autoremediator 0.21.2 → 0.22.0

package/dist/api/evidence-pack/cra.js

@@ -0,0 +1,234 @@
+/** Article 14(2) of Regulation (EU) 2024/2847: early warning within 24 hours of awareness. */
+export const EARLY_WARNING_HOURS = 24;
+/** Article 14(2)(b): vulnerability notification within 72 hours of awareness. */
+export const NOTIFICATION_HOURS = 72;
+/** Article 14(2)(c): final report no later than 14 days after a corrective or mitigating measure is available. */
+export const FINAL_REPORT_DAYS = 14;
+const HOUR_MS = 3_600_000;
+const DAY_MS = 24 * HOUR_MS;
+/**
+ * Parse an ISO 8601 timestamp that states its time zone. A timestamp without `Z` or an offset is
+ * refused: a deadline computed from a guessed zone could be wrong by hours, and the deadlines are
+ * the point.
+ */
+export function parseAwareness(value, label = "awarenessAt") {
+    const text = value.trim();
+    const parts = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2})(?::(\d{2})(?:\.\d+)?)?(?:Z|[+-]\d{2}:\d{2})$/.exec(text);
+    if (!parts) {
+        throw new Error(`${label} must be an ISO 8601 timestamp with a time zone, such as 2026-11-10T14:30:00Z or 2026-11-10T15:30:00+01:00 (got ${JSON.stringify(value)}).`);
+    }
+    const [year = 0, month = 0, day = 0, hour = 0, minute = 0] = [1, 2, 3, 4, 5].map((index) => Number(parts[index]));
+    const second = parts[6] === undefined ? 0 : Number(parts[6]);
+    const daysInMonth = new Date(Date.UTC(year, month, 0)).getUTCDate();
+    const date = new Date(text);
+    if (Number.isNaN(date.getTime()) ||
+        month < 1 ||
+        month > 12 ||
+        day < 1 ||
+        day > daysInMonth ||
+        hour > 23 ||
+        minute > 59 ||
+        second > 59) {
+        throw new Error(`${label} is not a real date and time: ${JSON.stringify(value)}.`);
+    }
+    return date;
+}
+/** The three Article 14(2) deadlines, in UTC. Pure arithmetic on instants; no calendar or zone rules. */
+export function craDeadlines(awareness, correctiveMeasureAvailableAt) {
+    return {
+        awarenessAt: awareness.toISOString(),
+        earlyWarningDue: new Date(awareness.getTime() + EARLY_WARNING_HOURS * HOUR_MS).toISOString(),
+        notificationDue: new Date(awareness.getTime() + NOTIFICATION_HOURS * HOUR_MS).toISOString(),
+        ...(correctiveMeasureAvailableAt
+            ? {
+                finalReportDue: new Date(correctiveMeasureAvailableAt.getTime() + FINAL_REPORT_DAYS * DAY_MS).toISOString(),
+            }
+            : {}),
+    };
+}
+/** A file name stem for an advisory id: letters, digits, dot, dash and underscore only. */
+export function safeFileStem(id) {
+    const stem = id.replaceAll(/[^A-Za-z0-9._-]/g, "_").replaceAll(/\.{2,}/g, "_");
+    return stem === "" || stem.startsWith(".") ? `advisory_${stem}` : stem;
+}
+const TODO = (what) => `**[MANUFACTURER TO COMPLETE: ${what}]**`;
+function productBlock(product) {
+    return [
+        `- Product: ${product.name}${product.version ? ` ${product.version}` : ""}${product.purl ? ` (\`${product.purl}\`)` : ""}`,
+        ...(product.description ? [`- Description (from package.json): ${product.description}`] : []),
+        `- Manufacturer: ${product.manufacturer ?? TODO("legal name of the manufacturer")}`,
+    ];
+}
+function advisoryBlock(cveId, details) {
+    const lines = [`- Advisory: ${cveId}`];
+    if (!details) {
+        lines.push(`- Advisory details: not available in the recorded runs. ${TODO("describe the vulnerability")}`);
+        return lines;
+    }
+    lines.push(`- Summary (from the advisory): ${details.summary}`, `- Severity: ${details.severity}${details.cvssScore === undefined ? "" : `, CVSS base score ${details.cvssScore}`}`);
+    if (details.affectedPackages.length > 0) {
+        lines.push(`- Affected package${details.affectedPackages.length === 1 ? "" : "s"} (npm): ${details.affectedPackages
+            .map((pkg) => `${pkg.name} ${pkg.vulnerableRange}${pkg.firstPatchedVersion ? ` (first patched: ${pkg.firstPatchedVersion})` : ""}`)
+            .join("; ")}`);
+    }
+    return lines;
+}
+function kevBlock(details) {
+    const kev = details?.kev;
+    if (!kev?.knownExploited)
+        return [];
+    return [
+        "- CISA Known Exploited Vulnerabilities catalog: listed",
+        ...(kev.dateAdded
+            ? [
+                `  - Added to the catalog: ${kev.dateAdded} (reference only; the CRA clock starts when *you* became aware, not on this date)`,
+            ]
+            : []),
+        ...(kev.knownRansomwareCampaignUse
+            ? [`  - Known ransomware campaign use (CISA's field): ${kev.knownRansomwareCampaignUse}`]
+            : []),
+        ...(kev.requiredAction ? [`  - CISA's required action: ${kev.requiredAction}`] : []),
+    ];
+}
+function measuresBlock(findings) {
+    const lines = [];
+    for (const finding of findings) {
+        const where = finding.component
+            ? `${finding.component.name}@${finding.component.version}`
+            : "the product";
+        lines.push(`- ${where}: ${finding.status.replaceAll("_", " ")}. ${finding.detail}`);
+    }
+    return lines.length > 0 ? lines : ["- No recorded run or policy entry describes a measure."];
+}
+/**
+ * A markdown DRAFT of the three Article 14(2) reports for one actively exploited vulnerability,
+ * filled in from local data. Everything the data cannot supply is marked for the manufacturer, and
+ * nothing is submitted: reports go through the single reporting platform by hand.
