@clear-capabilities/agentic-security-scanner 0.168.0 → 0.170.0

package/dist/2199.index.js

@@ -313,7 +313,7 @@ function saveProof(scanRoot, record) {
   const enc = (0,_encryption_provider_js__WEBPACK_IMPORTED_MODULE_3__/* .maybeEncryptForWrite */ .v2)(scanRoot, PROOFS_DIR, text);
   if (!enc.ok) return { ok: false, reason: enc.reason };
   const file = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.statePath)(scanRoot, PROOFS_DIR, findingKey(record.findingId), `${safe.recordDigest}.json`);
-  if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__/* .safeWriteState */ .Ep)(file, enc.content)) return { ok: false, reason: 'state write refused' };
+  if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.safeWriteState)(file, enc.content)) return { ok: false, reason: 'state write refused' };
   return { ok: true, file, digest: safe.recordDigest, encrypted: enc.encrypted };
 }
 

package/dist/2675.index.js

@@ -0,0 +1,174 @@
+export const id = 2675;
+export const ids = [2675];
+export const modules = {
+
+/***/ 82675:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   verifyImageSignature: () => (/* binding */ verifyImageSignature),
+/* harmony export */   verifyProvenanceAttestation: () => (/* binding */ verifyProvenanceAttestation)
+/* harmony export */ });
+/* unused harmony export SIGNATURE_STATES */
+/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(77598);
+// PRD 5 P0 §5 — Signature Verification. States are exactly the PRD's own
+// four, deliberately different from `sca/sigstore-verify.js`'s own vocabulary
+// (`verified/unverified/tampered/unknown`) so the two are never confused by
+// shared words — see docs/implementation-status/source-to-artifact-provenance.md's
+// naming-discipline section:
+//
+//   verified    — a real cryptographic check ran and the signature matches.
+//   invalid     — a real cryptographic check ran and the signature does NOT match.
+//   missing     — no signature/attestation material was supplied at all.
+//   unavailable — material was supplied but could not be cryptographically
+//                 checked (no public key given, or the check itself could
+//                 not run) — the PRD's "never treat missing tooling as
+//                 verified" clause means this state, not `verified`, is what
+//                 an incomplete check must report.
+//
+// Two real, independent mechanisms are implemented:
+//   1. A plain detached signature over the image digest string, verified
+//      with an operator-supplied public key. This is this tool's OWN local
+//      convention, not cosign's "simple signing" JSON format — disclosed in
+//      the implementation-status doc, not silently passed off as cosign-
+//      compatible.
+//   2. Real DSSE (Dead Simple Signing Envelope) verification for in-toto/SLSA
+//      provenance attestations — the actual encoding cosign/Sigstore use for
+//      attestations, so a real cosign-keyed attestation bundle DOES verify
+//      here given the matching public key. `dssePae` is the exact PAE
+//      (Pre-Authentication Encoding) from the DSSE spec.
+//
+// Keyless/Rekor-transparency-log verification is NOT implemented — disclosed
+// as a gap, never faked. `sca/sigstore-verify.js`'s Rekor-query pattern is
+// the template a future increment could extend this module with.
+
+
+const SIGNATURE_STATES = Object.freeze(['verified', 'invalid', 'missing', 'unavailable']);
+
+function verifyRaw(payload, signature, publicKeyPem) {
+  let publicKey;
+  try {
+    publicKey = node_crypto__WEBPACK_IMPORTED_MODULE_0__.createPublicKey(publicKeyPem);
+  } catch (err) {
+    return { ok: false, error: `public key is not parseable: ${err.message}` };
+  }
+  const keyType = publicKey.asymmetricKeyType;
+  const algorithm = (keyType === 'ed25519' || keyType === 'ed448') ? null : 'sha256';
+  try {
+    const ok = node_crypto__WEBPACK_IMPORTED_MODULE_0__.verify(algorithm, payload, publicKey, signature);
+    return { ok, keyType };
+  } catch (err) {
+    return { ok: false, error: `signature verification failed to run: ${err.message}` };
+  }
+}
+
+/**
+ * Verifies a detached signature over an image's digest string.
