@cejel/cejel 0.6.7 → 0.6.8

package/dist/{chunk-TOQPQPDF.js → chunk-KNTBED5T.js}

@@ -5,19 +5,19 @@ import {
   renderWitanBadgeSvg,
   renderWitanHtmlReport,
   runCejelScan
-} from "./chunk-ZZHQZW26.js";
+} from "./chunk-KJVFCZZ3.js";
 import {
   ZodFirstPartyTypeKind,
   ZodOptional,
   external_exports,
   objectType
-} from "./chunk-FSMZV3Y6.js";
+} from "./chunk-AMVP7L26.js";
 import {
   __commonJS,
   __export,
   __toESM,
   init_esm_shims
-} from "./chunk-O3MHSK25.js";
+} from "./chunk-AWLKQUI4.js";
 
 // node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/compile/codegen/code.js
 var require_code = __commonJS({

package/dist/{chunk-VGBFZBZQ.js → chunk-NIWSYJ6N.js}

@@ -3,7 +3,7 @@ import { createRequire as __cejelCreateRequire } from 'node:module';
 const require = __cejelCreateRequire(import.meta.url);
 import {
   init_esm_shims
-} from "./chunk-O3MHSK25.js";
+} from "./chunk-AWLKQUI4.js";
 
 // src/witan/git-exec.ts
 init_esm_shims();

package/dist/{chunk-5PFYOIOS.js → chunk-WXPGEQBE.js}

@@ -5,10 +5,10 @@ import {
   describeGitFailure,
   execGit,
   isExpectedGitAbsence
-} from "./chunk-VGBFZBZQ.js";
+} from "./chunk-NIWSYJ6N.js";
 import {
   init_esm_shims
-} from "./chunk-O3MHSK25.js";
+} from "./chunk-AWLKQUI4.js";
 
 // src/packs/llm/files.ts
 init_esm_shims();

package/dist/index.js

@@ -3,10 +3,11 @@ import { createRequire as __cejelCreateRequire } from 'node:module';
 const require = __cejelCreateRequire(import.meta.url);
 import {
   serveCejelMcpOverStdio
-} from "./chunk-TOQPQPDF.js";
+} from "./chunk-KNTBED5T.js";
 import {
   CALLER_CONTEXT_PRODUCT_IDENTITY_NOTICE,
   CERTIFICATE_GLOSSARY,
+  EXTERNAL_FINDINGS_DISPLAY_LIMIT,
   PROSPECTIVE_RUBRIC_NOTICE,
   WITAN_RUBRIC_VERSION_V22,
   WitanReportSchema,
@@ -15,6 +16,8 @@ import {
   buildVerdictExplanation,
   computeApplicableMeasuredCoverage,
   createWitanAttestation,
+  describeInputBindingRecord,
+  describeScannedSubject,
   formatCertificateMetricAppliedWeightPercent,
   formatCertificateMetricLabel,
   formatCertificateMetricValue,
@@ -22,21 +25,27 @@ import {
   formatDimensionsMeasuredSentence,
   formatExternalSourceLine,
   formatLowConfidenceSentence,
+  importedAdjustmentSentence,
+  inheritedFindingNote,
+  inputBindingHeadline,
   isProspectiveRubricVersion,
   renderWitanBadgeEndpoint,
   renderWitanBadgeSvg,
   renderWitanHtmlReport,
+  resolveIngestFilePath,
   runCejelScan,
   serializeWitanReport,
+  stripTerminalControls,
+  verifyRecordedInputDigests,
   verifyWitanAttestationBinding
-} from "./chunk-ZZHQZW26.js";
-import "./chunk-VGBFZBZQ.js";
+} from "./chunk-KJVFCZZ3.js";
+import "./chunk-NIWSYJ6N.js";
 import {
   external_exports
-} from "./chunk-FSMZV3Y6.js";
+} from "./chunk-AMVP7L26.js";
 import {
   init_esm_shims
-} from "./chunk-O3MHSK25.js";
+} from "./chunk-AWLKQUI4.js";
 
