@clear-capabilities/agentic-security-scanner 0.134.0 → 0.136.9

package/dist/113.index.js

@@ -52,7 +52,6 @@ export const modules = {
 
 
 
-const STATE_DIR = '.agentic-security';
 const LOG_FILE = 'fix-metrics.jsonl';
 
 // Below this many samples a percentile is an artifact of the sample, not a
@@ -65,7 +64,7 @@ const RELIABLE_N = 10;
 const FIX_STAGES = Object.freeze(['rescan', 'lint', 'tests', 'honesty', 'poc']);
 
 function _logPath(scanRoot) {
-  return node_path__WEBPACK_IMPORTED_MODULE_1__.join(scanRoot, STATE_DIR, LOG_FILE);
+  return (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__/* .statePath */ .BQ)(scanRoot, LOG_FILE);
 }
 
 /**
@@ -77,9 +76,10 @@ function _logPath(scanRoot) {
 function recordFixAttempt(scanRoot, record) {
   if (!scanRoot || !record || typeof record !== 'object') return false;
   try {
-    const dir = node_path__WEBPACK_IMPORTED_MODULE_1__.join(scanRoot, STATE_DIR);
+    const dir = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__/* .stateDir */ .Pn)(scanRoot);
     if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.isSafeStateDir)(dir)) return false;
-    node_fs__WEBPACK_IMPORTED_MODULE_0__.mkdirSync(dir, { recursive: true });
+    if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.stateWritesEnabled)()) return false;
+  node_fs__WEBPACK_IMPORTED_MODULE_0__.mkdirSync(dir, { recursive: true });
     // One writeSync of one newline-terminated line: a concurrent reader sees
     // whole records or nothing, and a torn tail is dropped on read.
     node_fs__WEBPACK_IMPORTED_MODULE_0__.appendFileSync(_logPath(scanRoot), JSON.stringify(record) + '\n', 'utf8');
@@ -266,7 +266,16 @@ function _detectRunner(scanRoot) {
     } catch { return null; }
   })();
   if (pkg && pkg.scripts && pkg.scripts.test && !/no test specified/.test(String(pkg.scripts.test))) {
-    return { runner: 'npm', cmd: 'npm', args: ['test', '--silent', '--', '--passWithNoTests'] };
+    // --passWithNoTests is Jest-specific CLI syntax — appending it
+    // unconditionally broke every non-Jest npm test script (mocha, vitest,
+    // ava, tap, or a plain node script) with an "unrecognized option" exit,
+    // failing verification for a reason that has nothing to do with
+    // whether the patch actually broke anything. Only add it when Jest is
+    // actually the configured runner.
+    const usesJest = /\bjest\b/.test(String(pkg.scripts.test))
+      || Boolean(pkg.devDependencies?.jest) || Boolean(pkg.dependencies?.jest);
+    const args = usesJest ? ['test', '--silent', '--', '--passWithNoTests'] : ['test', '--silent'];
+    return { runner: 'npm', cmd: 'npm', args };
   }
   if (has('pytest.ini') || has('pyproject.toml') || has('setup.cfg')) {
     return { runner: 'pytest', cmd: 'pytest', args: ['-q', '--no-header', '-x'] };
@@ -406,8 +415,8 @@ var external_node_child_process_ = __webpack_require__(1421);
 var external_node_fs_ = __webpack_require__(3024);
 // EXTERNAL MODULE: external "node:path"
 var external_node_path_ = __webpack_require__(6760);
-// EXTERNAL MODULE: ./src/engine.js + 501 modules
-var engine = __webpack_require__(5695);
+// EXTERNAL MODULE: ./src/engine.js + 196 modules
+var engine = __webpack_require__(2739);
 ;// CONCATENATED MODULE: ./src/posture/fix-honesty-gate.js
 // Deterministic honesty gates on fix / finding output (#7).
 //

package/dist/117.index.js

@@ -12,6 +12,7 @@ export const modules = {
 /* unused harmony exports badgeFromScanRoot, renderSvg, _internal */
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6760);
+/* harmony import */ var _posture_state_dir_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(1174);
 // Live SVG badge generator (v0.72).
 //
 // Every repo can drop a badge in its README pulling from the latest scan:
@@ -42,6 +43,7 @@ export const modules = {
 