+ * `signature`/`publicKeyPem` are Buffer/PEM-string; either missing means
+ * `missing` (nothing was supplied to check).
+ */
+function verifyImageSignature({ digest, signature, publicKeyPem }) {
+  if (typeof digest !== 'string' || !digest.startsWith('sha256:')) {
+    return { state: 'unavailable', reason: 'no image digest available to verify a signature against' };
+  }
+  if (!signature || !publicKeyPem) {
+    return { state: 'missing', reason: 'no detached signature and public key were supplied for this image' };
+  }
+  const { ok, error, keyType } = verifyRaw(Buffer.from(digest, 'utf8'), signature, publicKeyPem);
+  if (error) return { state: 'invalid', reason: error };
+  return ok
+    ? { state: 'verified', keyType }
+    : { state: 'invalid', reason: 'signature does not match the image digest under the supplied public key' };
+}
+
+// DSSE Pre-Authentication Encoding: "DSSEv1" SP LEN(type) SP type SP LEN(body) SP body.
+function dssePae(payloadType, payloadBytes) {
+  const typeBytes = Buffer.from(payloadType, 'utf8');
+  return Buffer.concat([
+    Buffer.from('DSSEv1 ', 'ascii'),
+    Buffer.from(String(typeBytes.length), 'ascii'),
+    Buffer.from(' ', 'ascii'),
+    typeBytes,
+    Buffer.from(' ', 'ascii'),
+    Buffer.from(String(payloadBytes.length), 'ascii'),
+    Buffer.from(' ', 'ascii'),
+    payloadBytes,
+  ]);
+}
+
+const SLSA_PREDICATE_PREFIX = 'https://slsa.dev/provenance/';
+const INTOTO_STATEMENT_TYPES = new Set(['https://in-toto.io/Statement/v0.1', 'https://in-toto.io/Statement/v1']);
+
+/**
+ * Verifies an in-toto/SLSA provenance attestation for an image.
+ * `envelope` is a DSSE envelope: `{ payloadType, payload (base64 in-toto
+ * Statement JSON), signatures: [{ sig (base64) }] }` — the real shape
+ * cosign/Sigstore attestations use. `publicKeyPem` verifies one of
+ * `signatures` against `dssePae(payloadType, payload)`.
+ *
+ * The subject-digest match is checked FIRST and independently of signature
+ * verification, so a mismatched subject is always `invalid` (never
+ * "unavailable", which would understate a real, checkable problem).
+ */
+function verifyProvenanceAttestation({ digest, envelope, publicKeyPem }) {
+  if (!envelope) return { state: 'missing', reason: 'no in-toto/SLSA provenance attestation was supplied for this image' };
+
+  let env;
+  try {
+    env = typeof envelope === 'string' ? JSON.parse(envelope) : envelope;
+  } catch (err) {
+    return { state: 'invalid', reason: `attestation envelope is not valid JSON: ${err.message}` };
+  }
+  if (typeof env.payload !== 'string' || typeof env.payloadType !== 'string' || !Array.isArray(env.signatures)) {
+    return { state: 'invalid', reason: 'not a recognized DSSE envelope (missing payload, payloadType, or signatures)' };
+  }
+
+  let payloadBytes;
+  let stmt;
+  try {
+    payloadBytes = Buffer.from(env.payload, 'base64');
+    stmt = JSON.parse(payloadBytes.toString('utf8'));
+  } catch (err) {
+    return { state: 'invalid', reason: `attestation payload is not a valid base64-encoded JSON statement: ${err.message}` };
+  }
+  if (!INTOTO_STATEMENT_TYPES.has(stmt._type)) {
+    return { state: 'invalid', reason: 'statement is missing a recognized in-toto "_type"' };
+  }
+
+  const digestHex = typeof digest === 'string' && digest.startsWith('sha256:') ? digest.slice('sha256:'.length) : digest;
+  const subjects = Array.isArray(stmt.subject) ? stmt.subject : [];
+  const subjectMatches = subjects.some((s) => s && s.digest && s.digest.sha256 === digestHex);
