@clear-capabilities/agentic-security-scanner 0.145.0 → 0.147.0

package/dist/6662.index.js

@@ -0,0 +1,297 @@
+export const id = 6662;
+export const ids = [6662];
+export const modules = {
+
+/***/ 6662:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+__webpack_require__.r(__webpack_exports__);
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   evaluateDriftPolicies: () => (/* binding */ evaluateDriftPolicies),
+/* harmony export */   loadDriftPolicies: () => (/* binding */ loadDriftPolicies)
+/* harmony export */ });
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
+// drift-policy.js — M4 deliverable #8, sub-project 8b, Task 2: a
+// before/after drift-policy DSL evaluated against a GraphDiff (Task 1's
+// own output, see graph-diff.js).
+//
+// Mirrors dataflow/privacy-sink-policy.js's fail-closed axis-matching
+// STYLE exactly — the `_matchesEnvironment`/`_matchesDestination`
+// precedent (an unset rule field is unconstrained; a set field the
+// current context has no comparable value for does NOT match) — never
+// its literal single-graph-state shape. That module evaluates a static
+// state ("is this (class, sink) pair permitted right now"); this module
+// evaluates a TRANSITION ("did this (class, sink) pair newly start
+// flowing, or did this flow's own verdict regress"), which is why its
+// rule shape is `{trigger, ...}`-keyed rather than `{allow: [...]}`.
+//
+// ── Design judgment calls made in this file (disclosed, not hidden) ──
+//
+// 1. `loadDriftPolicies(policyFilePath)` takes a literal file path, not
+//    a scanRoot — a deliberate, task-brief-directed divergence from
+//    `loadPrivacySinkPolicy(scanRoot)`'s own scanRoot-relative
+//    convention (`statePath(scanRoot, 'privacy-policy.json')`). Drift
+//    policies are a new artifact with no established scanRoot-relative
+//    home yet (Task 3's CLI wiring is the only real caller, and it can
+//    resolve whatever path convention it wants — e.g. a `--policy`
+//    flag, or a default under `.agentic-security/` — without this
+//    module forcing that choice). Keeping the signature a plain path
+//    keeps this module honest about being a pure evaluator with no
+//    opinion on where its config file lives.
+//
+// 2. The rule vocabulary generalizes `fromPolicyVerdict`/
+//    `toPolicyVerdict` to a second, structurally identical pair,
+//    `fromProtectionSummary`/`toProtectionSummary`, rather than adding a
+//    generic `field`/`from`/`to` triple. The task brief's own worked
+//    examples name `protectionSummary`'s "protected -> unknown/
+//    unprotected" transition as "an equivalent from/to pair for
+//    protectionSummary, generalizing" the policyVerdict pair — read
+//    literally, that is an instruction to add the SAME shape for a
+//    second watched field, not to invent a fully generic DSL over every
+//    WATCHED_FLOW_FIELDS entry. A generic `field`/`from`/`to` triple was
+//    considered and rejected: nothing in the brief's worked examples
+//    needs a THIRD field's transition, and a generic form would need its
+//    own validation against `WATCHED_FLOW_FIELDS` this task's tests
+//    don't exercise. Extending to a fully generic form remains easy
+//    later (both matchers already share one small helper,
+//    `_matchesVerdictTransition`) without a rule-shape migration for
+//    what's shipped today.
+//
+// 3. `dataClass`/`sinkCategory` are read as ADDITIONAL, optional
+//    constraints on a `changed_flow` rule too, not just `new_flow`
+//    rules — the brief's own rule shape lists them as top-level fields
+//    (not scoped textually to `new_flow` alone), and a changed flow's
+//    id is guaranteed present in `graphAfter` by construction (a
+//    `changed.flows` entry only exists when the SAME flow id survived
+//    into the after-graph — see graph-diff.js's own `computeGraphDiff`
+//    header), so the same `_resolveFlowContext` resolution that
+//    `new_flow` rules use applies unchanged. This lets an operator write
+//    "a PHI flow that regresses from protected" as one rule instead of
+//    two, and costs nothing when a rule doesn't set either field (both
+//    stay unconstrained, per the fail-closed style above).