+ */
+export function buildCraDraft(input) {
+    const { cveId, details, findings, product } = input;
+    const deadlines = input.awareness
+        ? craDeadlines(input.awareness, input.correctiveMeasureAvailableAt)
+        : undefined;
+    const status = findings.find((finding) => finding.status === "affected")?.status ?? findings[0].status;
+    const due = (value, hours, what) => value
+        ? `**Due: ${value}** (${what})`
+        : `Due: ${TODO(`no awareness timestamp was given, so no deadline was computed; it is ${hours} after the moment you became aware`)}`;
+    const finalDue = deadlines?.finalReportDue
+        ? `**Due: ${deadlines.finalReportDue}** (corrective measure available + 14 days)`
+        : `Due: ${TODO("the date a corrective or mitigating measure became available to users, plus 14 days; pass --corrective-measure-at <ISO 8601 with time zone> together with --awareness-at to compute it")}`;
+    const lines = [
+        `# DRAFT: Cyber Resilience Act Article 14 reports for ${cveId}`,
+        "",
+        "> **DRAFT. NOT SUBMITTED. NOT LEGAL ADVICE. NOT A COMPLIANCE CLAIM.**",
+        "> autoremediator assembled this from files on this machine. It has not been reviewed by anyone, it",
+        "> does not know whether this vulnerability is *actively exploited in the sense of the Regulation*",
+        "> (Article 3(42): reliable evidence that a malicious actor exploited it without the system owner's",
+        "> permission), and it submits nothing. Reports are made by the manufacturer through the single",
+        "> reporting platform (Article 14(1), Article 16), to the CSIRT designated as coordinator and to",
+        "> ENISA. Every field marked **[MANUFACTURER TO COMPLETE]** needs your input; check each filled-in",
+        "> field against your own records before relying on it.",
+        "",
+        `Generated ${input.generatedAt.toISOString()} by autoremediator ${input.toolVersion}.`,
+        "",
+        "## Timeline",
+        "",
+        input.awareness
+            ? `Awareness (as you stated it): ${deadlines.awarenessAt}`
+            : `Awareness: ${TODO("the moment the manufacturer became aware that this vulnerability is being actively exploited; pass --awareness-at <ISO 8601 with time zone> to compute the deadlines below")}`,
+        "",
+        "| Stage | Article | Due |",
+        "| ----- | ------- | --- |",
+        `| Early warning | 14(2)(a) | ${deadlines ? `${deadlines.earlyWarningDue} (awareness + 24 hours)` : "awareness + 24 hours"} |`,
+        `| Vulnerability notification | 14(2)(b) | ${deadlines ? `${deadlines.notificationDue} (awareness + 72 hours)` : "awareness + 72 hours"} |`,
+        `| Final report | 14(2)(c) | ${deadlines?.finalReportDue ? `${deadlines.finalReportDue} (corrective measure available + 14 days)` : "no later than 14 days after a corrective or mitigating measure is available"} |`,
+        "",
+        "All times are UTC. Deadlines are plain hour and day arithmetic from the timestamps you gave; whether",
+        "any rule on how periods are counted applies to your case is for you or your counsel to confirm.",
+        "",
+        "## 1. Early warning",
+        "",
+        "Article 14(2)(a): without undue delay and in any event within 24 hours of becoming aware.",
+        due(deadlines?.earlyWarningDue, "24 hours", "awareness + 24 hours"),
+        "",
+        "Pre-filled from local data:",
+        "",
+        ...productBlock(product),
+        ...advisoryBlock(cveId, details),
+        ...kevBlock(details),
+        "",
+        "To complete:",
+        "",
+        `- Member States where you know the product has been made available (where applicable): ${TODO("list the Member States")}`,
+        `- Your contact point for this report: ${TODO("name, role and contact details; not taken from any local file")}`,
+        "",
+        "## 2. Vulnerability notification",
+        "",
+        "Article 14(2)(b): within 72 hours of becoming aware, unless the information was already provided.",
+        due(deadlines?.notificationDue, "72 hours", "awareness + 72 hours"),
+        "",
+        "Pre-filled from local data:",
+        "",
+        "**General information about the product, as available**",
+        "",
+        ...productBlock(product),
+        "",
+        "**General nature of the exploit and the vulnerability**",
+        "",
+        ...advisoryBlock(cveId, details),