+  if (!subjectMatches) {
+    return { state: 'invalid', reason: 'attestation subject digest does not match this image', predicateType: stmt.predicateType || null };
+  }
+
+  const predicateType = stmt.predicateType || null;
+  const isSlsa = typeof predicateType === 'string' && predicateType.startsWith(SLSA_PREDICATE_PREFIX);
+
+  if (!publicKeyPem || env.signatures.length === 0) {
+    return {
+      state: 'unavailable',
+      reason: 'attestation subject matches this image, but no public key was supplied to verify its signature',
+      predicateType, isSlsa,
+    };
+  }
+
+  const pae = dssePae(env.payloadType, payloadBytes);
+  for (const sigEntry of env.signatures) {
+    if (!sigEntry || typeof sigEntry.sig !== 'string') continue;
+    let sigBytes;
+    try {
+      sigBytes = Buffer.from(sigEntry.sig, 'base64');
+    } catch {
+      continue;
+    }
+    const { ok } = verifyRaw(pae, sigBytes, publicKeyPem);
+    if (ok) return { state: 'verified', predicateType, isSlsa };
+  }
+  return { state: 'invalid', reason: 'no signature in the attestation envelope verifies under the supplied public key', predicateType, isSlsa };
+}
+
+
+/***/ })
+
+};

package/dist/2923.index.js

@@ -8,7 +8,7 @@ export const modules = {
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   adapterFor: () => (/* binding */ adapterFor)
 /* harmony export */ });
-/* unused harmony exports NATIVE_JSONL_RECORD_KEYS, parseNativeJsonlObservations */
+/* unused harmony exports NATIVE_JSONL_RECORD_KEYS, parseNativeJsonlObservations, parseOtelJsonObservations, parseEnvoyAccessLogObservations, parseK8sAuditLogObservations, parseHttpAccessLogObservations */
 // observation-adapters.js — the RuntimeObservation ADAPTER interface, plus
 // the one shipped implementation (`native-jsonl`) (M5 deliverable #7,
 // "Runtime-Corroborated Digital Twin" — the runtime-observed half only,
@@ -273,6 +273,370 @@ function parseNativeJsonlObservations(text, context) {
   return { drafts, errors };
 }
 
+// ── The four PRD "Runtime-Corroborated Security Twin" adapters ─────────
+//
+// Each of the four parsers below follows the identical contract the
+// native-jsonl adapter above already established: pure (zero imports, no
+// fs, never throws), `(text, context) -> {drafts, errors}`, one
+// `{line, message}` error per malformed line (never a value echo), every
+// OTHER line still parses. Each produces drafts carrying ONLY attribute
+// keys already on `RUNTIME_ATTRIBUTE_KEYS` (`runtime-observation.js`) —
+// none of these parsers imports that file (this module stays zero-import
+// by contract), so an attribute key typo here is caught one layer up, at
+// import time, exactly like the native-jsonl adapter's own documented
+// two-layer split. Each adapter deliberately DROPS every field of its
+// source format with no safe, approved destination — a raw URL path/query
+// string, a user agent, a client IP, a trace/span id, a username/identity
+// — rather than inventing a new attribute key to carry it (PRD "Privacy
+// Protection" P0-7: schema/field classification only, never a captured
+// value). What each adapter keeps and drops is documented at its own
+// definition.
+
+const _IDENTIFIER_ATTR_RE = /^[A-Za-z0-9._:-]{1,128}$/;
+
+// Only ever WRITES a value that already looks like an approved identifier
+// — never force-sanitizes an unsafe value into a misleadingly different
+// one. Returns `null` (meaning "drop this attribute") for anything that
+// doesn't already look safe, rather than guessing.
