@clear-capabilities/agentic-security-scanner 0.149.4 → 0.150.2

package/dist/4265.index.js

@@ -2,16 +2,16 @@ export const id = 4265;
 export const ids = [4265];
 export const modules = {
 
-/***/ 4265:
+/***/ 84265:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   createCascadePool: () => (/* binding */ createCascadePool)
 /* harmony export */ });
 /* unused harmony export DEFAULT_GRACE_MS */
-/* harmony import */ var node_worker_threads__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(5919);
-/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6760);
-/* harmony import */ var node_url__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(3136);
+/* harmony import */ var node_worker_threads__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(75919);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(76760);
+/* harmony import */ var node_url__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(73136);
 // FR-202 phase 3b (D-0050): a pool of long-lived workers, each running engine.js's
 // _runFileCascade for many files over its lifetime, instead of the one-shot-per-call
 // model runWithDeadline/analyzer-supervisor.js uses (which is correct for FR-202's

package/dist/4384.index.js

@@ -2,16 +2,21 @@ export const id = 4384;
 export const ids = [4384];
 export const modules = {
 
-/***/ 4384:
-/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+/***/ 74384:
+/***/ ((__webpack_module__, __webpack_exports__, __webpack_require__) => {
 
+__webpack_require__.a(__webpack_module__, async (__webpack_handle_async_dependencies__, __webpack_async_result__) => { try {
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   scanCredentials: () => (/* reexport safe */ _engine_js__WEBPACK_IMPORTED_MODULE_0__.Sv)
 /* harmony export */ });
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(9753);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(67198);
+var __webpack_async_dependencies__ = __webpack_handle_async_dependencies__([_engine_js__WEBPACK_IMPORTED_MODULE_0__]);
+_engine_js__WEBPACK_IMPORTED_MODULE_0__ = (__webpack_async_dependencies__.then ? (await __webpack_async_dependencies__)() : __webpack_async_dependencies__)[0];
 // Secrets submodule view of the engine — credential + entropy + TODO scanning.
 
 
+__webpack_async_result__();
+} catch(e) { __webpack_async_result__(e); } });
 
 /***/ })
 

