@waratahlabs/canopy 0.5.0

package/dist/examples/openclaw-assessment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openclaw-assessment.js","sourceRoot":"","sources":["../../src/examples/openclaw-assessment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC;AACzD,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAE9C,KAAK,UAAU,IAAI;IACjB,uCAAuC;IACvC,IAAI,MAA8C,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,GAAG,mBAAmB,EAAE,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,yBAAyB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxD,OAAO,CAAC,KAAK,CAAC,kEAAkE,CAAC,CAAC;QAClF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC;IAC1E,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC;IAEzB,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,cAAc,kBAAkB,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,aAAa,CAAC,CAAC;IAC7G,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3F,OAAO,CAAC,GAAG,CAAC,cAAc,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7C,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,CAAC,IAAI,CAAC,SAAS,gBAAgB,CAAC,MAAM,0DAA0D,CAAC,CAAC;QACzG,KAAK,MAAM,CAAC,IAAI,gBAAgB;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,CAAC;IAEd,iEAAiE;IACjE,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC;QACpC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE;QAC3C,eAAe,EAAE,gCAAgC;KAClD,CAAC,CAAC;IAEH,gBAAgB;IAChB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,+BAA+B,CAAC,CAAC;IACtE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAE5D,MAAM,EAAE,GAAG,cAAc,CAAC;QACxB,MAAM;QACN,QAAQ;QACR,eAAe,EAAE,gCAAgC;KAClD,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,gCAAgC,CAAC,CAAC,CAAC;IACvF,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAE7B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAC9C,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,mBAAmB,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,CAC7E,CAAC,MAAM,IAAI,CAAC,CAAC;IAEd,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,eAAe,OAAO,GAAG,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,uBAAuB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjG,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,EAAE,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,EAAE,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACtC,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;IAC5E,OAAO,CAAC,GAAG,EAAE,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,sBAAsB,MAAM,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/examples/simple-assessment.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=simple-assessment.d.ts.map

package/dist/examples/simple-assessment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"simple-assessment.d.ts","sourceRoot":"","sources":["../../src/examples/simple-assessment.ts"],"names":[],"mappings":""}

package/dist/examples/simple-assessment.js

@@ -0,0 +1,146 @@
+import * as path from "node:path";
+import { calculateAIVSSScore, buildBatchRequests, AIVSSKnowledgeBase, loadAtlasData, } from "../aivss/index";
+import { getAtlasContext } from "../aivss/atlas/loader";
+import { ATLAS_COVERAGE_MATRIX, getTechniquesForMetric, } from "../aivss/atlas/coverage-matrix";
+import demoAgent from "./demo-agent-definition.json";
+const SAMPLE_RESPONSES = [
+    {
+        metricCode: "MR",
+        subCategoryScores: {
+            "Evasion Resistance": "High",
+            "Gradient Masking / Obfuscation": "Medium",
+            "Robustness Certification": "Medium",
+        },
+        findings: ["Adversarial prompt testing exists, but formal robustness validation is limited."],
+        deploymentBlocker: false,
+    },
+    {
+        metricCode: "DS",
+        subCategoryScores: {
+            "Data Confidentiality": "High",
+            "Data Integrity": "Medium",
+            "Data Provenance": "Medium",
+        },
+        findings: ["Customer data access and refund tooling increase confidentiality exposure."],
+        deploymentBlocker: false,
+    },
+    {
+        metricCode: "EI",
+        subCategoryScores: {
+            "Bias and Discrimination": "Low",
+            "Transparency and Explainability": "Medium",
+            Accountability: "Low",
+            "Societal Impact": "Low",
+        },
+        findings: ["Operator accountability is defined, but explanation quality is still workflow-dependent."],
+        deploymentBlocker: false,
+    },
+    {
+        metricCode: "DC",
+        subCategoryScores: {
+            "Safety-Critical Applications": "None",
+            "Financial Impact": "High",
+            "Reputational Damage": "Medium",
+            "Operational Disruption": "Medium",
+        },
+        findings: ["Refund authority creates direct financial and reputational risk if abused."],
+        deploymentBlocker: false,
+    },
+    {
+        metricCode: "AD",
+        subCategoryScores: {
+            "Continuous Monitoring": "Medium",
+            "Retraining Capabilities": "Low",
+            "Threat Intelligence Integration": "Medium",
+            "Adversarial Training": "Medium",
+        },
+        findings: ["Monitoring exists, but threat feedback into hardening is only partially mature."],
+        deploymentBlocker: false,
+    },
+    {
+        metricCode: "AA",
+        subCategoryScores: {
+            "Model Inversion": "Low",
+            "Model Extraction": "Low",
+            "Membership Inference": "Medium",
+        },
+        findings: ["Conversation and customer context retention make membership inference worth monitoring."],
+        deploymentBlocker: false,
+    },
+    {
+        metricCode: "LL",
+        subCategoryScores: {
+            "Development Security": "Medium",
+            "Training Security": "Low",
+            "Deployment Security": "Medium",
+            "Operational Security": "Medium",
+        },
+        findings: ["Runtime and dependency controls are reasonable but not yet hardened end-to-end."],
+        deploymentBlocker: false,
+    },
+    {
+        metricCode: "GV",
+        subCategoryScores: {
+            "Regulatory Compliance": "Medium",
+            Auditing: "Medium",
+            "Risk Management": "Medium",
+            "Human Oversight": "Low",
+            "Ethical Framework Alignment": "Low",
+        },
+        findings: ["Financial-services use increases governance expectations around traceability and review."],
+        deploymentBlocker: false,
+    },
+    {
+        metricCode: "CS",
+        subCategoryScores: {
+            "Model Manipulation / Prompt Injection": "High",
+            "Data Poisoning": "Medium",
+            "Sensitive Data Disclosure": "High",
+            "Model Stealing": "Low",
+            "Failure / Malfunctioning": "Medium",
+            "Insecure Supply Chain": "Medium",
+            "Insecure Apps / Plugins": "High",
+            "Denial of Service (DoS)": "Low",
+            "Loss of Governance / Compliance": "Medium",
+        },
+        findings: ["Dangerous refund and customer-data tools materially raise prompt injection impact."],
+        deploymentBlocker: true,
+    },
+];
+async function assessSingleAgent() {
+    const agent = demoAgent;
+    const kb = new AIVSSKnowledgeBase();
+    const requests = await buildBatchRequests({
+        agents: [agent],
+        useKnowledgeBase: true,
+        model: "claude-opus-4-7",
+        temperature: 0,
+        maxTokens: 1024,
+    }, kb);
+    const score = calculateAIVSSScore({
+        agentDefinition: agent,
+        metricResponses: SAMPLE_RESPONSES,
+        baseScore: 2.4,
+        impactScore: 7.2,
+        temporalScore: 0.95,
+    });
+    console.log(`Built ${requests.length} V4 assessment requests for ${agent.name}`);
+    console.log(`Overall AIVSS score: ${score.aivssScore.toFixed(2)} (${score.severity})`);
+    console.log(`Deployment blocker: ${score.deploymentBlocker ? "yes" : "no"}`);
+    console.log("\nSample request structure:");
+    console.log(JSON.stringify(requests[0], null, 2));
+    console.log("\n---");
+    console.log("Top findings:");
+    for (const finding of score.allFindings.slice(0, 3)) {
+        console.log(`- ${finding}`);
+    }
+    const atlas = loadAtlasData(path.resolve(process.cwd(), "vendor/atlas-release/ATLAS-2026.07.yaml"));
+    const sampleMetric = "MR";
+    const ids = getTechniquesForMetric(sampleMetric);
+    console.log(`\nATLAS coverage for ${sampleMetric}: ${ids.length} technique IDs mapped, ${getAtlasContext(atlas, ids)
+        .split("\n")
+        .filter((line) => line.startsWith("- ")).length} resolved in ATLAS data`);
+    console.log(`Total coverage matrix entries: ${ATLAS_COVERAGE_MATRIX.length}`);
+}
+assessSingleAgent().catch(console.error);
+//# sourceMappingURL=simple-assessment.js.map

