@clear-capabilities/agentic-security-scanner 0.172.0 → 0.173.0

package/dist/4740.index.js

@@ -0,0 +1,165 @@
+export const id = 4740;
+export const ids = [4740];
+export const modules = {
+
+/***/ 4740:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   PROVENANCE_BUNDLE_SCHEMA: () => (/* binding */ PROVENANCE_BUNDLE_SCHEMA),
+/* harmony export */   buildProvenanceEvidenceBundle: () => (/* binding */ buildProvenanceEvidenceBundle),
+/* harmony export */   ensureKeyPair: () => (/* reexport safe */ _evidence_bundle_js__WEBPACK_IMPORTED_MODULE_1__.ensureKeyPair),
+/* harmony export */   signProvenanceEvidenceBundle: () => (/* binding */ signProvenanceEvidenceBundle),
+/* harmony export */   verifyProvenanceEvidenceBundle: () => (/* binding */ verifyProvenanceEvidenceBundle)
+/* harmony export */ });
+/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(77598);
+/* harmony import */ var _evidence_bundle_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(32876);
+// Signed provenance evidence bundles (Finding Provenance PRD, M4 §4.1).
+//
+// Sibling to posture/evidence-bundle.js, not a generalization of it — that
+// module's bundle shape (proofTier, taintPath, exploitability...) answers
+// "is this finding real"; this one answers "who/when introduced it, how
+// sure are we." Forcing one shape to cover both would leave half of every
+// bundle null. Same four-function pattern (build/sign/verify + a schema
+// string + a top-level-key allowlist), same Ed25519 key material — reused,
+// not reimplemented.
+//
+// The allowlisted fields mirror provenance/coordinator.js's own
+// computeDigest() material EXACTLY (stableId, findingOrigin.commit,
+// branchIntroduction.commit, evidenceAttribution role:path:line:commit
+// strings, method, confidence.reasons, limitations) plus repo/HEAD identity
+// (not in computeDigest's material, since that digest never leaves the repo
+// it was computed in, but a bundle does). Everything here is copied from
+// what findingProvenance already computed. Nothing is inferred.
+//
+// canonicalJson vs canonicalBytes — resolved before writing this file
+// -------------------------------------------------------------------
+// evidence-bundle.js exports TWO canonicalisation helpers, not one, and they
+// are not interchangeable. `canonicalJson(value)` is a pure, shape-agnostic
+// deterministic serialiser (sorted keys at every level, order-preserving
+// arrays) — safe to reuse for any bundle shape. `canonicalBytes(bundle)`
+// is NOT generic: it hardcodes evidence-bundle.js's own six top-level keys
+// (`schema, finding, evidence, engine, proves, doesNotProve`) when building
+// the object it signs. Reusing `canonicalBytes` here would silently sign a
+// filtered object missing this module's `repo` and `provenance` fields
+// (and would read `bundle.evidence`, which a provenance bundle never has) —
+// exactly the EA-03 failure mode the allowlist check below exists to catch,
+// just introduced from the signing side instead of the verifying side. So
+// this module imports the generic `canonicalJson` (as the brief's Step 1
+// sketch already did) and signs `canonicalJson(bundle)` directly, since
+// `buildProvenanceEvidenceBundle` never puts anything on the unsigned
+// object beyond this module's own allowlisted fields.
+
+
+
+
+const PROVENANCE_BUNDLE_SCHEMA = 'agentic-security/provenance-evidence@1';
+
+const PROVES = 'This bundle\'s contents are exactly what was signed at attestation time.';
+const DOES_NOT_PROVE = 'This bundle does NOT prove the origin commit is correctly identified — read confidence.level and limitations for that. It proves the RECORD is unmodified, not that the record is right.';
+
+/**
+ * Build an unsigned provenance bundle from one finding's findingProvenance.
+ * Returns null for a finding with no findingProvenance at all (nothing to
+ * attest) — this is a caller error (attest a scan before its provenance
+ * pass ran), not a case to paper over with an empty bundle.
