@clear-capabilities/agentic-security-scanner 0.142.0 → 0.144.0

package/dist/526.index.js

@@ -8,9 +8,10 @@ export const modules = {
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   I3: () => (/* binding */ recordFixAttempt),
 /* harmony export */   fixDurationReport: () => (/* binding */ fixDurationReport),
-/* harmony export */   renderFixDurationSummary: () => (/* binding */ renderFixDurationSummary)
+/* harmony export */   renderFixDurationSummary: () => (/* binding */ renderFixDurationSummary),
+/* harmony export */   sU: () => (/* binding */ loadFixAttempts)
 /* harmony export */ });
-/* unused harmony exports FIX_STAGES, loadFixAttempts, bucketOf, summarizeFixDurations, _internals, summarizeFixAxes, renderFixAxes */
+/* unused harmony exports FIX_STAGES, bucketOf, summarizeFixDurations, _internals, summarizeFixAxes, renderFixAxes */
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6760);
 /* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(1174);
@@ -310,8 +311,8 @@ var external_node_child_process_ = __webpack_require__(1421);
 var external_node_fs_ = __webpack_require__(3024);
 // EXTERNAL MODULE: external "node:path"
 var external_node_path_ = __webpack_require__(6760);
-// EXTERNAL MODULE: ./src/engine.js + 200 modules
-var engine = __webpack_require__(3474);
+// EXTERNAL MODULE: ./src/engine.js + 211 modules
+var engine = __webpack_require__(7087);
 ;// CONCATENATED MODULE: ./src/posture/fix-honesty-gate.js
 // Deterministic honesty gates on fix / finding output (#7).
 //
@@ -456,23 +457,64 @@ function computeFixTier(signals) {
 }
 
 /**
- * Compose the three gates for a single fix's output.
+ * FR-308: cross-check a fix-completeness TIER against MECHANICAL evidence,
+ * when any is available. `signals` (computeFixTier's input) is agent-
+ * self-reported — this module cannot compute sinkSignatureChanged /
+ * allCallersRouted / testDiscriminates itself (see the header above: "the
+ * gate can only run against claims the AGENT self-reports... nothing here
+ * is server-computable"). `pocLeg` is different: fix-verify.js's PoC leg is
+ * a REAL execution result (posture/CLAUDE.md's execution-proof tiers), not
+ * a claim. When it is available and shows the proof-of-concept STILL
+ * demonstrates the vulnerability against the patch, a self-reported FULL
+ * tier is not merely internally inconsistent — it is REFUTED by fact. This
+ * is the literal "a mitigation or workaround cannot be represented as a
+ * full fix" acceptance criterion, now backed by mechanical evidence where
+ * it exists rather than by self-report consistency alone.
  *
- * ok = residual-honesty ok AND evidence-citation ok, further constrained by the
- * tier/residual consistency invariant:
+ * A `pocLeg` of `not-requested` or `inconclusive` carries no mechanical
+ * signal either way and is a no-op here — this check can only ever ADD a
+ * violation on real contrary evidence, never manufacture one from absence.
+ *
+ * @param {string} tier
+ * @param {{status: string, reason?: string}|null} pocLeg
+ * @returns {{ ok: boolean, violations: string[] }}
+ */
+function checkMechanicalTierEvidence(tier, pocLeg) {
+  if (!pocLeg || typeof pocLeg !== 'object') return { ok: true, violations: [] };
+  if (tier === 'FULL' && pocLeg.status === 'still-exploitable') {
+    return {
+      ok: false,
+      violations: [`tier 'FULL' is refuted by mechanical evidence: the proof-of-concept still demonstrates the vulnerability against the patch${pocLeg.reason ? ` (${pocLeg.reason})` : ''}`],
+    };
+  }
+  return { ok: true, violations: [] };
+}
+
+/**
+ * Compose the four gates for a single fix's output.