package/dist/4399.index.js

@@ -0,0 +1,292 @@
+export const id = 4399;
+export const ids = [4399];
+export const modules = {
+
+/***/ 54399:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   MEMORY_PROFILES: () => (/* binding */ MEMORY_PROFILES),
+/* harmony export */   capabilitiesFromFamilyHint: () => (/* binding */ capabilitiesFromFamilyHint),
+/* harmony export */   classifyModelFamily: () => (/* binding */ classifyModelFamily),
+/* harmony export */   detectMemoryTier: () => (/* binding */ detectMemoryTier),
+/* harmony export */   detectSystemMemory: () => (/* binding */ detectSystemMemory),
+/* harmony export */   recommendAdmission: () => (/* binding */ recommendAdmission)
+/* harmony export */ });
+/* unused harmony exports KNOWN_MODEL_SIZE_GB, evaluateMemoryAdmission */
+/* harmony import */ var node_os__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(48161);
+/* harmony import */ var _oom_feedback_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6782);
+// Model family hints, RAM-aware memory profiles, and the memory-admission
+// check for the Ollama provider (agentic-security-ollama-offline-prd.md
+// §13, §14, §15, §22.3, §30).
+//
+// FAMILY HINTS ARE DEFAULTS, NEVER AUTHORITY (PRD §12/§13). A name like
+// `gemma4:e2b` tells us nothing Ollama itself won't confirm — it only lets the
+// harness suggest a sane default before any network call. If a model actually
+// installed under a family-hinted name lacks a capability the hint implied,
+// the runtime probe (model-probe.js, added when tool-calling/structured-output
+// probing lands) always wins. This module only classifies and estimates; it
+// never asserts a capability is present.
+//
+// MEMORY NUMBERS ARE ESTIMATES, NOT PROMISES (PRD §22.3, §14.1). Ollama
+// artifact sizes and this module's headroom reserves are best-effort figures
+// sourced from what Ollama currently publishes; they exist so the harness can
+// fail BEFORE an OS-level OOM, not so it can claim an exact answer. Every
+// admission decision leaves a stated safety margin rather than trying to pack
+// memory to the byte.
+
+
+
+
+// PRD §12/§13 FR-1203 — non-authoritative family hint from a model name.
+// Longest/most-specific pattern first so `qwen3.5:4b` doesn't fall through to
+// the bare `qwen` bucket.
+const FAMILY_PATTERNS = [
+  [/^qwen3\.5/i, 'qwen3.5'],
+  [/^qwen3-coder-next/i, 'qwen3-coder-next'],
+  [/^qwen3-coder/i, 'qwen3-coder'],
+  [/^qwen2\.5-coder/i, 'qwen2.5-coder'],
+  [/^qwen3/i, 'qwen3'],
+  [/^qwen/i, 'qwen'],
+  [/^gemma4/i, 'gemma4'],
+  [/^functiongemma/i, 'functiongemma'],
+  [/^gemma3/i, 'gemma3'],
+  [/^gemma/i, 'gemma'],
+];
+
+/** Non-authoritative family classification for defaults/messaging only. */
+function classifyModelFamily(modelName) {
+  const name = String(modelName || '').trim();
+  for (const [re, family] of FAMILY_PATTERNS) if (re.test(name)) return family;
+  return 'unknown';
+}
+
+// PRD §13.1 — non-authoritative defaults per family, overridden by any real
+// runtime probe result (model-probe.js). `tools`/`structuredJson`/`thinking`
+// are 'unknown' where Ollama's own behavior varies by specific tag/quant
+// rather than by family alone.
+const FAMILY_CAPABILITY_HINTS = {
+  'qwen3.5': { chat: true, structuredJson: true, tools: true, thinking: 'unknown' },
+  qwen3: { chat: true, structuredJson: true, tools: true, thinking: 'unknown' },
+  'qwen3-coder': { chat: true, structuredJson: true, tools: true, thinking: false },
+  'qwen3-coder-next': { chat: true, structuredJson: true, tools: true, thinking: false },
+  'qwen2.5-coder': { chat: true, structuredJson: true, tools: 'unknown', thinking: false },
+  qwen: { chat: true, structuredJson: 'unknown', tools: 'unknown', thinking: 'unknown' },
+  gemma4: { chat: true, structuredJson: true, tools: true, thinking: 'unknown' },
+  functiongemma: { chat: true, structuredJson: 'unknown', tools: true, thinking: false },
+  gemma3: { chat: true, structuredJson: true, tools: false, thinking: false },
+  gemma: { chat: true, structuredJson: 'unknown', tools: 'unknown', thinking: 'unknown' },
+  unknown: { chat: true, structuredJson: 'unknown', tools: 'unknown', thinking: 'unknown' },
+};
+
+/**
+ * Build the PRD §13.1 ModelCapabilities object from a family hint alone
+ * (Layer B). Layer A (Ollama's own /api/show metadata) and Layer C (runtime
