circle-ir-ai 2.59.1 → 2.60.1

package/CHANGELOG.md

@@ -5,6 +5,43 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.60.1] - 2026-07-28
+
+### Fixed — export `conformanceAttestationPass` from the package root
+
+2.60.0 added the pass to `src/trust/index.ts` but not the package-root
+re-export in `src/index.ts`, so `import { conformanceAttestationPass } from
+'circle-ir-ai'` failed for consumers (cognium-ai). Added the root export
+(+ `ConformanceAttestationOptions`). No behavior change.
+
+## [2.60.0] - 2026-07-28
+
+### Added — Q5: conformance-attestation trust pass (oracle verdict → trust)
+
+New supply_chain pass `conformance-attestation` (`src/trust/passes/conformance-attestation.ts`)
+closes the "evidence chain" pipe that previously had no shipped implementation.
+It consumes in-toto conformance attestations (predicateType
+`https://cognium.net/attestations/conformance/v0.1`, produced by
+`@cogniumhq/conformance`) and folds dependency-level spec-conformance VIOLATIONS
+into the `supply_chain_score`.
+
+- **Data-only coupling** — reads the public in-toto format, not the private
+  conformance package/store; no new dependency on circle-ir-ai.
+- **Opt-in, zero-overhead default** — source from `options.attestationsPath` or
+  `CONFORMANCE_ATTESTATIONS`; unset ⇒ fast-path `applicable:false`, byte-identical
+  to prior behavior.
+- **Coverage-honest** (cognium-ai#234) — `applicable:false` on no-source, empty
+  source, and no-matched-deps; a matched clean dep scores 100, a matched
+  VIOLATION is a medium finding (−5) carrying the requirement/clause/spec witness.
+- **Exact-artifact matching** — resolves npm deps at pinned versions from
+  `package-lock.json` (attestations are version-pinned); other ecosystems via
+  `parseAllManifests`. Registered in `PASS_CATEGORY_MAP` (supply_chain) +
+  `PASS_COMPONENT_MAP` (supply_chain_score); exported from `src/trust/index.ts`.
+- 9 tests (`tests/trust-conformance-attestation.test.ts`); full suite 1517 pass.
+
+CLI exposure (`cognium-ai trust --attestations`) lands in the cognium-ai bump
+after this publishes.
+
 ## [2.59.1] - 2026-07-28
 
