@waratahlabs/canopy 0.5.0

package/dist/references/nist-ai-rmf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nist-ai-rmf.js","sourceRoot":"","sources":["../../src/references/nist-ai-rmf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EACL,YAAY,GAIb,MAAM,eAAe,CAAC;AAEvB,kFAAkF;AAClF,4EAA4E;AAC5E,0DAA0D;AAE1D,MAAM,CAAC,MAAM,iBAAiB,GAAoB;IAChD;QACE,EAAE,EAAE,qBAAqB;QACzB,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,mCAAmC;QACzC,WAAW,EACT,yaAAya;QAC3a,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,CAAC;QACpB,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,gCAAgC;KAChD;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,4CAA4C;QAClD,WAAW,EACT,0ZAA0Z;QAC5Z,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,CAAC;QACpB,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,gCAAgC;KAChD;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,wCAAwC;QAC9C,WAAW,EACT,iVAAiV;QACnV,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,CAAC;QACpB,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,gCAAgC;KAChD;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,qCAAqC;QAC3C,WAAW,EACT,oWAAoW;QACtW,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,CAAC;QACpB,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,gCAAgC;KAChD;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,wCAAwC;QAC9C,WAAW,EACT,kYAAkY;QACpY,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,gCAAgC;KAChD;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EACT,4UAA4U;QAC9U,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,gCAAgC;KAChD;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,oCAAoC;QAC1C,WAAW,EACT,mYAAmY;QACrY,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,gCAAgC;KAChD;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,kDAAkD;QACxD,WAAW,EACT,qVAAqV;QACvV,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,CAAC;QACpB,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,gCAAgC;KAChD;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,sCAAsC;QAC5C,WAAW,EACT,2WAA2W;QAC7W,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,CAAC;QACpB,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,gCAAgC;KAChD;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,4CAA4C;QAClD,WAAW,EACT,mXAAmX;QACrX,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,gCAAgC;KAChD;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,qCAAqC;QAC3C,WAAW,EACT,mWAAmW;QACrW,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,CAAC;QACpB,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,gCAAgC;KAChD;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,sCAAsC;QAC5C,WAAW,EACT,yXAAyX;QAC3X,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,gCAAgC;KAChD;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,8DAA8D;QACpE,WAAW,EACT,0XAA0X;QAC5X,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,gCAAgC;KAChD;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACT,mZAAmZ;QACrZ,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,gCAAgC;KAChD;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,2CAA2C;QACjD,WAAW,EACT,sXAAsX;QACxX,QAAQ,EAAE,UAAU;QACpB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,CAAC,WAAW,CAAC;QAChC,aAAa,EAAE,gCAAgC;KAChD;IAED,gFAAgF;IAChF,4EAA4E;IAC5E,2CAA2C;IAE3C;QACE,EAAE,EAAE,kBAAkB;QACtB,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,yCAAyC;QAC/C,WAAW,EACT,+bAA+b;QACjc,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,6BAA6B;KAC7C;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,6CAA6C;QACnD,WAAW,EACT,0TAA0T;QAC5T,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,CAAC;QACpB,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,6BAA6B;KAC7C;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,qCAAqC;QAC3C,WAAW,EACT,kYAAkY;QACpY,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,6BAA6B;KAC7C;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,kCAAkC;QACxC,WAAW,EACT,oWAAoW;QACtW,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,6BAA6B;KAC7C;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,oDAAoD;QAC1D,WAAW,EACT,uZAAuZ;QACzZ,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAChC,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,6BAA6B;KAC7C;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,8CAA8C;QACpD,WAAW,EACT,gYAAgY;QAClY,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,6BAA6B;KAC7C;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,mCAAmC;QACzC,WAAW,EACT,sWAAsW;QACxW,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,6BAA6B;KAC7C;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,2BAA2B;QACjC,WAAW,EACT,gcAAgc;QAClc,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,6BAA6B;KAC7C;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,sCAAsC;QAC5C,WAAW,EACT,sYAAsY;QACxY,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAChC,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,6BAA6B;KAC7C;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,0CAA0C;QAChD,WAAW,EACT,uWAAuW;QACzW,QAAQ,EAAE,UAAU;QACpB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAChC,iBAAiB,EAAE,CAAC,WAAW,CAAC;QAChC,aAAa,EAAE,6BAA6B;KAC7C;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,4CAA4C;QAClD,WAAW,EACT,mYAAmY;QACrY,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,CAAC;QACpB,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,6BAA6B;KAC7C;IAED,iFAAiF;IACjF,yEAAyE;IACzE,wDAAwD;IAExD;QACE,EAAE,EAAE,sBAAsB;QAC1B,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,SAAS;QACnB,IAAI,EAAE,qCAAqC;QAC3C,WAAW,EACT,8XAA8X;QAChY,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,CAAC;QACpB,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,iCAAiC;KACjD;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,SAAS;QACnB,IAAI,EAAE,kDAAkD;QACxD,WAAW,EACT,gYAAgY;QAClY,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