+//
+// 4. A `changed_flow` rule that sets none of
+//    dataClass/sinkCategory/fromPolicyVerdict/toPolicyVerdict/
+//    fromProtectionSummary/toProtectionSummary matches EVERY
+//    `changed.flows` entry — every axis is independently unconstrained,
+//    so a rule with no axes set is the fully unconstrained case, exactly
+//    as an `allow` rule with neither `class` nor `sink` would be in
+//    `privacy-sink-policy.js` (it doesn't have that case in practice
+//    because `sink` is required there; this module has no required axis
+//    besides `trigger`, so the maximally-open rule is reachable and
+//    intentional — "alert on ANY change to a flow matching these
+//    constraints" is a real, useful policy shape).
+//
+// 5. The task brief's PRD-quoted worked examples also name "PII -> AI"
+//    ,"PCI -> log" (both plain `new_flow` shapes, already covered by
+//    dataClass/sinkCategory matching — no separate mechanism needed) and
+//    "new unresolved recipient" (a `governanceRefs.recipient`-shaped
+//    transition). The brief's own "Tests to write" section does not
+//    require a test for the recipient example, and it does not reduce
+//    cleanly to either matcher this task implements (a "new unresolved
+//    recipient" is a value becoming a specific sentinel, not a flow
+//    newly existing or an already-modeled verdict field transitioning)
+//    — left out rather than guessed at. Judgment call #2's rejected
+//    generic `field`/`from`/`to` form is the natural place to add it
+//    later, against a real governanceRefs.recipient fixture.
+//
+// 6. Fix round 1, Important 1 (see graph-diff.js's own judgment call #4):
+//    a `new_flow` rule must skip an added flow entry whose
+//    `causeClassification === 'reidentified'` — that flow isn't actually
+//    new, it's the SAME real-world (source, sink, dataElementIds) flow as
+//    a flow that existed before, just minted under a new flowId because
+//    the engine's own confidence/shape (evidenceGrade/transformationIds)
+//    changed. Firing `new_flow` on it would false-fire `--fail-on-drift`
+//    on a non-event, exactly what this fix round exists to close.
+
+
+
+const POLICY_TRIGGERS = Object.freeze(['new_flow', 'changed_flow']);
+
+function _isValidRuleShape(p) {
+  return !!p && typeof p === 'object' && !Array.isArray(p) && POLICY_TRIGGERS.includes(p.trigger);
+}
+
+/**
+ * Load an operator's drift-policy rules from a literal JSON file path
+ * (see judgment call #1 above — never a scanRoot). Never throws — a
+ * missing file (ENOENT) is "no policies configured," matching
+ * `loadPrivacySinkPolicy`'s own precedent; a malformed file logs a
+ * warning and degrades to no policies. Each entry is validated loosely:
+ * an entry that isn't a plain object with a recognized `trigger` is
+ * skipped (with a warning naming how many were dropped), never crashing
+ * the whole load over one bad rule.
+ */
+function loadDriftPolicies(policyFilePath) {
+  const EMPTY = { policies: [] };
+  if (!policyFilePath) return EMPTY;
+
+  let raw = null;
+  try {
+    raw = JSON.parse(node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(policyFilePath, 'utf8'));
+  } catch (e) {
+    if (e.code !== 'ENOENT') {
+      console.error(`agentic-security: bad JSON in drift policy file (${policyFilePath}) — falling back to no policies (${e.message})`);
+    }
+    return EMPTY;
+  }
+
+  if (!Array.isArray(raw?.policies)) {
+    console.error(`agentic-security: drift policy file ${policyFilePath} has no "policies" array — falling back to no policies (expected {"policies":[...]})`);
+  }
+  const rawPolicies = Array.isArray(raw?.policies) ? raw.policies : [];
+  const policies = rawPolicies.filter(_isValidRuleShape);
+  const skipped = rawPolicies.length - policies.length;
+  if (skipped > 0) {
+    console.error(`agentic-security: skipped ${skipped} malformed drift-policy rule(s) in ${policyFilePath} (each must be an object with trigger: 'new_flow' | 'changed_flow')`);
+  }
+  return { policies };
+}
+
+// Fail-closed, matching privacy-sink-policy.js's own
+// _matchesEnvironment/_matchesDestination precedent exactly: an unset
+// rule value is unconstrained (matches anything); a set rule value with
+// no comparable current value does NOT match.