+ *
+ * ok = residual-honesty ok AND evidence-citation ok AND mechanical-tier-
+ * evidence ok, further constrained by the tier/residual consistency
+ * invariant:
  *   - a FULL tier must NOT carry a residual (a full fix has nothing left);
  *   - a non-FULL tier MUST document a residual (say what's still open).
  *
  * @param {{ residual?: string, verdict?: string, evidence?: any, signals?: object }} input
+ * @param {{ pocLeg?: object|null }} [mechanical] - FR-308: optional real
+ *   execution evidence (fix-verify.js's pocLeg) to cross-check the
+ *   self-reported tier against. Omitted entirely by any caller that has no
+ *   PoC leg to offer — this parameter never REQUIRES mechanical evidence,
+ *   it only USES it when present.
  * @returns {{ ok: boolean, tier: string, violations: string[] }}
  */
-function gateFixOutput({ residual, verdict, evidence, signals } = {}) {
+function gateFixOutput({ residual, verdict, evidence, signals } = {}, { pocLeg = null } = {}) {
   const tier = computeFixTier(signals);
   const residualCheck = checkResidualHonesty(residual);
   const evidenceCheck = requireCitedEvidence(verdict, evidence);
+  const mechanicalCheck = checkMechanicalTierEvidence(tier, pocLeg);
 
-  const violations = [...residualCheck.violations, ...evidenceCheck.violations];
-  let ok = residualCheck.ok && evidenceCheck.ok;
+  const violations = [...residualCheck.violations, ...evidenceCheck.violations, ...mechanicalCheck.violations];
+  let ok = residualCheck.ok && evidenceCheck.ok && mechanicalCheck.ok;
 
   const residualEmpty = typeof residual !== 'string' || residual.trim() === '';
   if (tier === 'FULL' && !residualEmpty) {
@@ -830,12 +872,6 @@ async function verifyFix({
   // and on the result so a caller cannot mistake it for a verified patch.
   const _testedPrePatch = !tests.skipped && _candidateDiffersFromDisk(scanRoot, files);
   const testsOk = tests.skipped ? true : tests.passed === true;
-  let honesty = null;
-  if (fixMeta && typeof fixMeta === 'object') {
-    try { honesty = gateFixOutput(fixMeta); } catch { honesty = null; }
-  }
-  _lap('honesty');
-
   // R5 — the PoC leg. Re-run the finding's proof-of-concept against the
   // CANDIDATE patch inside R1's sandbox. A patch that still lets the PoC
   // demonstrate the predicted effect has not fixed anything, however green the
@@ -847,6 +883,11 @@ async function verifyFix({
   // to run, or a sandbox that could not start, is recorded as `inconclusive`
   // and left out of the verdict entirely. Treating "could not prove it" as
   // "fixed" is exactly the false confidence this leg exists to prevent.
+  //
+  // Computed BEFORE the honesty gate (FR-308): a still-exploitable PoC is
+  // MECHANICAL evidence, not a self-report, and gateFixOutput cross-checks a
+  // self-reported FULL tier against it below — the ordering matters, not
+  // just the value.
   let pocLeg = { status: 'not-requested', reason: null, tier: null };
   if (poc?.code) {
     try {
@@ -865,7 +906,54 @@ async function verifyFix({
   _lap('poc');
   const pocOk = pocLeg.status !== 'still-exploitable';
 
+  // FR-308: "a mitigation or workaround cannot be represented as a full
+  // fix" — gateFixOutput's tier/residual check is a pure self-consistency
+  // check (fixMeta.signals is agent-self-reported; see fix-honesty-gate.js's
+  // header for why nothing there is server-computable). pocLeg IS
+  // server-computable — a real execution result, not a claim — so it is
+  // passed through as the one MECHANICAL cross-check available: a
+  // self-reported FULL tier is refuted, not just internally inconsistent,
+  // when the PoC still demonstrates the vulnerability against the patch.
