@cejel/cejel 0.6.10 → 0.6.11

package/dist/{chunk-U2VDSTIT.js → chunk-S5B5KMSO.js}

@@ -5,7 +5,7 @@ import {
   renderWitanBadgeSvg,
   renderWitanHtmlReport,
   runCejelScan
-} from "./chunk-YHJ7ICL4.js";
+} from "./chunk-4YOIR3E6.js";
 import {
   ZodFirstPartyTypeKind,
   ZodOptional,

package/dist/index.js

@@ -3,11 +3,12 @@ import { createRequire as __cejelCreateRequire } from 'node:module';
 const require = __cejelCreateRequire(import.meta.url);
 import {
   serveCejelMcpOverStdio
-} from "./chunk-U2VDSTIT.js";
+} from "./chunk-S5B5KMSO.js";
 import {
   CALLER_CONTEXT_PRODUCT_IDENTITY_NOTICE,
   CERTIFICATE_GLOSSARY,
   EXTERNAL_FINDINGS_DISPLAY_LIMIT,
+  METRIC_DERIVED_FINDING_PATTERN,
   PROSPECTIVE_RUBRIC_NOTICE,
   WITAN_RUBRIC_VERSION_V22,
   WitanReportSchema,
@@ -44,7 +45,7 @@ import {
   verifyRecordedInputDigests,
   verifyWitanAttestationBinding,
   witanHistoryAbstentionInstruction
-} from "./chunk-YHJ7ICL4.js";
+} from "./chunk-4YOIR3E6.js";
 import "./chunk-2UMHJ23V.js";
 import {
   external_exports
@@ -67,7 +68,7 @@ init_esm_shims();
 init_esm_shims();
 var WITAN_ISSUANCE_STATEMENT_TYPE = "https://in-toto.io/Statement/v1";
 var WITAN_ISSUANCE_PREDICATE_TYPE = "https://cejel.dev/attestations/issuance/v1";
-var WITAN_ISSUANCE_FORMAT_VERSION = "1.0";
+var WITAN_ISSUANCE_FORMAT_VERSION = "1.1";
 var WITAN_ISSUANCE_SIGNATURE_NAMESPACE = "cejel-issuance";
 var WITAN_ISSUANCE_PRINCIPAL = "issuance@barglabs.ai";
 var WITAN_ISSUER_NAME = "Barg Labs Inc.";
@@ -95,6 +96,9 @@ var WitanIssuanceStatementSchema = external_exports.object({
       toolVersion: external_exports.string().min(1).max(80),
       rubricVersion: external_exports.string().min(1).max(120),
       rubricBehaviourFingerprint: external_exports.string().regex(/^sha256:[a-f0-9]{64}$/).optional(),
+      // The scan time the reproduction replayed: the attested scan's predicate.generatedAt
+      // (issuance format 1.1 and later). Optional on read, so a 1.0 issuance still verifies.
+      generatedAt: external_exports.string().datetime({ offset: true }).optional(),
       reportByteIdentical: external_exports.literal(true)
     }).strict(),
     issuedAt: external_exports.string().datetime({ offset: true }),
@@ -159,6 +163,7 @@ function createWitanIssuanceStatement(report, options) {
         toolVersion: options.toolVersion,
         rubricVersion: report.rubricVersion,
         ...report.rubricBehaviourFingerprint ? { rubricBehaviourFingerprint: report.rubricBehaviourFingerprint } : {},
+        ...options.reproductionGeneratedAt ? { generatedAt: options.reproductionGeneratedAt } : {},
         reportByteIdentical: true
       },
       issuedAt: options.issuedAt,
@@ -167,6 +172,40 @@ function createWitanIssuanceStatement(report, options) {
     }
   });
 }
+var ISO_8601_INSTANT = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(?::\d{2}(?:\.\d+)?)?(?:Z|[+-]\d{2}:\d{2})$/;
+function readReproductionGeneratedAt(attestation, now) {
+  const predicate = typeof attestation === "object" && attestation !== null ? attestation.predicate : void 0;
+  const value = typeof predicate === "object" && predicate !== null ? predicate.generatedAt : void 0;
+  if (value === void 0 || value === null) {
+    return {
+      ok: false,
+      reason: "the attestation's predicate.generatedAt is missing, so the reproduction has no scan time to replay"
+    };
+  }
+  const instant = typeof value === "string" ? Date.parse(value) : Number.NaN;
+  if (typeof value !== "string" || !ISO_8601_INSTANT.test(value) || !Number.isFinite(instant)) {
+    return {
+      ok: false,
+      reason: `the attestation's predicate.generatedAt is not a valid ISO 8601 time: ${JSON.stringify(value)}`
+    };
+  }
+  if (instant > now.getTime()) {
+    return {
+      ok: false,
+      reason: `the attestation's predicate.generatedAt (${value}) is later than this issuer's clock (${now.toISOString()})`
+    };
+  }
+  return { ok: true, generatedAt: value };
+}
+var NEW_YEAR_WINDOW_MS = 24 * 60 * 60 * 1e3;
+function isWithinDayOfNewYearUtc(generatedAt) {
+  const instant = Date.parse(generatedAt);
+  if (!Number.isFinite(instant)) return false;
+  const year = new Date(instant).getUTCFullYear();
+  const sinceNewYear = instant - Date.UTC(year, 0, 1);
+  const untilNewYear = Date.UTC(year + 1, 0, 1) - instant;
+  return sinceNewYear <= NEW_YEAR_WINDOW_MS || untilNewYear <= NEW_YEAR_WINDOW_MS;
+}
 function verifyWitanIssuanceBinding(statement, options) {
   const parsed = WitanIssuanceStatementSchema.safeParse(statement);
   if (!parsed.success) {
@@ -506,8 +545,15 @@ function normalizeRepoRelativePath(raw) {