+ * probes) are applied by the caller and override these fields — this
+ * function only ever sets `source.familyHint: true`.
+ */
+function capabilitiesFromFamilyHint(modelName) {
+  const family = classifyModelFamily(modelName);
+  const hint = FAMILY_CAPABILITY_HINTS[family] || FAMILY_CAPABILITY_HINTS.unknown;
+  return {
+    chat: hint.chat,
+    structuredJson: hint.structuredJson,
+    tools: hint.tools,
+    thinking: hint.thinking,
+    vision: false,
+    contextTokens: undefined,
+    source: { metadata: false, familyHint: true, runtimeProbe: false },
+  };
+}
+
+// ── RAM-aware memory profiles (PRD §14.4, §15.2, §22.3, §30) ───────────────
+
+const MB = 1024 * 1024;
+const GB = 1024 * MB;
+
+// Best-effort artifact sizes as currently distributed by Ollama, used only to
+// pick a SENSIBLE STARTING recommendation — the real admission decision below
+// uses actually-free memory, not this table. Keep in sync with the PRD's own
+// cited figures; a stale entry only affects the suggested default, never the
+// admission math (which reads real os.freemem()).
+const KNOWN_MODEL_SIZE_GB = Object.freeze({
+  'qwen3.5:2b': 1.7,
+  'qwen3.5:4b': 3.4,
+  'qwen3.5:9b': 6.6,
+  'gemma4:e2b': 7.2,
+  'gemma4:12b': 7.6,
+  'gemma4:latest': 9.6,
+});
+
+/** PRD §30 profile presets. `auto` picks between these by detected RAM. */
+const MEMORY_PROFILES = Object.freeze({
+  '8gb': {
+    label: '8gb',
+    preferredModel: 'qwen3.5:4b',
+    fallbackModel: 'qwen3.5:2b',
+    initialContextTokens: 4096,
+    targetContextTokens: 8192,
+    maxConcurrency: 1,
+    minFreeRamMb: 1536,
+  },
+  '16gb-qwen': {
+    label: '16gb-qwen',
+    preferredModel: 'qwen3.5:9b',
+    fallbackModel: 'qwen3.5:4b',
+    initialContextTokens: 16384,
+    targetContextTokens: 32768,
+    maxConcurrency: 1,
+    minFreeRamMb: 2048,
+  },
+  '16gb-gemma': {
+    label: '16gb-gemma',
+    preferredModel: 'gemma4:e2b',
+    fallbackModel: 'qwen3.5:4b',
+    initialContextTokens: 8192,
+    targetContextTokens: 16384,
+    maxConcurrency: 1,
+    minFreeRamMb: 2048,
+  },
+});
+
+/**
+ * PRD §22.3 — detect total/available system RAM. Thin wrapper over `os` so
+ * tests can inject fake values without mocking the `os` module globally.
+ */
+function detectSystemMemory({ totalBytes, freeBytes } = {}) {
+  return {
+    totalBytes: Number.isFinite(totalBytes) ? totalBytes : node_os__WEBPACK_IMPORTED_MODULE_0__.totalmem(),
+    freeBytes: Number.isFinite(freeBytes) ? freeBytes : node_os__WEBPACK_IMPORTED_MODULE_0__.freemem(),
+  };
+}
+
+/**
+ * Pick the RAM tier ('8gb' | '16gb') a machine falls into. Anything under
+ * ~9 GB total is treated as the 8 GB tier — real "8 GB" machines report
+ * slightly less than 8*1024^3 bytes to userspace (firmware/GPU reservations),
+ * so a hard `< 8*GB` cutoff would misclassify real 8 GB hardware as unknown.
+ */
+function detectMemoryTier(totalBytes) {
+  if (!Number.isFinite(totalBytes) || totalBytes <= 0) return 'unknown';
+  if (totalBytes < 9 * GB) return '8gb';
+  return '16gb';
+}
+
+/**
+ * PRD §22.3 admission algorithm: does `contextTokens` at `model` fit in
+ * currently-free memory with the configured reserve intact?
+ *
+ * This is deliberately conservative and coarse (PRD "avoid pretending memory
+ * estimates are exact"): model residency is estimated from KNOWN_MODEL_SIZE_GB
+ * when available (falling back to a pessimistic 8 GB assumption for an
+ * unrecognized tag so an unknown model never LOOKS safer than a known large
+ * one), and KV-cache growth is approximated as a fixed per-1K-token cost
+ * rather than modeled per-architecture — real KV cache size depends on layer
+ * count/head count/quantization the harness cannot know without Ollama's own
+ * runtime numbers.
+ */
+const ESTIMATED_KV_CACHE_MB_PER_1K_TOKENS = 32; // conservative, model-independent approximation
+const RUNTIME_OVERHEAD_MB = 512; // Ollama server + OS scheduler slack, independent of model size
+
+function evaluateMemoryAdmission({
+  modelName,
+  contextTokens,
+  freeBytes,
+  minFreeRamMb,
+  modelSizeGb,
+} = {}) {
+  const sizeGb = Number.isFinite(modelSizeGb) ? modelSizeGb : (KNOWN_MODEL_SIZE_GB[modelName] ?? 8);
+  const modelMb = sizeGb * 1024;
+  const kvCacheMb = (Number(contextTokens) || 0) / 1000 * ESTIMATED_KV_CACHE_MB_PER_1K_TOKENS;
+  const requiredMb = modelMb + kvCacheMb + RUNTIME_OVERHEAD_MB + (Number(minFreeRamMb) || 0);
