@clear-capabilities/agentic-security-scanner 0.184.0 → 0.186.1

package/dist/4740.index.js

@@ -1,165 +0,0 @@
-export const id = 4740;
-export const ids = [4740];
-export const modules = {
-
-/***/ 4740:
-/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
-
-/* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   PROVENANCE_BUNDLE_SCHEMA: () => (/* binding */ PROVENANCE_BUNDLE_SCHEMA),
-/* harmony export */   buildProvenanceEvidenceBundle: () => (/* binding */ buildProvenanceEvidenceBundle),
-/* harmony export */   ensureKeyPair: () => (/* reexport safe */ _evidence_bundle_js__WEBPACK_IMPORTED_MODULE_1__.ensureKeyPair),
-/* harmony export */   signProvenanceEvidenceBundle: () => (/* binding */ signProvenanceEvidenceBundle),
-/* harmony export */   verifyProvenanceEvidenceBundle: () => (/* binding */ verifyProvenanceEvidenceBundle)
-/* harmony export */ });
-/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(77598);
-/* harmony import */ var _evidence_bundle_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(32876);
-// Signed provenance evidence bundles (Finding Provenance PRD, M4 §4.1).
-//
-// Sibling to posture/evidence-bundle.js, not a generalization of it — that
-// module's bundle shape (proofTier, taintPath, exploitability...) answers
-// "is this finding real"; this one answers "who/when introduced it, how
-// sure are we." Forcing one shape to cover both would leave half of every
-// bundle null. Same four-function pattern (build/sign/verify + a schema
-// string + a top-level-key allowlist), same Ed25519 key material — reused,
-// not reimplemented.
-//
-// The allowlisted fields mirror provenance/coordinator.js's own
-// computeDigest() material EXACTLY (stableId, findingOrigin.commit,
-// branchIntroduction.commit, evidenceAttribution role:path:line:commit
-// strings, method, confidence.reasons, limitations) plus repo/HEAD identity
-// (not in computeDigest's material, since that digest never leaves the repo
-// it was computed in, but a bundle does). Everything here is copied from
-// what findingProvenance already computed. Nothing is inferred.
-//
-// canonicalJson vs canonicalBytes — resolved before writing this file
-// -------------------------------------------------------------------
-// evidence-bundle.js exports TWO canonicalisation helpers, not one, and they
-// are not interchangeable. `canonicalJson(value)` is a pure, shape-agnostic
-// deterministic serialiser (sorted keys at every level, order-preserving
-// arrays) — safe to reuse for any bundle shape. `canonicalBytes(bundle)`
-// is NOT generic: it hardcodes evidence-bundle.js's own six top-level keys
-// (`schema, finding, evidence, engine, proves, doesNotProve`) when building
-// the object it signs. Reusing `canonicalBytes` here would silently sign a
-// filtered object missing this module's `repo` and `provenance` fields
-// (and would read `bundle.evidence`, which a provenance bundle never has) —
-// exactly the EA-03 failure mode the allowlist check below exists to catch,
-// just introduced from the signing side instead of the verifying side. So
-// this module imports the generic `canonicalJson` (as the brief's Step 1
-// sketch already did) and signs `canonicalJson(bundle)` directly, since
-// `buildProvenanceEvidenceBundle` never puts anything on the unsigned
-// object beyond this module's own allowlisted fields.
-
-
-
-
-const PROVENANCE_BUNDLE_SCHEMA = 'agentic-security/provenance-evidence@1';
-
-const PROVES = 'This bundle\'s contents are exactly what was signed at attestation time.';
-const DOES_NOT_PROVE = 'This bundle does NOT prove the origin commit is correctly identified — read confidence.level and limitations for that. It proves the RECORD is unmodified, not that the record is right.';
-
-/**
- * Build an unsigned provenance bundle from one finding's findingProvenance.
- * Returns null for a finding with no findingProvenance at all (nothing to
- * attest) — this is a caller error (attest a scan before its provenance
- * pass ran), not a case to paper over with an empty bundle.
