@waratahlabs/canopy 0.5.0

package/dist/aivss/scoring/a2a-corpus.test.js

@@ -0,0 +1,109 @@
+/**
+ * A2A corpus regression — deterministic scoring against real agent definitions.
+ *
+ * The unit tests prove the scorer is pure over a hand-written fixture. This
+ * proves it stays stable over a corpus of ~25 real agent topologies harvested
+ * from a2aproject/a2a-samples, which is where scoring changes actually show up:
+ * a threshold tweak that looks harmless against one synthetic agent will move
+ * severities across a real corpus.
+ *
+ * Regenerate the corpus with a checkout of a2a-samples:
+ *
+ *   bun scripts/harvest-a2a-samples.ts path/to/a2a-samples
+ *
+ * That writes tests/fixtures/a2a/input/<agent>.json (the synthesized
+ * AgentDefinitions) and tests/fixtures/a2a/expected/<agent>.tc.json (the
+ * assessed artifact). This test re-derives the expected output from the input
+ * and diffs.
+ *
+ * A diff here is not automatically a bug. It means emitted scores moved, which
+ * per CONTRIBUTING.md is a breaking change requiring a major version bump — so
+ * the diff should be reviewed, then the corpus regenerated in the same commit
+ * that changes the scoring.
+ *
+ * The suite skips cleanly when the corpus is absent, so a fresh clone without
+ * fixtures is green rather than red.
+ */
+import { describe, expect, test } from "bun:test";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+import { heuristicSeverity } from "./heuristic-scorer.js";
+import { assembleTCFormat, severityKey, slotKey } from "../../output/tc-assembler.js";
+import { ATLAS_COVERAGE_MATRIX } from "../atlas/coverage-matrix.js";
+import { loadAtlasData } from "../atlas/loader.js";
+import { resolveAtlasYaml } from "../atlas/resolve-path.js";
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../..");
+const INPUT_DIR = path.join(repoRoot, "tests/fixtures/a2a/input");
+const EXPECTED_DIR = path.join(repoRoot, "tests/fixtures/a2a/expected");
+function corpusCases() {
+    if (!fs.existsSync(INPUT_DIR))
+        return [];
+    return fs
+        .readdirSync(INPUT_DIR)
+        .filter((f) => f.endsWith(".json"))
+        .map((f) => f.replace(/\.json$/, ""))
+        .sort();
+}
+const cases = corpusCases();
+// Normalise away the only field that legitimately varies between runs.
+const normalise = (doc) => JSON.stringify(doc).replace(/"Generated: [^"\\]+?  \\n/, '"Generated: <ts>  \\n');
+function assess(input) {
+    const atlasData = loadAtlasData(resolveAtlasYaml());
+    const severityBySubCategory = new Map();
+    const filledSlots = new Map();
+    for (const agent of input.agents) {
+        for (const entry of ATLAS_COVERAGE_MATRIX) {
+            severityBySubCategory.set(severityKey(agent.id, entry.metric, entry.subCategory), heuristicSeverity(agent, entry.metric, entry.subCategory));
+            const techniqueId = entry.atlasTechniqueIds[0];
+            if (!techniqueId)
+                continue;
+            const technique = atlasData.techniqueById.get(techniqueId);
+            if (!technique)
+                continue;
+            filledSlots.set(slotKey(agent.id, techniqueId, entry.metric, entry.subCategory), {
+                threatSource: "A threat actor",
+                prerequisites: `with access to ${agent.name}`,
+                threatAction: `exploit ${entry.subCategory.toLowerCase()} via ${technique.id}`,
+                threatImpact: `compromise ${agent.name}`,
+                impactedGoal: ["confidentiality", "integrity"],
+                impactedAssets: [agent.name.toLowerCase()],
+            });
+        }
+    }
+    return assembleTCFormat({
+        agents: input.agents,
+        handoffs: input.handoffs ?? [],
+        metricResponses: [],
+        atlasData,
+        coverageMatrix: ATLAS_COVERAGE_MATRIX,
+        filledSlots,
+        severityBySubCategory,
+        applicationName: input.applicationName,
+        scoringMode: "deterministic",
+    });
+}
+describe.skipIf(cases.length === 0)("a2a corpus regression", () => {
+    test("corpus has both halves of every golden pair", () => {
+        for (const name of cases) {
+            expect(fs.existsSync(path.join(EXPECTED_DIR, `${name}.tc.json`))).toBe(true);
+        }
+    });
+    test.each(cases)("%s scores identically to its committed artifact", (name) => {
+        const input = JSON.parse(fs.readFileSync(path.join(INPUT_DIR, `${name}.json`), "utf8"));
+        const expected = JSON.parse(fs.readFileSync(path.join(EXPECTED_DIR, `${name}.tc.json`), "utf8"));
+        expect(normalise(assess(input))).toBe(normalise(expected));
+    });
+    test.each(cases)("%s re-assesses identically within a single run", (name) => {
+        const input = JSON.parse(fs.readFileSync(path.join(INPUT_DIR, `${name}.json`), "utf8"));
+        expect(normalise(assess(input))).toBe(normalise(assess(input)));
+    });
+});
+// Visible when the corpus is missing, so an absent harness reads as a stated
+// gap rather than silent green.