+function _safeIdentifierOrNull(v) {
+  if (typeof v !== 'string' || v.length === 0) return null;
+  return _IDENTIFIER_ATTR_RE.test(v) ? v : null;
+}
+
+// `"host:port"` -> `{host, port}` (port `null` when absent/unparseable).
+// Never a full URL parse — this shape (Envoy's `upstream_host`, a bare
+// `host:port` pair) has no scheme/path to confuse it with.
+function _splitHostPort(v) {
+  if (typeof v !== 'string' || v.length === 0) return { host: null, port: null };
+  const i = v.lastIndexOf(':');
+  if (i === -1) return { host: _safeIdentifierOrNull(v), port: null };
+  const host = v.slice(0, i);
+  const portStr = v.slice(i + 1);
+  const port = /^[0-9]{1,5}$/.test(portStr) ? Number(portStr) : null;
+  return { host: _safeIdentifierOrNull(host), port };
+}
+
+function _draftBase(context, environmentOverride) {
+  const { version, adapter, source, environment, windowStart, windowEnd, importedAt, retention } = context;
+  return {
+    version, adapter, source,
+    environment: environmentOverride !== undefined ? environmentOverride : environment,
+    windowStart, windowEnd, retention, importedAt,
+  };
+}
+
+/**
+ * OpenTelemetry JSON trace export (the standard OTLP/JSON `resourceSpans`
+ * document — a SINGLE JSON object, never JSONL; this is the format
+ * `otlptracehttp` with `OTEL_EXPORTER_OTLP_TRACES_PROTOCOL=http/json`
+ * writes). One draft per span. Reads only well-known OpenTelemetry
+ * semantic-convention attribute keys — `server.address`/`net.peer.name`,
+ * `server.port`/`net.peer.port`, `url.scheme`/`http.scheme`,
+ * `network.protocol.name`, `db.system`/`db.name`,
+ * `messaging.destination.name` — mapped onto the approved
+ * `destination.*`/`network.protocol`/`schema.name` keys; `resource`-level
+ * `service.name` is carried as `service.name`. Every other span
+ * attribute (`http.url`'s full query string, `http.request.header.*`,
+ * `gen_ai.*` prompt/completion content, trace/span ids themselves) is
+ * dropped — none has a safe, approved destination. `eventCountBand` is
+ * always `'1'`: a single exported span is a single observed event, never
+ * an aggregate count OTel itself does not report.
+ */
+function parseOtelJsonObservations(text, context) {
+  if (typeof text !== 'string' || !_isPlainObject(context)) {
+    return { drafts: [], errors: [{ line: 0, message: 'parseOtelJsonObservations requires a string text and a plain-object context' }] };
+  }
+
+  let doc;
+  try {
+    doc = JSON.parse(text);
+  } catch {
+    return { drafts: [], errors: [{ line: 0, message: 'invalid JSON: expected one OTLP/JSON resourceSpans document' }] };
+  }
+  if (!_isPlainObject(doc) || !Array.isArray(doc.resourceSpans)) {
+    return { drafts: [], errors: [{ line: 0, message: 'expected a JSON object with a top-level "resourceSpans" array (the OTLP/JSON export shape)' }] };
+  }
+
+  const _attrMap = (attrs) => {
+    const m = {};
+    if (!Array.isArray(attrs)) return m;
+    for (const a of attrs) {
+      if (!_isPlainObject(a) || typeof a.key !== 'string' || !_isPlainObject(a.value)) continue;
+      const v = a.value;
+      if (typeof v.stringValue === 'string') m[a.key] = v.stringValue;
+      else if (typeof v.intValue === 'number' || typeof v.intValue === 'string') m[a.key] = String(v.intValue);
+      else if (typeof v.boolValue === 'boolean') m[a.key] = v.boolValue;
+    }
+    return m;
+  };
+
+  // Nanoseconds-since-epoch (OTLP's own wire unit) as a string or number
+  // -> ISO-8601. Returns null (never a fabricated "now") when absent or
+  // unparseable, letting the caller fall back to the import window.
