@clear-capabilities/agentic-security-scanner 0.172.0 → 0.173.0

package/dist/3075.index.js

@@ -0,0 +1,227 @@
+export const id = 3075;
+export const ids = [3075];
+export const modules = {
+
+/***/ 53075:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   computeDelta: () => (/* binding */ computeDelta),
+/* harmony export */   persistStatus: () => (/* binding */ persistStatus),
+/* harmony export */   renderStatusLine: () => (/* binding */ renderStatusLine),
+/* harmony export */   watchProject: () => (/* binding */ watchProject)
+/* harmony export */ });
+/* unused harmony exports readStatus, _internals */
+/* harmony import */ var node_fs_promises__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(51455);
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(73024);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(76760);
+/* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(69259);
+/* harmony import */ var _language_discovery_js__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(41928);
+// Watch mode — continuous incremental scan as the developer edits.
+//
+// Spawns a long-running scan watcher that:
+//   1. Subscribes to file-system events under the project root
+//   2. When a file matching the scan glob changes, re-scans incrementally
+//      using dataflow/incremental-cache.js (per-file cache hits avoid the
+//      full IR build)
+//   3. Diffs against the prior scan to compute a "risk delta" string
+//      (added/removed/changed criticals + highs)
+//   4. Writes the delta to .agentic-security/watch-status.{md,json}
+//
+// The Claude Code statusline / a chat command can poll watch-status.md
+// (cheap file read) to surface the delta inline without re-running anything.
+//
+// Implementation is deliberately node-only — no chokidar dep, uses
+// fs.promises.watch (Node ≥ 20). Debounces to 350ms.
+//
+// Lifecycle: start() returns an AbortController-like handle. The caller
+// (a /watch slash command or a long-running daemon spawn) is responsible
+// for keeping the process alive; this module is the pure logic.
+
+
+
+
+
+
+
+const STATUS_MD   = 'watch-status.md';
+const STATUS_JSON = 'watch-status.json';
+const DEBOUNCE_MS = 350;
+const MAX_BURST   = 50; // ignore beyond this # of rapid events
+
+const SCAN_EXT_RE = /\.(?:[jt]sx?|mjs|cjs|py|java|kt|go|rb|php|cs|c|cc|cpp|h|hpp|rs|sol|vy|swift|dart|toml|yml|yaml|json|tf|tfvars|bicep)$/i;
+const IGNORE_DIR_RE = /(?:^|\/)(?:\.git|node_modules|\.bench-cache|dist|build|\.next|coverage|\.agentic-security)(?:$|\/)/;
+
+function _isScanable(rel) {
+  if (!rel) return false;
+  // An explicit export is evidence even though it lives in a build directory.
+  if ((0,_language_discovery_js__WEBPACK_IMPORTED_MODULE_4__/* .isExplicitExport */ .Zh)(rel)) return true;
+  if (IGNORE_DIR_RE.test(rel)) return false;
+  if ((0,_language_discovery_js__WEBPACK_IMPORTED_MODULE_4__/* .isLanguageSource */ .Sv)(rel) || (0,_language_discovery_js__WEBPACK_IMPORTED_MODULE_4__/* .isLanguageManifest */ .mD)(rel)) return !(0,_language_discovery_js__WEBPACK_IMPORTED_MODULE_4__/* .isLanguageExcludedPath */ .EG)(rel);
+  return SCAN_EXT_RE.test(rel);
+}
+
+/**
+ * Widen a batch of changed absolute paths to every file whose results the
+ * change can stale: dependents through imports, and all Haskell/Nix sources for
+ * a manifest, lockfile or export change. Batches with no Haskell/Nix path are
+ * returned untouched, so other languages never pay for a tree read.