+        ...kevBlock(details),
+        `- What you know about the exploitation: ${TODO("how and where it was exploited; the CISA listing is a pointer, not your evidence")}`,
+        "",
+        "**Corrective or mitigating measures taken by the manufacturer** (from recorded runs and the policy file; what autoremediator knows about, not necessarily everything you did)",
+        "",
+        ...measuresBlock(findings),
+        "",
+        "To complete:",
+        "",
+        `- Corrective or mitigating measures users can take: ${TODO("for example the product version that contains the fix; the pre-filled measures above concern your dependencies, not your users' actions")}`,
+        `- How sensitive you consider the information to be (where applicable): ${TODO("your assessment")}`,
+        "",
+        "## 3. Final report",
+        "",
+        "Article 14(2)(c): no later than 14 days after a corrective or mitigating measure is available, unless the information was already provided.",
+        finalDue,
+        "",
+        "Pre-filled from local data:",
+        "",
+        "**Description of the vulnerability, including its severity and impact**",
+        "",
+        ...advisoryBlock(cveId, details),
+        `- Impact on your product: ${TODO("what an attacker could do against your product and your users")}`,
+        "",
+        "**Information on any malicious actor exploiting the vulnerability, where available**",
+        "",
+        ...(details?.kev?.knownRansomwareCampaignUse
+            ? [`- CISA's ransomware-use field: ${details.kev.knownRansomwareCampaignUse}`]
+            : []),
+        `- ${TODO("what you know about who is exploiting it; leave empty if nothing is known")}`,
+        "",
+        "**Details of the security update or other corrective measures made available**",
+        "",
+        ...measuresBlock(findings),
+        `- Release that ships the fix to your users: ${TODO("version and date")}`,
+        "",
+        "## Afterwards",
+        "",
+        "- Article 14(8): inform the impacted users, and where appropriate all users, about the vulnerability and the measures they can take, where appropriate in a structured, machine-readable format. `vex/vex.cdx.json` and `vex/vex.openvex.json` in this pack are machine-readable statements about your dependencies; whether they suit your users is your decision.",
+        "- Article 14(6): the CSIRT may ask for an intermediate report.",
+        "",
+        "## Sources",
+        "",
+        "- Regulation (EU) 2024/2847 (Cyber Resilience Act), Official Journal L, 20.11.2024; Article 14 paragraphs 1, 2, 6, 7 and 8, Article 3(42), Article 16.",
+        "- The field lists above follow the text of Article 14(2) as read on springlex.eu and cross-checked against secondary commentary; confirm them against the Official Journal text and against the fields the reporting platform actually shows.",
+        "",
+    ];
+    return {
+        cveId,
+        fileName: `${safeFileStem(cveId)}.md`,
+        markdown: lines.join("\n"),
+        ...(deadlines ? { deadlines } : {}),
+        status,
+    };
+}
+//# sourceMappingURL=cra.js.map

package/dist/api/evidence-pack/cra.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cra.js","sourceRoot":"","sources":["../../../src/api/evidence-pack/cra.ts"],"names":[],"mappings":"AAIA,8FAA8F;AAC9F,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AACtC,iFAAiF;AACjF,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AACrC,kHAAkH;AAClH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC,MAAM,OAAO,GAAG,SAAS,CAAC;AAC1B,MAAM,MAAM,GAAG,EAAE,GAAG,OAAO,CAAC;AAE5B;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,KAAK,GAAG,aAAa;IACjE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,MAAM,KAAK,GACT,uFAAuF,CAAC,IAAI,CAC1F,IAAI,CACL,CAAC;IACJ,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,mHAAmH,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CACrJ,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,IAAI,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACzF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CACrB,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;IACpE,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,IACE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5B,KAAK,GAAG,CAAC;QACT,KAAK,GAAG,EAAE;QACV,GAAG,GAAG,CAAC;QACP,GAAG,GAAG,WAAW;QACjB,IAAI,GAAG,EAAE;QACT,MAAM,GAAG,EAAE;QACX,MAAM,GAAG,EAAE,EACX