+  // D-0024: `fixMeta` is a shared envelope — FR-307/FR-1002's `approval`
+  // key lives alongside FR-308's completeness self-report (`residual`/
+  // `verdict`/`evidence`/`signals`). Gating on mere object-truthiness meant
+  // a caller supplying ONLY `approval` (a real, common shape once the CLI's
+  // --approved-by flag and the MCP schema fix made that reachable) got
+  // silently gated on an UNRELATED FR-308 self-consistency check it never
+  // engaged with — computeFixTier(undefined) defaults to MITIGATION, which
+  // then demands a `residual` nobody was ever asked to supply, blocking an
+  // otherwise-genuine, approved fix for a reason that has nothing to do
+  // with completeness honesty. Scope the gate to fixMeta shapes that
+  // actually make a completeness-adjacent claim.
+  const hasHonestyClaim = fixMeta && typeof fixMeta === 'object' &&
+    (fixMeta.residual !== undefined || fixMeta.verdict !== undefined ||
+     fixMeta.evidence !== undefined || fixMeta.signals !== undefined);
+  let honesty = null;
+  if (hasHonestyClaim) {
+    try { honesty = gateFixOutput(fixMeta, { pocLeg }); } catch { honesty = null; }
+  }
+  _lap('honesty');
+
   const ok = rescan.ok && (lint.ok || lint.skipped) && testsOk && pocOk && (honesty ? honesty.ok : true);
+
+  // FR-305 (assurance-hardening PRD): `ok` alone conflates "every leg
+  // genuinely ran and passed" with "passed, but a required leg was skipped
+  // or unavailable" — `lint.ok`/`testsOk` are both true in the skipped case
+  // by design (this codebase does not fail-closed just because a repo has
+  // no linter or no detected test runner), so a caller checking only `ok`
+  // cannot tell the difference. `lint.skipped` is only ever true when a
+  // linter WAS configured but its binary could not be run (missing config
+  // entirely returns `runner: 'none'` with no `skipped` field at all — that
+  // is a genuine N/A, nothing was required, not a degradation). `verifiedFull`
+  // is the honest label: true only when nothing that WAS required was
+  // skipped. A caller must never present `ok: true, verifiedFull: false` as
+  // "fully verified" — `degradedLegs` names exactly what was skipped so a
+  // report can say so plainly instead of a bare pass.
+  const degradedLegs = [];
+  if (lint.skipped) degradedLegs.push(`lint: ${lint.runner} not installed`);
+  if (tests.skipped) degradedLegs.push(`tests: skipped (${tests.reason})`);
+  const verifiedFull = ok && degradedLegs.length === 0;
+
   const durations = { ...stages, totalMs: Date.now() - t0 };
   const summary = [
     `re-scan: ${rescan.ok ? 'PASS' : 'FAIL — ' + rescan.reason}`,
@@ -887,6 +975,8 @@ async function verifyFix({
       : pocLeg.status === 'still-exploitable' ? `poc:     FAIL — the proof-of-concept still demonstrates the vulnerability against the patch`
       : pocLeg.status === 'no-longer-proven' ? 'poc:     PASS (ran against the patch and no longer demonstrates the vulnerability)'
       : `poc:     inconclusive — not counted either way (${pocLeg.reason || 'no detail reported'})`,
+    // FR-305: never let a degraded pass read the same as a full one.
+    ok && !verifiedFull ? `NOTE:    PASSED, but NOT fully verified — ${degradedLegs.join('; ')}` : null,
   ].filter(Boolean).join('\n');
   // Persist the attempt so the distribution can be reported from real runs.
