@waratahlabs/canopy 0.5.0

package/dist/examples/batch-submission-flow.js

@@ -0,0 +1,279 @@
+import { calculateAIVSSScore, buildBatchRequests, AIVSSKnowledgeBase, } from "../aivss/index";
+import demoAgent from "./demo-agent-definition.json";
+const METRIC_CODES = ["MR", "DS", "EI", "DC", "AD", "AA", "LL", "GV", "CS"];
+const DEMO_AGENTS = [
+    demoAgent,
+    {
+        id: "agent-002",
+        name: "Data Analysis Agent",
+        model: "claude-opus-4-7",
+        systemPrompt: "You are a data analysis expert. Analyze CSV files and generate reports.",
+        tools: [
+            { name: "read_csv", description: "Read CSV file", dangerous: false },
+            {
+                name: "execute_python",
+                description: "Execute Python code",
+                dangerous: true,
+            },
+        ],
+        permissions: ["read:files", "write:reports"],
+        deploymentContext: "General",
+        modelComplexity: "Complex",
+        mitigationMultiplier: 0.95,
+        finetuned: true,
+        dependencies: [
+            "pandas-runner",
+            "reporting-service-client",
+            "storage-gateway",
+            "artifact-scanner",
+        ],
+        secretManagement: "Vault-backed short-lived credentials with scoped execution roles",
+        deployment: "Kubernetes job runner with network policies and artifact scanning",
+        dataSources: ["user_uploads"],
+        autonomyLevel: "supervised",
+        objectives: ["Provide accurate data analysis"],
+        externalApiCount: 1,
+    },
+];
+async function runBatchAssessment() {
+    console.log("═══════════════════════════════════════════════════════");
+    console.log("AIVSS Batch Assessment Flow");
+    console.log("═══════════════════════════════════════════════════════\n");
+    console.log("Step 1: Initializing AIVSS Knowledge Base...");
+    const kb = new AIVSSKnowledgeBase();
+    console.log("✓ Knowledge base initialized with mock AIVSS 0.8 data\n");
+    console.log("Step 2: Building batch requests...");
+    const requests = await buildBatchRequests({
+        agents: DEMO_AGENTS,
+        useKnowledgeBase: true,
+        model: "claude-opus-4-7",
+        temperature: 0,
+        maxTokens: 1024,
+    }, kb);
+    console.log(`✓ Built ${requests.length} assessment requests`);
+    console.log(`  - ${DEMO_AGENTS.length} agents`);
+    console.log(`  - ${METRIC_CODES.length} V4 metrics per agent\n`);
+    console.log("Step 3: Sample request structure:");
+    const sampleRequest = requests[0];
+    console.log(`  Custom ID: ${sampleRequest.custom_id}`);
+    console.log(`  Model: ${sampleRequest.params.model}`);
+    console.log(`  Temperature: ${sampleRequest.params.temperature}`);
+    console.log(`  Max Tokens: ${sampleRequest.params.max_tokens}`);
+    console.log(`  System prompt length: ${sampleRequest.params.system.length} characters`);
+    console.log(`  User message length: ${sampleRequest.params.messages[0].content.length} characters\n`);
+    console.log("Step 4: Would submit to Claude Batch API");
+    console.log("  (In production, use: client.beta.messages.batches.create)");
+    console.log("  Request payload would contain all assessment requests\n");
+    console.log("Step 5: Simulating result polling and processing...");
+    const results = simulateBatchResults(requests, DEMO_AGENTS);
+    summarizeResults(DEMO_AGENTS, results);
+    console.log("\n═══════════════════════════════════════════════════════");
+    console.log("Batch assessment flow complete");
+    console.log("═══════════════════════════════════════════════════════");
+}
+function simulateBatchResults(requests, agents) {
+    return buildBatchRequestsResultSet(requests, agents);
+}
+function summarizeResults(agents, results) {
+    const assessmentsByAgent = new Map();
+    for (const result of results) {
+        if (result.result.type !== "succeeded") {
+            continue;
+        }
+        const [agentId] = result.custom_id.split(/-(?=[A-Z]{2}$)/);
+        const content = result.result.message?.content[0]?.text;
+        if (!agentId || !content) {
+            throw new Error(`Malformed batch result for ${result.custom_id}`);
+        }
+        const assessment = parseAssessmentResponse(content, result.custom_id);
+        const existing = assessmentsByAgent.get(agentId) ?? [];
+        existing.push(assessment);
+        assessmentsByAgent.set(agentId, existing);
+    }
+    console.log("  Agent Risk Summary:");
+    for (const agent of agents) {
+        const metricResponses = assessmentsByAgent.get(agent.id);
+        if (!metricResponses || metricResponses.length !== METRIC_CODES.length) {
+            throw new Error(`Expected ${METRIC_CODES.length} metric responses for ${agent.id}`);
+        }
+        const score = calculateAIVSSScore({
+            agentDefinition: agent,
+            metricResponses,
+            baseScore: agent.deploymentContext === "FinancialServices" ? 2.8 : 2.1,
+            impactScore: agent.autonomyLevel === "supervised" ? 5.4 : 6.7,
+            temporalScore: 0.96,
+        });
+        console.log(`    ${agent.name}: ${score.severity.toUpperCase()} (${score.aivssScore.toFixed(2)}/10)${score.deploymentBlocker ? " [DEPLOYMENT BLOCKER]" : ""}`);
+    }
+    console.log("\n  Results would be:");
+    console.log("    - Stored in compliance database");
+    console.log("    - Displayed on risk dashboard");
+    console.log("    - Alerts sent for deployment blockers");
+    console.log("    - Historical tracking updated");
+}
+function buildBatchRequestsResultSet(requests, agents) {
+    const agentsById = new Map(agents.map((agent) => [agent.id, agent]));
+    return requests.map((request) => {
+        const [agentId, metricCodeText] = request.custom_id.split(/-(?=[A-Z]{2}$)/);
+        const agent = agentId ? agentsById.get(agentId) : undefined;
+        if (!agent || !metricCodeText || !isMetricCode(metricCodeText)) {
+            throw new Error(`Cannot simulate batch result for ${request.custom_id}`);
+        }
+        return {
+            custom_id: request.custom_id,
+            result: {
+                type: "succeeded",
+                message: {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify(buildMockAssessment(agent, metricCodeText)),
+                        },
+                    ],
+                },
+            },
+        };
+    });
+}
+function buildMockAssessment(agent, metricCode) {
+    const dangerousToolCount = agent.tools.filter((tool) => tool.dangerous).length;
+    switch (metricCode) {
