@waratahlabs/canopy 0.5.0 → 0.6.0

package/dist/aivss/scoring/a2a-corpus.test.js

@@ -1,109 +0,0 @@
-/**
- * A2A corpus regression — deterministic scoring against real agent definitions.
- *
- * The unit tests prove the scorer is pure over a hand-written fixture. This
- * proves it stays stable over a corpus of ~25 real agent topologies harvested
- * from a2aproject/a2a-samples, which is where scoring changes actually show up:
- * a threshold tweak that looks harmless against one synthetic agent will move
- * severities across a real corpus.
- *
- * Regenerate the corpus with a checkout of a2a-samples:
- *
- *   bun scripts/harvest-a2a-samples.ts path/to/a2a-samples
- *
- * That writes tests/fixtures/a2a/input/<agent>.json (the synthesized
- * AgentDefinitions) and tests/fixtures/a2a/expected/<agent>.tc.json (the
- * assessed artifact). This test re-derives the expected output from the input
- * and diffs.
- *
- * A diff here is not automatically a bug. It means emitted scores moved, which
- * per CONTRIBUTING.md is a breaking change requiring a major version bump — so
- * the diff should be reviewed, then the corpus regenerated in the same commit
- * that changes the scoring.
- *
- * The suite skips cleanly when the corpus is absent, so a fresh clone without
- * fixtures is green rather than red.
- */
-import { describe, expect, test } from "bun:test";
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { fileURLToPath } from "node:url";
-import { heuristicSeverity } from "./heuristic-scorer.js";
-import { assembleTCFormat, severityKey, slotKey } from "../../output/tc-assembler.js";
-import { ATLAS_COVERAGE_MATRIX } from "../atlas/coverage-matrix.js";
-import { loadAtlasData } from "../atlas/loader.js";
-import { resolveAtlasYaml } from "../atlas/resolve-path.js";
-const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../..");
-const INPUT_DIR = path.join(repoRoot, "tests/fixtures/a2a/input");
-const EXPECTED_DIR = path.join(repoRoot, "tests/fixtures/a2a/expected");
-function corpusCases() {
-    if (!fs.existsSync(INPUT_DIR))
-        return [];
-    return fs
-        .readdirSync(INPUT_DIR)
-        .filter((f) => f.endsWith(".json"))
-        .map((f) => f.replace(/\.json$/, ""))
-        .sort();
-}
-const cases = corpusCases();
-// Normalise away the only field that legitimately varies between runs.
-const normalise = (doc) => JSON.stringify(doc).replace(/"Generated: [^"\\]+?  \\n/, '"Generated: <ts>  \\n');
-function assess(input) {
-    const atlasData = loadAtlasData(resolveAtlasYaml());
-    const severityBySubCategory = new Map();
-    const filledSlots = new Map();
-    for (const agent of input.agents) {
-        for (const entry of ATLAS_COVERAGE_MATRIX) {
-            severityBySubCategory.set(severityKey(agent.id, entry.metric, entry.subCategory), heuristicSeverity(agent, entry.metric, entry.subCategory));
-            const techniqueId = entry.atlasTechniqueIds[0];
-            if (!techniqueId)
-                continue;
-            const technique = atlasData.techniqueById.get(techniqueId);
-            if (!technique)
-                continue;
-            filledSlots.set(slotKey(agent.id, techniqueId, entry.metric, entry.subCategory), {
-                threatSource: "A threat actor",
-                prerequisites: `with access to ${agent.name}`,
-                threatAction: `exploit ${entry.subCategory.toLowerCase()} via ${technique.id}`,
-                threatImpact: `compromise ${agent.name}`,
-                impactedGoal: ["confidentiality", "integrity"],
-                impactedAssets: [agent.name.toLowerCase()],
-            });
-        }
-    }
-    return assembleTCFormat({
-        agents: input.agents,
-        handoffs: input.handoffs ?? [],
-        metricResponses: [],
-        atlasData,
-        coverageMatrix: ATLAS_COVERAGE_MATRIX,
-        filledSlots,
-        severityBySubCategory,
-        applicationName: input.applicationName,
-        scoringMode: "deterministic",
-    });
-}
-describe.skipIf(cases.length === 0)("a2a corpus regression", () => {
-    test("corpus has both halves of every golden pair", () => {
-        for (const name of cases) {
-            expect(fs.existsSync(path.join(EXPECTED_DIR, `${name}.tc.json`))).toBe(true);
-        }
-    });
-    test.each(cases)("%s scores identically to its committed artifact", (name) => {
-        const input = JSON.parse(fs.readFileSync(path.join(INPUT_DIR, `${name}.json`), "utf8"));
-        const expected = JSON.parse(fs.readFileSync(path.join(EXPECTED_DIR, `${name}.tc.json`), "utf8"));
-        expect(normalise(assess(input))).toBe(normalise(expected));
-    });
-    test.each(cases)("%s re-assesses identically within a single run", (name) => {
-        const input = JSON.parse(fs.readFileSync(path.join(INPUT_DIR, `${name}.json`), "utf8"));
-        expect(normalise(assess(input))).toBe(normalise(assess(input)));
-    });
-});
-// Visible when the corpus is missing, so an absent harness reads as a stated
-// gap rather than silent green.
-describe.skipIf(cases.length > 0)("a2a corpus regression (not present)", () => {
-    test("corpus is absent — regenerate with scripts/harvest-a2a-samples.ts", () => {
-        expect(cases.length).toBe(0);
-    });
-});
-//# sourceMappingURL=a2a-corpus.test.js.map