   // `testsRan` is the load-bearing field: it is what keeps "verified with no
@@ -899,6 +989,7 @@ async function verifyFix({
       at: new Date().toISOString(),
       stableId: originalFindingStableId || null,
       ok,
+      verifiedFull,
       testsRan: !tests.skipped,
       testsPassed: tests.skipped ? null : tests.passed === true,
       testedPrePatch: _testedPrePatch,
@@ -911,7 +1002,7 @@ async function verifyFix({
     });
   }
 
-  return { ok, rescan, lint, tests, testedPrePatch: _testedPrePatch, honesty, poc: pocLeg, durations, summary };
+  return { ok, verifiedFull, degradedLegs, rescan, lint, tests, testedPrePatch: _testedPrePatch, honesty, poc: pocLeg, durations, summary };
 }
 
 

package/dist/552.index.js

@@ -0,0 +1,97 @@
+export const id = 552;
+export const ids = [552];
+export const modules = {
+
+/***/ 7552:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   buildDeletionReport: () => (/* binding */ buildDeletionReport),
+/* harmony export */   buildExportReport: () => (/* binding */ buildExportReport),
+/* harmony export */   writeDeletionReport: () => (/* binding */ writeDeletionReport),
+/* harmony export */   writeExportReport: () => (/* binding */ writeExportReport)
+/* harmony export */ });
+/* unused harmony exports DELETION_REPORT_FILE, EXPORT_REPORT_FILE */
+/* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1174);
+// FR-706 (assurance-hardening PRD): manifest-based export and deletion
+// reports — "Operators can prove what was exported, deleted, retained, or
+// failed."
+//
+// Two report kinds, one shared per-item shape ({name, status, ...}), each
+// written by its one real caller in bin/agentic-security.js:
+//   - `cmdReset` builds a deletion report from the SAME target/preserved
+//     data it already computes for its console output (see FR-702/FR-703),
+//     reshaped into a durable, structured artifact instead of only ever
+//     printed and lost. Written on BOTH a dry run (items carry status
+//     'planned') and a real run (status 'deleted'/'failed'), so an operator
+//     can prove either "what would happen" or "what did happen" depending
+//     on which they asked for — `dryRun` on the report says which.
+//   - `cmdExport` (new) builds an export report after copying every
+//     currently-present registered artifact to an operator-chosen
+//     destination, naming what was copied (with a hash) and what failed.
+//
+// Each report is a SINGLE OVERWRITTEN file per kind — the same "last
+// action" precedent as last-scan.json, not an ever-growing log. An
+// operator who needs a persistent audit trail across many runs should
+// retain these externally (commit them, forward to their own SIEM); this
+// module's job is only to make the LAST action's outcome durable and
+// provable, not to be the audit log itself.
+
+
+
+const DELETION_REPORT_FILE = 'deletion-report.json';
+const EXPORT_REPORT_FILE = 'export-report.json';
+
+function buildDeletionReport({ mode, dryRun, root, items, preserved }) {
+  const list = Array.isArray(items) ? items : [];
+  const preservedList = Array.isArray(preserved) ? preserved : [];
+  return {
+    schema: 'agentic-security/deletion-report@1',
+    generatedAt: new Date().toISOString(),
+    mode: mode || 'reset',
+    dryRun: !!dryRun,
+    root: root || null,
+    items: list,
+    preserved: preservedList,
+    summary: {
+      planned: list.filter(i => i.status === 'planned').length,
+      deleted: list.filter(i => i.status === 'deleted').length,
+      failed: list.filter(i => i.status === 'failed').length,
+      preserved: preservedList.length,
+    },
+  };
+}
+
+function writeDeletionReport(scanRoot, report) {
+  try {
+    const fp = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_0__/* .statePath */ .BQ)(scanRoot, DELETION_REPORT_FILE);
+    return (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_0__/* .safeWriteState */ .Ep)(fp, JSON.stringify(report, null, 2) + '\n') ? fp : null;
+  } catch { return null; }
+}
+
+function buildExportReport({ root, outDir, items }) {
+  const list = Array.isArray(items) ? items : [];
+  return {
+    schema: 'agentic-security/export-report@1',
+    generatedAt: new Date().toISOString(),
+    root: root || null,
+    outDir: outDir || null,
+    items: list,
+    summary: {
+      exported: list.filter(i => i.status === 'exported').length,
+      failed: list.filter(i => i.status === 'failed').length,
+    },
+  };
+}
+
+function writeExportReport(scanRoot, report) {
+  try {
+    const fp = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_0__/* .statePath */ .BQ)(scanRoot, EXPORT_REPORT_FILE);
+    return (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_0__/* .safeWriteState */ .Ep)(fp, JSON.stringify(report, null, 2) + '\n') ? fp : null;
+  } catch { return null; }
+}
+
+
+/***/ })
+
+};

package/dist/637.index.js

@@ -11,7 +11,7 @@ export const modules = {
 /* harmony export */   renderPrDeltaText: () => (/* binding */ renderPrDeltaText)
 /* harmony export */ });
 /* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1421);
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(3474);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(7087);
 // Shadowscan / security-DELTA on PR (v0.72).
