@waratahlabs/canopy 0.5.0

package/dist/aivss/atlas/loader.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.test.js","sourceRoot":"","sources":["../../../src/aivss/atlas/loader.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,SAAS,aAAa,CAAC,OAAe;IACpC,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC1C,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmClB,CAAC;AAEF,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;CAyBlB,CAAC;AAEF,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,KAAK,GAAG,aAAa,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC;QAEvD,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAE1C,MAAM,SAAS,GAAG,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACvD,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACvD,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;QAEnD,MAAM,YAAY,GAAG,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC9D,MAAM,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAEvD,MAAM,WAAW,GAAG,KAAK,CAAC,wBAAwB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACpE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,KAAK,GAAG,aAAa,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC;QAEvD,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAE1C,MAAM,SAAS,GAAG,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACvD,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;QAEnD,MAAM,WAAW,GAAG,KAAK,CAAC,wBAAwB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACpE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,aAAa,CAAC,4BAA4B,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACrF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/aivss/atlas/resolve-path.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Single source of truth for locating the vendored MITRE ATLAS data file.
+ *
+ * Two problems this solves:
+ *
+ * 1. **Installed-package resolution.** When Canopy runs as a dependency, the
+ *    consumer's `process.cwd()` has no `vendor/` directory. Resolution must
+ *    fall back to a path relative to this module, which lands inside the
+ *    installed package. Previously `batch-builder.ts` resolved from cwd only
+ *    and would throw for every installed consumer.
+ *
+ * 2. **Version pinning.** The ATLAS content filename was hardcoded in eight
+ *    call sites, so a monthly content bump meant eight edits and a silent
+ *    miss if one was forgotten. The pinned filename now lives here alone.
+ *
+ * Deliberately NOT auto-discovering the newest `ATLAS-*.yaml` on disk: scores
+ * are a stability contract, and picking up a new content release implicitly
+ * would change emitted scores without a version bump. Upgrading ATLAS is an
+ * explicit edit to ATLAS_CONTENT_VERSION plus a re-run of the assessments.
+ */
+/** Calendar content version of the vendored ATLAS release (MITRE ships monthly). */
+export declare const ATLAS_CONTENT_VERSION = "2026.07";
+/** Semver schema version of the vendored release — tracked separately by MITRE since 2026.05. */
+export declare const ATLAS_FORMAT_VERSION = "6.0.0";
+/** Filename of the vendored ATLAS data, derived from the pinned content version. */
+export declare const ATLAS_YAML_FILENAME = "ATLAS-2026.07.yaml";
+/**
+ * Resolve the vendored ATLAS YAML.
+ *
+ * @param explicit - caller-supplied path; returned as-is when provided.
+ * @throws when no candidate exists, naming every path tried.
+ */
+export declare function resolveAtlasYaml(explicit?: string): string;
+//# sourceMappingURL=resolve-path.d.ts.map

package/dist/aivss/atlas/resolve-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-path.d.ts","sourceRoot":"","sources":["../../../src/aivss/atlas/resolve-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAMH,oFAAoF;AACpF,eAAO,MAAM,qBAAqB,YAAY,CAAC;AAE/C,iGAAiG;AACjG,eAAO,MAAM,oBAAoB,UAAU,CAAC;AAE5C,oFAAoF;AACpF,eAAO,MAAM,mBAAmB,uBAAwC,CAAC;AAIzE;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAwB1D"}

package/dist/aivss/atlas/resolve-path.js

@@ -0,0 +1,58 @@
+/**
+ * Single source of truth for locating the vendored MITRE ATLAS data file.
+ *
+ * Two problems this solves:
+ *
+ * 1. **Installed-package resolution.** When Canopy runs as a dependency, the
+ *    consumer's `process.cwd()` has no `vendor/` directory. Resolution must
+ *    fall back to a path relative to this module, which lands inside the
+ *    installed package. Previously `batch-builder.ts` resolved from cwd only
+ *    and would throw for every installed consumer.
+ *
+ * 2. **Version pinning.** The ATLAS content filename was hardcoded in eight
+ *    call sites, so a monthly content bump meant eight edits and a silent
+ *    miss if one was forgotten. The pinned filename now lives here alone.
+ *
+ * Deliberately NOT auto-discovering the newest `ATLAS-*.yaml` on disk: scores
+ * are a stability contract, and picking up a new content release implicitly
+ * would change emitted scores without a version bump. Upgrading ATLAS is an
+ * explicit edit to ATLAS_CONTENT_VERSION plus a re-run of the assessments.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+/** Calendar content version of the vendored ATLAS release (MITRE ships monthly). */
+export const ATLAS_CONTENT_VERSION = "2026.07";
+/** Semver schema version of the vendored release — tracked separately by MITRE since 2026.05. */
+export const ATLAS_FORMAT_VERSION = "6.0.0";
+/** Filename of the vendored ATLAS data, derived from the pinned content version. */
+export const ATLAS_YAML_FILENAME = `ATLAS-${ATLAS_CONTENT_VERSION}.yaml`;
+const VENDOR_RELATIVE = `vendor/atlas-release/${ATLAS_YAML_FILENAME}`;
+/**
+ * Resolve the vendored ATLAS YAML.
+ *
+ * @param explicit - caller-supplied path; returned as-is when provided.
+ * @throws when no candidate exists, naming every path tried.
+ */
+export function resolveAtlasYaml(explicit) {
+    if (explicit)
+        return explicit;
+    const moduleDir = path.dirname(fileURLToPath(import.meta.url));
+    const candidates = [
+        // Running from a checkout (cwd is the repo root).
+        path.resolve(process.cwd(), VENDOR_RELATIVE),
+        // Running as an installed dependency: this module sits at
+        // <pkg>/dist/aivss/atlas/, so the package root is three levels up.
+        path.resolve(moduleDir, "../../../", VENDOR_RELATIVE),
+        // Running from source via bun (src/aivss/atlas/), same depth.
+        path.resolve(moduleDir, "../../../", VENDOR_RELATIVE),
+    ];
+    for (const candidate of candidates) {
+        if (fs.existsSync(candidate))
+            return candidate;
+    }
+    throw new Error(`ATLAS data not found (expected ${ATLAS_YAML_FILENAME}). Looked in:\n` +
+        candidates.map((c) => `  - ${c}`).join("\n") +
+        `\nPass an explicit path, or verify the package shipped vendor/atlas-release/.`);
+}
+//# sourceMappingURL=resolve-path.js.map