package/dist/aivss/scoring/a2a-corpus.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"a2a-corpus.test.js","sourceRoot":"","sources":["../../../src/aivss/scoring/a2a-corpus.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAClD,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAI5D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;AACxF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC;AAClE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,6BAA6B,CAAC,CAAC;AAQxE,SAAS,WAAW;IAClB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IACzC,OAAO,EAAE;SACN,WAAW,CAAC,SAAS,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;SAClC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;SACpC,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;AAE5B,uEAAuE;AACvE,MAAM,SAAS,GAAG,CAAC,GAAY,EAAU,EAAE,CACzC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,2BAA2B,EAAE,uBAAuB,CAAC,CAAC;AAEpF,SAAS,MAAM,CAAC,KAAkB;IAChC,MAAM,SAAS,GAAG,aAAa,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACpD,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC/D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAE,CAAC;IAE9B,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,KAAK,MAAM,KAAK,IAAI,qBAAqB,EAAE,CAAC;YAC1C,qBAAqB,CAAC,GAAG,CACvB,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,EACtD,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAC1D,CAAC;YACF,MAAM,WAAW,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC/C,IAAI,CAAC,WAAW;gBAAE,SAAS;YAC3B,MAAM,SAAS,GAAG,SAAS,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC3D,IAAI,CAAC,SAAS;gBAAE,SAAS;YACzB,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE;gBAC/E,YAAY,EAAE,gBAAgB;gBAC9B,aAAa,EAAE,kBAAkB,KAAK,CAAC,IAAI,EAAE;gBAC7C,YAAY,EAAE,WAAW,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,QAAQ,SAAS,CAAC,EAAE,EAAE;gBAC9E,YAAY,EAAE,cAAc,KAAK,CAAC,IAAI,EAAE;gBACxC,YAAY,EAAE,CAAC,iBAAiB,EAAE,WAAW,CAAC;gBAC9C,cAAc,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;aAC3C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,gBAAgB,CAAC;QACtB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE;QAC9B,eAAe,EAAE,EAAE;QACnB,SAAS;QACT,cAAc,EAAE,qBAAqB;QACrC,WAAW;QACX,qBAAqB;QACrB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,WAAW,EAAE,eAAe;KAC7B,CAAC,CAAC;AACL,CAAC;AAED,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,uBAAuB,EAAE,GAAG,EAAE;IAChE,IAAI,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACvD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,iDAAiD,EAAE,CAAC,IAAI,EAAE,EAAE;QAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CACtB,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,OAAO,CAAC,EAAE,MAAM,CAAC,CAC/C,CAAC;QACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,IAAI,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAEjG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,gDAAgD,EAAE,CAAC,IAAI,EAAE,EAAE;QAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CACtB,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,OAAO,CAAC,EAAE,MAAM,CAAC,CAC/C,CAAC;QACjB,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,6EAA6E;AAC7E,gCAAgC;AAChC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,qCAAqC,EAAE,GAAG,EAAE;IAC5E,IAAI,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC7E,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/aivss/scoring/determinism.test.d.ts

@@ -1,16 +0,0 @@
-/**
- * Determinism — the property that makes a Canopy score defensible.
- *
- * A security engineer has to be able to say where a number came from. CVSS is
- * trusted because the vector string lets anyone recompute it; OpenSSF Scorecard
- * because every check's rule is readable. Canopy's deterministic mode makes the
- * same promise, and these tests are what keep it honest.
- *
- * Two distinct claims are covered:
- *   1. The heuristic scorer is a pure function of the agent definition.
- *   2. The assembled artifact is byte-stable apart from its generation
- *      timestamp — which required replacing random threat ids with
- *      content-derived ones.
- */
-export {};
-//# sourceMappingURL=determinism.test.d.ts.map

package/dist/aivss/scoring/determinism.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"determinism.test.d.ts","sourceRoot":"","sources":["../../../src/aivss/scoring/determinism.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG"}

