@transitrix/diagrams 1.8.4 → 1.8.7

package/src/compliance/__tests__/confidence.test.ts

@@ -1,98 +0,0 @@
-// Bridge from the compliance index projections to the DQ-1 confidence module
-// (vkgeorgia/strategy#162 — DQ-2). Pins that:
-//   • element TYPEs lift to REQUIREMENT / ASSERTION (decay lookup keys),
-//   • admitted_at flows through to the freshness curve,
-//   • the §11.6 header line matches the spec example shape,
-//   • an empty view suppresses the header (caller-controlled).
-
-import { describe, it, expect } from 'vitest';
-import {
-  assertionToScoringElement,
-  complianceConfidenceHeader,
-  requirementToScoringElement,
-  scoreComplianceView,
-} from '../confidence.js';
-import type { IndexAssertion, IndexRequirement } from '../types.js';
-
-const req = (over: Partial<IndexRequirement> = {}): IndexRequirement => ({
-  id: 'REQUIREMENT-1', name: 'R', admitted_at: '2026-05-01', ...over,
-});
-const ass = (over: Partial<IndexAssertion> = {}): IndexAssertion => ({
-  id: 'ASSERTION-1', about: 'REQUIREMENT-1', subject: 'PRODUCT-1',
-  status: 'compliant', admitted_at: '2026-05-01', ...over,
-});
-
-describe('requirementToScoringElement / assertionToScoringElement', () => {
-  it('lifts the index projection to a ScoringElement', () => {
-    expect(requirementToScoringElement(req())).toEqual({
-      type: 'REQUIREMENT', admitted_at: '2026-05-01',
-    });
-    expect(assertionToScoringElement(ass())).toEqual({
-      type: 'ASSERTION', admitted_at: '2026-05-01',
-    });
-  });
-
-  it('leaves sources undefined — v1 has no field-zone provenance to resolve', () => {
-    // Documents the §11.5 behaviour: until DSM/Studio ingest field-zone
-    // source_quality, every element scores unsourced and is counted separately.
-    expect(requirementToScoringElement(req()).sources).toBeUndefined();
-    expect(assertionToScoringElement(ass()).sources).toBeUndefined();
-  });
-
-  it('preserves an absent admitted_at as undefined', () => {
-    expect(requirementToScoringElement(req({ admitted_at: undefined })).admitted_at).toBeUndefined();
-  });
-});
-
-describe('scoreComplianceView', () => {
-  it('scores the union of requirements + assertions and reports today', () => {
-    const v = scoreComplianceView([req()], [ass()], '2026-06-07');
-    expect(v.today).toBe('2026-06-07');
-    expect(v.elements).toHaveLength(2);
-    expect(v.composite.element_count).toBe(2);
-    // Two fresh elements (37 days old, ≤ implicit fresh_days=180) → freshness=1.0,
-    // but no sources → source_trust=0.25 floor → confidence=0.25, band D.
-    for (const e of v.elements) {
-      expect(e.freshness).toBe(1.0);
-      expect(e.source_trust).toBe(0.25);
-      expect(e.confidence).toBe(0.25);
-      expect(e.sourced).toBe(false);
-    }
-    expect(v.composite.band).toBe('D');
-    expect(v.composite.coverage).toBe(0);
-    expect(v.composite.unsourced_count).toBe(2);
-  });
-
-  it('returns the degenerate composite for an empty view', () => {
-    const v = scoreComplianceView([], [], '2026-06-07');
-    expect(v.composite.element_count).toBe(0);
-    expect(v.elements).toHaveLength(0);
-  });
-
-  it('honours per-TYPE decay overrides from the manifest config', () => {
-    // ASSERTION decays faster than REQUIREMENT — exercise the by_type lookup.
-    const v = scoreComplianceView(
-      [req({ admitted_at: '2025-01-01' })],
-      [ass({ admitted_at: '2025-01-01' })],
-      '2026-06-07',
-      {
-        by_type: {
-          REQUIREMENT: { fresh_days: 1000, stale_days: 2000, floor: 0.5 },
-          ASSERTION:   { fresh_days: 30,   stale_days: 60,   floor: 0.1 },
-        },
-      },
-    );
-    // Requirement is still well within fresh_days=1000 → freshness 1.0.
