Spaces:
Running
Running
| import{o as e}from"./chunk-CMxvf4Kt.js";import{t}from"./react-DrNXigiH.js";import{C as n}from"./index-Caa1r77e.js";import{t as r}from"./layout-BtJ5ShnN.js";import{a as i,c as a,o,p as s,r as c,s as l,t as u,u as d}from"./ui-Ddu9t0Or.js";import{N as f,o as p,v as m}from"./hatunDoctrine-aBQYhBQF.js";var h=e(t(),1),g=n();async function _(e){let t=new TextEncoder().encode(e),n=await crypto.subtle.digest(`SHA-256`,t);return Array.from(new Uint8Array(n)).map(e=>e.toString(16).padStart(2,`0`)).join(``)}var v=`a11oy:cavd:submitted`;function y(){try{return JSON.parse(localStorage.getItem(v)??`[]`)}catch{return[]}}function b(e){localStorage.setItem(v,JSON.stringify(e))}var x=[`intake`,`triaged`,`embargoed`,`patch-developed`,`patch-verified`,`disclosed`,`withdrawn`],S={intake:`#5e5e5e`,triaged:`#8a8a8a`,embargoed:`#c9b787`,"patch-developed":`#c9b787`,"patch-verified":`#c9b787`,disclosed:`#f5f5f5`,withdrawn:`#5e5e5e`},C=e=>new Date(e).toISOString().slice(0,10),w=e=>Math.floor((new Date(e).getTime()-Date.now())/864e5);function T(){let[e,t]=(0,h.useState)(`all`),[n,i]=(0,h.useState)(p[0].advisoryId),[o,u]=(0,h.useState)(y),f=(0,h.useMemo)(()=>{let e=o.map(e=>({advisoryId:e.advisoryId,category:e.category,severity:e.severity,stage:e.stage,agentScope:e.agentScope,reporterPartnerId:e.partnerId,receivedAt:e.receivedAt,findingHash:e.findingHash,embargoExpiresAt:e.embargoExpiresAt,defenderCreditPaid:0,notes:e.description}));return[...p,...e]},[o]),m=(0,h.useMemo)(()=>e===`all`?f:f.filter(t=>t.stage===e),[e,f]),_=f.find(e=>e.advisoryId===n)??m[0]??f[0];return(0,g.jsxs)(r,{children:[(0,g.jsx)(a,{label:`DOCTRINE · CAVD`,title:`Coordinated Agent-Vulnerability Disclosure`,subtitle:`Hash-now / disclose-later. Default policy: 90d-or-patch. Modeled on CERT/CC, CISA, ISO/IEC 29147.`,status:`LIVE`}),(0,g.jsxs)(`div`,{className:`grid grid-cols-2 sm:grid-cols-5 gap-3 mb-6`,children:[(0,g.jsx)(l,{label:`TOTAL RECORDS`,value:f.length,accent:`#c9b787`}),(0,g.jsx)(l,{label:`EMBARGOED`,value:f.filter(e=>e.stage===`embargoed`).length,sub:`hash anchored`,accent:`#c9b787`}),(0,g.jsx)(l,{label:`PATCH-VERIFIED`,value:f.filter(e=>e.stage===`patch-verified`).length,sub:`awaiting publication`,accent:`#c9b787`}),(0,g.jsx)(l,{label:`DISCLOSED`,value:f.filter(e=>e.stage===`disclosed`).length,sub:`full content public`,accent:`#f5f5f5`}),(0,g.jsx)(l,{label:`DEFAULT POLICY`,value:`90d-or-patch`,sub:`whichever is sooner`,accent:`#c9b787`})]}),(0,g.jsxs)(c,{className:`mb-6`,children:[(0,g.jsx)(d,{children:`Lifecycle`}),(0,g.jsxs)(`div`,{className:`flex items-center gap-2 flex-wrap mb-3`,children:[(0,g.jsxs)(`button`,{onClick:()=>t(`all`),className:`px-2 py-1 rounded text-xs font-mono`,style:{backgroundColor:e===`all`?`rgba(201,183,135,0.12)`:`transparent`,color:e===`all`?`#c9b787`:`var(--color-a11oy-text-sub)`,border:`1px solid var(--color-a11oy-border)`,cursor:`pointer`},children:[`ALL (`,f.length,`)`]}),x.map(n=>{let r=f.filter(e=>e.stage===n).length;return(0,g.jsxs)(`button`,{onClick:()=>t(n),className:`px-2 py-1 rounded text-xs font-mono uppercase`,style:{backgroundColor:e===n?