@clear-capabilities/agentic-security-scanner 0.185.0 → 0.186.1

package/dist/9981.index.js

@@ -1,206 +0,0 @@
-export const id = 9981;
-export const ids = [9981];
-export const modules = {
-
-/***/ 89981:
-/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
-
-/* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   buildBaselineMap: () => (/* binding */ buildBaselineMap),
-/* harmony export */   computeMTTR: () => (/* binding */ computeMTTR),
-/* harmony export */   fingerprintFinding: () => (/* binding */ fingerprintFinding),
-/* harmony export */   renderSlaSummary: () => (/* binding */ renderSlaSummary),
-/* harmony export */   stampFindingTimestamps: () => (/* binding */ stampFindingTimestamps)
-/* harmony export */ });
-/* unused harmony export findingsExceedingSLA */
-/* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(77598);
-/* harmony import */ var _provenance_schema_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(49171);
-// 0.8.0 Feat-11: MTTR / finding-age tracking — per-finding firstSeenAt/lastSeenAt with SLA breach detection.
-//
-// Stamps every finding with `firstSeenAt` (preserved from the baseline if the
-// finding existed previously) and `lastSeenAt` (the current scan time). Surfaces
-// findings exceeding an SLA threshold per severity.
-//
-// Pure function — does not write to disk. The caller (CLI / fix workflow) decides
-// when to persist firstSeenAt back into the baseline.
-
-
-
-
-// FR-PROV-019: "reports never show an age without its basis and confidence."
-// FINDING_ORIGIN is the only basis backed by a resolved git commit for the
-// finding's actual introduction; EARLIEST_OBSERVABLE is also git-derived but
-// partial (weaker claim, no exact introduction commit). UNCOMMITTED and
-// FIRST_OBSERVED are both wall-clock fallbacks — the age is a first-seen
-// timestamp, never resolved against git history — and must say so honestly
-// rather than read like a proven date.
-function _ageBasisLabel(ageBasis, confidence) {
-  const level = confidence?.level && confidence.level !== 'unknown' ? confidence.level.toUpperCase() : null;
-  switch (ageBasis) {
-    case _provenance_schema_js__WEBPACK_IMPORTED_MODULE_1__/* .AGE_BASIS */ .pI.FINDING_ORIGIN:
-      return `proven origin${level ? `, ${level} confidence` : ''}`;
-    case _provenance_schema_js__WEBPACK_IMPORTED_MODULE_1__/* .AGE_BASIS */ .pI.EARLIEST_OBSERVABLE:
-      return `earliest observable commit, partial history${level ? `, ${level} confidence` : ''}`;
-    case _provenance_schema_js__WEBPACK_IMPORTED_MODULE_1__/* .AGE_BASIS */ .pI.UNCOMMITTED:
-      return 'uncommitted — first-seen fallback, origin not proven';
-    case _provenance_schema_js__WEBPACK_IMPORTED_MODULE_1__/* .AGE_BASIS */ .pI.FIRST_OBSERVED:
-    default:
-      return 'first-seen fallback — origin not proven';
-  }
-}
-
-// Stable fingerprint for cross-scan finding identity. Mirrors the dedupe key.
-// Exported so a caller can compute the "removed since baseline" (i.e. fixed)
-// set that computeMTTR needs, using the exact same identity function
-// buildBaselineMap uses internally — a caller-side reimplementation would
-// risk drifting from this one and silently under/over-counting fixes.
-function fingerprintFinding(f) { return _fingerprint(f); }
-function _fingerprint(f) {
-  const file = (f.file || '').split(' -> ').pop();
-  const line = f.line || f.source?.line || f.sink?.line || 0;
-  const vuln = (f.vuln || f.type || '').replace(/\W+/g, '_').toLowerCase();
-  const cwe = (f.cwe || '').toUpperCase();
-  return node_crypto__WEBPACK_IMPORTED_MODULE_0__.createHash('sha256').update(`${file}:${line}:${vuln}:${cwe}`).digest('hex').slice(0, 16);
-}
-
-// Stamp findings in-place with firstSeenAt / lastSeenAt / ageDays.
-// `findings` — current scan findings (will be mutated).
-// `baselineMap` — optional Map of fingerprint → { firstSeenAt }. Pass an empty Map for first run.
-// `now` — Date.now() at scan time (allow injection for tests).