package/dist/aivss/atlas/resolve-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-path.js","sourceRoot":"","sources":["../../../src/aivss/atlas/resolve-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,oFAAoF;AACpF,MAAM,CAAC,MAAM,qBAAqB,GAAG,SAAS,CAAC;AAE/C,iGAAiG;AACjG,MAAM,CAAC,MAAM,oBAAoB,GAAG,OAAO,CAAC;AAE5C,oFAAoF;AACpF,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,qBAAqB,OAAO,CAAC;AAEzE,MAAM,eAAe,GAAG,wBAAwB,mBAAmB,EAAE,CAAC;AAEtE;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAiB;IAChD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAE/D,MAAM,UAAU,GAAG;QACjB,kDAAkD;QAClD,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,eAAe,CAAC;QAC5C,0DAA0D;QAC1D,mEAAmE;QACnE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,eAAe,CAAC;QACrD,8DAA8D;QAC9D,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,eAAe,CAAC;KACtD,CAAC;IAEF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IACjD,CAAC;IAED,MAAM,IAAI,KAAK,CACb,kCAAkC,mBAAmB,iBAAiB;QACpE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC5C,+EAA+E,CAClF,CAAC;AACJ,CAAC"}

package/dist/aivss/batch/batch-builder.d.ts

@@ -0,0 +1,11 @@
+import { AIVSSKnowledgeBase } from "../knowledge-base/kb-client";
+import { type AgentDefinition, type BatchRequest } from "../types";
+export interface BatchAssessmentConfig {
+    agents: AgentDefinition[];
+    useKnowledgeBase: boolean;
+    model?: string;
+    temperature?: number;
+    maxTokens?: number;
+}
+export declare function buildBatchRequests(config: BatchAssessmentConfig, kb?: AIVSSKnowledgeBase): Promise<BatchRequest[]>;
+//# sourceMappingURL=batch-builder.d.ts.map

package/dist/aivss/batch/batch-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"batch-builder.d.ts","sourceRoot":"","sources":["../../../src/aivss/batch/batch-builder.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAWjE,OAAO,EAAgB,KAAK,eAAe,EAAE,KAAK,YAAY,EAAmB,MAAM,UAAU,CAAC;AAElG,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAoBD,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,qBAAqB,EAC7B,EAAE,CAAC,EAAE,kBAAkB,GACtB,OAAO,CAAC,YAAY,EAAE,CAAC,CA2CzB"}