+function _matchesDataClass(ruleDataClass, dataClasses) {
+  if (ruleDataClass == null) return true;
+  if (!Array.isArray(dataClasses) || !dataClasses.length) return false;
+  return dataClasses.includes(ruleDataClass);
+}
+
+function _matchesSinkCategory(ruleSinkCategory, sinkCategory) {
+  if (ruleSinkCategory == null) return true;
+  if (!sinkCategory) return false;
+  return ruleSinkCategory === sinkCategory;
+}
+
+// Matches a rule's {fromX, toX} pair against the {before, after} of the
+// changes[] entry for field X (or undefined, when that field didn't
+// change on this flow). Unset fromX/toX is unconstrained. A set fromX/
+// toX with no changes[] entry for that field at all (the flow changed,
+// but not on this axis) does NOT match — fails closed, same as an
+// environment-scoped rule against a caller who supplied no environment.
+function _matchesVerdictTransition(ruleFrom, ruleTo, changeEntry) {
+  if (ruleFrom == null && ruleTo == null) return true;
+  if (!changeEntry) return false;
+  if (ruleFrom != null && changeEntry.before !== ruleFrom) return false;
+  if (ruleTo != null && changeEntry.after !== ruleTo) return false;
+  return true;
+}
+
+// Resolves the real dataClasses/sinkCategory/sinkNode/flow for a flow id
+// against graphAfter — shared by both new_flow (added.flows entries) and
+// changed_flow (changed.flows entries) matching, since a changed.flows
+// entry's id is, by construction, present in graphAfter too (see
+// graph-diff.js's own computeGraphDiff: a changed entry only exists for
+// a flow id surviving into the after-graph). Returns null when the id
+// can't be resolved (should not happen for a well-formed GraphDiff
+// produced by computeGraphDiff against its own graphAfter, but a rule
+// must never crash the whole evaluation over a caller-supplied
+// diff/graph pairing that doesn't actually match).
+function _resolveFlowContext(flowId, graphAfter) {
+  const flow = (graphAfter?.flows ?? []).find((f) => f.id === flowId);
+  if (!flow) return null;
+
+  const dataClasses = [];
+  const seen = new Set();
+  for (const deId of flow.dataElementIds ?? []) {
+    const de = (graphAfter.dataElements ?? []).find((d) => d.id === deId);
+    if (!de) continue;
+    for (const cls of de.dataClasses ?? []) {
+      if (!seen.has(cls)) { seen.add(cls); dataClasses.push(cls); }
+    }
+  }
+  const dataElementNames = (flow.dataElementIds ?? [])
+    .map((id) => (graphAfter.dataElements ?? []).find((d) => d.id === id)?.name)
+    .filter((n) => typeof n === 'string' && n.length > 0);
+
+  const sinkNode = (graphAfter.nodes ?? []).find((n) => n.id === flow.sink) ?? null;
+  const sinkCategory = sinkNode?.subtype ?? sinkNode?.kind ?? null;
+
+  return { flow, dataClasses, dataElementNames, sinkNode, sinkCategory };
+}
+
+function _describeTransition(changeEntry) {
+  if (!changeEntry) return null;
+  return `${changeEntry.field} ${changeEntry.before} -> ${changeEntry.after}`;
+}
+
+function _buildViolation(rule, trigger, ctx, transitionDescriptions) {
+  const base = trigger === 'new_flow'
+    ? `New flow ${ctx.flow.id} (${ctx.dataClasses.join('/') || 'unclassified data'}) newly reaches sink ${ctx.sinkCategory ?? ctx.sinkNode?.id ?? 'unknown'}`
+    : `Flow ${ctx.flow.id} changed: ${transitionDescriptions.length ? transitionDescriptions.join(', ') : 'matched changed_flow rule (no policyVerdict/protectionSummary transition named by this rule)'}`;
+  const reason = rule.reason ? `${base} (${rule.reason})` : base;
+
+  return {
+    flowId: ctx.flow.id,
+    dataElementNames: ctx.dataElementNames,
+    sinkCategory: ctx.sinkCategory,
+    sinkNodeId: ctx.sinkNode?.id ?? ctx.flow.sink,
+    trigger,
+    rule,
+    reason,
+  };
+}
+
+/**
+ * Evaluates operator-configured drift policies against a GraphDiff.