package/dist/aivss/scoring/determinism.test.js

@@ -1,169 +0,0 @@
-/**
- * Determinism — the property that makes a Canopy score defensible.
- *
- * A security engineer has to be able to say where a number came from. CVSS is
- * trusted because the vector string lets anyone recompute it; OpenSSF Scorecard
- * because every check's rule is readable. Canopy's deterministic mode makes the
- * same promise, and these tests are what keep it honest.
- *
- * Two distinct claims are covered:
- *   1. The heuristic scorer is a pure function of the agent definition.
- *   2. The assembled artifact is byte-stable apart from its generation
- *      timestamp — which required replacing random threat ids with
- *      content-derived ones.
- */
-import { describe, expect, test } from "bun:test";
-import { heuristicSeverity } from "./heuristic-scorer.js";
-import { SCORING_MODE_INFO, SCORING_MODES, reproducibilityWarning } from "./scoring-mode.js";
-import { assembleTCFormat, severityKey, slotKey } from "../../output/tc-assembler.js";
-import { ATLAS_COVERAGE_MATRIX } from "../atlas/coverage-matrix.js";
-import { loadAtlasData } from "../atlas/loader.js";
-import { resolveAtlasYaml } from "../atlas/resolve-path.js";
-const AGENT = {
-    id: "agent-det-1",
-    name: "Determinism Fixture",
-    model: "claude-sonnet-4-6",
-    systemPrompt: "You process mortgage applications end to end.",
-    tools: [
-        { name: "shell", description: "Run shell commands", dangerous: true },
-        { name: "credit_check", description: "Query the credit bureau", dangerous: true },
-    ],
-    permissions: ["read:applications", "write:decisions", "execute:scripts"],
-    deploymentContext: "FinancialServices",
-    modelComplexity: "Complex",
-    mitigationMultiplier: 1.0,
-    finetuned: false,
-    dependencies: ["document-store", "credit-api"],
-    secretManagement: "env",
-    deployment: "AWS ECS Fargate",
-};
-describe("heuristic scorer is a pure function", () => {
-    test("repeated scoring of the same input yields identical severities", () => {
-        const runOnce = () => ATLAS_COVERAGE_MATRIX.map((e) => heuristicSeverity(AGENT, e.metric, e.subCategory));
-        const first = runOnce();
-        for (let i = 0; i < 25; i++) {
-            expect(runOnce()).toEqual(first);
-        }
-    });
-    test("scoring does not mutate the agent definition", () => {
-        const before = JSON.stringify(AGENT);
-        for (const e of ATLAS_COVERAGE_MATRIX)
-            heuristicSeverity(AGENT, e.metric, e.subCategory);
-        expect(JSON.stringify(AGENT)).toBe(before);
-    });
-    test("a materially riskier agent does not score lower", () => {
-        // Guards the direction of the scoring rules: removing every mitigation and
-        // granting dangerous capability must not reduce severity. Catches an
-        // inverted comparison, which a pure-determinism test would happily pass.
-        const hardened = { ...AGENT, mitigationMultiplier: 0.5, tools: [], permissions: ["read:applications"] };
-        const rank = { None: 0, Low: 1, Medium: 2, High: 3, Critical: 4 };
-        let exposedTotal = 0;
-        let hardenedTotal = 0;
-        for (const e of ATLAS_COVERAGE_MATRIX) {
-            exposedTotal += rank[heuristicSeverity(AGENT, e.metric, e.subCategory)];
-            hardenedTotal += rank[heuristicSeverity(hardened, e.metric, e.subCategory)];
-        }
-        expect(exposedTotal).toBeGreaterThan(hardenedTotal);
-    });
-});
-describe("assembled artifact is byte-stable", () => {
-    const atlasData = loadAtlasData(resolveAtlasYaml());
-    function build() {
-        const severityBySubCategory = new Map();
-        const filledSlots = new Map();
-        for (const e of ATLAS_COVERAGE_MATRIX) {
-            const severity = heuristicSeverity(AGENT, e.metric, e.subCategory);
-            severityBySubCategory.set(severityKey(AGENT.id, e.metric, e.subCategory), severity);
-            const techniqueId = e.atlasTechniqueIds[0];
-            if (!techniqueId || !atlasData.techniqueById.get(techniqueId))
-                continue;
-            filledSlots.set(slotKey(AGENT.id, techniqueId, e.metric, e.subCategory), {
-                threatSource: "A threat actor",
-                prerequisites: `with access to ${AGENT.name}`,
-                threatAction: `exploit ${e.subCategory.toLowerCase()}`,
-                threatImpact: `compromise ${AGENT.name}`,
-                impactedGoal: ["confidentiality"],
-                impactedAssets: [AGENT.name.toLowerCase()],
-            });
-        }
-        return assembleTCFormat({
-            agents: [AGENT],
-            handoffs: [],
-            metricResponses: [],
-            atlasData,
-            coverageMatrix: ATLAS_COVERAGE_MATRIX,
-            filledSlots,
-            severityBySubCategory,
-            applicationName: "Determinism Fixture App",
-            scoringMode: "deterministic",
-        });
-    }
-    // The audit trail carries a wall-clock generation time, which is legitimately
-    // different every run. Everything else must match byte for byte.
-    const stripTimestamp = (d) => JSON.stringify({
-        ...d,
-        applicationInfo: {
-            ...d.applicationInfo,
-            description: (d.applicationInfo?.description ?? "").replace(/Generated: [^\s]+/, "Generated: <ts>"),
-        },
-    });
-    test("two runs produce identical output apart from the timestamp", () => {
-        expect(stripTimestamp(build())).toBe(stripTimestamp(build()));
-    });
-    test("threat ids are content-derived, not random", () => {
-        // Regression guard: ids were crypto.randomUUID(), so structurally identical
-        // artifacts differed byte-wise every run and diffs were unusable.
-        const a = build();
-        const b = build();
-        const aThreats = a.threats ?? [];
-        const bThreats = b.threats ?? [];
-        expect(aThreats.map((t) => t.id)).toEqual(bThreats.map((t) => t.id));
-        expect(new Set(aThreats.map((t) => t.id)).size).toBe(aThreats.length);
-        for (const t of aThreats) {
-            expect(t.id).toMatch(/^[0-9a-f]{8}-[0-9a-f]{4}-5[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/);
-        }
-    });
-    test("every threat records the scoring mode that produced it", () => {
-        const doc = build();
-        const docThreats = doc.threats ?? [];
-        expect(docThreats.length).toBeGreaterThan(0);
-        for (const threat of docThreats) {
-            const mode = threat.metadata?.find((m) => m.key === "custom:scoring-mode")?.value;
-            expect(mode).toBe("deterministic");
-        }
-    });
-    test("the audit trail states the mode and its reproducibility", () => {
-        const description = build().applicationInfo?.description ?? "";
-        expect(description).toContain("Scoring mode: deterministic");
-        expect(description).toContain("Reproducible: yes");
-    });
-    test("a non-reproducible mode is labelled as such", () => {
-        const severityBySubCategory = new Map();
-        const doc = assembleTCFormat({
-            agents: [AGENT],
-            handoffs: [],
-            metricResponses: [],
-            atlasData,
-            coverageMatrix: ATLAS_COVERAGE_MATRIX,
-            filledSlots: new Map(),
-            severityBySubCategory,
-            applicationName: "Harness Run",
-            scoringMode: "harness",
-        });
-        expect(doc.applicationInfo?.description ?? "").toContain("Scoring mode: harness");
-        expect(doc.applicationInfo?.description ?? "").toContain("Reproducible: no");
-    });
-});
-describe("scoring mode metadata", () => {
-    test("exactly one mode is reproducible, and it needs no credentials", () => {
-        const reproducible = SCORING_MODES.filter((m) => SCORING_MODE_INFO[m].reproducible);
-        expect(reproducible).toEqual(["deterministic"]);
-        expect(SCORING_MODE_INFO.deterministic.requiresCredentials).toBe(false);
-    });
-    test("non-reproducible modes warn, the reproducible one does not", () => {
-        expect(reproducibilityWarning("deterministic")).toBeNull();
-        expect(reproducibilityWarning("model")).toContain("not reproducible");
-        expect(reproducibilityWarning("harness")).toContain("not reproducible");
-    });
-});
-//# sourceMappingURL=determinism.test.js.map

