@transitrix/diagrams 1.8.4 → 1.8.7

package/dist/compliance/__tests__/markdown.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/compliance/__tests__/markdown.test.js

@@ -1,85 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { readdirSync, readFileSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
-import path from 'node:path';
-import yaml from 'js-yaml';
-import { renderComplianceMarkdown } from '../markdown.js';
-import { emptyCanon, ingestComplianceDoc } from '../classify.js';
-function synthetic() {
-    const canon = emptyCanon();
-    ingestComplianceDoc(canon, { notation: 'product', id: 'PRODUCT-M-1', name: 'Mobile App' });
-    ingestComplianceDoc(canon, { notation: 'requirement', id: 'REQUIREMENT-ERASURE-1', name: 'Erasure', severity: 'high', derived_from: ['LAW-X-1'] });
-    ingestComplianceDoc(canon, { notation: 'requirement', id: 'REQUIREMENT-LOG-1', name: 'Logs', severity: 'low' });
-    ingestComplianceDoc(canon, { notation: 'assertion', id: 'ASSERTION-1', about: 'REQUIREMENT-ERASURE-1', subject: 'PRODUCT-M-1', status: 'compliant', evidence: [{ kind: 'note', text: 'x' }], next_review_at: '2026-09-01' });
-    ingestComplianceDoc(canon, { id: 'LAW-X-1', name: 'Privacy Law', zone: 'codex', type: 'LAW' });
-    return canon;
-}
-describe('renderComplianceMarkdown — matrix', () => {
-    it('renders a table with status cells and gap dashes', () => {
-        const md = renderComplianceMarkdown(synthetic(), { mode: 'matrix' });
-        expect(md).toContain('# Compliance Matrix');
-        expect(md).toContain('| Product \\ Requirement | Erasure | Logs |');
-        expect(md).toMatch(/\| Mobile App \| Compliant \| — \|/);
-    });
-});
-describe('renderComplianceMarkdown — law', () => {
-    it('renders the law name and its requirement with the assertion bullet', () => {
-        const md = renderComplianceMarkdown(synthetic(), { mode: 'law', id: 'LAW-X-1' });
-        expect(md).toContain('# Compliance — Privacy Law');
-        expect(md).toContain('## Erasure (`REQUIREMENT-ERASURE-1`) — severity: high');
-        expect(md).toContain('- **Compliant** — `ASSERTION-1`');
-    });
-});
-describe('renderComplianceMarkdown — product', () => {
-    it('renders the product table of asserted requirements', () => {
-        const md = renderComplianceMarkdown(synthetic(), { mode: 'product', id: 'PRODUCT-M-1' });
-        expect(md).toContain('# Compliance — Mobile App');
-        expect(md).toContain('| Requirement | Status | Assertion | Next review |');
-        expect(md).toMatch(/\| Erasure \(`REQUIREMENT-ERASURE-1`\) \| Compliant \| `ASSERTION-1` \| 2026-09-01 \|/);
-    });
-});
-describe('renderComplianceMarkdown — gap', () => {
-    it('lists the un-asserted requirement as a checklist item', () => {
-        const md = renderComplianceMarkdown(synthetic(), { mode: 'gap' }, { today: '2026-06-02' });
-        expect(md).toContain('## Requirements without assertions (1)');
-        expect(md).toContain('- [ ] `REQUIREMENT-LOG-1` Logs — severity: low');
-        expect(md).toContain('## Assertions without evidence — ASSERT-007 (0)');
-    });
-});
-// ── Conformance: build canon by ingesting the acme example files ────────────
-const examples = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../../../../../tests/fixtures/notation-corpus');
-function ingestDir(canon, dir) {
-    const full = path.join(examples, dir);
-    for (const f of readdirSync(full)) {
-        if (!f.endsWith('.yaml'))
-            continue;
-        ingestComplianceDoc(canon, yaml.load(readFileSync(path.join(full, f), 'utf-8')));
-    }
-}
-describe('renderComplianceMarkdown — acme conformance', () => {
-    const canon = emptyCanon();
-    ingestDir(canon, 'product');
-    ingestDir(canon, 'requirement');
-    ingestDir(canon, 'assertion');
-    it('matrix marks the dangling PRODUCT-MOBILE-1 row and shows compliant + gaps', () => {
-        const md = renderComplianceMarkdown(canon, { mode: 'matrix' });
-        expect(md).toContain('PRODUCT-MOBILE-1 ⚠');
-        expect(md).toContain('Compliant');
-        expect(md).toContain('—'); // at least one gap dash
-    });
-    it('gap report surfaces the un-asserted audit-log requirement', () => {
-        const md = renderComplianceMarkdown(canon, { mode: 'gap' }, { today: '2026-06-02' });
-        expect(md).toContain('`REQUIREMENT-AUDIT-LOG-RETENTION-1`');
-    });
-});
-describe('gapMarkdown CV-5 pastDeadlineRequirements section', () => {
-    it('includes the 4th section in output', () => {
-        const canon = emptyCanon();
-        ingestComplianceDoc(canon, { notation: 'requirement', id: 'REQ-PD-1', name: 'Past', deadline: '2020-01-01' });
-        const md = renderComplianceMarkdown(canon, { mode: 'gap' }, { today: '2026-06-09' });
-        expect(md).toContain('Past-deadline requirements');
-        expect(md).toContain('REQ-PD-1');
-        expect(md).toContain('2020-01-01');
-        expect(md).toContain('4 checks');
-    });
-});

package/dist/compliance/__tests__/trace.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/compliance/__tests__/trace.test.js

@@ -1,144 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { buildComplianceIndex } from '../reverse-index.js';
-import { buildRequirementTrace, buildTraceElementCatalog } from '../trace.js';
-// Requirement traceability + hierarchy view.
