@cejel/cejel 0.6.7 → 0.6.10

package/dist/index.js

@@ -3,18 +3,22 @@ import { createRequire as __cejelCreateRequire } from 'node:module';
 const require = __cejelCreateRequire(import.meta.url);
 import {
   serveCejelMcpOverStdio
-} from "./chunk-TOQPQPDF.js";
+} from "./chunk-U2VDSTIT.js";
 import {
   CALLER_CONTEXT_PRODUCT_IDENTITY_NOTICE,
   CERTIFICATE_GLOSSARY,
+  EXTERNAL_FINDINGS_DISPLAY_LIMIT,
   PROSPECTIVE_RUBRIC_NOTICE,
   WITAN_RUBRIC_VERSION_V22,
   WitanReportSchema,
   assertSelectableRubricVersion,
+  buildPlainSummary,
   buildRelyingPartySummary,
   buildVerdictExplanation,
   computeApplicableMeasuredCoverage,
   createWitanAttestation,
+  describeInputBindingRecord,
+  describeScannedSubject,
   formatCertificateMetricAppliedWeightPercent,
   formatCertificateMetricLabel,
   formatCertificateMetricValue,
@@ -22,21 +26,32 @@ import {
   formatDimensionsMeasuredSentence,
   formatExternalSourceLine,
   formatLowConfidenceSentence,
+  formatVerdictCapSentence,
+  glossaryEntryForRubric,
+  importedAdjustmentSentence,
+  inheritedFindingNote,
+  inputBindingHeadline,
   isProspectiveRubricVersion,
+  isWitanAbstentionLabel,
+  renderWitanAbstentionHeadline,
   renderWitanBadgeEndpoint,
   renderWitanBadgeSvg,
   renderWitanHtmlReport,
+  resolveIngestFilePath,
   runCejelScan,
   serializeWitanReport,
-  verifyWitanAttestationBinding
-} from "./chunk-ZZHQZW26.js";
-import "./chunk-VGBFZBZQ.js";
+  stripTerminalControls,
+  verifyRecordedInputDigests,
+  verifyWitanAttestationBinding,
+  witanHistoryAbstentionInstruction
+} from "./chunk-YHJ7ICL4.js";
+import "./chunk-2UMHJ23V.js";
 import {
   external_exports
-} from "./chunk-FSMZV3Y6.js";
+} from "./chunk-AMVP7L26.js";
 import {
   init_esm_shims
-} from "./chunk-O3MHSK25.js";
+} from "./chunk-AWLKQUI4.js";
 
