circle-ir-ai 2.59.0 → 2.60.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +36 -0
- package/dist/trust/index.d.ts +1 -0
- package/dist/trust/index.d.ts.map +1 -1
- package/dist/trust/index.js +2 -0
- package/dist/trust/index.js.map +1 -1
- package/dist/trust/passes/conformance-attestation.d.ts +37 -0
- package/dist/trust/passes/conformance-attestation.d.ts.map +1 -0
- package/dist/trust/passes/conformance-attestation.js +200 -0
- package/dist/trust/passes/conformance-attestation.js.map +1 -0
- package/dist/trust/scoring.d.ts.map +1 -1
- package/dist/trust/scoring.js +3 -0
- package/dist/trust/scoring.js.map +1 -1
- package/package.json +2 -2
package/CHANGELOG.md
CHANGED
|
@@ -5,6 +5,42 @@ All notable changes to this project will be documented in this file.
|
|
|
5
5
|
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
|
6
6
|
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
7
7
|
|
|
8
|
+
## [2.60.0] - 2026-07-28
|
|
9
|
+
|
|
10
|
+
### Added — Q5: conformance-attestation trust pass (oracle verdict → trust)
|
|
11
|
+
|
|
12
|
+
New supply_chain pass `conformance-attestation` (`src/trust/passes/conformance-attestation.ts`)
|
|
13
|
+
closes the "evidence chain" pipe that previously had no shipped implementation.
|
|
14
|
+
It consumes in-toto conformance attestations (predicateType
|
|
15
|
+
`https://cognium.net/attestations/conformance/v0.1`, produced by
|
|
16
|
+
`@cogniumhq/conformance`) and folds dependency-level spec-conformance VIOLATIONS
|
|
17
|
+
into the `supply_chain_score`.
|
|
18
|
+
|
|
19
|
+
- **Data-only coupling** — reads the public in-toto format, not the private
|
|
20
|
+
conformance package/store; no new dependency on circle-ir-ai.
|
|
21
|
+
- **Opt-in, zero-overhead default** — source from `options.attestationsPath` or
|
|
22
|
+
`CONFORMANCE_ATTESTATIONS`; unset ⇒ fast-path `applicable:false`, byte-identical
|
|
23
|
+
to prior behavior.
|
|
24
|
+
- **Coverage-honest** (cognium-ai#234) — `applicable:false` on no-source, empty
|
|
25
|
+
source, and no-matched-deps; a matched clean dep scores 100, a matched
|
|
26
|
+
VIOLATION is a medium finding (−5) carrying the requirement/clause/spec witness.
|
|
27
|
+
- **Exact-artifact matching** — resolves npm deps at pinned versions from
|
|
28
|
+
`package-lock.json` (attestations are version-pinned); other ecosystems via
|
|
29
|
+
`parseAllManifests`. Registered in `PASS_CATEGORY_MAP` (supply_chain) +
|
|
30
|
+
`PASS_COMPONENT_MAP` (supply_chain_score); exported from `src/trust/index.ts`.
|
|
31
|
+
- 9 tests (`tests/trust-conformance-attestation.test.ts`); full suite 1517 pass.
|
|
32
|
+
|
|
33
|
+
CLI exposure (`cognium-ai trust --attestations`) lands in the cognium-ai bump
|
|
34
|
+
after this publishes.
|
|
35
|
+
|
|
36
|
+
## [2.59.1] - 2026-07-28
|
|
37
|
+
|
|
38
|
+
### Changed — bump circle-ir 3.192.0 → 3.193.0
|
|
39
|
+
|
|
40
|
+
Uniform fleet pin. No source change in circle-ir-ai; consumes the latest
|
|
41
|
+
published circle-ir. Consumers (cognium-ai / circle-pack / mcp-server) follow
|
|
42
|
+
with a single-copy dedupe once this publishes.
|
|
43
|
+
|
|
8
44
|
## [2.59.0] - 2026-07-26
|
|
9
45
|
|
|
10
46
|
### Fixed — minified skip now catches the `-min.js` dash variant (cognium-ai#243)
|
package/dist/trust/index.d.ts
CHANGED
|
@@ -18,6 +18,7 @@ export { auditTrailPass, type AuditTrailOptions, } from './passes/audit-trail.js
|
|
|
18
18
|
export { vexGenerationPass, type VEXGenerationOptions, } from './passes/vex-generation.js';
|
|
19
19
|
export { dependencyAuditPass, type DependencyAuditOptions, } from './passes/dependency-audit.js';
|
|
20
20
|
export { osvDependencyAuditPass, type OsvAuditOptions, } from './passes/osv-dependency-audit.js';
|
|
21
|
+
export { conformanceAttestationPass, type ConformanceAttestationOptions, } from './passes/conformance-attestation.js';
|
|
21
22
|
export { parseAllManifests, parseMavenPom, parsePipRequirements, parseGoMod, parseCargoLock, type EcosystemDep, type Ecosystem, type ParseResult, } from './passes/dep-manifests.js';
|
|
22
23
|
export { codeComplexityPass, type CodeComplexityOptions, } from './passes/code-complexity.js';
|
|
23
24
|
export { inputValidationPass, type InputValidationOptions, } from './passes/input-validation.js';
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/trust/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,eAAe,GAChB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,oBAAoB,EACpB,KAAK,uBAAuB,GAC7B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,EACrB,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,EAClC,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,GACtB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,sBAAsB,EACtB,KAAK,yBAAyB,GAC/B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,mBAAmB,EACnB,KAAK,sBAAsB,GAC5B,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,0BAA0B,EAC1B,KAAK,6BAA6B,GACnC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,uBAAuB,EACvB,KAAK,0BAA0B,GAChC,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,wBAAwB,EACxB,KAAK,2BAA2B,GACjC,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,oBAAoB,EACpB,KAAK,uBAAuB,GAC7B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,kBAAkB,EAClB,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,kBAAkB,EAClB,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,cAAc,EACd,KAAK,iBAAiB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,iBAAiB,EACjB,KAAK,oBAAoB,GAC1B,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EACL,mBAAmB,EACnB,KAAK,sBAAsB,GAC5B,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EACL,sBAAsB,EACtB,KAAK,eAAe,GACrB,MAAM,kCAAkC,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/trust/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,eAAe,GAChB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,oBAAoB,EACpB,KAAK,uBAAuB,GAC7B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,EACrB,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,EAClC,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,GACtB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,sBAAsB,EACtB,KAAK,yBAAyB,GAC/B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,mBAAmB,EACnB,KAAK,sBAAsB,GAC5B,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,0BAA0B,EAC1B,KAAK,6BAA6B,GACnC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,uBAAuB,EACvB,KAAK,0BAA0B,GAChC,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,