+describe.skipIf(cases.length > 0)("a2a corpus regression (not present)", () => {
+    test("corpus is absent — regenerate with scripts/harvest-a2a-samples.ts", () => {
+        expect(cases.length).toBe(0);
+    });
+});
+//# sourceMappingURL=a2a-corpus.test.js.map

package/dist/aivss/scoring/a2a-corpus.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"a2a-corpus.test.js","sourceRoot":"","sources":["../../../src/aivss/scoring/a2a-corpus.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAClD,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAI5D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;AACxF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC;AAClE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,6BAA6B,CAAC,CAAC;AAQxE,SAAS,WAAW;IAClB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IACzC,OAAO,EAAE;SACN,WAAW,CAAC,SAAS,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;SAClC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;SACpC,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;AAE5B,uEAAuE;AACvE,MAAM,SAAS,GAAG,CAAC,GAAY,EAAU,EAAE,CACzC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,2BAA2B,EAAE,uBAAuB,CAAC,CAAC;AAEpF,SAAS,MAAM,CAAC,KAAkB;IAChC,MAAM,SAAS,GAAG,aAAa,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACpD,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC/D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAE,CAAC;IAE9B,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,KAAK,MAAM,KAAK,IAAI,qBAAqB,EAAE,CAAC;YAC1C,qBAAqB,CAAC,GAAG,CACvB,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,EACtD,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAC1D,CAAC;YACF,MAAM,WAAW,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC/C,IAAI,CAAC,WAAW;gBAAE,SAAS;YAC3B,MAAM,SAAS,GAAG,SAAS,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC3D,IAAI,CAAC,SAAS;gBAAE,SAAS;YACzB,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE;gBAC/E,YAAY,EAAE,gBAAgB;gBAC9B,aAAa,EAAE,kBAAkB,KAAK,CAAC,IAAI,EAAE;gBAC7C,YAAY,EAAE,WAAW,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,QAAQ,SAAS,CAAC,EAAE,EAAE;gBAC9E,YAAY,EAAE,cAAc,KAAK,CAAC,IAAI,EAAE;gBACxC,YAAY,EAAE,CAAC,iBAAiB,EAAE,WAAW,CAAC;gBAC9C,cAAc,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;aAC3C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,gBAAgB,CAAC;QACtB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE;QAC9B,eAAe,EAAE,EAAE;QACnB,SAAS;QACT,cAAc,EAAE,qBAAqB;QACrC,WAAW;QACX,qBAAqB;QACrB,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,WAAW,EAAE,eAAe;KAC7B,CAAC,CAAC;AACL,CAAC;AAED,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,uBAAuB,EAAE,GAAG,EAAE;IAChE,IAAI,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACvD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,iDAAiD,EAAE,CAAC,IAAI,EAAE,EAAE;QAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CACtB,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,OAAO,CAAC,EAAE,MAAM,CAAC,CAC/C,CAAC;QACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,IAAI,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAEjG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,gDAAgD,EAAE,CAAC,IAAI,EAAE,EAAE;QAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CACtB,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,OAAO,CAAC,EAAE,MAAM,CAAC,CAC/C,CAAC;QACjB,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,6EAA6E;AAC7E,gCAAgC;AAChC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,qCAAqC,EAAE,GAAG,EAAE;IAC5E,IAAI,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC7E,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/aivss/scoring/determinism.test.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Determinism — the property that makes a Canopy score defensible.
+ *
+ * A security engineer has to be able to say where a number came from. CVSS is
+ * trusted because the vector string lets anyone recompute it; OpenSSF Scorecard
+ * because every check's rule is readable. Canopy's deterministic mode makes the
+ * same promise, and these tests are what keep it honest.
+ *
+ * Two distinct claims are covered:
+ *   1. The heuristic scorer is a pure function of the agent definition.
+ *   2. The assembled artifact is byte-stable apart from its generation
+ *      timestamp — which required replacing random threat ids with
+ *      content-derived ones.
+ */
+export {};
+//# sourceMappingURL=determinism.test.d.ts.map

package/dist/aivss/scoring/determinism.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"determinism.test.d.ts","sourceRoot":"","sources":["../../../src/aivss/scoring/determinism.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG"}

package/dist/aivss/scoring/determinism.test.js

@@ -0,0 +1,169 @@
+/**
+ * Determinism — the property that makes a Canopy score defensible.
+ *
+ * A security engineer has to be able to say where a number came from. CVSS is
+ * trusted because the vector string lets anyone recompute it; OpenSSF Scorecard
+ * because every check's rule is readable. Canopy's deterministic mode makes the
+ * same promise, and these tests are what keep it honest.