-    expect(v.elements[0].freshness).toBe(1.0);
-    // Assertion is well past stale_days=60 → freshness floors at 0.1.
-    expect(v.elements[1].freshness).toBeCloseTo(0.1, 10);
-  });
-});
-
-describe('complianceConfidenceHeader', () => {
-  it('formats the §11.6 example shape and returns empty for an empty view', () => {
-    expect(complianceConfidenceHeader([], [], '2026-06-07')).toBe('');
-    const line = complianceConfidenceHeader([req()], [ass()], '2026-06-07');
-    expect(line).toMatch(/^Data confidence \(as of 2026-06-07\): D \(weakest link\) · 0\.25 mean · 0% sourced$/);
-  });
-});

package/src/compliance/__tests__/coverage-metric.test.ts

@@ -1,300 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import {
-  parseCoverageMetricConfig,
-  buildCoverageMatrix,
-  type CoverageMetricConfig,
-} from '../coverage-metric.js';
-import { emptyCanon, ingestComplianceDoc } from '../classify.js';
-import type { ComplianceCanon } from '../classify.js';
-
-// ── parseCoverageMetricConfig ─────────────────────────────────────────────────
-
-describe('parseCoverageMetricConfig', () => {
-  it('rejects null', () => {
-    const r = parseCoverageMetricConfig(null);
-    expect(r.ok).toBe(false);
-  });
-
-  it('rejects missing id', () => {
-    const r = parseCoverageMetricConfig({ view: { name: 'x' } });
-    expect(r.ok).toBe(false);
-    if (!r.ok) expect(r.errors.some(e => e.includes('id'))).toBe(true);
-  });
-
-  it('parses minimal config via view: wrapper', () => {
-    const r = parseCoverageMetricConfig({
-      view: { id: 'CM-1', name: 'Test' },
-    });
-    expect(r.ok).toBe(true);
-    if (r.ok) {
-      expect(r.config.id).toBe('CM-1');
-      expect(r.config.name).toBe('Test');
-      expect(r.config.thresholds.green).toBe(0.8);
-      expect(r.config.thresholds.amber).toBe(0.5);
-      expect(r.config.regimes).toBeUndefined();
-    }
-  });
-
-  it('parses view: wrapper with regimes.include and subjects', () => {
-    const r = parseCoverageMetricConfig({
-      view: {
-        id: 'CM-2',
-        name: 'EU Coverage',
-        description: 'desc',
-        regimes: { include: ['LAW-GDPR-1'] },
-        subjects: { products: ['PRODUCT-1'] },
-        thresholds: { green: 0.9, amber: 0.6 },
-      },
-    });
-    expect(r.ok).toBe(true);
-    if (r.ok) {
-      expect(r.config.regimes?.include).toEqual(['LAW-GDPR-1']);
-      expect(r.config.subjects?.products).toEqual(['PRODUCT-1']);
-      expect(r.config.thresholds.green).toBe(0.9);
-      expect(r.config.thresholds.amber).toBe(0.6);
-      expect(r.config.warnings).toBeUndefined();
-    }
-  });
-
-  it('parses view: wrapper with regimes.filter', () => {
-    const r = parseCoverageMetricConfig({
-      view: {
-        id: 'CM-3',
-        name: 'EU Filter',
-        regimes: { filter: { jurisdiction: ['EU'], codex_type: ['regulation'] } },
-      },
-    });
-    expect(r.ok).toBe(true);
-    if (r.ok) {
-      expect(r.config.regimes?.filter?.jurisdiction).toEqual(['EU']);
-      expect(r.config.regimes?.filter?.codex_type).toEqual(['regulation']);
-      expect(r.config.regimes?.include).toBeUndefined();
-    }
-  });
-
-  it('warns COVMET-007 when both regimes.include and regimes.filter are set', () => {
-    const r = parseCoverageMetricConfig({
-      view: {
-        id: 'CM-4',