,iCAAiC;KACjD;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,SAAS;QACnB,IAAI,EAAE,oCAAoC;QAC1C,WAAW,EACT,8XAA8X;QAChY,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,CAAC;QACpB,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,iCAAiC;KACjD;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,SAAS;QACnB,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EACT,2TAA2T;QAC7T,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,iCAAiC;KACjD;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,SAAS;QACnB,IAAI,EAAE,gDAAgD;QACtD,WAAW,EACT,8VAA8V;QAChW,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,iCAAiC;KACjD;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,SAAS;QACnB,IAAI,EAAE,8CAA8C;QACpD,WAAW,EACT,+ZAA+Z;QACja,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAChC,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,iCAAiC;KACjD;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,SAAS;QACnB,IAAI,EAAE,6CAA6C;QACnD,WAAW,EACT,kWAAkW;QACpW,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,iCAAiC;KACjD;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,SAAS;QACnB,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EACT,oWAAoW;QACtW,QAAQ,EAAE,UAAU;QACpB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAChC,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,iCAAiC;KACjD;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,SAAS;QACnB,IAAI,EAAE,oCAAoC;QAC1C,WAAW,EACT,6YAA6Y;QAC/Y,QAAQ,EAAE,UAAU;QACpB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QACtC,iBAAiB,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC;QACvE,aAAa,EAAE,iCAAiC;KACjD;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,SAAS;QACnB,IAAI,EAAE,kDAAkD;QACxD,WAAW,EACT,gZAAgZ;QAClZ,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAChC,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,iCAAiC;KACjD;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,SAAS;QACnB,IAAI,EAAE,gDAAgD;QACtD,WAAW,EACT,qYAAqY;QACvY,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,iCAAiC;KACjD;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,SAAS;QACnB,IAAI,EAAE,0BAA0B;QAChC,WAAW,EACT,0YAA0Y;QAC5Y,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAChC,iBAAiB,EAAE,CAAC,WAAW,CAAC;QAChC,aAAa,EAAE,kCAAkC;KAClD;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,SAAS;QACnB,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACT,uWAAuW;QACzW,QAAQ,EAAE,SAAS;QACnB,YAAY,EAAE,CAAC,IAAI,CAAC;QACpB,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,kCAAkC;KAClD;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,SAAS;QACnB,IAAI,EAAE,0CAA0C;QAChD,WAAW,EACT,0XAA0X;QAC5X,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAChC,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,iCAAiC;KACjD;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,SAAS;QACnB,IAAI,EAAE,qCAAqC;QAC3C,WAAW,EACT,oYAAoY;QACtY,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,iCAAiC;KACjD;IAED,iFAAiF;IACjF,0EAA0E;IAC1E,sCAAsC;IAEtC;QACE,EAAE,EAAE,qBAAqB;QACzB,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,mCAAmC;QACzC,WAAW,EACT,mUAAmU;QACrU,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,CAAC;QACpB,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,gCAAgC;KAChD;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,+BAA+B;QACrC,WAAW,EACT,4WAA4W;QAC9W,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,CAAC;QACpB,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,gCAAgC;KAChD;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,sCAAsC;QAC5C,WAAW,EACT,wVAAwV;QAC1V,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,CAAC;QACpB,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,gCAAgC;KAChD;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,6BAA6B;QACnC,WAAW,EACT,iWAAiW;QACnW,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,gCAAgC;KAChD;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,oCAAoC;QAC1C,WAAW,EACT,qUAAqU;QACvU,QAAQ,EAAE,UAAU;QACpB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,gCAAgC;KAChD;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,qCAAqC;QAC3C,WAAW,EACT,2bAA2b;QAC7b,QAAQ,EAAE,UAAU;QACpB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAChC,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,gCAAgC;KAChD;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,gCAAgC;QACtC,WAAW,EACT,4XAA4X;QAC9X,QAAQ,EAAE,UAAU;QACpB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAChC,iBAAiB,EAAE,CAAC,WAAW,CAAC;QAChC,aAAa,EAAE,gCAAgC;KAChD;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACT,sWAAsW;QACxW,QAAQ,EAAE,UAAU;QACpB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAChC,iBAAiB,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC;QAC7C,aAAa,EAAE,gCAAgC;KAChD;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,gDAAgD;QACtD,WAAW,EACT,wbAAwb;QAC1b,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAChC,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,gCAAgC;KAChD;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,mCAAmC;QACzC,WAAW,EACT,mYAAmY;QACrY,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,gCAAgC;KAChD;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,gDAAgD;QACtD,WAAW,EACT,qbAAqb;QACvb,QAAQ,EAAE,UAAU;QACpB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAChC,iBAAiB,EAAE,EAAE;QACrB,aAAa,EAAE,gCAAgC;KAChD;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,EAAE,EAAE,aAAa;IACjB,KAAK,EAAE,gEAAgE;IACvE,OAAO,EAAE,KAAK;IACd,OAAO,EAAE,CAAC,uDAAuD,CAAC;IAClE,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,6BAA6B;CACnC,CAAC;AAEF,MAAM,CAAC,MAAM,EAAE,iBAAiB,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,YAAY,CAAC,iBAAiB,CAAC,CAAC;AAElG;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAqB;IACnD,QAAQ,EAAE,oBAAoB;IAC9B,KAAK,EAAE,iBAAiB;IACxB,GAAG,YAAY,CAAC,iBAAiB,CAAC;CACnC,CAAC"}

