@clear-capabilities/agentic-security-scanner 0.184.0 → 0.186.1

package/dist/2223.index.js

@@ -1,159 +0,0 @@
-export const id = 2223;
-export const ids = [2223];
-export const modules = {
-
-/***/ 82223:
-/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
-
-/* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   detectVendoredLibraries: () => (/* binding */ detectVendoredLibraries)
-/* harmony export */ });
-// Vendored / copied library detection via version-string fingerprinting.
-//
-// Detects library code copied into src/ that bypasses SCA. Uses version
-// string patterns (_.VERSION, jQuery.fn.jquery, etc.) and characteristic
-// function signatures to identify vendored libraries.
-
-const VERSION_FINGERPRINTS = [
-  { pkg: 'lodash', ecosystem: 'npm', patterns: [
-    { re: /\b(?:lodash|_)\.VERSION\s*=\s*['"](\d+\.\d+\.\d+)['"]/, versionGroup: 1 },
-    { re: /\b__lodash_hash_undefined__\b/, version: null },
-  ]},
-  { pkg: 'jquery', ecosystem: 'npm', patterns: [
-    { re: /jQuery\.fn\.jquery\s*=\s*['"](\d+\.\d+\.\d+)['"]/, versionGroup: 1 },
-    { re: /\bjQuery\.fn\.init\b/, version: null },
-  ]},
-  { pkg: 'underscore', ecosystem: 'npm', patterns: [
-    { re: /\b_\.VERSION\s*=\s*['"](\d+\.\d+\.\d+)['"]/, versionGroup: 1 },
-  ]},
-  { pkg: 'moment', ecosystem: 'npm', patterns: [
-    { re: /\bmoment\.version\s*=\s*['"](\d+\.\d+\.\d+)['"]/, versionGroup: 1 },
-    { re: /\bmoment\.(?:utc|parseZone|duration|locale)\b/, version: null },
-  ]},
-  { pkg: 'handlebars', ecosystem: 'npm', patterns: [
-    { re: /\bHandlebars\.VERSION\s*=\s*['"](\d+\.\d+\.\d+)['"]/, versionGroup: 1 },
-  ]},
-  { pkg: 'backbone', ecosystem: 'npm', patterns: [
-    { re: /\bBackbone\.VERSION\s*=\s*['"](\d+\.\d+\.\d+)['"]/, versionGroup: 1 },
-  ]},
-  { pkg: 'angular', ecosystem: 'npm', patterns: [
-    { re: /\bangular\.version\s*=\s*\{[^}]*full\s*:\s*['"](\d+\.\d+\.\d+)['"]/, versionGroup: 1 },
-  ]},
-  { pkg: 'vue', ecosystem: 'npm', patterns: [
-    { re: /\bVue\.version\s*=\s*['"](\d+\.\d+\.\d+)['"]/, versionGroup: 1 },
-  ]},
-  { pkg: 'react', ecosystem: 'npm', patterns: [
-    { re: /\bReactVersion\s*=\s*['"](\d+\.\d+\.\d+)['"]/, versionGroup: 1 },
-  ]},
-  { pkg: 'dompurify', ecosystem: 'npm', patterns: [
-    { re: /\bDOMPurify\.version\s*=\s*['"](\d+\.\d+\.\d+)['"]/, versionGroup: 1 },
-  ]},
-  { pkg: 'marked', ecosystem: 'npm', patterns: [
-    { re: /\bmarked\.(?:defaults|setOptions|use|parse)\b[\s\S]{0,200}version\s*[:=]\s*['"](\d+\.\d+\.\d+)['"]/, versionGroup: 1 },
-  ]},
-  { pkg: 'axios', ecosystem: 'npm', patterns: [
-    { re: /\baxios\.VERSION\s*=\s*['"](\d+\.\d+\.\d+)['"]/, versionGroup: 1 },
-  ]},
-  { pkg: 'socket.io-client', ecosystem: 'npm', patterns: [
-    { re: /\bio\.protocol\s*=\s*(\d+)/, version: null },
-  ]},
-  { pkg: 'highlight.js', ecosystem: 'npm', patterns: [
-    { re: /\bhljs\.versionString\s*=\s*['"](\d+\.\d+\.\d+)['"]/, versionGroup: 1 },
-  ]},
-  { pkg: 'chart.js', ecosystem: 'npm', patterns: [
-    { re: /\bChart\.version\s*=\s*['"](\d+\.\d+\.\d+)['"]/, versionGroup: 1 },
-  ]},
-];
-
-const SKIP_DIRS = /(?:^|[/\\])(?:node_modules|vendor|dist|build|\.next|__pycache__|\.git)[/\\]/;
-
-function detectVendoredLibraries(fileContents) {
-  if (!fileContents || typeof fileContents !== 'object') return [];
-  const detected = [];
-  const seen = new Set();
-
-  for (const [fp, content] of Object.entries(fileContents)) {
-    if (!content || typeof content !== 'string') continue;
-    if (SKIP_DIRS.test(fp)) continue;
-    if (content.length < 500) continue;
-
-    for (const lib of VERSION_FINGERPRINTS) {
-      for (const pat of lib.patterns) {
-        const m = content.match(pat.re);
-        if (!m) continue;
-        const version = pat.versionGroup ? m[pat.versionGroup] : null;
-        const key = `${lib.pkg}:${fp}`;