+ */
+async function expandChangedBatch(scanRoot, batch) {
+  const rels = batch.map((p) => node_path__WEBPACK_IMPORTED_MODULE_2__.relative(scanRoot, p).split(node_path__WEBPACK_IMPORTED_MODULE_2__.sep).join('/'));
+  if (!rels.some((r) => (0,_language_discovery_js__WEBPACK_IMPORTED_MODULE_4__/* .isLanguageSource */ .Sv)(r) || (0,_language_discovery_js__WEBPACK_IMPORTED_MODULE_4__/* .isLanguageManifest */ .mD)(r) || (0,_language_discovery_js__WEBPACK_IMPORTED_MODULE_4__/* .isExplicitExport */ .Zh)(r))) return batch;
+  try {
+    const { readTree } = await Promise.resolve(/* import() */).then(__webpack_require__.bind(__webpack_require__, 58307));
+    const { fileContents, depFileContents } = await readTree(scanRoot);
+    const hit = (0,_language_discovery_js__WEBPACK_IMPORTED_MODULE_4__/* .impactedFiles */ .nn)(fileContents, depFileContents, rels);
+    const out = new Set(batch);
+    for (const r of hit) out.add(node_path__WEBPACK_IMPORTED_MODULE_2__.join(scanRoot, r));
+    return [...out];
+  } catch {
+    return batch;
+  }
+}
+
+function _readJsonSafe(fp) {
+  try { return JSON.parse(fsSync.readFileSync(fp, 'utf8')); } catch { return null; }
+}
+
+function _sevRank(s) { return ['info', 'low', 'medium', 'high', 'critical'].indexOf(s) + 1; }
+
+/**
+ * Pure delta computation between two finding arrays. Same logic
+ * baseline-compare uses, surfaced as a single ASCII status line.
+ */
+function computeDelta(prevFindings, currFindings) {
+  const key = (f) => `${f.file || ''}::${f.line || 0}::${f.family || f.parser || ''}`;
+  const prev = new Map();
+  for (const f of prevFindings || []) prev.set(key(f), f);
+  const cur  = new Map();
+  for (const f of currFindings || []) cur.set(key(f), f);
+  const added = [], removed = [];
+  for (const [k, f] of cur) if (!prev.has(k)) added.push(f);
+  for (const [k, f] of prev) if (!cur.has(k)) removed.push(f);
+  const newCrit = added.filter(f => f.severity === 'critical').length;
+  const newHigh = added.filter(f => f.severity === 'high').length;
+  const fixedCrit = removed.filter(f => f.severity === 'critical').length;
+  const fixedHigh = removed.filter(f => f.severity === 'high').length;
+  return {
+    addedCount: added.length, removedCount: removed.length,
+    newCritical: newCrit, newHigh, fixedCritical: fixedCrit, fixedHigh,
+    added, removed,
+  };
+}
+
+/**
+ * Render a one-line status string for the Claude Code statusline.
+ */
+function renderStatusLine(delta) {
+  const parts = [];
+  if (delta.newCritical) parts.push(`🛑 +${delta.newCritical} crit`);
+  if (delta.newHigh)     parts.push(`⚠️  +${delta.newHigh} high`);
+  if (delta.fixedCritical) parts.push(`✅ -${delta.fixedCritical} crit`);
+  if (delta.fixedHigh)     parts.push(`✅ -${delta.fixedHigh} high`);
+  if (!parts.length && (delta.addedCount + delta.removedCount) === 0) return 'agentic-security: clean';
+  if (!parts.length) return `agentic-security: +${delta.addedCount} / -${delta.removedCount}`;
+  return 'agentic-security: ' + parts.join(' · ');
+}
+
+/**
+ * Persist watch-status.{md,json}. Cheap atomic write (write tmp, rename).
