@clear-capabilities/agentic-security-scanner 0.172.1 → 0.174.0

package/dist/8126.index.js

@@ -0,0 +1,191 @@
+export const id = 8126;
+export const ids = [8126];
+export const modules = {
+
+/***/ 18126:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   createCascadePool: () => (/* binding */ createCascadePool)
+/* harmony export */ });
+/* unused harmony export DEFAULT_GRACE_MS */
+/* harmony import */ var node_worker_threads__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(75919);
+/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(76760);
+/* harmony import */ var node_url__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(73136);
+// FR-202 phase 3b (D-0050): a pool of long-lived workers, each running engine.js's
+// _runFileCascade for many files over its lifetime, instead of the one-shot-per-call
+// model runWithDeadline/analyzer-supervisor.js uses (which is correct for FR-202's
+// primitive-level proof but would force whole-project setup — _buildProjectIndex,
+// _buildGlobalJavaTaintedMethodIndex, _loadCustomRules — to redo per FILE, an O(n^2)
+// cost across a scan). Each worker performs that setup ONCE at creation via
+// _initCascadeWorkerState, then answers task messages over its lifetime.
+//
+// A task that exceeds its deadline+grace gets its OWN worker terminated (genuinely
+// preemptive, mirroring analyzer-supervisor.js's worker.terminate() precedent) and a
+// fresh replacement worker is spawned to keep the pool at full size for later files —
+// one hung file costs one worker restart, not the whole scan.
+
+
+
+
+// `new Worker()` needs a REAL file on disk -- once ncc bundles this module's code
+// into a dist/ chunk, `import.meta.url` resolves to that chunk's location (dist/),
+// not to src/pipeline/, so a naive path.join(HERE, 'cascade-worker.js') would look
+// for a file that was never copied there. src/ always ships as a sibling of dist/
+// (see package.json's "files"), in both a dev checkout and the published npm
+// package, so fall back to the real, unbundled worker script in that case.
+function _resolveDefaultWorkerScript() {
+  const hereDir = node_path__WEBPACK_IMPORTED_MODULE_1__.dirname((0,node_url__WEBPACK_IMPORTED_MODULE_2__.fileURLToPath)(import.meta.url));
+  if (node_path__WEBPACK_IMPORTED_MODULE_1__.basename(hereDir) === 'pipeline') return node_path__WEBPACK_IMPORTED_MODULE_1__.join(hereDir, 'cascade-worker.js');
+  return node_path__WEBPACK_IMPORTED_MODULE_1__.join(hereDir, '..', 'src', 'pipeline', 'cascade-worker.js');
+}
+const DEFAULT_WORKER_SCRIPT = _resolveDefaultWorkerScript();
+const DEFAULT_GRACE_MS = 500;
+
+function spawnReadyWorker({ workerScript, modulePath, fileContents, scanRoot }) {
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const worker = new node_worker_threads__WEBPACK_IMPORTED_MODULE_0__.Worker(workerScript, { workerData: { modulePath, fileContents, scanRoot } });
+    const finish = (fn, value) => {
+      if (settled) return;
+      settled = true;
+      worker.off('message', onMessage);
+      worker.off('error', onError);
+      fn(value);
+    };
+    const onMessage = (msg) => {
+      if (!msg) return;
+      if (msg.type === 'ready') finish(resolve, worker);
+      else if (msg.type === 'init-error') { worker.terminate().catch(() => {}); finish(reject, new Error(msg.error)); }
+    };
+    const onError = (err) => { worker.terminate().catch(() => {}); finish(reject, err); };
+    worker.on('message', onMessage);
+    worker.on('error', onError);
+  });
+}
+
+/**
+ * @param {object} opts
+ * @param {Record<string,string>} opts.fileContents - broadcast once to every worker at creation.
+ * @param {string|null} opts.scanRoot
+ * @param {number} [opts.poolSize=4]
+ * @param {string} opts.modulePath - absolute path to the engine.js each worker imports.
+ * @param {string} [opts.workerScript] - defaults to cascade-worker.js next to this file.
