import{r as x,k as e}from"./index-BVfpSx5Q.js";import{L as $}from"./layout-NiehYZnq.js";import{P,K as b,C as h,S as g,f as I,A as f,I as u,H as k}from"./ui-DGkmnhL-.js";import{c as C,G as F,v as L}from"./hatunDoctrine-Cq1LMtli.js";async function D(t){const c=new TextEncoder().encode(t),r=await crypto.subtle.digest("SHA-256",c);return Array.from(new Uint8Array(r)).map(n=>n.toString(16).padStart(2,"0")).join("")}const H="a11oy:cavd:submitted";function M(){try{return JSON.parse(localStorage.getItem(H)??"[]")}catch{return[]}}function V(t){localStorage.setItem(H,JSON.stringify(t))}const w=["intake","triaged","embargoed","patch-developed","patch-verified","disclosed","withdrawn"],d={intake:"#5e5e5e",triaged:"#8a8a8a",embargoed:"#c9b787","patch-developed":"#c9b787","patch-verified":"#c9b787",disclosed:"#f5f5f5",withdrawn:"#5e5e5e"},E=t=>new Date(t).toISOString().slice(0,10),G=t=>Math.floor((new Date(t).getTime()-Date.now())/864e5);function W(){const[t,c]=x.useState("all"),[r,n]=x.useState(C[0].advisoryId),[i,p]=x.useState(M),l=x.useMemo(()=>{const s=i.map(a=>({advisoryId:a.advisoryId,category:a.category,severity:a.severity,stage:a.stage,agentScope:a.agentScope,reporterPartnerId:a.partnerId,receivedAt:a.receivedAt,findingHash:a.findingHash,embargoExpiresAt:a.embargoExpiresAt,defenderCreditPaid:0,notes:a.description}));return[...C,...s]},[i]),v=x.useMemo(()=>t==="all"?l:l.filter(s=>s.stage===t),[t,l]),j=l.find(s=>s.advisoryId===r)??v[0]??l[0];return e.jsxs($,{children:[e.jsx(P,{label:"DOCTRINE · CAVD",title:"Coordinated Agent-Vulnerability Disclosure",subtitle:"Hash-now / disclose-later. Default policy: 90d-or-patch. Modeled on CERT/CC, CISA, ISO/IEC 29147.",status:"LIVE"}),e.jsxs("div",{className:"grid grid-cols-2 sm:grid-cols-5 gap-3 mb-6",children:[e.jsx(b,{label:"TOTAL RECORDS",value:l.length,accent:"#c9b787"}),e.jsx(b,{label:"EMBARGOED",value:l.filter(s=>s.stage==="embargoed").length,sub:"hash anchored",accent:"#c9b787"}),e.jsx(b,{label:"PATCH-VERIFIED",value:l.filter(s=>s.stage==="patch-verified").length,sub:"awaiting publication",accent:"#c9b787"}),e.jsx(b,{label:"DISCLOSED",value:l.filter(s=>s.stage==="disclosed").length,sub:"full content public",accent:"#f5f5f5"}),e.jsx(b,{label:"DEFAULT POLICY",value:"90d-or-patch",sub:"whichever is sooner",accent:"#c9b787"})]}),e.jsxs(h,{className:"mb-6",children:[e.jsx(g,{children:"Lifecycle"}),e.jsxs("div",{className:"flex items-center gap-2 flex-wrap mb-3",children:[e.jsxs("button",{onClick:()=>c("all"),className:"px-2 py-1 rounded text-xs font-mono",style:{backgroundColor:t==="all"?"rgba(201,183,135,0.12)":"transparent",color:t==="all"?"#c9b787":"var(--color-a11oy-text-sub)",border:"1px solid var(--color-a11oy-border)",cursor:"pointer"},children:["ALL (",l.length,")"]}),w.map(s=>{const a=l.filter(m=>m.stage===s).length;return e.jsxs("button",{onClick:()=>c(s),className:"px-2 py-1 rounded text-xs font-mono uppercase",style:{backgroundColor:t===s?