circle-ir-ai 2.47.1 → 2.55.0

package/dist/trust/passes/agent-inventory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-inventory.d.ts","sourceRoot":"","sources":["../../../src/trust/passes/agent-inventory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EACL,KAAK,eAAe,EAIrB,MAAM,aAAa,CAAC;AAMrB,mCAAmC;AACnC,QAAA,MAAM,gBAAgB,UAMrB,CAAC;AAEF,4CAA4C;AAC5C,QAAA,MAAM,iBAAiB,UAStB,CAAC;AAEF,QAAA,MAAM,mBAAmB,UAGxB,CAAC;AAEF,QAAA,MAAM,aAAa,aAGjB,CAAC;AAMH,UAAU,mBAAmB;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,UAAU,yBAAyB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,UAAU,iBAAiB;IACzB,UAAU,EAAE,mBAAmB,EAAE,CAAC;IAClC,gBAAgB,EAAE,yBAAyB,EAAE,CAAC;IAC9C,YAAY,EAAE,MAAM,CAAC;IACrB,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAMD,MAAM,WAAW,qBAAqB;IACpC,iDAAiD;IACjD,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,uDAAuD;IACvD,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAmCD,iBAAS,kBAAkB,CACzB,WAAW,EAAE,MAAM,EACnB,eAAe,CAAC,EAAE,MAAM,EAAE,GACzB,mBAAmB,EAAE,CAwDvB;AAMD,iBAAS,wBAAwB,CAC/B,WAAW,EAAE,MAAM,GAClB,yBAAyB,EAAE,CAyB7B;AAoHD,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,eAAe,CAAC,CA2C1B;AAGD,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,kBAAkB,EAClB,wBAAwB,EACxB,KAAK,iBAAiB,GACvB,CAAC"}
+{"version":3,"file":"agent-inventory.d.ts","sourceRoot":"","sources":["../../../src/trust/passes/agent-inventory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EACL,KAAK,eAAe,EAIrB,MAAM,aAAa,CAAC;AAMrB,mCAAmC;AACnC,QAAA,MAAM,gBAAgB,UAMrB,CAAC;AAEF,4CAA4C;AAC5C,QAAA,MAAM,iBAAiB,UAStB,CAAC;AAEF,QAAA,MAAM,mBAAmB,UAGxB,CAAC;AAEF,QAAA,MAAM,aAAa,aAGjB,CAAC;AAMH,UAAU,mBAAmB;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,UAAU,yBAAyB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,UAAU,iBAAiB;IACzB,UAAU,EAAE,mBAAmB,EAAE,CAAC;IAClC,gBAAgB,EAAE,yBAAyB,EAAE,CAAC;IAC9C,YAAY,EAAE,MAAM,CAAC;IACrB,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAMD,MAAM,WAAW,qBAAqB;IACpC,iDAAiD;IACjD,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,uDAAuD;IACvD,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAmCD,iBAAS,kBAAkB,CACzB,WAAW,EAAE,MAAM,EACnB,eAAe,CAAC,EAAE,MAAM,EAAE,GACzB,mBAAmB,EAAE,CAwDvB;AAMD,iBAAS,wBAAwB,CAC/B,WAAW,EAAE,MAAM,GAClB,yBAAyB,EAAE,CAyB7B;AAoHD,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,eAAe,CAAC,CA8C1B;AAGD,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,kBAAkB,EAClB,wBAAwB,EACxB,KAAK,iBAAiB,GACvB,CAAC"}

package/dist/trust/passes/agent-inventory.js

@@ -265,9 +265,12 @@ export async function agentInventoryPass(projectPath, options = {}) {
     };
     // No agent artifacts found → clean
     if (servers.length === 0 && instructionFiles.length === 0) {
+        // cognium-ai#234 (L1) — no agents/MCP servers/instruction files = no agent
+        // surface to inventory. Inapplicable, not "clean 100".
         return {
             pass: 'agent-inventory',
             score: 100,
+            applicable: false,
             findings: [],
             durationMs: Date.now() - start,
         };