`${S[n]}22`:`transparent`,color:e===n?S[n]:`var(--color-a11oy-text-sub)`,border:`1px solid ${e===n?S[n]:`var(--color-a11oy-border)`}`,cursor:`pointer`},children:[n,` (`,r,`)`]},n)})]})]}),(0,g.jsx)(E,{onSubmit:e=>{let t=[...o,e];u(t),b(t)},nextSequence:p.length+o.length+1}),(0,g.jsx)(D,{records:f}),(0,g.jsxs)(`div`,{className:`grid lg:grid-cols-[360px_1fr] gap-4`,children:[(0,g.jsx)(`div`,{className:`flex flex-col gap-2`,children:m.map(e=>{let t=w(e.embargoExpiresAt);return(0,g.jsxs)(`button`,{onClick:()=>i(e.advisoryId),className:`text-left rounded-lg border p-3`,style:{backgroundColor:n===e.advisoryId?`rgba(201,183,135,0.06)`:`var(--color-a11oy-card)`,borderColor:n===e.advisoryId?`rgba(201,183,135,0.3)`:`var(--color-a11oy-border)`,cursor:`pointer`},children:[(0,g.jsxs)(`div`,{className:`flex items-center gap-2 mb-1`,children:[(0,g.jsx)(`span`,{className:`text-sm font-mono font-semibold`,style:{color:`var(--color-a11oy-text)`},children:e.advisoryId}),(0,g.jsx)(s,{status:e.severity===`critical`||e.severity===`high`?`error`:e.severity===`medium`?`warn`:`info`,label:e.severity.toUpperCase()})]}),(0,g.jsxs)(`div`,{className:`text-xs`,style:{color:`var(--color-a11oy-text-sub)`},children:[e.category,` · `,e.agentScope.join(`, `)]}),(0,g.jsxs)(`div`,{className:`flex items-center justify-between mt-1`,children:[(0,g.jsx)(`span`,{className:`px-1.5 py-0.5 rounded text-xs font-mono uppercase`,style:{backgroundColor:`${S[e.stage]}22`,color:S[e.stage]},children:e.stage}),(0,g.jsx)(`span`,{className:`text-xs font-mono`,style:{color:t<0?`#f5f5f5`:`var(--color-a11oy-text-ghost)`},children:e.stage===`disclosed`||e.stage===`withdrawn`?`—`:`T${t>=0?`-`:`+`}${Math.abs(t)}d`})]})]},e.advisoryId)})}),(0,g.jsx)(O,{record:_})]})]})}function E({onSubmit:e,nextSequence:t}){let[n,r]=(0,h.useState)(!1),[i,a]=(0,h.useState)(!1),[o,l]=(0,h.useState)(null),[f,p]=(0,h.useState)(``),[v,y]=(0,h.useState)({partnerId:``,category:``,severity:`medium`,agentScope:``,description:``});return(0,h.useEffect)(()=>{if(!v.description){p(``);return}let e=!1;return _(JSON.stringify({...v,ts:`preview`})).then(t=>{e||p(`sha256:${t.slice(0,16)}...${t.slice(-8)}`)}),()=>{e=!0}},[v]),(0,g.jsxs)(c,{className:`mb-6`,children:[(0,g.jsxs)(`div`,{className:`flex items-center justify-between mb-3`,children:[(0,g.jsx)(d,{children:`Intake submission`}),(0,g.jsx)(u,{variant:`ghost`,size:`sm`,onClick:()=>r(!n),children:n?`Close`:`New intake`})]}),!n&&!o&&(0,g.jsx)(`p`,{className:`text-xs`,style:{color:`var(--color-a11oy-text-ghost)`,lineHeight:1.7},children:`Submit a new agent-vulnerability finding. The finding is hash-anchored at receive time via SHA-256, placed under 90-day embargo, and dual-approved by the Glasswing partner and A11oy operations. Click "New intake" to begin.`}),n&&!o&&(0,g.jsxs)(`div`,{className:`grid sm:grid-cols-2 gap-3`,children:[(0,g.jsxs)(`div`,{children:[(0,g.jsx)(`label`,{className:`block text-xs font-mono mb-1`,style:{color:`var(--color-a11oy-text-ghost)`},children:`Reporter partner`}),(0,g.jsxs)(`select`,{value:v.partnerId,onChange:e=>y({...v,partnerId:e.target.value}),className:`w-full text-xs p-2 rounded border bg-transparent`,style:{borderColor:`var(--color-a11oy-border)`,color:`var(--color-a11oy-text)`},children:[(0,g.jsx)(`option`,{value:``,children:`Select partner...