   if (path.split("/").some((segment) => segment === ".." || segment === "")) return void 0;
   return path;
 }
-function fingerprint(rule, path, line, identity) {
-  return createHash2("sha256").update(JSON.stringify([rule, path, line, identity])).digest("hex");
+var METRIC_DERIVED_IDENTITY = "metric-derived";
+var NUMBER_PLACEHOLDER = "<n>";
+var NUMBER_PATTERN = /\d+(?:\.\d+)?/g;
+function findingIdentity(summary) {
+  if (METRIC_DERIVED_FINDING_PATTERN.test(summary)) return METRIC_DERIVED_IDENTITY;
+  return summary.replace(NUMBER_PATTERN, NUMBER_PLACEHOLDER);
+}
+function fingerprint(rule, path, line, identity, ordinal) {
+  return createHash2("sha256").update(JSON.stringify([rule, path, line, identity, ordinal])).digest("hex");
 }
 function exportGitLabCodeQuality(report) {
   const ingestedCount = (report.consumedSignals ?? []).reduce(
@@ -525,6 +571,7 @@ function exportGitLabCodeQuality(report) {
   const entries = [];
   let excludedUnlocated = 0;
   const seen = /* @__PURE__ */ new Set();
+  const groupSizes = /* @__PURE__ */ new Map();
   for (const criterion of report.criteria) {
     for (const finding of criterion.findings) {
       const path = finding.evidence.path === void 0 ? void 0 : normalizeRepoRelativePath(finding.evidence.path);
@@ -533,9 +580,14 @@ function exportGitLabCodeQuality(report) {
         excludedUnlocated += 1;
         continue;
       }
-      const print = fingerprint(criterion.id, path, line, finding.summary);
-      if (seen.has(print)) continue;
-      seen.add(print);
+      const exact = JSON.stringify([criterion.id, path, line, finding.summary]);
+      if (seen.has(exact)) continue;
+      seen.add(exact);
+      const identity = findingIdentity(finding.summary);
+      const group = JSON.stringify([criterion.id, path, line, identity]);
+      const ordinal = groupSizes.get(group) ?? 0;
+      groupSizes.set(group, ordinal + 1);
+      const print = fingerprint(criterion.id, path, line, identity, ordinal);
       entries.push({
         description: finding.summary,
         check_name: criterion.id,
@@ -1597,6 +1649,12 @@ ${attestationBinding.errors.map((error) => `  - ${error}`).join("\n")}
     );
     return 1;
   }
+  const scanTime = readReproductionGeneratedAt(attestationArtifact.value, /* @__PURE__ */ new Date());
+  if (!scanTime.ok) {
+    process.stderr.write(`Cejel: refusing to issue \u2014 ${scanTime.reason}.
+`);
+    return 1;
+  }
   let keyContents;
   try {
     keyContents = readFileSync(options.keyPath, "utf8");
@@ -1619,7 +1677,8 @@ ${attestationBinding.errors.map((error) => `  - ${error}`).join("\n")}
     // comparison below, as it always has.
     ...suppliedReport.inputBinding?.policy === "strict" ? { strictIngest: true } : {},
     ...suppliedReport.inputBinding?.scannedSubject.repository ? { subjectRepository: suppliedReport.inputBinding.scannedSubject.repository } : {},
-    toolVersion: cliVersion()
+    toolVersion: cliVersion(),
+    generatedAt: scanTime.generatedAt
   });
   const reproducedBytes = serializeWitanReport(reproduction.report);
   const reproducedSha256 = createHash3("sha256").update(reproducedBytes, "utf8").digest("hex");
@@ -1633,6 +1692,12 @@ ${attestationBinding.errors.map((error) => `  - ${error}`).join("\n")}
         "  Check that the checkout is at the certificate revision, that the @cejel/cejel version matches",
         "  report.json's toolVersion, and that --product-name/--name/--rubric-pin/--ingest match the",
         "  original invocation. An issuance that cannot reproduce is not issued.",
+        // The reproduction replays the scan's instant, but v17's B4 reads that instant's year in
+        // the local time zone. Near a new year two hosts can disagree on it; name the setting,
+        // never guess a zone.
+        ...isWithinDayOfNewYearUtc(scanTime.generatedAt) ? [
+          `  The scan's generatedAt (${scanTime.generatedAt}) is within 24 hours of a new year in UTC, and v17's B4 freshness year is read in the scan host's local time: an issuer in another time zone may need to re-run with the TZ environment variable set to the scan host's.`
+        ] : [],
         ""
       ].join("\n")
     );
@@ -1644,6 +1709,7 @@ ${attestationBinding.errors.map((error) => `  - ${error}`).join("\n")}
     issuerKeyFingerprint: issuerKey.fingerprint,
     toolVersion: cliVersion(),
     issuedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    reproductionGeneratedAt: scanTime.generatedAt,
     engagementRef: options.engagementRef
   });
   const issuancePath = join2(options.outDir, ISSUANCE_OUTPUT_FILE);