-        if (seen.has(key)) continue;
-        seen.add(key);
-        detected.push({
-          name: lib.pkg,
-          version: version || 'unknown',
-          ecosystem: lib.ecosystem,
-          file: fp,
-          scope: 'vendored',
-          isVendored: true,
-        });
-        break;
-      }
-    }
-  }
-  // Pass 2: Function-body structural matching for minified/forked copies
-  const FUNCTION_BODY_SIGS = [
-    { pkg: 'lodash', ecosystem: 'npm', fn: 'merge', paramMin: 1,
-      bodyContains: ['assignValue', 'baseFor', 'isObject', 'baseMerge'] },
-    { pkg: 'lodash', ecosystem: 'npm', fn: 'template', paramMin: 1,
-      bodyContains: ['sourceURL', 'interpolate', 'evaluate', 'escape'] },
-    { pkg: 'lodash', ecosystem: 'npm', fn: 'defaultsDeep', paramMin: 1,
-      bodyContains: ['baseMerge', 'isMergeableObject', 'customDefaultsMerge'] },
-    { pkg: 'jquery', ecosystem: 'npm', fn: 'ajax', paramMin: 1,
-      bodyContains: ['XMLHttpRequest', 'ajaxSettings', 'crossDomain', 'responseFields'] },
-    { pkg: 'handlebars', ecosystem: 'npm', fn: 'compile', paramMin: 1,
-      bodyContains: ['templateSpec', 'container', 'invokePartial', 'blockParams'] },
-    { pkg: 'marked', ecosystem: 'npm', fn: 'parse', paramMin: 1,
-      bodyContains: ['Lexer', 'Parser', 'blockTokens', 'walkTokens'] },
-    { pkg: 'ejs', ecosystem: 'npm', fn: 'render', paramMin: 1,
-      bodyContains: ['includeFile', 'resolveInclude', 'rethrow', 'escapeFn'] },
-    { pkg: 'moment', ecosystem: 'npm', fn: 'format', paramMin: 0,
-      bodyContains: ['formatMoment', 'expandFormat', 'makeFormatFunction', 'localFormattingTokens'] },
-    { pkg: 'underscore', ecosystem: 'npm', fn: 'template', paramMin: 1,
-      bodyContains: ['interpolate', 'evaluate', 'escape', 'templateSettings'] },
-    { pkg: 'minimist', ecosystem: 'npm', fn: 'parse', paramMin: 1,
-      bodyContains: ['boolean', 'alias', 'default', 'stopEarly', 'unknown'] },
-  ];
-
-  for (const [fp, content] of Object.entries(fileContents)) {
-    if (!content || typeof content !== 'string') continue;
-    if (SKIP_DIRS.test(fp)) continue;
-    if (!/\.(?:js|mjs|cjs)$/i.test(fp)) continue;
-    if (content.length < 200 || content.length > 500_000) continue;
-
-    for (const sig of FUNCTION_BODY_SIGS) {
-      const key = `${sig.pkg}:${fp}`;
-      if (seen.has(key)) continue;
-      const fnRe = new RegExp(`(?:function\\s+${sig.fn}|(?:const|let|var)\\s+${sig.fn}\\s*=|${sig.fn}\\s*[:=]\\s*function)\\s*\\(`, 'g');
-      const m = fnRe.exec(content);
-      if (!m) continue;
-      const bodyWindow = content.slice(m.index, m.index + 2000);
-      const matchCount = sig.bodyContains.filter(kw => bodyWindow.includes(kw)).length;
-      if (matchCount < Math.ceil(sig.bodyContains.length * 0.6)) continue;
-      seen.add(key);
-      detected.push({
-        name: sig.pkg,
-        version: 'unknown',
-        ecosystem: sig.ecosystem,
-        file: fp,
-        scope: 'vendored',
-        isVendored: true,
-        _detectionMethod: 'function-body-signature',
-        _matchedKeywords: matchCount,
-      });
-    }
-  }
-
-  return detected;
-}
-
-
-/***/ })
-
-};

package/dist/2238.index.js

@@ -1,295 +0,0 @@
-export const id = 2238;
-export const ids = [2238];
-export const modules = {
-
-/***/ 32238:
-/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
-
-/* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   I3: () => (/* binding */ recordFixAttempt),
-/* harmony export */   fixDurationReport: () => (/* binding */ fixDurationReport),
-/* harmony export */   renderFixDurationSummary: () => (/* binding */ renderFixDurationSummary),
-/* harmony export */   sU: () => (/* binding */ loadFixAttempts)
-/* harmony export */ });
-/* unused harmony exports FIX_STAGES, bucketOf, summarizeFixDurations, _internals, summarizeFixAxes, renderFixAxes */
