@clear-capabilities/agentic-security-scanner 0.153.2 → 0.155.0

package/dist/2862.index.js

@@ -0,0 +1,325 @@
+export const id = 2862;
+export const ids = [2862];
+export const modules = {
+
+/***/ 72862:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+
+// EXPORTS
+__webpack_require__.d(__webpack_exports__, {
+  assessLanguageAssurance: () => (/* binding */ assessLanguageAssurance)
+});
+
+// UNUSED EXPORTS: ASSURANCE_VERSION, OPTIONAL_MODES, REQUIRED_CAPABILITIES
+
+// EXTERNAL MODULE: ./src/language/contracts.js
+var contracts = __webpack_require__(43790);
+// EXTERNAL MODULE: ./src/language/haskell-parser.js
+var haskell_parser = __webpack_require__(41745);
+// EXTERNAL MODULE: ./src/language/haskell-grammar.js
+var haskell_grammar = __webpack_require__(50029);
+;// CONCATENATED MODULE: ./src/language/haskell-adapter.js
+// Adapter that plugs the Haskell parser into the language pipeline contracts
+// (CORE-003), so parse outcomes reach scan health instead of staying inside the
+// parser. A missing or corrupt grammar becomes `missing_grammar`, a budget bound
+// becomes `timed_out` (deadline) or `unresolved` (size/depth), and syntax errors
+// and opaque boundaries become `unresolved-branch` outcomes. Findings from other
+// languages are never touched.
+
+
+
+
+
+const HASKELL_PARSE_PRODUCER = 'language:haskell-parse';
+
+// Boundaries whose content the parser could not see. cpp and ffi are disclosed on
+// the parse result but do not make the file unresolved: both CPP branches are
+// parsed and a foreign declaration's own Haskell signature is.
+const OPAQUE_BOUNDARIES = new Set(['th-splice', 'th-quote', 'th-name-quote', 'th-top-level-splice', 'quasiquote', 'hsc', 'generated']);
+
+function ensureHaskellParseProducer() {
+  if (!(0,contracts/* isRegisteredLanguageProducer */.dO)(HASKELL_PARSE_PRODUCER)) {
+    (0,contracts/* registerLanguageProducer */.OQ)({ id: HASKELL_PARSE_PRODUCER, language: 'haskell', capability: 'parse', evidenceKinds: ['source'], version: '1' });
+  }
+  return HASKELL_PARSE_PRODUCER;
+}
+
+/**
+ * @param {{grammarSource?:Function, budgets?:object, mode?:string, onParse?:(file:string, parse:object)=>void}} [opts]
+ */
+function createHaskellAdapter(opts = {}) {
+  ensureHaskellParseProducer();
+  return {
+    id: HASKELL_PARSE_PRODUCER,
+    language: 'haskell',
+    hasGrammar: () => (0,haskell_grammar/* loadHaskellGrammar */.UP)({ grammarSource: opts.grammarSource }).available,
+    analyze(file, content) {
+      const parse = (0,haskell_parser/* parseHaskell */.cX)(content, { file, grammarSource: opts.grammarSource, budgets: opts.budgets, mode: opts.mode });
+      if (typeof opts.onParse === 'function') opts.onParse(file, parse);
+      if (parse.status === 'budget_exceeded' && parse.budget && parse.budget.name === 'deadlineMs') {
+        throw Object.assign(new Error(`Haskell parser deadline exceeded for ${file}`), { code: 'LANG_TIMEOUT' });
+      }
+      const unresolved = [];
+      if (parse.status === 'budget_exceeded') unresolved.push({ line: 1, reason: `parser budget exceeded: ${parse.budget.name}` });
+      else if (parse.status === 'failed') throw new Error(parse.errors[0] ? parse.errors[0].detail : 'Haskell parse failed');
+      else {
+        for (const e of parse.errors) unresolved.push({ line: e.span ? e.span.startLine : 1, reason: `syntax-error: ${e.kind}` });
+        for (const b of parse.boundaries) if (OPAQUE_BOUNDARIES.has(b.kind)) unresolved.push({ line: b.span.startLine, reason: `opaque-boundary: ${b.kind}` });
+      }
+      return { findings: [], unresolved, parse };
+    },
+  };
+}
+
+// EXTERNAL MODULE: ./src/language/nix-ir.js
+var nix_ir = __webpack_require__(67772);
+// EXTERNAL MODULE: ./src/language/nix-grammar.js
+var nix_grammar = __webpack_require__(46910);
+;// CONCATENATED MODULE: ./src/language/nix-adapter.js
+// Adapter that plugs the Nix parser and config IR into the language pipeline
+// contracts (CORE-003), so parse outcomes reach scan health instead of staying
+// inside the parser. A missing or corrupt grammar becomes `missing_grammar`, a
+// deadline hit becomes `timed_out`, and syntax errors, dynamic attributes,
+// dynamic imports, lazy recursion and IR/parser budget hits become `unresolved`
+// outcomes. Findings from other languages are never touched.