-//
-// The two halves the view exposes:
-//   1. Trace chain — derived_from → REQUIREMENT → ASSERTION → subject +
-//      realised_via.
-//   2. Hierarchy — parent chain + children via the `parent` field
-//      (15-requirement.md §2.4 / ELEMENT_PRIMITIVES.md §7.13).
-const input = {
-    requirements: [
-        // A broad legislative parent decomposed into two child requirements.
-        { id: 'REQUIREMENT-DATA-PROTECTION-1', name: 'Personal-data protection', origin: 'legislative', derived_from: ['REGULATION-GDPR-2016-1'], element_kind: 'requirement' },
-        { id: 'REQUIREMENT-DATA-ERASURE-1', name: 'Erase on request within 30 days', origin: 'legislative', parent: 'REQUIREMENT-DATA-PROTECTION-1', derived_from: ['REGULATION-GDPR-2016-1'], element_kind: 'requirement' },
-        { id: 'REQUIREMENT-DATA-CONSENT-1', name: 'Obtain consent before processing', origin: 'legislative', parent: 'REQUIREMENT-DATA-PROTECTION-1', element_kind: 'requirement' },
-        // A process-product sub-requirement below the erasure duty (cross-origin).
-        { id: 'REQUIREMENT-ERASURE-SLA-1', name: 'Erasure SOP — 30d target', origin: 'process-product', parent: 'REQUIREMENT-DATA-ERASURE-1', element_kind: 'requirement' },
-        // Constraint hierarchy (mirror pattern).
-        { id: 'CONSTRAINT-EEA-TRANSFER-1', name: 'No transfer outside EEA without safeguards', element_kind: 'constraint' },
-        { id: 'CONSTRAINT-EEA-ANALYTICS-1', name: 'No PII in analytics logs', parent: 'CONSTRAINT-EEA-TRANSFER-1', element_kind: 'constraint' },
-        // Internal-only requirement — no source, no parent — for the empty-case sanity check.
-        { id: 'REQUIREMENT-INTERNAL-1', name: 'Internal-only', element_kind: 'requirement' },
-    ],
-    assertions: [
-        { id: 'ASSERTION-1', about: 'REQUIREMENT-DATA-ERASURE-1', subject: 'PRODUCT-MOBILE-1', realised_via: ['CAPABILITY-V1', 'PROCESS-PURGE-1'], status: 'compliant' },
-        { id: 'ASSERTION-2', about: 'REQUIREMENT-DATA-ERASURE-1', subject: 'PRODUCT-WEB-1', status: 'partial' },
-        { id: 'ASSERTION-3', about: 'REQUIREMENT-DATA-CONSENT-1', subject: 'PRODUCT-WEB-1', status: 'compliant' },
-    ],
-};
-const codex = [
-    { id: 'REGULATION-GDPR-2016-1', name: 'GDPR', type: 'REGULATION', jurisdiction: 'EU' },
-];
-const catalog = buildTraceElementCatalog([{ id: 'PRODUCT-MOBILE-1', name: 'Mobile app' }, { id: 'PRODUCT-WEB-1', name: 'Web app' }], [{ id: 'CAPABILITY-V1', name: 'Erasure capability v1' }, { id: 'PROCESS-PURGE-1', name: 'Purge process' }]);
-describe('buildComplianceIndex — requirementsByParent', () => {
-    const idx = buildComplianceIndex(input);
-    it('groups children of the same parent', () => {
-        const children = idx.requirementsByParent.get('REQUIREMENT-DATA-PROTECTION-1');
-        expect(children?.map(r => r.id).sort()).toEqual(['REQUIREMENT-DATA-CONSENT-1', 'REQUIREMENT-DATA-ERASURE-1']);
-    });
-    it('groups CONSTRAINT children the same way (element_kind-agnostic)', () => {
-        const children = idx.requirementsByParent.get('CONSTRAINT-EEA-TRANSFER-1');
-        expect(children?.map(r => r.id)).toEqual(['CONSTRAINT-EEA-ANALYTICS-1']);
-    });
-    it('returns undefined for a leaf with no children', () => {
-        expect(idx.requirementsByParent.has('REQUIREMENT-INTERNAL-1')).toBe(false);
-    });
-});
-describe('buildRequirementTrace — trace chain', () => {
-    const idx = buildComplianceIndex(input);
-    it('resolves derived_from codex artefacts on the sources block', () => {
-        const trace = buildRequirementTrace('REQUIREMENT-DATA-ERASURE-1', idx, catalog, codex);
-        expect(trace.sources).toHaveLength(1);
-        expect(trace.sources[0].id).toBe('REGULATION-GDPR-2016-1');
-        expect(trace.sources[0].codex?.jurisdiction).toBe('EU');
-    });