-/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(73024);
-/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(76760);
-/* harmony import */ var _state_dir_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(31174);
-// Time-to-validated-fix (R5, the reporting half).
-//
-// `verifyFix` already RUNS the stages and `test-runner.js` already times the
-// slowest one. What did not exist was anything durable to read afterwards, so
-// "how long does a fix actually take to validate" had no answer from real runs
-// — only an estimate (`time-to-fix.js` guesses engineering hours from family
-// and patch shape, before anything runs). This module is the opposite: it
-// records what the pipeline observed and reports the distribution.
-//
-// THE HONESTY RULES, which are most of why this file is longer than a mean:
-//
-//  1. A failed attempt is NOT a data point about how long a fix takes. Fixes
-//     that fail verification fail fast (a re-scan that still sees the finding
-//     never reaches the test suite), so blending them into one average makes
-//     the pipeline look faster the worse it performs. Validated and failed
-//     attempts are summarised separately and never merged.
-//
-//  2. "Tests skipped" is not "tests passed". A project with no detectable
-//     suite can reach `ok:true` having run only the re-scan and the linter.
-//     That is a weaker claim than a fix whose suite executed, and it is also
-//     much faster, so counting the two together would quietly deflate the
-//     headline. They get their own bucket: `validated` means the suite ran and
-//     passed, `validatedWithoutTests` means there was no suite to run.
-//
-//  3. Every figure carries its `n`, and a percentile computed from too few
-//     samples is labelled unreliable rather than omitted or silently reported.
-//     Same precedent as the accuracy scorecard's `{n, d}` rates: a number
-//     without its denominator is not a measurement.
-//
-// Storage is append-only JSONL at `<scanRoot>/.agentic-security/fix-metrics.jsonl`,
-// one record per verification attempt. Nothing here throws (posture
-// convention) — an unwritable or corrupt log degrades to "no metrics", never
-// to a failed verification.
-
-
-
-
-
-const LOG_FILE = 'fix-metrics.jsonl';
-
-// Below this many samples a percentile is an artifact of the sample, not a
-// property of the pipeline. Reported anyway (hiding it invites re-deriving it
-// wrong downstream) but flagged, so a caller cannot quote it as settled.
-const RELIABLE_N = 10;
-
-// The stages verifyFix runs, in execution order. Kept here so the recorder and
-// the summariser cannot drift apart on stage naming.
-const FIX_STAGES = Object.freeze(['rescan', 'lint', 'tests', 'honesty', 'poc']);
-
-function _logPath(scanRoot) {
-  return (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.statePath)(scanRoot, LOG_FILE);
-}
-
-/**
- * Append one verification attempt. Best-effort and silent on failure: metrics
- * must never be able to fail a fix that otherwise verified.
- *
- * @returns {boolean} whether the record was written (for tests, not callers).
- */
-function recordFixAttempt(scanRoot, record) {
-  if (!scanRoot || !record || typeof record !== 'object') return false;
-  try {
-    const dir = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__/* .stateDir */ .Pn)(scanRoot);
-    if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.isSafeStateDir)(dir)) return false;
-    if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.stateWritesEnabled)()) return false;
-  node_fs__WEBPACK_IMPORTED_MODULE_0__.mkdirSync(dir, { recursive: true });
-    // One writeSync of one newline-terminated line: a concurrent reader sees
-    // whole records or nothing, and a torn tail is dropped on read.