package/dist/references/owasp-agentic-top10.d.ts

@@ -0,0 +1,50 @@
+/**
+ * OWASP Top 10 for Agentic Applications 2026
+ *
+ * Source: "OWASP Top 10 For Agentic Applications 2026" (Version 2026, December 2025)
+ * Authors: OWASP Gen AI Security Project — Agentic Security Initiative
+ * URL: https://genai.owasp.org
+ *
+ * This module maps the OWASP Agentic Top 10 to AIVSS V4 metrics and MITRE ATLAS techniques,
+ * enabling threat statements to be grounded in the OWASP community-driven agentic guidance.
+ */
+import type { MetricCode } from "../aivss/types.js";
+import { type FrameworkAdapter, type FrameworkCitation, type FrameworkRisk } from "./registry.js";
+/**
+ * OWASP Top 10 for Agentic Applications 2026 — complete risk catalogue with AIVSS metric
+ * and MITRE ATLAS technique cross-references.
+ *
+ * Mapping rationale:
+ * - ASI01 Agent Goal Hijack         → MR (model robustness against instruction override), CS (input sanitisation)
+ * - ASI02 Tool Misuse               → CS (tool permission controls), DC (deployment constraints), AD (adaptive defence)
+ * - ASI03 Identity & Privilege      → DC (deployment context, least-privilege), CS (access controls), GV (governance)
+ * - ASI04 Supply Chain              → CS (supply chain integrity), LL (lifecycle & lineage), DC (runtime composition)
+ * - ASI05 Unexpected RCE            → DC (sandbox/execution constraints), CS (code execution controls), MR (injection hardening)
+ * - ASI06 Memory & Context Poison   → DS (data/store integrity), MR (context robustness), GV (oversight of persisted state)
+ * - ASI07 Insecure Inter-Agent Comm → CS (comms security), DC (protocol controls), GV (inter-agent governance)
+ * - ASI08 Cascading Failures        → DC (fault isolation), GV (governance gates), LL (lineage/traceability for rollback)
+ * - ASI09 Human-Agent Trust Exploit → GV (human-in-the-loop governance), EI (ethical implications of anthropomorphism)
+ * - ASI10 Rogue Agents              → AA (adversarial awareness / behavioural detection), GV (governance & audit), LL (lineage)
+ */
+export declare const OWASP_AGENTIC_TOP10_RISKS: FrameworkRisk[];
+/** Citation block for use in threat statement metadata and README credits */
+export declare const OWASP_AGENTIC_TOP10_CITATION: FrameworkCitation;
+/**
+ * Return OWASP Agentic Top 10 risks relevant to a given AIVSS metric.
+ * Results are ordered by number of ATLAS techniques (most-grounded first).
+ */
+export declare const getRisksForMetric: (metric: MetricCode) => FrameworkRisk[];
+/**
+ * Return OWASP Agentic Top 10 risks by risk type.
+ */
+export declare const getRisksByType: (type: import("./registry.js").RiskType) => FrameworkRisk[];
+/**
+ * Find an OWASP Agentic Top 10 risk by its ID.
+ */
+export declare const getRiskById: (id: string) => FrameworkRisk | undefined;
+/**
+ * The registrable adapter. Registered in ./index.ts — an adapter that is not
+ * registered there never annotates a finding, however complete its risk list.
+ */
+export declare const OWASP_AGENTIC_TOP10_ADAPTER: FrameworkAdapter;
+//# sourceMappingURL=owasp-agentic-top10.d.ts.map