+ */
+function buildProvenanceEvidenceBundle(finding, { engineVersion, repoIdentity, head } = {}) {
+  if (!finding || typeof finding !== 'object') return null;
+  const fp = finding.findingProvenance;
+  if (!fp || typeof fp !== 'object') return null;
+  return {
+    schema: PROVENANCE_BUNDLE_SCHEMA,
+    finding: {
+      id: finding.id ?? null,
+      stableId: finding.stableId ?? null,
+    },
+    repo: {
+      identity: repoIdentity ?? null,
+      head: head ?? fp.analysisBasis?.head ?? null,
+    },
+    provenance: {
+      status: fp.status ?? null,
+      findingOrigin: fp.findingOrigin
+        ? {
+            commit: fp.findingOrigin.commit ?? null,
+            authorName: fp.findingOrigin.authorName ?? null,
+            authorDate: fp.findingOrigin.authorDate ?? null,
+            summary: fp.findingOrigin.summary ?? null,
+          }
+        : null,
+      branchIntroduction: fp.branchIntroduction
+        ? { commit: fp.branchIntroduction.commit ?? null, branch: fp.branchIntroduction.branch ?? null }
+        : null,
+      evidenceAttribution: (fp.evidenceAttribution || []).map((n) => ({
+        role: n.role ?? null, path: n.path ?? null, line: n.line ?? null, commit: n.commit ?? null,
+      })),
+      method: fp.method ?? null,
+      confidence: fp.confidence
+        ? { level: fp.confidence.level ?? null, score: fp.confidence.score ?? null, reasons: fp.confidence.reasons || [] }
+        : null,
+      limitations: fp.limitations || [],
+      // M4 §4.2 final-review fix: this module was written (Task 1) before
+      // the cross-repo lineage feature existed (Task 5), so a
+      // cross-repo-resolved origin's boundary-crossing marker was dropped
+      // from the signed bundle — a foreign repository's commit SHA and a
+      // real author name, with no MACHINE-READABLE signal that the origin
+      // crossed a repository boundary (only the prose in `limitations`
+      // said so, and a programmatic verifier does not read prose). Nested
+      // under `provenance` alongside the fields above, so it is part of
+      // what gets signed — never a new top-level key.
+      historyCoverage: { crossRepoLineage: fp.historyCoverage?.crossRepoLineage ?? false },
+    },
+    engine: { engineVersion: engineVersion ?? null },
+    proves: PROVES,
+    doesNotProve: DOES_NOT_PROVE,
+  };
+}
+
+function signProvenanceEvidenceBundle(bundle, privateKeyPem) {
+  const sig = node_crypto__WEBPACK_IMPORTED_MODULE_0__.sign(null, Buffer.from((0,_evidence_bundle_js__WEBPACK_IMPORTED_MODULE_1__/* .canonicalJson */ .dj)(bundle), 'utf8'), privateKeyPem);
+  return {
+    ...bundle,
+    signature: { algorithm: 'ed25519', canonicalisation: PROVENANCE_BUNDLE_SCHEMA, value: sig.toString('base64') },
+  };
+}
+
+const PROVENANCE_BUNDLE_TOP_LEVEL_KEYS = new Set([
+  'schema', 'finding', 'repo', 'provenance', 'engine', 'proves', 'doesNotProve', 'signature',
+]);
+
+/**
+ * Verify with a PUBLIC key only. Rejects any top-level key outside the
+ * allowlist BEFORE checking the signature — same EA-03 fix evidence-bundle.js
+ * carries: a signature only covers the bytes it was computed over, so an
+ * unknown key stapled on after signing would otherwise verify as authentic.