+
+
+
+
+
+const NIX_PARSE_PRODUCER = 'language:nix-parse';
+
+function ensureNixParseProducer() {
+  if (!(0,contracts/* isRegisteredLanguageProducer */.dO)(NIX_PARSE_PRODUCER)) {
+    (0,contracts/* registerLanguageProducer */.OQ)({ id: NIX_PARSE_PRODUCER, language: 'nix', capability: 'parse', evidenceKinds: ['source'], version: '1' });
+  }
+  return NIX_PARSE_PRODUCER;
+}
+
+/**
+ * @param {{grammarSource?:Function, budgets?:object, irBudgets?:object, onParse?:(file:string, result:object)=>void}} [opts]
+ */
+function createNixAdapter(opts = {}) {
+  ensureNixParseProducer();
+  return {
+    id: NIX_PARSE_PRODUCER,
+    language: 'nix',
+    hasGrammar: () => (0,nix_grammar/* loadNixGrammar */.T$)({ grammarSource: opts.grammarSource }).available,
+    analyze(file, content) {
+      const result = (0,nix_ir/* analyzeNix */.KL)(content, { file, grammarSource: opts.grammarSource, budgets: opts.budgets, irBudgets: opts.irBudgets });
+      if (typeof opts.onParse === 'function') opts.onParse(file, result);
+      const { parse, ir } = result;
+      if (parse.status === 'budget_exceeded' && parse.budget && parse.budget.name === 'deadlineMs') {
+        throw Object.assign(new Error(`Nix parser deadline exceeded for ${file}`), { code: 'LANG_TIMEOUT' });
+      }
+      if (parse.status === 'failed' && !parse.errors.length) throw new Error('Nix parse failed');
+      const unresolved = ir.unresolved.map((u) => ({ line: u.span ? u.span.startLine : 1, reason: `${u.kind}: ${u.detail}` }));
+      return { findings: [], unresolved, parse, ir };
+    },
+  };
+}
+
+// EXTERNAL MODULE: ./src/language/haskell-manifests.js
+var haskell_manifests = __webpack_require__(16522);
+// EXTERNAL MODULE: ./src/language/haskell-models.js
+var haskell_models = __webpack_require__(54084);
+;// CONCATENATED MODULE: ./src/language/assurance.js
+// Scan health and assurance for Haskell and Nix analysis (X-007).
+//
+// Collects every way language analysis can be incomplete into ONE `languageCoverage` input for computeScanHealth,
+// so the existing advisory / standard / strict policy and the "Safe to deploy" verdict apply unchanged:
+//
+//   required capabilities   parser, SAST, taint, SCA, secrets (Haskell); parser, config, taint, secrets, supply (Nix).
+//                           A required capability that is disabled, unavailable or failed is a CONDITION.
+//   expected static limits  an opaque boundary (Template Haskell, quasi-quotes, FFI, CPP, hsc) is a documented limit
+//                           of a static analysis, not a failure. It is listed under `limitations`, never as a
+//                           condition, and never hides the files it touches (they stay `unresolved` in the ledger).
+//   optional modes          nix-eval, cabal-plan, hackage-live. Their state is separate: `not_selected` (no
+//                           condition), `not_run` (selected but absent: a condition, never reported as run), `failed`
+//                           (a condition; static findings are retained untouched), `ok`.
+//   data currency           a stale or missing advisory snapshot, a malformed manifest, a partial effective NixOS
+//                           configuration.
+//
+// Independent findings are never dropped here: this module only produces health inputs and returns the findings it
+// was given by reference, with a count, so a caller can prove retention.
+
+
+
+
+
+
+
+const ASSURANCE_VERSION = 'language-assurance/1';
+
+const REQUIRED_CAPABILITIES = Object.freeze({
+  haskell: Object.freeze(['parser', 'sast', 'taint', 'sca', 'secrets']),
+  nix: Object.freeze(['parser', 'config', 'taint', 'secrets', 'supply']),
+});
+const OPTIONAL_MODES = Object.freeze(['nix-eval', 'cabal-plan', 'hackage-live']);
+
+const MALFORMED_MANIFEST = new Set(['malformed_manifest', 'malformed_yaml', 'parser_failure', 'read_failed', 'malformed_dependency', 'malformed_lock_entry', 'malformed_constraint', 'malformed_extra_dep', 'invalid_version_range', 'empty_manifest']);
+const LANGS = Object.keys(REQUIRED_CAPABILITIES);
+const langOf = (f) => (/\.l?hs$|\.hs-boot$|\.hsc$/i.test(f) ? 'haskell' : /\.nix$/i.test(f) ? 'nix' : null);
+const isManifest = (f) => /(?:^|\/)(?:[^/]+\.cabal|cabal\.project(?:\.freeze|\.local)?|package\.yaml|stack\.yaml(?:\.lock)?)$/i.test(f);
+
+function optionalState(name, cfg) {
+  const c = cfg && cfg[name];
+  if (!c || !c.selected) return { name, selected: false, status: 'not_selected', ran: false, reason: 'the mode is opt-in and was not selected', condition: null };
+  const r = c.result;
+  if (!r) return { name, selected: true, status: 'not_run', ran: false, reason: c.reason || 'selected, but no result was produced', condition: `optional mode "${name}" was selected but did not run` };
+  if (r.status === 'ok' && r.ran !== false) return { name, selected: true, status: 'ok', ran: true, reason: null, condition: null };
+  return { name, selected: true, status: r.status || 'failed', ran: false, reason: r.reason || null, condition: `optional mode "${name}" ${r.status === 'timed_out' ? 'timed out' : 'failed'}${r.reason ? ` (${r.reason})` : ''}; static results are retained` };
+}
+
+/**
+ * @param {object} input
+ * @param {Record<string,string>} input.files      rel path -> content: sources and manifests
+ * @param {object[]} [input.adapters]              override the default parse adapters (tests inject hung or corrupt ones)
+ * @param {number}  [input.timeoutMs]              per-file adapter deadline
+ * @param {string[]} [input.disabled]              capability ids switched off, "<language>:<capability>"
+ * @param {Record<string,string[]>} [input.required]  override of REQUIRED_CAPABILITIES
+ * @param {object|null} [input.advisoryDb]         a Hackage AdvisoryDb (haskell-sca.js), or null when none loaded
+ * @param {object[]} [input.effectiveConfigs]      NixOS effective-config reports (nixos-module-resolver.js)
+ * @param {Record<string,{selected:boolean, result?:object, reason?:string}>} [input.optional]
+ * @param {object[]} [input.findings]              findings already produced; returned untouched
+ */
+async function assessLanguageAssurance(input = {}) {
+  const files = input.files || {};
+  const present = new Set(Object.keys(files).map(langOf).filter(Boolean));
+  const manifests = Object.entries(files).filter(([f]) => isManifest(f));
+  if (manifests.length) present.add('haskell');
+  const required = input.required || REQUIRED_CAPABILITIES;
+  const disabled = new Set(input.disabled || []);
+  const findings = Array.isArray(input.findings) ? input.findings : [];
+  const conditions = [];
+  const limitations = [];
+
+  // 1. parse adapters over every language source
+  // Boundaries that do not make a file unresolved but that a reader must be told about: CPP (every branch was parsed, the
+  // chosen one is not known) and FFI (the foreign code is not analysed).
