@tangle-network/browser-agent-driver 0.30.0 → 0.32.0

package/dist/design/audit/ethics/check.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Ethics check — Layer 7.
+ *
+ * Given a page state + classification, evaluate every loaded `EthicsRule` whose
+ * `appliesWhen` matches the classification. Each rule produces zero-or-one
+ * `EthicsViolation`. Violations enforce a hard floor on the rollup score:
+ * `critical-floor → 4`, `major-floor → 6`.
+ *
+ * Detector kinds:
+ *   pattern-absent   → regex must appear in page text; violation if absent
+ *   pattern-present  → regex must NOT appear in page text; violation if present
+ *   llm-classifier   → ask the LLM the question; violation when answer is yes
+ *
+ * Pattern matches are case-insensitive. The LLM classifier asks for a
+ * single-token yes/no answer to keep latency + cost predictable.
+ */
+import type { Brain } from '../../../brain/index.js';
+import type { AppliesWhen, EthicsRule, EthicsViolation, PageClassification, AudienceTag, ModalityTag, RegulatoryContextTag, AudienceVulnerabilityTag } from '../score-types.js';
+export interface EthicsCheckContext {
+    /** Lowercased page text used by `pattern-absent` / `pattern-present`. */
+    pageText: string;
+    /** Page snapshot — passed verbatim to the LLM classifier prompt. */
+    snapshot: string;
+    /** The page-type / domain / maturity / designSystem classification. */
+    classification: PageClassification;
+    /** Operator-supplied audience / modality / regulatory hints (Layer 6). */
+    audience?: AudienceTag[];
+    modality?: ModalityTag[];
+    regulatoryContext?: RegulatoryContextTag[];
+    audienceVulnerability?: AudienceVulnerabilityTag[];
+}
+export interface EthicsCheckOptions {
+    /** When set, llm-classifier rules are evaluated; else skipped (deterministic-only). */
+    brain?: Brain;
+    /** Optional screenshot URL/path passed alongside snapshot context (unused today). */
+    screenshotPath?: string;
+    /** Logger override — defaults to console.warn for skipped rules. */
+    warn?: (msg: string) => void;
+}
+/**
+ * Run every applicable rule against the page. Returns one violation per rule
+ * that fires. Rules whose detector is `llm-classifier` are skipped (with a
+ * warning) when no `brain` is supplied — the alternative is silent passes,
+ * which would hide ethics gaps in offline tests.
+ */
+export declare function checkEthics(rules: EthicsRule[], ctx: EthicsCheckContext, opts?: EthicsCheckOptions): Promise<EthicsViolation[]>;
+/**
+ * Predicate evaluator — extends the rubric loader's logic with the layered fields
+ * (audience / modality / regulatoryContext / audienceVulnerability). All
+ * declared predicates are AND-combined.
+ */
+export declare function appliesWhenMatches(w: AppliesWhen, ctx: EthicsCheckContext): boolean;
+export declare function runLlmClassifier(brain: Brain, question: string, snapshot: string): Promise<boolean>;
+/** Build the lowercased text blob used by pattern detectors. URL is intentionally excluded — URL path tokens (e.g. "no-dosage") would cause false negatives on pattern-absent rules. */
+export declare function pageTextBlob(snapshot: string, extra?: {
+    url?: string;
+    title?: string;
+}): string;
+//# sourceMappingURL=check.d.ts.map

package/dist/design/audit/ethics/check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../../../src/design/audit/ethics/check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,KAAK,EACV,WAAW,EACX,UAAU,EACV,eAAe,EACf,kBAAkB,EAClB,WAAW,EACX,WAAW,EACX,oBAAoB,EACpB,wBAAwB,EACzB,MAAM,mBAAmB,CAAA;AAG1B,MAAM,WAAW,kBAAkB;IACjC,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAA;IAChB,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAA;IAChB,uEAAuE;IACvE,cAAc,EAAE,kBAAkB,CAAA;IAClC,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAA;IACxB,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAA;IACxB,iBAAiB,CAAC,EAAE,oBAAoB,EAAE,CAAA;IAC1C,qBAAqB,CAAC,EAAE,wBAAwB,EAAE,CAAA;CACnD;AAED,MAAM,WAAW,kBAAkB;IACjC,uFAAuF;IACvF,KAAK,CAAC,EAAE,KAAK,CAAA;IACb,qFAAqF;IACrF,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,oEAAoE;IACpE,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAC7B;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,KAAK,EAAE,UAAU,EAAE,EACnB,GAAG,EAAE,kBAAkB,EACvB,IAAI,GAAE,kBAAuB,GAC5B,OAAO,CAAC,eAAe,EAAE,CAAC,CAS5B;AAaD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAqCnF;AAuCD,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,KAAK,EACZ,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC,CAMlB;AAED,wLAAwL;AACxL,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAG/F"}