package/dist/references/owasp-agentic-top10.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owasp-agentic-top10.d.ts","sourceRoot":"","sources":["../../src/references/owasp-agentic-top10.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EACnB,MAAM,eAAe,CAAC;AAEvB;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,yBAAyB,EAAE,aAAa,EAoLpD,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,4BAA4B,EAAE,iBAO1C,CAAC;AAIF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,yCAA4B,CAAC;AAE3D;;GAEG;AACH,eAAO,MAAM,cAAc,6DAAyB,CAAC;AAErD;;GAEG;AACH,eAAO,MAAM,WAAW,2CAAsB,CAAC;AAE/C;;;GAGG;AACH,eAAO,MAAM,2BAA2B,EAAE,gBAIzC,CAAC"}

package/dist/references/owasp-agentic-top10.js

@@ -0,0 +1,202 @@
+/**
+ * OWASP Top 10 for Agentic Applications 2026
+ *
+ * Source: "OWASP Top 10 For Agentic Applications 2026" (Version 2026, December 2025)
+ * Authors: OWASP Gen AI Security Project — Agentic Security Initiative
+ * URL: https://genai.owasp.org
+ *
+ * This module maps the OWASP Agentic Top 10 to AIVSS V4 metrics and MITRE ATLAS techniques,
+ * enabling threat statements to be grounded in the OWASP community-driven agentic guidance.
+ */
+import { buildHelpers, } from "./registry.js";
+/**
+ * OWASP Top 10 for Agentic Applications 2026 — complete risk catalogue with AIVSS metric
+ * and MITRE ATLAS technique cross-references.
+ *
+ * Mapping rationale:
+ * - ASI01 Agent Goal Hijack         → MR (model robustness against instruction override), CS (input sanitisation)
+ * - ASI02 Tool Misuse               → CS (tool permission controls), DC (deployment constraints), AD (adaptive defence)
+ * - ASI03 Identity & Privilege      → DC (deployment context, least-privilege), CS (access controls), GV (governance)
+ * - ASI04 Supply Chain              → CS (supply chain integrity), LL (lifecycle & lineage), DC (runtime composition)
+ * - ASI05 Unexpected RCE            → DC (sandbox/execution constraints), CS (code execution controls), MR (injection hardening)
+ * - ASI06 Memory & Context Poison   → DS (data/store integrity), MR (context robustness), GV (oversight of persisted state)
+ * - ASI07 Insecure Inter-Agent Comm → CS (comms security), DC (protocol controls), GV (inter-agent governance)
+ * - ASI08 Cascading Failures        → DC (fault isolation), GV (governance gates), LL (lineage/traceability for rollback)
+ * - ASI09 Human-Agent Trust Exploit → GV (human-in-the-loop governance), EI (ethical implications of anthropomorphism)
+ * - ASI10 Rogue Agents              → AA (adversarial awareness / behavioural detection), GV (governance & audit), LL (lineage)
+ */
+export const OWASP_AGENTIC_TOP10_RISKS = [
+    // ── ASI01 ──────────────────────────────────────────────────────────────────
+    {
+        id: "owasp-asi01-agent-goal-hijack",
+        framework: "owasp-agentic-top10",
+        category: "ASI01 — Agent Goal Hijack",
+        name: "Agent Goal Hijack",
+        description: "Attackers manipulate an agent's objectives, task selection, or decision pathways through prompt-based manipulation, deceptive tool outputs, malicious artefacts, forged agent-to-agent messages, or poisoned external data. Because agents rely on untyped natural-language inputs and loosely governed orchestration logic, they cannot reliably distinguish legitimate instructions from attacker-controlled content. Unlike prompt injection targeting a single model response, ASI01 captures the broader agentic impact where manipulated inputs redirect goals, planning, and multi-step behaviour across an entire workflow.",
+        riskType: "security",
+        aivssMetrics: ["MR", "CS", "GV"],
+        atlasTechniqueIds: [
+            "AML.T0051", // LLM prompt injection — primary vector for goal hijack
+            "AML.T0054", // LLM jailbreak — bypasses goal constraints
+        ],
+        sourceSection: "OWASP Top 10 for Agentic Applications 2026 > ASI01: Agent Goal Hijack",
+    },
+    // ── ASI02 ──────────────────────────────────────────────────────────────────
+    {
+        id: "owasp-asi02-tool-misuse",
+        framework: "owasp-agentic-top10",
+        category: "ASI02 — Tool Misuse and Exploitation",
+        name: "Tool Misuse and Exploitation",
+        description: "Agents can misuse legitimate tools due to prompt injection, misalignment, unsafe delegation, or ambiguous instructions, leading to data exfiltration, tool-output manipulation, or workflow hijacking. This entry covers cases where the agent operates within its authorised privileges but applies a tool in an unsafe or unintended way — for example deleting valuable data, over-invoking costly APIs, or exfiltrating information. Risks arise from agent memory, dynamic tool selection, and delegation chains that can enable tool chaining, privilege escalation, and unintended side effects.",
+        riskType: "security",
+        aivssMetrics: ["CS", "DC", "AD"],
+        atlasTechniqueIds: [
+            "AML.T0051", // LLM prompt injection — triggers unsafe tool use
+            "AML.T0080", // LLM meta-prompt extraction — tool descriptor manipulation / tool poisoning
+        ],
+        sourceSection: "OWASP Top 10 for Agentic Applications 2026 > ASI02: Tool Misuse and Exploitation",
+    },
+    // ── ASI03 ──────────────────────────────────────────────────────────────────
+    {
+        id: "owasp-asi03-identity-privilege-abuse",
+        framework: "owasp-agentic-top10",
+        category: "ASI03 — Identity and Privilege Abuse",
+        name: "Identity and Privilege Abuse",
+        description: "Identity and Privilege Abuse exploits dynamic trust and delegation in agents to escalate access and bypass controls by manipulating delegation chains, role inheritance, control flows, and agent context including cached credentials or conversation history across interconnected systems. Without a distinct, governed identity of its own, an agent operates in an attribution gap that makes enforcing true least privilege impossible. Agent-to-agent trust or inherited credentials can be exploited to escalate access, hijack privileges, or execute unauthorised actions — including via time-of-check/time-of-use races, synthetic identity injection, and memory-based credential retention.",
+        riskType: "security",
+        aivssMetrics: ["DC", "CS", "GV"],
+        atlasTechniqueIds: [
+            "AML.T0069", // Discover ML model family — reconnaissance enabling targeted impersonation
+        ],
+        sourceSection: "OWASP Top 10 for Agentic Applications 2026 > ASI03: Identity and Privilege Abuse",
+    },
+    // ── ASI04 ──────────────────────────────────────────────────────────────────
+    {
+        id: "owasp-asi04-supply-chain",
+        framework: "owasp-agentic-top10",
+        category: "ASI04 — Agentic Supply Chain Vulnerabilities",
+        name: "Agentic Supply Chain Vulnerabilities",
+        description: "Agentic supply chain vulnerabilities arise when agents, tools, and related artefacts they work with are provided by third parties and may be malicious, compromised, or tampered with in transit — including models and model weights, tools, plug-ins, datasets, other agents, agentic interfaces (MCP, A2A), agentic registries, or update channels. Unlike traditional software supply chains, agentic ecosystems compose capabilities at runtime by loading external tools and agent personas dynamically, increasing the attack surface. Distributed runtime coordination combined with agentic autonomy creates a live supply chain that can cascade vulnerabilities across agents without static analysis catching them.",
+        riskType: "security",
+        aivssMetrics: ["CS", "LL", "DC"],
+        atlasTechniqueIds: [
+            "AML.T0010", // ML supply chain compromise — poisoned models/tools/plugins
+            "AML.T0115.000", // Publish poisoned AI artifacts: datasets — analogue: publish malicious MCP tools or prompt templates
+            "AML.T0020", // Poison training data — via poisoned knowledge plugins and RAG sources
+        ],
+        sourceSection: "OWASP Top 10 for Agentic Applications 2026 > ASI04: Agentic Supply Chain Vulnerabilities",
+    },
+    // ── ASI05 ──────────────────────────────────────────────────────────────────
+    {
+        id: "owasp-asi05-unexpected-rce",
+        framework: "owasp-agentic-top10",
+        category: "ASI05 — Unexpected Code Execution (RCE)",
+        name: "Unexpected Code Execution (RCE)",