+ * @param {number} [opts.graceMs]
+ */
+function createCascadePool(opts = {}) {
+  const {
+    fileContents = {},
+    scanRoot = null,
+    poolSize = 4,
+    workerScript = DEFAULT_WORKER_SCRIPT,
+    modulePath,
+    graceMs = DEFAULT_GRACE_MS,
+  } = opts;
+  if (!modulePath) throw new Error('createCascadePool requires opts.modulePath');
+  if (!(Number.isInteger(poolSize) && poolSize > 0)) throw new Error('createCascadePool requires opts.poolSize to be a positive integer');
+
+  const idle = [];
+  const pendingIdle = [];
+  const allWorkers = new Set();
+  let nextTaskId = 1;
+  let closed = false;
+  let spawnFailureCount = 0;
+  let lastSpawnError = null;
+
+  function spawnAndRegister() {
+    return spawnReadyWorker({ workerScript, modulePath, fileContents, scanRoot }).then((w) => {
+      allWorkers.add(w);
+      return w;
+    });
+  }
+
+  // Background respawn after a killed worker (see runFile's timeout branch)
+  // is deliberately fire-and-forget -- the timed-out task has already
+  // resolved and nothing is waiting on this promise -- but a swallowed
+  // failure here would otherwise shrink the pool invisibly (e.g. thread
+  // exhaustion making every future respawn fail silently forever). Track
+  // it instead of a bare `.catch(() => {})`.
+  function respawnInBackground() {
+    spawnAndRegister().then(releaseWorker).catch((err) => {
+      spawnFailureCount += 1;
+      lastSpawnError = err;
+    });
+  }
+
+  function releaseWorker(w) {
+    if (closed) { allWorkers.delete(w); w.terminate().catch(() => {}); return; }
+    if (pendingIdle.length) pendingIdle.shift()(w);
+    else idle.push(w);
+  }
+
+  function acquireWorker() {
+    if (idle.length) return Promise.resolve(idle.pop());
+    return new Promise((resolve) => pendingIdle.push(resolve));
+  }
+
+  const ready = Promise.all(
+    Array.from({ length: poolSize }, () => spawnAndRegister().then(releaseWorker))
+  );
+
+  /**
+   * Run one file's cascade on a pooled worker. Resolves with
+   * {ok:true, result} | {ok:false, error} | {ok:false, timedOut:true, timeoutMs, graceMs}.
+   * Never rejects.
+   */
+  async function runFile(p, c, taskScanRoot, detectorErrors, taskOpts = {}) {
+    await ready;
+    if (closed) return { ok: false, error: 'pool is closed' };
+    const timeoutMs = taskOpts.timeoutMs;
+    const worker = await acquireWorker();
+    const id = nextTaskId++;
+    return new Promise((resolve) => {
+      let settled = false;
+      let killTimer = null;
+      const onMessage = (msg) => {
+        if (settled || !msg || msg.id !== id) return;
+        settled = true;
+        if (killTimer) clearTimeout(killTimer);
+        worker.off('message', onMessage);
+        releaseWorker(worker);
+        resolve(msg.ok ? { ok: true, result: msg.result } : { ok: false, error: msg.error });
+      };
+      worker.on('message', onMessage);
+      if (Number.isFinite(timeoutMs) && timeoutMs > 0) {
+        killTimer = setTimeout(() => {
+          if (settled) return;
+          settled = true;
+          worker.off('message', onMessage);
+          allWorkers.delete(worker);
+          worker.terminate().catch(() => {});
+          if (!closed) respawnInBackground();
+          resolve({ ok: false, timedOut: true, timeoutMs, graceMs });
+        }, timeoutMs + graceMs);
+        killTimer.unref?.();
+      }
+      worker.postMessage({ type: 'task', id, p, c, scanRoot: taskScanRoot, detectorErrors });
+    });
+  }
+
+  async function shutdown() {
+    closed = true;
+    await ready.catch(() => {});
+    for (const w of allWorkers) await w.terminate().catch(() => {});
+    allWorkers.clear();
+    idle.length = 0;
+  }
+
+  return {
+    runFile,
+    shutdown,
+    ready,
+    DEFAULT_GRACE_MS: graceMs,
+    getSpawnFailureCount: () => spawnFailureCount,
+    getLastSpawnError: () => lastSpawnError,
+  };
+}
+
+
+/***/ })
+
+};

package/dist/8178.index.js

@@ -0,0 +1,78 @@
+export const id = 8178;
+export const ids = [8178];
+export const modules = {
+
+/***/ 48178:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   exportFlowsCSV: () => (/* binding */ exportFlowsCSV)
+/* harmony export */ });
+/* harmony import */ var _protection_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(59114);
+// export-csv.js — Milestone 4, sub-project JSON/CSV export.