package/dist/design/audit/ethics/check.js

@@ -0,0 +1,137 @@
+/**
+ * Ethics check — Layer 7.
+ *
+ * Given a page state + classification, evaluate every loaded `EthicsRule` whose
+ * `appliesWhen` matches the classification. Each rule produces zero-or-one
+ * `EthicsViolation`. Violations enforce a hard floor on the rollup score:
+ * `critical-floor → 4`, `major-floor → 6`.
+ *
+ * Detector kinds:
+ *   pattern-absent   → regex must appear in page text; violation if absent
+ *   pattern-present  → regex must NOT appear in page text; violation if present
+ *   llm-classifier   → ask the LLM the question; violation when answer is yes
+ *
+ * Pattern matches are case-insensitive. The LLM classifier asks for a
+ * single-token yes/no answer to keep latency + cost predictable.
+ */
+import { rollupCapFor } from './loader.js';
+/**
+ * Run every applicable rule against the page. Returns one violation per rule
+ * that fires. Rules whose detector is `llm-classifier` are skipped (with a
+ * warning) when no `brain` is supplied — the alternative is silent passes,
+ * which would hide ethics gaps in offline tests.
+ */
+export async function checkEthics(rules, ctx, opts = {}) {
+    const warn = opts.warn ?? ((m) => console.warn(m));
+    const violations = [];
+    for (const rule of rules) {
+        if (!appliesWhenMatches(rule.appliesWhen, ctx))
+            continue;
+        const fired = await runDetector(rule, ctx, opts.brain, warn);
+        if (fired)
+            violations.push(toViolation(rule));
+    }
+    return violations;
+}
+function toViolation(rule) {
+    return {
+        ruleId: rule.ruleId,
+        detected: true,
+        severity: rule.severity,
+        rollupCap: rollupCapFor(rule.severity),
+        remediation: rule.remediation,
+        ...(rule.citation ? { citation: rule.citation } : {}),
+    };
+}
+/**
+ * Predicate evaluator — extends the rubric loader's logic with the layered fields
+ * (audience / modality / regulatoryContext / audienceVulnerability). All
+ * declared predicates are AND-combined.
+ */
+export function appliesWhenMatches(w, ctx) {
+    if (w.universal)
+        return true;
+    const cls = ctx.classification;
+    if (w.type?.length && !w.type.includes(cls.type))
+        return false;
+    if (w.maturity?.length && !w.maturity.includes(cls.maturity))
+        return false;
+    if (w.designSystem?.length && !w.designSystem.includes(cls.designSystem))
+        return false;
+    if (w.domain?.length) {
+        const domain = (cls.domain ?? '').toLowerCase();
+        const ok = w.domain.some(d => domain.includes(d.toLowerCase()));
+        if (!ok)
+            return false;
+    }
+    if (w.audience?.length) {
+        if (!w.audience.some(a => (ctx.audience ?? []).includes(a)))
+            return false;
+    }
+    if (w.modality?.length) {
+        if (!w.modality.some(m => (ctx.modality ?? []).includes(m)))
+            return false;
+    }
+    if (w.regulatoryContext?.length) {
+        if (!w.regulatoryContext.some(r => (ctx.regulatoryContext ?? []).includes(r)))
+            return false;
+    }
+    if (w.audienceVulnerability?.length) {
+        if (!w.audienceVulnerability.some(v => (ctx.audienceVulnerability ?? []).includes(v)))
+            return false;
+    }
+    // Same conservative behavior as the rubric loader: with no predicates and
+    // no `universal: true`, the rule does NOT apply (don't fire blindly).
+    const hasPredicate = !!w.type?.length ||
+        !!w.maturity?.length ||
+        !!w.designSystem?.length ||
+        !!w.domain?.length ||
+        !!w.audience?.length ||
+        !!w.modality?.length ||
+        !!w.regulatoryContext?.length ||
+        !!w.audienceVulnerability?.length;
+    return hasPredicate;
+}
+async function runDetector(rule, ctx, brain, warn) {
+    const d = rule.detector;
+    if (d.kind === 'pattern-absent') {
+        const re = compilePattern(d.pattern);
+        return !re.test(ctx.pageText);
+    }
+    if (d.kind === 'pattern-present') {
+        const re = compilePattern(d.pattern);
+        return re.test(ctx.pageText);
+    }
+    if (d.kind === 'llm-classifier') {
+        if (!brain) {
+            warn(`ethics: skipping llm-classifier rule ${rule.ruleId} — no brain provided`);
+            return false;
+        }
+        return await runLlmClassifier(brain, d.llmCheck, ctx.snapshot);
+    }
+    return false;
+}
+function compilePattern(pattern) {
+    // Allow already-anchored regexes; default is case-insensitive substring.
+    try {
+        return new RegExp(pattern, 'i');
+    }
+    catch {
+        // Fallback: treat as a literal token if regex compile fails.
+        return new RegExp(pattern.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'), 'i');
+    }
+}
+const LLM_SYSTEM = `You are an ethics auditor. Answer the user's yes/no question about the page snapshot. Respond with exactly one token — yes or no — followed by an optional one-sentence rationale. Do not hedge. If the evidence is missing, answer no.`;
+export async function runLlmClassifier(brain, question, snapshot) {
+    const truncated = snapshot.length > 8000 ? `${snapshot.slice(0, 8000)}\n…[truncated]` : snapshot;
+    const user = `QUESTION: ${question}\n\nPAGE SNAPSHOT:\n${truncated}\n\nAnswer yes or no.`;
+    const { text } = await brain.complete(LLM_SYSTEM, user, { maxOutputTokens: 80 });
+    const first = text.trim().toLowerCase().match(/^[a-z]+/)?.[0] ?? '';
+    return first === 'yes';
+}
+/** Build the lowercased text blob used by pattern detectors. URL is intentionally excluded — URL path tokens (e.g. "no-dosage") would cause false negatives on pattern-absent rules. */
+export function pageTextBlob(snapshot, extra) {
+    const parts = [snapshot, extra?.title ?? ''];
+    return parts.join('\n').toLowerCase();
+}
+//# sourceMappingURL=check.js.map