package/dist/aivss/scoring/determinism.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"determinism.test.js","sourceRoot":"","sources":["../../../src/aivss/scoring/determinism.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC7F,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAG5D,MAAM,KAAK,GAAoB;IAC7B,EAAE,EAAE,aAAa;IACjB,IAAI,EAAE,qBAAqB;IAC3B,KAAK,EAAE,mBAAmB;IAC1B,YAAY,EAAE,+CAA+C;IAC7D,KAAK,EAAE;QACL,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,SAAS,EAAE,IAAI,EAAE;QACrE,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,yBAAyB,EAAE,SAAS,EAAE,IAAI,EAAE;KAClF;IACD,WAAW,EAAE,CAAC,mBAAmB,EAAE,iBAAiB,EAAE,iBAAiB,CAAC;IACxE,iBAAiB,EAAE,mBAAmB;IACtC,eAAe,EAAE,SAAS;IAC1B,oBAAoB,EAAE,GAAG;IACzB,SAAS,EAAE,KAAK;IAChB,YAAY,EAAE,CAAC,gBAAgB,EAAE,YAAY,CAAC;IAC9C,gBAAgB,EAAE,KAAK;IACvB,UAAU,EAAE,iBAAiB;CAC9B,CAAC;AAEF,QAAQ,CAAC,qCAAqC,EAAE,GAAG,EAAE;IACnD,IAAI,CAAC,gEAAgE,EAAE,GAAG,EAAE;QAC1E,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QAEtF,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC;QACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5B,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,qBAAqB;YAAE,iBAAiB,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;QACzF,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,iDAAiD,EAAE,GAAG,EAAE;QAC3D,2EAA2E;QAC3E,qEAAqE;QACrE,yEAAyE;QACzE,MAAM,QAAQ,GAAoB,EAAE,GAAG,KAAK,EAAE,oBAAoB,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACzH,MAAM,IAAI,GAAkC,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QAEjG,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,KAAK,MAAM,CAAC,IAAI,qBAAqB,EAAE,CAAC;YACtC,YAAY,IAAI,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;YACxE,aAAa,IAAI,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,CAAC,YAAY,CAAC,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;IACjD,MAAM,SAAS,GAAG,aAAa,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAEpD,SAAS,KAAK;QACZ,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAyB,CAAC;QAC/D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,qBAAqB,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;YACnE,qBAAqB,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,CAAC;YACpF,MAAM,WAAW,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC3C,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC;gBAAE,SAAS;YACxE,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE;gBACvE,YAAY,EAAE,gBAAgB;gBAC9B,aAAa,EAAE,kBAAkB,KAAK,CAAC,IAAI,EAAE;gBAC7C,YAAY,EAAE,WAAW,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE;gBACtD,YAAY,EAAE,cAAc,KAAK,CAAC,IAAI,EAAE;gBACxC,YAAY,EAAE,CAAC,iBAAiB,CAAC;gBACjC,cAAc,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;aAC3C,CAAC,CAAC;QACL,CAAC;QACD,OAAO,gBAAgB,CAAC;YACtB,MAAM,EAAE,CAAC,KAAK,CAAC;YACf,QAAQ,EAAE,EAAE;YACZ,eAAe,EAAE,EAAE;YACnB,SAAS;YACT,cAAc,EAAE,qBAAqB;YACrC,WAAW;YACX,qBAAqB;YACrB,eAAe,EAAE,yBAAyB;YAC1C,WAAW,EAAE,eAAe;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,iEAAiE;IACjE,MAAM,cAAc,GAAG,CAAC,CAA2B,EAAE,EAAE,CACrD,IAAI,CAAC,SAAS,CAAC;QACb,GAAG,CAAC;QACJ,eAAe,EAAE;YACf,GAAG,CAAC,CAAC,eAAe;YACpB,WAAW,EAAE,CAAC,CAAC,CAAC,eAAe,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,OAAO,CACzD,mBAAmB,EACnB,iBAAiB,CAClB;SACF;KACF,CAAC,CAAC;IAEL,IAAI,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACtE,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACtD,4EAA4E;QAC5E,kEAAkE;QAClE,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC;QAClB,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC;QAClB,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;QACjC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrE,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtE,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,uEAAuE,CAAC,CAAC;QAChG,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAClE,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;QACpB,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;QACrC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC7C,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,qBAAqB,CAAC,EAAE,KAAK,CAAC;YAClF,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACrC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACnE,MAAM,WAAW,GAAG,KAAK,EAAE,CAAC,eAAe,EAAE,WAAW,IAAI,EAAE,CAAC;QAC/D,MAAM,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC;QAC7D,MAAM,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACvD,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAyB,CAAC;QAC/D,MAAM,GAAG,GAAG,gBAAgB,CAAC;YAC3B,MAAM,EAAE,CAAC,KAAK,CAAC;YACf,QAAQ,EAAE,EAAE;YACZ,eAAe,EAAE,EAAE;YACnB,SAAS;YACT,cAAc,EAAE,qBAAqB;YACrC,WAAW,EAAE,IAAI,GAAG,EAAE;YACtB,qBAAqB;YACrB,eAAe,EAAE,aAAa;YAC9B,WAAW,EAAE,SAAS;SACvB,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAClF,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,IAAI,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACzE,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QACpF,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,iBAAiB,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACtE,MAAM,CAAC,sBAAsB,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACtE,MAAM,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/aivss/scoring/scoring-mode.d.ts