 
 
+
 const COLORS = {
   critical:    '#e05d44',  // red
   high:        '#fe7d37',  // orange
@@ -56,7 +58,7 @@ const SEVERITIES = ['critical', 'high', 'medium', 'low', 'info'];
 
 function _readLastScan(scanRoot) {
   if (!scanRoot) return null;
-  const fp = node_path__WEBPACK_IMPORTED_MODULE_1__.join(scanRoot, '.agentic-security', 'last-scan.json');
+  const fp = (0,_posture_state_dir_js__WEBPACK_IMPORTED_MODULE_2__/* .statePath */ .BQ)(scanRoot, 'last-scan.json');
   if (!node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(fp)) return null;
   try { return JSON.parse(node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(fp, 'utf8')); }
   catch { return null; }

package/dist/178.index.js

@@ -13,7 +13,7 @@ export const modules = {
 /* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1421);
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(3024);
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6760);
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(5695);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(2739);
 // Time-travel + counterfactual scanning (v0.68).
 //
 // Two new modes that exploit the pure-input shape of runFullScan:

package/dist/207.index.js

@@ -6,9 +6,10 @@ export const modules = {
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   computeRunAttestation: () => (/* binding */ computeRunAttestation)
+/* harmony export */   computeRunAttestation: () => (/* binding */ computeRunAttestation),
+/* harmony export */   verifyRunAttestation: () => (/* binding */ verifyRunAttestation)
 /* harmony export */ });
-/* unused harmony exports ATTESTATION_CANONICALISATION, verifyRunAttestation */
+/* unused harmony export ATTESTATION_CANONICALISATION */
 /* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(7598);
 /* harmony import */ var _integrity_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(1130);
 // R4 — determinism as a contract.
@@ -202,11 +203,11 @@ function verifyRunAttestation(attestation, inputs = {}) {
   }
   if (attestation.signature) {
     let expected;
-    try { expected = signLastScan(attestation.digest); }
+    try { expected = (0,_integrity_js__WEBPACK_IMPORTED_MODULE_1__/* .signLastScan */ .lU)(attestation.digest); }
     catch { return { ok: false, reason: 'signature present but no key material available to check it' }; }
     const a = Buffer.from(String(attestation.signature), 'hex');
     const b = Buffer.from(expected, 'hex');
-    if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
+    if (a.length !== b.length || !node_crypto__WEBPACK_IMPORTED_MODULE_0__.timingSafeEqual(a, b)) {
       return { ok: false, reason: 'signature does not verify under this install key' };
     }
     return { ok: true, reason: 'digest and per-install signature verify' };

package/dist/220.index.js

@@ -15,6 +15,7 @@ export const modules = {
 /* harmony import */ var node_fs_promises__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1455);
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(3024);
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6760);
+/* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(1174);
 // Watch mode — continuous incremental scan as the developer edits.
 //
 // Spawns a long-running scan watcher that:
@@ -40,7 +41,7 @@ export const modules = {
 
 
 
-const STATE = '.agentic-security';
+
 const STATUS_MD   = 'watch-status.md';
 const STATUS_JSON = 'watch-status.json';
 const DEBOUNCE_MS = 350;
@@ -102,7 +103,8 @@ function renderStatusLine(delta) {
  * Persist watch-status.{md,json}. Cheap atomic write (write tmp, rename).
  */
 function persistStatus(scanRoot, delta) {
-  const dir = node_path__WEBPACK_IMPORTED_MODULE_2__.join(scanRoot, STATE);
+  const dir = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_3__/* .stateDir */ .Pn)(scanRoot);
+  if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_3__.stateWritesEnabled)()) return;
   try { node_fs__WEBPACK_IMPORTED_MODULE_1__.mkdirSync(dir, { recursive: true }); } catch {}
   const status = {
     ts: new Date().toISOString(),
@@ -139,7 +141,7 @@ function persistStatus(scanRoot, delta) {
  * Read the latest watch-status (returns null if none).
  */
 function readStatus(scanRoot) {
-  return _readJsonSafe(path.join(scanRoot, STATE, STATUS_JSON));
+  return _readJsonSafe(statePath(scanRoot, STATUS_JSON));
 }
 