-        name: 'Both',
-        regimes: {
-          include: ['LAW-GDPR-1'],
-          filter: { jurisdiction: ['EU'] },
-        },
-      },
-    });
-    expect(r.ok).toBe(true);
-    if (r.ok) {
-      expect(r.config.warnings?.some(w => w.includes('COVMET-007'))).toBe(true);
-    }
-  });
-
-  it('accepts bare (unwrapped) object without wrapper warning', () => {
-    const r = parseCoverageMetricConfig({ id: 'CM-5', name: 'Bare' });
-    expect(r.ok).toBe(true);
-    if (r.ok) {
-      expect(r.config.warnings?.some(w => w.includes('COVMET-DEPRECATED'))).toBeFalsy();
-    }
-  });
-
-  // ── Backward compatibility: deprecated coverage_metric: wrapper ──────────────
-
-  it('accepts deprecated coverage_metric: wrapper with COVMET-DEPRECATED warning', () => {
-    const r = parseCoverageMetricConfig({
-      coverage_metric: { id: 'CM-6', name: 'Legacy' },
-    });
-    expect(r.ok).toBe(true);
-    if (r.ok) {
-      expect(r.config.warnings?.some(w => w.includes('COVMET-DEPRECATED'))).toBe(true);
-    }
-  });
-
-  it('maps deprecated scope.codex to regimes.include', () => {
-    const r = parseCoverageMetricConfig({
-      coverage_metric: {
-        id: 'CM-7',
-        name: 'Legacy Scope',
-        scope: {
-          codex: ['LAW-GDPR-1', 'LAW-NIS2-1'],
-          subjects: { products: ['PRODUCT-1'] },
-        },
-        thresholds: { green: 0.9, amber: 0.6 },
-      },
-    });
-    expect(r.ok).toBe(true);
-    if (r.ok) {
-      expect(r.config.regimes?.include).toEqual(['LAW-GDPR-1', 'LAW-NIS2-1']);
-      expect(r.config.subjects?.products).toEqual(['PRODUCT-1']);
-      expect(r.config.thresholds.green).toBe(0.9);
-    }
-  });
-});
-
-// ── buildCoverageMatrix ───────────────────────────────────────────────────────
-
-function makeCanon(): ComplianceCanon {
-  const canon = emptyCanon();
-  ingestComplianceDoc(canon, { id: 'LAW-GDPR-1', name: 'GDPR', zone: 'codex', jurisdiction: 'EU' });
-  ingestComplianceDoc(canon, { notation: 'requirement', id: 'REQ-1', name: 'Lawful basis', derived_from: ['LAW-GDPR-1'] });
-  ingestComplianceDoc(canon, { notation: 'requirement', id: 'REQ-2', name: 'Data minimisation', derived_from: ['LAW-GDPR-1'] });
-  ingestComplianceDoc(canon, { notation: 'requirement', id: 'REQ-3', name: 'Breach notification', derived_from: ['LAW-GDPR-1'] });
-  ingestComplianceDoc(canon, { notation: 'product', id: 'PRODUCT-1', name: 'E-commerce' });
-  ingestComplianceDoc(canon, { notation: 'assertion', id: 'ASSERTION-1', about: 'REQ-1', subject: 'PRODUCT-1', status: 'compliant' });
-  ingestComplianceDoc(canon, { notation: 'assertion', id: 'ASSERTION-2', about: 'REQ-2', subject: 'PRODUCT-1', status: 'partial' });
-  // REQ-3 has no assertion → gap
-  return canon;
-}
-
-function makeConfig(overrides?: Partial<CoverageMetricConfig>): CoverageMetricConfig {
-  return {
-    id: 'CM-TEST-1',
-    name: 'Test Coverage',
-    regimes: { include: ['LAW-GDPR-1'] },
-    subjects: { products: ['PRODUCT-1'] },
-    thresholds: { green: 0.8, amber: 0.5 },
-    ...overrides,
-  };
-}
-
-describe('buildCoverageMatrix', () => {
-  it('returns correct row counts', () => {
-    const matrix = buildCoverageMatrix(makeCanon(), makeConfig());
-    expect(matrix.rows).toHaveLength(1);
-    const row = matrix.rows[0];
-    expect(row.codexId).toBe('LAW-GDPR-1');
