witnora 0.8.1 → 0.9.0

package/dist/schema-validator.js

@@ -0,0 +1,503 @@
+import { AGENTCERT_EVIDENCE_SCHEMA_SEMVER, AGENTCERT_EVIDENCE_SCHEMA_VERSION } from "./types.js";
+import { validateEvidenceSignature } from "./evidence-signing.js";
+import { validateReleaseGateReport } from "./release-gate.js";
+export function parseSchemaId(input) {
+    const value = input ?? "evidence-bundle";
+    if (value === "evidence-bundle" ||
+        value === "result" ||
+        value === "corpus-record" ||
+        value === "failure-review" ||
+        value === "classifier-eval" ||
+        value === "monitor-snapshot" ||
+        value === "robustness-lab" ||
+        value === "release-gate" ||
+        value === "assurance-report" ||
+        value === "assurance-delivery" ||
+        value === "assurance-scope" ||
+        value === "evidence-signature" ||
+        value === "evidence-strength" ||
+        value === "action-mandate" ||
+        value === "trusted-action-record" ||
+        value === "trusted-run-receipt") {
+        return value;
+    }
+    throw new Error(`Unsupported schema "${value}". Use evidence-bundle, result, corpus-record, failure-review, classifier-eval, monitor-snapshot, robustness-lab, release-gate, assurance-report, assurance-delivery, assurance-scope, evidence-signature, evidence-strength, action-mandate, trusted-action-record, or trusted-run-receipt.`);
+}
+export function validateAgentCertSchema(schema, input) {
+    const errors = [];
+    if (schema === "release-gate") {
+        errors.push(...validateReleaseGateReport(input));
+        return { schema, valid: errors.length === 0, errors };
+    }
+    if (schema === "evidence-signature") {
+        errors.push(...validateEvidenceSignature(input));
+        return { schema, valid: errors.length === 0, errors };
+    }
+    const value = object(input, "$", errors);
+    if (value) {
+        if (schema === "evidence-bundle")
+            validateEvidenceBundle(value, errors);
+        if (schema === "result")
+            validateResult(value, errors);
+        if (schema === "corpus-record")
+            validateCorpusRecord(value, errors);
+        if (schema === "failure-review")
+            validateFailureReview(value, errors);
+        if (schema === "classifier-eval")
+            validateClassifierEval(value, errors);
+        if (schema === "monitor-snapshot")
+            validateMonitorSnapshot(value, errors);
+        if (schema === "robustness-lab")
+            validateRobustnessLab(value, errors);
+        if (schema === "assurance-report")
+            validateAssuranceReport(value, errors);
+        if (schema === "assurance-delivery")
+            validateAssuranceDelivery(value, errors);
+        if (schema === "assurance-scope")
+            validateAssuranceScope(value, errors);
+        if (schema === "evidence-strength")
+            validateEvidenceStrength(value, errors);
+        if (schema === "action-mandate")
+            validateActionMandate(value, errors);
+        if (schema === "trusted-action-record")
+            validateTrustedActionRecord(value, errors);
+        if (schema === "trusted-run-receipt")
+            validateTrustedRunReceipt(value, errors);
+    }
+    return { schema, valid: errors.length === 0, errors };
+}
+function validateEvidenceBundle(value, errors) {
+    requiredConst(value, "schemaName", "agentcert.evidence_bundle", errors);
+    requiredConst(value, "schemaVersion", AGENTCERT_EVIDENCE_SCHEMA_VERSION, errors);
+    requiredConst(value, "schemaSemver", AGENTCERT_EVIDENCE_SCHEMA_SEMVER, errors);
+    requiredConst(value, "kind", "agentcert.evidence_bundle", errors);
+    requiredString(value, "runId", errors);
+    requiredString(value, "generatedAt", errors);
+    requiredObject(value, "subject", errors);
+    requiredObject(value, "verdict", errors);
+    requiredObject(value, "summary", errors);
+    requiredArray(value, "results", errors);
+    requiredArray(value, "evidence", errors);
+    requiredObject(value, "artifacts", errors);