+//
+// One row per FLOW (not node, not edge — the closest analogue in this
+// domain to report/index.js's own toCSV's "one row per finding", per this
+// sub-project's own scoping doc decision 3). Node/edge CSV exports are
+// deferred, named explicitly in that doc, not attempted here.
+
+
+
+// Same escaping convention as report/index.js's own toCSV — quote only
+// when a comma/quote/newline is present, double embedded quotes.
+function esc(v) {
+  if (v == null) return '';
+  const s = String(v);
+  return /[",\n]/.test(s) ? '"' + s.replace(/"/g, '""') + '"' : s;
+}
+
+// Join character for a flow's multiple `dataClasses` values in one CSV
+// cell: `;`, not `,`. Chosen (this module's own decision, not prescribed
+// by the plan) because `,` is CSV's own delimiter — joining multiple
+// classes with it would put a raw delimiter inside a single logical cell
+// value, forcing outer quoting for the ordinary multi-class case (e.g. a
+// field classified both PCI and PII). `;` never collides with the CSV
+// grammar, so the common case ("PCI;PII") never needs quoting at all.
+// `esc()` still quotes correctly if a comma ends up in cell content for
+// any other reason (see export-csv.test.js's own escaping test) — this
+// choice only avoids manufacturing that case in the common path.
+const DATA_CLASSES_JOIN = ';';
+
+function _dataClassesForFlow(flow, dataElementsById) {
+  const classes = new Set();
+  for (const deId of flow.dataElementIds ?? []) {
+    const de = dataElementsById.get(deId);
+    for (const c of de?.dataClasses ?? []) classes.add(c);
+  }
+  return [...classes].sort();
+}
+
+function _dimensionVerdict(flow, edgesById, dimension) {
+  const verdicts = (flow.edgeIds ?? [])
+    .map((id) => edgesById.get(id)?.protection?.[dimension]?.verdict)
+    .filter(Boolean);
+  return (0,_protection_js__WEBPACK_IMPORTED_MODULE_0__/* .aggregateVerdicts */ .SX)(verdicts);
+}
+
+function exportFlowsCSV(graph) {
+  const dataElementsById = new Map((graph.dataElements ?? []).map((d) => [d.id, d]));
+  const edgesById = new Map((graph.edges ?? []).map((e) => [e.id, e]));
+  const header = ['id', 'source', 'sink', 'dataClasses', 'transitVerdict', 'atRestVerdict', 'handlingVerdict', 'policyVerdict', 'coverageStatus'];
+  const rows = [header.join(',')];
+  for (const flow of graph.flows ?? []) {
+    rows.push([
+      esc(flow.id), esc(flow.source), esc(flow.sink),
+      esc(_dataClassesForFlow(flow, dataElementsById).join(DATA_CLASSES_JOIN)),
+      esc(_dimensionVerdict(flow, edgesById, 'transit')),
+      esc(_dimensionVerdict(flow, edgesById, 'atRest')),
+      esc(_dimensionVerdict(flow, edgesById, 'handling')),
+      esc(flow.policyVerdict), esc(flow.coverageStatus),
+    ].join(','));
+  }
+  return rows.join('\n');
+}
+
+
+/***/ })
+
+};

package/dist/818.index.js

@@ -88,6 +88,218 @@ function formatFixProof(r) {
 }
 
 
+/***/ }),
+
+/***/ 3740:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   kO: () => (/* binding */ proveFinding)
+/* harmony export */ });
+/* unused harmony exports independentVerify, applySeverityPolicy, _newRunId */
+/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(77598);
+/* harmony import */ var _states_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(12090);
+/* harmony import */ var _runner_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(2998);
+/* harmony import */ var _reproducer_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(37055);
+/* harmony import */ var _proof_tier_js__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(40216);
+// Proof orchestration: finding + revision + reproducer + policy -> structured evidence.
