@waratahlabs/canopy 0.5.0

package/dist/output/likec4-generator.js

@@ -0,0 +1,287 @@
+/**
+ * LikeC4 diagram generator for Canopy agent system assessments.
+ *
+ * Converts AgentDefinition[] + HandoffEdge[] into a LikeC4 DSL string (.c4)
+ * representing the full agent system architecture — agents, tools, data stores,
+ * external dependencies, and handoff trust relationships.
+ *
+ * Pure function: no I/O, no side effects. The caller writes the file.
+ *
+ * Why LikeC4 over plain Mermaid/PlantUML:
+ *   - Architecture as code: a single `.c4` file is the canonical system description
+ *   - Multiple views from one model (landscape, per-agent drill-down, deployment)
+ *   - Fills the gap AWS Threat Composer leaves: TC produces a threat list with no
+ *     structural diagram of the system being modelled
+ *   - LikeC4's DSL is designed for AI-assisted generation — LLM-friendly syntax
+ *
+ * Reference: https://likec4.dev
+ */
+// ── ID helpers ──────────────────────────────────────────────────────────────
+/**
+ * Sanitise a string into a valid LikeC4 identifier.
+ * LikeC4 identifiers must match [a-zA-Z_][a-zA-Z0-9_]*.
+ */
+function toId(raw) {
+    return raw
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "_")
+        .replace(/^[0-9]/, "_$&")
+        .replace(/^_+|_+$/g, "")
+        || "element";
+}
+function agentId(agent) {
+    return `agent_${toId(agent.id)}`;
+}
+function toolId(agentDef, toolName) {
+    return `${agentId(agentDef)}_tool_${toId(toolName)}`;
+}
+function depId(depName) {
+    return `dep_${toId(depName)}`;
+}
+function dataSourceId(dsName) {
+    return `ds_${toId(dsName)}`;
+}
+// ── Indent helper ────────────────────────────────────────────────────────────
+function indent(level) {
+    return "  ".repeat(level);
+}
+// ── Escaping ─────────────────────────────────────────────────────────────────
+function q(s) {
+    return `'${s.replace(/'/g, "\\'")}'`;
+}
+// ── Section builders ─────────────────────────────────────────────────────────
+function buildSpecification() {
+    return [
+        "specification {",
+        `${indent(1)}// Standard C4 model element kinds`,
+        `${indent(1)}element actor`,
+        `${indent(1)}element system`,
+        `${indent(1)}element container`,
+        ``,
+        `${indent(1)}// Canopy-specific element kinds for agentic AI systems`,
+        `${indent(1)}element agent {`,
+        `${indent(2)}style {`,
+        `${indent(3)}shape rectangle`,
+        `${indent(3)}color secondary`,
+        `${indent(2)}}`,
+        `${indent(1)}}`,
+        `${indent(1)}element tool {`,
+        `${indent(2)}style {`,
+        `${indent(3)}shape component`,
+        `${indent(3)}color muted`,
+        `${indent(2)}}`,
+        `${indent(1)}}`,
+        `${indent(1)}element datastore {`,
+        `${indent(2)}style {`,
+        `${indent(3)}shape storage`,
+        `${indent(3)}color green`,
+        `${indent(2)}}`,
+        `${indent(1)}}`,
+        `${indent(1)}element external {`,
+        `${indent(2)}style {`,
+        `${indent(3)}shape rectangle`,
+        `${indent(3)}color amber`,
+        `${indent(2)}}`,
+        `${indent(1)}}`,
+        "}",
+    ].join("\n");
+}
+function buildAgentBlock(agent, i) {
+    const lines = [];
+    const aid = agentId(agent);
+    const autonomy = agent.autonomyLevel;
+    const desc = [
+        `Model: ${agent.model}`,
+        `Deployment: ${agent.deploymentContext}`,
+        `Complexity: ${agent.modelComplexity}`,
+        autonomy ? `Autonomy: ${autonomy}` : null,
+    ].filter(Boolean).join(" | ");
+    lines.push(`${indent(2)}${aid} = agent ${q(agent.name)} {`);
+    lines.push(`${indent(3)}description ${q(desc)}`);
+    // Tools as nested elements
+    if (agent.tools.length > 0) {
+        lines.push("");
+        lines.push(`${indent(3)}// Tools`);
+        for (const tool of agent.tools) {
+            const tid = toolId(agent, tool.name);
+            const isDangerous = tool.dangerous === true;
+            lines.push(`${indent(3)}${tid} = tool ${q(tool.name)} {`);
+            if (tool.description) {
+                lines.push(`${indent(4)}description ${q(tool.description)}`);
+            }
+            if (isDangerous) {
+                lines.push(`${indent(4)}style {`);
+                lines.push(`${indent(5)}color red`);
+                lines.push(`${indent(4)}}`);
+            }
+            lines.push(`${indent(3)}}`);
+        }
+    }
+    lines.push(`${indent(2)}}`);
+    return lines.join("\n");
+}
+function buildModel(agents, handoffs, applicationName) {
+    const lines = [];
+    const systemId = toId(applicationName) || "system";
+    // Collect all unique dependencies and data sources across all agents
+    const allDeps = new Map(); // id -> name