 //
 // Most SAST PR-comment integrations show absolute counts — "12 findings

package/dist/730.index.js

@@ -0,0 +1,311 @@
+export const id = 730;
+export const ids = [730,144];
+export const modules = {
+
+/***/ 5144:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   addLegalHold: () => (/* binding */ addLegalHold),
+/* harmony export */   isUnderHold: () => (/* binding */ isUnderHold),
+/* harmony export */   listLegalHolds: () => (/* binding */ listLegalHolds),
+/* harmony export */   loadLegalHolds: () => (/* binding */ loadLegalHolds),
+/* harmony export */   removeLegalHold: () => (/* binding */ removeLegalHold)
+/* harmony export */ });
+/* unused harmony export LEGAL_HOLD_FILE */
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
+/* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(1174);
+/* harmony import */ var _artifact_registry_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(471);
+// FR-707 (assurance-hardening PRD): "Support legal hold and policy-
+// authorized retention exceptions | Legal hold is identity-bound, reasoned,
+// time-bounded where applicable, and auditable."
+//
+// A third instance of the recurring {owner, reason, expires_at} exception
+// shape this codebase already uses twice — `posture/suppressions.js`'s
+// pro-tier exception (scoped to a FINDING) and `posture/compliance-policy.js`'s
+// structured `not-applicable` (scoped to a COMPLIANCE CONTROL). Per D-0025,
+// these are deliberately distinct mechanisms serving different subjects, not
+// one shared module — this file is the third subject: a STATE ARTIFACT.
+//
+// Field naming matches the existing two schemas' snake_case convention
+// (`owner`, `reason`, `expires_at`) rather than inventing a fourth style.
+//
+//   identity-bound   -> `owner` (required, who placed the hold and is
+//                        accountable for lifting it)
+//   reasoned         -> `reason` (required — "we might need this later" is
+//                        not a reason; same discipline suppressions.js
+//                        already enforces for its own exceptions)
+//   time-bounded
+//     where applicable -> `expires_at` is OPTIONAL: a null/absent value is
+//                        an INDEFINITE hold, which the acceptance
+//                        criterion's own "where applicable" phrase
+//                        explicitly allows (a genuine legal matter may have
+//                        no known end date) — an ISO date value behaves
+//                        exactly like FR-506/FR-1004's own expiring
+//                        exceptions: once past, the hold is no longer
+//                        active and the artifact is exposed to its normal
+//                        retention TTL again.
+//   auditable        -> persisted as a single JSON array under
+//                        `.agentic-security/legal-holds.json` (itself
+//                        registered as operator-config — an operator/legal
+//                        team's own input, never scanner-written from scan
+//                        results), readable via `listLegalHolds`.
+//
+// Consulted from TWO places, not one: `retention-policy.js#findExpiredArtifacts`
+// (defense in depth for any caller reaching it directly) AND `cmdReset`
+// itself for its PLAIN (non-`--expired`) path, which deletes every
+// registered 'generated' artifact unconditionally and would otherwise blow
+// through a hold that only gated TTL expiry.