,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iCAAiC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAaD,yGAAyG;AACzG,MAAM,UAAU,YAAY,CAAC,SAAe,EAAE,4BAAmC;IAC/E,OAAO;QACL,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE;QACpC,eAAe,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,mBAAmB,GAAG,OAAO,CAAC,CAAC,WAAW,EAAE;QAC5F,eAAe,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,kBAAkB,GAAG,OAAO,CAAC,CAAC,WAAW,EAAE;QAC3F,GAAG,CAAC,4BAA4B;YAC9B,CAAC,CAAC;gBACE,cAAc,EAAE,IAAI,IAAI,CACtB,4BAA4B,CAAC,OAAO,EAAE,GAAG,iBAAiB,GAAG,MAAM,CACpE,CAAC,WAAW,EAAE;aAChB;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAYD,2FAA2F;AAC3F,MAAM,UAAU,YAAY,CAAC,EAAU;IACrC,MAAM,IAAI,GAAG,EAAE,CAAC,UAAU,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC/E,OAAO,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACzE,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,gCAAgC,IAAI,KAAK,CAAC;AAEjF,SAAS,YAAY,CAAC,OAAwB;IAC5C,OAAO;QACL,cAAc,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;QAC1H,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,sCAAsC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,mBAAmB,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,gCAAgC,CAAC,EAAE;KACpF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,OAAsC;IAC1E,MAAM,KAAK,GAAG,CAAC,eAAe,KAAK,EAAE,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CACR,2DAA2D,IAAI,CAAC,4BAA4B,CAAC,EAAE,CAChG,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,CAAC,IAAI,CACR,kCAAkC,OAAO,CAAC,OAAO,EAAE,EACnD,eAAe,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB,OAAO,CAAC,SAAS,EAAE,EAAE,CACpH,CAAC;IACF,IAAI,OAAO,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CACR,qBAAqB,OAAO,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,WAAW,OAAO,CAAC,gBAAgB;aACrG,GAAG,CACF,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,eAAe,GAAG,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,oBAAoB,GAAG,CAAC,mBAAmB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACvH;aACA,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,QAAQ,CAAC,OAAsC;IACtD,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,CAAC;IACzB,IAAI,CAAC,GAAG,EAAE,cAAc;QAAE,OAAO,EAAE,CAAC;IACpC,OAAO;QACL,wDAAwD;QACxD,GAAG,CAAC,GAAG,CAAC,SAAS;YACf,CAAC,CAAC;gBACE,6BAA6B,GAAG,CAAC,SAAS,mFAAmF;aAC9H;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,GAAG,CAAC,0BAA0B;YAChC,CAAC,CAAC,CAAC,qDAAqD,GAAG,CAAC,0BAA0B,EAAE,CAAC;YACzF,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,+BAA+B,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACrF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,QAAsB;IAC3C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS;YAC7B,CAAC,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,IAAI,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE;YAC1D,CAAC,CAAC,aAAa,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,wDAAwD,CAAC,CAAC;AAC/F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAS7B;IACC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IACpD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS;QAC/B,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,4BAA4B,CAAC;QACnE,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,MAAM,GACV,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,EAAE,MAAM,IAAI,QAAQ,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC;IAE3F,MAAM,GAAG,GAAG,CAAC,KAAyB,EAAE,KAAa,EAAE,IAAY,EAAU,EAAE,CAC7E,KAAK;QACH,CAAC,CAAC,UAAU,KAAK,OAAO,IAAI,GAAG;QAC/B,CAAC,CAAC,QAAQ,IAAI,CAAC,wEAAwE,KAAK,oCAAoC,CAAC,EAAE,CAAC;IAExI,MAAM,QAAQ,GAAG,SAAS,EAAE,cAAc;QACxC,CAAC,CAAC,UAAU,SAAS,CAAC,cAAc,6CAA6C;QACjF,CAAC,CAAC,QAAQ,IAAI,CAAC,wLAAwL,CAAC,EAAE,CAAC;IAE7M,MAAM,KAAK,GAAa;QACtB,wDAAwD,KAAK,EAAE;QAC/D,EAAE;QACF,uEAAuE;QACvE,oGAAoG;QACpG,mGAAmG;QACnG,oGAAoG;QACpG,gGAAgG;QAChG,iGAAiG;QACjG,mGAAmG;QACnG,wDAAwD;QACxD,EAAE;QACF,aAAa,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,sBAAsB,KAAK,CAAC,WAAW,GAAG;QACtF,EAAE;QACF,aAAa;QACb,EAAE;QACF,KAAK,CAAC,SAAS;YACb,CAAC,CAAC,iCAAiC,SAAU,CAAC,WAAW,EAAE;YAC3D,CAAC,CAAC,cAAc,IAAI,CAAC,4KAA4K,CAAC,EAAE;QACtM,EAAE;QACF,2BAA2B;QAC3B,2BAA2B;QAC3B,gCAAgC,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,eAAe,yBAAyB,CAAC,CAAC,CAAC,sBAAsB,IAAI;QAC9H,6CAA6C,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,eAAe,yBAAyB,CAAC,CAAC,CAAC,sBAAsB,IAAI;QAC3I,+BAA+B,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,cAAc,2CAA2C,CAAC,CAAC,CAAC,6EAA6E,IAAI;QACrN,EAAE;QACF,sGAAsG;QACtG,iGAAiG;QACjG,EAAE;QACF,qBAAqB;QACrB,EAAE;QACF,2FAA2F;QAC3F,GAAG,CAAC,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,sBAAsB,CAAC;QACnE,EAAE;QACF,6BAA6B;QAC7B,EAAE;QACF,GAAG,YAAY,CAAC,OAAO,CAAC;QACxB,GAAG,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC;QAChC,GAAG,QAAQ,CAAC,OAAO,CAAC;QACpB,EAAE;QACF,cAAc;QACd,EAAE;QACF,0FAA0F,IAAI,CAAC,wBAAwB,CAAC,EAAE;QAC1H,yCAAyC,IAAI,CAAC,+DAA+D,CAAC,EAAE;QAChH,EAAE;QACF,kCAAkC;QAClC,EAAE;QACF,mGAAmG;QACnG,GAAG,CAAC,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,sBAAsB,CAAC;QACnE,EAAE;QACF,6BAA6B;QAC7B,EAAE;QACF,yDAAyD;QACzD,EAAE;QACF,GAAG,YAAY,CAAC,OAAO,CAAC;QACxB,EAAE;QACF,yDAAyD;QACzD,EAAE;QACF,GAAG,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC;QAChC,GAAG,QAAQ,CAAC,OAAO,CAAC;QACpB,2CAA2C,IAAI,CAAC,kFAAkF,CAAC,EAAE;QACrI,EAAE;QACF,+KAA+K;QAC/K,EAAE;QACF,GAAG,aAAa,CAAC,QAAQ,CAAC;QAC1B,EAAE;QACF,cAAc;QACd,EAAE;QACF,uDAAuD,IAAI,CAAC,yIAAyI,CAAC,EAAE;QACxM,0EAA0E,IAAI,CAAC,iBAAiB,CAAC,EAAE;QACnG,EAAE;QACF,oBAAoB;QACpB,EAAE;QACF,6IAA6I;QAC7I,QAAQ;QACR,EAAE;QACF,6BAA6B;QAC7B,EAAE;QACF,yEAAyE;QACzE,EAAE;QACF,GAAG,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC;QAChC,6BAA6B,IAAI,CAAC,+DAA+D,CAAC,EAAE;QACpG,EAAE;QACF,sFAAsF;QACtF,EAAE;QACF,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,0BAA0B;YAC1C,CAAC,CAAC,CAAC,kCAAkC,OAAO,CAAC,GAAG,CAAC,0BAA0B,EAAE,CAAC;YAC9E,CAAC,CAAC,EAAE,CAAC;QACP,KAAK,IAAI,CAAC,2EAA2E,CAAC,EAAE;QACxF,EAAE;QACF,gFAAgF;QAChF,EAAE;QACF,GAAG,aAAa,CAAC,QAAQ,CAAC;QAC1B,+CAA+C,IAAI,CAAC,kBAAkB,CAAC,EAAE;QACzE,EAAE;QACF,eAAe;QACf,EAAE;QACF,qWAAqW;QACrW,gEAAgE;QAChE,EAAE;QACF,YAAY;QACZ,EAAE;QACF,wJAAwJ;QACxJ,+OAA+O;QAC/O,EAAE;KACH,CAAC;IAEF,OAAO;QACL,KAAK;QACL,QAAQ,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK;QACrC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC;QAC1B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,MAAM;KACP,CAAC;AACJ,CAAC"}

package/dist/api/evidence-pack/dsse.d.ts

@@ -0,0 +1,53 @@
+import { type KeyObject } from "node:crypto";
+/** Payload type of an in-toto statement inside a DSSE envelope. */
+export declare const INTOTO_PAYLOAD_TYPE = "application/vnd.in-toto+json";
+/**
+ * DSSE pre-authentication encoding (DSSE protocol, "Signature Protocol"):
+ * `"DSSEv1" SP LEN(type) SP type SP LEN(body) SP body`, where SP is one ASCII space and LEN is the
+ * length in bytes as ASCII decimal with no leading zeros. Lengths count UTF-8 bytes, not characters.
+ */
+export declare function pae(payloadType: string, body: string | Uint8Array): Buffer;
+export interface DsseSignature {
+    keyid?: string;
+    /** Base64 of the signature over PAE(payloadType, payload). */
+    sig: string;
+}
+export interface DsseEnvelope {
+    payloadType: string;
+    /** Base64 of the serialized body. */
+    payload: string;
+    signatures: DsseSignature[];
+}
+export type SigningAlgorithm = "ed25519" | "ecdsa-p256-sha256" | "ecdsa-p384-sha384";
+export interface SigningKey {
+    privateKey: KeyObject;
+    algorithm: SigningAlgorithm;
+    /** SHA-256 of the public key's SubjectPublicKeyInfo DER, hex. An unauthenticated hint, never a trust decision. */
+    keyid: string;
+    publicKeyPem: string;
+}
+/** SHA-256 over the SPKI DER of a public key, hex. */
+export declare function keyIdOf(publicKey: KeyObject): string;
+/** Read an unencrypted PEM private key (PKCS#8 or SEC1). Never logs or returns the key material. */
+export declare function loadSigningKey(path: string): SigningKey;
+/** Read a PEM public key for verification. */
+export declare function loadPublicKey(path: string): KeyObject;
+/** Sign `PAE(payloadType, body)`. ECDSA signatures are DER encoded, as Sigstore tooling expects. */
+export declare function signPayload(key: SigningKey, payloadType: string, body: string | Uint8Array): DsseSignature;
+/** A DSSE envelope around `body`; unsigned (`signatures: []`) when no key is given. */
+export declare function createEnvelope(body: string, key: SigningKey | undefined, payloadType?: string): DsseEnvelope;
+/** Decode base64 in either the standard or the URL-safe alphabet; the DSSE protocol allows both. */
+export declare function decodeBase64(text: string): Buffer;
+export type EnvelopeCheck = {
+    ok: true;
+    keyid: string;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Check that at least one signature of the envelope verifies against `publicKey` over the PAE of
+ * the envelope's own payload type and payload. The `keyid` is not used to decide anything.