+  const disclosed = new Map();   // boundary kind -> {count, files:Set}
+  const projectModules = new Set(); const importedModules = new Map();   // module -> files
+  const onParse = (file, parse) => {
+    if (parse && parse.module && parse.module.name) projectModules.add(parse.module.name);
+    for (const i of (parse && parse.imports) || []) if (i && i.module) { const e = importedModules.get(i.module) || new Set(); e.add(file); importedModules.set(i.module, e); }
+    for (const b of (parse && parse.boundaries) || []) if (b.kind === 'cpp' || b.kind === 'ffi') { const e = disclosed.get(b.kind) || { count: 0, files: new Set() }; e.count += b.count || 1; e.files.add(file); disclosed.set(b.kind, e); }
+  };
+  const adapters = input.adapters || [createHaskellAdapter({ onParse }), createNixAdapter()];
+  const run = await (0,contracts/* runLanguageAnalysis */.i5)({ files, adapters, timeoutMs: input.timeoutMs || 0 });
+  const reconcile = (0,contracts/* reconcileLanguageLedger */.SA)(run.ledger, files);
+  const base = (0,contracts/* languageHealth */.bX)({ ledger: run.ledger, outcomes: run.outcomes });
+  const byKind = { ...base.byKind };
+
+  // outcome classification: expected static limits are not conditions
+  const opaque = run.outcomes.filter((o) => o.kind === 'unresolved-branch' && /^opaque-boundary/.test(String(o.detail || '')));
+  const otherUnresolved = run.outcomes.filter((o) => o.kind === 'unresolved-branch' && !/^opaque-boundary/.test(String(o.detail || '')));
+  if (byKind['missing-grammar']) conditions.push(`${byKind['missing-grammar']} language file(s) skipped: grammar unavailable or corrupt`);
+  if (byKind['adapter-exception']) conditions.push(`${byKind['adapter-exception']} language adapter exception(s)`);
+  if (byKind['timeout']) conditions.push(`${byKind['timeout']} language file(s) timed out`);
+  if (otherUnresolved.length) conditions.push(`${otherUnresolved.length} unresolved language construct(s) (syntax errors, dynamic attributes or imports)`);
+  if (byKind['unregistered-producer']) conditions.push(`${byKind['unregistered-producer']} result(s) from an unregistered language producer were discarded`);
+  if (opaque.length) {
+    const kinds = {};
+    for (const o of opaque) { const k = String(o.detail).replace(/^opaque-boundary:\s*/, ''); kinds[k] = (kinds[k] || 0) + 1; }
+    for (const [k, n] of Object.entries(kinds).sort()) limitations.push({ kind: 'opaque-boundary', boundary: k, count: n, note: 'a documented limit of static analysis: this code is not analysed, and is not reported clean' });
+  }
+  const DISCLOSED_NOTE = { cpp: 'preprocessor conditionals: every branch was parsed, but which branch is compiled is not known', ffi: 'foreign declarations: the foreign code is not analysed and its effects are not modelled' };
+  for (const [k, e] of [...disclosed.entries()].sort()) limitations.push({ kind: 'opaque-boundary', boundary: k, count: e.count, files: [...e.files].sort().slice(0, 20), note: `a documented limit of static analysis (${DISCLOSED_NOTE[k]})` });
+  // Imported modules this scan has no model for: their functions are ordinary, opaque calls (never a source, sink or
+  // sanitizer), so a taint flow through them is widened and disclosed on the finding. Listed so a reader knows how much of the
+  // import surface the models cover. A limitation, not a condition: most real projects import unmodelled modules.
+  const unmodeled = [...importedModules.keys()].filter((m) => !projectModules.has(m) && !(0,haskell_models/* packageOfModule */.KF)(m)).sort();
+  if (unmodeled.length) limitations.push({ kind: 'unmodeled-imports', count: unmodeled.length, modules: unmodeled.slice(0, 30), note: 'no security model exists for these imported modules: their functions are analysed as ordinary calls, so a flow through them is widened and disclosed on the finding' });
+  // Sources the default ignore list kept out of the scan (tests, specs, mocks, bin, build, dist, vendor): the same
+  // policy every language has, but stated here so an unscanned Haskell/Nix file is never invisible.
+  // Sources and manifests over the read cap were NOT analysed: unlike a default-ignored directory, that is a gap in the analysis,
+  // so it is a condition (the verdict cannot be complete), listed with the path, its size and the cap.
+  const sizeSkipped = Array.isArray(input.sizeSkipped) ? input.sizeSkipped : [];
+  if (sizeSkipped.length) conditions.push(`${sizeSkipped.length} Haskell/Nix source or manifest file(s) exceed the size cap and were not analysed: ${sizeSkipped.slice(0, 3).map((x) => `${x.file} (${x.bytes} bytes > ${x.cap})`).join(', ')}${sizeSkipped.length > 3 ? ', ...' : ''}`);
+  const policyExcluded = Array.isArray(input.policyExcluded) ? input.policyExcluded : [];
+  if (policyExcluded.length) limitations.push({ kind: 'default-ignore', count: policyExcluded.length, files: policyExcluded.slice(0, 20), note: 'Haskell/Nix files under a default-ignored directory (tests, specs, mocks, bin, build, dist, vendor) are not scanned; this is the project-wide default for every language' });
+  // Nix-built images and declared OCI services are not image-layer or base-image scanned: the container analyzers read
+  // Dockerfile and compose SOURCE. Stated whenever such a declaration is present, so its absence from the findings is
+  // never read as a clean image.