+        description: "Agentic systems — including code-generation and 'vibe coding' tools — often generate and execute code at runtime. Attackers exploit code-generation features or embedded tool access to escalate actions into remote code execution, local misuse, or exploitation of internal systems; because this code is generated in real-time it can bypass traditional static security controls. Prompt injection, tool misuse, or unsafe serialisation can convert natural-language text into unintended executable behaviour through scripts, binaries, JIT/WASM modules, deserialised objects, template engines, or in-memory evaluations that lead to host or container compromise, persistence, or sandbox escape.",
+        riskType: "security",
+        aivssMetrics: ["DC", "CS", "MR"],
+        atlasTechniqueIds: [
+            "AML.T0051", // LLM prompt injection — primary trigger for injected code execution
+        ],
+        sourceSection: "OWASP Top 10 for Agentic Applications 2026 > ASI05: Unexpected Code Execution (RCE)",
+    },
+    // ── ASI06 ──────────────────────────────────────────────────────────────────
+    {
+        id: "owasp-asi06-memory-context-poisoning",
+        framework: "owasp-agentic-top10",
+        category: "ASI06 — Memory & Context Poisoning",
+        name: "Memory & Context Poisoning",
+        description: "Agentic systems rely on stored and retrievable information — conversation history, memory tools, expanded context, summaries, embeddings, and RAG stores — that supports continuity across tasks and reasoning cycles. Adversaries corrupt or seed this context with malicious or misleading data, causing future reasoning, planning, or tool use to become biased, unsafe, or aid exfiltration. This is distinct from direct goal hijack (ASI01) in that it targets persistent corruption of stored context or long-term memory rather than interactively overriding instructions; the poisoned state propagates across sessions and alters autonomous reasoning long after the original injection.",
+        riskType: "security",
+        aivssMetrics: ["DS", "MR", "GV"],
+        atlasTechniqueIds: [
+            "AML.T0020", // Poison training data — analogue: poison RAG/memory stores
+            "AML.T0051", // LLM prompt injection — used to implant memory via indirect injection
+        ],
+        sourceSection: "OWASP Top 10 for Agentic Applications 2026 > ASI06: Memory & Context Poisoning",
+    },
+    // ── ASI07 ──────────────────────────────────────────────────────────────────
+    {
+        id: "owasp-asi07-insecure-inter-agent-comm",
+        framework: "owasp-agentic-top10",
+        category: "ASI07 — Insecure Inter-Agent Communication",
+        name: "Insecure Inter-Agent Communication",
+        description: "Multi-agent systems depend on continuous communication between autonomous agents that coordinate via APIs, message buses, and shared memory, significantly expanding the attack surface. Decentralised architecture, varying autonomy levels, and uneven trust make perimeter-based security models ineffective. Insecure inter-agent communication occurs when these exchanges lack proper authentication, integrity, or semantic validation, allowing interception, spoofing, or manipulation of agent messages and intents across transport, routing, discovery, and semantic layers — including covert or side-channels where agents leak or infer data through timing or behavioural cues.",
+        riskType: "security",
+        aivssMetrics: ["CS", "DC", "GV"],
+        atlasTechniqueIds: [],
+        sourceSection: "OWASP Top 10 for Agentic Applications 2026 > ASI07: Insecure Inter-Agent Communication",
+    },
+    // ── ASI08 ──────────────────────────────────────────────────────────────────
+    {
+        id: "owasp-asi08-cascading-failures",
+        framework: "owasp-agentic-top10",
+        category: "ASI08 — Cascading Failures",
+        name: "Cascading Failures",
+        description: "Agentic cascading failures occur when a single fault — hallucination, malicious input, corrupted tool, or poisoned memory — propagates across autonomous agents, compounding into system-wide harm. Because agents plan, persist, and delegate autonomously, a single error can bypass stepwise human checks and persist in a saved state; as agents form emergent links to new tools or peers, these latent faults chain into privileged operations that compromise confidentiality, integrity, and availability. ASI08 focuses on the propagation and amplification of an initial fault across agents, tools, and workflows — not the initial vulnerability itself — causing measurable fan-out or systemic impact beyond the original breach.",
+        riskType: "security",
+        aivssMetrics: ["DC", "GV", "LL"],
+        atlasTechniqueIds: [],
+        sourceSection: "OWASP Top 10 for Agentic Applications 2026 > ASI08: Cascading Failures",
+    },
+    // ── ASI09 ──────────────────────────────────────────────────────────────────
+    {
+        id: "owasp-asi09-human-agent-trust-exploitation",
+        framework: "owasp-agentic-top10",
+        category: "ASI09 — Human-Agent Trust Exploitation",
+        name: "Human-Agent Trust Exploitation",
+        description: "Intelligent agents can establish strong trust with human users through natural language fluency, emotional intelligence, and perceived expertise — a phenomenon known as anthropomorphism. Adversaries or misaligned designs may exploit this trust to influence user decisions, extract sensitive information, or steer outcomes for malicious purposes; in agentic systems this risk is amplified when humans over-rely on autonomous recommendations or unverifiable rationales, approving actions without independent validation. The agent acts as an untraceable 'bad influence,' manipulating the human into performing the final, audited action while making the agent's role invisible to forensics.",
+        riskType: "security",
+        aivssMetrics: ["GV", "EI"],
+        atlasTechniqueIds: [],
+        sourceSection: "OWASP Top 10 for Agentic Applications 2026 > ASI09: Human-Agent Trust Exploitation",
+    },
+    // ── ASI10 ──────────────────────────────────────────────────────────────────
+    {
+        id: "owasp-asi10-rogue-agents",
+        framework: "owasp-agentic-top10",
+        category: "ASI10 — Rogue Agents",
+        name: "Rogue Agents",
+        description: "Rogue Agents are malicious or compromised AI agents that deviate from their intended function or authorised scope, acting harmfully, deceptively, or parasitically within multi-agent or human-agent ecosystems. The agent's actions may individually appear legitimate but its emergent behaviour becomes harmful, creating a containment gap for traditional rule-based systems. ASI10 focuses on the loss of behavioural integrity and governance once drift begins — not the initial intrusion itself — with consequences including sensitive information disclosure, misinformation propagation, workflow hijacking, reward hacking, autonomous self-replication, and operational sabotage.",
+        riskType: "security",
+        aivssMetrics: ["AA", "GV", "LL"],
+        atlasTechniqueIds: [
+            "AML.T0054", // LLM jailbreak — can initiate behavioural divergence
+            "AML.T0010", // ML supply chain compromise — compromised agent introduced into workflow
+        ],
+        sourceSection: "OWASP Top 10 for Agentic Applications 2026 > ASI10: Rogue Agents",
+    },
+];
+/** Citation block for use in threat statement metadata and README credits */
+export const OWASP_AGENTIC_TOP10_CITATION = {
+    id: "owasp-agentic-top10",
+    title: "OWASP Top 10 For Agentic Applications 2026",
+    version: "2026",
+    authors: ["OWASP Gen AI Security Project — Agentic Security Initiative"],
+    year: 2025,
+    url: "https://genai.owasp.org",
+};
+const helpers = buildHelpers(OWASP_AGENTIC_TOP10_RISKS);
+/**
+ * Return OWASP Agentic Top 10 risks relevant to a given AIVSS metric.
+ * Results are ordered by number of ATLAS techniques (most-grounded first).
+ */
+export const getRisksForMetric = helpers.getRisksForMetric;
+/**
+ * Return OWASP Agentic Top 10 risks by risk type.
+ */
+export const getRisksByType = helpers.getRisksByType;
+/**
+ * Find an OWASP Agentic Top 10 risk by its ID.
+ */
+export const getRiskById = helpers.getRiskById;
+/**
+ * The registrable adapter. Registered in ./index.ts — an adapter that is not
+ * registered there never annotates a finding, however complete its risk list.
+ */
+export const OWASP_AGENTIC_TOP10_ADAPTER = {
+    citation: OWASP_AGENTIC_TOP10_CITATION,
+    risks: OWASP_AGENTIC_TOP10_RISKS,
+    ...helpers,
+};
+//# sourceMappingURL=owasp-agentic-top10.js.map

