@clear-capabilities/agentic-security-scanner 0.185.0 → 0.186.2

package/dist/8097.index.js

@@ -1,201 +0,0 @@
-export const id = 8097;
-export const ids = [8097];
-export const modules = {
-
-/***/ 48097:
-/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
-
-/* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   productionFeedbackReport: () => (/* binding */ productionFeedbackReport),
-/* harmony export */   renderProductionFeedbackSummary: () => (/* binding */ renderProductionFeedbackSummary)
-/* harmony export */ });
-/* unused harmony exports CATEGORIES, collectFeedbackEvents, summarizeFeedbackTrend, _internals */
-/* harmony import */ var _suppressions_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(82166);
-/* harmony import */ var _triage_memory_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(77008);
-/* harmony import */ var _sca_policy_js__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(75228);
-/* harmony import */ var _fix_history_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(74294);
-/* harmony import */ var _fix_metrics_js__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(62683);
-// FR-907 (assurance-hardening PRD): "Add longitudinal production feedback
-// measurement | Metrics separate user suppression, accepted risk, invalid
-// finding, fixed finding, and verification outcome."
-//
-// Read-only aggregation over 5 ALREADY-BUILT, separate mechanisms — this
-// module invents no new storage of its own, only a unified view:
-//
-//   user-suppression     -> triage-memory.jsonl (decision:'wont-fix'),
-//                            accepted.json (vibecoder soft-accept, dated),
-//                            suppressions.yml (pro exception, undated)
-//   invalid-finding       -> triage-memory.jsonl (decision:'false-positive')
-//   accepted-risk         -> sca-policy.yml's accept-risk[] (undated snapshot
-//                            — the policy file has no per-entry creation
-//                            timestamp, only an optional future `expires`)
-//   fixed-finding          -> fix-history/log.json (dated via `appliedAt`,
-//                            status-tagged: applied/pending/reverted/failed)
-//   verification-outcome  -> fix-metrics.jsonl (dated via `at`, ok-tagged)
-//
-// "Longitudinal" means: every event that HAS a real timestamp is usable in
-// a time-bucketed trend; every event that does NOT (accept-risk entries,
-// pro suppressions — neither schema records when the entry was added) is
-// still counted in its category total but reported separately as
-// "undated" rather than silently smeared across the time window or
-// silently dropped. Same disclosed-gap discipline this codebase already
-// uses elsewhere (privacy-framework.js's engine-gap bucket, accuracy-
-// scorecard.js's excluded-from-denominator entries) — a number without
-// its caveat is not a measurement.
-//
-// Never throws (posture convention): each of the 5 reads is wrapped
-// independently, so a missing or malformed source degrades only that ONE
-// category to empty, never blocks the other four. Every underlying reader
-// (loadSoftAccepted, loadProSuppressions, loadMemory, loadScaPolicy,
-// readLog, loadFixAttempts) already degrades gracefully on its own; the
-// wrapping here is defense in depth against a reader whose contract
-// changes later, not a claim that today's readers can throw.
-
-
-
-
-
-
-
-const MS_PER_DAY = 86400000;
-
-// The 5 categories named verbatim in FR-907's own acceptance criterion.
-const CATEGORIES = Object.freeze([
-  'user-suppression', 'accepted-risk', 'invalid-finding', 'fixed-finding', 'verification-outcome',
-]);
-
-function _safe(fn) {
-  try { return fn(); } catch { return []; }
-}
-
-/**
- * One unified event per underlying record, tagged with which of the 5
- * PRD-named categories it belongs to. `at` is an ISO timestamp or null
- * when the source schema has no per-entry creation date. `raw` keeps the
- * original record for drill-down — never re-derived from the unified
- * shape, so nothing is lost in translation.