 // src/index.ts
 init_esm_shims();
@@ -643,9 +658,14 @@ function writeOutputFiles(dir, files, what) {
 // src/terminal.ts
 init_esm_shims();
 function renderMinScoreAbstentionFailure(summary, minScore) {
-  if (summary.verdict !== "Insufficient source" && summary.verdict !== "Insufficient evidence") {
+  if (!isWitanAbstentionLabel(summary.verdict)) {
     throw new Error("A minimum-score abstention message requires an abstained Cejel summary.");
   }
+  const instruction = witanHistoryAbstentionInstruction(summary.verdict);
+  if (instruction !== void 0) {
+    return `Cejel: cannot evaluate the required minimum ${minScore.toFixed(1)}/4.0 because the scan is ${summary.verdict.toLowerCase()}, with no composite score and no verdict. ${instruction}
+`;
+  }
   return `Cejel: cannot evaluate the required minimum ${minScore.toFixed(1)}/4.0 because this repository has ${summary.verdict.toLowerCase()}.
 `;
 }
@@ -663,24 +683,22 @@ function renderMinScoreCoverageFailure(coverage, minScore) {
   return `Cejel: cannot evaluate the required minimum ${minScore.toFixed(1)}/4.0 because fewer than half of the applicable dimensions were measured in at least one score (${formatCoverageSummary(coverage)}). Resolve the reported evidence gaps and re-scan.
 `;
 }
-function stripTerminalControls(text) {
-  return text.replace(/[\t\n]/g, " ").replace(/[\u0000-\u001f\u007f-\u009f]/g, "");
-}
 function renderTerminalCertificate(summary, report) {
-  const abstained = summary.verdict === "Insufficient source" || summary.verdict === "Insufficient evidence";
+  const abstained = isWitanAbstentionLabel(summary.verdict);
   if (!abstained && (summary.overallScore === null || summary.codeTrustScore === null || summary.processTrustScore === null)) {
     throw new Error("A scored Cejel summary must carry numeric headline scores.");
   }
   const lines = abstained ? [
     `Cejel Trust Certificate \u2014 ${stripTerminalControls(summary.productDisplayName)}`,
     "",
-    `${summary.verdict} to certify.`,
+    renderWitanAbstentionHeadline(summary.verdict),
     `  ${summary.insufficientSourceReason === void 0 ? "No ratable source or measurable evidence was found." : stripTerminalControls(summary.insufficientSourceReason)}`,
     ""
   ] : [
     `Cejel Trust Certificate \u2014 ${stripTerminalControls(summary.productDisplayName)}`,
     "",
     `Overall: ${formatScore(summary.overallScore)}/4.0 (${summary.verdict})`,
+    ...report && formatVerdictCapSentence(report) ? [`  ${formatVerdictCapSentence(report)}`] : [],
     `  Code trust:    ${formatScore(summary.codeTrustScore)}/4.0`,
     `  Process trust: ${formatScore(summary.processTrustScore)}/4.0`,
     ...report ? [`  ${formatDimensionsMeasuredSentence(report)}`] : [],
@@ -696,11 +714,12 @@ function renderTerminalCertificate(summary, report) {
       `Scope: ${relyingPartySummary.scope}`,
       `What was examined: ${stripTerminalControls(relyingPartySummary.examined)}`,
       `What was established: ${relyingPartySummary.established}`,
-      `What was not established: ${relyingPartySummary.notEstablished}`,
+      `What was not established: ${stripTerminalControls(relyingPartySummary.notEstablished)}`,
       `What to do next: ${relyingPartySummary.next}`,
       ""
     );
   }
+  if (report) lines.push(...renderPlainSummaryLines(buildPlainSummary(report), summary, abstained));
   if (summary.scanLimitations.length > 0) {
     lines.push(
       "LIMITED EVIDENCE \u2014 the score and verdict are qualified by scan limitations:",
@@ -710,7 +729,7 @@ function renderTerminalCertificate(summary, report) {
   }
   if (summary.historyLimitations?.length) {
     lines.push(
-      "HISTORY LIMITATION \u2014 scored as usual, but some criteria read truncated history:",