package/dist/references/owasp-agentic-top10.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"owasp-agentic-top10.js","sourceRoot":"","sources":["../../src/references/owasp-agentic-top10.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EACL,YAAY,GAIb,MAAM,eAAe,CAAC;AAEvB;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAoB;IACxD,8EAA8E;IAE9E;QACE,EAAE,EAAE,+BAA+B;QACnC,SAAS,EAAE,qBAAqB;QAChC,QAAQ,EAAE,2BAA2B;QACrC,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACT,qmBAAqmB;QACvmB,QAAQ,EAAE,UAAU;QACpB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAChC,iBAAiB,EAAE;YACjB,WAAW,EAAE,wDAAwD;YACrE,WAAW,EAAE,4CAA4C;SAC1D;QACD,aAAa,EACX,uEAAuE;KAC1E;IAED,8EAA8E;IAE9E;QACE,EAAE,EAAE,yBAAyB;QAC7B,SAAS,EAAE,qBAAqB;QAChC,QAAQ,EAAE,sCAAsC;QAChD,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACT,ykBAAykB;QAC3kB,QAAQ,EAAE,UAAU;QACpB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAChC,iBAAiB,EAAE;YACjB,WAAW,EAAE,kDAAkD;YAC/D,WAAW,EAAE,6EAA6E;SAC3F;QACD,aAAa,EACX,kFAAkF;KACrF;IAED,8EAA8E;IAE9E;QACE,EAAE,EAAE,sCAAsC;QAC1C,SAAS,EAAE,qBAAqB;QAChC,QAAQ,EAAE,sCAAsC;QAChD,IAAI,EAAE,8BAA8B;QACpC,WAAW,EACT,2qBAA2qB;QAC7qB,QAAQ,EAAE,UAAU;QACpB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAChC,iBAAiB,EAAE;YACjB,WAAW,EAAE,4EAA4E;SAC1F;QACD,aAAa,EACX,kFAAkF;KACrF;IAED,8EAA8E;IAE9E;QACE,EAAE,EAAE,0BAA0B;QAC9B,SAAS,EAAE,qBAAqB;QAChC,QAAQ,EAAE,8CAA8C;QACxD,IAAI,EAAE,sCAAsC;QAC5C,WAAW,EACT,isBAAisB;QACnsB,QAAQ,EAAE,UAAU;QACpB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAChC,iBAAiB,EAAE;YACjB,WAAW,EAAE,6DAA6D;YAC1E,eAAe,EAAE,sGAAsG;YACvH,WAAW,EAAE,wEAAwE;SACtF;QACD,aAAa,EACX,0FAA0F;KAC7F;IAED,8EAA8E;IAE9E;QACE,EAAE,EAAE,4BAA4B;QAChC,SAAS,EAAE,qBAAqB;QAChC,QAAQ,EAAE,yCAAyC;QACnD,IAAI,EAAE,iCAAiC;QACvC,WAAW,EACT,grBAAgrB;QAClrB,QAAQ,EAAE,UAAU;QACpB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAChC,iBAAiB,EAAE;YACjB,WAAW,EAAE,qEAAqE;SACnF;QACD,aAAa,EACX,qFAAqF;KACxF;IAED,8EAA8E;IAE9E;QACE,EAAE,EAAE,sCAAsC;QAC1C,SAAS,EAAE,qBAAqB;QAChC,QAAQ,EAAE,oCAAoC;QAC9C,IAAI,EAAE,4BAA4B;QAClC,WAAW,EACT,uqBAAuqB;QACzqB,QAAQ,EAAE,UAAU;QACpB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAChC,iBAAiB,EAAE;YACjB,WAAW,EAAE,4DAA4D;YACzE,WAAW,EAAE,uEAAuE;SACrF;QACD,aAAa,EACX,gFAAgF;KACnF;IAED,8EAA8E;IAE9E;QACE,EAAE,EAAE,uCAAuC;QAC3C,SAAS,EAAE,qBAAqB;QAChC,QAAQ,EAAE,4CAA4C;QACtD,IAAI,EAAE,oCAAoC;QAC1C,WAAW,EACT,iqBAAiqB;QACnqB,QAAQ,EAAE,UAAU;QACpB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAChC,iBAAiB,EAAE,EAAE;QACrB,aAAa,EACX,wFAAwF;KAC3F;IAED,8EAA8E;IAE9E;QACE,EAAE,EAAE,gCAAgC;QACpC,SAAS,EAAE,qBAAqB;QAChC,QAAQ,EAAE,4BAA4B;QACtC,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EACT,ktBAAktB;QACptB,QAAQ,EAAE,UAAU;QACpB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAChC,iBAAiB,EAAE,EAAE;QACrB,aAAa,EACX,wEAAwE;KAC3E;IAED,8EAA8E;IAE9E;QACE,EAAE,EAAE,4CAA4C;QAChD,SAAS,EAAE,qBAAqB;QAChC,QAAQ,EAAE,wCAAwC;QAClD,IAAI,EAAE,gCAAgC;QACtC,WAAW,EACT,grBAAgrB;QAClrB,QAAQ,EAAE,UAAU;QACpB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QAC1B,iBAAiB,EAAE,EAAE;QACrB,aAAa,EACX,oFAAoF;KACvF;IAED,8EAA8E;IAE9E;QACE,EAAE,EAAE,0BAA0B;QAC9B,SAAS,EAAE,qBAAqB;QAChC,QAAQ,EAAE,sBAAsB;QAChC,IAAI,EAAE,cAAc;QACpB,WAAW,EACT,kqBAAkqB;QACpqB,QAAQ,EAAE,UAAU;QACpB,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QAChC,iBAAiB,EAAE;YACjB,WAAW,EAAE,sDAAsD;YACnE,WAAW,EAAE,0EAA0E;SACxF;QACD,aAAa,EACX,kEAAkE;KACrE;CACF,CAAC;AAEF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,4BAA4B,GAAsB;IAC7D,EAAE,EAAE,qBAAqB;IACzB,KAAK,EAAE,4CAA4C;IACnD,OAAO,EAAE,MAAM;IACf,OAAO,EAAE,CAAC,6DAA6D,CAAC;IACxE,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,yBAAyB;CAC/B,CAAC;AAEF,MAAM,OAAO,GAAG,YAAY,CAAC,yBAAyB,CAAC,CAAC;AAExD;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;AAE3D;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;AAErD;;GAEG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;AAE/C;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAqB;IAC3D,QAAQ,EAAE,4BAA4B;IACtC,KAAK,EAAE,yBAAyB;IAChC,GAAG,OAAO;CACX,CAAC"}