+    requiredArray(value, "standards", errors);
+    if (value.evidenceStrength !== undefined) {
+        const strength = recordValue(value.evidenceStrength);
+        if (!strength)
+            errors.push("evidenceStrength must be an object.");
+        else
+            validateEvidenceStrength(strength, errors, "evidenceStrength.");
+    }
+    const subject = recordValue(value.subject);
+    if (subject) {
+        requiredStringAt(subject, "name", "subject.name", errors);
+        requiredEnumAt(subject, "type", ["agent", "mcp-server", "tool", "application", "unknown"], "subject.type", errors);
+    }
+    const verdict = recordValue(value.verdict);
+    if (verdict) {
+        requiredBooleanAt(verdict, "passed", "verdict.passed", errors);
+        requiredNumberRange(verdict, "score", "verdict.score", 0, 100, errors);
+        requiredStringAt(verdict, "level", "verdict.level", errors);
+    }
+    const summary = recordValue(value.summary);
+    if (summary) {
+        stringArray(summary.products, "summary.products", errors);
+        requiredNonNegativeInteger(summary, "criticalEvidence", "summary.criticalEvidence", errors);
+        requiredNonNegativeInteger(summary, "highEvidence", "summary.highEvidence", errors);
+        requiredNonNegativeInteger(summary, "totalEvidence", "summary.totalEvidence", errors);
+    }
+    validateTimestamp(value.generatedAt, "generatedAt", errors);
+    validateArtifactMap(value.artifacts, "artifacts", errors);
+    validateResultArray(value.results, "results", errors);
+    validateEvidenceArray(value.evidence, "evidence", errors);
+    validateStandards(value.standards, errors);
+}
+const EVIDENCE_LEVELS = ["reported", "recorded", "enforced", "outcome_verified", "independently_reviewed"];
+const ACTION_TYPES = ["SUBMIT", "PAY", "SEND", "UPDATE"];
+function validateEvidenceStrength(value, errors, prefix = "") {
+    requiredConst(value, "schemaVersion", "agentcert.evidence_strength.v0.1", errors);
+    requiredEnumAt(value, "level", EVIDENCE_LEVELS, `${prefix}level`, errors);
+    requiredArray(value, "claims", errors);
+    requiredArray(value, "limitations", errors);
+    stringArray(value.claims, `${prefix}claims`, errors);
+    stringArray(value.limitations, `${prefix}limitations`, errors);
+}
+function validateActionMandate(value, errors) {
+    requiredConst(value, "schemaVersion", "agentcert.action_mandate.v0.1", errors);
+    for (const field of ["mandateId", "policySha256", "validFrom", "expiresAt", "issuedAt", "digestSha256"])
+        requiredString(value, field, errors);
+    requiredObject(value, "issuer", errors);
+    requiredObject(value, "subject", errors);
+    requiredObject(value, "scope", errors);
+    requiredObject(value, "sourceSignature", errors);
+    sha256Field(value, "policySha256", errors);
+    sha256Field(value, "digestSha256", errors);
+    for (const field of ["validFrom", "expiresAt", "issuedAt"])
+        validateTimestamp(value[field], field, errors);
+    const scope = recordValue(value.scope);
+    if (scope) {
+        requiredArray(scope, "actionTypes", errors);
+        requiredArray(scope, "targetSystems", errors);
+        requiredArray(scope, "permissions", errors);
+        if (Array.isArray(scope.actionTypes))
+            scope.actionTypes.forEach((item, index) => {
+                if (!ACTION_TYPES.includes(String(item)))
+                    errors.push(`scope.actionTypes[${index}] is not supported.`);
+            });
+    }
+    validateSourceSignature(value.sourceSignature, "sourceSignature", errors);
+}
+function validateTrustedActionRecord(value, errors) {
+    requiredConst(value, "schemaVersion", "agentcert.trusted_action_record.v0.1", errors);
+    for (const field of ["recordId", "runId", "occurredAt", "type", "payloadSha256", "eventHash"])
+        requiredString(value, field, errors);
+    requiredNonNegativeInteger(value, "sequence", "sequence", errors);
+    requiredObject(value, "collector", errors);
+    requiredObject(value, "payload", errors);
+    requiredObject(value, "sourceSignature", errors);
