@clear-capabilities/agentic-security-scanner 0.143.0 → 0.145.0

package/dist/178.index.js

@@ -13,7 +13,8 @@ export const modules = {
 /* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1421);
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(3024);
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6760);
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(3474);
+/* harmony import */ var _util_git_hardening_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(8844);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(7691);
 // Time-travel + counterfactual scanning (v0.68).
 //
 // Two new modes that exploit the pure-input shape of runFullScan:
@@ -36,10 +37,14 @@ export const modules = {
 
 
 
+
 const MAX_FILES_PER_SCAN = 5000;
 
+// `root` is the scan target's repository, not this project's own trusted
+// checkout — hardened per FR-PROV-024 / the second Finding Provenance PRD
+// audit (same exposure class as provenance/git-evidence.js's `_run`).
 function _git(root, args) {
-  const r = (0,node_child_process__WEBPACK_IMPORTED_MODULE_0__.spawnSync)('git', args, { cwd: root, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+  const r = (0,node_child_process__WEBPACK_IMPORTED_MODULE_0__.spawnSync)('git', (0,_util_git_hardening_js__WEBPACK_IMPORTED_MODULE_3__/* .hardenGitArgs */ .Ax)(args), { cwd: root, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024, env: (0,_util_git_hardening_js__WEBPACK_IMPORTED_MODULE_3__/* .hardenGitEnv */ .Si)() });
   return { ok: r.status === 0, stdout: r.stdout || '', stderr: r.stderr || '' };
 }
 
@@ -99,7 +104,10 @@ function _listFilesAtRef(root, ref) {
 }
 
 function _readFileAtRef(root, ref, file) {
-  const r = _git(root, ['show', `${ref}:${file}`]);
+  // `--no-textconv`: this blob-cat form of `show` was verified NOT
+  // reachable via a hostile textconv driver in current git — kept for
+  // defense-in-depth/uniformity, same as pr-delta.js's equivalent.
+  const r = _git(root, ['show', '--no-textconv', `${ref}:${file}`]);
   if (!r.ok) return null;
   return r.stdout;
 }
@@ -111,7 +119,13 @@ async function _scanAtRef(root, ref) {
     const c = _readFileAtRef(root, ref, f);
     if (c != null) fileContents[f] = c;
   }
-  const scan = await (0,_engine_js__WEBPACK_IMPORTED_MODULE_3__/* .runFullScan */ .wW)({ fileContents, scanRoot: root }, () => {});
+  // `provenance:false` — this is a HISTORICAL ref, not "the state of this repo
+  // right now". Two things must not happen here: resolving git provenance for
+  // findings that already are a point in history (pure waste), and letting
+  // updateLifecycle see this partial, historical finding set as the current
+  // one — it marks every open stableId NOT in the set as `remediated`, so one
+  // per-ref scan would mass-remediate the whole project's real open findings.
+  const scan = await (0,_engine_js__WEBPACK_IMPORTED_MODULE_4__/* .runFullScan */ .wW)({ fileContents, scanRoot: root, provenance: false }, () => {});
   return {
     ref,
     fileCount: Object.keys(fileContents).length,
@@ -193,8 +207,12 @@ async function runWhatIf(root, { overlays = [], remove = [] } = {}) {
     }
   }
   // Baseline (without overlays) for delta computation.
-  const baseScan = await (0,_engine_js__WEBPACK_IMPORTED_MODULE_3__/* .runFullScan */ .wW)({ fileContents: _baselineFor(fileContents, overlays, remove, root), scanRoot: root }, () => {});
-  const whatIfScan = await (0,_engine_js__WEBPACK_IMPORTED_MODULE_3__/* .runFullScan */ .wW)({ fileContents, scanRoot: root }, () => {});
+  // Both legs are hypothetical snapshots being differenced against each other,
+  // never the repo's current state — `provenance:false` for the same reason as
+  // _scanAtRef above (no provenance to resolve, and updateLifecycle must not
+  // treat either snapshot as "what is open right now").
+  const baseScan = await (0,_engine_js__WEBPACK_IMPORTED_MODULE_4__/* .runFullScan */ .wW)({ fileContents: _baselineFor(fileContents, overlays, remove, root), scanRoot: root, provenance: false }, () => {});
+  const whatIfScan = await (0,_engine_js__WEBPACK_IMPORTED_MODULE_4__/* .runFullScan */ .wW)({ fileContents, scanRoot: root, provenance: false }, () => {});
   const baseIds = new Set((baseScan.findings || []).map(f => f.stableId || f.id));
   const wIds = new Set((whatIfScan.findings || []).map(f => f.stableId || f.id));
   const introduced = (whatIfScan.findings || []).filter(f => !baseIds.has(f.stableId || f.id)).map(_compact);

