@clear-capabilities/agentic-security-scanner 0.172.0 → 0.173.0

package/dist/2199.index.js

@@ -2,245 +2,6 @@ export const id = 2199;
 export const ids = [2199];
 export const modules = {
 
-/***/ 25517:
-/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
-
-/* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   $: () => (/* binding */ ORACLE_TYPES),
-/* harmony export */   U: () => (/* binding */ evaluateOracle)
-/* harmony export */ });
-// Deterministic security oracles. A model may SELECT an oracle and propose its parameters; it may never decide that the
-// oracle succeeded. Each oracle is a pure function of an Observation gathered by the TRUSTED runner (never by the model):
-//
-//   Observation = {
-//     exitCode, signal, timedOut, stdout, stderr,
-//     canaries: { <name>: { exists, digestBefore, digestAfter } }      // checked by the runner on disk, after the run
-//     callbacks: [{ nonce }]                                            // hits recorded by the runner's loopback listener
-//     nonce                                                             // per-run random token the target cannot predict
-//   }
-//
-// An oracle returns { fired, reason }. `fired:false` with `inconclusive:true` means the observation could not decide
-// (for example a timeout); it is never treated as "not exploitable".
-const ORACLE_TYPES = Object.freeze([
-  'crash_sanitizer', 'command_execution', 'unauthorized_http_access', 'unauthorized_db_read', 'database_mutation',
-  'filesystem_mutation', 'outbound_callback', 'authentication_bypass', 'arbitrary_assertion',
-]);
-
-const SANITIZER_RE = /(AddressSanitizer|UndefinedBehaviorSanitizer|stack-buffer-overflow|heap-buffer-overflow|SEGV on unknown address|stack smashing detected|buffer overflow detected)/i;
-const CRASH_SIGNALS = new Set(['SIGSEGV', 'SIGABRT', 'SIGBUS', 'SIGILL', 'SIGFPE']);
-
-const out = (fired, reason, extra = {}) => ({ fired, reason, ...extra });
-const inconclusive = (reason) => ({ fired: false, inconclusive: true, reason });
-const has = (obs, text) => typeof text === 'string' && text.length > 0 && `${obs.stdout || ''}${obs.stderr || ''}`.includes(text);
-
-const IMPL = {
-  crash_sanitizer(obs) {
-    if (SANITIZER_RE.test(obs.stderr || '')) return out(true, 'sanitizer or runtime memory-safety report on stderr');
-    if (obs.signal && CRASH_SIGNALS.has(obs.signal)) return out(true, `process terminated by ${obs.signal}`);
-    if (obs.timedOut) return inconclusive('run timed out before a crash could be judged');
-    return out(false, 'no crash signal and no sanitizer report');
-  },
-  // The injected payload asks the shell/interpreter to create a file named after the per-run nonce inside the
-  // watched canary directory. The target cannot create it unless attacker data reached a command.
-  command_execution(obs, p) {
-    const c = obs.canaries?.[p.canary || 'command'];
-    if (!c) return inconclusive('command canary was not armed by the runner');
-    if (c.exists && !c.existedBefore) return out(true, 'nonce-named canary file created by an injected command');
-    if (obs.timedOut) return inconclusive('run timed out before the canary could be judged');
-    return out(false, 'canary file not created');
-  },
-  // A secret planted behind authorization (never shown to the exploit client). Seeing the nonce-bearing secret in the
-  // client's output while the actor held no credential is the violation.
