circle-ir-ai 2.48.0 → 2.55.0

package/CHANGELOG.md

@@ -5,6 +5,255 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.55.0] - 2026-07-16
+
+### Changed — L6 ecosystem-aware weighting: ai_safety drops out on non-AI repos (cognium-ai#234 L6)
+
+The #234 review: *"ai_safety 20% shouldn't be a constant on non-AI repos"* —
+on a normal app all 6 ai_safety passes scored 100 (nothing to fire on), so a
+fifth of every trust score was a constant 100. L6 fixes this **not** with a
+separate ecosystem weight table but by making category validation honest, so
+L1's existing validated-category re-normalization redistributes the weight
+automatically ("weight by what's validated"). Two passes were spuriously
+keeping ai_safety alive on non-AI repos:
+
+- **`eu-ai-act-flags` bug** — its no-AI-project branch returned `score: 100`
+  with a finding message literally saying *"not applicable"*, but never set
+  `applicable: false`. L1 therefore counted it as a validated clean 100. Now
+  set correctly.
+- **`ai-generated-fingerprint` miscategorization** — it measures code
+  *provenance* (was this AI-written), not an AI-safety *threat*. It runs on any
+  source and is legitimately clean-100 on human-written code, so it can't be
+  gated on findings ("no AI patterns" is a real clean result, not "couldn't
+  look"). As an ai_safety member it kept that category permanently validated.
+  Moved to `artifacts` (informational, weight 0): still reported via
+  `provenance_score` + findings, but no longer anchors a security category.
+
+Result on a non-AI repo: all five remaining ai_safety passes (prompt-injection,
+tool-poisoning, excessive-permissions, agent-inventory, eu-ai-act-flags) are
+`applicable: false` → the category is unvalidated → its 20% is re-normalized
+across the validated legs (supply_chain / code_security / compliance). On an AI
+repo the threat passes fire and ai_safety counts again. Example: a non-AI repo
+with supply_chain 90 / code_security 60 / compliance 100 now scores 81.25
+(coverageWeight 0.80) instead of diluting toward a fake-100 ai_safety leg.
+AI repos are unaffected (ai_safety still validates and counts). 5 new tests.
+
+## [2.54.0] - 2026-07-16
+
+### Added — L5 de-saturate code_security (cognium-ai#234 L5)
+
+The synthetic `llm-security-scan` pass (weight **10** in code_security) scored
+findings with a linear penalty clamped to [0,100]:
+`100 - (crit×25 + high×10 + med×3 + low×1)`. That pins to 0 the moment the load
+crosses 100 — ~4 criticals — so on a large repo (the #234 review saw 28,300 raw
+findings) **3 vulns and 3,000 both scored ≈0**: a heavily-weighted pass carrying
+no signal beyond "something fired".
+
+New `discriminatingSecurityScore()` (`src/trust/security-score.ts`) replaces the
+linear clamp with **rational (reciprocal) decay** on the same severity-weighted
+load: `100 × SCALE / (SCALE + load)`, `SCALE = 90`. 100 at load 0; 50 at load =
+SCALE; monotonic; asymptotic to 0 but never pinned there, so it keeps ranking
+across the whole range. Severity weights are unchanged, so "which repo is worse"
+ordering is preserved — only the saturation is removed.
+
+Before → after (crit/high/med/low → score):
+
+| findings | old (linear) | new (decay) |
+|---|---:|---:|
+| 1/0/0/0 | 75 | 78.3 |
+| 4/0/0/0 | **0** | 47.4 |
+| 10/2/5/0 | **0** | 24.0 |
+| 50/100/500/1000 | **0** | 1.9 |
+| 500/2000/8000/18000 | **0** | 0.12 |
+
+Numeric leniency at moderate counts is intentional and safe: the BLOCKED tier
+override still fires on ANY critical finding regardless of this number, so a
+repo with real criticals cannot pass on score alone. Exported
+`discriminatingSecurityScore` / `securityLoad` / `SECURITY_SEVERITY_PENALTY` /
+`SECURITY_SCORE_SCALE` for the CLI (and future engine passes that saturate).
+8 new unit tests.
+
+## [2.53.0] - 2026-07-16
+
+### Added — L4 reachability factor is now live (cognium-ai#234 L4)
+
+`reachability_factor` shipped as a hardcoded `1.0` since the trust score's
+inception (T9 vuln-reachability was deferred as "complex call-graph analysis")
+— the #234 critical review flagged it as a dead leg. circle-ir emits taint
+flows during `analyze()`, so reachability is now measured, not faked:
+
+- New `computeReachabilityFactor(circleIRResults)` (`src/trust/reachability.ts`).
+  A dangerous **sink** reached by an *unsanitized* taint **flow** is a
+  confirmed exploitable path; a sink no flow reaches is dormant. The factor is
+  a bounded penalty multiplier on the composite:
+  `1 - MAX_PENALTY × (reachable dangerous sinks / all dangerous sinks)`, with
+  `MAX_PENALTY = 0.15`. Sinks are keyed per-file so line numbers don't collide;
+  an absent `sanitized` flag counts as unsanitized (conservative).
+- `computeTrustScore` gains an optional third arg
+  `context: { circleIRResults? }`. The factor multiplies the coverage-
+  normalized composite **before** tier derivation, so a confirmed-reachable
+  exploit can pull a borderline repo down a tier. **Backward compatible:** every
+  caller that omits `context` gets a neutral 1.0 — byte-identical to pre-L4.
+- **Coverage-honest (L1 discipline):** `reachabilityDetail.measured` is `false`
+  (⇒ neutral 1.0) when circle-ir didn't run OR there are no dangerous sinks —
+  never a fake penalty for something we couldn't see. Full breakdown
+  (`dangerousSinks`, `reachableSinks`, `unsanitizedFlows`, `reachableRatio`)
+  emitted in the additive `reachabilityDetail` field.
+
+Verified live: a real SQLi source→sink flow → factor 0.85, composite 80 → 68.
+11 new unit tests. drift/freshness factors remain neutral (later L-series).
+
+## [2.52.0] - 2026-07-16
+
+### Added — L3 cryptographic-weakness trust pass (cognium-ai#234 L3)
+
+New `crypto-weakness` trust pass (code_security → `crypto_score`). `crypto_score`
+was a permanent 100 — no pass ever fed it, so an MD5-hashing, DES-ECB-encrypting,
+`java.util.Random`-for-tokens repo reported a clean crypto component (see the
+#234 critical review). circle-ir already emits the relevant findings during
+`analyze()`; this pass consumes them (zero extra analysis cost, no regex
+reimplementation — respects the SAST/Tree-sitter ownership boundary):
+
+- Curated `CRYPTO_PASS_NAMES` allowlist: `weak-crypto` (CWE-327), `weak-hash`
+  (CWE-328), `weak-random` (CWE-330), `weak-cipher`, `weak-rsa-key` (CWE-326),
+  `weak-password-hash` (CWE-916), `weak-password-encoding`, `fast-unsalted-hash`,
+  `static-iv` (CWE-329). Non-crypto `weak-*` passes (e.g. `weak-value`,
+  `insecure-cookie`) are deliberately excluded.
+- **Coverage-honest (L1):** `applicable: false` when circle-ir analysis did not
+  run (static-only trust, no `circleIRResults`) — a 100 means "the crypto SAST
+  passes ran and found nothing weak", never "we couldn't look".
+- Wired into `PASS_CATEGORY_MAP` (code_security) + `PASS_COMPONENT_MAP`
+  (crypto_score) and exported from `src/trust/index.ts`.
+
+Verified live: MD5 + DES/ECB + `java.util.Random` → 4 findings, `crypto_score`
+70. 8 new unit tests.
+
+### Changed — component scores respect L1 applicability (cognium-ai#234)
