circle-ir-ai 2.89.0 → 2.92.0

package/dist/trust/hardened-artifacts.js

@@ -0,0 +1,106 @@
+/**
+ * Hardened-artifact registry (cognium-ai#123)
+ *
+ * A static, data-driven table of dependency versions that *compile out* or
+ * patch a known-dangerous sink — e.g. fastjson `_noneautotype` builds remove
+ * the autoType gadget codepath, so a `JSON.parseObject` deserialization
+ * finding on such a repo is very likely a false positive.
+ *
+ * This lives in the AI layer (trust), NOT in circle-ir: the engine stays
+ * correct about *sinks*; dependency-version-gated hardening is context the
+ * engine shouldn't carry (it would rot as new hardened variants ship). The
+ * `dependency-hardening-detected` trust pass reads the dependency manifest and
+ * emits an **advisory** (never touches severity — Option C in #123) so a
+ * reviewer can correlate it against circle-ir's raw finding.
+ *
+ * Adding a new hardened variant is a table edit here — no engine change.
+ */
+// ---------------------------------------------------------------------------
+// Version helpers
+// ---------------------------------------------------------------------------
+/** Split a Maven version into leading numeric segments (ignores qualifiers). */
+function numericParts(v) {
+    return v
+        .split(/[^0-9]+/)
+        .filter((s) => s.length > 0)
+        .map((s) => parseInt(s, 10));
+}
+/** `a >= b` on dotted numeric versions (qualifier-insensitive). */
+export function atLeast(version, min) {
+    const a = numericParts(version);
+    const b = numericParts(min);
+    const n = Math.max(a.length, b.length);
+    for (let i = 0; i < n; i++) {
+        const x = a[i] ?? 0;
+        const y = b[i] ?? 0;
+        if (x !== y)
+            return x > y;
+    }
+    return true; // equal
+}
+/** `min <= version < maxExclusive` — for backport bands (e.g. 2.12.4 <= v < 2.13). */
+function inBand(version, min, maxExclusive) {
+    return atLeast(version, min) && !atLeast(version, maxExclusive);
+}
+// ---------------------------------------------------------------------------
+// Registry
+// ---------------------------------------------------------------------------
+export const HARDENED_ARTIFACTS = [
+    // #123 seed — fastjson _noneautotype build removes the autoType gadget.
+    {
+        ecosystem: 'Maven',
+        ga: 'com.alibaba:fastjson',
+        predicate: (v) => /_noneautotype$/i.test(v),
+        hardens: ['deserialization'],
+        sinkHint: 'com.alibaba.fastjson.JSON#parseObject',
+        cwe: ['CWE-502'],
+        note: (v) => `fastjson pinned to a _noneautotype build (${v}) — the autoType gadget codepath is removed at compile time; deserialization findings on JSON.parseObject/JSON.parse in this repo are likely hardened.`,
+    },
+    // Log4Shell — 2.17.0+ (or the 2.12.4 / 2.3.2 branch backports) disable JNDI lookup.
+    {
+        ecosystem: 'Maven',
+        ga: 'org.apache.logging.log4j:log4j-core',
+        predicate: (v) => atLeast(v, '2.17.0') || inBand(v, '2.12.4', '2.13.0') || inBand(v, '2.3.2', '2.4.0'),
+        hardens: ['deserialization', 'code_injection'],
+        sinkHint: 'org.apache.logging.log4j.Logger#error',
+        cwe: ['CWE-917', 'CWE-502'],
+        note: (v) => `log4j-core ${v} — JNDI message-lookup disabled (Log4Shell CVE-2021-44228 class hardened).`,
+    },
+    // Spring4Shell — spring-beans 5.3.18+ / 5.2.20+ patch CVE-2022-22965.
+    {
+        ecosystem: 'Maven',
+        ga: 'org.springframework:spring-beans',
+        predicate: (v) => atLeast(v, '5.3.18') || inBand(v, '5.2.20', '5.3.0'),
+        hardens: ['code_injection'],
+        sinkHint: 'org.springframework.beans.CachedIntrospectionResults',
+        cwe: ['CWE-94'],
+        note: (v) => `spring-beans ${v} — Spring4Shell (CVE-2022-22965) class-loader access patched.`,
+    },
+    // commons-collections InvokerTransformer gadget hardened in 3.2.2 / 4.1.
+    {
+        ecosystem: 'Maven',
+        ga: 'commons-collections:commons-collections',
+        predicate: (v) => atLeast(v, '3.2.2'),
+        hardens: ['deserialization'],
+        sinkHint: 'org.apache.commons.collections.functors.InvokerTransformer',
+        cwe: ['CWE-502'],
+        note: (v) => `commons-collections ${v} — InvokerTransformer deserialization gadget disabled by default.`,
+    },
+    {
+        ecosystem: 'Maven',
+        ga: 'org.apache.commons:commons-collections4',
+        predicate: (v) => atLeast(v, '4.1'),
+        hardens: ['deserialization'],
+        sinkHint: 'org.apache.commons.collections4.functors.InvokerTransformer',
+        cwe: ['CWE-502'],
+        note: (v) => `commons-collections4 ${v} — InvokerTransformer deserialization gadget disabled by default.`,
+    },
+    // NOTE: jackson-databind is intentionally omitted — version alone is
+    // insufficient (hardening depends on whether `enableDefaultTyping` is
+    // enabled in code). Deferred to a config-gated follow-up per #123.
+];
+/** Match a resolved dependency against the registry. */
+export function matchHardened(dep) {
+    return HARDENED_ARTIFACTS.find((h) => h.ecosystem === dep.ecosystem && h.ga === dep.name && h.predicate(dep.version));
+}
+//# sourceMappingURL=hardened-artifacts.js.map