- */
-function collectFeedbackEvents(scanRoot) {
-  const events = [];
-
-  for (const e of _safe(() => (0,_suppressions_js__WEBPACK_IMPORTED_MODULE_0__/* .loadSoftAccepted */ .gv)(scanRoot))) {
-    events.push({
-      category: 'user-suppression', source: 'suppressions.js:accepted.json',
-      at: e.accepted_at || null, findingId: e.id || null, file: e.file || null,
-      line: e.line ?? null, outcome: 'soft-accepted', raw: e,
-    });
-  }
-  for (const e of _safe(() => (0,_suppressions_js__WEBPACK_IMPORTED_MODULE_0__/* .loadProSuppressions */ .KM)(scanRoot))) {
-    events.push({
-      category: 'user-suppression', source: 'suppressions.js:suppressions.yml',
-      at: null, findingId: e.finding_id || null, file: e.file || null,
-      line: null, outcome: 'pro-exception', raw: e,
-    });
-  }
-  for (const e of _safe(() => (0,_triage_memory_js__WEBPACK_IMPORTED_MODULE_1__/* .loadMemory */ .ab)(scanRoot))) {
-    if (e.decision === 'wont-fix') {
-      events.push({
-        category: 'user-suppression', source: 'triage-memory.js',
-        at: e.at || null, findingId: e.id || null, file: e.file || null,
-        line: e.line ?? null, outcome: 'wont-fix', raw: e,
-      });
-    } else if (e.decision === 'false-positive') {
-      events.push({
-        category: 'invalid-finding', source: 'triage-memory.js',
-        at: e.at || null, findingId: e.id || null, file: e.file || null,
-        line: e.line ?? null, outcome: 'false-positive', raw: e,
-      });
-    }
-  }
-  const scaPolicy = _safe(() => (0,_sca_policy_js__WEBPACK_IMPORTED_MODULE_2__/* .loadScaPolicy */ .IN)(scanRoot));
-  const acceptRisk = scaPolicy && Array.isArray(scaPolicy.acceptRisk) ? scaPolicy.acceptRisk : [];
-  for (const e of acceptRisk) {
-    events.push({
-      category: 'accepted-risk', source: 'sca-policy.js',
-      at: null, findingId: e.cve || e.package || null, file: null,
-      line: null, outcome: 'accept-risk', raw: e,
-    });
-  }
-  for (const e of _safe(() => (0,_fix_history_js__WEBPACK_IMPORTED_MODULE_3__/* .readLog */ .x6)(scanRoot))) {
-    events.push({
-      category: 'fixed-finding', source: 'fix-history.js',
-      at: e.appliedAt || null, findingId: e.findingId || e.stableId || null,
-      file: e.file || null, line: null, outcome: e.status || 'unknown', raw: e,
-    });
-  }
-  for (const e of _safe(() => (0,_fix_metrics_js__WEBPACK_IMPORTED_MODULE_4__/* .loadFixAttempts */ .sU)(scanRoot))) {
-    events.push({
-      category: 'verification-outcome', source: 'fix-metrics.js',
-      at: e.at || null, findingId: e.stableId || null, file: null,
-      line: null, outcome: e.ok ? 'verified' : 'not-verified', raw: e,
-    });
-  }
-
-  return events;
-}
-
-/**
- * Bucket events by day within a rolling `sinceDays`-day window — the same
- * cutoff-window shape as posture/triage.js's own trend(). An event with no
- * timestamp (or an unparseable one) cannot be placed on a time axis: it is
- * counted once in `undated` per category rather than silently dropped or
- * silently smeared into the window.