 // src/index.ts
 init_esm_shims();
@@ -663,9 +672,6 @@ function renderMinScoreCoverageFailure(coverage, minScore) {
   return `Cejel: cannot evaluate the required minimum ${minScore.toFixed(1)}/4.0 because fewer than half of the applicable dimensions were measured in at least one score (${formatCoverageSummary(coverage)}). Resolve the reported evidence gaps and re-scan.
 `;
 }
-function stripTerminalControls(text) {
-  return text.replace(/[\t\n]/g, " ").replace(/[\u0000-\u001f\u007f-\u009f]/g, "");
-}
 function renderTerminalCertificate(summary, report) {
   const abstained = summary.verdict === "Insufficient source" || summary.verdict === "Insufficient evidence";
   if (!abstained && (summary.overallScore === null || summary.codeTrustScore === null || summary.processTrustScore === null)) {
@@ -696,7 +702,7 @@ function renderTerminalCertificate(summary, report) {
       `Scope: ${relyingPartySummary.scope}`,
       `What was examined: ${stripTerminalControls(relyingPartySummary.examined)}`,
       `What was established: ${relyingPartySummary.established}`,
-      `What was not established: ${relyingPartySummary.notEstablished}`,
+      `What was not established: ${stripTerminalControls(relyingPartySummary.notEstablished)}`,
       `What to do next: ${relyingPartySummary.next}`,
       ""
     );
@@ -719,7 +725,7 @@ function renderTerminalCertificate(summary, report) {
     const reads = summary.contentReadSummary;
     const errnoCounts = Object.entries(reads.unreadableByErrno).map(([errno, count]) => `${errno}: ${count}`).join(", ");
     lines.push(
-      `Skipped content entries: ${reads.skipped} (unreadable: ${reads.byReason.unreadable}${errnoCounts ? ` [${errnoCounts}]` : ""}; too large: ${reads.byReason.tooLarge}; excluded by extension: ${reads.byReason.excludedByExtension}; denied path: ${reads.byReason.deniedPath}; non-regular file: ${reads.byReason.nonRegularFile}).`
+      `Skipped content entries: ${reads.skipped} (unreadable: ${reads.byReason.unreadable}${errnoCounts ? ` [${errnoCounts}]` : ""}; too large: ${reads.byReason.tooLarge}; excluded by extension: ${reads.byReason.excludedByExtension}; denied path: ${reads.byReason.deniedPath}; non-regular file: ${reads.byReason.nonRegularFile}${reads.byReason.lfsPointer ? `; Git LFS pointer: ${reads.byReason.lfsPointer}` : ""}).`
     );
     if (reads.affectedCriteria.length > 0) {
       lines.push(
@@ -737,6 +743,20 @@ function renderTerminalCertificate(summary, report) {
     }
     lines.push("");
   }
+  if (report?.inputBinding) {
+    lines.push(stripTerminalControls(inputBindingHeadline(report.inputBinding)));
+    lines.push(`  ${stripTerminalControls(describeScannedSubject(report.inputBinding))}`);
+    for (const input of report.inputBinding.inputs.slice(0, EXTERNAL_FINDINGS_DISPLAY_LIMIT)) {
+      lines.push(`  ${stripTerminalControls(describeInputBindingRecord(input))}`);
+    }
+    const remaining = report.inputBinding.inputs.length - EXTERNAL_FINDINGS_DISPLAY_LIMIT;
+    if (remaining > 0) lines.push(`  ...and ${remaining} more \u2014 see report.json inputBinding.`);
+    for (const criterion of report.criteria) {
+      const sentence = importedAdjustmentSentence(criterion);
+      if (sentence) lines.push(`  ${criterion.id}: ${sentence}`);
+    }
+    lines.push("");
+  }
   const measurements = report?.criteria.flatMap(
     (criterion) => criterion.metrics.map((metric) => ({
       criterionId: criterion.id,
@@ -749,7 +769,7 @@ function renderTerminalCertificate(summary, report) {
     lines.push("Measurements:");
     for (const measurement of measurements ?? []) {
       lines.push(
-        `  ${measurement.criterionId} \u2014 ${measurement.label}: ${measurement.value} (weight ${measurement.weightPercent}% of ${measurement.criterionId})`
+        `  ${measurement.criterionId} \u2014 ${measurement.label}: ${stripTerminalControls(measurement.value)} (weight ${measurement.weightPercent}% of ${measurement.criterionId})`
       );
     }
     lines.push("");
@@ -783,6 +803,8 @@ function renderTerminalCertificate(summary, report) {
       lines.push(
         `  [${finding.severity}] ${stripTerminalControls(finding.label)} \u2192 ${finding.dimension}: ${stripTerminalControls(finding.ruleId)} \u2014 ${stripTerminalControls(finding.message)}${finding.location ? ` (${stripTerminalControls(finding.location)})` : ""}`
       );
+      const note = inheritedFindingNote(finding.ruleId);
+      if (note) lines.push(`    Note: ${note}`);
     }
     const remaining = summary.externalFindingCount - summary.topExternalFindings.length;
     if (remaining > 0) {
@@ -861,6 +883,17 @@ var CLI_FLAG_SPECS = [
     description: "fold in a SARIF/JSON scanner report (repeatable)",
     kind: "ingest"
   },
+  {
+    tokens: ["--subject-repository"],
+    value: "<repo>",
+    description: "name this repository (e.g. github.com/owner/repo) so ingested inputs declaring another repository are recorded as mismatched",
+    kind: "subjectRepository"
+  },
+  {
+    tokens: ["--strict-ingest"],
+    description: "refuse ingested inputs for another repository or commit, observed before this commit, or duplicated (default: record only)",
+    kind: "strictIngest"
+  },
   {
     tokens: ["--rubric-pin"],
     value: "<version>",
@@ -953,6 +986,8 @@ ${usageOptions}
 Verify options:
   --signers <file>       use this allowed-signers file instead of the published one
   --revocations <file>   use this revocations file instead of the published one
+  --input <file>         an ingested input (repeatable); fails unless the supplied set of files
+                         has exactly the sha256 digests report.json records in inputBinding
 