+  const ociFiles = Object.entries(files).filter(([f, t]) => /\.nix$/i.test(f) && typeof t === 'string' && /oci-containers|dockerTools\.(?:buildImage|buildLayeredImage|streamLayeredImage)|virtualisation\.(?:docker|podman)/.test(t)).map(([f]) => f);
+  if (ociFiles.length) limitations.push({ kind: 'container-image-scan', files: ociFiles.sort(), note: 'Nix-built images and declared OCI services are analysed as configuration only: image layers and base-image vulnerabilities are NOT scanned' });
+  if (!reconcile.ok) conditions.push(`language ledger does not reconcile with the inputs: ${reconcile.errors[0]}`);
+
+  // 2. manifests
+  if (manifests.length) {
+    let m = null;
+    try { m = (0,haskell_manifests/* analyzeHaskellManifests */.JS)(manifests.map(([path, text]) => ({ path, text })), {}); } catch (e) { conditions.push(`Haskell manifest analysis failed: ${String((e && e.message) || e)}`); }
+    if (m) {
+      const bad = m.diagnostics.filter((d) => MALFORMED_MANIFEST.has(d.kind));
+      if (bad.length) conditions.push(`${bad.length} malformed Haskell manifest entr${bad.length === 1 ? 'y' : 'ies'}: ${[...new Set(bad.map((d) => d.kind))].join(', ')}`);
+      if (m.coverage && m.coverage.failed) conditions.push(`${m.coverage.failed} Haskell manifest(s) could not be parsed`);
+    }
+  }
+
+  // 3. advisory feed currency (only meaningful when Haskell dependencies are in play and SCA is required)
+  const scaRequired = (required.haskell || []).includes('sca') && !disabled.has('haskell:sca');
+  if (present.has('haskell') && scaRequired && manifests.length) {
+    const db = input.advisoryDb;
+    if (!db) conditions.push(`no Hackage advisory snapshot is loaded: Haskell dependency vulnerabilities were not assessed${input.advisoryReason ? `. ${input.advisoryReason}` : ''}`);
+    else if (db.stale) conditions.push(`the Hackage advisory snapshot is stale (${db.ageDays == null ? 'age unknown' : `${Math.floor(db.ageDays)} day(s) old`}, limit ${db.maxAgeDays})`);
+  }
+
+  // 3b. resolved dependency data and the Nix closure: a stale, malformed or unchecked input is stated, never silently dropped
+  for (const g of input.supplyGaps || []) {
+    if (!g || !g.kind) continue;
+    if (/unavailable|stale|malformed|failed|unverified|refused|contradicts/.test(g.kind)) conditions.push(`${g.kind.replace(/^(?:resolved|closure)-/, '')}: ${String(g.detail || '').slice(0, 220)}`);
+    else limitations.push({ kind: 'supply-gap', gap: g.kind, note: String(g.detail || '').slice(0, 220) });
+  }
+
+  if (input.licenseUnavailable) limitations.push({ kind: 'license-data-unavailable', count: input.licenseUnavailable, note: 'Haskell and Nix dependency records carry no license data, so no license policy was applied to them; this is not a statement that they are acceptable' });
+
+  // 4. effective NixOS configuration
+  for (const r of input.effectiveConfigs || []) {
+    if (r && r.completeness === 'partial') conditions.push(`the effective NixOS configuration for ${(r.target && r.target.name) || 'a target'} is partial: ${(r.unresolved || []).length} unresolved, ${(r.truncated || []).length} truncated`);
+  }
+
+  // 5. required capabilities
+  const capabilities = {};
+  for (const lang of LANGS) {
+    if (!present.has(lang)) continue;
+    capabilities[lang] = {};
+    for (const cap of required[lang] || []) {
+      const id = `${lang}:${cap}`;
+      let status = 'ran'; let detail = null;
+      if (disabled.has(id)) { status = 'disabled'; detail = 'switched off by configuration'; }
+      else if (cap === 'parser') {
+        const counts = Object.values(run.ledger.byAnalyzer).filter((a) => a.language === lang);
+        const failed = counts.reduce((s, a) => s + a.failed + a.timedOut + a.missingGrammar, 0);
+        if (failed) { status = 'failed'; detail = `${failed} file(s) not parsed`; }
+      }
+      capabilities[lang][cap] = { required: true, status, detail };
+      if (status === 'disabled') conditions.push(`required analyzer "${id}" is disabled`);
+    }
+  }
+
+  // 6. optional modes
+  const optionalModes = {};
+  for (const name of OPTIONAL_MODES) {
+    const st = optionalState(name, input.optional);
+    optionalModes[name] = { selected: st.selected, status: st.status, ran: st.ran, reason: st.reason };
+    if (st.condition) conditions.push(st.condition);
+  }
+
+  return {
+    version: ASSURANCE_VERSION,
+    languageCoverage: { totals: base.totals, byKind, conditions, limitations, capabilities, optionalModes },
+    ledger: { reconciled: reconcile.ok, errors: reconcile.errors, byAnalyzer: run.ledger.byAnalyzer },
+    outcomes: run.outcomes,
+    retained: { findings: findings.length, findingsRef: findings },
+    conditions,
+    limitations,
+    optionalModes,
+    capabilities,
+  };
+}
+
+
+/***/ })
+
+};

package/dist/3499.index.js

@@ -10,6 +10,7 @@ export const modules = {
 /* harmony export */   LENSES: () => (/* binding */ LENSES),
 /* harmony export */   j: () => (/* binding */ buildHunterPrompt)
 /* harmony export */ });
+/* harmony import */ var _egress_redact_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(74831);
 //
 // The seven hunting lenses. Each hunter run is one (focus area × lens) pair.
