@transitrix/diagrams 1.8.4 → 1.8.7

package/src/compliance/__tests__/markdown.test.ts

@@ -1,95 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { readdirSync, readFileSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
-import path from 'node:path';
-import yaml from 'js-yaml';
-import { renderComplianceMarkdown } from '../markdown.js';
-import { emptyCanon, ingestComplianceDoc, type ComplianceCanon } from '../classify.js';
-
-function synthetic(): ComplianceCanon {
-  const canon = emptyCanon();
-  ingestComplianceDoc(canon, { notation: 'product', id: 'PRODUCT-M-1', name: 'Mobile App' });
-  ingestComplianceDoc(canon, { notation: 'requirement', id: 'REQUIREMENT-ERASURE-1', name: 'Erasure', severity: 'high', derived_from: ['LAW-X-1'] });
-  ingestComplianceDoc(canon, { notation: 'requirement', id: 'REQUIREMENT-LOG-1', name: 'Logs', severity: 'low' });
-  ingestComplianceDoc(canon, { notation: 'assertion', id: 'ASSERTION-1', about: 'REQUIREMENT-ERASURE-1', subject: 'PRODUCT-M-1', status: 'compliant', evidence: [{ kind: 'note', text: 'x' }], next_review_at: '2026-09-01' });
-  ingestComplianceDoc(canon, { id: 'LAW-X-1', name: 'Privacy Law', zone: 'codex', type: 'LAW' });
-  return canon;
-}
-
-describe('renderComplianceMarkdown — matrix', () => {
-  it('renders a table with status cells and gap dashes', () => {
-    const md = renderComplianceMarkdown(synthetic(), { mode: 'matrix' });
-    expect(md).toContain('# Compliance Matrix');
-    expect(md).toContain('| Product \\ Requirement | Erasure | Logs |');
-    expect(md).toMatch(/\| Mobile App \| Compliant \| — \|/);
-  });
-});
-
-describe('renderComplianceMarkdown — law', () => {
-  it('renders the law name and its requirement with the assertion bullet', () => {
-    const md = renderComplianceMarkdown(synthetic(), { mode: 'law', id: 'LAW-X-1' });
-    expect(md).toContain('# Compliance — Privacy Law');
-    expect(md).toContain('## Erasure (`REQUIREMENT-ERASURE-1`) — severity: high');
-    expect(md).toContain('- **Compliant** — `ASSERTION-1`');
-  });
-});
-
-describe('renderComplianceMarkdown — product', () => {
-  it('renders the product table of asserted requirements', () => {
-    const md = renderComplianceMarkdown(synthetic(), { mode: 'product', id: 'PRODUCT-M-1' });
-    expect(md).toContain('# Compliance — Mobile App');
-    expect(md).toContain('| Requirement | Status | Assertion | Next review |');
-    expect(md).toMatch(/\| Erasure \(`REQUIREMENT-ERASURE-1`\) \| Compliant \| `ASSERTION-1` \| 2026-09-01 \|/);
-  });
-});
-
-describe('renderComplianceMarkdown — gap', () => {
-  it('lists the un-asserted requirement as a checklist item', () => {
-    const md = renderComplianceMarkdown(synthetic(), { mode: 'gap' }, { today: '2026-06-02' });
-    expect(md).toContain('## Requirements without assertions (1)');
-    expect(md).toContain('- [ ] `REQUIREMENT-LOG-1` Logs — severity: low');
-    expect(md).toContain('## Assertions without evidence — ASSERT-007 (0)');
-  });
-});
-
-// ── Conformance: build canon by ingesting the acme example files ────────────
-
-const examples = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../../../../../tests/fixtures/notation-corpus');
-function ingestDir(canon: ComplianceCanon, dir: string): void {
-  const full = path.join(examples, dir);
-  for (const f of readdirSync(full)) {
-    if (!f.endsWith('.yaml')) continue;
-    ingestComplianceDoc(canon, yaml.load(readFileSync(path.join(full, f), 'utf-8')));
-  }
-}
-
-describe('renderComplianceMarkdown — acme conformance', () => {
-  const canon = emptyCanon();
-  ingestDir(canon, 'product');
-  ingestDir(canon, 'requirement');
-  ingestDir(canon, 'assertion');
-
-  it('matrix marks the dangling PRODUCT-MOBILE-1 row and shows compliant + gaps', () => {
-    const md = renderComplianceMarkdown(canon, { mode: 'matrix' });
-    expect(md).toContain('PRODUCT-MOBILE-1 ⚠');
-    expect(md).toContain('Compliant');
-    expect(md).toContain('—'); // at least one gap dash
-  });
-
-  it('gap report surfaces the un-asserted audit-log requirement', () => {
-    const md = renderComplianceMarkdown(canon, { mode: 'gap' }, { today: '2026-06-02' });
-    expect(md).toContain('`REQUIREMENT-AUDIT-LOG-RETENTION-1`');
-  });
-});
-
-describe('gapMarkdown CV-5 pastDeadlineRequirements section', () => {
-  it('includes the 4th section in output', () => {
-    const canon = emptyCanon();
-    ingestComplianceDoc(canon, { notation: 'requirement', id: 'REQ-PD-1', name: 'Past', deadline: '2020-01-01' });
-    const md = renderComplianceMarkdown(canon, { mode: 'gap' }, { today: '2026-06-09' });
-    expect(md).toContain('Past-deadline requirements');
-    expect(md).toContain('REQ-PD-1');
-    expect(md).toContain('2020-01-01');
-    expect(md).toContain('4 checks');
-  });
-});

package/src/compliance/__tests__/trace.test.ts

@@ -1,157 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { buildComplianceIndex } from '../reverse-index.js';
-import { buildRequirementTrace, buildTraceElementCatalog } from '../trace.js';
-import type { ComplianceIndexInput } from '../types.js';
-import type { ComplianceCodexDoc } from '../classify.js';
-
-// Requirement traceability + hierarchy view.