-  unauthorized_http_access(obs, p) {
-    const secret = obs.secrets?.[p.secret || 'http'];
-    if (!secret) return inconclusive('protected secret was not armed by the runner');
-    if (has(obs, secret)) return out(true, 'protected resource content returned to an unauthenticated actor');
-    if (obs.timedOut) return inconclusive('run timed out');
-    return out(false, 'protected content not observed');
-  },
-  unauthorized_db_read(obs, p) {
-    const secret = obs.secrets?.[p.secret || 'db'];
-    if (!secret) return inconclusive('database canary row was not armed by the runner');
-    if (has(obs, secret)) return out(true, 'row the actor may not read was returned');
-    if (obs.timedOut) return inconclusive('run timed out');
-    return out(false, 'canary row value not observed');
-  },
-  database_mutation(obs, p) {
-    const c = obs.canaries?.[p.canary || 'db'];
-    if (!c) return inconclusive('database canary was not armed by the runner');
-    if (c.digestBefore && c.digestAfter && c.digestBefore !== c.digestAfter) return out(true, 'protected database state changed');
-    if (obs.timedOut) return inconclusive('run timed out');
-    return out(false, 'protected database state unchanged');
-  },
-  filesystem_mutation(obs, p) {
-    const c = obs.canaries?.[p.canary || 'fs'];
-    if (!c) return inconclusive('filesystem canary was not armed by the runner');
-    if ((c.exists && !c.existedBefore) || (c.digestBefore && c.digestAfter && c.digestBefore !== c.digestAfter)) return out(true, 'file outside the permitted area was created or modified');
-    if (obs.timedOut) return inconclusive('run timed out');
-    return out(false, 'protected path unchanged');
-  },
-  outbound_callback(obs) {
-    if (obs.callbackUnavailable) return { fired: false, unsupported: true, reason: 'loopback callback listener is not available on this backend' };
-    const hit = (obs.callbacks || []).some((c) => c && c.nonce && c.nonce === obs.nonce);
-    if (hit) return out(true, 'nonce-bearing request reached the runner-controlled listener');
-    if (obs.timedOut) return inconclusive('run timed out');
-    return out(false, 'no nonce-bearing callback received');
-  },
-  authentication_bypass(obs, p) {
-    const secret = obs.secrets?.[p.secret || 'auth'];
-    if (!secret) return inconclusive('protected secret was not armed by the runner');
-    if (has(obs, secret)) return out(true, 'privileged content returned without valid credentials');
-    if (obs.timedOut) return inconclusive('run timed out');
-    return out(false, 'privileged content not observed without credentials');
-  },
-  // Declarative only: no code, no regex supplied by a model. Operators are a closed set.
-  arbitrary_assertion(obs, p) {
-    const a = p.assert;
-    if (!a || typeof a !== 'object') return inconclusive('assertion missing');
-    if (obs.timedOut) return inconclusive('run timed out');
-    if ('exitCode' in a) return a.exitCode === obs.exitCode ? out(true, `exit code was ${obs.exitCode}`) : out(false, `exit code was ${obs.exitCode}`);
-    if ('stdoutIncludes' in a) return has({ stdout: obs.stdout }, String(a.stdoutIncludes)) ? out(true, 'stdout contained the asserted text') : out(false, 'stdout did not contain the asserted text');
-    if ('stderrIncludes' in a) return has({ stderr: obs.stderr }, String(a.stderrIncludes)) ? out(true, 'stderr contained the asserted text') : out(false, 'stderr did not contain the asserted text');
-    return inconclusive('unsupported assertion operator');
-  },
-};
-
-function evaluateOracle(spec, observation) {
-  if (!spec || !ORACLE_TYPES.includes(spec.type)) return { fired: false, unsupported: true, reason: `unknown oracle type: ${String(spec?.type)}` };
-  if (!observation || typeof observation !== 'object') return inconclusive('no observation');
-  try { return IMPL[spec.type](observation, spec.params || {}); } catch (e) { return inconclusive(`oracle error: ${e.message}`); }
-}
-
-
-/***/ }),
-
-/***/ 37055:
-/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
-
-/* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   IW: () => (/* binding */ verifierView),
-/* harmony export */   V2: () => (/* binding */ substitute),
-/* harmony export */   Yj: () => (/* binding */ LANGUAGES),
-/* harmony export */   dw: () => (/* binding */ canonicalize),
-/* harmony export */   mC: () => (/* binding */ validateReproducer),
-/* harmony export */   sc: () => (/* binding */ sha256),
-/* harmony export */   we: () => (/* binding */ reproducerDigest)
-/* harmony export */ });
-/* unused harmony exports MAX_FILES, MAX_FILE_BYTES, isSafeRelPath */
-/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(77598);
-/* harmony import */ var _oracles_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(25517);
-// Serialized reproducer: the ONLY thing an independent verifier receives (besides revision, finding id and oracle).
-// It carries no reasoning, no model output and no prior results. Everything per-run (nonce, secrets, canary paths,
-// callback URL) is a placeholder substituted fresh by the trusted runner, so a replay can never reuse a stale value
-// and a target cannot learn the values in advance.