@@ -1,48 +0,0 @@
-/**
- * Scoring provenance — how a severity in the output was actually arrived at.
- *
- * Why this exists: a score you cannot reproduce is not evidence. CVSS earned
- * practitioner trust because the vector string lets anyone recompute the
- * number; OpenSSF Scorecard because every check documents its own rule. Canopy
- * emitted a number with no statement of how it was produced, and the three
- * possible provenances have very different reproducibility properties:
- *
- * - `deterministic` — the heuristic scorer. Pure function of the
- *   AgentDefinition. Same input always yields the same score, on any machine,
- *   with no network and no credentials. Auditable: every rule is readable in
- *   heuristic-scorer.ts.
- *
- * - `model` — a provider (Bedrock / Anthropic) classified each sub-category.
- *   Richer reasoning, but NOT reproducible: temperature, model version, and
- *   provider-side changes all move the result. Two runs a month apart can
- *   legitimately differ.
- *
- * - `harness` — the calling LLM agent answered the assessment prompts itself
- *   via HarnessBatchProvider. Least reproducible of the three, because the
- *   model doing the reasoning is whatever happened to be driving the harness.
- *   Excellent for zero-credential exploration; not something to put in front
- *   of an auditor as a stable measurement.
- *
- * A consumer gating CI on Canopy baselines needs `deterministic`. Someone
- * exploring a new system interactively is well served by `harness`. The defect
- * was never offering the choice, or recording which one produced the artifact.
- */
-export type ScoringMode = "deterministic" | "model" | "harness";
-export declare const SCORING_MODES: readonly ScoringMode[];
-export interface ScoringModeDescriptor {
-    mode: ScoringMode;
-    /** Whether identical input is guaranteed to yield identical scores. */
-    reproducible: boolean;
-    /** Whether the mode needs provider credentials or network access. */
-    requiresCredentials: boolean;
-    /** One-line description for the audit trail in emitted artifacts. */
-    summary: string;
-}
-export declare const SCORING_MODE_INFO: Record<ScoringMode, ScoringModeDescriptor>;
-/**
- * Human-facing warning shown when a run's scoring mode carries a
- * reproducibility caveat the operator should know about before quoting the
- * numbers. Returns null when no warning is warranted.
- */
-export declare function reproducibilityWarning(mode: ScoringMode): string | null;
-//# sourceMappingURL=scoring-mode.d.ts.map