+
+
+
+
+
+const LEGAL_HOLD_FILE = 'legal-holds.json';
+
+function _loadRaw(scanRoot) {
+  let fp;
+  try { fp = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_1__/* .statePath */ .BQ)(scanRoot, LEGAL_HOLD_FILE); } catch { return []; }
+  let raw;
+  try { raw = node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(fp, 'utf8'); } catch { return []; }
+  try {
+    const doc = JSON.parse(raw);
+    return Array.isArray(doc) ? doc : [];
+  } catch { return []; }
+}
+
+/**
+ * All legal holds ever recorded for this project, malformed entries
+ * dropped rather than throwing. Never filters by expiry — see
+ * `isUnderHold`/`listLegalHolds` for that.
+ */
+function loadLegalHolds(scanRoot) {
+  return _loadRaw(scanRoot).filter(h => h && typeof h === 'object' && typeof h.artifact === 'string' && typeof h.owner === 'string' && typeof h.reason === 'string');
+}
+
+/**
+ * Is `artifactName` currently protected by an active (non-expired) hold?
+ * Returns the matching hold record, or null. Multiple holds on the same
+ * artifact are permitted (e.g. two independent legal matters); the first
+ * still-active one found is returned.
+ */
+function isUnderHold(artifactName, holds, now = Date.now()) {
+  for (const h of holds) {
+    if (h.artifact !== artifactName) continue;
+    if (!h.expires_at) return h; // indefinite hold — always active
+    const t = Date.parse(h.expires_at);
+    if (!Number.isFinite(t) || t >= now) return h;
+  }
+  return null;
+}
+
+/**
+ * Active (non-expired) holds only, unless `includeExpired`. For
+ * `legal-hold list` / auditing.
+ */
+function listLegalHolds(scanRoot, { includeExpired = false, now = Date.now() } = {}) {
+  const holds = loadLegalHolds(scanRoot);
+  if (includeExpired) return holds;
+  return holds.filter(h => {
+    if (!h.expires_at) return true;
+    const t = Date.parse(h.expires_at);
+    return !Number.isFinite(t) || t >= now;
+  });
+}
+
+/**
+ * Add a legal hold. Validates identity-bound + reasoned up front (both
+ * required, non-empty) and that `expires_at`, if given, is a parseable
+ * date in the future — an already-expired hold would be a hold that
+ * protects nothing, which is never a legitimate request. `artifact` must
+ * name a real registered artifact (artifact-registry.js) — a hold on an
+ * unrecognised name can never protect anything and almost always means a
+ * typo. Returns `{ok:true, hold}` or `{ok:false, reason}`; never throws.
+ */
+function addLegalHold(scanRoot, { artifact, owner, reason, expires_at } = {}) {
+  if (!artifact || typeof artifact !== 'string') return { ok: false, reason: '--artifact is required' };
+  if (!(0,_artifact_registry_js__WEBPACK_IMPORTED_MODULE_2__/* .isRegisteredArtifact */ .Jl)(artifact)) return { ok: false, reason: `"${artifact}" is not a registered state artifact` };
+  if (!owner || typeof owner !== 'string') return { ok: false, reason: '--owner is required (identity-bound)' };
+  if (!reason || typeof reason !== 'string') return { ok: false, reason: '--reason is required (reasoned)' };
+  if (expires_at) {
+    const t = Date.parse(expires_at);
+    if (!Number.isFinite(t)) return { ok: false, reason: 'expires_at must be a parseable date' };
+    if (t < Date.now()) return { ok: false, reason: 'expires_at is in the past — a hold that already expired protects nothing' };
+  }
+  const hold = { artifact, owner, reason, expires_at: expires_at || null, created_at: new Date().toISOString() };
+  const holds = _loadRaw(scanRoot);
+  holds.push(hold);
+  const fp = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_1__/* .statePath */ .BQ)(scanRoot, LEGAL_HOLD_FILE);
+  if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_1__/* .safeWriteState */ .Ep)(fp, JSON.stringify(holds, null, 2) + '\n')) {
+    return { ok: false, reason: 'state writes are disabled (--no-state) or this is not a safe state directory' };
+  }
+  return { ok: true, hold };
+}
+
+/**
+ * Remove every hold on `artifact` (lifting a hold, not letting it expire).