package/dist/238.index.js

@@ -8,9 +8,10 @@ export const modules = {
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   I3: () => (/* binding */ recordFixAttempt),
 /* harmony export */   fixDurationReport: () => (/* binding */ fixDurationReport),
-/* harmony export */   renderFixDurationSummary: () => (/* binding */ renderFixDurationSummary)
+/* harmony export */   renderFixDurationSummary: () => (/* binding */ renderFixDurationSummary),
+/* harmony export */   sU: () => (/* binding */ loadFixAttempts)
 /* harmony export */ });
-/* unused harmony exports FIX_STAGES, loadFixAttempts, bucketOf, summarizeFixDurations, _internals, summarizeFixAxes, renderFixAxes */
+/* unused harmony exports FIX_STAGES, bucketOf, summarizeFixDurations, _internals, summarizeFixAxes, renderFixAxes */
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6760);
 /* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(1174);

package/dist/265.index.js

@@ -0,0 +1,191 @@
+export const id = 265;
+export const ids = [265];
+export const modules = {
+
+/***/ 4265:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   createCascadePool: () => (/* binding */ createCascadePool)
+/* harmony export */ });
+/* unused harmony export DEFAULT_GRACE_MS */
+/* harmony import */ var node_worker_threads__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(5919);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6760);
+/* harmony import */ var node_url__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(3136);
+// FR-202 phase 3b (D-0050): a pool of long-lived workers, each running engine.js's
+// _runFileCascade for many files over its lifetime, instead of the one-shot-per-call
+// model runWithDeadline/analyzer-supervisor.js uses (which is correct for FR-202's
+// primitive-level proof but would force whole-project setup — _buildProjectIndex,
+// _buildGlobalJavaTaintedMethodIndex, _loadCustomRules — to redo per FILE, an O(n^2)
+// cost across a scan). Each worker performs that setup ONCE at creation via
+// _initCascadeWorkerState, then answers task messages over its lifetime.
+//
+// A task that exceeds its deadline+grace gets its OWN worker terminated (genuinely
+// preemptive, mirroring analyzer-supervisor.js's worker.terminate() precedent) and a
+// fresh replacement worker is spawned to keep the pool at full size for later files —
+// one hung file costs one worker restart, not the whole scan.
+
+
+
+
+// `new Worker()` needs a REAL file on disk -- once ncc bundles this module's code
+// into a dist/ chunk, `import.meta.url` resolves to that chunk's location (dist/),
+// not to src/pipeline/, so a naive path.join(HERE, 'cascade-worker.js') would look
+// for a file that was never copied there. src/ always ships as a sibling of dist/
+// (see package.json's "files"), in both a dev checkout and the published npm
+// package, so fall back to the real, unbundled worker script in that case.
+function _resolveDefaultWorkerScript() {
+  const hereDir = node_path__WEBPACK_IMPORTED_MODULE_1__.dirname((0,node_url__WEBPACK_IMPORTED_MODULE_2__.fileURLToPath)(import.meta.url));
+  if (node_path__WEBPACK_IMPORTED_MODULE_1__.basename(hereDir) === 'pipeline') return node_path__WEBPACK_IMPORTED_MODULE_1__.join(hereDir, 'cascade-worker.js');
+  return node_path__WEBPACK_IMPORTED_MODULE_1__.join(hereDir, '..', 'src', 'pipeline', 'cascade-worker.js');
+}
+const DEFAULT_WORKER_SCRIPT = _resolveDefaultWorkerScript();
+const DEFAULT_GRACE_MS = 500;
+
+function spawnReadyWorker({ workerScript, modulePath, fileContents, scanRoot }) {
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const worker = new node_worker_threads__WEBPACK_IMPORTED_MODULE_0__.Worker(workerScript, { workerData: { modulePath, fileContents, scanRoot } });
+    const finish = (fn, value) => {
+      if (settled) return;
+      settled = true;
+      worker.off('message', onMessage);
+      worker.off('error', onError);
+      fn(value);
+    };
+    const onMessage = (msg) => {
+      if (!msg) return;
+      if (msg.type === 'ready') finish(resolve, worker);
+      else if (msg.type === 'init-error') { worker.terminate().catch(() => {}); finish(reject, new Error(msg.error)); }
+    };
+    const onError = (err) => { worker.terminate().catch(() => {}); finish(reject, err); };
+    worker.on('message', onMessage);