 Issue options:
   --report <file>        the report.json being countersigned (required)
@@ -964,6 +999,7 @@ Issue options:
   --name <display>       pass exactly what the original scan used, or the bytes will not reproduce
   --rubric-pin <version> pass exactly what the original scan used, or the bytes will not reproduce
   --ingest <file>        pass exactly what the original scan used, or the bytes will not reproduce
+                         (--strict-ingest and --subject-repository are read from report.json's inputBinding)
 
 cejel never signs and never reads private key material.
 
@@ -1035,6 +1071,8 @@ async function runWitanCli(args, rubricVersion) {
     ...effectiveRubricVersion ? { rubricVersion: effectiveRubricVersion } : {},
     ingestPatterns: options.ingestPatterns,
     warnOnEmptyIngestMatch: !options.quiet,
+    ...options.strictIngest ? { strictIngest: true } : {},
+    ...options.subjectRepository ? { subjectRepository: options.subjectRepository } : {},
     toolVersion: cliVersion()
   });
   const attestation = createWitanAttestation(report, {
@@ -1198,14 +1236,22 @@ ${members.map((member) => `  - ${member}`).join("\n")}
   process.stderr.write(renderGitLabCodeQualityFooter(result));
   return 0;
 }
-var VERIFY_USAGE = () => `Usage: npx ${NPX_PACKAGE_NAME} verify <report.json> <attestation.json> [issuance.json issuance.json.sig] [--signers <file>] [--revocations <file>]`;
+var VERIFY_USAGE = () => `Usage: npx ${NPX_PACKAGE_NAME} verify <report.json> <attestation.json> [issuance.json issuance.json.sig] [--signers <file>] [--revocations <file>] [--input <file>...]`;
 function parseVerifyArgs(args) {
   const positionals = [];
   let signersPath;
   let revocationsPath;
+  const inputPaths = [];
   for (let index = 0; index < args.length; index += 1) {
     const arg = args[index];
     if (arg === void 0) continue;
+    if (arg === "--input") {
+      const value = args[index + 1];
+      if (!value) throw new Error(`Missing value for ${arg}`);
+      inputPaths.push(resolve3(value));
+      index += 1;
+      continue;
+    }
     if (arg === "--signers" || arg === "--revocations") {
       const value = args[index + 1];
       if (!value) throw new Error(`Missing value for ${arg}`);
@@ -1227,7 +1273,8 @@ function parseVerifyArgs(args) {
     ...issuancePath ? { issuancePath: resolve3(issuancePath) } : {},
     ...issuanceSignaturePath ? { issuanceSignaturePath: resolve3(issuanceSignaturePath) } : {},
     ...signersPath ? { signersPath } : {},
-    ...revocationsPath ? { revocationsPath } : {}
+    ...revocationsPath ? { revocationsPath } : {},
+    ...inputPaths.length > 0 ? { inputPaths } : {}
   };
 }
 function parseIssueArgs(args) {
@@ -1352,6 +1399,26 @@ ${result.errors.map((error) => `  - ${error}`).join("\n")}
     return 1;
   }
   process.stdout.write("Cejel: report/attestation binding verified.\n");
+  if (invocation.inputPaths) {
+    let inputCheck;
+    try {
+      inputCheck = verifyRecordedInputDigests(
+        reportResult.data,
+        invocation.inputPaths,
+        (path) => readFileSync(resolveIngestFilePath(path))
+      );
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      process.stderr.write(
+        `Cejel: input digests not verified \u2014 ${stripTerminalControls(message.replace(/^Cejel: /, ""))}
+`
+      );
+      return 1;
+    }
+    for (const line of inputCheck.lines) process.stdout.write(`${stripTerminalControls(line)}
+`);
+    if (!inputCheck.valid) return 1;
+  }
   if (!invocation.issuancePath || !invocation.issuanceSignaturePath) {
     process.stdout.write("Cejel: signature and signer identity were not verified.\n");
     return 0;
@@ -1490,6 +1557,12 @@ ${attestationBinding.errors.map((error) => `  - ${error}`).join("\n")}
     ...options.rubricPin ? { rubricVersion: options.rubricPin } : {},
     ingestPatterns: options.ingestPatterns,
     warnOnEmptyIngestMatch: true,
+    // The binding policy and the named subject repository are part of the invocation the report
+    // records, so the reproduction reads them from the report it is reproducing rather than from
+    // flags an issuer could forget. Anything else a report states differently fails the byte
+    // comparison below, as it always has.
+    ...suppliedReport.inputBinding?.policy === "strict" ? { strictIngest: true } : {},
+    ...suppliedReport.inputBinding?.scannedSubject.repository ? { subjectRepository: suppliedReport.inputBinding.scannedSubject.repository } : {},
     toolVersion: cliVersion()
   });
   const reproducedBytes = serializeWitanReport(reproduction.report);
@@ -1568,6 +1641,8 @@ function parseArgs(args) {
   let showVersion = false;
   let rubricPin;
   let runAttempt;
+  let strictIngest = false;
+  let subjectRepository;
   const ingestPatterns = [];
   for (let index = 0; index < args.length; index += 1) {
     const arg = args[index];
@@ -1646,6 +1721,16 @@ function parseArgs(args) {
           index += 1;
           break;
         }
+        case "strictIngest":
+          strictIngest = true;
+          break;
+        case "subjectRepository": {
+          const value = args[index + 1];
+          if (!value) throw new Error("Missing value for --subject-repository");
+          subjectRepository = value;
+          index += 1;
+          break;
+        }
         case "runAttempt": {
           const value = args[index + 1];
           if (!value) throw new Error("Missing value for --run-attempt");
@@ -1678,6 +1763,8 @@ function parseArgs(args) {
     showHelp,
     showVersion,
     ingestPatterns,
+    ...strictIngest ? { strictIngest } : {},
+    ...subjectRepository ? { subjectRepository } : {},
     ...rubricPin ? { rubricPin } : {},
     ...runAttempt ? { runAttempt } : {}
   };