+ */
+function persistStatus(scanRoot, delta) {
+  const dir = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_3__/* .stateDir */ .Pn)(scanRoot);
+  if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_3__.stateWritesEnabled)()) return;
+  try { node_fs__WEBPACK_IMPORTED_MODULE_1__.mkdirSync(dir, { recursive: true }); } catch {}
+  const status = {
+    ts: new Date().toISOString(),
+    line: renderStatusLine(delta),
+    delta: {
+      addedCount: delta.addedCount, removedCount: delta.removedCount,
+      newCritical: delta.newCritical, newHigh: delta.newHigh,
+      fixedCritical: delta.fixedCritical, fixedHigh: delta.fixedHigh,
+    },
+    addedTop5: (delta.added || []).slice(0, 5).map(f => ({
+      file: f.file, line: f.line, family: f.family, severity: f.severity, vuln: f.vuln,
+    })),
+  };
+  const jsonPath = node_path__WEBPACK_IMPORTED_MODULE_2__.join(dir, STATUS_JSON);
+  const mdPath   = node_path__WEBPACK_IMPORTED_MODULE_2__.join(dir, STATUS_MD);
+  try { node_fs__WEBPACK_IMPORTED_MODULE_1__.writeFileSync(jsonPath, JSON.stringify(status, null, 2)); } catch {}
+  const md = [
+    `# Watch status — ${status.ts.slice(11, 19)} UTC`,
+    '',
+    status.line,
+    '',
+  ];
+  if (status.addedTop5.length) {
+    md.push('## New findings');
+    for (const f of status.addedTop5) {
+      md.push(`- **[${(f.severity || '?').toUpperCase()}]** ${f.vuln || f.family || 'finding'} — \`${f.file}:${f.line}\``);
+    }
+  }
+  try { node_fs__WEBPACK_IMPORTED_MODULE_1__.writeFileSync(mdPath, md.join('\n')); } catch {}
+  return status;
+}
+
+/**
+ * Read the latest watch-status (returns null if none).
+ */
+function readStatus(scanRoot) {
+  return _readJsonSafe(statePath(scanRoot, STATUS_JSON));
+}
+
+/**
+ * Subscribe to FS events and call onChange(absPath, eventType) for each
+ * matching event. Debounces bursts. Returns a controller with stop().
+ *
+ * The actual incremental scan call lives in the caller — this module
+ * stays pure for testability.
+ */
+async function watchProject(scanRoot, onChange, opts = {}) {
+  if (process.env.AGENTIC_SECURITY_NO_WATCH === '1') return { stop: async () => {}, _disabled: true };
+  const recursive = opts.recursive !== false;
+  const ac = new AbortController();
+  let timer = null;
+  const pending = new Set();
+  const flush = () => {
+    timer = null;
+    if (pending.size > MAX_BURST) { pending.clear(); return; }
+    const batch = Array.from(pending);
+    pending.clear();
+    const needsExpansion = batch.some((p) => {
+      const r = node_path__WEBPACK_IMPORTED_MODULE_2__.relative(scanRoot, p).split(node_path__WEBPACK_IMPORTED_MODULE_2__.sep).join('/');
+      return (0,_language_discovery_js__WEBPACK_IMPORTED_MODULE_4__/* .isLanguageSource */ .Sv)(r) || (0,_language_discovery_js__WEBPACK_IMPORTED_MODULE_4__/* .isLanguageManifest */ .mD)(r) || (0,_language_discovery_js__WEBPACK_IMPORTED_MODULE_4__/* .isExplicitExport */ .Zh)(r);
+    });
+    if (!needsExpansion) { try { onChange(batch); } catch {} return; }
+    expandChangedBatch(scanRoot, batch).then((b) => { try { onChange(b); } catch {} });
+  };
+  let stopped = false;
+  (async () => {
+    try {
+      for await (const evt of node_fs_promises__WEBPACK_IMPORTED_MODULE_0__.watch(scanRoot, { recursive, signal: ac.signal })) {
+        if (stopped) break;
+        const rel = String(evt.filename || '').replace(/\\/g, '/');
+        if (!_isScanable(rel)) continue;
+        pending.add(node_path__WEBPACK_IMPORTED_MODULE_2__.join(scanRoot, rel));
+        if (timer) clearTimeout(timer);
+        timer = setTimeout(flush, DEBOUNCE_MS);
+      }
+    } catch (e) {
+      if (e && e.name !== 'AbortError') {
+        // Surface but don't crash — caller decides how to handle.