+    worker.on('error', onError);
+  });
+}
+
+/**
+ * @param {object} opts
+ * @param {Record<string,string>} opts.fileContents - broadcast once to every worker at creation.
+ * @param {string|null} opts.scanRoot
+ * @param {number} [opts.poolSize=4]
+ * @param {string} opts.modulePath - absolute path to the engine.js each worker imports.
+ * @param {string} [opts.workerScript] - defaults to cascade-worker.js next to this file.
+ * @param {number} [opts.graceMs]
+ */
+function createCascadePool(opts = {}) {
+  const {
+    fileContents = {},
+    scanRoot = null,
+    poolSize = 4,
+    workerScript = DEFAULT_WORKER_SCRIPT,
+    modulePath,
+    graceMs = DEFAULT_GRACE_MS,
+  } = opts;
+  if (!modulePath) throw new Error('createCascadePool requires opts.modulePath');
+  if (!(Number.isInteger(poolSize) && poolSize > 0)) throw new Error('createCascadePool requires opts.poolSize to be a positive integer');
+
+  const idle = [];
+  const pendingIdle = [];
+  const allWorkers = new Set();
+  let nextTaskId = 1;
+  let closed = false;
+  let spawnFailureCount = 0;
+  let lastSpawnError = null;
+
+  function spawnAndRegister() {
+    return spawnReadyWorker({ workerScript, modulePath, fileContents, scanRoot }).then((w) => {
+      allWorkers.add(w);
+      return w;
+    });
+  }
+
+  // Background respawn after a killed worker (see runFile's timeout branch)
+  // is deliberately fire-and-forget -- the timed-out task has already
+  // resolved and nothing is waiting on this promise -- but a swallowed
+  // failure here would otherwise shrink the pool invisibly (e.g. thread
+  // exhaustion making every future respawn fail silently forever). Track
+  // it instead of a bare `.catch(() => {})`.
+  function respawnInBackground() {
+    spawnAndRegister().then(releaseWorker).catch((err) => {
+      spawnFailureCount += 1;
+      lastSpawnError = err;
+    });
+  }
+
+  function releaseWorker(w) {
+    if (closed) { allWorkers.delete(w); w.terminate().catch(() => {}); return; }
+    if (pendingIdle.length) pendingIdle.shift()(w);
+    else idle.push(w);
+  }
+
+  function acquireWorker() {
+    if (idle.length) return Promise.resolve(idle.pop());
+    return new Promise((resolve) => pendingIdle.push(resolve));
+  }
+
+  const ready = Promise.all(
+    Array.from({ length: poolSize }, () => spawnAndRegister().then(releaseWorker))
+  );
+
+  /**
+   * Run one file's cascade on a pooled worker. Resolves with
+   * {ok:true, result} | {ok:false, error} | {ok:false, timedOut:true, timeoutMs, graceMs}.
+   * Never rejects.
+   */
+  async function runFile(p, c, taskScanRoot, detectorErrors, taskOpts = {}) {
+    await ready;
+    if (closed) return { ok: false, error: 'pool is closed' };
+    const timeoutMs = taskOpts.timeoutMs;
+    const worker = await acquireWorker();
+    const id = nextTaskId++;
+    return new Promise((resolve) => {
+      let settled = false;
+      let killTimer = null;
+      const onMessage = (msg) => {
+        if (settled || !msg || msg.id !== id) return;
+        settled = true;
+        if (killTimer) clearTimeout(killTimer);
+        worker.off('message', onMessage);
+        releaseWorker(worker);
+        resolve(msg.ok ? { ok: true, result: msg.result } : { ok: false, error: msg.error });
+      };
+      worker.on('message', onMessage);
+      if (Number.isFinite(timeoutMs) && timeoutMs > 0) {
+        killTimer = setTimeout(() => {
+          if (settled) return;
+          settled = true;
+          worker.off('message', onMessage);
+          allWorkers.delete(worker);
+          worker.terminate().catch(() => {});
+          if (!closed) respawnInBackground();
+          resolve({ ok: false, timedOut: true, timeoutMs, graceMs });
+        }, timeoutMs + graceMs);
+        killTimer.unref?.();
+      }
+      worker.postMessage({ type: 'task', id, p, c, scanRoot: taskScanRoot, detectorErrors });
+    });
+  }
+
+  async function shutdown() {
+    closed = true;
+    await ready.catch(() => {});
+    for (const w of allWorkers) await w.terminate().catch(() => {});
+    allWorkers.clear();
+    idle.length = 0;
+  }
+
+  return {
+    runFile,
+    shutdown,
+    ready,
+    DEFAULT_GRACE_MS: graceMs,
+    getSpawnFailureCount: () => spawnFailureCount,
+    getLastSpawnError: () => lastSpawnError,
+  };
+}
+
+
+/***/ })
+
+};