+  const _isoFromUnixNano = (v) => {
+    if (v === undefined || v === null) return null;
+    const n = typeof v === 'string' ? Number(v) : v;
+    if (!Number.isFinite(n) || n <= 0) return null;
+    const ms = Math.round(n / 1e6);
+    const d = new Date(ms);
+    return Number.isFinite(d.getTime()) ? d.toISOString() : null;
+  };
+
+  const drafts = [];
+  for (const rs of doc.resourceSpans) {
+    if (!_isPlainObject(rs)) continue;
+    const resourceAttrs = _attrMap(rs.resource?.attributes);
+    const serviceName = _safeIdentifierOrNull(resourceAttrs['service.name']);
+
+    for (const ss of Array.isArray(rs.scopeSpans) ? rs.scopeSpans : []) {
+      if (!_isPlainObject(ss)) continue;
+      for (const span of Array.isArray(ss.spans) ? ss.spans : []) {
+        if (!_isPlainObject(span)) continue;
+        const a = _attrMap(span.attributes);
+
+        const attributes = {};
+        if (serviceName) attributes['service.name'] = serviceName;
+        const host = _safeIdentifierOrNull(a['server.address'] ?? a['net.peer.name']);
+        if (host) attributes['destination.host'] = host;
+        const portRaw = a['server.port'] ?? a['net.peer.port'];
+        const port = /^[0-9]{1,5}$/.test(String(portRaw ?? '')) ? Number(portRaw) : null;
+        if (port !== null) attributes['destination.port'] = port;
+        const scheme = _safeIdentifierOrNull(a['url.scheme'] ?? a['http.scheme']);
+        if (scheme) attributes['destination.scheme'] = scheme;
+        const protocol = _safeIdentifierOrNull(a['network.protocol.name']);
+        if (protocol) attributes['network.protocol'] = protocol;
+        const storeService = _safeIdentifierOrNull(a['db.system'] ?? a['db.name'] ?? a['messaging.destination.name']);
+        if (storeService) attributes['destination.service'] = storeService;
+
+        if (Object.keys(attributes).length === 0) continue; // nothing safe to report for this span
+
+        const at = _isoFromUnixNano(span.startTimeUnixNano) ?? context.windowStart;
+        drafts.push({
+          ..._draftBase(context),
+          attributes,
+          eventCountBand: '1',
+          firstObservedAt: at,
+          lastObservedAt: _isoFromUnixNano(span.endTimeUnixNano) ?? at,
+        });
+      }
+    }
+  }
+
+  return { drafts, errors: [] };
+}
+
+/**
+ * Envoy's default JSON access log (`json_format` logging, one JSON
+ * object per line). Reads `upstream_host` (split into
+ * `destination.host`/`destination.port`), `upstream_cluster` (as
+ * `destination.service`), `protocol` (normalized — Envoy writes
+ * `"HTTP/1.1"`, which contains `/` and is not an approved identifier
+ * shape; lowercased and `/` stripped, e.g. `"http1.1"`), and
+ * `response_flags` (`'-'`/empty means no flag, i.e. allowed; a non-empty
+ * flags string, e.g. `"UAEX"` for unauthorized, is treated as `'denied'`
+ * via `network.securityDecision`). `start_time`/`end_time` (or
+ * `start_time` alone, with `duration` in milliseconds added) feed
+ * `firstObservedAt`/`lastObservedAt`. Everything else — client address,
+ * request path/query, user agent, request id, response code's own exact
+ * value — is dropped.