package/dist/examples/simple-assessment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"simple-assessment.js","sourceRoot":"","sources":["../../src/examples/simple-assessment.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,GAGd,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,gCAAgC,CAAC;AACxC,OAAO,SAAS,MAAM,8BAA8B,CAAC;AAErD,MAAM,gBAAgB,GAA+B;IACnD;QACE,UAAU,EAAE,IAAI;QAChB,iBAAiB,EAAE;YACjB,oBAAoB,EAAE,MAAM;YAC5B,gCAAgC,EAAE,QAAQ;YAC1C,0BAA0B,EAAE,QAAQ;SACrC;QACD,QAAQ,EAAE,CAAC,iFAAiF,CAAC;QAC7F,iBAAiB,EAAE,KAAK;KACzB;IACD;QACE,UAAU,EAAE,IAAI;QAChB,iBAAiB,EAAE;YACjB,sBAAsB,EAAE,MAAM;YAC9B,gBAAgB,EAAE,QAAQ;YAC1B,iBAAiB,EAAE,QAAQ;SAC5B;QACD,QAAQ,EAAE,CAAC,4EAA4E,CAAC;QACxF,iBAAiB,EAAE,KAAK;KACzB;IACD;QACE,UAAU,EAAE,IAAI;QAChB,iBAAiB,EAAE;YACjB,yBAAyB,EAAE,KAAK;YAChC,iCAAiC,EAAE,QAAQ;YAC3C,cAAc,EAAE,KAAK;YACrB,iBAAiB,EAAE,KAAK;SACzB;QACD,QAAQ,EAAE,CAAC,0FAA0F,CAAC;QACtG,iBAAiB,EAAE,KAAK;KACzB;IACD;QACE,UAAU,EAAE,IAAI;QAChB,iBAAiB,EAAE;YACjB,8BAA8B,EAAE,MAAM;YACtC,kBAAkB,EAAE,MAAM;YAC1B,qBAAqB,EAAE,QAAQ;YAC/B,wBAAwB,EAAE,QAAQ;SACnC;QACD,QAAQ,EAAE,CAAC,4EAA4E,CAAC;QACxF,iBAAiB,EAAE,KAAK;KACzB;IACD;QACE,UAAU,EAAE,IAAI;QAChB,iBAAiB,EAAE;YACjB,uBAAuB,EAAE,QAAQ;YACjC,yBAAyB,EAAE,KAAK;YAChC,iCAAiC,EAAE,QAAQ;YAC3C,sBAAsB,EAAE,QAAQ;SACjC;QACD,QAAQ,EAAE,CAAC,iFAAiF,CAAC;QAC7F,iBAAiB,EAAE,KAAK;KACzB;IACD;QACE,UAAU,EAAE,IAAI;QAChB,iBAAiB,EAAE;YACjB,iBAAiB,EAAE,KAAK;YACxB,kBAAkB,EAAE,KAAK;YACzB,sBAAsB,EAAE,QAAQ;SACjC;QACD,QAAQ,EAAE,CAAC,yFAAyF,CAAC;QACrG,iBAAiB,EAAE,KAAK;KACzB;IACD;QACE,UAAU,EAAE,IAAI;QAChB,iBAAiB,EAAE;YACjB,sBAAsB,EAAE,QAAQ;YAChC,mBAAmB,EAAE,KAAK;YAC1B,qBAAqB,EAAE,QAAQ;YAC/B,sBAAsB,EAAE,QAAQ;SACjC;QACD,QAAQ,EAAE,CAAC,iFAAiF,CAAC;QAC7F,iBAAiB,EAAE,KAAK;KACzB;IACD;QACE,UAAU,EAAE,IAAI;QAChB,iBAAiB,EAAE;YACjB,uBAAuB,EAAE,QAAQ;YACjC,QAAQ,EAAE,QAAQ;YAClB,iBAAiB,EAAE,QAAQ;YAC3B,iBAAiB,EAAE,KAAK;YACxB,6BAA6B,EAAE,KAAK;SACrC;QACD,QAAQ,EAAE,CAAC,0FAA0F,CAAC;QACtG,iBAAiB,EAAE,KAAK;KACzB;IACD;QACE,UAAU,EAAE,IAAI;QAChB,iBAAiB,EAAE;YACjB,uCAAuC,EAAE,MAAM;YAC/C,gBAAgB,EAAE,QAAQ;YAC1B,2BAA2B,EAAE,MAAM;YACnC,gBAAgB,EAAE,KAAK;YACvB,0BAA0B,EAAE,QAAQ;YACpC,uBAAuB,EAAE,QAAQ;YACjC,yBAAyB,EAAE,MAAM;YACjC,yBAAyB,EAAE,KAAK;YAChC,iCAAiC,EAAE,QAAQ;SAC5C;QACD,QAAQ,EAAE,CAAC,oFAAoF,CAAC;QAChG,iBAAiB,EAAE,IAAI;KACxB;CACF,CAAC;AAEF,KAAK,UAAU,iBAAiB;IAC9B,MAAM,KAAK,GAAoB,SAA4B,CAAC;IAC5D,MAAM,EAAE,GAAG,IAAI,kBAAkB,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CACvC;QACE,MAAM,EAAE,CAAC,KAAK,CAAC;QACf,gBAAgB,EAAE,IAAI;QACtB,KAAK,EAAE,iBAAiB;QACxB,WAAW,EAAE,CAAC;QACd,SAAS,EAAE,IAAI;KAChB,EACD,EAAE,CACH,CAAC;IAEF,MAAM,KAAK,GAAG,mBAAmB,CAAC;QAChC,eAAe,EAAE,KAAK;QACtB,eAAe,EAAE,gBAAgB;QACjC,SAAS,EAAE,GAAG;QACd,WAAW,EAAE,GAAG;QAChB,aAAa,EAAE,IAAI;KACpB,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CAAC,SAAS,QAAQ,CAAC,MAAM,+BAA+B,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,wBAAwB,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvF,OAAO,CAAC,GAAG,CAAC,uBAAuB,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAC3C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrB,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC7B,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;IAC9B,CAAC;IAED,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,yCAAyC,CAAC,CAAC,CAAC;IACpG,MAAM,YAAY,GAAG,IAAa,CAAC;IACnC,MAAM,GAAG,GAAG,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CACT,wBAAwB,YAAY,KAAK,GAAG,CAAC,MAAM,0BAA0B,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC;SACrG,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,yBAAyB,CAC3E,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,kCAAkC,qBAAqB,CAAC,MAAM,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,iBAAiB,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC"}