package/dist/trust/passes/agent-inventory.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-inventory.js","sourceRoot":"","sources":["../../../src/trust/passes/agent-inventory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAIL,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAErB,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,mCAAmC;AACnC,MAAM,gBAAgB,GAAG;IACvB,UAAU;IACV,WAAW;IACX,iBAAiB;IACjB,4BAA4B;IAC5B,kBAAkB;CACnB,CAAC;AAEF,4CAA4C;AAC5C,MAAM,iBAAiB,GAAG;IACxB,UAAU;IACV,UAAU;IACV,iBAAiB;IACjB,iBAAiB;IACjB,iCAAiC;IACjC,WAAW;IACX,cAAc;IACd,eAAe;CAChB,CAAC;AAEF,MAAM,mBAAmB,GAAG;IAC1B,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS;IAC3D,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW;CAChD,CAAC;AAEF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK;IACjD,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI;CAC9B,CAAC,CAAC;AAuCH,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,WAAW,CAAC,QAAgB;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB;IAChC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IAClC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,SAAS,kBAAkB,CACzB,WAAmB,EACnB,eAA0B;IAE1B,MAAM,OAAO,GAA0B,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,CAAC,GAAG,gBAAgB,EAAE,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC;IAEnE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YACvC,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAEpC,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,SAAS;QAEvE,MAAM,OAAO,GAAG,IAA+B,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YACrC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,OAAO;YAChD,CAAC,CAAC,OAAO,CAAC;QAEZ,8CAA8C;QAC9C,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACjE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAqC,CAAC;YACjE,KAAK,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC3D,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ;oBAAE,SAAS;gBAC1D,MAAM,MAAM,GAAG,SAAoC,CAAC;gBAEpD,MAAM,OAAO,GAAa,EAAE,CAAC;gBAC7B,IAAI,MAAM,CAAC,GAAG,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;oBACjD,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAA8B,CAAC,CAAC,CAAC;gBACtE,CAAC;gBAED,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI;oBACJ,MAAM;oBACN,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;oBAC5D,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;oBACtE,OAAO;oBACP,SAAS,EAAE,CAAC;oBACZ,eAAe,EAAE,CAAC;iBACnB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,sBAAsB;aACjB,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YAElF,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,SAAS,CAAC;gBACvC,MAAM;gBACN,OAAO,EAAE,EAAE;gBACX,SAAS,EAAE,KAAK,CAAC,MAAM;gBACvB,eAAe,EAAE,WAAW,CAAC,MAAM;aACpC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E,SAAS,wBAAwB,CAC/B,WAAmB;IAEnB,MAAM,KAAK,GAAgC,EAAE,CAAC;IAC9C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IAErC,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACjD,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,gEAAgE;YAChE,IAAI,GAAW,CAAC;YAChB,IAAI,CAAC;gBACH,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAClC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAEpB,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,OAAO;gBACb,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC;aAC9B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,SAAS,gBAAgB,CACvB,OAA8B,EAC9B,gBAA6C,EAC7C,GAAsB;IAEtB,MAAM,QAAQ,GAAmB,EAAE,CAAC;IAEpC,gCAAgC;IAChC,QAAQ,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,iBAAiB;QACvB,MAAM,EAAE,cAAc;QACtB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,WAAW,GAAG,CAAC,YAAY,mBAAmB,GAAG,CAAC,qBAAqB,sBAAsB;QACtG,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC7B,IAAI,EAAE;YACJ,GAAG;SACJ;KACF,CAAC,CAAC;IAEH,sBAAsB;IACtB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,0BAA0B;QAC1B,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,wBAAwB;YAChC,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,eAAe,MAAM,CAAC,IAAI,cAAc,MAAM,CAAC,MAAM,EAAE;YAChE,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE;YACjC,IAAI,EAAE;gBACJ,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;aACnC;SACF,CAAC,CAAC;QAEH,+BAA+B;QAC/B,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACpD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,iBAAiB;oBACvB,MAAM,EAAE,4BAA4B;oBACpC,QAAQ,EAAE,QAAQ;oBAClB,OAAO,EAAE,wBAAwB,MAAM,gCAAgC,MAAM,CAAC,IAAI,QAAQ,MAAM,CAAC,MAAM,EAAE;oBACzG,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE;oBACjC,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE;iBAC1C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,iBAAiB;oBACvB,MAAM,EAAE,yBAAyB;oBACjC,QAAQ,EAAE,QAAQ;oBAClB,OAAO,EAAE,eAAe,MAAM,CAAC,IAAI,mBAAmB,MAAM,CAAC,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE;oBAC3F,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE;oBACjC,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;iBAC3D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,mCAAmC;QACnC,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CACjC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAChD,CAAC;YACF,0DAA0D;YAC1D,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;YACjE,IAAI,YAAY,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/E,8DAA8D;gBAC9D,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,iBAAiB;oBACvB,MAAM,EAAE,sBAAsB;oBAC9B,QAAQ,EAAE,KAAK;oBACf,OAAO,EAAE,eAAe,MAAM,CAAC,IAAI,2CAA2C,YAAY,QAAQ,MAAM,CAAC,MAAM,EAAE;oBACjH,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE;oBACjC,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;iBAC5E,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,gCAAgC;IAChC,KAAK,MAAM,SAAS,IAAI,gBAAgB,EAAE,CAAC;QACzC,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,8BAA8B;YACtC,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,qBAAqB,SAAS,CAAC,IAAI,YAAY,SAAS,CAAC,SAAS,SAAS;YACpF,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE;YAClC,IAAI,EAAE;gBACJ,QAAQ,EAAE,SAAS,CAAC,IAAI;gBACxB,SAAS,EAAE,SAAS,CAAC,SAAS;aAC/B;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,WAAmB,EACnB,UAAiC,EAAE;IAEnC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEzB,WAAW;IACX,MAAM,OAAO,GAAG,kBAAkB,CAAC,WAAW,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IACzE,MAAM,gBAAgB,GAAG,OAAO,CAAC,oBAAoB;QACnD,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,wBAAwB,CAAC,WAAW,CAAC,CAAC;IAE1C,eAAe;IACf,MAAM,GAAG,GAAsB;QAC7B,UAAU,EAAE,OAAO;QACnB,gBAAgB;QAChB,YAAY,EAAE,OAAO,CAAC,MAAM;QAC5B,qBAAqB,EAAE,gBAAgB,CAAC,MAAM;KAC/C,CAAC;IAEF,mCAAmC;IACnC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,KAAK,EAAE,GAAG;YACV,QAAQ,EAAE,EAAE;YACZ,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,oBAAoB;IACpB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAElE,+CAA+C;IAC/C,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,SAAS,IAAI,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC;IAE1D,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,KAAK;QACL,QAAQ;QACR,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC/B,CAAC;AACJ,CAAC;AAED,sBAAsB;AACtB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,kBAAkB,EAClB,wBAAwB,GAEzB,CAAC"}
+{"version":3,"file":"agent-inventory.js","sourceRoot":"","sources":["../../../src/trust/passes/agent-inventory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAIL,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAErB,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,mCAAmC;AACnC,MAAM,gBAAgB,GAAG;IACvB,UAAU;IACV,WAAW;IACX,iBAAiB;IACjB,4BAA4B;IAC5B,kBAAkB;CACnB,CAAC;AAEF,4CAA4C;AAC5C,MAAM,iBAAiB,GAAG;IACxB,UAAU;IACV,UAAU;IACV,iBAAiB;IACjB,iBAAiB;IACjB,iCAAiC;IACjC,WAAW;IACX,cAAc;IACd,eAAe;CAChB,CAAC;AAEF,MAAM,mBAAmB,GAAG;IAC1B,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS;IAC3D,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW;CAChD,CAAC;AAEF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK;IACjD,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI;CAC9B,CAAC,CAAC;AAuCH,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,WAAW,CAAC,QAAgB;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB;IAChC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IAClC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,SAAS,kBAAkB,CACzB,WAAmB,EACnB,eAA0B;IAE1B,MAAM,OAAO,GAA0B,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,CAAC,GAAG,gBAAgB,EAAE,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC;IAEnE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YACvC,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAEpC,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,SAAS;QAEvE,MAAM,OAAO,GAAG,IAA+B,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YACrC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,OAAO;YAChD,CAAC,CAAC,OAAO,CAAC;QAEZ,8CAA8C;QAC9C,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACjE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAqC,CAAC;YACjE,KAAK,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC3D,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ;oBAAE,SAAS;gBAC1D,MAAM,MAAM,GAAG,SAAoC,CAAC;gBAEpD,MAAM,OAAO,GAAa,EAAE,CAAC;gBAC7B,IAAI,MAAM,CAAC,GAAG,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;oBACjD,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAA8B,CAAC,CAAC,CAAC;gBACtE,CAAC;gBAED,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI;oBACJ,MAAM;oBACN,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;oBAC5D,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;oBACtE,OAAO;oBACP,SAAS,EAAE,CAAC;oBACZ,eAAe,EAAE,CAAC;iBACnB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,sBAAsB;aACjB,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YAElF,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,SAAS,CAAC;gBACvC,MAAM;gBACN,OAAO,EAAE,EAAE;gBACX,SAAS,EAAE,KAAK,CAAC,MAAM;gBACvB,eAAe,EAAE,WAAW,CAAC,MAAM;aACpC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E,SAAS,wBAAwB,CAC/B,WAAmB;IAEnB,MAAM,KAAK,GAAgC,EAAE,CAAC;IAC9C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IAErC,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACjD,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,gEAAgE;YAChE,IAAI,GAAW,CAAC;YAChB,IAAI,CAAC;gBACH,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAClC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAEpB,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,OAAO;gBACb,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC;aAC9B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,SAAS,gBAAgB,CACvB,OAA8B,EAC9B,gBAA6C,EAC7C,GAAsB;IAEtB,MAAM,QAAQ,GAAmB,EAAE,CAAC;IAEpC,gCAAgC;IAChC,QAAQ,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,iBAAiB;QACvB,MAAM,EAAE,cAAc;QACtB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,WAAW,GAAG,CAAC,YAAY,mBAAmB,GAAG,CAAC,qBAAqB,sBAAsB;QACtG,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC7B,IAAI,EAAE;YACJ,GAAG;SACJ;KACF,CAAC,CAAC;IAEH,sBAAsB;IACtB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,0BAA0B;QAC1B,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,wBAAwB;YAChC,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,eAAe,MAAM,CAAC,IAAI,cAAc,MAAM,CAAC,MAAM,EAAE;YAChE,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE;YACjC,IAAI,EAAE;gBACJ,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;aACnC;SACF,CAAC,CAAC;QAEH,+BAA+B;QAC/B,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACpD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,iBAAiB;oBACvB,MAAM,EAAE,4BAA4B;oBACpC,QAAQ,EAAE,QAAQ;oBAClB,OAAO,EAAE,wBAAwB,MAAM,gCAAgC,MAAM,CAAC,IAAI,QAAQ,MAAM,CAAC,MAAM,EAAE;oBACzG,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE;oBACjC,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE;iBAC1C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,iBAAiB;oBACvB,MAAM,EAAE,yBAAyB;oBACjC,QAAQ,EAAE,QAAQ;oBAClB,OAAO,EAAE,eAAe,MAAM,CAAC,IAAI,mBAAmB,MAAM,CAAC,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE;oBAC3F,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE;oBACjC,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;iBAC3D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,mCAAmC;QACnC,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CACjC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAChD,CAAC;YACF,0DAA0D;YAC1D,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;YACjE,IAAI,YAAY,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/E,8DAA8D;gBAC9D,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,iBAAiB;oBACvB,MAAM,EAAE,sBAAsB;oBAC9B,QAAQ,EAAE,KAAK;oBACf,OAAO,EAAE,eAAe,MAAM,CAAC,IAAI,2CAA2C,YAAY,QAAQ,MAAM,CAAC,MAAM,EAAE;oBACjH,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE;oBACjC,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;iBAC5E,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,gCAAgC;IAChC,KAAK,MAAM,SAAS,IAAI,gBAAgB,EAAE,CAAC;QACzC,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,8BAA8B;YACtC,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,qBAAqB,SAAS,CAAC,IAAI,YAAY,SAAS,CAAC,SAAS,SAAS;YACpF,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE;YAClC,IAAI,EAAE;gBACJ,QAAQ,EAAE,SAAS,CAAC,IAAI;gBACxB,SAAS,EAAE,SAAS,CAAC,SAAS;aAC/B;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,WAAmB,EACnB,UAAiC,EAAE;IAEnC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEzB,WAAW;IACX,MAAM,OAAO,GAAG,kBAAkB,CAAC,WAAW,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IACzE,MAAM,gBAAgB,GAAG,OAAO,CAAC,oBAAoB;QACnD,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,wBAAwB,CAAC,WAAW,CAAC,CAAC;IAE1C,eAAe;IACf,MAAM,GAAG,GAAsB;QAC7B,UAAU,EAAE,OAAO;QACnB,gBAAgB;QAChB,YAAY,EAAE,OAAO,CAAC,MAAM;QAC5B,qBAAqB,EAAE,gBAAgB,CAAC,MAAM;KAC/C,CAAC;IAEF,mCAAmC;IACnC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,2EAA2E;QAC3E,uDAAuD;QACvD,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,KAAK,EAAE,GAAG;YACV,UAAU,EAAE,KAAK;YACjB,QAAQ,EAAE,EAAE;YACZ,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,oBAAoB;IACpB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAElE,+CAA+C;IAC/C,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,SAAS,IAAI,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC;IAE1D,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,KAAK;QACL,QAAQ;QACR,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC/B,CAAC;AACJ,CAAC;AAED,sBAAsB;AACtB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,kBAAkB,EAClB,wBAAwB,GAEzB,CAAC"}