+ *
+ * Two distinct claims are covered:
+ *   1. The heuristic scorer is a pure function of the agent definition.
+ *   2. The assembled artifact is byte-stable apart from its generation
+ *      timestamp — which required replacing random threat ids with
+ *      content-derived ones.
+ */
+import { describe, expect, test } from "bun:test";
+import { heuristicSeverity } from "./heuristic-scorer.js";
+import { SCORING_MODE_INFO, SCORING_MODES, reproducibilityWarning } from "./scoring-mode.js";
+import { assembleTCFormat, severityKey, slotKey } from "../../output/tc-assembler.js";
+import { ATLAS_COVERAGE_MATRIX } from "../atlas/coverage-matrix.js";
+import { loadAtlasData } from "../atlas/loader.js";
+import { resolveAtlasYaml } from "../atlas/resolve-path.js";
+const AGENT = {
+    id: "agent-det-1",
+    name: "Determinism Fixture",
+    model: "claude-sonnet-4-6",
+    systemPrompt: "You process mortgage applications end to end.",
+    tools: [
+        { name: "shell", description: "Run shell commands", dangerous: true },
+        { name: "credit_check", description: "Query the credit bureau", dangerous: true },
+    ],
+    permissions: ["read:applications", "write:decisions", "execute:scripts"],
+    deploymentContext: "FinancialServices",
+    modelComplexity: "Complex",
+    mitigationMultiplier: 1.0,
+    finetuned: false,
+    dependencies: ["document-store", "credit-api"],
+    secretManagement: "env",
+    deployment: "AWS ECS Fargate",
+};
+describe("heuristic scorer is a pure function", () => {
+    test("repeated scoring of the same input yields identical severities", () => {
+        const runOnce = () => ATLAS_COVERAGE_MATRIX.map((e) => heuristicSeverity(AGENT, e.metric, e.subCategory));
+        const first = runOnce();
+        for (let i = 0; i < 25; i++) {
+            expect(runOnce()).toEqual(first);
+        }
+    });
+    test("scoring does not mutate the agent definition", () => {
+        const before = JSON.stringify(AGENT);
+        for (const e of ATLAS_COVERAGE_MATRIX)
+            heuristicSeverity(AGENT, e.metric, e.subCategory);
+        expect(JSON.stringify(AGENT)).toBe(before);
+    });
+    test("a materially riskier agent does not score lower", () => {
+        // Guards the direction of the scoring rules: removing every mitigation and
+        // granting dangerous capability must not reduce severity. Catches an
+        // inverted comparison, which a pure-determinism test would happily pass.
+        const hardened = { ...AGENT, mitigationMultiplier: 0.5, tools: [], permissions: ["read:applications"] };
+        const rank = { None: 0, Low: 1, Medium: 2, High: 3, Critical: 4 };
+        let exposedTotal = 0;
+        let hardenedTotal = 0;
+        for (const e of ATLAS_COVERAGE_MATRIX) {
+            exposedTotal += rank[heuristicSeverity(AGENT, e.metric, e.subCategory)];
+            hardenedTotal += rank[heuristicSeverity(hardened, e.metric, e.subCategory)];
+        }
+        expect(exposedTotal).toBeGreaterThan(hardenedTotal);
+    });
+});
+describe("assembled artifact is byte-stable", () => {
+    const atlasData = loadAtlasData(resolveAtlasYaml());
+    function build() {
+        const severityBySubCategory = new Map();
+        const filledSlots = new Map();
+        for (const e of ATLAS_COVERAGE_MATRIX) {
+            const severity = heuristicSeverity(AGENT, e.metric, e.subCategory);
+            severityBySubCategory.set(severityKey(AGENT.id, e.metric, e.subCategory), severity);
+            const techniqueId = e.atlasTechniqueIds[0];
+            if (!techniqueId || !atlasData.techniqueById.get(techniqueId))
+                continue;
+            filledSlots.set(slotKey(AGENT.id, techniqueId, e.metric, e.subCategory), {
+                threatSource: "A threat actor",
+                prerequisites: `with access to ${AGENT.name}`,
+                threatAction: `exploit ${e.subCategory.toLowerCase()}`,
+                threatImpact: `compromise ${AGENT.name}`,
+                impactedGoal: ["confidentiality"],
+                impactedAssets: [AGENT.name.toLowerCase()],
+            });
+        }
+        return assembleTCFormat({
+            agents: [AGENT],
+            handoffs: [],
+            metricResponses: [],
+            atlasData,
+            coverageMatrix: ATLAS_COVERAGE_MATRIX,
+            filledSlots,
+            severityBySubCategory,
+            applicationName: "Determinism Fixture App",
+            scoringMode: "deterministic",
+        });
+    }
+    // The audit trail carries a wall-clock generation time, which is legitimately
+    // different every run. Everything else must match byte for byte.