 ### Changed — bump circle-ir 3.192.0 → 3.193.0

package/dist/index.d.ts

@@ -41,7 +41,7 @@ export { analyzeMCPPermissions, parseMCPConfig } from './skills/mcp-permissions.
 export { analyzeProject, analyzeProjectTwoPhase, buildTypeHierarchy, buildCrossFileCalls, findTaintPaths, type ProjectOptions, type FileInput, type TwoPhaseOptions, type ProjectAnalysis, type EnrichedFileAnalysis, type ProjectContext, type CrossFileTaintFlow, type TwoPhaseProjectAnalysis, } from './project/index.js';
 export { NaturalLanguageExtractor } from './extractors/natural-language.js';
 export { type CodebaseExtractor, ExtractorRegistry, createDefaultExtractorRegistry } from './extractors/index.js';
-export { type TrustSeverity, type TrustTier, type TierReason, type BlockingFinding, type TrustFinding, type TrustPassResult, type TrustScoreResult, TIER_THRESHOLDS, TIER_COLORS, SEVERITY_WEIGHTS, getTierForScore, hardcodedSecretsPass, type HardcodedSecretsOptions, licenseCompliancePass, cargoLicenseCompliancePass, scanLicenseCompliance, COPYLEFT_SEVERITY, type LicenseComplianceOptions, type CargoLicenseComplianceOptions, type LicenseFinding, type LicenseScanResult, type LicenseScanOptions, type PackageEcosystem, typosquatDetectionPass, type TyposquatDetectionOptions, promptInjectionPass, type PromptInjectionOptions, maliciousInstallScriptPass, type MaliciousInstallScriptOptions, dependencyStalenessPass, type DependencyStalenessOptions, excessivePermissionsPass, type ExcessivePermissionsOptions, dataExfiltrationPass, type DataExfiltrationOptions, agentInventoryPass, type AgentInventoryOptions, sbomGenerationPass, type SBOMGenerationOptions, auditTrailPass, type AuditTrailOptions, vexGenerationPass, type VEXGenerationOptions, dependencyAuditPass, type DependencyAuditOptions, codeComplexityPass, type CodeComplexityOptions, inputValidationPass, type InputValidationOptions, euAiActFlagsPass, type EuAiActFlagsOptions, toolPoisoningPass, type ToolPoisoningOptions, aiGeneratedFingerprintPass, type AiGeneratedFingerprintOptions, cacheInvalidationPass, type PerformancePassOptions, adaptCircleIRFindings, type CircleIRFindingsAdapterOptions, missingGuardDomPass, type MissingGuardDomOptions, featureEnvyPass, type FeatureEnvyOptions, specGapReportPass, type SpecGapReportOptions, computeTrustScore, validateScoringConfig, DEFAULT_SCORING_CONFIG, PASS_CATEGORY_MAP, PASS_COMPONENT_MAP, type TrustCategory, type TrustScoringConfig, type TrustScoringContext, type CategoryCoverage, type ReachabilityDetail, osvDependencyAuditPass, type OsvAuditOptions, parseAllManifests, parseMavenPom, parsePipRequirements, parseGoMod, parseCargoLock, type EcosystemDep, type Ecosystem, type ParseResult, cryptoWeaknessPass, CRYPTO_PASS_NAMES, type CryptoWeaknessOptions, computeReachabilityFactor, REACHABILITY_MAX_PENALTY, discriminatingSecurityScore, securityLoad, SECURITY_SEVERITY_PENALTY, SECURITY_SCORE_SCALE, type SecurityFindingCounts, compareTrustResults, formatComparisonReport, type TrustComparisonResult, type PassDelta, generateTrustSARIF, generateTrustBadge, generateBadgeFromScore, type BadgeOptions, } from './trust/index.js';
+export { type TrustSeverity, type TrustTier, type TierReason, type BlockingFinding, type TrustFinding, type TrustPassResult, type TrustScoreResult, TIER_THRESHOLDS, TIER_COLORS, SEVERITY_WEIGHTS, getTierForScore, hardcodedSecretsPass, type HardcodedSecretsOptions, licenseCompliancePass, cargoLicenseCompliancePass, scanLicenseCompliance, COPYLEFT_SEVERITY, type LicenseComplianceOptions, type CargoLicenseComplianceOptions, type LicenseFinding, type LicenseScanResult, type LicenseScanOptions, type PackageEcosystem, typosquatDetectionPass, type TyposquatDetectionOptions, promptInjectionPass, type PromptInjectionOptions, maliciousInstallScriptPass, type MaliciousInstallScriptOptions, dependencyStalenessPass, type DependencyStalenessOptions, excessivePermissionsPass, type ExcessivePermissionsOptions, dataExfiltrationPass, type DataExfiltrationOptions, agentInventoryPass, type AgentInventoryOptions, sbomGenerationPass, type SBOMGenerationOptions, auditTrailPass, type AuditTrailOptions, vexGenerationPass, type VEXGenerationOptions, dependencyAuditPass, type DependencyAuditOptions, conformanceAttestationPass, type ConformanceAttestationOptions, codeComplexityPass, type CodeComplexityOptions, inputValidationPass, type InputValidationOptions, euAiActFlagsPass, type EuAiActFlagsOptions, toolPoisoningPass, type ToolPoisoningOptions, aiGeneratedFingerprintPass, type AiGeneratedFingerprintOptions, cacheInvalidationPass, type PerformancePassOptions, adaptCircleIRFindings, type CircleIRFindingsAdapterOptions, missingGuardDomPass, type MissingGuardDomOptions, featureEnvyPass, type FeatureEnvyOptions, specGapReportPass, type SpecGapReportOptions, computeTrustScore, validateScoringConfig, DEFAULT_SCORING_CONFIG, PASS_CATEGORY_MAP, PASS_COMPONENT_MAP, type TrustCategory, type TrustScoringConfig, type TrustScoringContext, type CategoryCoverage, type ReachabilityDetail, osvDependencyAuditPass, type OsvAuditOptions, parseAllManifests, parseMavenPom, parsePipRequirements, parseGoMod, parseCargoLock, type EcosystemDep, type Ecosystem, type ParseResult, cryptoWeaknessPass, CRYPTO_PASS_NAMES, type CryptoWeaknessOptions, computeReachabilityFactor, REACHABILITY_MAX_PENALTY, discriminatingSecurityScore, securityLoad, SECURITY_SEVERITY_PENALTY, SECURITY_SCORE_SCALE, type SecurityFindingCounts, compareTrustResults, formatComparisonReport, type TrustComparisonResult, type PassDelta, generateTrustSARIF, generateTrustBadge, generateBadgeFromScore, type BadgeOptions, } from './trust/index.js';
 export { deprecatedUsagePass } from './trust/passes/deprecated-usage.js';
 export { throwsMismatchPass } from './trust/passes/throws-mismatch.js';
 export { inconsistentNamingPass } from './trust/passes/inconsistent-naming.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,cAAc,WAAW,CAAC;AAG1B,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAG5F,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAG5D,OAAO,EACL,sBAAsB,EACtB,SAAS,EACT,gBAAgB,EAChB,KAAK,SAAS,IAAI,mBAAmB,GACtC,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAGrE,OAAO,EACL,WAAW,EACX,cAAc,EACd,KAAK,OAAO,EAEZ,kBAAkB,EAClB,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,SAAS,EACd,KAAK,WAAW,GACjB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,UAAU,EACV,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,qBAAqB,GAC3B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,eAAe,EACf,mBAAmB,EAEnB,mBAAmB,EACnB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,cAAc,GACpB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,cAAc,EACd,eAAe,EACf,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,sBAAsB,EACtB,6BAA6B,EAC7B,2BAA2B,EAC3B,kCAAkC,EAClC,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,cAAc,GACpB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,YAAY,EACZ,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,SAAS,IAAI,cAAc,GACjC,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,KAAK,aAAa,EAClB,KAAK,cAAc,GACpB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,eAAe,EACf,cAAc,EACd,aAAa,EACb,SAAS,EACT,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,UAAU,IAAI,kBAAkB,GACtC,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,aAAa,EAClB,KAAK,YAAY,GAClB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,YAAY,EACZ,eAAe,EACf,SAAS,EACT,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,YAAY,GAClB,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,aAAa,GACnB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,aAAa,EACb,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,YAAY,IAAI,kBAAkB,EACvC,KAAK,cAAc,EACnB,KAAK,gBAAgB,GACtB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,sBAAsB,EACtB,6BAA6B,EAC7B,qBAAqB,EACrB,yBAAyB,EACzB,aAAa,EACb,aAAa,EACb,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACnB,KAAK,kBAAkB,GACxB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,0BAA0B,EAC1B,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,GACtB,MAAM,oBAAoB,CAAC;AAK5B,OAAO,EACL,eAAe,EACf,KAAK,kBAAkB,GACxB,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,wBAAwB,EACxB,aAAa,EACb,WAAW,EACX,aAAa,EACb,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GAClB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,UAAU,EACf,KAAK,gBAAgB,GACtB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,EACxB,KAAK,0BAA0B,GAChC,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EACL,iBAAiB,EACjB,6BAA6B,EAC7B,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,eAAe,EACf,UAAU,EACV,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,GACxB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,OAAO,EACZ,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,IAAI,0BAA0B,EACvD,KAAK,gBAAgB,IAAI,qBAAqB,EAC9C,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAC7G,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAGpF,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,GAC7B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,KAAK,iBAAiB,EAAE,iBAAiB,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AAGlH,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,eAAe,EACf,oBAAoB,EACpB,KAAK,uBAAuB,EAC5B,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,EACrB,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,EAClC,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,KAAK,yBAAyB,EAC9B,mBAAmB,EACnB,KAAK,sBAAsB,EAC3B,0BAA0B,EAC1B,KAAK,6BAA6B,EAClC,uBAAuB,EACvB,KAAK,0BAA0B,EAC/B,wBAAwB,EACxB,KAAK,2BAA2B,EAChC,oBAAoB,EACpB,KAAK,uBAAuB,EAC5B,kBAAkB,EAClB,KAAK,qBAAqB,EAC1B,kBAAkB,EAClB,KAAK,qBAAqB,EAC1B,cAAc,EACd,KAAK,iBAAiB,EACtB,iBAAiB,EACjB,KAAK,oBAAoB,EACzB,mBAAmB,EACnB,KAAK,sBAAsB,EAC3B,kBAAkB,EAClB,KAAK,qBAAqB,EAC1B,mBAAmB,EACnB,KAAK,sBAAsB,EAC3B,gBAAgB,EAChB,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,KAAK,oBAAoB,EACzB,0BAA0B,EAC1B,KAAK,6BAA6B,EAClC,qBAAqB,EACrB,KAAK,sBAAsB,EAC3B,qBAAqB,EACrB,KAAK,8BAA8B,EACnC,mBAAmB,EACnB,KAAK,sBAAsB,EAC3B,eAAe,EACf,KAAK,kBAAkB,EACvB,iBAAiB,EACjB,KAAK,oBAAoB,EACzB,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EAEvB,sBAAsB,EACtB,KAAK,eAAe,EACpB,iBAAiB,EACjB,aAAa,EACb,oBAAoB,EACpB,UAAU,EACV,cAAc,EACd,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,WAAW,EAEhB,kBAAkB,EAClB,iBAAiB,EACjB,KAAK,qBAAqB,EAE1B,yBAAyB,EACzB,wBAAwB,EAExB,2BAA2B,EAC3B,YAAY,EACZ,yBAAyB,EACzB,oBAAoB,EACpB,KAAK,qBAAqB,EAC1B,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,SAAS,EACd,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,YAAY,GAClB,MAAM,kBAAkB,CAAC;AAK1B,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAC5F,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,EAAE,6BAA6B,EAAE,MAAM,+CAA+C,CAAC;AAC9F,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAC5F,OAAO,EAAE,yBAAyB,EAAE,MAAM,2CAA2C,CAAC;AAGtF,OAAO,EACL,qBAAqB,IAAI,eAAe,EACxC,mBAAmB,EACnB,uBAAuB,EACvB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,KAAK,UAAU,GAChB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACL,eAAe,EACf,aAAa,EACb,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,GACxB,MAAM,2BAA2B,CAAC;AAOnC,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,6BAA6B,IAAI,gCAAgC,EACjE,gBAAgB,EAChB,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,SAAS,EACd,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,GAC7B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,UAAU,EACV,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,GACtB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,cAAc,EACd,WAAW,EACX,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,GAC1B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,iBAAiB,EACjB,iCAAiC,EACjC,KAAK,aAAa,EAClB,KAAK,WAAW,GACjB,MAAM,4BAA4B,CAAC;AAKpC,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,EACnB,eAAe,EACf,aAAa,EACb,sBAAsB,EACtB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,cAAc,GACpB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,cAAc,WAAW,CAAC;AAG1B,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAG5F,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAG5D,OAAO,EACL,sBAAsB,EACtB,SAAS,EACT,gBAAgB,EAChB,KAAK,SAAS,IAAI,mBAAmB,GACtC,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAGrE,OAAO,EACL,WAAW,EACX,cAAc,EACd,KAAK,OAAO,EAEZ,kBAAkB,EAClB,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,SAAS,EACd,KAAK,WAAW,GACjB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,UAAU,EACV,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,qBAAqB,GAC3B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,eAAe,EACf,mBAAmB,EAEnB,mBAAmB,EACnB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,cAAc,GACpB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,cAAc,EACd,eAAe,EACf,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,sBAAsB,EACtB,6BAA6B,EAC7B,2BAA2B,EAC3B,kCAAkC,EAClC,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,cAAc,GACpB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,YAAY,EACZ,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,SAAS,IAAI,cAAc,GACjC,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,KAAK,aAAa,EAClB,KAAK,cAAc,GACpB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,eAAe,EACf,cAAc,EACd,aAAa,EACb,SAAS,EACT,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,UAAU,IAAI,kBAAkB,GACtC,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,sBAAsB,EACtB,2BAA2B,EAC3B,KAAK,aAAa,EAClB,KAAK,YAAY,GAClB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,YAAY,EACZ,eAAe,EACf,SAAS,EACT,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,YAAY,GAClB,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,aAAa,GACnB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,aAAa,EACb,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,YAAY,IAAI,kBAAkB,EACvC,KAAK,cAAc,EACnB,KAAK,gBAAgB,GACtB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,sBAAsB,EACtB,6BAA6B,EAC7B,qBAAqB,EACrB,yBAAyB,EACzB,aAAa,EACb,aAAa,EACb,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,KAAK,cAAc,EACnB,KAAK,kBAAkB,GACxB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,0BAA0B,EAC1B,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,GACtB,MAAM,oBAAoB,CAAC;AAK5B,OAAO,EACL,eAAe,EACf,KAAK,kBAAkB,GACxB,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,wBAAwB,EACxB,aAAa,EACb,WAAW,EACX,aAAa,EACb,KAAK,UAAU,EACf,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,YAAY,GAClB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,UAAU,EACf,KAAK,gBAAgB,GACtB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,EACxB,KAAK,0BAA0B,GAChC,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EACL,iBAAiB,EACjB,6BAA6B,EAC7B,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,eAAe,EACf,UAAU,EACV,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,GACxB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,OAAO,EACZ,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,IAAI,0BAA0B,EACvD,KAAK,gBAAgB,IAAI,qBAAqB,EAC9C,KAAK,iBAAiB,GACvB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAC7G,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAGpF,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,GAC7B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,KAAK,iBAAiB,EAAE,iBAAiB,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AAGlH,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,eAAe,EACf,oBAAoB,EACpB,KAAK,uBAAuB,EAC5B,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,EACrB,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,EAClC,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,sBAAsB,EACtB,KAAK,yBAAyB,EAC9B,mBAAmB,EACnB,KAAK,sBAAsB,EAC3B,0BAA0B,EAC1B,KAAK,6BAA6B,EAClC,uBAAuB,EACvB,KAAK,0BAA0B,EAC/B,wBAAwB,EACxB,KAAK,2BAA2B,EAChC,oBAAoB,EACpB,KAAK,uBAAuB,EAC5B,kBAAkB,EAClB,KAAK,qBAAqB,EAC1B,kBAAkB,EAClB,KAAK,qBAAqB,EAC1B,cAAc,EACd,KAAK,iBAAiB,EACtB,iBAAiB,EACjB,KAAK,oBAAoB,EACzB,mBAAmB,EACnB,KAAK,sBAAsB,EAC3B,0BAA0B,EAC1B,KAAK,6BAA6B,EAClC,kBAAkB,EAClB,KAAK,qBAAqB,EAC1B,mBAAmB,EACnB,KAAK,sBAAsB,EAC3B,gBAAgB,EAChB,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,KAAK,oBAAoB,EACzB,0BAA0B,EAC1B,KAAK,6BAA6B,EAClC,qBAAqB,EACrB,KAAK,sBAAsB,EAC3B,qBAAqB,EACrB,KAAK,8BAA8B,EACnC,mBAAmB,EACnB,KAAK,sBAAsB,EAC3B,eAAe,EACf,KAAK,kBAAkB,EACvB,iBAAiB,EACjB,KAAK,oBAAoB,EACzB,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EAEvB,sBAAsB,EACtB,KAAK,eAAe,EACpB,iBAAiB,EACjB,aAAa,EACb,oBAAoB,EACpB,UAAU,EACV,cAAc,EACd,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,WAAW,EAEhB,kBAAkB,EAClB,iBAAiB,EACjB,KAAK,qBAAqB,EAE1B,yBAAyB,EACzB,wBAAwB,EAExB,2BAA2B,EAC3B,YAAY,EACZ,yBAAyB,EACzB,oBAAoB,EACpB,KAAK,qBAAqB,EAC1B,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,SAAS,EACd,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,YAAY,GAClB,MAAM,kBAAkB,CAAC;AAK1B,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAC5F,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,EAAE,6BAA6B,EAAE,MAAM,+CAA+C,CAAC;AAC9F,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAC5F,OAAO,EAAE,yBAAyB,EAAE,MAAM,2CAA2C,CAAC;AAGtF,OAAO,EACL,qBAAqB,IAAI,eAAe,EACxC,mBAAmB,EACnB,uBAAuB,EACvB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,kBAAkB,EACvB,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,KAAK,UAAU,GAChB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACL,eAAe,EACf,aAAa,EACb,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,GACxB,MAAM,2BAA2B,CAAC;AAOnC,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,6BAA6B,IAAI,gCAAgC,EACjE,gBAAgB,EAChB,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,SAAS,EACd,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,GAC7B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,UAAU,EACV,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,GACtB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,cAAc,EACd,WAAW,EACX,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,GAC1B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,iBAAiB,EACjB,iCAAiC,EACjC,KAAK,aAAa,EAClB,KAAK,WAAW,GACjB,MAAM,4BAA4B,CAAC;AAKpC,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,EACnB,eAAe,EACf,aAAa,EACb,sBAAsB,EACtB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,cAAc,GACpB,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -71,7 +71,7 @@ export { analyzeProject, analyzeProjectTwoPhase, buildTypeHierarchy, buildCrossF
 export { NaturalLanguageExtractor } from './extractors/natural-language.js';
 export { ExtractorRegistry, createDefaultExtractorRegistry } from './extractors/index.js';
 // Trust Score
-export { TIER_THRESHOLDS, TIER_COLORS, SEVERITY_WEIGHTS, getTierForScore, hardcodedSecretsPass, licenseCompliancePass, cargoLicenseCompliancePass, scanLicenseCompliance, COPYLEFT_SEVERITY, typosquatDetectionPass, promptInjectionPass, maliciousInstallScriptPass, dependencyStalenessPass, excessivePermissionsPass, dataExfiltrationPass, agentInventoryPass, sbomGenerationPass, auditTrailPass, vexGenerationPass, dependencyAuditPass, codeComplexityPass, inputValidationPass, euAiActFlagsPass, toolPoisoningPass, aiGeneratedFingerprintPass, cacheInvalidationPass, adaptCircleIRFindings, missingGuardDomPass, featureEnvyPass, specGapReportPass, computeTrustScore, validateScoringConfig, DEFAULT_SCORING_CONFIG, PASS_CATEGORY_MAP, PASS_COMPONENT_MAP, 
+export { TIER_THRESHOLDS, TIER_COLORS, SEVERITY_WEIGHTS, getTierForScore, hardcodedSecretsPass, licenseCompliancePass, cargoLicenseCompliancePass, scanLicenseCompliance, COPYLEFT_SEVERITY, typosquatDetectionPass, promptInjectionPass, maliciousInstallScriptPass, dependencyStalenessPass, excessivePermissionsPass, dataExfiltrationPass, agentInventoryPass, sbomGenerationPass, auditTrailPass, vexGenerationPass, dependencyAuditPass, conformanceAttestationPass, codeComplexityPass, inputValidationPass, euAiActFlagsPass, toolPoisoningPass, aiGeneratedFingerprintPass, cacheInvalidationPass, adaptCircleIRFindings, missingGuardDomPass, featureEnvyPass, specGapReportPass, computeTrustScore, validateScoringConfig, DEFAULT_SCORING_CONFIG, PASS_CATEGORY_MAP, PASS_COMPONENT_MAP, 
 // cognium-ai#234 (L2) — OSV multi-ecosystem dependency audit
 osvDependencyAuditPass, parseAllManifests, parseMavenPom, parsePipRequirements, parseGoMod, parseCargoLock, 
 // cognium-ai#234 (L3) — crypto-weakness pass