+    const allDataSources = new Map(); // id -> name
+    for (const agent of agents) {
+        for (const dep of agent.dependencies ?? []) {
+            allDeps.set(depId(dep), dep);
+        }
+        for (const ds of agent.dataSources ?? []) {
+            allDataSources.set(dataSourceId(ds), ds);
+        }
+    }
+    lines.push("model {");
+    lines.push(`${indent(1)}// Human actors interacting with the system`);
+    lines.push(`${indent(1)}user = actor 'User'`);
+    lines.push("");
+    lines.push(`${indent(1)}${systemId} = system ${q(applicationName)} {`);
+    lines.push("");
+    lines.push(`${indent(2)}// AI Agents`);
+    for (let i = 0; i < agents.length; i++) {
+        lines.push(buildAgentBlock(agents[i], i));
+        if (i < agents.length - 1)
+            lines.push("");
+    }
+    // Dependency elements (shared across agents, defined once at system level)
+    if (allDeps.size > 0) {
+        lines.push("");
+        lines.push(`${indent(2)}// External dependencies and services`);
+        for (const [id, name] of allDeps) {
+            lines.push(`${indent(2)}${id} = external ${q(name)}`);
+        }
+    }
+    // Data source elements
+    if (allDataSources.size > 0) {
+        lines.push("");
+        lines.push(`${indent(2)}// Data sources`);
+        for (const [id, name] of allDataSources) {
+            lines.push(`${indent(2)}${id} = datastore ${q(name)}`);
+        }
+    }
+    lines.push(`${indent(1)}}`);
+    lines.push("");
+    // Relationships — agent → tools (invocation)
+    lines.push(`${indent(1)}// Agent tool invocations`);
+    for (const agent of agents) {
+        for (const tool of agent.tools) {
+            const label = tool.dangerous
+                ? "'invokes (dangerous)'"
+                : "'invokes'";
+            lines.push(`${indent(1)}${agentId(agent)}.${toolId(agent, tool.name)} -> ${agentId(agent)} ${label}`);
+        }
+    }
+    // Relationships — agent → external deps
+    if (allDeps.size > 0) {
+        lines.push("");
+        lines.push(`${indent(1)}// Agent → dependency relationships`);
+        for (const agent of agents) {
+            for (const dep of agent.dependencies ?? []) {
+                lines.push(`${indent(1)}${agentId(agent)} -> ${depId(dep)} 'depends on'`);
+            }
+        }
+    }
+    // Relationships — agent → data sources
+    if (allDataSources.size > 0) {
+        lines.push("");
+        lines.push(`${indent(1)}// Agent → data source relationships`);
+        for (const agent of agents) {
+            for (const ds of agent.dataSources ?? []) {
+                lines.push(`${indent(1)}${agentId(agent)} -> ${dataSourceId(ds)} 'reads'`);
+            }
+        }
+    }
+    // Relationships — user → agents
+    lines.push("");
+    lines.push(`${indent(1)}// User entry points`);
+    // User talks to the first agent (or all if no handoffs)
+    const entryAgents = handoffs.length > 0
+        ? agents.filter((a) => !handoffs.some((h) => h.toAgentId === a.id))
+        : agents;
+    for (const agent of entryAgents) {
+        lines.push(`${indent(1)}user -> ${agentId(agent)} 'sends request'`);
+    }
+    // Relationships — handoffs (agent → agent)
+    if (handoffs.length > 0) {
+        lines.push("");
+        lines.push(`${indent(1)}// Agent handoff relationships (implicit trust grants)`);
+        for (const handoff of handoffs) {
+            const from = `agent_${toId(handoff.fromAgentId)}`;
+            const to = `agent_${toId(handoff.toAgentId)}`;
+            lines.push(`${indent(1)}${from} -> ${to} 'handoff (implicit trust)'`);
+        }
+    }
+    lines.push("}");
+    return lines.join("\n");
+}
+function buildViews(agents, applicationName) {
+    const systemId = toId(applicationName) || "system";
+    const lines = [];
+    lines.push("views {");
+    // Landscape — everything
+    lines.push(`${indent(1)}view index {`);
+    lines.push(`${indent(2)}title ${q(`${applicationName} — Landscape`)}`);
+    lines.push(`${indent(2)}include *`);
+    lines.push(`${indent(1)}}`);
+    lines.push("");
+    // System drill-down
+    lines.push(`${indent(1)}view of ${systemId} {`);
+    lines.push(`${indent(2)}title ${q(`${applicationName} — Agent System`)}`);
+    lines.push(`${indent(2)}include *`);
+    lines.push(`${indent(1)}}`);
+    // Per-agent drill-down views
+    for (const agent of agents) {
+        lines.push("");
+        lines.push(`${indent(1)}view of ${agentId(agent)} {`);
+        lines.push(`${indent(2)}title ${q(`${agent.name} — Agent Detail`)}`);
+        lines.push(`${indent(2)}include *`);
+        lines.push(`${indent(1)}}`);
+    }
+    lines.push("}");
+    return lines.join("\n");
+}
+/**
+ * Generate a LikeC4 DSL string from Canopy agent definitions.