+        try { onChange([], e); } catch {}
+      }
+    }
+  })();
+  return {
+    stop: async () => { stopped = true; ac.abort(); if (timer) clearTimeout(timer); },
+  };
+}
+
+const _internals = { _isScanable, expandChangedBatch, SCAN_EXT_RE, IGNORE_DIR_RE };
+
+
+/***/ })
+
+};

package/dist/3121.index.js

@@ -0,0 +1,297 @@
+export const id = 3121;
+export const ids = [3121];
+export const modules = {
+
+/***/ 83121:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+__webpack_require__.r(__webpack_exports__);
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   evaluateDriftPolicies: () => (/* binding */ evaluateDriftPolicies),
+/* harmony export */   loadDriftPolicies: () => (/* binding */ loadDriftPolicies)
+/* harmony export */ });
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(73024);
+// drift-policy.js — M4 deliverable #8, sub-project 8b, Task 2: a
+// before/after drift-policy DSL evaluated against a GraphDiff (Task 1's
+// own output, see graph-diff.js).
+//
+// Mirrors dataflow/privacy-sink-policy.js's fail-closed axis-matching
+// STYLE exactly — the `_matchesEnvironment`/`_matchesDestination`
+// precedent (an unset rule field is unconstrained; a set field the
+// current context has no comparable value for does NOT match) — never
+// its literal single-graph-state shape. That module evaluates a static
+// state ("is this (class, sink) pair permitted right now"); this module
+// evaluates a TRANSITION ("did this (class, sink) pair newly start
+// flowing, or did this flow's own verdict regress"), which is why its
+// rule shape is `{trigger, ...}`-keyed rather than `{allow: [...]}`.
+//
+// ── Design judgment calls made in this file (disclosed, not hidden) ──
+//
+// 1. `loadDriftPolicies(policyFilePath)` takes a literal file path, not
+//    a scanRoot — a deliberate, task-brief-directed divergence from
+//    `loadPrivacySinkPolicy(scanRoot)`'s own scanRoot-relative
+//    convention (`statePath(scanRoot, 'privacy-policy.json')`). Drift
+//    policies are a new artifact with no established scanRoot-relative
+//    home yet (Task 3's CLI wiring is the only real caller, and it can
+//    resolve whatever path convention it wants — e.g. a `--policy`
+//    flag, or a default under `.agentic-security/` — without this
+//    module forcing that choice). Keeping the signature a plain path
+//    keeps this module honest about being a pure evaluator with no
+//    opinion on where its config file lives.
+//
+// 2. The rule vocabulary generalizes `fromPolicyVerdict`/
+//    `toPolicyVerdict` to a second, structurally identical pair,
+//    `fromProtectionSummary`/`toProtectionSummary`, rather than adding a
+//    generic `field`/`from`/`to` triple. The task brief's own worked
+//    examples name `protectionSummary`'s "protected -> unknown/
+//    unprotected" transition as "an equivalent from/to pair for
+//    protectionSummary, generalizing" the policyVerdict pair — read
+//    literally, that is an instruction to add the SAME shape for a
+//    second watched field, not to invent a fully generic DSL over every
+//    WATCHED_FLOW_FIELDS entry. A generic `field`/`from`/`to` triple was
+//    considered and rejected: nothing in the brief's worked examples
+//    needs a THIRD field's transition, and a generic form would need its
+//    own validation against `WATCHED_FLOW_FIELDS` this task's tests
+//    don't exercise. Extending to a fully generic form remains easy
+//    later (both matchers already share one small helper,
+//    `_matchesVerdictTransition`) without a rule-shape migration for
+//    what's shipped today.
+//
+// 3. `dataClass`/`sinkCategory` are read as ADDITIONAL, optional
+//    constraints on a `changed_flow` rule too, not just `new_flow`
+//    rules — the brief's own rule shape lists them as top-level fields
+//    (not scoped textually to `new_flow` alone), and a changed flow's
+//    id is guaranteed present in `graphAfter` by construction (a
+//    `changed.flows` entry only exists when the SAME flow id survived
+//    into the after-graph — see graph-diff.js's own `computeGraphDiff`
+//    header), so the same `_resolveFlowContext` resolution that
+//    `new_flow` rules use applies unchanged. This lets an operator write
+//    "a PHI flow that regresses from protected" as one rule instead of
+//    two, and costs nothing when a rule doesn't set either field (both
+//    stay unconstrained, per the fail-closed style above).