-function stampFindingTimestamps(findings, baselineMap = new Map(), now = Date.now()) {
-  const nowIso = new Date(now).toISOString();
-  for (const f of findings) {
-    const fp = _fingerprint(f);
-    f._fp = fp;
-    const prev = baselineMap.get(fp);
-    f.firstSeenAt = prev?.firstSeenAt || nowIso;
-    f.lastSeenAt = nowIso;
-    const firstMs = Date.parse(f.firstSeenAt);
-    f.ageDays = Math.max(0, Math.floor((now - firstMs) / 86400000));
-    // FR-PROV-019: age/SLA basis. ageDays above stays pure wall-clock —
-    // every existing SLA/computeMTTR consumer keeps its current meaning.
-    // ageBasis + provenAgeDays are ADDITIVE: a report can show both and
-    // explain the discrepancy, never silently swap which number "age" means.
-    const status = f.findingProvenance?.status;
-    const origin = f.findingProvenance?.findingOrigin;
-    if (status === 'complete' && origin?.authorDate) {
-      f.ageBasis = _provenance_schema_js__WEBPACK_IMPORTED_MODULE_1__/* .AGE_BASIS */ .pI.FINDING_ORIGIN;
-      f.provenAgeDays = Math.max(0, Math.floor((now - Date.parse(origin.authorDate)) / 86400000));
-    } else if (status === 'partial' && origin?.authorDate) {
-      f.ageBasis = _provenance_schema_js__WEBPACK_IMPORTED_MODULE_1__/* .AGE_BASIS */ .pI.EARLIEST_OBSERVABLE;
-      f.provenAgeDays = Math.max(0, Math.floor((now - Date.parse(origin.authorDate)) / 86400000));
-    } else if (status === 'uncommitted') {
-      f.ageBasis = _provenance_schema_js__WEBPACK_IMPORTED_MODULE_1__/* .AGE_BASIS */ .pI.UNCOMMITTED;
-      f.provenAgeDays = f.ageDays;
-    } else {
-      f.ageBasis = _provenance_schema_js__WEBPACK_IMPORTED_MODULE_1__/* .AGE_BASIS */ .pI.FIRST_OBSERVED;
-      f.provenAgeDays = f.ageDays;
-    }
-  }
-  return findings;
-}
-
-// Build a baseline map from an existing baseline JSON (or scan JSON shape).
-// Recognised top-level: { findings, secrets, supplyChain }. Each entry retains
-// firstSeenAt if it had one previously.
-function buildBaselineMap(baselineJson) {
-  const map = new Map();
-  const all = [
-    ...(baselineJson?.findings || []),
-    ...(baselineJson?.secrets || []),
-    ...(baselineJson?.supplyChain || []).filter(s => s.type === 'vulnerable_dep'),
-  ];
-  for (const f of all) {
-    const fp = _fingerprint(f);
-    if (f.firstSeenAt) map.set(fp, { firstSeenAt: f.firstSeenAt });
-  }
-  return map;
-}
-
-// Identify findings exceeding an SLA threshold.
-// slaDays: { critical: 7, high: 30, medium: 60, low: 90, info: 180 } (default).
-function findingsExceedingSLA(findings, slaDays = null) {
-  const SLA = slaDays || { critical: 7, high: 30, medium: 60, low: 90, info: 180 };
-  return findings.filter(f => {
-    const limit = SLA[f.severity] ?? 90;
-    return (f.ageDays || 0) > limit;
-  });
-}
-
-// Median age (days) of the currently-open findings, PLUS the ageBasis/
-// confidence of whichever finding landed on that median — a single-scan proxy
-// for "how long has this debt been sitting". True MTTR (computeMTTR) needs the
-// set of findings that were FIXED; this reports the open backlog's median age
-// so a scan can show whether debt is getting older. Returns null on empty
-// input. Local — surfaced only through renderSlaSummary (its sole consumer).
-//
-// FR-PROV-019: the days figure prefers `provenAgeDays` (git-derived when
-// available) over the pure-wall-clock `ageDays`, and the ageBasis/confidence
-// travel WITH the day count they describe — never a bare number with the
-// basis looked up separately, which is how the original miss happened
-// (ageBasis was stamped onto the finding but never reached the string that
-// printed its age). Findings stamped by an older/test caller that never ran
-// through stampFindingTimestamps (no ageBasis at all) degrade to the same
-// honest "not proven" label FIRST_OBSERVED gets, never a false claim.