- */
-function summarizeFeedbackTrend(events, { sinceDays = 30, now = Date.now() } = {}) {
-  const cutoff = now - sinceDays * MS_PER_DAY;
-  const byCategory = {};
-  for (const cat of CATEGORIES) byCategory[cat] = { total: 0, inWindow: 0, undated: 0 };
-
-  const dayBuckets = new Map(); // 'YYYY-MM-DD' -> { category: count }
-  for (const ev of Array.isArray(events) ? events : []) {
-    if (!ev || !CATEGORIES.includes(ev.category)) continue;
-    byCategory[ev.category].total++;
-    const t = ev.at ? Date.parse(ev.at) : NaN;
-    if (!Number.isFinite(t)) { byCategory[ev.category].undated++; continue; }
-    if (t < cutoff) continue;
-    byCategory[ev.category].inWindow++;
-    const dayKey = new Date(t).toISOString().slice(0, 10);
-    if (!dayBuckets.has(dayKey)) dayBuckets.set(dayKey, {});
-    const bucket = dayBuckets.get(dayKey);
-    bucket[ev.category] = (bucket[ev.category] || 0) + 1;
-  }
-
-  const series = [...dayBuckets.entries()]
-    .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
-    .map(([day, counts]) => ({ day, counts }));
-  return { sinceDays, byCategory, series };
-}
-
-/**
- * Convenience wrapper: collect + summarize in one call — same pattern as
- * fix-metrics.js's fixDurationReport(scanRoot).
- */
-function productionFeedbackReport(scanRoot, opts) {
-  const events = collectFeedbackEvents(scanRoot);
-  return { events, ...summarizeFeedbackTrend(events, opts) };
-}
-
-/**
- * One block of human-readable summary, or null when nothing was measured
- * at all — same "null when nothing measured" contract as
- * renderFixDurationSummary, so a caller can skip the section entirely
- * rather than print an empty header.
- */
-function renderProductionFeedbackSummary(report) {
-  if (!report || !Array.isArray(report.events) || !report.events.length) return null;
-  const lines = [`Production feedback (last ${report.sinceDays}d):`];
-  for (const cat of CATEGORIES) {
-    const c = report.byCategory[cat];
-    if (!c || c.total === 0) continue;
-    const undatedNote = c.undated ? `, ${c.undated} undated` : '';
-    lines.push(`  ${cat}: ${c.inWindow} in window / ${c.total} total${undatedNote}`);
-  }
-  return lines.length > 1 ? lines.join('\n') : null;
-}
-
-const _internals = { MS_PER_DAY };
-
-
-/***/ })
-
-};

package/dist/8126.index.js

@@ -1,191 +0,0 @@
-export const id = 8126;
-export const ids = [8126];
-export const modules = {
-
-/***/ 18126:
-/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
-
-/* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   createCascadePool: () => (/* binding */ createCascadePool)
-/* harmony export */ });
-/* unused harmony export DEFAULT_GRACE_MS */
-/* harmony import */ var node_worker_threads__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(75919);
-/* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(76760);
-/* harmony import */ var node_url__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(73136);
-// FR-202 phase 3b (D-0050): a pool of long-lived workers, each running engine.js's
-// _runFileCascade for many files over its lifetime, instead of the one-shot-per-call
-// model runWithDeadline/analyzer-supervisor.js uses (which is correct for FR-202's
-// primitive-level proof but would force whole-project setup — _buildProjectIndex,
-// _buildGlobalJavaTaintedMethodIndex, _loadCustomRules — to redo per FILE, an O(n^2)
-// cost across a scan). Each worker performs that setup ONCE at creation via
-// _initCascadeWorkerState, then answers task messages over its lifetime.
-//
-// A task that exceeds its deadline+grace gets its OWN worker terminated (genuinely
-// preemptive, mirroring analyzer-supervisor.js's worker.terminate() precedent) and a
-// fresh replacement worker is spawned to keep the pool at full size for later files —
-// one hung file costs one worker restart, not the whole scan.
-
-
-
-
-// `new Worker()` needs a REAL file on disk -- once ncc bundles this module's code
-// into a dist/ chunk, `import.meta.url` resolves to that chunk's location (dist/),
-// not to src/pipeline/, so a naive path.join(HERE, 'cascade-worker.js') would look
-// for a file that was never copied there. src/ always ships as a sibling of dist/
-// (see package.json's "files"), in both a dev checkout and the published npm
-// package, so fall back to the real, unbundled worker script in that case.