package/dist/trust/passes/ai-config-detect.d.ts

@@ -0,0 +1,45 @@
+/**
+ * cognium-ai#211 — recognize AI-agent config / tool-manifest files regardless
+ * of their exact filename.
+ *
+ * The AI-native trust passes (tool-poisoning LLM04, excessive-permissions
+ * LLM06, agent-inventory) historically gated on an exact-name allowlist
+ * (`mcp.json`, `tool.json`, `manifest.json`, …). The #120 corpus names its
+ * fixtures descriptively (`mcp_tool_poisoning.json`, `excessive_agency.json`),
+ * so they never matched and the passes reported zero recall — even though the
+ * detectors work (proven: the identical content under `mcp.json` fires). Real
+ * repos are the same: an MCP manifest can live at any path/name.
+ *
+ * This recognizes such files two ways, either sufficient:
+ *   1. **name** — a JSON/YAML whose basename mentions an AI-agent artifact
+ *      (mcp / tool / manifest / plugin / agent / skill / openapi / swagger /
+ *      functions), OR
+ *   2. **content shape** — a JSON object with a top-level `tools`,
+ *      `mcpServers`, `servers`, `functions`, or `plugins` key (the canonical
+ *      MCP / tool-manifest shape).
+ *
+ * Name matching is cheap; content sniffing is gated to `.json`/`.yaml` files
+ * and a cheap regex pre-check before `JSON.parse`, so the walk cost stays
+ * proportional to config files, not the whole repo.
+ */
+/** True if the basename looks like an AI-agent config/manifest file. */
+export declare function looksLikeAiConfigName(basename: string): boolean;
+/**
+ * True if the (JSON) content has a top-level tool/agent-manifest key. Cheap
+ * regex pre-check gates the `JSON.parse`, so non-manifest JSON is rejected
+ * without parsing.
+ */
+export declare function looksLikeAiManifestContent(content: string): boolean;
+/**
+ * Combined recognizer used by the file walkers. `content` is optional — when
+ * omitted (or the file isn't JSON/YAML), only the name is considered.
+ */
+export declare function isAiConfigFile(basename: string, content?: string): boolean;
+/**
+ * cognium-ai#211 — walk a project tree for AI-agent config / manifest files,
+ * matched by fuzzy name or (for JSON/YAML) manifest content shape. Bounded in
+ * depth and count; skips heavy build/dep dirs. Shared by the AI-native passes
+ * so they all catch a manifest regardless of its exact name or location.
+ */
+export declare function walkAiConfigFiles(root: string, maxFiles?: number, maxDepth?: number): string[];
+//# sourceMappingURL=ai-config-detect.d.ts.map

package/dist/trust/passes/ai-config-detect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-config-detect.d.ts","sourceRoot":"","sources":["../../../src/trust/passes/ai-config-detect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAUH,wEAAwE;AACxE,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAYnE;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAM1E;AAUD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,SAAM,EAAE,QAAQ,SAAI,GAAG,MAAM,EAAE,CA+BtF"}