wBAAwB,EACxB,KAAK,2BAA2B,GACjC,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,oBAAoB,EACpB,KAAK,uBAAuB,GAC7B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,kBAAkB,EAClB,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,kBAAkB,EAClB,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,cAAc,EACd,KAAK,iBAAiB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,iBAAiB,EACjB,KAAK,oBAAoB,GAC1B,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EACL,mBAAmB,EACnB,KAAK,sBAAsB,GAC5B,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EACL,sBAAsB,EACtB,KAAK,eAAe,GACrB,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EACL,0BAA0B,EAC1B,KAAK,6BAA6B,GACnC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,oBAAoB,EACpB,UAAU,EACV,cAAc,EACd,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,WAAW,GACjB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,kBAAkB,EAClB,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,mBAAmB,EACnB,KAAK,sBAAsB,GAC5B,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EACL,gBAAgB,EAChB,KAAK,mBAAmB,GACzB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,iBAAiB,EACjB,KAAK,oBAAoB,GAC1B,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,0BAA0B,EAC1B,KAAK,6BAA6B,GACnC,MAAM,sCAAsC,CAAC;AAG9C,OAAO,EACL,qBAAqB,EACrB,KAAK,sBAAsB,GAC5B,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EACL,qBAAqB,EACrB,KAAK,8BAA8B,GACpC,MAAM,sCAAsC,CAAC;AAG9C,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,2BAA2B,EAC3B,YAAY,EACZ,yBAAyB,EACzB,oBAAoB,EACpB,KAAK,qBAAqB,GAC3B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,mBAAmB,EACnB,KAAK,sBAAsB,GAC5B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,eAAe,EACf,KAAK,kBAAkB,GACxB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EACL,iBAAiB,EACjB,KAAK,oBAAoB,GAC1B,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,SAAS,GACf,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGhD,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,YAAY,GAClB,MAAM,YAAY,CAAC"}
|
package/dist/trust/index.js
CHANGED
|
@@ -22,6 +22,8 @@ export { vexGenerationPass, } from './passes/vex-generation.js';
|
|
|
22
22
|
export { dependencyAuditPass, } from './passes/dependency-audit.js';
|
|
23
23
|
// cognium-ai#234 (L2) — ecosystem-agnostic OSV dependency CVE audit
|
|
24
24
|
export { osvDependencyAuditPass, } from './passes/osv-dependency-audit.js';
|
|
25
|
+
// Q5 — conformance-attestation pass (oracle verdict → supply_chain signal)
|
|
26
|
+
export { conformanceAttestationPass, } from './passes/conformance-attestation.js';
|
|
25
27
|
export { parseAllManifests, parseMavenPom, parsePipRequirements, parseGoMod, parseCargoLock, } from './passes/dep-manifests.js';
|
|
26
28
|
export { codeComplexityPass, } from './passes/code-complexity.js';
|
|
27
29
|
export { inputValidationPass, } from './passes/input-validation.js';
|
package/dist/trust/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/trust/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,QAAQ;AACR,OAAO,EAUL,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,eAAe,GAChB,MAAM,YAAY,CAAC;AAEpB,SAAS;AACT,OAAO,EACL,oBAAoB,GAErB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,EACrB,iBAAiB,GAOlB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,sBAAsB,GAEvB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,0BAA0B,GAE3B,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,uBAAuB,GAExB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,wBAAwB,GAEzB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,oBAAoB,GAErB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,kBAAkB,GAEnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,kBAAkB,GAEnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,cAAc,GAEf,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,iBAAiB,GAElB,MAAM,4BAA4B,CAAC;AAEpC,kBAAkB;AAClB,OAAO,EACL,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AAEtC,oEAAoE;AACpE,OAAO,EACL,sBAAsB,GAEvB,MAAM,kCAAkC,CAAC;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/trust/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,QAAQ;AACR,OAAO,EAUL,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,eAAe,GAChB,MAAM,YAAY,CAAC;AAEpB,SAAS;AACT,OAAO,EACL,oBAAoB,GAErB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,EACrB,iBAAiB,GAOlB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,sBAAsB,GAEvB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,0BAA0B,GAE3B,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,uBAAuB,GAExB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,wBAAwB,GAEzB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,oBAAoB,GAErB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,kBAAkB,GAEnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,kBAAkB,GAEnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,cAAc,GAEf,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,iBAAiB,GAElB,MAAM,4BAA4B,CAAC;AAEpC,kBAAkB;AAClB,OAAO,EACL,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AAEtC,oEAAoE;AACpE,OAAO,EACL,sBAAsB,GAEvB,MAAM,kCAAkC,CAAC;AAE1C,2EAA2E;AAC3E,OAAO,EACL,0BAA0B,GAE3B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,oBAAoB,EACpB,UAAU,EACV,cAAc,GAIf,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,kBAAkB,GAEnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AAEtC,kBAAkB;AAClB,OAAO,EACL,gBAAgB,GAEjB,MAAM,6BAA6B,CAAC;AAErC,4BAA4B;AAC5B,OAAO,EACL,iBAAiB,GAElB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,0BAA0B,GAE3B,MAAM,sCAAsC,CAAC;AAE9C,sEAAsE;AACtE,OAAO,EACL,qBAAqB,GAEtB,MAAM,gCAAgC,CAAC;AAExC,uCAAuC;AACvC,OAAO,EACL,qBAAqB,GAEtB,MAAM,sCAAsC,CAAC;AAE9C,yEAAyE;AACzE,OAAO,EACL,kBAAkB,EAClB,iBAAiB,GAElB,MAAM,6BAA6B,CAAC;AAErC,wEAAwE;AACxE,OAAO,EACL,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAE3B,qEAAqE;AACrE,OAAO,EACL,2BAA2B,EAC3B,YAAY,EACZ,yBAAyB,EACzB,oBAAoB,GAErB,MAAM,qBAAqB,CAAC;AAE7B,0DAA0D;AAC1D,OAAO,EACL,mBAAmB,GAEpB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,eAAe,GAEhB,MAAM,0BAA0B,CAAC;AAElC,8BAA8B;AAC9B,OAAO,EACL,iBAAiB,GAElB,MAAM,6BAA6B,CAAC;AAErC,sBAAsB;AACtB,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,GAInB,MAAM,cAAc,CAAC;AAEtB,UAAU;AACV,OAAO,EACL,mBAAmB,EACnB,sBAAsB,GAGvB,MAAM,cAAc,CAAC;AAEtB,QAAQ;AACR,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD,QAAQ;AACR,OAAO,EACL,kBAAkB,EAClB,sBAAsB,GAEvB,MAAM,YAAY,CAAC"}
|
|
@@ -0,0 +1,37 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Conformance-attestation trust pass (Q5 — verdict → trust pipe).