+    sha256Field(value, "payloadSha256", errors);
+    sha256Field(value, "eventHash", errors);
+    if (value.previousEventHash !== undefined)
+        sha256Field(value, "previousEventHash", errors);
+    validateTimestamp(value.occurredAt, "occurredAt", errors);
+    validateSourceSignature(value.sourceSignature, "sourceSignature", errors);
+}
+function validateTrustedRunReceipt(value, errors) {
+    requiredConst(value, "schemaVersion", "agentcert.trusted_run_receipt.v0.1", errors);
+    for (const field of ["runId", "startedAt", "completedAt", "firstEventHash", "lastEventHash", "sourcePublicKeyPem", "receiptSha256"])
+        requiredString(value, field, errors);
+    for (const field of ["eventCount", "droppedEventCount"])
+        requiredNonNegativeInteger(value, field, field, errors);
+    requiredObject(value, "collector", errors);
+    requiredArray(value, "mandateDigests", errors);
+    requiredArray(value, "actionIds", errors);
+    requiredObject(value, "journal", errors);
+    requiredObject(value, "evidenceStrength", errors);
+    requiredObject(value, "sourceSignature", errors);
+    for (const field of ["firstEventHash", "lastEventHash", "receiptSha256"])
+        sha256Field(value, field, errors);
+    const strength = recordValue(value.evidenceStrength);
+    if (strength)
+        validateEvidenceStrength(strength, errors, "evidenceStrength.");
+    validateSourceSignature(value.sourceSignature, "sourceSignature", errors);
+}
+function sha256Field(value, field, errors) {
+    if (typeof value[field] === "string" && !/^[0-9a-f]{64}$/.test(value[field]))
+        errors.push(`${field} must be a lowercase SHA-256 digest.`);
+}
+function validateSourceSignature(value, path, errors) {
+    const signature = recordValue(value);
+    if (!signature)
+        return;
+    if (signature.algorithm !== "Ed25519")
+        errors.push(`${path}.algorithm must equal Ed25519.`);
+    requiredStringAt(signature, "keyId", `${path}.keyId`, errors);
+    requiredStringAt(signature, "signature", `${path}.signature`, errors);
+}
+function validateResult(value, errors) {
+    requiredConst(value, "schemaVersion", "1", errors);
+    requiredString(value, "product", errors);
+    requiredString(value, "runId", errors);
+    requiredString(value, "timestamp", errors);
+    requiredEnum(value, "phase", ["pre-release", "runtime"], errors);
+    requiredNumber(value, "score", errors);
+    requiredBoolean(value, "passed", errors);
+    requiredObject(value, "artifacts", errors);
+    requiredArray(value, "evidence", errors);
+    requiredNumberRange(value, "score", "score", 0, 100, errors);
+    validateTimestamp(value.timestamp, "timestamp", errors);
+    validateArtifactMap(value.artifacts, "artifacts", errors);
+    validateEvidenceArray(value.evidence, "evidence", errors);
+}
+function validateResultArray(input, path, errors) {
+    if (!Array.isArray(input))
+        return;
+    input.forEach((item, index) => {
+        const value = object(item, `${path}[${index}]`, errors);
+        if (!value)
+            return;
+        const nested = [];
+        validateResult(value, nested);
+        errors.push(...nested.map((error) => `${path}[${index}].${error}`));
+    });
+}
+function validateEvidenceArray(input, path, errors) {
+    if (!Array.isArray(input))
+        return;
+    input.forEach((item, index) => {
+        const value = object(item, `${path}[${index}]`, errors);
+        if (!value)
+            return;
+        requiredStringAt(value, "id", `${path}[${index}].id`, errors);
+        requiredStringAt(value, "kind", `${path}[${index}].kind`, errors);
+        requiredEnumAt(value, "severity", ["critical", "high", "medium", "low", "info"], `${path}[${index}].severity`, errors);
+        requiredStringAt(value, "message", `${path}[${index}].message`, errors);
+        for (const field of ["source", "artifactPath", "suggestedFix"]) {
+            if (value[field] !== undefined && typeof value[field] !== "string")
+                errors.push(`${path}[${index}].${field} must be a string.`);