 /**

package/dist/238.index.js

@@ -52,7 +52,6 @@ export const modules = {
 
 
 
-const STATE_DIR = '.agentic-security';
 const LOG_FILE = 'fix-metrics.jsonl';
 
 // Below this many samples a percentile is an artifact of the sample, not a
@@ -65,7 +64,7 @@ const RELIABLE_N = 10;
 const FIX_STAGES = Object.freeze(['rescan', 'lint', 'tests', 'honesty', 'poc']);
 
 function _logPath(scanRoot) {
-  return node_path__WEBPACK_IMPORTED_MODULE_1__.join(scanRoot, STATE_DIR, LOG_FILE);
+  return (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__/* .statePath */ .BQ)(scanRoot, LOG_FILE);
 }
 
 /**
@@ -77,9 +76,10 @@ function _logPath(scanRoot) {
 function recordFixAttempt(scanRoot, record) {
   if (!scanRoot || !record || typeof record !== 'object') return false;
   try {
-    const dir = node_path__WEBPACK_IMPORTED_MODULE_1__.join(scanRoot, STATE_DIR);
+    const dir = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__/* .stateDir */ .Pn)(scanRoot);
     if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.isSafeStateDir)(dir)) return false;
-    node_fs__WEBPACK_IMPORTED_MODULE_0__.mkdirSync(dir, { recursive: true });
+    if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.stateWritesEnabled)()) return false;
+  node_fs__WEBPACK_IMPORTED_MODULE_0__.mkdirSync(dir, { recursive: true });
     // One writeSync of one newline-terminated line: a concurrent reader sees
     // whole records or nothing, and a torn tail is dropped on read.
     node_fs__WEBPACK_IMPORTED_MODULE_0__.appendFileSync(_logPath(scanRoot), JSON.stringify(record) + '\n', 'utf8');