|
|
3
|
+
*
|
|
4
|
+
* Consumes in-toto conformance attestations (predicateType
|
|
5
|
+
* `https://cognium.net/attestations/conformance/v0.1`, produced by
|
|
6
|
+
* `@cogniumhq/conformance`'s exporter) and folds dependency-level spec-conformance
|
|
7
|
+
* VIOLATIONS into the supply_chain trust signal. The attestation is the witness —
|
|
8
|
+
* this is the "evidence chain" made concrete: a pinned dependency graded against
|
|
9
|
+
* spec-derived oracles, its verdict carried as a standard in-toto Statement.
|
|
10
|
+
*
|
|
11
|
+
* Data-only coupling: this pass reads the public in-toto format, NOT the private
|
|
12
|
+
* conformance package/store — circle-ir-ai takes no dependency on it.
|
|
13
|
+
*
|
|
14
|
+
* Opt-in: the attestation source comes from `options.attestationsPath` or the
|
|
15
|
+
* `CONFORMANCE_ATTESTATIONS` env var. Unset ⇒ the pass no-ops before doing any
|
|
16
|
+
* work (`applicable: false`), byte-identical to pre-Q5 behavior. `applicable` is
|
|
17
|
+
* also false when attestations exist but none match this repo's dependencies —
|
|
18
|
+
* a 100 there would mean "didn't look", not "clean" (cognium-ai#234 semantics).
|
|
19
|
+
*/
|
|
20
|
+
import { type TrustPassResult } from '../types.js';
|
|
21
|
+
import { type EcosystemDep } from './dep-manifests.js';
|
|
22
|
+
declare const PREDICATE_TYPE = "https://cognium.net/attestations/conformance/v0.1";
|
|
23
|
+
export interface ConformanceAttestationOptions {
|
|
24
|
+
/** Path to an in-toto bundle (`.jsonl`), a single `.json` Statement, or a dir
|
|
25
|
+
* of `*.intoto.json`. Falls back to the `CONFORMANCE_ATTESTATIONS` env var. */
|
|
26
|
+
attestationsPath?: string;
|
|
27
|
+
/** Pre-parsed repo dependencies to match against (else parsed from projectPath). */
|
|
28
|
+
deps?: EcosystemDep[];
|
|
29
|
+
}
|
|
30
|
+
/** Split a subject "name@version" — version is after the LAST '@' (scopes keep theirs). */
|
|
31
|
+
declare function splitSubject(subject: string): {
|
|
32
|
+
name: string;
|
|
33
|
+
version: string;
|
|
34
|
+
} | null;
|
|
35
|
+
export declare function conformanceAttestationPass(projectPath: string, options?: ConformanceAttestationOptions): Promise<TrustPassResult>;
|
|
36
|
+
export { PREDICATE_TYPE, splitSubject };
|
|
37
|
+
//# sourceMappingURL=conformance-attestation.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"conformance-attestation.d.ts","sourceRoot":"","sources":["../../../src/trust/passes/conformance-attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,EACL,KAAK,eAAe,EAGrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAqB,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAG1E,QAAA,MAAM,cAAc,sDAAsD,CAAC;AAE3E,MAAM,WAAW,6BAA6B;IAC5C;oFACgF;IAChF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oFAAoF;IACpF,IAAI,CAAC,EAAE,YAAY,EAAE,CAAC;CACvB;AA4CD,2FAA2F;AAC3F,iBAAS,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAI/E;AAsED,wBAAsB,0BAA0B,CAC9C,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,6BAAkC,GAC1C,OAAO,CAAC,eAAe,CAAC,CA2D1B;AAGD,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC"}
|
|
@@ -0,0 +1,200 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Conformance-attestation trust pass (Q5 — verdict → trust pipe).
|
|
3
|
+
*
|
|
4
|
+
* Consumes in-toto conformance attestations (predicateType
|
|
5
|
+
* `https://cognium.net/attestations/conformance/v0.1`, produced by
|
|
6
|
+
* `@cogniumhq/conformance`'s exporter) and folds dependency-level spec-conformance
|
|
7
|
+
* VIOLATIONS into the supply_chain trust signal. The attestation is the witness —
|
|
8
|
+
* this is the "evidence chain" made concrete: a pinned dependency graded against
|
|
9
|
+
* spec-derived oracles, its verdict carried as a standard in-toto Statement.
|
|
10
|
+
*
|
|
11
|
+
* Data-only coupling: this pass reads the public in-toto format, NOT the private
|
|
12
|
+
* conformance package/store — circle-ir-ai takes no dependency on it.
|
|
13
|
+
*
|
|
14
|
+
* Opt-in: the attestation source comes from `options.attestationsPath` or the
|
|
15
|
+
* `CONFORMANCE_ATTESTATIONS` env var. Unset ⇒ the pass no-ops before doing any
|
|
16
|
+
* work (`applicable: false`), byte-identical to pre-Q5 behavior. `applicable` is
|
|
17
|
+
* also false when attestations exist but none match this repo's dependencies —
|
|
18
|
+
* a 100 there would mean "didn't look", not "clean" (cognium-ai#234 semantics).