+        }
+        if (value.metadata !== undefined && !recordValue(value.metadata))
+            errors.push(`${path}[${index}].metadata must be an object.`);
+    });
+}
+function validateArtifactMap(input, path, errors) {
+    const value = recordValue(input);
+    if (!value)
+        return;
+    for (const [key, item] of Object.entries(value))
+        if (typeof item !== "string")
+            errors.push(`${path}.${key} must be a string.`);
+}
+function validateStandards(input, errors) {
+    if (!Array.isArray(input))
+        return;
+    input.forEach((item, index) => {
+        const value = object(item, `standards[${index}]`, errors);
+        if (!value)
+            return;
+        requiredStringAt(value, "id", `standards[${index}].id`, errors);
+        requiredStringAt(value, "name", `standards[${index}].name`, errors);
+        requiredEnumAt(value, "status", ["mapped", "planned"], `standards[${index}].status`, errors);
+        requiredStringAt(value, "note", `standards[${index}].note`, errors);
+    });
+}
+function validateCorpusRecord(value, errors) {
+    requiredConst(value, "schemaVersion", "1", errors);
+    requiredEnum(value, "kind", ["product_run", "scenario_run"], errors);
+    requiredString(value, "id", errors);
+    requiredString(value, "subject", errors);
+    requiredString(value, "agentName", errors);
+    requiredString(value, "agentVersion", errors);
+    requiredString(value, "runId", errors);
+    requiredBoolean(value, "passed", errors);
+    requiredArray(value, "failurePatterns", errors);
+    if (value.governance !== undefined) {
+        const governance = recordValue(value.governance);
+        if (!governance)
+            errors.push("governance must be an object.");
+        else {
+            requiredConst(governance, "schemaVersion", "agentcert.corpus_governance.v0.1", errors);
+            requiredEnum(governance, "consent", ["private", "anonymous", "public", "denied"], errors);
+            requiredString(governance, "consentSource", errors);
+            requiredString(governance, "consentRecordedAt", errors);
+            requiredObject(governance, "provenance", errors);
+            requiredObject(governance, "redaction", errors);
+        }
+    }
+}
+function validateAssuranceReport(value, errors) {
+    requiredConst(value, "schemaVersion", "agentcert.assurance_report.v0.1", errors);
+    for (const key of ["assuranceCaseId", "projectId", "policyPackVersion", "evaluationPlanSha256", "reviewerId", "issuedAt", "expiresAt", "statement"])
+        requiredString(value, key, errors);
+    requiredObject(value, "subject", errors);
+    requiredArray(value, "evidence", errors);
+    requiredConst(value, "decision", "issued", errors);
+    requiredArray(value, "limitations", errors);
+    if (!/^[0-9a-f]{64}$/.test(String(value.evaluationPlanSha256 ?? "")))
+        errors.push("evaluationPlanSha256 must be a lowercase SHA-256 digest.");
+    validateTimestamp(value.issuedAt, "issuedAt", errors);
+    validateTimestamp(value.expiresAt, "expiresAt", errors);
+    validateAssuranceContinuity(value.continuousAssurance, errors);
+}
+function validateAssuranceDelivery(value, errors) {
+    requiredConst(value, "schemaVersion", "agentcert.assurance_delivery.v0.1", errors);
+    for (const key of ["engagementId", "projectId", "assuranceCaseId", "dueAt", "deliveredAt", "evaluationPlanSha256", "statement"])
+        requiredString(value, key, errors);
+    for (const key of ["customer", "subject", "sandbox", "workflow", "terms", "decision", "integration", "evidenceStrength", "attestation"])
+        requiredObject(value, key, errors);
+    for (const key of ["baselineEvidence", "remediationItems", "retestEvidence"])
+        requiredArray(value, key, errors);
+    if (!/^[0-9a-f]{64}$/.test(String(value.evaluationPlanSha256 ?? "")))
+        errors.push("evaluationPlanSha256 must be a lowercase SHA-256 digest.");
+    validateTimestamp(value.dueAt, "dueAt", errors);
+    validateTimestamp(value.deliveredAt, "deliveredAt", errors);