+  const freeMb = (Number(freeBytes) || 0) / MB;
+  const admitted = freeMb >= requiredMb;
+  return {
+    admitted,
+    freeMb: Math.round(freeMb),
+    requiredMb: Math.round(requiredMb),
+    modelEstimateMb: Math.round(modelMb),
+    kvCacheEstimateMb: Math.round(kvCacheMb),
+    reserveMb: Number(minFreeRamMb) || 0,
+  };
+}
+
+/**
+ * Full recommendation flow (PRD §22 "Memory admission algorithm"):
+ * try the profile's preferred context, shrink it, then fall back to the
+ * profile's smaller model, before ever declaring the profile unusable.
+ * Never recommends cloud — the worst outcome this function can return is
+ * `{admitted:false}` with a human-readable explanation, which callers treat
+ * as "run deterministic-only" (PRD §23.4).
+ */
+function recommendAdmission(opts = {}) {
+  const result = _recommendAdmissionCore(opts);
+  // Adversarial-review fix (2026-09): a memory-admission ESTIMATE that
+  // actually caused a real OOM (ollama-provider.js's callOllamaChat now
+  // records this via oom-feedback.js) used to have no way to affect a
+  // future admission decision for the SAME model on the SAME machine — the
+  // exact same "admitted: true" would repeat forever. This does not
+  // recalibrate the underlying estimate (that needs real hardware variety
+  // one machine's observed failures can't substitute for); it attaches an
+  // honest warning so the decision is no longer presented with unqualified
+  // confidence.
+  const chosenModel = result.model || opts.requestedModel;
+  const prior = chosenModel ? (0,_oom_feedback_js__WEBPACK_IMPORTED_MODULE_1__/* .priorOOMFor */ .NL)(chosenModel) : null;
+  if (prior) {
+    return {
+      ...result,
+      priorOOMWarning: `'${chosenModel}' has previously failed with an out-of-memory error on this machine ` +
+        `(${prior.count} time${prior.count === 1 ? '' : 's'}, most recently ${new Date(prior.lastAt).toISOString()}). ` +
+        'The memory estimate below may be optimistic for your hardware.',
+    };
+  }
+  return result;
+}
+
+function _recommendAdmissionCore({ profile, freeBytes, requestedContextTokens, requestedModel } = {}) {
+  const p = MEMORY_PROFILES[profile];
+  if (!p) return { admitted: false, reason: `unknown memory profile '${profile}'` };
+
+  const model = requestedModel || p.preferredModel;
+  const attempts = [];
+
+  // 1. Requested (or target) context at the requested/preferred model.
+  const primaryContext = Number.isFinite(requestedContextTokens) ? requestedContextTokens : p.targetContextTokens;
+  let check = evaluateMemoryAdmission({ modelName: model, contextTokens: primaryContext, freeBytes, minFreeRamMb: p.minFreeRamMb });
+  attempts.push({ model, contextTokens: primaryContext, ...check });
+  if (check.admitted) return { admitted: true, model, contextTokens: primaryContext, attempts };
+
+  // 2. Reduce context to the profile's conservative initial value first —
+  //    PRD FR-2104: "shrink context before declaring an otherwise compatible
+  //    model unusable."
+  if (primaryContext !== p.initialContextTokens) {
+    check = evaluateMemoryAdmission({ modelName: model, contextTokens: p.initialContextTokens, freeBytes, minFreeRamMb: p.minFreeRamMb });
+    attempts.push({ model, contextTokens: p.initialContextTokens, ...check });
+    if (check.admitted) return { admitted: true, model, contextTokens: p.initialContextTokens, attempts, reducedContext: true };
+  }
+
+  // 3. Fall back to the profile's smaller model at its initial context.
+  if (p.fallbackModel && p.fallbackModel !== model) {
+    check = evaluateMemoryAdmission({ modelName: p.fallbackModel, contextTokens: p.initialContextTokens, freeBytes, minFreeRamMb: p.minFreeRamMb });
+    attempts.push({ model: p.fallbackModel, contextTokens: p.initialContextTokens, ...check });
+    if (check.admitted) {
+      return {
+        admitted: true, model: p.fallbackModel, contextTokens: p.initialContextTokens, attempts,
+        reducedContext: true, fellBackToSmallerModel: true,
+      };
+    }
+  }
+
+  // 4. Nothing fits — deterministic-only, never cloud.
+  return {
+    admitted: false,
+    attempts,
+    reason: `No local model/context combination fit in available memory with the configured reserve. ` +
+      `Recommend deterministic-only scanning, or free memory before retrying.`,
+  };
+}
+
+
+/***/ })
+
+};