+
+`computeTrustScore` step 4 now skips `applicable === false` passes when filling
+the display component buckets (`crypto_score`, `permission_score`, …), symmetric
+with the composite. Previously an inapplicable pass pushed its default 100 into
+the bucket, so a component shared by an applicable low score and an inapplicable
+sibling was inflated (e.g. `permission_score` = avg(real 40, fake 100) = 70).
+Now such a bucket reflects only the passes that actually looked; a fully
+unvalidated component still defaults to 100.
+
+## [2.51.0] - 2026-07-16
+
+### Added — L2 ecosystem-agnostic dependency CVE audit via OSV.dev (cognium-ai#234 L2)
+
+New `osv-dependency-audit` trust pass (supply_chain). The existing
+`dependency-audit` pass shells out to `npm audit`, so it is blind on every
+non-npm repo — a Maven project reported a clean 100 with zero dependency
+validation (see the #234 critical review). This pass closes that gap:
+
+- **Multi-ecosystem manifest parsers** (`src/trust/passes/dep-manifests.ts`) —
+  pure, unit-tested functions for `pom.xml` (Maven, with `${prop}` resolution),
+  `requirements.txt` (PyPI, exact `==` pins), `go.mod` (Go, incl.
+  pseudo-versions), and `Cargo.lock` (crates.io). Only *resolvable literal
+  versions* are emitted; managed/range/unresolvable entries are dropped and
+  counted in `skipped` so coverage stays honest. Bounded tree walker
+  (`parseAllManifests`, 400 files / depth 10, skips node_modules/target/…).
+- **OSV.dev query** (`src/trust/passes/osv-dependency-audit.ts`) — one chunked
+  `POST /v1/querybatch` for detection, then bounded `GET /v1/vulns/{id}` detail
+  fetches (default cap 40, cached within the run) to resolve worst-case
+  severity and CVE aliases. Severity maps from `database_specific.severity`
+  (conservative `high` default for a known vuln with no machine-readable
+  severity).
+- **Coverage-honest (L1)** — `applicable: false` when there are no resolvable
+  dependencies OR OSV is unreachable/timed out: it degrades to *unvalidated*,
+  never a fake clean 100. `OSV_AUDIT=0` kill-switch; per-request timeout
+  (default 15s) with `AbortController`.
+
+Verified live against OSV.dev: `log4j-core@2.14.1` → 7 CVEs (critical),
+`jackson-databind@2.9.8` → 55 CVEs (critical). Wired into `PASS_CATEGORY_MAP`
+(supply_chain) + `PASS_COMPONENT_MAP` (supply_chain_score) and exported from
+`src/trust/index.ts`. 12 new unit tests (pure parsers + injected-fetch OSV
+mapping + applicable/offline behavior).
+
+## [2.50.1] - 2026-07-16
+
+### Changed — L1 coverage: wire the AI-safety + compliance passes' applicability (cognium-ai#234 L1 phase 2)
+
+Extends the coverage dimension to the ecosystem/artifact-gated passes. They now
+signal `applicable: false` when there's nothing to look at, so their 100 no
+longer inflates the category:
+
+- `tool-poisoning` / `prompt-injection` — inapplicable when no tool manifest /
+  skill/prompt file is present (only when a manifest exists is the 100 real).
+- `excessive-permissions` / `agent-inventory` — inapplicable when no MCP/agent
+  config is found.
+- `license-compliance` / `malicious-install-script` — inapplicable off npm
+  (no `package.json`).
+
+**Effect (apache/camel, Maven):** score 73.93 → **67.41**, `coverageWeight`
+0.8 — **compliance now drops out entirely** (validated=false: both its passes
+are npm-only), so the score stops crediting 20% for a category it couldn't
+assess, and `ai_safety` reports its 3 inapplicable manifest passes. The score
+now reflects what was actually validated. 3 new applicability tests (1434).
+
+## [2.50.0] - 2026-07-16
+
+### Changed — trust score is coverage-aware: "didn't look" no longer scores 100 (cognium-ai#234 L1)
+
+The keystone of the trust-completeness umbrella (#234). A critical review found
+the score conflated **cleanliness with coverage**: a pass that couldn't apply
+(wrong ecosystem, no relevant files) returned 100, and an empty category
+defaulted to 100 — so a high score often meant "we lacked the leg to look,"
+not "it's safe" (e.g. npm-only dependency audit reporting a clean 100 on a
+Maven repo).
+
+- New `TrustPassResult.applicable` (default `true`). A pass sets it `false`
+  when it could not look; that 100 is then **excluded** from its category
+  average instead of inflating it.
+- `computeTrustScore` is now **coverage-aware**: the composite is the weighted
+  mean of only the **validated** categories, with weights **re-normalized**
+  across them. An unvalidated category (no applicable pass) is excluded rather
+  than treated as a clean 100.
+- New additive output: `categoryCoverage[]` (per-category `validated` /
+  `score` / `inapplicablePasses`) and `coverageWeight` (fraction of default
+  weight that was validated — low = the score rests on few real legs).
+- Wired the npm-only supply-chain passes to signal inapplicability off npm:
+  `dependency-audit` (no `package-lock.json`), `dependency-staleness` /
+  `typosquat-detection` (no `package.json`).
+
+**Trust scores may change** for repos where a category was previously inflated
+by inapplicable passes (validated on apache/camel: 76.18 → 73.93, and
+`supply_chain` now honestly reports `inapplicable=[typosquat, dependency-
+staleness, dependency-audit]` instead of hiding them in a 97.5 average). No
+change where all passes applied. 5 new scoring tests (1434 total).
+
+## [2.49.0] - 2026-07-16
+
+### Fixed — AI-native trust recall: LLM04 + LLM06 now fire on any-named manifest (cognium-ai#211)
+
+The AI-safety trust passes reported zero recall (#120) — not because the
+detectors are broken, but because they gated on an **exact-name allowlist**
+(`{mcp.json, tool.json, manifest.json, …}`). A manifest named
+`mcp_tool_poisoning.json`, or anywhere but the project root, was never read.
+Triage proved it: identical poisoned content under `mcp.json` fired 3
+findings; under `mcp_tool_poisoning.json`, zero.
+
+New `src/trust/passes/ai-config-detect.ts` recognizes AI-agent config /
+tool-manifest files two ways — **fuzzy name** (basename mentions
+mcp/tool/manifest/plugin/agent/skill/openapi/…) or **content shape** (a JSON
+with a top-level `tools`/`mcpServers`/`servers`/`functions`/`plugins` key). A
+cheap regex pre-check gates the `JSON.parse`, so plain JSON isn't scanned.
+Wired into:
+
+- **LLM04 tool-poisoning** — fires on a poisoned manifest of any name /
+  location (validated: `mcp.json`, `mcp_tool_poisoning.json`, `config/xyz.json`,
+  `a/b/registry.json` all detect; plain JSON ignored).
+- **LLM06 excessive-permissions** — walks for any-named MCP/agent config, not
+  just root `mcp.json`.
+- **LLM01 prompt-injection** — its skill-bundle scan now also reads any-named
+  AI-config manifests for embedded directives.
+
+**Out of scope (filed):** LLM01 *application-code* prompt injection (untrusted
+input → LLM-call prompt) needs a taint sink in circle-ir, not regex — filed as
+#233. Trust scores may change on repos that ship AI manifests (that's the
+zero-recall bug being corrected). 13 new tests (1432 total).
+
 ## [2.48.0] - 2026-07-16
 