-function _resolveDefaultWorkerScript() {
-  const hereDir = node_path__WEBPACK_IMPORTED_MODULE_1__.dirname((0,node_url__WEBPACK_IMPORTED_MODULE_2__.fileURLToPath)(import.meta.url));
-  if (node_path__WEBPACK_IMPORTED_MODULE_1__.basename(hereDir) === 'pipeline') return node_path__WEBPACK_IMPORTED_MODULE_1__.join(hereDir, 'cascade-worker.js');
-  return node_path__WEBPACK_IMPORTED_MODULE_1__.join(hereDir, '..', 'src', 'pipeline', 'cascade-worker.js');
-}
-const DEFAULT_WORKER_SCRIPT = _resolveDefaultWorkerScript();
-const DEFAULT_GRACE_MS = 500;
-
-function spawnReadyWorker({ workerScript, modulePath, fileContents, scanRoot }) {
-  return new Promise((resolve, reject) => {
-    let settled = false;
-    const worker = new node_worker_threads__WEBPACK_IMPORTED_MODULE_0__.Worker(workerScript, { workerData: { modulePath, fileContents, scanRoot } });
-    const finish = (fn, value) => {
-      if (settled) return;
-      settled = true;
-      worker.off('message', onMessage);
-      worker.off('error', onError);
-      fn(value);
-    };
-    const onMessage = (msg) => {
-      if (!msg) return;
-      if (msg.type === 'ready') finish(resolve, worker);
-      else if (msg.type === 'init-error') { worker.terminate().catch(() => {}); finish(reject, new Error(msg.error)); }
-    };
-    const onError = (err) => { worker.terminate().catch(() => {}); finish(reject, err); };
-    worker.on('message', onMessage);
-    worker.on('error', onError);
-  });
-}
-
-/**
- * @param {object} opts
- * @param {Record<string,string>} opts.fileContents - broadcast once to every worker at creation.
- * @param {string|null} opts.scanRoot
- * @param {number} [opts.poolSize=4]
- * @param {string} opts.modulePath - absolute path to the engine.js each worker imports.
- * @param {string} [opts.workerScript] - defaults to cascade-worker.js next to this file.
- * @param {number} [opts.graceMs]
- */
-function createCascadePool(opts = {}) {
-  const {
-    fileContents = {},
-    scanRoot = null,
-    poolSize = 4,
-    workerScript = DEFAULT_WORKER_SCRIPT,
-    modulePath,
-    graceMs = DEFAULT_GRACE_MS,
-  } = opts;
-  if (!modulePath) throw new Error('createCascadePool requires opts.modulePath');
-  if (!(Number.isInteger(poolSize) && poolSize > 0)) throw new Error('createCascadePool requires opts.poolSize to be a positive integer');
-
-  const idle = [];
-  const pendingIdle = [];
-  const allWorkers = new Set();
-  let nextTaskId = 1;
-  let closed = false;
-  let spawnFailureCount = 0;
-  let lastSpawnError = null;
-
-  function spawnAndRegister() {
-    return spawnReadyWorker({ workerScript, modulePath, fileContents, scanRoot }).then((w) => {
-      allWorkers.add(w);
-      return w;
-    });
-  }
-
-  // Background respawn after a killed worker (see runFile's timeout branch)
-  // is deliberately fire-and-forget -- the timed-out task has already
-  // resolved and nothing is waiting on this promise -- but a swallowed
-  // failure here would otherwise shrink the pool invisibly (e.g. thread
-  // exhaustion making every future respawn fail silently forever). Track
-  // it instead of a bare `.catch(() => {})`.