+//
+// Rules that make this safe to trust:
+//  * The model may propose a reproducer and select an oracle. The oracle (oracles.js) judges. Never a model.
+//  * An attempt that did not complete (timeout, build failure, blocked, unsupported, error) is NOT a negative and NOT a
+//    positive: it is degraded evidence, it never advances the state, and it makes the result INCOMPLETE.
+//  * EXPLOIT_CONFIRMED needs `required` successes in `attempts` completed attempts AND a pass from an independent
+//    verifier that receives only {revision, reproducer, findingId, oracle} in a fresh environment.
+//  * "Not reproduced" is reported as such; it is never reported as safe.
+
+
+
+
+
+
+const PROOF_POLICY_DEFAULTS = Object.freeze({ attempts: 3, required: 3, independentReplay: true, timeoutMs: 20_000, cpus: 1, memoryMb: 512, network: 'none', requireContainer: false });
+const RESULT_SCHEMA = 'agentic-security/proof-result';
+
+function normalizePolicy(p = {}) {
+  const x = { ...PROOF_POLICY_DEFAULTS, ...p };
+  x.attempts = Math.max(1, Math.min(10, Math.trunc(Number(x.attempts)) || PROOF_POLICY_DEFAULTS.attempts));
+  x.required = Math.max(1, Math.min(x.attempts, Math.trunc(Number(x.required)) || x.attempts));
+  x.timeoutMs = Math.max(1000, Math.min(120_000, Number(x.timeoutMs) || PROOF_POLICY_DEFAULTS.timeoutMs));
+  return x;
+}
+
+const summarize = (a) => ({ status: a.status, fired: a.oracle?.fired === true, inconclusive: a.oracle?.inconclusive === true, reason: a.oracle?.reason ?? a.reasons?.[0] ?? null, durationMs: a.durationMs, degraded: a.degraded });
+
+/**
+ * Independent verifier. Takes a verifierView ONLY; any extra property (a model's reasoning, prior results) is rejected so
+ * the isolation of its inputs is checkable rather than a convention.
+ */
+async function independentVerify(view, opts = {}) {
+  const allowed = new Set(['revision', 'reproducer', 'findingId', 'oracle']);
+  const extra = Object.keys(view || {}).filter((k) => !allowed.has(k));
+  if (extra.length) return { status: 'rejected', reason: `verifier input must be exactly revision, reproducer, findingId, oracle; got extra: ${extra.join(', ')}` };
+  const attempt = await (opts.attemptFn ?? _runner_js__WEBPACK_IMPORTED_MODULE_2__/* .runAttempt */ .Tm)(structuredClone(view.reproducer), { ...opts, preferContainer: opts.preferContainer });
+  return { status: attempt.status === 'completed' ? (attempt.oracle?.fired ? 'confirmed' : 'not-reproduced') : 'incomplete', attempt: summarize(attempt), environment: attempt.environment ?? null };
+}
+
+/**
+ * @param {object} a
+ * @param {object} a.finding       the finding (id/stableId, severity, proofTier ...)