-
-
-
-const REPRODUCER_SCHEMA = 'agentic-security/reproducer';
-const REPRODUCER_VERSION = 1;
-const LANGUAGES = Object.freeze(['javascript', 'typescript', 'python', 'java', 'c', 'cpp', 'csharp']);
-const MAX_FILES = 64;
-const MAX_FILE_BYTES = 256 * 1024;
-const MAX_TOTAL_BYTES = 1024 * 1024;
-const PLACEHOLDER_RE = /\{\{([A-Z_]+)(?::([a-z0-9_-]{1,32}))?\}\}/g;
-const ALLOWED_PLACEHOLDERS = new Set(['NONCE', 'SECRET', 'CANARY', 'CALLBACK_URL', 'CALLBACK_PORT', 'ROOT', 'NODE', 'PYTHON', 'JAVA', 'JAVAC', 'CC']);
-
-function isSafeRelPath(rel) {
-  if (typeof rel !== 'string' || !rel || rel.length > 200) return false;
-  if (rel.startsWith('/') || rel.includes('\0') || rel.includes('\\')) return false;
-  if (['canary', 'tmp'].includes(rel.split('/')[0])) return false;
-  return rel.split('/').every((seg) => seg && seg !== '.' && seg !== '..' && !seg.startsWith('__oracle_'));
-}
-
-/** Canonical JSON (sorted keys) so identical reproducers hash identically regardless of key order. */
-function canonicalize(v) {
-  if (Array.isArray(v)) return `[${v.map(canonicalize).join(',')}]`;
-  if (v && typeof v === 'object') return `{${Object.keys(v).sort().map((k) => `${JSON.stringify(k)}:${canonicalize(v[k])}`).join(',')}}`;
-  return JSON.stringify(v);
-}
-const sha256 = (s) => (0,node_crypto__WEBPACK_IMPORTED_MODULE_0__.createHash)('sha256').update(s).digest('hex');
-const reproducerDigest = (r) => sha256(canonicalize(r));
-
-function validateReproducer(r) {
-  const errs = [];
-  if (!r || typeof r !== 'object' || Array.isArray(r)) return ['reproducer must be an object'];
-  if (r.schema !== REPRODUCER_SCHEMA) errs.push('unknown schema');
-  if (r.version !== REPRODUCER_VERSION) errs.push('unsupported reproducer version');
-  if (typeof r.findingId !== 'string' || !r.findingId || r.findingId.length > 200) errs.push('findingId required');
-  if (!LANGUAGES.includes(r.lang)) errs.push(`unsupported language: ${String(r.lang)}`);
-  if (!r.oracle || !_oracles_js__WEBPACK_IMPORTED_MODULE_1__/* .ORACLE_TYPES */ .$.includes(r.oracle.type)) errs.push(`unknown oracle: ${String(r.oracle?.type)}`);
-  const files = r.files ?? {};
-  if (typeof files !== 'object' || Array.isArray(files)) errs.push('files must be an object');
-  else {
-    const names = Object.keys(files);
-    if (names.length > MAX_FILES) errs.push(`file count must be at most ${MAX_FILES}`);
-    let total = 0;
-    for (const n of names) {
-      if (!isSafeRelPath(n)) { errs.push(`unsafe file path: ${n}`); continue; }
-      if (typeof files[n] !== 'string') { errs.push(`file ${n} must be a string`); continue; }
-      const b = Buffer.byteLength(files[n]);
-      total += b;
-      if (b > MAX_FILE_BYTES) errs.push(`file ${n} exceeds ${MAX_FILE_BYTES} bytes`);
-    }
-    if (total > MAX_TOTAL_BYTES) errs.push('reproducer exceeds total size limit');
-  }
-  const sourceNames = r.sources && typeof r.sources === 'object' && !Array.isArray(r.sources) ? Object.keys(r.sources) : [];
-  if (Object.keys(files).length + sourceNames.length === 0) errs.push('reproducer must declare at least one file or source');
-  for (const key of ['build', 'run']) {
-    const a = r[key];
-    if (a == null && key === 'build') continue;
-    if (!Array.isArray(a) || !a.length || !a.every((x) => typeof x === 'string' && x.length < 2000 && !x.includes('\0'))) errs.push(`${key} must be a non-empty argv array of strings (no shell string)`);
-  }
-  for (const text of [...Object.values(files || {}), ...(r.build || []), ...(r.run || [])]) {
-    if (typeof text !== 'string') continue;
-    for (const m of text.matchAll(PLACEHOLDER_RE)) if (!ALLOWED_PLACEHOLDERS.has(m[1])) errs.push(`unknown placeholder {{${m[1]}}}`);
-  }
-  if (r.watch != null) {
-    if (typeof r.watch !== 'object' || Array.isArray(r.watch)) errs.push('watch must be an object');
-    else for (const [k, v] of Object.entries(r.watch)) if (!/^[a-z0-9_-]{1,32}$/.test(k) || !isSafeRelPath(v)) errs.push(`bad watch entry: ${k}`);
-  }