package/dist/trust/hardened-artifacts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hardened-artifacts.js","sourceRoot":"","sources":["../../src/trust/hardened-artifacts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAwBH,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,gFAAgF;AAChF,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC;SACL,KAAK,CAAC,SAAS,CAAC;SAChB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,OAAO,CAAC,OAAe,EAAE,GAAW;IAClD,MAAM,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,QAAQ;AACvB,CAAC;AAED,sFAAsF;AACtF,SAAS,MAAM,CAAC,OAAe,EAAE,GAAW,EAAE,YAAoB;IAChE,OAAO,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;AAClE,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E,MAAM,CAAC,MAAM,kBAAkB,GAAuB;IACpD,wEAAwE;IACxE;QACE,SAAS,EAAE,OAAO;QAClB,EAAE,EAAE,sBAAsB;QAC1B,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3C,OAAO,EAAE,CAAC,iBAAiB,CAAC;QAC5B,QAAQ,EAAE,uCAAuC;QACjD,GAAG,EAAE,CAAC,SAAS,CAAC;QAChB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CACV,6CAA6C,CAAC,wJAAwJ;KACzM;IACD,oFAAoF;IACpF;QACE,SAAS,EAAE,OAAO;QAClB,EAAE,EAAE,qCAAqC;QACzC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CACf,OAAO,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC;QACtF,OAAO,EAAE,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;QAC9C,QAAQ,EAAE,uCAAuC;QACjD,GAAG,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;QAC3B,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,4EAA4E;KACzG;IACD,sEAAsE;IACtE;QACE,SAAS,EAAE,OAAO;QAClB,EAAE,EAAE,kCAAkC;QACtC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC;QACtE,OAAO,EAAE,CAAC,gBAAgB,CAAC;QAC3B,QAAQ,EAAE,sDAAsD;QAChE,GAAG,EAAE,CAAC,QAAQ,CAAC;QACf,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,+DAA+D;KAC9F;IACD,yEAAyE;IACzE;QACE,SAAS,EAAE,OAAO;QAClB,EAAE,EAAE,yCAAyC;QAC7C,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC;QACrC,OAAO,EAAE,CAAC,iBAAiB,CAAC;QAC5B,QAAQ,EAAE,4DAA4D;QACtE,GAAG,EAAE,CAAC,SAAS,CAAC;QAChB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,mEAAmE;KACzG;IACD;QACE,SAAS,EAAE,OAAO;QAClB,EAAE,EAAE,yCAAyC;QAC7C,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,CAAC;QACnC,OAAO,EAAE,CAAC,iBAAiB,CAAC;QAC5B,QAAQ,EAAE,6DAA6D;QACvE,GAAG,EAAE,CAAC,SAAS,CAAC;QAChB,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,wBAAwB,CAAC,mEAAmE;KAC1G;IACD,qEAAqE;IACrE,sEAAsE;IACtE,mEAAmE;CACpE,CAAC;AAEF,wDAAwD;AACxD,MAAM,UAAU,aAAa,CAAC,GAI7B;IACC,OAAO,kBAAkB,CAAC,IAAI,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS,IAAI,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CACtF,CAAC;AACJ,CAAC"}

package/dist/trust/index.d.ts

@@ -33,6 +33,8 @@ export { discriminatingSecurityScore, securityLoad, SECURITY_SEVERITY_PENALTY, S
 export { missingGuardDomPass, type MissingGuardDomOptions, } from './passes/missing-guard-dom.js';
 export { featureEnvyPass, type FeatureEnvyOptions, } from './passes/feature-envy.js';
 export { specGapReportPass, type SpecGapReportOptions, } from './passes/spec-gap-report.js';
+export { dependencyHardeningPass, type DependencyHardeningOptions, } from './passes/dependency-hardening.js';
+export { HARDENED_ARTIFACTS, matchHardened, atLeast, type HardenedArtifact, } from './hardened-artifacts.js';
 export { computeTrustScore, validateScoringConfig, DEFAULT_SCORING_CONFIG, PASS_CATEGORY_MAP, PASS_COMPONENT_MAP, type TrustCategory, type TrustScoringConfig, type TrustScoringContext, } from './scoring.js';
 export { compareTrustResults, formatComparisonReport, type TrustComparisonResult, type PassDelta, } from './compare.js';
 export { generateTrustSARIF } from './sarif.js';

package/dist/trust/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/trust/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,eAAe,GAChB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,oBAAoB,EACpB,KAAK,uBAAuB,GAC7B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,EACrB,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,EAClC,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,GACtB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,sBAAsB,EACtB,KAAK,yBAAyB,GAC/B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,mBAAmB,EACnB,KAAK,sBAAsB,GAC5B,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,0BAA0B,EAC1B,KAAK,6BAA6B,GACnC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,uBAAuB,EACvB,KAAK,0BAA0B,GAChC,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,wBAAwB,EACxB,KAAK,2BAA2B,GACjC,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,oBAAoB,EACpB,KAAK,uBAAuB,GAC7B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,kBAAkB,EAClB,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,kBAAkB,EAClB,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,cAAc,EACd,KAAK,iBAAiB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,iBAAiB,EACjB,KAAK,oBAAoB,GAC1B,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EACL,mBAAmB,EACnB,KAAK,sBAAsB,GAC5B,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EACL,sBAAsB,EACtB,KAAK,eAAe,GACrB,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EACL,0BAA0B,EAC1B,KAAK,6BAA6B,GACnC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,oBAAoB,EACpB,UAAU,EACV,cAAc,EACd,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,WAAW,GACjB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,kBAAkB,EAClB,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,mBAAmB,EACnB,KAAK,sBAAsB,GAC5B,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EACL,gBAAgB,EAChB,KAAK,mBAAmB,GACzB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,iBAAiB,EACjB,KAAK,oBAAoB,GAC1B,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,0BAA0B,EAC1B,KAAK,6BAA6B,GACnC,MAAM,sCAAsC,CAAC;AAG9C,OAAO,EACL,qBAAqB,EACrB,KAAK,sBAAsB,GAC5B,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EACL,qBAAqB,EACrB,KAAK,8BAA8B,GACpC,MAAM,sCAAsC,CAAC;AAG9C,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,2BAA2B,EAC3B,YAAY,EACZ,yBAAyB,EACzB,oBAAoB,EACpB,KAAK,qBAAqB,GAC3B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,mBAAmB,EACnB,KAAK,sBAAsB,GAC5B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,eAAe,EACf,KAAK,kBAAkB,GACxB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EACL,iBAAiB,EACjB,KAAK,oBAAoB,GAC1B,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,SAAS,GACf,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGhD,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,YAAY,GAClB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/trust/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,eAAe,GAChB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,oBAAoB,EACpB,KAAK,uBAAuB,GAC7B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,EACrB,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,6BAA6B,EAClC,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,GACtB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,sBAAsB,EACtB,KAAK,yBAAyB,GAC/B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,mBAAmB,EACnB,KAAK,sBAAsB,GAC5B,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,0BAA0B,EAC1B,KAAK,6BAA6B,GACnC,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,uBAAuB,EACvB,KAAK,0BAA0B,GAChC,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,wBAAwB,EACxB,KAAK,2BAA2B,GACjC,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,oBAAoB,EACpB,KAAK,uBAAuB,GAC7B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,kBAAkB,EAClB,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,kBAAkB,EAClB,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,cAAc,EACd,KAAK,iBAAiB,GACvB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,iBAAiB,EACjB,KAAK,oBAAoB,GAC1B,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EACL,mBAAmB,EACnB,KAAK,sBAAsB,GAC5B,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EACL,sBAAsB,EACtB,KAAK,eAAe,GACrB,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EACL,0BAA0B,EAC1B,KAAK,6BAA6B,GACnC,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,oBAAoB,EACpB,UAAU,EACV,cAAc,EACd,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,WAAW,GACjB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,kBAAkB,EAClB,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,mBAAmB,EACnB,KAAK,sBAAsB,GAC5B,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EACL,gBAAgB,EAChB,KAAK,mBAAmB,GACzB,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,iBAAiB,EACjB,KAAK,oBAAoB,GAC1B,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,0BAA0B,EAC1B,KAAK,6BAA6B,GACnC,MAAM,sCAAsC,CAAC;AAG9C,OAAO,EACL,qBAAqB,EACrB,KAAK,sBAAsB,GAC5B,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EACL,qBAAqB,EACrB,KAAK,8BAA8B,GACpC,MAAM,sCAAsC,CAAC;AAG9C,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,2BAA2B,EAC3B,YAAY,EACZ,yBAAyB,EACzB,oBAAoB,EACpB,KAAK,qBAAqB,GAC3B,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,mBAAmB,EACnB,KAAK,sBAAsB,GAC5B,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,eAAe,EACf,KAAK,kBAAkB,GACxB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EACL,iBAAiB,EACjB,KAAK,oBAAoB,GAC1B,MAAM,6BAA6B,CAAC;AAGrC,OAAO,EACL,uBAAuB,EACvB,KAAK,0BAA0B,GAChC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,OAAO,EACP,KAAK,gBAAgB,GACtB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,SAAS,GACf,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGhD,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,YAAY,GAClB,MAAM,YAAY,CAAC"}