|
|
19
|
+
*/
|
|
20
|
+
import * as fs from 'fs';
|
|
21
|
+
import * as path from 'path';
|
|
22
|
+
import { SEVERITY_WEIGHTS, } from '../types.js';
|
|
23
|
+
import { parseAllManifests } from './dep-manifests.js';
|
|
24
|
+
const PASS = 'conformance-attestation';
|
|
25
|
+
const PREDICATE_TYPE = 'https://cognium.net/attestations/conformance/v0.1';
|
|
26
|
+
/**
|
|
27
|
+
* Resolve npm dependencies at their EXACT installed versions from
|
|
28
|
+
* package-lock.json (v2/v3 `packages` map). Attestations bind to pinned
|
|
29
|
+
* artifacts, so ranges in package.json are not enough — the lockfile is the
|
|
30
|
+
* source of exact `name@version`. parseAllManifests covers the other ecosystems
|
|
31
|
+
* (Maven/PyPI/Go/Cargo); npm is intentionally not in it (npm-audit owns npm),
|
|
32
|
+
* so this pass resolves npm itself for subject matching.
|
|
33
|
+
*/
|
|
34
|
+
function resolveNpmDeps(projectPath) {
|
|
35
|
+
const lock = path.join(projectPath, 'package-lock.json');
|
|
36
|
+
let parsed;
|
|
37
|
+
try {
|
|
38
|
+
parsed = JSON.parse(fs.readFileSync(lock, 'utf-8'));
|
|
39
|
+
}
|
|
40
|
+
catch {
|
|
41
|
+
return [];
|
|
42
|
+
}
|
|
43
|
+
const packages = parsed?.packages;
|
|
44
|
+
if (!packages || typeof packages !== 'object')
|
|
45
|
+
return [];
|
|
46
|
+
const out = [];
|
|
47
|
+
for (const [key, entry] of Object.entries(packages)) {
|
|
48
|
+
if (!key)
|
|
49
|
+
continue; // "" is the root project
|
|
50
|
+
const marker = 'node_modules/';
|
|
51
|
+
const i = key.lastIndexOf(marker); // final segment handles nested node_modules
|
|
52
|
+
if (i < 0)
|
|
53
|
+
continue;
|
|
54
|
+
const name = key.slice(i + marker.length);
|
|
55
|
+
const version = entry?.version;
|
|
56
|
+
if (name && version)
|
|
57
|
+
out.push({ ecosystem: 'npm', name, version, file: 'package-lock.json' });
|
|
58
|
+
}
|
|
59
|
+
return out;
|
|
60
|
+
}
|
|
61
|
+
/** Split a subject "name@version" — version is after the LAST '@' (scopes keep theirs). */
|
|
62
|
+
function splitSubject(subject) {
|
|
63
|
+
const at = subject.lastIndexOf('@');
|
|
64
|
+
if (at <= 0)
|
|
65
|
+
return null; // no version, or leading-@ scope with no version marker
|
|
66
|
+
return { name: subject.slice(0, at), version: subject.slice(at + 1) };
|
|
67
|
+
}
|
|
68
|
+
function isConformanceStatement(v) {
|
|
69
|
+
if (v === null || typeof v !== 'object')
|
|
70
|
+
return false;
|
|
71
|
+
const s = v;
|
|
72
|
+
return (s.predicateType === PREDICATE_TYPE &&
|
|
73
|
+
Array.isArray(s.subject) &&
|
|
74
|
+
typeof s.predicate === 'object' &&
|
|
75
|
+
s.predicate !== null);
|
|
76
|
+
}
|
|
77
|
+
/** Load conformance Statements from a bundle file, single JSON, or directory. */
|
|
78
|
+
function loadStatements(source) {
|
|
79
|
+
const out = [];
|
|
80
|
+
const add = (raw) => {
|
|
81
|
+
try {
|
|
82
|
+
const v = JSON.parse(raw);
|
|
83
|
+
if (isConformanceStatement(v))
|
|
84
|
+
out.push(v);
|
|
85
|
+
}
|
|
86
|
+
catch {
|
|
87
|
+
/* skip malformed line/file — never throw from a trust pass */
|
|
88
|
+
}
|
|
89
|
+
};
|
|
90
|
+
let stat;
|
|
91
|
+
try {
|
|
92
|
+
stat = fs.statSync(source);
|
|
93
|
+
}
|
|
94
|
+
catch {
|
|
95
|
+
return out;
|
|
96
|
+
}
|
|
97
|
+
if (stat.isDirectory()) {
|
|
98
|
+
for (const f of fs.readdirSync(source)) {
|
|
99
|
+
if (f.endsWith('.intoto.json') || f.endsWith('.json')) {
|
|
100
|
+
try {
|
|
101
|
+
add(fs.readFileSync(path.join(source, f), 'utf-8'));
|
|
102
|
+
}
|
|
103
|
+
catch {
|
|
104
|
+
/* skip unreadable file */
|
|
105
|
+
}
|
|
106
|
+
}
|
|
107
|
+
}
|
|
108
|
+
}
|
|
109
|
+
else if (source.endsWith('.jsonl')) {
|
|
110
|
+
let content = '';
|
|
111
|
+
try {
|
|
112
|
+
content = fs.readFileSync(source, 'utf-8');
|
|
113
|
+
}
|
|
114
|
+
catch {
|
|
115
|
+
return out;
|
|
116
|
+
}
|
|
117
|
+
for (const line of content.split('\n')) {
|
|
118
|
+
if (line.trim())
|
|
119
|
+
add(line);
|
|
120
|
+
}
|
|
121
|
+
}
|
|
122
|
+
else {
|
|
123
|
+
try {
|
|
124
|
+
add(fs.readFileSync(source, 'utf-8'));
|
|
125
|
+
}
|
|
126
|
+
catch {
|
|
127
|
+
/* skip */
|
|
128
|
+
}
|
|
129
|
+
}
|
|
130
|
+
return out;
|
|
131
|
+
}
|
|
132
|
+
function skip(reason, message, start) {
|
|
133
|
+
return {
|
|
134
|
+
pass: PASS,
|
|
135
|
+
score: 100,
|
|
136
|
+
applicable: false,
|
|
137
|
+
findings: [{ pass: PASS, ruleId: `conformance-${reason}`, severity: 'info', message, meta: { reason } }],
|
|
138
|
+
durationMs: Date.now() - start,
|
|
139
|
+
};
|
|
140
|
+
}
|
|
141
|
+
export async function conformanceAttestationPass(projectPath, options = {}) {
|
|
142
|
+
const start = Date.now();
|
|
143
|
+
const source = options.attestationsPath ?? process.env.CONFORMANCE_ATTESTATIONS;
|
|
144
|
+
// Fast-path bail: unset ⇒ zero work, pre-Q5 behavior.