+    const stripTimestamp = (d) => JSON.stringify({
+        ...d,
+        applicationInfo: {
+            ...d.applicationInfo,
+            description: (d.applicationInfo?.description ?? "").replace(/Generated: [^\s]+/, "Generated: <ts>"),
+        },
+    });
+    test("two runs produce identical output apart from the timestamp", () => {
+        expect(stripTimestamp(build())).toBe(stripTimestamp(build()));
+    });
+    test("threat ids are content-derived, not random", () => {
+        // Regression guard: ids were crypto.randomUUID(), so structurally identical
+        // artifacts differed byte-wise every run and diffs were unusable.
+        const a = build();
+        const b = build();
+        const aThreats = a.threats ?? [];
+        const bThreats = b.threats ?? [];
+        expect(aThreats.map((t) => t.id)).toEqual(bThreats.map((t) => t.id));
+        expect(new Set(aThreats.map((t) => t.id)).size).toBe(aThreats.length);
+        for (const t of aThreats) {
+            expect(t.id).toMatch(/^[0-9a-f]{8}-[0-9a-f]{4}-5[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/);
+        }
+    });
+    test("every threat records the scoring mode that produced it", () => {
+        const doc = build();
+        const docThreats = doc.threats ?? [];
+        expect(docThreats.length).toBeGreaterThan(0);
+        for (const threat of docThreats) {
+            const mode = threat.metadata?.find((m) => m.key === "custom:scoring-mode")?.value;
+            expect(mode).toBe("deterministic");
+        }
+    });
+    test("the audit trail states the mode and its reproducibility", () => {
+        const description = build().applicationInfo?.description ?? "";
+        expect(description).toContain("Scoring mode: deterministic");
+        expect(description).toContain("Reproducible: yes");
+    });
+    test("a non-reproducible mode is labelled as such", () => {
+        const severityBySubCategory = new Map();
+        const doc = assembleTCFormat({
+            agents: [AGENT],
+            handoffs: [],
+            metricResponses: [],
+            atlasData,
+            coverageMatrix: ATLAS_COVERAGE_MATRIX,
+            filledSlots: new Map(),
+            severityBySubCategory,
+            applicationName: "Harness Run",
+            scoringMode: "harness",
+        });
+        expect(doc.applicationInfo?.description ?? "").toContain("Scoring mode: harness");
+        expect(doc.applicationInfo?.description ?? "").toContain("Reproducible: no");
+    });
+});
+describe("scoring mode metadata", () => {
+    test("exactly one mode is reproducible, and it needs no credentials", () => {
+        const reproducible = SCORING_MODES.filter((m) => SCORING_MODE_INFO[m].reproducible);
+        expect(reproducible).toEqual(["deterministic"]);
+        expect(SCORING_MODE_INFO.deterministic.requiresCredentials).toBe(false);
+    });
+    test("non-reproducible modes warn, the reproducible one does not", () => {
+        expect(reproducibilityWarning("deterministic")).toBeNull();
+        expect(reproducibilityWarning("model")).toContain("not reproducible");
+        expect(reproducibilityWarning("harness")).toContain("not reproducible");
+    });
+});
+//# sourceMappingURL=determinism.test.js.map

package/dist/aivss/scoring/determinism.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"determinism.test.js","sourceRoot":"","sources":["../../../src/aivss/scoring/determinism.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC7F,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAG5D,MAAM,KAAK,GAAoB;IAC7B,EAAE,EAAE,aAAa;IACjB,IAAI,EAAE,qBAAqB;IAC3B,KAAK,EAAE,mBAAmB;IAC1B,YAAY,EAAE,+CAA+C;IAC7D,KAAK,EAAE;QACL,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,SAAS,EAAE,IAAI,EAAE;QACrE,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,yBAAyB,EAAE,SAAS,EAAE,IAAI,EAAE;KAClF;IACD,WAAW,EAAE,CAAC,mBAAmB,EAAE,iBAAiB,EAAE,iBAAiB,CAAC;IACxE,iBAAiB,EAAE,mBAAmB;IACtC,eAAe,EAAE,SAAS;IAC1B,oBAAoB,EAAE,GAAG;IACzB,SAAS,EAAE,KAAK;IAChB,YAAY,EAAE,CAAC,gBAAgB,EAAE,YAAY,CAAC;IAC9C,gBAAgB,EAAE,KAAK;IACvB,UAAU,EAAE,iBAAiB;CAC9B,CAAC;AAEF,QAAQ,CAAC,qCAAqC,EAAE,GAAG,EAAE;IACnD,IAAI,CAAC,gEAAgE,EAAE,GAAG,EAAE;QAC1E,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QAEtF,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC;QACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5B,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACxD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,qBAAqB;YAAE,iBAAiB,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;QACzF,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,iDAAiD,EAAE,GAAG,EAAE;QAC3D,2EAA2E;QAC3E,qEAAqE;QACrE,yEAAyE;QACzE,MAAM,QAAQ,GAAoB,EAAE,GAAG,KAAK,EAAE,oBAAoB,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACzH,MAAM,IAAI,GAAkC,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QAEjG,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,KAAK,MAAM,CAAC,IAAI,qBAAqB,EAAE,CAAC;YACtC,YAAY,IAAI,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;YACxE,aAAa,IAAI,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,CAAC,YAAY,CAAC,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;IACjD,MAAM,SAAS,GAAG,aAAa,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAEpD,SAAS,KAAK;QACZ,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAyB,CAAC;QAC/D,MAAM,WAAW,GAAG,IAAI,GAAG,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,qBAAqB,EAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;YACnE,qBAAqB,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,CAAC;YACpF,MAAM,WAAW,GAAG,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC3C,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC;gBAAE,SAAS;YACxE,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE;gBACvE,YAAY,EAAE,gBAAgB;gBAC9B,aAAa,EAAE,kBAAkB,KAAK,CAAC,IAAI,EAAE;gBAC7C,YAAY,EAAE,WAAW,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE,EAAE;gBACtD,YAAY,EAAE,cAAc,KAAK,CAAC,IAAI,EAAE;gBACxC,YAAY,EAAE,CAAC,iBAAiB,CAAC;gBACjC,cAAc,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;aAC3C,CAAC,CAAC;QACL,CAAC;QACD,OAAO,gBAAgB,CAAC;YACtB,MAAM,EAAE,CAAC,KAAK,CAAC;YACf,QAAQ,EAAE,EAAE;YACZ,eAAe,EAAE,EAAE;YACnB,SAAS;YACT,cAAc,EAAE,qBAAqB;YACrC,WAAW;YACX,qBAAqB;YACrB,eAAe,EAAE,yBAAyB;YAC1C,WAAW,EAAE,eAAe;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,iEAAiE;IACjE,MAAM,cAAc,GAAG,CAAC,CAA2B,EAAE,EAAE,CACrD,IAAI,CAAC,SAAS,CAAC;QACb,GAAG,CAAC;QACJ,eAAe,EAAE;YACf,GAAG,CAAC,CAAC,eAAe;YACpB,WAAW,EAAE,CAAC,CAAC,CAAC,eAAe,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,OAAO,CACzD,mBAAmB,EACnB,iBAAiB,CAClB;SACF;KACF,CAAC,CAAC;IAEL,IAAI,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACtE,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACtD,4EAA4E;QAC5E,kEAAkE;QAClE,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC;QAClB,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC;QAClB,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;QACjC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrE,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtE,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,uEAAuE,CAAC,CAAC;QAChG,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAClE,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC;QACpB,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;QACrC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC7C,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,qBAAqB,CAAC,EAAE,KAAK,CAAC;YAClF,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACrC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACnE,MAAM,WAAW,GAAG,KAAK,EAAE,CAAC,eAAe,EAAE,WAAW,IAAI,EAAE,CAAC;QAC/D,MAAM,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC;QAC7D,MAAM,CAAC,WAAW,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACvD,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAyB,CAAC;QAC/D,MAAM,GAAG,GAAG,gBAAgB,CAAC;YAC3B,MAAM,EAAE,CAAC,KAAK,CAAC;YACf,QAAQ,EAAE,EAAE;YACZ,eAAe,EAAE,EAAE;YACnB,SAAS;YACT,cAAc,EAAE,qBAAqB;YACrC,WAAW,EAAE,IAAI,GAAG,EAAE;YACtB,qBAAqB;YACrB,eAAe,EAAE,aAAa;YAC9B,WAAW,EAAE,SAAS;SACvB,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAClF,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,IAAI,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACzE,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QACpF,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,iBAAiB,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACtE,MAAM,CAAC,sBAAsB,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACtE,MAAM,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/aivss/scoring/heuristic-scorer.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Deterministic heuristic severity scorer.
+ *
+ * Produces per-sub-category SeverityLabels from AgentDefinition fields alone —
+ * no LLM call required. Used by the --deterministic CLI path so assessments carry
+ * meaningful signal rather than a flat "Medium" for every finding.
+ *
+ * Calibration principle: High requires 2+ independent risk signals. A single
+ * contextual signal (e.g. high-stakes deployment) gives Medium uplift, not High.
+ * Two compounding signals (context + agent capability, or capability + weak controls)
+ * justify High. This keeps the High tier meaningful for triage.
+ *
+ * "Critical" is never returned — reserved for live batch scoring where the model
+ * evaluates full context. "None" is never returned — callers filter those upstream.
+ *
+ * mitigationMultiplier < 0.9 caps High → Medium as a downgrade signal, reflecting
+ * that demonstrable mitigations are already partially addressing the risk.