+    const terms = recordValue(value.terms);
+    if (terms) {
+        if (terms.priceUsd !== 5000)
+            errors.push("terms.priceUsd must equal 5000.");
+        if (terms.workflowCount !== 1)
+            errors.push("terms.workflowCount must equal 1.");
+        if (terms.includedRetests !== 1)
+            errors.push("terms.includedRetests must equal 1.");
+        if (terms.privacy !== "private_by_default")
+            errors.push("terms.privacy must equal private_by_default.");
+    }
+    const decision = recordValue(value.decision);
+    if (decision)
+        requiredEnum(decision, "verdict", ["RELEASE", "RELEASE_WITH_CONTROLS", "BLOCK"], errors);
+    validateAssuranceContinuity(value.continuousAssurance, errors);
+}
+function validateAssuranceContinuity(input, errors) {
+    if (input === undefined)
+        return;
+    const value = recordValue(input);
+    if (!value) {
+        errors.push("continuousAssurance must be an object.");
+        return;
+    }
+    requiredConst(value, "schemaVersion", "agentcert.assurance_continuity.v0.1", errors);
+    requiredObject(value, "scope", errors);
+    requiredSha256At(value, "scopeFingerprintSha256", "continuousAssurance.scopeFingerprintSha256", errors);
+    requiredConst(value, "freshnessAtIssuance", "CURRENT", errors);
+    requiredArray(value, "revalidationRequiredWhen", errors);
+    stringArray(value.revalidationRequiredWhen, "continuousAssurance.revalidationRequiredWhen", errors);
+    const scope = recordValue(value.scope);
+    if (scope) {
+        const nested = [];
+        validateAssuranceScope(scope, nested);
+        errors.push(...nested.map((error) => `continuousAssurance.scope.${error}`));
+    }
+}
+function validateAssuranceScope(value, errors) {
+    requiredConst(value, "schemaVersion", "agentcert.assurance_scope.v0.1", errors);
+    for (const key of ["agent", "model", "prompt", "tools", "policy", "scenarioSuite"])
+        requiredObject(value, key, errors);
+    const agent = recordValue(value.agent);
+    const model = recordValue(value.model);
+    const prompt = recordValue(value.prompt);
+    const tools = recordValue(value.tools);
+    const policy = recordValue(value.policy);
+    const suite = recordValue(value.scenarioSuite);
+    if (agent) {
+        requiredStringAt(agent, "id", "agent.id", errors);
+        requiredStringAt(agent, "version", "agent.version", errors);
+        optionalSha256At(agent, "artifactSha256", "agent.artifactSha256", errors);
+    }
+    if (model)
+        for (const key of ["provider", "name", "version"])
+            requiredStringAt(model, key, `model.${key}`, errors);
+    if (prompt)
+        requiredSha256At(prompt, "sha256", "prompt.sha256", errors);
+    if (tools)
+        requiredSha256At(tools, "manifestSha256", "tools.manifestSha256", errors);
+    if (policy) {
+        requiredStringAt(policy, "id", "policy.id", errors);
+        requiredStringAt(policy, "version", "policy.version", errors);
+        optionalSha256At(policy, "sha256", "policy.sha256", errors);
+    }
+    if (suite) {
+        requiredStringAt(suite, "id", "scenarioSuite.id", errors);
+        requiredStringAt(suite, "version", "scenarioSuite.version", errors);
+        requiredSha256At(suite, "sha256", "scenarioSuite.sha256", errors);
+    }
+}
+function requiredSha256At(value, key, path, errors) {
+    if (typeof value[key] !== "string" || !/^[0-9a-f]{64}$/.test(value[key]))
+        errors.push(`${path} must be a lowercase SHA-256 digest.`);
+}
+function optionalSha256At(value, key, path, errors) {
+    if (value[key] !== undefined && (typeof value[key] !== "string" || !/^[0-9a-f]{64}$/.test(value[key])))
+        errors.push(`${path} must be a lowercase SHA-256 digest.`);
+}
+function validateFailureReview(value, errors) {
+    requiredConst(value, "schemaVersion", "1", errors);
+    requiredConst(value, "kind", "agentcert.failure_review", errors);
+    requiredString(value, "id", errors);
+    requiredString(value, "reviewedAt", errors);