-//
-// The two halves the view exposes:
-//   1. Trace chain — derived_from → REQUIREMENT → ASSERTION → subject +
-//      realised_via.
-//   2. Hierarchy — parent chain + children via the `parent` field
-//      (15-requirement.md §2.4 / ELEMENT_PRIMITIVES.md §7.13).
-
-const input: ComplianceIndexInput = {
-  requirements: [
-    // A broad legislative parent decomposed into two child requirements.
-    { id: 'REQUIREMENT-DATA-PROTECTION-1', name: 'Personal-data protection', origin: 'legislative', derived_from: ['REGULATION-GDPR-2016-1'], element_kind: 'requirement' },
-    { id: 'REQUIREMENT-DATA-ERASURE-1',    name: 'Erase on request within 30 days', origin: 'legislative', parent: 'REQUIREMENT-DATA-PROTECTION-1', derived_from: ['REGULATION-GDPR-2016-1'], element_kind: 'requirement' },
-    { id: 'REQUIREMENT-DATA-CONSENT-1',    name: 'Obtain consent before processing', origin: 'legislative', parent: 'REQUIREMENT-DATA-PROTECTION-1', element_kind: 'requirement' },
-    // A process-product sub-requirement below the erasure duty (cross-origin).
-    { id: 'REQUIREMENT-ERASURE-SLA-1',     name: 'Erasure SOP — 30d target', origin: 'process-product', parent: 'REQUIREMENT-DATA-ERASURE-1', element_kind: 'requirement' },
-    // Constraint hierarchy (mirror pattern).
-    { id: 'CONSTRAINT-EEA-TRANSFER-1',     name: 'No transfer outside EEA without safeguards', element_kind: 'constraint' },
-    { id: 'CONSTRAINT-EEA-ANALYTICS-1',    name: 'No PII in analytics logs', parent: 'CONSTRAINT-EEA-TRANSFER-1', element_kind: 'constraint' },
-    // Internal-only requirement — no source, no parent — for the empty-case sanity check.
-    { id: 'REQUIREMENT-INTERNAL-1',        name: 'Internal-only', element_kind: 'requirement' },
-  ],
-  assertions: [
-    { id: 'ASSERTION-1', about: 'REQUIREMENT-DATA-ERASURE-1', subject: 'PRODUCT-MOBILE-1', realised_via: ['CAPABILITY-V1', 'PROCESS-PURGE-1'], status: 'compliant' },
-    { id: 'ASSERTION-2', about: 'REQUIREMENT-DATA-ERASURE-1', subject: 'PRODUCT-WEB-1',    status: 'partial' },
-    { id: 'ASSERTION-3', about: 'REQUIREMENT-DATA-CONSENT-1', subject: 'PRODUCT-WEB-1',    status: 'compliant' },
-  ],
-};
-
-const codex: ComplianceCodexDoc[] = [
-  { id: 'REGULATION-GDPR-2016-1', name: 'GDPR', type: 'REGULATION', jurisdiction: 'EU' },
-];
-
-const catalog = buildTraceElementCatalog(
-  [{ id: 'PRODUCT-MOBILE-1', name: 'Mobile app' }, { id: 'PRODUCT-WEB-1', name: 'Web app' }],
-  [{ id: 'CAPABILITY-V1', name: 'Erasure capability v1' }, { id: 'PROCESS-PURGE-1', name: 'Purge process' }],
-);
-
-describe('buildComplianceIndex — requirementsByParent', () => {
-  const idx = buildComplianceIndex(input);
-  it('groups children of the same parent', () => {
-    const children = idx.requirementsByParent.get('REQUIREMENT-DATA-PROTECTION-1');
-    expect(children?.map(r => r.id).sort()).toEqual(['REQUIREMENT-DATA-CONSENT-1', 'REQUIREMENT-DATA-ERASURE-1']);
-  });
-  it('groups CONSTRAINT children the same way (element_kind-agnostic)', () => {
-    const children = idx.requirementsByParent.get('CONSTRAINT-EEA-TRANSFER-1');
-    expect(children?.map(r => r.id)).toEqual(['CONSTRAINT-EEA-ANALYTICS-1']);
-  });
-  it('returns undefined for a leaf with no children', () => {
-    expect(idx.requirementsByParent.has('REQUIREMENT-INTERNAL-1')).toBe(false);
-  });
-});
-
-describe('buildRequirementTrace — trace chain', () => {
-  const idx = buildComplianceIndex(input);
-  it('resolves derived_from codex artefacts on the sources block', () => {
-    const trace = buildRequirementTrace('REQUIREMENT-DATA-ERASURE-1', idx, catalog, codex);
-    expect(trace.sources).toHaveLength(1);
-    expect(trace.sources[0].id).toBe('REGULATION-GDPR-2016-1');
-    expect(trace.sources[0].codex?.jurisdiction).toBe('EU');