+ *
+ * @returns A string containing a complete LikeC4 `.c4` file.
+ *          Write it to `<outputDir>/<applicationName>.c4` or `architecture.c4`.
+ *
+ * @example
+ * const c4 = generateLikeC4({ agents, handoffs, applicationName: "My System" });
+ * await Bun.write("output/architecture.c4", c4);
+ * // Then: npx likec4 serve output/architecture.c4
+ */
+export function generateLikeC4(options) {
+    const { agents, handoffs = [], applicationName } = options;
+    const extended = agents;
+    const sections = [
+        `// LikeC4 architecture model generated by Canopy`,
+        `// Application: ${applicationName}`,
+        `// Generated: ${new Date().toISOString()}`,
+        `// Reference: https://likec4.dev`,
+        `//`,
+        `// To view: npx likec4 serve <this-file>`,
+        `// To export PNG: npx likec4 export png -o diagrams/ <this-file>`,
+        "",
+        buildSpecification(),
+        "",
+        buildModel(extended, handoffs, applicationName),
+        "",
+        buildViews(extended, applicationName),
+    ];
+    return sections.join("\n");
+}
+/**
+ * Derive a safe output filename from the application name.
+ * e.g. "My Agent System" → "my-agent-system.c4"
+ */
+export function likec4Filename(applicationName) {
+    return (applicationName
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "") || "architecture") + ".c4";
+}
+//# sourceMappingURL=likec4-generator.js.map

package/dist/output/likec4-generator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"likec4-generator.js","sourceRoot":"","sources":["../../src/output/likec4-generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,+EAA+E;AAE/E;;;GAGG;AACH,SAAS,IAAI,CAAC,GAAW;IACvB,OAAO,GAAG;SACP,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC;SACxB,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;WACrB,SAAS,CAAC;AACjB,CAAC;AAED,SAAS,OAAO,CAAC,KAAsB;IACrC,OAAO,SAAS,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,MAAM,CAAC,QAAyB,EAAE,QAAgB;IACzD,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,KAAK,CAAC,OAAe;IAC5B,OAAO,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;AAC9B,CAAC;AAED,gFAAgF;AAEhF,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,gFAAgF;AAEhF,SAAS,CAAC,CAAC,CAAS;IAClB,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;AACvC,CAAC;AAWD,gFAAgF;AAEhF,SAAS,kBAAkB;IACzB,OAAO;QACL,iBAAiB;QACjB,GAAG,MAAM,CAAC,CAAC,CAAC,oCAAoC;QAChD,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe;QAC3B,GAAG,MAAM,CAAC,CAAC,CAAC,gBAAgB;QAC5B,GAAG,MAAM,CAAC,CAAC,CAAC,mBAAmB;QAC/B,EAAE;QACF,GAAG,MAAM,CAAC,CAAC,CAAC,yDAAyD;QACrE,GAAG,MAAM,CAAC,CAAC,CAAC,iBAAiB;QAC7B,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS;QACrB,GAAG,MAAM,CAAC,CAAC,CAAC,iBAAiB;QAC7B,GAAG,MAAM,CAAC,CAAC,CAAC,iBAAiB;QAC7B,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG;QACf,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG;QACf,GAAG,MAAM,CAAC,CAAC,CAAC,gBAAgB;QAC5B,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS;QACrB,GAAG,MAAM,CAAC,CAAC,CAAC,iBAAiB;QAC7B,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa;QACzB,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG;QACf,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG;QACf,GAAG,MAAM,CAAC,CAAC,CAAC,qBAAqB;QACjC,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS;QACrB,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe;QAC3B,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa;QACzB,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG;QACf,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG;QACf,GAAG,MAAM,CAAC,CAAC,CAAC,oBAAoB;QAChC,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS;QACrB,GAAG,MAAM,CAAC,CAAC,CAAC,iBAAiB;QAC7B,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa;QACzB,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG;QACf,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG;QACf,GAAG;KACJ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,KAAoB,EAAE,CAAS;IACtD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,QAAQ,GAAI,KAA+C,CAAC,aAAa,CAAC;IAChF,MAAM,IAAI,GAAG;QACX,UAAU,KAAK,CAAC,KAAK,EAAE;QACvB,eAAe,KAAK,CAAC,iBAAiB,EAAE;QACxC,eAAe,KAAK,CAAC,eAAe,EAAE;QACtC,QAAQ,CAAC,CAAC,CAAC,aAAa,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI;KAC1C,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAE9B,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,YAAY,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5D,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEjD,2BAA2B;IAC3B,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YACrC,MAAM,WAAW,GAAI,IAAgC,CAAC,SAAS,KAAK,IAAI,CAAC;YACzE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1D,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrB,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YAC/D,CAAC;YACD,IAAI,WAAW,EAAE,CAAC;gBAChB,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBAClC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;gBACpC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC9B,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,UAAU,CACjB,MAAuB,EACvB,QAAuB,EACvB,eAAuB;IAEvB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,QAAQ,CAAC;IAEnD,qEAAqE;IACrE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,aAAa;IACxD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,aAAa;IAC/D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QAC/B,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