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,sCAAsC;AACtC,cAAc,WAAW,CAAC;AAE1B,6DAA6D;AAC7D,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAE5F,SAAS;AACT,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAE5D,6EAA6E;AAC7E,OAAO,EACL,sBAAsB,EACtB,SAAS,EACT,gBAAgB,GAEjB,MAAM,yBAAyB,CAAC;AAEjC,2DAA2D;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAErE,+BAA+B;AAC/B,OAAO,EACL,WAAW,EACX,cAAc;AAEd,mEAAmE;AACnE,kBAAkB,EAClB,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,GAGlB,MAAM,iBAAiB,CAAC;AAEzB,aAAa;AACb,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,UAAU,GAMX,MAAM,qBAAqB,CAAC;AAE7B,eAAe;AACf,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,eAAe,EACf,mBAAmB;AACnB,iDAAiD;AACjD,mBAAmB,GAKpB,MAAM,uBAAuB,CAAC;AAE/B,sCAAsC;AACtC,OAAO,EACL,cAAc,EACd,eAAe,EACf,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAElC,oCAAoC;AACpC,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,sBAAsB,EACtB,6BAA6B,EAC7B,2BAA2B,EAC3B,kCAAkC,GAKnC,MAAM,wBAAwB,CAAC;AAEhC,+EAA+E;AAC/E,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,YAAY,EACZ,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAE/B,iBAAiB;AACjB,OAAO,EACL,iBAAiB,EACjB,uBAAuB,GAKxB,MAAM,0BAA0B,CAAC;AAElC,WAAW;AACX,OAAO,EACL,WAAW,EACX,iBAAiB,GAGlB,MAAM,6BAA6B,CAAC;AAErC,gBAAgB;AAChB,OAAO,EACL,eAAe,EACf,cAAc,EACd,aAAa,EACb,SAAS,EACT,gBAAgB,EAChB,iBAAiB,GASlB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,sBAAsB,EACtB,2BAA2B,GAG5B,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,YAAY,EACZ,eAAe,EACf,SAAS,GAKV,MAAM,kCAAkC,CAAC;AAE1C,sBAAsB;AACtB,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,kBAAkB,EAClB,oBAAoB,GAQrB,MAAM,sBAAsB,CAAC;AAE9B,kBAAkB;AAClB,OAAO,EACL,aAAa,EACb,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,GAOrB,MAAM,wBAAwB,CAAC;AAEhC,eAAe;AACf,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,sBAAsB,EACtB,6BAA6B,EAC7B,qBAAqB,EACrB,yBAAyB,EACzB,aAAa,EACb,aAAa,GASd,MAAM,yBAAyB,CAAC;AAEjC,iCAAiC;AACjC,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,0BAA0B,GAI3B,MAAM,oBAAoB,CAAC;AAE5B,qEAAqE;AACrE,uEAAuE;AACvE,yEAAyE;AACzE,OAAO,EACL,eAAe,GAEhB,MAAM,4BAA4B,CAAC;AAEpC,eAAe;AACf,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,wBAAwB,EACxB,aAAa,EACb,WAAW,EACX,aAAa,GAcd,MAAM,yBAAyB,CAAC;AAEjC,6BAA6B;AAC7B,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,kBAAkB,GAGnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,GAEzB,MAAM,iCAAiC,CAAC;AAEzC,uBAAuB;AACvB,OAAO,EACL,iBAAiB,EACjB,6BAA6B,EAC7B,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,eAAe,EACf,UAAU,EACV,mBAAmB,GAQpB,MAAM,sBAAsB,CAAC;AAkB9B,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAC7G,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAEpF,yBAAyB;AACzB,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,GASf,MAAM,oBAAoB,CAAC;AAE5B,8CAA8C;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAA0B,iBAAiB,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AAElH,cAAc;AACd,OAAO,EAQL,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,eAAe,EACf,oBAAoB,EAEpB,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,EACrB,iBAAiB,EAOjB,sBAAsB,EAEtB,mBAAmB,EAEnB,0BAA0B,EAE1B,uBAAuB,EAEvB,wBAAwB,EAExB,oBAAoB,EAEpB,kBAAkB,EAElB,kBAAkB,EAElB,cAAc,EAEd,iBAAiB,EAEjB,mBAAmB,EAEnB,kBAAkB,EAElB,mBAAmB,EAEnB,gBAAgB,EAEhB,iBAAiB,EAEjB,0BAA0B,EAE1B,qBAAqB,EAErB,qBAAqB,EAErB,mBAAmB,EAEnB,eAAe,EAEf,iBAAiB,EAEjB,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB;AAMlB,6DAA6D;AAC7D,sBAAsB,EAEtB,iBAAiB,EACjB,aAAa,EACb,oBAAoB,EACpB,UAAU,EACV,cAAc;AAId,6CAA6C;AAC7C,kBAAkB,EAClB,iBAAiB;AAEjB,4CAA4C;AAC5C,yBAAyB,EACzB,wBAAwB;AACxB,oDAAoD;AACpD,2BAA2B,EAC3B,YAAY,EACZ,yBAAyB,EACzB,oBAAoB,EAEpB,mBAAmB,EACnB,sBAAsB,EAGtB,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,GAEvB,MAAM,kBAAkB,CAAC;AAE1B,wEAAwE;AACxE,4EAA4E;AAC5E,gCAAgC;AAChC,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAC5F,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,EAAE,6BAA6B,EAAE,MAAM,+CAA+C,CAAC;AAC9F,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAC5F,OAAO,EAAE,yBAAyB,EAAE,MAAM,2CAA2C,CAAC;AAEtF,gBAAgB;AAChB,OAAO,EACL,qBAAqB,IAAI,eAAe,EACxC,mBAAmB,EACnB,uBAAuB,EAOvB,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAE5B,iBAAiB;AACjB,OAAO,EACL,cAAc,EACd,sBAAsB,GAEvB,MAAM,yBAAyB,CAAC;AAEjC,mBAAmB;AACnB,OAAO,EACL,eAAe,EACf,aAAa,GAKd,MAAM,2BAA2B,CAAC;AAEnC,yBAAyB;AACzB,EAAE;AACF,2EAA2E;AAC3E,4EAA4E;AAC5E,sCAAsC;AACtC,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,6BAA6B,IAAI,gCAAgC,EACjE,gBAAgB,GAEjB,MAAM,6BAA6B,CAAC;AAErC,yCAAyC;AACzC,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,iBAAiB,GAUlB,MAAM,uBAAuB,CAAC;AAE/B,sCAAsC;AACtC,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,UAAU,GAQX,MAAM,uBAAuB,CAAC;AAE/B,oBAAoB;AACpB,OAAO,EACL,cAAc,EACd,WAAW,GAMZ,MAAM,qBAAqB,CAAC;AAE7B,8CAA8C;AAC9C,OAAO,EACL,iBAAiB,EACjB,iCAAiC,GAGlC,MAAM,4BAA4B,CAAC;AAEpC,qEAAqE;AACrE,uEAAuE;AACvE,8BAA8B;AAC9B,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,EACnB,eAAe,EACf,aAAa,EACb,sBAAsB,GAOvB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,sCAAsC;AACtC,cAAc,WAAW,CAAC;AAE1B,6DAA6D;AAC7D,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAE5F,SAAS;AACT,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAE5D,6EAA6E;AAC7E,OAAO,EACL,sBAAsB,EACtB,SAAS,EACT,gBAAgB,GAEjB,MAAM,yBAAyB,CAAC;AAEjC,2DAA2D;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAErE,+BAA+B;AAC/B,OAAO,EACL,WAAW,EACX,cAAc;AAEd,mEAAmE;AACnE,kBAAkB,EAClB,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,GAGlB,MAAM,iBAAiB,CAAC;AAEzB,aAAa;AACb,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,UAAU,GAMX,MAAM,qBAAqB,CAAC;AAE7B,eAAe;AACf,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,eAAe,EACf,mBAAmB;AACnB,iDAAiD;AACjD,mBAAmB,GAKpB,MAAM,uBAAuB,CAAC;AAE/B,sCAAsC;AACtC,OAAO,EACL,cAAc,EACd,eAAe,EACf,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAElC,oCAAoC;AACpC,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,sBAAsB,EACtB,6BAA6B,EAC7B,2BAA2B,EAC3B,kCAAkC,GAKnC,MAAM,wBAAwB,CAAC;AAEhC,+EAA+E;AAC/E,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,YAAY,EACZ,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAE/B,iBAAiB;AACjB,OAAO,EACL,iBAAiB,EACjB,uBAAuB,GAKxB,MAAM,0BAA0B,CAAC;AAElC,WAAW;AACX,OAAO,EACL,WAAW,EACX,iBAAiB,GAGlB,MAAM,6BAA6B,CAAC;AAErC,gBAAgB;AAChB,OAAO,EACL,eAAe,EACf,cAAc,EACd,aAAa,EACb,SAAS,EACT,gBAAgB,EAChB,iBAAiB,GASlB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,sBAAsB,EACtB,2BAA2B,GAG5B,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,YAAY,EACZ,eAAe,EACf,SAAS,GAKV,MAAM,kCAAkC,CAAC;AAE1C,sBAAsB;AACtB,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,kBAAkB,EAClB,oBAAoB,GAQrB,MAAM,sBAAsB,CAAC;AAE9B,kBAAkB;AAClB,OAAO,EACL,aAAa,EACb,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,eAAe,EACf,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,GAOrB,MAAM,wBAAwB,CAAC;AAEhC,eAAe;AACf,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,sBAAsB,EACtB,6BAA6B,EAC7B,qBAAqB,EACrB,yBAAyB,EACzB,aAAa,EACb,aAAa,GASd,MAAM,yBAAyB,CAAC;AAEjC,iCAAiC;AACjC,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,uBAAuB,EACvB,0BAA0B,GAI3B,MAAM,oBAAoB,CAAC;AAE5B,qEAAqE;AACrE,uEAAuE;AACvE,yEAAyE;AACzE,OAAO,EACL,eAAe,GAEhB,MAAM,4BAA4B,CAAC;AAEpC,eAAe;AACf,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,wBAAwB,EACxB,aAAa,EACb,WAAW,EACX,aAAa,GAcd,MAAM,yBAAyB,CAAC;AAEjC,6BAA6B;AAC7B,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,kBAAkB,GAGnB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,wBAAwB,GAEzB,MAAM,iCAAiC,CAAC;AAEzC,uBAAuB;AACvB,OAAO,EACL,iBAAiB,EACjB,6BAA6B,EAC7B,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,eAAe,EACf,UAAU,EACV,mBAAmB,GAQpB,MAAM,sBAAsB,CAAC;AAkB9B,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AAC7G,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAEpF,yBAAyB;AACzB,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,GASf,MAAM,oBAAoB,CAAC;AAE5B,8CAA8C;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAA0B,iBAAiB,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AAElH,cAAc;AACd,OAAO,EAQL,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,eAAe,EACf,oBAAoB,EAEpB,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,EACrB,iBAAiB,EAOjB,sBAAsB,EAEtB,mBAAmB,EAEnB,0BAA0B,EAE1B,uBAAuB,EAEvB,wBAAwB,EAExB,oBAAoB,EAEpB,kBAAkB,EAElB,kBAAkB,EAElB,cAAc,EAEd,iBAAiB,EAEjB,mBAAmB,EAEnB,0BAA0B,EAE1B,kBAAkB,EAElB,mBAAmB,EAEnB,gBAAgB,EAEhB,iBAAiB,EAEjB,0BAA0B,EAE1B,qBAAqB,EAErB,qBAAqB,EAErB,mBAAmB,EAEnB,eAAe,EAEf,iBAAiB,EAEjB,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB;AAMlB,6DAA6D;AAC7D,sBAAsB,EAEtB,iBAAiB,EACjB,aAAa,EACb,oBAAoB,EACpB,UAAU,EACV,cAAc;AAId,6CAA6C;AAC7C,kBAAkB,EAClB,iBAAiB;AAEjB,4CAA4C;AAC5C,yBAAyB,EACzB,wBAAwB;AACxB,oDAAoD;AACpD,2BAA2B,EAC3B,YAAY,EACZ,yBAAyB,EACzB,oBAAoB,EAEpB,mBAAmB,EACnB,sBAAsB,EAGtB,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,GAEvB,MAAM,kBAAkB,CAAC;AAE1B,wEAAwE;AACxE,4EAA4E;AAC5E,gCAAgC;AAChC,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAC5F,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AACxF,OAAO,EAAE,6BAA6B,EAAE,MAAM,+CAA+C,CAAC;AAC9F,OAAO,EAAE,4BAA4B,EAAE,MAAM,8CAA8C,CAAC;AAC5F,OAAO,EAAE,yBAAyB,EAAE,MAAM,2CAA2C,CAAC;AAEtF,gBAAgB;AAChB,OAAO,EACL,qBAAqB,IAAI,eAAe,EACxC,mBAAmB,EACnB,uBAAuB,EAOvB,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,6BAA6B,GAC9B,MAAM,oBAAoB,CAAC;AAE5B,iBAAiB;AACjB,OAAO,EACL,cAAc,EACd,sBAAsB,GAEvB,MAAM,yBAAyB,CAAC;AAEjC,mBAAmB;AACnB,OAAO,EACL,eAAe,EACf,aAAa,GAKd,MAAM,2BAA2B,CAAC;AAEnC,yBAAyB;AACzB,EAAE;AACF,2EAA2E;AAC3E,4EAA4E;AAC5E,sCAAsC;AACtC,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,EACpB,6BAA6B,IAAI,gCAAgC,EACjE,gBAAgB,GAEjB,MAAM,6BAA6B,CAAC;AAErC,yCAAyC;AACzC,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,iBAAiB,GAUlB,MAAM,uBAAuB,CAAC;AAE/B,sCAAsC;AACtC,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,UAAU,GAQX,MAAM,uBAAuB,CAAC;AAE/B,oBAAoB;AACpB,OAAO,EACL,cAAc,EACd,WAAW,GAMZ,MAAM,qBAAqB,CAAC;AAE7B,8CAA8C;AAC9C,OAAO,EACL,iBAAiB,EACjB,iCAAiC,GAGlC,MAAM,4BAA4B,CAAC;AAEpC,qEAAqE;AACrE,uEAAuE;AACvE,8BAA8B;AAC9B,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,oBAAoB,EACpB,mBAAmB,EACnB,eAAe,EACf,aAAa,EACb,sBAAsB,GAOvB,MAAM,oBAAoB,CAAC"}