package/dist/trust/index.js

@@ -47,6 +47,9 @@ export { missingGuardDomPass, } from './passes/missing-guard-dom.js';
 export { featureEnvyPass, } from './passes/feature-envy.js';
 // Sprint 10 — Spec-gap report
 export { specGapReportPass, } from './passes/spec-gap-report.js';
+// cognium-ai#123 — dependency-hardening advisory (artifacts, informational)
+export { dependencyHardeningPass, } from './passes/dependency-hardening.js';
+export { HARDENED_ARTIFACTS, matchHardened, atLeast, } from './hardened-artifacts.js';
 // Scoring engine (v2)
 export { computeTrustScore, validateScoringConfig, DEFAULT_SCORING_CONFIG, PASS_CATEGORY_MAP, PASS_COMPONENT_MAP, } from './scoring.js';
 // Compare

package/dist/trust/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/trust/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,QAAQ;AACR,OAAO,EAUL,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,eAAe,GAChB,MAAM,YAAY,CAAC;AAEpB,SAAS;AACT,OAAO,EACL,oBAAoB,GAErB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,EACrB,iBAAiB,GAOlB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,sBAAsB,GAEvB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,0BAA0B,GAE3B,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,uBAAuB,GAExB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,wBAAwB,GAEzB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,oBAAoB,GAErB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,kBAAkB,GAEnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,kBAAkB,GAEnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,cAAc,GAEf,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,iBAAiB,GAElB,MAAM,4BAA4B,CAAC;AAEpC,kBAAkB;AAClB,OAAO,EACL,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AAEtC,oEAAoE;AACpE,OAAO,EACL,sBAAsB,GAEvB,MAAM,kCAAkC,CAAC;AAE1C,2EAA2E;AAC3E,OAAO,EACL,0BAA0B,GAE3B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,oBAAoB,EACpB,UAAU,EACV,cAAc,GAIf,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,kBAAkB,GAEnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AAEtC,kBAAkB;AAClB,OAAO,EACL,gBAAgB,GAEjB,MAAM,6BAA6B,CAAC;AAErC,4BAA4B;AAC5B,OAAO,EACL,iBAAiB,GAElB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,0BAA0B,GAE3B,MAAM,sCAAsC,CAAC;AAE9C,sEAAsE;AACtE,OAAO,EACL,qBAAqB,GAEtB,MAAM,gCAAgC,CAAC;AAExC,uCAAuC;AACvC,OAAO,EACL,qBAAqB,GAEtB,MAAM,sCAAsC,CAAC;AAE9C,yEAAyE;AACzE,OAAO,EACL,kBAAkB,EAClB,iBAAiB,GAElB,MAAM,6BAA6B,CAAC;AAErC,wEAAwE;AACxE,OAAO,EACL,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAE3B,qEAAqE;AACrE,OAAO,EACL,2BAA2B,EAC3B,YAAY,EACZ,yBAAyB,EACzB,oBAAoB,GAErB,MAAM,qBAAqB,CAAC;AAE7B,0DAA0D;AAC1D,OAAO,EACL,mBAAmB,GAEpB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,eAAe,GAEhB,MAAM,0BAA0B,CAAC;AAElC,8BAA8B;AAC9B,OAAO,EACL,iBAAiB,GAElB,MAAM,6BAA6B,CAAC;AAErC,sBAAsB;AACtB,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,GAInB,MAAM,cAAc,CAAC;AAEtB,UAAU;AACV,OAAO,EACL,mBAAmB,EACnB,sBAAsB,GAGvB,MAAM,cAAc,CAAC;AAEtB,QAAQ;AACR,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD,QAAQ;AACR,OAAO,EACL,kBAAkB,EAClB,sBAAsB,GAEvB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/trust/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,QAAQ;AACR,OAAO,EAUL,eAAe,EACf,WAAW,EACX,gBAAgB,EAChB,eAAe,GAChB,MAAM,YAAY,CAAC;AAEpB,SAAS;AACT,OAAO,EACL,oBAAoB,GAErB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,qBAAqB,EACrB,0BAA0B,EAC1B,qBAAqB,EACrB,iBAAiB,GAOlB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EACL,sBAAsB,GAEvB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EACL,0BAA0B,GAE3B,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EACL,uBAAuB,GAExB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EACL,wBAAwB,GAEzB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,oBAAoB,GAErB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,kBAAkB,GAEnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,kBAAkB,GAEnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,cAAc,GAEf,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,iBAAiB,GAElB,MAAM,4BAA4B,CAAC;AAEpC,kBAAkB;AAClB,OAAO,EACL,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AAEtC,oEAAoE;AACpE,OAAO,EACL,sBAAsB,GAEvB,MAAM,kCAAkC,CAAC;AAE1C,2EAA2E;AAC3E,OAAO,EACL,0BAA0B,GAE3B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,oBAAoB,EACpB,UAAU,EACV,cAAc,GAIf,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,kBAAkB,GAEnB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AAEtC,kBAAkB;AAClB,OAAO,EACL,gBAAgB,GAEjB,MAAM,6BAA6B,CAAC;AAErC,4BAA4B;AAC5B,OAAO,EACL,iBAAiB,GAElB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EACL,0BAA0B,GAE3B,MAAM,sCAAsC,CAAC;AAE9C,sEAAsE;AACtE,OAAO,EACL,qBAAqB,GAEtB,MAAM,gCAAgC,CAAC;AAExC,uCAAuC;AACvC,OAAO,EACL,qBAAqB,GAEtB,MAAM,sCAAsC,CAAC;AAE9C,yEAAyE;AACzE,OAAO,EACL,kBAAkB,EAClB,iBAAiB,GAElB,MAAM,6BAA6B,CAAC;AAErC,wEAAwE;AACxE,OAAO,EACL,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,mBAAmB,CAAC;AAE3B,qEAAqE;AACrE,OAAO,EACL,2BAA2B,EAC3B,YAAY,EACZ,yBAAyB,EACzB,oBAAoB,GAErB,MAAM,qBAAqB,CAAC;AAE7B,0DAA0D;AAC1D,OAAO,EACL,mBAAmB,GAEpB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EACL,eAAe,GAEhB,MAAM,0BAA0B,CAAC;AAElC,8BAA8B;AAC9B,OAAO,EACL,iBAAiB,GAElB,MAAM,6BAA6B,CAAC;AAErC,4EAA4E;AAC5E,OAAO,EACL,uBAAuB,GAExB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,OAAO,GAER,MAAM,yBAAyB,CAAC;AAEjC,sBAAsB;AACtB,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,GAInB,MAAM,cAAc,CAAC;AAEtB,UAAU;AACV,OAAO,EACL,mBAAmB,EACnB,sBAAsB,GAGvB,MAAM,cAAc,CAAC;AAEtB,QAAQ;AACR,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD,QAAQ;AACR,OAAO,EACL,kBAAkB,EAClB,sBAAsB,GAEvB,MAAM,YAAY,CAAC"}