-    node_fs__WEBPACK_IMPORTED_MODULE_0__.appendFileSync(_logPath(scanRoot), JSON.stringify(record) + '\n', 'utf8');
-    return true;
-  } catch { return false; }
-}
-
-/**
- * Read every well-formed attempt. A line that does not parse is skipped, not
- * fatal — the last line of an interrupted write is the expected case.
- */
-function loadFixAttempts(scanRoot) {
-  try {
-    const raw = node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(_logPath(scanRoot), 'utf8');
-    const out = [];
-    for (const line of raw.split('\n')) {
-      if (!line.trim()) continue;
-      try {
-        const rec = JSON.parse(line);
-        if (rec && typeof rec === 'object' && typeof rec.totalMs === 'number') out.push(rec);
-      } catch { /* torn or hand-edited line — drop it, keep the rest */ }
-    }
-    return out;
-  } catch { return []; }
-}
-
-// Nearest-rank percentile over an ascending array. Nearest-rank rather than
-// interpolated because these are observed durations, and an interpolated p50
-// reports a duration that no run actually took.
-function _pct(sorted, p) {
-  if (!sorted.length) return null;
-  const rank = Math.ceil((p / 100) * sorted.length);
-  return sorted[Math.min(sorted.length - 1, Math.max(0, rank - 1))];
-}
-
-function _dist(values) {
-  const v = values.filter(x => typeof x === 'number' && Number.isFinite(x) && x >= 0).sort((a, b) => a - b);
-  if (!v.length) return { n: 0, minMs: null, p50Ms: null, p90Ms: null, maxMs: null, meanMs: null, reliable: false };
-  const sum = v.reduce((a, b) => a + b, 0);
-  return {
-    n: v.length,
-    minMs: v[0],
-    p50Ms: _pct(v, 50),
-    p90Ms: _pct(v, 90),
-    maxMs: v[v.length - 1],
-    meanMs: Math.round(sum / v.length),
-    // Says whether the percentiles above may be quoted, not whether the count
-    // is real. n and min/max/mean are exact at any sample size.
-    reliable: v.length >= RELIABLE_N,
-  };
-}
-
-// Which bucket an attempt belongs to. Deliberately total: every attempt lands
-// in exactly one, so the bucket counts always sum to the attempt count and a
-// mis-shaped record cannot silently vanish from the denominator.
-function bucketOf(a) {
-  if (!a?.ok) return 'failed';
-  return a.testsRan ? 'validated' : 'validatedWithoutTests';
-}
-
-/**
- * Summarise a set of attempts into the reported distribution.
- *
- * `validated` is the headline: attempts that verified AND whose test suite
- * actually ran and passed. The other two buckets exist so that headline cannot
- * be inflated by counting weaker or faster outcomes inside it.
- */
-function summarizeFixDurations(attempts) {
-  const all = Array.isArray(attempts) ? attempts : [];
-  const buckets = { validated: [], validatedWithoutTests: [], failed: [] };
-  for (const a of all) buckets[bucketOf(a)].push(a);
-
-  const byStage = {};
-  for (const stage of FIX_STAGES) {
-    // Per-stage timings come from validated runs only. A stage's duration in a
-    // failed run is truncated by the failure (the pipeline stops), so mixing
-    // them in would understate every stage after the first failure point.
-    byStage[stage] = _dist(buckets.validated.map(a => a?.stages?.[stage]));
-  }
-
-  return {
-    attempts: all.length,
-    counts: {
-      validated: buckets.validated.length,
-      validatedWithoutTests: buckets.validatedWithoutTests.length,
-      failed: buckets.failed.length,
-    },
-    timeToValidatedFix: _dist(buckets.validated.map(a => a.totalMs)),
-    timeToValidatedFixWithoutTests: _dist(buckets.validatedWithoutTests.map(a => a.totalMs)),
-    timeToFailure: _dist(buckets.failed.map(a => a.totalMs)),
-    byStage,
-    reliableAtOrAbove: RELIABLE_N,
-  };
-}
-
-/** Read + summarise in one step. */
-function fixDurationReport(scanRoot) {
-  return summarizeFixDurations(loadFixAttempts(scanRoot));
-}
-
-function _ms(v) {
-  if (v == null) return '—';
-  return v >= 1000 ? `${(v / 1000).toFixed(1)}s` : `${v}ms`;
-}
-
-/**
- * One-paragraph human summary. Returns null when there is nothing measured —
- * callers print nothing rather than printing an empty table.