-    it('keeps a dangling derived_from ref with no codex when the artefact is missing', () => {
-        const local = {
-            requirements: [{ id: 'REQUIREMENT-X-1', name: 'X', derived_from: ['LAW-MISSING-1'] }],
-            assertions: [],
-        };
-        const trace = buildRequirementTrace('REQUIREMENT-X-1', buildComplianceIndex(local), catalog);
-        expect(trace.sources).toEqual([{ id: 'LAW-MISSING-1' }]);
-    });
-    it('lists ASSERTIONs id-sorted, each with resolved subject + realised_via names', () => {
-        const trace = buildRequirementTrace('REQUIREMENT-DATA-ERASURE-1', idx, catalog, codex);
-        expect(trace.assertions.map(a => a.assertion.id)).toEqual(['ASSERTION-1', 'ASSERTION-2']);
-        expect(trace.assertions[0].subject).toEqual({ id: 'PRODUCT-MOBILE-1', name: 'Mobile app' });
-        expect(trace.assertions[0].realisedVia.map(r => r.name)).toEqual(['Erasure capability v1', 'Purge process']);
-    });
-    it('returns an empty assertions list for a REQUIREMENT with no filed claim', () => {
-        const trace = buildRequirementTrace('REQUIREMENT-DATA-PROTECTION-1', idx, catalog);
-        expect(trace.assertions).toEqual([]);
-    });
-    it('returns an empty assertions list for a CONSTRAINT (16-assertion.md §1 — CONSTRAINT-side out of v1)', () => {
-        const trace = buildRequirementTrace('CONSTRAINT-EEA-TRANSFER-1', idx, catalog);
-        expect(trace.assertions).toEqual([]);
-    });
-    it('falls back to id when the subject / realised_via element is not in the catalog (dangling ref)', () => {
-        const local = {
-            requirements: [{ id: 'REQUIREMENT-Y-1', name: 'Y' }],
-            assertions: [{ id: 'ASSERTION-9', about: 'REQUIREMENT-Y-1', subject: 'PRODUCT-GONE-1', realised_via: ['CAPABILITY-GONE-1'], status: 'n_a' }],
-        };
-        const trace = buildRequirementTrace('REQUIREMENT-Y-1', buildComplianceIndex(local), catalog);
-        expect(trace.assertions[0].subject).toEqual({ id: 'PRODUCT-GONE-1' });
-        expect(trace.assertions[0].realisedVia).toEqual([{ id: 'CAPABILITY-GONE-1' }]);
-    });
-});
-describe('buildRequirementTrace — hierarchy', () => {
-    const idx = buildComplianceIndex(input);
-    it('walks ancestors: immediate parent first, root last', () => {
-        const trace = buildRequirementTrace('REQUIREMENT-ERASURE-SLA-1', idx, catalog);
-        expect(trace.ancestors.map(r => r.id)).toEqual([
-            'REQUIREMENT-DATA-ERASURE-1',
-            'REQUIREMENT-DATA-PROTECTION-1',
-        ]);
-    });
-    it('lists direct children id-sorted', () => {
-        const trace = buildRequirementTrace('REQUIREMENT-DATA-PROTECTION-1', idx, catalog);
-        expect(trace.children.map(r => r.id)).toEqual([
-            'REQUIREMENT-DATA-CONSENT-1',
-            'REQUIREMENT-DATA-ERASURE-1',
-        ]);
-    });
-    it('handles a top-level requirement (no ancestors) with no children', () => {
-        const trace = buildRequirementTrace('REQUIREMENT-INTERNAL-1', idx, catalog);
-        expect(trace.ancestors).toEqual([]);
-        expect(trace.children).toEqual([]);
-    });
-    it('supports CONSTRAINT hierarchy the same way', () => {
-        const trace = buildRequirementTrace('CONSTRAINT-EEA-ANALYTICS-1', idx, catalog);
-        expect(trace.ancestors.map(r => r.id)).toEqual(['CONSTRAINT-EEA-TRANSFER-1']);
-    });
-    it('terminates at a missing parent without throwing (broken model)', () => {
-        const local = {
-            requirements: [{ id: 'REQUIREMENT-ORPHAN-1', name: 'Orphan', parent: 'REQUIREMENT-GONE-1' }],
-            assertions: [],
-        };
-        const trace = buildRequirementTrace('REQUIREMENT-ORPHAN-1', buildComplianceIndex(local), catalog);
-        expect(trace.ancestors).toEqual([]);
-    });
-    it('breaks a parent cycle rather than looping', () => {
-        // A → B → A (misauthored).