-    expect(row.totalRequirements).toBe(3);
-    expect(row.compliant).toBe(1);
-    expect(row.partial).toBe(1);
-    expect(row.gap).toBe(1);
-    expect(row.coveredCount).toBe(2);
-  });
-
-  it('computes coverage percentage correctly', () => {
-    const row = buildCoverageMatrix(makeCanon(), makeConfig()).rows[0];
-    expect(row.coveragePct).toBeCloseTo(2 / 3, 5);
-  });
-
-  it('assigns amber RAG status for ~67% coverage with green=0.80, amber=0.50', () => {
-    expect(buildCoverageMatrix(makeCanon(), makeConfig()).rows[0].ragStatus).toBe('amber');
-  });
-
-  it('assigns green RAG when all requirements covered', () => {
-    const canon = makeCanon();
-    ingestComplianceDoc(canon, { notation: 'assertion', id: 'ASSERTION-3', about: 'REQ-3', subject: 'PRODUCT-1', status: 'compliant' });
-    const matrix = buildCoverageMatrix(canon, makeConfig());
-    expect(matrix.rows[0].ragStatus).toBe('green');
-    expect(matrix.rows[0].coveragePct).toBe(1);
-  });
-
-  it('assigns red RAG when coverage < amber threshold', () => {
-    const matrix = buildCoverageMatrix(makeCanon(), makeConfig({ thresholds: { green: 0.9, amber: 0.8 } }));
-    expect(matrix.rows[0].ragStatus).toBe('red');
-  });
-
-  it('returns no_data when codex has no requirements', () => {
-    const canon = emptyCanon();
-    ingestComplianceDoc(canon, { id: 'LAW-EMPTY-1', name: 'Empty Law', zone: 'codex', jurisdiction: 'XX' });
-    const matrix = buildCoverageMatrix(canon, makeConfig({ regimes: { include: ['LAW-EMPTY-1'] } }));
-    expect(matrix.rows[0].ragStatus).toBe('no_data');
-    expect(matrix.rows[0].totalRequirements).toBe(0);
-  });
-
-  it('includes jurisdiction from scanned canon', () => {
-    expect(buildCoverageMatrix(makeCanon(), makeConfig()).rows[0].jurisdiction).toBe('EU');
-  });
-
-  it('handles multiple codex entries via regimes.include', () => {
-    const canon = makeCanon();
-    ingestComplianceDoc(canon, { id: 'LAW-NIS2-1', name: 'NIS2', zone: 'codex', jurisdiction: 'EU' });
-    ingestComplianceDoc(canon, { notation: 'requirement', id: 'REQ-NIS-1', name: 'Incident reporting', derived_from: ['LAW-NIS2-1'] });
-    const matrix = buildCoverageMatrix(canon, makeConfig({ regimes: { include: ['LAW-GDPR-1', 'LAW-NIS2-1'] } }));
-    expect(matrix.rows).toHaveLength(2);
-    expect(matrix.rows[1].codexId).toBe('LAW-NIS2-1');
-    expect(matrix.rows[1].gap).toBe(1);
-  });
-
-  it('respects product scope — ignores assertions for other products', () => {
-    const canon = makeCanon();
-    ingestComplianceDoc(canon, { notation: 'product', id: 'PRODUCT-2', name: 'Support' });
-    ingestComplianceDoc(canon, { notation: 'assertion', id: 'ASSERTION-OUT', about: 'REQ-3', subject: 'PRODUCT-2', status: 'compliant' });
-    const matrix = buildCoverageMatrix(canon, makeConfig({
-      regimes: { include: ['LAW-GDPR-1'] },
-      subjects: { products: ['PRODUCT-1'] },
-    }));
-    expect(matrix.rows[0].gap).toBe(1);
-  });
-
-  it('counts non_compliant separately', () => {
-    const canon = makeCanon();
-    ingestComplianceDoc(canon, { notation: 'assertion', id: 'ASSERTION-FAIL', about: 'REQ-3', subject: 'PRODUCT-1', status: 'non_compliant' });
-    const matrix = buildCoverageMatrix(canon, makeConfig());
-    expect(matrix.rows[0].non_compliant).toBe(1);
-    expect(matrix.rows[0].gap).toBe(0);