-  if (r.env != null) {
-    if (typeof r.env !== 'object' || Array.isArray(r.env)) errs.push('env must be an object');
-    else for (const [k, v] of Object.entries(r.env)) {
-      if (!/^[A-Z][A-Z0-9_]{0,63}$/.test(k)) errs.push(`bad env var name: ${k}`);
-      if (typeof v !== 'string' || v.length > 4096) errs.push(`env value for ${k} must be a short string`);
-    }
-  }
-  if (r.sources != null) {
-    if (typeof r.sources !== 'object' || Array.isArray(r.sources)) errs.push('sources must be an object');
-    else for (const [dest, src] of Object.entries(r.sources)) if (!isSafeRelPath(dest) || !isSafeRelPath(src)) errs.push(`bad sources entry: ${dest}`);
-  }
-  if (r.network != null && !['none', 'callback'].includes(r.network)) errs.push('network must be none or callback');
-  return errs;
-}
-
-/** The view handed to an independent verifier: exactly the reproducer, plus identifiers. Nothing else. */
-function verifierView({ revision, reproducer, findingId, oracle }) {
-  return Object.freeze({ revision: revision ?? null, findingId, oracle, reproducer: structuredClone(reproducer) });
-}
-
-function substitute(text, ctx) {
-  return text.replace(PLACEHOLDER_RE, (whole, name, arg) => {
-    switch (name) {
-      case 'NONCE': return ctx.nonce;
-      case 'SECRET': return ctx.secret(arg || 'default');
-      case 'CANARY': return ctx.canary(arg || 'default');
-      case 'CALLBACK_URL': return ctx.callbackUrl ?? whole;
-      case 'CALLBACK_PORT': return String(ctx.callbackPort ?? '');
-      case 'ROOT': return ctx.root;
-      case 'NODE': return ctx.tools.node;
-      case 'PYTHON': return ctx.tools.python ?? whole;
-      case 'JAVA': return ctx.tools.java ?? whole;
-      case 'JAVAC': return ctx.tools.javac ?? whole;
-      case 'CC': return ctx.tools.cc ?? whole;
-      default: return whole;
-    }
-  });
-}
-
-
-/***/ }),
-
 /***/ 62199:
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 

package/dist/2223.index.js

@@ -0,0 +1,159 @@
+export const id = 2223;
+export const ids = [2223];
+export const modules = {
+
+/***/ 82223:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   detectVendoredLibraries: () => (/* binding */ detectVendoredLibraries)
+/* harmony export */ });
+// Vendored / copied library detection via version-string fingerprinting.
+//
+// Detects library code copied into src/ that bypasses SCA. Uses version
+// string patterns (_.VERSION, jQuery.fn.jquery, etc.) and characteristic
+// function signatures to identify vendored libraries.
+
+const VERSION_FINGERPRINTS = [
+  { pkg: 'lodash', ecosystem: 'npm', patterns: [
+    { re: /\b(?:lodash|_)\.VERSION\s*=\s*['"](\d+\.\d+\.\d+)['"]/, versionGroup: 1 },
+    { re: /\b__lodash_hash_undefined__\b/, version: null },
+  ]},
+  { pkg: 'jquery', ecosystem: 'npm', patterns: [
+    { re: /jQuery\.fn\.jquery\s*=\s*['"](\d+\.\d+\.\d+)['"]/, versionGroup: 1 },
+    { re: /\bjQuery\.fn\.init\b/, version: null },
+  ]},
+  { pkg: 'underscore', ecosystem: 'npm', patterns: [
+    { re: /\b_\.VERSION\s*=\s*['"](\d+\.\d+\.\d+)['"]/, versionGroup: 1 },
+  ]},
+  { pkg: 'moment', ecosystem: 'npm', patterns: [
+    { re: /\bmoment\.version\s*=\s*['"](\d+\.\d+\.\d+)['"]/, versionGroup: 1 },
+    { re: /\bmoment\.(?:utc|parseZone|duration|locale)\b/, version: null },
+  ]},
+  { pkg: 'handlebars', ecosystem: 'npm', patterns: [
+    { re: /\bHandlebars\.VERSION\s*=\s*['"](\d+\.\d+\.\d+)['"]/, versionGroup: 1 },
+  ]},
+  { pkg: 'backbone', ecosystem: 'npm', patterns: [
+    { re: /\bBackbone\.VERSION\s*=\s*['"](\d+\.\d+\.\d+)['"]/, versionGroup: 1 },
+  ]},
+  { pkg: 'angular', ecosystem: 'npm', patterns: [
+    { re: /\bangular\.version\s*=\s*\{[^}]*full\s*:\s*['"](\d+\.\d+\.\d+)['"]/, versionGroup: 1 },
+  ]},
+  { pkg: 'vue', ecosystem: 'npm', patterns: [
+    { re: /\bVue\.version\s*=\s*['"](\d+\.\d+\.\d+)['"]/, versionGroup: 1 },
+  ]},
+  { pkg: 'react', ecosystem: 'npm', patterns: [
+    { re: /\bReactVersion\s*=\s*['"](\d+\.\d+\.\d+)['"]/, versionGroup: 1 },
+  ]},