package/dist/aivss/batch/batch-builder.js

@@ -0,0 +1,75 @@
+import { resolveAtlasYaml } from "../atlas/resolve-path";
+import { buildBaseSystemPrompt } from "../prompts/base-system-prompt";
+import { composeAssessmentPrompt } from "../prompts/prompt-composer";
+import { getTechniquesForMetric } from "../atlas/coverage-matrix";
+import { getAtlasContext, loadAtlasData } from "../atlas/loader";
+import { KBSearchBuilder } from "../knowledge-base/search-builder";
+import { buildADPrompt } from "../metrics/ad";
+import { buildAAPrompt } from "../metrics/aa";
+import { buildCSPrompt } from "../metrics/cs";
+import { buildDCPrompt } from "../metrics/dc";
+import { buildDSPrompt } from "../metrics/ds";
+import { buildEIPrompt } from "../metrics/ei";
+import { buildGVPrompt } from "../metrics/gv";
+import { buildLLPrompt } from "../metrics/ll";
+import { buildMRPrompt } from "../metrics/mr";
+import { METRIC_CODES } from "../types";
+const METRIC_PROMPT_BUILDERS = {
+    MR: buildMRPrompt,
+    DS: buildDSPrompt,
+    EI: buildEIPrompt,
+    DC: buildDCPrompt,
+    AD: buildADPrompt,
+    AA: buildAAPrompt,
+    LL: buildLLPrompt,
+    GV: buildGVPrompt,
+    CS: buildCSPrompt,
+};
+export async function buildBatchRequests(config, kb) {
+    const atlas = loadAtlasData(resolveAtlasYaml());
+    const model = config.model ?? "claude-opus-4-7";
+    const temperature = config.temperature ?? 0;
+    const maxTokens = config.maxTokens ?? 1024;
+    const baseSystemPrompt = buildBaseSystemPrompt();
+    const requests = [];
+    for (const agent of config.agents) {
+        const metricRequests = await Promise.all(METRIC_CODES.map(async (metricCode) => {
+            const kbContext = config.useKnowledgeBase && kb
+                ? await buildKnowledgeBaseContext(kb, metricCode, agent)
+                : undefined;
+            const ids = getTechniquesForMetric(metricCode);
+            const ctx = getAtlasContext(atlas, ids);
+            const metricPrompt = METRIC_PROMPT_BUILDERS[metricCode](agent, kbContext, ctx);
+            const { system, user } = composeAssessmentPrompt({
+                baseSystemPrompt,
+                metricPrompt,
+                agentDefinition: agent,
+                kbContext,
+            });
+            const request = {
+                custom_id: `${agent.id}-${metricCode}`,
+                params: {
+                    model,
+                    max_tokens: maxTokens,
+                    temperature,
+                    system,
+                    messages: [{ role: "user", content: user }],
+                },
+            };
+            return request;
+        }));
+        requests.push(...metricRequests);
+    }
+    return requests;
+}
+async function buildKnowledgeBaseContext(kb, metricCode, agent) {
+    const query = KBSearchBuilder.buildQueryForMetric(metricCode, agent);
+    const results = await kb.search(query);
+    if (results.results.length === 0) {
+        return undefined;
+    }
+    return results.results
+        .map((result) => `- **${result.section}**: ${result.excerpt}`)
+        .join("\n");
+}
+//# sourceMappingURL=batch-builder.js.map

package/dist/aivss/batch/batch-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"batch-builder.js","sourceRoot":"","sources":["../../../src/aivss/batch/batch-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEjE,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,YAAY,EAA4D,MAAM,UAAU,CAAC;AAgBlG,MAAM,sBAAsB,GAA4C;IACtE,EAAE,EAAE,aAAa;IACjB,EAAE,EAAE,aAAa;IACjB,EAAE,EAAE,aAAa;IACjB,EAAE,EAAE,aAAa;IACjB,EAAE,EAAE,aAAa;IACjB,EAAE,EAAE,aAAa;IACjB,EAAE,EAAE,aAAa;IACjB,EAAE,EAAE,aAAa;IACjB,EAAE,EAAE,aAAa;CAClB,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAA6B,EAC7B,EAAuB;IAEvB,MAAM,KAAK,GAAG,aAAa,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,iBAAiB,CAAC;IAChD,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC;IAC3C,MAAM,gBAAgB,GAAG,qBAAqB,EAAE,CAAC;IACjD,MAAM,QAAQ,GAAmB,EAAE,CAAC;IAEpC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,GAAG,CACtC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;YACpC,MAAM,SAAS,GACb,MAAM,CAAC,gBAAgB,IAAI,EAAE;gBAC3B,CAAC,CAAC,MAAM,yBAAyB,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC;gBACxD,CAAC,CAAC,SAAS,CAAC;YAChB,MAAM,GAAG,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;YAC/C,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACxC,MAAM,YAAY,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;YAC/E,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,uBAAuB,CAAC;gBAC/C,gBAAgB;gBAChB,YAAY;gBACZ,eAAe,EAAE,KAAK;gBACtB,SAAS;aACV,CAAC,CAAC;YAEH,MAAM,OAAO,GAAiB;gBAC5B,SAAS,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,UAAU,EAAE;gBACtC,MAAM,EAAE;oBACN,KAAK;oBACL,UAAU,EAAE,SAAS;oBACrB,WAAW;oBACX,MAAM;oBACN,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;iBAC5C;aACF,CAAC;YACF,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CACH,CAAC;QAEF,QAAQ,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,EAAsB,EACtB,UAAsB,EACtB,KAAsB;IAEtB,MAAM,KAAK,GAAG,eAAe,CAAC,mBAAmB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,OAAO,CAAC,OAAO;SACnB,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,MAAM,CAAC,OAAO,OAAO,MAAM,CAAC,OAAO,EAAE,CAAC;SAC7D,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC"}

package/dist/aivss/index.d.ts

@@ -0,0 +1,21 @@
+export { MODEL_COMPLEXITY_VALUES, SEVERITY_VALUES, type AgentDefinition, type AtlasFinding, type BatchRequest, type DeploymentContext, type MetricAssessmentResponse, type MetricCode, type MitigationMultiplier, type ModelComplexity, type SeverityLabel, type Tool, type V4Score, } from "./types";
+export { AIVSSKnowledgeBase } from "./knowledge-base/kb-client";
+export { KBSearchBuilder } from "./knowledge-base/search-builder";
+export type { KBContext, KBSearchQuery, KBSearchResult } from "./knowledge-base/kb-types";
+export { buildMRPrompt } from "./metrics/mr";
+export { buildDSPrompt } from "./metrics/ds";
+export { buildEIPrompt } from "./metrics/ei";
+export { buildDCPrompt } from "./metrics/dc";
+export { buildADPrompt } from "./metrics/ad";
+export { buildAAPrompt } from "./metrics/aa";
+export { buildLLPrompt } from "./metrics/ll";
+export { buildGVPrompt } from "./metrics/gv";
+export { buildCSPrompt } from "./metrics/cs";
+export { buildBaseSystemPrompt } from "./prompts/base-system-prompt";
+export { composeAssessmentPrompt } from "./prompts/prompt-composer";
+export { calculateAIVSSScore, DEPLOYMENT_WEIGHTS, severityLabel } from "./scoring/v4-engine";
+export { buildBatchRequests } from "./batch/batch-builder";
+export type { BatchAssessmentConfig } from "./batch/batch-builder";
+export { ATLAS_COVERAGE_MATRIX } from "./atlas/coverage-matrix";
+export { loadAtlasData, type AtlasData, type AtlasTechnique, } from "./atlas/loader";
+//# sourceMappingURL=index.d.ts.map