+ */
+export declare function verifyEnvelope(envelope: DsseEnvelope, publicKey: KeyObject): EnvelopeCheck;
+//# sourceMappingURL=dsse.d.ts.map

package/dist/api/evidence-pack/dsse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dsse.d.ts","sourceRoot":"","sources":["../../../src/api/evidence-pack/dsse.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,SAAS,EACf,MAAM,aAAa,CAAC;AAGrB,mEAAmE;AACnE,eAAO,MAAM,mBAAmB,iCAAiC,CAAC;AAElE;;;;GAIG;AACH,wBAAgB,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAS1E;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,aAAa,EAAE,CAAC;CAC7B;AAED,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,mBAAmB,GAAG,mBAAmB,CAAC;AAErF,MAAM,WAAW,UAAU;IACzB,UAAU,EAAE,SAAS,CAAC;IACtB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,kHAAkH;IAClH,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,sDAAsD;AACtD,wBAAgB,OAAO,CAAC,SAAS,EAAE,SAAS,GAAG,MAAM,CAIpD;AAqBD,oGAAoG;AACpG,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CA2BvD;AAED,8CAA8C;AAC9C,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAoBrD;AAED,oGAAoG;AACpG,wBAAgB,WAAW,CACzB,GAAG,EAAE,UAAU,EACf,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,GAAG,UAAU,GACxB,aAAa,CAGf;AAED,uFAAuF;AACvF,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,UAAU,GAAG,SAAS,EAC3B,WAAW,GAAE,MAA4B,GACxC,YAAY,CAMd;AAED,oGAAoG;AACpG,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,MAAM,MAAM,aAAa,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAExF;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,GAAG,aAAa,CAsB1F"}

package/dist/api/evidence-pack/dsse.js

@@ -0,0 +1,132 @@
+import { createHash, createPrivateKey, createPublicKey, sign as cryptoSign, verify as cryptoVerify, } from "node:crypto";
+import { readFileSync } from "node:fs";
+/** Payload type of an in-toto statement inside a DSSE envelope. */
+export const INTOTO_PAYLOAD_TYPE = "application/vnd.in-toto+json";
+/**
+ * DSSE pre-authentication encoding (DSSE protocol, "Signature Protocol"):
+ * `"DSSEv1" SP LEN(type) SP type SP LEN(body) SP body`, where SP is one ASCII space and LEN is the
+ * length in bytes as ASCII decimal with no leading zeros. Lengths count UTF-8 bytes, not characters.
+ */
+export function pae(payloadType, body) {
+    const type = Buffer.from(payloadType, "utf8");
+    const payload = typeof body === "string" ? Buffer.from(body, "utf8") : Buffer.from(body);
+    return Buffer.concat([
+        Buffer.from(`DSSEv1 ${type.length} `, "ascii"),
+        type,
+        Buffer.from(` ${payload.length} `, "ascii"),
+        payload,
+    ]);
+}
+/** SHA-256 over the SPKI DER of a public key, hex. */
+export function keyIdOf(publicKey) {
+    return createHash("sha256")
+        .update(publicKey.export({ type: "spki", format: "der" }))
+        .digest("hex");
+}
+function algorithmOf(key) {
+    if (key.asymmetricKeyType === "ed25519")
+        return "ed25519";
+    if (key.asymmetricKeyType === "ec") {
+        const curve = key.asymmetricKeyDetails?.namedCurve;
+        if (curve === "prime256v1" || curve === "P-256")
+            return "ecdsa-p256-sha256";
+        if (curve === "secp384r1" || curve === "P-384")
+            return "ecdsa-p384-sha384";
+        throw new Error(`Unsupported ECDSA curve ${String(curve)}; use P-256 or P-384.`);
+    }
+    throw new Error(`Unsupported key type ${String(key.asymmetricKeyType)}; use an Ed25519 or ECDSA (P-256, P-384) key.`);
+}
+const HASH_OF = {
+    ed25519: null,
+    "ecdsa-p256-sha256": "sha256",
+    "ecdsa-p384-sha384": "sha384",
+};
+/** Read an unencrypted PEM private key (PKCS#8 or SEC1). Never logs or returns the key material. */
+export function loadSigningKey(path) {
+    let pem;
+    try {
+        pem = readFileSync(path, "utf8");
+    }
+    catch (error) {
+        throw new Error(`Cannot read the signing key at "${path}": ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+    }
+    let privateKey;
+    try {
+        privateKey = createPrivateKey(pem);
+    }
+    catch (error) {
+        throw new Error(`The signing key at "${path}" is not a usable unencrypted PEM private key (PKCS#8 or SEC1). Generate one with: openssl genpkey -algorithm ed25519 -out evidence-signing.pem`, { cause: error });
+    }
+    const algorithm = algorithmOf(privateKey);
+    const publicKey = createPublicKey(privateKey);
+    return {
+        privateKey,
+        algorithm,
+        keyid: keyIdOf(publicKey),
+        publicKeyPem: publicKey.export({ type: "spki", format: "pem" }),
+    };
+}
+/** Read a PEM public key for verification. */
+export function loadPublicKey(path) {
+    let pem;
+    try {
+        pem = readFileSync(path, "utf8");
+    }
+    catch (error) {
+        throw new Error(`Cannot read the public key at "${path}": ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+    }
+    try {
+        const key = createPublicKey(pem);
+        algorithmOf(key);
+        return key;
+    }
+    catch (error) {
+        throw new Error(`The file at "${path}" is not a usable PEM public key (Ed25519 or ECDSA P-256/P-384): ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+    }