- */
-function buildProvenanceEvidenceBundle(finding, { engineVersion, repoIdentity, head } = {}) {
-  if (!finding || typeof finding !== 'object') return null;
-  const fp = finding.findingProvenance;
-  if (!fp || typeof fp !== 'object') return null;
-  return {
-    schema: PROVENANCE_BUNDLE_SCHEMA,
-    finding: {
-      id: finding.id ?? null,
-      stableId: finding.stableId ?? null,
-    },
-    repo: {
-      identity: repoIdentity ?? null,
-      head: head ?? fp.analysisBasis?.head ?? null,
-    },
-    provenance: {
-      status: fp.status ?? null,
-      findingOrigin: fp.findingOrigin
-        ? {
-            commit: fp.findingOrigin.commit ?? null,
-            authorName: fp.findingOrigin.authorName ?? null,
-            authorDate: fp.findingOrigin.authorDate ?? null,
-            summary: fp.findingOrigin.summary ?? null,
-          }
-        : null,
-      branchIntroduction: fp.branchIntroduction
-        ? { commit: fp.branchIntroduction.commit ?? null, branch: fp.branchIntroduction.branch ?? null }
-        : null,
-      evidenceAttribution: (fp.evidenceAttribution || []).map((n) => ({
-        role: n.role ?? null, path: n.path ?? null, line: n.line ?? null, commit: n.commit ?? null,
-      })),
-      method: fp.method ?? null,
-      confidence: fp.confidence
-        ? { level: fp.confidence.level ?? null, score: fp.confidence.score ?? null, reasons: fp.confidence.reasons || [] }
-        : null,
-      limitations: fp.limitations || [],
-      // M4 §4.2 final-review fix: this module was written (Task 1) before
-      // the cross-repo lineage feature existed (Task 5), so a
-      // cross-repo-resolved origin's boundary-crossing marker was dropped
-      // from the signed bundle — a foreign repository's commit SHA and a
-      // real author name, with no MACHINE-READABLE signal that the origin
-      // crossed a repository boundary (only the prose in `limitations`
-      // said so, and a programmatic verifier does not read prose). Nested
-      // under `provenance` alongside the fields above, so it is part of
-      // what gets signed — never a new top-level key.
-      historyCoverage: { crossRepoLineage: fp.historyCoverage?.crossRepoLineage ?? false },
-    },
-    engine: { engineVersion: engineVersion ?? null },
-    proves: PROVES,
-    doesNotProve: DOES_NOT_PROVE,
-  };
-}
-
-function signProvenanceEvidenceBundle(bundle, privateKeyPem) {
-  const sig = node_crypto__WEBPACK_IMPORTED_MODULE_0__.sign(null, Buffer.from((0,_evidence_bundle_js__WEBPACK_IMPORTED_MODULE_1__/* .canonicalJson */ .dj)(bundle), 'utf8'), privateKeyPem);
-  return {
-    ...bundle,
-    signature: { algorithm: 'ed25519', canonicalisation: PROVENANCE_BUNDLE_SCHEMA, value: sig.toString('base64') },
-  };
-}
-
-const PROVENANCE_BUNDLE_TOP_LEVEL_KEYS = new Set([
-  'schema', 'finding', 'repo', 'provenance', 'engine', 'proves', 'doesNotProve', 'signature',
-]);
-
-/**
- * Verify with a PUBLIC key only. Rejects any top-level key outside the
- * allowlist BEFORE checking the signature — same EA-03 fix evidence-bundle.js
- * carries: a signature only covers the bytes it was computed over, so an
- * unknown key stapled on after signing would otherwise verify as authentic.