+ */
+function parseEnvoyAccessLogObservations(text, context) {
+  if (typeof text !== 'string' || !_isPlainObject(context)) {
+    return { drafts: [], errors: [{ line: 0, message: 'parseEnvoyAccessLogObservations requires a string text and a plain-object context' }] };
+  }
+
+  const drafts = [];
+  const errors = [];
+  const lines = text.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    const rawLine = lines[i];
+    if (rawLine.trim().length === 0) continue;
+    const line = i + 1;
+
+    let record;
+    try {
+      record = JSON.parse(rawLine);
+    } catch {
+      errors.push({ line, message: `invalid JSON on line ${line}` });
+      continue;
+    }
+    if (!_isPlainObject(record)) {
+      errors.push({ line, message: `record on line ${line} must be a JSON object` });
+      continue;
+    }
+
+    const { host, port } = _splitHostPort(record.upstream_host);
+    const cluster = _safeIdentifierOrNull(record.upstream_cluster);
+    const protocol = typeof record.protocol === 'string'
+      ? _safeIdentifierOrNull(record.protocol.toLowerCase().replace(/\//g, ''))
+      : null;
+
+    const attributes = {};
+    if (host) attributes['destination.host'] = host;
+    if (port !== null) attributes['destination.port'] = port;
+    if (cluster) attributes['destination.service'] = cluster;
+    if (protocol) attributes['network.protocol'] = protocol;
+    if (typeof record.response_flags === 'string') {
+      attributes['network.securityDecision'] = record.response_flags.trim().length === 0 || record.response_flags.trim() === '-' ? 'allowed' : 'denied';
+    }
+
+    if (Object.keys(attributes).length === 0) continue; // nothing safe/present to report for this line
+
+    const startIso = typeof record.start_time === 'string' && Number.isFinite(Date.parse(record.start_time))
+      ? record.start_time : context.windowStart;
+    let endIso = typeof record.end_time === 'string' && Number.isFinite(Date.parse(record.end_time))
+      ? record.end_time : null;
+    if (endIso === null && typeof record.duration === 'number' && Number.isFinite(record.duration)) {
+      endIso = new Date(Date.parse(startIso) + record.duration).toISOString();
+    }
+
+    drafts.push({
+      ..._draftBase(context),
+      attributes,
+      eventCountBand: '1',
+      firstObservedAt: startIso,
+      lastObservedAt: endIso ?? startIso,
+    });
+  }
+
+  return { drafts, errors };
+}
+
+/**
+ * Kubernetes `audit.k8s.io` audit-event JSONL (one event object per
+ * line — the default `webhook`/file backend format). Reads `objectRef`
+ * (`namespace` + `resource`, joined as `"<namespace>:<resource>"` into
+ * `destination.service` — never `objectRef.name`, which is frequently a
+ * user-chosen, potentially sensitive resource name) and
+ * `responseStatus.code` (mapped to `network.securityDecision`: `< 400`
+ * is `'allowed'`, `>= 400` is `'denied'` — a client error is treated as a
+ * decision here because the audit log's own admission/authorization
+ * failures surface as 401/403/409, which is exactly the "security
+ * decision" fact this adapter exists to carry). `requestReceivedTimestamp`/
+ * `stageTimestamp` feed the observed-at window. **`user.username` and
+ * every request/response body field are deliberately never read** — a
+ * K8s audit event's `user` block is exactly the "authenticated identity"
+ * PRD 2 names, and `runtime-observation.js`'s own contract has no
+ * approved field for it (a deliberate, disclosed scope boundary — see
+ * this PRD's implementation-status doc).