;YACzC,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtB,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,6CAA6C,CAAC,CAAC;IACtE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC;IAC9C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CACR,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,QAAQ,aAAa,CAAC,CAAC,eAAe,CAAC,IAAI,CAC3D,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;IAEvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,2EAA2E;IAC3E,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,uCAAuC,CAAC,CAAC;QAChE,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,IAAI,cAAc,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;QAC1C,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,cAAc,EAAE,CAAC;YACxC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,6CAA6C;IAC7C,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC;IACpD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAI,IAAgC,CAAC,SAAS;gBACvD,CAAC,CAAC,uBAAuB;gBACzB,CAAC,CAAC,WAAW,CAAC;YAChB,KAAK,CAAC,IAAI,CACR,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,EAAE,CAC1F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,wCAAwC;IACxC,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC;QAC9D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;gBAC3C,KAAK,CAAC,IAAI,CACR,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,GAAG,CAAC,eAAe,CAC9D,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,IAAI,cAAc,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC;QAC/D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;gBACzC,KAAK,CAAC,IAAI,CACR,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,EAAE,CAAC,UAAU,CAC/D,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,gCAAgC;IAChC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC;IAC/C,wDAAwD;IACxD,MAAM,WAAW,GACf,QAAQ,CAAC,MAAM,GAAG,CAAC;QACjB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC,CAAC,MAAM,CAAC;IACb,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACtE,CAAC;IAED,2CAA2C;IAC3C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,wDAAwD,CAAC,CAAC;QACjF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,SAAS,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YAClD,MAAM,EAAE,GAAG,SAAS,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,OAAO,EAAE,6BAA6B,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,UAAU,CACjB,MAAuB,EACvB,eAAuB;IAEvB,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,QAAQ,CAAC;IACnD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAEtB,yBAAyB;IACzB,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;IACvC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,eAAe,cAAc,CAAC,EAAE,CAAC,CAAC;IACvE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACpC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,oBAAoB;IACpB,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,QAAQ,IAAI,CAAC,CAAC;IAChD,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,eAAe,iBAAiB,CAAC,EAAE,CAAC,CAAC;IAC1E,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACpC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAE5B,6BAA6B;IAC7B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtD,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,iBAAiB,CAAC,EAAE,CAAC,CAAC;QACrE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAUD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAAC,OAA+B;IAC5D,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,EAAE,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC;IAC3D,MAAM,QAAQ,GAAG,MAAyB,CAAC;IAE3C,MAAM,QAAQ,GAAG;QACf,kDAAkD;QAClD,mBAAmB,eAAe,EAAE;QACpC,iBAAiB,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;QAC3C,kCAAkC;QAClC,IAAI;QACJ,0CAA0C;QAC1C,kEAAkE;QAClE,EAAE;QACF,kBAAkB,EAAE;QACpB,EAAE;QACF,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,eAAe,CAAC;QAC/C,EAAE;QACF,UAAU,CAAC,QAAQ,EAAE,eAAe,CAAC;KACtC,CAAC;IAEF,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,eAAuB;IACpD,OAAO,CACL,eAAe;SACZ,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,cAAc,CAC7C,GAAG,KAAK,CAAC;AACZ,CAAC"}

package/dist/output/slot-filler.d.ts

@@ -0,0 +1,6 @@
+import type { InferenceProvider } from "../providers/types";
+import type { AtlasTechnique } from "../aivss/atlas/loader";
+import type { AgentDefinition, MetricCode, SeverityLabel, ThreatSlots } from "../aivss/types";
+export type { ThreatSlots } from "../aivss/types.js";
+export declare function fillThreatSlots(provider: InferenceProvider, agent: AgentDefinition, technique: AtlasTechnique, tactic: string, metric: MetricCode, subCategory: string, severityLabel: SeverityLabel): Promise<ThreatSlots>;
+//# sourceMappingURL=slot-filler.d.ts.map

package/dist/output/slot-filler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slot-filler.d.ts","sourceRoot":"","sources":["../../src/output/slot-filler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EACV,eAAe,EACf,UAAU,EACV,aAAa,EACb,WAAW,EACZ,MAAM,gBAAgB,CAAC;AAGxB,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAyDrD,wBAAsB,eAAe,CACnC,QAAQ,EAAE,iBAAiB,EAC3B,KAAK,EAAE,eAAe,EACtB,SAAS,EAAE,cAAc,EACzB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,aAAa,GAC3B,OAAO,CAAC,WAAW,CAAC,CAkCtB"}

package/dist/output/slot-filler.js

@@ -0,0 +1,71 @@
+import { SEVERITY_VALUES } from "../aivss/types";
+const SYSTEM_PROMPT = `You are a security analyst filling structured threat statement fields for a Threat Composer report.