+      abstained ? "HISTORY LIMITATION \u2014 some criteria read truncated history:" : "HISTORY LIMITATION \u2014 scored as usual, but some criteria read truncated history:",
       ...summary.historyLimitations.map((limitation) => `  - ${stripTerminalControls(limitation)}`),
       ""
     );
@@ -719,7 +738,7 @@ function renderTerminalCertificate(summary, report) {
     const reads = summary.contentReadSummary;
     const errnoCounts = Object.entries(reads.unreadableByErrno).map(([errno, count]) => `${errno}: ${count}`).join(", ");
     lines.push(
-      `Skipped content entries: ${reads.skipped} (unreadable: ${reads.byReason.unreadable}${errnoCounts ? ` [${errnoCounts}]` : ""}; too large: ${reads.byReason.tooLarge}; excluded by extension: ${reads.byReason.excludedByExtension}; denied path: ${reads.byReason.deniedPath}; non-regular file: ${reads.byReason.nonRegularFile}).`
+      `Skipped content entries: ${reads.skipped} (unreadable: ${reads.byReason.unreadable}${errnoCounts ? ` [${errnoCounts}]` : ""}; too large: ${reads.byReason.tooLarge}; excluded by extension: ${reads.byReason.excludedByExtension}; denied path: ${reads.byReason.deniedPath}; non-regular file: ${reads.byReason.nonRegularFile}${reads.byReason.lfsPointer ? `; Git LFS pointer: ${reads.byReason.lfsPointer}` : ""}).`
     );
     if (reads.affectedCriteria.length > 0) {
       lines.push(
@@ -737,6 +756,20 @@ function renderTerminalCertificate(summary, report) {
     }
     lines.push("");
   }
+  if (report?.inputBinding) {
+    lines.push(stripTerminalControls(inputBindingHeadline(report.inputBinding)));
+    lines.push(`  ${stripTerminalControls(describeScannedSubject(report.inputBinding))}`);
+    for (const input of report.inputBinding.inputs.slice(0, EXTERNAL_FINDINGS_DISPLAY_LIMIT)) {
+      lines.push(`  ${stripTerminalControls(describeInputBindingRecord(input))}`);
+    }
+    const remaining = report.inputBinding.inputs.length - EXTERNAL_FINDINGS_DISPLAY_LIMIT;
+    if (remaining > 0) lines.push(`  ...and ${remaining} more \u2014 see report.json inputBinding.`);
+    for (const criterion of report.criteria) {
+      const sentence = importedAdjustmentSentence(criterion);
+      if (sentence) lines.push(`  ${criterion.id}: ${sentence}`);
+    }
+    lines.push("");
+  }
   const measurements = report?.criteria.flatMap(
     (criterion) => criterion.metrics.map((metric) => ({
       criterionId: criterion.id,
@@ -749,7 +782,7 @@ function renderTerminalCertificate(summary, report) {
     lines.push("Measurements:");
     for (const measurement of measurements ?? []) {
       lines.push(
-        `  ${measurement.criterionId} \u2014 ${measurement.label}: ${measurement.value} (weight ${measurement.weightPercent}% of ${measurement.criterionId})`
+        `  ${measurement.criterionId} \u2014 ${measurement.label}: ${stripTerminalControls(measurement.value)} (weight ${measurement.weightPercent}% of ${measurement.criterionId})`
       );
     }
     lines.push("");
@@ -783,6 +816,8 @@ function renderTerminalCertificate(summary, report) {
       lines.push(
         `  [${finding.severity}] ${stripTerminalControls(finding.label)} \u2192 ${finding.dimension}: ${stripTerminalControls(finding.ruleId)} \u2014 ${stripTerminalControls(finding.message)}${finding.location ? ` (${stripTerminalControls(finding.location)})` : ""}`
       );
+      const note = inheritedFindingNote(finding.ruleId);
+      if (note) lines.push(`    Note: ${note}`);
     }
     const remaining = summary.externalFindingCount - summary.topExternalFindings.length;
     if (remaining > 0) {
@@ -790,7 +825,7 @@ function renderTerminalCertificate(summary, report) {
     }
   }
   lines.push("", "Plain-language glossary:");
-  for (const entry of CERTIFICATE_GLOSSARY) {