+    requiredString(value, "reviewer", errors);
+    requiredEnum(value, "status", ["confirmed", "corrected"], errors);
+    requiredObject(value, "target", errors);
+    requiredString(value, "type", errors);
+}
+function validateClassifierEval(value, errors) {
+    requiredConst(value, "schemaVersion", "1", errors);
+    requiredConst(value, "kind", "agentcert.failure_classifier_evaluation", errors);
+    requiredNumber(value, "reviewedRows", errors);
+    requiredNumber(value, "correctRows", errors);
+    requiredNumber(value, "incorrectRows", errors);
+    requiredNumber(value, "precision", errors);
+    requiredNumber(value, "coverage", errors);
+    requiredArray(value, "byType", errors);
+    requiredArray(value, "confusion", errors);
+}
+function validateMonitorSnapshot(value, errors) {
+    requiredConst(value, "schemaVersion", "1", errors);
+    requiredConst(value, "kind", "agentcert.monitor_snapshot", errors);
+    requiredString(value, "generatedAt", errors);
+    requiredString(value, "subject", errors);
+    requiredObject(value, "summary", errors);
+    requiredObject(value, "filters", errors);
+    requiredArray(value, "lifecycle", errors);
+    requiredArray(value, "recentRuns", errors);
+    requiredArray(value, "failurePatterns", errors);
+}
+function validateRobustnessLab(value, errors) {
+    requiredConst(value, "schemaVersion", "1", errors);
+    requiredConst(value, "kind", "agentcert.real_agent_robustness_lab", errors);
+    requiredString(value, "generatedAt", errors);
+    requiredString(value, "name", errors);
+    requiredObject(value, "summary", errors);
+    requiredArray(value, "agents", errors);
+    requiredArray(value, "faults", errors);
+    requiredArray(value, "matrix", errors);
+    requiredArray(value, "limitations", errors);
+}
+function object(input, path, errors) {
+    if (!input || typeof input !== "object" || Array.isArray(input)) {
+        errors.push(`${path} must be an object.`);
+        return undefined;
+    }
+    return input;
+}
+function requiredConst(input, key, expected, errors) {
+    if (input[key] !== expected)
+        errors.push(`${key} must be ${JSON.stringify(expected)}.`);
+}
+function requiredString(input, key, errors) {
+    if (typeof input[key] !== "string" || input[key] === "")
+        errors.push(`${key} must be a non-empty string.`);
+}
+function requiredNumber(input, key, errors) {
+    if (typeof input[key] !== "number" || !Number.isFinite(input[key]))
+        errors.push(`${key} must be a finite number.`);
+}
+function requiredBoolean(input, key, errors) {
+    if (typeof input[key] !== "boolean")
+        errors.push(`${key} must be a boolean.`);
+}
+function requiredArray(input, key, errors) {
+    if (!Array.isArray(input[key]))
+        errors.push(`${key} must be an array.`);
+}
+function requiredObject(input, key, errors) {
+    if (!input[key] || typeof input[key] !== "object" || Array.isArray(input[key]))
+        errors.push(`${key} must be an object.`);
+}
+function requiredEnum(input, key, values, errors) {
+    if (typeof input[key] !== "string" || !values.includes(input[key])) {
+        errors.push(`${key} must be one of: ${values.join(", ")}.`);
+    }
+}
+function recordValue(input) {
+    return input && typeof input === "object" && !Array.isArray(input) ? input : undefined;
+}
+function requiredStringAt(input, key, path, errors) {
+    if (typeof input[key] !== "string" || input[key] === "")
+        errors.push(`${path} must be a non-empty string.`);
+}
+function requiredBooleanAt(input, key, path, errors) {
+    if (typeof input[key] !== "boolean")
+        errors.push(`${path} must be a boolean.`);
+}
+function requiredEnumAt(input, key, values, path, errors) {
+    if (typeof input[key] !== "string" || !values.includes(input[key]))
+        errors.push(`${path} must be one of: ${values.join(", ")}.`);
+}
+function requiredNumberRange(input, key, path, minimum, maximum, errors) {
+    const value = input[key];
+    if (typeof value !== "number" || !Number.isFinite(value) || value < minimum || value > maximum) {