- */
-function renderFixDurationSummary(sum) {
-  if (!sum || !sum.attempts) return null;
-  const d = sum.timeToValidatedFix;
-  const parts = [];
-  if (d.n) {
-    parts.push(
-      `time-to-validated-fix: median ${_ms(d.p50Ms)}, p90 ${_ms(d.p90Ms)} `
-      + `(n=${d.n}${d.reliable ? '' : `, below ${sum.reliableAtOrAbove} — percentiles not yet reliable`})`,
-    );
-  } else {
-    parts.push('time-to-validated-fix: no fix has both verified and had its test suite run yet');
-  }
-  if (sum.counts.validatedWithoutTests) {
-    parts.push(`${sum.counts.validatedWithoutTests} verified with no detectable test suite (excluded from the median above)`);
-  }
-  if (sum.counts.failed) {
-    parts.push(`${sum.counts.failed} failed verification, median ${_ms(sum.timeToFailure.p50Ms)} (counted separately)`);
-  }
-  return parts.join('; ') + '.';
-}
-
-const _internals = { _dist, _pct, RELIABLE_N };
-
-
-// ── PRD F6.1 — score fixes on THREE AXES, not one ──────────────────────────
-//
-// The three axes the PRD names:
-//   (a) does the finding disappear      — the rescan leg
-//   (b) does the project's own suite pass — the tests leg
-//   (c) does an independent verifier agree — the PoC re-check leg
-//
-// All three were already computed by verifyFixCore and then collapsed into one
-// boolean, which is the problem: **(a) alone is satisfiable by deleting code.**
-// A patch that removes the vulnerable function passes the rescan, has nothing
-// left to fail, and — on a project with no detectable test suite — reaches
-// ok:true having proven only that the detector went quiet.
-//
-// Reporting the axes separately makes that visible. `aOnly` is the number that
-// matters most and the one nobody was publishing: attempts that satisfied ONLY
-// the disappearance axis. A high aOnly with a high headline is the shape of a
-// remediation feature that is deleting code and calling it a fix.
-function summarizeFixAxes(attempts) {
-  const list = Array.isArray(attempts) ? attempts.filter(Boolean) : [];
-  const d = list.length;
-
-  const rate = (pred) => ({ n: list.filter(pred).length, d });
-
-  // Each axis is judged INDEPENDENTLY of the overall verdict, so a leg that
-  // passed inside a failed attempt still counts for its own axis. Reading them
-  // off `ok` would make the three axes three copies of the same number.
-  const findingDisappeared = rate((a) => a.rescanOk === true || (a.ok === true && a.rescanOk !== false));
-  const testsStillPass = rate((a) => a.testsRan === true && a.testsOk !== false);
-  const verifierAgrees = rate((a) => a.pocOk === true);
-
-  const satisfiesAll = rate((a) =>
-    (a.rescanOk === true || (a.ok === true && a.rescanOk !== false))
-    && a.testsRan === true && a.testsOk !== false
-    && a.pocOk === true);
-
-  // The honesty number: disappearance WITHOUT either corroborating axis.
-  const aOnly = rate((a) => {
-    const disappeared = a.rescanOk === true || (a.ok === true && a.rescanOk !== false);
-    const corroborated = (a.testsRan === true && a.testsOk !== false) || a.pocOk === true;
-    return disappeared && !corroborated;
-  });
-
-  return {
-    total: d,
-    findingDisappeared,
-    testsStillPass,
-    verifierAgrees,
-    satisfiesAll,
-    aOnly,
-    meaning:
-      'findingDisappeared = the detector went quiet; testsStillPass = the project suite ran AND passed; '
-      + 'verifierAgrees = an independent PoC re-check confirmed the hole is shut. '
-      + 'aOnly counts attempts that satisfied ONLY disappearance — the shape a code-deleting "fix" produces.',
-    caveat: d === 0
-      ? 'no attempts recorded; every rate is 0/0 and means nothing'
-      : 'rates carry {n,d}; a small d is indicative, not settled',
-  };
-}
-
-/** Markdown for a report. Denominators always attached. */
-function renderFixAxes(sum) {
-  if (!sum || !sum.total) return '_No fix attempts recorded._\n';
-  const row = (label, r, note) => `| ${label} | ${r.n}/${r.d} | ${note} |`;
-  return [
-    '| Axis | Rate | Meaning |',
-    '|---|---|---|',
-    row('(a) finding disappeared', sum.findingDisappeared, 'the detector went quiet'),
-    row('(b) project tests pass', sum.testsStillPass, 'the suite RAN and passed'),
-    row('(c) verifier agrees', sum.verifierAgrees, 'an independent PoC re-check confirmed it'),
-    row('all three', sum.satisfiesAll, 'the only row that means "fixed"'),
-    row('(a) ALONE', sum.aOnly, 'satisfiable by deleting code — watch this number'),
-    '',
-  ].join('\n');
-}
-
-
-/***/ })
-
-};

package/dist/2530.index.js

@@ -1,152 +0,0 @@
-export const id = 2530;
-export const ids = [2530];
-export const modules = {
-
-/***/ 92530:
-/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
-
-/* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   verifyReleasePackage: () => (/* binding */ verifyReleasePackage)
-/* harmony export */ });
-/* unused harmony export MINIMUM_KINDS */
-/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(77598);
-// The verifier for a signed release assurance package (E7-03). Used by `scripts/verify-release-package.mjs` (a command-line wrapper) and by `release-view`.