package/dist/references/registry-parity.test.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Framework parity — package metadata must match what the engine registers.
+ *
+ * Why this test exists: the package advertised "OWASP, NIST AI RMF" in its
+ * description and keywords while src/references/index.ts registered only three
+ * adapters. NIST and OWASP Agentic Top 10 had complete risk catalogues but
+ * never assembled a FrameworkAdapter, and NemoClaw assembled one that was
+ * never registered. A user reading the package page would have expected
+ * framework annotations that the engine could not produce.
+ *
+ * For a tool whose product is trust, an advertised-but-absent framework is a
+ * correctness defect, not a documentation lag. This test makes the drift
+ * mechanical to catch: add an adapter without advertising it, or advertise one
+ * without registering it, and the suite fails.
+ */
+export {};
+//# sourceMappingURL=registry-parity.test.d.ts.map

package/dist/references/registry-parity.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-parity.test.d.ts","sourceRoot":"","sources":["../../src/references/registry-parity.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG"}

package/dist/references/registry-parity.test.js

@@ -0,0 +1,87 @@
+/**
+ * Framework parity — package metadata must match what the engine registers.
+ *
+ * Why this test exists: the package advertised "OWASP, NIST AI RMF" in its
+ * description and keywords while src/references/index.ts registered only three
+ * adapters. NIST and OWASP Agentic Top 10 had complete risk catalogues but
+ * never assembled a FrameworkAdapter, and NemoClaw assembled one that was
+ * never registered. A user reading the package page would have expected
+ * framework annotations that the engine could not produce.
+ *
+ * For a tool whose product is trust, an advertised-but-absent framework is a
+ * correctness defect, not a documentation lag. This test makes the drift
+ * mechanical to catch: add an adapter without advertising it, or advertise one
+ * without registering it, and the suite fails.
+ */
+import { describe, expect, test } from "bun:test";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+import { FRAMEWORK_REGISTRY, REGISTERED_FRAMEWORK_IDS } from "./index.js";
+const packageJsonPath = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../package.json");
+const pkg = JSON.parse(fs.readFileSync(packageJsonPath, "utf8"));
+describe("framework registry parity", () => {
+    test("package.json declares a canopy.frameworks list", () => {
+        expect(Array.isArray(pkg.canopy?.frameworks)).toBe(true);
+        expect(pkg.canopy.frameworks.length).toBeGreaterThan(0);
+    });
+    test("advertised frameworks exactly match registered adapters", () => {
+        const advertised = [...pkg.canopy.frameworks].sort();
+        // Set equality in both directions — an adapter registered but not
+        // advertised is as much a defect as the reverse, because the README and
+        // package page under-report what the tool actually does.
+        expect(advertised).toEqual(REGISTERED_FRAMEWORK_IDS);
+    });
+    test("no duplicate framework ids are registered", () => {
+        const ids = FRAMEWORK_REGISTRY.map((a) => a.citation.id);
+        expect(new Set(ids).size).toBe(ids.length);
+    });
+});
+describe("registered adapters are well-formed", () => {
+    test.each(FRAMEWORK_REGISTRY.map((a) => [a.citation.id, a]))("%s carries a complete citation and a non-empty risk list", (_id, adapter) => {
+        expect(adapter.citation.title.length).toBeGreaterThan(0);
+        expect(adapter.citation.authors.length).toBeGreaterThan(0);
+        expect(adapter.citation.url).toMatch(/^https?:\/\//);
+        expect(adapter.citation.year).toBeGreaterThan(2000);
+        expect(adapter.risks.length).toBeGreaterThan(0);
+    });
+    test.each(FRAMEWORK_REGISTRY.map((a) => [a.citation.id, a]))("%s risks declare the framework id they belong to", (id, adapter) => {
+        for (const risk of adapter.risks) {
+            expect(risk.framework).toBe(id);
+        }
+    });
+    test.each(FRAMEWORK_REGISTRY.map((a) => [a.citation.id, a]))("%s risk ids are unique within the framework", (_id, adapter) => {
+        const ids = adapter.risks.map((r) => r.id);
+        expect(new Set(ids).size).toBe(ids.length);
+    });
+    test.each(FRAMEWORK_REGISTRY.map((a) => [a.citation.id, a]))("%s cites only real ATLAS technique ids", (_id, adapter) => {
+        // Shape check rather than a lookup against vendored ATLAS: this catches
+        // the failure mode competitors have shipped — a model asked to "attach a
+        // technique id" inventing a plausible-looking one.
+        for (const risk of adapter.risks) {
+            for (const techniqueId of risk.atlasTechniqueIds) {
+                expect(techniqueId).toMatch(/^AML\.T\d{4}(\.\d{3})?$/);
+            }
+        }
+    });
+    test.each(FRAMEWORK_REGISTRY.map((a) => [a.citation.id, a]))("%s risks declare a valid riskType and known AIVSS metrics", (_id, adapter) => {
+        const validMetrics = new Set([
+            "MR",
+            "DS",
+            "EI",
+            "DC",
+            "AD",
+            "AA",
+            "LL",
+            "GV",
+            "CS",
+        ]);
+        for (const risk of adapter.risks) {
+            expect(["security", "ethical", "compliance"]).toContain(risk.riskType);
+            for (const metric of risk.aivssMetrics) {
+                expect(validMetrics.has(metric)).toBe(true);
+            }
+        }
+    });
+});
+//# sourceMappingURL=registry-parity.test.js.map