+ */
+function parseK8sAuditLogObservations(text, context) {
+  if (typeof text !== 'string' || !_isPlainObject(context)) {
+    return { drafts: [], errors: [{ line: 0, message: 'parseK8sAuditLogObservations requires a string text and a plain-object context' }] };
+  }
+
+  const drafts = [];
+  const errors = [];
+  const lines = text.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    const rawLine = lines[i];
+    if (rawLine.trim().length === 0) continue;
+    const line = i + 1;
+
+    let record;
+    try {
+      record = JSON.parse(rawLine);
+    } catch {
+      errors.push({ line, message: `invalid JSON on line ${line}` });
+      continue;
+    }
+    if (!_isPlainObject(record)) {
+      errors.push({ line, message: `record on line ${line} must be a JSON object` });
+      continue;
+    }
+
+    const objectRef = _isPlainObject(record.objectRef) ? record.objectRef : {};
+    const namespace = _safeIdentifierOrNull(objectRef.namespace);
+    const resource = _safeIdentifierOrNull(objectRef.resource);
+    const code = record.responseStatus && typeof record.responseStatus === 'object' ? record.responseStatus.code : undefined;
+
+    const attributes = {};
+    if (namespace && resource) attributes['destination.service'] = `${namespace}:${resource}`;
+    else if (resource) attributes['destination.service'] = resource;
+    if (typeof code === 'number' && Number.isFinite(code)) {
+      attributes['network.securityDecision'] = code < 400 ? 'allowed' : 'denied';
+    }
+
+    if (Object.keys(attributes).length === 0) continue;
+
+    const observedAt = typeof record.requestReceivedTimestamp === 'string' && Number.isFinite(Date.parse(record.requestReceivedTimestamp))
+      ? record.requestReceivedTimestamp
+      : (typeof record.stageTimestamp === 'string' && Number.isFinite(Date.parse(record.stageTimestamp)) ? record.stageTimestamp : context.windowStart);
+
+    drafts.push({
+      ..._draftBase(context),
+      attributes,
+      eventCountBand: '1',
+      firstObservedAt: observedAt,
+      lastObservedAt: observedAt,
+    });
+  }
+
+  return { drafts, errors };
+}
+
+/**
+ * A generic JSON-lines HTTP access log (one JSON object per line — the
+ * shape a structured reverse proxy or load-balancer access log normalizes
+ * to; deliberately not an Apache/Nginx TEXT combined-log parser, which
+ * would need its own separate, much larger format-string handling).
+ * Reads `host`/`destination_host` -> `destination.host`,
+ * `upstream`/`upstream_service` -> `destination.service`, `scheme` ->
+ * `destination.scheme`. `timestamp` (or `time`) feeds the observed-at
+ * window. Request path/query, client IP, user agent, status code's own
+ * value, and every header are dropped.
+ */
+function parseHttpAccessLogObservations(text, context) {
+  if (typeof text !== 'string' || !_isPlainObject(context)) {
+    return { drafts: [], errors: [{ line: 0, message: 'parseHttpAccessLogObservations requires a string text and a plain-object context' }] };
+  }
+
+  const drafts = [];
+  const errors = [];
+  const lines = text.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    const rawLine = lines[i];
+    if (rawLine.trim().length === 0) continue;
+    const line = i + 1;
+
+    let record;
+    try {
+      record = JSON.parse(rawLine);
+    } catch {
+      errors.push({ line, message: `invalid JSON on line ${line}` });
+      continue;
+    }
+    if (!_isPlainObject(record)) {
+      errors.push({ line, message: `record on line ${line} must be a JSON object` });
+      continue;
+    }
+
+    const host = _safeIdentifierOrNull(record.host ?? record.destination_host);
+    const upstream = _safeIdentifierOrNull(record.upstream ?? record.upstream_service);
+    const scheme = _safeIdentifierOrNull(record.scheme);
+
+    const attributes = {};
+    if (host) attributes['destination.host'] = host;
+    if (upstream) attributes['destination.service'] = upstream;
+    if (scheme) attributes['destination.scheme'] = scheme;
+
+    if (Object.keys(attributes).length === 0) continue;
+
+    const ts = record.timestamp ?? record.time;
+    const observedAt = typeof ts === 'string' && Number.isFinite(Date.parse(ts)) ? ts : context.windowStart;
+
+    drafts.push({
+      ..._draftBase(context),
+      attributes,
+      eventCountBand: '1',
+      firstObservedAt: observedAt,
+      lastObservedAt: observedAt,
+    });
+  }
+
+  return { drafts, errors };
+}
+
 // The adapter registry — a frozen, module-level lookup. `adapterFor`
 // returns `null` for anything unknown, NEVER a default: an unimplemented
 // adapter name (e.g. `'otlp'`, deferred per the scoping doc's §4.3 ruling)
@@ -280,6 +644,10 @@ function parseNativeJsonlObservations(text, context) {
 // someday exist.