package/dist/design/audit/ethics/check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.js","sourceRoot":"","sources":["../../../../src/design/audit/ethics/check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAaH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAyB1C;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,KAAmB,EACnB,GAAuB,EACvB,OAA2B,EAAE;IAE7B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1D,MAAM,UAAU,GAAsB,EAAE,CAAA;IACxC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC;YAAE,SAAQ;QACxD,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QAC5D,IAAI,KAAK;YAAE,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAA;IAC/C,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,SAAS,WAAW,CAAC,IAAgB;IACnC,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;QACtC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtD,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,CAAc,EAAE,GAAuB;IACxE,IAAI,CAAC,CAAC,SAAS;QAAE,OAAO,IAAI,CAAA;IAC5B,MAAM,GAAG,GAAG,GAAG,CAAC,cAAc,CAAA;IAE9B,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IAC9D,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAA;IAC1E,IAAI,CAAC,CAAC,YAAY,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAA;IACtF,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;QAC/C,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;QAC/D,IAAI,CAAC,EAAE;YAAE,OAAO,KAAK,CAAA;IACvB,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;IAC3E,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;IAC3E,CAAC;IACD,IAAI,CAAC,CAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;IAC7F,CAAC;IACD,IAAI,CAAC,CAAC,qBAAqB,EAAE,MAAM,EAAE,CAAC;QACpC,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;IACrG,CAAC;IAED,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,YAAY,GAChB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM;QAChB,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM;QACpB,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,MAAM;QACxB,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM;QAClB,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM;QACpB,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM;QACpB,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,MAAM;QAC7B,CAAC,CAAC,CAAC,CAAC,qBAAqB,EAAE,MAAM,CAAA;IACnC,OAAO,YAAY,CAAA;AACrB,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,IAAgB,EAChB,GAAuB,EACvB,KAAwB,EACxB,IAAyB;IAEzB,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAA;IACvB,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAChC,MAAM,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;QACpC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC/B,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACjC,MAAM,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;QACpC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC9B,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,wCAAwC,IAAI,CAAC,MAAM,sBAAsB,CAAC,CAAA;YAC/E,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,MAAM,gBAAgB,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;IAChE,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,cAAc,CAAC,OAAe;IACrC,yEAAyE;IACzE,IAAI,CAAC;QACH,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;QAC7D,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAA;IACxE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,GAAG,yOAAyO,CAAA;AAE5P,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAY,EACZ,QAAgB,EAChB,QAAgB;IAEhB,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAA;IAChG,MAAM,IAAI,GAAG,aAAa,QAAQ,uBAAuB,SAAS,uBAAuB,CAAA;IACzF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC,CAAA;IAChF,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACnE,OAAO,KAAK,KAAK,KAAK,CAAA;AACxB,CAAC;AAED,wLAAwL;AACxL,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,KAAwC;IACrF,MAAM,KAAK,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAA;IAC5C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAA;AACvC,CAAC"}

package/dist/design/audit/ethics/loader.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Ethics rule loader — Layer 7.
+ *
+ * Loads `EthicsRule[]` from `rules/*.yaml`. Idempotent + cached: the in-memory
+ * cache keys on directory path so repeated calls (per-page audits) never re-IO.
+ *
+ * Each YAML file is a list of rule objects. The minimal parser supports the
+ * shape used in the RFC: `- key: value` items with nested objects and inline
+ * `[a, b]` lists. No external yaml dep — same approach as rubric/loader.ts.
+ */
+import type { EthicsRule, EthicsSeverity } from '../score-types.js';
+/** Severity → rollup ceiling. critical-floor caps at 4; major-floor caps at 6. */
+export declare function rollupCapFor(severity: EthicsSeverity): number;
+/**
+ * Load every `*.yaml` rule file in `dir`. Cached by absolute path.
+ * Returns a stable order (sorted by filename + position within file).
+ */
+export declare function loadEthicsRules(dir?: string): EthicsRule[];
+/** Reset cache — test-only. */
+export declare function clearEthicsRuleCache(): void;
+//# sourceMappingURL=loader.d.ts.map

package/dist/design/audit/ethics/loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../../../src/design/audit/ethics/loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,KAAK,EACV,UAAU,EAEV,cAAc,EAGf,MAAM,mBAAmB,CAAA;AAO1B,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,CAE7D;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAA0B,GAAG,UAAU,EAAE,CAkB7E;AAED,+BAA+B;AAC/B,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C"}