package/dist/aivss/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/aivss/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,EAC7B,KAAK,UAAU,EACf,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,IAAI,EACT,KAAK,OAAO,GACb,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE1F,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAE7F,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,YAAY,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EACL,aAAa,EACb,KAAK,SAAS,EACd,KAAK,cAAc,GACpB,MAAM,gBAAgB,CAAC"}

package/dist/aivss/index.js

@@ -0,0 +1,19 @@
+export { MODEL_COMPLEXITY_VALUES, SEVERITY_VALUES, } from "./types";
+export { AIVSSKnowledgeBase } from "./knowledge-base/kb-client";
+export { KBSearchBuilder } from "./knowledge-base/search-builder";
+export { buildMRPrompt } from "./metrics/mr";
+export { buildDSPrompt } from "./metrics/ds";
+export { buildEIPrompt } from "./metrics/ei";
+export { buildDCPrompt } from "./metrics/dc";
+export { buildADPrompt } from "./metrics/ad";
+export { buildAAPrompt } from "./metrics/aa";
+export { buildLLPrompt } from "./metrics/ll";
+export { buildGVPrompt } from "./metrics/gv";
+export { buildCSPrompt } from "./metrics/cs";
+export { buildBaseSystemPrompt } from "./prompts/base-system-prompt";
+export { composeAssessmentPrompt } from "./prompts/prompt-composer";
+export { calculateAIVSSScore, DEPLOYMENT_WEIGHTS, severityLabel } from "./scoring/v4-engine";
+export { buildBatchRequests } from "./batch/batch-builder";
+export { ATLAS_COVERAGE_MATRIX } from "./atlas/coverage-matrix";
+export { loadAtlasData, } from "./atlas/loader";
+//# sourceMappingURL=index.js.map

package/dist/aivss/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/aivss/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,eAAe,GAYhB,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAGlE,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAE7F,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,EACL,aAAa,GAGd,MAAM,gBAAgB,CAAC"}

package/dist/aivss/knowledge-base/kb-client.d.ts

@@ -0,0 +1,9 @@
+import type { KBContext, KBSearchQuery } from "./kb-types";
+export declare class AIVSSKnowledgeBase {
+    private readonly mockIndex;
+    constructor();
+    search(query: KBSearchQuery): Promise<KBContext>;
+    private calculateRelevance;
+    private initializeMockData;
+}
+//# sourceMappingURL=kb-client.d.ts.map

package/dist/aivss/knowledge-base/kb-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kb-client.d.ts","sourceRoot":"","sources":["../../../src/aivss/knowledge-base/kb-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAkB,MAAM,YAAY,CAAC;AAE3E,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAuC;;IAM3D,MAAM,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC;IAUtD,OAAO,CAAC,kBAAkB;IAQ1B,OAAO,CAAC,kBAAkB;CAiJ3B"}