+ */
+function verifyProvenanceEvidenceBundle(bundle, publicKeyPem) {
+  if (!bundle || typeof bundle !== 'object') return { ok: false, reason: 'bundle is not an object' };
+  if (bundle.schema !== PROVENANCE_BUNDLE_SCHEMA) return { ok: false, reason: `unrecognised schema: ${bundle.schema}` };
+  const unknownKeys = Object.keys(bundle).filter((k) => !PROVENANCE_BUNDLE_TOP_LEVEL_KEYS.has(k));
+  if (unknownKeys.length) {
+    return { ok: false, reason: `unrecognised top-level key(s) not covered by the signature: ${unknownKeys.join(', ')}` };
+  }
+  const sig = bundle.signature;
+  if (!sig?.value) return { ok: false, reason: 'bundle is unsigned' };
+  if (sig.algorithm !== 'ed25519') return { ok: false, reason: `unsupported algorithm: ${sig.algorithm}` };
+  if (!publicKeyPem) return { ok: false, reason: 'no public key supplied' };
+  const { signature, ...unsigned } = bundle;
+  let ok = false;
+  try {
+    ok = node_crypto__WEBPACK_IMPORTED_MODULE_0__.verify(null, Buffer.from((0,_evidence_bundle_js__WEBPACK_IMPORTED_MODULE_1__/* .canonicalJson */ .dj)(unsigned), 'utf8'), publicKeyPem, Buffer.from(sig.value, 'base64'));
+  } catch (e) {
+    return { ok: false, reason: `verification error: ${e.message}` };
+  }
+  return ok
+    ? { ok: true, reason: null }
+    : { ok: false, reason: 'signature does not match the bundle contents — it was modified after signing' };
+}
+
+
+
+
+/***/ })
+
+};

package/dist/4780.index.js

@@ -0,0 +1,209 @@
+export const id = 4780;
+export const ids = [4780];
+export const modules = {
+
+/***/ 44780:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   iI: () => (/* binding */ summarizeForBadge),
+/* harmony export */   renderBadge: () => (/* binding */ renderBadge)
+/* harmony export */ });
+/* unused harmony exports badgeFromScanRoot, renderSvg, _internal */
+/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(73024);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(76760);
+/* harmony import */ var _posture_state_dir_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(69259);
+// Live SVG badge generator (v0.72).
+//
+// Every repo can drop a badge in its README pulling from the latest scan:
+//
+//   ![agentic-security](https://agentic-security.dev/badge?repo=<slug>)
+//
+// or self-hosted via the CLI subcommand emitting an inline <img> URL or
+// a static SVG. The badge format borrows from shields.io for visual
+// consistency. Reads from .agentic-security/last-scan.json or accepts a
+// scan object directly.
+//
+// Output formats:
+//   - 'svg'  — inline SVG string (default; the bytes you'd serve)
+//   - 'json' — { label, count, color, severity } for a frontend renderer
+//
+// Style variants:
+//   - 'flat'         — shields.io flat
+//   - 'for-the-badge' — caps + thicker
+//
+// Color is driven by the highest non-zero severity:
+//   critical → red
+//   high     → orange
+//   medium   → yellow
+//   low      → blue
+//   info     → lightgrey
+//   none     → brightgreen
+
+
+
+
+
+const COLORS = {
+  critical:    '#e05d44',  // red
+  high:        '#fe7d37',  // orange
+  medium:      '#dfb317',  // yellow
+  low:         '#007ec6',  // blue
+  info:        '#9f9f9f',  // grey
+  none:        '#4c1',     // brightgreen
+  label:       '#555',
+};
+
+const SEVERITIES = ['critical', 'high', 'medium', 'low', 'info'];
+
+function _readLastScan(scanRoot) {
+  if (!scanRoot) return null;
+  const fp = (0,_posture_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.statePath)(scanRoot, 'last-scan.json');
+  if (!node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(fp)) return null;
+  try { return JSON.parse(node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(fp, 'utf8')); }
+  catch { return null; }
+}
+
+function _ageString(ts) {
+  if (!ts) return null;
+  const ageMs = Date.now() - new Date(ts).getTime();
+  if (isNaN(ageMs) || ageMs < 0) return null;
+  const min = Math.floor(ageMs / 60_000);
+  if (min < 60) return `${min}m ago`;
+  const hr = Math.floor(min / 60);
+  if (hr < 24) return `${hr}h ago`;
+  const day = Math.floor(hr / 24);
+  return `${day}d ago`;
+}
+
+/**
+ * Compute the badge value from a scan object.