package/dist/design/audit/ethics/loader.js

@@ -0,0 +1,207 @@
+/**
+ * Ethics rule loader — Layer 7.
+ *
+ * Loads `EthicsRule[]` from `rules/*.yaml`. Idempotent + cached: the in-memory
+ * cache keys on directory path so repeated calls (per-page audits) never re-IO.
+ *
+ * Each YAML file is a list of rule objects. The minimal parser supports the
+ * shape used in the RFC: `- key: value` items with nested objects and inline
+ * `[a, b]` lists. No external yaml dep — same approach as rubric/loader.ts.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath } from 'node:url';
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const BUILTIN_RULES_DIR = path.join(__dirname, 'rules');
+const cache = new Map();
+/** Severity → rollup ceiling. critical-floor caps at 4; major-floor caps at 6. */
+export function rollupCapFor(severity) {
+    return severity === 'critical-floor' ? 4 : 6;
+}
+/**
+ * Load every `*.yaml` rule file in `dir`. Cached by absolute path.
+ * Returns a stable order (sorted by filename + position within file).
+ */
+export function loadEthicsRules(dir = BUILTIN_RULES_DIR) {
+    const abs = path.resolve(dir);
+    const cached = cache.get(abs);
+    if (cached)
+        return cached;
+    if (!fs.existsSync(abs)) {
+        cache.set(abs, []);
+        return [];
+    }
+    const rules = [];
+    const files = fs.readdirSync(abs).filter(f => f.endsWith('.yaml')).sort();
+    for (const f of files) {
+        const file = path.join(abs, f);
+        const raw = fs.readFileSync(file, 'utf-8');
+        const parsed = parseRuleList(raw, file);
+        for (const r of parsed)
+            rules.push(r);
+    }
+    cache.set(abs, rules);
+    return rules;
+}
+/** Reset cache — test-only. */
+export function clearEthicsRuleCache() {
+    cache.clear();
+}
+function parseRuleList(text, sourceFile) {
+    const items = splitTopLevelItems(text);
+    return items.map((block, idx) => parseRule(block, `${sourceFile}#${idx}`));
+}
+/** Split a YAML doc into top-level `- item` blocks (one block per rule). */
+function splitTopLevelItems(text) {
+    const lines = text.split('\n');
+    const items = [];
+    let current = null;
+    for (const line of lines) {
+        if (/^\s*#/.test(line) || line.trim() === '') {
+            if (current)
+                current.push(line);
+            continue;
+        }
+        if (line.startsWith('- ')) {
+            if (current)
+                items.push(current.join('\n'));
+            current = [line.slice(2)];
+        }
+        else if (current) {
+            // Indented continuation. Strip 2 leading spaces if present so nesting
+            // levels become consistent within the item.
+            current.push(line.startsWith('  ') ? line.slice(2) : line);
+        }
+    }
+    if (current)
+        items.push(current.join('\n'));
+    return items;
+}
+function parseRule(block, ref) {
+    const meta = parseYamlBlock(block);
+    const ruleId = stringField(meta, 'ruleId', ref);
+    const category = stringField(meta, 'category', ref);
+    const severity = stringField(meta, 'severity', ref);
+    if (severity !== 'critical-floor' && severity !== 'major-floor') {
+        throw new Error(`ethics rule ${ruleId} (${ref}): invalid severity ${severity}`);
+    }
+    const remediation = stringField(meta, 'remediation', ref);
+    const appliesWhen = meta.appliesWhen ?? {};
+    const detectorRaw = meta.detector ?? {};
+    const detector = parseDetector(detectorRaw, ruleId);
+    const citation = meta.citation != null ? String(meta.citation) : undefined;
+    return {
+        ruleId,
+        category,
+        severity,
+        appliesWhen,
+        detector,
+        remediation,
+        ...(citation ? { citation } : {}),
+    };
+}
+function parseDetector(d, ruleId) {
+    const kind = String(d.kind ?? '');
+    if (kind === 'pattern-absent' || kind === 'pattern-present') {
+        const pattern = String(d.pattern ?? '');
+        if (!pattern)
+            throw new Error(`ethics rule ${ruleId}: detector.pattern required for ${kind}`);
+        return { kind, pattern };
+    }
+    if (kind === 'llm-classifier') {
+        const llmCheck = String(d.llmCheck ?? '');
+        if (!llmCheck)
+            throw new Error(`ethics rule ${ruleId}: detector.llmCheck required for llm-classifier`);
+        return { kind, llmCheck };
+    }
+    throw new Error(`ethics rule ${ruleId}: unknown detector.kind ${kind}`);
+}
+function stringField(meta, key, ref) {
+    const v = meta[key];
+    if (v == null || String(v) === '') {
+        throw new Error(`ethics rule (${ref}): missing required field ${key}`);
+    }
+    return String(v);
+}
+/**
+ * YAML block parser supporting:
+ *   key: scalar
+ *   key: [a, b]
+ *   key: |  → folded multi-line block (preserves newlines)
+ *   key: > or just continuation lines indented under the key
+ *   key:
+ *     subkey: value
+ *     listKey: [a, b]
+ */
+function parseYamlBlock(text) {
+    const lines = text.split('\n');
+    const result = {};
+    let i = 0;
+    while (i < lines.length) {
+        const line = lines[i];
+        if (!line.trim() || line.trim().startsWith('#')) {
+            i++;
+            continue;
+        }
+        const m = line.match(/^([a-zA-Z][\w-]*):\s*(.*)$/);
+        if (!m) {
+            i++;
+            continue;
+        }
+        const [, key, valueRaw] = m;
+        const value = valueRaw.trim();
+        if (value === '|' || value === '>') {
+            // Folded block: collect indented continuation lines.
+            const collected = [];
+            i++;
+            while (i < lines.length && (lines[i].startsWith('  ') || lines[i].trim() === '')) {
+                collected.push(lines[i].replace(/^ {2}/, ''));
+                i++;
+            }
+            result[key] = collected.join(value === '|' ? '\n' : ' ').trim();
+        }
+        else if (value === '') {
+            // Nested object — collect indented lines.
+            const nested = {};
+            i++;
+            while (i < lines.length && (lines[i].startsWith('  ') || lines[i].trim() === '')) {
+                if (!lines[i].trim()) {
+                    i++;
+                    continue;
+                }
+                const nm = lines[i].match(/^\s+([a-zA-Z][\w-]*):\s*(.*)$/);
+                if (nm) {
+                    nested[nm[1]] = parseScalarOrList(nm[2].trim());
+                }
+                i++;
+            }
+            result[key] = nested;
+        }
+        else {
+            result[key] = parseScalarOrList(value);
+            i++;
+        }
+    }
+    return result;
+}
+function parseScalarOrList(value) {
+    if (value.startsWith('[') && value.endsWith(']')) {
+        return value
+            .slice(1, -1)
+            .split(',')
+            .map(s => s.trim().replace(/^['"]|['"]$/g, ''))
+            .filter(Boolean);
+    }
+    // Strip surrounding quotes for plain scalars.
+    if ((value.startsWith("'") && value.endsWith("'")) || (value.startsWith('"') && value.endsWith('"'))) {
+        return value.slice(1, -1);
+    }
+    if (value === 'true')
+        return true;
+    if (value === 'false')
+        return false;
+    if (/^-?\d+(\.\d+)?$/.test(value))
+        return Number(value);
+    return value;
+}
+//# sourceMappingURL=loader.js.map