package/dist/aivss/knowledge-base/kb-client.js

@@ -0,0 +1,139 @@
+export class AIVSSKnowledgeBase {
+    constructor() {
+        this.mockIndex = new Map();
+        this.initializeMockData();
+    }
+    async search(query) {
+        const results = this.mockIndex.get(query.category) ?? [];
+        return {
+            category: query.category,
+            results: results.slice(0, query.limit ?? 5),
+            totalRelevance: this.calculateRelevance(results),
+        };
+    }
+    calculateRelevance(results) {
+        if (results.length === 0) {
+            return 0;
+        }
+        return results.reduce((sum, result) => sum + result.relevance, 0) / results.length;
+    }
+    initializeMockData() {
+        this.mockIndex.set("MR", [
+            {
+                section: "V4 MR-1: Evasion Resistance",
+                relevance: 0.94,
+                excerpt: "Assess robustness against adversarial prompts, distribution shifts, and manipulated inputs that seek to induce unsafe or incorrect outputs.",
+                definition: "Resilience of the model when attackers perturb inputs to evade intended safeguards.",
+                examples: ["Prompt perturbations", "Adversarial suffixes", "Input distribution drift"],
+            },
+            {
+                section: "V4 MR-3: Robustness Certification",
+                relevance: 0.86,
+                excerpt: "Formal certification is rare, so empirical adversarial testing and repeatable benchmarking are important evidence for robustness scoring.",
+            },
+        ]);
+        this.mockIndex.set("DS", [
+            {
+                section: "V4 DS-1: Data Confidentiality",
+                relevance: 0.93,
+                excerpt: "Training data, prompts, logs, embeddings, and retrieval stores can all expose regulated or proprietary data if access boundaries are weak.",
+                examples: ["PII leakage", "Secret disclosure", "Sensitive context returned in outputs"],
+            },
+            {
+                section: "V4 DS-3: Data Provenance",
+                relevance: 0.84,
+                excerpt: "Provenance controls should establish source trust, chain of custody, integrity verification, and clear handling for low-confidence data.",
+            },
+        ]);
+        this.mockIndex.set("EI", [
+            {
+                section: "V4 EI-1: Bias and Discrimination",
+                relevance: 0.91,
+                excerpt: "Bias evaluation should examine disparate impact, representational harm, and whether protected groups are disproportionately affected by errors.",
+            },
+            {
+                section: "V4 EI-4: Societal Impact",
+                relevance: 0.83,
+                excerpt: "Even when direct harm is limited, broader social effects such as misinformation, exclusion, and trust erosion influence severity.",
+            },
+        ]);
+        this.mockIndex.set("DC", [
+            {
+                section: "V4 DC-1: Safety-Critical Applications",
+                relevance: 0.95,
+                excerpt: "Systems that influence health, physical systems, or public safety should score high when failures can propagate into real-world harm.",
+            },
+            {
+                section: "V4 DC-4: Operational Disruption",
+                relevance: 0.88,
+                excerpt: "Operational disruption considers outage potential, workflow blockage, recovery complexity, and cascading system dependencies.",
+            },
+        ]);
+        this.mockIndex.set("AD", [
+            {
+                section: "V4 AD-1: Continuous Monitoring",
+                relevance: 0.89,
+                excerpt: "Production telemetry should capture drift, anomalous prompts, unsafe tool calls, and unusual response patterns for rapid triage.",
+            },
+            {
+                section: "V4 AD-4: Adversarial Training",
+                relevance: 0.82,
+                excerpt: "Adversarial training and structured red teaming improve resilience when they are paired with validation, rollback, and post-update measurement.",
+            },
+        ]);
+        this.mockIndex.set("AA", [
+            {
+                section: "V4 AA-1: Model Inversion",
+                relevance: 0.9,
+                excerpt: "Inversion risks increase when outputs reveal stable internal signals or high-fidelity details about sensitive training examples.",
+            },
+            {
+                section: "V4 AA-2: Model Extraction",
+                relevance: 0.87,
+                excerpt: "Extraction risk depends on rate limits, query observability, interface richness, and whether outputs expose behavior that supports cloning.",
+            },
+        ]);
+        this.mockIndex.set("LL", [
+            {
+                section: "V4 LL-1: Development Security",
+                relevance: 0.92,
+                excerpt: "Secure development includes code review, dependency hygiene, secret handling, reproducible builds, and environment isolation.",
+            },
+            {
+                section: "V4 LL-3: Deployment Security",
+                relevance: 0.87,
+                excerpt: "Deployment controls should cover network segmentation, IAM, runtime policy, container hardening, and release approval workflows.",
+            },
+        ]);
+        this.mockIndex.set("GV", [
+            {
+                section: "V4 GV-1: Regulatory Compliance",
+                relevance: 0.9,
+                excerpt: "Severity should increase when the deployment handles regulated decisions or sensitive populations without clear compliance evidence.",
+            },
+            {
+                section: "V4 GV-4: Human Oversight",
+                relevance: 0.86,
+                excerpt: "High-consequence systems should give humans practical override paths, review checkpoints, and accountability for decisions.",
+            },
+        ]);
+        this.mockIndex.set("CS", [
+            {
+                section: "V4 CS-1: Model Manipulation / Prompt Injection",
+                relevance: 0.97,
+                excerpt: "Prompt injection severity depends on input trust boundaries, tool authority, context isolation, and whether untrusted content can redirect execution.",
+            },
+            {
+                section: "V4 CS-6: Insecure Supply Chain",
+                relevance: 0.88,
+                excerpt: "Supply chain exposure includes models, datasets, plugins, packages, and build-time artifacts that can be compromised upstream.",
+            },
+            {
+                section: "V4 CS-9: Loss of Governance / Compliance",
+                relevance: 0.84,
+                excerpt: "Systems should be evaluated for drift outside policy, logging gaps, missing approvals, and control bypasses that break governance expectations.",
+            },
+        ]);
+    }
+}
+//# sourceMappingURL=kb-client.js.map

