@cejel/cejel 0.6.8 → 0.6.11

package/dist/{chunk-WXPGEQBE.js → chunk-RRPQHEBU.js}

@@ -5,7 +5,7 @@ import {
   describeGitFailure,
   execGit,
   isExpectedGitAbsence
-} from "./chunk-NIWSYJ6N.js";
+} from "./chunk-2UMHJ23V.js";
 import {
   init_esm_shims
 } from "./chunk-AWLKQUI4.js";

package/dist/{chunk-KNTBED5T.js → chunk-S5B5KMSO.js}

@@ -5,7 +5,7 @@ import {
   renderWitanBadgeSvg,
   renderWitanHtmlReport,
   runCejelScan
-} from "./chunk-KJVFCZZ3.js";
+} from "./chunk-4YOIR3E6.js";
 import {
   ZodFirstPartyTypeKind,
   ZodOptional,

package/dist/index.js

@@ -3,15 +3,17 @@ import { createRequire as __cejelCreateRequire } from 'node:module';
 const require = __cejelCreateRequire(import.meta.url);
 import {
   serveCejelMcpOverStdio
-} from "./chunk-KNTBED5T.js";
+} from "./chunk-S5B5KMSO.js";
 import {
   CALLER_CONTEXT_PRODUCT_IDENTITY_NOTICE,
   CERTIFICATE_GLOSSARY,
   EXTERNAL_FINDINGS_DISPLAY_LIMIT,
+  METRIC_DERIVED_FINDING_PATTERN,
   PROSPECTIVE_RUBRIC_NOTICE,
   WITAN_RUBRIC_VERSION_V22,
   WitanReportSchema,
   assertSelectableRubricVersion,
+  buildPlainSummary,
   buildRelyingPartySummary,
   buildVerdictExplanation,
   computeApplicableMeasuredCoverage,
@@ -25,10 +27,14 @@ import {
   formatDimensionsMeasuredSentence,
   formatExternalSourceLine,
   formatLowConfidenceSentence,
+  formatVerdictCapSentence,
+  glossaryEntryForRubric,
   importedAdjustmentSentence,
   inheritedFindingNote,
   inputBindingHeadline,
   isProspectiveRubricVersion,
+  isWitanAbstentionLabel,
+  renderWitanAbstentionHeadline,
   renderWitanBadgeEndpoint,
   renderWitanBadgeSvg,
   renderWitanHtmlReport,
@@ -37,9 +43,10 @@ import {
   serializeWitanReport,
   stripTerminalControls,
   verifyRecordedInputDigests,
-  verifyWitanAttestationBinding
-} from "./chunk-KJVFCZZ3.js";
-import "./chunk-NIWSYJ6N.js";
+  verifyWitanAttestationBinding,
+  witanHistoryAbstentionInstruction
+} from "./chunk-4YOIR3E6.js";
+import "./chunk-2UMHJ23V.js";
 import {
   external_exports
 } from "./chunk-AMVP7L26.js";
@@ -61,7 +68,7 @@ init_esm_shims();
 init_esm_shims();
 var WITAN_ISSUANCE_STATEMENT_TYPE = "https://in-toto.io/Statement/v1";
 var WITAN_ISSUANCE_PREDICATE_TYPE = "https://cejel.dev/attestations/issuance/v1";
-var WITAN_ISSUANCE_FORMAT_VERSION = "1.0";
+var WITAN_ISSUANCE_FORMAT_VERSION = "1.1";
 var WITAN_ISSUANCE_SIGNATURE_NAMESPACE = "cejel-issuance";
 var WITAN_ISSUANCE_PRINCIPAL = "issuance@barglabs.ai";
 var WITAN_ISSUER_NAME = "Barg Labs Inc.";
@@ -89,6 +96,9 @@ var WitanIssuanceStatementSchema = external_exports.object({
       toolVersion: external_exports.string().min(1).max(80),
       rubricVersion: external_exports.string().min(1).max(120),
       rubricBehaviourFingerprint: external_exports.string().regex(/^sha256:[a-f0-9]{64}$/).optional(),
+      // The scan time the reproduction replayed: the attested scan's predicate.generatedAt
+      // (issuance format 1.1 and later). Optional on read, so a 1.0 issuance still verifies.
+      generatedAt: external_exports.string().datetime({ offset: true }).optional(),
       reportByteIdentical: external_exports.literal(true)
     }).strict(),
     issuedAt: external_exports.string().datetime({ offset: true }),
@@ -153,6 +163,7 @@ function createWitanIssuanceStatement(report, options) {
         toolVersion: options.toolVersion,
         rubricVersion: report.rubricVersion,
         ...report.rubricBehaviourFingerprint ? { rubricBehaviourFingerprint: report.rubricBehaviourFingerprint } : {},
+        ...options.reproductionGeneratedAt ? { generatedAt: options.reproductionGeneratedAt } : {},
         reportByteIdentical: true
       },
       issuedAt: options.issuedAt,
@@ -161,6 +172,40 @@ function createWitanIssuanceStatement(report, options) {
     }
   });
 }
+var ISO_8601_INSTANT = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(?::\d{2}(?:\.\d+)?)?(?:Z|[+-]\d{2}:\d{2})$/;
+function readReproductionGeneratedAt(attestation, now) {
+  const predicate = typeof attestation === "object" && attestation !== null ? attestation.predicate : void 0;
+  const value = typeof predicate === "object" && predicate !== null ? predicate.generatedAt : void 0;
+  if (value === void 0 || value === null) {
+    return {
+      ok: false,