package/dist/design/audit/ethics/loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../../../src/design/audit/ethics/loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AASxC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;AAC9D,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;AAEvD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAwB,CAAA;AAE7C,kFAAkF;AAClF,MAAM,UAAU,YAAY,CAAC,QAAwB;IACnD,OAAO,QAAQ,KAAK,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc,iBAAiB;IAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC7B,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC7B,IAAI,MAAM;QAAE,OAAO,MAAM,CAAA;IACzB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;QAClB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,KAAK,GAAiB,EAAE,CAAA;IAC9B,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACzE,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;QAC9B,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QAC1C,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QACvC,KAAK,MAAM,CAAC,IAAI,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACvC,CAAC;IACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IACrB,OAAO,KAAK,CAAA;AACd,CAAC;AAED,+BAA+B;AAC/B,MAAM,UAAU,oBAAoB;IAClC,KAAK,CAAC,KAAK,EAAE,CAAA;AACf,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,UAAkB;IACrD,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAA;IACtC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,UAAU,IAAI,GAAG,EAAE,CAAC,CAAC,CAAA;AAC5E,CAAC;AAED,4EAA4E;AAC5E,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC9B,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,OAAO,GAAoB,IAAI,CAAA;IACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC7C,IAAI,OAAO;gBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC/B,SAAQ;QACV,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,IAAI,OAAO;gBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;YAC3C,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3B,CAAC;aAAM,IAAI,OAAO,EAAE,CAAC;YACnB,sEAAsE;YACtE,4CAA4C;YAC5C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAC5D,CAAC;IACH,CAAC;IACD,IAAI,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IAC3C,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,GAAW;IAC3C,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;IAClC,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAA;IAC/C,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,CAAmB,CAAA;IACrE,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,CAAmB,CAAA;IACrE,IAAI,QAAQ,KAAK,gBAAgB,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,eAAe,MAAM,KAAK,GAAG,uBAAuB,QAAQ,EAAE,CAAC,CAAA;IACjF,CAAC;IACD,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,CAAC,CAAA;IACzD,MAAM,WAAW,GAAI,IAAI,CAAC,WAA2B,IAAI,EAAE,CAAA;IAC3D,MAAM,WAAW,GAAI,IAAI,CAAC,QAAoC,IAAI,EAAE,CAAA;IACpE,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;IACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC1E,OAAO;QACL,MAAM;QACN,QAAQ;QACR,QAAQ;QACR,WAAW;QACX,QAAQ;QACR,WAAW;QACX,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClC,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CAAC,CAA0B,EAAE,MAAc;IAC/D,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;IACjC,IAAI,IAAI,KAAK,gBAAgB,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAA;QACvC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,MAAM,mCAAmC,IAAI,EAAE,CAAC,CAAA;QAC7F,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IAC1B,CAAC;IACD,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAA;QACzC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,MAAM,iDAAiD,CAAC,CAAA;QACtG,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;IAC3B,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,eAAe,MAAM,2BAA2B,IAAI,EAAE,CAAC,CAAA;AACzE,CAAC;AAED,SAAS,WAAW,CAAC,IAA6B,EAAE,GAAW,EAAE,GAAW;IAC1E,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAA;IACnB,IAAI,CAAC,IAAI,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,6BAA6B,GAAG,EAAE,CAAC,CAAA;IACxE,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAA;AAClB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC9B,MAAM,MAAM,GAA4B,EAAE,CAAA;IAC1C,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACrB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,CAAC,EAAE,CAAA;YACH,SAAQ;QACV,CAAC;QACD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAA;QAClD,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,CAAC,EAAE,CAAA;YACH,SAAQ;QACV,CAAC;QACD,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAA;QAC3B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAA;QAC7B,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACnC,qDAAqD;YACrD,MAAM,SAAS,GAAa,EAAE,CAAA;YAC9B,CAAC,EAAE,CAAA;YACH,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;gBACjF,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAA;gBAC7C,CAAC,EAAE,CAAA;YACL,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;QACjE,CAAC;aAAM,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxB,0CAA0C;YAC1C,MAAM,MAAM,GAA4B,EAAE,CAAA;YAC1C,CAAC,EAAE,CAAA;YACH,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;gBACjF,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;oBACrB,CAAC,EAAE,CAAA;oBACH,SAAQ;gBACV,CAAC;gBACD,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAA;gBAC1D,IAAI,EAAE,EAAE,CAAC;oBACP,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;gBACjD,CAAC;gBACD,CAAC,EAAE,CAAA;YACL,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAA;QACtB,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAA;YACtC,CAAC,EAAE,CAAA;QACL,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO,KAAK;aACT,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;aACZ,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;aAC9C,MAAM,CAAC,OAAO,CAAC,CAAA;IACpB,CAAC;IACD,8CAA8C;IAC9C,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACrG,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC3B,CAAC;IACD,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,IAAI,CAAA;IACjC,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,KAAK,CAAA;IACnC,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;IACvD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/design/audit/ethics/rules/finance.yaml