+        case "MR":
+            return {
+                metricCode,
+                subCategoryScores: {
+                    "Evasion Resistance": dangerousToolCount > 0 ? "High" : "Medium",
+                    "Gradient Masking / Obfuscation": "Medium",
+                    "Robustness Certification": agent.finetuned ? "Low" : "Medium",
+                },
+                findings: ["Robustness evidence is incomplete for prompt and tool-mediated adversarial inputs."],
+                deploymentBlocker: false,
+            };
+        case "DS":
+            return {
+                metricCode,
+                subCategoryScores: {
+                    "Data Confidentiality": agent.permissions.length > 3 ? "High" : "Medium",
+                    "Data Integrity": "Medium",
+                    "Data Provenance": agent.dataSources?.some((source) => source.includes("user")) ? "High" : "Medium",
+                },
+                findings: ["User-influenced data and privileged access increase data handling exposure."],
+                deploymentBlocker: false,
+            };
+        case "EI":
+            return {
+                metricCode,
+                subCategoryScores: {
+                    "Bias and Discrimination": "Low",
+                    "Transparency and Explainability": "Medium",
+                    Accountability: "Medium",
+                    "Societal Impact": agent.deploymentContext === "FinancialServices" ? "Medium" : "Low",
+                },
+                findings: ["Explainability and operator accountability need consistent evidence."],
+                deploymentBlocker: false,
+            };
+        case "DC":
+            return {
+                metricCode,
+                subCategoryScores: {
+                    "Safety-Critical Applications": "None",
+                    "Financial Impact": agent.deploymentContext === "FinancialServices" ? "High" : "Medium",
+                    "Reputational Damage": "Medium",
+                    "Operational Disruption": dangerousToolCount > 0 ? "Medium" : "Low",
+                },
+                findings: ["Incorrect outputs could drive meaningful business-process harm."],
+                deploymentBlocker: false,
+            };
+        case "AD":
+            return {
+                metricCode,
+                subCategoryScores: {
+                    "Continuous Monitoring": "Medium",
+                    "Retraining Capabilities": agent.finetuned ? "Low" : "Medium",
+                    "Threat Intelligence Integration": "Medium",
+                    "Adversarial Training": "Medium",
+                },
+                findings: ["Adaptive hardening exists, but feedback loops are not deeply automated."],
+                deploymentBlocker: false,
+            };
+        case "AA":
+            return {
+                metricCode,
+                subCategoryScores: {
+                    "Model Inversion": "Low",
+                    "Model Extraction": "Low",
+                    "Membership Inference": agent.dataSources?.length ? "Medium" : "Low",
+                },
+                findings: ["Interfaces should be monitored for privacy leakage and behavioral extraction patterns."],
+                deploymentBlocker: false,
+            };
+        case "LL":
+            return {
+                metricCode,
+                subCategoryScores: {
+                    "Development Security": "Medium",
+                    "Training Security": agent.finetuned ? "Medium" : "Low",
+                    "Deployment Security": "Medium",
+                    "Operational Security": "Medium",
+                },
+                findings: ["Dependency and runtime controls are present but not yet fully hardened."],
+                deploymentBlocker: false,
+            };
+        case "GV":
+            return {
+                metricCode,
+                subCategoryScores: {
+                    "Regulatory Compliance": agent.deploymentContext === "FinancialServices" ? "Medium" : "Low",
+                    Auditing: "Medium",
+                    "Risk Management": "Medium",
+                    "Human Oversight": agent.autonomyLevel === "supervised" ? "Low" : "Medium",
+                    "Ethical Framework Alignment": "Low",
+                },
+                findings: ["Governance requirements rise with sector obligations and privileged workflows."],
+                deploymentBlocker: false,
+            };
+        case "CS":
+            return {
+                metricCode,
+                subCategoryScores: {
+                    "Model Manipulation / Prompt Injection": dangerousToolCount > 0 ? "High" : "Medium",
+                    "Data Poisoning": agent.dataSources?.some((source) => source.includes("user")) ? "High" : "Medium",
+                    "Sensitive Data Disclosure": agent.permissions.length > 3 ? "High" : "Medium",
+                    "Model Stealing": "Low",
+                    "Failure / Malfunctioning": "Medium",
+                    "Insecure Supply Chain": agent.dependencies.length > 3 ? "Medium" : "Low",
+                    "Insecure Apps / Plugins": dangerousToolCount > 0 ? "High" : "Medium",
+                    "Denial of Service (DoS)": "Low",
+                    "Loss of Governance / Compliance": agent.deploymentContext === "FinancialServices" ? "Medium" : "Low",
+                },
+                findings: ["Tool authority and user-influenced inputs create the main deployment risk."],
+                deploymentBlocker: dangerousToolCount > 0,
+            };
+    }
+}
+function parseAssessmentResponse(payload, customId) {
+    let parsed;
+    try {
+        parsed = JSON.parse(payload);
+    }
+    catch (error) {
+        throw new Error(`Invalid JSON in batch result ${customId}: ${String(error)}`);
+    }
+    if (!parsed || typeof parsed !== "object") {
+        throw new Error(`Invalid assessment payload for ${customId}`);
+    }
+    const assessment = parsed;
+    if (typeof assessment.metricCode !== "string" ||
+        typeof assessment.deploymentBlocker !== "boolean" ||
+        !Array.isArray(assessment.findings) ||
+        !assessment.subCategoryScores ||
+        typeof assessment.subCategoryScores !== "object") {
+        throw new Error(`Malformed assessment response for ${customId}`);
+    }
+    return assessment;
+}
+function isMetricCode(value) {
+    return METRIC_CODES.includes(value);
+}
+runBatchAssessment().catch(console.error);
+//# sourceMappingURL=batch-submission-flow.js.map