package/dist/trust/index.d.ts

@@ -18,6 +18,7 @@ export { auditTrailPass, type AuditTrailOptions, } from './passes/audit-trail.js
 export { vexGenerationPass, type VEXGenerationOptions, } from './passes/vex-generation.js';
 export { dependencyAuditPass, type DependencyAuditOptions, } from './passes/dependency-audit.js';
 export { osvDependencyAuditPass, type OsvAuditOptions, } from './passes/osv-dependency-audit.js';
+export { conformanceAttestationPass, type ConformanceAttestationOptions, } from './passes/conformance-attestation.js';
 export { parseAllManifests, parseMavenPom, parsePipRequirements, parseGoMod, parseCargoLock, type EcosystemDep, type Ecosystem, type ParseResult, } from './passes/dep-manifests.js';
 export { codeComplexityPass, type CodeComplexityOptions, } from './passes/code-complexity.js';
 export { inputValidationPass, type InputValidationOptions, } from './passes/input-validation.js';

package/dist/trust/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/trust/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,eAAe,GAChB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,oBAAoB,EACpB,KAAK,uBAAuB,GAC7B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,EACrB,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,EAClC,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,GACtB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,sBAAsB,EACtB,KAAK,yBAAyB,GAC/B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,mBAAmB,EACnB,KAAK,sBAAsB,GAC5B,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,0BAA0B,EAC1B,KAAK,6BAA6B,GACnC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,uBAAuB,EACvB,KAAK,0BAA0B,GAChC,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,wBAAwB,EACxB,KAAK,2BAA2B,GACjC,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,oBAAoB,EACpB,KAAK,uBAAuB,GAC7B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,kBAAkB,EAClB,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,kBAAkB,EAClB,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,cAAc,EACd,KAAK,iBAAiB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,iBAAiB,EACjB,KAAK,oBAAoB,GAC1B,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EACL,mBAAmB,EACnB,KAAK,sBAAsB,GAC5B,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EACL,sBAAsB,EACtB,KAAK,eAAe,GACrB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,oBAAoB,EACpB,UAAU,EACV,cAAc,EACd,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,WAAW,GACjB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,kBAAkB,EAClB,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,mBAAmB,EACnB,KAAK,sBAAsB,GAC5B,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EACL,gBAAgB,EAChB,KAAK,mBAAmB,GACzB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,iBAAiB,EACjB,KAAK,oBAAoB,GAC1B,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,0BAA0B,EAC1B,KAAK,6BAA6B,GACnC,MAAM,sCAAsC,CAAC;AAG9C,OAAO,EACL,qBAAqB,EACrB,KAAK,sBAAsB,GAC5B,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EACL,qBAAqB,EACrB,KAAK,8BAA8B,GACpC,MAAM,sCAAsC,CAAC;AAG9C,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,2BAA2B,EAC3B,YAAY,EACZ,yBAAyB,EACzB,oBAAoB,EACpB,KAAK,qBAAqB,GAC3B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,mBAAmB,EACnB,KAAK,sBAAsB,GAC5B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,eAAe,EACf,KAAK,kBAAkB,GACxB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EACL,iBAAiB,EACjB,KAAK,oBAAoB,GAC1B,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,SAAS,GACf,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGhD,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,YAAY,GAClB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/trust/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,eAAe,GAChB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,oBAAoB,EACpB,KAAK,uBAAuB,GAC7B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,EACrB,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,EAClC,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,GACtB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,sBAAsB,EACtB,KAAK,yBAAyB,GAC/B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,mBAAmB,EACnB,KAAK,sBAAsB,GAC5B,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,0BAA0B,EAC1B,KAAK,6BAA6B,GACnC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,uBAAuB,EACvB,KAAK,0BAA0B,GAChC,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,wBAAwB,EACxB,KAAK,2BAA2B,GACjC,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,oBAAoB,EACpB,KAAK,uBAAuB,GAC7B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,kBAAkB,EAClB,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,kBAAkB,EAClB,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,cAAc,EACd,KAAK,iBAAiB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,iBAAiB,EACjB,KAAK,oBAAoB,GAC1B,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EACL,mBAAmB,EACnB,KAAK,sBAAsB,GAC5B,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EACL,sBAAsB,EACtB,KAAK,eAAe,GACrB,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EACL,0BAA0B,EAC1B,KAAK,6BAA6B,GACnC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,oBAAoB,EACpB,UAAU,EACV,cAAc,EACd,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,WAAW,GACjB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,kBAAkB,EAClB,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,mBAAmB,EACnB,KAAK,sBAAsB,GAC5B,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EACL,gBAAgB,EAChB,KAAK,mBAAmB,GACzB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,iBAAiB,EACjB,KAAK,oBAAoB,GAC1B,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,0BAA0B,EAC1B,KAAK,6BAA6B,GACnC,MAAM,sCAAsC,CAAC;AAG9C,OAAO,EACL,qBAAqB,EACrB,KAAK,sBAAsB,GAC5B,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EACL,qBAAqB,EACrB,KAAK,8BAA8B,GACpC,MAAM,sCAAsC,CAAC;AAG9C,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,2BAA2B,EAC3B,YAAY,EACZ,yBAAyB,EACzB,oBAAoB,EACpB,KAAK,qBAAqB,GAC3B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,mBAAmB,EACnB,KAAK,sBAAsB,GAC5B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,eAAe,EACf,KAAK,kBAAkB,GACxB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EACL,iBAAiB,EACjB,KAAK,oBAAoB,GAC1B,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,SAAS,GACf,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGhD,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,YAAY,GAClB,MAAM,YAAY,CAAC"}

package/dist/trust/index.js

@@ -22,6 +22,8 @@ export { vexGenerationPass, } from './passes/vex-generation.js';
 export { dependencyAuditPass, } from './passes/dependency-audit.js';
 // cognium-ai#234 (L2) — ecosystem-agnostic OSV dependency CVE audit
 export { osvDependencyAuditPass, } from './passes/osv-dependency-audit.js';
+// Q5 — conformance-attestation pass (oracle verdict → supply_chain signal)
+export { conformanceAttestationPass, } from './passes/conformance-attestation.js';
 export { parseAllManifests, parseMavenPom, parsePipRequirements, parseGoMod, parseCargoLock, } from './passes/dep-manifests.js';
 export { codeComplexityPass, } from './passes/code-complexity.js';
 export { inputValidationPass, } from './passes/input-validation.js';