 //
@@ -19,6 +20,7 @@ export const modules = {
 // same code than one told to look at crypto, so the union covers failure modes
 // no single prompt reaches. `wildcard` exists because a fixed taxonomy is a
 // ceiling, and the classes worth finding are the ones not on the list.
+
 const LENSES = Object.freeze([
   { key: 'injection', title: 'Injection', family: 'injection', cwe: 'CWE-74',
     brief: 'Untrusted input reaching an interpreter: SQL, shell, template, XPath, LDAP, or deserialization. Follow the value, not the function name.' },
@@ -51,7 +53,9 @@ function buildHunterPrompt(focusArea, lens, ctx = {}) {
   let budget = maxChars;
   const blocks = [];
   for (const f of files) {
-    const src = contents[f];
+    // Everything that leaves the machine is redacted first (secrets, PII/PHI/PCI-shaped fields, operator-declared
+    // customer data, and whole proprietary paths), by the same choke point the validator and the proposers use.
+    const src = (0,_egress_redact_js__WEBPACK_IMPORTED_MODULE_0__/* .redactPayload */ .cy)({ text: contents[f], filePath: f, scanRoot: ctx.scanRoot || null }).text;
     const slice = src.length > budget ? src.slice(0, Math.max(0, budget)) : src;
     const truncated = slice.length < src.length;
     blocks.push(`--- SOURCE FILE (untrusted data): ${f}${truncated ? ' (truncated)' : ''} ---\n${slice}\n--- END SOURCE FILE: ${f} ---`);

package/dist/3531.index.js

@@ -0,0 +1,261 @@
+export const id = 3531;
+export const ids = [3531];
+export const modules = {
+
+/***/ 33531:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+__webpack_require__.r(__webpack_exports__);
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   LANGUAGE_BOM_VERSION: () => (/* binding */ LANGUAGE_BOM_VERSION),
+/* harmony export */   genericPurl: () => (/* binding */ genericPurl),
+/* harmony export */   languageBom: () => (/* binding */ languageBom),
+/* harmony export */   languagePbom: () => (/* binding */ languagePbom),
+/* harmony export */   purlFromGitHost: () => (/* binding */ purlFromGitHost),
+/* harmony export */   purlFromUpstreamUrl: () => (/* binding */ purlFromUpstreamUrl)
+/* harmony export */ });
+/* harmony import */ var _haskell_supply_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(86349);
+/* harmony import */ var _haskell_sca_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(2437);
+/* harmony import */ var _haskell_resolved_graph_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(86359);
+/* harmony import */ var _nix_inventory_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(81303);
+// Hackage and Nix components, dependency edges and target provenance for the SBOM emitters (X-010).
+//
+// Turns what the language analyses already know into BOM-shaped data WITHOUT inventing any of it:
+//
+//   * A version appears only where a resolver or a lock states one. A declared range (`aeson ==2.1.*`) is a property,
+//     never a version. A Nix package selector (`pkgs.git`) is not a component at all.
+//   * A dependency graph appears only from a fresh resolved plan/export. A manifest or a freeze file gives declared
+//     edges at most, and the document says so through `compositions` (`incomplete`), never `complete`.
+//   * Resolved builds are never merged away: two Hackage units that differ in flags, or two Nix outputs that share a
+//     name and version but not a store hash, stay two components with two bom-refs.
+//   * A license appears only when a source states one. Nothing here guesses a license from a name.
+//   * Purls follow the registered type rules: `hackage`, `github` for validated upstream hosts, and `generic` (with
+//     vcs_url / download_url qualifiers) as the labelled fallback. Nix build provenance travels beside the identity
+//     as properties (store path, derivation, system, installable, lock digest), not inside the purl.