-  });
-  it('keeps a dangling derived_from ref with no codex when the artefact is missing', () => {
-    const local: ComplianceIndexInput = {
-      requirements: [{ id: 'REQUIREMENT-X-1', name: 'X', derived_from: ['LAW-MISSING-1'] }],
-      assertions: [],
-    };
-    const trace = buildRequirementTrace('REQUIREMENT-X-1', buildComplianceIndex(local), catalog);
-    expect(trace.sources).toEqual([{ id: 'LAW-MISSING-1' }]);
-  });
-  it('lists ASSERTIONs id-sorted, each with resolved subject + realised_via names', () => {
-    const trace = buildRequirementTrace('REQUIREMENT-DATA-ERASURE-1', idx, catalog, codex);
-    expect(trace.assertions.map(a => a.assertion.id)).toEqual(['ASSERTION-1', 'ASSERTION-2']);
-    expect(trace.assertions[0].subject).toEqual({ id: 'PRODUCT-MOBILE-1', name: 'Mobile app' });
-    expect(trace.assertions[0].realisedVia.map(r => r.name)).toEqual(['Erasure capability v1', 'Purge process']);
-  });
-  it('returns an empty assertions list for a REQUIREMENT with no filed claim', () => {
-    const trace = buildRequirementTrace('REQUIREMENT-DATA-PROTECTION-1', idx, catalog);
-    expect(trace.assertions).toEqual([]);
-  });
-  it('returns an empty assertions list for a CONSTRAINT (16-assertion.md §1 — CONSTRAINT-side out of v1)', () => {
-    const trace = buildRequirementTrace('CONSTRAINT-EEA-TRANSFER-1', idx, catalog);
-    expect(trace.assertions).toEqual([]);
-  });
-  it('falls back to id when the subject / realised_via element is not in the catalog (dangling ref)', () => {
-    const local: ComplianceIndexInput = {
-      requirements: [{ id: 'REQUIREMENT-Y-1', name: 'Y' }],
-      assertions: [{ id: 'ASSERTION-9', about: 'REQUIREMENT-Y-1', subject: 'PRODUCT-GONE-1', realised_via: ['CAPABILITY-GONE-1'], status: 'n_a' }],
-    };
-    const trace = buildRequirementTrace('REQUIREMENT-Y-1', buildComplianceIndex(local), catalog);
-    expect(trace.assertions[0].subject).toEqual({ id: 'PRODUCT-GONE-1' });
-    expect(trace.assertions[0].realisedVia).toEqual([{ id: 'CAPABILITY-GONE-1' }]);
-  });
-});
-
-describe('buildRequirementTrace — hierarchy', () => {
-  const idx = buildComplianceIndex(input);
-  it('walks ancestors: immediate parent first, root last', () => {
-    const trace = buildRequirementTrace('REQUIREMENT-ERASURE-SLA-1', idx, catalog);
-    expect(trace.ancestors.map(r => r.id)).toEqual([
-      'REQUIREMENT-DATA-ERASURE-1',
-      'REQUIREMENT-DATA-PROTECTION-1',
-    ]);
-  });
-  it('lists direct children id-sorted', () => {
-    const trace = buildRequirementTrace('REQUIREMENT-DATA-PROTECTION-1', idx, catalog);
-    expect(trace.children.map(r => r.id)).toEqual([
-      'REQUIREMENT-DATA-CONSENT-1',
-      'REQUIREMENT-DATA-ERASURE-1',
-    ]);
-  });
-  it('handles a top-level requirement (no ancestors) with no children', () => {
-    const trace = buildRequirementTrace('REQUIREMENT-INTERNAL-1', idx, catalog);
-    expect(trace.ancestors).toEqual([]);
-    expect(trace.children).toEqual([]);
-  });
-  it('supports CONSTRAINT hierarchy the same way', () => {
-    const trace = buildRequirementTrace('CONSTRAINT-EEA-ANALYTICS-1', idx, catalog);
-    expect(trace.ancestors.map(r => r.id)).toEqual(['CONSTRAINT-EEA-TRANSFER-1']);
-  });
-  it('terminates at a missing parent without throwing (broken model)', () => {
-    const local: ComplianceIndexInput = {
-      requirements: [{ id: 'REQUIREMENT-ORPHAN-1', name: 'Orphan', parent: 'REQUIREMENT-GONE-1' }],
-      assertions: [],
-    };
-    const trace = buildRequirementTrace('REQUIREMENT-ORPHAN-1', buildComplianceIndex(local), catalog);
-    expect(trace.ancestors).toEqual([]);
-  });
-  it('breaks a parent cycle rather than looping', () => {
-    // A → B → A (misauthored).