- */
-function verifyProvenanceEvidenceBundle(bundle, publicKeyPem) {
-  if (!bundle || typeof bundle !== 'object') return { ok: false, reason: 'bundle is not an object' };
-  if (bundle.schema !== PROVENANCE_BUNDLE_SCHEMA) return { ok: false, reason: `unrecognised schema: ${bundle.schema}` };
-  const unknownKeys = Object.keys(bundle).filter((k) => !PROVENANCE_BUNDLE_TOP_LEVEL_KEYS.has(k));
-  if (unknownKeys.length) {
-    return { ok: false, reason: `unrecognised top-level key(s) not covered by the signature: ${unknownKeys.join(', ')}` };
-  }
-  const sig = bundle.signature;
-  if (!sig?.value) return { ok: false, reason: 'bundle is unsigned' };
-  if (sig.algorithm !== 'ed25519') return { ok: false, reason: `unsupported algorithm: ${sig.algorithm}` };
-  if (!publicKeyPem) return { ok: false, reason: 'no public key supplied' };
-  const { signature, ...unsigned } = bundle;
-  let ok = false;
-  try {
-    ok = node_crypto__WEBPACK_IMPORTED_MODULE_0__.verify(null, Buffer.from((0,_evidence_bundle_js__WEBPACK_IMPORTED_MODULE_1__/* .canonicalJson */ .dj)(unsigned), 'utf8'), publicKeyPem, Buffer.from(sig.value, 'base64'));
-  } catch (e) {
-    return { ok: false, reason: `verification error: ${e.message}` };
-  }
-  return ok
-    ? { ok: true, reason: null }
-    : { ok: false, reason: 'signature does not match the bundle contents — it was modified after signing' };
-}
-
-
-
-
-/***/ })
-
-};

package/dist/4780.index.js

@@ -1,209 +0,0 @@
-export const id = 4780;
-export const ids = [4780];
-export const modules = {
-
-/***/ 44780:
-/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
-
-/* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   iI: () => (/* binding */ summarizeForBadge),
-/* harmony export */   renderBadge: () => (/* binding */ renderBadge)
-/* harmony export */ });
-/* unused harmony exports badgeFromScanRoot, renderSvg, _internal */
-/* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(73024);
-/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(76760);
-/* harmony import */ var _posture_state_dir_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(69259);
-// Live SVG badge generator (v0.72).
-//
-// Every repo can drop a badge in its README pulling from the latest scan:
-//
-//   ![agentic-security](https://agentic-security.dev/badge?repo=<slug>)
-//
-// or self-hosted via the CLI subcommand emitting an inline <img> URL or
-// a static SVG. The badge format borrows from shields.io for visual
-// consistency. Reads from .agentic-security/last-scan.json or accepts a
-// scan object directly.
-//
-// Output formats:
-//   - 'svg'  — inline SVG string (default; the bytes you'd serve)
-//   - 'json' — { label, count, color, severity } for a frontend renderer
-//
-// Style variants:
-//   - 'flat'         — shields.io flat
-//   - 'for-the-badge' — caps + thicker
-//
-// Color is driven by the highest non-zero severity:
-//   critical → red
-//   high     → orange
-//   medium   → yellow
-//   low      → blue
-//   info     → lightgrey
-//   none     → brightgreen
-
-
-
-
-
-const COLORS = {
-  critical:    '#e05d44',  // red
-  high:        '#fe7d37',  // orange
-  medium:      '#dfb317',  // yellow
-  low:         '#007ec6',  // blue
-  info:        '#9f9f9f',  // grey
-  none:        '#4c1',     // brightgreen
-  label:       '#555',
-};
-
-const SEVERITIES = ['critical', 'high', 'medium', 'low', 'info'];
-
-function _readLastScan(scanRoot) {
-  if (!scanRoot) return null;
-  const fp = (0,_posture_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.statePath)(scanRoot, 'last-scan.json');
-  if (!node_fs__WEBPACK_IMPORTED_MODULE_0__.existsSync(fp)) return null;
-  try { return JSON.parse(node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(fp, 'utf8')); }
-  catch { return null; }
-}
-
-function _ageString(ts) {
-  if (!ts) return null;
-  const ageMs = Date.now() - new Date(ts).getTime();
-  if (isNaN(ageMs) || ageMs < 0) return null;
-  const min = Math.floor(ageMs / 60_000);
-  if (min < 60) return `${min}m ago`;
-  const hr = Math.floor(min / 60);
-  if (hr < 24) return `${hr}h ago`;
-  const day = Math.floor(hr / 24);
-  return `${day}d ago`;
-}
-
-/**
- * Compute the badge value from a scan object.