package/dist/examples/threat-model-demo.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=threat-model-demo.d.ts.map

package/dist/examples/threat-model-demo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"threat-model-demo.d.ts","sourceRoot":"","sources":["../../src/examples/threat-model-demo.ts"],"names":[],"mappings":""}

package/dist/examples/threat-model-demo.js

@@ -0,0 +1,103 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { assessWorkflow, generateLikeC4, likec4Filename } from "../index";
+import { assembleTCFormat, severityKey } from "../output/tc-assembler";
+import { ATLAS_COVERAGE_MATRIX, loadAtlasData, } from "../aivss";
+const PROJECT_ROOT = path.resolve(import.meta.dir, "../..");
+const OUTPUT_DIR = path.join(PROJECT_ROOT, "output");
+const OUTPUT_FILE = path.join(OUTPUT_DIR, "demo-threat-model.tc.json");
+const DIAGRAM_FILE = path.join(OUTPUT_DIR, likec4Filename("Customer Support Agent Demo"));
+const DEMO_AGENT_PATH = path.join(PROJECT_ROOT, "src/examples/demo-agent-definition.json");
+const ATLAS_YAML = path.join(PROJECT_ROOT, "vendor/atlas-release/ATLAS-2026.07.yaml");
+function loadDemoAgent() {
+    const raw = fs.readFileSync(DEMO_AGENT_PATH, "utf8");
+    return JSON.parse(raw);
+}
+function ensureOutputDir() {
+    if (!fs.existsSync(OUTPUT_DIR)) {
+        fs.mkdirSync(OUTPUT_DIR, { recursive: true });
+    }
+}
+// Fallback when no provider credentials are available — assemble a TC document
+// using stub slot fills so the artifact is still openable in Threat Composer
+// and the assembler path is exercised end-to-end.
+function buildMockOutput(agent) {
+    const atlasData = loadAtlasData(ATLAS_YAML);
+    const filledSlots = new Map();
+    const severityBySubCategory = new Map();
+    for (const entry of ATLAS_COVERAGE_MATRIX) {
+        severityBySubCategory.set(severityKey(agent.id, entry.metric, entry.subCategory), "Medium");
+        const techniqueId = entry.atlasTechniqueIds[0];
+        if (!techniqueId)
+            continue;
+        const technique = atlasData.techniqueById.get(techniqueId);
+        if (!technique)
+            continue;
+        filledSlots.set(`${agent.id}::${techniqueId}::${entry.metric}::${entry.subCategory}`, {
+            threatSource: "An internet-based adversary",
+            prerequisites: `with network access to ${agent.name}`,
+            threatAction: `exploit ${entry.subCategory.toLowerCase()} weaknesses (${technique.id})`,
+            threatImpact: `compromise ${agent.deploymentContext.toLowerCase()} operations`,
+            impactedGoal: ["confidentiality", "integrity"],
+            impactedAssets: [agent.name.toLowerCase()],
+        });
+    }
+    return assembleTCFormat({
+        agents: [agent],
+        handoffs: [],
+        metricResponses: [],
+        atlasData,
+        coverageMatrix: ATLAS_COVERAGE_MATRIX,
+        filledSlots,
+        severityBySubCategory: severityBySubCategory,
+        applicationName: `${agent.name} (mock — no provider credentials)`,
+    });
+}
+async function main() {
+    ensureOutputDir();
+    const agent = loadDemoAgent();
+    let output;
+    let mode;
+    const hasAnthropicKey = Boolean(process.env.ANTHROPIC_API_KEY);
+    if (!hasAnthropicKey) {
+        process.stdout.write("ANTHROPIC_API_KEY not set — falling back to mock slot fills.\n");
+        output = buildMockOutput(agent);
+        mode = "mock";
+    }
+    else {
+        try {
+            output = await assessWorkflow({
+                input: { type: "agents", agents: [agent] },
+                provider: { type: "anthropic" },
+                applicationName: `${agent.name} — AIVSS Threat Model`,
+            });
+            mode = "live";
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            process.stderr.write(`Live provider call failed (${message}). Writing mock output instead.\n`);
+            output = buildMockOutput(agent);
+            mode = "mock";
+        }
+    }
+    fs.writeFileSync(OUTPUT_FILE, JSON.stringify(output, null, 2));
+    // Generate LikeC4 architecture diagram alongside the threat model
+    const c4 = generateLikeC4({
+        agents: [agent],
+        handoffs: [],
+        applicationName: "Customer Support Agent Demo",
+    });
+    fs.writeFileSync(DIAGRAM_FILE, c4);
+    const threatCount = output.threats?.length ?? 0;
+    const mitigationCount = output.mitigations?.length ?? 0;
+    const linkCount = output.mitigationLinks?.length ?? 0;
+    process.stdout.write(`Threat model (${mode}): ${threatCount} threats, ${mitigationCount} mitigations, ${linkCount} links. Written to ${OUTPUT_FILE}\n`);
+    process.stdout.write(`Architecture diagram written to ${DIAGRAM_FILE}\n`);
+    process.stdout.write(`  To view: npx likec4 serve ${DIAGRAM_FILE}\n`);
+}
+main().catch((err) => {
+    const message = err instanceof Error ? err.stack ?? err.message : String(err);
+    process.stderr.write(`threat-model-demo failed: ${message}\n`);
+    process.exit(1);
+});
+//# sourceMappingURL=threat-model-demo.js.map