+      reason: "the attestation's predicate.generatedAt is missing, so the reproduction has no scan time to replay"
+    };
+  }
+  const instant = typeof value === "string" ? Date.parse(value) : Number.NaN;
+  if (typeof value !== "string" || !ISO_8601_INSTANT.test(value) || !Number.isFinite(instant)) {
+    return {
+      ok: false,
+      reason: `the attestation's predicate.generatedAt is not a valid ISO 8601 time: ${JSON.stringify(value)}`
+    };
+  }
+  if (instant > now.getTime()) {
+    return {
+      ok: false,
+      reason: `the attestation's predicate.generatedAt (${value}) is later than this issuer's clock (${now.toISOString()})`
+    };
+  }
+  return { ok: true, generatedAt: value };
+}
+var NEW_YEAR_WINDOW_MS = 24 * 60 * 60 * 1e3;
+function isWithinDayOfNewYearUtc(generatedAt) {
+  const instant = Date.parse(generatedAt);
+  if (!Number.isFinite(instant)) return false;
+  const year = new Date(instant).getUTCFullYear();
+  const sinceNewYear = instant - Date.UTC(year, 0, 1);
+  const untilNewYear = Date.UTC(year + 1, 0, 1) - instant;
+  return sinceNewYear <= NEW_YEAR_WINDOW_MS || untilNewYear <= NEW_YEAR_WINDOW_MS;
+}
 function verifyWitanIssuanceBinding(statement, options) {
   const parsed = WitanIssuanceStatementSchema.safeParse(statement);
   if (!parsed.success) {
@@ -500,8 +545,15 @@ function normalizeRepoRelativePath(raw) {
   if (path.split("/").some((segment) => segment === ".." || segment === "")) return void 0;
   return path;
 }
-function fingerprint(rule, path, line, identity) {
-  return createHash2("sha256").update(JSON.stringify([rule, path, line, identity])).digest("hex");
+var METRIC_DERIVED_IDENTITY = "metric-derived";
+var NUMBER_PLACEHOLDER = "<n>";
+var NUMBER_PATTERN = /\d+(?:\.\d+)?/g;
+function findingIdentity(summary) {
+  if (METRIC_DERIVED_FINDING_PATTERN.test(summary)) return METRIC_DERIVED_IDENTITY;
+  return summary.replace(NUMBER_PATTERN, NUMBER_PLACEHOLDER);
+}
+function fingerprint(rule, path, line, identity, ordinal) {
+  return createHash2("sha256").update(JSON.stringify([rule, path, line, identity, ordinal])).digest("hex");
 }
 function exportGitLabCodeQuality(report) {
   const ingestedCount = (report.consumedSignals ?? []).reduce(
@@ -519,6 +571,7 @@ function exportGitLabCodeQuality(report) {
   const entries = [];
   let excludedUnlocated = 0;
   const seen = /* @__PURE__ */ new Set();
+  const groupSizes = /* @__PURE__ */ new Map();
   for (const criterion of report.criteria) {
     for (const finding of criterion.findings) {
       const path = finding.evidence.path === void 0 ? void 0 : normalizeRepoRelativePath(finding.evidence.path);
@@ -527,9 +580,14 @@ function exportGitLabCodeQuality(report) {
         excludedUnlocated += 1;
         continue;
       }
-      const print = fingerprint(criterion.id, path, line, finding.summary);
-      if (seen.has(print)) continue;
-      seen.add(print);
+      const exact = JSON.stringify([criterion.id, path, line, finding.summary]);
+      if (seen.has(exact)) continue;
+      seen.add(exact);
+      const identity = findingIdentity(finding.summary);
+      const group = JSON.stringify([criterion.id, path, line, identity]);
+      const ordinal = groupSizes.get(group) ?? 0;
+      groupSizes.set(group, ordinal + 1);
+      const print = fingerprint(criterion.id, path, line, identity, ordinal);
       entries.push({
         description: finding.summary,
         check_name: criterion.id,
@@ -652,9 +710,14 @@ function writeOutputFiles(dir, files, what) {
 // src/terminal.ts
 init_esm_shims();
 function renderMinScoreAbstentionFailure(summary, minScore) {
-  if (summary.verdict !== "Insufficient source" && summary.verdict !== "Insufficient evidence") {
+  if (!isWitanAbstentionLabel(summary.verdict)) {
     throw new Error("A minimum-score abstention message requires an abstained Cejel summary.");
   }
+  const instruction = witanHistoryAbstentionInstruction(summary.verdict);
+  if (instruction !== void 0) {
+    return `Cejel: cannot evaluate the required minimum ${minScore.toFixed(1)}/4.0 because the scan is ${summary.verdict.toLowerCase()}, with no composite score and no verdict. ${instruction}
+`;
+  }
   return `Cejel: cannot evaluate the required minimum ${minScore.toFixed(1)}/4.0 because this repository has ${summary.verdict.toLowerCase()}.