+ * @param {string} [a.revision]    commit the proof applies to
+ * @param {object} a.reproducer    serialized reproducer
+ * @param {object} [a.policy]
+ * @param {object} [a.deps]        test seams: { attemptFn }
+ */
+async function proveFinding({ finding, revision = null, reproducer, policy = {}, signal, deps = {}, sourceState = null, sourceRoot = null, overlay = null } = {}) {
+  const started = Date.now();
+  const pol = normalizePolicy(policy);
+  const attemptFn = deps.attemptFn ?? _runner_js__WEBPACK_IMPORTED_MODULE_2__/* .runAttempt */ .Tm;
+  const findingId = finding?.stableId ?? finding?.id ?? reproducer?.findingId ?? 'unknown';
+  const degradation = [];
+  let state = sourceState ?? (0,_states_js__WEBPACK_IMPORTED_MODULE_1__/* .fromProofTier */ .jn)((0,_proof_tier_js__WEBPACK_IMPORTED_MODULE_4__/* .proofTierOf */ .gx)(finding || {}));
+  if (state === 'REPRODUCED') state = 'STATICALLY_CORROBORATED'; // an old single-run marker proof must be re-earned here
+  const startState = state;
+
+  const result = (extra) => ({
+    schema: RESULT_SCHEMA, version: 1, findingId, revision, startState, state, staticCorroboration: (0,_states_js__WEBPACK_IMPORTED_MODULE_1__/* .stateRank */ .g3)(startState) >= 1, tier: (0,_states_js__WEBPACK_IMPORTED_MODULE_1__/* .toProofTier */ .KF)(state),
+    oracle: reproducer?.oracle?.type ?? null, policy: pol,
+    reproducerDigest: reproducer ? safeDigest(reproducer) : null,
+    degradation, timing: { proofMs: Date.now() - started }, ...extra,
+  });
+
+  const errs = reproducer ? (0,_reproducer_js__WEBPACK_IMPORTED_MODULE_3__/* .validateReproducer */ .mC)(reproducer) : ['no reproducer supplied'];
+  if (errs.length) { degradation.push('invalid-reproducer'); return result({ completeness: 'INCOMPLETE', outcome: 'invalid-reproducer', reasons: errs, attempts: { required: pol.required, run: 0, successes: 0, incomplete: 0 }, independentReplay: { status: 'not-run' } }); }
+
+  // A valid reproducer is itself the REPRODUCER_GENERATED rung. Static corroboration is recorded, not required: an exploit
+  // that reproduces under an independent oracle is deterministic corroboration in its own right, and a pattern-only finding
+  // must not be unable to earn proof merely because the taint engine never saw it. The record says which it was.
+  const staticCorroboration = (0,_states_js__WEBPACK_IMPORTED_MODULE_1__/* .stateRank */ .g3)(startState) >= (0,_states_js__WEBPACK_IMPORTED_MODULE_1__/* .stateRank */ .g3)('STATICALLY_CORROBORATED');
+  if (!staticCorroboration) degradation.push('no-static-corroboration');
+  state = 'REPRODUCER_GENERATED';
+
+  const attempts = [];
+  for (let i = 0; i < pol.attempts; i++) {
+    if (signal?.aborted) { degradation.push('cancelled'); break; }
+    const a = await attemptFn(structuredClone(reproducer), { limits: { timeoutMs: pol.timeoutMs }, signal, requireContainer: pol.requireContainer, preferContainer: pol.preferContainer, force: pol.force, sourceRoot, overlay });
+    attempts.push(a);
+    // Stop early once the threshold can no longer be met only if every attempt is a decisive negative; incomplete runs continue.
+  }
+  const completed = attempts.filter((a) => a.status === 'completed' && !a.oracle?.inconclusive);
+  const successes = completed.filter((a) => a.oracle?.fired).length;
+  const incomplete = attempts.length - completed.length;
+  for (const a of attempts) for (const d of a.degraded || []) if (!degradation.includes(d)) degradation.push(d);
+  if (incomplete) degradation.push(`incomplete-attempts:${incomplete}`);
+  const env = attempts.find((a) => a.environment)?.environment ?? null;
+  const base = {
+    environment: env && { mode: env.mode, assurance: env.assurance, backend: env.backend ?? null, note: env.note ?? null },
+    build: attempts.some((a) => a.status === 'build-failed') ? 'failed' : attempts.length ? 'ok' : 'not-run',
+    attempts: { required: pol.required, run: attempts.length, successes, incomplete, detail: attempts.map(summarize) },