package/dist/trust/passes/ai-config-detect.js

@@ -0,0 +1,116 @@
+/**
+ * cognium-ai#211 — recognize AI-agent config / tool-manifest files regardless
+ * of their exact filename.
+ *
+ * The AI-native trust passes (tool-poisoning LLM04, excessive-permissions
+ * LLM06, agent-inventory) historically gated on an exact-name allowlist
+ * (`mcp.json`, `tool.json`, `manifest.json`, …). The #120 corpus names its
+ * fixtures descriptively (`mcp_tool_poisoning.json`, `excessive_agency.json`),
+ * so they never matched and the passes reported zero recall — even though the
+ * detectors work (proven: the identical content under `mcp.json` fires). Real
+ * repos are the same: an MCP manifest can live at any path/name.
+ *
+ * This recognizes such files two ways, either sufficient:
+ *   1. **name** — a JSON/YAML whose basename mentions an AI-agent artifact
+ *      (mcp / tool / manifest / plugin / agent / skill / openapi / swagger /
+ *      functions), OR
+ *   2. **content shape** — a JSON object with a top-level `tools`,
+ *      `mcpServers`, `servers`, `functions`, or `plugins` key (the canonical
+ *      MCP / tool-manifest shape).
+ *
+ * Name matching is cheap; content sniffing is gated to `.json`/`.yaml` files
+ * and a cheap regex pre-check before `JSON.parse`, so the walk cost stays
+ * proportional to config files, not the whole repo.
+ */
+/** Basenames that mention an AI-agent artifact + a config extension. */
+const AI_CONFIG_NAME_RE = /(?:^|[-_.])(?:mcp|tool|manifest|plugin|agents?|skills?|openapi|swagger|functions?)(?:[-_.].*)?\.(?:json|ya?ml)$/i;
+/** Top-level manifest keys that mark a JSON as an AI tool/agent config. */
+const MANIFEST_KEYS = ['tools', 'mcpServers', 'servers', 'functions', 'plugins'];
+const MANIFEST_KEY_RE = /["'](?:tools|mcpServers|servers|functions|plugins)["']\s*:/;
+/** True if the basename looks like an AI-agent config/manifest file. */
+export function looksLikeAiConfigName(basename) {
+    return AI_CONFIG_NAME_RE.test(basename);
+}
+/**
+ * True if the (JSON) content has a top-level tool/agent-manifest key. Cheap
+ * regex pre-check gates the `JSON.parse`, so non-manifest JSON is rejected
+ * without parsing.
+ */
+export function looksLikeAiManifestContent(content) {
+    if (!MANIFEST_KEY_RE.test(content))
+        return false;
+    try {
+        const obj = JSON.parse(content);
+        return (!!obj &&
+            typeof obj === 'object' &&
+            MANIFEST_KEYS.some((k) => obj[k] !== undefined));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Combined recognizer used by the file walkers. `content` is optional — when
+ * omitted (or the file isn't JSON/YAML), only the name is considered.
+ */
+export function isAiConfigFile(basename, content) {
+    if (looksLikeAiConfigName(basename))
+        return true;
+    if (content !== undefined && /\.(json|ya?ml)$/i.test(basename)) {
+        return looksLikeAiManifestContent(content);
+    }
+    return false;
+}
+import * as fs from 'fs';
+import * as path from 'path';
+const WALK_SKIP_DIRS = new Set([
+    'node_modules', '.git', 'dist', 'build', 'out', 'vendor', '.venv',
+    'venv', '__pycache__', 'coverage', '.next', 'target',
+]);
+/**
+ * cognium-ai#211 — walk a project tree for AI-agent config / manifest files,
+ * matched by fuzzy name or (for JSON/YAML) manifest content shape. Bounded in
+ * depth and count; skips heavy build/dep dirs. Shared by the AI-native passes
+ * so they all catch a manifest regardless of its exact name or location.
+ */
+export function walkAiConfigFiles(root, maxFiles = 200, maxDepth = 8) {
+    const out = [];
+    const walk = (dir, depth) => {
+        if (depth > maxDepth || out.length >= maxFiles)
+            return;
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            if (out.length >= maxFiles)
+                break;
+            const full = path.join(dir, e.name);
+            if (e.isDirectory()) {
+                if (!WALK_SKIP_DIRS.has(e.name) && !e.name.startsWith('.'))
+                    walk(full, depth + 1);
+                continue;
+            }
+            if (!e.isFile())
+                continue;
+            if (looksLikeAiConfigName(e.name)) {
+                out.push(full);
+            }
+            else if (/\.(json|ya?ml)$/i.test(e.name)) {
+                try {
+                    if (looksLikeAiManifestContent(fs.readFileSync(full, 'utf-8')))
+                        out.push(full);
+                }
+                catch {
+                    /* unreadable — skip */
+                }
+            }
+        }
+    };
+    walk(root, 0);
+    return out;
+}
+//# sourceMappingURL=ai-config-detect.js.map

package/dist/trust/passes/ai-config-detect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-config-detect.js","sourceRoot":"","sources":["../../../src/trust/passes/ai-config-detect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,wEAAwE;AACxE,MAAM,iBAAiB,GACrB,kHAAkH,CAAC;AAErH,2EAA2E;AAC3E,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,CAAU,CAAC;AAC1F,MAAM,eAAe,GAAG,4DAA4D,CAAC;AAErF,wEAAwE;AACxE,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,OAAO,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAe;IACxD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA4B,CAAC;QAC3D,OAAO,CACL,CAAC,CAAC,GAAG;YACL,OAAO,GAAG,KAAK,QAAQ;YACvB,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAChD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,OAAgB;IAC/D,IAAI,qBAAqB,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,OAAO,KAAK,SAAS,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/D,OAAO,0BAA0B,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO;IACjE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ;CACrD,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,QAAQ,GAAG,GAAG,EAAE,QAAQ,GAAG,CAAC;IAC1E,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,KAAa,EAAQ,EAAE;QAChD,IAAI,KAAK,GAAG,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,QAAQ;YAAE,OAAO;QACvD,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,GAAG,CAAC,MAAM,IAAI,QAAQ;gBAAE,MAAM;YAClC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBACpB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBAClF,SAAS;YACX,CAAC;YACD,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE;gBAAE,SAAS;YAC1B,IAAI,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC;iBAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3C,IAAI,CAAC;oBACH,IAAI,0BAA0B,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;wBAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjF,CAAC;gBAAC,MAAM,CAAC;oBACP,uBAAuB;gBACzB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACd,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/trust/passes/crypto-weakness.d.ts

@@ -0,0 +1,30 @@
+/**
+ * cognium-ai#234 (L3) — cryptographic weakness trust pass.
+ *
+ * `crypto_score` was a permanent 100: no pass ever fed it, so every repo —
+ * MD5-hashing, DES-ECB-encrypting, `java.util.Random`-for-tokens or not —
+ * reported a clean crypto component (see the #234 critical review). circle-ir
+ * already emits the relevant findings during `analyze()` (weak-hash CWE-328,
+ * weak-crypto CWE-327, weak-random CWE-330, weak-cipher, weak-rsa-key CWE-326,
+ * static-iv, unsalted/weak password hashing). This pass consumes those
+ * findings — zero extra analysis cost, no regex reimplementation (per the
+ * SAST/Tree-sitter ownership boundary) — and turns crypto into a real signal.
+ *
+ * Coverage-honest (L1): `applicable` is `false` when circle-ir analysis did
+ * NOT run (static-only trust with no `circleIRResults`), so a 100 means "the
+ * crypto SAST passes ran and found nothing weak", never "we couldn't look".
+ */
+import type { CircleIR } from 'circle-ir';
+import { type TrustPassResult } from '../types.js';
+export interface CryptoWeaknessOptions {
+    /** Pre-computed CircleIR results (from analyze()). */
+    circleIRResults?: CircleIR[];
+}
+/**
+ * circle-ir pass names that represent cryptographic-primitive weaknesses.
+ * Curated allowlist (not every `weak-*` pass is crypto — e.g. `weak-value`
+ * is a general code-quality signal, `insecure-cookie` is session handling).
+ */
+export declare const CRYPTO_PASS_NAMES: Set<string>;
+export declare function cryptoWeaknessPass(options?: CryptoWeaknessOptions): TrustPassResult;
+//# sourceMappingURL=crypto-weakness.d.ts.map

package/dist/trust/passes/crypto-weakness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-weakness.d.ts","sourceRoot":"","sources":["../../../src/trust/passes/crypto-weakness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAe,MAAM,WAAW,CAAC;AACvD,OAAO,EACL,KAAK,eAAe,EAIrB,MAAM,aAAa,CAAC;AAErB,MAAM,WAAW,qBAAqB;IACpC,sDAAsD;IACtD,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC;CAC9B;AAED;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,aAU5B,CAAC;AAsBH,wBAAgB,kBAAkB,CAChC,OAAO,GAAE,qBAA0B,GAClC,eAAe,CAgCjB"}