package/dist/examples/threat-model-demo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"threat-model-demo.js","sourceRoot":"","sources":["../../src/examples/threat-model-demo.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE1E,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EACL,qBAAqB,EACrB,aAAa,GACd,MAAM,UAAU,CAAC;AAIlB,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAC5D,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;AACrD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,2BAA2B,CAAC,CAAC;AACvE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,6BAA6B,CAAC,CAAC,CAAC;AAC1F,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAC/B,YAAY,EACZ,yCAAyC,CAC1C,CAAC;AACF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAC1B,YAAY,EACZ,yCAAyC,CAC1C,CAAC;AAEF,SAAS,aAAa;IACpB,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACrD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;AAC5C,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,6EAA6E;AAC7E,kDAAkD;AAClD,SAAS,eAAe,CAAC,KAAsB;IAC7C,MAAM,SAAS,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,IAAI,GAAG,EAAuB,CAAC;IACnD,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAoB,CAAC;IAE1D,KAAK,MAAM,KAAK,IAAI,qBAAqB,EAAE,CAAC;QAC1C,qBAAqB,CAAC,GAAG,CACvB,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,EACtD,QAAQ,CACT,CAAC;QACF,MAAM,WAAW,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC,WAAW;YAAE,SAAS;QAC3B,MAAM,SAAS,GAAG,SAAS,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC3D,IAAI,CAAC,SAAS;YAAE,SAAS;QACzB,WAAW,CAAC,GAAG,CACb,GAAG,KAAK,CAAC,EAAE,KAAK,WAAW,KAAK,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,WAAW,EAAE,EACpE;YACE,YAAY,EAAE,6BAA6B;YAC3C,aAAa,EAAE,0BAA0B,KAAK,CAAC,IAAI,EAAE;YACrD,YAAY,EAAE,WAAW,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,gBAAgB,SAAS,CAAC,EAAE,GAAG;YACvF,YAAY,EAAE,cAAc,KAAK,CAAC,iBAAiB,CAAC,WAAW,EAAE,aAAa;YAC9E,YAAY,EAAE,CAAC,iBAAiB,EAAE,WAAW,CAAC;YAC9C,cAAc,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;SAC3C,CACF,CAAC;IACJ,CAAC;IAED,OAAO,gBAAgB,CAAC;QACtB,MAAM,EAAE,CAAC,KAAK,CAAC;QACf,QAAQ,EAAE,EAAE;QACZ,eAAe,EAAE,EAAE;QACnB,SAAS;QACT,cAAc,EAAE,qBAAqB;QACrC,WAAW;QACX,qBAAqB,EAAE,qBAGtB;QACD,eAAe,EAAE,GAAG,KAAK,CAAC,IAAI,mCAAmC;KAClE,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,eAAe,EAAE,CAAC;IAClB,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAE9B,IAAI,MAA0B,CAAC;IAC/B,IAAI,IAAqB,CAAC;IAE1B,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC/D,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,gEAAgE,CACjE,CAAC;QACF,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,GAAG,MAAM,CAAC;IAChB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,cAAc,CAAC;gBAC5B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE;gBAC1C,QAAQ,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;gBAC/B,eAAe,EAAE,GAAG,KAAK,CAAC,IAAI,uBAAuB;aACtD,CAAC,CAAC;YACH,IAAI,GAAG,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,8BAA8B,OAAO,mCAAmC,CACzE,CAAC;YACF,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,GAAG,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAE/D,kEAAkE;IAClE,MAAM,EAAE,GAAG,cAAc,CAAC;QACxB,MAAM,EAAE,CAAC,KAAK,CAAC;QACf,QAAQ,EAAE,EAAE;QACZ,eAAe,EAAE,6BAA6B;KAC/C,CAAC,CAAC;IACH,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAEnC,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC;IAChD,MAAM,eAAe,GAAG,MAAM,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,EAAE,MAAM,IAAI,CAAC,CAAC;IACtD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iBAAiB,IAAI,MAAM,WAAW,aAAa,eAAe,iBAAiB,SAAS,sBAAsB,WAAW,IAAI,CAClI,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mCAAmC,YAAY,IAAI,CACpD,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,+BAA+B,YAAY,IAAI,CAChD,CAAC;AACJ,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC9E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,OAAO,IAAI,CAAC,CAAC;IAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,60 @@
+import type { AgentDefinition, DeploymentContext, MetricCode } from "./aivss/types";
+import type { HandoffEdge, N8NWorkflow } from "./adapters/types";
+import { type ProviderConfig } from "./providers";
+import type { DataExchangeFormat } from "./output/tc-types";
+import type { BatchProvider } from "./batch/providers/index.js";
+export { createProvider } from "./providers";
+export { parseN8NWorkflow } from "./adapters/n8n";
+export { parseOpenClawConfig } from "./adapters/openclaw.js";
+export { parseLangfuseTraces, loadOverlaysFromYaml } from "./adapters/langfuse.js";
+export { walkA2AGraph, fetchA2AAgent } from "./adapters/a2a.js";
+export type { OpenClawAdapterOptions, OpenClawAdapterResult } from "./adapters/openclaw.js";
+export type { LangfuseAdapterConfig, AgentOverlay } from "./adapters/langfuse.js";
+export type { A2AAgentCard, A2ASkill, A2AWalkOptions, A2AWalkResult } from "./adapters/a2a.js";