`}),m.filter(e=>e.stage===`active`).map(e=>(0,g.jsx)(`option`,{value:e.id,children:e.name},e.id))]})]}),(0,g.jsxs)(`div`,{children:[(0,g.jsx)(`label`,{className:`block text-xs font-mono mb-1`,style:{color:`var(--color-a11oy-text-ghost)`},children:`Category`}),(0,g.jsxs)(`select`,{value:v.category,onChange:e=>y({...v,category:e.target.value}),className:`w-full text-xs p-2 rounded border bg-transparent`,style:{borderColor:`var(--color-a11oy-border)`,color:`var(--color-a11oy-text)`},children:[(0,g.jsx)(`option`,{value:``,children:`Select...`}),(0,g.jsx)(`option`,{value:`prompt-injection`,children:`prompt-injection`}),(0,g.jsx)(`option`,{value:`indirect-injection`,children:`indirect-injection`}),(0,g.jsx)(`option`,{value:`data-exfiltration`,children:`data-exfiltration`}),(0,g.jsx)(`option`,{value:`tool-misuse`,children:`tool-misuse`}),(0,g.jsx)(`option`,{value:`scope-escape`,children:`scope-escape`}),(0,g.jsx)(`option`,{value:`policy-bypass`,children:`policy-bypass`}),(0,g.jsx)(`option`,{value:`covert-channel`,children:`covert-channel`}),(0,g.jsx)(`option`,{value:`snapshot-tampering`,children:`snapshot-tampering`}),(0,g.jsx)(`option`,{value:`supply-chain`,children:`supply-chain`}),(0,g.jsx)(`option`,{value:`auth-bypass`,children:`auth-bypass`}),(0,g.jsx)(`option`,{value:`other`,children:`other`})]})]}),(0,g.jsxs)(`div`,{children:[(0,g.jsx)(`label`,{className:`block text-xs font-mono mb-1`,style:{color:`var(--color-a11oy-text-ghost)`},children:`Severity`}),(0,g.jsx)(`select`,{value:v.severity,onChange:e=>y({...v,severity:e.target.value}),className:`w-full text-xs p-2 rounded border bg-transparent`,style:{borderColor:`var(--color-a11oy-border)`,color:`var(--color-a11oy-text)`},children:[`critical`,`high`,`medium`,`low`].map(e=>(0,g.jsx)(`option`,{value:e,children:e},e))})]}),(0,g.jsxs)(`div`,{children:[(0,g.jsx)(`label`,{className:`block text-xs font-mono mb-1`,style:{color:`var(--color-a11oy-text-ghost)`},children:`Agent scope`}),(0,g.jsx)(`input`,{value:v.agentScope,onChange:e=>y({...v,agentScope:e.target.value}),placeholder:`op-cascade, op-counsel`,className:`w-full text-xs p-2 rounded border bg-transparent`,style:{borderColor:`var(--color-a11oy-border)`,color:`var(--color-a11oy-text)`}})]}),(0,g.jsxs)(`div`,{className:`sm:col-span-2`,children:[(0,g.jsx)(`label`,{className:`block text-xs font-mono mb-1`,style:{color:`var(--color-a11oy-text-ghost)`},children:`Finding description`}),(0,g.jsx)(`textarea`,{value:v.description,onChange:e=>y({...v,description:e.target.value}),rows:3,placeholder:`Describe the vulnerability finding...`,className:`w-full text-xs p-2 rounded border bg-transparent resize-none`,style:{borderColor:`var(--color-a11oy-border)`,color:`var(--color-a11oy-text)`}})]}),(0,g.jsxs)(`div`,{className:`sm:col-span-2 flex items-center justify-between`,children:[(0,g.jsxs)(`span`,{className:`text-xs font-mono`,style:{color:`var(--color-a11oy-text-ghost)`},children:[`SHA-256 anchor: `,(0,g.jsx)(`span`,{style:{color:`#c9b787`},children:f||`—`})]}),(0,g.jsx)(u,{variant:`primary`,size:`sm`,onClick:async()=>{a(!0);let n=new Date,i=n.toISOString(),o=`sha256:${await _(JSON.stringify({...v,ts:n.getTime()}))}`,s=new Date(n);s.setDate(s.getDate()+90),e({advisoryId:`CAVD-${n.getFullYear()}-${String(t).padStart(4,`0`)}`,partnerId:v.partnerId,category:v.category,severity:v.severity,agentScope:v.agentScope.split(`,`).map(e=>e.trim()).filter(Boolean),description:v.description,findingHash:o,receivedAt:i,embargoExpiresAt:s.toISOString(),stage:`intake`}),l(o),a(!1),setTimeout(()=>{l(null),r(!1),y({partnerId:``,category:``,severity:`medium`,agentScope:``,description:``})},4e3)},disabled:!v.partnerId||!v.category||!v.description||i,children:i?`Anchoring…`:`Hash & submit`})]})]}),o&&(0,g.jsxs)(`div`,{className:`flex flex-col gap-2 p-3 rounded`,style:{backgroundColor:`rgba(201,183,135,0.06)`,border:`1px solid rgba(201,183,135,0.2)`},children:[(0,g.jsxs)(`div`,{className:`flex items-center gap-2`,children:[(0,g.jsx)(s,{status:`ok`,label:`ANCHORED`}),(0,g.jsx)(`span`,{className:`text-xs`,style:{color:`var(--color-a11oy-text-sub)`},children:`Finding hash-anchored via SHA-256. 90-day embargo started. Dual-approval required before disclosure.`})]}),(0,g.jsx)(`span`,{className:`text-xs font-mono break-all`,style:{color:`#c9b787`},children:o})]})]})}function D({records:e}){let t=e.filter(e=>e.stage===`embargoed`||e.stage===`patch-developed`||e.stage===`patch-verified`||e.stage===`intake`);return t.length===0?null:(0,g.jsxs)(c,{className:`mb-6`,children:[(0,g.jsx)(d,{children:`Embargo automation — active countdowns`}),(0,g.jsx)(`div`,{className:`flex flex-col gap-2`,children:t.map(e=>{let t=Math.floor((new Date(e.embargoExpiresAt).getTime()-Date.now())/864e5),n=Math.max(0,Math.min(100,(90-Math.max(0,t))/90*100));return(0,g.jsxs)(`div`,{className:`flex items-center gap-3 p-2 rounded border`,style:{borderColor:`var(--color-a11oy-border)`},children:[(0,g.jsx)(`span`,{className:`text-xs font-mono font-semibold w-32 shrink-0`,style:{color:`var(--color-a11oy-text)`},children:e.advisoryId}),(0,g.jsx)(`div`,{className:`flex-1 h-2 rounded-full overflow-hidden`,style:{backgroundColor:`rgba(201,183,135,0.08)`},children:(0,g.jsx)(`div`,{className:`h-full rounded-full`,style:{width:`${n}%`,backgroundColor:t<14?`#f5f5f5`:`#c9b787`,transition:`width 0.3s`}})}),(0,g.jsx)(`span`,{className:`text-xs font-mono w-20 text-right`,style:{color:t<14?`#f5f5f5`:`var(--color-a11oy-text-ghost)`},children:t<0?`expired ${Math.abs(t)}d ago`:`${t}d left`}),(0,g.jsx)(`span`,{className:`text-xs font-mono px-1.5 py-0.5 rounded`,style:{backgroundColor:`${S[e.stage]}22`,color:S[e.stage]},children:e.stage===`patch-verified`?`ready`:e.stage.replace(`-`,` `)})]},e.advisoryId)})}),(0,g.jsx)(`p`,{className:`text-xs mt-3`,style:{color:`var(--color-a11oy-text-ghost)`,lineHeight:1.7},children:`Policy: auto-disclose at embargo expiry or patch verification — whichever is sooner. Dual-approval (partner + A11oy ops) required before early disclosure.