package/dist/examples/batch-submission-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"batch-submission-flow.js","sourceRoot":"","sources":["../../src/examples/batch-submission-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,GAKnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,SAAS,MAAM,8BAA8B,CAAC;AAerD,MAAM,YAAY,GAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAE1F,MAAM,WAAW,GAAsB;IACrC,SAA4B;IAC5B;QACE,EAAE,EAAE,WAAW;QACf,IAAI,EAAE,qBAAqB;QAC3B,KAAK,EAAE,iBAAiB;QACxB,YAAY,EACV,yEAAyE;QAC3E,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,SAAS,EAAE,KAAK,EAAE;YACpE;gBACE,IAAI,EAAE,gBAAgB;gBACtB,WAAW,EAAE,qBAAqB;gBAClC,SAAS,EAAE,IAAI;aAChB;SACF;QACD,WAAW,EAAE,CAAC,YAAY,EAAE,eAAe,CAAC;QAC5C,iBAAiB,EAAE,SAAS;QAC5B,eAAe,EAAE,SAAS;QAC1B,oBAAoB,EAAE,IAAI;QAC1B,SAAS,EAAE,IAAI;QACf,YAAY,EAAE;YACZ,eAAe;YACf,0BAA0B;YAC1B,iBAAiB;YACjB,kBAAkB;SACnB;QACD,gBAAgB,EAAE,kEAAkE;QACpF,UAAU,EAAE,mEAAmE;QAC/E,WAAW,EAAE,CAAC,cAAc,CAAC;QAC7B,aAAa,EAAE,YAAY;QAC3B,UAAU,EAAE,CAAC,gCAAgC,CAAC;QAC9C,gBAAgB,EAAE,CAAC;KACpB;CACF,CAAC;AAEF,KAAK,UAAU,kBAAkB;IAC/B,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;IACvE,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAC3C,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;IAEzE,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;IAC5D,MAAM,EAAE,GAAG,IAAI,kBAAkB,EAAE,CAAC;IACpC,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;IAEvE,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CACvC;QACE,MAAM,EAAE,WAAW;QACnB,gBAAgB,EAAE,IAAI;QACtB,KAAK,EAAE,iBAAiB;QACxB,WAAW,EAAE,CAAC;QACd,SAAS,EAAE,IAAI;KAChB,EACD,EAAE,CACH,CAAC;IAEF,OAAO,CAAC,GAAG,CAAC,WAAW,QAAQ,CAAC,MAAM,sBAAsB,CAAC,CAAC;IAC9D,OAAO,CAAC,GAAG,CAAC,OAAO,WAAW,CAAC,MAAM,SAAS,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,OAAO,YAAY,CAAC,MAAM,yBAAyB,CAAC,CAAC;IAEjE,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;IACjD,MAAM,aAAa,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAClC,OAAO,CAAC,GAAG,CAAC,gBAAgB,aAAa,CAAC,SAAS,EAAE,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,YAAY,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,kBAAkB,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,iBAAiB,aAAa,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,2BAA2B,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,aAAa,CAAC,CAAC;IACxF,OAAO,CAAC,GAAG,CAAC,0BAA0B,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,eAAe,CAAC,CAAC;IAEtG,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;IACxD,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;IAC3E,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;IAEzE,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC5D,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAEvC,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;IACzE,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,oBAAoB,CAC3B,QAAwB,EACxB,MAAyB;IAEzB,OAAO,2BAA2B,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAyB,EAAE,OAAsB;IACzE,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAsC,CAAC;IAEzE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACvC,SAAS;QACX,CAAC;QAED,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;QACxD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,UAAU,GAAG,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACtE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACvD,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC1B,kBAAkB,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,eAAe,GAAG,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,eAAe,IAAI,eAAe,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,YAAY,YAAY,CAAC,MAAM,yBAAyB,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,KAAK,GAAG,mBAAmB,CAAC;YAChC,eAAe,EAAE,KAAK;YACtB,eAAe;YACf,SAAS,EAAE,KAAK,CAAC,iBAAiB,KAAK,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;YACtE,WAAW,EAAE,KAAK,CAAC,aAAa,KAAK,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;YAC7D,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CACT,OAAO,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,EAAE,CAClJ,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,2BAA2B,CAClC,QAAwB,EACxB,MAAyB;IAEzB,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAErE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,MAAM,CAAC,OAAO,EAAE,cAAc,