-    const local: ComplianceIndexInput = {
-      requirements: [
-        { id: 'REQUIREMENT-A-1', name: 'A', parent: 'REQUIREMENT-B-1' },
-        { id: 'REQUIREMENT-B-1', name: 'B', parent: 'REQUIREMENT-A-1' },
-      ],
-      assertions: [],
-    };
-    const trace = buildRequirementTrace('REQUIREMENT-A-1', buildComplianceIndex(local), catalog);
-    expect(trace.ancestors.map(r => r.id)).toEqual(['REQUIREMENT-B-1']);
-  });
-});
-
-describe('buildRequirementTrace — dangling target', () => {
-  it('returns a stub carrying the id as name when the requirement is not scanned', () => {
-    const trace = buildRequirementTrace('REQUIREMENT-UNKNOWN-1', buildComplianceIndex({ requirements: [], assertions: [] }), catalog);
-    expect(trace.requirement).toEqual({ id: 'REQUIREMENT-UNKNOWN-1', name: 'REQUIREMENT-UNKNOWN-1' });
-    expect(trace.sources).toEqual([]);
-    expect(trace.assertions).toEqual([]);
-    expect(trace.ancestors).toEqual([]);
-    expect(trace.children).toEqual([]);
-  });
-});

package/src/compliance/__tests__/view-resolution.test.ts

@@ -1,80 +0,0 @@
-import { describe, it, expect } from 'vitest';
-
-import { emptyCanon } from '../classify.js';
-import { catalogFromMap } from '../canon-catalog.js';
-import { collectImpactViewResolutionFindings } from '../impact.js';
-import { collectCoverageViewResolutionFindings } from '../coverage-metric.js';
-import type { ImpactViewConfig } from '../impact.js';
-import type { CoverageMetricConfig } from '../coverage-metric.js';
-
-const catalog = catalogFromMap(
-  new Map([
-    ['PRODUCT-ECOMM-1', 'PRODUCT'],
-    ['REQUIREMENT-GDPR-1', 'REQUIREMENT'],
-    ['LAW-GDPR-1', 'LAW'],
-  ]),
-);
-
-const complianceCanon = emptyCanon();
-complianceCanon.products.push({ id: 'PRODUCT-ECOMM-1', name: 'E-Commerce' });
-complianceCanon.requirements.push({ id: 'REQUIREMENT-GDPR-1', name: 'GDPR req' });
-complianceCanon.codex.push({ id: 'LAW-GDPR-1', name: 'GDPR' });
-
-describe('collectImpactViewResolutionFindings', () => {
-  const base: ImpactViewConfig = {
-    id: 'test-impact',
-    name: 'Test',
-    subjects: { products: ['PRODUCT-ECOMM-1'], processes: [], capabilities: [] },
-    obligations: { filter: { derived_from_codex: ['LAW-GDPR-1'] } },
-    status_display: { show: ['compliant'] },
-    empty_cells: {},
-    order_rows_by: 'id',
-  };
-
-  it('passes when subjects and regimes resolve', () => {
-    expect(collectImpactViewResolutionFindings(base, catalog, complianceCanon)).toEqual([]);
-  });
-
-  it('flags unresolved subjects and regimes', () => {
-    const findings = collectImpactViewResolutionFindings(
-      {
-        ...base,
-        subjects: { products: ['PRODUCT-MISSING-1'], processes: [], capabilities: [] },
-        obligations: { include: ['REQUIREMENT-MISSING-1'], filter: { derived_from_codex: ['LAW-MISSING-1'] } },
-      },
-      catalog,
-      complianceCanon,
-    );
-    expect(findings.some((f) => f.code === 'COMPIMP-REF' && f.message.includes('PRODUCT-MISSING-1'))).toBe(true);
-    expect(findings.some((f) => f.message.includes('REQUIREMENT-MISSING-1'))).toBe(true);
-    expect(findings.some((f) => f.message.includes('LAW-MISSING-1'))).toBe(true);
-  });
-});
-
-describe('collectCoverageViewResolutionFindings', () => {
-  const base: CoverageMetricConfig = {
-    id: 'test-coverage',
-    name: 'Test',
-    thresholds: { green: 0.9, amber: 0.7 },
-    subjects: { products: ['PRODUCT-ECOMM-1'] },
-    regimes: { include: ['LAW-GDPR-1'] },
-  };
-
-  it('passes when products and regimes resolve', () => {
-    expect(collectCoverageViewResolutionFindings(base, catalog, complianceCanon)).toEqual([]);
-  });
-
-  it('flags unresolved product and regime refs', () => {
-    const findings = collectCoverageViewResolutionFindings(
-      {
-        ...base,
-        subjects: { products: ['PRODUCT-MISSING-1'] },