+  { pkg: 'dompurify', ecosystem: 'npm', patterns: [
+    { re: /\bDOMPurify\.version\s*=\s*['"](\d+\.\d+\.\d+)['"]/, versionGroup: 1 },
+  ]},
+  { pkg: 'marked', ecosystem: 'npm', patterns: [
+    { re: /\bmarked\.(?:defaults|setOptions|use|parse)\b[\s\S]{0,200}version\s*[:=]\s*['"](\d+\.\d+\.\d+)['"]/, versionGroup: 1 },
+  ]},
+  { pkg: 'axios', ecosystem: 'npm', patterns: [
+    { re: /\baxios\.VERSION\s*=\s*['"](\d+\.\d+\.\d+)['"]/, versionGroup: 1 },
+  ]},
+  { pkg: 'socket.io-client', ecosystem: 'npm', patterns: [
+    { re: /\bio\.protocol\s*=\s*(\d+)/, version: null },
+  ]},
+  { pkg: 'highlight.js', ecosystem: 'npm', patterns: [
+    { re: /\bhljs\.versionString\s*=\s*['"](\d+\.\d+\.\d+)['"]/, versionGroup: 1 },
+  ]},
+  { pkg: 'chart.js', ecosystem: 'npm', patterns: [
+    { re: /\bChart\.version\s*=\s*['"](\d+\.\d+\.\d+)['"]/, versionGroup: 1 },
+  ]},
+];
+
+const SKIP_DIRS = /(?:^|[/\\])(?:node_modules|vendor|dist|build|\.next|__pycache__|\.git)[/\\]/;
+
+function detectVendoredLibraries(fileContents) {
+  if (!fileContents || typeof fileContents !== 'object') return [];
+  const detected = [];
+  const seen = new Set();
+
+  for (const [fp, content] of Object.entries(fileContents)) {
+    if (!content || typeof content !== 'string') continue;
+    if (SKIP_DIRS.test(fp)) continue;
+    if (content.length < 500) continue;
+
+    for (const lib of VERSION_FINGERPRINTS) {
+      for (const pat of lib.patterns) {
+        const m = content.match(pat.re);
+        if (!m) continue;
+        const version = pat.versionGroup ? m[pat.versionGroup] : null;
+        const key = `${lib.pkg}:${fp}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        detected.push({
+          name: lib.pkg,
+          version: version || 'unknown',
+          ecosystem: lib.ecosystem,
+          file: fp,
+          scope: 'vendored',
+          isVendored: true,
+        });
+        break;
+      }
+    }
+  }
+  // Pass 2: Function-body structural matching for minified/forked copies
+  const FUNCTION_BODY_SIGS = [
+    { pkg: 'lodash', ecosystem: 'npm', fn: 'merge', paramMin: 1,
+      bodyContains: ['assignValue', 'baseFor', 'isObject', 'baseMerge'] },
+    { pkg: 'lodash', ecosystem: 'npm', fn: 'template', paramMin: 1,
+      bodyContains: ['sourceURL', 'interpolate', 'evaluate', 'escape'] },
+    { pkg: 'lodash', ecosystem: 'npm', fn: 'defaultsDeep', paramMin: 1,
+      bodyContains: ['baseMerge', 'isMergeableObject', 'customDefaultsMerge'] },
+    { pkg: 'jquery', ecosystem: 'npm', fn: 'ajax', paramMin: 1,
+      bodyContains: ['XMLHttpRequest', 'ajaxSettings', 'crossDomain', 'responseFields'] },
+    { pkg: 'handlebars', ecosystem: 'npm', fn: 'compile', paramMin: 1,
+      bodyContains: ['templateSpec', 'container', 'invokePartial', 'blockParams'] },
+    { pkg: 'marked', ecosystem: 'npm', fn: 'parse', paramMin: 1,
+      bodyContains: ['Lexer', 'Parser', 'blockTokens', 'walkTokens'] },
+    { pkg: 'ejs', ecosystem: 'npm', fn: 'render', paramMin: 1,
+      bodyContains: ['includeFile', 'resolveInclude', 'rethrow', 'escapeFn'] },
+    { pkg: 'moment', ecosystem: 'npm', fn: 'format', paramMin: 0,
+      bodyContains: ['formatMoment', 'expandFormat', 'makeFormatFunction', 'localFormattingTokens'] },
+    { pkg: 'underscore', ecosystem: 'npm', fn: 'template', paramMin: 1,
+      bodyContains: ['interpolate', 'evaluate', 'escape', 'templateSettings'] },
+    { pkg: 'minimist', ecosystem: 'npm', fn: 'parse', paramMin: 1,
+      bodyContains: ['boolean', 'alias', 'default', 'stopEarly', 'unknown'] },
+  ];
+
+  for (const [fp, content] of Object.entries(fileContents)) {
+    if (!content || typeof content !== 'string') continue;
+    if (SKIP_DIRS.test(fp)) continue;
+    if (!/\.(?:js|mjs|cjs)$/i.test(fp)) continue;
+    if (content.length < 200 || content.length > 500_000) continue;
+
+    for (const sig of FUNCTION_BODY_SIGS) {
+      const key = `${sig.pkg}:${fp}`;
+      if (seen.has(key)) continue;