+  for (const entry of CERTIFICATE_GLOSSARY.map((curated) => glossaryEntryForRubric(curated, report?.rubricVersion))) {
     lines.push(`  ${entry.term} \u2014 ${entry.definition}`);
   }
   if (report && isProspectiveRubricVersion(report.rubricVersion)) {
@@ -799,6 +834,43 @@ function renderTerminalCertificate(summary, report) {
   return `${lines.join("\n")}
 `;
 }
+var PLAIN_TERMINAL_ITEM_LIMIT = 3;
+function renderPlainSummaryLines(plain, summary, abstained) {
+  const section = (heading, leads, items, empty) => {
+    const shown = items.slice(0, PLAIN_TERMINAL_ITEM_LIMIT);
+    const remaining = items.length - shown.length;
+    return [
+      `${heading} (${items.length}):`,
+      ...leads.filter((lead) => lead !== void 0).map((lead) => `  ${lead}`),
+      ...items.length === 0 ? [`  ${empty}`] : shown.map((item) => `  - ${stripTerminalControls(item)}`),
+      ...remaining > 0 ? [`  ...and ${remaining} more in certificate.html.`] : []
+    ];
+  };
+  const itemLine = (item) => `${item.area} \u2014 ${item.text}${item.location !== void 0 ? ` (${item.location})` : ""}`;
+  const wrongFindings = plain.wrong.filter((item) => item.source.kind === "finding").length;
+  const otherFindings = summary.findingCount - wrongFindings;
+  const topFindingsNote = !abstained && otherFindings > 0 ? `Top findings below counts ${summary.findingCount} finding${summary.findingCount === 1 ? "" : "s"} in all, including ${otherFindings} informational finding${otherFindings === 1 ? "" : "s"} not listed here.` : void 0;
+  return [
+    "In plain words (the full lists, with links to the evidence, are in certificate.html):",
+    ...plain.prospectiveNotice !== void 0 ? [`  ${plain.prospectiveNotice}`] : [],
+    ...section("What holds", [plain.areasLine, plain.holdsLead], plain.holds.map(itemLine), plain.holdsNote ?? ""),
+    ...section(
+      "What is wrong",
+      [plain.wrongNote, topFindingsNote],
+      plain.wrong.map((item) => `${item.level === "critical" ? "Critical" : "Warning"}: ${itemLine(item)}`),
+      "Cejel recorded no critical or warning-level problem in what it checked."
+    ),
+    ...section("What is not known", [], plain.notKnown.map(itemLine), "Cejel listed no gap here; anything it did not measure is still not established."),
+    ...section(
+      "What to check next",
+      [],
+      plain.checkNext.map((check) => `${check.area} \u2014 ${check.text}`),
+      "Nothing to check from these lists."
+    ),
+    plain.notCovered,
+    ""
+  ];
+}
 function formatScore(score) {
   if (score === null) throw new Error("A scored Cejel summary must carry numeric scores.");
   return score.toFixed(1);
@@ -861,6 +933,17 @@ var CLI_FLAG_SPECS = [
     description: "fold in a SARIF/JSON scanner report (repeatable)",
     kind: "ingest"
   },
+  {
+    tokens: ["--subject-repository"],
+    value: "<repo>",
+    description: "name this repository (e.g. github.com/owner/repo) so ingested inputs declaring another repository are recorded as mismatched",
+    kind: "subjectRepository"
+  },
+  {
+    tokens: ["--strict-ingest"],
+    description: "refuse ingested inputs for another repository or commit, observed before this commit, or duplicated (default: record only)",
+    kind: "strictIngest"
+  },
   {
     tokens: ["--rubric-pin"],
     value: "<version>",
@@ -953,6 +1036,8 @@ ${usageOptions}
 Verify options:
   --signers <file>       use this allowed-signers file instead of the published one
   --revocations <file>   use this revocations file instead of the published one
+  --input <file>         an ingested input (repeatable); fails unless the supplied set of files
+                         has exactly the sha256 digests report.json records in inputBinding
 