+export { generateLikeC4, likec4Filename } from "./output/likec4-generator";
+export { runBedrockBatch, submitBedrockBatch, fetchBedrockBatch } from "./batch/bedrock-batch-runner.js";
+export { submitAnthropicBatch, fetchAnthropicBatch } from "./batch/anthropic-batch-runner.js";
+export { createBatchProvider, BedrockBatchProvider, AnthropicBatchProvider, OllamaBatchProvider } from "./batch/providers/index.js";
+export { runModelEval } from "./tools/model-eval.js";
+export { buildBaseline, saveBaseline, loadRecentBaselines } from "./baseline/store.js";
+export { diffBaselines, formatDiff } from "./baseline/diff.js";
+export type { AssessmentBaseline, AgentSummary } from "./baseline/store.js";
+export type { BaselineDiff, SeverityChange, AgentDelta } from "./baseline/diff.js";
+export type { LikeC4GeneratorOptions } from "./output/likec4-generator";
+export type { BatchProvider, BatchProviderConfig, BedrockBatchProviderConfig, AnthropicBatchProviderConfig, AnthropicBatchConfig, OllamaBatchProviderConfig, OllamaBatchConfig } from "./batch/providers/index.js";
+export type { ModelEvalReport, ModelEvalOptions, ModelRecommendation, MetricAgreement, ModelVerdict } from "./tools/model-eval.js";
+export type { BedrockBatchConfig, BatchRunOptions, BatchRunResult, BatchJobHandle, SubmitOptions, FetchOptions, FetchStatus } from "./batch/bedrock-batch-runner.js";
+export type { AnthropicBatchHandle, AnthropicSubmitOptions, AnthropicFetchOptions, AnthropicFetchStatus } from "./batch/anthropic-batch-runner.js";
+export type { InferenceProvider, ProviderConfig } from "./providers";
+export type { DataExchangeFormat } from "./output/tc-types";
+export type { AgentDefinition } from "./aivss/types";
+export type { HandoffEdge, N8NWorkflow } from "./adapters/types";
+export type AssessWorkflowInput = {
+    type: "n8n";
+    workflow: N8NWorkflow;
+} | {
+    type: "agents";
+    agents: AgentDefinition[];
+    handoffs?: HandoffEdge[];
+};
+export interface AssessWorkflowOptions {
+    input: AssessWorkflowInput;
+    provider?: ProviderConfig;
+    deploymentContext?: DeploymentContext;
+    applicationName?: string;
+    atlasYamlPath?: string;
+    /**
+     * When provided, Canopy runs a live batch inference job to obtain real
+     * per-sub-category severity scores instead of the PoC mock (Medium).
+     *
+     * Use `createBatchProvider({ type: "bedrock", ... })` or
+     * `createBatchProvider({ type: "anthropic", ... })` to get a provider,
+     * or implement `BatchProvider` directly for any other backend.
+     */
+    batchProvider?: BatchProvider;
+    /** Progress callback forwarded to the batch provider when batchProvider is set. */
+    onBatchProgress?: (status: string) => void;
+}
+export declare function assessWorkflow(options: AssessWorkflowOptions): Promise<DataExchangeFormat>;
+export declare const METRICS: readonly MetricCode[];
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EACV,eAAe,EACf,iBAAiB,EAEjB,UAAU,EAEX,MAAM,eAAe,CAAC;AAGvB,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,aAAa,CAAC;AAWrB,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAEhE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAChE,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC5F,YAAY,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAClF,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAC/F,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACzG,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAC9F,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACpI,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AACvF,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC/D,YAAY,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAC5E,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACnF,YAAY,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxE,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,4BAA4B,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AACnN,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACnI,YAAY,EAAE,kBAAkB,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AACrK,YAAY,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACnJ,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACrE,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEjE,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,WAAW,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,eAAe,EAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAA;CAAE,CAAC;AAE5E,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,mBAAmB,CAAC;IAC3B,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,mFAAmF;IACnF,eAAe,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;CAC5C;AAuFD,wBAAsB,cAAc,CAClC,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,kBAAkB,CAAC,CAoF7B;AAID,eAAO,MAAM,OAAO,EAAE,SAAS,UAAU,EAAiB,CAAC"}