package/dist/trust/passes/dependency-hardening.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Dependency-Hardening Advisory Trust Pass (cognium-ai#123, Option C)
+ *
+ * Reads the dependency manifest and emits an **advisory** (`info`) finding for
+ * each dependency pinned to a version that compiles out / patches a known
+ * dangerous sink (e.g. fastjson `_noneautotype`, log4j ≥2.17, Spring4Shell
+ * patch). It does NOT change any severity — circle-ir's raw deserialization /
+ * code-injection finding stays exactly as emitted; this sits *next to* it so a
+ * reviewer (or a future scan↔trust merge, the "B later" step) can correlate
+ * via `meta.sink_hint` and render a `hardened-by:` badge.
+ *
+ * Category: `artifacts` (weight 0, informational) — never moves the score.
+ * Cost: deterministic, zero-LLM (manifest parse + static registry match).
+ */
+import type { TrustPassResult } from '../types.js';
+export interface DependencyHardeningOptions {
+    /** Max manifest files to scan (passed through to parseAllManifests). */
+    maxFiles?: number;
+}
+export declare function dependencyHardeningPass(projectPath: string, options?: DependencyHardeningOptions): Promise<TrustPassResult>;
+//# sourceMappingURL=dependency-hardening.d.ts.map

package/dist/trust/passes/dependency-hardening.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependency-hardening.d.ts","sourceRoot":"","sources":["../../../src/trust/passes/dependency-hardening.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,aAAa,CAAC;AAIjE,MAAM,WAAW,0BAA0B;IACzC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,eAAe,CAAC,CAuC1B"}

package/dist/trust/passes/dependency-hardening.js

@@ -0,0 +1,56 @@
+/**
+ * Dependency-Hardening Advisory Trust Pass (cognium-ai#123, Option C)
+ *
+ * Reads the dependency manifest and emits an **advisory** (`info`) finding for
+ * each dependency pinned to a version that compiles out / patches a known
+ * dangerous sink (e.g. fastjson `_noneautotype`, log4j ≥2.17, Spring4Shell
+ * patch). It does NOT change any severity — circle-ir's raw deserialization /
+ * code-injection finding stays exactly as emitted; this sits *next to* it so a
+ * reviewer (or a future scan↔trust merge, the "B later" step) can correlate
+ * via `meta.sink_hint` and render a `hardened-by:` badge.
+ *
+ * Category: `artifacts` (weight 0, informational) — never moves the score.
+ * Cost: deterministic, zero-LLM (manifest parse + static registry match).
+ */
+import { parseAllManifests } from './dep-manifests.js';
+import { HARDENED_ARTIFACTS } from '../hardened-artifacts.js';
+export async function dependencyHardeningPass(projectPath, options = {}) {
+    const start = Date.now();
+    const pass = 'dependency-hardening-detected';
+    const { deps } = parseAllManifests(projectPath, options.maxFiles ?? 400);
+    const findings = [];
+    for (const dep of deps) {
+        for (const h of HARDENED_ARTIFACTS) {
+            if (dep.ecosystem !== h.ecosystem || dep.name !== h.ga)
+                continue;
+            if (!h.predicate(dep.version))
+                continue;
+            findings.push({
+                pass,
+                ruleId: `hardened-${h.ga}`,
+                severity: 'info',
+                message: h.note(dep.version),
+                location: { file: dep.file },
+                meta: {
+                    artifact: h.ga,
+                    version: dep.version,
+                    hardens: h.hardens,
+                    hardened_cwe: h.cwe,
+                    // Correlate against a raw finding whose sink matches this method.
+                    sink_hint: h.sinkHint,
+                    advisory: true,
+                },
+            });
+        }
+    }
+    return {
+        pass,
+        score: 100, // advisory-only; artifacts category has weight 0
+        findings,
+        durationMs: Date.now() - start,
+        // #234 — only "applicable" when there was a manifest to read. A repo with
+        // no resolvable deps didn't get a real look, so don't count its clean 100.
+        applicable: deps.length > 0,
+    };
+}
+//# sourceMappingURL=dependency-hardening.js.map

package/dist/trust/passes/dependency-hardening.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependency-hardening.js","sourceRoot":"","sources":["../../../src/trust/passes/dependency-hardening.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAO9D,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,WAAmB,EACnB,UAAsC,EAAE;IAExC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,+BAA+B,CAAC;IAE7C,MAAM,EAAE,IAAI,EAAE,GAAG,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC;IAEzE,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,kBAAkB,EAAE,CAAC;YACnC,IAAI,GAAG,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE;gBAAE,SAAS;YACjE,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,SAAS;YACxC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI;gBACJ,MAAM,EAAE,YAAY,CAAC,CAAC,EAAE,EAAE;gBAC1B,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBAC5B,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;gBAC5B,IAAI,EAAE;oBACJ,QAAQ,EAAE,CAAC,CAAC,EAAE;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,YAAY,EAAE,CAAC,CAAC,GAAG;oBACnB,kEAAkE;oBAClE,SAAS,EAAE,CAAC,CAAC,QAAQ;oBACrB,QAAQ,EAAE,IAAI;iBACf;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,GAAG,EAAE,iDAAiD;QAC7D,QAAQ;QACR,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;QAC9B,0EAA0E;QAC1E,2EAA2E;QAC3E,UAAU,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC;KAC5B,CAAC;AACJ,CAAC"}

