0sec-cli 0.18.0 → 0.22.0

package/chunks/{chunk-SAFFWQW4.js → chunk-DKSCN2AB.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 import {
   describeEdgeTechnique,
   highValueTargetIds,
   reachableTo,
   shortestPaths
-} from "./chunk-VQG4FT5D.js";
+} from "./chunk-UFHN6RIU.js";
 
 // packages/core/dist/identity/graph-client.js
 var DEFAULT_BASE_URL = "https://graph.microsoft.com/v1.0";
@@ -84,7 +84,7 @@ var GraphClient = class {
     this.pageDelayMs = opts.pageDelayMs ?? DEFAULT_PAGE_DELAY_MS;
     this.maxPages = opts.maxPages ?? DEFAULT_MAX_PAGES;
     this.sleep = opts.sleep ?? defaultSleep;
-    this.userAgent = opts.userAgent ?? "0sec-identity";
+    this.userAgent = opts.userAgent ?? "0-identity";
   }
   /** GET a v1.0-relative path (`/users`) and return the parsed body. */
   async get(path, query) {
@@ -197,7 +197,7 @@ var GraphClient = class {
       throw new GraphScopeError(url, `origin '${parsed.origin}' is not the configured Graph origin '${this.origin}'`);
     }
     if (this.scope) {
-      const match = this.scope.match(url);
+      const match = this.scope.enforce(url);
       if (!match.allowed)
         throw new GraphScopeError(url, match.reason);
     }
@@ -4283,7 +4283,7 @@ function ingestAzureHound(documents) {
   for (const missing of ["azusers", "azgroups", "azroleassignments"].filter((c) => !seen.has(c))) {
     warnings.push(`export carried no \`${missing}\` collection; coverage is partial`);
   }
-  warnings.push("AzureHound exports do not include conditional-access policies, federation configuration, or PIM eligibility schedules \u2014 run `0sec identity` against a live tenant for the posture checks that read them");
+  warnings.push("AzureHound exports do not include conditional-access policies, federation configuration, or PIM eligibility schedules \u2014 run `0 identity` against a live tenant for the posture checks that read them");
   const relationships = haveRelationships ? {
     groupMembers,
     groupOwners,
@@ -4713,7 +4713,7 @@ function describeGaps(correspondences, coverage, conflicts, adNodeCount, entraNo
   if (correspondences.length === 0) {
     gaps.push(`NO IDENTITY CORRESPONDENCE COULD BE ESTABLISHED between the ${adNodeCount} on-premises principal(s) and the ${entraNodeCount} cloud principal(s) collected. No hybrid attack path could be computed, and that is a limit of the input, NOT a finding that the two directories are unconnected.`);
     if (!anchorsPresent) {
-      gaps.push("None of the cloud objects carried onPremisesImmutableId, onPremisesSecurityIdentifier, or onPremisesDistinguishedName. These attributes are not part of an AzureHound export and are dropped by Microsoft Graph when the token lacks directory read scope \u2014 so the most likely explanation is that they were never collected. Re-collect with `0sec identity` against the tenant, or supply the correspondence directly via `knownCorrespondences`.");
+      gaps.push("None of the cloud objects carried onPremisesImmutableId, onPremisesSecurityIdentifier, or onPremisesDistinguishedName. These attributes are not part of an AzureHound export and are dropped by Microsoft Graph when the token lacks directory read scope \u2014 so the most likely explanation is that they were never collected. Re-collect with `0 identity` against the tenant, or supply the correspondence directly via `knownCorrespondences`.");
     } else {
       gaps.push(`Synchronisation anchors WERE present on the cloud objects (immutableId: ${coverage["immutable-id"].entraObjectsCarrying}, SID: ${coverage["security-identifier"].entraObjectsCarrying}) but matched no collected on-premises object. The two collections most likely cover different forests or different scopes of the same forest.`);
     }

package/chunks/{chunk-2JCCA2JL.js → chunk-DM5C5L5D.js}

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 import {
   severityRank
-} from "./chunk-6L26OBWI.js";
+} from "./chunk-76KSBWOQ.js";
 
 // packages/core/dist/triage/kernel-primitive.js
 function maxSeverity(a, b) {

package/chunks/{chunk-RWONANDA.js → chunk-DQTNI3KY.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { createRequire as __0secCreateRequire } from "node:module";
-const require = __0secCreateRequire(import.meta.url);
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
 
 // packages/core/dist/stages/npm-detectors/dedup.js
 function forkTwinFor(hints, name) {
@@ -12,7 +12,7 @@ async function dedupConfirmation(args) {
     return {
       novel: false,
       source: "prior-report",
-      advisories: [`${name}: previously reported by 0sec for this class`]
+      advisories: [`${name}: previously reported by 0 for this class`]
     };
   }
   const twin = forkTwinFor(hints, name);
@@ -360,7 +360,7 @@ var ssppFuzzDetector = {
     };
   },
   dedupHints: {
-    // 0sec prior filing for this exact class.
+    // 0 prior filing for this exact class.
     priorReports: ["es-toolkit"],
     // Fork-twin the prototype learned the hard way: npm audit gave a false
     // all-clear because the advisory lives under the maintained fork's name.
@@ -371,7 +371,7 @@ var ssppFuzzDetector = {
 };
 
 // packages/core/dist/stages/npm-detectors/read-unstable.js
-var EVIL = "__0sec_toctou_forbidden__";
+var EVIL = "__0_toctou_forbidden__";
 function makePhasedField(clean, evil = EVIL) {
   let phase = "validate";
   return {