 ### Performance — gate the scan cluster pass on whether its output is consumed (cognium-ai#231)

package/dist/trust/index.d.ts

@@ -3,7 +3,7 @@
  *
  * Trust scoring system: passes, badge generation, and shared types.
  */
-export { type TrustSeverity, type TrustTier, type TierReason, type BlockingFinding, type TrustFinding, type TrustPassResult, type TrustScoreResult, TIER_THRESHOLDS, TIER_COLORS, SEVERITY_WEIGHTS, getTierForScore, } from './types.js';
+export { type TrustSeverity, type TrustTier, type TierReason, type BlockingFinding, type TrustFinding, type TrustPassResult, type TrustScoreResult, type CategoryCoverage, type ReachabilityDetail, TIER_THRESHOLDS, TIER_COLORS, SEVERITY_WEIGHTS, getTierForScore, } from './types.js';
 export { hardcodedSecretsPass, type HardcodedSecretsOptions, } from './passes/hardcoded-secrets.js';
 export { licenseCompliancePass, cargoLicenseCompliancePass, scanLicenseCompliance, COPYLEFT_SEVERITY, type LicenseComplianceOptions, type CargoLicenseComplianceOptions, type LicenseFinding, type LicenseScanResult, type LicenseScanOptions, type PackageEcosystem, } from './passes/license-compliance.js';
 export { typosquatDetectionPass, type TyposquatDetectionOptions, } from './passes/typosquat-detection.js';
@@ -17,6 +17,8 @@ export { sbomGenerationPass, type SBOMGenerationOptions, } from './passes/sbom-g
 export { auditTrailPass, type AuditTrailOptions, } from './passes/audit-trail.js';
 export { vexGenerationPass, type VEXGenerationOptions, } from './passes/vex-generation.js';
 export { dependencyAuditPass, type DependencyAuditOptions, } from './passes/dependency-audit.js';
+export { osvDependencyAuditPass, type OsvAuditOptions, } from './passes/osv-dependency-audit.js';
+export { parseAllManifests, parseMavenPom, parsePipRequirements, parseGoMod, parseCargoLock, type EcosystemDep, type Ecosystem, type ParseResult, } from './passes/dep-manifests.js';
 export { codeComplexityPass, type CodeComplexityOptions, } from './passes/code-complexity.js';
 export { inputValidationPass, type InputValidationOptions, } from './passes/input-validation.js';
 export { euAiActFlagsPass, type EuAiActFlagsOptions, } from './passes/eu-ai-act-flags.js';
@@ -24,10 +26,13 @@ export { toolPoisoningPass, type ToolPoisoningOptions, } from './passes/tool-poi
 export { aiGeneratedFingerprintPass, type AiGeneratedFingerprintOptions, } from './passes/ai-generated-fingerprint.js';
 export { cacheInvalidationPass, type PerformancePassOptions, } from './passes/performance-passes.js';
 export { adaptCircleIRFindings, type CircleIRFindingsAdapterOptions, } from './passes/circlir-findings-adapter.js';
+export { cryptoWeaknessPass, CRYPTO_PASS_NAMES, type CryptoWeaknessOptions, } from './passes/crypto-weakness.js';
+export { computeReachabilityFactor, REACHABILITY_MAX_PENALTY, } from './reachability.js';
+export { discriminatingSecurityScore, securityLoad, SECURITY_SEVERITY_PENALTY, SECURITY_SCORE_SCALE, type SecurityFindingCounts, } from './security-score.js';
 export { missingGuardDomPass, type MissingGuardDomOptions, } from './passes/missing-guard-dom.js';
 export { featureEnvyPass, type FeatureEnvyOptions, } from './passes/feature-envy.js';
 export { specGapReportPass, type SpecGapReportOptions, } from './passes/spec-gap-report.js';
-export { computeTrustScore, validateScoringConfig, DEFAULT_SCORING_CONFIG, PASS_CATEGORY_MAP, PASS_COMPONENT_MAP, type TrustCategory, type TrustScoringConfig, } from './scoring.js';
+export { computeTrustScore, validateScoringConfig, DEFAULT_SCORING_CONFIG, PASS_CATEGORY_MAP, PASS_COMPONENT_MAP, type TrustCategory, type TrustScoringConfig, type TrustScoringContext, } from './scoring.js';
 export { compareTrustResults, formatComparisonReport, type TrustComparisonResult, type PassDelta, } from './compare.js';
 export { generateTrustSARIF } from './sarif.js';
 export { generateTrustBadge, generateBadgeFromScore, type BadgeOptions, } from './badge.js';

package/dist/trust/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/trust/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,eAAe,GAChB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,oBAAoB,EACpB,KAAK,uBAAuB,GAC7B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,EACrB,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,EAClC,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,GACtB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,sBAAsB,EACtB,KAAK,yBAAyB,GAC/B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,mBAAmB,EACnB,KAAK,sBAAsB,GAC5B,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,0BAA0B,EAC1B,KAAK,6BAA6B,GACnC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,uBAAuB,EACvB,KAAK,0BAA0B,GAChC,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,wBAAwB,EACxB,KAAK,2BAA2B,GACjC,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,oBAAoB,EACpB,KAAK,uBAAuB,GAC7B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,kBAAkB,EAClB,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,kBAAkB,EAClB,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,cAAc,EACd,KAAK,iBAAiB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,iBAAiB,EACjB,KAAK,oBAAoB,GAC1B,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EACL,mBAAmB,EACnB,KAAK,sBAAsB,GAC5B,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,kBAAkB,EAClB,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,mBAAmB,EACnB,KAAK,sBAAsB,GAC5B,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EACL,gBAAgB,EAChB,KAAK,mBAAmB,GACzB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,iBAAiB,EACjB,KAAK,oBAAoB,GAC1B,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,0BAA0B,EAC1B,KAAK,6BAA6B,GACnC,MAAM,sCAAsC,CAAC;AAG9C,OAAO,EACL,qBAAqB,EACrB,KAAK,sBAAsB,GAC5B,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EACL,qBAAqB,EACrB,KAAK,8BAA8B,GACpC,MAAM,sCAAsC,CAAC;AAG9C,OAAO,EACL,mBAAmB,EACnB,KAAK,sBAAsB,GAC5B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,eAAe,EACf,KAAK,kBAAkB,GACxB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EACL,iBAAiB,EACjB,KAAK,oBAAoB,GAC1B,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,kBAAkB,GACxB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,SAAS,GACf,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGhD,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,YAAY,GAClB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/trust/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,eAAe,GAChB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,oBAAoB,EACpB,KAAK,uBAAuB,GAC7B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,EACrB,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,EAClC,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,GACtB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,sBAAsB,EACtB,KAAK,yBAAyB,GAC/B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,mBAAmB,EACnB,KAAK,sBAAsB,GAC5B,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,0BAA0B,EAC1B,KAAK,6BAA6B,GACnC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,uBAAuB,EACvB,KAAK,0BAA0B,GAChC,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,wBAAwB,EACxB,KAAK,2BAA2B,GACjC,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,oBAAoB,EACpB,KAAK,uBAAuB,GAC7B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,kBAAkB,EAClB,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,kBAAkB,EAClB,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,cAAc,EACd,KAAK,iBAAiB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,iBAAiB,EACjB,KAAK,oBAAoB,GAC1B,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EACL,mBAAmB,EACnB,KAAK,sBAAsB,GAC5B,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EACL,sBAAsB,EACtB,KAAK,eAAe,GACrB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,oBAAoB,EACpB,UAAU,EACV,cAAc,EACd,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,WAAW,GACjB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,kBAAkB,EAClB,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,mBAAmB,EACnB,KAAK,sBAAsB,GAC5B,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EACL,gBAAgB,EAChB,KAAK,mBAAmB,GACzB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,iBAAiB,EACjB,KAAK,oBAAoB,GAC1B,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,0BAA0B,EAC1B,KAAK,6BAA6B,GACnC,MAAM,sCAAsC,CAAC;AAG9C,OAAO,EACL,qBAAqB,EACrB,KAAK,sBAAsB,GAC5B,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EACL,qBAAqB,EACrB,KAAK,8BAA8B,GACpC,MAAM,sCAAsC,CAAC;AAG9C,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,2BAA2B,EAC3B,YAAY,EACZ,yBAAyB,EACzB,oBAAoB,EACpB,KAAK,qBAAqB,GAC3B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,mBAAmB,EACnB,KAAK,sBAAsB,GAC5B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,eAAe,EACf,KAAK,kBAAkB,GACxB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EACL,iBAAiB,EACjB,KAAK,oBAAoB,GAC1B,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,SAAS,GACf,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGhD,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,YAAY,GAClB,MAAM,YAAY,CAAC"}