-//
-// This file imports nothing but Node built-ins. It does not use the producer's code, so a defect in the producer cannot make it agree with itself. What it
-// checks, each reported under its own code:
-//   FORMAT      known schema, supported major version, no unknown top-level keys
-//   SIGNATURE   Ed25519 over the domain label plus the canonical JSON of everything but the signature, verified with the key the CALLER supplies; the key the
-//               package names must be the same key (a package cannot vouch for itself, and a signature lifted from another package does not verify)
-//   SNAPSHOT    the snapshot digest matches its fields
-//   EVIDENCE    every record matches the digest in its reference; every reference matches its own digest; every reference is bound to this snapshot
-//   LINEAGE     every dependency is present, there is no cycle, and the stated order is the dependency order
-//   MANDATORY   every kind in the verifier's own minimum, in the caller's --require list, and in the package's own list is present
-//   COMPLETE    the package may not claim a complete scan over a scan health that is not complete
-//   FINDINGS    each finding's proof tier and exploitability flag equal what the finding itself says
-//   ASSERTIONS  every cited record is in the package, and a "supported" statement cites at least one
-
-
-const MINIMUM_KINDS = Object.freeze(['scan-health', 'finding']);
-const SCHEMA = 'agentic-security/release-package';
-const DOMAIN = `${SCHEMA}@1\n`;
-const TOP_KEYS = new Set(['schema', 'schemaVersion', 'snapshot', 'evidence', 'lineageOrder', 'requiredKinds', 'findings', 'completeness', 'policy', 'assertions', 'proves', 'doesNotProve', 'issuance', 'signature']);
-const ROLES = new Set(['finding', 'completeness', 'context', 'control', 'inventory']);
-
-const canon = (v) => {
-  if (v === null || typeof v !== 'object') return JSON.stringify(v ?? null);
-  if (Array.isArray(v)) return `[${v.map(canon).join(',')}]`;
-  return `{${Object.keys(v).sort().map((k) => `${JSON.stringify(k)}:${canon(v[k])}`).join(',')}}`;
-};
-const digest = (v) => `sha256:${node_crypto__WEBPACK_IMPORTED_MODULE_0__.createHash('sha256').update(canon(v)).digest('hex')}`;
-const isObj = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
-
-function verifyReleasePackage(pkg, publicKeyPem, { require: extraRequired = [] } = {}) {
-  const errors = [];
-  const fail = (code, message) => errors.push({ code, message });
-  if (!isObj(pkg)) return { ok: false, errors: [{ code: 'FORMAT', message: 'the package is not an object' }] };
-  if (pkg.schema !== SCHEMA) fail('FORMAT', `unrecognised schema ${JSON.stringify(pkg.schema)}`);
-  const major = Number(String(pkg.schemaVersion).split('.')[0]);
-  if (major !== 1) fail('FORMAT', `unsupported version ${JSON.stringify(pkg.schemaVersion)}`);
-  for (const k of Object.keys(pkg)) if (!TOP_KEYS.has(k)) fail('FORMAT', `unrecognised top-level key "${k}", which the signature does not vouch for`);
-  if (errors.length) return { ok: false, errors };
-
-  // ---- SIGNATURE
-  const sig = pkg.signature;
-  let publicKey = null;
-  if (!publicKeyPem) fail('SIGNATURE', 'no public key was supplied');
-  else { try { publicKey = node_crypto__WEBPACK_IMPORTED_MODULE_0__.createPublicKey(publicKeyPem); } catch (e) { fail('SIGNATURE', `the public key is unusable: ${e.message}`); } }
-  if (!isObj(sig) || sig.algorithm !== 'ed25519' || typeof sig.value !== 'string') fail('SIGNATURE', 'the package is unsigned or uses an unsupported algorithm');
-  else if (publicKey) {