package/dist/mcp/index.js

@@ -3,8 +3,8 @@ import { createRequire as __cejelCreateRequire } from 'node:module';
 const require = __cejelCreateRequire(import.meta.url);
 import {
   serveCejelMcpOverStdio
-} from "../chunk-U2VDSTIT.js";
-import "../chunk-YHJ7ICL4.js";
+} from "../chunk-S5B5KMSO.js";
+import "../chunk-4YOIR3E6.js";
 import "../chunk-2UMHJ23V.js";
 import "../chunk-AMVP7L26.js";
 import {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cejel/cejel",
-  "version": "0.6.10",
+  "version": "0.6.11",
   "mcpName": "io.github.BargLabs/cejel",
   "private": false,
   "publishConfig": {
@@ -31,7 +31,7 @@
     "type": "git",
     "url": "git+https://github.com/BargLabs/cejel.git"
   },
-  "packageManager": "pnpm@9.0.0",
+  "packageManager": "pnpm@9.0.0+sha512.b4106707c7225b1748b61595953ccbebff97b54ad05d002aa3635f633b9c53cd666f7ce9b8bc44704f1fa048b9a49b55371ab2d9e9d667d1efe2ef1514bcd513",
   "type": "module",
   "bin": {
     "cejel": "dist/index.js",