+    artifactHashes: { reproducer: safeDigest(reproducer), observations: (0,_reproducer_js__WEBPACK_IMPORTED_MODULE_3__/* .sha256 */ .sc)((0,_reproducer_js__WEBPACK_IMPORTED_MODULE_3__/* .canonicalize */ .dw)(attempts.map((a) => a.observation ?? null))) },
+  };
+
+  if (successes > 0) {
+    const r = (0,_states_js__WEBPACK_IMPORTED_MODULE_1__/* .advance */ .np)(state, 'REPRODUCED'); if (r.ok) state = r.state;
+  }
+  if (!attempts.length) return result({ ...base, completeness: 'INCOMPLETE', outcome: 'not-run', independentReplay: { status: 'not-run' } });
+  if (successes === 0) {
+    const decisive = completed.length === attempts.length;
+    return result({ ...base, completeness: decisive ? 'FULL' : 'INCOMPLETE', outcome: decisive ? 'not-reproduced' : 'inconclusive', note: 'not reproduced is not proof of safety', independentReplay: { status: 'not-run' } });
+  }
+  if (successes < pol.required || incomplete) {
+    return result({ ...base, completeness: incomplete ? 'INCOMPLETE' : 'DEGRADED', outcome: 'reproduced-below-threshold', independentReplay: { status: 'not-run' } });
+  }
+
+  let independent = { status: 'skipped' };
+  if (pol.independentReplay) {
+    independent = await independentVerify((0,_reproducer_js__WEBPACK_IMPORTED_MODULE_3__/* .verifierView */ .IW)({ revision, reproducer, findingId, oracle: reproducer.oracle }), { attemptFn, limits: { timeoutMs: pol.timeoutMs }, signal, requireContainer: pol.requireContainer, force: pol.force, sourceRoot, overlay });
+    if (independent.status !== 'confirmed') degradation.push(`independent-replay:${independent.status}`);
+  } else degradation.push('independent-replay-disabled');
+  if (independent.status === 'confirmed') {
+    const r = (0,_states_js__WEBPACK_IMPORTED_MODULE_1__/* .advance */ .np)(state, 'EXPLOIT_CONFIRMED'); if (r.ok) state = r.state;
+  }
+  const full = state === 'EXPLOIT_CONFIRMED' && base.environment?.assurance !== 'none';
+  return result({ ...base, independentReplay: independent, completeness: full ? (base.environment.assurance === 'lower' ? 'DEGRADED' : 'FULL') : 'INCOMPLETE', outcome: full ? 'exploit-confirmed' : 'reproduced-unverified' });
+}
+
+const safeDigest = (r) => { try { return (0,_reproducer_js__WEBPACK_IMPORTED_MODULE_3__/* .reproducerDigest */ .we)(r); } catch { return null; } };
+
+/** Severity policy: optional, never on by default. Returns the finding unchanged unless the policy asks to demote. */
+function applySeverityPolicy(finding, evidenceState, policy) {
+  const req = policy?.criticalRequires;
+  if (!Array.isArray(req) || !req.length || finding?.severity !== 'critical') return finding;
+  const ok = req.some((s) => stateRankOf(evidenceState ?? 'CANDIDATE') >= stateRankOf(s));
+  return ok ? finding : { ...finding, severity: 'high', severityPolicy: { demotedFrom: 'critical', reason: `critical requires ${req.join(' or ')}; evidence state is ${evidenceState ?? 'CANDIDATE'}` } };
+}
+const _newRunId = () => randomBytes(6).toString('hex');
+
+
+/***/ }),
+
+/***/ 12090:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   KF: () => (/* binding */ toProofTier),
+/* harmony export */   g3: () => (/* binding */ stateRank),
+/* harmony export */   jn: () => (/* binding */ fromProofTier),
+/* harmony export */   np: () => (/* binding */ advance)
+/* harmony export */ });
+/* unused harmony exports EVIDENCE_STATES, COMPLETENESS */
+// Evidence state ladder for the Universal Exploit Proof Fabric.
+//
+// Evidence state is SEPARATE from severity and confidence. It extends, never replaces, the vocabulary that already
+// exists: `proof-tier.js` (execution-proven / proof-failed / taint-proven / unproven) and the fix-verify legs
+// (`verifiedFull`, `degradedLegs`). `toProofTier` / `fromProofTier` are the explicit bridges.
+//
+// Transitions are guarded: a state can only be reached from the state directly before it (or by dropping back), so no
+// caller can jump a finding to EXPLOIT_CONFIRMED without passing REPRODUCED, or to FIX_VERIFIED without
+// FIX_REPLAY_BLOCKED. A degraded or incomplete run NEVER advances a state.