-    const { signature, ...rest } = pkg;
-    let ok = false;
-    try { ok = node_crypto__WEBPACK_IMPORTED_MODULE_0__.verify(null, Buffer.from(DOMAIN + canon(rest), 'utf8'), publicKey, Buffer.from(sig.value, 'base64')); } catch (e) { fail('SIGNATURE', `verification error: ${e.message}`); }
-    if (!ok && !errors.some((e) => e.code === 'SIGNATURE')) fail('SIGNATURE', 'the signature does not match the package contents: something changed after signing, or it was signed by another key');
-    const fp = node_crypto__WEBPACK_IMPORTED_MODULE_0__.createHash('sha256').update(publicKey.export({ type: 'spki', format: 'der' })).digest('hex');
-    const named = pkg.issuance && pkg.issuance.issuer && pkg.issuance.issuer.keyFingerprint;
-    if (named !== fp) fail('SIGNATURE', 'the key the package names is not the key supplied for verification');
-    if (!pkg.issuance || pkg.issuance.independentlyCertified !== false) fail('SIGNATURE', 'a self-issued package may not claim independent certification');
-  }
-
-  // ---- SNAPSHOT
-  const snap = pkg.snapshot;
-  if (!isObj(snap)) fail('SNAPSHOT', 'there is no snapshot');
-  else {
-    const { digest: d, immutable, ...body } = snap;
-    if (d !== digest(body)) fail('SNAPSHOT', 'the snapshot does not match its digest');
-    if (immutable !== (!!body.commit && body.dirty === false)) fail('SNAPSHOT', 'the snapshot\'s immutability flag is not what its fields imply');
-  }
-
-  // ---- EVIDENCE
-  const entries = Array.isArray(pkg.evidence) ? pkg.evidence : [];
-  if (!Array.isArray(pkg.evidence)) fail('EVIDENCE', 'evidence is not a list');
-  const byDigest = new Map();
-  for (const [i, e] of entries.entries()) {
-    if (!isObj(e) || !isObj(e.ref) || !('payload' in e)) { fail('EVIDENCE', `entry ${i} is malformed`); continue; }
-    if (!ROLES.has(e.role)) fail('EVIDENCE', `entry ${i} has an unknown role ${JSON.stringify(e.role)}`);
-    const { digest: rd, findingProvenanceDigest, otherProvenanceDigest, ...rb } = e.ref;
-    if (rd !== digest(rb)) fail('EVIDENCE', `the reference of entry ${i} (${e.ref.kind}) does not match its own digest`);
-    if (e.ref.payloadDigest !== digest(e.payload)) fail('EVIDENCE', `the ${e.ref.kind} record in entry ${i} does not match the digest in its reference`);
-    if (isObj(snap) && e.ref.snapshotDigest !== snap.digest) fail('EVIDENCE', `the ${e.ref.kind} record in entry ${i} describes a different snapshot`);
-    if (byDigest.has(e.ref.digest)) fail('EVIDENCE', `entry ${i} duplicates another reference`);
-    byDigest.set(e.ref.digest, e);
-  }
-
-  // ---- LINEAGE
-  for (const e of byDigest.values()) for (const dep of e.ref.restsOn || []) if (!byDigest.has(dep)) fail('LINEAGE', `${e.ref.kind} rests on a record that is not in the package (${String(dep).slice(0, 19)}...)`);
-  const state = new Map(); const order = [];
-  const visit = (d, trail) => {
-    if (state.get(d) === 2) return; if (state.get(d) === 1) { fail('LINEAGE', `cycle through ${trail.concat(d).map((x) => x.slice(7, 15)).join(' -> ')}`); return; }
-    state.set(d, 1);
-    for (const dep of (byDigest.get(d) || { ref: {} }).ref.restsOn || []) if (byDigest.has(dep)) visit(dep, trail.concat(d));
-    state.set(d, 2); order.push(d);
-  };
-  for (const d of [...byDigest.keys()].sort()) visit(d, []);
-  if (JSON.stringify(order) !== JSON.stringify(pkg.lineageOrder)) fail('LINEAGE', 'the stated order is not the dependency order');
-  if (JSON.stringify(entries.map((e) => e && e.ref && e.ref.digest)) !== JSON.stringify(pkg.lineageOrder)) fail('LINEAGE', 'the evidence list is not in the stated order');