package/dist/trust/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/trust/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,QAAQ;AACR,OAAO,EAUL,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,eAAe,GAChB,MAAM,YAAY,CAAC;AAEpB,SAAS;AACT,OAAO,EACL,oBAAoB,GAErB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,EACrB,iBAAiB,GAOlB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,sBAAsB,GAEvB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,0BAA0B,GAE3B,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,uBAAuB,GAExB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,wBAAwB,GAEzB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,oBAAoB,GAErB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,kBAAkB,GAEnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,kBAAkB,GAEnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,cAAc,GAEf,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,iBAAiB,GAElB,MAAM,4BAA4B,CAAC;AAEpC,kBAAkB;AAClB,OAAO,EACL,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AAEtC,oEAAoE;AACpE,OAAO,EACL,sBAAsB,GAEvB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,oBAAoB,EACpB,UAAU,EACV,cAAc,GAIf,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,kBAAkB,GAEnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AAEtC,kBAAkB;AAClB,OAAO,EACL,gBAAgB,GAEjB,MAAM,6BAA6B,CAAC;AAErC,4BAA4B;AAC5B,OAAO,EACL,iBAAiB,GAElB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,0BAA0B,GAE3B,MAAM,sCAAsC,CAAC;AAE9C,sEAAsE;AACtE,OAAO,EACL,qBAAqB,GAEtB,MAAM,gCAAgC,CAAC;AAExC,uCAAuC;AACvC,OAAO,EACL,qBAAqB,GAEtB,MAAM,sCAAsC,CAAC;AAE9C,yEAAyE;AACzE,OAAO,EACL,kBAAkB,EAClB,iBAAiB,GAElB,MAAM,6BAA6B,CAAC;AAErC,wEAAwE;AACxE,OAAO,EACL,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAE3B,qEAAqE;AACrE,OAAO,EACL,2BAA2B,EAC3B,YAAY,EACZ,yBAAyB,EACzB,oBAAoB,GAErB,MAAM,qBAAqB,CAAC;AAE7B,0DAA0D;AAC1D,OAAO,EACL,mBAAmB,GAEpB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,eAAe,GAEhB,MAAM,0BAA0B,CAAC;AAElC,8BAA8B;AAC9B,OAAO,EACL,iBAAiB,GAElB,MAAM,6BAA6B,CAAC;AAErC,sBAAsB;AACtB,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,GAInB,MAAM,cAAc,CAAC;AAEtB,UAAU;AACV,OAAO,EACL,mBAAmB,EACnB,sBAAsB,GAGvB,MAAM,cAAc,CAAC;AAEtB,QAAQ;AACR,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD,QAAQ;AACR,OAAO,EACL,kBAAkB,EAClB,sBAAsB,GAEvB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/trust/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,QAAQ;AACR,OAAO,EAUL,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,eAAe,GAChB,MAAM,YAAY,CAAC;AAEpB,SAAS;AACT,OAAO,EACL,oBAAoB,GAErB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,EACrB,iBAAiB,GAOlB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,sBAAsB,GAEvB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,0BAA0B,GAE3B,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,uBAAuB,GAExB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,wBAAwB,GAEzB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,oBAAoB,GAErB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,kBAAkB,GAEnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,kBAAkB,GAEnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,cAAc,GAEf,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,iBAAiB,GAElB,MAAM,4BAA4B,CAAC;AAEpC,kBAAkB;AAClB,OAAO,EACL,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AAEtC,oEAAoE;AACpE,OAAO,EACL,sBAAsB,GAEvB,MAAM,kCAAkC,CAAC;AAE1C,2EAA2E;AAC3E,OAAO,EACL,0BAA0B,GAE3B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,oBAAoB,EACpB,UAAU,EACV,cAAc,GAIf,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,kBAAkB,GAEnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AAEtC,kBAAkB;AAClB,OAAO,EACL,gBAAgB,GAEjB,MAAM,6BAA6B,CAAC;AAErC,4BAA4B;AAC5B,OAAO,EACL,iBAAiB,GAElB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,0BAA0B,GAE3B,MAAM,sCAAsC,CAAC;AAE9C,sEAAsE;AACtE,OAAO,EACL,qBAAqB,GAEtB,MAAM,gCAAgC,CAAC;AAExC,uCAAuC;AACvC,OAAO,EACL,qBAAqB,GAEtB,MAAM,sCAAsC,CAAC;AAE9C,yEAAyE;AACzE,OAAO,EACL,kBAAkB,EAClB,iBAAiB,GAElB,MAAM,6BAA6B,CAAC;AAErC,wEAAwE;AACxE,OAAO,EACL,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAE3B,qEAAqE;AACrE,OAAO,EACL,2BAA2B,EAC3B,YAAY,EACZ,yBAAyB,EACzB,oBAAoB,GAErB,MAAM,qBAAqB,CAAC;AAE7B,0DAA0D;AAC1D,OAAO,EACL,mBAAmB,GAEpB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,eAAe,GAEhB,MAAM,0BAA0B,CAAC;AAElC,8BAA8B;AAC9B,OAAO,EACL,iBAAiB,GAElB,MAAM,6BAA6B,CAAC;AAErC,sBAAsB;AACtB,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,GAInB,MAAM,cAAc,CAAC;AAEtB,UAAU;AACV,OAAO,EACL,mBAAmB,EACnB,sBAAsB,GAGvB,MAAM,cAAc,CAAC;AAEtB,QAAQ;AACR,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD,QAAQ;AACR,OAAO,EACL,kBAAkB,EAClB,sBAAsB,GAEvB,MAAM,YAAY,CAAC"}

package/dist/trust/passes/conformance-attestation.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Conformance-attestation trust pass (Q5 — verdict → trust pipe).
+ *
+ * Consumes in-toto conformance attestations (predicateType
+ * `https://cognium.net/attestations/conformance/v0.1`, produced by
+ * `@cogniumhq/conformance`'s exporter) and folds dependency-level spec-conformance
+ * VIOLATIONS into the supply_chain trust signal. The attestation is the witness —
+ * this is the "evidence chain" made concrete: a pinned dependency graded against
+ * spec-derived oracles, its verdict carried as a standard in-toto Statement.
+ *
+ * Data-only coupling: this pass reads the public in-toto format, NOT the private
+ * conformance package/store — circle-ir-ai takes no dependency on it.
+ *
+ * Opt-in: the attestation source comes from `options.attestationsPath` or the
+ * `CONFORMANCE_ATTESTATIONS` env var. Unset ⇒ the pass no-ops before doing any
+ * work (`applicable: false`), byte-identical to pre-Q5 behavior. `applicable` is
+ * also false when attestations exist but none match this repo's dependencies —
+ * a 100 there would mean "didn't look", not "clean" (cognium-ai#234 semantics).
+ */
+import { type TrustPassResult } from '../types.js';
+import { type EcosystemDep } from './dep-manifests.js';
+declare const PREDICATE_TYPE = "https://cognium.net/attestations/conformance/v0.1";
+export interface ConformanceAttestationOptions {
+    /** Path to an in-toto bundle (`.jsonl`), a single `.json` Statement, or a dir
+     *  of `*.intoto.json`. Falls back to the `CONFORMANCE_ATTESTATIONS` env var. */
+    attestationsPath?: string;
+    /** Pre-parsed repo dependencies to match against (else parsed from projectPath). */
+    deps?: EcosystemDep[];
+}
+/** Split a subject "name@version" — version is after the LAST '@' (scopes keep theirs). */
+declare function splitSubject(subject: string): {
+    name: string;
+    version: string;
+} | null;
+export declare function conformanceAttestationPass(projectPath: string, options?: ConformanceAttestationOptions): Promise<TrustPassResult>;
+export { PREDICATE_TYPE, splitSubject };
+//# sourceMappingURL=conformance-attestation.d.ts.map

package/dist/trust/passes/conformance-attestation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conformance-attestation.d.ts","sourceRoot":"","sources":["../../../src/trust/passes/conformance-attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,EACL,KAAK,eAAe,EAGrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAqB,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAG1E,QAAA,MAAM,cAAc,sDAAsD,CAAC;AAE3E,MAAM,WAAW,6BAA6B;IAC5C;oFACgF;IAChF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oFAAoF;IACpF,IAAI,CAAC,EAAE,YAAY,EAAE,CAAC;CACvB;AA4CD,2FAA2F;AAC3F,iBAAS,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAI/E;AAsED,wBAAsB,0BAA0B,CAC9C,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,6BAAkC,GAC1C,OAAO,CAAC,eAAe,CAAC,CA2D1B;AAGD,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC"}

package/dist/trust/passes/conformance-attestation.js

@@ -0,0 +1,200 @@
+/**
+ * Conformance-attestation trust pass (Q5 — verdict → trust pipe).
+ *
+ * Consumes in-toto conformance attestations (predicateType
+ * `https://cognium.net/attestations/conformance/v0.1`, produced by
+ * `@cogniumhq/conformance`'s exporter) and folds dependency-level spec-conformance
+ * VIOLATIONS into the supply_chain trust signal. The attestation is the witness —
+ * this is the "evidence chain" made concrete: a pinned dependency graded against
+ * spec-derived oracles, its verdict carried as a standard in-toto Statement.
+ *
+ * Data-only coupling: this pass reads the public in-toto format, NOT the private
+ * conformance package/store — circle-ir-ai takes no dependency on it.
+ *
+ * Opt-in: the attestation source comes from `options.attestationsPath` or the
+ * `CONFORMANCE_ATTESTATIONS` env var. Unset ⇒ the pass no-ops before doing any
+ * work (`applicable: false`), byte-identical to pre-Q5 behavior. `applicable` is
+ * also false when attestations exist but none match this repo's dependencies —
+ * a 100 there would mean "didn't look", not "clean" (cognium-ai#234 semantics).
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { SEVERITY_WEIGHTS, } from '../types.js';
+import { parseAllManifests } from './dep-manifests.js';
+const PASS = 'conformance-attestation';
+const PREDICATE_TYPE = 'https://cognium.net/attestations/conformance/v0.1';
+/**
+ * Resolve npm dependencies at their EXACT installed versions from
+ * package-lock.json (v2/v3 `packages` map). Attestations bind to pinned
+ * artifacts, so ranges in package.json are not enough — the lockfile is the
+ * source of exact `name@version`. parseAllManifests covers the other ecosystems
+ * (Maven/PyPI/Go/Cargo); npm is intentionally not in it (npm-audit owns npm),
+ * so this pass resolves npm itself for subject matching.
+ */
+function resolveNpmDeps(projectPath) {
+    const lock = path.join(projectPath, 'package-lock.json');
+    let parsed;
+    try {
+        parsed = JSON.parse(fs.readFileSync(lock, 'utf-8'));
+    }
+    catch {
+        return [];
+    }
+    const packages = parsed?.packages;
+    if (!packages || typeof packages !== 'object')
+        return [];
+    const out = [];
+    for (const [key, entry] of Object.entries(packages)) {
+        if (!key)
+            continue; // "" is the root project
+        const marker = 'node_modules/';
+        const i = key.lastIndexOf(marker); // final segment handles nested node_modules
+        if (i < 0)
+            continue;
+        const name = key.slice(i + marker.length);
+        const version = entry?.version;
+        if (name && version)
+            out.push({ ecosystem: 'npm', name, version, file: 'package-lock.json' });
+    }
+    return out;
+}
+/** Split a subject "name@version" — version is after the LAST '@' (scopes keep theirs). */
+function splitSubject(subject) {
+    const at = subject.lastIndexOf('@');
+    if (at <= 0)
+        return null; // no version, or leading-@ scope with no version marker
+    return { name: subject.slice(0, at), version: subject.slice(at + 1) };
+}
+function isConformanceStatement(v) {
+    if (v === null || typeof v !== 'object')
+        return false;
+    const s = v;
+    return (s.predicateType === PREDICATE_TYPE &&
+        Array.isArray(s.subject) &&
+        typeof s.predicate === 'object' &&
+        s.predicate !== null);
+}
+/** Load conformance Statements from a bundle file, single JSON, or directory. */
+function loadStatements(source) {
+    const out = [];
+    const add = (raw) => {
+        try {
+            const v = JSON.parse(raw);
+            if (isConformanceStatement(v))
+                out.push(v);
+        }
+        catch {
+            /* skip malformed line/file — never throw from a trust pass */
+        }
+    };
+    let stat;
+    try {
+        stat = fs.statSync(source);
+    }
+    catch {
+        return out;
+    }
+    if (stat.isDirectory()) {
+        for (const f of fs.readdirSync(source)) {
+            if (f.endsWith('.intoto.json') || f.endsWith('.json')) {
+                try {
+                    add(fs.readFileSync(path.join(source, f), 'utf-8'));
+                }
+                catch {
+                    /* skip unreadable file */
+                }
+            }
+        }
+    }
+    else if (source.endsWith('.jsonl')) {
+        let content = '';
+        try {
+            content = fs.readFileSync(source, 'utf-8');
+        }
+        catch {
+            return out;
+        }
+        for (const line of content.split('\n')) {
+            if (line.trim())
+                add(line);
+        }
+    }
+    else {
+        try {
+            add(fs.readFileSync(source, 'utf-8'));
+        }
+        catch {
+            /* skip */
+        }
+    }
+    return out;
+}
+function skip(reason, message, start) {
+    return {
+        pass: PASS,
+        score: 100,
+        applicable: false,
+        findings: [{ pass: PASS, ruleId: `conformance-${reason}`, severity: 'info', message, meta: { reason } }],
+        durationMs: Date.now() - start,
+    };
+}
+export async function conformanceAttestationPass(projectPath, options = {}) {
+    const start = Date.now();
+    const source = options.attestationsPath ?? process.env.CONFORMANCE_ATTESTATIONS;
+    // Fast-path bail: unset ⇒ zero work, pre-Q5 behavior.
+    if (!source) {
+        return skip('no-attestations', 'No conformance attestations provided; pass skipped', start);
+    }
+    const statements = loadStatements(source);
+    if (statements.length === 0) {
+        return skip('empty-attestations', `No conformance attestations found at ${source}`, start);
+    }
+    const deps = options.deps ?? [...resolveNpmDeps(projectPath), ...parseAllManifests(projectPath).deps];
+    // Index repo deps by "name@version" for exact-artifact matching.
+    const depKeys = new Set(deps.map((d) => `${d.name}@${d.version}`));
+    const findings = [];
+    let matched = 0;
+    for (const st of statements) {
+        const subject = st.subject[0]?.name;
+        if (!subject)
+            continue;
+        const nv = splitSubject(subject);
+        if (!nv || !depKeys.has(subject))
+            continue; // attestation not about a dep this repo pins
+        matched++;
+        if (st.predicate.verdict !== 'VIOLATION')
+            continue; // PASS on a matched dep = clean signal
+        findings.push({
+            pass: PASS,
+            // A dependency deviating from its own spec is a supply-chain quality signal,
+            // not (necessarily) an exploitable CVE → medium baseline.
+            ruleId: `conformance-violation-${nv.name}`,
+            severity: 'medium',
+            message: `${subject}: fails spec conformance — ${st.predicate.requirement.clause} (${st.predicate.requirement.id})`,
+            meta: {
+                package: nv.name,
+                version: nv.version,
+                requirementId: st.predicate.requirement.id,
+                clause: st.predicate.requirement.clause,
+                specAuthority: st.predicate.spec.authority,
+                specUrl: st.predicate.spec.url,
+                contractRev: st.predicate.spec.contractRev,
+                evidenceTrust: st.predicate.trust?.tier,
+                attestation: PREDICATE_TYPE,
+            },
+        });
+    }
+    // Attestations exist but none concern this repo's deps ⇒ we did not actually
+    // assess anything here — inapplicable, so it can't inflate supply_chain to 100.
+    if (matched === 0) {
+        return skip('no-matched-deps', 'No conformance attestations matched this repo’s dependencies', start);
+    }
+    let deduction = 0;
+    for (const f of findings)
+        deduction += SEVERITY_WEIGHTS[f.severity];
+    const score = Math.max(0, Math.min(100, 100 - deduction));
+    return { pass: PASS, score, findings, durationMs: Date.now() - start };
+}
+// Exports for testing
+export { PREDICATE_TYPE, splitSubject };
+//# sourceMappingURL=conformance-attestation.js.map