 Issue options:
   --report <file>        the report.json being countersigned (required)
@@ -964,6 +1049,7 @@ Issue options:
   --name <display>       pass exactly what the original scan used, or the bytes will not reproduce
   --rubric-pin <version> pass exactly what the original scan used, or the bytes will not reproduce
   --ingest <file>        pass exactly what the original scan used, or the bytes will not reproduce
+                         (--strict-ingest and --subject-repository are read from report.json's inputBinding)
 
 cejel never signs and never reads private key material.
 
@@ -1035,6 +1121,8 @@ async function runWitanCli(args, rubricVersion) {
     ...effectiveRubricVersion ? { rubricVersion: effectiveRubricVersion } : {},
     ingestPatterns: options.ingestPatterns,
     warnOnEmptyIngestMatch: !options.quiet,
+    ...options.strictIngest ? { strictIngest: true } : {},
+    ...options.subjectRepository ? { subjectRepository: options.subjectRepository } : {},
     toolVersion: cliVersion()
   });
   const attestation = createWitanAttestation(report, {
@@ -1057,7 +1145,13 @@ async function runWitanCli(args, rubricVersion) {
       },
       { name: "badge.json", contents: JSON.stringify(renderWitanBadgeEndpoint(report), null, 2) },
       { name: "badge.svg", contents: renderWitanBadgeSvg(report) },
-      { name: "summary.json", contents: JSON.stringify(summary, null, 2) }
+      // plainSummary (goal_cejel_four_question_summary_2026-11-02) is added here, at the one place
+      // summary.json is written, so buildWitanCliSummary's shape (the MCP and HTTP responses) and
+      // every key before it are unchanged.
+      {
+        name: "summary.json",
+        contents: JSON.stringify({ ...summary, plainSummary: buildPlainSummary(report) }, null, 2)
+      }
     ],
     "scan output"
   );
@@ -1198,14 +1292,22 @@ ${members.map((member) => `  - ${member}`).join("\n")}
   process.stderr.write(renderGitLabCodeQualityFooter(result));
   return 0;
 }
-var VERIFY_USAGE = () => `Usage: npx ${NPX_PACKAGE_NAME} verify <report.json> <attestation.json> [issuance.json issuance.json.sig] [--signers <file>] [--revocations <file>]`;
+var VERIFY_USAGE = () => `Usage: npx ${NPX_PACKAGE_NAME} verify <report.json> <attestation.json> [issuance.json issuance.json.sig] [--signers <file>] [--revocations <file>] [--input <file>...]`;
 function parseVerifyArgs(args) {
   const positionals = [];
   let signersPath;
   let revocationsPath;
+  const inputPaths = [];
   for (let index = 0; index < args.length; index += 1) {
     const arg = args[index];
     if (arg === void 0) continue;
+    if (arg === "--input") {
+      const value = args[index + 1];
+      if (!value) throw new Error(`Missing value for ${arg}`);
+      inputPaths.push(resolve3(value));
+      index += 1;
+      continue;
+    }
     if (arg === "--signers" || arg === "--revocations") {
       const value = args[index + 1];
       if (!value) throw new Error(`Missing value for ${arg}`);
@@ -1227,7 +1329,8 @@ function parseVerifyArgs(args) {
     ...issuancePath ? { issuancePath: resolve3(issuancePath) } : {},
     ...issuanceSignaturePath ? { issuanceSignaturePath: resolve3(issuanceSignaturePath) } : {},
     ...signersPath ? { signersPath } : {},
-    ...revocationsPath ? { revocationsPath } : {}
+    ...revocationsPath ? { revocationsPath } : {},
+    ...inputPaths.length > 0 ? { inputPaths } : {}
   };
 }
 function parseIssueArgs(args) {
@@ -1352,6 +1455,26 @@ ${result.errors.map((error) => `  - ${error}`).join("\n")}
     return 1;
   }
   process.stdout.write("Cejel: report/attestation binding verified.\n");
+  if (invocation.inputPaths) {
+    let inputCheck;
+    try {
+      inputCheck = verifyRecordedInputDigests(
+        reportResult.data,
+        invocation.inputPaths,
+        (path) => readFileSync(resolveIngestFilePath(path))
+      );
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      process.stderr.write(
+        `Cejel: input digests not verified \u2014 ${stripTerminalControls(message.replace(/^Cejel: /, ""))}
+`
+      );
+      return 1;
+    }
+    for (const line of inputCheck.lines) process.stdout.write(`${stripTerminalControls(line)}
+`);
+    if (!inputCheck.valid) return 1;
+  }
   if (!invocation.issuancePath || !invocation.issuanceSignaturePath) {
     process.stdout.write("Cejel: signature and signer identity were not verified.\n");
     return 0;
@@ -1490,6 +1613,12 @@ ${attestationBinding.errors.map((error) => `  - ${error}`).join("\n")}
     ...options.rubricPin ? { rubricVersion: options.rubricPin } : {},
     ingestPatterns: options.ingestPatterns,
     warnOnEmptyIngestMatch: true,
+    // The binding policy and the named subject repository are part of the invocation the report
+    // records, so the reproduction reads them from the report it is reproducing rather than from
+    // flags an issuer could forget. Anything else a report states differently fails the byte
+    // comparison below, as it always has.
+    ...suppliedReport.inputBinding?.policy === "strict" ? { strictIngest: true } : {},
+    ...suppliedReport.inputBinding?.scannedSubject.repository ? { subjectRepository: suppliedReport.inputBinding.scannedSubject.repository } : {},
     toolVersion: cliVersion()
   });
   const reproducedBytes = serializeWitanReport(reproduction.report);
@@ -1568,6 +1697,8 @@ function parseArgs(args) {
   let showVersion = false;
   let rubricPin;
   let runAttempt;
+  let strictIngest = false;
+  let subjectRepository;
   const ingestPatterns = [];
   for (let index = 0; index < args.length; index += 1) {
     const arg = args[index];
@@ -1646,6 +1777,16 @@ function parseArgs(args) {
           index += 1;
           break;
         }
+        case "strictIngest":
+          strictIngest = true;
+          break;
+        case "subjectRepository": {
+          const value = args[index + 1];
+          if (!value) throw new Error("Missing value for --subject-repository");
+          subjectRepository = value;
+          index += 1;
+          break;
+        }
         case "runAttempt": {
           const value = args[index + 1];
           if (!value) throw new Error("Missing value for --run-attempt");
@@ -1678,6 +1819,8 @@ function parseArgs(args) {
     showHelp,
     showVersion,
     ingestPatterns,
+    ...strictIngest ? { strictIngest } : {},
+    ...subjectRepository ? { subjectRepository } : {},
     ...rubricPin ? { rubricPin } : {},
     ...runAttempt ? { runAttempt } : {}
   };