+}
+/** Sign `PAE(payloadType, body)`. ECDSA signatures are DER encoded, as Sigstore tooling expects. */
+export function signPayload(key, payloadType, body) {
+    const signature = cryptoSign(HASH_OF[key.algorithm], pae(payloadType, body), key.privateKey);
+    return { keyid: key.keyid, sig: signature.toString("base64") };
+}
+/** A DSSE envelope around `body`; unsigned (`signatures: []`) when no key is given. */
+export function createEnvelope(body, key, payloadType = INTOTO_PAYLOAD_TYPE) {
+    return {
+        payloadType,
+        payload: Buffer.from(body, "utf8").toString("base64"),
+        signatures: key ? [signPayload(key, payloadType, body)] : [],
+    };
+}
+/** Decode base64 in either the standard or the URL-safe alphabet; the DSSE protocol allows both. */
+export function decodeBase64(text) {
+    return Buffer.from(text.replaceAll("-", "+").replaceAll("_", "/"), "base64");
+}
+/**
+ * Check that at least one signature of the envelope verifies against `publicKey` over the PAE of
+ * the envelope's own payload type and payload. The `keyid` is not used to decide anything.
+ */
+export function verifyEnvelope(envelope, publicKey) {
+    if (typeof envelope?.payloadType !== "string" ||
+        typeof envelope.payload !== "string" ||
+        !Array.isArray(envelope.signatures)) {
+        return { ok: false, reason: "not a DSSE envelope" };
+    }
+    if (envelope.signatures.length === 0)
+        return { ok: false, reason: "the envelope is not signed" };
+    const algorithm = algorithmOf(publicKey);
+    const data = pae(envelope.payloadType, decodeBase64(envelope.payload));
+    for (const entry of envelope.signatures) {
+        if (typeof entry?.sig !== "string")
+            continue;
+        try {
+            if (cryptoVerify(HASH_OF[algorithm], data, publicKey, decodeBase64(entry.sig))) {
+                return { ok: true, keyid: keyIdOf(publicKey) };
+            }
+        }
+        catch {
+            // A malformed signature is a failed one.
+        }
+    }
+    return { ok: false, reason: "no signature verifies against the key" };
+}
+//# sourceMappingURL=dsse.js.map

package/dist/api/evidence-pack/dsse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dsse.js","sourceRoot":"","sources":["../../../src/api/evidence-pack/dsse.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,IAAI,IAAI,UAAU,EAClB,MAAM,IAAI,YAAY,GAEvB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,mEAAmE;AACnE,MAAM,CAAC,MAAM,mBAAmB,GAAG,8BAA8B,CAAC;AAElE;;;;GAIG;AACH,MAAM,UAAU,GAAG,CAAC,WAAmB,EAAE,IAAyB;IAChE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,GAAG,EAAE,OAAO,CAAC;QAC9C,IAAI;QACJ,MAAM,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE,OAAO,CAAC;QAC3C,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAyBD,sDAAsD;AACtD,MAAM,UAAU,OAAO,CAAC,SAAoB;IAC1C,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;SACzD,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAAC,GAAc;IACjC,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1D,IAAI,GAAG,CAAC,iBAAiB,KAAK,IAAI,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,GAAG,CAAC,oBAAoB,EAAE,UAAU,CAAC;QACnD,IAAI,KAAK,KAAK,YAAY,IAAI,KAAK,KAAK,OAAO;YAAE,OAAO,mBAAmB,CAAC;QAC5E,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,OAAO;YAAE,OAAO,mBAAmB,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,IAAI,KAAK,CACb,wBAAwB,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,+CAA+C,CACrG,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,GAA4C;IACvD,OAAO,EAAE,IAAI;IACb,mBAAmB,EAAE,QAAQ;IAC7B,mBAAmB,EAAE,QAAQ;CAC9B,CAAC;AAEF,oGAAoG;AACpG,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,mCAAmC,IAAI,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EACrG,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;IACD,IAAI,UAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,uBAAuB,IAAI,iJAAiJ,EAC5K,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC9C,OAAO;QACL,UAAU;QACV,SAAS;QACT,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC;QACzB,YAAY,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;KAChE,CAAC;AACJ,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,kCAAkC,IAAI,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EACpG,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACjC,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,gBAAgB,IAAI,oEAAoE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAChJ,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,WAAW,CACzB,GAAe,EACf,WAAmB,EACnB,IAAyB;IAEzB,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IAC7F,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;AACjE,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,GAA2B,EAC3B,WAAW,GAAW,mBAAmB;IAEzC,OAAO;QACL,WAAW;QACX,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACrD,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;KAC7D,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC/E,CAAC;AAID;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,QAAsB,EAAE,SAAoB;IACzE,IACE,OAAO,QAAQ,EAAE,WAAW,KAAK,QAAQ;QACzC,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ;QACpC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,EACnC,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IACjG,MAAM,SAAS,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACvE,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;QACxC,IAAI,OAAO,KAAK,EAAE,GAAG,KAAK,QAAQ;YAAE,SAAS;QAC7C,IAAI,CAAC;YACH,IAAI,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC/E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACjD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yCAAyC;QAC3C,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;AACxE,CAAC"}