-  function respawnInBackground() {
-    spawnAndRegister().then(releaseWorker).catch((err) => {
-      spawnFailureCount += 1;
-      lastSpawnError = err;
-    });
-  }
-
-  function releaseWorker(w) {
-    if (closed) { allWorkers.delete(w); w.terminate().catch(() => {}); return; }
-    if (pendingIdle.length) pendingIdle.shift()(w);
-    else idle.push(w);
-  }
-
-  function acquireWorker() {
-    if (idle.length) return Promise.resolve(idle.pop());
-    return new Promise((resolve) => pendingIdle.push(resolve));
-  }
-
-  const ready = Promise.all(
-    Array.from({ length: poolSize }, () => spawnAndRegister().then(releaseWorker))
-  );
-
-  /**
-   * Run one file's cascade on a pooled worker. Resolves with
-   * {ok:true, result} | {ok:false, error} | {ok:false, timedOut:true, timeoutMs, graceMs}.
-   * Never rejects.
-   */
-  async function runFile(p, c, taskScanRoot, detectorErrors, taskOpts = {}) {
-    await ready;
-    if (closed) return { ok: false, error: 'pool is closed' };
-    const timeoutMs = taskOpts.timeoutMs;
-    const worker = await acquireWorker();
-    const id = nextTaskId++;
-    return new Promise((resolve) => {
-      let settled = false;
-      let killTimer = null;
-      const onMessage = (msg) => {
-        if (settled || !msg || msg.id !== id) return;
-        settled = true;
-        if (killTimer) clearTimeout(killTimer);
-        worker.off('message', onMessage);
-        releaseWorker(worker);
-        resolve(msg.ok ? { ok: true, result: msg.result } : { ok: false, error: msg.error });
-      };
-      worker.on('message', onMessage);
-      if (Number.isFinite(timeoutMs) && timeoutMs > 0) {
-        killTimer = setTimeout(() => {
-          if (settled) return;
-          settled = true;
-          worker.off('message', onMessage);
-          allWorkers.delete(worker);
-          worker.terminate().catch(() => {});
-          if (!closed) respawnInBackground();
-          resolve({ ok: false, timedOut: true, timeoutMs, graceMs });
-        }, timeoutMs + graceMs);
-        killTimer.unref?.();
-      }
-      worker.postMessage({ type: 'task', id, p, c, scanRoot: taskScanRoot, detectorErrors });
-    });
-  }
-
-  async function shutdown() {
-    closed = true;
-    await ready.catch(() => {});
-    for (const w of allWorkers) await w.terminate().catch(() => {});
-    allWorkers.clear();
-    idle.length = 0;
-  }
-
-  return {
-    runFile,
-    shutdown,
-    ready,
-    DEFAULT_GRACE_MS: graceMs,
-    getSpawnFailureCount: () => spawnFailureCount,
-    getLastSpawnError: () => lastSpawnError,
-  };
-}
-
-
-/***/ })
-
-};

package/dist/8178.index.js

@@ -1,78 +0,0 @@
-export const id = 8178;
-export const ids = [8178];
-export const modules = {
-
-/***/ 48178:
-/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
-
-/* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   exportFlowsCSV: () => (/* binding */ exportFlowsCSV)
-/* harmony export */ });
-/* harmony import */ var _protection_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(59114);
-// export-csv.js — Milestone 4, sub-project JSON/CSV export.
-//
-// One row per FLOW (not node, not edge — the closest analogue in this
-// domain to report/index.js's own toCSV's "one row per finding", per this
-// sub-project's own scoping doc decision 3). Node/edge CSV exports are
-// deferred, named explicitly in that doc, not attempted here.
-
-
-
-// Same escaping convention as report/index.js's own toCSV — quote only
-// when a comma/quote/newline is present, double embedded quotes.
-function esc(v) {
-  if (v == null) return '';
-  const s = String(v);
-  return /[",\n]/.test(s) ? '"' + s.replace(/"/g, '""') + '"' : s;
-}
-
-// Join character for a flow's multiple `dataClasses` values in one CSV
-// cell: `;`, not `,`. Chosen (this module's own decision, not prescribed
-// by the plan) because `,` is CSV's own delimiter — joining multiple
-// classes with it would put a raw delimiter inside a single logical cell
-// value, forcing outer quoting for the ordinary multi-class case (e.g. a
-// field classified both PCI and PII). `;` never collides with the CSV
-// grammar, so the common case ("PCI;PII") never needs quoting at all.