+ */
+import type { AgentDefinition, SeverityLabel } from "../types";
+export declare function heuristicSeverity(agent: AgentDefinition, metric: string, subCategory: string): SeverityLabel;
+//# sourceMappingURL=heuristic-scorer.d.ts.map

package/dist/aivss/scoring/heuristic-scorer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"heuristic-scorer.d.ts","sourceRoot":"","sources":["../../../src/aivss/scoring/heuristic-scorer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAuS/D,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,eAAe,EACtB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,aAAa,CAYf"}

package/dist/aivss/scoring/heuristic-scorer.js

@@ -0,0 +1,299 @@
+/**
+ * Deterministic heuristic severity scorer.
+ *
+ * Produces per-sub-category SeverityLabels from AgentDefinition fields alone —
+ * no LLM call required. Used by the --deterministic CLI path so assessments carry
+ * meaningful signal rather than a flat "Medium" for every finding.
+ *
+ * Calibration principle: High requires 2+ independent risk signals. A single
+ * contextual signal (e.g. high-stakes deployment) gives Medium uplift, not High.
+ * Two compounding signals (context + agent capability, or capability + weak controls)
+ * justify High. This keeps the High tier meaningful for triage.
+ *
+ * "Critical" is never returned — reserved for live batch scoring where the model
+ * evaluates full context. "None" is never returned — callers filter those upstream.
+ *
+ * mitigationMultiplier < 0.9 caps High → Medium as a downgrade signal, reflecting
+ * that demonstrable mitigations are already partially addressing the risk.
+ */
+// ---------------------------------------------------------------------------
+// Agent property signals
+// ---------------------------------------------------------------------------
+const hasDangerousTools = (a) => a.tools.some((t) => t.dangerous === true);
+const hasWritePermission = (a) => a.permissions.some((p) => p.startsWith("write:"));
+const hasExecutePermission = (a) => a.permissions.some((p) => p.startsWith("execute:"));
+const isAutonomous = (a) => a.autonomyLevel === "autonomous";
+const isSemiAutonomousOrHigher = (a) => a.autonomyLevel === "autonomous" || a.autonomyLevel === "semi-autonomous";
+const isHighStakesContext = (a) => ["FinancialServices", "Healthcare", "CriticalInfrastructure", "LegalJustice"].includes(a.deploymentContext);
+const isRegulatedContext = (a) => [
+    "FinancialServices", "Healthcare", "CriticalInfrastructure",
+    "LegalJustice", "GovernmentPublic", "AutomotiveTransport",
+].includes(a.deploymentContext);
+const hasDataSources = (a) => (a.dataSources ?? []).length > 0;
+const hasExternalApis = (a) => (a.externalApiCount ?? 0) > 0;
+const hasManyExternalApis = (a) => (a.externalApiCount ?? 0) > 2;
+const isHighComplexity = (a) => a.modelComplexity === "Complex" || a.modelComplexity === "HighlyComplex";
+const hasMonitoring = (a) => /langfuse|datadog|prometheus|grafana|splunk|sentry|opentelemetry|\botel\b|jaeger|zipkin|newrelic|dynatrace/i.test((a.dependencies ?? []).join(" "));
+const hasWeakSecrets = (a) => {
+    const sm = (a.secretManagement ?? "").toLowerCase();
+    if (!sm || sm === "none" || sm === "unknown")
+        return true;
+    if (/vault|secret.?manager|aws.?ssm|parameter.?store|hsm|kms|rotation/i.test(sm))
+        return false;
+    if (/env.?var|environ|\benv\b|\.env|hardcod|no.?rotat|long.?lived|plain.?text/i.test(sm))
+        return true;
+    return true; // undocumented = assume weak
+};
+// ---------------------------------------------------------------------------
+// Per-metric scorers — each returns "High" | "Medium" | "Low"
+// High requires 2+ independent signals on most sub-categories.