- *
- * Returns:
- *   {
- *     label:    'agentic-security',
- *     summary:  'critical 0 · high 2 · medium 5' | 'passing' | 'no scan',
- *     color:    '#fe7d37',
- *     highest:  'high' | 'none' | 'unknown',
- *     ageStr:   '4h ago' | null,
- *     counts:   { critical, high, medium, low, info },
- *     total:    7,
- *   }
- */
-function summarizeForBadge(scan) {
-  if (!scan || !Array.isArray(scan.findings)) {
-    return {
-      label: 'agentic-security',
-      summary: 'no scan',
-      color: COLORS.info,
-      highest: 'unknown',
-      ageStr: null,
-      counts: { critical: 0, high: 0, medium: 0, low: 0, info: 0 },
-      total: 0,
-    };
-  }
-  const counts = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
-  for (const f of scan.findings) {
-    const s = f.severity || 'info';
-    if (counts[s] !== undefined) counts[s]++;
-  }
-  let highest = 'none';
-  for (const s of SEVERITIES) { if (counts[s] > 0) { highest = s; break; } }
-  const color = COLORS[highest] || COLORS.info;
-  const summary = highest === 'none'
-    ? 'passing'
-    : `crit ${counts.critical} · high ${counts.high} · med ${counts.medium}`;
-  const total = SEVERITIES.reduce((a, s) => a + counts[s], 0);
-  return {
-    label: 'agentic-security',
-    summary,
-    color,
-    highest,
-    ageStr: _ageString(scan.timestamp || scan.when || scan.lastScan),
-    counts,
-    total,
-  };
-}
-
-/**
- * Compute the badge from .agentic-security/last-scan.json under `scanRoot`.
- */
-function badgeFromScanRoot(scanRoot) {
-  return summarizeForBadge(_readLastScan(scanRoot));
-}
-
-function _xmlEscape(s) {
-  return String(s).replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
-}
-
-function _textWidth(s) {
-  // Rough character width — works fine for the small badge label range.
-  return s.length * 7 + 10;
-}
-
-/**
- * Render an inline SVG matching shields.io's flat style. Self-contained
- * (no external font references) so the badge works in any README.
- */
-function renderSvg(b, opts = {}) {
-  if (!b) b = summarizeForBadge(null);
-  const style = opts.style || 'flat';
-  const labelText = b.label;
-  const valueText = b.ageStr ? `${b.summary} · ${b.ageStr}` : b.summary;
-  const lblW = _textWidth(labelText);
-  const valW = _textWidth(valueText);
-  const totalW = lblW + valW;
-  const h = style === 'for-the-badge' ? 28 : 20;
-  const fontSize = style === 'for-the-badge' ? 12 : 11;
-  return `<svg xmlns="http://www.w3.org/2000/svg" width="${totalW}" height="${h}" role="img" aria-label="${_xmlEscape(labelText)}: ${_xmlEscape(valueText)}">
-  <title>${_xmlEscape(labelText)}: ${_xmlEscape(valueText)}</title>
-  <linearGradient id="s" x2="0" y2="100%">
-    <stop offset="0" stop-color="#bbb" stop-opacity=".1"/>
-    <stop offset="1" stop-opacity=".1"/>
-  </linearGradient>
-  <clipPath id="r"><rect width="${totalW}" height="${h}" rx="3" fill="#fff"/></clipPath>
-  <g clip-path="url(#r)">
-    <rect width="${lblW}" height="${h}" fill="${COLORS.label}"/>
-    <rect x="${lblW}" width="${valW}" height="${h}" fill="${b.color}"/>
-    <rect width="${totalW}" height="${h}" fill="url(#s)"/>
-  </g>
-  <g fill="#fff" text-anchor="middle" font-family="Verdana,Geneva,DejaVu Sans,sans-serif" font-size="${fontSize}">
-    <text aria-hidden="true" x="${lblW / 2}" y="${h - 6}" fill="#010101" fill-opacity=".3">${_xmlEscape(labelText)}</text>
-    <text x="${lblW / 2}" y="${h - 7}">${_xmlEscape(labelText)}</text>
-    <text aria-hidden="true" x="${lblW + valW / 2}" y="${h - 6}" fill="#010101" fill-opacity=".3">${_xmlEscape(valueText)}</text>
-    <text x="${lblW + valW / 2}" y="${h - 7}">${_xmlEscape(valueText)}</text>
-  </g>
-</svg>`;
-}
-
-/**
- * Public entry: produce the badge in the requested format.