package/dist/mcp/index.js

@@ -3,13 +3,13 @@ import { createRequire as __cejelCreateRequire } from 'node:module';
 const require = __cejelCreateRequire(import.meta.url);
 import {
   serveCejelMcpOverStdio
-} from "../chunk-TOQPQPDF.js";
-import "../chunk-ZZHQZW26.js";
-import "../chunk-VGBFZBZQ.js";
-import "../chunk-FSMZV3Y6.js";
+} from "../chunk-U2VDSTIT.js";
+import "../chunk-YHJ7ICL4.js";
+import "../chunk-2UMHJ23V.js";
+import "../chunk-AMVP7L26.js";
 import {
   init_esm_shims
-} from "../chunk-O3MHSK25.js";
+} from "../chunk-AWLKQUI4.js";
 
 // src/mcp/index.ts
 init_esm_shims();

package/dist/packs/d-series/index.js

@@ -3,18 +3,18 @@ import { createRequire as __cejelCreateRequire } from 'node:module';
 const require = __cejelCreateRequire(import.meta.url);
 import {
   listCejelLlmPackFiles
-} from "../../chunk-5PFYOIOS.js";
+} from "../../chunk-RRPQHEBU.js";
 import {
   execGit
-} from "../../chunk-VGBFZBZQ.js";
+} from "../../chunk-2UMHJ23V.js";
 import {
   require_typescript
-} from "../../chunk-RH6FKREX.js";
+} from "../../chunk-6LVNNJTG.js";
 import {
   __toESM,
   init_esm_shims,
   readRepoText
-} from "../../chunk-O3MHSK25.js";
+} from "../../chunk-AWLKQUI4.js";
 
 // src/packs/d-series/index.ts
 init_esm_shims();

package/dist/packs/decision-contracts/index.js

@@ -3,15 +3,15 @@ import { createRequire as __cejelCreateRequire } from 'node:module';
 const require = __cejelCreateRequire(import.meta.url);
 import {
   external_exports
-} from "../../chunk-FSMZV3Y6.js";
+} from "../../chunk-AMVP7L26.js";
 import {
   require_typescript
-} from "../../chunk-RH6FKREX.js";
+} from "../../chunk-6LVNNJTG.js";
 import {
   __toESM,
   init_esm_shims,
   readRepoText
-} from "../../chunk-O3MHSK25.js";
+} from "../../chunk-AWLKQUI4.js";
 
 // src/packs/decision-contracts/index.ts
 init_esm_shims();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cejel/cejel",
-  "version": "0.6.7",
+  "version": "0.6.10",
   "mcpName": "io.github.BargLabs/cejel",
   "private": false,
   "publishConfig": {