|
|
145
|
+
if (!source) {
|
|
146
|
+
return skip('no-attestations', 'No conformance attestations provided; pass skipped', start);
|
|
147
|
+
}
|
|
148
|
+
const statements = loadStatements(source);
|
|
149
|
+
if (statements.length === 0) {
|
|
150
|
+
return skip('empty-attestations', `No conformance attestations found at ${source}`, start);
|
|
151
|
+
}
|
|
152
|
+
const deps = options.deps ?? [...resolveNpmDeps(projectPath), ...parseAllManifests(projectPath).deps];
|
|
153
|
+
// Index repo deps by "name@version" for exact-artifact matching.
|
|
154
|
+
const depKeys = new Set(deps.map((d) => `${d.name}@${d.version}`));
|
|
155
|
+
const findings = [];
|
|
156
|
+
let matched = 0;
|
|
157
|
+
for (const st of statements) {
|
|
158
|
+
const subject = st.subject[0]?.name;
|
|
159
|
+
if (!subject)
|
|
160
|
+
continue;
|
|
161
|
+
const nv = splitSubject(subject);
|
|
162
|
+
if (!nv || !depKeys.has(subject))
|
|
163
|
+
continue; // attestation not about a dep this repo pins
|
|
164
|
+
matched++;
|
|
165
|
+
if (st.predicate.verdict !== 'VIOLATION')
|
|
166
|
+
continue; // PASS on a matched dep = clean signal
|
|
167
|
+
findings.push({
|
|
168
|
+
pass: PASS,
|
|
169
|
+
// A dependency deviating from its own spec is a supply-chain quality signal,
|
|
170
|
+
// not (necessarily) an exploitable CVE → medium baseline.
|
|
171
|
+
ruleId: `conformance-violation-${nv.name}`,
|
|
172
|
+
severity: 'medium',
|
|
173
|
+
message: `${subject}: fails spec conformance — ${st.predicate.requirement.clause} (${st.predicate.requirement.id})`,
|
|
174
|
+
meta: {
|
|
175
|
+
package: nv.name,
|
|
176
|
+
version: nv.version,
|
|
177
|
+
requirementId: st.predicate.requirement.id,
|
|
178
|
+
clause: st.predicate.requirement.clause,
|
|
179
|
+
specAuthority: st.predicate.spec.authority,
|
|
180
|
+
specUrl: st.predicate.spec.url,
|
|
181
|
+
contractRev: st.predicate.spec.contractRev,
|
|
182
|
+
evidenceTrust: st.predicate.trust?.tier,
|
|
183
|
+
attestation: PREDICATE_TYPE,
|
|
184
|
+
},
|
|
185
|
+
});
|
|
186
|
+
}
|
|
187
|
+
// Attestations exist but none concern this repo's deps ⇒ we did not actually
|
|
188
|
+
// assess anything here — inapplicable, so it can't inflate supply_chain to 100.
|
|
189
|
+
if (matched === 0) {
|
|
190
|
+
return skip('no-matched-deps', 'No conformance attestations matched this repo’s dependencies', start);
|
|
191
|
+
}
|
|
192
|
+
let deduction = 0;
|
|
193
|
+
for (const f of findings)
|
|
194
|
+
deduction += SEVERITY_WEIGHTS[f.severity];
|
|
195
|
+
const score = Math.max(0, Math.min(100, 100 - deduction));
|
|
196
|
+
return { pass: PASS, score, findings, durationMs: Date.now() - start };
|
|
197
|
+
}
|
|
198
|
+
// Exports for testing
|
|
199
|
+
export { PREDICATE_TYPE, splitSubject };
|
|
200
|
+
//# sourceMappingURL=conformance-attestation.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"conformance-attestation.js","sourceRoot":"","sources":["../../../src/trust/passes/conformance-attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAGL,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAqB,MAAM,oBAAoB,CAAC;AAE1E,MAAM,IAAI,GAAG,yBAAyB,CAAC;AACvC,MAAM,cAAc,GAAG,mDAAmD,CAAC;AAqB3E;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,WAAmB;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IACzD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,QAAQ,GAAI,MAA8D,EAAE,QAAQ,CAAC;IAC3F,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzD,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,GAAG;YAAE,SAAS,CAAC,yBAAyB;QAC7C,MAAM,MAAM,GAAG,eAAe,CAAC;QAC/B,MAAM,CAAC,GAAG,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,4CAA4C;QAC/E,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QACpB,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,KAAK,EAAE,OAAO,CAAC;QAC/B,IAAI,IAAI,IAAI,OAAO;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2FAA2F;AAC3F,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,wDAAwD;IAClF,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,SAAS,sBAAsB,CAAC,CAAU;IACxC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,OAAO,CACL,CAAC,CAAC,aAAa,KAAK,cAAc;QAClC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QACxB,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,CAAC,CAAC,SAAS,KAAK,IAAI,CACrB,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAS,cAAc,CAAC,MAAc;IACpC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,CAAC,GAAW,EAAQ,EAAE;QAChC,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,sBAAsB,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,8DAA8D;QAChE,CAAC;IACH,CAAC,CAAC;IACF,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtD,IAAI,CAAC;oBACH,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;gBACtD,CAAC;gBAAC,MAAM,CAAC;oBACP,0BAA0B;gBAC5B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,IAAI,OAAO,GAAG,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,CAAC;QACb,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,IAAI,EAAE;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,UAAU;QACZ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,IAAI,CAAC,MAAc,EAAE,OAAe,EAAE,KAAa;IAC1D,OAAO;QACL,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,GAAG;QACV,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;QACxG,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,WAAmB,EACnB,UAAyC,EAAE;IAE3C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEzB,MAAM,MAAM,GAAG,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;IAChF,sDAAsD;IACtD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC,iBAAiB,EAAE,oDAAoD,EAAE,KAAK,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,oBAAoB,EAAE,wCAAwC,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC;IAC7F,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,cAAc,CAAC,WAAW,CAAC,EAAE,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC;IACtG,iEAAiE;IACjE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAEnE,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;QACpC,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS,CAAC,6CAA6C;QACzF,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,WAAW;YAAE,SAAS,CAAC,uCAAuC;QAC3F,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,IAAI;YACV,6EAA6E;YAC7E,0DAA0D;YAC1D,MAAM,EAAE,yBAAyB,EAAE,CAAC,IAAI,EAAE;YAC1C,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,GAAG,OAAO,8BAA8B,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,KAAK,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,GAAG;YACnH,IAAI,EAAE;gBACJ,OAAO,EAAE,EAAE,CAAC,IAAI;gBAChB,OAAO,EAAE,EAAE,CAAC,OAAO;gBACnB,aAAa,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE;gBAC1C,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM;gBACvC,aAAa,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS;gBAC1C,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG;gBAC9B,WAAW,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW;gBAC1C,aAAa,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI;gBACvC,WAAW,EAAE,cAAc;aAC5B;SACF,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,gFAAgF;IAChF,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC,iBAAiB,EAAE,8DAA8D,EAAE,KAAK,CAAC,CAAC;IACxG,CAAC;IAED,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,SAAS,IAAI,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC;IAE1D,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;AACzE,CAAC;AAED,sBAAsB;AACtB,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"scoring.d.ts","sourceRoot":"","sources":["../../src/trust/scoring.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,gBAAgB,EAKtB,MAAM,YAAY,CAAC;AAGpB;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC;CAC9B;AAMD,MAAM,MAAM,aAAa,GACrB,cAAc,GACd,eAAe,GACf,WAAW,GACX,YAAY,GACZ,WAAW,CAAC;AAMhB,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,eAAO,MAAM,sBAAsB,EAAE,kBAQpC,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAE7D,CAAC;AAUF,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,
|
|
1
|
+
{"version":3,"file":"scoring.d.ts","sourceRoot":"","sources":["../../src/trust/scoring.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,gBAAgB,EAKtB,MAAM,YAAY,CAAC;AAGpB;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC;CAC9B;AAMD,MAAM,MAAM,aAAa,GACrB,cAAc,GACd,eAAe,GACf,WAAW,GACX,YAAY,GACZ,WAAW,CAAC;AAMhB,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,eAAO,MAAM,sBAAsB,EAAE,kBAQpC,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAE7D,CAAC;AAUF,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CA4E3D,CAAC;AAMF,iEAAiE;AACjE,KAAK,cAAc,GACf,qBAAqB,GACrB,oBAAoB,GACpB,oBAAoB,GACpB,mBAAmB,GACnB,kBAAkB,GAClB,eAAe,GACf,eAAe,GACf,eAAe,GACf,kBAAkB,GAClB,cAAc,GACd,iBAAiB,GACjB,kBAAkB,GAClB,mBAAmB,CAAC;AAExB,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAuC7D,CAAC;AAMF;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAUtE;AAMD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,eAAe,EAAE,EAC9B,MAAM,GAAE,kBAA2C,EACnD,OAAO,GAAE,mBAAwB,GAChC,gBAAgB,CAgMlB"}
|
package/dist/trust/scoring.js
CHANGED
|
@@ -44,6 +44,8 @@ export const PASS_CATEGORY_MAP = {
|
|
|
44
44
|
// cognium-ai#234 (L2) — ecosystem-agnostic CVE audit (Maven/PyPI/Go/Cargo)
|
|
45
45
|
// via OSV.dev; makes supply_chain a real signal on non-npm repos.
|
|
46
46
|
'osv-dependency-audit': 'supply_chain',
|
|
47
|
+
// Q5 — a pinned dependency failing spec conformance (in-toto attestation).
|
|
48
|
+
'conformance-attestation': 'supply_chain',
|
|
47
49
|
// code_security
|
|
48
50
|
'data-exfiltration': 'code_security',
|
|