-        regimes: { include: ['LAW-MISSING-1'] },
-      },
-      catalog,
-      complianceCanon,
-    );
-    expect(findings.some((f) => f.code === 'COVMET-REF')).toBe(true);
-    expect(findings).toHaveLength(2);
-  });
-});

package/src/compliance/__tests__/views.test.ts

@@ -1,64 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { buildComplianceIndex } from '../reverse-index.js';
-import { buildLawTree, buildProductView } from '../views.js';
-import type { ComplianceIndexInput } from '../types.js';
-
-const input: ComplianceIndexInput = {
-  requirements: [
-    { id: 'REQUIREMENT-A-1', name: 'A', severity: 'high', derived_from: ['LAW-X-1'] },
-    { id: 'REQUIREMENT-B-1', name: 'B', severity: 'low', derived_from: ['LAW-X-1', 'REGULATION-Y-1'] },
-    { id: 'REQUIREMENT-C-1', name: 'C' }, // internal-only, no law
-  ],
-  assertions: [
-    { id: 'ASSERTION-2', about: 'REQUIREMENT-A-1', subject: 'PRODUCT-M-1', status: 'compliant' },
-    { id: 'ASSERTION-1', about: 'REQUIREMENT-A-1', subject: 'CAPABILITY-V2', status: 'under_review' },
-    { id: 'ASSERTION-3', about: 'REQUIREMENT-B-1', subject: 'PRODUCT-M-1', status: 'partial' },
-  ],
-};
-
-describe('buildComplianceIndex', () => {
-  const idx = buildComplianceIndex(input);
-  it('indexes requirements by the laws they derive from', () => {
-    expect(idx.requirementsByLaw.get('LAW-X-1')?.map(r => r.id)).toEqual(['REQUIREMENT-A-1', 'REQUIREMENT-B-1']);
-    expect(idx.requirementsByLaw.get('REGULATION-Y-1')?.map(r => r.id)).toEqual(['REQUIREMENT-B-1']);
-    expect(idx.requirementsByLaw.has('LAW-NONE-1')).toBe(false);
-  });
-  it('indexes assertions by requirement and by subject', () => {
-    expect(idx.assertionsByRequirement.get('REQUIREMENT-A-1')?.map(a => a.id).sort()).toEqual(['ASSERTION-1', 'ASSERTION-2']);
-    expect(idx.assertionsBySubject.get('PRODUCT-M-1')?.map(a => a.id).sort()).toEqual(['ASSERTION-2', 'ASSERTION-3']);
-  });
-});
-
-describe('buildLawTree', () => {
-  const idx = buildComplianceIndex(input);
-  it('lists requirements derived from the law, each with its id-sorted assertions', () => {
-    const tree = buildLawTree('LAW-X-1', idx);
-    expect(tree.requirements.map(r => r.requirement.id)).toEqual(['REQUIREMENT-A-1', 'REQUIREMENT-B-1']);
-    expect(tree.requirements[0].assertions.map(a => a.id)).toEqual(['ASSERTION-1', 'ASSERTION-2']);
-    expect(tree.requirements[0].assertions.map(a => a.status)).toEqual(['under_review', 'compliant']);
-  });
-  it('returns an empty tree for an unknown law', () => {
-    expect(buildLawTree('LAW-NONE-1', idx).requirements).toEqual([]);
-  });
-});
-
-describe('buildProductView', () => {
-  const idx = buildComplianceIndex(input);
-  it('lists the requirements the product is asserted against, with status, requirement-id-sorted', () => {
-    const view = buildProductView('PRODUCT-M-1', idx);
-    expect(view.requirements.map(r => r.requirement.id)).toEqual(['REQUIREMENT-A-1', 'REQUIREMENT-B-1']);
-    expect(view.requirements.map(r => r.assertion.status)).toEqual(['compliant', 'partial']);
-    expect(view.requirements[0].requirement.name).toBe('A');
-  });
-  it('falls back to the id as name when the requirement is not in the scan (dangling about)', () => {
-    const idx2 = buildComplianceIndex({
-      requirements: [],
-      assertions: [{ id: 'ASSERTION-9', about: 'REQUIREMENT-GONE-1', subject: 'PRODUCT-M-1', status: 'n_a' }],
-    });
-    const view = buildProductView('PRODUCT-M-1', idx2);
-    expect(view.requirements[0].requirement).toEqual({ id: 'REQUIREMENT-GONE-1', name: 'REQUIREMENT-GONE-1' });
-  });
-  it('returns an empty view for a product with no assertions', () => {
-    expect(buildProductView('PRODUCT-NONE-1', idx).requirements).toEqual([]);
-  });
-});

package/src/compliance-matrix/__tests__/build.test.ts

@@ -1,200 +0,0 @@