-
-  // ---- MANDATORY
-  const kinds = new Set([...byDigest.values()].map((e) => e.ref.kind));
-  const needed = new Set([...MINIMUM_KINDS, ...extraRequired, ...(Array.isArray(pkg.requiredKinds) ? pkg.requiredKinds : [])]);
-  for (const k of MINIMUM_KINDS) if (!(Array.isArray(pkg.requiredKinds) && pkg.requiredKinds.includes(k))) fail('MANDATORY', `the package does not declare "${k}" as required`);
-  for (const k of [...needed].sort()) if (!kinds.has(k)) fail('MANDATORY', `required evidence is missing: ${k}`);
-
-  // ---- COMPLETE
-  const healthEntry = [...byDigest.values()].find((e) => e.ref.kind === 'scan-health');
-  const c = pkg.completeness;
-  if (!isObj(c)) fail('COMPLETE', 'there is no completeness statement');
-  else if (healthEntry) {
-    const hs = healthEntry.payload && healthEntry.payload.status;
-    if (c.scanStatus !== hs) fail('COMPLETE', `the package states scan status ${JSON.stringify(c.scanStatus)} but the scan health says ${JSON.stringify(hs)}`);
-    if (c.verdict === 'complete' && hs !== 'complete') fail('COMPLETE', 'the package claims a complete scan over a scan health that is not complete');
-    if (c.verdict !== 'complete' && hs === 'complete') fail('COMPLETE', 'the package calls an unfinished scan complete or the reverse: the verdict disagrees with the scan health');
-    if (JSON.stringify(c.conditions) !== JSON.stringify(Array.isArray(healthEntry.payload.conditions) ? healthEntry.payload.conditions : [])) fail('COMPLETE', 'the stated conditions differ from the scan health\'s own');
-    if (c.source !== healthEntry.ref.digest) fail('COMPLETE', 'the completeness statement cites a different scan health');
-  }
-
-  // ---- FINDINGS
-  const findingEntries = [...byDigest.values()].filter((e) => e.ref.kind === 'finding');
-  const listed = new Map((Array.isArray(pkg.findings) ? pkg.findings : []).map((f) => [f.findingRef, f]));
-  if (listed.size !== findingEntries.length) fail('FINDINGS', `the package lists ${listed.size} findings but contains ${findingEntries.length}`);
-  for (const e of findingEntries) {
-    const f = listed.get(e.ref.digest);
-    if (!f) { fail('FINDINGS', `finding ${e.ref.payloadId} is in the package but not in its findings summary`); continue; }
-    const tier = e.payload && typeof e.payload.proofTier === 'string' ? e.payload.proofTier : 'unproven';
-    if (f.proofTier !== tier) fail('FINDINGS', `finding ${e.ref.payloadId}: the summary says proof tier ${JSON.stringify(f.proofTier)} but the finding says ${JSON.stringify(tier)}`);
-    if (f.exploitabilityProven !== (tier === 'execution-proven')) fail('FINDINGS', `finding ${e.ref.payloadId}: exploitability is stated as proven without an execution proof`);
-    if (f.integrity !== 'unmodified-since-signing') fail('FINDINGS', `finding ${e.ref.payloadId}: unexpected integrity statement`);
-  }
-
-  // ---- ASSERTIONS
-  for (const a of Array.isArray(pkg.assertions) ? pkg.assertions : []) {
-    for (const d of a.evidence || []) if (!byDigest.has(d)) fail('ASSERTIONS', `assertion ${a.id} cites a record that is not in the package`);
-    if (a.status === 'supported' && !(a.evidence || []).length) fail('ASSERTIONS', `assertion ${a.id} is "supported" but cites nothing`);
-    if (!['supported', 'unsupported', 'unknown'].includes(a.status)) fail('ASSERTIONS', `assertion ${a.id} has an unknown status`);
-  }
-  return { ok: errors.length === 0, errors, issuer: pkg.issuance && pkg.issuance.issuer, completeness: isObj(c) ? c.verdict : null };
-}
-
-
-
-/***/ })
-
-};