package/dist/api/evidence-pack/findings.d.ts

@@ -0,0 +1,57 @@
+import type { CveDetails, VexSuppression } from "../../platform/types.js";
+import type { RunRecord, RunStore } from "../../runs/run-store.js";
+export type VexStatus = "fixed" | "affected" | "not_affected" | "under_investigation";
+export type OpenVexJustification = "component_not_present" | "vulnerable_code_not_present" | "vulnerable_code_not_in_execute_path" | "vulnerable_code_cannot_be_controlled_by_adversary" | "inline_mitigations_already_exist";
+export type CycloneDxJustification = "code_not_present" | "protected_by_mitigating_control";
+export interface FindingComponent {
+    name: string;
+    version: string;
+}
+/** One assertion the evidence pack makes about one advisory and, where known, one component. */
+export interface VexFinding {
+    cveId: string;
+    status: VexStatus;
+    /**
+     * What the statement is about: the locked package. For `fixed`, the version that now carries the
+     * fix; otherwise the version the advisory matched. Absent for a policy suppression that matched
+     * no recorded run.
+     */
+    component?: FindingComponent;
+    /** Where the claim comes from: a recorded run and the lockfile, or the project's policy file. */
+    basis: "run" | "policy";
+    runIds: string[];
+    /** One sentence for a human reader. */
+    detail: string;
+    openVexJustification?: OpenVexJustification;
+    cycloneDxJustification?: CycloneDxJustification;
+    /** Required by OpenVEX when the status is `affected`. */
+    actionStatement?: string;
+    /** Free-text reason for a `not_affected` or suppressed statement when no machine-readable justification applies. */
+    impactStatement?: string;
+    /** The version the plan or run moves the component to. */
+    targetVersion?: string;
+    /** Planned or applied fix exists, so CycloneDX `response: update`. */
+    updateAvailable: boolean;
+}
+export interface FindingsResult {
+    findings: VexFinding[];
+    /** Advisory details from the newest recorded report that has them. */
+    cves: Map<string, CveDetails | null>;
+    /** Runs whose report was used, newest first. */
+    usedRuns: string[];
+    notes: string[];
+}
+/**
+ * What the pack asserts, from two sources only: the project's policy suppressions, and the runs
+ * recorded under `.autoremediator/runs/`, read against what the lockfile locks now. Nothing is
+ * looked up and nothing is inferred beyond that; an advisory with no recorded run and no
+ * suppression does not appear.
+ */
+export declare function collectFindings(input: {
+    store: RunStore;
+    runs: RunRecord[];
+    suppressions: VexSuppression[];
+    /** `name@version` the lockfile locks now, or undefined when no lockfile could be read. */
+    locked: Set<string> | undefined;
+}): FindingsResult;
+//# sourceMappingURL=findings.d.ts.map

package/dist/api/evidence-pack/findings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"findings.d.ts","sourceRoot":"","sources":["../../../src/api/evidence-pack/findings.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAC1E,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAGnE,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,UAAU,GAAG,cAAc,GAAG,qBAAqB,CAAC;AAEtF,MAAM,MAAM,oBAAoB,GAC5B,uBAAuB,GACvB,6BAA6B,GAC7B,qCAAqC,GACrC,mDAAmD,GACnD,kCAAkC,CAAC;AAEvC,MAAM,MAAM,sBAAsB,GAAG,kBAAkB,GAAG,iCAAiC,CAAC;AAE5F,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,gGAAgG;AAChG,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,SAAS,CAAC;IAClB;;;;OAIG;IACH,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,iGAAiG;IACjG,KAAK,EAAE,KAAK,GAAG,QAAQ,CAAC;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,uCAAuC;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C,sBAAsB,CAAC,EAAE,sBAAsB,CAAC;IAChD,yDAAyD;IACzD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oHAAoH;IACpH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,0DAA0D;IAC1D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sEAAsE;IACtE,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB,sEAAsE;IACtE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAAC,CAAC;IACrC,gDAAgD;IAChD,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAwLD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE;IACrC,KAAK,EAAE,QAAQ,CAAC;IAChB,IAAI,EAAE,SAAS,EAAE,CAAC;IAClB,YAAY,EAAE,cAAc,EAAE,CAAC;IAC/B,0FAA0F;IAC1F,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;CACjC,GAAG,cAAc,CAgGjB"}