 `;
 }
@@ -673,20 +736,21 @@ function renderMinScoreCoverageFailure(coverage, minScore) {
 `;
 }
 function renderTerminalCertificate(summary, report) {
-  const abstained = summary.verdict === "Insufficient source" || summary.verdict === "Insufficient evidence";
+  const abstained = isWitanAbstentionLabel(summary.verdict);
   if (!abstained && (summary.overallScore === null || summary.codeTrustScore === null || summary.processTrustScore === null)) {
     throw new Error("A scored Cejel summary must carry numeric headline scores.");
   }
   const lines = abstained ? [
     `Cejel Trust Certificate \u2014 ${stripTerminalControls(summary.productDisplayName)}`,
     "",
-    `${summary.verdict} to certify.`,
+    renderWitanAbstentionHeadline(summary.verdict),
     `  ${summary.insufficientSourceReason === void 0 ? "No ratable source or measurable evidence was found." : stripTerminalControls(summary.insufficientSourceReason)}`,
     ""
   ] : [
     `Cejel Trust Certificate \u2014 ${stripTerminalControls(summary.productDisplayName)}`,
     "",
     `Overall: ${formatScore(summary.overallScore)}/4.0 (${summary.verdict})`,
+    ...report && formatVerdictCapSentence(report) ? [`  ${formatVerdictCapSentence(report)}`] : [],
     `  Code trust:    ${formatScore(summary.codeTrustScore)}/4.0`,
     `  Process trust: ${formatScore(summary.processTrustScore)}/4.0`,
     ...report ? [`  ${formatDimensionsMeasuredSentence(report)}`] : [],
@@ -707,6 +771,7 @@ function renderTerminalCertificate(summary, report) {
       ""
     );
   }
+  if (report) lines.push(...renderPlainSummaryLines(buildPlainSummary(report), summary, abstained));
   if (summary.scanLimitations.length > 0) {
     lines.push(
       "LIMITED EVIDENCE \u2014 the score and verdict are qualified by scan limitations:",
@@ -716,7 +781,7 @@ function renderTerminalCertificate(summary, report) {
   }
   if (summary.historyLimitations?.length) {
     lines.push(
-      "HISTORY LIMITATION \u2014 scored as usual, but some criteria read truncated history:",
+      abstained ? "HISTORY LIMITATION \u2014 some criteria read truncated history:" : "HISTORY LIMITATION \u2014 scored as usual, but some criteria read truncated history:",
       ...summary.historyLimitations.map((limitation) => `  - ${stripTerminalControls(limitation)}`),
       ""
     );
@@ -812,7 +877,7 @@ function renderTerminalCertificate(summary, report) {
     }
   }
   lines.push("", "Plain-language glossary:");
-  for (const entry of CERTIFICATE_GLOSSARY) {
+  for (const entry of CERTIFICATE_GLOSSARY.map((curated) => glossaryEntryForRubric(curated, report?.rubricVersion))) {
     lines.push(`  ${entry.term} \u2014 ${entry.definition}`);
   }
   if (report && isProspectiveRubricVersion(report.rubricVersion)) {
@@ -821,6 +886,43 @@ function renderTerminalCertificate(summary, report) {
   return `${lines.join("\n")}
 `;
 }
+var PLAIN_TERMINAL_ITEM_LIMIT = 3;
+function renderPlainSummaryLines(plain, summary, abstained) {
+  const section = (heading, leads, items, empty) => {
+    const shown = items.slice(0, PLAIN_TERMINAL_ITEM_LIMIT);
+    const remaining = items.length - shown.length;
+    return [
+      `${heading} (${items.length}):`,
+      ...leads.filter((lead) => lead !== void 0).map((lead) => `  ${lead}`),
+      ...items.length === 0 ? [`  ${empty}`] : shown.map((item) => `  - ${stripTerminalControls(item)}`),
+      ...remaining > 0 ? [`  ...and ${remaining} more in certificate.html.`] : []
+    ];
+  };
+  const itemLine = (item) => `${item.area} \u2014 ${item.text}${item.location !== void 0 ? ` (${item.location})` : ""}`;
+  const wrongFindings = plain.wrong.filter((item) => item.source.kind === "finding").length;
+  const otherFindings = summary.findingCount - wrongFindings;
+  const topFindingsNote = !abstained && otherFindings > 0 ? `Top findings below counts ${summary.findingCount} finding${summary.findingCount === 1 ? "" : "s"} in all, including ${otherFindings} informational finding${otherFindings === 1 ? "" : "s"} not listed here.` : void 0;
+  return [
+    "In plain words (the full lists, with links to the evidence, are in certificate.html):",