package/dist/271.index.js

@@ -0,0 +1,165 @@
+export const id = 271;
+export const ids = [271];
+export const modules = {
+
+/***/ 2271:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   PROVENANCE_BUNDLE_SCHEMA: () => (/* binding */ PROVENANCE_BUNDLE_SCHEMA),
+/* harmony export */   buildProvenanceEvidenceBundle: () => (/* binding */ buildProvenanceEvidenceBundle),
+/* harmony export */   ensureKeyPair: () => (/* reexport safe */ _evidence_bundle_js__WEBPACK_IMPORTED_MODULE_1__.ensureKeyPair),
+/* harmony export */   signProvenanceEvidenceBundle: () => (/* binding */ signProvenanceEvidenceBundle),
+/* harmony export */   verifyProvenanceEvidenceBundle: () => (/* binding */ verifyProvenanceEvidenceBundle)
+/* harmony export */ });
+/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(7598);
+/* harmony import */ var _evidence_bundle_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(8317);
+// Signed provenance evidence bundles (Finding Provenance PRD, M4 §4.1).
+//
+// Sibling to posture/evidence-bundle.js, not a generalization of it — that
+// module's bundle shape (proofTier, taintPath, exploitability...) answers
+// "is this finding real"; this one answers "who/when introduced it, how
+// sure are we." Forcing one shape to cover both would leave half of every
+// bundle null. Same four-function pattern (build/sign/verify + a schema
+// string + a top-level-key allowlist), same Ed25519 key material — reused,
+// not reimplemented.
+//
+// The allowlisted fields mirror provenance/coordinator.js's own
+// computeDigest() material EXACTLY (stableId, findingOrigin.commit,
+// branchIntroduction.commit, evidenceAttribution role:path:line:commit
+// strings, method, confidence.reasons, limitations) plus repo/HEAD identity
+// (not in computeDigest's material, since that digest never leaves the repo
+// it was computed in, but a bundle does). Everything here is copied from
+// what findingProvenance already computed. Nothing is inferred.
+//
+// canonicalJson vs canonicalBytes — resolved before writing this file
+// -------------------------------------------------------------------
+// evidence-bundle.js exports TWO canonicalisation helpers, not one, and they
+// are not interchangeable. `canonicalJson(value)` is a pure, shape-agnostic
+// deterministic serialiser (sorted keys at every level, order-preserving
+// arrays) — safe to reuse for any bundle shape. `canonicalBytes(bundle)`
+// is NOT generic: it hardcodes evidence-bundle.js's own six top-level keys
+// (`schema, finding, evidence, engine, proves, doesNotProve`) when building
+// the object it signs. Reusing `canonicalBytes` here would silently sign a
+// filtered object missing this module's `repo` and `provenance` fields
+// (and would read `bundle.evidence`, which a provenance bundle never has) —
+// exactly the EA-03 failure mode the allowlist check below exists to catch,
+// just introduced from the signing side instead of the verifying side. So
+// this module imports the generic `canonicalJson` (as the brief's Step 1