+
+
+
+
+
+
+const LANGUAGE_BOM_VERSION = 'language-bom/1';
+
+const enc = (s) => encodeURIComponent(String(s)).replace(/%2F/gi, '/').replace(/%40/g, '%40');
+const qEnc = (s) => encodeURIComponent(String(s));
+const prop = (name, value) => (value === null || value === undefined || value === '' ? null : { name: `agentic-security:${name}`, value: typeof value === 'string' ? value : JSON.stringify(value) });
+const props = (...xs) => xs.filter(Boolean);
+
+/** purl for a generic component, qualifiers sorted by key as the purl spec requires. */
+function genericPurl(name, version, qualifiers = {}) {
+  const q = Object.entries(qualifiers).filter(([, v]) => v !== null && v !== undefined && v !== '').sort(([a], [b]) => (a < b ? -1 : 1)).map(([k, v]) => `${k.toLowerCase()}=${qEnc(v)}`);
+  return `pkg:generic/${enc(name)}${version ? `@${qEnc(version)}` : ''}${q.length ? `?${q.join('&')}` : ''}`;
+}
+
+/** A purl for a recognised source host; null otherwise (never guessed). */
+function purlFromGitHost(type, owner, repo, rev) {
+  if (!['github', 'gitlab', 'bitbucket'].includes(type) || !owner || !repo) return null;
+  return `pkg:${type}/${enc(String(owner).toLowerCase())}/${enc(String(repo).toLowerCase())}${rev ? `@${qEnc(rev)}` : ''}`;
+}
+const GH_URL = /^https:\/\/github\.com\/([^/]+)\/([^/]+?)(?:\.git)?\/(?:releases\/download|archive)\//i;
+/** Validated upstream identity from a source URL on a known host. */
+function purlFromUpstreamUrl(url, version) {
+  const m = GH_URL.exec(String(url || ''));
+  return m ? purlFromGitHost('github', m[1], m[2], version) : null;
+}
+
+const cdxScope = (scopes) => ((scopes || []).includes('runtime') ? 'required' : 'excluded');
+
+// ── Haskell ─────────────────────────────────────────────────────────────────
+function haskellBom(files, opts) {
+  const out = { components: [], dependencies: [], compositions: [], properties: [], gaps: [], root: null };
+  const { components: declared, manifests } = (0,_haskell_supply_js__WEBPACK_IMPORTED_MODULE_0__/* .hackageComponents */ .vG)(files);
+  if (!manifests) return out;
+  const pkg = (manifests.packages || [])[0] || null;
+  const rootRef = pkg ? `haskell-root:${pkg.name}@${pkg.version || 'unversioned'}` : 'haskell-root';
+  if (pkg) out.root = { type: 'application', 'bom-ref': rootRef, name: pkg.name, ...(pkg.version ? { version: pkg.version } : {}) };
+
+  const graph = opts.resolved || (0,_haskell_resolved_graph_js__WEBPACK_IMPORTED_MODULE_2__/* .buildResolvedGraph */ .xU)({ manifests, plan: opts.plan, stackExport: opts.stackExport, expected: opts.expected, rejectStale: opts.rejectStale });
+  out.properties.push(prop('haskell:resolution', graph.source), prop('haskell:freshness', graph.freshness && graph.freshness.status), prop('haskell:closure', graph.closure));
+  if (graph.compiler) out.properties.push(prop('haskell:compiler', graph.compiler.id));
+  out.gaps.push(...(graph.gaps || []).map((g) => ({ ...g, source: 'haskell' })));
+
+  const refOf = new Map();                                         // unit id -> bom-ref
+  if (graph.graphAvailable && graph.units) {
+    for (const u of graph.units) {
+      if (u.origin === 'local') { refOf.set(u.id, rootRef); continue; }
+      const ref = `hackage:${u.id}`;
+      refOf.set(u.id, ref);
+      let purl = null;
+      if (u.origin === 'hackage' || u.origin === 'compiler') purl = (0,_haskell_sca_js__WEBPACK_IMPORTED_MODULE_1__/* .hackagePurl */ .Gf)(u.name, u.version || null);
+      else if (u.origin === 'vcs') purl = genericPurl(u.name, u.version, { vcs_url: u.repo && u.repo.uri });
+      else if (u.origin === 'url') purl = genericPurl(u.name, u.version, { download_url: u.repo && u.repo.uri });
+      out.components.push({
+        ecosystem: 'hackage', name: u.name, version: u.version || null, purl, bomRef: ref, filePath: (files && Object.keys(files).find((f) => /\.cabal$|cabal\.project$/.test(f))) || undefined, cdxScope: cdxScope(u.scopes), scopes: u.scopes || [],
+        // identity across versions: the package, plus its flag assignment when it has one (two builds stay two components)
+        identityKey: `hackage:${u.name}${u.flags && Object.keys(u.flags).length ? `?${JSON.stringify(u.flags)}` : ''}${u.sublibrary ? `:${u.sublibrary}` : ''}`,
+        ...(u.sha256 ? { hashes: [{ alg: 'SHA-256', content: u.sha256 }] } : {}),
+        properties: props(prop('haskell:unitId', u.id), prop('haskell:origin', u.origin), prop('haskell:scopes', u.scopes), prop('haskell:flags', u.flags && Object.keys(u.flags).length ? u.flags : null), prop('haskell:boot', u.boot ? true : null), prop('haskell:component', u.component && u.component.kind), prop('haskell:originEvidence', u.originEvidence)),
+      });
+    }
+    const dep = new Map();
+    for (const e of graph.edges || []) {
+      const from = refOf.get(e.from); const to = refOf.get(e.to);
+      if (!from || !to || from === to) continue;
+      if (!dep.has(from)) dep.set(from, new Map());
+      const toUnit = (graph.units || []).find((x) => x.id === e.to);
+      dep.get(from).set(to, (toUnit && toUnit.scopes && toUnit.scopes.includes('runtime')) ? 'runtime' : ((toUnit && toUnit.scopes && toUnit.scopes.includes('test')) ? 'test' : 'build'));
+    }
+    for (const [ref, m] of [...dep.entries()].sort((a, b) => (a[0] < b[0] ? -1 : 1))) out.dependencies.push({ ref, dependsOn: [...m.keys()].sort(), kinds: Object.fromEntries(m) });
+    out.compositions.push({ aggregate: graph.closure && graph.closure.complete ? 'complete' : 'incomplete', dependencies: [...new Set([...refOf.values()])].sort() });
+  } else {
+    // Declared inventory only: names and (where a freeze or exact pin states one) versions. Not a closure.