package/dist/index.js

@@ -0,0 +1,155 @@
+import { ATLAS_COVERAGE_MATRIX, loadAtlasData, } from "./aivss";
+import { resolveAtlasYaml } from "./aivss/atlas/resolve-path";
+import { METRIC_CODES } from "./aivss/types";
+import { parseN8NWorkflow } from "./adapters/n8n";
+import { createProvider, } from "./providers";
+import { fillThreatSlots, } from "./output/slot-filler";
+import { assembleTCFormat, severityKey, slotKey, } from "./output/tc-assembler";
+export { createProvider } from "./providers";
+export { parseN8NWorkflow } from "./adapters/n8n";
+export { parseOpenClawConfig } from "./adapters/openclaw.js";
+export { parseLangfuseTraces, loadOverlaysFromYaml } from "./adapters/langfuse.js";
+export { walkA2AGraph, fetchA2AAgent } from "./adapters/a2a.js";
+export { generateLikeC4, likec4Filename } from "./output/likec4-generator";
+export { runBedrockBatch, submitBedrockBatch, fetchBedrockBatch } from "./batch/bedrock-batch-runner.js";
+export { submitAnthropicBatch, fetchAnthropicBatch } from "./batch/anthropic-batch-runner.js";
+export { createBatchProvider, BedrockBatchProvider, AnthropicBatchProvider, OllamaBatchProvider } from "./batch/providers/index.js";
+export { runModelEval } from "./tools/model-eval.js";
+export { buildBaseline, saveBaseline, loadRecentBaselines } from "./baseline/store.js";
+export { diffBaselines, formatDiff } from "./baseline/diff.js";
+// ATLAS path resolution lives in src/aivss/atlas/resolve-path.ts — one place
+// that knows the pinned content version and how to find the file both from a
+// checkout and from inside an installed package.
+// PoC simplification: real per-sub-category severity comes from live batch API
+// responses (Bedrock/Anthropic Messages Batches). For this PoC we mock every
+// sub-category as Medium so the assembler emits a meaningful output. When the
+// real batch path is wired in, replace this with severities extracted from
+// MetricAssessmentResponse.subCategoryScores.
+const MOCK_SEVERITY = "Medium";
+function buildSeverityMap(agents, coverage, responses) {
+    const map = new Map();
+    // Index responses by (agentId, metricCode). Responses without agentId are
+    // treated as global — applied to all agents (single-agent runs or pre-v0.3 data).
+    const perAgent = new Map(); // `${agentId}|${metricCode}`
+    const global = new Map(); // metricCode only
+    for (const r of responses) {
+        if (r.agentId) {
+            perAgent.set(`${r.agentId}|${r.metricCode}`, r);
+        }
+        else {
+            global.set(r.metricCode, r);
+        }
+    }
+    for (const agent of agents) {
+        for (const entry of coverage) {
+            const response = perAgent.get(`${agent.id}|${entry.metric}`) ??
+                global.get(entry.metric);
+            const severity = response?.subCategoryScores?.[entry.subCategory] ?? MOCK_SEVERITY;
+            map.set(severityKey(agent.id, entry.metric, entry.subCategory), severity);
+        }
+    }
+    return map;
+}
+function tacticForTechnique(atlas, techniqueId) {
+    const tech = atlas.techniqueById.get(techniqueId);
+    if (!tech || tech.tactics.length === 0)
+        return "unspecified";
+    return tech.tactics[0] ?? "unspecified";
+}
+async function fillAllSlots(provider, agents, coverage, atlas, batchSlotIndex, severityMap) {
+    const filled = new Map();
+    for (const agent of agents) {
+        for (const entry of coverage) {
+            const severity = severityMap.get(severityKey(agent.id, entry.metric, entry.subCategory));
+            if (!severity || severity === "None")
+                continue;
+            const techniqueId = entry.atlasTechniqueIds[0];
+            if (!techniqueId)
+                continue;
+            const technique = atlas.techniqueById.get(techniqueId);
+            if (!technique)
+                continue;
+            // Use batch-provided slots when available — skip the provider call entirely.
+            const batchSlot = batchSlotIndex.get(`${agent.id}|${entry.metric}|${entry.subCategory}`);
+            if (batchSlot) {
+                filled.set(slotKey(agent.id, techniqueId, entry.metric, entry.subCategory), batchSlot);
+                continue;
+            }
+            const tactic = tacticForTechnique(atlas, techniqueId);
+            const slots = await fillThreatSlots(provider, agent, technique, tactic, entry.metric, entry.subCategory, severity);
+            filled.set(slotKey(agent.id, techniqueId, entry.metric, entry.subCategory), slots);
+        }
+    }
+    return filled;
+}
+export async function assessWorkflow(options) {
+    // 1. Parse input
+    let agents;
+    let handoffs;
+    let workflowName;
+    if (options.input.type === "n8n") {
+        const result = parseN8NWorkflow(options.input.workflow, {
+            deploymentContext: options.deploymentContext,
+        });
+        agents = result.agents;
+        handoffs = result.handoffs;
+        workflowName = result.workflowName;
+    }
+    else {
+        agents = options.input.agents;
+        handoffs = options.input.handoffs ?? [];
+        workflowName = options.applicationName ?? "Direct Agents Assessment";
+    }
+    if (agents.length === 0) {
+        throw new Error("assessWorkflow: input produced zero agents");
+    }
+    // 2. Load ATLAS data
+    const atlasYamlPath = resolveAtlasYaml(options.atlasYamlPath);
+    const atlasData = loadAtlasData(atlasYamlPath);
+    // 3. Provider
+    const providerConfig = options.provider ?? { type: "bedrock" };
+    const provider = createProvider(providerConfig);
+    // 4. Severity map — live batch when batchProvider provided, mock otherwise
+    let metricResponses = [];
+    if (options.batchProvider) {
+        metricResponses = await options.batchProvider.runBatch(agents, {
+            onProgress: options.onBatchProgress,
+        });
+    }
+    const severityBySubCategory = buildSeverityMap(agents, ATLAS_COVERAGE_MATRIX, metricResponses);
+    // 5. Fill threat slots — use batch-provided slots where present, provider for the rest
+    const batchSlotIndex = new Map();