package/dist/aivss/scoring/scoring-mode.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"scoring-mode.d.ts","sourceRoot":"","sources":["../../../src/aivss/scoring/scoring-mode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,MAAM,MAAM,WAAW,GAAG,eAAe,GAAG,OAAO,GAAG,SAAS,CAAC;AAEhE,eAAO,MAAM,aAAa,EAAE,SAAS,WAAW,EAAmD,CAAC;AAEpG,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,WAAW,CAAC;IAClB,uEAAuE;IACvE,YAAY,EAAE,OAAO,CAAC;IACtB,qEAAqE;IACrE,mBAAmB,EAAE,OAAO,CAAC;IAC7B,qEAAqE;IACrE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE,qBAAqB,CAsBxE,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,GAAG,IAAI,CAQvE"}

package/dist/aivss/scoring/scoring-mode.js

@@ -1,64 +0,0 @@
-/**
- * Scoring provenance — how a severity in the output was actually arrived at.
- *
- * Why this exists: a score you cannot reproduce is not evidence. CVSS earned
- * practitioner trust because the vector string lets anyone recompute the
- * number; OpenSSF Scorecard because every check documents its own rule. Canopy
- * emitted a number with no statement of how it was produced, and the three
- * possible provenances have very different reproducibility properties:
- *
- * - `deterministic` — the heuristic scorer. Pure function of the
- *   AgentDefinition. Same input always yields the same score, on any machine,
- *   with no network and no credentials. Auditable: every rule is readable in
- *   heuristic-scorer.ts.
- *
- * - `model` — a provider (Bedrock / Anthropic) classified each sub-category.
- *   Richer reasoning, but NOT reproducible: temperature, model version, and
- *   provider-side changes all move the result. Two runs a month apart can
- *   legitimately differ.
- *
- * - `harness` — the calling LLM agent answered the assessment prompts itself
- *   via HarnessBatchProvider. Least reproducible of the three, because the
- *   model doing the reasoning is whatever happened to be driving the harness.
- *   Excellent for zero-credential exploration; not something to put in front
- *   of an auditor as a stable measurement.
- *
- * A consumer gating CI on Canopy baselines needs `deterministic`. Someone
- * exploring a new system interactively is well served by `harness`. The defect
- * was never offering the choice, or recording which one produced the artifact.
- */
-export const SCORING_MODES = ["deterministic", "model", "harness"];
-export const SCORING_MODE_INFO = {
-    deterministic: {
-        mode: "deterministic",
-        reproducible: true,
-        requiresCredentials: false,
-        summary: "Heuristic scorer — pure function of the agent definition. Byte-identical across runs; every rule auditable in heuristic-scorer.ts.",
-    },
-    model: {
-        mode: "model",
-        reproducible: false,
-        requiresCredentials: true,
-        summary: "Provider inference (Bedrock/Anthropic) classified each sub-category. Richer reasoning; not reproducible across model versions.",
-    },
-    harness: {
-        mode: "harness",
-        reproducible: false,
-        requiresCredentials: false,
-        summary: "The calling LLM agent answered assessment prompts directly. Zero-credential; reproducibility depends on the driving model.",
-    },
-};
-/**
- * Human-facing warning shown when a run's scoring mode carries a
- * reproducibility caveat the operator should know about before quoting the
- * numbers. Returns null when no warning is warranted.
- */
-export function reproducibilityWarning(mode) {
-    const info = SCORING_MODE_INFO[mode];
-    if (info.reproducible)
-        return null;
-    return (`canopy: scoring mode "${mode}" is not reproducible — ${info.summary}\n` +
-        `        Re-running may yield different scores. Use --deterministic for a\n` +
-        `        stable, auditable score suitable for CI gating or an audit trail.\n`);
-}
-//# sourceMappingURL=scoring-mode.js.map