+// sketch already did) and signs `canonicalJson(bundle)` directly, since
+// `buildProvenanceEvidenceBundle` never puts anything on the unsigned
+// object beyond this module's own allowlisted fields.
+
+
+
+
+const PROVENANCE_BUNDLE_SCHEMA = 'agentic-security/provenance-evidence@1';
+
+const PROVES = 'This bundle\'s contents are exactly what was signed at attestation time.';
+const DOES_NOT_PROVE = 'This bundle does NOT prove the origin commit is correctly identified — read confidence.level and limitations for that. It proves the RECORD is unmodified, not that the record is right.';
+
+/**
+ * Build an unsigned provenance bundle from one finding's findingProvenance.
+ * Returns null for a finding with no findingProvenance at all (nothing to
+ * attest) — this is a caller error (attest a scan before its provenance
+ * pass ran), not a case to paper over with an empty bundle.
+ */
+function buildProvenanceEvidenceBundle(finding, { engineVersion, repoIdentity, head } = {}) {
+  if (!finding || typeof finding !== 'object') return null;
+  const fp = finding.findingProvenance;
+  if (!fp || typeof fp !== 'object') return null;
+  return {
+    schema: PROVENANCE_BUNDLE_SCHEMA,
+    finding: {
+      id: finding.id ?? null,
+      stableId: finding.stableId ?? null,
+    },
+    repo: {
+      identity: repoIdentity ?? null,
+      head: head ?? fp.analysisBasis?.head ?? null,
+    },
+    provenance: {
+      status: fp.status ?? null,
+      findingOrigin: fp.findingOrigin
+        ? {
+            commit: fp.findingOrigin.commit ?? null,
+            authorName: fp.findingOrigin.authorName ?? null,
+            authorDate: fp.findingOrigin.authorDate ?? null,
+            summary: fp.findingOrigin.summary ?? null,
+          }
+        : null,
+      branchIntroduction: fp.branchIntroduction
+        ? { commit: fp.branchIntroduction.commit ?? null, branch: fp.branchIntroduction.branch ?? null }
+        : null,
+      evidenceAttribution: (fp.evidenceAttribution || []).map((n) => ({
+        role: n.role ?? null, path: n.path ?? null, line: n.line ?? null, commit: n.commit ?? null,
+      })),
+      method: fp.method ?? null,
+      confidence: fp.confidence
+        ? { level: fp.confidence.level ?? null, score: fp.confidence.score ?? null, reasons: fp.confidence.reasons || [] }
+        : null,
+      limitations: fp.limitations || [],
+      // M4 §4.2 final-review fix: this module was written (Task 1) before
+      // the cross-repo lineage feature existed (Task 5), so a
+      // cross-repo-resolved origin's boundary-crossing marker was dropped
+      // from the signed bundle — a foreign repository's commit SHA and a
+      // real author name, with no MACHINE-READABLE signal that the origin
+      // crossed a repository boundary (only the prose in `limitations`
+      // said so, and a programmatic verifier does not read prose). Nested
+      // under `provenance` alongside the fields above, so it is part of