+ * Returns the number removed. A no-op (0) if none existed — never an error.
+ */
+function removeLegalHold(scanRoot, artifact) {
+  const holds = _loadRaw(scanRoot);
+  const remaining = holds.filter(h => !(h && h.artifact === artifact));
+  const removedCount = holds.length - remaining.length;
+  if (removedCount > 0) {
+    const fp = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_1__/* .statePath */ .BQ)(scanRoot, LEGAL_HOLD_FILE);
+    (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_1__/* .safeWriteState */ .Ep)(fp, JSON.stringify(remaining, null, 2) + '\n');
+  }
+  return removedCount;
+}
+
+
+/***/ }),
+
+/***/ 6730:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   findExpiredArtifacts: () => (/* binding */ findExpiredArtifacts)
+/* harmony export */ });
+/* unused harmony exports RETENTION_DEFAULTS, loadRetentionPolicy, effectiveTtlDays */
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
+/* harmony import */ var _util_yaml_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(2340);
+/* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(1174);
+/* harmony import */ var _artifact_registry_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(471);
+/* harmony import */ var _legal_hold_js__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(5144);
+// Retention policy: default and maximum TTL by artifact class (assurance-
+// hardening PRD FR-702).
+//
+// "Enforce default and maximum TTL by artifact class | Expired caches,
+// scans, evidence, tickets, and backups are purged or archived according
+// to policy."
+//
+// TWO NUMBERS PER CLASS, ON PURPOSE
+// --------------------------------------------------------------------------
+// `defaultDays` is what applies when nobody configures anything — a
+// reasonable, disclosed starting point, not a regulatory citation (an
+// operator with a real compliance regime should configure their own via
+// the policy file below). `maxDays` is a CEILING an operator's own
+// configuration cannot exceed: the literal "default AND maximum" wording
+// asks for both a floor-free default and a hard cap, not just a knob. An
+// operator who wants indefinite retention for `evidence` for their own
+// audit reasons should say so in their own retention program — this
+// module will not silently allow a TTL past its built-in ceiling for a
+// class, because "TTL" than can be configured to "never" is not a TTL.
+//
+// PURGE, NOT ARCHIVE
+// --------------------------------------------------------------------------
+// The acceptance criterion allows either. This implements PURGE (delete)
+// only — the simpler, safer, and more directly verifiable of the two.
+// "Archive" implies a defined export format and destination, which is
+// FR-706's own separate scope (manifest-based export); an operator who
+// wants to archive before purging already has the tool for it once FR-706
+// exists, or can back up `.agentic-security/` by their own means before
+// running the enforcement command.
+//
+// WHICH ARTIFACTS THIS APPLIES TO
+// --------------------------------------------------------------------------
+// Only 'generated' artifacts carrying a `retentionClass` in
+// artifact-registry.js — deliberately a SUBSET of all generated artifacts
+// (see that module's own header for which ones were left classless and
+// why). An 'operator-config' artifact is NEVER touched by this module,
+// regardless of age, matching FR-703's own "reset preserves operator-
+// authored configuration" precedent.
+
+
+
+
+
+
+
+const POLICY_FILE = 'retention-policy.yml';
+const MS_PER_DAY = 24 * 60 * 60 * 1000;
+
+// Engineering defaults, not a regulatory claim — see the header above.
+const RETENTION_DEFAULTS = {
+  cache: { defaultDays: 7, maxDays: 30 },
+  scan: { defaultDays: 90, maxDays: 365 },
+  evidence: { defaultDays: 365, maxDays: 1095 },
+  ticket: { defaultDays: 180, maxDays: 730 },
+  backup: { defaultDays: 30, maxDays: 180 },
+};
+
+/**
+ * Load an operator's `.agentic-security/retention-policy.yml`. Never
+ * throws — a missing or malformed file degrades to "no overrides," the
+ * same no-op-until-configured convention this repo uses for every other
+ * policy surface. Shape:
+ *   cache: { defaultDays: 3 }
+ *   evidence: { defaultDays: 730 }
+ * A class not mentioned, or a file not present at all, uses
+ * RETENTION_DEFAULTS unmodified.