+ * `policies` is `{policies: [...]}` (loadDriftPolicies' own return
+ * shape). `graphAfter` is the AFTER graph the diff was computed against
+ * — needed because an `added.flows`/`changed.flows` entry carries only
+ * `{id, causeClassification, ...}` (see graph-diff.js's own header),
+ * never dataElement/sink info directly.
+ *
+ * Returns `{violations: [...]}` — never a bare boolean per flow; every
+ * violation names the real triggering flow (id, data element names,
+ * sink), the rule that fired, and a human-readable `reason` string.
+ */
+function evaluateDriftPolicies(diff, policies, graphAfter) {
+  const violations = [];
+  const rules = Array.isArray(policies?.policies) ? policies.policies : [];
+  if (!rules.length) return { violations };
+
+  for (const rule of rules) {
+    if (rule.trigger === 'new_flow') {
+      for (const addedEntry of diff?.added?.flows ?? []) {
+        // See judgment call #6 above / graph-diff.js's own judgment call
+        // #4: a reidentified added flow is not actually new.
+        if (addedEntry.causeClassification === 'reidentified') continue;
+        const ctx = _resolveFlowContext(addedEntry.id, graphAfter);
+        if (!ctx) continue;
+        if (!_matchesDataClass(rule.dataClass, ctx.dataClasses)) continue;
+        if (!_matchesSinkCategory(rule.sinkCategory, ctx.sinkCategory)) continue;
+        violations.push(_buildViolation(rule, 'new_flow', ctx, []));
+      }
+    } else if (rule.trigger === 'changed_flow') {
+      for (const changedEntry of diff?.changed?.flows ?? []) {
+        const ctx = _resolveFlowContext(changedEntry.id, graphAfter);
+        if (!ctx) continue;
+        if (!_matchesDataClass(rule.dataClass, ctx.dataClasses)) continue;
+        if (!_matchesSinkCategory(rule.sinkCategory, ctx.sinkCategory)) continue;
+
+        const changes = Array.isArray(changedEntry.changes) ? changedEntry.changes : [];
+        const policyChange = changes.find((c) => c.field === 'policyVerdict');
+        if (!_matchesVerdictTransition(rule.fromPolicyVerdict, rule.toPolicyVerdict, policyChange)) continue;
+
+        const protectionChange = changes.find((c) => c.field === 'protectionSummary');
+        if (!_matchesVerdictTransition(rule.fromProtectionSummary, rule.toProtectionSummary, protectionChange)) continue;
+
+        const transitionDescriptions = [policyChange, protectionChange].map(_describeTransition).filter(Boolean);
+        violations.push(_buildViolation(rule, 'changed_flow', ctx, transitionDescriptions));
+      }
+    }
+    // An unrecognized trigger was already filtered out by
+    // loadDriftPolicies' own _isValidRuleShape when loaded from disk; a
+    // directly hand-built `policies` object (as tests do) with an
+    // unrecognized trigger simply matches nothing, silently — the same
+    // "match nothing rather than throw" discipline as every other
+    // unresolvable axis in this file.