+You must return valid JSON only — no markdown, no explanation.
+Use precise, lowercase-first-word phrasing for prerequisites, threatAction, threatImpact, impactedAssets.
+Base all fields on the agent profile and the specific ATLAS technique provided.`;
+function buildUserPrompt(agent, technique, tactic, metric, subCategory, severityLabel) {
+    const score = SEVERITY_VALUES[severityLabel];
+    const toolList = agent.tools.length > 0 ? agent.tools.map((t) => t.name).join(", ") : "none";
+    return `Agent: ${agent.name}
+Model: ${agent.model}
+System prompt summary: ${agent.systemPrompt.slice(0, 200)}
+Tools: ${toolList}
+Deployment context: ${agent.deploymentContext}
+
+ATLAS Technique: ${technique.id} — ${technique.name}
+Tactic: ${tactic}
+Description: ${technique.description.slice(0, 300)}
+AIVSS Metric: ${metric} — Sub-category: ${subCategory} — Severity: ${severityLabel} (${score})
+
+Fill these threat statement slots:
+{
+  "threatSource": "The entity taking action (e.g. 'An internet-based adversary', 'A malicious insider')",
+  "prerequisites": "lowercase — conditions needed (e.g. 'with API access to the agent endpoint')",
+  "threatAction": "lowercase — what the adversary does (e.g. 'inject indirect prompt instructions via tool output')",
+  "threatImpact": "lowercase — what happens to the system (e.g. 'exfiltrate customer order records')",
+  "impactedGoal": ["confidentiality" | "integrity" | "availability" — pick relevant ones],
+  "impactedAssets": ["lowercase asset names from the agent profile"]
+}
+Return JSON only.`;
+}
+function stripFences(raw) {
+    const trimmed = raw.trim();
+    if (trimmed.startsWith("```")) {
+        return trimmed
+            .replace(/^```(?:json)?\s*/i, "")
+            .replace(/```\s*$/m, "")
+            .trim();
+    }
+    return trimmed;
+}
+function asStringArray(value) {
+    if (!Array.isArray(value))
+        return [];
+    return value.filter((v) => typeof v === "string");
+}
+export async function fillThreatSlots(provider, agent, technique, tactic, metric, subCategory, severityLabel) {
+    const raw = await provider.complete(SYSTEM_PROMPT, buildUserPrompt(agent, technique, tactic, metric, subCategory, severityLabel));
+    let parsed;
+    try {
+        parsed = JSON.parse(stripFences(raw));
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`Slot-filler returned non-JSON for ${agent.id}/${technique.id}: ${message}. Raw: ${raw.slice(0, 200)}`);
+    }
+    return {
+        threatSource: typeof parsed.threatSource === "string"
+            ? parsed.threatSource
+            : "An unidentified adversary",
+        prerequisites: typeof parsed.prerequisites === "string" ? parsed.prerequisites : "",
+        threatAction: typeof parsed.threatAction === "string"
+            ? parsed.threatAction
+            : `exploit ${metric} weaknesses`,
+        threatImpact: typeof parsed.threatImpact === "string"
+            ? parsed.threatImpact
+            : "compromise agent behavior",
+        impactedGoal: asStringArray(parsed.impactedGoal),
+        impactedAssets: asStringArray(parsed.impactedAssets),
+    };
+}
+//# sourceMappingURL=slot-filler.js.map

package/dist/output/slot-filler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slot-filler.js","sourceRoot":"","sources":["../../src/output/slot-filler.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAIjD,MAAM,aAAa,GAAG;;;gFAG0D,CAAC;AAEjF,SAAS,eAAe,CACtB,KAAsB,EACtB,SAAyB,EACzB,MAAc,EACd,MAAkB,EAClB,WAAmB,EACnB,aAA4B;IAE5B,MAAM,KAAK,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IAC7C,MAAM,QAAQ,GACZ,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC9E,OAAO,UAAU,KAAK,CAAC,IAAI;SACpB,KAAK,CAAC,KAAK;yBACK,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SAChD,QAAQ;sBACK,KAAK,CAAC,iBAAiB;;mBAE1B,SAAS,CAAC,EAAE,MAAM,SAAS,CAAC,IAAI;UACzC,MAAM;eACD,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBAClC,MAAM,oBAAoB,WAAW,gBAAgB,aAAa,KAAK,KAAK;;;;;;;;;;;kBAW1E,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,OAAO;aACX,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC;aAChC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;aACvB,IAAI,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAA2B,EAC3B,KAAsB,EACtB,SAAyB,EACzB,MAAc,EACd,MAAkB,EAClB,WAAmB,EACnB,aAA4B;IAE5B,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,QAAQ,CACjC,aAAa,EACb,eAAe,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,CAAC,CAC9E,CAAC;IAEF,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAA4B