-// `esc()` still quotes correctly if a comma ends up in cell content for
-// any other reason (see export-csv.test.js's own escaping test) — this
-// choice only avoids manufacturing that case in the common path.
-const DATA_CLASSES_JOIN = ';';
-
-function _dataClassesForFlow(flow, dataElementsById) {
-  const classes = new Set();
-  for (const deId of flow.dataElementIds ?? []) {
-    const de = dataElementsById.get(deId);
-    for (const c of de?.dataClasses ?? []) classes.add(c);
-  }
-  return [...classes].sort();
-}
-
-function _dimensionVerdict(flow, edgesById, dimension) {
-  const verdicts = (flow.edgeIds ?? [])
-    .map((id) => edgesById.get(id)?.protection?.[dimension]?.verdict)
-    .filter(Boolean);
-  return (0,_protection_js__WEBPACK_IMPORTED_MODULE_0__/* .aggregateVerdicts */ .SX)(verdicts);
-}
-
-function exportFlowsCSV(graph) {
-  const dataElementsById = new Map((graph.dataElements ?? []).map((d) => [d.id, d]));
-  const edgesById = new Map((graph.edges ?? []).map((e) => [e.id, e]));
-  const header = ['id', 'source', 'sink', 'dataClasses', 'transitVerdict', 'atRestVerdict', 'handlingVerdict', 'policyVerdict', 'coverageStatus'];
-  const rows = [header.join(',')];
-  for (const flow of graph.flows ?? []) {
-    rows.push([
-      esc(flow.id), esc(flow.source), esc(flow.sink),
-      esc(_dataClassesForFlow(flow, dataElementsById).join(DATA_CLASSES_JOIN)),
-      esc(_dimensionVerdict(flow, edgesById, 'transit')),
-      esc(_dimensionVerdict(flow, edgesById, 'atRest')),
-      esc(_dimensionVerdict(flow, edgesById, 'handling')),
-      esc(flow.policyVerdict), esc(flow.coverageStatus),
-    ].join(','));
-  }
-  return rows.join('\n');
-}
-
-
-/***/ })
-
-};

package/dist/8382.index.js

@@ -1,93 +0,0 @@
-export const id = 8382;
-export const ids = [8382];
-export const modules = {
-
-/***/ 78382:
-/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
-
-/* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   qc: () => (/* binding */ IMPACT_VERSION),
-/* harmony export */   validateImpactAssessment: () => (/* binding */ validateImpactAssessment)
-/* harmony export */ });
-/* unused harmony exports IMPACT_TARGET_KINDS, IMPACT_SCOPE_VALUES, IMPACT_TRACE_KINDS */
-// impact-assessment.js — M5 deliverable #4 (FR-507 §10.10): the
-// ImpactAssessment extension contract — the result of asking "what is
-// reachable from this compromised node/edge/flow/data element, per the
-// graph's own already-scanned evidence." NOT a DataFlowGraph v1 entity,
-// mirrors recipient-profile.js's/scenario.js's own contract shape
-// exactly (structural-only {valid, errors} validator, zero graph
-// access at construction time).
-//
-// See docs/superpowers/plans/2026-09-02-data-flow-explorer-m5-blast-radius-impact-scoping.md
-// for the full design reasoning, including why there is no
-// affectedObligationIds field (ObligationMapping records are built on
-// demand per compliance framework, not stored on the graph) and why
-// `scope` is always 'possible' today (no runtime-corroboration layer
-// exists yet).