-import { describe, it, expect } from 'vitest';
-import { buildComplianceMatrix, filterComplianceMatrix } from '../build.js';
-import type { ComplianceMatrixInput } from '../types.js';
-
-function input(over: Partial<ComplianceMatrixInput> = {}): ComplianceMatrixInput {
-  return {
-    products: [
-      { id: 'PRODUCT-ECOMM-1', name: 'E-Commerce' },
-      { id: 'PRODUCT-SUPPORT-1', name: 'Support' },
-    ],
-    requirements: [
-      { id: 'REQUIREMENT-DATA-ERASURE-1', name: 'Erasure', severity: 'high' },
-      { id: 'REQUIREMENT-AUDIT-LOG-RETENTION-1', name: 'Audit logs', severity: 'medium' },
-    ],
-    assertions: [
-      { id: 'ASSERTION-1', about: 'REQUIREMENT-DATA-ERASURE-1', subject: 'PRODUCT-ECOMM-1', status: 'compliant' },
-    ],
-    ...over,
-  };
-}
-
-describe('buildComplianceMatrix', () => {
-  it('sorts products as rows and requirements as columns by id', () => {
-    const m = buildComplianceMatrix(input());
-    expect(m.products.map(p => p.id)).toEqual(['PRODUCT-ECOMM-1', 'PRODUCT-SUPPORT-1']);
-    expect(m.requirements.map(r => r.id)).toEqual([
-      'REQUIREMENT-AUDIT-LOG-RETENTION-1',
-      'REQUIREMENT-DATA-ERASURE-1',
-    ]);
-  });
-
-  it('places an assertion status in the (product, requirement) cell and gaps elsewhere', () => {
-    const m = buildComplianceMatrix(input());
-    // row 0 = ECOMM; col 1 = DATA-ERASURE (after the sort)
-    expect(m.cells[0][1]).toMatchObject({ status: 'compliant', assertionId: 'ASSERTION-1' });
-    expect(m.cells[0][0].status).toBeUndefined(); // ECOMM × AUDIT-LOG → gap
-    expect(m.cells[1][1].status).toBeUndefined(); // SUPPORT × DATA-ERASURE → gap
-    expect(m.summary).toMatchObject({ products: 2, requirements: 2, assertions: 1, gaps: 3 });
-  });
-
-  it('adds a product-typed assertion subject with no product file as an unresolved row', () => {
-    const m = buildComplianceMatrix(input({
-      assertions: [
-        { id: 'A1', about: 'REQUIREMENT-DATA-ERASURE-1', subject: 'PRODUCT-MOBILE-1', status: 'partial' },
-      ],
-    }));
-    const mobile = m.products.find(p => p.id === 'PRODUCT-MOBILE-1');
-    expect(mobile).toMatchObject({ unresolved: true });
-    const col = m.requirements.findIndex(r => r.id === 'REQUIREMENT-DATA-ERASURE-1');
-    const row = m.products.findIndex(p => p.id === 'PRODUCT-MOBILE-1');
-    expect(m.cells[row][col].status).toBe('partial');
-  });
-
-  it('ignores assertions whose subject is not a PRODUCT', () => {
-    const m = buildComplianceMatrix(input({
-      assertions: [
-        { id: 'A1', about: 'REQUIREMENT-DATA-ERASURE-1', subject: 'CAPABILITY-V2', status: 'compliant' },
-        { id: 'A2', about: 'REQUIREMENT-DATA-ERASURE-1', subject: 'PROCESS-X-1', status: 'partial' },
-      ],
-    }));
-    expect(m.summary.assertions).toBe(0);
-    expect(m.products.map(p => p.id)).toEqual(['PRODUCT-ECOMM-1', 'PRODUCT-SUPPORT-1']);
-  });
-});
-
-describe('buildComplianceMatrix — jurisdiction resolution (F16)', () => {
-  it('resolves Requirement.jurisdictions from derived_from → codex', () => {
-    const m = buildComplianceMatrix(input({
-      requirements: [
-        { id: 'REQUIREMENT-DATA-ERASURE-1', name: 'Erasure', severity: 'high',
-          derived_from: ['LAW-PERSONAL-DATA-2017-1'] },
-        { id: 'REQUIREMENT-AUDIT-LOG-RETENTION-1', name: 'Audit logs', severity: 'medium',
-          derived_from: ['LAW-AUDIT-2020-1', 'LAW-PERSONAL-DATA-2017-1'] },
-      ],
-      codex: [
-        { id: 'LAW-PERSONAL-DATA-2017-1', jurisdiction: 'ge' },
-        { id: 'LAW-AUDIT-2020-1', jurisdiction: 'eu' },
-      ],
-    }));
-    const erasure = m.requirements.find(r => r.id === 'REQUIREMENT-DATA-ERASURE-1')!;
-    const audit = m.requirements.find(r => r.id === 'REQUIREMENT-AUDIT-LOG-RETENTION-1')!;
-    expect(erasure.jurisdictions).toEqual(['ge']);
-    // Sorted, deduplicated union.