,CAAC;IACnE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CACb,qCAAqC,KAAK,CAAC,EAAE,IAAI,SAAS,CAAC,EAAE,KAAK,OAAO,UAAU,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CACvG,CAAC;IACJ,CAAC;IAED,OAAO;QACL,YAAY,EACV,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ;YACrC,CAAC,CAAC,MAAM,CAAC,YAAY;YACrB,CAAC,CAAC,2BAA2B;QACjC,aAAa,EACX,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE;QACtE,YAAY,EACV,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ;YACrC,CAAC,CAAC,MAAM,CAAC,YAAY;YACrB,CAAC,CAAC,WAAW,MAAM,aAAa;QACpC,YAAY,EACV,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ;YACrC,CAAC,CAAC,MAAM,CAAC,YAAY;YACrB,CAAC,CAAC,2BAA2B;QACjC,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC;QAChD,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,cAAc,CAAC;KACrD,CAAC;AACJ,CAAC"}

package/dist/output/tc-assembler.d.ts

@@ -0,0 +1,30 @@
+import type { CoverageEntry } from "../aivss/atlas/coverage-matrix";
+import type { AtlasData } from "../aivss/atlas/loader";
+import type { AgentDefinition, MetricAssessmentResponse, SeverityLabel } from "../aivss/types";
+import type { HandoffEdge } from "../adapters/types";
+import { type ScoringMode } from "../aivss/scoring/scoring-mode.js";
+import type { ThreatSlots } from "./slot-filler";
+import type { DataExchangeFormat } from "./tc-types";
+export interface AssessmentBundle {
+    agents: AgentDefinition[];
+    handoffs: HandoffEdge[];
+    metricResponses: MetricAssessmentResponse[];
+    atlasData: AtlasData;
+    coverageMatrix: readonly CoverageEntry[];
+    filledSlots: Map<string, ThreatSlots>;
+    severityBySubCategory: Map<string, SeverityLabel>;
+    applicationName: string;
+    /**
+     * How the severities above were produced. Stamped per-threat and into the
+     * audit trail so a reader can tell whether these scores are reproducible.
+     *
+     * Defaults to "deterministic": it is the only mode that cannot silently vary
+     * between runs, so it is the only safe assumption when a caller does not
+     * say. A caller using model or harness inference must declare it.
+     */
+    scoringMode?: ScoringMode;
+}
+export declare function slotKey(agentId: string, techniqueId: string, metric: string, subCategory: string): string;
+export declare function severityKey(agentId: string, metric: string, subCategory: string): string;
+export declare function assembleTCFormat(bundle: AssessmentBundle): DataExchangeFormat;
+//# sourceMappingURL=tc-assembler.d.ts.map

package/dist/output/tc-assembler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tc-assembler.d.ts","sourceRoot":"","sources":["../../src/output/tc-assembler.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EACV,eAAe,EACf,wBAAwB,EACxB,aAAa,EACd,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAYvF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,KAAK,EACV,kBAAkB,EAKnB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,eAAe,EAAE,wBAAwB,EAAE,CAAC;IAC5C,SAAS,EAAE,SAAS,CAAC;IACrB,cAAc,EAAE,SAAS,aAAa,EAAE,CAAC;IAEzC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAEtC,qBAAqB,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAClD,eAAe,EAAE,MAAM,CAAC;IACxB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AA6BD,wBAAgB,OAAO,CACrB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,MAAM,CAER;AAED,wBAAgB,WAAW,CACzB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,MAAM,CAER;AAeD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,kBAAkB,CAwL7E"}

package/dist/output/tc-assembler.js

@@ -0,0 +1,227 @@
+import { createHash } from "node:crypto";
+import { createRequire } from "node:module";
+import { SEVERITY_VALUES } from "../aivss/types";
+import { FRAMEWORK_REGISTRY } from "../references/index.js";
+import { SCORING_MODE_INFO } from "../aivss/scoring/scoring-mode.js";
+// TC native keys that must NOT be prefixed with "custom:".
+const TC_NATIVE_KEYS = new Set(["Priority", "Comments", "STRIDE", "source"]);
+// Prefix all non-native, non-prefixed keys with "custom:".
+const cm = (entries) => entries.map((e) => ({
+    ...e,
+    key: TC_NATIVE_KEYS.has(e.key) || e.key.startsWith("custom:") ? e.key : `custom:${e.key}`,
+}));
+/**
+ * Content-derived UUID.
+ *
+ * Threat and mitigation ids were `crypto.randomUUID()`, which meant two runs
+ * over identical input produced structurally identical but byte-different
+ * artifacts. That defeats `diff` as a review tool, makes baselines noisy, and
+ * quietly contradicts the promise of a deterministic scoring mode.