+ *
+ * Returns:
+ *   {
+ *     label:    'agentic-security',
+ *     summary:  'critical 0 · high 2 · medium 5' | 'passing' | 'no scan',
+ *     color:    '#fe7d37',
+ *     highest:  'high' | 'none' | 'unknown',
+ *     ageStr:   '4h ago' | null,
+ *     counts:   { critical, high, medium, low, info },
+ *     total:    7,
+ *   }
+ */
+function summarizeForBadge(scan) {
+  if (!scan || !Array.isArray(scan.findings)) {
+    return {
+      label: 'agentic-security',
+      summary: 'no scan',
+      color: COLORS.info,
+      highest: 'unknown',
+      ageStr: null,
+      counts: { critical: 0, high: 0, medium: 0, low: 0, info: 0 },
+      total: 0,
+    };
+  }
+  const counts = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
+  for (const f of scan.findings) {
+    const s = f.severity || 'info';
+    if (counts[s] !== undefined) counts[s]++;
+  }
+  let highest = 'none';
+  for (const s of SEVERITIES) { if (counts[s] > 0) { highest = s; break; } }
+  const color = COLORS[highest] || COLORS.info;
+  const summary = highest === 'none'
+    ? 'passing'
+    : `crit ${counts.critical} · high ${counts.high} · med ${counts.medium}`;
+  const total = SEVERITIES.reduce((a, s) => a + counts[s], 0);
+  return {
+    label: 'agentic-security',
+    summary,
+    color,
+    highest,
+    ageStr: _ageString(scan.timestamp || scan.when || scan.lastScan),
+    counts,
+    total,
+  };
+}
+
+/**
+ * Compute the badge from .agentic-security/last-scan.json under `scanRoot`.
+ */
+function badgeFromScanRoot(scanRoot) {
+  return summarizeForBadge(_readLastScan(scanRoot));
+}
+
+function _xmlEscape(s) {
+  return String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+}
+
+function _textWidth(s) {
+  // Rough character width — works fine for the small badge label range.
+  return s.length * 7 + 10;
+}
+
+/**
+ * Render an inline SVG matching shields.io's flat style. Self-contained
+ * (no external font references) so the badge works in any README.
+ */
+function renderSvg(b, opts = {}) {
+  if (!b) b = summarizeForBadge(null);
+  const style = opts.style || 'flat';
+  const labelText = b.label;
+  const valueText = b.ageStr ? `${b.summary} · ${b.ageStr}` : b.summary;
+  const lblW = _textWidth(labelText);
+  const valW = _textWidth(valueText);
+  const totalW = lblW + valW;
+  const h = style === 'for-the-badge' ? 28 : 20;
+  const fontSize = style === 'for-the-badge' ? 12 : 11;
+  return `<svg xmlns="http://www.w3.org/2000/svg" width="${totalW}" height="${h}" role="img" aria-label="${_xmlEscape(labelText)}: ${_xmlEscape(valueText)}">
+  <title>${_xmlEscape(labelText)}: ${_xmlEscape(valueText)}</title>
+  <linearGradient id="s" x2="0" y2="100%">
+    <stop offset="0" stop-color="#bbb" stop-opacity=".1"/>
+    <stop offset="1" stop-opacity=".1"/>
+  </linearGradient>
+  <clipPath id="r"><rect width="${totalW}" height="${h}" rx="3" fill="#fff"/></clipPath>
+  <g clip-path="url(#r)">
+    <rect width="${lblW}" height="${h}" fill="${COLORS.label}"/>
+    <rect x="${lblW}" width="${valW}" height="${h}" fill="${b.color}"/>
+    <rect width="${totalW}" height="${h}" fill="url(#s)"/>
+  </g>
+  <g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" font-size="${fontSize}">
+    <text aria-hidden="true" x="${lblW / 2}" y="${h - 6}" fill="#010101" fill-opacity=".3">${_xmlEscape(labelText)}</text>
+    <text x="${lblW / 2}" y="${h - 7}">${_xmlEscape(labelText)}</text>
+    <text aria-hidden="true" x="${lblW + valW / 2}" y="${h - 6}" fill="#010101" fill-opacity=".3">${_xmlEscape(valueText)}</text>
+    <text x="${lblW + valW / 2}" y="${h - 7}">${_xmlEscape(valueText)}</text>
+  </g>
+</svg>`;
+}
+
+/**
+ * Public entry: produce the badge in the requested format.