+  }
+
+  return { violations };
+}
+
+
+/***/ })
+
+};

package/dist/{675.index.js → 6675.index.js}

@@ -1,5 +1,5 @@
-export const id = 675;
-export const ids = [675];
+export const id = 6675;
+export const ids = [6675];
 export const modules = {
 
 /***/ 6675:
@@ -281,7 +281,7 @@ async function _queryOsvForDep({ name, ecosystem }, { fetchImpl = globalThis.fet
 // ─── State persistence ───────────────────────────────────────────────────
 
 function loadState(scanRoot) {
-  const fp = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__/* .statePath */ .BQ)(scanRoot, 'cve-alerts-state.json');
+  const fp = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.statePath)(scanRoot, 'cve-alerts-state.json');
   if (!node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(fp)) return { known: new Set(), lastRun: null };
   try {
     const j = JSON.parse(node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(fp, 'utf8'));
@@ -290,7 +290,7 @@ function loadState(scanRoot) {
 }
 
 function persistState(scanRoot, state) {
-  const fp = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__/* .statePath */ .BQ)(scanRoot, 'cve-alerts-state.json');
+  const fp = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.statePath)(scanRoot, 'cve-alerts-state.json');
   if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.stateWritesEnabled)()) return;
   node_fs__WEBPACK_IMPORTED_MODULE_0__.mkdirSync(node_path__WEBPACK_IMPORTED_MODULE_1__.dirname(fp), { recursive: true });
   node_fs__WEBPACK_IMPORTED_MODULE_0__.writeFileSync(fp, JSON.stringify({
@@ -300,7 +300,7 @@ function persistState(scanRoot, state) {
 }
 
 function loadConfig(scanRoot) {
-  const fp = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__/* .statePath */ .BQ)(scanRoot, 'cve-alerts.json');
+  const fp = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.statePath)(scanRoot, 'cve-alerts.json');
   if (!node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(fp)) return null;
   try { return JSON.parse(node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(fp, 'utf8')); } catch { return null; }
 }

package/dist/{730.index.js → 6730.index.js}

@@ -1,5 +1,5 @@
-export const id = 730;
-export const ids = [730,144];
+export const id = 6730;
+export const ids = [6730,5144];
 export const modules = {
 
 /***/ 5144:
@@ -65,7 +65,7 @@ const LEGAL_HOLD_FILE = 'legal-holds.json';
 
 function _loadRaw(scanRoot) {
   let fp;
-  try { fp = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_1__/* .statePath */ .BQ)(scanRoot, LEGAL_HOLD_FILE); } catch { return []; }
+  try { fp = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_1__.statePath)(scanRoot, LEGAL_HOLD_FILE); } catch { return []; }
   let raw;
   try { raw = node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(fp, 'utf8'); } catch { return []; }
   try {
@@ -135,7 +135,7 @@ function addLegalHold(scanRoot, { artifact, owner, reason, expires_at } = {}) {
   const hold = { artifact, owner, reason, expires_at: expires_at || null, created_at: new Date().toISOString() };
   const holds = _loadRaw(scanRoot);
   holds.push(hold);
-  const fp = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_1__/* .statePath */ .BQ)(scanRoot, LEGAL_HOLD_FILE);
+  const fp = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_1__.statePath)(scanRoot, LEGAL_HOLD_FILE);
   if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_1__/* .safeWriteState */ .Ep)(fp, JSON.stringify(holds, null, 2) + '\n')) {
     return { ok: false, reason: 'state writes are disabled (--no-state) or this is not a safe state directory' };
   }
@@ -151,7 +151,7 @@ function removeLegalHold(scanRoot, artifact) {
   const remaining = holds.filter(h => !(h && h.artifact === artifact));
   const removedCount = holds.length - remaining.length;
   if (removedCount > 0) {
-    const fp = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_1__/* .statePath */ .BQ)(scanRoot, LEGAL_HOLD_FILE);
+    const fp = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_1__.statePath)(scanRoot, LEGAL_HOLD_FILE);
     (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_1__/* .safeWriteState */ .Ep)(fp, JSON.stringify(remaining, null, 2) + '\n');
   }
   return removedCount;
@@ -242,7 +242,7 @@ const RETENTION_DEFAULTS = {
 function loadRetentionPolicy(scanRoot) {
   if (!scanRoot) return null;
   let fp;
-  try { fp = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__/* .statePath */ .BQ)(scanRoot, POLICY_FILE); } catch { return null; }