package/dist/trust/passes/crypto-weakness.js

@@ -0,0 +1,68 @@
+import { SEVERITY_WEIGHTS, } from '../types.js';
+/**
+ * circle-ir pass names that represent cryptographic-primitive weaknesses.
+ * Curated allowlist (not every `weak-*` pass is crypto — e.g. `weak-value`
+ * is a general code-quality signal, `insecure-cookie` is session handling).
+ */
+export const CRYPTO_PASS_NAMES = new Set([
+    'weak-crypto', // CWE-327 broken/risky algorithm (DES, RC4, ECB…)
+    'weak-hash', // CWE-328 weak hash (MD5, SHA-1)
+    'weak-random', // CWE-330 insecure PRNG for security context
+    'weak-cipher', // CWE-327 weak cipher configuration
+    'weak-rsa-key', // CWE-326 inadequate key size
+    'weak-password-hash', // CWE-916 weak password hashing
+    'weak-password-encoding', // CWE-261 weak password encoding
+    'fast-unsalted-hash', // CWE-759/760 unsalted / fast password hash
+    'static-iv', // CWE-329 static/hardcoded IV
+]);
+const VALID_SEVERITIES = new Set(['critical', 'high', 'medium', 'low']);
+function mapSeverity(severity) {
+    return VALID_SEVERITIES.has(severity) ? severity : 'low';
+}
+function adaptFinding(sast) {
+    return {
+        pass: 'crypto-weakness',
+        ruleId: sast.rule_id,
+        severity: mapSeverity(sast.severity),
+        message: sast.message,
+        location: { file: sast.file, line: sast.line, column: sast.column },
+        meta: {
+            ...(sast.cwe ? { cwe: sast.cwe } : {}),
+            sourcePass: sast.pass,
+            ...(sast.evidence ?? {}),
+        },
+    };
+}
+export function cryptoWeaknessPass(options = {}) {
+    const start = Date.now();
+    const irs = options.circleIRResults;
+    const findings = [];
+    if (irs) {
+        for (const ir of irs) {
+            for (const sast of ir.findings ?? []) {
+                if (CRYPTO_PASS_NAMES.has(sast.pass))
+                    findings.push(adaptFinding(sast));
+            }
+        }
+    }
+    let deduction = 0;
+    for (const f of findings)
+        deduction += SEVERITY_WEIGHTS[f.severity];
+    const score = Math.max(0, Math.min(100, 100 - deduction));
+    return {
+        pass: 'crypto-weakness',
+        score,
+        // L1 — validated only when circle-ir analysis actually ran. Static-only
+        // trust (no circleIRResults) never looked at crypto → inapplicable, not a
+        // fake clean 100.
+        applicable: (irs?.length ?? 0) > 0,
+        findings: findings.length > 0 ? findings : [{
+                pass: 'crypto-weakness',
+                ruleId: 'crypto-clean',
+                severity: 'info',
+                message: 'No weak cryptographic primitives detected (hash/cipher/PRNG/key)',
+            }],
+        durationMs: Date.now() - start,
+    };
+}
+//# sourceMappingURL=crypto-weakness.js.map

package/dist/trust/passes/crypto-weakness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-weakness.js","sourceRoot":"","sources":["../../../src/trust/passes/crypto-weakness.ts"],"names":[],"mappings":"AAiBA,OAAO,EAIL,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAOrB;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAS;IAC/C,aAAa,EAAa,kDAAkD;IAC5E,WAAW,EAAe,iCAAiC;IAC3D,aAAa,EAAa,6CAA6C;IACvE,aAAa,EAAa,oCAAoC;IAC9D,cAAc,EAAY,8BAA8B;IACxD,oBAAoB,EAAM,gCAAgC;IAC1D,wBAAwB,EAAE,iCAAiC;IAC3D,oBAAoB,EAAM,4CAA4C;IACtE,WAAW,EAAe,8BAA8B;CACzD,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AACxE,SAAS,WAAW,CAAC,QAAgB;IACnC,OAAO,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAE,QAA0B,CAAC,CAAC,CAAC,KAAK,CAAC;AAC9E,CAAC;AAED,SAAS,YAAY,CAAC,IAAiB;IACrC,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,MAAM,EAAE,IAAI,CAAC,OAAO;QACpB,QAAQ,EAAE,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC;QACpC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;QACnE,IAAI,EAAE;YACJ,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtC,UAAU,EAAE,IAAI,CAAC,IAAI;YACrB,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;SACzB;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,UAAiC,EAAE;IAEnC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,GAAG,GAAG,OAAO,CAAC,eAAe,CAAC;IACpC,MAAM,QAAQ,GAAmB,EAAE,CAAC;IAEpC,IAAI,GAAG,EAAE,CAAC;QACR,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;gBACrC,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,SAAS,IAAI,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC;IAE1D,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,KAAK;QACL,wEAAwE;QACxE,0EAA0E;QAC1E,kBAAkB;QAClB,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;QAClC,QAAQ,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAC1C,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EAAE,cAAc;gBACtB,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,kEAAkE;aAC5E,CAAC;QACF,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC/B,CAAC;AACJ,CAAC"}

package/dist/trust/passes/dep-manifests.d.ts

@@ -0,0 +1,25 @@
+export type Ecosystem = 'Maven' | 'PyPI' | 'Go' | 'crates.io' | 'npm';
+export interface EcosystemDep {
+    ecosystem: Ecosystem;
+    /** OSV package name (Maven: `group:artifact`; others: package name). */
+    name: string;
+    version: string;
+    /** Manifest the dep came from (repo-relative). */
+    file: string;
+}
+export interface ParseResult {
+    deps: EcosystemDep[];
+    /** Count of entries dropped for an unresolvable version (transparency). */
+    skipped: number;
+}
+export declare function parseMavenPom(content: string, file: string): ParseResult;
+export declare function parsePipRequirements(content: string, file: string): ParseResult;
+export declare function parseGoMod(content: string, file: string): ParseResult;
+export declare function parseCargoLock(content: string, file: string): ParseResult;
+/**
+ * Walk `root`, parse every recognized manifest, and return the merged,
+ * de-duplicated dependency set + total skipped count. Bounded in depth and
+ * file count so a monorepo doesn't blow up.
+ */
+export declare function parseAllManifests(root: string, maxFiles?: number, maxDepth?: number): ParseResult;
+//# sourceMappingURL=dep-manifests.d.ts.map

package/dist/trust/passes/dep-manifests.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dep-manifests.d.ts","sourceRoot":"","sources":["../../../src/trust/passes/dep-manifests.ts"],"names":[],"mappings":"AAgBA,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,MAAM,GAAG,IAAI,GAAG,WAAW,GAAG,KAAK,CAAC;AAEtE,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,SAAS,CAAC;IACrB,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,YAAY,EAAE,CAAC;IACrB,2EAA2E;IAC3E,OAAO,EAAE,MAAM,CAAC;CACjB;AAmBD,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAuBxE;AAMD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAe/E;AAMD,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAWrE;AAMD,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAWzE;AAqBD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,SAAM,EAAE,QAAQ,SAAK,GAAG,WAAW,CA6B1F"}