+    ...plain.prospectiveNotice !== void 0 ? [`  ${plain.prospectiveNotice}`] : [],
+    ...section("What holds", [plain.areasLine, plain.holdsLead], plain.holds.map(itemLine), plain.holdsNote ?? ""),
+    ...section(
+      "What is wrong",
+      [plain.wrongNote, topFindingsNote],
+      plain.wrong.map((item) => `${item.level === "critical" ? "Critical" : "Warning"}: ${itemLine(item)}`),
+      "Cejel recorded no critical or warning-level problem in what it checked."
+    ),
+    ...section("What is not known", [], plain.notKnown.map(itemLine), "Cejel listed no gap here; anything it did not measure is still not established."),
+    ...section(
+      "What to check next",
+      [],
+      plain.checkNext.map((check) => `${check.area} \u2014 ${check.text}`),
+      "Nothing to check from these lists."
+    ),
+    plain.notCovered,
+    ""
+  ];
+}
 function formatScore(score) {
   if (score === null) throw new Error("A scored Cejel summary must carry numeric scores.");
   return score.toFixed(1);
@@ -1095,7 +1197,13 @@ async function runWitanCli(args, rubricVersion) {
       },
       { name: "badge.json", contents: JSON.stringify(renderWitanBadgeEndpoint(report), null, 2) },
       { name: "badge.svg", contents: renderWitanBadgeSvg(report) },
-      { name: "summary.json", contents: JSON.stringify(summary, null, 2) }
+      // plainSummary (goal_cejel_four_question_summary_2026-11-02) is added here, at the one place
+      // summary.json is written, so buildWitanCliSummary's shape (the MCP and HTTP responses) and
+      // every key before it are unchanged.
+      {
+        name: "summary.json",
+        contents: JSON.stringify({ ...summary, plainSummary: buildPlainSummary(report) }, null, 2)
+      }
     ],
     "scan output"
   );
@@ -1541,6 +1649,12 @@ ${attestationBinding.errors.map((error) => `  - ${error}`).join("\n")}
     );
     return 1;
   }
+  const scanTime = readReproductionGeneratedAt(attestationArtifact.value, /* @__PURE__ */ new Date());
+  if (!scanTime.ok) {
+    process.stderr.write(`Cejel: refusing to issue \u2014 ${scanTime.reason}.
+`);
+    return 1;
+  }
   let keyContents;
   try {
     keyContents = readFileSync(options.keyPath, "utf8");
@@ -1563,7 +1677,8 @@ ${attestationBinding.errors.map((error) => `  - ${error}`).join("\n")}
     // comparison below, as it always has.
     ...suppliedReport.inputBinding?.policy === "strict" ? { strictIngest: true } : {},
     ...suppliedReport.inputBinding?.scannedSubject.repository ? { subjectRepository: suppliedReport.inputBinding.scannedSubject.repository } : {},
-    toolVersion: cliVersion()
+    toolVersion: cliVersion(),
+    generatedAt: scanTime.generatedAt
   });
   const reproducedBytes = serializeWitanReport(reproduction.report);
   const reproducedSha256 = createHash3("sha256").update(reproducedBytes, "utf8").digest("hex");
@@ -1577,6 +1692,12 @@ ${attestationBinding.errors.map((error) => `  - ${error}`).join("\n")}
         "  Check that the checkout is at the certificate revision, that the @cejel/cejel version matches",
         "  report.json's toolVersion, and that --product-name/--name/--rubric-pin/--ingest match the",
         "  original invocation. An issuance that cannot reproduce is not issued.",
+        // The reproduction replays the scan's instant, but v17's B4 reads that instant's year in
+        // the local time zone. Near a new year two hosts can disagree on it; name the setting,
+        // never guess a zone.
+        ...isWithinDayOfNewYearUtc(scanTime.generatedAt) ? [
+          `  The scan's generatedAt (${scanTime.generatedAt}) is within 24 hours of a new year in UTC, and v17's B4 freshness year is read in the scan host's local time: an issuer in another time zone may need to re-run with the TZ environment variable set to the scan host's.`
+        ] : [],
         ""
       ].join("\n")
     );
@@ -1588,6 +1709,7 @@ ${attestationBinding.errors.map((error) => `  - ${error}`).join("\n")}
     issuerKeyFingerprint: issuerKey.fingerprint,
     toolVersion: cliVersion(),
     issuedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    reproductionGeneratedAt: scanTime.generatedAt,
     engagementRef: options.engagementRef
   });
   const issuancePath = join2(options.outDir, ISSUANCE_OUTPUT_FILE);