@@ -0,0 +1,37 @@
+# Financial product ethics rules.
+# Anchored to CFPB Reg E / Reg Z, EU PSD2, and SEC Rule 10b-10 disclosures.
+
+- ruleId: finance:fees-disclosed-pre-commitment
+  category: finance
+  severity: critical-floor
+  appliesWhen:
+    type: [ecommerce]
+    domain: [fintech, finance, banking, payments]
+  detector:
+    kind: llm-classifier
+    llmCheck: Does this checkout page hide, defer, or fail to itemize any fees, taxes, FX, or charges that the user will pay, with the pay/commit button reachable before the totals are fully visible?
+  remediation: Surface every line item (fees, taxes, FX) above the pay button.
+  citation: CFPB 12 CFR 1026 Reg Z / FTC Junk Fees Rule
+
+- ruleId: finance:apr-or-effective-rate-shown
+  category: finance
+  severity: major-floor
+  appliesWhen:
+    domain: [fintech, finance, banking, payments, lending]
+  detector:
+    kind: pattern-absent
+    pattern: (APR|annual percentage rate|effective (interest )?rate|finance charge)
+  remediation: Display APR or effective interest rate alongside any credit, lending, or yield-bearing offer.
+  citation: TILA 15 USC 1638 / CFPB 12 CFR 1026.18
+
+- ruleId: finance:risk-disclosure-required
+  category: finance
+  severity: major-floor
+  appliesWhen:
+    domain: [fintech, finance, crypto, investing, trading]
+    audienceVulnerability: [high-stakes-financial]
+  detector:
+    kind: llm-classifier
+    llmCheck: Does this trading / investing / staking page allow the user to commit funds WITHOUT a clearly visible disclosure of principal-loss, volatility, or non-FDIC-insurance risk above the action button?
+  remediation: Show risk-of-loss and insurance-status disclosures above the action button on any investing, trading, or staking surface.
+  citation: SEC Rule 10b-10 / FINRA Rule 2210

package/dist/design/audit/ethics/rules/kids.yaml

@@ -0,0 +1,37 @@
+# Kids-targeted product ethics rules.
+# Anchored to COPPA + UK ICO Age Appropriate Design Code (AADC).
+
+- ruleId: kids:dark-patterns-prohibited
+  category: kids
+  severity: critical-floor
+  appliesWhen:
+    audience: [kids]
+  detector:
+    kind: llm-classifier
+    llmCheck: Does this page use any dark pattern (hidden costs, forced action, fake urgency, confirmshaming, manipulated visual hierarchy) targeting a minor user?
+  remediation: Remove all dark patterns. Use clear, age-appropriate, friction-symmetric flows.
+  citation: COPPA 16 CFR 312.5 / FTC Dark Patterns Report 2022
+
+- ruleId: kids:age-gate-required
+  category: kids
+  severity: critical-floor
+  appliesWhen:
+    audience: [kids]
+    audienceVulnerability: [minor-facing]
+  detector:
+    kind: pattern-absent
+    pattern: (age|date of birth|verify your age)
+  remediation: Implement an age gate before collecting any data or showing user-generated content.
+  citation: COPPA 16 CFR 312.5
+
+- ruleId: kids:data-minimization-default
+  category: kids
+  severity: major-floor
+  appliesWhen:
+    audience: [kids]
+    regulatoryContext: [coppa]
+  detector:
+    kind: llm-classifier
+    llmCheck: Does this page request data fields from a child that are NOT strictly necessary for the activity (e.g. unmarked optional fields, profile / social / friend-graph fields, location or contact data not required for the task)?
+  remediation: Default to data minimization for child users — collect only what is strictly necessary, mark every optional field, and disable profile/social fields by default.
+  citation: ICO AADC Standard 8 / COPPA 16 CFR 312.7