+    for (const r of metricResponses) {
+        if (!r.threatSlots || !r.agentId)
+            continue;
+        for (const [subCat, slots] of Object.entries(r.threatSlots)) {
+            batchSlotIndex.set(`${r.agentId}|${r.metricCode}|${subCat}`, slots);
+        }
+    }
+    const filledSlots = await fillAllSlots(provider, agents, ATLAS_COVERAGE_MATRIX, atlasData, batchSlotIndex, severityBySubCategory);
+    // 6. Assemble TC DataExchangeFormat
+    const bundle = {
+        agents,
+        handoffs,
+        metricResponses,
+        atlasData,
+        coverageMatrix: ATLAS_COVERAGE_MATRIX,
+        filledSlots,
+        severityBySubCategory,
+        applicationName: options.applicationName ?? workflowName,
+        // A caller-supplied batchProvider means some LLM produced these
+        // severities. HarnessBatchProvider delegates to the calling agent's own
+        // model; anything else is a provider batch API. Both are non-reproducible,
+        // but they are distinct provenance and the artifact should say which.
+        scoringMode: options.batchProvider
+            ? options.batchProvider.name === "harness-file-exchange"
+                ? "harness"
+                : "model"
+            : "model",
+    };
+    return assembleTCFormat(bundle);
+}
+// Quiet "unused import" diagnostics by re-exporting the metric codes constant
+// for downstream consumers that want the canonical metric ordering.
+export const METRICS = METRIC_CODES;
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,qBAAqB,EACrB,aAAa,GAEd,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAQ9D,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,OAAO,EACL,cAAc,GAGf,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,GAEhB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,gBAAgB,EAChB,WAAW,EACX,OAAO,GAER,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAIhE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACzG,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAC9F,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACpI,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AACvF,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAoC/D,6EAA6E;AAC7E,6EAA6E;AAC7E,iDAAiD;AAEjD,+EAA+E;AAC/E,6EAA6E;AAC7E,8EAA8E;AAC9E,2EAA2E;AAC3E,8CAA8C;AAC9C,MAAM,aAAa,GAAkB,QAAQ,CAAC;AAE9C,SAAS,gBAAgB,CACvB,MAAyB,EACzB,QAAkC,EAClC,SAAqC;IAErC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAyB,CAAC;IAE7C,0EAA0E;IAC1E,kFAAkF;IAClF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAoC,CAAC,CAAG,6BAA6B;IAC7F,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoC,CAAC,CAAK,kBAAkB;IAElF,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YACd,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC7B,MAAM,QAAQ,GACZ,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC3C,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC3B,MAAM,QAAQ,GACZ,QAAQ,EAAE,iBAAiB,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,aAAa,CAAC;YACpE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAgB,EAAE,WAAmB;IAC/D,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAClD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC;IAC7D,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,QAA2B,EAC3B,MAAyB,EACzB,QAAkC,EAClC,KAAgB,EAChB,cAAwC,EACxC,WAAuC;IAEvC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAE9C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;YACzF,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,MAAM;gBAAE,SAAS;YAE/C,MAAM,WAAW,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAC/C,IAAI,CAAC,WAAW;gBAAE,SAAS;YAC3B,MAAM,SAAS,GAAG,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACvD,IAAI,CAAC,SAAS;gBAAE,SAAS;YAEzB,6EAA6E;YAC7E,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;YACzF,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,SAAS,CAAC,CAAC;gBACvF,SAAS;YACX,CAAC;YAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YACtD,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YACnH,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAA8B;IAE9B,iBAAiB;IACjB,IAAI,MAAyB,CAAC;IAC9B,IAAI,QAAuB,CAAC;IAC5B,IAAI,YAAoB,CAAC;IAEzB,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE;YACtD,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;SAC7C,CAAC,CAAC;QACH,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QACvB,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC3B,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QAC9B,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;QACxC,YAAY,GAAG,OAAO,CAAC,eAAe,IAAI,0BAA0B,CAAC;IACvE,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IAED,qBAAqB;IACrB,MAAM,aAAa,GAAG,gBAAgB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,aAAa,CAAC,aAAa,CAAC,CAAC;IAE/C,cAAc;IACd,MAAM,cAAc,GAClB,OAAO,CAAC,QAAQ,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,cAAc,CAAC,cAAc,CAAC,CAAC;IAEhD,2EAA2E;IAC3E,IAAI,eAAe,GAA+B,EAAE,CAAC;IACrD,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,eAAe,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,EAAE;YAC7D,UAAU,EAAE,OAAO,CAAC,eAAe;SACpC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,qBAAqB,GAAG,gBAAgB,CAC5C,MAAM,EACN,qBAAqB,EACrB,eAAe,CAChB,CAAC;IAEF,uFAAuF;IACvF,MAAM,cAAc,GAAG,IAAI,GAAG,EAAuB,CAAC;IACtD,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,SAAS;QAC3C,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5D,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,UAAU,IAAI,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,YAAY,CACpC,QAAQ,EACR,MAAM,EACN,qBAAqB,EACrB,SAAS,EACT,cAAc,EACd,qBAAqB,CACtB,CAAC;IAEF,oCAAoC;IACpC,MAAM,MAAM,GAAqB;QAC/B,MAAM;QACN,QAAQ;QACR,eAAe;QACf,SAAS;QACT,cAAc,EAAE,qBAAqB;QACrC,WAAW;QACX,qBAAqB;QACrB,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,YAAY;QACxD,gEAAgE;QAChE,wEAAwE;QACxE,2EAA2E;QAC3E,sEAAsE;QACtE,WAAW,EAAE,OAAO,CAAC,aAAa;YAChC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,KAAK,uBAAuB;gBACtD,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,OAAO;YACX,CAAC,CAAC,OAAO;KACZ,CAAC;IACF,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;AAClC,CAAC;AAED,8EAA8E;AAC9E,oEAAoE;AACpE,MAAM,CAAC,MAAM,OAAO,GAA0B,YAAY,CAAC"}