package/dist/4547.index.js

@@ -2,13 +2,13 @@ export const id = 4547;
 export const ids = [4547];
 export const modules = {
 
-/***/ 4547:
+/***/ 24547:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   applyScenario: () => (/* binding */ applyScenario)
 /* harmony export */ });
-/* harmony import */ var _protection_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(965);
+/* harmony import */ var _protection_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(80965);
 /* harmony import */ var _dataflow_privacy_sink_policy_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(3138);
 // scenario-engine.js — M5 deliverable #3a (FR-502): the clone-and-
 // override engine. Deep-clones the base graph, applies each declared

package/dist/4863.index.js

@@ -2,7 +2,7 @@ export const id = 4863;
 export const ids = [4863];
 export const modules = {
 
-/***/ 4863:
+/***/ 54863:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 
@@ -12,13 +12,13 @@ __webpack_require__.d(__webpack_exports__, {
 });
 
 // EXTERNAL MODULE: external "node:fs"
-var external_node_fs_ = __webpack_require__(3024);
+var external_node_fs_ = __webpack_require__(73024);
 // EXTERNAL MODULE: ./src/lineage/schema.js
-var schema = __webpack_require__(4073);
+var schema = __webpack_require__(84073);
 // EXTERNAL MODULE: ./src/lineage/protection.js
-var protection = __webpack_require__(965);
+var protection = __webpack_require__(80965);
 // EXTERNAL MODULE: ./src/lineage/classification.js
-var classification = __webpack_require__(2602);
+var classification = __webpack_require__(42602);
 ;// CONCATENATED MODULE: ./src/lineage/validate.js
 //
 // Structural validator for DataFlowGraph v1 (PRD section 10). Hand-rolled
@@ -302,7 +302,7 @@ function validateGraph(graph) {
 }
 
 // EXTERNAL MODULE: ./src/lineage/export-json.js
-var export_json = __webpack_require__(859);
+var export_json = __webpack_require__(40859);
 ;// CONCATENATED MODULE: ./src/lineage/federation-loader.js
 // federation-loader.js — M5 deliverable #8 (FR-304's "declared" half):
 // loadRemoteGraphExport(filePath) reads an exportGraphJSON-shaped file

package/dist/4970.index.js

@@ -2,7 +2,7 @@ export const id = 4970;
 export const ids = [4970];
 export const modules = {
 
-/***/ 4970:
+/***/ 94970:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
@@ -11,7 +11,7 @@ export const modules = {
 /* harmony export */   evaluateAssuranceMode: () => (/* binding */ evaluateAssuranceMode)
 /* harmony export */ });
 /* unused harmony export _internals */
-/* harmony import */ var _posture_provenance_schema_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(4594);
+/* harmony import */ var _posture_provenance_schema_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(34594);
 // Assurance modes (assurance-hardening PRD FR-204).
 //
 // "Add assurance modes: advisory, standard, and strict | Strict mode fails

package/dist/5051.index.js

@@ -2,7 +2,7 @@ export const id = 5051;
 export const ids = [5051,6944];
 export const modules = {
 
-/***/ 5051:
+/***/ 55051:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 
@@ -14,19 +14,19 @@ __webpack_require__.d(__webpack_exports__, {
 // UNUSED EXPORTS: DEFAULT_IDLE_TIMEOUT_MS, MAX_REQUEST_BODY_BYTES, TOKEN_HEADER
 
 // EXTERNAL MODULE: external "node:http"
-var external_node_http_ = __webpack_require__(7067);
+var external_node_http_ = __webpack_require__(37067);
 // EXTERNAL MODULE: external "node:fs"
-var external_node_fs_ = __webpack_require__(3024);
+var external_node_fs_ = __webpack_require__(73024);
 // EXTERNAL MODULE: external "node:path"
-var external_node_path_ = __webpack_require__(6760);
+var external_node_path_ = __webpack_require__(76760);
 // EXTERNAL MODULE: ./src/server/security.js
-var security = __webpack_require__(6944);
+var security = __webpack_require__(86944);
 // EXTERNAL MODULE: ./src/server/routes.js
-var routes = __webpack_require__(4268);
+var routes = __webpack_require__(84268);
 // EXTERNAL MODULE: external "node:url"
-var external_node_url_ = __webpack_require__(3136);
+var external_node_url_ = __webpack_require__(73136);
 // EXTERNAL MODULE: ./src/shared/frontend-root.js
-var frontend_root = __webpack_require__(1185);
+var frontend_root = __webpack_require__(61185);
 ;// CONCATENATED MODULE: ./src/server/static-assets.js
 // static-assets.js — Milestone 3, sub-project Wire.
 //
@@ -503,7 +503,7 @@ function createExploreServer({
 