+  try { fp = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.statePath)(scanRoot, POLICY_FILE); } catch { return null; }
   let raw;
   try { raw = node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(fp, 'utf8'); } catch { return null; }
   try {

package/dist/6829.index.js

@@ -0,0 +1,225 @@
+export const id = 6829;
+export const ids = [6829];
+export const modules = {
+
+/***/ 6829:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   OBLIGATION_EVIDENCE_PACK_SCHEMA: () => (/* binding */ OBLIGATION_EVIDENCE_PACK_SCHEMA),
+/* harmony export */   buildObligationEvidencePack: () => (/* binding */ buildObligationEvidencePack),
+/* harmony export */   ensureKeyPair: () => (/* reexport safe */ _evidence_bundle_js__WEBPACK_IMPORTED_MODULE_0__.ensureKeyPair),
+/* harmony export */   signObligationEvidencePack: () => (/* binding */ signObligationEvidencePack),
+/* harmony export */   verifyObligationEvidencePack: () => (/* binding */ verifyObligationEvidencePack)
+/* harmony export */ });
+/* harmony import */ var _evidence_bundle_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(8317);
+/* harmony import */ var _evidence_grade_wording_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(3540);
+/* harmony import */ var _lineage_export_json_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(859);
+/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(7598);
+// obligation-evidence-pack.js — Milestone 4 sub-project 6c: signed,
+// versioned evidence packs for a Regulatory Obligation Overlay framework
+// evaluation (FR-504, PRD §10.10). Fourth sibling in the
+// evidence-bundle.js family — see that module's own header for the
+// shared-key rationale, and provenance-evidence-bundle.js for the most
+// directly mirrored precedent (same reused ensureKeyPair/keyPaths/
+// canonicalJson, own schema string, own build/sign/verify trio, own
+// top-level-key allowlist).
+//
+// WHAT THIS IS NOT
+// -----------------
+// Not a reuse of evidence-bundle.js's own bundle shape (that's a single
+// FINDING's evidence — proofTier/taintPath/etc; this artifact has no
+// finding at all). Not compliance-evidence-signing.js's ComplianceEvidence
+// manifest either — that signs the pre-existing family:/module:/rule:-
+// driven present/partial/absent/manual walkthrough status; this signs the
+// newer, additive graph: mapping type's own real ObligationMapping
+// records (evaluateGraphFlowPredicate/buildObligationMappingFromGraphPredicate,
+// sub-project 6b) — a distinct FR-504 artifact with its own field list
+// (scope, framework versions, facts, evidence index, unknown/manual
+// items, accepted exceptions, scan health, limitations, graph digest,
+// reproducibility metadata).
+//
+// THE EVIDENCE-INDEX DESIGN DECISION (see the scoping doc for the full
+// writeup)
+// -----------------------------------------------------------------
+// A real ObligationMapping record's own `evidence[]` is structurally
+// always empty today (graph-builder.js hardcodes `edge.evidenceRefs: []`
+// on every minted edge, disclosed in obligation-predicates.js's own
+// header). Rather than ship an evidence pack whose "evidence index" is
+// honestly, permanently empty, this module builds a REAL evidence index
+// from each fact's own `contributingGraphIds` (real flow ids
+// evaluateGraphFlowPredicate already returns) — resolving each flow id
+// back into a small, real summary (source/sink kind, dataElement
+// dataClasses, the edge's own transit/atRest/handling verdicts) by
+// joining against the graph's own entity arrays. `record.evidence` is
+// still carried through verbatim on each fact (honest, even though
+// empty) — the evidence index is an ADDITIONAL section built from data
+// that genuinely IS populated, not a replacement that hides the gap.
+
+
+
+
+
+
+const OBLIGATION_EVIDENCE_PACK_SCHEMA = 'agentic-security/obligation-evidence-pack@1';
+
+function _asArray(v) {
+  return Array.isArray(v) ? v : [];
+}
+
+/**
+ * Resolve one ObligationMapping fact's contributingGraphIds (real flow
+ * ids) into a small, real, human-and-machine-readable summary per flow —
+ * the evidence index's own per-fact contribution. Never throws: a flow id
+ * that no longer resolves against this graph (a stale pack re-evaluated
+ * against a newer graph, or a malformed fact) is simply skipped, not
+ * fabricated.