package/dist/trust/scoring.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scoring.d.ts","sourceRoot":"","sources":["../../src/trust/scoring.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,gBAAgB,EAKtB,MAAM,YAAY,CAAC;AAGpB;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC;CAC9B;AAMD,MAAM,MAAM,aAAa,GACrB,cAAc,GACd,eAAe,GACf,WAAW,GACX,YAAY,GACZ,WAAW,CAAC;AAMhB,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,eAAO,MAAM,sBAAsB,EAAE,kBAQpC,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAE7D,CAAC;AAUF,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CA4E3D,CAAC;AAMF,iEAAiE;AACjE,KAAK,cAAc,GACf,qBAAqB,GACrB,oBAAoB,GACpB,oBAAoB,GACpB,mBAAmB,GACnB,kBAAkB,GAClB,eAAe,GACf,eAAe,GACf,eAAe,GACf,kBAAkB,GAClB,cAAc,GACd,iBAAiB,GACjB,kBAAkB,GAClB,mBAAmB,CAAC;AAExB,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAuC7D,CAAC;AAMF;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAUtE;AAMD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,eAAe,EAAE,EAC9B,MAAM,GAAE,kBAA2C,EACnD,OAAO,GAAE,mBAAwB,GAChC,gBAAgB,CAgMlB"}
+{"version":3,"file":"scoring.d.ts","sourceRoot":"","sources":["../../src/trust/scoring.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,gBAAgB,EAKtB,MAAM,YAAY,CAAC;AAGpB;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC;CAC9B;AAMD,MAAM,MAAM,aAAa,GACrB,cAAc,GACd,eAAe,GACf,WAAW,GACX,YAAY,GACZ,WAAW,CAAC;AAMhB,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,eAAO,MAAM,sBAAsB,EAAE,kBAQpC,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAE7D,CAAC;AAUF,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CA6E3D,CAAC;AAMF,iEAAiE;AACjE,KAAK,cAAc,GACf,qBAAqB,GACrB,oBAAoB,GACpB,oBAAoB,GACpB,mBAAmB,GACnB,kBAAkB,GAClB,eAAe,GACf,eAAe,GACf,eAAe,GACf,kBAAkB,GAClB,cAAc,GACd,iBAAiB,GACjB,kBAAkB,GAClB,mBAAmB,CAAC;AAExB,eAAO,MAAM,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAuC7D,CAAC;AAMF;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,kBAAkB,GAAG,IAAI,CAUtE;AAMD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,WAAW,EAAE,eAAe,EAAE,EAC9B,MAAM,GAAE,kBAA2C,EACnD,OAAO,GAAE,mBAAwB,GAChC,gBAAgB,CAgMlB"}

package/dist/trust/scoring.js

@@ -102,6 +102,7 @@ export const PASS_CATEGORY_MAP = {
     'vex-generation': 'artifacts',
     'audit-trail': 'artifacts',
     'ai-generated-fingerprint': 'artifacts', // #234 L6 — provenance, not a threat
+    'dependency-hardening-detected': 'artifacts', // cognium-ai#123 — advisory, never scores
 };
 export const PASS_COMPONENT_MAP = {
     'input-validation': 'vulnerability_score',