-
-const IMPACT_VERSION = '1.0.0';
-
-const IMPACT_TARGET_KINDS = Object.freeze(['node', 'edge', 'flow', 'dataElement']);
-
-// 'possible' is the only value any producer emits today — 'observed'
-// is reserved for a future Digital Twin (M5 #7) increment with a real
-// runtime-corroboration signal. Both are valid schema values now so
-// that increment needs no breaking change to this contract later.
-const IMPACT_SCOPE_VALUES = Object.freeze(['possible', 'observed']);
-
-// Discloses WHICH of the two genuinely different traversal semantics
-// produced this record (final-review I2 fix) — `scope` alone cannot
-// distinguish them, since both families emit `scope: 'possible'`.
-// 'topology_reachable': a `node` target's topology-wide showAllPaths
-// BFS — "everything this compromised node could push to." 'flow_
-// restricted': an `edge`/`flow`/`dataElement` target's direct trace
-// over the flows that actually carry it — never the topology-wide BFS.
-// Without this field a JSON consumer cannot tell "exact carrier trace"
-// from "topological presumption" apart, the exact silent-conflation
-// this codebase's own disclosure discipline exists to prevent.
-const IMPACT_TRACE_KINDS = Object.freeze(['topology_reachable', 'flow_restricted']);
-
-function _isNonEmptyString(v) { return typeof v === 'string' && v.length > 0; }
-function _isStringArray(v) { return Array.isArray(v) && v.every((x) => typeof x === 'string'); }
-
-/**
- * Structural validation only — mirrors validateRecipientProfile's/
- * validateScenario's own {valid, errors} shape and "never throws"
- * contract.
- */
-function validateImpactAssessment(record) {
-  const errors = [];
-  const err = (p, message) => errors.push({ path: p, message });
-  if (!record || typeof record !== 'object' || Array.isArray(record)) {
-    err('$', 'ImpactAssessment record must be an object');
-    return { valid: false, errors };
-  }
-  if (!_isNonEmptyString(record.id) || !record.id.startsWith('impact:')) {
-    err('$.id', 'id is required and must start with "impact:"');
-  }
-  if (!_isNonEmptyString(record.version)) err('$.version', 'version is required');
-  if (!_isNonEmptyString(record.graphId)) err('$.graphId', 'graphId is required');
-  if (!_isNonEmptyString(record.graphDigest)) err('$.graphDigest', 'graphDigest is required');
-  if (!_isNonEmptyString(record.targetId)) err('$.targetId', 'targetId is required');
-  if (!IMPACT_TARGET_KINDS.includes(record.targetKind)) {
-    err('$.targetKind', `targetKind must be one of ${IMPACT_TARGET_KINDS.join('|')}`);
-  }
-  if (!IMPACT_SCOPE_VALUES.includes(record.scope)) {
-    err('$.scope', `scope must be one of ${IMPACT_SCOPE_VALUES.join('|')}`);
-  }
-  if (!IMPACT_TRACE_KINDS.includes(record.traceKind)) {
-    err('$.traceKind', `traceKind must be one of ${IMPACT_TRACE_KINDS.join('|')}`);
-  }
-  if (!_isStringArray(record.affectedNodeIds ?? [])) err('$.affectedNodeIds', 'affectedNodeIds must be an array of strings');
-  if (!_isStringArray(record.affectedEdgeIds ?? [])) err('$.affectedEdgeIds', 'affectedEdgeIds must be an array of strings');
-  if (!_isStringArray(record.affectedDataClasses ?? [])) err('$.affectedDataClasses', 'affectedDataClasses must be an array of strings');
-  if (!_isStringArray(record.affectedRecipientProfileIds ?? [])) err('$.affectedRecipientProfileIds', 'affectedRecipientProfileIds must be an array of strings');
-  if (!_isStringArray(record.coverageLimitations ?? [])) err('$.coverageLimitations', 'coverageLimitations must be an array of strings');
-  if (!_isNonEmptyString(record.generatedAt)) err('$.generatedAt', 'generatedAt is required');
-  return { valid: errors.length === 0, errors };
-}
-
-
-/***/ })
-
-};