+ */
+function _resolveEvidenceForFact(fact, joins) {
+  const { flowsById, nodesById, edgesById, dataElementsById } = joins;
+  const flowIds = _asArray(fact?.contributingGraphIds);
+  const resolved = [];
+  for (const flowId of flowIds) {
+    const flow = flowsById.get(flowId);
+    if (!flow) continue;
+    const sourceNode = nodesById.get(flow.source);
+    const sinkNode = nodesById.get(flow.sink);
+    // Reads only edgeIds[0] — mirrors obligation-predicates.js's own
+    // disclosed, currently-unreachable limitation (graph-builder.js always
+    // mints single-edge flows; see that module's own header) rather than
+    // inventing a different convention for the same case here.
+    const edge = edgesById.get(_asArray(flow.edgeIds)[0]);
+    const dataClasses = _asArray(flow.dataElementIds)
+      .map((id) => dataElementsById.get(id))
+      .filter(Boolean)
+      .flatMap((d) => _asArray(d.dataClasses));
+    resolved.push({
+      flowId,
+      source: sourceNode ? { kind: sourceNode.kind ?? null, subtype: sourceNode.subtype ?? null } : null,
+      sink: sinkNode ? { kind: sinkNode.kind ?? null, subtype: sinkNode.subtype ?? null } : null,
+      dataClasses: [...new Set(dataClasses)],
+      transitVerdict: edge?.protection?.transit?.verdict ?? null,
+      atRestVerdict: edge?.protection?.atRest?.verdict ?? null,
+      handlingVerdict: edge?.protection?.handling?.verdict ?? null,
+    });
+  }
+  return resolved;
+}
+
+function _buildJoins(graph) {
+  return {
+    flowsById: new Map(_asArray(graph?.flows).filter(Boolean).map((f) => [f.id, f])),
+    nodesById: new Map(_asArray(graph?.nodes).filter(Boolean).map((n) => [n.id, n])),
+    edgesById: new Map(_asArray(graph?.edges).filter(Boolean).map((e) => [e.id, e])),
+    dataElementsById: new Map(_asArray(graph?.dataElements).filter(Boolean).map((d) => [d.id, d])),
+  };
+}
+
+/**
+ * Build an unsigned evidence pack from a framework evaluation. Never
+ * throws: every field degrades honestly on missing input rather than
+ * fabricating a value — a null/absent graph yields empty facts/
+ * evidenceIndex and a null graphDigest/scope, never a guess.
+ *
+ * @param {object} args
+ * @param {object|null} args.graph - the scan's DataFlowGraph v1 document (scan.lineageGraph), or null
+ * @param {object} args.framework - the loaded framework object (auditor-walkthrough.js#loadFramework's return)
+ * @param {Array}  args.evaluation - auditor-walkthrough.js#evaluateFramework's return (per-control entries, each carrying .obligationMappings)
+ * @param {object|null} [args.scanHealth] - scan.scanHealth, passed through verbatim; null if not supplied, never fabricated
+ * @param {string|null} [args.engineVersion]
+ * @param {string|null} [args.rulesetVersion]
+ * @param {string|null} [args.bundleSha]
+ * @param {string} [args.generatedAt] - defaults to new Date().toISOString()
+ */
+function buildObligationEvidencePack({
+  graph, framework, evaluation, scanHealth, engineVersion, rulesetVersion, bundleSha, generatedAt,
+} = {}) {
+  const facts = _asArray(evaluation).flatMap((e) => _asArray(e?.obligationMappings));
+  const joins = _buildJoins(graph);
+  const evidenceIndex = facts.map((fact) => ({
+    obligationId: fact?.id ?? null,
+    requirementId: fact?.requirementId ?? null,
+    evidence: _resolveEvidenceForFact(fact, joins),
+  }));
+
+  return {
+    schema: OBLIGATION_EVIDENCE_PACK_SCHEMA,
+    framework: {
+      id: framework?.id ?? null,
+      name: framework?.name ?? null,
+      version: framework?.controlsDigest ?? null,