 /***/ }),
 
-/***/ 4268:
+/***/ 84268:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
@@ -515,7 +515,7 @@ function createExploreServer({
 /* harmony export */   rR: () => (/* binding */ handleQuery)
 /* harmony export */ });
 /* unused harmony export wrapResponse */
-/* harmony import */ var _lineage_export_json_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(859);
+/* harmony import */ var _lineage_export_json_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(40859);
 // routes.js — Milestone 3, sub-project Server, increment 1.
 //
 // Five pure GET-endpoint handlers, each `(graph, ...) -> {status, body}`.
@@ -649,7 +649,7 @@ function handleFlow(graph, id) {
 
 /***/ }),
 
-/***/ 6944:
+/***/ 86944:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
@@ -658,7 +658,7 @@ function handleFlow(graph, id) {
 /* harmony export */   Xv: () => (/* binding */ CSP_HEADER_VALUE),
 /* harmony export */   generateSessionToken: () => (/* binding */ generateSessionToken)
 /* harmony export */ });
-/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(7598);
+/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(77598);
 // security.js — Milestone 3, sub-project Server, increment 1.
 //
 // Security primitives for the `explore` loopback HTTP server: session-token
@@ -774,14 +774,14 @@ const CSP_HEADER_VALUE = "default-src 'none'; frame-ancestors 'none'";
 
 /***/ }),
 
-/***/ 1185:
+/***/ 61185:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   D: () => (/* binding */ resolveFrontendRoot)
 /* harmony export */ });
-/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
-/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(6760);
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(73024);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(76760);
 // frontend-root.js — locates the Data Flow Explorer's `frontend/` assets
 // (index.html/src/styles) regardless of whether this code is running:
 //   - unbundled, straight out of scanner/src/ or scanner/scripts/ (dev/test —

package/dist/5144.index.js

@@ -2,7 +2,7 @@ export const id = 5144;
 export const ids = [5144];
 export const modules = {
 
-/***/ 5144:
+/***/ 45144:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
@@ -13,9 +13,9 @@ export const modules = {
 /* harmony export */   removeLegalHold: () => (/* binding */ removeLegalHold)
 /* harmony export */ });
 /* unused harmony export LEGAL_HOLD_FILE */
-/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
-/* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(1174);
-/* harmony import */ var _artifact_registry_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(471);
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(73024);
+/* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(31174);
+/* harmony import */ var _artifact_registry_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(70471);
 // FR-707 (assurance-hardening PRD): "Support legal hold and policy-
 // authorized retention exceptions | Legal hold is identity-bound, reasoned,
 // time-bounded where applicable, and auditable."

package/dist/5333.index.js

@@ -2,7 +2,7 @@ export const id = 5333;
 export const ids = [5333];
 export const modules = {
 
-/***/ 5333:
+/***/ 35333:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 __webpack_require__.r(__webpack_exports__);
@@ -10,13 +10,13 @@ __webpack_require__.r(__webpack_exports__);
 /* harmony export */   applyScaUpgrade: () => (/* binding */ applyScaUpgrade),
 /* harmony export */   planScaUpgrade: () => (/* binding */ planScaUpgrade)
 /* harmony export */ });
-/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(3024);
-/* harmony import */ var node_fs_promises__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(1455);
-/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6760);
-/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(7598);
-/* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(1421);
-/* harmony import */ var node_util__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(7975);
-/* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(1174);
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(73024);
+/* harmony import */ var node_fs_promises__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(51455);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(76760);
+/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(77598);
+/* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(31421);
+/* harmony import */ var node_util__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__(57975);
+/* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__(31174);
 // SCA upgrade engine: dry-run plan + worktree-isolated apply.
 //
 // Phase 3 / Item 5 of the SCA improvement plan. The MCP `apply_fix` path

package/dist/5343.index.js

@@ -2,13 +2,13 @@ export const id = 5343;
 export const ids = [5343];
 export const modules = {
 