-        const local = {
-            requirements: [
-                { id: 'REQUIREMENT-A-1', name: 'A', parent: 'REQUIREMENT-B-1' },
-                { id: 'REQUIREMENT-B-1', name: 'B', parent: 'REQUIREMENT-A-1' },
-            ],
-            assertions: [],
-        };
-        const trace = buildRequirementTrace('REQUIREMENT-A-1', buildComplianceIndex(local), catalog);
-        expect(trace.ancestors.map(r => r.id)).toEqual(['REQUIREMENT-B-1']);
-    });
-});
-describe('buildRequirementTrace — dangling target', () => {
-    it('returns a stub carrying the id as name when the requirement is not scanned', () => {
-        const trace = buildRequirementTrace('REQUIREMENT-UNKNOWN-1', buildComplianceIndex({ requirements: [], assertions: [] }), catalog);
-        expect(trace.requirement).toEqual({ id: 'REQUIREMENT-UNKNOWN-1', name: 'REQUIREMENT-UNKNOWN-1' });
-        expect(trace.sources).toEqual([]);
-        expect(trace.assertions).toEqual([]);
-        expect(trace.ancestors).toEqual([]);
-        expect(trace.children).toEqual([]);
-    });
-});

package/dist/compliance/__tests__/view-resolution.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/compliance/__tests__/view-resolution.test.js

@@ -1,59 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { emptyCanon } from '../classify.js';
-import { catalogFromMap } from '../canon-catalog.js';
-import { collectImpactViewResolutionFindings } from '../impact.js';
-import { collectCoverageViewResolutionFindings } from '../coverage-metric.js';
-const catalog = catalogFromMap(new Map([
-    ['PRODUCT-ECOMM-1', 'PRODUCT'],
-    ['REQUIREMENT-GDPR-1', 'REQUIREMENT'],
-    ['LAW-GDPR-1', 'LAW'],
-]));
-const complianceCanon = emptyCanon();
-complianceCanon.products.push({ id: 'PRODUCT-ECOMM-1', name: 'E-Commerce' });
-complianceCanon.requirements.push({ id: 'REQUIREMENT-GDPR-1', name: 'GDPR req' });
-complianceCanon.codex.push({ id: 'LAW-GDPR-1', name: 'GDPR' });
-describe('collectImpactViewResolutionFindings', () => {
-    const base = {
-        id: 'test-impact',
-        name: 'Test',
-        subjects: { products: ['PRODUCT-ECOMM-1'], processes: [], capabilities: [] },
-        obligations: { filter: { derived_from_codex: ['LAW-GDPR-1'] } },
-        status_display: { show: ['compliant'] },
-        empty_cells: {},
-        order_rows_by: 'id',
-    };
-    it('passes when subjects and regimes resolve', () => {
-        expect(collectImpactViewResolutionFindings(base, catalog, complianceCanon)).toEqual([]);
-    });
-    it('flags unresolved subjects and regimes', () => {
-        const findings = collectImpactViewResolutionFindings({
-            ...base,
-            subjects: { products: ['PRODUCT-MISSING-1'], processes: [], capabilities: [] },
-            obligations: { include: ['REQUIREMENT-MISSING-1'], filter: { derived_from_codex: ['LAW-MISSING-1'] } },
-        }, catalog, complianceCanon);
-        expect(findings.some((f) => f.code === 'COMPIMP-REF' && f.message.includes('PRODUCT-MISSING-1'))).toBe(true);
-        expect(findings.some((f) => f.message.includes('REQUIREMENT-MISSING-1'))).toBe(true);
-        expect(findings.some((f) => f.message.includes('LAW-MISSING-1'))).toBe(true);
-    });
-});
-describe('collectCoverageViewResolutionFindings', () => {
-    const base = {
-        id: 'test-coverage',
-        name: 'Test',
-        thresholds: { green: 0.9, amber: 0.7 },
-        subjects: { products: ['PRODUCT-ECOMM-1'] },
-        regimes: { include: ['LAW-GDPR-1'] },
-    };
-    it('passes when products and regimes resolve', () => {
-        expect(collectCoverageViewResolutionFindings(base, catalog, complianceCanon)).toEqual([]);
-    });
-    it('flags unresolved product and regime refs', () => {
-        const findings = collectCoverageViewResolutionFindings({
-            ...base,
-            subjects: { products: ['PRODUCT-MISSING-1'] },
-            regimes: { include: ['LAW-MISSING-1'] },
-        }, catalog, complianceCanon);