package/dist/trust/passes/conformance-attestation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"conformance-attestation.js","sourceRoot":"","sources":["../../../src/trust/passes/conformance-attestation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAGL,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,iBAAiB,EAAqB,MAAM,oBAAoB,CAAC;AAE1E,MAAM,IAAI,GAAG,yBAAyB,CAAC;AACvC,MAAM,cAAc,GAAG,mDAAmD,CAAC;AAqB3E;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,WAAmB;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IACzD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,QAAQ,GAAI,MAA8D,EAAE,QAAQ,CAAC;IAC3F,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzD,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,GAAG;YAAE,SAAS,CAAC,yBAAyB;QAC7C,MAAM,MAAM,GAAG,eAAe,CAAC;QAC/B,MAAM,CAAC,GAAG,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,4CAA4C;QAC/E,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QACpB,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,KAAK,EAAE,OAAO,CAAC;QAC/B,IAAI,IAAI,IAAI,OAAO;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2FAA2F;AAC3F,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,wDAAwD;IAClF,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;AACxE,CAAC;AAED,SAAS,sBAAsB,CAAC,CAAU;IACxC,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,OAAO,CACL,CAAC,CAAC,aAAa,KAAK,cAAc;QAClC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QACxB,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,CAAC,CAAC,SAAS,KAAK,IAAI,CACrB,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAS,cAAc,CAAC,MAAc;IACpC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,CAAC,GAAW,EAAQ,EAAE;QAChC,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,sBAAsB,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,8DAA8D;QAChE,CAAC;IACH,CAAC,CAAC;IACF,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtD,IAAI,CAAC;oBACH,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;gBACtD,CAAC;gBAAC,MAAM,CAAC;oBACP,0BAA0B;gBAC5B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,IAAI,OAAO,GAAG,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,CAAC;QACb,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,IAAI,EAAE;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,UAAU;QACZ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,IAAI,CAAC,MAAc,EAAE,OAAe,EAAE,KAAa;IAC1D,OAAO;QACL,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,GAAG;QACV,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;QACxG,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,WAAmB,EACnB,UAAyC,EAAE;IAE3C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEzB,MAAM,MAAM,GAAG,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;IAChF,sDAAsD;IACtD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC,iBAAiB,EAAE,oDAAoD,EAAE,KAAK,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,oBAAoB,EAAE,wCAAwC,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC;IAC7F,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,GAAG,cAAc,CAAC,WAAW,CAAC,EAAE,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC;IACtG,iEAAiE;IACjE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAEnE,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,EAAE,IAAI,UAAU,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;QACpC,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS,CAAC,6CAA6C;QACzF,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,WAAW;YAAE,SAAS,CAAC,uCAAuC;QAC3F,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,IAAI;YACV,6EAA6E;YAC7E,0DAA0D;YAC1D,MAAM,EAAE,yBAAyB,EAAE,CAAC,IAAI,EAAE;YAC1C,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,GAAG,OAAO,8BAA8B,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,KAAK,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,GAAG;YACnH,IAAI,EAAE;gBACJ,OAAO,EAAE,EAAE,CAAC,IAAI;gBAChB,OAAO,EAAE,EAAE,CAAC,OAAO;gBACnB,aAAa,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE;gBAC1C,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM;gBACvC,aAAa,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS;gBAC1C,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG;gBAC9B,WAAW,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW;gBAC1C,aAAa,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI;gBACvC,WAAW,EAAE,cAAc;aAC5B;SACF,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,gFAAgF;IAChF,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC,iBAAiB,EAAE,8DAA8D,EAAE,KAAK,CAAC,CAAC;IACxG,CAAC;IAED,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,SAAS,IAAI,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC;IAE1D,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC;AACzE,CAAC;AAED,sBAAsB;AACtB,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC"}

package/dist/trust/scoring.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scoring.d.ts","sourceRoot":"","sources":["../../src/trust/scoring.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,gBAAgB,EAKtB,MAAM,YAAY,CAAC;AAGpB;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC;CAC9B;AAMD,MAAM,MAAM,aAAa,GACrB,cAAc,GACd,eAAe,GACf,WAAW,GACX,YAAY,GACZ,WAAW,CAAC;AAMhB,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,eAAO,MAAM,sBAAsB,EAAE,kBAQpC,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAE7D,CAAC;AAUF,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CA0E3D,CAAC;AAMF,iEAAiE;AACjE,KAAK,cAAc,GACf,qBAAqB,GACrB,oBAAoB,GACpB,oBAAoB,GACpB,mBAAmB,GACnB,kBAAkB,GAClB,eAAe,GACf,eAAe,GACf,eAAe,GACf,kBAAkB,GAClB,cAAc,GACd,iBAAiB,GACjB,kBAAkB,GAClB,mBAAmB,CAAC;AAExB,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAsC7D,CAAC;AAMF;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAUtE;AAMD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,eAAe,EAAE,EAC9B,MAAM,GAAE,kBAA2C,EACnD,OAAO,GAAE,mBAAwB,GAChC,gBAAgB,CAgMlB"}
+{"version":3,"file":"scoring.d.ts","sourceRoot":"","sources":["../../src/trust/scoring.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,gBAAgB,EAKtB,MAAM,YAAY,CAAC;AAGpB;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC;CAC9B;AAMD,MAAM,MAAM,aAAa,GACrB,cAAc,GACd,eAAe,GACf,WAAW,GACX,YAAY,GACZ,WAAW,CAAC;AAMhB,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,eAAO,MAAM,sBAAsB,EAAE,kBAQpC,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAE7D,CAAC;AAUF,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CA4E3D,CAAC;AAMF,iEAAiE;AACjE,KAAK,cAAc,GACf,qBAAqB,GACrB,oBAAoB,GACpB,oBAAoB,GACpB,mBAAmB,GACnB,kBAAkB,GAClB,eAAe,GACf,eAAe,GACf,eAAe,GACf,kBAAkB,GAClB,cAAc,GACd,iBAAiB,GACjB,kBAAkB,GAClB,mBAAmB,CAAC;AAExB,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAuC7D,CAAC;AAMF;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAUtE;AAMD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,eAAe,EAAE,EAC9B,MAAM,GAAE,kBAA2C,EACnD,OAAO,GAAE,mBAAwB,GAChC,gBAAgB,CAgMlB"}

package/dist/trust/scoring.js

@@ -44,6 +44,8 @@ export const PASS_CATEGORY_MAP = {
     // cognium-ai#234 (L2) — ecosystem-agnostic CVE audit (Maven/PyPI/Go/Cargo)
     // via OSV.dev; makes supply_chain a real signal on non-npm repos.
     'osv-dependency-audit': 'supply_chain',
+    // Q5 — a pinned dependency failing spec conformance (in-toto attestation).
+    'conformance-attestation': 'supply_chain',
     // code_security
     'data-exfiltration': 'code_security',
     'input-validation': 'code_security',
@@ -107,6 +109,7 @@ export const PASS_COMPONENT_MAP = {
     'dependency-staleness': 'supply_chain_score',
     'dependency-audit': 'supply_chain_score',
     'osv-dependency-audit': 'supply_chain_score',
+    'conformance-attestation': 'supply_chain_score',
     'data-exfiltration': 'exfiltration_score',
     'prompt-injection': 'instruction_score',
     'excessive-permissions': 'permission_score',