package/dist/aivss/knowledge-base/kb-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kb-client.js","sourceRoot":"","sources":["../../../src/aivss/knowledge-base/kb-client.ts"],"names":[],"mappings":"AAEA,MAAM,OAAO,kBAAkB;IAG7B;QAFiB,cAAS,GAAG,IAAI,GAAG,EAA4B,CAAC;QAG/D,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAoB;QAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAEzD,OAAO;YACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;YAC3C,cAAc,EAAE,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;SACjD,CAAC;IACJ,CAAC;IAEO,kBAAkB,CAAC,OAAyB;QAClD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,CAAC;QACX,CAAC;QAED,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACrF,CAAC;IAEO,kBAAkB;QACxB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE;YACvB;gBACE,OAAO,EAAE,6BAA6B;gBACtC,SAAS,EAAE,IAAI;gBACf,OAAO,EACL,6IAA6I;gBAC/I,UAAU,EAAE,qFAAqF;gBACjG,QAAQ,EAAE,CAAC,sBAAsB,EAAE,sBAAsB,EAAE,0BAA0B,CAAC;aACvF;YACD;gBACE,OAAO,EAAE,mCAAmC;gBAC5C,SAAS,EAAE,IAAI;gBACf,OAAO,EACL,2IAA2I;aAC9I;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE;YACvB;gBACE,OAAO,EAAE,+BAA+B;gBACxC,SAAS,EAAE,IAAI;gBACf,OAAO,EACL,4IAA4I;gBAC9I,QAAQ,EAAE,CAAC,aAAa,EAAE,mBAAmB,EAAE,uCAAuC,CAAC;aACxF;YACD;gBACE,OAAO,EAAE,0BAA0B;gBACnC,SAAS,EAAE,IAAI;gBACf,OAAO,EACL,0IAA0I;aAC7I;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE;YACvB;gBACE,OAAO,EAAE,kCAAkC;gBAC3C,SAAS,EAAE,IAAI;gBACf,OAAO,EACL,iJAAiJ;aACpJ;YACD;gBACE,OAAO,EAAE,0BAA0B;gBACnC,SAAS,EAAE,IAAI;gBACf,OAAO,EACL,mIAAmI;aACtI;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE;YACvB;gBACE,OAAO,EAAE,uCAAuC;gBAChD,SAAS,EAAE,IAAI;gBACf,OAAO,EACL,uIAAuI;aAC1I;YACD;gBACE,OAAO,EAAE,iCAAiC;gBAC1C,SAAS,EAAE,IAAI;gBACf,OAAO,EACL,+HAA+H;aAClI;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE;YACvB;gBACE,OAAO,EAAE,gCAAgC;gBACzC,SAAS,EAAE,IAAI;gBACf,OAAO,EACL,kIAAkI;aACrI;YACD;gBACE,OAAO,EAAE,+BAA+B;gBACxC,SAAS,EAAE,IAAI;gBACf,OAAO,EACL,iJAAiJ;aACpJ;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE;YACvB;gBACE,OAAO,EAAE,0BAA0B;gBACnC,SAAS,EAAE,GAAG;gBACd,OAAO,EACL,kIAAkI;aACrI;YACD;gBACE,OAAO,EAAE,2BAA2B;gBACpC,SAAS,EAAE,IAAI;gBACf,OAAO,EACL,6IAA6I;aAChJ;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE;YACvB;gBACE,OAAO,EAAE,+BAA+B;gBACxC,SAAS,EAAE,IAAI;gBACf,OAAO,EACL,+HAA+H;aAClI;YACD;gBACE,OAAO,EAAE,8BAA8B;gBACvC,SAAS,EAAE,IAAI;gBACf,OAAO,EACL,kIAAkI;aACrI;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE;YACvB;gBACE,OAAO,EAAE,gCAAgC;gBACzC,SAAS,EAAE,GAAG;gBACd,OAAO,EACL,sIAAsI;aACzI;YACD;gBACE,OAAO,EAAE,0BAA0B;gBACnC,SAAS,EAAE,IAAI;gBACf,OAAO,EACL,6HAA6H;aAChI;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE;YACvB;gBACE,OAAO,EAAE,gDAAgD;gBACzD,SAAS,EAAE,IAAI;gBACf,OAAO,EACL,uJAAuJ;aAC1J;YACD;gBACE,OAAO,EAAE,gCAAgC;gBACzC,SAAS,EAAE,IAAI;gBACf,OAAO,EACL,gIAAgI;aACnI;YACD;gBACE,OAAO,EAAE,0CAA0C;gBACnD,SAAS,EAAE,IAAI;gBACf,OAAO,EACL,iJAAiJ;aACpJ;SACF,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/aivss/knowledge-base/kb-types.d.ts

@@ -0,0 +1,21 @@
+import type { MetricCode } from "../types";
+export interface KBSearchQuery {
+    category: MetricCode;
+    keywords: string[];
+    specificRisks?: string[];
+    limit?: number;
+}
+export interface KBSearchResult {
+    section: string;
+    relevance: number;
+    excerpt: string;
+    pageReference?: string;
+    definition?: string;
+    examples?: string[];
+}
+export interface KBContext {
+    category: MetricCode;
+    results: KBSearchResult[];
+    totalRelevance: number;
+}
+//# sourceMappingURL=kb-types.d.ts.map

package/dist/aivss/knowledge-base/kb-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kb-types.d.ts","sourceRoot":"","sources":["../../../src/aivss/knowledge-base/kb-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAE3C,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,UAAU,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,UAAU,CAAC;IACrB,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;CACxB"}

package/dist/aivss/knowledge-base/kb-types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=kb-types.js.map

package/dist/aivss/knowledge-base/kb-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kb-types.js","sourceRoot":"","sources":["../../../src/aivss/knowledge-base/kb-types.ts"],"names":[],"mappings":""}

package/dist/aivss/knowledge-base/search-builder.d.ts

@@ -0,0 +1,7 @@
+import type { AgentDefinition, MetricCode } from "../types";
+import type { KBSearchQuery } from "./kb-types";
+export declare class KBSearchBuilder {
+    static buildQueryForMetric(metricCode: MetricCode, agentProfile: AgentDefinition): KBSearchQuery;
+    private static inferSpecificRisks;
+}
+//# sourceMappingURL=search-builder.d.ts.map