package/dist/317.index.js

@@ -0,0 +1,300 @@
+export const id = 317;
+export const ids = [317];
+export const modules = {
+
+/***/ 8317:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   buildEvidenceBundle: () => (/* binding */ buildEvidenceBundle),
+/* harmony export */   ensureKeyPair: () => (/* binding */ ensureKeyPair),
+/* harmony export */   keyPaths: () => (/* binding */ keyPaths),
+/* harmony export */   signEvidenceBundle: () => (/* binding */ signEvidenceBundle),
+/* harmony export */   verifyEvidenceBundle: () => (/* binding */ verifyEvidenceBundle)
+/* harmony export */ });
+/* unused harmony exports BUNDLE_SCHEMA, canonicalBytes, canonicalJson */
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
+/* harmony import */ var node_os__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(8161);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6760);
+/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(7598);
+// Per-finding evidence bundles, signed so a THIRD PARTY can verify them.
+// PRD Phase 2 / D2.
+//
+// WHAT WAS MISSING
+// ----------------
+// `attestation.js` already turns a run into a checkable digest, and it is
+// explicit about its own ceiling: the signature is a per-install SYMMETRIC HMAC,
+// so it is "tamper-evidence for the operator, not third-party non-repudiation."
+// Anyone who can verify it can also forge it. That is fine for detecting local
+// corruption and useless for handing a finding to somebody else.
+//
+// This module closes that gap for the artefact that actually travels: a single
+// finding plus the evidence behind it. A buyer, an auditor, or a downstream
+// consumer can check the bundle with the PUBLIC key alone, having never had
+// access to ours.
+//
+// WHY A SEPARATE MODULE RATHER THAN EXTENDING attestation.js
+// ----------------------------------------------------------
+// They answer different questions and must not be conflated. A run attestation
+// says "this set of findings came from this engine, ruleset and bundle". An
+// evidence bundle says "THIS finding is backed by THIS evidence, and here is
+// proof the claim was not edited after the fact." One is about reproducibility,
+// the other about portability. Merging them would produce an artefact that is
+// worse at both.
+//
+// WHAT A BUNDLE PROVES, AND WHAT IT DOES NOT
+// -------------------------------------------
+// PROVES — the bundle's contents are exactly what the holder of the signing key
+// attested, unmodified. Nothing in it has been added, removed, or edited since.
+//
+// DOES NOT PROVE — that the finding is real. A signature is an integrity claim,
+// never a correctness claim. An `unproven` finding in a signed bundle is still
+// an unproven finding; the signature only stops someone silently upgrading the
+// word `unproven` to `execution-proven` in transit. Both statements are carried
+// INSIDE the bundle so they travel with it and cannot be dropped by a
+// summariser.
+//
+// The evidence chain is deliberately the honest one this engine already
+// computes: the proof tier, what the sandbox observed, which backend ran it, the
+// taint path if there is one. A bundle for a regex finding says so plainly
+// rather than dressing it up.
+
+
+
+
+
+
+const BUNDLE_SCHEMA = 'agentic-security/finding-evidence@1';
+
+/** Where the Ed25519 signing key lives. Mirrors integrity.js's key handling. */
+function keyDir() {
+  const xdg = process.env.XDG_CONFIG_HOME || node_path__WEBPACK_IMPORTED_MODULE_2__.join(node_os__WEBPACK_IMPORTED_MODULE_1__.homedir(), '.config');
+  return node_path__WEBPACK_IMPORTED_MODULE_2__.join(xdg, 'agentic-security');
+}
+const PRIVATE_KEY_FILE = 'attest-key.pem';
+const PUBLIC_KEY_FILE = 'attest-key.pub.pem';
+
+function keyPaths(dir = keyDir()) {
+  return {
+    privateKey: node_path__WEBPACK_IMPORTED_MODULE_2__.join(dir, PRIVATE_KEY_FILE),
+    publicKey: node_path__WEBPACK_IMPORTED_MODULE_2__.join(dir, PUBLIC_KEY_FILE),
+  };
+}
+
+/**
+ * Load the signing key pair, generating one on first use.
+ *
+ * Ed25519 from node:crypto — no new dependency, and deliberately not a
+ * transparency-log scheme: those need a network round trip, and this project
+ * does not make runtime cloud calls. A log-backed option can layer on later
+ * without changing the bundle format.
+ */
+function ensureKeyPair(dir = keyDir()) {
+  const p = keyPaths(dir);
+
+  // NO existsSync-then-read. This project's own scanner flagged the first
+  // version of this function for TOCTOU (CWE-367) and it was right: between an
+  // existence check and the read, an attacker who can write this directory can
+  // swap the file, and the thing being swapped is a SIGNING KEY. Winning that
+  // race means we sign with a key the attacker controls, which defeats the