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5D,IAAI,CAAC,KAAK,IAAI,CAAC,cAAc,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,oCAAoC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,OAAO;YACL,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE;gBACN,IAAI,EAAE,WAAoB;gBAC1B,OAAO,EAAE;oBACP,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;yBACjE;qBACF;iBACF;aACF;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAC1B,KAAsB,EACtB,UAAsB;IAEtB,MAAM,kBAAkB,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;IAE/E,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,IAAI;YACP,OAAO;gBACL,UAAU;gBACV,iBAAiB,EAAE;oBACjB,oBAAoB,EAAE,kBAAkB,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;oBAChE,gCAAgC,EAAE,QAAQ;oBAC1C,0BAA0B,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;iBAC/D;gBACD,QAAQ,EAAE,CAAC,oFAAoF,CAAC;gBAChG,iBAAiB,EAAE,KAAK;aACzB,CAAC;QACJ,KAAK,IAAI;YACP,OAAO;gBACL,UAAU;gBACV,iBAAiB,EAAE;oBACjB,sBAAsB,EAAE,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;oBACxE,gBAAgB,EAAE,QAAQ;oBAC1B,iBAAiB,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;iBACpG;gBACD,QAAQ,EAAE,CAAC,6EAA6E,CAAC;gBACzF,iBAAiB,EAAE,KAAK;aACzB,CAAC;QACJ,KAAK,IAAI;YACP,OAAO;gBACL,UAAU;gBACV,iBAAiB,EAAE;oBACjB,yBAAyB,EAAE,KAAK;oBAChC,iCAAiC,EAAE,QAAQ;oBAC3C,cAAc,EAAE,QAAQ;oBACxB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,KAAK,mBAAmB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK;iBACtF;gBACD,QAAQ,EAAE,CAAC,sEAAsE,CAAC;gBAClF,iBAAiB,EAAE,KAAK;aACzB,CAAC;QACJ,KAAK,IAAI;YACP,OAAO;gBACL,UAAU;gBACV,iBAAiB,EAAE;oBACjB,8BAA8B,EAAE,MAAM;oBACtC,kBAAkB,EAAE,KAAK,CAAC,iBAAiB,KAAK,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;oBACvF,qBAAqB,EAAE,QAAQ;oBAC/B,wBAAwB,EAAE,kBAAkB,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK;iBACpE;gBACD,QAAQ,EAAE,CAAC,iEAAiE,CAAC;gBAC7E,iBAAiB,EAAE,KAAK;aACzB,CAAC;QACJ,KAAK,IAAI;YACP,OAAO;gBACL,UAAU;gBACV,iBAAiB,EAAE;oBACjB,uBAAuB,EAAE,QAAQ;oBACjC,yBAAyB,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;oBAC7D,iCAAiC,EAAE,QAAQ;oBAC3C,sBAAsB,EAAE,QAAQ;iBACjC;gBACD,QAAQ,EAAE,CAAC,yEAAyE,CAAC;gBACrF,iBAAiB,EAAE,KAAK;aACzB,CAAC;QACJ,KAAK,IAAI;YACP,OAAO;gBACL,UAAU;gBACV,iBAAiB,EAAE;oBACjB,iBAAiB,EAAE,KAAK;oBACxB,kBAAkB,EAAE,KAAK;oBACzB,sBAAsB,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK;iBACrE;gBACD,QAAQ,EAAE,CAAC,wFAAwF,CAAC;gBACpG,iBAAiB,EAAE,KAAK;aACzB,CAAC;QACJ,KAAK,IAAI;YACP,OAAO;gBACL,UAAU;gBACV,iBAAiB,EAAE;oBACjB,sBAAsB,EAAE,QAAQ;oBAChC,mBAAmB,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK;oBACvD,qBAAqB,EAAE,QAAQ;oBAC/B,sBAAsB,EAAE,QAAQ;iBACjC;gBACD,QAAQ,EAAE,CAAC,yEAAyE,CAAC;gBACrF,iBAAiB,EAAE,KAAK;aACzB,CAAC;QACJ,KAAK,IAAI;YACP,OAAO;gBACL,UAAU;gBACV,iBAAiB,EAAE;oBACjB,uBAAuB,EAAE,KAAK,CAAC,iBAAiB,KAAK,mBAAmB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK;oBAC3F,QAAQ,EAAE,QAAQ;oBAClB,iBAAiB,EAAE,QAAQ;oBAC3B,iBAAiB,EAAE,KAAK,CAAC,aAAa,KAAK,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;oBAC1E,6BAA6B,EAAE,KAAK;iBACrC;gBACD,QAAQ,EAAE,CAAC,gFAAgF,CAAC;gBAC5F,iBAAiB,EAAE,KAAK;aACzB,CAAC;QACJ,KAAK,IAAI;YACP,OAAO;gBACL,UAAU;gBACV,iBAAiB,EAAE;oBACjB,uCAAuC,EAAE,kBAAkB,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;oBACnF,gBAAgB,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;oBAClG,2BAA2B,EAAE,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;oBAC7E,gBAAgB,EAAE,KAAK;oBACvB,0BAA0B,EAAE,QAAQ;oBACpC,uBAAuB,EAAE,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK;oBACzE,yBAAyB,EAAE,kBAAkB,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;oBACrE,yBAAyB,EAAE,KAAK;oBAChC,iCAAiC,EAAE,KAAK,CAAC,iBAAiB,KAAK,mBAAmB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK;iBACtG;gBACD,QAAQ,EAAE,CAAC,4EAA4E,CAAC;gBACxF,iBAAiB,EAAE,kBAAkB,GAAG,CAAC;aAC1C,CAAC;IACN,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAC9B,OAAe,EACf,QAAgB;IAEhB,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,UAAU,GAAG,MAAkC,CAAC;IACtD,IACE,OAAO,UAAU,CAAC,UAAU,KAAK,QAAQ;QACzC,OAAO,UAAU,CAAC,iBAAiB,KAAK,SAAS;QACjD,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;QACnC,CAAC,UAAU,CAAC,iBAAiB;QAC7B,OAAO,UAAU,CAAC,iBAAiB,KAAK,QAAQ,EAChD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,YAAY,CAAC,QAAQ,CAAC,KAAmB,CAAC,CAAC;AACpD,CAAC;AAED,kBAAkB,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC"}