+        errors.push(`${path} must be a finite number from ${minimum} to ${maximum}.`);
+    }
+}
+function requiredNonNegativeInteger(input, key, path, errors) {
+    const value = input[key];
+    if (!Number.isInteger(value) || value < 0)
+        errors.push(`${path} must be a non-negative integer.`);
+}
+function stringArray(input, path, errors) {
+    if (!Array.isArray(input) || input.some((item) => typeof item !== "string"))
+        errors.push(`${path} must be an array of strings.`);
+}
+function validateTimestamp(input, path, errors) {
+    if (typeof input === "string" && !Number.isFinite(Date.parse(input)))
+        errors.push(`${path} must be a valid date-time string.`);
+}

package/dist/try.js

@@ -0,0 +1,135 @@
+import { randomUUID } from "node:crypto";
+import { mkdir, writeFile } from "node:fs/promises";
+import { relative, resolve } from "node:path";
+import { renderAgentCertBadge } from "./badge.js";
+import { buildEvidenceBundle } from "./bundle.js";
+import { renderHtmlReport, renderMarkdownReport } from "./report.js";
+const TEMPLATE_STEPS = {
+    browser: [
+        { type: "task.started", status: "recorded", observed: "A synthetic browser task started." },
+        { type: "navigation.observed", status: "recorded", observed: "The sample reached the expected local route." },
+        { type: "outcome.verified", status: "verified", observed: "Expected and observed sample states matched." },
+    ],
+    coding: [
+        { type: "change.proposed", status: "recorded", observed: "A synthetic repository change was proposed." },
+        { type: "tests.observed", status: "recorded", observed: "The deterministic sample test completed." },
+        { type: "outcome.verified", status: "verified", observed: "The sample workspace remained unchanged." },
+    ],
+    mcp: [
+        { type: "tool.discovered", status: "recorded", observed: "A synthetic read-only tool was discovered." },
+        { type: "tool.invoked", status: "recorded", observed: "The deterministic tool fixture returned its declared response." },
+        { type: "outcome.verified", status: "verified", observed: "The response matched the sample contract." },
+    ],
+    workflow: [
+        { type: "workflow.started", status: "recorded", observed: "A synthetic claim workflow started." },
+        { type: "policy.evaluated", status: "recorded", observed: "The sample required approval before its mock action." },
+        { type: "approval.recorded", status: "recorded", observed: "A fixture approval was recorded." },
+        { type: "mock_action.executed", status: "recorded", observed: "Only local sample state changed." },
+        { type: "outcome.verified", status: "verified", observed: "Expected SUBMITTED matched observed SUBMITTED." },
+    ],
+    data: [
+        { type: "query.planned", status: "recorded", observed: "A synthetic read-only query was planned." },
+        { type: "query.executed", status: "recorded", observed: "The local fixture returned three rows." },
+        { type: "outcome.verified", status: "verified", observed: "The result count and schema matched expectations." },
+    ],
+};
+export async function writeTryEvidence(options) {
+    const outDir = resolve(options.outDir);
+    const now = options.now ?? new Date();
+    const id = options.id ?? randomUUID();
+    const runId = `agentcert_try_${id}`;
+    const timestamp = now.toISOString();
+    const tracePath = resolve(outDir, "sample-trace.json");
+    const evidencePath = resolve(outDir, "agentcert-evidence.json");
+    const reportPath = resolve(outDir, "agentcert-report.html");
+    const markdownPath = resolve(outDir, "agentcert-report.md");
+    const badgePath = resolve(outDir, "badge.svg");
+    const artifactPath = portablePath(relative(process.cwd(), tracePath));
+    const steps = TEMPLATE_STEPS[options.template].map((step, index) => ({ sequence: index + 1, ...step }));
+    const trace = {
+        schemaVersion: "agentcert.synthetic_trace.v0.1",
+        synthetic: true,
+        purpose: "onboarding_only",