-        expect(findings.some((f) => f.code === 'COVMET-REF')).toBe(true);
-        expect(findings).toHaveLength(2);
-    });
-});

package/dist/compliance/__tests__/views.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/compliance/__tests__/views.test.js

@@ -1,59 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { buildComplianceIndex } from '../reverse-index.js';
-import { buildLawTree, buildProductView } from '../views.js';
-const input = {
-    requirements: [
-        { id: 'REQUIREMENT-A-1', name: 'A', severity: 'high', derived_from: ['LAW-X-1'] },
-        { id: 'REQUIREMENT-B-1', name: 'B', severity: 'low', derived_from: ['LAW-X-1', 'REGULATION-Y-1'] },
-        { id: 'REQUIREMENT-C-1', name: 'C' }, // internal-only, no law
-    ],
-    assertions: [
-        { id: 'ASSERTION-2', about: 'REQUIREMENT-A-1', subject: 'PRODUCT-M-1', status: 'compliant' },
-        { id: 'ASSERTION-1', about: 'REQUIREMENT-A-1', subject: 'CAPABILITY-V2', status: 'under_review' },
-        { id: 'ASSERTION-3', about: 'REQUIREMENT-B-1', subject: 'PRODUCT-M-1', status: 'partial' },
-    ],
-};
-describe('buildComplianceIndex', () => {
-    const idx = buildComplianceIndex(input);
-    it('indexes requirements by the laws they derive from', () => {
-        expect(idx.requirementsByLaw.get('LAW-X-1')?.map(r => r.id)).toEqual(['REQUIREMENT-A-1', 'REQUIREMENT-B-1']);
-        expect(idx.requirementsByLaw.get('REGULATION-Y-1')?.map(r => r.id)).toEqual(['REQUIREMENT-B-1']);
-        expect(idx.requirementsByLaw.has('LAW-NONE-1')).toBe(false);
-    });
-    it('indexes assertions by requirement and by subject', () => {
-        expect(idx.assertionsByRequirement.get('REQUIREMENT-A-1')?.map(a => a.id).sort()).toEqual(['ASSERTION-1', 'ASSERTION-2']);
-        expect(idx.assertionsBySubject.get('PRODUCT-M-1')?.map(a => a.id).sort()).toEqual(['ASSERTION-2', 'ASSERTION-3']);
-    });
-});
-describe('buildLawTree', () => {
-    const idx = buildComplianceIndex(input);
-    it('lists requirements derived from the law, each with its id-sorted assertions', () => {
-        const tree = buildLawTree('LAW-X-1', idx);
-        expect(tree.requirements.map(r => r.requirement.id)).toEqual(['REQUIREMENT-A-1', 'REQUIREMENT-B-1']);
-        expect(tree.requirements[0].assertions.map(a => a.id)).toEqual(['ASSERTION-1', 'ASSERTION-2']);
-        expect(tree.requirements[0].assertions.map(a => a.status)).toEqual(['under_review', 'compliant']);
-    });
-    it('returns an empty tree for an unknown law', () => {
-        expect(buildLawTree('LAW-NONE-1', idx).requirements).toEqual([]);
-    });
-});
-describe('buildProductView', () => {
-    const idx = buildComplianceIndex(input);
-    it('lists the requirements the product is asserted against, with status, requirement-id-sorted', () => {
-        const view = buildProductView('PRODUCT-M-1', idx);
-        expect(view.requirements.map(r => r.requirement.id)).toEqual(['REQUIREMENT-A-1', 'REQUIREMENT-B-1']);
-        expect(view.requirements.map(r => r.assertion.status)).toEqual(['compliant', 'partial']);
-        expect(view.requirements[0].requirement.name).toBe('A');
-    });
-    it('falls back to the id as name when the requirement is not in the scan (dangling about)', () => {
-        const idx2 = buildComplianceIndex({
-            requirements: [],
-            assertions: [{ id: 'ASSERTION-9', about: 'REQUIREMENT-GONE-1', subject: 'PRODUCT-M-1', status: 'n_a' }],
-        });
-        const view = buildProductView('PRODUCT-M-1', idx2);
-        expect(view.requirements[0].requirement).toEqual({ id: 'REQUIREMENT-GONE-1', name: 'REQUIREMENT-GONE-1' });
-    });
-    it('returns an empty view for a product with no assertions', () => {
-        expect(buildProductView('PRODUCT-NONE-1', idx).requirements).toEqual([]);
-    });
-});

package/dist/compliance-matrix/__tests__/build.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/compliance-matrix/__tests__/build.test.js

@@ -1,183 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { buildComplianceMatrix, filterComplianceMatrix } from '../build.js';