- *
- *   format: 'svg' (default) | 'json'
- *   style:  'flat' (default) | 'for-the-badge'
- *   scanRoot: directory containing .agentic-security/last-scan.json
- *   scan: pre-loaded scan object (skips disk read)
- */
-function renderBadge({ format = 'svg', style = 'flat', scanRoot, scan } = {}) {
-  const summary = summarizeForBadge(scan || _readLastScan(scanRoot));
-  if (format === 'json') {
-    return JSON.stringify({
-      schemaVersion: 1,
-      label: summary.label,
-      message: summary.summary,
-      color: summary.color,
-      highest: summary.highest,
-      ageStr: summary.ageStr,
-      counts: summary.counts,
-      total: summary.total,
-    });
-  }
-  return renderSvg(summary, { style });
-}
-
-const _internal = { COLORS, _ageString, _readLastScan };
-
-
-/***/ })
-
-};

package/dist/4802.index.js

@@ -1,225 +0,0 @@
-export const id = 4802;
-export const ids = [4802];
-export const modules = {
-
-/***/ 94802:
-/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
-
-/* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   OBLIGATION_EVIDENCE_PACK_SCHEMA: () => (/* binding */ OBLIGATION_EVIDENCE_PACK_SCHEMA),
-/* harmony export */   buildObligationEvidencePack: () => (/* binding */ buildObligationEvidencePack),
-/* harmony export */   ensureKeyPair: () => (/* reexport safe */ _evidence_bundle_js__WEBPACK_IMPORTED_MODULE_0__.ensureKeyPair),
-/* harmony export */   signObligationEvidencePack: () => (/* binding */ signObligationEvidencePack),
-/* harmony export */   verifyObligationEvidencePack: () => (/* binding */ verifyObligationEvidencePack)
-/* harmony export */ });
-/* harmony import */ var _evidence_bundle_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(32876);
-/* harmony import */ var _evidence_grade_wording_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(51128);
-/* harmony import */ var _lineage_export_json_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(63406);
-/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(77598);
-// obligation-evidence-pack.js — Milestone 4 sub-project 6c: signed,
-// versioned evidence packs for a Regulatory Obligation Overlay framework
-// evaluation (FR-504, PRD §10.10). Fourth sibling in the
-// evidence-bundle.js family — see that module's own header for the
-// shared-key rationale, and provenance-evidence-bundle.js for the most
-// directly mirrored precedent (same reused ensureKeyPair/keyPaths/
-// canonicalJson, own schema string, own build/sign/verify trio, own
-// top-level-key allowlist).
-//
-// WHAT THIS IS NOT
-// -----------------
-// Not a reuse of evidence-bundle.js's own bundle shape (that's a single
-// FINDING's evidence — proofTier/taintPath/etc; this artifact has no
-// finding at all). Not compliance-evidence-signing.js's ComplianceEvidence
-// manifest either — that signs the pre-existing family:/module:/rule:-
-// driven present/partial/absent/manual walkthrough status; this signs the
-// newer, additive graph: mapping type's own real ObligationMapping
-// records (evaluateGraphFlowPredicate/buildObligationMappingFromGraphPredicate,
-// sub-project 6b) — a distinct FR-504 artifact with its own field list
-// (scope, framework versions, facts, evidence index, unknown/manual
-// items, accepted exceptions, scan health, limitations, graph digest,
-// reproducibility metadata).
-//
-// THE EVIDENCE-INDEX DESIGN DECISION (see the scoping doc for the full
-// writeup)
-// -----------------------------------------------------------------
-// A real ObligationMapping record's own `evidence[]` is structurally
-// always empty today (graph-builder.js hardcodes `edge.evidenceRefs: []`
-// on every minted edge, disclosed in obligation-predicates.js's own
-// header). Rather than ship an evidence pack whose "evidence index" is
-// honestly, permanently empty, this module builds a REAL evidence index
-// from each fact's own `contributingGraphIds` (real flow ids
-// evaluateGraphFlowPredicate already returns) — resolving each flow id
-// back into a small, real summary (source/sink kind, dataElement
-// dataClasses, the edge's own transit/atRest/handling verdicts) by
-// joining against the graph's own entity arrays. `record.evidence` is
-// still carried through verbatim on each fact (honest, even though
-// empty) — the evidence index is an ADDITIONAL section built from data
-// that genuinely IS populated, not a replacement that hides the gap.
-
-
-
-
-
-
-const OBLIGATION_EVIDENCE_PACK_SCHEMA = 'agentic-security/obligation-evidence-pack@1';
-
-function _asArray(v) {
-  return Array.isArray(v) ? v : [];
-}
-
-/**
- * Resolve one ObligationMapping fact's contributingGraphIds (real flow
- * ids) into a small, real, human-and-machine-readable summary per flow —
- * the evidence index's own per-fact contribution. Never throws: a flow id
- * that no longer resolves against this graph (a stale pack re-evaluated
- * against a newer graph, or a malformed fact) is simply skipped, not
- * fabricated.