+      const fnRe = new RegExp(`(?:function\\s+${sig.fn}|(?:const|let|var)\\s+${sig.fn}\\s*=|${sig.fn}\\s*[:=]\\s*function)\\s*\\(`, 'g');
+      const m = fnRe.exec(content);
+      if (!m) continue;
+      const bodyWindow = content.slice(m.index, m.index + 2000);
+      const matchCount = sig.bodyContains.filter(kw => bodyWindow.includes(kw)).length;
+      if (matchCount < Math.ceil(sig.bodyContains.length * 0.6)) continue;
+      seen.add(key);
+      detected.push({
+        name: sig.pkg,
+        version: 'unknown',
+        ecosystem: sig.ecosystem,
+        file: fp,
+        scope: 'vendored',
+        isVendored: true,
+        _detectionMethod: 'function-body-signature',
+        _matchedKeywords: matchCount,
+      });
+    }
+  }
+
+  return detected;
+}
+
+
+/***/ })
+
+};

package/dist/2530.index.js

@@ -0,0 +1,152 @@
+export const id = 2530;
+export const ids = [2530];
+export const modules = {
+
+/***/ 92530:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   verifyReleasePackage: () => (/* binding */ verifyReleasePackage)
+/* harmony export */ });
+/* unused harmony export MINIMUM_KINDS */
+/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(77598);
+// The verifier for a signed release assurance package (E7-03). Used by `scripts/verify-release-package.mjs` (a command-line wrapper) and by `release-view`.
+//
+// This file imports nothing but Node built-ins. It does not use the producer's code, so a defect in the producer cannot make it agree with itself. What it
+// checks, each reported under its own code:
+//   FORMAT      known schema, supported major version, no unknown top-level keys
+//   SIGNATURE   Ed25519 over the domain label plus the canonical JSON of everything but the signature, verified with the key the CALLER supplies; the key the
+//               package names must be the same key (a package cannot vouch for itself, and a signature lifted from another package does not verify)
+//   SNAPSHOT    the snapshot digest matches its fields
+//   EVIDENCE    every record matches the digest in its reference; every reference matches its own digest; every reference is bound to this snapshot
+//   LINEAGE     every dependency is present, there is no cycle, and the stated order is the dependency order
+//   MANDATORY   every kind in the verifier's own minimum, in the caller's --require list, and in the package's own list is present
+//   COMPLETE    the package may not claim a complete scan over a scan health that is not complete
+//   FINDINGS    each finding's proof tier and exploitability flag equal what the finding itself says
+//   ASSERTIONS  every cited record is in the package, and a "supported" statement cites at least one
+
+
+const MINIMUM_KINDS = Object.freeze(['scan-health', 'finding']);
+const SCHEMA = 'agentic-security/release-package';
+const DOMAIN = `${SCHEMA}@1\n`;
+const TOP_KEYS = new Set(['schema', 'schemaVersion', 'snapshot', 'evidence', 'lineageOrder', 'requiredKinds', 'findings', 'completeness', 'policy', 'assertions', 'proves', 'doesNotProve', 'issuance', 'signature']);
+const ROLES = new Set(['finding', 'completeness', 'context', 'control', 'inventory']);
+
+const canon = (v) => {
+  if (v === null || typeof v !== 'object') return JSON.stringify(v ?? null);
+  if (Array.isArray(v)) return `[${v.map(canon).join(',')}]`;
+  return `{${Object.keys(v).sort().map((k) => `${JSON.stringify(k)}:${canon(v[k])}`).join(',')}}`;
+};
+const digest = (v) => `sha256:${node_crypto__WEBPACK_IMPORTED_MODULE_0__.createHash('sha256').update(canon(v)).digest('hex')}`;
+const isObj = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
+
+function verifyReleasePackage(pkg, publicKeyPem, { require: extraRequired = [] } = {}) {
+  const errors = [];
+  const fail = (code, message) => errors.push({ code, message });
+  if (!isObj(pkg)) return { ok: false, errors: [{ code: 'FORMAT', message: 'the package is not an object' }] };
+  if (pkg.schema !== SCHEMA) fail('FORMAT', `unrecognised schema ${JSON.stringify(pkg.schema)}`);