+    const seen = new Map();
+    for (const d of declared) {
+      const key = `${d.name}@${d.version || ''}`;
+      const ref = d.version ? `hackage:${d.name}@${d.version}` : `hackage:${d.name}`;
+      if (seen.has(key)) { const c = seen.get(key); if (!c.scopes.includes(d.scope)) c.scopes.push(d.scope); c.cdxScope = cdxScope(c.scopes); continue; }
+      const c = {
+        ecosystem: 'hackage', name: d.name, version: d.version || null, purl: (0,_haskell_sca_js__WEBPACK_IMPORTED_MODULE_1__/* .hackagePurl */ .Gf)(d.name, d.version || null), bomRef: ref, filePath: d.manifest || undefined, scopes: [d.scope], cdxScope: cdxScope([d.scope]), identityKey: `hackage:${d.name}`,
+        properties: props(prop('haskell:declaredRange', d.declaredRange), prop('haskell:resolution', d.resolution), prop('haskell:boot', d.ghcComponent ? true : null), prop('haskell:manifest', d.manifest)),
+      };
+      seen.set(key, c); out.components.push(c);
+    }
+    if (declared.length) {
+      out.dependencies.push({ ref: rootRef, dependsOn: out.components.map((c) => c.bomRef).sort(), kinds: Object.fromEntries(out.components.map((c) => [c.bomRef, (c.scopes || []).includes('runtime') ? 'runtime' : 'build'])) });
+      out.compositions.push({ aggregate: 'incomplete', dependencies: [rootRef] });
+    }
+    out.gaps.push({ kind: 'declared-inventory-only', source: 'haskell', detail: 'no fresh plan or Stack export: components are the declared dependencies, versions only where a freeze or an exact pin states one; transitive packages are not listed' });
+  }
+  return out;
+}
+
+// ── Nix ─────────────────────────────────────────────────────────────────────
+function nixInputBom(files) {
+  const out = { components: [], dependencies: [], compositions: [], properties: [], gaps: [], root: null };
+  const inv = (0,_nix_inventory_js__WEBPACK_IMPORTED_MODULE_3__/* .analyzeNixInputs */ .Tw)({ files });
+  out.gaps.push(...inv.gaps.map((g) => ({ ...g, source: 'nix' })));
+  const refOf = new Map();
+  for (const f of inv.flakes) {
+    const nodes = (f.graph && f.graph.nodes) || [];
+    for (const n of nodes) {
+      if (n.root || !n.reachable) continue;
+      const key = `${f.file}:${n.key}`;
+      const ref = `nix-input:${key}`;
+      refOf.set(`${f.file}|${n.key}`, ref);
+      const lk = n.locked || null;
+      const rev = lk && (lk.rev || null);
+      let purl = null; let url = null;
+      if (lk && lk.type) {
+        purl = purlFromGitHost(lk.type, lk.owner, lk.repo, rev);
+        if (!purl && lk.url) purl = genericPurl(n.name, rev, lk.type === 'tarball' ? { download_url: lk.url } : { vcs_url: lk.url });
+        if (lk.type === 'github') url = `https://github.com/${lk.owner}/${lk.repo}`;
+        else if (lk.url) url = lk.url;
+      }
+      if (!purl) purl = genericPurl(n.name, null);
+      out.components.push({
+        ecosystem: 'nix', name: n.name, version: rev, purl, bomRef: ref, filePath: f.lock && f.lock.file ? f.lock.file : f.file, cdxScope: 'required', scopes: ['source'], identityKey: `nix-input:${f.file}:${n.key}`,
+        ...(url ? { externalReferences: [{ type: 'vcs', url }] } : {}),
+        properties: props(prop('nix:class', 'flake-input'), prop('nix:lockNode', n.key), prop('nix:flakeFile', f.file), prop('nix:fetchType', lk && lk.type), prop('nix:narHash', lk && lk.narHash), prop('nix:locked', lk ? true : false), prop('nix:purlBasis', purl.startsWith('pkg:generic') ? 'generic-fallback' : 'validated-upstream-host')),
+      });
+    }
+    const edges = (f.graph && f.graph.edges) || [];
+    const by = new Map();
+    for (const e of edges) { const a = refOf.get(`${f.file}|${e.from}`); const b = e.to ? refOf.get(`${f.file}|${e.to}`) : null; if (a && b && a !== b) { if (!by.has(a)) by.set(a, new Set()); by.get(a).add(b); } }
+    for (const [ref, set] of [...by.entries()].sort((x, y) => (x[0] < y[0] ? -1 : 1))) out.dependencies.push({ ref, dependsOn: [...set].sort(), kinds: Object.fromEntries([...set].map((s) => [s, 'runtime'])) });
+  }
+  if (out.components.length) out.compositions.push({ aggregate: 'incomplete', dependencies: out.components.map((c) => c.bomRef).sort() });
+  out.gaps.push({ kind: 'inputs-are-not-a-closure', source: 'nix', detail: 'flake.lock lists source inputs; it is not the build or runtime closure, so the Nix inputs are reported as incomplete' });
+  return out;
+}
+
+function nixClosureBom(closure) {
+  const out = { components: [], dependencies: [], compositions: [], properties: [], gaps: [], root: null };
+  if (!closure || closure.status !== 'ok') { if (closure) out.gaps.push({ kind: 'closure-not-usable', source: 'nix', detail: `closure import status ${closure.status}` }); return out; }
+  const prov = (closure.provenance || [])[0] || {};
+  const target = prov.target || {};
+  out.properties.push(prop('nix:target.system', target.system), prop('nix:target.installable', target.installable), prop('nix:toolVersion', prov.toolVersion), prop('nix:exactRuntimeClosure', closure.claims && closure.claims.exactRuntimeClosure), prop('nix:exactBuildGraph', closure.claims && closure.claims.exactBuildGraph));
+  const refOf = new Map();
+  for (const n of closure.nodes) {
+    if (n.kind !== 'output' && n.kind !== 'source') continue;
+    if (!n.pname && !n.storeName) continue;
+    const name = n.pname || n.storeName;
+    const ref = `nix-store:${n.hash}-${n.storeName}`;