+ */
+function loadRetentionPolicy(scanRoot) {
+  if (!scanRoot) return null;
+  let fp;
+  try { fp = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__/* .statePath */ .BQ)(scanRoot, POLICY_FILE); } catch { return null; }
+  let raw;
+  try { raw = node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(fp, 'utf8'); } catch { return null; }
+  try {
+    const doc = _util_yaml_js__WEBPACK_IMPORTED_MODULE_1__/* .load */ .Hh(raw);
+    if (!doc || typeof doc !== 'object') return null;
+    return doc;
+  } catch { return null; }
+}
+
+/**
+ * The TTL (in days) actually in effect for a class, after applying any
+ * operator override and clamping it to the class's own maxDays — an
+ * override CANNOT raise retention past the ceiling, only lower it (or
+ * leave it at the default). An unrecognised class (should not happen —
+ * only artifact-registry.js's own 5 named classes are ever passed in)
+ * degrades to null, meaning "not subject to a TTL."
+ */
+function effectiveTtlDays(retentionClass, policy) {
+  const bounds = RETENTION_DEFAULTS[retentionClass];
+  if (!bounds) return null;
+  const override = policy?.[retentionClass]?.defaultDays;
+  if (typeof override === 'number' && Number.isFinite(override) && override >= 0) {
+    return Math.min(override, bounds.maxDays);
+  }
+  return bounds.defaultDays;
+}
+
+/**
+ * Which registered, retention-classed artifacts under `scanRoot`'s state
+ * dir are currently past their effective TTL. Never throws — a missing
+ * state dir or an artifact that does not exist on disk is simply absent
+ * from the result, not an error.
+ *
+ * @returns {Array<{name: string, isDir: boolean, retentionClass: string,
+ *   ageDays: number, ttlDays: number}>}
+ */
+function findExpiredArtifacts(scanRoot, { now = Date.now() } = {}) {
+  const dir = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__/* .stateDir */ .Pn)(scanRoot);
+  let dirExists = true;
+  try { node_fs__WEBPACK_IMPORTED_MODULE_0__.accessSync(dir); } catch { dirExists = false; }
+  if (!dirExists) return [];
+  const policy = loadRetentionPolicy(scanRoot);
+  // FR-707: an artifact under an active legal hold is NEVER reported as
+  // expired, regardless of TTL — checked here (not just in cmdReset) so
+  // any future caller of this function inherits the same guarantee.
+  const holds = (0,_legal_hold_js__WEBPACK_IMPORTED_MODULE_4__.loadLegalHolds)(scanRoot);
+  const expired = [];
+  for (const artifact of (0,_artifact_registry_js__WEBPACK_IMPORTED_MODULE_3__/* .listArtifactsWithRetentionClass */ .U_)()) {
+    const ttlDays = effectiveTtlDays(artifact.retentionClass, policy);
+    if (ttlDays === null) continue;
+    if ((0,_legal_hold_js__WEBPACK_IMPORTED_MODULE_4__.isUnderHold)(artifact.name, holds, now)) continue;
+    const p = `${dir}/${artifact.name}`;
+    let st;
+    try { st = node_fs__WEBPACK_IMPORTED_MODULE_0__.statSync(p); } catch { continue; } // not present — nothing to expire
+    const ageDays = (now - st.mtimeMs) / MS_PER_DAY;
+    if (ageDays > ttlDays) {
+      expired.push({ name: artifact.name, isDir: st.isDirectory(), retentionClass: artifact.retentionClass, ageDays, ttlDays });
+    }
+  }
+  return expired;
+}
+
+
+/***/ })
+
+};