49
51
|
'input-validation': 'code_security',
|
|
@@ -107,6 +109,7 @@ export const PASS_COMPONENT_MAP = {
|
|
|
107
109
|
'dependency-staleness': 'supply_chain_score',
|
|
108
110
|
'dependency-audit': 'supply_chain_score',
|
|
109
111
|
'osv-dependency-audit': 'supply_chain_score',
|
|
112
|
+
'conformance-attestation': 'supply_chain_score',
|
|
110
113
|
'data-exfiltration': 'exfiltration_score',
|
|
111
114
|
'prompt-injection': 'instruction_score',
|
|
112
115
|
'excessive-permissions': 'permission_score',
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"scoring.js","sourceRoot":"","sources":["../../src/trust/scoring.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAML,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AA+B9D,MAAM,CAAC,MAAM,sBAAsB,GAAuB;IACxD,OAAO,EAAE;QACP,YAAY,EAAE,GAAG;QACjB,aAAa,EAAE,GAAG;QAClB,SAAS,EAAE,GAAG;QACd,UAAU,EAAE,GAAG;QACf,SAAS,EAAE,GAAG;KACf;CACF,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAA2B;IAChE,mBAAmB,EAAE,EAAE;CACxB,CAAC;AAEF,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,8EAA8E;AAC9E,2CAA2C;AAC3C,8EAA8E;AAE9E,MAAM,CAAC,MAAM,iBAAiB,GAAkC;IAC9D,eAAe;IACf,mBAAmB,EAAE,cAAc;IACnC,qBAAqB,EAAE,cAAc;IACrC,sBAAsB,EAAE,cAAc;IACtC,kBAAkB,EAAE,cAAc;IAClC,2EAA2E;IAC3E,kEAAkE;IAClE,sBAAsB,EAAE,cAAc;
|
|
1
|
+
{"version":3,"file":"scoring.js","sourceRoot":"","sources":["../../src/trust/scoring.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAML,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AA+B9D,MAAM,CAAC,MAAM,sBAAsB,GAAuB;IACxD,OAAO,EAAE;QACP,YAAY,EAAE,GAAG;QACjB,aAAa,EAAE,GAAG;QAClB,SAAS,EAAE,GAAG;QACd,UAAU,EAAE,GAAG;QACf,SAAS,EAAE,GAAG;KACf;CACF,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAA2B;IAChE,mBAAmB,EAAE,EAAE;CACxB,CAAC;AAEF,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,8EAA8E;AAC9E,2CAA2C;AAC3C,8EAA8E;AAE9E,MAAM,CAAC,MAAM,iBAAiB,GAAkC;IAC9D,eAAe;IACf,mBAAmB,EAAE,cAAc;IACnC,qBAAqB,EAAE,cAAc;IACrC,sBAAsB,EAAE,cAAc;IACtC,kBAAkB,EAAE,cAAc;IAClC,2EAA2E;IAC3E,kEAAkE;IAClE,sBAAsB,EAAE,cAAc;IACtC,2EAA2E;IAC3E,yBAAyB,EAAE,cAAc;IAEzC,gBAAgB;IAChB,mBAAmB,EAAE,eAAe;IACpC,kBAAkB,EAAE,eAAe;IACnC,iBAAiB,EAAE,eAAe;IAClC,gEAAgE;IAChE,kEAAkE;IAClE,wEAAwE;IACxE,sEAAsE;IACtE,uEAAuE;IACvE,mBAAmB,EAAE,eAAe;IACpC,4EAA4E;IAC5E,oDAAoD;IACpD,iBAAiB,EAAE,eAAe;IAElC,0EAA0E;IAC1E,uEAAuE;IACvE,mDAAmD;IACnD,kBAAkB,EAAE,WAAW;IAC/B,uBAAuB,EAAE,WAAW;IACpC,iBAAiB,EAAE,WAAW;IAC9B,iBAAiB,EAAE,WAAW;IAC9B,gBAAgB,EAAE,WAAW;IAC7B,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,2EAA2E;IAC3E,2EAA2E;IAC3E,6EAA6E;IAC7E,8EAA8E;IAC9E,0CAA0C;IAE1C,aAAa;IACb,oBAAoB,EAAE,YAAY;IAClC,mBAAmB,EAAE,YAAY;IAEjC,yCAAyC;IACzC,oBAAoB,EAAE,eAAe;IACrC,sBAAsB,EAAE,eAAe;IACvC,oBAAoB,EAAE,eAAe;IACrC,6BAA6B,EAAE,eAAe;IAC9C,eAAe,EAAE,eAAe;IAEhC,qCAAqC;IACrC,sBAAsB,EAAE,eAAe;IACvC,sBAAsB,EAAE,eAAe;IACvC,gBAAgB,EAAE,eAAe;IACjC,oBAAoB,EAAE,eAAe;IAErC,kEAAkE;IAClE,mBAAmB,EAAE,eAAe;IACpC,cAAc,EAAE,eAAe;IAE/B,gEAAgE;IAChE,WAAW,EAAE,eAAe;IAC5B,mBAAmB,EAAE,eAAe;IAEpC,qDAAqD;IACrD,iBAAiB,EAAE,eAAe;IAElC,sCAAsC;IACtC,iBAAiB,EAAE,WAAW;IAC9B,gBAAgB,EAAE,WAAW;IAC7B,aAAa,EAAE,WAAW;IAC1B,0BAA0B,EAAE,WAAW,EAAE,qCAAqC;CAC/E,CAAC;AAsBF,MAAM,CAAC,MAAM,kBAAkB,GAAmC;IAChE,kBAAkB,EAAE,qBAAqB;IACzC,qBAAqB,EAAE,oBAAoB;IAC3C,sBAAsB,EAAE,oBAAoB;IAC5C,kBAAkB,EAAE,oBAAoB;IACxC,sBAAsB,EAAE,oBAAoB;IAC5C,yBAAyB,EAAE,oBAAoB;IAC/C,mBAAmB,EAAE,oBAAoB;IACzC,kBAAkB,EAAE,mBAAmB;IACvC,uBAAuB,EAAE,kBAAkB;IAC3C,iBAAiB,EAAE,kBAAkB;IACrC,mBAAmB,EAAE,eAAe;IACpC,iBAAiB,EAAE,eAAe;IAClC,oBAAoB,EAAE,eAAe;IACrC,mBAAmB,EAAE,kBAAkB;IACvC,iBAAiB,EAAE,kBAAkB;IACrC,gBAAgB,EAAE,iBAAiB;IACnC,0BAA0B,EAAE,kBAAkB;IAC9C,oBAAoB,EAAE,eAAe;IACrC,sBAAsB,EAAE,eAAe;IACvC,oBAAoB,EAAE,eAAe;IACrC,6BAA6B,EAAE,eAAe;IAC9C,eAAe,EAAE,eAAe;IAChC,sBAAsB,EAAE,mBAAmB;IAC3C,sBAAsB,EAAE,mBAAmB;IAC3C,gBAAgB,EAAE,mBAAmB;IACrC,oBAAoB,EAAE,mBAAmB;IACzC,mBAAmB,EAAE,qBAAqB;IAC1C,0EAA0E;IAC1E,gEAAgE;IAChE,4DAA4D;IAC5D,mBAAmB,EAAE,qBAAqB;IAC1C,cAAc,EAAE,eAAe;IAC/B,WAAW,EAAE,eAAe;IAC5B,mBAAmB,EAAE,eAAe;IACpC,iBAAiB,EAAE,eAAe;IAClC,4EAA4E;IAC5E,kDAAkD;IAClD,iBAAiB,EAAE,cAAc;CAClC,CAAC;AAEF,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAA0B;IAC9D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;SAC7C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;SACtB,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAElC,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,kDAAkD,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAC3E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,WAA8B,EAC9B,SAA6B,sBAAsB,EACnD,UAA+B,EAAE;IAEjC,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAE9B,6EAA6E;IAE7E,mEAAmE;IACnE,0CAA0C;IAC1C,yEAAyE;IACzE,sEAAsE;IACtE,yEAAyE;IACzE,wCAAwC;IACxC,MAAM,cAAc,GAAG,IAAI,GAAG,EAA6D,CAAC;IAC5F,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAA2B,CAAC;IAElE,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,oEAAoE;YACpE,SAAS;QACX,CAAC;QACD,IAAI,EAAE,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClD,IAAI,IAAI;gBAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;;gBACxB,sBAAsB,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;YACrD,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC;YACnC,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC1D,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,IAAI,cAAc,EAAE,CAAC;QAC/D,IAAI,SAAS,GAAG,CAAC;YAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,SAAS,CAAC,CAAC;IACxE,CAAC;IAED,4EAA4E;IAC5E,EAAE;IACF,uEAAuE;IACvE,mEAAmE;IACnE,4EAA4E;IAC5E,sEAAsE;IACtE,2EAA2E;IAC3E,0EAA0E;IAC1E,0CAA0C;IAE1C,MAAM,gBAAgB,GAAoB;QACxC,cAAc;QACd,eAAe;QACf,WAAW;QACX,YAAY;KACb,CAAC,CAAC,iEAAiE;IAEpE,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,MAAM,KAAK,CAAC;YAAE,SAAS;QAC3B,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,GAAG,KAAK,SAAS;YAAE,SAAS,CAAC,yCAAyC;QAC1E,WAAW,IAAI,GAAG,GAAG,MAAM,CAAC;QAC5B,eAAe,IAAI,MAAM,CAAC;IAC5B,CAAC;IAED,2EAA2E;IAC3E,uEAAuE;IACvE,IAAI,cAAc,GAChB,eAAe,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC;IAC5D,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAEpF,6EAA6E;IAC7E,8EAA8E;IAC9E,4EAA4E;IAC5E,2EAA2E;IAC3E,mEAAmE;IACnE,oCAAoC;IACpC,MAAM,YAAY,GAAG,yBAAyB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACxE,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EACvC,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,YAAY,CAAC,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAEjE,qCAAqC;IACrC,MAAM,gBAAgB,GAAuB,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACxE,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO;YACL,QAAQ,EAAE,GAAG;YACb,SAAS,EAAE,GAAG,KAAK,SAAS;YAC5B,KAAK,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI;YAC7D,kBAAkB,EAAE,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE;YACzD,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SAC5B,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAEjE,4EAA4E;IAE5E,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA4B,CAAC;IAE7D,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,wEAAwE;QACxE,qEAAqE;QACrE,sEAAsE;QACtE,IAAI,EAAE,CAAC,UAAU,KAAK,KAAK;YAAE,SAAS;QACtC,MAAM,SAAS,GAAG,kBAAkB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,SAAS,KAAK,SAAS;YAAE,SAAS;QACtC,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,CAAC,GAAmB,EAAU,EAAE;QACnD,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC,CAAC,8BAA8B;QAC9E,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3D,CAAC,CAAC;IAEF,4EAA4E;IAE5E,yEAAyE;IACzE,8DAA8D;IAC9D,MAAM,gBAAgB,GAAsB,EAAE,CAAC;IAC/C,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;gBAC9B,gBAAgB,CAAC,IAAI,CAAC;oBACpB,IAAI,EAAE,EAAE,CAAC,IAAI;oBACb,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI;oBACtB,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI;oBACtB,OAAO,EAAE,CAAC,CAAC,OAAO;iBACnB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC;IAEhD,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,eAAe,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACxD,uEAAuE;IACvE,MAAM,IAAI,GAAG,eAAe,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAe,WAAW;QACxC,CAAC,CAAC,2BAA2B;QAC7B,CAAC,CAAC,OAAO,CAAC;IAEZ,4EAA4E;IAE5E,OAAO;QACL,KAAK,EAAE,cAAc;QACrB,IAAI;QAEJ,qCAAqC;QACrC,UAAU;QACV,QAAQ;QACR,gBAAgB;QAEhB,8CAA8C;QAC9C,gBAAgB;QAChB,cAAc;QAEd,sBAAsB;QACtB,mBAAmB,EAAE,YAAY,CAAC,qBAAqB,CAAC;QACxD,kBAAkB,EAAE,YAAY,CAAC,oBAAoB,CAAC;QACtD,kBAAkB,EAAE,YAAY,CAAC,oBAAoB,CAAC;QACtD,iBAAiB,EAAE,YAAY,CAAC,mBAAmB,CAAC;QACpD,gBAAgB,EAAE,YAAY,CAAC,kBAAkB,CAAC;QAClD,aAAa,EAAE,YAAY,CAAC,eAAe,CAAC;QAC5C,YAAY,EAAE,YAAY,CAAC,cAAc,CAAC,EAAE,iCAAiC;QAC7E,aAAa,EAAE,YAAY,CAAC,eAAe,CAAC;QAC5C,gBAAgB,EAAE,YAAY,CAAC,kBAAkB,CAAC;QAClD,aAAa,EAAE,YAAY,CAAC,eAAe,CAAC;QAC5C,eAAe,EAAE,YAAY,CAAC,iBAAiB,CAAC;QAChD,gBAAgB,EAAE,YAAY,CAAC,kBAAkB,CAAC;QAClD,iBAAiB,EAAE,YAAY,CAAC,mBAAmB,CAAC;QAEpD,oEAAoE;QACpE,wDAAwD;QACxD,mBAAmB,EAAE,YAAY,CAAC,MAAM;QACxC,YAAY,EAAE,GAAG;QACjB,gBAAgB,EAAE,GAAG;QACrB,kBAAkB,EAAE,YAAY;QAEhC,WAAW;QACX,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;AACJ,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "circle-ir-ai",
|
|
3
|
-
"version": "2.
|
|
3
|
+
"version": "2.60.0",
|
|
4
4
|
"description": "LLM-enhanced SAST analysis built on circle-ir",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"module": "dist/index.js",
|
|
@@ -98,7 +98,7 @@
|
|
|
98
98
|
"@ax-llm/ax": "^20.0.0",
|
|
99
99
|
"@cognium/project-profile-detect": "^1.1.0",
|
|
100
100
|
"@mastra/core": "^1.18.0",
|
|
101
|
-
"circle-ir": "3.
|
|
101
|
+
"circle-ir": "3.193.0",
|
|
102
102
|
"minimatch": "^10.2.5",
|
|
103
103
|
"p-queue": "^9.1.0"
|
|
104
104
|
},
|