-function input(over = {}) {
-    return {
-        products: [
-            { id: 'PRODUCT-ECOMM-1', name: 'E-Commerce' },
-            { id: 'PRODUCT-SUPPORT-1', name: 'Support' },
-        ],
-        requirements: [
-            { id: 'REQUIREMENT-DATA-ERASURE-1', name: 'Erasure', severity: 'high' },
-            { id: 'REQUIREMENT-AUDIT-LOG-RETENTION-1', name: 'Audit logs', severity: 'medium' },
-        ],
-        assertions: [
-            { id: 'ASSERTION-1', about: 'REQUIREMENT-DATA-ERASURE-1', subject: 'PRODUCT-ECOMM-1', status: 'compliant' },
-        ],
-        ...over,
-    };
-}
-describe('buildComplianceMatrix', () => {
-    it('sorts products as rows and requirements as columns by id', () => {
-        const m = buildComplianceMatrix(input());
-        expect(m.products.map(p => p.id)).toEqual(['PRODUCT-ECOMM-1', 'PRODUCT-SUPPORT-1']);
-        expect(m.requirements.map(r => r.id)).toEqual([
-            'REQUIREMENT-AUDIT-LOG-RETENTION-1',
-            'REQUIREMENT-DATA-ERASURE-1',
-        ]);
-    });
-    it('places an assertion status in the (product, requirement) cell and gaps elsewhere', () => {
-        const m = buildComplianceMatrix(input());
-        // row 0 = ECOMM; col 1 = DATA-ERASURE (after the sort)
-        expect(m.cells[0][1]).toMatchObject({ status: 'compliant', assertionId: 'ASSERTION-1' });
-        expect(m.cells[0][0].status).toBeUndefined(); // ECOMM × AUDIT-LOG → gap
-        expect(m.cells[1][1].status).toBeUndefined(); // SUPPORT × DATA-ERASURE → gap
-        expect(m.summary).toMatchObject({ products: 2, requirements: 2, assertions: 1, gaps: 3 });
-    });
-    it('adds a product-typed assertion subject with no product file as an unresolved row', () => {
-        const m = buildComplianceMatrix(input({
-            assertions: [
-                { id: 'A1', about: 'REQUIREMENT-DATA-ERASURE-1', subject: 'PRODUCT-MOBILE-1', status: 'partial' },
-            ],
-        }));
-        const mobile = m.products.find(p => p.id === 'PRODUCT-MOBILE-1');
-        expect(mobile).toMatchObject({ unresolved: true });
-        const col = m.requirements.findIndex(r => r.id === 'REQUIREMENT-DATA-ERASURE-1');
-        const row = m.products.findIndex(p => p.id === 'PRODUCT-MOBILE-1');
-        expect(m.cells[row][col].status).toBe('partial');
-    });
-    it('ignores assertions whose subject is not a PRODUCT', () => {
-        const m = buildComplianceMatrix(input({
-            assertions: [
-                { id: 'A1', about: 'REQUIREMENT-DATA-ERASURE-1', subject: 'CAPABILITY-V2', status: 'compliant' },
-                { id: 'A2', about: 'REQUIREMENT-DATA-ERASURE-1', subject: 'PROCESS-X-1', status: 'partial' },
-            ],
-        }));
-        expect(m.summary.assertions).toBe(0);
-        expect(m.products.map(p => p.id)).toEqual(['PRODUCT-ECOMM-1', 'PRODUCT-SUPPORT-1']);
-    });
-});
-describe('buildComplianceMatrix — jurisdiction resolution (F16)', () => {
-    it('resolves Requirement.jurisdictions from derived_from → codex', () => {
-        const m = buildComplianceMatrix(input({
-            requirements: [
-                { id: 'REQUIREMENT-DATA-ERASURE-1', name: 'Erasure', severity: 'high',
-                    derived_from: ['LAW-PERSONAL-DATA-2017-1'] },
-                { id: 'REQUIREMENT-AUDIT-LOG-RETENTION-1', name: 'Audit logs', severity: 'medium',
-                    derived_from: ['LAW-AUDIT-2020-1', 'LAW-PERSONAL-DATA-2017-1'] },
-            ],
-            codex: [
-                { id: 'LAW-PERSONAL-DATA-2017-1', jurisdiction: 'ge' },
-                { id: 'LAW-AUDIT-2020-1', jurisdiction: 'eu' },
-            ],
-        }));
-        const erasure = m.requirements.find(r => r.id === 'REQUIREMENT-DATA-ERASURE-1');
-        const audit = m.requirements.find(r => r.id === 'REQUIREMENT-AUDIT-LOG-RETENTION-1');
-        expect(erasure.jurisdictions).toEqual(['ge']);
-        // Sorted, deduplicated union.