 const _ADAPTERS = Object.freeze({
   'native-jsonl': Object.freeze({ name: 'native-jsonl', parse: parseNativeJsonlObservations }),
+  'otel-json': Object.freeze({ name: 'otel-json', parse: parseOtelJsonObservations }),
+  'envoy-access-log': Object.freeze({ name: 'envoy-access-log', parse: parseEnvoyAccessLogObservations }),
+  'k8s-audit-log': Object.freeze({ name: 'k8s-audit-log', parse: parseK8sAuditLogObservations }),
+  'http-access-log': Object.freeze({ name: 'http-access-log', parse: parseHttpAccessLogObservations }),
 });
 
 /**

package/dist/4142.index.js

@@ -712,13 +712,13 @@ function loadLedger(scanRoot) {
 function saveLedger(scanRoot, ledger) {
   if (!(0,state_dir/* ensureStateDir */.xH)(scanRoot)) return { ok: false, reason: 'no safe state directory for this project' };
   const f = (0,state_dir.statePath)(scanRoot, DIR, 'ledger.json');
-  return { ok: (0,state_dir/* safeWriteState */.Ep)(f, JSON.stringify(ledger, null, 2)) };
+  return { ok: (0,state_dir.safeWriteState)(f, JSON.stringify(ledger, null, 2)) };
 }
 
 function saveIR(scanRoot, ir) {
   if (!(0,state_dir/* ensureStateDir */.xH)(scanRoot)) return { ok: false, reason: 'no safe state directory for this project' };
   const f = external_node_path_.join(ruleDir(scanRoot, ir.id), 'ir.json');
-  return { ok: (0,state_dir/* safeWriteState */.Ep)(f, JSON.stringify(ir, null, 2)), file: f };
+  return { ok: (0,state_dir.safeWriteState)(f, JSON.stringify(ir, null, 2)), file: f };
 }
 
 function loadIR(scanRoot, id) {
@@ -729,7 +729,7 @@ function loadIR(scanRoot, id) {
 function saveEvaluation(scanRoot, id, evaluation) {
   if (!(0,state_dir/* ensureStateDir */.xH)(scanRoot)) return { ok: false, reason: 'no safe state directory for this project' };
   const f = external_node_path_.join(ruleDir(scanRoot, id), 'evaluation.json');
-  return { ok: (0,state_dir/* safeWriteState */.Ep)(f, JSON.stringify(evaluation, null, 2)) };
+  return { ok: (0,state_dir.safeWriteState)(f, JSON.stringify(evaluation, null, 2)) };
 }
 
 /** Write the regression fixtures a promoted rule needs: the SAME vulnerable/clean convention `runRuleTests`
@@ -741,11 +741,11 @@ function writeFixtures(scanRoot, ir, corpus) {
   const written = [];
   for (const p of corpus.positives) {
     const f = external_node_path_.join(base, 'vulnerable', `${p.label.replace(/[^a-z0-9_-]/gi, '_')}.${ext}`);
-    if ((0,state_dir/* safeWriteState */.Ep)(f, p.code)) written.push(f);
+    if ((0,state_dir.safeWriteState)(f, p.code)) written.push(f);
   }
   for (const n of corpus.negatives) {
     const f = external_node_path_.join(base, 'clean', `${n.label.replace(/[^a-z0-9_-]/gi, '_')}.${ext}`);
-    if ((0,state_dir/* safeWriteState */.Ep)(f, n.code)) written.push(f);
+    if ((0,state_dir.safeWriteState)(f, n.code)) written.push(f);
   }
   return { ok: true, written, glob: external_node_path_.join(base, '**', '*') };
 }
@@ -772,7 +772,7 @@ function publishCustomRule(scanRoot, ir) {
     `  message: ${JSON.stringify(doc.message)}`,
     '',
   ].join('\n');
-  return { ok: (0,state_dir/* safeWriteState */.Ep)(f, yamlText), file: f };
+  return { ok: (0,state_dir.safeWriteState)(f, yamlText), file: f };
 }
 
 function unpublishCustomRule(scanRoot, id) {