+//
+// 4. A `changed_flow` rule that sets none of
+//    dataClass/sinkCategory/fromPolicyVerdict/toPolicyVerdict/
+//    fromProtectionSummary/toProtectionSummary matches EVERY
+//    `changed.flows` entry — every axis is independently unconstrained,
+//    so a rule with no axes set is the fully unconstrained case, exactly
+//    as an `allow` rule with neither `class` nor `sink` would be in
+//    `privacy-sink-policy.js` (it doesn't have that case in practice
+//    because `sink` is required there; this module has no required axis
+//    besides `trigger`, so the maximally-open rule is reachable and
+//    intentional — "alert on ANY change to a flow matching these
+//    constraints" is a real, useful policy shape).
+//
+// 5. The task brief's PRD-quoted worked examples also name "PII -> AI"
+//    ,"PCI -> log" (both plain `new_flow` shapes, already covered by
+//    dataClass/sinkCategory matching — no separate mechanism needed) and
+//    "new unresolved recipient" (a `governanceRefs.recipient`-shaped
+//    transition). The brief's own "Tests to write" section does not
+//    require a test for the recipient example, and it does not reduce
+//    cleanly to either matcher this task implements (a "new unresolved
+//    recipient" is a value becoming a specific sentinel, not a flow
+//    newly existing or an already-modeled verdict field transitioning)
+//    — left out rather than guessed at. Judgment call #2's rejected
+//    generic `field`/`from`/`to` form is the natural place to add it
+//    later, against a real governanceRefs.recipient fixture.
+//
+// 6. Fix round 1, Important 1 (see graph-diff.js's own judgment call #4):
+//    a `new_flow` rule must skip an added flow entry whose
+//    `causeClassification === 'reidentified'` — that flow isn't actually
+//    new, it's the SAME real-world (source, sink, dataElementIds) flow as
+//    a flow that existed before, just minted under a new flowId because
+//    the engine's own confidence/shape (evidenceGrade/transformationIds)
+//    changed. Firing `new_flow` on it would false-fire `--fail-on-drift`
+//    on a non-event, exactly what this fix round exists to close.
+
+
+
+const POLICY_TRIGGERS = Object.freeze(['new_flow', 'changed_flow']);
+
+function _isValidRuleShape(p) {
+  return !!p && typeof p === 'object' && !Array.isArray(p) && POLICY_TRIGGERS.includes(p.trigger);
+}
+
+/**
+ * Load an operator's drift-policy rules from a literal JSON file path
+ * (see judgment call #1 above — never a scanRoot). Never throws — a
+ * missing file (ENOENT) is "no policies configured," matching
+ * `loadPrivacySinkPolicy`'s own precedent; a malformed file logs a
+ * warning and degrades to no policies. Each entry is validated loosely:
+ * an entry that isn't a plain object with a recognized `trigger` is
+ * skipped (with a warning naming how many were dropped), never crashing
+ * the whole load over one bad rule.
+ */
+function loadDriftPolicies(policyFilePath) {
+  const EMPTY = { policies: [] };
+  if (!policyFilePath) return EMPTY;
+
+  let raw = null;
+  try {
+    raw = JSON.parse(node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(policyFilePath, 'utf8'));
+  } catch (e) {
+    if (e.code !== 'ENOENT') {
+      console.error(`agentic-security: bad JSON in drift policy file (${policyFilePath}) — falling back to no policies (${e.message})`);
+    }
+    return EMPTY;
+  }
+
+  if (!Array.isArray(raw?.policies)) {
+    console.error(`agentic-security: drift policy file ${policyFilePath} has no "policies" array — falling back to no policies (expected {"policies":[...]})`);
+  }
+  const rawPolicies = Array.isArray(raw?.policies) ? raw.policies : [];
+  const policies = rawPolicies.filter(_isValidRuleShape);
+  const skipped = rawPolicies.length - policies.length;
+  if (skipped > 0) {
+    console.error(`agentic-security: skipped ${skipped} malformed drift-policy rule(s) in ${policyFilePath} (each must be an object with trigger: 'new_flow' | 'changed_flow')`);
+  }
+  return { policies };
+}
+
+// Fail-closed, matching privacy-sink-policy.js's own
+// _matchesEnvironment/_matchesDestination precedent exactly: an unset
+// rule value is unconstrained (matches anything); a set rule value with
+// no comparable current value does NOT match.