+        runId,
+        template: options.template,
+        subject: options.subject,
+        startedAt: timestamp,
+        completedAt: timestamp,
+        steps,
+        outcome: {
+            success: true,
+            expected: sampleExpectedOutcome(options.template),
+            observed: sampleExpectedOutcome(options.template),
+        },
+        limitations: [
+            "No customer agent, model, tool, credential, or production system was executed.",
+            "This sample cannot establish a CURRENT assurance contract or independent certification.",
+        ],
+    };
+    const result = {
+        schemaVersion: "1",
+        product: "agentcert-cli",
+        runId,
+        timestamp,
+        phase: "pre-release",
+        score: 100,
+        passed: true,
+        certLevel: "synthetic-onboarding-sample",
+        summary: `Synthetic ${options.template} onboarding sample completed. This validates the Witnora evidence path, not a customer agent.`,
+        evidenceStrength: {
+            schemaVersion: "agentcert.evidence_strength.v0.1",
+            level: "reported",
+            claims: ["Witnora recorded a deterministic local onboarding sample and its expected outcome."],
+            limitations: [
+                "No customer agent behavior was evaluated.",
+                "No execution boundary or independent reviewer attested this sample.",
+                "A passing sample cannot establish CURRENT assurance for a real agent.",
+            ],
+        },
+        artifacts: { sampleTrace: artifactPath },
+        evidence: [{
+                id: `synthetic_onboarding_${id}`,
+                kind: "synthetic_onboarding",
+                severity: "info",
+                message: `Deterministic ${options.template} sample passed. Replace it with evidence from the real agent boundary before making a release decision.`,
+                source: "agentcert try",
+                artifactPath,
+                metadata: { synthetic: true, template: options.template, purpose: "onboarding_only" },
+            }],
+    };
+    const bundle = buildEvidenceBundle([result], options.subject, "agent");
+    bundle.runId = runId;
+    bundle.generatedAt = timestamp;
+    await mkdir(outDir, { recursive: true });
+    await writeFile(tracePath, `${JSON.stringify(trace, null, 2)}\n`, "utf8");
+    await writeFile(evidencePath, `${JSON.stringify(bundle, null, 2)}\n`, "utf8");
+    await writeFile(reportPath, renderHtmlReport(bundle), "utf8");
+    await writeFile(markdownPath, renderMarkdownReport(bundle), "utf8");
+    await writeFile(badgePath, renderAgentCertBadge(bundle), "utf8");
+    return { bundle, evidencePath, reportPath, markdownPath, badgePath, tracePath };
+}
+export function renderTrySummary(outcome) {
+    return `Synthetic onboarding sample: PASS\n` +
+        `Evidence: ${outcome.evidencePath}\n` +
+        `Report: ${outcome.reportPath}\n` +
+        `Trace: ${outcome.tracePath}\n\n` +
+        `This proves the local Witnora evidence path works. It does not evaluate a real agent or establish CURRENT assurance.\n\n` +
+        `Next:\n` +
+        `  1. Open the HTML report.\n` +
+        `  2. To retain this sample in Hosted, connect a project and re-run with --push.\n` +
+        `  3. When ready, run witnora init --template <type> inside the real agent repository.\n`;
+}
+function sampleExpectedOutcome(template) {
+    if (template === "browser")
+        return "task_completed";
+    if (template === "coding")
+        return "workspace_unchanged";
+    if (template === "mcp")
+        return "contract_response_valid";
+    if (template === "data")
+        return "three_valid_rows";
+    return "SUBMITTED";
+}
+function portablePath(path) {
+    return path.replaceAll("\\", "/");
+}

package/dist/types.js

@@ -0,0 +1,3 @@
+export const AGENTCERT_EVIDENCE_SCHEMA_VERSION = "agentcert.evidence.v0.1";
+export const AGENTCERT_EVIDENCE_SCHEMA_SEMVER = "0.1.0";
+export const AGENTCERT_ARTIFACT_MANIFEST_VERSION = "agentcert.artifact_manifest.v0.1";