package/dist/examples/demo-agent-definition.json

@@ -0,0 +1,58 @@
+{
+    "id": "agent-001",
+    "name": "Customer Support Agent",
+    "model": "claude-opus-4-7",
+    "systemPrompt": "You are a helpful customer support agent. Answer customer questions about orders, returns, and refunds. Always be polite and professional. Do not make refunds larger than $500 without manager approval.",
+    "tools": [
+        {
+            "name": "lookup_order",
+            "description": "Look up a customer order by order ID or email",
+            "dangerous": false
+        },
+        {
+            "name": "process_refund",
+            "description": "Process a refund for an order",
+            "dangerous": true
+        },
+        {
+            "name": "send_email",
+            "description": "Send an email to the customer",
+            "dangerous": false
+        },
+        {
+            "name": "access_customer_database",
+            "description": "Query customer database for information",
+            "dangerous": true
+        }
+    ],
+    "permissions": [
+        "read:orders",
+        "write:refunds",
+        "read:customers",
+        "write:emails"
+    ],
+    "deploymentContext": "FinancialServices",
+    "modelComplexity": "Moderate",
+    "mitigationMultiplier": 1.1,
+    "finetuned": false,
+    "dependencies": [
+        "order-service-sdk",
+        "refund-orchestrator",
+        "customer-profile-api",
+        "email-gateway-client"
+    ],
+    "secretManagement": "Cloud KMS with short-lived credentials injected at runtime",
+    "deployment": "AWS ECS Fargate in private subnets behind an API gateway",
+    "dataSources": [
+        "company_kb",
+        "product_catalog",
+        "order_history"
+    ],
+    "autonomyLevel": "semi-autonomous",
+    "objectives": [
+        "Resolve customer issues quickly",
+        "Minimize refund costs",
+        "Maintain customer satisfaction"
+    ],
+    "externalApiCount": 3
+}

package/dist/examples/langfuse-assessment.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=langfuse-assessment.d.ts.map

package/dist/examples/langfuse-assessment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"langfuse-assessment.d.ts","sourceRoot":"","sources":["../../src/examples/langfuse-assessment.ts"],"names":[],"mappings":""}