+const EVIDENCE_STATES = Object.freeze([
+  'CANDIDATE',
+  'STATICALLY_CORROBORATED',
+  'REPRODUCER_GENERATED',
+  'REPRODUCED',
+  'EXPLOIT_CONFIRMED',
+  'FIX_REPLAY_BLOCKED',
+  'FIX_VERIFIED',
+]);
+
+const stateRank = (s) => EVIDENCE_STATES.indexOf(s);
+
+const REQUIRES_PREDECESSOR = Object.freeze(Object.fromEntries(EVIDENCE_STATES.map((s, i) => [s, i === 0 ? null : EVIDENCE_STATES[i - 1]])));
+
+/**
+ * Advance `from` to `to`. Returns { ok, state, reason }. Moving up requires `to` to be exactly the next rung; moving
+ * down or staying is always allowed (evidence can be lost, never invented). Unknown states are rejected.
+ */
+function advance(from, to) {
+  if (!EVIDENCE_STATES.includes(from)) return { ok: false, state: 'CANDIDATE', reason: `unknown current state: ${String(from)}` };
+  if (!EVIDENCE_STATES.includes(to)) return { ok: false, state: from, reason: `unknown target state: ${String(to)}` };
+  if (stateRank(to) <= stateRank(from)) return { ok: true, state: to, reason: null };
+  if (REQUIRES_PREDECESSOR[to] !== from) return { ok: false, state: from, reason: `cannot reach ${to} from ${from}: ${REQUIRES_PREDECESSOR[to]} is required first` };
+  return { ok: true, state: to, reason: null };
+}
+
+// Bridges to the older vocabulary so existing consumers keep working.
+function toProofTier(state) {
+  const r = stateRank(state);
+  if (r >= stateRank('EXPLOIT_CONFIRMED')) return 'execution-proven';
+  if (r >= stateRank('STATICALLY_CORROBORATED')) return 'taint-proven';
+  return 'unproven';
+}
+
+function fromProofTier(tier) {
+  if (tier === 'taint-proven') return 'STATICALLY_CORROBORATED';
+  // execution-proven under the older single-run marker path is one run, not the 3/3 + independent replay the fabric
+  // requires, so it maps to REPRODUCED and never to EXPLOIT_CONFIRMED.
+  if (tier === 'execution-proven') return 'REPRODUCED';
+  return 'CANDIDATE';
+}
+
+// Completeness vocabulary shared with fix-verify: FULL only when nothing was skipped.
+const COMPLETENESS = Object.freeze(['FULL', 'DEGRADED', 'INCOMPLETE']);
+
+
 /***/ })
 
 };

package/dist/8382.index.js

@@ -0,0 +1,93 @@
+export const id = 8382;
+export const ids = [8382];
+export const modules = {
+
+/***/ 78382:
+/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   qc: () => (/* binding */ IMPACT_VERSION),
+/* harmony export */   validateImpactAssessment: () => (/* binding */ validateImpactAssessment)
+/* harmony export */ });
+/* unused harmony exports IMPACT_TARGET_KINDS, IMPACT_SCOPE_VALUES, IMPACT_TRACE_KINDS */
+// impact-assessment.js — M5 deliverable #4 (FR-507 §10.10): the
+// ImpactAssessment extension contract — the result of asking "what is
+// reachable from this compromised node/edge/flow/data element, per the
+// graph's own already-scanned evidence." NOT a DataFlowGraph v1 entity,
+// mirrors recipient-profile.js's/scenario.js's own contract shape
+// exactly (structural-only {valid, errors} validator, zero graph
+// access at construction time).
+//
+// See docs/superpowers/plans/2026-09-02-data-flow-explorer-m5-blast-radius-impact-scoping.md
+// for the full design reasoning, including why there is no
+// affectedObligationIds field (ObligationMapping records are built on
+// demand per compliance framework, not stored on the graph) and why
+// `scope` is always 'possible' today (no runtime-corroboration layer
+// exists yet).