+function _matchesDataClass(ruleDataClass, dataClasses) {
+  if (ruleDataClass == null) return true;
+  if (!Array.isArray(dataClasses) || !dataClasses.length) return false;
+  return dataClasses.includes(ruleDataClass);
+}
+
+function _matchesSinkCategory(ruleSinkCategory, sinkCategory) {
+  if (ruleSinkCategory == null) return true;
+  if (!sinkCategory) return false;
+  return ruleSinkCategory === sinkCategory;
+}
+
+// Matches a rule's {fromX, toX} pair against the {before, after} of the
+// changes[] entry for field X (or undefined, when that field didn't
+// change on this flow). Unset fromX/toX is unconstrained. A set fromX/
+// toX with no changes[] entry for that field at all (the flow changed,
+// but not on this axis) does NOT match — fails closed, same as an
+// environment-scoped rule against a caller who supplied no environment.
+function _matchesVerdictTransition(ruleFrom, ruleTo, changeEntry) {
+  if (ruleFrom == null && ruleTo == null) return true;
+  if (!changeEntry) return false;
+  if (ruleFrom != null && changeEntry.before !== ruleFrom) return false;
+  if (ruleTo != null && changeEntry.after !== ruleTo) return false;
+  return true;
+}
+
+// Resolves the real dataClasses/sinkCategory/sinkNode/flow for a flow id
+// against graphAfter — shared by both new_flow (added.flows entries) and
+// changed_flow (changed.flows entries) matching, since a changed.flows
+// entry's id is, by construction, present in graphAfter too (see
+// graph-diff.js's own computeGraphDiff: a changed entry only exists for
+// a flow id surviving into the after-graph). Returns null when the id
+// can't be resolved (should not happen for a well-formed GraphDiff
+// produced by computeGraphDiff against its own graphAfter, but a rule
+// must never crash the whole evaluation over a caller-supplied
+// diff/graph pairing that doesn't actually match).
+function _resolveFlowContext(flowId, graphAfter) {
+  const flow = (graphAfter?.flows ?? []).find((f) => f.id === flowId);
+  if (!flow) return null;
+
+  const dataClasses = [];
+  const seen = new Set();
+  for (const deId of flow.dataElementIds ?? []) {
+    const de = (graphAfter.dataElements ?? []).find((d) => d.id === deId);
+    if (!de) continue;
+    for (const cls of de.dataClasses ?? []) {
+      if (!seen.has(cls)) { seen.add(cls); dataClasses.push(cls); }
+    }
+  }
+  const dataElementNames = (flow.dataElementIds ?? [])
+    .map((id) => (graphAfter.dataElements ?? []).find((d) => d.id === id)?.name)
+    .filter((n) => typeof n === 'string' && n.length > 0);
+
+  const sinkNode = (graphAfter.nodes ?? []).find((n) => n.id === flow.sink) ?? null;
+  const sinkCategory = sinkNode?.subtype ?? sinkNode?.kind ?? null;
+
+  return { flow, dataClasses, dataElementNames, sinkNode, sinkCategory };
+}
+
+function _describeTransition(changeEntry) {
+  if (!changeEntry) return null;
+  return `${changeEntry.field} ${changeEntry.before} -> ${changeEntry.after}`;
+}
+
+function _buildViolation(rule, trigger, ctx, transitionDescriptions) {
+  const base = trigger === 'new_flow'
+    ? `New flow ${ctx.flow.id} (${ctx.dataClasses.join('/') || 'unclassified data'}) newly reaches sink ${ctx.sinkCategory ?? ctx.sinkNode?.id ?? 'unknown'}`
+    : `Flow ${ctx.flow.id} changed: ${transitionDescriptions.length ? transitionDescriptions.join(', ') : 'matched changed_flow rule (no policyVerdict/protectionSummary transition named by this rule)'}`;
+  const reason = rule.reason ? `${base} (${rule.reason})` : base;
+
+  return {
+    flowId: ctx.flow.id,
+    dataElementNames: ctx.dataElementNames,
+    sinkCategory: ctx.sinkCategory,
+    sinkNodeId: ctx.sinkNode?.id ?? ctx.flow.sink,
+    trigger,
+    rule,
+    reason,
+  };
+}
+
+/**
+ * Evaluates operator-configured drift policies against a GraphDiff.