-    expect(matrix.rows[0].coveredCount).toBe(2);
-  });
-
-  it('counts pending_owner separately and does not include it in coveredCount', () => {
-    const canon = makeCanon();
-    ingestComplianceDoc(canon, { notation: 'assertion', id: 'ASSERTION-PO', about: 'REQ-3', subject: 'PRODUCT-1', status: 'pending_owner', owner_to_confirm: 'alice' });
-    const matrix = buildCoverageMatrix(canon, makeConfig());
-    expect(matrix.rows[0].pending_owner).toBe(1);
-    expect(matrix.rows[0].gap).toBe(0);
-    expect(matrix.rows[0].coveredCount).toBe(2);
-  });
-
-  // ── regimes.filter ───────────────────────────────────────────────────────────
-
-  it('resolves codex via regimes.filter.jurisdiction', () => {
-    const canon = makeCanon();
-    ingestComplianceDoc(canon, { id: 'LAW-CCPA-1', name: 'CCPA', zone: 'codex', jurisdiction: 'US' });
-    // regimes.filter: only EU laws → should return LAW-GDPR-1 only
-    const matrix = buildCoverageMatrix(canon, makeConfig({
-      regimes: { filter: { jurisdiction: ['EU'] } },
-    }));
-    expect(matrix.rows.every(r => r.codexId !== 'LAW-CCPA-1')).toBe(true);
-    expect(matrix.rows.some(r => r.codexId === 'LAW-GDPR-1')).toBe(true);
-  });
-
-  it('resolves codex via regimes.filter.codex_type', () => {
-    const canon = emptyCanon();
-    ingestComplianceDoc(canon, { id: 'LAW-A', name: 'Regulation A', zone: 'codex', type: 'regulation' });
-    ingestComplianceDoc(canon, { id: 'LAW-B', name: 'Standard B', zone: 'codex', type: 'standard' });
-    const matrix = buildCoverageMatrix(canon, makeConfig({
-      regimes: { filter: { codex_type: ['regulation'] } },
-    }));
-    expect(matrix.rows.map(r => r.codexId)).toEqual(['LAW-A']);
-  });
-
-  // ── Zero-config: all canon codex entries ─────────────────────────────────────
-
-  it('zero-config (no regimes) enumerates all canon codex', () => {
-    const canon = makeCanon();
-    ingestComplianceDoc(canon, { id: 'LAW-NIS2-1', name: 'NIS2', zone: 'codex', jurisdiction: 'EU' });
-    const matrix = buildCoverageMatrix(canon, makeConfig({ regimes: undefined }));
-    expect(matrix.rows.map(r => r.codexId)).toContain('LAW-GDPR-1');
-    expect(matrix.rows.map(r => r.codexId)).toContain('LAW-NIS2-1');
-  });
-
-  // ── Backward compat: deprecated config still produces correct matrix ─────────
-
-  it('deprecated scope.codex via parseCoverageMetricConfig maps to correct matrix', () => {
-    const r = parseCoverageMetricConfig({
-      coverage_metric: {
-        id: 'CM-LEGACY',
-        name: 'Legacy',
-        scope: {
-          codex: ['LAW-GDPR-1'],
-          subjects: { products: ['PRODUCT-1'] },
-        },
-        thresholds: { green: 0.8, amber: 0.5 },
-      },
-    });
-    expect(r.ok).toBe(true);
-    if (r.ok) {
-      const matrix = buildCoverageMatrix(makeCanon(), r.config);
-      expect(matrix.rows).toHaveLength(1);
-      expect(matrix.rows[0].codexId).toBe('LAW-GDPR-1');
-      expect(matrix.rows[0].coveredCount).toBe(2);
-    }
-  });
-});

package/src/compliance/__tests__/demo-scenario.test.ts

@@ -1,273 +0,0 @@
-// Conformance test for the NorthBay Retail EU compliance demo scenario
-// (strategy hub #178). Validates that the demo data files load without errors,
-// produce the expected matrix shape, and exercise all four compliance statuses.