package/dist/examples/langfuse-assessment.js

@@ -0,0 +1,46 @@
+// Usage: LANGFUSE_HOST=... LANGFUSE_SECRET_KEY=... LANGFUSE_PUBLIC_KEY=... bun src/examples/langfuse-assessment.ts
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { assessWorkflow } from "../index.js";
+import { loadOverlaysFromYaml, parseLangfuseTraces, } from "../adapters/langfuse.js";
+const OUTPUT_DIR = path.resolve(process.cwd(), "output");
+const OUTPUT_FILE = path.join(OUTPUT_DIR, "langfuse-threat-model.tc.json");
+const overlayPath = path.resolve(process.cwd(), process.env["LANGFUSE_OVERLAY_PATH"] ?? "src/examples/langfuse-overlay.example.yaml");
+function readRequiredEnv(name) {
+    const value = process.env[name]?.trim();
+    if (!value) {
+        console.error(`Missing required environment variable: ${name}`);
+        process.exit(1);
+    }
+    return value;
+}
+async function main() {
+    const config = {
+        host: readRequiredEnv("LANGFUSE_HOST"),
+        secretKey: readRequiredEnv("LANGFUSE_SECRET_KEY"),
+        publicKey: readRequiredEnv("LANGFUSE_PUBLIC_KEY"),
+        projectId: process.env["LANGFUSE_PROJECT_ID"]?.trim() || undefined,
+        fromDate: process.env["LANGFUSE_FROM_DATE"]?.trim() || undefined,
+        limit: process.env["LANGFUSE_LIMIT"] ? Number(process.env["LANGFUSE_LIMIT"]) : undefined,
+    };
+    const overlays = loadOverlaysFromYaml(overlayPath);
+    const parsed = await parseLangfuseTraces(config, overlays);
+    const result = await assessWorkflow({
+        input: {
+            type: "agents",
+            agents: parsed.agents,
+            handoffs: parsed.handoffs,
+        },
+        applicationName: parsed.workflowName,
+    });
+    fs.mkdirSync(OUTPUT_DIR, { recursive: true });
+    fs.writeFileSync(OUTPUT_FILE, JSON.stringify(result, null, 2));
+    console.log(`Agents found: ${parsed.agents.length}`);
+    console.log(`Threats: ${result.threats?.length ?? 0}`);
+    console.log(`Output: ${OUTPUT_FILE}`);
+}
+main().catch((error) => {
+    console.error(error);
+    process.exit(1);
+});
+//# sourceMappingURL=langfuse-assessment.js.map

package/dist/examples/langfuse-assessment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"langfuse-assessment.js","sourceRoot":"","sources":["../../src/examples/langfuse-assessment.ts"],"names":[],"mappings":"AAAA,mHAAmH;AAEnH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GAEpB,MAAM,yBAAyB,CAAC;AAEjC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC;AACzD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,+BAA+B,CAAC,CAAC;AAC3E,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAC9B,OAAO,CAAC,GAAG,EAAE,EACb,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,4CAA4C,CACrF,CAAC;AAEF,SAAS,eAAe,CAAC,IAAqE;IAC5F,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,0CAA0C,IAAI,EAAE,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAA0B;QACpC,IAAI,EAAE,eAAe,CAAC,eAAe,CAAC;QACtC,SAAS,EAAE,eAAe,CAAC,qBAAqB,CAAC;QACjD,SAAS,EAAE,eAAe,CAAC,qBAAqB,CAAC;QACjD,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS;QAClE,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS;QAChE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;KACzF,CAAC;IACF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;QAClC,KAAK,EAAE;YACL,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B;QACD,eAAe,EAAE,MAAM,CAAC,YAAY;KACrC,CAAC,CAAC;IAEH,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAE/D,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,WAAW,WAAW,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IAC9B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/examples/model-eval.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Model Evaluation Example
+ *
+ * Runs the AIVSS assessment through multiple Ollama models and produces a
+ * recommendation report. Use this to vet which models are suitable for
+ * reliable threat assessment before recommending them to users.
+ *
+ * Prerequisites:
+ *   ollama pull llama3.2
+ *   ollama pull qwen2.5:7b
+ *   ollama pull mistral
+ *   ollama pull gemma2:9b
+ *
+ * Usage:
+ *   # Local (default)
+ *   bun src/examples/model-eval.ts
+ *
+ *   # Custom model set
+ *   MODELS=llama3.2,phi3.5,qwen2.5:3b bun src/examples/model-eval.ts
+ *
+ *   # Ollama cloud
+ *   OLLAMA_BASE_URL=https://ollama.com/api OLLAMA_API_KEY=<key> bun src/examples/model-eval.ts
+ */
+export {};
+//# sourceMappingURL=model-eval.d.ts.map

package/dist/examples/model-eval.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-eval.d.ts","sourceRoot":"","sources":["../../src/examples/model-eval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG"}