package/dist/trust/passes/dep-manifests.js

@@ -0,0 +1,190 @@
+/**
+ * cognium-ai#234 (L2) — multi-ecosystem dependency manifest parsers.
+ *
+ * Extracts `{ ecosystem, name, version }` triples from the common manifests so
+ * the OSV audit can check known CVEs across ecosystems (not just npm). Pure
+ * functions of file content — unit-testable without a filesystem — plus a
+ * bounded walker that finds and parses the manifests in a project tree.
+ *
+ * Ecosystem names match OSV's (`Maven`, `PyPI`, `Go`, `crates.io`, `npm`).
+ * Only dependencies with a *resolvable literal version* are emitted; ones
+ * whose version is a property/range/parent-managed reference we can't resolve
+ * statically are dropped and reported via `skipped` so coverage stays honest.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+// ---------------------------------------------------------------------------
+// Maven — pom.xml
+// ---------------------------------------------------------------------------
+/** Resolve `${prop}` versions against the pom's own <properties> block. */
+function mavenProperties(content) {
+    const props = new Map();
+    const propsBlock = /<properties>([\s\S]*?)<\/properties>/i.exec(content);
+    if (propsBlock) {
+        const re = /<([a-zA-Z0-9._-]+)>\s*([^<]+?)\s*<\/\1>/g;
+        let m;
+        while ((m = re.exec(propsBlock[1])) !== null)
+            props.set(m[1], m[2].trim());
+    }
+    // project.version / common built-ins are left unresolved (dropped).
+    return props;
+}
+export function parseMavenPom(content, file) {
+    const deps = [];
+    let skipped = 0;
+    const props = mavenProperties(content);
+    const depRe = /<dependency>([\s\S]*?)<\/dependency>/gi;
+    let block;
+    while ((block = depRe.exec(content)) !== null) {
+        const b = block[1];
+        const gid = /<groupId>\s*([^<]+?)\s*<\/groupId>/i.exec(b)?.[1];
+        const aid = /<artifactId>\s*([^<]+?)\s*<\/artifactId>/i.exec(b)?.[1];
+        let ver = /<version>\s*([^<]+?)\s*<\/version>/i.exec(b)?.[1];
+        if (!gid || !aid)
+            continue;
+        if (!ver) {
+            skipped++;
+            continue;
+        } // managed/parent version — can't resolve
+        const prop = /^\$\{([^}]+)\}$/.exec(ver.trim());
+        if (prop) {
+            const resolved = props.get(prop[1]);
+            if (!resolved || /\$\{/.test(resolved)) {
+                skipped++;
+                continue;
+            }
+            ver = resolved;
+        }
+        if (/[\$\[\](),]/.test(ver)) {
+            skipped++;
+            continue;
+        } // range / unresolved
+        deps.push({ ecosystem: 'Maven', name: `${gid}:${aid}`, version: ver, file });
+    }
+    return { deps, skipped };
+}
+// ---------------------------------------------------------------------------
+// PyPI — requirements.txt
+// ---------------------------------------------------------------------------
+export function parsePipRequirements(content, file) {
+    const deps = [];
+    let skipped = 0;
+    for (const raw of content.split(/\r?\n/)) {
+        const line = raw.replace(/#.*$/, '').trim();
+        if (!line || line.startsWith('-'))
+            continue; // comment / -r / -e / options
+        // name==version  (only exact pins are safely resolvable)
+        const m = /^([A-Za-z0-9._-]+)\s*(?:\[[^\]]*\])?\s*==\s*([A-Za-z0-9._+!-]+)/.exec(line);
+        if (m) {
+            deps.push({ ecosystem: 'PyPI', name: m[1].toLowerCase().replace(/[_.]+/g, '-'), version: m[2], file });
+        }
+        else if (/^[A-Za-z0-9._-]+\s*[<>~!]=?/.test(line)) {
+            skipped++; // range/compatible-release — not an exact version
+        }
+    }
+    return { deps, skipped };
+}
+// ---------------------------------------------------------------------------
+// Go — go.mod
+// ---------------------------------------------------------------------------
+export function parseGoMod(content, file) {
+    const deps = [];
+    let skipped = 0;
+    // Both `require ( ... )` blocks and single `require mod v` lines.
+    const reqLine = /^\s*(?:require\s+)?([a-z0-9./_-]+\.[a-z0-9./_-]+)\s+(v[0-9][\w.\-+]*)\s*(\/\/\s*indirect)?\s*$/gim;
+    let m;
+    while ((m = reqLine.exec(content)) !== null) {
+        // pseudo-versions (v0.0.0-date-hash) are valid to OSV; keep them.
+        deps.push({ ecosystem: 'Go', name: m[1], version: m[2], file });
+    }
+    return { deps, skipped };
+}
+// ---------------------------------------------------------------------------
+// crates.io — Cargo.lock
+// ---------------------------------------------------------------------------
+export function parseCargoLock(content, file) {
+    const deps = [];
+    let skipped = 0;
+    const pkgRe = /\[\[package\]\]\s*([\s\S]*?)(?=\n\[\[|\n\[|$)/g;
+    let block;
+    while ((block = pkgRe.exec(content)) !== null) {
+        const name = /name\s*=\s*"([^"]+)"/.exec(block[1])?.[1];
+        const version = /version\s*=\s*"([^"]+)"/.exec(block[1])?.[1];
+        if (name && version)
+            deps.push({ ecosystem: 'crates.io', name, version, file });
+    }
+    return { deps, skipped };
+}
+// ---------------------------------------------------------------------------
+// Walker
+// ---------------------------------------------------------------------------
+const MANIFEST_SKIP_DIRS = new Set([
+    'node_modules', '.git', 'dist', 'build', 'out', 'target', 'vendor',
+    '.venv', 'venv', '__pycache__', '.gradle', 'coverage',
+]);
+/** file basename → parser. */
+function parserFor(basename) {
+    const b = basename.toLowerCase();
+    if (b === 'pom.xml')
+        return parseMavenPom;
+    if (b === 'requirements.txt')
+        return parsePipRequirements;
+    if (b === 'go.mod')
+        return parseGoMod;
+    if (b === 'cargo.lock')
+        return parseCargoLock;
+    return null;
+}
+/**
+ * Walk `root`, parse every recognized manifest, and return the merged,
+ * de-duplicated dependency set + total skipped count. Bounded in depth and
+ * file count so a monorepo doesn't blow up.
+ */
+export function parseAllManifests(root, maxFiles = 400, maxDepth = 10) {
+    const deps = [];
+    const seen = new Set();
+    let skipped = 0;
+    let filesParsed = 0;
+    const walk = (dir, depth) => {
+        if (depth > maxDepth || filesParsed >= maxFiles)
+            return;
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            if (filesParsed >= maxFiles)
+                break;
+            const full = path.join(dir, e.name);
+            if (e.isDirectory()) {
+                if (!MANIFEST_SKIP_DIRS.has(e.name))
+                    walk(full, depth + 1);
+                continue;
+            }
+            if (!e.isFile())
+                continue;
+            const parser = parserFor(e.name);
+            if (!parser)
+                continue;
+            filesParsed++;
+            try {
+                const res = parser(fs.readFileSync(full, 'utf-8'), path.relative(root, full));
+                skipped += res.skipped;
+                for (const d of res.deps) {
+                    const key = `${d.ecosystem}|${d.name}|${d.version}`;
+                    if (!seen.has(key)) {
+                        seen.add(key);
+                        deps.push(d);
+                    }
+                }
+            }
+            catch { /* unreadable manifest — skip */ }
+        }
+    };
+    walk(root, 0);
+    return { deps, skipped };
+}
+//# sourceMappingURL=dep-manifests.js.map