-
-import { describe, it, expect } from 'vitest';
-import { readdirSync, readFileSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
-import path from 'node:path';
-import yaml from 'js-yaml';
-import { buildComplianceIndex } from '../reverse-index.js';
-import { buildLawTree, buildProductView } from '../views.js';
-import { buildGapReport } from '../gap-report.js';
-import { parseImpactViewConfig, buildImpactMatrix } from '../impact.js';
-import { emptyCanon, ingestComplianceDoc } from '../classify.js';
-import type { IndexAssertion, IndexRequirement, ComplianceIndex } from '../types.js';
-
-const EXAMPLES = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../../../../../tests/fixtures/notation-corpus');
-
-function loadYamlDir(dir: string): Record<string, unknown>[] {
-  const full = path.join(EXAMPLES, dir);
-  return readdirSync(full)
-    .filter(f => f.endsWith('.yaml'))
-    .map(f => yaml.load(readFileSync(path.join(full, f), 'utf-8')) as Record<string, unknown>);
-}
-
-function loadYamlFile(relPath: string): unknown {
-  return yaml.load(readFileSync(path.join(EXAMPLES, relPath), 'utf-8'));
-}
-
-// ── Build the demo canon ─────────────────────────────────────────────────────
-
-const requirements: IndexRequirement[] = loadYamlDir('compliance/requirements').map(r => ({
-  id: String(r.id),
-  name: String(r.name),
-  severity: r.severity as string | undefined,
-  derived_from: Array.isArray(r.derived_from) ? (r.derived_from as string[]) : undefined,
-  deadline: typeof r.deadline === 'string' ? r.deadline : undefined,
-}));
-
-const assertions: IndexAssertion[] = loadYamlDir('compliance/assertions').map(a => ({
-  id: String(a.id),
-  about: String(a.about),
-  subject: String(a.subject),
-  status: a.status as IndexAssertion['status'],
-  realised_via: Array.isArray(a.realised_via) ? (a.realised_via as string[]) : undefined,
-  assessed_at: typeof a.assessed_at === 'string' ? a.assessed_at : undefined,
-  next_review_at: typeof a.next_review_at === 'string' ? a.next_review_at : undefined,
-  evidenceCount: Array.isArray(a.evidence) ? (a.evidence as unknown[]).length : 0,
-}));
-
-const index: ComplianceIndex = buildComplianceIndex({ requirements, assertions });
-
-// ── Demo data integrity ──────────────────────────────────────────────────────
-
-describe('demo scenario — data integrity', () => {
-  it('loads 5 requirements from the demo scenario', () => {
-    expect(requirements).toHaveLength(5);
-    const ids = requirements.map(r => r.id).sort();
-    expect(ids).toEqual([
-      'REQUIREMENT-GDPR-CONSENT-1',
-      'REQUIREMENT-GDPR-DATA-ERASURE-1',
-      'REQUIREMENT-GDPR-PORTABILITY-1',
-      'REQUIREMENT-NIS2-INCIDENT-REPORT-1',
-      'REQUIREMENT-NIS2-SUPPLY-CHAIN-1',
-    ]);
-  });
-
-  it('loads 5 assertions covering all four compliance statuses', () => {
-    expect(assertions).toHaveLength(5);
-    const statuses = assertions.map(a => a.status).sort();
-    expect(statuses).toContain('compliant');
-    expect(statuses).toContain('partial');
-    expect(statuses).toContain('non_compliant');
-    expect(statuses).toContain('under_review');
-  });
-
-  it('requirements have deadline fields on 3 of 5', () => {
-    const withDeadline = requirements.filter(r => r.deadline != null);
-    expect(withDeadline).toHaveLength(3);
-    const ids = withDeadline.map(r => r.id).sort();
-    expect(ids).toEqual([
-      'REQUIREMENT-GDPR-CONSENT-1',
-      'REQUIREMENT-GDPR-DATA-ERASURE-1',
-      'REQUIREMENT-NIS2-INCIDENT-REPORT-1',
-    ]);
-  });
-
-  it('REQUIREMENT-GDPR-DATA-ERASURE-1 has a past-due deadline', () => {
-    const req = requirements.find(r => r.id === 'REQUIREMENT-GDPR-DATA-ERASURE-1');
-    expect(req?.deadline).toBe('2025-12-31');
-    // 2025-12-31 is in the past relative to any 2026+ date
-    expect(req!.deadline! < '2026-01-01').toBe(true);
-  });
-});
-
-// ── Single-law trees ─────────────────────────────────────────────────────────
-
-describe('single-law tree — LAW-GDPR-1', () => {
-  const tree = buildLawTree('LAW-GDPR-1', index);
-
-  it('has 3 GDPR requirements', () => {
-    expect(tree.requirements).toHaveLength(3);
-    const ids = tree.requirements.map(r => r.requirement.id).sort();
-    expect(ids).toEqual([