+// ---------------------------------------------------------------------------
+function scoreMR(a, sub) {
+    if (sub === "Robustness Certification") {
+        // Certification fails when you can't enumerate the attack surface
+        return (a.finetuned && isHighStakesContext(a)) ? "High"
+            : (a.finetuned || isHighComplexity(a)) ? "Medium"
+                : "Low";
+    }
+    if (sub === "Gradient Masking / Obfuscation") {
+        return isHighComplexity(a) && isHighStakesContext(a) ? "High"
+            : isHighComplexity(a) ? "Medium"
+                : "Low";
+    }
+    // Evasion Resistance — adversarial inputs more dangerous when dangerous tools are available
+    return hasDangerousTools(a) && isHighStakesContext(a) ? "High"
+        : hasDangerousTools(a) || isHighStakesContext(a) ? "Medium"
+            : "Low";
+}
+function scoreDS(a, sub) {
+    if (sub === "Data Confidentiality") {
+        return hasWeakSecrets(a) && hasDataSources(a) ? "High"
+            : hasWeakSecrets(a) || hasDataSources(a) ? "Medium"
+                : "Low";
+    }
+    if (sub === "Data Integrity") {
+        return (hasWritePermission(a) || hasDangerousTools(a)) && isHighStakesContext(a) ? "High"
+            : hasWritePermission(a) || hasDangerousTools(a) ? "Medium"
+                : "Low";
+    }
+    if (sub === "Data Provenance") {
+        return hasWeakSecrets(a) && !hasMonitoring(a) ? "High"
+            : hasWeakSecrets(a) || !hasMonitoring(a) ? "Medium"
+                : "Low";
+    }
+    return hasWeakSecrets(a) ? "Medium" : "Low";
+}
+function scoreEI(a, sub) {
+    if (sub === "Bias and Discrimination") {
+        // Needs both high-stakes context AND agent-specific amplifier (fine-tuned on domain data,
+        // or autonomous decision-making without human review)
+        return isHighStakesContext(a) && (a.finetuned || isAutonomous(a)) ? "High"
+            : isHighStakesContext(a) ? "Medium"
+                : "Low";
+    }
+    if (sub === "Transparency and Explainability") {
+        return isHighComplexity(a) && !hasMonitoring(a) ? "High"
+            : isHighComplexity(a) || !hasMonitoring(a) ? "Medium"
+                : "Low";
+    }
+    if (sub === "Accountability") {
+        return isAutonomous(a) && !hasMonitoring(a) ? "High"
+            : isAutonomous(a) || !hasMonitoring(a) ? "Medium"
+                : "Low";
+    }
+    if (sub === "Societal Impact") {
+        return isHighStakesContext(a) && isAutonomous(a) ? "High"
+            : isHighStakesContext(a) ? "Medium"
+                : "Low";
+    }
+    return isHighStakesContext(a) ? "Medium" : "Low";
+}
+function scoreDC(a, sub) {
+    if (sub === "Safety-Critical Applications") {
+        return ["CriticalInfrastructure", "Healthcare", "AutomotiveTransport"].includes(a.deploymentContext)
+            ? "High"
+            : "Medium";
+    }
+    if (sub === "Financial Impact") {
+        return a.deploymentContext === "FinancialServices" && (hasDangerousTools(a) || isAutonomous(a))
+            ? "High"
+            : a.deploymentContext === "FinancialServices" ? "Medium"
+                : "Low";
+    }
+    if (sub === "Reputational Damage") {
+        return isHighStakesContext(a) && (isAutonomous(a) || hasDangerousTools(a)) ? "High"
+            : isHighStakesContext(a) ? "Medium"
+                : "Low";
+    }
+    if (sub === "Operational Disruption") {
+        // Needs dangerous capability AND autonomous or high-stakes context
+        return hasDangerousTools(a) && (isAutonomous(a) || isHighStakesContext(a)) ? "High"
+            : hasDangerousTools(a) ? "Medium"
+                : "Low";
+    }
+    return isHighStakesContext(a) ? "Medium" : "Low";
+}
+function scoreAD(a, sub) {
+    if (sub === "Continuous Monitoring") {
+        return !hasMonitoring(a) ? "High" : "Low";
+    }
+    if (sub === "Retraining Capabilities") {
+        // Fine-tuned models have a retraining surface to attack; base models don't
+        return a.finetuned && isHighStakesContext(a) ? "High"
+            : a.finetuned ? "Medium"
+                : "Low";
+    }
+    if (sub === "Threat Intelligence Integration") {
+        return !hasMonitoring(a) && isHighStakesContext(a) ? "High"
+            : !hasMonitoring(a) ? "Medium"
+                : "Low";
+    }
+    if (sub === "Adversarial Training") {
+        // Only relevant if the model has been fine-tuned (something to adversarially harden)
+        return a.finetuned ? "Medium" : "Low";
+    }
+    return !hasMonitoring(a) ? "Medium" : "Low";
+}
+function scoreAA(a, sub) {
+    if (sub === "Model Inversion") {
+        return a.finetuned && isHighStakesContext(a) ? "High"
+            : a.finetuned || (hasDataSources(a) && isHighStakesContext(a)) ? "Medium"
+                : "Low";
+    }
+    if (sub === "Model Extraction") {
+        return isHighComplexity(a) && a.finetuned ? "High"
+            : isHighComplexity(a) || a.finetuned ? "Medium"
+                : "Low";
+    }