-function medianOpenAge(findings) {
-  const entries = (findings || [])
-    .map(f => ({
-      days: f.provenAgeDays != null ? f.provenAgeDays : (f.ageDays || 0),
-      ageBasis: f.ageBasis || _provenance_schema_js__WEBPACK_IMPORTED_MODULE_1__/* .AGE_BASIS */ .pI.FIRST_OBSERVED,
-      confidence: f.findingProvenance?.confidence || null,
-    }))
-    .sort((a, b) => a.days - b.days);
-  if (!entries.length) return null;
-  return entries[Math.floor(entries.length / 2)];
-}
-
-// One-line SLA-breach summary for surfacing after a scan (#10). Returns null
-// when nothing is past its per-severity SLA. Pairs with medianOpenAge for a
-// "is my security debt aging" readout that the vibecoder can act on.
-//
-// FR-PROV-019: never prints the median age number without its basis and
-// confidence alongside it — see medianOpenAge/_ageBasisLabel above.
-function renderSlaSummary(findings, slaDays = null) {
-  const breached = findingsExceedingSLA(findings || [], slaDays);
-  if (!breached.length) return null;
-  const bySev = {};
-  for (const f of breached) bySev[f.severity] = (bySev[f.severity] || 0) + 1;
-  const parts = ['critical', 'high', 'medium', 'low', 'info'].filter(s => bySev[s]).map(s => `${bySev[s]} ${s}`);
-  const median = medianOpenAge(findings);
-  const ageNote = median != null
-    ? ` (median open age ${median.days}d, ${_ageBasisLabel(median.ageBasis, median.confidence)})`
-    : '';
-  return `${breached.length} finding(s) past remediation SLA: ${parts.join(', ')}${ageNote}`;
-}
-
-// Compute MTTR statistics from a series of saved scans (each with firstSeen/lastSeen).
-// Useful for trend reporting.
-function computeMTTR(removedFindings) {
-  // removedFindings: findings that existed in baseline but no longer in current
-  // (i.e., were fixed). Each carries firstSeenAt and lastSeenAt from the baseline.
-  if (!removedFindings.length) return { count: 0, meanDays: null, medianDays: null, perSeverity: {} };
-  const ages = removedFindings.map(f => {
-    const first = Date.parse(f.firstSeenAt || 0);
-    const last = Date.parse(f.lastSeenAt || 0);
-    return Math.max(0, (last - first) / 86400000);
-  }).sort((a, b) => a - b);
-  const meanDays = ages.reduce((s, x) => s + x, 0) / ages.length;
-  const medianDays = ages[Math.floor(ages.length / 2)];
-  const perSeverity = {};
-  for (const f of removedFindings) {
-    const sev = f.severity || 'medium';
-    (perSeverity[sev] = perSeverity[sev] || []).push(
-      Math.max(0, (Date.parse(f.lastSeenAt || 0) - Date.parse(f.firstSeenAt || 0)) / 86400000)
-    );
-  }
-  for (const k of Object.keys(perSeverity)) {
-    const a = perSeverity[k];
-    perSeverity[k] = { count: a.length, meanDays: a.reduce((s,x)=>s+x,0)/a.length };
-  }
-  return { count: removedFindings.length, meanDays, medianDays, perSeverity };
-}
-
-
-/***/ })
-
-};

package/dist/999.index.js

@@ -1,117 +0,0 @@
-export const id = 999;
-export const ids = [999];
-export const modules = {
-
-/***/ 60999:
-/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
-
-/* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   validateScenario: () => (/* binding */ validateScenario)
-/* harmony export */ });
-/* unused harmony exports SCENARIO_VERSION, SCENARIO_OPERATION_KINDS, SCENARIO_OPERATION_REQUIRED_FIELDS */
-// scenario.js — M5 deliverable #3a (FR-502 §10.10, DFG-0xx): the
-// Scenario extension contract — a hypothetical set of graph overrides,
-// NOT a DataFlowGraph v1 entity, mirrors recipient-profile.js's own
-// contract shape exactly (structural-only {valid, errors} validator,
-// zero graph access, per-field evidence typing for the fields a
-// Scenario actually overrides).
-//
-// See docs/superpowers/plans/2026-09-02-data-flow-explorer-m5-whatif-simulator-scoping.md
-// for the full design reasoning, including why EVIDENCE_GRADES gained
-// 'assumed' instead of reusing 'declared', and why this module's own
-// operations catalog excludes synthetic node/edge insertion (deferred).
-
-const SCENARIO_VERSION = '1.0.0';
-
-// The 6 in-scope hypothetical-change kinds (FR-502's own 7, minus the
-// deferred synthetic-insertion category). Each operation names its
-// target canonical id(s) plus the override value(s); scenario-engine.js
-// is the only consumer that interprets `kind`.