`${d[s]}22`:"transparent",color:t===s?d[s]:"var(--color-a11oy-text-sub)",border:`1px solid ${t===s?d[s]:"var(--color-a11oy-border)"}`,cursor:"pointer"},children:[s," (",a,")"]},s)})]})]}),e.jsx(_,{onSubmit:s=>{const a=[...i,s];p(a),V(a)},nextSequence:C.length+i.length+1}),e.jsx(z,{records:l}),e.jsxs("div",{className:"grid lg:grid-cols-[360px_1fr] gap-4",children:[e.jsx("div",{className:"flex flex-col gap-2",children:v.map(s=>{const a=G(s.embargoExpiresAt);return e.jsxs("button",{onClick:()=>n(s.advisoryId),className:"text-left rounded-lg border p-3",style:{backgroundColor:r===s.advisoryId?"rgba(201,183,135,0.06)":"var(--color-a11oy-card)",borderColor:r===s.advisoryId?"rgba(201,183,135,0.3)":"var(--color-a11oy-border)",cursor:"pointer"},children:[e.jsxs("div",{className:"flex items-center gap-2 mb-1",children:[e.jsx("span",{className:"text-sm font-mono font-semibold",style:{color:"var(--color-a11oy-text)"},children:s.advisoryId}),e.jsx(I,{status:s.severity==="critical"||s.severity==="high"?"error":s.severity==="medium"?"warn":"info",label:s.severity.toUpperCase()})]}),e.jsxs("div",{className:"text-xs",style:{color:"var(--color-a11oy-text-sub)"},children:[s.category," · ",s.agentScope.join(", ")]}),e.jsxs("div",{className:"flex items-center justify-between mt-1",children:[e.jsx("span",{className:"px-1.5 py-0.5 rounded text-xs font-mono uppercase",style:{backgroundColor:`${d[s.stage]}22`,color:d[s.stage]},children:s.stage}),e.jsx("span",{className:"text-xs font-mono",style:{color:a<0?"#f5f5f5":"var(--color-a11oy-text-ghost)"},children:s.stage==="disclosed"||s.stage==="withdrawn"?"—":`T${a>=0?"-":"+"}${Math.abs(a)}d`})]})]},s.advisoryId)})}),e.jsx(B,{record:j})]})]})}function _({onSubmit:t,nextSequence:c}){const[r,n]=x.useState(!1),[i,p]=x.useState(!1),[l,v]=x.useState(null),[j,s]=x.useState(""),[a,m]=x.useState({partnerId:"",category:"",severity:"medium",agentScope:"",description:""});x.useEffect(()=>{if(!a.description){s("");return}let o=!1;const N=JSON.stringify({...a,ts:"preview"});return D(N).then(y=>{o||s(`sha256:${y.slice(0,16)}...${y.slice(-8)}`)}),()=>{o=!0}},[a]);const O=async()=>{p(!0);const o=new Date,N=o.toISOString(),y=JSON.stringify({...a,ts:o.getTime()}),A=`sha256:${await D(y)}`,S=new Date(o);S.setDate(S.getDate()+90);const R={advisoryId:`CAVD-${o.getFullYear()}-${String(c).padStart(4,"0")}`,partnerId:a.partnerId,category:a.category,severity:a.severity,agentScope:a.agentScope.split(",").map(T=>T.trim()).filter(Boolean),description:a.description,findingHash:A,receivedAt:N,embargoExpiresAt:S.toISOString(),stage:"intake"};t(R),v(A),p(!1),setTimeout(()=>{v(null),n(!1),m({partnerId:"",category:"",severity:"medium",agentScope:"",description:""})},4e3)};return e.jsxs(h,{className:"mb-6",children:[e.jsxs("div",{className:"flex items-center justify-between mb-3",children:[e.jsx(g,{children:"Intake submission"}),e.jsx(f,{variant:"ghost",size:"sm",onClick:()=>n(!r),children:r?"Close":"New intake"})]}),!r&&!l&&e.jsx("p",{className:"text-xs",style:{color:"var(--color-a11oy-text-ghost)",lineHeight:1.7},children:'Submit a new agent-vulnerability finding. The finding is hash-anchored at receive time via SHA-256, placed under 90-day embargo, and dual-approved by the Glasswing partner and A11oy operations. Click "New intake" to begin.'