+  const major = Number(String(pkg.schemaVersion).split('.')[0]);
+  if (major !== 1) fail('FORMAT', `unsupported version ${JSON.stringify(pkg.schemaVersion)}`);
+  for (const k of Object.keys(pkg)) if (!TOP_KEYS.has(k)) fail('FORMAT', `unrecognised top-level key "${k}", which the signature does not vouch for`);
+  if (errors.length) return { ok: false, errors };
+
+  // ---- SIGNATURE
+  const sig = pkg.signature;
+  let publicKey = null;
+  if (!publicKeyPem) fail('SIGNATURE', 'no public key was supplied');
+  else { try { publicKey = node_crypto__WEBPACK_IMPORTED_MODULE_0__.createPublicKey(publicKeyPem); } catch (e) { fail('SIGNATURE', `the public key is unusable: ${e.message}`); } }
+  if (!isObj(sig) || sig.algorithm !== 'ed25519' || typeof sig.value !== 'string') fail('SIGNATURE', 'the package is unsigned or uses an unsupported algorithm');
+  else if (publicKey) {
+    const { signature, ...rest } = pkg;
+    let ok = false;
+    try { ok = node_crypto__WEBPACK_IMPORTED_MODULE_0__.verify(null, Buffer.from(DOMAIN + canon(rest), 'utf8'), publicKey, Buffer.from(sig.value, 'base64')); } catch (e) { fail('SIGNATURE', `verification error: ${e.message}`); }
+    if (!ok && !errors.some((e) => e.code === 'SIGNATURE')) fail('SIGNATURE', 'the signature does not match the package contents: something changed after signing, or it was signed by another key');
+    const fp = node_crypto__WEBPACK_IMPORTED_MODULE_0__.createHash('sha256').update(publicKey.export({ type: 'spki', format: 'der' })).digest('hex');
+    const named = pkg.issuance && pkg.issuance.issuer && pkg.issuance.issuer.keyFingerprint;
+    if (named !== fp) fail('SIGNATURE', 'the key the package names is not the key supplied for verification');
+    if (!pkg.issuance || pkg.issuance.independentlyCertified !== false) fail('SIGNATURE', 'a self-issued package may not claim independent certification');
+  }
+
+  // ---- SNAPSHOT
+  const snap = pkg.snapshot;
+  if (!isObj(snap)) fail('SNAPSHOT', 'there is no snapshot');
+  else {
+    const { digest: d, immutable, ...body } = snap;
+    if (d !== digest(body)) fail('SNAPSHOT', 'the snapshot does not match its digest');
+    if (immutable !== (!!body.commit && body.dirty === false)) fail('SNAPSHOT', 'the snapshot\'s immutability flag is not what its fields imply');
+  }
+
+  // ---- EVIDENCE
+  const entries = Array.isArray(pkg.evidence) ? pkg.evidence : [];
+  if (!Array.isArray(pkg.evidence)) fail('EVIDENCE', 'evidence is not a list');
+  const byDigest = new Map();
+  for (const [i, e] of entries.entries()) {
+    if (!isObj(e) || !isObj(e.ref) || !('payload' in e)) { fail('EVIDENCE', `entry ${i} is malformed`); continue; }
+    if (!ROLES.has(e.role)) fail('EVIDENCE', `entry ${i} has an unknown role ${JSON.stringify(e.role)}`);
+    const { digest: rd, findingProvenanceDigest, otherProvenanceDigest, ...rb } = e.ref;
+    if (rd !== digest(rb)) fail('EVIDENCE', `the reference of entry ${i} (${e.ref.kind}) does not match its own digest`);
+    if (e.ref.payloadDigest !== digest(e.payload)) fail('EVIDENCE', `the ${e.ref.kind} record in entry ${i} does not match the digest in its reference`);
+    if (isObj(snap) && e.ref.snapshotDigest !== snap.digest) fail('EVIDENCE', `the ${e.ref.kind} record in entry ${i} describes a different snapshot`);
+    if (byDigest.has(e.ref.digest)) fail('EVIDENCE', `entry ${i} duplicates another reference`);
+    byDigest.set(e.ref.digest, e);
+  }
+
+  // ---- LINEAGE
+  for (const e of byDigest.values()) for (const dep of e.ref.restsOn || []) if (!byDigest.has(dep)) fail('LINEAGE', `${e.ref.kind} rests on a record that is not in the package (${String(dep).slice(0, 19)}...)`);
+  const state = new Map(); const order = [];
+  const visit = (d, trail) => {
+    if (state.get(d) === 2) return; if (state.get(d) === 1) { fail('LINEAGE', `cycle through ${trail.concat(d).map((x) => x.slice(7, 15)).join(' -> ')}`); return; }
+    state.set(d, 1);