- */
-function _resolveEvidenceForFact(fact, joins) {
-  const { flowsById, nodesById, edgesById, dataElementsById } = joins;
-  const flowIds = _asArray(fact?.contributingGraphIds);
-  const resolved = [];
-  for (const flowId of flowIds) {
-    const flow = flowsById.get(flowId);
-    if (!flow) continue;
-    const sourceNode = nodesById.get(flow.source);
-    const sinkNode = nodesById.get(flow.sink);
-    // Reads only edgeIds[0] — mirrors obligation-predicates.js's own
-    // disclosed, currently-unreachable limitation (graph-builder.js always
-    // mints single-edge flows; see that module's own header) rather than
-    // inventing a different convention for the same case here.
-    const edge = edgesById.get(_asArray(flow.edgeIds)[0]);
-    const dataClasses = _asArray(flow.dataElementIds)
-      .map((id) => dataElementsById.get(id))
-      .filter(Boolean)
-      .flatMap((d) => _asArray(d.dataClasses));
-    resolved.push({
-      flowId,
-      source: sourceNode ? { kind: sourceNode.kind ?? null, subtype: sourceNode.subtype ?? null } : null,
-      sink: sinkNode ? { kind: sinkNode.kind ?? null, subtype: sinkNode.subtype ?? null } : null,
-      dataClasses: [...new Set(dataClasses)],
-      transitVerdict: edge?.protection?.transit?.verdict ?? null,
-      atRestVerdict: edge?.protection?.atRest?.verdict ?? null,
-      handlingVerdict: edge?.protection?.handling?.verdict ?? null,
-    });
-  }
-  return resolved;
-}
-
-function _buildJoins(graph) {
-  return {
-    flowsById: new Map(_asArray(graph?.flows).filter(Boolean).map((f) => [f.id, f])),
-    nodesById: new Map(_asArray(graph?.nodes).filter(Boolean).map((n) => [n.id, n])),
-    edgesById: new Map(_asArray(graph?.edges).filter(Boolean).map((e) => [e.id, e])),
-    dataElementsById: new Map(_asArray(graph?.dataElements).filter(Boolean).map((d) => [d.id, d])),
-  };
-}
-
-/**
- * Build an unsigned evidence pack from a framework evaluation. Never
- * throws: every field degrades honestly on missing input rather than
- * fabricating a value — a null/absent graph yields empty facts/
- * evidenceIndex and a null graphDigest/scope, never a guess.
- *
- * @param {object} args
- * @param {object|null} args.graph - the scan's DataFlowGraph v1 document (scan.lineageGraph), or null
- * @param {object} args.framework - the loaded framework object (auditor-walkthrough.js#loadFramework's return)
- * @param {Array}  args.evaluation - auditor-walkthrough.js#evaluateFramework's return (per-control entries, each carrying .obligationMappings)
- * @param {object|null} [args.scanHealth] - scan.scanHealth, passed through verbatim; null if not supplied, never fabricated
- * @param {string|null} [args.engineVersion]
- * @param {string|null} [args.rulesetVersion]
- * @param {string|null} [args.bundleSha]
- * @param {string} [args.generatedAt] - defaults to new Date().toISOString()
- */
-function buildObligationEvidencePack({
-  graph, framework, evaluation, scanHealth, engineVersion, rulesetVersion, bundleSha, generatedAt,
-} = {}) {
-  const facts = _asArray(evaluation).flatMap((e) => _asArray(e?.obligationMappings));
-  const joins = _buildJoins(graph);
-  const evidenceIndex = facts.map((fact) => ({
-    obligationId: fact?.id ?? null,
-    requirementId: fact?.requirementId ?? null,
-    evidence: _resolveEvidenceForFact(fact, joins),
-  }));
-
-  return {
-    schema: OBLIGATION_EVIDENCE_PACK_SCHEMA,
-    framework: {
-      id: framework?.id ?? null,
-      name: framework?.name ?? null,
-      version: framework?.controlsDigest ?? null,