+
+const IMPACT_VERSION = '1.0.0';
+
+const IMPACT_TARGET_KINDS = Object.freeze(['node', 'edge', 'flow', 'dataElement']);
+
+// 'possible' is the only value any producer emits today — 'observed'
+// is reserved for a future Digital Twin (M5 #7) increment with a real
+// runtime-corroboration signal. Both are valid schema values now so
+// that increment needs no breaking change to this contract later.
+const IMPACT_SCOPE_VALUES = Object.freeze(['possible', 'observed']);
+
+// Discloses WHICH of the two genuinely different traversal semantics
+// produced this record (final-review I2 fix) — `scope` alone cannot
+// distinguish them, since both families emit `scope: 'possible'`.
+// 'topology_reachable': a `node` target's topology-wide showAllPaths
+// BFS — "everything this compromised node could push to." 'flow_
+// restricted': an `edge`/`flow`/`dataElement` target's direct trace
+// over the flows that actually carry it — never the topology-wide BFS.
+// Without this field a JSON consumer cannot tell "exact carrier trace"
+// from "topological presumption" apart, the exact silent-conflation
+// this codebase's own disclosure discipline exists to prevent.
+const IMPACT_TRACE_KINDS = Object.freeze(['topology_reachable', 'flow_restricted']);
+
+function _isNonEmptyString(v) { return typeof v === 'string' && v.length > 0; }
+function _isStringArray(v) { return Array.isArray(v) && v.every((x) => typeof x === 'string'); }
+
+/**
+ * Structural validation only — mirrors validateRecipientProfile's/
+ * validateScenario's own {valid, errors} shape and "never throws"
+ * contract.
+ */
+function validateImpactAssessment(record) {
+  const errors = [];
+  const err = (p, message) => errors.push({ path: p, message });
+  if (!record || typeof record !== 'object' || Array.isArray(record)) {
+    err('$', 'ImpactAssessment record must be an object');
+    return { valid: false, errors };
+  }
+  if (!_isNonEmptyString(record.id) || !record.id.startsWith('impact:')) {
+    err('$.id', 'id is required and must start with "impact:"');
+  }
+  if (!_isNonEmptyString(record.version)) err('$.version', 'version is required');
+  if (!_isNonEmptyString(record.graphId)) err('$.graphId', 'graphId is required');
+  if (!_isNonEmptyString(record.graphDigest)) err('$.graphDigest', 'graphDigest is required');
+  if (!_isNonEmptyString(record.targetId)) err('$.targetId', 'targetId is required');
+  if (!IMPACT_TARGET_KINDS.includes(record.targetKind)) {
+    err('$.targetKind', `targetKind must be one of ${IMPACT_TARGET_KINDS.join('|')}`);
+  }
+  if (!IMPACT_SCOPE_VALUES.includes(record.scope)) {
+    err('$.scope', `scope must be one of ${IMPACT_SCOPE_VALUES.join('|')}`);
+  }
+  if (!IMPACT_TRACE_KINDS.includes(record.traceKind)) {
+    err('$.traceKind', `traceKind must be one of ${IMPACT_TRACE_KINDS.join('|')}`);
+  }
+  if (!_isStringArray(record.affectedNodeIds ?? [])) err('$.affectedNodeIds', 'affectedNodeIds must be an array of strings');
+  if (!_isStringArray(record.affectedEdgeIds ?? [])) err('$.affectedEdgeIds', 'affectedEdgeIds must be an array of strings');
+  if (!_isStringArray(record.affectedDataClasses ?? [])) err('$.affectedDataClasses', 'affectedDataClasses must be an array of strings');
+  if (!_isStringArray(record.affectedRecipientProfileIds ?? [])) err('$.affectedRecipientProfileIds', 'affectedRecipientProfileIds must be an array of strings');
+  if (!_isStringArray(record.coverageLimitations ?? [])) err('$.coverageLimitations', 'coverageLimitations must be an array of strings');
+  if (!_isNonEmptyString(record.generatedAt)) err('$.generatedAt', 'generatedAt is required');
+  return { valid: errors.length === 0, errors };
+}
+
+
+/***/ })
+
+};