package/dist/aivss/knowledge-base/search-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"search-builder.d.ts","sourceRoot":"","sources":["../../../src/aivss/knowledge-base/search-builder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAC5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,qBAAa,eAAe;IAC1B,MAAM,CAAC,mBAAmB,CAAC,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,eAAe,GAAG,aAAa;IAwEhG,OAAO,CAAC,MAAM,CAAC,kBAAkB;CAwDlC"}

package/dist/aivss/knowledge-base/search-builder.js

@@ -0,0 +1,119 @@
+export class KBSearchBuilder {
+    static buildQueryForMetric(metricCode, agentProfile) {
+        const categoryKeywords = {
+            MR: [
+                "adversarial robustness",
+                "evasion resistance",
+                "distribution shift",
+                "robustness certification",
+                ...(agentProfile.tools.length > 0 ? ["tool-mediated prompt attacks"] : []),
+            ],
+            DS: [
+                "data confidentiality",
+                "data integrity",
+                "data provenance",
+                "retrieval store exposure",
+                ...(agentProfile.dataSources?.length ? ["source validation"] : []),
+            ],
+            EI: [
+                "bias and discrimination",
+                "transparency and explainability",
+                "accountability",
+                "societal impact",
+            ],
+            DC: [
+                "safety critical",
+                "financial impact",
+                "reputational damage",
+                "operational disruption",
+            ],
+            AD: [
+                "continuous monitoring",
+                "retraining capabilities",
+                "threat intelligence integration",
+                "adversarial training",
+            ],
+            AA: [
+                "model inversion",
+                "model extraction",
+                "membership inference",
+                "privacy leakage",
+            ],
+            LL: [
+                "development security",
+                "training security",
+                "deployment security",
+                "operational security",
+                "dependency governance",
+            ],
+            GV: [
+                "regulatory compliance",
+                "auditing",
+                "risk management",
+                "human oversight",
+                "ethical framework alignment",
+            ],
+            CS: [
+                "prompt injection",
+                "sensitive data disclosure",
+                "insecure supply chain",
+                "plugin security",
+                "denial of service",
+                "loss of governance",
+            ],
+        };
+        return {
+            category: metricCode,
+            keywords: categoryKeywords[metricCode],
+            specificRisks: this.inferSpecificRisks(metricCode, agentProfile),
+            limit: 5,
+        };
+    }
+    static inferSpecificRisks(metricCode, profile) {
+        const risks = [];
+        if (metricCode === "MR" && profile.tools.some((tool) => tool.dangerous)) {
+            risks.push("Dangerous tool access raises the impact of adversarial prompt evasion.");
+        }
+        if (metricCode === "DS") {
+            if (profile.dataSources?.some((source) => source.includes("user"))) {
+                risks.push("User-influenced data sources raise poisoning and provenance concerns.");
+            }
+            if (profile.finetuned) {
+                risks.push("Fine-tuning increases the need for stronger provenance and integrity controls.");
+            }
+        }
+        if (metricCode === "EI" && profile.deploymentContext !== "General") {
+            risks.push(`Sector-specific obligations apply for ${profile.deploymentContext} deployments.`);
+        }
+        if (metricCode === "DC" && profile.autonomyLevel === "autonomous") {
+            risks.push("Autonomous operation increases the blast radius of incorrect decisions.");
+        }
+        if (metricCode === "AD" && !profile.finetuned) {
+            risks.push("Lack of fine-tuning can limit controlled retraining and adaptive hardening options.");
+        }
+        if (metricCode === "AA" && profile.permissions.length > 3) {
+            risks.push("Broad permissions can amplify data recovery and extraction consequences.");
+        }
+        if (metricCode === "LL") {
+            if (profile.dependencies.length > 5) {
+                risks.push("A larger dependency graph increases lifecycle and supply chain exposure.");
+            }
+            if (profile.externalApiCount && profile.externalApiCount > 2) {
+                risks.push("Multiple external APIs expand the deployed attack surface.");
+            }
+        }
+        if (metricCode === "GV" && profile.autonomyLevel !== "supervised") {
+            risks.push("Reduced human supervision raises oversight and accountability requirements.");
+        }
+        if (metricCode === "CS") {
+            if (profile.tools.some((tool) => tool.dangerous)) {
+                risks.push("Dangerous tools increase prompt injection and plugin abuse risk.");
+            }
+            if (profile.secretManagement.toLowerCase().includes("environment")) {
+                risks.push("Environment-variable-only secret handling may need stronger runtime controls.");
+            }
+        }
+        return risks;
+    }
+}
+//# sourceMappingURL=search-builder.js.map