+    refOf.set(n.id, ref);
+    const urls = (n.upstream && n.upstream.urls) || [];
+    let purl = null; let basis = 'generic-fallback';
+    for (const u of urls) { const p = purlFromUpstreamUrl(u, n.version); if (p) { purl = p; basis = 'validated-upstream-host'; break; } }
+    if (!purl) purl = genericPurl(name, n.version || null);
+    const scopes = n.scopes || [];
+    out.components.push({
+      ecosystem: 'nix', name, version: n.version || null, purl, bomRef: ref, cdxScope: cdxScope(scopes), scopes,
+      identityKey: `nix:${name}:${n.system || ''}:${n.outputName || 'out'}${n.sameNameDifferentBuild ? `:${n.hash}` : ''}`,
+      properties: props(prop('nix:class', n.kind === 'source' ? 'source' : 'store-output'), prop('nix:storePath', n.id), prop('nix:system', n.system), prop('nix:output', n.outputName), prop('nix:scopes', scopes), prop('nix:versionAuthority', n.versionAuthority), prop('nix:identity', n.identity), prop('nix:purlBasis', basis), prop('nix:sameNameDifferentBuild', n.sameNameDifferentBuild ? true : null), prop('nix:patches', (n.patches || []).map((p) => p.name)), prop('nix:installable', target.installable)),
+    });
+  }
+  const by = new Map();
+  for (const e of closure.edges) {
+    if (e.kind !== 'reference') continue;
+    const a = refOf.get(e.from); const b = refOf.get(e.to);
+    if (!a || !b || a === b) continue;
+    if (!by.has(a)) by.set(a, new Set()); by.get(a).add(b);
+  }
+  for (const [ref, set] of [...by.entries()].sort((x, y) => (x[0] < y[0] ? -1 : 1))) out.dependencies.push({ ref, dependsOn: [...set].sort(), kinds: Object.fromEntries([...set].map((s) => [s, 'runtime'])) });
+  const runtimeRefs = closure.nodes.filter((n) => n.kind === 'output' && (n.scopes || []).includes('runtime')).map((n) => refOf.get(n.id)).filter(Boolean).sort();
+  if (runtimeRefs.length) out.compositions.push({ aggregate: closure.claims && closure.claims.exactRuntimeClosure ? 'complete' : 'incomplete', dependencies: runtimeRefs });
+  return out;
+}
+
+/**
+ * @param {Record<string,string>} files rel path -> content (sources and manifests)
+ * @param {{closure?: object, resolved?: object, plan?: object, stackExport?: object, expected?: object, rejectStale?: boolean}} [opts]
+ *   `closure` is an importNixClosure() result (an explicit, provenance-carrying export); nothing is run or fetched.
+ */
+function languageBom(files, opts = {}) {
+  const parts = [haskellBom(files || {}, opts), nixInputBom(files || {}), nixClosureBom(opts.closure)];
+  const merged = { version: LANGUAGE_BOM_VERSION, components: [], dependencies: [], compositions: [], properties: [], gaps: [], root: null };
+  const byRef = new Map();
+  for (const p of parts) {
+    for (const c of p.components) { if (!byRef.has(c.bomRef)) { byRef.set(c.bomRef, c); merged.components.push(c); } }
+    for (const d of p.dependencies) merged.dependencies.push(d);
+    merged.compositions.push(...p.compositions);
+    merged.properties.push(...p.properties);
+    merged.gaps.push(...p.gaps);
+    if (!merged.root && p.root) merged.root = p.root;
+  }
+  // a dependency edge may only name refs that exist (the root ref is allowed)
+  const known = new Set([...byRef.keys(), ...(merged.root ? [merged.root['bom-ref']] : [])]);
+  merged.dependencies = merged.dependencies.map((d) => ({ ...d, dependsOn: d.dependsOn.filter((r) => known.has(r)) })).filter((d) => known.has(d.ref));
+  merged.components.sort((a, b) => (a.bomRef < b.bomRef ? -1 : 1));
+  return merged;
+}
+
+/**
+ * The language half of a Pipeline Bill of Materials: what is fetched and how it is pinned before anything is built.
+ * Static facts from the manifests and lock files only; nothing is fetched or evaluated.
+ */
+function languagePbom(files) {
+  const out = { version: LANGUAGE_BOM_VERSION, haskell: null, nix: null };
+  const { manifests } = (0,_haskell_supply_js__WEBPACK_IMPORTED_MODULE_0__/* .hackageComponents */ .vG)(files || {});
+  if (manifests) {
+    out.haskell = {
+      packages: (manifests.packages || []).map((p) => ({ name: p.name, version: p.version || null, buildType: p.buildType || null, file: p.file })),
+      customSetup: (manifests.packages || []).some((p) => String(p.buildType || '').toLowerCase() === 'custom'),
+      sourceRepositories: (manifests.sourceRepositories || []).map((r) => ({ location: r.location, tag: r.tag || null, pinned: /^[0-9a-f]{40}$/i.test(r.tag || ''), file: r.file, line: r.line })),
+      compiler: (manifests.projects || []).map((p) => p.withCompiler).find(Boolean) || null,
+    };
+  }
+  const inv = (0,_nix_inventory_js__WEBPACK_IMPORTED_MODULE_3__/* .analyzeNixInputs */ .Tw)({ files: files || {} });
+  if (inv.flakes.length || inv.legacy.length) {
+    out.nix = {
+      inputs: inv.flakes.flatMap((f) => (f.declared || []).map((d) => ({ flake: f.file, name: d.name, url: d.url || null, status: d.status, fetchType: d.lockedFetch ? d.lockedFetch.type : null, rev: d.lockedFetch ? d.lockedFetch.rev || null : null, narHash: d.lockedFetch ? d.lockedFetch.narHash || null : null, locked: !!d.locked }))),
+      legacy: inv.legacy.map((l) => ({ kind: l.kind, file: l.file, line: l.line || null, resolution: l.resolution || null })),
+      closure: { complete: false, reason: 'inputs and fetchers only; a build or runtime closure needs an explicit export' },
+    };
+  }
+  return out;
+}
+
+
+/***/ })
+
+};