package/dist/examples/model-eval.js

@@ -0,0 +1,94 @@
+/**
+ * Model Evaluation Example
+ *
+ * Runs the AIVSS assessment through multiple Ollama models and produces a
+ * recommendation report. Use this to vet which models are suitable for
+ * reliable threat assessment before recommending them to users.
+ *
+ * Prerequisites:
+ *   ollama pull llama3.2
+ *   ollama pull qwen2.5:7b
+ *   ollama pull mistral
+ *   ollama pull gemma2:9b
+ *
+ * Usage:
+ *   # Local (default)
+ *   bun src/examples/model-eval.ts
+ *
+ *   # Custom model set
+ *   MODELS=llama3.2,phi3.5,qwen2.5:3b bun src/examples/model-eval.ts
+ *
+ *   # Ollama cloud
+ *   OLLAMA_BASE_URL=https://ollama.com/api OLLAMA_API_KEY=<key> bun src/examples/model-eval.ts
+ */
+import * as path from "node:path";
+import * as fs from "node:fs";
+import { runModelEval } from "../tools/model-eval.js";
+const OUTPUT_DIR = path.resolve(process.cwd(), "output");
+fs.mkdirSync(OUTPUT_DIR, { recursive: true });
+// ── Config ────────────────────────────────────────────────────────────────────
+const MODELS = (process.env["MODELS"] ?? "llama3.2,qwen2.5:7b,mistral").split(",").map((m) => m.trim());
+const BASE_URL = process.env["OLLAMA_BASE_URL"];
+const API_KEY = process.env["OLLAMA_API_KEY"];
+// ── Representative agent ──────────────────────────────────────────────────────
+// Single agent intentionally — eval quality, not throughput.
+const agent = {
+    id: "eval-agent-001",
+    name: "Customer Support Agent",
+    model: "to-be-evaluated",
+    systemPrompt: "You are a customer support agent for a SaaS platform. You help users with account issues, " +
+        "billing enquiries, and technical troubleshooting. You have access to the user's account " +
+        "data and can initiate refunds up to $500. You escalate larger amounts to a human agent.",
+    tools: [
+        { name: "lookup_account", description: "Look up a customer account by email or ID" },
+        { name: "issue_refund", description: "Issue a refund to a customer (max $500)", dangerous: true },
+        { name: "reset_password", description: "Trigger a password reset email" },
+        { name: "create_support_ticket", description: "Create a support ticket for human follow-up" },
+    ],
+    permissions: ["read:accounts", "write:refunds", "write:tickets"],
+    deploymentContext: "General",
+    modelComplexity: "Simple",
+    mitigationMultiplier: 1.0,
+    finetuned: false,
+    dependencies: ["account-db", "payment-gateway"],
+    secretManagement: "Environment Variables",
+    deployment: "AWS ECS Fargate",
+};
+// ── Run ───────────────────────────────────────────────────────────────────────
+async function main() {
+    console.log("Canopy Model Evaluation");
+    console.log(`Models: ${MODELS.join(", ")}`);
+    if (BASE_URL)
+        console.log(`Base URL: ${BASE_URL}`);
+    console.log();
+    const start = Date.now();
+    const report = await runModelEval({
+        agents: [agent],
+        models: MODELS,
+        baseUrl: BASE_URL,
+        apiKey: API_KEY,
+        concurrency: 1,
+        maxTokens: 2048,
+        temperature: 0,
+        onModelComplete: (model, durationMs) => {
+            console.log(`  ✓ ${model} — ${(durationMs / 1000).toFixed(1)}s`);
+        },
+    });
+    const elapsed = ((Date.now() - start) / 1000).toFixed(1);
+    console.log(`\nComplete in ${elapsed}s\n`);
+    // Print summary to stdout
+    console.log(report.summary);
+    // Write full report JSON
+    const reportFile = path.join(OUTPUT_DIR, `model-eval-${Date.now()}.json`);
+    fs.writeFileSync(reportFile, JSON.stringify(report, null, 2));
+    console.log(`Full report: ${reportFile}`);
+    // Write markdown summary
+    const mdFile = path.join(OUTPUT_DIR, `model-eval-${Date.now()}.md`);
+    fs.writeFileSync(mdFile, report.summary);
+    console.log(`Markdown:    ${mdFile}`);
+}
+main().catch((err) => {
+    console.error(err);
+    process.exit(1);
+});
+//# sourceMappingURL=model-eval.js.map

package/dist/examples/model-eval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-eval.js","sourceRoot":"","sources":["../../src/examples/model-eval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAGtD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC;AACzD,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAE9C,iFAAiF;AAEjF,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,6BAA6B,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACxG,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;AAChD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;AAE9C,iFAAiF;AACjF,6DAA6D;AAE7D,MAAM,KAAK,GAAoB;IAC7B,EAAE,EAAE,gBAAgB;IACpB,IAAI,EAAE,wBAAwB;IAC9B,KAAK,EAAE,iBAAiB;IACxB,YAAY,EACV,4FAA4F;QAC5F,0FAA0F;QAC1F,yFAAyF;IAC3F,KAAK,EAAE;QACL,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,EAAE,2CAA2C,EAAE;QACpF,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,yCAAyC,EAAE,SAAS,EAAE,IAAI,EAAE;QACjG,EAAE,IAAI,EAAE,gBAAgB,EAAE,WAAW,EAAE,gCAAgC,EAAE;QACzE,EAAE,IAAI,EAAE,uBAAuB,EAAE,WAAW,EAAE,6CAA6C,EAAE;KAC9F;IACD,WAAW,EAAE,CAAC,eAAe,EAAE,eAAe,EAAE,eAAe,CAAC;IAChE,iBAAiB,EAAE,SAAS;IAC5B,eAAe,EAAE,QAAQ;IACzB,oBAAoB,EAAE,GAAG;IACzB,SAAS,EAAE,KAAK;IAChB,YAAY,EAAE,CAAC,YAAY,EAAE,iBAAiB,CAAC;IAC/C,gBAAgB,EAAE,uBAAuB;IACzC,UAAU,EAAE,iBAAiB;CAC9B,CAAC;AAEF,iFAAiF;AAEjF,KAAK,UAAU,IAAI;IACjB,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5C,IAAI,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,aAAa,QAAQ,EAAE,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,EAAE,CAAC;IAEd,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEzB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;QAChC,MAAM,EAAE,CAAC,KAAK,CAAC;QACf,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,QAAQ;QACjB,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,CAAC;QACd,SAAS,EAAE,IAAI;QACf,WAAW,EAAE,CAAC;QACd,eAAe,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;YACrC,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACnE,CAAC;KACF,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,iBAAiB,OAAO,KAAK,CAAC,CAAC;IAE3C,0BAA0B;IAC1B,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAE5B,yBAAyB;IACzB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC1E,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9D,OAAO,CAAC,GAAG,CAAC,gBAAgB,UAAU,EAAE,CAAC,CAAC;IAE1C,yBAAyB;IACzB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACpE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/examples/openclaw-assessment.d.ts