package/dist/aivss/scoring/scoring-mode.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"scoring-mode.js","sourceRoot":"","sources":["../../../src/aivss/scoring/scoring-mode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAIH,MAAM,CAAC,MAAM,aAAa,GAA2B,CAAC,eAAe,EAAE,OAAO,EAAE,SAAS,CAAU,CAAC;AAYpG,MAAM,CAAC,MAAM,iBAAiB,GAA+C;IAC3E,aAAa,EAAE;QACb,IAAI,EAAE,eAAe;QACrB,YAAY,EAAE,IAAI;QAClB,mBAAmB,EAAE,KAAK;QAC1B,OAAO,EACL,oIAAoI;KACvI;IACD,KAAK,EAAE;QACL,IAAI,EAAE,OAAO;QACb,YAAY,EAAE,KAAK;QACnB,mBAAmB,EAAE,IAAI;QACzB,OAAO,EACL,gIAAgI;KACnI;IACD,OAAO,EAAE;QACP,IAAI,EAAE,SAAS;QACf,YAAY,EAAE,KAAK;QACnB,mBAAmB,EAAE,KAAK;QAC1B,OAAO,EACL,4HAA4H;KAC/H;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAiB;IACtD,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,CACL,yBAAyB,IAAI,2BAA2B,IAAI,CAAC,OAAO,IAAI;QACxE,4EAA4E;QAC5E,6EAA6E,CAC9E,CAAC;AACJ,CAAC"}

package/dist/references/registry-parity.test.d.ts

@@ -1,17 +0,0 @@
-/**
- * Framework parity — package metadata must match what the engine registers.
- *
- * Why this test exists: the package advertised "OWASP, NIST AI RMF" in its
- * description and keywords while src/references/index.ts registered only three
- * adapters. NIST and OWASP Agentic Top 10 had complete risk catalogues but
- * never assembled a FrameworkAdapter, and NemoClaw assembled one that was
- * never registered. A user reading the package page would have expected
- * framework annotations that the engine could not produce.
- *
- * For a tool whose product is trust, an advertised-but-absent framework is a
- * correctness defect, not a documentation lag. This test makes the drift
- * mechanical to catch: add an adapter without advertising it, or advertise one
- * without registering it, and the suite fails.
- */
-export {};
-//# sourceMappingURL=registry-parity.test.d.ts.map

package/dist/references/registry-parity.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"registry-parity.test.d.ts","sourceRoot":"","sources":["../../src/references/registry-parity.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG"}