}),r&&!l&&e.jsxs("div",{className:"grid sm:grid-cols-2 gap-3",children:[e.jsxs("div",{children:[e.jsx("label",{className:"block text-xs font-mono mb-1",style:{color:"var(--color-a11oy-text-ghost)"},children:"Reporter partner"}),e.jsxs("select",{value:a.partnerId,onChange:o=>m({...a,partnerId:o.target.value}),className:"w-full text-xs p-2 rounded border bg-transparent",style:{borderColor:"var(--color-a11oy-border)",color:"var(--color-a11oy-text)"},children:[e.jsx("option",{value:"",children:"Select partner..."}),F.filter(o=>o.stage==="active").map(o=>e.jsx("option",{value:o.id,children:o.name},o.id))]})]}),e.jsxs("div",{children:[e.jsx("label",{className:"block text-xs font-mono mb-1",style:{color:"var(--color-a11oy-text-ghost)"},children:"Category"}),e.jsxs("select",{value:a.category,onChange:o=>m({...a,category:o.target.value}),className:"w-full text-xs p-2 rounded border bg-transparent",style:{borderColor:"var(--color-a11oy-border)",color:"var(--color-a11oy-text)"},children:[e.jsx("option",{value:"",children:"Select..."}),e.jsx("option",{value:"prompt-injection",children:"prompt-injection"}),e.jsx("option",{value:"indirect-injection",children:"indirect-injection"}),e.jsx("option",{value:"data-exfiltration",children:"data-exfiltration"}),e.jsx("option",{value:"tool-misuse",children:"tool-misuse"}),e.jsx("option",{value:"scope-escape",children:"scope-escape"}),e.jsx("option",{value:"policy-bypass",children:"policy-bypass"}),e.jsx("option",{value:"covert-channel",children:"covert-channel"}),e.jsx("option",{value:"snapshot-tampering",children:"snapshot-tampering"}),e.jsx("option",{value:"supply-chain",children:"supply-chain"}),e.jsx("option",{value:"auth-bypass",children:"auth-bypass"}),e.jsx("option",{value:"other",children:"other"})]})]}),e.jsxs("div",{children:[e.jsx("label",{className:"block text-xs font-mono mb-1",style:{color:"var(--color-a11oy-text-ghost)"},children:"Severity"}),e.jsx("select",{value:a.severity,onChange:o=>m({...a,severity:o.target.value}),className:"w-full text-xs p-2 rounded border bg-transparent",style:{borderColor:"var(--color-a11oy-border)",color:"var(--color-a11oy-text)"},children:["critical","high","medium","low"].map(o=>e.jsx("option",{value:o,children:o},o))})]}),e.jsxs("div",{children:[e.jsx("label",{className:"block text-xs font-mono mb-1",style:{color:"var(--color-a11oy-text-ghost)"},children:"Agent scope"}),e.jsx("input",{value:a.agentScope,onChange:o=>m({...a,agentScope:o.target.value}),placeholder:"op-cascade, op-counsel",className:"w-full text-xs p-2 rounded border bg-transparent",style:{borderColor:"var(--color-a11oy-border)",color:"var(--color-a11oy-text)"}})]}),e.jsxs("div",{className:"sm:col-span-2",children:[e.jsx("label",{className:"block text-xs font-mono mb-1",style:{color:"var(--color-a11oy-text-ghost)"},children:"Finding description"}),e.jsx("textarea",{value:a.description,onChange:o=>m({...a,description:o.target.value}),rows:3,placeholder:"Describe the