+    for (const dep of (byDigest.get(d) || { ref: {} }).ref.restsOn || []) if (byDigest.has(dep)) visit(dep, trail.concat(d));
+    state.set(d, 2); order.push(d);
+  };
+  for (const d of [...byDigest.keys()].sort()) visit(d, []);
+  if (JSON.stringify(order) !== JSON.stringify(pkg.lineageOrder)) fail('LINEAGE', 'the stated order is not the dependency order');
+  if (JSON.stringify(entries.map((e) => e && e.ref && e.ref.digest)) !== JSON.stringify(pkg.lineageOrder)) fail('LINEAGE', 'the evidence list is not in the stated order');
+
+  // ---- MANDATORY
+  const kinds = new Set([...byDigest.values()].map((e) => e.ref.kind));
+  const needed = new Set([...MINIMUM_KINDS, ...extraRequired, ...(Array.isArray(pkg.requiredKinds) ? pkg.requiredKinds : [])]);
+  for (const k of MINIMUM_KINDS) if (!(Array.isArray(pkg.requiredKinds) && pkg.requiredKinds.includes(k))) fail('MANDATORY', `the package does not declare "${k}" as required`);
+  for (const k of [...needed].sort()) if (!kinds.has(k)) fail('MANDATORY', `required evidence is missing: ${k}`);
+
+  // ---- COMPLETE
+  const healthEntry = [...byDigest.values()].find((e) => e.ref.kind === 'scan-health');
+  const c = pkg.completeness;
+  if (!isObj(c)) fail('COMPLETE', 'there is no completeness statement');
+  else if (healthEntry) {
+    const hs = healthEntry.payload && healthEntry.payload.status;
+    if (c.scanStatus !== hs) fail('COMPLETE', `the package states scan status ${JSON.stringify(c.scanStatus)} but the scan health says ${JSON.stringify(hs)}`);
+    if (c.verdict === 'complete' && hs !== 'complete') fail('COMPLETE', 'the package claims a complete scan over a scan health that is not complete');
+    if (c.verdict !== 'complete' && hs === 'complete') fail('COMPLETE', 'the package calls an unfinished scan complete or the reverse: the verdict disagrees with the scan health');
+    if (JSON.stringify(c.conditions) !== JSON.stringify(Array.isArray(healthEntry.payload.conditions) ? healthEntry.payload.conditions : [])) fail('COMPLETE', 'the stated conditions differ from the scan health\'s own');
+    if (c.source !== healthEntry.ref.digest) fail('COMPLETE', 'the completeness statement cites a different scan health');
+  }
+
+  // ---- FINDINGS
+  const findingEntries = [...byDigest.values()].filter((e) => e.ref.kind === 'finding');
+  const listed = new Map((Array.isArray(pkg.findings) ? pkg.findings : []).map((f) => [f.findingRef, f]));
+  if (listed.size !== findingEntries.length) fail('FINDINGS', `the package lists ${listed.size} findings but contains ${findingEntries.length}`);
+  for (const e of findingEntries) {
+    const f = listed.get(e.ref.digest);
+    if (!f) { fail('FINDINGS', `finding ${e.ref.payloadId} is in the package but not in its findings summary`); continue; }
+    const tier = e.payload && typeof e.payload.proofTier === 'string' ? e.payload.proofTier : 'unproven';
+    if (f.proofTier !== tier) fail('FINDINGS', `finding ${e.ref.payloadId}: the summary says proof tier ${JSON.stringify(f.proofTier)} but the finding says ${JSON.stringify(tier)}`);
+    if (f.exploitabilityProven !== (tier === 'execution-proven')) fail('FINDINGS', `finding ${e.ref.payloadId}: exploitability is stated as proven without an execution proof`);
+    if (f.integrity !== 'unmodified-since-signing') fail('FINDINGS', `finding ${e.ref.payloadId}: unexpected integrity statement`);
+  }
+
+  // ---- ASSERTIONS
+  for (const a of Array.isArray(pkg.assertions) ? pkg.assertions : []) {
+    for (const d of a.evidence || []) if (!byDigest.has(d)) fail('ASSERTIONS', `assertion ${a.id} cites a record that is not in the package`);
+    if (a.status === 'supported' && !(a.evidence || []).length) fail('ASSERTIONS', `assertion ${a.id} is "supported" but cites nothing`);
+    if (!['supported', 'unsupported', 'unknown'].includes(a.status)) fail('ASSERTIONS', `assertion ${a.id} has an unknown status`);
+  }
+  return { ok: errors.length === 0, errors, issuer: pkg.issuance && pkg.issuance.issuer, completeness: isObj(c) ? c.verdict : null };
+}
+
+
+
+/***/ })
+
+};