+    if (sub === "Membership Inference") {
+        return hasDataSources(a) && isHighStakesContext(a) ? "High"
+            : hasDataSources(a) || a.finetuned ? "Medium"
+                : "Low";
+    }
+    return hasDangerousTools(a) && isAutonomous(a) ? "High"
+        : hasDangerousTools(a) || hasExecutePermission(a) ? "Medium"
+            : "Low";
+}
+function scoreLL(a, sub) {
+    if (sub === "Development Security") {
+        return (a.objectives ?? []).length === 0 && isHighStakesContext(a) ? "High"
+            : (a.objectives ?? []).length === 0 ? "Medium"
+                : "Low";
+    }
+    if (sub === "Training Security") {
+        return a.finetuned && hasWeakSecrets(a) ? "High"
+            : a.finetuned ? "Medium"
+                : "Low";
+    }
+    if (sub === "Deployment Security") {
+        return hasWeakSecrets(a) && isHighStakesContext(a) ? "High"
+            : hasWeakSecrets(a) ? "Medium"
+                : "Low";
+    }
+    if (sub === "Operational Security") {
+        return hasWeakSecrets(a) && !hasMonitoring(a) ? "High"
+            : hasWeakSecrets(a) || !hasMonitoring(a) ? "Medium"
+                : "Low";
+    }
+    return hasWeakSecrets(a) ? "Medium" : "Low";
+}
+function scoreGV(a, sub) {
+    if (sub === "Regulatory Compliance") {
+        return isRegulatedContext(a) && !hasMonitoring(a) ? "High"
+            : isRegulatedContext(a) ? "Medium"
+                : "Low";
+    }
+    if (sub === "Auditing") {
+        return isHighStakesContext(a) && !hasMonitoring(a) ? "High"
+            : !hasMonitoring(a) ? "Medium"
+                : "Low";
+    }
+    if (sub === "Risk Management") {
+        return isAutonomous(a) && (a.objectives ?? []).length === 0 ? "High"
+            : isAutonomous(a) ? "Medium"
+                : "Low";
+    }
+    if (sub === "Human Oversight") {
+        // Directly proportional to autonomy — this one single signal is sufficient
+        return isAutonomous(a) ? "High"
+            : isSemiAutonomousOrHigher(a) ? "Medium"
+                : "Low";
+    }
+    if (sub === "Ethical Framework Alignment") {
+        return isRegulatedContext(a) && isAutonomous(a) ? "High"
+            : isRegulatedContext(a) ? "Medium"
+                : "Low";
+    }
+    return isAutonomous(a) ? "Medium" : "Low";
+}
+function scoreCS(a, sub) {
+    if (sub === "Model Manipulation / Prompt Injection") {
+        return hasDangerousTools(a) && hasExternalApis(a) ? "High"
+            : hasDangerousTools(a) || hasExternalApis(a) ? "Medium"
+                : "Low";
+    }
+    if (sub === "Data Poisoning") {
+        return hasDataSources(a) && hasExternalApis(a) ? "High"
+            : hasDataSources(a) ? "Medium"
+                : "Low";
+    }
+    if (sub === "Sensitive Data Disclosure") {
+        return hasWeakSecrets(a) && hasDataSources(a) ? "High"
+            : hasWeakSecrets(a) || hasDataSources(a) ? "Medium"
+                : "Low";
+    }
+    if (sub === "Model Stealing") {
+        return isHighComplexity(a) && a.finetuned ? "High"
+            : isHighComplexity(a) || a.finetuned ? "Medium"
+                : "Low";
+    }
+    if (sub === "Failure / Malfunctioning") {
+        return hasDangerousTools(a) && isAutonomous(a) ? "High"
+            : hasDangerousTools(a) || isAutonomous(a) ? "Medium"
+                : "Low";
+    }
+    if (sub === "Insecure Supply Chain") {
+        return hasManyExternalApis(a) || (a.dependencies ?? []).length > 5 ? "High" : "Medium";
+    }
+    if (sub === "Insecure Apps / Plugins") {
+        return hasExternalApis(a) && hasDangerousTools(a) ? "High"
+            : hasExternalApis(a) ? "Medium"
+                : "Low";
+    }
+    if (sub === "Denial of Service (DoS)") {
+        return hasManyExternalApis(a) ? "High" : hasExternalApis(a) ? "Medium" : "Low";
+    }
+    if (sub === "Loss of Governance / Compliance") {
+        return isAutonomous(a) && isRegulatedContext(a) ? "High"
+            : isAutonomous(a) || isRegulatedContext(a) ? "Medium"
+                : "Low";
+    }
+    return hasExternalApis(a) ? "Medium" : "Low";
+}
+// ---------------------------------------------------------------------------
+// Public entry point
+// ---------------------------------------------------------------------------
+const METRIC_SCORERS = {
+    MR: scoreMR,
+    DS: scoreDS,
+    EI: scoreEI,
+    DC: scoreDC,
+    AD: scoreAD,
+    AA: scoreAA,
+    LL: scoreLL,
+    GV: scoreGV,
+    CS: scoreCS,
+};
+export function heuristicSeverity(agent, metric, subCategory) {
+    const scorer = METRIC_SCORERS[metric];
+    if (!scorer)
+        return "Medium";
+    const raw = scorer(agent, subCategory);
+    // mitigationMultiplier < 0.9 indicates demonstrable mitigations are deployed.
+    // Cap High → Medium for those agents — they still have the exposure but it's
+    // partially addressed.
+    if (raw === "High" && agent.mitigationMultiplier < 0.9)
+        return "Medium";
+    return raw;
+}
+//# sourceMappingURL=heuristic-scorer.js.map