vulnerability finding...",className:"w-full text-xs p-2 rounded border bg-transparent resize-none",style:{borderColor:"var(--color-a11oy-border)",color:"var(--color-a11oy-text)"}})]}),e.jsxs("div",{className:"sm:col-span-2 flex items-center justify-between",children:[e.jsxs("span",{className:"text-xs font-mono",style:{color:"var(--color-a11oy-text-ghost)"},children:["SHA-256 anchor: ",e.jsx("span",{style:{color:"#c9b787"},children:j||"—"})]}),e.jsx(f,{variant:"primary",size:"sm",onClick:O,disabled:!a.partnerId||!a.category||!a.description||i,children:i?"Anchoring…":"Hash & submit"})]})]}),l&&e.jsxs("div",{className:"flex flex-col gap-2 p-3 rounded",style:{backgroundColor:"rgba(201,183,135,0.06)",border:"1px solid rgba(201,183,135,0.2)"},children:[e.jsxs("div",{className:"flex items-center gap-2",children:[e.jsx(I,{status:"ok",label:"ANCHORED"}),e.jsx("span",{className:"text-xs",style:{color:"var(--color-a11oy-text-sub)"},children:"Finding hash-anchored via SHA-256. 90-day embargo started. Dual-approval required before disclosure."})]}),e.jsx("span",{className:"text-xs font-mono break-all",style:{color:"#c9b787"},children:l})]})]})}function z({records:t}){const c=t.filter(r=>r.stage==="embargoed"||r.stage==="patch-developed"||r.stage==="patch-verified"||r.stage==="intake");return c.length===0?null:e.jsxs(h,{className:"mb-6",children:[e.jsx(g,{children:"Embargo automation — active countdowns"}),e.jsx("div",{className:"flex flex-col gap-2",children:c.map(r=>{const n=Math.floor((new Date(r.embargoExpiresAt).getTime()-Date.now())/864e5),i=Math.max(0,Math.min(100,(90-Math.max(0,n))/90*100));return e.jsxs("div",{className:"flex items-center gap-3 p-2 rounded border",style:{borderColor:"var(--color-a11oy-border)"},children:[e.jsx("span",{className:"text-xs font-mono font-semibold w-32 shrink-0",style:{color:"var(--color-a11oy-text)"},children:r.advisoryId}),e.jsx("div",{className:"flex-1 h-2 rounded-full overflow-hidden",style:{backgroundColor:"rgba(201,183,135,0.08)"},children:e.jsx("div",{className:"h-full rounded-full",style:{width:`${i}%`,backgroundColor:n<14?"#f5f5f5":"#c9b787",transition:"width 0.3s"}})}),e.jsx("span",{className:"text-xs font-mono w-20 text-right",style:{color:n<14?"#f5f5f5":"var(--color-a11oy-text-ghost)"},children:n<0?`expired ${Math.abs(n)}d ago`:`${n}d left`}),e.jsx("span",{className:"text-xs font-mono px-1.5 py-0.5 rounded",style:{backgroundColor:`${d[r.stage]}22`,color:d[r.stage]},children:r.stage==="patch-verified"?"ready":r.stage.replace("-"," ")})]},r.advisoryId)})}),e.jsx("p",{className:"text-xs mt-3",style:{color:"var(--color-a11oy-text-ghost)",lineHeight:1.7},children:"Policy: auto-disclose at embargo expiry or patch verification — whichever is sooner. Dual-approval (partner + A11oy ops) required before early disclosure."