+      publisher: framework?.publisher ?? null,
+      url: framework?.url ?? null,
+    },
+    scope: graph?.scope ?? null,
+    facts,
+    evidenceIndex,
+    unknownItems: facts.filter((f) => f?.state === 'unknown'),
+    manualItems: facts.filter((f) => f?.state === 'manual_required'),
+    acceptedExceptions: facts.filter((f) => f?.state === 'accepted_exception'),
+    scanHealth: scanHealth ?? null,
+    limitations: _asArray(graph?.limitations),
+    graphDigest: graph ? (0,_lineage_export_json_js__WEBPACK_IMPORTED_MODULE_2__.computeGraphDigest)(graph) : null,
+    reproducibility: {
+      graphId: graph?.graphId ?? null,
+      graphDigest: graph ? (0,_lineage_export_json_js__WEBPACK_IMPORTED_MODULE_2__.computeGraphDigest)(graph) : null,
+      engineVersion: engineVersion ?? null,
+      rulesetVersion: rulesetVersion ?? null,
+      bundleSha: bundleSha ?? null,
+      generatedAt: generatedAt ?? new Date().toISOString(),
+    },
+    disclaimer: _evidence_grade_wording_js__WEBPACK_IMPORTED_MODULE_1__/* .EVIDENCE_GRADE_DISCLAIMER */ .ux,
+  };
+}
+
+/** Sign a pack. Returns a new object; the input is not mutated. */
+function signObligationEvidencePack(pack, privateKeyPem) {
+  const sig = node_crypto__WEBPACK_IMPORTED_MODULE_3__.sign(null, Buffer.from((0,_evidence_bundle_js__WEBPACK_IMPORTED_MODULE_0__/* .canonicalJson */ .dj)(pack), 'utf8'), privateKeyPem);
+  return {
+    ...pack,
+    signature: { algorithm: 'ed25519', canonicalisation: OBLIGATION_EVIDENCE_PACK_SCHEMA, value: sig.toString('base64') },
+  };
+}
+
+const OBLIGATION_EVIDENCE_PACK_TOP_LEVEL_KEYS = new Set([
+  'schema', 'framework', 'scope', 'facts', 'evidenceIndex', 'unknownItems',
+  'manualItems', 'acceptedExceptions', 'scanHealth', 'limitations',
+  'graphDigest', 'reproducibility', 'disclaimer', 'signature',
+]);
+
+/**
+ * Verify with a PUBLIC key only. Rejects any top-level key outside the
+ * allowlist BEFORE checking the signature — same EA-03 discipline every
+ * sibling in this family carries: a signature only covers the bytes it
+ * was computed over, so a key stapled on after signing would otherwise
+ * verify as authentic.
+ */
+function verifyObligationEvidencePack(pack, publicKeyPem) {
+  if (!pack || typeof pack !== 'object') return { ok: false, reason: 'pack is not an object' };
+  if (pack.schema !== OBLIGATION_EVIDENCE_PACK_SCHEMA) return { ok: false, reason: `unrecognised schema: ${pack.schema}` };
+  const unknownKeys = Object.keys(pack).filter((k) => !OBLIGATION_EVIDENCE_PACK_TOP_LEVEL_KEYS.has(k));
+  if (unknownKeys.length) {
+    return { ok: false, reason: `unrecognised top-level key(s) not covered by the signature: ${unknownKeys.join(', ')}` };
+  }
+  const sig = pack.signature;
+  if (!sig?.value) return { ok: false, reason: 'pack is unsigned' };
+  if (sig.algorithm !== 'ed25519') return { ok: false, reason: `unsupported algorithm: ${sig.algorithm}` };
+  if (!publicKeyPem) return { ok: false, reason: 'no public key supplied' };
+  const { signature, ...unsigned } = pack;
+  let ok = false;
+  try {
+    ok = node_crypto__WEBPACK_IMPORTED_MODULE_3__.verify(null, Buffer.from((0,_evidence_bundle_js__WEBPACK_IMPORTED_MODULE_0__/* .canonicalJson */ .dj)(unsigned), 'utf8'), publicKeyPem, Buffer.from(sig.value, 'base64'));
+  } catch (e) {
+    return { ok: false, reason: `verification error: ${e.message}` };
+  }
+  return ok
+    ? { ok: true, reason: null }
+    : { ok: false, reason: 'signature does not match the pack contents — it was modified after signing' };
+}
+
+
+
+
+/***/ })
+
+};