package/dist/trust/scoring.js.map

@@ -1 +1 @@
-{"version":3,"file":"scoring.js","sourceRoot":"","sources":["../../src/trust/scoring.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAML,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AA+B9D,MAAM,CAAC,MAAM,sBAAsB,GAAuB;IACxD,OAAO,EAAE;QACP,YAAY,EAAE,GAAG;QACjB,aAAa,EAAE,GAAG;QAClB,SAAS,EAAE,GAAG;QACd,UAAU,EAAE,GAAG;QACf,SAAS,EAAE,GAAG;KACf;CACF,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAA2B;IAChE,mBAAmB,EAAE,EAAE;CACxB,CAAC;AAEF,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,8EAA8E;AAC9E,2CAA2C;AAC3C,8EAA8E;AAE9E,MAAM,CAAC,MAAM,iBAAiB,GAAkC;IAC9D,eAAe;IACf,mBAAmB,EAAE,cAAc;IACnC,qBAAqB,EAAE,cAAc;IACrC,sBAAsB,EAAE,cAAc;IACtC,kBAAkB,EAAE,cAAc;IAClC,2EAA2E;IAC3E,kEAAkE;IAClE,sBAAsB,EAAE,cAAc;IACtC,2EAA2E;IAC3E,yBAAyB,EAAE,cAAc;IAEzC,gBAAgB;IAChB,mBAAmB,EAAE,eAAe;IACpC,kBAAkB,EAAE,eAAe;IACnC,iBAAiB,EAAE,eAAe;IAClC,gEAAgE;IAChE,kEAAkE;IAClE,wEAAwE;IACxE,sEAAsE;IACtE,uEAAuE;IACvE,mBAAmB,EAAE,eAAe;IACpC,4EAA4E;IAC5E,oDAAoD;IACpD,iBAAiB,EAAE,eAAe;IAElC,0EAA0E;IAC1E,uEAAuE;IACvE,mDAAmD;IACnD,kBAAkB,EAAE,WAAW;IAC/B,uBAAuB,EAAE,WAAW;IACpC,iBAAiB,EAAE,WAAW;IAC9B,iBAAiB,EAAE,WAAW;IAC9B,gBAAgB,EAAE,WAAW;IAC7B,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,2EAA2E;IAC3E,2EAA2E;IAC3E,6EAA6E;IAC7E,8EAA8E;IAC9E,0CAA0C;IAE1C,aAAa;IACb,oBAAoB,EAAE,YAAY;IAClC,mBAAmB,EAAE,YAAY;IAEjC,yCAAyC;IACzC,oBAAoB,EAAE,eAAe;IACrC,sBAAsB,EAAE,eAAe;IACvC,oBAAoB,EAAE,eAAe;IACrC,6BAA6B,EAAE,eAAe;IAC9C,eAAe,EAAE,eAAe;IAEhC,qCAAqC;IACrC,sBAAsB,EAAE,eAAe;IACvC,sBAAsB,EAAE,eAAe;IACvC,gBAAgB,EAAE,eAAe;IACjC,oBAAoB,EAAE,eAAe;IAErC,kEAAkE;IAClE,mBAAmB,EAAE,eAAe;IACpC,cAAc,EAAE,eAAe;IAE/B,gEAAgE;IAChE,WAAW,EAAE,eAAe;IAC5B,mBAAmB,EAAE,eAAe;IAEpC,qDAAqD;IACrD,iBAAiB,EAAE,eAAe;IAElC,sCAAsC;IACtC,iBAAiB,EAAE,WAAW;IAC9B,gBAAgB,EAAE,WAAW;IAC7B,aAAa,EAAE,WAAW;IAC1B,0BAA0B,EAAE,WAAW,EAAE,qCAAqC;CAC/E,CAAC;AAsBF,MAAM,CAAC,MAAM,kBAAkB,GAAmC;IAChE,kBAAkB,EAAE,qBAAqB;IACzC,qBAAqB,EAAE,oBAAoB;IAC3C,sBAAsB,EAAE,oBAAoB;IAC5C,kBAAkB,EAAE,oBAAoB;IACxC,sBAAsB,EAAE,oBAAoB;IAC5C,yBAAyB,EAAE,oBAAoB;IAC/C,mBAAmB,EAAE,oBAAoB;IACzC,kBAAkB,EAAE,mBAAmB;IACvC,uBAAuB,EAAE,kBAAkB;IAC3C,iBAAiB,EAAE,kBAAkB;IACrC,mBAAmB,EAAE,eAAe;IACpC,iBAAiB,EAAE,eAAe;IAClC,oBAAoB,EAAE,eAAe;IACrC,mBAAmB,EAAE,kBAAkB;IACvC,iBAAiB,EAAE,kBAAkB;IACrC,gBAAgB,EAAE,iBAAiB;IACnC,0BAA0B,EAAE,kBAAkB;IAC9C,oBAAoB,EAAE,eAAe;IACrC,sBAAsB,EAAE,eAAe;IACvC,oBAAoB,EAAE,eAAe;IACrC,6BAA6B,EAAE,eAAe;IAC9C,eAAe,EAAE,eAAe;IAChC,sBAAsB,EAAE,mBAAmB;IAC3C,sBAAsB,EAAE,mBAAmB;IAC3C,gBAAgB,EAAE,mBAAmB;IACrC,oBAAoB,EAAE,mBAAmB;IACzC,mBAAmB,EAAE,qBAAqB;IAC1C,0EAA0E;IAC1E,gEAAgE;IAChE,4DAA4D;IAC5D,mBAAmB,EAAE,qBAAqB;IAC1C,cAAc,EAAE,eAAe;IAC/B,WAAW,EAAE,eAAe;IAC5B,mBAAmB,EAAE,eAAe;IACpC,iBAAiB,EAAE,eAAe;IAClC,4EAA4E;IAC5E,kDAAkD;IAClD,iBAAiB,EAAE,cAAc;CAClC,CAAC;AAEF,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAA0B;IAC9D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;SAC7C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;SACtB,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAElC,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,kDAAkD,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAC3E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,WAA8B,EAC9B,SAA6B,sBAAsB,EACnD,UAA+B,EAAE;IAEjC,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAE9B,6EAA6E;IAE7E,mEAAmE;IACnE,0CAA0C;IAC1C,yEAAyE;IACzE,sEAAsE;IACtE,yEAAyE;IACzE,wCAAwC;IACxC,MAAM,cAAc,GAAG,IAAI,GAAG,EAA6D,CAAC;IAC5F,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAA2B,CAAC;IAElE,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,oEAAoE;YACpE,SAAS;QACX,CAAC;QACD,IAAI,EAAE,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClD,IAAI,IAAI;gBAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;;gBACxB,sBAAsB,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;YACrD,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC;YACnC,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC1D,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,IAAI,cAAc,EAAE,CAAC;QAC/D,IAAI,SAAS,GAAG,CAAC;YAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,SAAS,CAAC,CAAC;IACxE,CAAC;IAED,4EAA4E;IAC5E,EAAE;IACF,uEAAuE;IACvE,mEAAmE;IACnE,4EAA4E;IAC5E,sEAAsE;IACtE,2EAA2E;IAC3E,0EAA0E;IAC1E,0CAA0C;IAE1C,MAAM,gBAAgB,GAAoB;QACxC,cAAc;QACd,eAAe;QACf,WAAW;QACX,YAAY;KACb,CAAC,CAAC,iEAAiE;IAEpE,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,MAAM,KAAK,CAAC;YAAE,SAAS;QAC3B,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,GAAG,KAAK,SAAS;YAAE,SAAS,CAAC,yCAAyC;QAC1E,WAAW,IAAI,GAAG,GAAG,MAAM,CAAC;QAC5B,eAAe,IAAI,MAAM,CAAC;IAC5B,CAAC;IAED,2EAA2E;IAC3E,uEAAuE;IACvE,IAAI,cAAc,GAChB,eAAe,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC;IAC5D,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAEpF,6EAA6E;IAC7E,8EAA8E;IAC9E,4EAA4E;IAC5E,2EAA2E;IAC3E,mEAAmE;IACnE,oCAAoC;IACpC,MAAM,YAAY,GAAG,yBAAyB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACxE,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EACvC,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,YAAY,CAAC,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAEjE,qCAAqC;IACrC,MAAM,gBAAgB,GAAuB,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACxE,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO;YACL,QAAQ,EAAE,GAAG;YACb,SAAS,EAAE,GAAG,KAAK,SAAS;YAC5B,KAAK,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI;YAC7D,kBAAkB,EAAE,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE;YACzD,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SAC5B,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAEjE,4EAA4E;IAE5E,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA4B,CAAC;IAE7D,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,wEAAwE;QACxE,qEAAqE;QACrE,sEAAsE;QACtE,IAAI,EAAE,CAAC,UAAU,KAAK,KAAK;YAAE,SAAS;QACtC,MAAM,SAAS,GAAG,kBAAkB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,SAAS,KAAK,SAAS;YAAE,SAAS;QACtC,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,CAAC,GAAmB,EAAU,EAAE;QACnD,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC,CAAC,8BAA8B;QAC9E,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3D,CAAC,CAAC;IAEF,4EAA4E;IAE5E,yEAAyE;IACzE,8DAA8D;IAC9D,MAAM,gBAAgB,GAAsB,EAAE,CAAC;IAC/C,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;gBAC9B,gBAAgB,CAAC,IAAI,CAAC;oBACpB,IAAI,EAAE,EAAE,CAAC,IAAI;oBACb,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI;oBACtB,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI;oBACtB,OAAO,EAAE,CAAC,CAAC,OAAO;iBACnB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC;IAEhD,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,eAAe,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACxD,uEAAuE;IACvE,MAAM,IAAI,GAAG,eAAe,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAe,WAAW;QACxC,CAAC,CAAC,2BAA2B;QAC7B,CAAC,CAAC,OAAO,CAAC;IAEZ,4EAA4E;IAE5E,OAAO;QACL,KAAK,EAAE,cAAc;QACrB,IAAI;QAEJ,qCAAqC;QACrC,UAAU;QACV,QAAQ;QACR,gBAAgB;QAEhB,8CAA8C;QAC9C,gBAAgB;QAChB,cAAc;QAEd,sBAAsB;QACtB,mBAAmB,EAAE,YAAY,CAAC,qBAAqB,CAAC;QACxD,kBAAkB,EAAE,YAAY,CAAC,oBAAoB,CAAC;QACtD,kBAAkB,EAAE,YAAY,CAAC,oBAAoB,CAAC;QACtD,iBAAiB,EAAE,YAAY,CAAC,mBAAmB,CAAC;QACpD,gBAAgB,EAAE,YAAY,CAAC,kBAAkB,CAAC;QAClD,aAAa,EAAE,YAAY,CAAC,eAAe,CAAC;QAC5C,YAAY,EAAE,YAAY,CAAC,cAAc,CAAC,EAAE,iCAAiC;QAC7E,aAAa,EAAE,YAAY,CAAC,eAAe,CAAC;QAC5C,gBAAgB,EAAE,YAAY,CAAC,kBAAkB,CAAC;QAClD,aAAa,EAAE,YAAY,CAAC,eAAe,CAAC;QAC5C,eAAe,EAAE,YAAY,CAAC,iBAAiB,CAAC;QAChD,gBAAgB,EAAE,YAAY,CAAC,kBAAkB,CAAC;QAClD,iBAAiB,EAAE,YAAY,CAAC,mBAAmB,CAAC;QAEpD,oEAAoE;QACpE,wDAAwD;QACxD,mBAAmB,EAAE,YAAY,CAAC,MAAM;QACxC,YAAY,EAAE,GAAG;QACjB,gBAAgB,EAAE,GAAG;QACrB,kBAAkB,EAAE,YAAY;QAEhC,WAAW;QACX,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"scoring.js","sourceRoot":"","sources":["../../src/trust/scoring.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAML,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AA+B9D,MAAM,CAAC,MAAM,sBAAsB,GAAuB;IACxD,OAAO,EAAE;QACP,YAAY,EAAE,GAAG;QACjB,aAAa,EAAE,GAAG;QAClB,SAAS,EAAE,GAAG;QACd,UAAU,EAAE,GAAG;QACf,SAAS,EAAE,GAAG;KACf;CACF,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAA2B;IAChE,mBAAmB,EAAE,EAAE;CACxB,CAAC;AAEF,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,8EAA8E;AAC9E,2CAA2C;AAC3C,8EAA8E;AAE9E,MAAM,CAAC,MAAM,iBAAiB,GAAkC;IAC9D,eAAe;IACf,mBAAmB,EAAE,cAAc;IACnC,qBAAqB,EAAE,cAAc;IACrC,sBAAsB,EAAE,cAAc;IACtC,kBAAkB,EAAE,cAAc;IAClC,2EAA2E;IAC3E,kEAAkE;IAClE,sBAAsB,EAAE,cAAc;IACtC,2EAA2E;IAC3E,yBAAyB,EAAE,cAAc;IAEzC,gBAAgB;IAChB,mBAAmB,EAAE,eAAe;IACpC,kBAAkB,EAAE,eAAe;IACnC,iBAAiB,EAAE,eAAe;IAClC,gEAAgE;IAChE,kEAAkE;IAClE,wEAAwE;IACxE,sEAAsE;IACtE,uEAAuE;IACvE,mBAAmB,EAAE,eAAe;IACpC,4EAA4E;IAC5E,oDAAoD;IACpD,iBAAiB,EAAE,eAAe;IAElC,0EAA0E;IAC1E,uEAAuE;IACvE,mDAAmD;IACnD,kBAAkB,EAAE,WAAW;IAC/B,uBAAuB,EAAE,WAAW;IACpC,iBAAiB,EAAE,WAAW;IAC9B,iBAAiB,EAAE,WAAW;IAC9B,gBAAgB,EAAE,WAAW;IAC7B,4EAA4E;IAC5E,4EAA4E;IAC5E,8EAA8E;IAC9E,2EAA2E;IAC3E,2EAA2E;IAC3E,6EAA6E;IAC7E,8EAA8E;IAC9E,0CAA0C;IAE1C,aAAa;IACb,oBAAoB,EAAE,YAAY;IAClC,mBAAmB,EAAE,YAAY;IAEjC,yCAAyC;IACzC,oBAAoB,EAAE,eAAe;IACrC,sBAAsB,EAAE,eAAe;IACvC,oBAAoB,EAAE,eAAe;IACrC,6BAA6B,EAAE,eAAe;IAC9C,eAAe,EAAE,eAAe;IAEhC,qCAAqC;IACrC,sBAAsB,EAAE,eAAe;IACvC,sBAAsB,EAAE,eAAe;IACvC,gBAAgB,EAAE,eAAe;IACjC,oBAAoB,EAAE,eAAe;IAErC,kEAAkE;IAClE,mBAAmB,EAAE,eAAe;IACpC,cAAc,EAAE,eAAe;IAE/B,gEAAgE;IAChE,WAAW,EAAE,eAAe;IAC5B,mBAAmB,EAAE,eAAe;IAEpC,qDAAqD;IACrD,iBAAiB,EAAE,eAAe;IAElC,sCAAsC;IACtC,iBAAiB,EAAE,WAAW;IAC9B,gBAAgB,EAAE,WAAW;IAC7B,aAAa,EAAE,WAAW;IAC1B,0BAA0B,EAAE,WAAW,EAAE,qCAAqC;IAC9E,+BAA+B,EAAE,WAAW,EAAE,0CAA0C;CACzF,CAAC;AAsBF,MAAM,CAAC,MAAM,kBAAkB,GAAmC;IAChE,kBAAkB,EAAE,qBAAqB;IACzC,qBAAqB,EAAE,oBAAoB;IAC3C,sBAAsB,EAAE,oBAAoB;IAC5C,kBAAkB,EAAE,oBAAoB;IACxC,sBAAsB,EAAE,oBAAoB;IAC5C,yBAAyB,EAAE,oBAAoB;IAC/C,mBAAmB,EAAE,oBAAoB;IACzC,kBAAkB,EAAE,mBAAmB;IACvC,uBAAuB,EAAE,kBAAkB;IAC3C,iBAAiB,EAAE,kBAAkB;IACrC,mBAAmB,EAAE,eAAe;IACpC,iBAAiB,EAAE,eAAe;IAClC,oBAAoB,EAAE,eAAe;IACrC,mBAAmB,EAAE,kBAAkB;IACvC,iBAAiB,EAAE,kBAAkB;IACrC,gBAAgB,EAAE,iBAAiB;IACnC,0BAA0B,EAAE,kBAAkB;IAC9C,oBAAoB,EAAE,eAAe;IACrC,sBAAsB,EAAE,eAAe;IACvC,oBAAoB,EAAE,eAAe;IACrC,6BAA6B,EAAE,eAAe;IAC9C,eAAe,EAAE,eAAe;IAChC,sBAAsB,EAAE,mBAAmB;IAC3C,sBAAsB,EAAE,mBAAmB;IAC3C,gBAAgB,EAAE,mBAAmB;IACrC,oBAAoB,EAAE,mBAAmB;IACzC,mBAAmB,EAAE,qBAAqB;IAC1C,0EAA0E;IAC1E,gEAAgE;IAChE,4DAA4D;IAC5D,mBAAmB,EAAE,qBAAqB;IAC1C,cAAc,EAAE,eAAe;IAC/B,WAAW,EAAE,eAAe;IAC5B,mBAAmB,EAAE,eAAe;IACpC,iBAAiB,EAAE,eAAe;IAClC,4EAA4E;IAC5E,kDAAkD;IAClD,iBAAiB,EAAE,cAAc;CAClC,CAAC;AAEF,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAA0B;IAC9D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;SAC7C