package/dist/trust/scoring.js.map

@@ -1 +1 @@
-{"version":3,"file":"scoring.js","sourceRoot":"","sources":["../../src/trust/scoring.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAML,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AA+B9D,MAAM,CAAC,MAAM,sBAAsB,GAAuB;IACxD,OAAO,EAAE;QACP,YAAY,EAAE,GAAG;QACjB,aAAa,EAAE,GAAG;QAClB,SAAS,EAAE,GAAG;QACd,UAAU,EAAE,GAAG;QACf,SAAS,EAAE,GAAG;KACf;CACF,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAA2B;IAChE,mBAAmB,EAAE,EAAE;CACxB,CAAC;AAEF,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,8EAA8E;AAC9E,2CAA2C;AAC3C,8EAA8E;AAE9E,MAAM,CAAC,MAAM,iBAAiB,GAAkC;IAC9D,eAAe;IACf,mBAAmB,EAAE,cAAc;IACnC,qBAAqB,EAAE,cAAc;IACrC,sBAAsB,EAAE,cAAc;IACtC,kBAAkB,EAAE,cAAc;IAClC,2EAA2E;IAC3E,kEAAkE;IAClE,sBAAsB,EAAE,cAAc;IAEtC,gBAAgB;IAChB,mBAAmB,EAAE,eAAe;IACpC,kBAAkB,EAAE,eAAe;IACnC,iBAAiB,EAAE,eAAe;IAClC,gEAAgE;IAChE,kEAAkE;IAClE,wEAAwE;IACxE,sEAAsE;IACtE,uEAAuE;IACvE,mBAAmB,EAAE,eAAe;IACpC,4EAA4E;IAC5E,oDAAoD;IACpD,iBAAiB,EAAE,eAAe;IAElC,0EAA0E;IAC1E,uEAAuE;IACvE,mDAAmD;IACnD,kBAAkB,EAAE,WAAW;IAC/B,uBAAuB,EAAE,WAAW;IACpC,iBAAiB,EAAE,WAAW;IAC9B,iBAAiB,EAAE,WAAW;IAC9B,gBAAgB,EAAE,WAAW;IAC7B,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,2EAA2E;IAC3E,2EAA2E;IAC3E,6EAA6E;IAC7E,8EAA8E;IAC9E,0CAA0C;IAE1C,aAAa;IACb,oBAAoB,EAAE,YAAY;IAClC,mBAAmB,EAAE,YAAY;IAEjC,yCAAyC;IACzC,oBAAoB,EAAE,eAAe;IACrC,sBAAsB,EAAE,eAAe;IACvC,oBAAoB,EAAE,eAAe;IACrC,6BAA6B,EAAE,eAAe;IAC9C,eAAe,EAAE,eAAe;IAEhC,qCAAqC;IACrC,sBAAsB,EAAE,eAAe;IACvC,sBAAsB,EAAE,eAAe;IACvC,gBAAgB,EAAE,eAAe;IACjC,oBAAoB,EAAE,eAAe;IAErC,kEAAkE;IAClE,mBAAmB,EAAE,eAAe;IACpC,cAAc,EAAE,eAAe;IAE/B,gEAAgE;IAChE,WAAW,EAAE,eAAe;IAC5B,mBAAmB,EAAE,eAAe;IAEpC,qDAAqD;IACrD,iBAAiB,EAAE,eAAe;IAElC,sCAAsC;IACtC,iBAAiB,EAAE,WAAW;IAC9B,gBAAgB,EAAE,WAAW;IAC7B,aAAa,EAAE,WAAW;IAC1B,0BAA0B,EAAE,WAAW,EAAE,qCAAqC;CAC/E,CAAC;AAsBF,MAAM,CAAC,MAAM,kBAAkB,GAAmC;IAChE,kBAAkB,EAAE,qBAAqB;IACzC,qBAAqB,EAAE,oBAAoB;IAC3C,sBAAsB,EAAE,oBAAoB;IAC5C,kBAAkB,EAAE,oBAAoB;IACxC,sBAAsB,EAAE,oBAAoB;IAC5C,mBAAmB,EAAE,oBAAoB;IACzC,kBAAkB,EAAE,mBAAmB;IACvC,uBAAuB,EAAE,kBAAkB;IAC3C,iBAAiB,EAAE,kBAAkB;IACrC,mBAAmB,EAAE,eAAe;IACpC,iBAAiB,EAAE,eAAe;IAClC,oBAAoB,EAAE,eAAe;IACrC,mBAAmB,EAAE,kBAAkB;IACvC,iBAAiB,EAAE,kBAAkB;IACrC,gBAAgB,EAAE,iBAAiB;IACnC,0BAA0B,EAAE,kBAAkB;IAC9C,oBAAoB,EAAE,eAAe;IACrC,sBAAsB,EAAE,eAAe;IACvC,oBAAoB,EAAE,eAAe;IACrC,6BAA6B,EAAE,eAAe;IAC9C,eAAe,EAAE,eAAe;IAChC,sBAAsB,EAAE,mBAAmB;IAC3C,sBAAsB,EAAE,mBAAmB;IAC3C,gBAAgB,EAAE,mBAAmB;IACrC,oBAAoB,EAAE,mBAAmB;IACzC,mBAAmB,EAAE,qBAAqB;IAC1C,0EAA0E;IAC1E,gEAAgE;IAChE,4DAA4D;IAC5D,mBAAmB,EAAE,qBAAqB;IAC1C,cAAc,EAAE,eAAe;IAC/B,WAAW,EAAE,eAAe;IAC5B,mBAAmB,EAAE,eAAe;IACpC,iBAAiB,EAAE,eAAe;IAClC,4EAA4E;IAC5E,kDAAkD;IAClD,iBAAiB,EAAE,cAAc;CAClC,CAAC;AAEF,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAA0B;IAC9D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;SAC7C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;SACtB,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAElC,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,kDAAkD,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAC3E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,WAA8B,EAC9B,SAA6B,sBAAsB,EACnD,UAA+B,EAAE;IAEjC,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAE9B,6EAA6E;IAE7E,mEAAmE;IACnE,0CAA0C;IAC1C,yEAAyE;IACzE,sEAAsE;IACtE,yEAAyE;IACzE,wCAAwC;IACxC,MAAM,cAAc,GAAG,IAAI,GAAG,EAA6D,CAAC;IAC5F,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAA2B,CAAC;IAElE,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,oEAAoE;YACpE,SAAS;QACX,CAAC;QACD,IAAI,EAAE,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClD,IAAI,IAAI;gBAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;;gBACxB,sBAAsB,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;YACrD,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC;YACnC,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC1D,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,IAAI,cAAc,EAAE,CAAC;QAC/D,IAAI,SAAS,GAAG,CAAC;YAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,SAAS,CAAC,CAAC;IACxE,CAAC;IAED,4EAA4E;IAC5E,EAAE;IACF,uEAAuE;IACvE,mEAAmE;IACnE,4EAA4E;IAC5E,sEAAsE;IACtE,2EAA2E;IAC3E,0EAA0E;IAC1E,0CAA0C;IAE1C,MAAM,gBAAgB,GAAoB;QACxC,cAAc;QACd,eAAe;QACf,WAAW;QACX,YAAY;KACb,CAAC,CAAC,iEAAiE;IAEpE,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,MAAM,KAAK,CAAC;YAAE,SAAS;QAC3B,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,GAAG,KAAK,SAAS;YAAE,SAAS,CAAC,yCAAyC;QAC1E,WAAW,IAAI,GAAG,GAAG,MAAM,CAAC;QAC5B,eAAe,IAAI,MAAM,CAAC;IAC5B,CAAC;IAED,2EAA2E;IAC3E,uEAAuE;IACvE,IAAI,cAAc,GAChB,eAAe,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC;IAC5D,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAEpF,6EAA6E;IAC7E,8EAA8E;IAC9E,4EAA4E;IAC5E,2EAA2E;IAC3E,mEAAmE;IACnE,oCAAoC;IACpC,MAAM,YAAY,GAAG,yBAAyB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACxE,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EACvC,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,YAAY,CAAC,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAEjE,qCAAqC;IACrC,MAAM,gBAAgB,GAAuB,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACxE,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO;YACL,QAAQ,EAAE,GAAG;YACb,SAAS,EAAE,GAAG,KAAK,SAAS;YAC5B,KAAK,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI;YAC7D,kBAAkB,EAAE,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE;YACzD,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SAC5B,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAEjE,4EAA4E;IAE5E,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA4B,CAAC;IAE7D,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,wEAAwE;QACxE,qEAAqE;QACrE,sEAAsE;QACtE,IAAI,EAAE,CAAC,UAAU,KAAK,KAAK;YAAE,SAAS;QACtC,MAAM,SAAS,GAAG,kBAAkB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,SAAS,KAAK,SAAS;YAAE,SAAS;QACtC,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,CAAC,GAAmB,EAAU,EAAE;QACnD,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC,CAAC,8BAA8B;QAC9E,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3D,CAAC,CAAC;IAEF,4EAA4E;IAE5E,yEAAyE;IACzE,8DAA8D;IAC9D,MAAM,gBAAgB,GAAsB,EAAE,CAAC;IAC/C,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;gBAC9B,gBAAgB,CAAC,IAAI,CAAC;oBACpB,IAAI,EAAE,EAAE,CAAC,IAAI;oBACb,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI;oBACtB,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI;oBACtB,OAAO,EAAE,CAAC,CAAC,OAAO;iBACnB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC;IAEhD,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,eAAe,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACxD,uEAAuE;IACvE,MAAM,IAAI,GAAG,eAAe,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAe,WAAW;QACxC,CAAC,CAAC,2BAA2B;QAC7B,CAAC,CAAC,OAAO,CAAC;IAEZ,4EAA4E;IAE5E,OAAO;QACL,KAAK,EAAE,cAAc;QACrB,IAAI;QAEJ,qCAAqC;QACrC,UAAU;QACV,QAAQ;QACR,gBAAgB;QAEhB,8CAA8C;QAC9C,gBAAgB;QAChB,cAAc;QAEd,sBAAsB;QACtB,mBAAmB,EAAE,YAAY,CAAC,qBAAqB,CAAC;QACxD,kBAAkB,EAAE,YAAY,CAAC,oBAAoB,CAAC;QACtD,kBAAkB,EAAE,YAAY,CAAC,oBAAoB,CAAC;QACtD,iBAAiB,EAAE,YAAY,CAAC,mBAAmB,CAAC;QACpD,gBAAgB,EAAE,YAAY,CAAC,kBAAkB,CAAC;QAClD,aAAa,EAAE,YAAY,CAAC,eAAe,CAAC;QAC5C,YAAY,EAAE,YAAY,CAAC,cAAc,CAAC,EAAE,iCAAiC;QAC7E,aAAa,EAAE,YAAY,CAAC,eAAe,CAAC;QAC5C,gBAAgB,EAAE,YAAY,CAAC,kBAAkB,CAAC;QAClD,aAAa,EAAE,YAAY,CAAC,eAAe,CAAC;QAC5C,eAAe,EAAE,YAAY,CAAC,iBAAiB,CAAC;QAChD,gBAAgB,EAAE,YAAY,CAAC,kBAAkB,CAAC;QAClD,iBAAiB,EAAE,YAAY,CAAC,mBAAmB,CAAC;QAEpD,oEAAoE;QACpE,wDAAwD;QACxD,mBAAmB,EAAE,YAAY,CAAC,MAAM;QACxC,YAAY,EAAE,GAAG;QACjB,gBAAgB,EAAE,GAAG;QACrB,kBAAkB,EAAE,YAAY;QAEhC,WAAW;QACX,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"scoring.js","sourceRoot":"","sources":["../../src/trust/scoring.