package/dist/trust/index.js

@@ -20,6 +20,9 @@ export { auditTrailPass, } from './passes/audit-trail.js';
 export { vexGenerationPass, } from './passes/vex-generation.js';
 // Sprint 4 passes
 export { dependencyAuditPass, } from './passes/dependency-audit.js';
+// cognium-ai#234 (L2) — ecosystem-agnostic OSV dependency CVE audit
+export { osvDependencyAuditPass, } from './passes/osv-dependency-audit.js';
+export { parseAllManifests, parseMavenPom, parsePipRequirements, parseGoMod, parseCargoLock, } from './passes/dep-manifests.js';
 export { codeComplexityPass, } from './passes/code-complexity.js';
 export { inputValidationPass, } from './passes/input-validation.js';
 // Sprint 5 passes
@@ -31,6 +34,12 @@ export { aiGeneratedFingerprintPass, } from './passes/ai-generated-fingerprint.j
 export { cacheInvalidationPass, } from './passes/performance-passes.js';
 // Sprint 9 — CircleIR findings adapter
 export { adaptCircleIRFindings, } from './passes/circlir-findings-adapter.js';
+// cognium-ai#234 (L3) — cryptographic-weakness pass (feeds crypto_score)
+export { cryptoWeaknessPass, CRYPTO_PASS_NAMES, } from './passes/crypto-weakness.js';
+// cognium-ai#234 (L4) — reachability factor (feeds reachability_factor)
+export { computeReachabilityFactor, REACHABILITY_MAX_PENALTY, } from './reachability.js';
+// cognium-ai#234 (L5) — de-saturated security score (rational decay)
+export { discriminatingSecurityScore, securityLoad, SECURITY_SEVERITY_PENALTY, SECURITY_SCORE_SCALE, } from './security-score.js';
 // Sprint 8 — LLM-enhanced replacements (circle-ir 3.14.0)
 export { missingGuardDomPass, } from './passes/missing-guard-dom.js';
 export { featureEnvyPass, } from './passes/feature-envy.js';

package/dist/trust/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/trust/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,QAAQ;AACR,OAAO,EAQL,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,eAAe,GAChB,MAAM,YAAY,CAAC;AAEpB,SAAS;AACT,OAAO,EACL,oBAAoB,GAErB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,EACrB,iBAAiB,GAOlB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,sBAAsB,GAEvB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,0BAA0B,GAE3B,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,uBAAuB,GAExB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,wBAAwB,GAEzB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,oBAAoB,GAErB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,kBAAkB,GAEnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,kBAAkB,GAEnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,cAAc,GAEf,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,iBAAiB,GAElB,MAAM,4BAA4B,CAAC;AAEpC,kBAAkB;AAClB,OAAO,EACL,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,kBAAkB,GAEnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AAEtC,kBAAkB;AAClB,OAAO,EACL,gBAAgB,GAEjB,MAAM,6BAA6B,CAAC;AAErC,4BAA4B;AAC5B,OAAO,EACL,iBAAiB,GAElB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,0BAA0B,GAE3B,MAAM,sCAAsC,CAAC;AAE9C,sEAAsE;AACtE,OAAO,EACL,qBAAqB,GAEtB,MAAM,gCAAgC,CAAC;AAExC,uCAAuC;AACvC,OAAO,EACL,qBAAqB,GAEtB,MAAM,sCAAsC,CAAC;AAE9C,0DAA0D;AAC1D,OAAO,EACL,mBAAmB,GAEpB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,eAAe,GAEhB,MAAM,0BAA0B,CAAC;AAElC,8BAA8B;AAC9B,OAAO,EACL,iBAAiB,GAElB,MAAM,6BAA6B,CAAC;AAErC,sBAAsB;AACtB,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,GAGnB,MAAM,cAAc,CAAC;AAEtB,UAAU;AACV,OAAO,EACL,mBAAmB,EACnB,sBAAsB,GAGvB,MAAM,cAAc,CAAC;AAEtB,QAAQ;AACR,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD,QAAQ;AACR,OAAO,EACL,kBAAkB,EAClB,sBAAsB,GAEvB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/trust/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,QAAQ;AACR,OAAO,EAUL,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,eAAe,GAChB,MAAM,YAAY,CAAC;AAEpB,SAAS;AACT,OAAO,EACL,oBAAoB,GAErB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,EACrB,iBAAiB,GAOlB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,sBAAsB,GAEvB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,0BAA0B,GAE3B,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,uBAAuB,GAExB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,wBAAwB,GAEzB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,oBAAoB,GAErB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,kBAAkB,GAEnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,kBAAkB,GAEnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,cAAc,GAEf,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,iBAAiB,GAElB,MAAM,4BAA4B,CAAC;AAEpC,kBAAkB;AAClB,OAAO,EACL,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AAEtC,oEAAoE;AACpE,OAAO,EACL,sBAAsB,GAEvB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,oBAAoB,EACpB,UAAU,EACV,cAAc,GAIf,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,kBAAkB,GAEnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AAEtC,kBAAkB;AAClB,OAAO,EACL,gBAAgB,GAEjB,MAAM,6BAA6B,CAAC;AAErC,4BAA4B;AAC5B,OAAO,EACL,iBAAiB,GAElB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,0BAA0B,GAE3B,MAAM,sCAAsC,CAAC;AAE9C,sEAAsE;AACtE,OAAO,EACL,qBAAqB,GAEtB,MAAM,gCAAgC,CAAC;AAExC,uCAAuC;AACvC,OAAO,EACL,qBAAqB,GAEtB,MAAM,sCAAsC,CAAC;AAE9C,yEAAyE;AACzE,OAAO,EACL,kBAAkB,EAClB,iBAAiB,GAElB,MAAM,6BAA6B,CAAC;AAErC,wEAAwE;AACxE,OAAO,EACL,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAE3B,qEAAqE;AACrE,OAAO,EACL,2BAA2B,EAC3B,YAAY,EACZ,yBAAyB,EACzB,oBAAoB,GAErB,MAAM,qBAAqB,CAAC;AAE7B,0DAA0D;AAC1D,OAAO,EACL,mBAAmB,GAEpB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,eAAe,GAEhB,MAAM,0BAA0B,CAAC;AAElC,8BAA8B;AAC9B,OAAO,EACL,iBAAiB,GAElB,MAAM,6BAA6B,CAAC;AAErC,sBAAsB;AACtB,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,GAInB,MAAM,cAAc,CAAC;AAEtB,UAAU;AACV,OAAO,EACL,mBAAmB,EACnB,sBAAsB,GAGvB,MAAM,cAAc,CAAC;AAEtB,QAAQ;AACR,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD,QAAQ;AACR,OAAO,EACL,kBAAkB,EAClB,sBAAsB,GAEvB,MAAM,YAAY,CAAC"}