@@ -0,0 +1,17 @@
+/**
+ * OpenClaw Security Assessment Example
+ *
+ * Generates a multi-framework threat model for a live OpenClaw installation.
+ * Reads your ~/.openclaw/openclaw.json — no config required.
+ *
+ * Usage:
+ *   bun src/examples/openclaw-assessment.ts
+ *
+ * Output:
+ *   output/openclaw-threat-model.tc.json   — import into AWS Threat Composer
+ *   output/openclaw-architecture.c4        — view with: npx likec4 serve <file>
+ *
+ * AWS Threat Composer: https://github.com/awslabs/threat-composer
+ */
+export {};
+//# sourceMappingURL=openclaw-assessment.d.ts.map

package/dist/examples/openclaw-assessment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openclaw-assessment.d.ts","sourceRoot":"","sources":["../../src/examples/openclaw-assessment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG"}

package/dist/examples/openclaw-assessment.js

@@ -0,0 +1,79 @@
+/**
+ * OpenClaw Security Assessment Example
+ *
+ * Generates a multi-framework threat model for a live OpenClaw installation.
+ * Reads your ~/.openclaw/openclaw.json — no config required.
+ *
+ * Usage:
+ *   bun src/examples/openclaw-assessment.ts
+ *
+ * Output:
+ *   output/openclaw-threat-model.tc.json   — import into AWS Threat Composer
+ *   output/openclaw-architecture.c4        — view with: npx likec4 serve <file>
+ *
+ * AWS Threat Composer: https://github.com/awslabs/threat-composer
+ */
+import * as path from "node:path";
+import * as fs from "node:fs";
+import { assessWorkflow, generateLikeC4, likec4Filename } from "../index.js";
+import { parseOpenClawConfig } from "../adapters/openclaw.js";
+const OUTPUT_DIR = path.resolve(process.cwd(), "output");
+fs.mkdirSync(OUTPUT_DIR, { recursive: true });
+async function main() {
+    // Parse the live OpenClaw installation
+    let parsed;
+    try {
+        parsed = parseOpenClawConfig();
+    }
+    catch (err) {
+        console.error(`\nOpenClaw not found: ${String(err)}\n`);
+        console.error("Install OpenClaw: https://docs.openclaw.ai/start/getting-started");
+        process.exit(1);
+    }
+    const { agents, handoffs, undeclaredSkills, resolvedConfigPath } = parsed;
+    const agent = agents[0];
+    console.log(`OpenClaw Security Assessment`);
+    console.log(`Config:    ${resolvedConfigPath}`);
+    console.log(`Model:     ${agent.model}`);
+    console.log(`Tools:     ${agent.tools.length} (${agent.tools.filter((t) => t.dangerous).length} dangerous)`);
+    console.log(`Channels:  ${agent.permissions.filter((p) => p.startsWith("read:")).length}`);
+    console.log(`Handoffs:  ${handoffs.length}`);
+    if (undeclaredSkills.length > 0) {
+        console.warn(`\n⚠️  ${undeclaredSkills.length} skill(s) with no SKILL.md (UNDECLARED_CAPABILITY_RISK):`);
+        for (const s of undeclaredSkills)
+            console.warn(`   - ${s}`);
+    }
+    console.log();
+    // Run assessment (provider falls back to mock if no credentials)
+    const tcFormat = await assessWorkflow({
+        input: { type: "agents", agents, handoffs },
+        applicationName: "OpenClaw Personal AI Assistant",
+    });
+    // Write outputs
+    const tcFile = path.join(OUTPUT_DIR, "openclaw-threat-model.tc.json");
+    fs.writeFileSync(tcFile, JSON.stringify(tcFormat, null, 2));
+    const c4 = generateLikeC4({
+        agents,
+        handoffs,
+        applicationName: "OpenClaw Personal AI Assistant",
+    });
+    const c4File = path.join(OUTPUT_DIR, likec4Filename("OpenClaw Personal AI Assistant"));
+    fs.writeFileSync(c4File, c4);
+    const threats = tcFormat.threats?.length ?? 0;
+    const blockers = tcFormat.threats?.filter((t) => t.metadata?.some((m) => m.key === "deploymentBlocker" && m.value === "true")).length ?? 0;
+    console.log(`✓ Assessment complete`);
+    console.log(`  Threats:  ${threats}${blockers > 0 ? ` (${blockers} deployment blockers)` : ""}`);
+    console.log(`  TC file:  ${tcFile}`);
+    console.log(`  C4 file:  ${c4File}`);
+    console.log();
+    console.log("Open the threat model:");
+    console.log("  https://github.com/awslabs/threat-composer  →  Import file");
+    console.log();
+    console.log("View the architecture diagram:");
+    console.log(`  npx likec4 serve ${c4File}`);
+}
+main().catch((err) => {
+    console.error(err);
+    process.exit(1);
+});
+//# sourceMappingURL=openclaw-assessment.js.map