+ *
+ *   format: 'svg' (default) | 'json'
+ *   style:  'flat' (default) | 'for-the-badge'
+ *   scanRoot: directory containing .agentic-security/last-scan.json
+ *   scan: pre-loaded scan object (skips disk read)
+ */
+function renderBadge({ format = 'svg', style = 'flat', scanRoot, scan } = {}) {
+  const summary = summarizeForBadge(scan || _readLastScan(scanRoot));
+  if (format === 'json') {
+    return JSON.stringify({
+      schemaVersion: 1,
+      label: summary.label,
+      message: summary.summary,
+      color: summary.color,
+      highest: summary.highest,
+      ageStr: summary.ageStr,
+      counts: summary.counts,
+      total: summary.total,
+    });
+  }
+  return renderSvg(summary, { style });
+}
+
+const _internal = { COLORS, _ageString, _readLastScan };
+
+
+/***/ })
+
+};

package/dist/4802.index.js

@@ -0,0 +1,225 @@
+export const id = 4802;
+export const ids = [4802];
+export const modules = {
+
+/***/ 94802:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   OBLIGATION_EVIDENCE_PACK_SCHEMA: () => (/* binding */ OBLIGATION_EVIDENCE_PACK_SCHEMA),
+/* harmony export */   buildObligationEvidencePack: () => (/* binding */ buildObligationEvidencePack),
+/* harmony export */   ensureKeyPair: () => (/* reexport safe */ _evidence_bundle_js__WEBPACK_IMPORTED_MODULE_0__.ensureKeyPair),
+/* harmony export */   signObligationEvidencePack: () => (/* binding */ signObligationEvidencePack),
+/* harmony export */   verifyObligationEvidencePack: () => (/* binding */ verifyObligationEvidencePack)
+/* harmony export */ });
+/* harmony import */ var _evidence_bundle_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(32876);
+/* harmony import */ var _evidence_grade_wording_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(51128);
+/* harmony import */ var _lineage_export_json_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(63406);
+/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(77598);
+// obligation-evidence-pack.js — Milestone 4 sub-project 6c: signed,
+// versioned evidence packs for a Regulatory Obligation Overlay framework
+// evaluation (FR-504, PRD §10.10). Fourth sibling in the
+// evidence-bundle.js family — see that module's own header for the
+// shared-key rationale, and provenance-evidence-bundle.js for the most
+// directly mirrored precedent (same reused ensureKeyPair/keyPaths/
+// canonicalJson, own schema string, own build/sign/verify trio, own
+// top-level-key allowlist).
+//
+// WHAT THIS IS NOT
+// -----------------
+// Not a reuse of evidence-bundle.js's own bundle shape (that's a single
+// FINDING's evidence — proofTier/taintPath/etc; this artifact has no
+// finding at all). Not compliance-evidence-signing.js's ComplianceEvidence
+// manifest either — that signs the pre-existing family:/module:/rule:-
+// driven present/partial/absent/manual walkthrough status; this signs the
+// newer, additive graph: mapping type's own real ObligationMapping
+// records (evaluateGraphFlowPredicate/buildObligationMappingFromGraphPredicate,
+// sub-project 6b) — a distinct FR-504 artifact with its own field list
+// (scope, framework versions, facts, evidence index, unknown/manual
+// items, accepted exceptions, scan health, limitations, graph digest,
+// reproducibility metadata).
+//
+// THE EVIDENCE-INDEX DESIGN DECISION (see the scoping doc for the full
+// writeup)
+// -----------------------------------------------------------------
+// A real ObligationMapping record's own `evidence[]` is structurally
+// always empty today (graph-builder.js hardcodes `edge.evidenceRefs: []`
+// on every minted edge, disclosed in obligation-predicates.js's own
+// header). Rather than ship an evidence pack whose "evidence index" is
+// honestly, permanently empty, this module builds a REAL evidence index
+// from each fact's own `contributingGraphIds` (real flow ids
+// evaluateGraphFlowPredicate already returns) — resolving each flow id
+// back into a small, real summary (source/sink kind, dataElement
+// dataClasses, the edge's own transit/atRest/handling verdicts) by
+// joining against the graph's own entity arrays. `record.evidence` is
+// still carried through verbatim on each fact (honest, even though
+// empty) — the evidence index is an ADDITIONAL section built from data
+// that genuinely IS populated, not a replacement that hides the gap.
+
+
+
+
+
+
+const OBLIGATION_EVIDENCE_PACK_SCHEMA = 'agentic-security/obligation-evidence-pack@1';
+
+function _asArray(v) {
+  return Array.isArray(v) ? v : [];
+}
+
+/**
+ * Resolve one ObligationMapping fact's contributingGraphIds (real flow
+ * ids) into a small, real, human-and-machine-readable summary per flow —
+ * the evidence index's own per-fact contribution. Never throws: a flow id
+ * that no longer resolves against this graph (a stale pack re-evaluated
+ * against a newer graph, or a malformed fact) is simply skipped, not
+ * fabricated.