package/dist/trust/passes/agent-inventory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-inventory.d.ts","sourceRoot":"","sources":["../../../src/trust/passes/agent-inventory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EACL,KAAK,eAAe,EAIrB,MAAM,aAAa,CAAC;AAMrB,mCAAmC;AACnC,QAAA,MAAM,gBAAgB,UAMrB,CAAC;AAEF,4CAA4C;AAC5C,QAAA,MAAM,iBAAiB,UAStB,CAAC;AAEF,QAAA,MAAM,mBAAmB,UAGxB,CAAC;AAEF,QAAA,MAAM,aAAa,aAGjB,CAAC;AAMH,UAAU,mBAAmB;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,UAAU,yBAAyB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,UAAU,iBAAiB;IACzB,UAAU,EAAE,mBAAmB,EAAE,CAAC;IAClC,gBAAgB,EAAE,yBAAyB,EAAE,CAAC;IAC9C,YAAY,EAAE,MAAM,CAAC;IACrB,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAMD,MAAM,WAAW,qBAAqB;IACpC,iDAAiD;IACjD,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,uDAAuD;IACvD,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAmCD,iBAAS,kBAAkB,CACzB,WAAW,EAAE,MAAM,EACnB,eAAe,CAAC,EAAE,MAAM,EAAE,GACzB,mBAAmB,EAAE,CAwDvB;AAMD,iBAAS,wBAAwB,CAC/B,WAAW,EAAE,MAAM,GAClB,yBAAyB,EAAE,CAyB7B;AAoHD,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,eAAe,CAAC,CA2C1B;AAGD,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,kBAAkB,EAClB,wBAAwB,EACxB,KAAK,iBAAiB,GACvB,CAAC"}
+{"version":3,"file":"agent-inventory.d.ts","sourceRoot":"","sources":["../../../src/trust/passes/agent-inventory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EACL,KAAK,eAAe,EAIrB,MAAM,aAAa,CAAC;AAMrB,mCAAmC;AACnC,QAAA,MAAM,gBAAgB,UAMrB,CAAC;AAEF,4CAA4C;AAC5C,QAAA,MAAM,iBAAiB,UAStB,CAAC;AAEF,QAAA,MAAM,mBAAmB,UAGxB,CAAC;AAEF,QAAA,MAAM,aAAa,aAGjB,CAAC;AAMH,UAAU,mBAAmB;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,UAAU,yBAAyB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,UAAU,iBAAiB;IACzB,UAAU,EAAE,mBAAmB,EAAE,CAAC;IAClC,gBAAgB,EAAE,yBAAyB,EAAE,CAAC;IAC9C,YAAY,EAAE,MAAM,CAAC;IACrB,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAMD,MAAM,WAAW,qBAAqB;IACpC,iDAAiD;IACjD,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,uDAAuD;IACvD,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAmCD,iBAAS,kBAAkB,CACzB,WAAW,EAAE,MAAM,EACnB,eAAe,CAAC,EAAE,MAAM,EAAE,GACzB,mBAAmB,EAAE,CAwDvB;AAMD,iBAAS,wBAAwB,CAC/B,WAAW,EAAE,MAAM,GAClB,yBAAyB,EAAE,CAyB7B;AAoHD,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,eAAe,CAAC,CA8C1B;AAGD,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,kBAAkB,EAClB,wBAAwB,EACxB,KAAK,iBAAiB,GACvB,CAAC"}

package/dist/trust/passes/agent-inventory.js

@@ -265,9 +265,12 @@ export async function agentInventoryPass(projectPath, options = {}) {
     };
     // No agent artifacts found → clean
     if (servers.length === 0 && instructionFiles.length === 0) {
+        // cognium-ai#234 (L1) — no agents/MCP servers/instruction files = no agent
+        // surface to inventory. Inapplicable, not "clean 100".
         return {
             pass: 'agent-inventory',
             score: 100,
+            applicable: false,
             findings: [],
             durationMs: Date.now() - start,
         };