-    expect(audit.jurisdictions).toEqual(['eu', 'ge']);
-  });
-
-  it('leaves jurisdictions undefined when no codex source resolves', () => {
-    const m = buildComplianceMatrix(input({
-      requirements: [
-        { id: 'REQUIREMENT-INTERNAL-1', name: 'Internal', severity: 'low' },
-        { id: 'REQUIREMENT-DANGLING-1', name: 'Dangling', severity: 'low',
-          derived_from: ['LAW-MISSING-1'] },
-      ],
-      codex: [{ id: 'LAW-OTHER-1', jurisdiction: 'us' }],
-    }));
-    expect(m.requirements.find(r => r.id === 'REQUIREMENT-INTERNAL-1')!.jurisdictions).toBeUndefined();
-    expect(m.requirements.find(r => r.id === 'REQUIREMENT-DANGLING-1')!.jurisdictions).toBeUndefined();
-  });
-
-  it('ignores codex entries with no jurisdiction (e.g. internal POLICY)', () => {
-    const m = buildComplianceMatrix(input({
-      requirements: [
-        { id: 'REQUIREMENT-DATA-ERASURE-1', name: 'Erasure', severity: 'high',
-          derived_from: ['POLICY-INTERNAL-1'] },
-      ],
-      codex: [{ id: 'POLICY-INTERNAL-1' }],
-    }));
-    expect(m.requirements[0].jurisdictions).toBeUndefined();
-  });
-
-  it('works with no codex input (backwards-compatible)', () => {
-    const m = buildComplianceMatrix(input({
-      requirements: [
-        { id: 'REQUIREMENT-DATA-ERASURE-1', name: 'Erasure', severity: 'high',
-          derived_from: ['LAW-PERSONAL-DATA-2017-1'] },
-      ],
-    }));
-    expect(m.requirements[0].jurisdictions).toBeUndefined();
-  });
-});
-
-describe('filterComplianceMatrix', () => {
-  it('trims requirement columns by severity', () => {
-    const m = buildComplianceMatrix(input());
-    const f = filterComplianceMatrix(m, { severities: ['high'] });
-    expect(f.requirements.map(r => r.id)).toEqual(['REQUIREMENT-DATA-ERASURE-1']);
-    expect(f.cells[0]).toHaveLength(1);
-    expect(f.cells[0][0]).toMatchObject({ status: 'compliant' });
-  });
-
-  it('blanks cells whose status is filtered out, preserving the grid shape', () => {
-    const m = buildComplianceMatrix(input());
-    const f = filterComplianceMatrix(m, { statuses: ['non_compliant'] });
-    // The compliant cell is now hidden (treated as a gap); columns unchanged.
-    expect(f.requirements).toHaveLength(2);
-    expect(f.cells[0][1].status).toBeUndefined();
-    expect(f.summary.assertions).toBe(0);
-  });
-
-  it('is a no-op when no filter dimension is set', () => {
-    const m = buildComplianceMatrix(input());
-    const f = filterComplianceMatrix(m, {});
-    expect(f.summary).toEqual(m.summary);
-  });
-
-  it('keeps only columns whose resolved jurisdiction is in the filter (F16)', () => {
-    const m = buildComplianceMatrix(input({
-      requirements: [
-        { id: 'REQUIREMENT-DATA-ERASURE-1', name: 'Erasure', severity: 'high',
-          derived_from: ['LAW-PERSONAL-DATA-2017-1'] },
-        { id: 'REQUIREMENT-AUDIT-LOG-RETENTION-1', name: 'Audit logs', severity: 'medium',
-          derived_from: ['LAW-AUDIT-2020-1'] },
-      ],
-      codex: [
-        { id: 'LAW-PERSONAL-DATA-2017-1', jurisdiction: 'ge' },
-        { id: 'LAW-AUDIT-2020-1', jurisdiction: 'eu' },
-      ],
-    }));
-    const f = filterComplianceMatrix(m, { jurisdictions: ['ge'] });
-    expect(f.requirements.map(r => r.id)).toEqual(['REQUIREMENT-DATA-ERASURE-1']);
-    expect(f.cells[0]).toHaveLength(1);
-  });
-
-  it('drops requirements with no resolved jurisdiction when the filter is active', () => {
-    const m = buildComplianceMatrix(input({
-      requirements: [
-        { id: 'REQUIREMENT-DATA-ERASURE-1', name: 'Erasure', severity: 'high',
-          derived_from: ['LAW-PERSONAL-DATA-2017-1'] },
-        { id: 'REQUIREMENT-INTERNAL-1', name: 'Internal', severity: 'low' },
-      ],
-      codex: [{ id: 'LAW-PERSONAL-DATA-2017-1', jurisdiction: 'ge' }],
-    }));
-    const f = filterComplianceMatrix(m, { jurisdictions: ['ge'] });
-    expect(f.requirements.map(r => r.id)).toEqual(['REQUIREMENT-DATA-ERASURE-1']);
-  });
-
-  it('combines jurisdiction filter with severity (intersection)', () => {