package/dist/trust/passes/dep-manifests.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dep-manifests.js","sourceRoot":"","sources":["../../../src/trust/passes/dep-manifests.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAmB7B,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,2EAA2E;AAC3E,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,MAAM,UAAU,GAAG,uCAAuC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzE,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,EAAE,GAAG,0CAA0C,CAAC;QACtD,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,oEAAoE;IACpE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,IAAY;IACzD,MAAM,IAAI,GAAmB,EAAE,CAAC;IAChC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,wCAAwC,CAAC;IACvD,IAAI,KAA6B,CAAC;IAClC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9C,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACnB,MAAM,GAAG,GAAG,qCAAqC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,2CAA2C,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACrE,IAAI,GAAG,GAAG,qCAAqC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG;YAAE,SAAS;QAC3B,IAAI,CAAC,GAAG,EAAE,CAAC;YAAC,OAAO,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC,CAAC,yCAAyC;QAC5E,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAChD,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACpC,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAAC,OAAO,EAAE,CAAC;gBAAC,SAAS;YAAC,CAAC;YAChE,GAAG,GAAG,QAAQ,CAAC;QACjB,CAAC;QACD,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAC,OAAO,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC,CAAC,qBAAqB;QAC3E,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,GAAG,IAAI,GAAG,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,IAAY;IAChE,MAAM,IAAI,GAAmB,EAAE,CAAC;IAChC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,8BAA8B;QAC3E,yDAAyD;QACzD,MAAM,CAAC,GAAG,iEAAiE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvF,IAAI,CAAC,EAAE,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QACzG,CAAC;aAAM,IAAI,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACpD,OAAO,EAAE,CAAC,CAAC,kDAAkD;QAC/D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,MAAM,UAAU,UAAU,CAAC,OAAe,EAAE,IAAY;IACtD,MAAM,IAAI,GAAmB,EAAE,CAAC;IAChC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,kEAAkE;IAClE,MAAM,OAAO,GAAG,mGAAmG,CAAC;IACpH,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC5C,kEAAkE;QAClE,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,IAAY;IAC1D,MAAM,IAAI,GAAmB,EAAE,CAAC;IAChC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,KAAK,GAAG,gDAAgD,CAAC;IAC/D,IAAI,KAA6B,CAAC;IAClC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9D,IAAI,IAAI,IAAI,OAAO;YAAE,IAAI,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ;IAClE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU;CACtD,CAAC,CAAC;AAEH,8BAA8B;AAC9B,SAAS,SAAS,CAAC,QAAgB;IACjC,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,aAAa,CAAC;IAC1C,IAAI,CAAC,KAAK,kBAAkB;QAAE,OAAO,oBAAoB,CAAC;IAC1D,IAAI,CAAC,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC;IACtC,IAAI,CAAC,KAAK,YAAY;QAAE,OAAO,cAAc,CAAC;IAC9C,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,QAAQ,GAAG,GAAG,EAAE,QAAQ,GAAG,EAAE;IAC3E,MAAM,IAAI,GAAmB,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,KAAa,EAAQ,EAAE;QAChD,IAAI,KAAK,GAAG,QAAQ,IAAI,WAAW,IAAI,QAAQ;YAAE,OAAO;QACxD,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO;QAAC,CAAC;QACjF,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,WAAW,IAAI,QAAQ;gBAAE,MAAM;YACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YAC9F,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE;gBAAE,SAAS;YAC1B,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,CAAC,MAAM;gBAAE,SAAS;YACtB,WAAW,EAAE,CAAC;YACd,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;gBAC9E,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC;gBACvB,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;oBACzB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;oBACpD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;wBAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;wBAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAAC,CAAC;gBACtD,CAAC;YACH,CAAC;YAAC,MAAM,CAAC,CAAC,gCAAgC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACd,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC"}

package/dist/trust/passes/dependency-audit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dependency-audit.d.ts","sourceRoot":"","sources":["../../../src/trust/passes/dependency-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,EACL,KAAK,eAAe,EAEpB,KAAK,aAAa,EAEnB,MAAM,aAAa,CAAC;AAMrB,sDAAsD;AACtD,QAAA,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAMnD,CAAC;AA8BF,MAAM,WAAW,sBAAsB;IACrC,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wDAAwD;IACxD,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAMD,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,eAAe,CAAC,CA+F1B;AAkBD,OAAO,EAAE,gBAAgB,EAAE,CAAC"}
+{"version":3,"file":"dependency-audit.d.ts","sourceRoot":"","sources":["../../../src/trust/passes/dependency-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,EACL,KAAK,eAAe,EAEpB,KAAK,aAAa,EAEnB,MAAM,aAAa,CAAC;AAMrB,sDAAsD;AACtD,QAAA,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAMnD,CAAC;AA8BF,MAAM,WAAW,sBAAsB;IACrC,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wDAAwD;IACxD,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAMD,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,eAAe,CAAC,CAmG1B;AAkBD,OAAO,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/trust/passes/dependency-audit.js

@@ -35,6 +35,10 @@ export async function dependencyAuditPass(projectPath, options = {}) {
         return {
             pass: 'dependency-audit',
             score: 100,
+            // cognium-ai#234 (L1) — no lockfile means we could NOT audit deps (this
+            // is every non-npm repo). The 100 is "didn't look", not "no CVEs" — mark
+            // inapplicable so it doesn't inflate supply_chain.
+            applicable: false,
             findings: [{
                     pass: 'dependency-audit',
                     ruleId: 'audit-skipped',