package/dist/trust/passes/agent-inventory.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-inventory.js","sourceRoot":"","sources":["../../../src/trust/passes/agent-inventory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAIL,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAErB,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,mCAAmC;AACnC,MAAM,gBAAgB,GAAG;IACvB,UAAU;IACV,WAAW;IACX,iBAAiB;IACjB,4BAA4B;IAC5B,kBAAkB;CACnB,CAAC;AAEF,4CAA4C;AAC5C,MAAM,iBAAiB,GAAG;IACxB,UAAU;IACV,UAAU;IACV,iBAAiB;IACjB,iBAAiB;IACjB,iCAAiC;IACjC,WAAW;IACX,cAAc;IACd,eAAe;CAChB,CAAC;AAEF,MAAM,mBAAmB,GAAG;IAC1B,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS;IAC3D,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW;CAChD,CAAC;AAEF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK;IACjD,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI;CAC9B,CAAC,CAAC;AAuCH,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,WAAW,CAAC,QAAgB;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB;IAChC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IAClC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,SAAS,kBAAkB,CACzB,WAAmB,EACnB,eAA0B;IAE1B,MAAM,OAAO,GAA0B,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,CAAC,GAAG,gBAAgB,EAAE,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC;IAEnE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YACvC,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAEpC,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,SAAS;QAEvE,MAAM,OAAO,GAAG,IAA+B,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YACrC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,OAAO;YAChD,CAAC,CAAC,OAAO,CAAC;QAEZ,8CAA8C;QAC9C,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACjE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAqC,CAAC;YACjE,KAAK,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC3D,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ;oBAAE,SAAS;gBAC1D,MAAM,MAAM,GAAG,SAAoC,CAAC;gBAEpD,MAAM,OAAO,GAAa,EAAE,CAAC;gBAC7B,IAAI,MAAM,CAAC,GAAG,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;oBACjD,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAA8B,CAAC,CAAC,CAAC;gBACtE,CAAC;gBAED,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI;oBACJ,MAAM;oBACN,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;oBAC5D,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;oBACtE,OAAO;oBACP,SAAS,EAAE,CAAC;oBACZ,eAAe,EAAE,CAAC;iBACnB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,sBAAsB;aACjB,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YAElF,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,SAAS,CAAC;gBACvC,MAAM;gBACN,OAAO,EAAE,EAAE;gBACX,SAAS,EAAE,KAAK,CAAC,MAAM;gBACvB,eAAe,EAAE,WAAW,CAAC,MAAM;aACpC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E,SAAS,wBAAwB,CAC/B,WAAmB;IAEnB,MAAM,KAAK,GAAgC,EAAE,CAAC;IAC9C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IAErC,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACjD,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,gEAAgE;YAChE,IAAI,GAAW,CAAC;YAChB,IAAI,CAAC;gBACH,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAClC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAEpB,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,OAAO;gBACb,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC;aAC9B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,SAAS,gBAAgB,CACvB,OAA8B,EAC9B,gBAA6C,EAC7C,GAAsB;IAEtB,MAAM,QAAQ,GAAmB,EAAE,CAAC;IAEpC,gCAAgC;IAChC,QAAQ,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,iBAAiB;QACvB,MAAM,EAAE,cAAc;QACtB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,WAAW,GAAG,CAAC,YAAY,mBAAmB,GAAG,CAAC,qBAAqB,sBAAsB;QACtG,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC7B,IAAI,EAAE;YACJ,GAAG;SACJ;KACF,CAAC,CAAC;IAEH,sBAAsB;IACtB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,0BAA0B;QAC1B,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,wBAAwB;YAChC,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,eAAe,MAAM,CAAC,IAAI,cAAc,MAAM,CAAC,MAAM,EAAE;YAChE,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE;YACjC,IAAI,EAAE;gBACJ,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;aACnC;SACF,CAAC,CAAC;QAEH,+BAA+B;QAC/B,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACpD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,iBAAiB;oBACvB,MAAM,EAAE,4BAA4B;oBACpC,QAAQ,EAAE,QAAQ;oBAClB,OAAO,EAAE,wBAAwB,MAAM,gCAAgC,MAAM,CAAC,IAAI,QAAQ,MAAM,CAAC,MAAM,EAAE;oBACzG,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE;oBACjC,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE;iBAC1C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,iBAAiB;oBACvB,MAAM,EAAE,yBAAyB;oBACjC,QAAQ,EAAE,QAAQ;oBAClB,OAAO,EAAE,eAAe,MAAM,CAAC,IAAI,mBAAmB,MAAM,CAAC,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE;oBAC3F,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE;oBACjC,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;iBAC3D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,mCAAmC;QACnC,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CACjC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAChD,CAAC;YACF,0DAA0D;YAC1D,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;YACjE,IAAI,YAAY,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/E,8DAA8D;gBAC9D,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,iBAAiB;oBACvB,MAAM,EAAE,sBAAsB;oBAC9B,QAAQ,EAAE,KAAK;oBACf,OAAO,EAAE,eAAe,MAAM,CAAC,IAAI,2CAA2C,YAAY,QAAQ,MAAM,CAAC,MAAM,EAAE;oBACjH,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE;oBACjC,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;iBAC5E,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,gCAAgC;IAChC,KAAK,MAAM,SAAS,IAAI,gBAAgB,EAAE,CAAC;QACzC,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,8BAA8B;YACtC,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,qBAAqB,SAAS,CAAC,IAAI,YAAY,SAAS,CAAC,SAAS,SAAS;YACpF,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE;YAClC,IAAI,EAAE;gBACJ,QAAQ,EAAE,SAAS,CAAC,IAAI;gBACxB,SAAS,EAAE,SAAS,CAAC,SAAS;aAC/B;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,WAAmB,EACnB,UAAiC,EAAE;IAEnC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEzB,WAAW;IACX,MAAM,OAAO,GAAG,kBAAkB,CAAC,WAAW,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IACzE,MAAM,gBAAgB,GAAG,OAAO,CAAC,oBAAoB;QACnD,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,wBAAwB,CAAC,WAAW,CAAC,CAAC;IAE1C,eAAe;IACf,MAAM,GAAG,GAAsB;QAC7B,UAAU,EAAE,OAAO;QACnB,gBAAgB;QAChB,YAAY,EAAE,OAAO,CAAC,MAAM;QAC5B,qBAAqB,EAAE,gBAAgB,CAAC,MAAM;KAC/C,CAAC;IAEF,mCAAmC;IACnC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,KAAK,EAAE,GAAG;YACV,QAAQ,EAAE,EAAE;YACZ,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,oBAAoB;IACpB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAElE,+CAA+C;IAC/C,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,SAAS,IAAI,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC;IAE1D,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,KAAK;QACL,QAAQ;QACR,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC/B,CAAC;AACJ,CAAC;AAED,sBAAsB;AACtB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,kBAAkB,EAClB,wBAAwB,GAEzB,CAAC"}
+{"version":3,"file":"agent-inventory.js","sourceRoot":"","sources":["../../../src/trust/passes/agent-inventory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAIL,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAErB,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,mCAAmC;AACnC,MAAM,gBAAgB,GAAG;IACvB,UAAU;IACV,WAAW;IACX,iBAAiB;IACjB,4BAA4B;IAC5B,kBAAkB;CACnB,CAAC;AAEF,4CAA4C;AAC5C,MAAM,iBAAiB,GAAG;IACxB,UAAU;IACV,UAAU;IACV,iBAAiB;IACjB,iBAAiB;IACjB,iCAAiC;IACjC,WAAW;IACX,cAAc;IACd,eAAe;CAChB,CAAC;AAEF,MAAM,mBAAmB,GAAG;IAC1B,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS;IAC3D,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW;CAChD,CAAC;AAEF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK;IACjD,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI;CAC9B,CAAC,CAAC;AAuCH,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,WAAW,CAAC,QAAgB;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB;IAChC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IAClC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,SAAS,kBAAkB,CACzB,WAAmB,EACnB,eAA0B;IAE1B,MAAM,OAAO,GAA0B,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,CAAC,GAAG,gBAAgB,EAAE,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC;IAEnE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YACvC,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAEpC,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,SAAS;QAEvE,MAAM,OAAO,GAAG,IAA+B,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YACrC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,OAAO;YAChD,CAAC,CAAC,OAAO,CAAC;QAEZ,8CAA8C;QAC9C,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACjE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAqC,CAAC;YACjE,KAAK,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC3D,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ;oBAAE,SAAS;gBAC1D,MAAM,MAAM,GAAG,SAAoC,CAAC;gBAEpD,MAAM,OAAO,GAAa,EAAE,CAAC;gBAC7B,IAAI,MAAM,CAAC,GAAG,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;oBACjD,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAA8B,CAAC,CAAC,CAAC;gBACtE,CAAC;gBAED,OAAO,CAAC,IAAI,CAAC;oBACX,IAAI;oBACJ,MAAM;oBACN,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;oBAC5D,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;oBACtE,OAAO;oBACP,SAAS,EAAE,CAAC;oBACZ,eAAe,EAAE,CAAC;iBACnB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,sBAAsB;aACjB,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YAElF,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,SAAS,CAAC;gBACvC,MAAM;gBACN,OAAO,EAAE,EAAE;gBACX,SAAS,EAAE,KAAK,CAAC,MAAM;gBACvB,eAAe,EAAE,WAAW,CAAC,MAAM;aACpC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAE9E,SAAS,wBAAwB,CAC/B,WAAmB;IAEnB,MAAM,KAAK,GAAgC,EAAE,CAAC;IAC9C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IAErC,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACjD,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,gEAAgE;YAChE,IAAI,GAAW,CAAC;YAChB,IAAI,CAAC;gBACH,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAClC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAEpB,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,OAAO;gBACb,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC;aAC9B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,SAAS,gBAAgB,CACvB,OAA8B,EAC9B,gBAA6C,EAC7C,GAAsB;IAEtB,MAAM,QAAQ,GAAmB,EAAE,CAAC;IAEpC,gCAAgC;IAChC,QAAQ,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,iBAAiB;QACvB,MAAM,EAAE,cAAc;QACtB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,WAAW,GAAG,CAAC,YAAY,mBAAmB,GAAG,CAAC,qBAAqB,sBAAsB;QACtG,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC7B,IAAI,EAAE;YACJ,GAAG;SACJ;KACF,CAAC,CAAC;IAEH,sBAAsB;IACtB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,0BAA0B;QAC1B,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,wBAAwB;YAChC,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,eAAe,MAAM,CAAC,IAAI,cAAc,MAAM,CAAC,MAAM,EAAE;YAChE,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE;YACjC,IAAI,EAAE;gBACJ,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;aACnC;SACF,CAAC,CAAC;QAEH,+BAA+B;QAC/B,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBACpD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,iBAAiB;oBACvB,MAAM,EAAE,4BAA4B;oBACpC,QAAQ,EAAE,QAAQ;oBAClB,OAAO,EAAE,wBAAwB,MAAM,gCAAgC,MAAM,CAAC,IAAI,QAAQ,MAAM,CAAC,MAAM,EAAE;oBACzG,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE;oBACjC,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE;iBAC1C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,iBAAiB;oBACvB,MAAM,EAAE,yBAAyB;oBACjC,QAAQ,EAAE,QAAQ;oBAClB,OAAO,EAAE,eAAe,MAAM,CAAC,IAAI,mBAAmB,MAAM,CAAC,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE;oBAC3F,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE;oBACjC,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;iBAC3D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,mCAAmC;QACnC,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CACjC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAChD,CAAC;YACF,0DAA0D;YAC1D,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;YACjE,IAAI,YAAY,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/E,8DAA8D;gBAC9D,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,iBAAiB;oBACvB,MAAM,EAAE,sBAAsB;oBAC9B,QAAQ,EAAE,KAAK;oBACf,OAAO,EAAE,eAAe,MAAM,CAAC,IAAI,2CAA2C,YAAY,QAAQ,MAAM,CAAC,MAAM,EAAE;oBACjH,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE;oBACjC,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;iBAC5E,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,gCAAgC;IAChC,KAAK,MAAM,SAAS,IAAI,gBAAgB,EAAE,CAAC;QACzC,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,8BAA8B;YACtC,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,qBAAqB,SAAS,CAAC,IAAI,YAAY,SAAS,CAAC,SAAS,SAAS;YACpF,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE;YAClC,IAAI,EAAE;gBACJ,QAAQ,EAAE,SAAS,CAAC,IAAI;gBACxB,SAAS,EAAE,SAAS,CAAC,SAAS;aAC/B;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,WAAmB,EACnB,UAAiC,EAAE;IAEnC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEzB,WAAW;IACX,MAAM,OAAO,GAAG,kBAAkB,CAAC,WAAW,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IACzE,MAAM,gBAAgB,GAAG,OAAO,CAAC,oBAAoB;QACnD,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,wBAAwB,CAAC,WAAW,CAAC,CAAC;IAE1C,eAAe;IACf,MAAM,GAAG,GAAsB;QAC7B,UAAU,EAAE,OAAO;QACnB,gBAAgB;QAChB,YAAY,EAAE,OAAO,CAAC,MAAM;QAC5B,qBAAqB,EAAE,gBAAgB,CAAC,MAAM;KAC/C,CAAC;IAEF,mCAAmC;IACnC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,2EAA2E;QAC3E,uDAAuD;QACvD,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,KAAK,EAAE,GAAG;YACV,UAAU,EAAE,KAAK;YACjB,QAAQ,EAAE,EAAE;YACZ,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,oBAAoB;IACpB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAElE,+CAA+C;IAC/C,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,SAAS,IAAI,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC;IAE1D,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,KAAK;QACL,QAAQ;QACR,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC/B,CAAC;AACJ,CAAC;AAED,sBAAsB;AACtB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,kBAAkB,EAClB,wBAAwB,GAEzB,CAAC"}