-/***/ 5343:
+/***/ 65343:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   proposeGovernanceEdit: () => (/* binding */ proposeGovernanceEdit)
 /* harmony export */ });
-/* harmony import */ var _recipient_registry_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(6703);
+/* harmony import */ var _recipient_registry_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(96703);
 // governance-edit.js — M5 deliverable #5 (PRD line 1324's 5-part write
 // contract: preview, validation, backup/version guard, confirmation,
 // audit event). A CLI-only workflow for proposing a validated,

package/dist/5350.index.js

@@ -2,7 +2,7 @@ export const id = 5350;
 export const ids = [5350];
 export const modules = {
 
-/***/ 5350:
+/***/ 55350:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 
@@ -13,7 +13,7 @@ __webpack_require__.d(__webpack_exports__, {
 });
 
 // EXTERNAL MODULE: ./src/dataflow/privacy-taxonomy.js
-var privacy_taxonomy = __webpack_require__(7451);
+var privacy_taxonomy = __webpack_require__(47451);
 ;// CONCATENATED MODULE: ./src/lineage/decision-story.js
 // decision-story.js — M4 deliverable #7 (FR-501 §14, DFG-035): the
 // DecisionStory extension contract (§10.10) + a transparent 9-factor
@@ -223,13 +223,13 @@ function rankFlows(graph, opts = {}) {
 }
 
 // EXTERNAL MODULE: ./src/lineage/export-json.js
-var export_json = __webpack_require__(859);
+var export_json = __webpack_require__(40859);
 // EXTERNAL MODULE: ./src/lineage/ids.js
-var ids = __webpack_require__(5034);
+var ids = __webpack_require__(45034);
 // EXTERNAL MODULE: ./src/lineage/protection.js
-var protection = __webpack_require__(965);
+var protection = __webpack_require__(80965);
 // EXTERNAL MODULE: ./src/dataflow/privacy-governance.js
-var privacy_governance = __webpack_require__(3308);
+var privacy_governance = __webpack_require__(63308);
 ;// CONCATENATED MODULE: ./src/lineage/export-briefing.js
 // export-briefing.js — M4 deliverable #7 (FR-501 §14, DFG-035): Executive
 // Risk Story Mode. Turns Task 1's decision-story.js#rankFlows output into a

package/dist/5561.index.js

@@ -2,7 +2,7 @@ export const id = 5561;
 export const ids = [5561];
 export const modules = {
 
-/***/ 5561:
+/***/ 75561:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {

package/dist/5637.index.js

@@ -2,17 +2,20 @@ export const id = 5637;
 export const ids = [5637];
 export const modules = {
 
-/***/ 5637:
-/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+/***/ 55637:
+/***/ ((__webpack_module__, __webpack_exports__, __webpack_require__) => {
 
+__webpack_require__.a(__webpack_module__, async (__webpack_handle_async_dependencies__, __webpack_async_result__) => { try {
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   computePrDelta: () => (/* binding */ computePrDelta),
 /* harmony export */   netNewGate: () => (/* binding */ netNewGate),
 /* harmony export */   renderPrDeltaText: () => (/* binding */ renderPrDeltaText)
 /* harmony export */ });
-/* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1421);
-/* harmony import */ var _util_git_hardening_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(8844);
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(9753);
+/* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(31421);
+/* harmony import */ var _util_git_hardening_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(78844);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(67198);
+var __webpack_async_dependencies__ = __webpack_handle_async_dependencies__([_engine_js__WEBPACK_IMPORTED_MODULE_2__]);
+_engine_js__WEBPACK_IMPORTED_MODULE_2__ = (__webpack_async_dependencies__.then ? (await __webpack_async_dependencies__)() : __webpack_async_dependencies__)[0];
 // Shadowscan / security-DELTA on PR (v0.72).
 //
 // Most SAST PR-comment integrations show absolute counts — "12 findings
@@ -246,6 +249,8 @@ function renderPrDeltaText(delta) {
   return lines.join('\n');
 }
 
+__webpack_async_result__();
+} catch(e) { __webpack_async_result__(e); } });
 
 /***/ })