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAML,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AA+B9D,MAAM,CAAC,MAAM,sBAAsB,GAAuB;IACxD,OAAO,EAAE;QACP,YAAY,EAAE,GAAG;QACjB,aAAa,EAAE,GAAG;QAClB,SAAS,EAAE,GAAG;QACd,UAAU,EAAE,GAAG;QACf,SAAS,EAAE,GAAG;KACf;CACF,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAA2B;IAChE,mBAAmB,EAAE,EAAE;CACxB,CAAC;AAEF,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,8EAA8E;AAC9E,2CAA2C;AAC3C,8EAA8E;AAE9E,MAAM,CAAC,MAAM,iBAAiB,GAAkC;IAC9D,eAAe;IACf,mBAAmB,EAAE,cAAc;IACnC,qBAAqB,EAAE,cAAc;IACrC,sBAAsB,EAAE,cAAc;IACtC,kBAAkB,EAAE,cAAc;IAClC,2EAA2E;IAC3E,kEAAkE;IAClE,sBAAsB,EAAE,cAAc;IACtC,2EAA2E;IAC3E,yBAAyB,EAAE,cAAc;IAEzC,gBAAgB;IAChB,mBAAmB,EAAE,eAAe;IACpC,kBAAkB,EAAE,eAAe;IACnC,iBAAiB,EAAE,eAAe;IAClC,gEAAgE;IAChE,kEAAkE;IAClE,wEAAwE;IACxE,sEAAsE;IACtE,uEAAuE;IACvE,mBAAmB,EAAE,eAAe;IACpC,4EAA4E;IAC5E,oDAAoD;IACpD,iBAAiB,EAAE,eAAe;IAElC,0EAA0E;IAC1E,uEAAuE;IACvE,mDAAmD;IACnD,kBAAkB,EAAE,WAAW;IAC/B,uBAAuB,EAAE,WAAW;IACpC,iBAAiB,EAAE,WAAW;IAC9B,iBAAiB,EAAE,WAAW;IAC9B,gBAAgB,EAAE,WAAW;IAC7B,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,2EAA2E;IAC3E,2EAA2E;IAC3E,6EAA6E;IAC7E,8EAA8E;IAC9E,0CAA0C;IAE1C,aAAa;IACb,oBAAoB,EAAE,YAAY;IAClC,mBAAmB,EAAE,YAAY;IAEjC,yCAAyC;IACzC,oBAAoB,EAAE,eAAe;IACrC,sBAAsB,EAAE,eAAe;IACvC,oBAAoB,EAAE,eAAe;IACrC,6BAA6B,EAAE,eAAe;IAC9C,eAAe,EAAE,eAAe;IAEhC,qCAAqC;IACrC,sBAAsB,EAAE,eAAe;IACvC,sBAAsB,EAAE,eAAe;IACvC,gBAAgB,EAAE,eAAe;IACjC,oBAAoB,EAAE,eAAe;IAErC,kEAAkE;IAClE,mBAAmB,EAAE,eAAe;IACpC,cAAc,EAAE,eAAe;IAE/B,gEAAgE;IAChE,WAAW,EAAE,eAAe;IAC5B,mBAAmB,EAAE,eAAe;IAEpC,qDAAqD;IACrD,iBAAiB,EAAE,eAAe;IAElC,sCAAsC;IACtC,iBAAiB,EAAE,WAAW;IAC9B,gBAAgB,EAAE,WAAW;IAC7B,aAAa,EAAE,WAAW;IAC1B,0BAA0B,EAAE,WAAW,EAAE,qCAAqC;CAC/E,CAAC;AAsBF,MAAM,CAAC,MAAM,kBAAkB,GAAmC;IAChE,kBAAkB,EAAE,qBAAqB;IACzC,qBAAqB,EAAE,oBAAoB;IAC3C,sBAAsB,EAAE,oBAAoB;IAC5C,kBAAkB,EAAE,oBAAoB;IACxC,sBAAsB,EAAE,oBAAoB;IAC5C,yBAAyB,EAAE,oBAAoB;IAC/C,mBAAmB,EAAE,oBAAoB;IACzC,kBAAkB,EAAE,mBAAmB;IACvC,uBAAuB,EAAE,kBAAkB;IAC3C,iBAAiB,EAAE,kBAAkB;IACrC,mBAAmB,EAAE,eAAe;IACpC,iBAAiB,EAAE,eAAe;IAClC,oBAAoB,EAAE,eAAe;IACrC,mBAAmB,EAAE,kBAAkB;IACvC,iBAAiB,EAAE,kBAAkB;IACrC,gBAAgB,EAAE,iBAAiB;IACnC,0BAA0B,EAAE,kBAAkB;IAC9C,oBAAoB,EAAE,eAAe;IACrC,sBAAsB,EAAE,eAAe;IACvC,oBAAoB,EAAE,eAAe;IACrC,6BAA6B,EAAE,eAAe;IAC9C,eAAe,EAAE,eAAe;IAChC,sBAAsB,EAAE,mBAAmB;IAC3C,sBAAsB,EAAE,mBAAmB;IAC3C,gBAAgB,EAAE,mBAAmB;IACrC,oBAAoB,EAAE,mBAAmB;IACzC,mBAAmB,EAAE,qBAAqB;IAC1C,0EAA0E;IAC1E,gEAAgE;IAChE,4DAA4D;IAC5D,mBAAmB,EAAE,qBAAqB;IAC1C,cAAc,EAAE,eAAe;IAC/B,WAAW,EAAE,eAAe;IAC5B,mBAAmB,EAAE,eAAe;IACpC,iBAAiB,EAAE,eAAe;IAClC,4EAA4E;IAC5E,kDAAkD;IAClD,iBAAiB,EAAE,cAAc;CAClC,CAAC;AAEF,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAA0B;IAC9D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;SAC7C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;SACtB,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAElC,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,kDAAkD,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAC3E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,WAA8B,EAC9B,SAA6B,sBAAsB,EACnD,UAA+B,EAAE;IAEjC,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAE9B,6EAA6E;IAE7E,mEAAmE;IACnE,0CAA0C;IAC1C,yEAAyE;IACzE,sEAAsE;IACtE,yEAAyE;IACzE,wCAAwC;IACxC,MAAM,cAAc,GAAG,IAAI,GAAG,EAA6D,CAAC;IAC5F,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAA2B,CAAC;IAElE,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,oEAAoE;YACpE,SAAS;QACX,CAAC;QACD,IAAI,EAAE,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClD,IAAI,IAAI;gBAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;;gBACxB,sBAAsB,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;YACrD,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC;YACnC,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC1D,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,IAAI,cAAc,EAAE,CAAC;QAC/D,IAAI,SAAS,GAAG,CAAC;YAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,SAAS,CAAC,CAAC;IACxE,CAAC;IAED,4EAA4E;IAC5E,EAAE;IACF,uEAAuE;IACvE,mEAAmE;IACnE,4EAA4E;IAC5E,sEAAsE;IACtE,2EAA2E;IAC3E,0EAA0E;IAC1E,0CAA0C;IAE1C,MAAM,gBAAgB,GAAoB;QACxC,cAAc;QACd,eAAe;QACf,WAAW;QACX,YAAY;KACb,CAAC,CAAC,iEAAiE;IAEpE,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,MAAM,KAAK,CAAC;YAAE,SAAS;QAC3B,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,GAAG,KAAK,SAAS;YAAE,SAAS,CAAC,yCAAyC;QAC1E,WAAW,IAAI,GAAG,GAAG,MAAM,CAAC;QAC5B,eAAe,IAAI,MAAM,CAAC;IAC5B,CAAC;IAED,2EAA2E;IAC3E,uEAAuE;IACvE,IAAI,cAAc,GAChB,eAAe,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC;IAC5D,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAEpF,6EAA6E;IAC7E,8EAA8E;IAC9E,4EAA4E;IAC5E,2EAA2E;IAC3E,mEAAmE;IACnE,oCAAoC;IACpC,MAAM,YAAY,GAAG,yBAAyB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACxE,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EACvC,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,YAAY,CAAC,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAEjE,qCAAqC;IACrC,MAAM,gBAAgB,GAAuB,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACxE,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO;YACL,QAAQ,EAAE,GAAG;YACb,SAAS,EAAE,GAAG,KAAK,SAAS;YAC5B,KAAK,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI;YAC7D,kBAAkB,EAAE,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE;YACzD,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SAC5B,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAEjE,4EAA4E;IAE5E,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA4B,CAAC;IAE7D,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,wEAAwE;QACxE,qEAAqE;QACrE,sEAAsE;QACtE,IAAI,EAAE,CAAC,UAAU,KAAK,KAAK;YAAE,SAAS;QACtC,MAAM,SAAS,GAAG,kBAAkB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,SAAS,KAAK,SAAS;YAAE,SAAS;QACtC,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,CAAC,GAAmB,EAAU,EAAE;QACnD,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC,CAAC,8BAA8B;QAC9E,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3D,CAAC,CAAC;IAEF,4EAA4E;IAE5E,yEAAyE;IACzE,8DAA8D;IAC9D,MAAM,gBAAgB,GAAsB,EAAE,CAAC;IAC/C,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;gBAC9B,gBAAgB,CAAC,IAAI,CAAC;oBACpB,IAAI,EAAE,EAAE,CAAC,IAAI;oBACb,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI;oBACtB,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI;oBACtB,OAAO,EAAE,CAAC,CAAC,OAAO;iBACnB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC;IAEhD,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,eAAe,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACxD,uEAAuE;IACvE,MAAM,IAAI,GAAG,eAAe,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAe,WAAW;QACxC,CAAC,CAAC,2BAA2B;QAC7B,CAAC,CAAC,OAAO,CAAC;IAEZ,4EAA4E;IAE5E,OAAO;QACL,KAAK,EAAE,cAAc;QACrB,IAAI;QAEJ,qCAAqC;QACrC,UAAU;QACV,QAAQ;QACR,gBAAgB;QAEhB,8CAA8C;QAC9C,gBAAgB;QAChB,cAAc;QAEd,sBAAsB;QACtB,mBAAmB,EAAE,YAAY,CAAC,qBAAqB,CAAC;QACxD,kBAAkB,EAAE,YAAY,CAAC,oBAAoB,CAAC;QACtD,kBAAkB,EAAE,YAAY,CAAC,oBAAoB,CAAC;QACtD,iBAAiB,EAAE,YAAY,CAAC,mBAAmB,CAAC;QACpD,gBAAgB,EAAE,YAAY,CAAC,kBAAkB,CAAC;QAClD,aAAa,EAAE,YAAY,CAAC,eAAe,CAAC;QAC5C,YAAY,EAAE,YAAY,CAAC,cAAc,CAAC,EAAE,iCAAiC;QAC7E,aAAa,EAAE,YAAY,CAAC,eAAe,CAAC;QAC5C,gBAAgB,EAAE,YAAY,CAAC,kBAAkB,CAAC;QAClD,aAAa,EAAE,YAAY,CAAC,eAAe,CAAC;QAC5C,eAAe,EAAE,YAAY,CAAC,iBAAiB,CAAC;QAChD,gBAAgB,EAAE,YAAY,CAAC,kBAAkB,CAAC;QAClD,iBAAiB,EAAE,YAAY,CAAC,mBAAmB,CAAC;QAEpD,oEAAoE;QACpE,wDAAwD;QACxD,mBAAmB,EAAE,YAAY,CAAC,MAAM;QACxC,YAAY,EAAE,GAAG;QACjB,gBAAgB,EAAE,GAAG;QACrB,kBAAkB,EAAE,YAAY;QAEhC,WAAW;QACX,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir-ai",
-  "version": "2.59.1",
+  "version": "2.60.1",
   "description": "LLM-enhanced SAST analysis built on circle-ir",
   "main": "dist/index.js",
   "module": "dist/index.js",