`})]})}function O({record:e}){let t=f(e.reporterPartnerId),n=e.stage===`disclosed`,r=x.indexOf(e.stage);return(0,g.jsxs)(`div`,{className:`flex flex-col gap-4`,children:[(0,g.jsxs)(c,{children:[(0,g.jsxs)(`div`,{className:`flex items-start justify-between gap-3 mb-3`,children:[(0,g.jsxs)(`div`,{children:[(0,g.jsxs)(`div`,{className:`flex items-center gap-2 mb-1`,children:[(0,g.jsx)(`span`,{className:`text-base font-mono font-semibold`,style:{color:`var(--color-a11oy-text)`},children:e.advisoryId}),(0,g.jsx)(`span`,{className:`px-1.5 py-0.5 rounded text-xs font-mono uppercase`,style:{backgroundColor:`${S[e.stage]}22`,color:S[e.stage]},children:e.stage}),(0,g.jsx)(s,{status:e.severity===`critical`||e.severity===`high`?`error`:e.severity===`medium`?`warn`:`info`,label:e.severity.toUpperCase()})]}),(0,g.jsxs)(`div`,{className:`text-xs`,style:{color:`var(--color-a11oy-text-ghost)`},children:[e.category,` · agents: `,(0,g.jsx)(`span`,{className:`font-mono`,children:e.agentScope.join(`, `)})]})]}),(0,g.jsxs)(`div`,{className:`flex gap-2`,children:[e.stage!==`disclosed`&&e.stage!==`withdrawn`&&(0,g.jsx)(u,{variant:`ghost`,size:`sm`,children:`Advance`}),e.stage===`patch-verified`&&(0,g.jsx)(u,{variant:`primary`,size:`sm`,children:`Disclose`})]})]}),(0,g.jsx)(`div`,{className:`text-xs font-mono mb-2`,style:{color:`var(--color-a11oy-text-ghost)`},children:`LIFECYCLE`}),(0,g.jsx)(`div`,{className:`flex items-center gap-1`,children:x.slice(0,6).map((e,t)=>{let n=t<=r;return(0,g.jsxs)(`div`,{className:`flex items-center flex-1`,children:[(0,g.jsx)(`div`,{className:`px-2 py-0.5 rounded-full text-xs font-mono uppercase`,style:{backgroundColor:n?`${S[e]}22`:`transparent`,color:n?S[e]:`var(--color-a11oy-text-ghost)`,border:`1px solid ${n?S[e]:`var(--color-a11oy-border)`}`},children:e.replace(`-`,` `)}),t<5&&(0,g.jsx)(`div`,{className:`flex-1 h-px mx-1`,style:{backgroundColor:t<r?`#c9b787`:`var(--color-a11oy-border)`}})]},e)})})]}),(0,g.jsxs)(c,{children:[(0,g.jsx)(d,{children:`Intake (hash anchored at receive time)`}),(0,g.jsx)(o,{label:`reporter`,value:(0,g.jsxs)(g.Fragment,{children:[(0,g.jsx)(`span`,{className:`font-mono`,children:e.reporterPartnerId}),t?(0,g.jsxs)(`span`,{style:{color:`var(--color-a11oy-text-ghost)`},children:[` · `,t.name]}):null]})}),(0,g.jsx)(o,{label:`received`,value:C(e.receivedAt)}),(0,g.jsx)(o,{label:`findingHash`,value:(0,g.jsx)(i,{id:e.findingHash})}),(0,g.jsx)(o,{label:`embargo policy`,value:(0,g.jsx)(`span`,{className:`font-mono`,children:`90d-or-patch`})}),(0,g.jsx)(o,{label:`embargo expires`,value:C(e.embargoExpiresAt)})]}),e.patchedSnapshotRef&&(0,g.jsxs)(c,{children:[(0,g.jsx)(d,{children:`Patch verification`}),(0,g.jsx)(o,{label:`patched snapshot`,value:(0,g.jsx)(i,{id:e.patchedSnapshotRef})})]}),n&&e.publicSummary?(0,g.jsxs)(c,{children:[(0,g.jsx)(d,{children:`Public summary`}),(0,g.jsx)(`p`,{className:`text-xs`,style:{color:`var(--color-a11oy-text-sub)`,lineHeight:1.7},children:e.publicSummary})]}):(0,g.jsxs)(c,{children:[(0,g.jsx)(d,{children:`Public summary`}),(0,g.jsx)(`p`,{className:`text-xs`,style:{color:`var(--color-a11oy-text-ghost)`,lineHeight:1.7},children:`Embargoed. The finding hash above is the cryptographic anchor. Full content publishes at embargo expiry or patch verification — whichever is sooner.`})]}),(0,g.jsxs)(c,{children:[(0,g.jsx)(d,{children:`Notes`}),(0,g.jsx)(`p`,{className:`text-xs`,style:{color:`var(--color-a11oy-text-sub)`,lineHeight:1.7},children:e.notes})]})]})}export{T as CAVD}; |