package/dist/trust/passes/dependency-audit.js.map

@@ -1 +1 @@
-{"version":3,"file":"dependency-audit.js","sourceRoot":"","sources":["../../../src/trust/passes/dependency-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAIL,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAErB,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,sDAAsD;AACtD,MAAM,gBAAgB,GAAkC;IACtD,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,QAAQ;IAClB,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;CACb,CAAC;AAqCF,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,WAAmB,EACnB,UAAkC,EAAE;IAEpC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC;IAEzC,8BAA8B;IAC9B,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IACjE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,KAAK,EAAE,GAAG;YACV,QAAQ,EAAE,CAAC;oBACT,IAAI,EAAE,kBAAkB;oBACxB,MAAM,EAAE,eAAe;oBACvB,QAAQ,EAAE,MAAM;oBAChB,OAAO,EAAE,+CAA+C;oBACxD,IAAI,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE;iBAChC,CAAC;YACF,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,uBAAuB;IACvB,IAAI,WAA2B,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC;QAC7D,MAAM,MAAM,GAAG,QAAQ,CACrB,mBAAmB,QAAQ,EAAE,EAC7B;YACE,GAAG,EAAE,WAAW;YAChB,OAAO;YACP,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CACF,CAAC;QACF,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,+DAA+D;QAC/D,4CAA4C;QAC5C,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;YAC5D,IAAI,CAAC;gBACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAE,KAA4B,CAAC,MAAM,CAAC,CAAC;YACjE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,eAAe,CAAC,mBAAmB,EAAE,qCAAqC,EAAE,KAAK,CAAC,CAAC;YAC5F,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,eAAe,CAAC,mBAAmB,EAAE,8CAA8C,EAAE,KAAK,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,IAAI,WAAW,CAAC,eAAe,EAAE,CAAC;QAChC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,CAAC;YACvE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC;YAE3D,iCAAiC;YACjC,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,MAAM,CACxC,CAAC,CAAC,EAAoB,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAC/C,CAAC;YACF,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,0BAA0B,IAAI,EAAE,CAAC;YACvE,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;YAC/B,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;YAEpD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,kBAAkB;gBACxB,MAAM,EAAE,SAAS,IAAI,CAAC,QAAQ,IAAI,IAAI,EAAE;gBACxC,QAAQ;gBACR,OAAO,EAAE,GAAG,IAAI,KAAK,KAAK,EAAE;gBAC5B,QAAQ,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE;gBACvC,IAAI,EAAE;oBACJ,OAAO,EAAE,IAAI;oBACb,WAAW,EAAE,IAAI,CAAC,QAAQ;oBAC1B,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,WAAW,EAAE,GAAG;oBAChB,IAAI;iBACL;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,kBAAkB;IAClB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,SAAS,IAAI,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC;IAE1D,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,KAAK;QACL,QAAQ;QACR,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC/B,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,MAAc,EAAE,OAAe,EAAE,KAAa;IACrE,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,KAAK,EAAE,GAAG;QACV,QAAQ,EAAE,CAAC;gBACT,IAAI,EAAE,kBAAkB;gBACxB,MAAM;gBACN,QAAQ,EAAE,MAAM;gBAChB,OAAO;gBACP,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;aACzB,CAAC;QACF,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC/B,CAAC;AACJ,CAAC;AAED,sBAAsB;AACtB,OAAO,EAAE,gBAAgB,EAAE,CAAC"}
+{"version":3,"file":"dependency-audit.js","sourceRoot":"","sources":["../../../src/trust/passes/dependency-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAIL,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAErB,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,sDAAsD;AACtD,MAAM,gBAAgB,GAAkC;IACtD,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,QAAQ;IAClB,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;CACb,CAAC;AAqCF,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,WAAmB,EACnB,UAAkC,EAAE;IAEpC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,KAAK,CAAC;IAEzC,8BAA8B;IAC9B,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IACjE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,KAAK,EAAE,GAAG;YACV,wEAAwE;YACxE,yEAAyE;YACzE,mDAAmD;YACnD,UAAU,EAAE,KAAK;YACjB,QAAQ,EAAE,CAAC;oBACT,IAAI,EAAE,kBAAkB;oBACxB,MAAM,EAAE,eAAe;oBACvB,QAAQ,EAAE,MAAM;oBAChB,OAAO,EAAE,+CAA+C;oBACxD,IAAI,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE;iBAChC,CAAC;YACF,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,uBAAuB;IACvB,IAAI,WAA2B,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC;QAC7D,MAAM,MAAM,GAAG,QAAQ,CACrB,mBAAmB,QAAQ,EAAE,EAC7B;YACE,GAAG,EAAE,WAAW;YAChB,OAAO;YACP,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CACF,CAAC;QACF,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,+DAA+D;QAC/D,4CAA4C;QAC5C,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;YAC5D,IAAI,CAAC;gBACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAE,KAA4B,CAAC,MAAM,CAAC,CAAC;YACjE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,eAAe,CAAC,mBAAmB,EAAE,qCAAqC,EAAE,KAAK,CAAC,CAAC;YAC5F,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,eAAe,CAAC,mBAAmB,EAAE,8CAA8C,EAAE,KAAK,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,IAAI,WAAW,CAAC,eAAe,EAAE,CAAC;QAChC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,CAAC;YACvE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC;YAE3D,iCAAiC;YACjC,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,MAAM,CACxC,CAAC,CAAC,EAAoB,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAC/C,CAAC;YACF,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,0BAA0B,IAAI,EAAE,CAAC;YACvE,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;YAC/B,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;YAEpD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,kBAAkB;gBACxB,MAAM,EAAE,SAAS,IAAI,CAAC,QAAQ,IAAI,IAAI,EAAE;gBACxC,QAAQ;gBACR,OAAO,EAAE,GAAG,IAAI,KAAK,KAAK,EAAE;gBAC5B,QAAQ,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE;gBACvC,IAAI,EAAE;oBACJ,OAAO,EAAE,IAAI;oBACb,WAAW,EAAE,IAAI,CAAC,QAAQ;oBAC1B,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,WAAW,EAAE,GAAG;oBAChB,IAAI;iBACL;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,kBAAkB;IAClB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,SAAS,IAAI,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC;IAE1D,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,KAAK;QACL,QAAQ;QACR,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC/B,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,MAAc,EAAE,OAAe,EAAE,KAAa;IACrE,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,KAAK,EAAE,GAAG;QACV,QAAQ,EAAE,CAAC;gBACT,IAAI,EAAE,kBAAkB;gBACxB,MAAM;gBACN,QAAQ,EAAE,MAAM;gBAChB,OAAO;gBACP,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;aACzB,CAAC;QACF,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC/B,CAAC;AACJ,CAAC;AAED,sBAAsB;AACtB,OAAO,EAAE,gBAAgB,EAAE,CAAC"}

package/dist/trust/passes/dependency-staleness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dependency-staleness.d.ts","sourceRoot":"","sources":["../../../src/trust/passes/dependency-staleness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,EACL,KAAK,eAAe,EAEpB,KAAK,aAAa,EAEnB,MAAM,aAAa,CAAC;AAMrB,QAAA,MAAM,iBAAiB,+BAA+B,CAAC;AACvD,QAAA,MAAM,YAAY,2BAA2B,CAAC;AAI9C,UAAU,aAAa;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,aAAa,CAAC;CACzB;AAED,QAAA,MAAM,eAAe,EAAE,aAAa,EAInC,CAAC;AAMF,MAAM,WAAW,0BAA0B;IACzC,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,uBAAuB;IACvB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,yEAAyE;IACzE,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAMD,iBAAS,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE5C;AAED,UAAU,cAAc;IACtB,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,iBAAe,gBAAgB,CAC7B,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,cAAc,CAAC,CAmCzB;AAeD,UAAU,gBAAgB;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAMD;;GAEG;AACH,iBAAS,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED;;GAEG;AACH,iBAAe,oBAAoB,CACjC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAkC7B;AAED;;GAEG;AACH,iBAAS,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAKnD;AAiCD,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,eAAe,CAAC,CA6H1B;AAGD,OAAO,EACL,UAAU,EACV,eAAe,EACf,iBAAiB,EACjB,YAAY,EACZ,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,GACf,CAAC"}
+{"version":3,"file":"dependency-staleness.d.ts","sourceRoot":"","sources":["../../../src/trust/passes/dependency-staleness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,EACL,KAAK,eAAe,EAEpB,KAAK,aAAa,EAEnB,MAAM,aAAa,CAAC;AAMrB,QAAA,MAAM,iBAAiB,+BAA+B,CAAC;AACvD,QAAA,MAAM,YAAY,2BAA2B,CAAC;AAI9C,UAAU,aAAa;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,aAAa,CAAC;CACzB;AAED,QAAA,MAAM,eAAe,EAAE,aAAa,EAInC,CAAC;AAMF,MAAM,WAAW,0BAA0B;IACzC,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,uBAAuB;IACvB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,yEAAyE;IACzE,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAMD,iBAAS,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE5C;AAED,UAAU,cAAc;IACtB,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,iBAAe,gBAAgB,CAC7B,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,cAAc,CAAC,CAmCzB;AAeD,UAAU,gBAAgB;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAMD;;GAEG;AACH,iBAAS,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED;;GAEG;AACH,iBAAe,oBAAoB,CACjC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAkC7B;AAED;;GAEG;AACH,iBAAS,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAKnD;AAiCD,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,eAAe,CAAC,CAgI1B;AAGD,OAAO,EACL,UAAU,EACV,eAAe,EACf,iBAAiB,EACjB,YAAY,EACZ,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,GACf,CAAC"}