-    const m = buildComplianceMatrix(input({
-      requirements: [
-        { id: 'REQUIREMENT-DATA-ERASURE-1', name: 'Erasure', severity: 'high',
-          derived_from: ['LAW-PERSONAL-DATA-2017-1'] },
-        { id: 'REQUIREMENT-DATA-PORTABILITY-1', name: 'Portability', severity: 'medium',
-          derived_from: ['LAW-PERSONAL-DATA-2017-1'] },
-      ],
-      codex: [{ id: 'LAW-PERSONAL-DATA-2017-1', jurisdiction: 'ge' }],
-    }));
-    const f = filterComplianceMatrix(m, { jurisdictions: ['ge'], severities: ['high'] });
-    expect(f.requirements.map(r => r.id)).toEqual(['REQUIREMENT-DATA-ERASURE-1']);
-  });
-
-  it('empty jurisdiction array is treated as no-filter on that dimension', () => {
-    const m = buildComplianceMatrix(input({
-      requirements: [
-        { id: 'REQUIREMENT-INTERNAL-1', name: 'Internal', severity: 'low' },
-      ],
-    }));
-    const f = filterComplianceMatrix(m, { jurisdictions: [] });
-    expect(f.requirements).toHaveLength(1);
-  });
-});

package/src/compliance-matrix/__tests__/example.test.ts

@@ -1,57 +0,0 @@
-// Conformance test — the compliance matrix on the acme_corp worked examples
-// (mirrored under tests/fixtures/notation-corpus/product, tests/fixtures/notation-corpus/requirement, tests/fixtures/notation-corpus/assertion).
-// Pins the #84 Phase 2 acceptance: the matrix renders correctly and gaps are
-// obvious.
-
-import { describe, it, expect } from 'vitest';
-import { readdirSync, readFileSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
-import path from 'node:path';
-import yaml from 'js-yaml';
-import { buildComplianceMatrix } from '../build.js';
-import type { MatrixAssertionRef, MatrixProduct, MatrixRequirement } from '../types.js';
-
-const examples = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../../../../../tests/fixtures/notation-corpus');
-function loadAll(dir: string): Record<string, unknown>[] {
-  const full = path.join(examples, dir);
-  return readdirSync(full)
-    .filter(f => f.endsWith('.yaml'))
-    .map(f => yaml.load(readFileSync(path.join(full, f), 'utf-8')) as Record<string, unknown>);
-}
-
-describe('compliance matrix — acme_corp worked examples', () => {
-  const products: MatrixProduct[] = loadAll('product').map(p => ({ id: String(p.id), name: String(p.name) }));
-  const requirements: MatrixRequirement[] = loadAll('requirement').map(r => ({
-    id: String(r.id), name: String(r.name), severity: r.severity as string | undefined,
-  }));
-  const assertions: MatrixAssertionRef[] = loadAll('assertion').map(a => ({
-    id: String(a.id), about: String(a.about), subject: String(a.subject),
-    status: a.status as MatrixAssertionRef['status'],
-    assessed_at: a.assessed_at as string | undefined,
-    next_review_at: a.next_review_at as string | undefined,
-  }));
-
-  const m = buildComplianceMatrix({ products, requirements, assertions });
-
-  it('rows = the two product files plus the dangling PRODUCT-MOBILE-1 subject', () => {
-    expect(m.products.map(p => p.id)).toEqual([
-      'PRODUCT-ECOMM-1', 'PRODUCT-MOBILE-1', 'PRODUCT-SUPPORT-1',
-    ]);
-    expect(m.products.find(p => p.id === 'PRODUCT-MOBILE-1')?.unresolved).toBe(true);
-  });
-
-  it('columns = the two requirements', () => {
-    expect(m.requirements.map(r => r.id)).toEqual([
-      'REQUIREMENT-AUDIT-LOG-RETENTION-1', 'REQUIREMENT-DATA-ERASURE-1',
-    ]);
-  });
-
-  it('the only product-subject assertion (mobile → data-erasure) is compliant; everything else is a gap', () => {
-    const row = m.products.findIndex(p => p.id === 'PRODUCT-MOBILE-1');
-    const col = m.requirements.findIndex(r => r.id === 'REQUIREMENT-DATA-ERASURE-1');
-    expect(m.cells[row][col]).toMatchObject({ status: 'compliant', assertionId: 'ASSERTION-MOBILE-DATA-ERASURE-1' });
-    // 3 products × 2 requirements = 6 cells; 1 filled → 5 gaps. The CRM
-    // (capability) and onboarding (process) assertions are not in the matrix.
-    expect(m.summary).toMatchObject({ products: 3, requirements: 2, assertions: 1, gaps: 5 });
-  });
-});