package/dist/mcp/index.js

@@ -3,13 +3,13 @@ import { createRequire as __cejelCreateRequire } from 'node:module';
 const require = __cejelCreateRequire(import.meta.url);
 import {
   serveCejelMcpOverStdio
-} from "../chunk-TOQPQPDF.js";
-import "../chunk-ZZHQZW26.js";
-import "../chunk-VGBFZBZQ.js";
-import "../chunk-FSMZV3Y6.js";
+} from "../chunk-KNTBED5T.js";
+import "../chunk-KJVFCZZ3.js";
+import "../chunk-NIWSYJ6N.js";
+import "../chunk-AMVP7L26.js";
 import {
   init_esm_shims
-} from "../chunk-O3MHSK25.js";
+} from "../chunk-AWLKQUI4.js";
 
 // src/mcp/index.ts
 init_esm_shims();

package/dist/packs/d-series/index.js

@@ -3,18 +3,18 @@ import { createRequire as __cejelCreateRequire } from 'node:module';
 const require = __cejelCreateRequire(import.meta.url);
 import {
   listCejelLlmPackFiles
-} from "../../chunk-5PFYOIOS.js";
+} from "../../chunk-WXPGEQBE.js";
 import {
   execGit
-} from "../../chunk-VGBFZBZQ.js";
+} from "../../chunk-NIWSYJ6N.js";
 import {
   require_typescript
-} from "../../chunk-RH6FKREX.js";
+} from "../../chunk-6LVNNJTG.js";
 import {
   __toESM,
   init_esm_shims,
   readRepoText
-} from "../../chunk-O3MHSK25.js";
+} from "../../chunk-AWLKQUI4.js";
 
 // src/packs/d-series/index.ts
 init_esm_shims();

package/dist/packs/decision-contracts/index.js

@@ -3,15 +3,15 @@ import { createRequire as __cejelCreateRequire } from 'node:module';
 const require = __cejelCreateRequire(import.meta.url);
 import {
   external_exports
-} from "../../chunk-FSMZV3Y6.js";
+} from "../../chunk-AMVP7L26.js";
 import {
   require_typescript
-} from "../../chunk-RH6FKREX.js";
+} from "../../chunk-6LVNNJTG.js";
 import {
   __toESM,
   init_esm_shims,
   readRepoText
-} from "../../chunk-O3MHSK25.js";
+} from "../../chunk-AWLKQUI4.js";
 
 // src/packs/decision-contracts/index.ts
 init_esm_shims();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cejel/cejel",
-  "version": "0.6.7",
+  "version": "0.6.8",
   "mcpName": "io.github.BargLabs/cejel",
   "private": false,
   "publishConfig": {