package/dist/trust/passes/ai-config-detect.d.ts

@@ -0,0 +1,45 @@
+/**
+ * cognium-ai#211 — recognize AI-agent config / tool-manifest files regardless
+ * of their exact filename.
+ *
+ * The AI-native trust passes (tool-poisoning LLM04, excessive-permissions
+ * LLM06, agent-inventory) historically gated on an exact-name allowlist
+ * (`mcp.json`, `tool.json`, `manifest.json`, …). The #120 corpus names its
+ * fixtures descriptively (`mcp_tool_poisoning.json`, `excessive_agency.json`),
+ * so they never matched and the passes reported zero recall — even though the
+ * detectors work (proven: the identical content under `mcp.json` fires). Real
+ * repos are the same: an MCP manifest can live at any path/name.
+ *
+ * This recognizes such files two ways, either sufficient:
+ *   1. **name** — a JSON/YAML whose basename mentions an AI-agent artifact
+ *      (mcp / tool / manifest / plugin / agent / skill / openapi / swagger /
+ *      functions), OR
+ *   2. **content shape** — a JSON object with a top-level `tools`,
+ *      `mcpServers`, `servers`, `functions`, or `plugins` key (the canonical
+ *      MCP / tool-manifest shape).
+ *
+ * Name matching is cheap; content sniffing is gated to `.json`/`.yaml` files
+ * and a cheap regex pre-check before `JSON.parse`, so the walk cost stays
+ * proportional to config files, not the whole repo.
+ */
+/** True if the basename looks like an AI-agent config/manifest file. */
+export declare function looksLikeAiConfigName(basename: string): boolean;
+/**
+ * True if the (JSON) content has a top-level tool/agent-manifest key. Cheap
+ * regex pre-check gates the `JSON.parse`, so non-manifest JSON is rejected
+ * without parsing.
+ */
+export declare function looksLikeAiManifestContent(content: string): boolean;
+/**
+ * Combined recognizer used by the file walkers. `content` is optional — when
+ * omitted (or the file isn't JSON/YAML), only the name is considered.
+ */
+export declare function isAiConfigFile(basename: string, content?: string): boolean;
+/**
+ * cognium-ai#211 — walk a project tree for AI-agent config / manifest files,
+ * matched by fuzzy name or (for JSON/YAML) manifest content shape. Bounded in
+ * depth and count; skips heavy build/dep dirs. Shared by the AI-native passes
+ * so they all catch a manifest regardless of its exact name or location.
+ */
+export declare function walkAiConfigFiles(root: string, maxFiles?: number, maxDepth?: number): string[];
+//# sourceMappingURL=ai-config-detect.d.ts.map

package/dist/trust/passes/ai-config-detect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-config-detect.d.ts","sourceRoot":"","sources":["../../../src/trust/passes/ai-config-detect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAUH,wEAAwE;AACxE,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE/D;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAYnE;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAM1E;AAUD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,SAAM,EAAE,QAAQ,SAAI,GAAG,MAAM,EAAE,CA+BtF"}