+      // what gets signed — never a new top-level key.
+      historyCoverage: { crossRepoLineage: fp.historyCoverage?.crossRepoLineage ?? false },
+    },
+    engine: { engineVersion: engineVersion ?? null },
+    proves: PROVES,
+    doesNotProve: DOES_NOT_PROVE,
+  };
+}
+
+function signProvenanceEvidenceBundle(bundle, privateKeyPem) {
+  const sig = node_crypto__WEBPACK_IMPORTED_MODULE_0__.sign(null, Buffer.from((0,_evidence_bundle_js__WEBPACK_IMPORTED_MODULE_1__/* .canonicalJson */ .dj)(bundle), 'utf8'), privateKeyPem);
+  return {
+    ...bundle,
+    signature: { algorithm: 'ed25519', canonicalisation: PROVENANCE_BUNDLE_SCHEMA, value: sig.toString('base64') },
+  };
+}
+
+const PROVENANCE_BUNDLE_TOP_LEVEL_KEYS = new Set([
+  'schema', 'finding', 'repo', 'provenance', 'engine', 'proves', 'doesNotProve', 'signature',
+]);
+
+/**
+ * Verify with a PUBLIC key only. Rejects any top-level key outside the
+ * allowlist BEFORE checking the signature — same EA-03 fix evidence-bundle.js
+ * carries: a signature only covers the bytes it was computed over, so an
+ * unknown key stapled on after signing would otherwise verify as authentic.
+ */
+function verifyProvenanceEvidenceBundle(bundle, publicKeyPem) {
+  if (!bundle || typeof bundle !== 'object') return { ok: false, reason: 'bundle is not an object' };
+  if (bundle.schema !== PROVENANCE_BUNDLE_SCHEMA) return { ok: false, reason: `unrecognised schema: ${bundle.schema}` };
+  const unknownKeys = Object.keys(bundle).filter((k) => !PROVENANCE_BUNDLE_TOP_LEVEL_KEYS.has(k));
+  if (unknownKeys.length) {
+    return { ok: false, reason: `unrecognised top-level key(s) not covered by the signature: ${unknownKeys.join(', ')}` };
+  }
+  const sig = bundle.signature;
+  if (!sig?.value) return { ok: false, reason: 'bundle is unsigned' };
+  if (sig.algorithm !== 'ed25519') return { ok: false, reason: `unsupported algorithm: ${sig.algorithm}` };
+  if (!publicKeyPem) return { ok: false, reason: 'no public key supplied' };
+  const { signature, ...unsigned } = bundle;
+  let ok = false;
+  try {
+    ok = node_crypto__WEBPACK_IMPORTED_MODULE_0__.verify(null, Buffer.from((0,_evidence_bundle_js__WEBPACK_IMPORTED_MODULE_1__/* .canonicalJson */ .dj)(unsigned), 'utf8'), publicKeyPem, Buffer.from(sig.value, 'base64'));
+  } catch (e) {
+    return { ok: false, reason: `verification error: ${e.message}` };
+  }
+  return ok
+    ? { ok: true, reason: null }
+    : { ok: false, reason: 'signature does not match the bundle contents — it was modified after signing' };
+}
+
+
+
+
+/***/ })
+
+};

package/dist/384.index.js

@@ -8,7 +8,7 @@ export const modules = {
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   scanCredentials: () => (/* reexport safe */ _engine_js__WEBPACK_IMPORTED_MODULE_0__.Sv)
 /* harmony export */ });
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3474);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(7691);
 // Secrets submodule view of the engine — credential + entropy + TODO scanning.