package/dist/references/registry-parity.test.js

@@ -1,87 +0,0 @@
-/**
- * Framework parity — package metadata must match what the engine registers.
- *
- * Why this test exists: the package advertised "OWASP, NIST AI RMF" in its
- * description and keywords while src/references/index.ts registered only three
- * adapters. NIST and OWASP Agentic Top 10 had complete risk catalogues but
- * never assembled a FrameworkAdapter, and NemoClaw assembled one that was
- * never registered. A user reading the package page would have expected
- * framework annotations that the engine could not produce.
- *
- * For a tool whose product is trust, an advertised-but-absent framework is a
- * correctness defect, not a documentation lag. This test makes the drift
- * mechanical to catch: add an adapter without advertising it, or advertise one
- * without registering it, and the suite fails.
- */
-import { describe, expect, test } from "bun:test";
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { fileURLToPath } from "node:url";
-import { FRAMEWORK_REGISTRY, REGISTERED_FRAMEWORK_IDS } from "./index.js";
-const packageJsonPath = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../package.json");
-const pkg = JSON.parse(fs.readFileSync(packageJsonPath, "utf8"));
-describe("framework registry parity", () => {
-    test("package.json declares a canopy.frameworks list", () => {
-        expect(Array.isArray(pkg.canopy?.frameworks)).toBe(true);
-        expect(pkg.canopy.frameworks.length).toBeGreaterThan(0);
-    });
-    test("advertised frameworks exactly match registered adapters", () => {
-        const advertised = [...pkg.canopy.frameworks].sort();
-        // Set equality in both directions — an adapter registered but not
-        // advertised is as much a defect as the reverse, because the README and
-        // package page under-report what the tool actually does.
-        expect(advertised).toEqual(REGISTERED_FRAMEWORK_IDS);
-    });
-    test("no duplicate framework ids are registered", () => {
-        const ids = FRAMEWORK_REGISTRY.map((a) => a.citation.id);
-        expect(new Set(ids).size).toBe(ids.length);
-    });
-});
-describe("registered adapters are well-formed", () => {
-    test.each(FRAMEWORK_REGISTRY.map((a) => [a.citation.id, a]))("%s carries a complete citation and a non-empty risk list", (_id, adapter) => {
-        expect(adapter.citation.title.length).toBeGreaterThan(0);
-        expect(adapter.citation.authors.length).toBeGreaterThan(0);
-        expect(adapter.citation.url).toMatch(/^https?:\/\//);
-        expect(adapter.citation.year).toBeGreaterThan(2000);
-        expect(adapter.risks.length).toBeGreaterThan(0);
-    });
-    test.each(FRAMEWORK_REGISTRY.map((a) => [a.citation.id, a]))("%s risks declare the framework id they belong to", (id, adapter) => {
-        for (const risk of adapter.risks) {
-            expect(risk.framework).toBe(id);
-        }
-    });
-    test.each(FRAMEWORK_REGISTRY.map((a) => [a.citation.id, a]))("%s risk ids are unique within the framework", (_id, adapter) => {
-        const ids = adapter.risks.map((r) => r.id);
-        expect(new Set(ids).size).toBe(ids.length);
-    });
-    test.each(FRAMEWORK_REGISTRY.map((a) => [a.citation.id, a]))("%s cites only real ATLAS technique ids", (_id, adapter) => {
-        // Shape check rather than a lookup against vendored ATLAS: this catches
-        // the failure mode competitors have shipped — a model asked to "attach a
-        // technique id" inventing a plausible-looking one.
-        for (const risk of adapter.risks) {
-            for (const techniqueId of risk.atlasTechniqueIds) {
-                expect(techniqueId).toMatch(/^AML\.T\d{4}(\.\d{3})?$/);
-            }
-        }
-    });
-    test.each(FRAMEWORK_REGISTRY.map((a) => [a.citation.id, a]))("%s risks declare a valid riskType and known AIVSS metrics", (_id, adapter) => {
-        const validMetrics = new Set([
-            "MR",
-            "DS",
-            "EI",
-            "DC",
-            "AD",
-            "AA",
-            "LL",
-            "GV",
-            "CS",
-        ]);
-        for (const risk of adapter.risks) {
-            expect(["security", "ethical", "compliance"]).toContain(risk.riskType);
-            for (const metric of risk.aivssMetrics) {
-                expect(validMetrics.has(metric)).toBe(true);
-            }
-        }
-    });
-});
-//# sourceMappingURL=registry-parity.test.js.map

package/dist/references/registry-parity.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"registry-parity.test.js","sourceRoot":"","sources":["../../src/references/registry-parity.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAClD,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG1E,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAClC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAC5C,oBAAoB,CACrB,CAAC;AAEF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAE9D,CAAC;AAEF,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,IAAI,CAAC,gDAAgD,EAAE,GAAG,EAAE;QAC1D,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,CAAC,GAAG,CAAC,MAAO,CAAC,UAAW,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACnE,MAAM,UAAU,GAAG,CAAC,GAAG,GAAG,CAAC,MAAO,CAAC,UAAW,CAAC,CAAC,IAAI,EAAE,CAAC;QACvD,kEAAkE;QAClE,wEAAwE;QACxE,yDAAyD;QACzD,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACrD,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACzD,MAAM,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qCAAqC,EAAE,GAAG,EAAE;IACnD,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAU,CAAC,CAAC,CACnE,0DAA0D,EAC1D,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;QACf,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC3D,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACrD,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CACF,CAAC;IAEF,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAU,CAAC,CAAC,CACnE,kDAAkD,EAClD,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE;QACd,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAU,CAAC,CAAC,CACnE,6CAA6C,EAC7C,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;QACf,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC,CACF,CAAC;IAEF,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAU,CAAC,CAAC,CACnE,wCAAwC,EACxC,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;QACf,wEAAwE;QACxE,yEAAyE;QACzE,mDAAmD;QACnD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACjC,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACjD,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAU,CAAC,CAAC,CACnE,2DAA2D,EAC3D,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;QACf,MAAM,YAAY,GAAG,IAAI,GAAG,CAAa;YACvC,IAAI;YACJ,IAAI;YACJ,IAAI;YACJ,IAAI;YACJ,IAAI;YACJ,IAAI;YACJ,IAAI;YACJ,IAAI;YACJ,IAAI;SACL,CAAC,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACjC,MAAM,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvE,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACvC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC"}