+ *
+ * Deriving the id from a stable content key gives the same threat the same id
+ * across runs and machines, while remaining unique per distinct threat. Format
+ * is RFC-4122-shaped (version nibble 5, correct variant bits) so consumers
+ * expecting a UUID still parse it — the bytes come from SHA-256 of the key
+ * rather than a random source, which is exactly the UUIDv5 construction with a
+ * fixed namespace.
+ */
+function stableId(key) {
+    const h = createHash("sha256").update(`canopy::${key}`).digest("hex");
+    const variant = ((parseInt(h.slice(16, 17), 16) & 0x3) | 0x8).toString(16);
+    return [
+        h.slice(0, 8),
+        h.slice(8, 12),
+        `5${h.slice(13, 16)}`,
+        `${variant}${h.slice(17, 20)}`,
+        h.slice(20, 32),
+    ].join("-");
+}
+export function slotKey(agentId, techniqueId, metric, subCategory) {
+    return `${agentId}::${techniqueId}::${metric}::${subCategory}`;
+}
+export function severityKey(agentId, metric, subCategory) {
+    return `${agentId}::${metric}::${subCategory}`;
+}
+function priorityFor(severity) {
+    if (severity === "Critical" || severity === "High")
+        return "High";
+    if (severity === "Medium")
+        return "Medium";
+    return "Low";
+}
+function buildStatement(slots, agentName) {
+    const prereqs = slots.prerequisites ? ` ${slots.prerequisites}` : "";
+    const action = slots.threatAction || "exploit a weakness";
+    const impact = slots.threatImpact || "compromise the agent";
+    return `${slots.threatSource}${prereqs} can ${action} ${agentName} to ${impact}`;
+}
+export function assembleTCFormat(bundle) {
+    // Absent an explicit declaration, assume the reproducible mode — see the
+    // scoringMode field docs on AssessmentBundle.
+    const scoringMode = bundle.scoringMode ?? "deterministic";
+    const threats = [];
+    const mitigations = [];
+    const mitigationLinks = [];
+    const mitigationIdByAtlasId = new Map();
+    const usedTechniqueIds = new Set();
+    let threatCounter = 0;
+    let mitigationCounter = 0;
+    // 1. Threats from agent × metric × technique slot fills
+    for (const agent of bundle.agents) {
+        for (const entry of bundle.coverageMatrix) {
+            const severity = bundle.severityBySubCategory.get(severityKey(agent.id, entry.metric, entry.subCategory)) ?? "None";
+            if (severity === "None")
+                continue;
+            for (const techniqueId of entry.atlasTechniqueIds) {
+                const slots = bundle.filledSlots.get(slotKey(agent.id, techniqueId, entry.metric, entry.subCategory));
+                if (!slots)
+                    continue;
+                const technique = bundle.atlasData.techniqueById.get(techniqueId);
+                if (!technique)
+                    continue;
+                usedTechniqueIds.add(techniqueId);
+                const tactic = technique.tactics[0] ?? "unspecified";
+                const score = SEVERITY_VALUES[severity];
+                const metadata = [
+                    { key: "aivss-metric", value: entry.metric },
+                    { key: "aivss-sub-category", value: entry.subCategory },
+                    { key: "aivss-score", value: score.toFixed(2) },
+                    { key: "aivss-severity", value: severity },
+                    { key: "atlas-technique-id", value: technique.id },
+                    { key: "atlas-technique-name", value: technique.name },
+                    { key: "atlas-tactic", value: tactic },
+                    { key: "deployment-context", value: agent.deploymentContext },
+                    { key: "agent-id", value: agent.id },
+                    { key: "agent-name", value: agent.name },
+                    { key: "Priority", value: priorityFor(severity) },
+                    // Provenance: how this severity was arrived at. A consumer gating CI
+                    // on these numbers needs to know whether re-running can move them.
+                    { key: "scoring-mode", value: scoringMode },
+                    // Cross-framework annotations — each registered adapter contributes its
+                    // top matching risk for this AIVSS metric as {framework}-risk-id / category tags.