package/dist/design/audit/ethics/rules/legal.yaml

@@ -0,0 +1,35 @@
+# Legal / regulatory consent rules.
+# Anchored to GDPR, ePrivacy Directive, and CCPA/CPRA notice-at-collection.
+
+- ruleId: legal:gdpr-cookie-consent
+  category: legal
+  severity: major-floor
+  appliesWhen:
+    regulatoryContext: [gdpr]
+  detector:
+    kind: pattern-absent
+    pattern: (cookie|consent|necessary|preferences)
+  remediation: Display GDPR-compliant cookie consent banner with granular controls.
+  citation: GDPR Art. 7 / ePrivacy Directive 2002/58/EC Art. 5(3)
+
+- ruleId: legal:privacy-policy-link-required
+  category: legal
+  severity: major-floor
+  appliesWhen:
+    regulatoryContext: [gdpr]
+  detector:
+    kind: pattern-absent
+    pattern: (privacy policy|privacy notice|data protection)
+  remediation: Provide a clearly labeled privacy policy / notice link on every page that processes personal data.
+  citation: GDPR Art. 13-14
+
+- ruleId: legal:ccpa-do-not-sell-link
+  category: legal
+  severity: major-floor
+  appliesWhen:
+    regulatoryContext: [gdpr]
+  detector:
+    kind: pattern-absent
+    pattern: (do not sell|do not share|opt.?out|your privacy choices)
+  remediation: Provide a "Do Not Sell or Share My Personal Information" / "Your Privacy Choices" link in the global footer.
+  citation: CCPA Cal. Civ. Code 1798.135 / CPRA 1798.121

package/dist/design/audit/ethics/rules/medical.yaml

@@ -0,0 +1,36 @@
+# Medical / clinical / pharmacy ethics rules.
+# Anchored to FDA labeling regs, ICH E2 pharmacovigilance, and ONC info-blocking.
+
+- ruleId: medical:dosage-warning-required
+  category: medical
+  severity: critical-floor
+  appliesWhen:
+    domain: [medical, clinical, pharmacy, health]
+  detector:
+    kind: pattern-absent
+    pattern: (dosage|warning|contraindication|adverse|side effect)
+  remediation: Display dosage warnings, contraindications, and adverse-effect summaries before any prescription action.
+  citation: FDA 21 CFR 201.57
+
+- ruleId: medical:adverse-event-reporting-path
+  category: medical
+  severity: major-floor
+  appliesWhen:
+    domain: [medical, clinical, pharmacy, health]
+  detector:
+    kind: pattern-absent
+    pattern: (report.{0,20}(side effect|adverse|reaction)|MedWatch|FDA 1088|pharmacovigilance)
+  remediation: Provide a visible adverse-event reporting path (MedWatch link or equivalent) on any prescribing or dispensing surface.
+  citation: FDA 21 CFR 314.80 / ICH E2D
+
+- ruleId: medical:patient-education-disclosure
+  category: medical
+  severity: major-floor
+  appliesWhen:
+    domain: [medical, clinical, pharmacy, health]
+    audienceVulnerability: [patient-facing]
+  detector:
+    kind: llm-classifier
+    llmCheck: Does this patient-facing page request a clinical action or health-data submission WITHOUT first presenting plain-language patient education (indications, risks, instructions for use)?
+  remediation: Surface plain-language patient education (indications, risks, instructions) ahead of any clinical action a patient can take.
+  citation: ONC 45 CFR 170.315(g)(9) Patient Education