-      'REQUIREMENT-GDPR-CONSENT-1',
-      'REQUIREMENT-GDPR-DATA-ERASURE-1',
-      'REQUIREMENT-GDPR-PORTABILITY-1',
-    ]);
-  });
-
-  it('erasure requirement has 2 assertions (one per product)', () => {
-    const erasure = tree.requirements.find(r => r.requirement.id === 'REQUIREMENT-GDPR-DATA-ERASURE-1');
-    expect(erasure).toBeDefined();
-    expect(erasure!.assertions).toHaveLength(2);
-    const statuses = erasure!.assertions.map(a => a.status).sort();
-    expect(statuses).toEqual(['compliant', 'non_compliant']);
-  });
-
-  it('consent requirement has exactly one partial assertion', () => {
-    const consent = tree.requirements.find(r => r.requirement.id === 'REQUIREMENT-GDPR-CONSENT-1');
-    expect(consent!.assertions).toHaveLength(1);
-    expect(consent!.assertions[0].status).toBe('partial');
-  });
-
-  it('portability requirement is compliant', () => {
-    const portability = tree.requirements.find(r => r.requirement.id === 'REQUIREMENT-GDPR-PORTABILITY-1');
-    expect(portability!.assertions).toHaveLength(1);
-    expect(portability!.assertions[0].status).toBe('compliant');
-  });
-});
-
-describe('single-law tree — LAW-NIS2-1', () => {
-  const tree = buildLawTree('LAW-NIS2-1', index);
-
-  it('has 2 NIS2 requirements', () => {
-    expect(tree.requirements).toHaveLength(2);
-    const ids = tree.requirements.map(r => r.requirement.id).sort();
-    expect(ids).toEqual([
-      'REQUIREMENT-NIS2-INCIDENT-REPORT-1',
-      'REQUIREMENT-NIS2-SUPPLY-CHAIN-1',
-    ]);
-  });
-
-  it('incident-report requirement has one under_review assertion', () => {
-    const incident = tree.requirements.find(r => r.requirement.id === 'REQUIREMENT-NIS2-INCIDENT-REPORT-1');
-    expect(incident!.assertions).toHaveLength(1);
-    expect(incident!.assertions[0].status).toBe('under_review');
-  });
-
-  it('supply-chain requirement has no assertions — deliberate gap', () => {
-    const supplyChain = tree.requirements.find(r => r.requirement.id === 'REQUIREMENT-NIS2-SUPPLY-CHAIN-1');
-    expect(supplyChain!.assertions).toHaveLength(0);
-  });
-});
-
-// ── Single-product views ─────────────────────────────────────────────────────
-
-describe('single-product view — PRODUCT-ECOMM-1', () => {
-  const view = buildProductView('PRODUCT-ECOMM-1', index);
-
-  it('covers 4 requirements (4 assertions with PRODUCT-ECOMM-1 as subject)', () => {
-    expect(view.requirements).toHaveLength(4);
-  });
-
-  it('includes non_compliant erasure status', () => {
-    const erasure = view.requirements.find(r => r.requirement.id === 'REQUIREMENT-GDPR-DATA-ERASURE-1');
-    expect(erasure).toBeDefined();
-    expect(erasure!.assertion.status).toBe('non_compliant');
-  });
-});
-
-describe('single-product view — PRODUCT-SUPPORT-1', () => {
-  const view = buildProductView('PRODUCT-SUPPORT-1', index);
-
-  it('has exactly 1 assertion (erasure only)', () => {
-    expect(view.requirements).toHaveLength(1);
-    expect(view.requirements[0].requirement.id).toBe('REQUIREMENT-GDPR-DATA-ERASURE-1');
-    expect(view.requirements[0].assertion.status).toBe('compliant');
-  });
-});
-
-// ── Gap report ───────────────────────────────────────────────────────────────
-
-describe('gap report', () => {
-  const today = '2026-06-10';
-  const report = buildGapReport(index, { today });
-
-  it('NIS2 supply-chain requirement appears in requirements-without-assertions', () => {
-    const gap = report.requirementsWithoutAssertions.find(
-      r => r.id === 'REQUIREMENT-NIS2-SUPPLY-CHAIN-1',
-    );
-    expect(gap).toBeDefined();
-  });
-
-  it('non_compliant erasure requirement is NOT in requirements-without-assertions', () => {
-    const gap = report.requirementsWithoutAssertions.find(
-      r => r.id === 'REQUIREMENT-GDPR-DATA-ERASURE-1',
-    );
-    expect(gap).toBeUndefined();
-  });
-
-  it('erasure requirement is NOT in pastDeadlineRequirements — it has a compliant assertion for PRODUCT-SUPPORT-1', () => {
-    // buildGapReport only surfaces a past-deadline req when ALL its assertions
-    // are non-compliant. PRODUCT-SUPPORT-1 has a compliant assertion for erasure,
-    // so the requirement is excluded from the past-deadline gap list even though
-    // PRODUCT-ECOMM-1 is non_compliant.