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;SACtB,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAElC,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,kDAAkD,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAC3E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,WAA8B,EAC9B,SAA6B,sBAAsB,EACnD,UAA+B,EAAE;IAEjC,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAE9B,6EAA6E;IAE7E,mEAAmE;IACnE,0CAA0C;IAC1C,yEAAyE;IACzE,sEAAsE;IACtE,yEAAyE;IACzE,wCAAwC;IACxC,MAAM,cAAc,GAAG,IAAI,GAAG,EAA6D,CAAC;IAC5F,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAA2B,CAAC;IAElE,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,oEAAoE;YACpE,SAAS;QACX,CAAC;QACD,IAAI,EAAE,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,sBAAsB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClD,IAAI,IAAI;gBAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;;gBACxB,sBAAsB,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;YACrD,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC;YACnC,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,cAAc,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC1D,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,IAAI,cAAc,EAAE,CAAC;QAC/D,IAAI,SAAS,GAAG,CAAC;YAAE,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,GAAG,SAAS,CAAC,CAAC;IACxE,CAAC;IAED,4EAA4E;IAC5E,EAAE;IACF,uEAAuE;IACvE,mEAAmE;IACnE,4EAA4E;IAC5E,sEAAsE;IACtE,2EAA2E;IAC3E,0EAA0E;IAC1E,0CAA0C;IAE1C,MAAM,gBAAgB,GAAoB;QACxC,cAAc;QACd,eAAe;QACf,WAAW;QACX,YAAY;KACb,CAAC,CAAC,iEAAiE;IAEpE,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,MAAM,KAAK,CAAC;YAAE,SAAS;QAC3B,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,GAAG,KAAK,SAAS;YAAE,SAAS,CAAC,yCAAyC;QAC1E,WAAW,IAAI,GAAG,GAAG,MAAM,CAAC;QAC5B,eAAe,IAAI,MAAM,CAAC;IAC5B,CAAC;IAED,2EAA2E;IAC3E,uEAAuE;IACvE,IAAI,cAAc,GAChB,eAAe,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC;IAC5D,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAEpF,6EAA6E;IAC7E,8EAA8E;IAC9E,4EAA4E;IAC5E,2EAA2E;IAC3E,mEAAmE;IACnE,oCAAoC;IACpC,MAAM,YAAY,GAAG,yBAAyB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACxE,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EACvC,IAAI,CAAC,KAAK,CAAC,cAAc,GAAG,YAAY,CAAC,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAEjE,qCAAqC;IACrC,MAAM,gBAAgB,GAAuB,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACxE,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO;YACL,QAAQ,EAAE,GAAG;YACb,SAAS,EAAE,GAAG,KAAK,SAAS;YAC5B,KAAK,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI;YAC7D,kBAAkB,EAAE,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE;YACzD,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SAC5B,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAEjE,4EAA4E;IAE5E,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA4B,CAAC;IAE7D,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,wEAAwE;QACxE,qEAAqE;QACrE,sEAAsE;QACtE,IAAI,EAAE,CAAC,UAAU,KAAK,KAAK;YAAE,SAAS;QACtC,MAAM,SAAS,GAAG,kBAAkB,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,SAAS,KAAK,SAAS;YAAE,SAAS;QACtC,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,MAAM,YAAY,GAAG,CAAC,GAAmB,EAAU,EAAE;QACnD,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC,CAAC,8BAA8B;QAC9E,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3D,CAAC,CAAC;IAEF,4EAA4E;IAE5E,yEAAyE;IACzE,8DAA8D;IAC9D,MAAM,gBAAgB,GAAsB,EAAE,CAAC;IAC/C,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;gBAC9B,gBAAgB,CAAC,IAAI,CAAC;oBACpB,IAAI,EAAE,EAAE,CAAC,IAAI;oBACb,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI;oBACtB,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI;oBACtB,OAAO,EAAE,CAAC,CAAC,OAAO;iBACnB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC;IAEhD,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,eAAe,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACxD,uEAAuE;IACvE,MAAM,IAAI,GAAG,eAAe,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAe,WAAW;QACxC,CAAC,CAAC,2BAA2B;QAC7B,CAAC,CAAC,OAAO,CAAC;IAEZ,4EAA4E;IAE5E,OAAO;QACL,KAAK,EAAE,cAAc;QACrB,IAAI;QAEJ,qCAAqC;QACrC,UAAU;QACV,QAAQ;QACR,gBAAgB;QAEhB,8CAA8C;QAC9C,gBAAgB;QAChB,cAAc;QAEd,sBAAsB;QACtB,mBAAmB,EAAE,YAAY,CAAC,qBAAqB,CAAC;QACxD,kBAAkB,EAAE,YAAY,CAAC,oBAAoB,CAAC;QACtD,kBAAkB,EAAE,YAAY,CAAC,oBAAoB,CAAC;QACtD,iBAAiB,EAAE,YAAY,CAAC,mBAAmB,CAAC;QACpD,gBAAgB,EAAE,YAAY,CAAC,kBAAkB,CAAC;QAClD,aAAa,EAAE,YAAY,CAAC,eAAe,CAAC;QAC5C,YAAY,EAAE,YAAY,CAAC,cAAc,CAAC,EAAE,iCAAiC;QAC7E,aAAa,EAAE,YAAY,CAAC,eAAe,CAAC;QAC5C,gBAAgB,EAAE,YAAY,CAAC,kBAAkB,CAAC;QAClD,aAAa,EAAE,YAAY,CAAC,eAAe,CAAC;QAC5C,eAAe,EAAE,YAAY,CAAC,iBAAiB,CAAC;QAChD,gBAAgB,EAAE,YAAY,CAAC,kBAAkB,CAAC;QAClD,iBAAiB,EAAE,YAAY,CAAC,mBAAmB,CAAC;QAEpD,oEAAoE;QACpE,wDAAwD;QACxD,mBAAmB,EAAE,YAAY,CAAC,MAAM;QACxC,YAAY,EAAE,GAAG;QACjB,gBAAgB,EAAE,GAAG;QACrB,kBAAkB,EAAE,YAAY;QAEhC,WAAW;QACX,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir-ai",
-  "version": "2.89.0",
+  "version": "2.92.0",
   "description": "LLM-enhanced SAST analysis built on circle-ir",
   "main": "dist/index.js",
   "module": "dist/index.js",
@@ -98,7 +98,7 @@
     "@ax-llm/ax": "^20.0.0",
     "@cognium/project-profile-detect": "^1.1.0",
     "@mastra/core": "^1.18.0",
-    "circle-ir": "3.206.0",
+    "circle-ir": "3.212.0",
     "minimatch": "^10.2.5",
     "p-queue": "^9.1.0"
   },