+  // entire point of the module. Read first and treat absence as the exceptional
+  // case — there is then no window between the check and the use, because there
+  // is no check.
+  try {
+    const privateKeyPem = node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(p.privateKey, 'utf8');
+    const publicKeyPem = node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(p.publicKey, 'utf8');
+    if (privateKeyPem && publicKeyPem) {
+      return { privateKeyPem, publicKeyPem, created: false, ...p };
+    }
+  } catch { /* missing or unreadable — fall through and generate */ }
+
+  const { privateKey, publicKey } = node_crypto__WEBPACK_IMPORTED_MODULE_3__.generateKeyPairSync('ed25519');
+  const privateKeyPem = privateKey.export({ type: 'pkcs8', format: 'pem' });
+  const publicKeyPem = publicKey.export({ type: 'spki', format: 'pem' });
+  node_fs__WEBPACK_IMPORTED_MODULE_0__.mkdirSync(dir, { recursive: true, mode: 0o700 });
+
+  // `wx` — exclusive create. If another process generated a key between our
+  // failed read and this write, we must NOT clobber it: every bundle already
+  // signed with that key would silently stop verifying. On collision, re-read
+  // and use the winner's key.
+  try {
+    node_fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(p.privateKey, privateKeyPem, { mode: 0o600, flag: 'wx' });
+    node_fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(p.publicKey, publicKeyPem, { mode: 0o644, flag: 'w' });
+    return { privateKeyPem, publicKeyPem, created: true, ...p };
+  } catch (e) {
+    if (e.code !== 'EEXIST') throw e;
+    // We lost the race on the private key — someone else's 'wx' won.
+    // Their public-key write follows immediately after their private-key
+    // write but is not itself atomic with it, so it may not have landed
+    // yet: a bare read here would throw an uncaught ENOENT on a genuinely
+    // transient state, not a real error. Retry briefly rather than crash.
+    const sleepBuf = new Int32Array(new SharedArrayBuffer(4));
+    for (let attempt = 0; ; attempt++) {
+      try {
+        return {
+          privateKeyPem: node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(p.privateKey, 'utf8'),
+          publicKeyPem: node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(p.publicKey, 'utf8'),
+          created: false,
+          ...p,
+        };
+      } catch (readErr) {
+        if (readErr.code !== 'ENOENT' || attempt >= 50) throw readErr;
+        Atomics.wait(sleepBuf, 0, 0, 10); // 10ms; ~500ms total budget
+      }
+    }
+  }
+}
+
+/**
+ * Canonical bytes for signing.
+ *
+ * An ALLOWLIST, exactly as attestation.js canonicalises: a field that is not
+ * named here is not signed, so a future addition cannot silently enter the
+ * signed surface. Sorted keys, so serialisation order cannot change the
+ * signature.
+ */
+function canonicalBytes(bundle) {
+  const signed = {
+    schema: bundle.schema,
+    finding: bundle.finding,
+    evidence: bundle.evidence,
+    engine: bundle.engine,
+    proves: bundle.proves,
+    doesNotProve: bundle.doesNotProve,
+  };
+  return Buffer.from(canonicalJson(signed), 'utf8');
+}
+
+/**
+ * Deterministic JSON: keys sorted at EVERY level, arrays order-preserving.
+ *
+ * Written by hand rather than using JSON.stringify's replacer argument, and the
+ * reason matters. The first version of this function did
+ * `JSON.stringify(signed, Object.keys(signed).sort())`, believing the array
+ * argument was a top-level field allowlist. It is not — a replacer ARRAY is a
+ * key filter applied at every nesting depth, so every nested object serialised
+ * as `{}` and the signature covered nothing but the two prose strings. A bundle
+ * whose severity was edited from `high` to `critical` verified as authentic.
+ *
+ * That is the worst possible failure for this module: a security feature that
+ * appears to work, produces a valid-looking signature, and protects nothing. It
+ * was caught by tampering with a bundle and expecting verification to fail —
+ * which is why the tamper cases in the test file are not optional extras.
+ */
+function canonicalJson(value) {
+  if (value === null || typeof value !== 'object') return JSON.stringify(value ?? null);
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(',')}]`;
+  const keys = Object.keys(value).sort();
+  return `{${keys.map(k => `${JSON.stringify(k)}:${canonicalJson(value[k])}`).join(',')}}`;
+}
+
+const PROVES =
+  'The contents of this bundle are exactly what the signer attested, unmodified.';
+const DOES_NOT_PROVE =
+  'That the finding is real. A signature is an integrity claim, never a correctness ' +
+  'claim — read `evidence.proofTier` for how well-supported the finding actually is. ' +
+  'An unproven finding in a signed bundle is still an unproven finding.';