package/dist/mcp/index.js

@@ -3,9 +3,9 @@ import { createRequire as __cejelCreateRequire } from 'node:module';
 const require = __cejelCreateRequire(import.meta.url);
 import {
   serveCejelMcpOverStdio
-} from "../chunk-KNTBED5T.js";
-import "../chunk-KJVFCZZ3.js";
-import "../chunk-NIWSYJ6N.js";
+} from "../chunk-S5B5KMSO.js";
+import "../chunk-4YOIR3E6.js";
+import "../chunk-2UMHJ23V.js";
 import "../chunk-AMVP7L26.js";
 import {
   init_esm_shims

package/dist/packs/d-series/index.js

@@ -3,10 +3,10 @@ import { createRequire as __cejelCreateRequire } from 'node:module';
 const require = __cejelCreateRequire(import.meta.url);
 import {
   listCejelLlmPackFiles
-} from "../../chunk-WXPGEQBE.js";
+} from "../../chunk-RRPQHEBU.js";
 import {
   execGit
-} from "../../chunk-NIWSYJ6N.js";
+} from "../../chunk-2UMHJ23V.js";
 import {
   require_typescript
 } from "../../chunk-6LVNNJTG.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cejel/cejel",
-  "version": "0.6.8",
+  "version": "0.6.11",
   "mcpName": "io.github.BargLabs/cejel",
   "private": false,
   "publishConfig": {
@@ -31,7 +31,7 @@
     "type": "git",
     "url": "git+https://github.com/BargLabs/cejel.git"
   },
-  "packageManager": "pnpm@9.0.0",
+  "packageManager": "pnpm@9.0.0+sha512.b4106707c7225b1748b61595953ccbebff97b54ad05d002aa3635f633b9c53cd666f7ce9b8bc44704f1fa048b9a49b55371ab2d9e9d667d1efe2ef1514bcd513",
   "type": "module",
   "bin": {
     "cejel": "dist/index.js",