package/dist/aivss/knowledge-base/search-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"search-builder.js","sourceRoot":"","sources":["../../../src/aivss/knowledge-base/search-builder.ts"],"names":[],"mappings":"AAGA,MAAM,OAAO,eAAe;IAC1B,MAAM,CAAC,mBAAmB,CAAC,UAAsB,EAAE,YAA6B;QAC9E,MAAM,gBAAgB,GAAiC;YACrD,EAAE,EAAE;gBACF,wBAAwB;gBACxB,oBAAoB;gBACpB,oBAAoB;gBACpB,0BAA0B;gBAC1B,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3E;YACD,EAAE,EAAE;gBACF,sBAAsB;gBACtB,gBAAgB;gBAChB,iBAAiB;gBACjB,0BAA0B;gBAC1B,GAAG,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACnE;YACD,EAAE,EAAE;gBACF,yBAAyB;gBACzB,iCAAiC;gBACjC,gBAAgB;gBAChB,iBAAiB;aAClB;YACD,EAAE,EAAE;gBACF,iBAAiB;gBACjB,kBAAkB;gBAClB,qBAAqB;gBACrB,wBAAwB;aACzB;YACD,EAAE,EAAE;gBACF,uBAAuB;gBACvB,yBAAyB;gBACzB,iCAAiC;gBACjC,sBAAsB;aACvB;YACD,EAAE,EAAE;gBACF,iBAAiB;gBACjB,kBAAkB;gBAClB,sBAAsB;gBACtB,iBAAiB;aAClB;YACD,EAAE,EAAE;gBACF,sBAAsB;gBACtB,mBAAmB;gBACnB,qBAAqB;gBACrB,sBAAsB;gBACtB,uBAAuB;aACxB;YACD,EAAE,EAAE;gBACF,uBAAuB;gBACvB,UAAU;gBACV,iBAAiB;gBACjB,iBAAiB;gBACjB,6BAA6B;aAC9B;YACD,EAAE,EAAE;gBACF,kBAAkB;gBAClB,2BAA2B;gBAC3B,uBAAuB;gBACvB,iBAAiB;gBACjB,mBAAmB;gBACnB,oBAAoB;aACrB;SACF,CAAC;QAEF,OAAO;YACL,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,gBAAgB,CAAC,UAAU,CAAC;YACtC,aAAa,EAAE,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,YAAY,CAAC;YAChE,KAAK,EAAE,CAAC;SACT,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,kBAAkB,CAAC,UAAsB,EAAE,OAAwB;QAChF,MAAM,KAAK,GAAa,EAAE,CAAC;QAE3B,IAAI,UAAU,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACxE,KAAK,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAC;QACvF,CAAC;QAED,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,IAAI,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACnE,KAAK,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;YACtF,CAAC;YACD,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBACtB,KAAK,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;YAC/F,CAAC;QACH,CAAC;QAED,IAAI,UAAU,KAAK,IAAI,IAAI,OAAO,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACnE,KAAK,CAAC,IAAI,CAAC,yCAAyC,OAAO,CAAC,iBAAiB,eAAe,CAAC,CAAC;QAChG,CAAC;QAED,IAAI,UAAU,KAAK,IAAI,IAAI,OAAO,CAAC,aAAa,KAAK,YAAY,EAAE,CAAC;YAClE,KAAK,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;QACxF,CAAC;QAED,IAAI,UAAU,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,qFAAqF,CAAC,CAAC;QACpG,CAAC;QAED,IAAI,UAAU,KAAK,IAAI,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1D,KAAK,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;QACzF,CAAC;QAED,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpC,KAAK,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;YACzF,CAAC;YACD,IAAI,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,gBAAgB,GAAG,CAAC,EAAE,CAAC;gBAC7D,KAAK,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;QAED,IAAI,UAAU,KAAK,IAAI,IAAI,OAAO,CAAC,aAAa,KAAK,YAAY,EAAE,CAAC;YAClE,KAAK,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;QAC5F,CAAC;QAED,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBACjD,KAAK,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;YACjF,CAAC;YACD,IAAI,OAAO,CAAC,gBAAgB,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;gBACnE,KAAK,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAC;YAC9F,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/aivss/metrics/aa.d.ts

@@ -0,0 +1,3 @@
+import type { AgentDefinition } from "../types";
+export declare function buildAAPrompt(agent: AgentDefinition, kbContext?: string, atlasContext?: string): string;
+//# sourceMappingURL=aa.d.ts.map

package/dist/aivss/metrics/aa.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aa.d.ts","sourceRoot":"","sources":["../../../src/aivss/metrics/aa.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAGhD,wBAAgB,aAAa,CAC3B,KAAK,EAAE,eAAe,EACtB,SAAS,CAAC,EAAE,MAAM,EAClB,YAAY,CAAC,EAAE,MAAM,GACpB,MAAM,CA2BR"}

package/dist/aivss/metrics/aa.js

@@ -0,0 +1,26 @@
+import { buildMetricPrompt } from "./shared";
+export function buildAAPrompt(agent, kbContext, atlasContext) {
+    return buildMetricPrompt({
+        metricCode: "AA",
+        metricName: "Adversarial Attack Surface",
+        metricDescription: "Adversarial Attack Surface measures the system's susceptibility to privacy and model theft attacks that extract hidden knowledge or training membership.",
+        subCategories: [
+            {
+                name: "Model Inversion",
+                definition: "Evaluate whether attackers can reconstruct sensitive features, prompt contents, or training signals from outputs or interfaces.",
+            },
+            {
+                name: "Model Extraction",
+                definition: "Evaluate whether the deployed interface enables replication of weights, behavior, decision boundaries, or proprietary model capabilities.",
+            },
+            {
+                name: "Membership Inference",
+                definition: "Evaluate whether an attacker can determine whether a specific record, user, or document was present in training or fine-tuning data.",
+            },
+        ],
+        agent,
+        kbContext,
+        atlasContext,
+    });
+}
+//# sourceMappingURL=aa.js.map