-        expect(audit.jurisdictions).toEqual(['eu', 'ge']);
-    });
-    it('leaves jurisdictions undefined when no codex source resolves', () => {
-        const m = buildComplianceMatrix(input({
-            requirements: [
-                { id: 'REQUIREMENT-INTERNAL-1', name: 'Internal', severity: 'low' },
-                { id: 'REQUIREMENT-DANGLING-1', name: 'Dangling', severity: 'low',
-                    derived_from: ['LAW-MISSING-1'] },
-            ],
-            codex: [{ id: 'LAW-OTHER-1', jurisdiction: 'us' }],
-        }));
-        expect(m.requirements.find(r => r.id === 'REQUIREMENT-INTERNAL-1').jurisdictions).toBeUndefined();
-        expect(m.requirements.find(r => r.id === 'REQUIREMENT-DANGLING-1').jurisdictions).toBeUndefined();
-    });
-    it('ignores codex entries with no jurisdiction (e.g. internal POLICY)', () => {
-        const m = buildComplianceMatrix(input({
-            requirements: [
-                { id: 'REQUIREMENT-DATA-ERASURE-1', name: 'Erasure', severity: 'high',
-                    derived_from: ['POLICY-INTERNAL-1'] },
-            ],
-            codex: [{ id: 'POLICY-INTERNAL-1' }],
-        }));
-        expect(m.requirements[0].jurisdictions).toBeUndefined();
-    });
-    it('works with no codex input (backwards-compatible)', () => {
-        const m = buildComplianceMatrix(input({
-            requirements: [
-                { id: 'REQUIREMENT-DATA-ERASURE-1', name: 'Erasure', severity: 'high',
-                    derived_from: ['LAW-PERSONAL-DATA-2017-1'] },
-            ],
-        }));
-        expect(m.requirements[0].jurisdictions).toBeUndefined();
-    });
-});
-describe('filterComplianceMatrix', () => {
-    it('trims requirement columns by severity', () => {
-        const m = buildComplianceMatrix(input());
-        const f = filterComplianceMatrix(m, { severities: ['high'] });
-        expect(f.requirements.map(r => r.id)).toEqual(['REQUIREMENT-DATA-ERASURE-1']);
-        expect(f.cells[0]).toHaveLength(1);
-        expect(f.cells[0][0]).toMatchObject({ status: 'compliant' });
-    });
-    it('blanks cells whose status is filtered out, preserving the grid shape', () => {
-        const m = buildComplianceMatrix(input());
-        const f = filterComplianceMatrix(m, { statuses: ['non_compliant'] });
-        // The compliant cell is now hidden (treated as a gap); columns unchanged.
-        expect(f.requirements).toHaveLength(2);
-        expect(f.cells[0][1].status).toBeUndefined();
-        expect(f.summary.assertions).toBe(0);
-    });
-    it('is a no-op when no filter dimension is set', () => {
-        const m = buildComplianceMatrix(input());
-        const f = filterComplianceMatrix(m, {});
-        expect(f.summary).toEqual(m.summary);
-    });
-    it('keeps only columns whose resolved jurisdiction is in the filter (F16)', () => {
-        const m = buildComplianceMatrix(input({
-            requirements: [
-                { id: 'REQUIREMENT-DATA-ERASURE-1', name: 'Erasure', severity: 'high',
-                    derived_from: ['LAW-PERSONAL-DATA-2017-1'] },
-                { id: 'REQUIREMENT-AUDIT-LOG-RETENTION-1', name: 'Audit logs', severity: 'medium',
-                    derived_from: ['LAW-AUDIT-2020-1'] },
-            ],
-            codex: [
-                { id: 'LAW-PERSONAL-DATA-2017-1', jurisdiction: 'ge' },
-                { id: 'LAW-AUDIT-2020-1', jurisdiction: 'eu' },
-            ],
-        }));
-        const f = filterComplianceMatrix(m, { jurisdictions: ['ge'] });
-        expect(f.requirements.map(r => r.id)).toEqual(['REQUIREMENT-DATA-ERASURE-1']);
-        expect(f.cells[0]).toHaveLength(1);
-    });
-    it('drops requirements with no resolved jurisdiction when the filter is active', () => {
-        const m = buildComplianceMatrix(input({
-            requirements: [
-                { id: 'REQUIREMENT-DATA-ERASURE-1', name: 'Erasure', severity: 'high',
-                    derived_from: ['LAW-PERSONAL-DATA-2017-1'] },
-                { id: 'REQUIREMENT-INTERNAL-1', name: 'Internal', severity: 'low' },
-            ],
-            codex: [{ id: 'LAW-PERSONAL-DATA-2017-1', jurisdiction: 'ge' }],
-        }));
-        const f = filterComplianceMatrix(m, { jurisdictions: ['ge'] });