package/dist/references/registry-parity.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-parity.test.js","sourceRoot":"","sources":["../../src/references/registry-parity.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAClD,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAG1E,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAClC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAC5C,oBAAoB,CACrB,CAAC;AAEF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAE9D,CAAC;AAEF,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,IAAI,CAAC,gDAAgD,EAAE,GAAG,EAAE;QAC1D,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,CAAC,GAAG,CAAC,MAAO,CAAC,UAAW,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACnE,MAAM,UAAU,GAAG,CAAC,GAAG,GAAG,CAAC,MAAO,CAAC,UAAW,CAAC,CAAC,IAAI,EAAE,CAAC;QACvD,kEAAkE;QAClE,wEAAwE;QACxE,yDAAyD;QACzD,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACrD,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACzD,MAAM,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qCAAqC,EAAE,GAAG,EAAE;IACnD,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAU,CAAC,CAAC,CACnE,0DAA0D,EAC1D,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;QACf,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC3D,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACrD,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CACF,CAAC;IAEF,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAU,CAAC,CAAC,CACnE,kDAAkD,EAClD,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE;QACd,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAU,CAAC,CAAC,CACnE,6CAA6C,EAC7C,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;QACf,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC,CACF,CAAC;IAEF,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAU,CAAC,CAAC,CACnE,wCAAwC,EACxC,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;QACf,wEAAwE;QACxE,yEAAyE;QACzE,mDAAmD;QACnD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACjC,KAAK,MAAM,WAAW,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACjD,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;IACH,CAAC,CACF,CAAC;IAEF,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAU,CAAC,CAAC,CACnE,2DAA2D,EAC3D,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;QACf,MAAM,YAAY,GAAG,IAAI,GAAG,CAAa;YACvC,IAAI;YACJ,IAAI;YACJ,IAAI;YACJ,IAAI;YACJ,IAAI;YACJ,IAAI;YACJ,IAAI;YACJ,IAAI;YACJ,IAAI;SACL,CAAC,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACjC,MAAM,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvE,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACvC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/references/registry.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Framework Registry — shared interface for all risk framework adapters.
+ *
+ * Each adapter (asd-acsc-risks.ts, owasp-agentic-top10.ts, dstg-meaid.ts,
+ * nist-ai-rmf.ts, …) exports a list of FrameworkRisk entries and a citation
+ * block. New frameworks are added via GitHub PRs — one file per framework,
+ * implementing this interface.
+ *
+ * Design: assess once (AIVSS V4 + ATLAS), map many (each framework adapter
+ * annotates findings with its own risk IDs and categories).
+ */
+import type { MetricCode } from "../aivss/types.js";
+/**
+ * The type of risk a finding represents.
+ *
+ * - "security"   — CIA triad violation; AIVSS + ATLAS territory
+ * - "ethical"    — bias, fairness, misappropriation, transparency; MEAID territory.
+ *                  BAU misuse of AI resources is ethical, not necessarily a security event.
+ * - "compliance" — governance, audit, regulatory accountability; ISO 42001, NIST AI RMF territory
+ */
+export type RiskType = "security" | "ethical" | "compliance";
+/**
+ * A single named risk from any framework, normalised to a common shape.
+ */
+export interface FrameworkRisk {
+    /** Unique slug within this framework (kebab-case, framework-prefixed). e.g. "owasp-a1-prompt-injection" */
+    id: string;
+    /** Short framework identifier. e.g. "owasp-agentic-top10", "dstg-meaid", "nist-ai-rmf", "asd-acsc" */
+    framework: string;
+    /** The framework's own top-level category or function. e.g. "GOVERN", "Privilege", "A1" */
+    category: string;
+    /** Risk name as used in the source document */
+    name: string;
+    /** One-paragraph description faithful to the source document */
+    description: string;
+    /** Type of risk — determines which stakeholder audience this finding is relevant to */
+    riskType: RiskType;
+    /**
+     * AIVSS V4 metrics most relevant to assessing this risk.
+     * Ordered by relevance (primary first). May be empty for purely ethical/compliance risks
+     * that fall outside AIVSS's scoring scope — those still appear in TC output as framework findings.
+     */
+    aivssMetrics: MetricCode[];
+    /**
+     * MITRE ATLAS technique IDs that operationalise this risk as adversary TTPs.
+     * Empty where ATLAS does not directly cover the risk (e.g. ethical, governance domains).
+     */
+    atlasTechniqueIds: string[];
+    /** Section or identifier in the source document for traceability */
+    sourceSection: string;
+}
+/**
+ * Citation block for a framework — used in TC metadata and README attribution.
+ */
+export interface FrameworkCitation {
+    /** Short identifier matching FrameworkRisk.framework */
+    id: string;
+    /** Full title of the document or framework */
+    title: string;
+    /** Version string if applicable */
+    version?: string;
+    /** Publishing organisation(s) */
+    authors: string[];
+    /** Publication year */
+    year: number;
+    /** Canonical URL */
+    url: string;
+}
+/**
+ * A complete framework adapter — citation + risk list + lookup helpers.
+ * Each adapter file exports one of these.
+ */
+export interface FrameworkAdapter {
+    citation: FrameworkCitation;
+    risks: FrameworkRisk[];
+    /** Return risks relevant to a given AIVSS metric */
+    getRisksForMetric(metric: MetricCode): FrameworkRisk[];
+    /** Return risks of a given type */
+    getRisksByType(type: RiskType): FrameworkRisk[];
+    /** Look up a risk by its id */
+    getRiskById(id: string): FrameworkRisk | undefined;
+}
+/**
+ * Convenience: build the three standard lookup helpers from a risk list.
+ * Each adapter file calls this rather than re-implementing the same functions.
+ */
+export declare function buildHelpers(risks: FrameworkRisk[]): Pick<FrameworkAdapter, "getRisksForMetric" | "getRisksByType" | "getRiskById">;
+export declare const FRAMEWORK_REGISTRY: FrameworkAdapter[];
+export declare function registerFrameworkAdapter(adapter: FrameworkAdapter): void;
+//# sourceMappingURL=registry.d.ts.map

package/dist/references/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/references/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD;;;;;;;GAOG;AACH,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,SAAS,GAAG,YAAY,CAAC;AAE7D;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,2GAA2G;IAC3G,EAAE,EAAE,MAAM,CAAC;IACX,sGAAsG;IACtG,SAAS,EAAE,MAAM,CAAC;IAClB,2FAA2F;IAC3F,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,WAAW,EAAE,MAAM,CAAC;IACpB,uFAAuF;IACvF,QAAQ,EAAE,QAAQ,CAAC;IACnB;;;;OAIG;IACH,YAAY,EAAE,UAAU,EAAE,CAAC;IAC3B;;;OAGG;IACH,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,oEAAoE;IACpE,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,wDAAwD;IACxD,EAAE,EAAE,MAAM,CAAC;IACX,8CAA8C;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,mCAAmC;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iCAAiC;IACjC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB;IACpB,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,oDAAoD;IACpD,iBAAiB,CAAC,MAAM,EAAE,UAAU,GAAG,aAAa,EAAE,CAAC;IACvD,mCAAmC;IACnC,cAAc,CAAC,IAAI,EAAE,QAAQ,GAAG,aAAa,EAAE,CAAC;IAChD,+BAA+B;IAC/B,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAAC;CACpD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC,gBAAgB,EAAE,mBAAmB,GAAG,gBAAgB,GAAG,aAAa,CAAC,CASnI;AAED,eAAO,MAAM,kBAAkB,EAAE,gBAAgB,EAAO,CAAC;AAEzD,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAExE"}

package/dist/references/registry.js

@@ -0,0 +1,29 @@
+/**
+ * Framework Registry — shared interface for all risk framework adapters.
+ *
+ * Each adapter (asd-acsc-risks.ts, owasp-agentic-top10.ts, dstg-meaid.ts,
+ * nist-ai-rmf.ts, …) exports a list of FrameworkRisk entries and a citation
+ * block. New frameworks are added via GitHub PRs — one file per framework,
+ * implementing this interface.
+ *
+ * Design: assess once (AIVSS V4 + ATLAS), map many (each framework adapter
+ * annotates findings with its own risk IDs and categories).
+ */
+/**
+ * Convenience: build the three standard lookup helpers from a risk list.
+ * Each adapter file calls this rather than re-implementing the same functions.
+ */
+export function buildHelpers(risks) {
+    return {
+        getRisksForMetric: (metric) => risks
+            .filter((r) => r.aivssMetrics.includes(metric))
+            .sort((a, b) => b.atlasTechniqueIds.length - a.atlasTechniqueIds.length),
+        getRisksByType: (type) => risks.filter((r) => r.riskType === type),
+        getRiskById: (id) => risks.find((r) => r.id === id),
+    };
+}
+export const FRAMEWORK_REGISTRY = [];
+export function registerFrameworkAdapter(adapter) {
+    FRAMEWORK_REGISTRY.push(adapter);
+}
+//# sourceMappingURL=registry.js.map

package/dist/references/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/references/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AA8EH;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAsB;IACjD,OAAO;QACL,iBAAiB,EAAE,CAAC,MAAM,EAAE,EAAE,CAC5B,KAAK;aACF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;aAC9C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC;QAC5E,cAAc,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC;QAClE,WAAW,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;KACpD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAuB,EAAE,CAAC;AAEzD,MAAM,UAAU,wBAAwB,CAAC,OAAyB;IAChE,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACnC,CAAC"}