+ */
+function _resolveEvidenceForFact(fact, joins) {
+  const { flowsById, nodesById, edgesById, dataElementsById } = joins;
+  const flowIds = _asArray(fact?.contributingGraphIds);
+  const resolved = [];
+  for (const flowId of flowIds) {
+    const flow = flowsById.get(flowId);
+    if (!flow) continue;
+    const sourceNode = nodesById.get(flow.source);
+    const sinkNode = nodesById.get(flow.sink);
+    // Reads only edgeIds[0] — mirrors obligation-predicates.js's own
+    // disclosed, currently-unreachable limitation (graph-builder.js always
+    // mints single-edge flows; see that module's own header) rather than
+    // inventing a different convention for the same case here.
+    const edge = edgesById.get(_asArray(flow.edgeIds)[0]);
+    const dataClasses = _asArray(flow.dataElementIds)
+      .map((id) => dataElementsById.get(id))
+      .filter(Boolean)
+      .flatMap((d) => _asArray(d.dataClasses));
+    resolved.push({
+      flowId,
+      source: sourceNode ? { kind: sourceNode.kind ?? null, subtype: sourceNode.subtype ?? null } : null,
+      sink: sinkNode ? { kind: sinkNode.kind ?? null, subtype: sinkNode.subtype ?? null } : null,
+      dataClasses: [...new Set(dataClasses)],
+      transitVerdict: edge?.protection?.transit?.verdict ?? null,
+      atRestVerdict: edge?.protection?.atRest?.verdict ?? null,
+      handlingVerdict: edge?.protection?.handling?.verdict ?? null,
+    });
+  }
+  return resolved;
+}
+
+function _buildJoins(graph) {
+  return {
+    flowsById: new Map(_asArray(graph?.flows).filter(Boolean).map((f) => [f.id, f])),
+    nodesById: new Map(_asArray(graph?.nodes).filter(Boolean).map((n) => [n.id, n])),
+    edgesById: new Map(_asArray(graph?.edges).filter(Boolean).map((e) => [e.id, e])),
+    dataElementsById: new Map(_asArray(graph?.dataElements).filter(Boolean).map((d) => [d.id, d])),
+  };
+}
+
+/**
+ * Build an unsigned evidence pack from a framework evaluation. Never
+ * throws: every field degrades honestly on missing input rather than
+ * fabricating a value — a null/absent graph yields empty facts/
+ * evidenceIndex and a null graphDigest/scope, never a guess.
+ *
+ * @param {object} args
+ * @param {object|null} args.graph - the scan's DataFlowGraph v1 document (scan.lineageGraph), or null
+ * @param {object} args.framework - the loaded framework object (auditor-walkthrough.js#loadFramework's return)
+ * @param {Array}  args.evaluation - auditor-walkthrough.js#evaluateFramework's return (per-control entries, each carrying .obligationMappings)
+ * @param {object|null} [args.scanHealth] - scan.scanHealth, passed through verbatim; null if not supplied, never fabricated
+ * @param {string|null} [args.engineVersion]
+ * @param {string|null} [args.rulesetVersion]
+ * @param {string|null} [args.bundleSha]
+ * @param {string} [args.generatedAt] - defaults to new Date().toISOString()
+ */
+function buildObligationEvidencePack({
+  graph, framework, evaluation, scanHealth, engineVersion, rulesetVersion, bundleSha, generatedAt,
+} = {}) {
+  const facts = _asArray(evaluation).flatMap((e) => _asArray(e?.obligationMappings));
+  const joins = _buildJoins(graph);
+  const evidenceIndex = facts.map((fact) => ({
+    obligationId: fact?.id ?? null,
+    requirementId: fact?.requirementId ?? null,
+    evidence: _resolveEvidenceForFact(fact, joins),
+  }));
+
+  return {
+    schema: OBLIGATION_EVIDENCE_PACK_SCHEMA,
+    framework: {
+      id: framework?.id ?? null,
+      name: framework?.name ?? null,
+      version: framework?.controlsDigest ?? null,