+                    ...FRAMEWORK_REGISTRY.flatMap((adapter) => {
+                        const risk = adapter.getRisksForMetric(entry.metric)[0];
+                        return risk
+                            ? [
+                                { key: `${adapter.citation.id}-risk-id`, value: risk.id },
+                                { key: `${adapter.citation.id}-risk-category`, value: risk.category },
+                                { key: `${adapter.citation.id}-risk-type`, value: risk.riskType },
+                            ]
+                            : [];
+                    }),
+                ];
+                threatCounter += 1;
+                threats.push({
+                    id: stableId(`threat::${agent.id}::${entry.metric}::${entry.subCategory}::${technique.id}`),
+                    numericId: threatCounter,
+                    displayOrder: threatCounter,
+                    threatSource: slots.threatSource,
+                    prerequisites: slots.prerequisites,
+                    threatAction: slots.threatAction,
+                    threatImpact: slots.threatImpact,
+                    impactedGoal: slots.impactedGoal,
+                    impactedAssets: slots.impactedAssets,
+                    statement: buildStatement(slots, agent.name),
+                    status: "threatIdentified",
+                    metadata: cm(metadata),
+                    tags: [entry.metric, technique.id, "ai-threat-model"],
+                });
+            }
+        }
+    }
+    // 2. Synthesised handoff threats — implicit trust grants between agents
+    for (const edge of bundle.handoffs) {
+        threatCounter += 1;
+        const handoffTechniqueId = "AML.T0080.000";
+        usedTechniqueIds.add(handoffTechniqueId);
+        threats.push({
+            id: stableId(`handoff::${edge.fromAgentName}::${edge.toAgentName}::${handoffTechniqueId}`),
+            numericId: threatCounter,
+            displayOrder: threatCounter,
+            threatSource: "An upstream agent",
+            prerequisites: `with control over ${edge.fromAgentName}'s output`,
+            threatAction: `inject poisoned context into ${edge.toAgentName} via agent handoff`,
+            threatImpact: `cause ${edge.toAgentName} to perform unintended actions`,
+            impactedGoal: ["integrity"],
+            impactedAssets: [edge.toAgentName.toLowerCase()],
+            statement: `An upstream agent with control over ${edge.fromAgentName}'s output can inject poisoned context into ${edge.toAgentName} via agent handoff to cause ${edge.toAgentName} to perform unintended actions`,
+            status: "threatIdentified",
+            metadata: cm([
+                { key: "aivss-metric", value: "CS" },
+                { key: "atlas-technique-id", value: handoffTechniqueId },
+                { key: "atlas-tactic", value: "initial-access" },
+                { key: "from-agent", value: edge.fromAgentName },
+                { key: "to-agent", value: edge.toAgentName },
+                { key: "Priority", value: "High" },
+                { key: "scoring-mode", value: scoringMode },
+            ]),
+            tags: ["CS", handoffTechniqueId, "agent-handoff", "ai-threat-model"],
+        });
+    }
+    // 3. Mitigations for techniques referenced by any emitted threat.
+    // Note: the upstream ATLAS loader normalises mitigation.techniques to whatever
+    // the YAML provides — recent ATLAS YAML uses {id, use} objects, not bare
+    // strings. We read .id off each entry defensively to handle both shapes.
+    const mitigationsForTechnique = (techniqueId) => bundle.atlasData.mitigations.filter((m) => m.techniques.some((t) => {
+        if (typeof t === "string")
+            return t === techniqueId;
+        if (t && typeof t === "object")
+            return t.id === techniqueId;
+        return false;
+    }));
+    for (const techniqueId of usedTechniqueIds) {
+        const atlasMitigations = mitigationsForTechnique(techniqueId);
+        for (const mitigation of atlasMitigations) {
+            let mitigationId = mitigationIdByAtlasId.get(mitigation.id);
+            if (!mitigationId) {
+                mitigationId = stableId(`mitigation::${mitigation.id}`);
+                mitigationIdByAtlasId.set(mitigation.id, mitigationId);
+                mitigationCounter += 1;
+                mitigations.push({
+                    id: mitigationId,
+                    numericId: mitigationCounter,
+                    displayOrder: mitigationCounter,
+                    content: `${mitigation.id} — ${mitigation.name}: ${mitigation.description}`,
+                    tags: ["atlas-mitigation", mitigation.id],
+                });
+            }
+            for (const threat of threats) {
+                const techMeta = threat.metadata?.find((m) => m.key === "custom:atlas-technique-id" && m.value === techniqueId);
+                if (!techMeta)
+                    continue;
+                mitigationLinks.push({
+                    mitigationId,
+                    linkedId: threat.id,
+                });
+            }
+        }
+    }
+    const _require = createRequire(import.meta.url);
+    const pkg = _require("../../package.json");
+    const generatedAt = new Date().toISOString();
+    const versionStamp = [
+        `canopy@${pkg.version}`,
+        "AIVSS V4.0.8",
+        "ATLAS format-6.0.0/2026.07",
+        "ACSC 2026-05",
+        "DSTG MEAID TR-3786",
+    ].join(" · ");
+    const modeInfo = SCORING_MODE_INFO[scoringMode];
+    return {
+        schema: 1,
+        applicationInfo: {
+            name: bundle.applicationName,
+            description: `AIVSS V4 + ATLAS threat model for ${bundle.agents.length} agent(s) ` +
+                `and ${bundle.handoffs.length} handoff(s).\n\n` +
+                `### Canopy Audit Trail\n\n` +
+                `Generated: ${generatedAt}  \n` +
+                `Frameworks: ${versionStamp}  \n` +
+                `Scoring mode: ${scoringMode} — ${modeInfo.summary}  \n` +
+                `Reproducible: ${modeInfo.reproducible ? "yes — identical input yields identical scores" : "no — re-running may yield different scores"}`,
+        },
+        threats,
+        mitigations,
+        mitigationLinks,
+    };
+}
+//# sourceMappingURL=tc-assembler.js.map