package/dist/trust/passes/ai-config-detect.js

@@ -0,0 +1,116 @@
+/**
+ * cognium-ai#211 — recognize AI-agent config / tool-manifest files regardless
+ * of their exact filename.
+ *
+ * The AI-native trust passes (tool-poisoning LLM04, excessive-permissions
+ * LLM06, agent-inventory) historically gated on an exact-name allowlist
+ * (`mcp.json`, `tool.json`, `manifest.json`, …). The #120 corpus names its
+ * fixtures descriptively (`mcp_tool_poisoning.json`, `excessive_agency.json`),
+ * so they never matched and the passes reported zero recall — even though the
+ * detectors work (proven: the identical content under `mcp.json` fires). Real
+ * repos are the same: an MCP manifest can live at any path/name.
+ *
+ * This recognizes such files two ways, either sufficient:
+ *   1. **name** — a JSON/YAML whose basename mentions an AI-agent artifact
+ *      (mcp / tool / manifest / plugin / agent / skill / openapi / swagger /
+ *      functions), OR
+ *   2. **content shape** — a JSON object with a top-level `tools`,
+ *      `mcpServers`, `servers`, `functions`, or `plugins` key (the canonical
+ *      MCP / tool-manifest shape).
+ *
+ * Name matching is cheap; content sniffing is gated to `.json`/`.yaml` files
+ * and a cheap regex pre-check before `JSON.parse`, so the walk cost stays
+ * proportional to config files, not the whole repo.
+ */
+/** Basenames that mention an AI-agent artifact + a config extension. */
+const AI_CONFIG_NAME_RE = /(?:^|[-_.])(?:mcp|tool|manifest|plugin|agents?|skills?|openapi|swagger|functions?)(?:[-_.].*)?\.(?:json|ya?ml)$/i;
+/** Top-level manifest keys that mark a JSON as an AI tool/agent config. */
+const MANIFEST_KEYS = ['tools', 'mcpServers', 'servers', 'functions', 'plugins'];
+const MANIFEST_KEY_RE = /["'](?:tools|mcpServers|servers|functions|plugins)["']\s*:/;
+/** True if the basename looks like an AI-agent config/manifest file. */
+export function looksLikeAiConfigName(basename) {
+    return AI_CONFIG_NAME_RE.test(basename);
+}
+/**
+ * True if the (JSON) content has a top-level tool/agent-manifest key. Cheap
+ * regex pre-check gates the `JSON.parse`, so non-manifest JSON is rejected
+ * without parsing.
+ */
+export function looksLikeAiManifestContent(content) {
+    if (!MANIFEST_KEY_RE.test(content))
+        return false;
+    try {
+        const obj = JSON.parse(content);
+        return (!!obj &&
+            typeof obj === 'object' &&
+            MANIFEST_KEYS.some((k) => obj[k] !== undefined));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Combined recognizer used by the file walkers. `content` is optional — when
+ * omitted (or the file isn't JSON/YAML), only the name is considered.
+ */
+export function isAiConfigFile(basename, content) {
+    if (looksLikeAiConfigName(basename))
+        return true;
+    if (content !== undefined && /\.(json|ya?ml)$/i.test(basename)) {
+        return looksLikeAiManifestContent(content);
+    }
+    return false;
+}
+import * as fs from 'fs';
+import * as path from 'path';
+const WALK_SKIP_DIRS = new Set([
+    'node_modules', '.git', 'dist', 'build', 'out', 'vendor', '.venv',
+    'venv', '__pycache__', 'coverage', '.next', 'target',
+]);
+/**
+ * cognium-ai#211 — walk a project tree for AI-agent config / manifest files,
+ * matched by fuzzy name or (for JSON/YAML) manifest content shape. Bounded in
+ * depth and count; skips heavy build/dep dirs. Shared by the AI-native passes
+ * so they all catch a manifest regardless of its exact name or location.
+ */
+export function walkAiConfigFiles(root, maxFiles = 200, maxDepth = 8) {
+    const out = [];
+    const walk = (dir, depth) => {
+        if (depth > maxDepth || out.length >= maxFiles)
+            return;
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            if (out.length >= maxFiles)
+                break;
+            const full = path.join(dir, e.name);
+            if (e.isDirectory()) {
+                if (!WALK_SKIP_DIRS.has(e.name) && !e.name.startsWith('.'))
+                    walk(full, depth + 1);
+                continue;
+            }
+            if (!e.isFile())
+                continue;
+            if (looksLikeAiConfigName(e.name)) {
+                out.push(full);
+            }
+            else if (/\.(json|ya?ml)$/i.test(e.name)) {
+                try {
+                    if (looksLikeAiManifestContent(fs.readFileSync(full, 'utf-8')))
+                        out.push(full);
+                }
+                catch {
+                    /* unreadable — skip */
+                }
+            }
+        }
+    };
+    walk(root, 0);
+    return out;
+}
+//# sourceMappingURL=ai-config-detect.js.map

package/dist/trust/passes/ai-config-detect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-config-detect.js","sourceRoot":"","sources":["../../../src/trust/passes/ai-config-detect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,wEAAwE;AACxE,MAAM,iBAAiB,GACrB,kHAAkH,CAAC;AAErH,2EAA2E;AAC3E,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,CAAU,CAAC;AAC1F,MAAM,eAAe,GAAG,4DAA4D,CAAC;AAErF,wEAAwE;AACxE,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,OAAO,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAAe;IACxD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA4B,CAAC;QAC3D,OAAO,CACL,CAAC,CAAC,GAAG;YACL,OAAO,GAAG,KAAK,QAAQ;YACvB,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAChD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,OAAgB;IAC/D,IAAI,qBAAqB,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,OAAO,KAAK,SAAS,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/D,OAAO,0BAA0B,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO;IACjE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ;CACrD,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,QAAQ,GAAG,GAAG,EAAE,QAAQ,GAAG,CAAC;IAC1E,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,KAAa,EAAQ,EAAE;QAChD,IAAI,KAAK,GAAG,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,QAAQ;YAAE,OAAO;QACvD,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,GAAG,CAAC,MAAM,IAAI,QAAQ;gBAAE,MAAM;YAClC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBACpB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBAClF,SAAS;YACX,CAAC;YACD,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE;gBAAE,SAAS;YAC1B,IAAI,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBAClC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC;iBAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3C,IAAI,CAAC;oBACH,IAAI,0BAA0B,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;wBAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjF,CAAC;gBAAC,MAAM,CAAC;oBACP,uBAAuB;gBACzB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACd,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/trust/passes/crypto-weakness.d.ts

@@ -0,0 +1,30 @@
+/**
+ * cognium-ai#234 (L3) — cryptographic weakness trust pass.
+ *
+ * `crypto_score` was a permanent 100: no pass ever fed it, so every repo —
+ * MD5-hashing, DES-ECB-encrypting, `java.util.Random`-for-tokens or not —
+ * reported a clean crypto component (see the #234 critical review). circle-ir
+ * already emits the relevant findings during `analyze()` (weak-hash CWE-328,
+ * weak-crypto CWE-327, weak-random CWE-330, weak-cipher, weak-rsa-key CWE-326,
+ * static-iv, unsalted/weak password hashing). This pass consumes those
+ * findings — zero extra analysis cost, no regex reimplementation (per the
+ * SAST/Tree-sitter ownership boundary) — and turns crypto into a real signal.
+ *
+ * Coverage-honest (L1): `applicable` is `false` when circle-ir analysis did
+ * NOT run (static-only trust with no `circleIRResults`), so a 100 means "the
+ * crypto SAST passes ran and found nothing weak", never "we couldn't look".
+ */
+import type { CircleIR } from 'circle-ir';
+import { type TrustPassResult } from '../types.js';
+export interface CryptoWeaknessOptions {
+    /** Pre-computed CircleIR results (from analyze()). */
+    circleIRResults?: CircleIR[];
+}
+/**
+ * circle-ir pass names that represent cryptographic-primitive weaknesses.
+ * Curated allowlist (not every `weak-*` pass is crypto — e.g. `weak-value`
+ * is a general code-quality signal, `insecure-cookie` is session handling).
+ */
+export declare const CRYPTO_PASS_NAMES: Set<string>;
+export declare function cryptoWeaknessPass(options?: CryptoWeaknessOptions): TrustPassResult;
+//# sourceMappingURL=crypto-weakness.d.ts.map

package/dist/trust/passes/crypto-weakness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-weakness.d.ts","sourceRoot":"","sources":["../../../src/trust/passes/crypto-weakness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAe,MAAM,WAAW,CAAC;AACvD,OAAO,EACL,KAAK,eAAe,EAIrB,MAAM,aAAa,CAAC;AAErB,MAAM,WAAW,qBAAqB;IACpC,sDAAsD;IACtD,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC;CAC9B;AAED;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,aAU5B,CAAC;AAsBH,wBAAgB,kBAAkB,CAChC,OAAO,GAAE,qBAA0B,GAClC,eAAe,CAgCjB"}