package/dist/output/likec4-generator.d.ts

@@ -0,0 +1,43 @@
+/**
+ * LikeC4 diagram generator for Canopy agent system assessments.
+ *
+ * Converts AgentDefinition[] + HandoffEdge[] into a LikeC4 DSL string (.c4)
+ * representing the full agent system architecture — agents, tools, data stores,
+ * external dependencies, and handoff trust relationships.
+ *
+ * Pure function: no I/O, no side effects. The caller writes the file.
+ *
+ * Why LikeC4 over plain Mermaid/PlantUML:
+ *   - Architecture as code: a single `.c4` file is the canonical system description
+ *   - Multiple views from one model (landscape, per-agent drill-down, deployment)
+ *   - Fills the gap AWS Threat Composer leaves: TC produces a threat list with no
+ *     structural diagram of the system being modelled
+ *   - LikeC4's DSL is designed for AI-assisted generation — LLM-friendly syntax
+ *
+ * Reference: https://likec4.dev
+ */
+import type { AgentDefinition } from "../aivss/types.js";
+import type { HandoffEdge } from "../adapters/types.js";
+export interface LikeC4GeneratorOptions {
+    agents: AgentDefinition[];
+    handoffs?: HandoffEdge[];
+    applicationName: string;
+}
+/**
+ * Generate a LikeC4 DSL string from Canopy agent definitions.
+ *
+ * @returns A string containing a complete LikeC4 `.c4` file.
+ *          Write it to `<outputDir>/<applicationName>.c4` or `architecture.c4`.
+ *
+ * @example
+ * const c4 = generateLikeC4({ agents, handoffs, applicationName: "My System" });
+ * await Bun.write("output/architecture.c4", c4);
+ * // Then: npx likec4 serve output/architecture.c4
+ */
+export declare function generateLikeC4(options: LikeC4GeneratorOptions): string;
+/**
+ * Derive a safe output filename from the application name.
+ * e.g. "My Agent System" → "my-agent-system.c4"
+ */
+export declare function likec4Filename(applicationName: string): string;
+//# sourceMappingURL=likec4-generator.d.ts.map

package/dist/output/likec4-generator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"likec4-generator.d.ts","sourceRoot":"","sources":["../../src/output/likec4-generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAkSxD,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,sBAAsB,GAAG,MAAM,CAqBtE;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAO9D"}