-    const overdue = report.pastDeadlineRequirements.find(
-      r => r.id === 'REQUIREMENT-GDPR-DATA-ERASURE-1',
-    );
-    expect(overdue).toBeUndefined();
-  });
-});
-
-// ── Compliance-impact view-config ────────────────────────────────────────────
-
-describe('compliance-impact view-config — gdpr-nis2', () => {
-  const raw = loadYamlFile('compliance-impact/gdpr-nis2.compliance-impact.view.yaml');
-  const result = parseImpactViewConfig(raw);
-
-  it('parses without errors', () => {
-    expect(result.ok).toBe(true);
-  });
-
-  it('scopes to PRODUCT-ECOMM-1 and PRODUCT-SUPPORT-1', () => {
-    if (!result.ok) throw new Error('parse failed');
-    expect(result.config.subjects.products).toEqual(['PRODUCT-ECOMM-1', 'PRODUCT-SUPPORT-1']);
-  });
-
-  it('filters obligations to LAW-GDPR-1 and LAW-NIS2-1', () => {
-    if (!result.ok) throw new Error('parse failed');
-    expect(result.config.obligations.filter?.derived_from_codex).toEqual(['LAW-GDPR-1', 'LAW-NIS2-1']);
-  });
-
-  it('builds a matrix with 2 products and 5 requirements scoped to the two laws', () => {
-    if (!result.ok) throw new Error('parse failed');
-
-    // Build the canon using ingestComplianceDoc (same path as the Studio extension).
-    const canon = emptyCanon();
-    for (const r of loadYamlDir('compliance/requirements')) ingestComplianceDoc(canon, r);
-    for (const a of loadYamlDir('compliance/assertions')) ingestComplianceDoc(canon, a);
-    // Add the two products.
-    canon.products.push({ id: 'PRODUCT-ECOMM-1', name: 'E-Commerce Platform' });
-    canon.products.push({ id: 'PRODUCT-SUPPORT-1', name: 'Customer Support Service' });
-
-    const matrix = buildImpactMatrix(canon, result.config);
-    expect(matrix.columns).toHaveLength(2);
-    // 5 requirements are split: 3 GDPR + 2 NIS2 — all 5 should appear.
-    expect(matrix.rows).toHaveLength(5);
-  });
-});
-
-// ── Regression: existing worked examples unaffected ─────────────────────────
-
-describe('regression — existing tests/fixtures/notation-corpus/requirement + tests/fixtures/notation-corpus/assertion unchanged', () => {
-  const reqs: IndexRequirement[] = loadYamlDir('requirement').map(r => ({
-    id: String(r.id),
-    name: String(r.name),
-    derived_from: Array.isArray(r.derived_from) ? (r.derived_from as string[]) : undefined,
-  }));
-  const asns: IndexAssertion[] = loadYamlDir('assertion').map(a => ({
-    id: String(a.id),
-    about: String(a.about),
-    subject: String(a.subject),
-    status: a.status as IndexAssertion['status'],
-  }));
-  const idx = buildComplianceIndex({ requirements: reqs, assertions: asns });
-
-  it('original LAW-PERSONAL-DATA-2017-1 tree still resolves correctly', () => {
-    const tree = buildLawTree('LAW-PERSONAL-DATA-2017-1', idx);
-    expect(tree.requirements.map(r => r.requirement.id)).toEqual(['REQUIREMENT-DATA-ERASURE-1']);
-    expect(tree.requirements[0].assertions).toHaveLength(3);
-  });
-});