-        expect(f.requirements.map(r => r.id)).toEqual(['REQUIREMENT-DATA-ERASURE-1']);
-    });
-    it('combines jurisdiction filter with severity (intersection)', () => {
-        const m = buildComplianceMatrix(input({
-            requirements: [
-                { id: 'REQUIREMENT-DATA-ERASURE-1', name: 'Erasure', severity: 'high',
-                    derived_from: ['LAW-PERSONAL-DATA-2017-1'] },
-                { id: 'REQUIREMENT-DATA-PORTABILITY-1', name: 'Portability', severity: 'medium',
-                    derived_from: ['LAW-PERSONAL-DATA-2017-1'] },
-            ],
-            codex: [{ id: 'LAW-PERSONAL-DATA-2017-1', jurisdiction: 'ge' }],
-        }));
-        const f = filterComplianceMatrix(m, { jurisdictions: ['ge'], severities: ['high'] });
-        expect(f.requirements.map(r => r.id)).toEqual(['REQUIREMENT-DATA-ERASURE-1']);
-    });
-    it('empty jurisdiction array is treated as no-filter on that dimension', () => {
-        const m = buildComplianceMatrix(input({
-            requirements: [
-                { id: 'REQUIREMENT-INTERNAL-1', name: 'Internal', severity: 'low' },
-            ],
-        }));
-        const f = filterComplianceMatrix(m, { jurisdictions: [] });
-        expect(f.requirements).toHaveLength(1);
-    });
-});

package/dist/compliance-matrix/__tests__/example.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/compliance-matrix/__tests__/example.test.js

@@ -1,49 +0,0 @@
-// Conformance test — the compliance matrix on the acme_corp worked examples
-// (mirrored under tests/fixtures/notation-corpus/product, tests/fixtures/notation-corpus/requirement, tests/fixtures/notation-corpus/assertion).
-// Pins the #84 Phase 2 acceptance: the matrix renders correctly and gaps are
-// obvious.
-import { describe, it, expect } from 'vitest';
-import { readdirSync, readFileSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
-import path from 'node:path';
-import yaml from 'js-yaml';
-import { buildComplianceMatrix } from '../build.js';
-const examples = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../../../../../tests/fixtures/notation-corpus');
-function loadAll(dir) {
-    const full = path.join(examples, dir);
-    return readdirSync(full)
-        .filter(f => f.endsWith('.yaml'))
-        .map(f => yaml.load(readFileSync(path.join(full, f), 'utf-8')));
-}
-describe('compliance matrix — acme_corp worked examples', () => {
-    const products = loadAll('product').map(p => ({ id: String(p.id), name: String(p.name) }));
-    const requirements = loadAll('requirement').map(r => ({
-        id: String(r.id), name: String(r.name), severity: r.severity,
-    }));
-    const assertions = loadAll('assertion').map(a => ({
-        id: String(a.id), about: String(a.about), subject: String(a.subject),
-        status: a.status,
-        assessed_at: a.assessed_at,
-        next_review_at: a.next_review_at,
-    }));
-    const m = buildComplianceMatrix({ products, requirements, assertions });
-    it('rows = the two product files plus the dangling PRODUCT-MOBILE-1 subject', () => {
-        expect(m.products.map(p => p.id)).toEqual([
-            'PRODUCT-ECOMM-1', 'PRODUCT-MOBILE-1', 'PRODUCT-SUPPORT-1',
-        ]);
-        expect(m.products.find(p => p.id === 'PRODUCT-MOBILE-1')?.unresolved).toBe(true);
-    });
-    it('columns = the two requirements', () => {
-        expect(m.requirements.map(r => r.id)).toEqual([
-            'REQUIREMENT-AUDIT-LOG-RETENTION-1', 'REQUIREMENT-DATA-ERASURE-1',
-        ]);
-    });
-    it('the only product-subject assertion (mobile → data-erasure) is compliant; everything else is a gap', () => {
-        const row = m.products.findIndex(p => p.id === 'PRODUCT-MOBILE-1');
-        const col = m.requirements.findIndex(r => r.id === 'REQUIREMENT-DATA-ERASURE-1');
-        expect(m.cells[row][col]).toMatchObject({ status: 'compliant', assertionId: 'ASSERTION-MOBILE-DATA-ERASURE-1' });
-        // 3 products × 2 requirements = 6 cells; 1 filled → 5 gaps. The CRM
-        // (capability) and onboarding (process) assertions are not in the matrix.
-        expect(m.summary).toMatchObject({ products: 3, requirements: 2, assertions: 1, gaps: 5 });
-    });
-});

package/dist/confidence/__tests__/score.test.d.ts

@@ -1 +0,0 @@
-export {};