+
+/**
+ * Build an unsigned bundle from a finding.
+ *
+ * Everything here is copied from what the engine already computed. Nothing is
+ * inferred, and a missing field stays missing rather than being defaulted into
+ * something more confident-looking than the truth.
+ */
+function buildEvidenceBundle(finding, { engineVersion, rulesetVersion, bundleSha, commit } = {}) {
+  if (!finding || typeof finding !== 'object') return null;
+  return {
+    schema: BUNDLE_SCHEMA,
+    finding: {
+      id: finding.id ?? null,
+      stableId: finding.stableId ?? null,
+      severity: finding.severity ?? null,
+      file: finding.file ?? null,
+      line: finding.line ?? null,
+      vuln: finding.vuln ?? null,
+      cwe: finding.cwe ?? null,
+      family: finding.family ?? null,
+      parser: finding.parser ?? null,
+    },
+    evidence: {
+      // The honest chain, in the vocabulary the engine already uses.
+      proofTier: finding.proofTier ?? null,
+      proofEvidence: finding.proofEvidence ?? null,
+      confidence: finding.confidence ?? null,
+      exploitability: finding.exploitability ?? null,
+      unreachable: finding.unreachable ?? null,
+      // Present only for the layers that produce them; absent means absent.
+      taintPath: finding.pathSteps ?? finding.exampleFlows ?? null,
+      discovery: finding.discovery ?? null,
+    },
+    engine: {
+      engineVersion: engineVersion ?? null,
+      rulesetVersion: rulesetVersion ?? null,
+      bundleSha: bundleSha ?? null,
+      commit: commit ?? null,
+    },
+    proves: PROVES,
+    doesNotProve: DOES_NOT_PROVE,
+  };
+}
+
+/** Sign a bundle. Returns a new object; the input is not mutated. */
+function signEvidenceBundle(bundle, privateKeyPem) {
+  const sig = node_crypto__WEBPACK_IMPORTED_MODULE_3__.sign(null, canonicalBytes(bundle), privateKeyPem);
+  return {
+    ...bundle,
+    signature: {
+      algorithm: 'ed25519',
+      canonicalisation: BUNDLE_SCHEMA,
+      value: sig.toString('base64'),
+    },
+  };
+}
+
+/**
+ * Verify a bundle with a PUBLIC key. This is the whole point: the verifier
+ * never needs, and never had, the signing key.
+ *
+ * Returns {ok, reason}. Never throws — a malformed bundle from an untrusted
+ * source is an expected input, not an exceptional one.
+ */
+// The complete set of top-level keys a legitimately-built, signed bundle can
+// carry — buildEvidenceBundle's six plus signEvidenceBundle's `signature`.
+// EA-03 (Stage-0 audit, 2026): canonicalBytes SIGNS an allowlist of fields;
+// verifyEvidenceBundle never checked for keys OUTSIDE that allowlist, so a
+// bundle with a fabricated `verdict`/`proofLevel`/anything-else stapled on
+// after signing verified as authentic — the signature simply never covered
+// those bytes. Rejecting unknown keys here closes that; it must exactly match
+// what buildEvidenceBundle+signEvidenceBundle actually produce, or a
+// legitimate bundle would start failing verification.
+const BUNDLE_TOP_LEVEL_KEYS = new Set([
+  'schema', 'finding', 'evidence', 'engine', 'proves', 'doesNotProve', 'signature',
+]);
+
+function verifyEvidenceBundle(bundle, publicKeyPem) {
+  if (!bundle || typeof bundle !== 'object') return { ok: false, reason: 'bundle is not an object' };
+  if (bundle.schema !== BUNDLE_SCHEMA) return { ok: false, reason: `unrecognised schema: ${bundle.schema}` };
+  const unknownKeys = Object.keys(bundle).filter(k => !BUNDLE_TOP_LEVEL_KEYS.has(k));
+  if (unknownKeys.length) {
+    return { ok: false, reason: `unrecognised top-level key(s) not covered by the signature: ${unknownKeys.join(', ')}` };
+  }
+  const sig = bundle.signature;
+  if (!sig?.value) return { ok: false, reason: 'bundle is unsigned' };
+  if (sig.algorithm !== 'ed25519') return { ok: false, reason: `unsupported algorithm: ${sig.algorithm}` };
+  if (!publicKeyPem) return { ok: false, reason: 'no public key supplied' };
+  let ok = false;
+  try {
+    ok = node_crypto__WEBPACK_IMPORTED_MODULE_3__.verify(null, canonicalBytes(bundle), publicKeyPem, Buffer.from(sig.value, 'base64'));
+  } catch (e) {
+    return { ok: false, reason: `verification error: ${e.message}` };
+  }
+  return ok
+    ? { ok: true, reason: null }
+    : { ok: false, reason: 'signature does not match the bundle contents — it was modified after signing' };
+}
+
+
+/***/ })
+
+};

package/dist/384.index.js

@@ -8,7 +8,7 @@ export const modules = {
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   scanCredentials: () => (/* reexport safe */ _engine_js__WEBPACK_IMPORTED_MODULE_0__.Sv)
 /* harmony export */ });
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(5695);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(2739);
 // Secrets submodule view of the engine — credential + entropy + TODO scanning.