+      publisher: framework?.publisher ?? null,
+      url: framework?.url ?? null,
+    },
+    scope: graph?.scope ?? null,
+    facts,
+    evidenceIndex,
+    unknownItems: facts.filter((f) => f?.state === 'unknown'),
+    manualItems: facts.filter((f) => f?.state === 'manual_required'),
+    acceptedExceptions: facts.filter((f) => f?.state === 'accepted_exception'),
+    scanHealth: scanHealth ?? null,
+    limitations: _asArray(graph?.limitations),
+    graphDigest: graph ? (0,_lineage_export_json_js__WEBPACK_IMPORTED_MODULE_2__.computeGraphDigest)(graph) : null,
+    reproducibility: {
+      graphId: graph?.graphId ?? null,
+      graphDigest: graph ? (0,_lineage_export_json_js__WEBPACK_IMPORTED_MODULE_2__.computeGraphDigest)(graph) : null,
+      engineVersion: engineVersion ?? null,
+      rulesetVersion: rulesetVersion ?? null,
+      bundleSha: bundleSha ?? null,
+      generatedAt: generatedAt ?? new Date().toISOString(),
+    },
+    disclaimer: _evidence_grade_wording_js__WEBPACK_IMPORTED_MODULE_1__/* .EVIDENCE_GRADE_DISCLAIMER */ .ux,
+  };
+}
+
+/** Sign a pack. Returns a new object; the input is not mutated. */
+function signObligationEvidencePack(pack, privateKeyPem) {
+  const sig = node_crypto__WEBPACK_IMPORTED_MODULE_3__.sign(null, Buffer.from((0,_evidence_bundle_js__WEBPACK_IMPORTED_MODULE_0__/* .canonicalJson */ .dj)(pack), 'utf8'), privateKeyPem);
+  return {
+    ...pack,
+    signature: { algorithm: 'ed25519', canonicalisation: OBLIGATION_EVIDENCE_PACK_SCHEMA, value: sig.toString('base64') },
+  };
+}
+
+const OBLIGATION_EVIDENCE_PACK_TOP_LEVEL_KEYS = new Set([
+  'schema', 'framework', 'scope', 'facts', 'evidenceIndex', 'unknownItems',
+  'manualItems', 'acceptedExceptions', 'scanHealth', 'limitations',
+  'graphDigest', 'reproducibility', 'disclaimer', 'signature',
+]);
+
+/**
+ * Verify with a PUBLIC key only. Rejects any top-level key outside the
+ * allowlist BEFORE checking the signature — same EA-03 discipline every
+ * sibling in this family carries: a signature only covers the bytes it
+ * was computed over, so a key stapled on after signing would otherwise
+ * verify as authentic.
+ */
+function verifyObligationEvidencePack(pack, publicKeyPem) {
+  if (!pack || typeof pack !== 'object') return { ok: false, reason: 'pack is not an object' };
+  if (pack.schema !== OBLIGATION_EVIDENCE_PACK_SCHEMA) return { ok: false, reason: `unrecognised schema: ${pack.schema}` };
+  const unknownKeys = Object.keys(pack).filter((k) => !OBLIGATION_EVIDENCE_PACK_TOP_LEVEL_KEYS.has(k));
+  if (unknownKeys.length) {
+    return { ok: false, reason: `unrecognised top-level key(s) not covered by the signature: ${unknownKeys.join(', ')}` };
+  }
+  const sig = pack.signature;
+  if (!sig?.value) return { ok: false, reason: 'pack is unsigned' };
+  if (sig.algorithm !== 'ed25519') return { ok: false, reason: `unsupported algorithm: ${sig.algorithm}` };
+  if (!publicKeyPem) return { ok: false, reason: 'no public key supplied' };
+  const { signature, ...unsigned } = pack;
+  let ok = false;
+  try {
+    ok = node_crypto__WEBPACK_IMPORTED_MODULE_3__.verify(null, Buffer.from((0,_evidence_bundle_js__WEBPACK_IMPORTED_MODULE_0__/* .canonicalJson */ .dj)(unsigned), 'utf8'), publicKeyPem, Buffer.from(sig.value, 'base64'));
+  } catch (e) {
+    return { ok: false, reason: `verification error: ${e.message}` };
+  }
+  return ok
+    ? { ok: true, reason: null }
+    : { ok: false, reason: 'signature does not match the pack contents — it was modified after signing' };
+}
+
+
+
+
+/***/ })
+
+};