-      publisher: framework?.publisher ?? null,
-      url: framework?.url ?? null,
-    },
-    scope: graph?.scope ?? null,
-    facts,
-    evidenceIndex,
-    unknownItems: facts.filter((f) => f?.state === 'unknown'),
-    manualItems: facts.filter((f) => f?.state === 'manual_required'),
-    acceptedExceptions: facts.filter((f) => f?.state === 'accepted_exception'),
-    scanHealth: scanHealth ?? null,
-    limitations: _asArray(graph?.limitations),
-    graphDigest: graph ? (0,_lineage_export_json_js__WEBPACK_IMPORTED_MODULE_2__.computeGraphDigest)(graph) : null,
-    reproducibility: {
-      graphId: graph?.graphId ?? null,
-      graphDigest: graph ? (0,_lineage_export_json_js__WEBPACK_IMPORTED_MODULE_2__.computeGraphDigest)(graph) : null,
-      engineVersion: engineVersion ?? null,
-      rulesetVersion: rulesetVersion ?? null,
-      bundleSha: bundleSha ?? null,
-      generatedAt: generatedAt ?? new Date().toISOString(),
-    },
-    disclaimer: _evidence_grade_wording_js__WEBPACK_IMPORTED_MODULE_1__/* .EVIDENCE_GRADE_DISCLAIMER */ .ux,
-  };
-}
-
-/** Sign a pack. Returns a new object; the input is not mutated. */
-function signObligationEvidencePack(pack, privateKeyPem) {
-  const sig = node_crypto__WEBPACK_IMPORTED_MODULE_3__.sign(null, Buffer.from((0,_evidence_bundle_js__WEBPACK_IMPORTED_MODULE_0__/* .canonicalJson */ .dj)(pack), 'utf8'), privateKeyPem);
-  return {
-    ...pack,
-    signature: { algorithm: 'ed25519', canonicalisation: OBLIGATION_EVIDENCE_PACK_SCHEMA, value: sig.toString('base64') },
-  };
-}
-
-const OBLIGATION_EVIDENCE_PACK_TOP_LEVEL_KEYS = new Set([
-  'schema', 'framework', 'scope', 'facts', 'evidenceIndex', 'unknownItems',
-  'manualItems', 'acceptedExceptions', 'scanHealth', 'limitations',
-  'graphDigest', 'reproducibility', 'disclaimer', 'signature',
-]);
-
-/**
- * Verify with a PUBLIC key only. Rejects any top-level key outside the
- * allowlist BEFORE checking the signature — same EA-03 discipline every
- * sibling in this family carries: a signature only covers the bytes it
- * was computed over, so a key stapled on after signing would otherwise
- * verify as authentic.
- */
-function verifyObligationEvidencePack(pack, publicKeyPem) {
-  if (!pack || typeof pack !== 'object') return { ok: false, reason: 'pack is not an object' };
-  if (pack.schema !== OBLIGATION_EVIDENCE_PACK_SCHEMA) return { ok: false, reason: `unrecognised schema: ${pack.schema}` };
-  const unknownKeys = Object.keys(pack).filter((k) => !OBLIGATION_EVIDENCE_PACK_TOP_LEVEL_KEYS.has(k));
-  if (unknownKeys.length) {
-    return { ok: false, reason: `unrecognised top-level key(s) not covered by the signature: ${unknownKeys.join(', ')}` };
-  }
-  const sig = pack.signature;
-  if (!sig?.value) return { ok: false, reason: 'pack is unsigned' };
-  if (sig.algorithm !== 'ed25519') return { ok: false, reason: `unsupported algorithm: ${sig.algorithm}` };
-  if (!publicKeyPem) return { ok: false, reason: 'no public key supplied' };
-  const { signature, ...unsigned } = pack;
-  let ok = false;
-  try {
-    ok = node_crypto__WEBPACK_IMPORTED_MODULE_3__.verify(null, Buffer.from((0,_evidence_bundle_js__WEBPACK_IMPORTED_MODULE_0__/* .canonicalJson */ .dj)(unsigned), 'utf8'), publicKeyPem, Buffer.from(sig.value, 'base64'));
-  } catch (e) {
-    return { ok: false, reason: `verification error: ${e.message}` };
-  }
-  return ok
-    ? { ok: true, reason: null }
-    : { ok: false, reason: 'signature does not match the pack contents — it was modified after signing' };
-}
-
-
-
-
-/***/ })
-
-};