})]})}function B({record:t}){const c=L(t.reporterPartnerId),r=t.stage==="disclosed",n=w.indexOf(t.stage);return e.jsxs("div",{className:"flex flex-col gap-4",children:[e.jsxs(h,{children:[e.jsxs("div",{className:"flex items-start justify-between gap-3 mb-3",children:[e.jsxs("div",{children:[e.jsxs("div",{className:"flex items-center gap-2 mb-1",children:[e.jsx("span",{className:"text-base font-mono font-semibold",style:{color:"var(--color-a11oy-text)"},children:t.advisoryId}),e.jsx("span",{className:"px-1.5 py-0.5 rounded text-xs font-mono uppercase",style:{backgroundColor:`${d[t.stage]}22`,color:d[t.stage]},children:t.stage}),e.jsx(I,{status:t.severity==="critical"||t.severity==="high"?"error":t.severity==="medium"?"warn":"info",label:t.severity.toUpperCase()})]}),e.jsxs("div",{className:"text-xs",style:{color:"var(--color-a11oy-text-ghost)"},children:[t.category," · agents: ",e.jsx("span",{className:"font-mono",children:t.agentScope.join(", ")})]})]}),e.jsxs("div",{className:"flex gap-2",children:[t.stage!=="disclosed"&&t.stage!=="withdrawn"&&e.jsx(f,{variant:"ghost",size:"sm",children:"Advance"}),t.stage==="patch-verified"&&e.jsx(f,{variant:"primary",size:"sm",children:"Disclose"})]})]}),e.jsx("div",{className:"text-xs font-mono mb-2",style:{color:"var(--color-a11oy-text-ghost)"},children:"LIFECYCLE"}),e.jsx("div",{className:"flex items-center gap-1",children:w.slice(0,6).map((i,p)=>{const l=p<=n;return e.jsxs("div",{className:"flex items-center flex-1",children:[e.jsx("div",{className:"px-2 py-0.5 rounded-full text-xs font-mono uppercase",style:{backgroundColor:l?`${d[i]}22`:"transparent",color:l?d[i]:"var(--color-a11oy-text-ghost)",border:`1px solid ${l?d[i]:"var(--color-a11oy-border)"}`},children:i.replace("-"," ")}),p<5&&e.jsx("div",{className:"flex-1 h-px mx-1",style:{backgroundColor:p<n?"#c9b787":"var(--color-a11oy-border)"}})]},i)})})]}),e.jsxs(h,{children:[e.jsx(g,{children:"Intake (hash anchored at receive time)"}),e.jsx(u,{label:"reporter",value:e.jsxs(e.Fragment,{children:[e.jsx("span",{className:"font-mono",children:t.reporterPartnerId}),c?e.jsxs("span",{style:{color:"var(--color-a11oy-text-ghost)"},children:[" · ",c.name]}):null]})}),e.jsx(u,{label:"received",value:E(t.receivedAt)}),e.jsx(u,{label:"findingHash",value:e.jsx(k,{id:t.findingHash})}),e.jsx(u,{label:"embargo policy",value:e.jsx("span",{className:"font-mono",children:"90d-or-patch"})}),e.jsx(u,{label:"embargo expires",value:E(t.embargoExpiresAt)})]}),t.patchedSnapshotRef&&e.jsxs(h,{children:[e.jsx(g,{children:"Patch verification"}),e.jsx(u,{label:"patched snapshot",value:e.jsx(k,{id:t.patchedSnapshotRef})})]}),r&&t.publicSummary?e.jsxs(h,{children:[e.jsx(g,{children:"Public summary"}),e.jsx("p",{className:"text-xs",style:{color:"var(--color-a11oy-text-sub)",lineHeight:1.7},children:t.publicSummary})]}):e.jsxs(h,{children:[e.jsx(g,{children:"Public summary"}),e.jsx("p",{className:"text-xs",style:{color:"var(--color-a11oy-text-ghost)",lineHeight:1.7},children:"Embargoed. The finding hash above is the cryptographic anchor. Full content publishes at embargo expiry or patch verification — whichever is sooner."})]}),e.jsxs(h,{children:[e.jsx(g,{children:"Notes"}),e.jsx("p",{className:"text-xs",style:{color:"var(--color-a11oy-text-sub)",lineHeight:1.7},children:t.notes})]})]})}export{W as CAVD};