+ * `policies` is `{policies: [...]}` (loadDriftPolicies' own return
+ * shape). `graphAfter` is the AFTER graph the diff was computed against
+ * — needed because an `added.flows`/`changed.flows` entry carries only
+ * `{id, causeClassification, ...}` (see graph-diff.js's own header),
+ * never dataElement/sink info directly.
+ *
+ * Returns `{violations: [...]}` — never a bare boolean per flow; every
+ * violation names the real triggering flow (id, data element names,
+ * sink), the rule that fired, and a human-readable `reason` string.
+ */
+function evaluateDriftPolicies(diff, policies, graphAfter) {
+  const violations = [];
+  const rules = Array.isArray(policies?.policies) ? policies.policies : [];
+  if (!rules.length) return { violations };
+
+  for (const rule of rules) {
+    if (rule.trigger === 'new_flow') {
+      for (const addedEntry of diff?.added?.flows ?? []) {
+        // See judgment call #6 above / graph-diff.js's own judgment call
+        // #4: a reidentified added flow is not actually new.
+        if (addedEntry.causeClassification === 'reidentified') continue;
+        const ctx = _resolveFlowContext(addedEntry.id, graphAfter);
+        if (!ctx) continue;
+        if (!_matchesDataClass(rule.dataClass, ctx.dataClasses)) continue;
+        if (!_matchesSinkCategory(rule.sinkCategory, ctx.sinkCategory)) continue;
+        violations.push(_buildViolation(rule, 'new_flow', ctx, []));
+      }
+    } else if (rule.trigger === 'changed_flow') {
+      for (const changedEntry of diff?.changed?.flows ?? []) {
+        const ctx = _resolveFlowContext(changedEntry.id, graphAfter);
+        if (!ctx) continue;
+        if (!_matchesDataClass(rule.dataClass, ctx.dataClasses)) continue;
+        if (!_matchesSinkCategory(rule.sinkCategory, ctx.sinkCategory)) continue;
+
+        const changes = Array.isArray(changedEntry.changes) ? changedEntry.changes : [];
+        const policyChange = changes.find((c) => c.field === 'policyVerdict');
+        if (!_matchesVerdictTransition(rule.fromPolicyVerdict, rule.toPolicyVerdict, policyChange)) continue;
+
+        const protectionChange = changes.find((c) => c.field === 'protectionSummary');
+        if (!_matchesVerdictTransition(rule.fromProtectionSummary, rule.toProtectionSummary, protectionChange)) continue;
+
+        const transitionDescriptions = [policyChange, protectionChange].map(_describeTransition).filter(Boolean);
+        violations.push(_buildViolation(rule, 'changed_flow', ctx, transitionDescriptions));
+      }
+    }
+    // An unrecognized trigger was already filtered out by
+    // loadDriftPolicies' own _isValidRuleShape when loaded from disk; a
+    // directly hand-built `policies` object (as tests do) with an
+    // unrecognized trigger simply matches nothing, silently — the same
+    // "match nothing rather than throw" discipline as every other
+    // unresolvable axis in this file.
+  }
+
+  return { violations };
+}
+
+
+/***/ })
+
+};