-const SCENARIO_OPERATION_KINDS = Object.freeze([
-  'require_transit_protection',
-  'apply_handling',
-  'remove_entity',
-  'replace_recipient_fact',
-  'change_storage_fact',
-  'change_governance_fact',
-]);
-
-// Per-operation-kind required fields, beyond the universal `kind`. Kept
-// as data (not inline in validateScenario) for the same reason
-// SCENARIO_OPERATION_KINDS above is — a single source of truth a table
-// can be checked against — though scenario-engine.js does not currently
-// import this table itself; it only mentions it in a prose comment on
-// its own _applyReplaceRecipientFact.
-const SCENARIO_OPERATION_REQUIRED_FIELDS = Object.freeze({
-  require_transit_protection: ['targetEdgeId'],
-  apply_handling: ['targetEdgeId', 'handling'],
-  remove_entity: ['targetNodeId'],
-  replace_recipient_fact: ['targetNodeId', 'field', 'value'],
-  change_storage_fact: ['targetNodeId', 'field', 'value'],
-  change_governance_fact: ['targetFlowId', 'field', 'value'],
-});
-
-function _isNonEmptyString(v) { return typeof v === 'string' && v.length > 0; }
-function _isPlainObject(v) { return v !== null && typeof v === 'object' && !Array.isArray(v); }
-function _isStringArray(v) { return Array.isArray(v) && v.every((x) => typeof x === 'string'); }
-
-/**
- * Structural validation only — mirrors validateRecipientProfile's own
- * {valid, errors} shape and "never throws" contract. Does not check
- * that targetEdgeId/targetNodeId/targetFlowId actually exist in any
- * real graph — that is scenario-engine.js's job at apply time, since
- * this module has zero graph access by design.
- */
-function validateScenario(record) {
-  const errors = [];
-  const err = (p, message) => errors.push({ path: p, message });
-  if (!record || typeof record !== 'object' || Array.isArray(record)) {
-    err('$', 'Scenario record must be an object');
-    return { valid: false, errors };
-  }
-  if (!_isNonEmptyString(record.id) || !record.id.startsWith('scenario:')) {
-    err('$.id', 'id is required and must start with "scenario:"');
-  }
-  if (!_isNonEmptyString(record.version)) err('$.version', 'version is required');
-  if (!_isNonEmptyString(record.baseGraphId)) err('$.baseGraphId', 'baseGraphId is required');
-  if (!_isNonEmptyString(record.baseGraphDigest)) err('$.baseGraphDigest', 'baseGraphDigest is required');
-  if (!_isNonEmptyString(record.author)) err('$.author', 'author is required');
-  if (!_isNonEmptyString(record.createdAt)) err('$.createdAt', 'createdAt is required');
-  if (record.expiration !== null && record.expiration !== undefined && !_isNonEmptyString(record.expiration)) {
-    err('$.expiration', 'expiration must be a string or null');
-  }
-  if (!_isStringArray(record.assumptions ?? [])) err('$.assumptions', 'assumptions must be an array of strings');
-  if (!_isStringArray(record.verificationRequirements ?? [])) {
-    err('$.verificationRequirements', 'verificationRequirements must be an array of strings');
-  }
-  if (!Array.isArray(record.operations) || record.operations.length === 0) {
-    err('$.operations', 'operations is required and must be a non-empty array');
-  } else {
-    record.operations.forEach((op, i) => {
-      const p = `$.operations[${i}]`;
-      if (!_isPlainObject(op)) { err(p, 'each operation must be an object'); return; }
-      if (!SCENARIO_OPERATION_KINDS.includes(op.kind)) {
-        err(`${p}.kind`, `unrecognized operation kind "${op.kind}" — must be one of ${SCENARIO_OPERATION_KINDS.join('|')}`);
-        return;
-      }
-      for (const field of SCENARIO_OPERATION_REQUIRED_FIELDS[op.kind]) {
-        if (op[field] === undefined || op[field] === null || op[field] === '') {
-          err(`${p}.${field}`, `operation of kind "${op.kind}" requires "${field}"`);
-        }
-      }
-    });
-  }
-  // simulatedDelta is populated by scenario-engine.js after apply, never
-  // by a caller constructing the pre-apply record — null is the only
-  // valid pre-apply value, an object (scenario-diff.js's own shape) the
-  // only valid post-apply value.
-  if (record.simulatedDelta !== null && record.simulatedDelta !== undefined && !_isPlainObject(record.simulatedDelta)) {
-    err('$.simulatedDelta', 'simulatedDelta must be null (before apply) or an object (after apply)');
-  }
-  return { valid: errors.length === 0, errors };
-}
-
-
-/***/ })
-
-};