package/dist/design/audit/evaluate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../../src/design/audit/evaluate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAC9D,OAAO,KAAK,EACV,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,eAAe,EAChB,MAAM,YAAY,CAAA;AAInB,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,SAAS,CAAA;IAChB,cAAc,EAAE,kBAAkB,CAAA;IAClC,MAAM,EAAE,cAAc,CAAA;IACtB,YAAY,EAAE,iBAAiB,CAAA;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,WAAW,CAAC,EAAE,WAAW,EAAE,CAAA;IAC3B;;;;OAIG;IACH,SAAS,CAAC,EAAE,cAAc,CAAA;CAC3B;AAED,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,CAAA;AAE9F,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,WAAW,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,MAAM,CAAA;IACpB;;;;;OAKG;IACH,YAAY,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,eAAe,EAAE,YAAY,GAAG,QAAQ,GAAG,SAAS,GAAG,YAAY,GAAG,IAAI,CAAA;CAC3E;AAED,MAAM,WAAW,cAAc;IAC7B,oFAAoF;IACpF,eAAe,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAA;IACzD,wDAAwD;IACxD,cAAc,CAAC,EAAE,CAAC,cAAc,EAAE,kBAAkB,KAAK,MAAM,CAAA;IAC/D;+EAC2E;IAC3E,eAAe,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAA;IACtD,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;IACpB,+DAA+D;IAC/D,mBAAmB,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACnD,sFAAsF;IACtF,oBAAoB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,GAAG,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;CAC9F;AAED,eAAO,MAAM,mBAAmB,EAAE,MAAM,EAOvC,CAAA;AAED,eAAO,MAAM,4BAA4B;;;CAA4B,CAAA;AAErE,eAAO,MAAM,2BAA2B,EAAE,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,GAAG,SAAS,EAAE,WAAW,EAAE,CAYrG,CAAA;AAED,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,CA6D3D,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAyEjE,CAAA;AAED,wBAAgB,kBAAkB,CAChC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,WAAW,EAAE,EACvC,OAAO,CAAC,EAAE;IAAE,cAAc,CAAC,EAAE,kBAAkB,CAAC;IAAC,SAAS,CAAC,EAAE,cAAc,CAAA;CAAE,GAC5E,WAAW,EAAE,CAaf;AA8CD,wBAAgB,cAAc,CAAC,cAAc,EAAE,kBAAkB,GAAG,MAAM,CAwBzE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,GAAG,MAAM,CAqH7E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,iBAAiB,GAAG,aAAa,EAAE,CAuGvF;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,eAAe,CAAC,CAmG1B;AA8ID,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EAAE,EAChB,OAAO,GAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAiC,GACpE,MAAM,CASR"}
+{"version":3,"file":"evaluate.d.ts","sourceRoot":"","sources":["../../../src/design/audit/evaluate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAC9D,OAAO,KAAK,EACV,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,eAAe,EAChB,MAAM,YAAY,CAAA;AAInB,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,SAAS,CAAA;IAChB,cAAc,EAAE,kBAAkB,CAAA;IAClC,MAAM,EAAE,cAAc,CAAA;IACtB,YAAY,EAAE,iBAAiB,CAAA;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,WAAW,CAAC,EAAE,WAAW,EAAE,CAAA;IAC3B;;;;OAIG;IACH,SAAS,CAAC,EAAE,cAAc,CAAA;CAC3B;AAED,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,CAAA;AAE9F,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,WAAW,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,MAAM,CAAA;IACpB;;;;;OAKG;IACH,YAAY,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,eAAe,EAAE,YAAY,GAAG,QAAQ,GAAG,SAAS,GAAG,YAAY,GAAG,IAAI,CAAA;CAC3E;AAED,MAAM,WAAW,cAAc;IAC7B,oFAAoF;IACpF,eAAe,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAA;IACzD,wDAAwD;IACxD,cAAc,CAAC,EAAE,CAAC,cAAc,EAAE,kBAAkB,KAAK,MAAM,CAAA;IAC/D;+EAC2E;IAC3E,eAAe,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAA;IACtD,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;IACpB,+DAA+D;IAC/D,mBAAmB,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACnD,sFAAsF;IACtF,oBAAoB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,GAAG,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;CAC9F;AAED,eAAO,MAAM,mBAAmB,EAAE,MAAM,EAOvC,CAAA;AAED,eAAO,MAAM,4BAA4B;;;CAA4B,CAAA;AAErE,eAAO,MAAM,2BAA2B,EAAE,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,GAAG,SAAS,EAAE,WAAW,EAAE,CAYrG,CAAA;AAED,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,CA6D3D,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAyEjE,CAAA;AAED,wBAAgB,kBAAkB,CAChC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,WAAW,EAAE,EACvC,OAAO,CAAC,EAAE;IAAE,cAAc,CAAC,EAAE,kBAAkB,CAAC;IAAC,SAAS,CAAC,EAAE,cAAc,CAAA;CAAE,GAC5E,WAAW,EAAE,CAgBf;AA8CD,wBAAgB,cAAc,CAAC,cAAc,EAAE,kBAAkB,GAAG,MAAM,CAwBzE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,GAAG,MAAM,CAqH7E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,iBAAiB,GAAG,aAAa,EAAE,CAuGvF;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,eAAe,CAAC,CAmG1B;AA8ID,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EAAE,EAChB,OAAO,GAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAiC,GACpE,MAAM,CASR"}

package/dist/design/audit/evaluate.js

@@ -175,7 +175,10 @@ export function resolveAuditPasses(value, options) {
     const raw = value?.trim().toLowerCase();
     if (!raw || raw === 'standard' || raw === 'single' || raw === 'default')
         return ['standard'];
-    if (raw === 'deep' || raw === 'parallel' || raw === 'full') {
+    // Layer 1 — `auto` is the new default for the canonical path: classification-aware
+    // selection mirroring `deep`. The pipeline runs the ensemble classifier
+    // first, then this picks the focused pass bundle for that page type.
+    if (raw === 'auto' || raw === 'deep' || raw === 'parallel' || raw === 'full') {
         return deepPassesForClassification(options?.classification, options?.overrides);
     }
     if (raw === 'max' || raw === 'exhaustive')