{"schemaVersion":1,"status":{"id":"9e612bd1-a088-48e1-b960-d94d6a5d828c","scanId":"b6a8296e-7ef3-42cf-afcc-b2f80b305518","invalidatedAt":null,"invalidationReason":null,"replacedBy":null,"snapshotAvailable":true,"policyAllowed":true,"createdAt":"2026-10-09T13:50:44.356Z","observationRevision":0,"previousScanId":null,"previousReportId":null,"current":true},"report":{"schemaVersion":1,"id":"9e612bd1-a088-48e1-b960-d94d6a5d828c","scanId":"b6a8296e-7ef3-42cf-afcc-b2f80b305518","classifierRevision":"classifier_v2","observedAt":"2026-10-09T13:50:42.899Z","classifiedAt":"2026-10-09T13:50:44.359Z","artifact":{"name":"pg","version":"8.23.1","integrity":"sha512-aL96AHANtWjPLDOLqnhx+ngp9+UK7ETEU8VJrDCGvsSSi/mGLcWYsS6Herg7lmaBJe4uwrfqsa7gTEFaSizDoQ==","tarballUrl":"https://registry.npmjs.org/pg/-/pg-8.23.1.tgz"},"preparation":{"id":"95e2410c-b68d-4383-abd3-db35064c0b39","outcome":"pass","failure":null,"profileRevision":"npm_11_19_0_linux_amd64_v2","snapshot":{"id":"bb6f8163-1c38-4f83-af49-49189f141629","generation":"6d79bdfe-13cf-49e4-8078-42a970997c32","lockDigest":"642e44b718824adbfa5c06056ec8277022b46a2a070c40beab51b85db2e43481","treeDigest":"6a265cc9c9c431d1b41174d28bb51376c5d06783adebcf9149c8223affca5688","profileRevision":"npm_11_19_0_linux_amd64_v2","installerImage":"node:24.21.0-bookworm-slim@sha256:5cbc7caba8c2c0f0bca675d1b61b9f2857e1cf1853c6164ee9dd409501a936e7"},"installedCount":14,"omittedOptionalCount":0,"staticObservations":{"native":{"count":0,"paths":[],"buildIndicators":[],"prerequisiteProven":false},"declared":{"main":"./lib","engines":{"node":">= 16.0.0"},"exports":{".":{"import":"./esm/index.mjs","default":"./lib/index.js","require":"./lib/index.js"},"./lib/*":"./lib/*.js","./lib/*.js":"./lib/*.js","./package.json":{"default":"./package.json"}},"scripts":{"test":"make test-all"},"dependencies":{"pgpass":"1.0.5","pg-pool":"^3.14.0","pg-types":"2.2.0","pg-protocol":"^1.16.1","pg-connection-string":"^2.14.1"},"devDependencies":{"co":"4.6.0","async":"2.6.4","vitest":"~3.0.9","bluebird":"3.7.2","wrangler":"^3.x","typescript":"^6.0.3","pg-copy-streams":"0.3.0","@cloudflare/workers-types":"^4.20230404.0","@cloudflare/vitest-pool-workers":"0.8.23"},"peerDependencies":{"pg-native":">=3.0.1"},"optionalDependencies":{"pg-cloudflare":"^1.4.1"},"peerDependenciesMeta":{"pg-native":{"optional":true}}},"platform":{"os":true,"cpu":true,"libc":true},"evidenceLevel":"static_only","lifecycleScripts":[]}},"matrix":{"id":"bfab88d7-3f4a-41b5-97a9-5aafd5bda511","revision":"production_ab51508deb208994caf81cb80f14b800","platform":"linux_amd64_glibc","harnessRevision":"load_v2","planRevision":"explicit_exports_v1","policyRevision":"runtime_limits_v2","images":[{"profileId":"node_24_21_0","kind":"node","version":"24.21.0","imageId":"sha256:f2fcbb4dfbd6d5f57f4e43de97e70182d9982ac7cc0cc063dfff2cf1759a411d","builtAt":"2026-10-04T15:20:38.392Z","sourceImage":"node:24.21.0-bookworm-slim@sha256:5cbc7caba8c2c0f0bca675d1b61b9f2857e1cf1853c6164ee9dd409501a936e7","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"node_26_10_0","kind":"node","version":"26.10.0","imageId":"sha256:9c1c93cc35d1408d26a61c4efccbde37c35425e362a2e723b885c3333d2be073","builtAt":"2026-10-04T15:20:47.161Z","sourceImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"bun_1_4_2","kind":"bun","version":"1.4.2","imageId":"sha256:2343363679fb92d59a395ff081b783b5514f06295b1bc6d61baaeef17e793789","builtAt":"2026-10-04T15:21:07.160Z","sourceImage":"oven/bun:1.4.2-debian@sha256:53710ce0f14eef8312521c586a7ae1d9aeab4011840f09f1966073b68fc2e2ab","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"},{"profileId":"deno_2_9_7","kind":"deno","version":"2.9.7","imageId":"sha256:4292bb23555f98fb9dfc30fb447daa1c301686d89264fd8643ccb86bc0d53c29","builtAt":"2026-10-04T15:21:22.570Z","sourceImage":"denoland/deno:debian-2.9.7@sha256:869d374bdaddda4fde029c492d7219199b0e821c2c53cca5357b3a6f5b9336fc","baseImage":"gcr.io/distroless/cc-debian13:nonroot@sha256:20afe6a70f2565277b704cc17289cb557f353a3619f6350f52a2317106598df4","supportImage":"node:26.10.0-bookworm-slim@sha256:0a992e1420e2d70611578f1844a6f10a9d11fe6bb535aabf72efe3007f13d79b","platform":"linux_amd64_glibc","recipeRevision":"runtime_image_v1"}]},"omissions":{"counts":{"pattern":2,"non_executable":1,"not_exported":0,"invalid_subpath":0,"coverage_limit":0},"samples":[{"subpath":"./package.json","reason":"non_executable"},{"subpath":"./lib/*","reason":"pattern"},{"subpath":"./lib/*.js","reason":"pattern"}]},"outcome":"inconclusive","evidenceLevel":"smoke_tested","coverageComplete":false,"cells":[{"runId":"2af7f0c4-4213-4137-a212-23ccc33ac41a","profileId":"node_24_21_0","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":314.6169409994036,"failure":null,"entries":[{"index":0,"specifier":"pg","displaySpecifier":"pg","outcome":"pass","durationMs":35.544442000000004,"resolvedTo":"file:///workspace/node_modules/pg/esm/index.mjs","failure":null}],"sessions":[{"probeId":"bb53a009-843e-4636-a1ec-0face3481fcd","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":314.6169409994036}]},{"runId":"81170dd9-21c1-4725-a4a0-cc4415e26905","profileId":"node_24_21_0","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":340.98504799976945,"failure":null,"entries":[{"index":0,"specifier":"pg","displaySpecifier":"pg","outcome":"pass","durationMs":18.108895,"resolvedTo":"/workspace/node_modules/pg/lib/index.js","failure":null}],"sessions":[{"probeId":"2a0a452a-a6db-45e0-bbba-944f470dcc3d","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":340.98504799976945}]},{"runId":"cc26688d-318a-4462-a6ff-333852dca722","profileId":"node_24_21_0","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"106a3866-eb7c-4aed-8af0-f52c772926ac","profileId":"node_24_21_0","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"99178a95-e55a-448b-9bfd-2bc0deebe44a","profileId":"node_26_10_0","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":320.1069389991462,"failure":null,"entries":[{"index":0,"specifier":"pg","displaySpecifier":"pg","outcome":"pass","durationMs":23.877677999999996,"resolvedTo":"file:///workspace/node_modules/pg/esm/index.mjs","failure":null}],"sessions":[{"probeId":"1fbfe8f0-7f12-494b-835f-6c3fe9633d98","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":320.1069389991462}]},{"runId":"6de1039d-b676-4a0e-adfc-fd84b5e1b249","profileId":"node_26_10_0","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":361.83539400063455,"failure":null,"entries":[{"index":0,"specifier":"pg","displaySpecifier":"pg","outcome":"pass","durationMs":21.779846,"resolvedTo":"/workspace/node_modules/pg/lib/index.js","failure":null}],"sessions":[{"probeId":"1e2ce367-5b6e-4d4c-85fc-f6dedb7e05a8","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":361.83539400063455}]},{"runId":"9120d3cb-f747-4ea4-a530-5fe16240bd49","profileId":"node_26_10_0","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"7cd569f5-fb56-486d-a38a-2176db6f3dd5","profileId":"node_26_10_0","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"7e34547b-c6d1-4953-932d-1c3f9028b488","profileId":"bun_1_4_2","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":342.60843400098383,"failure":null,"entries":[{"index":0,"specifier":"pg","displaySpecifier":"pg","outcome":"pass","durationMs":21.653051,"resolvedTo":"file:///workspace/node_modules/pg/esm/index.mjs","failure":null}],"sessions":[{"probeId":"97505c98-94fa-4c2f-ae3e-b14a332713ce","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":342.60843400098383}]},{"runId":"07f15a92-81a3-484c-820a-5424038c95ed","profileId":"bun_1_4_2","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":321.570589998737,"failure":null,"entries":[{"index":0,"specifier":"pg","displaySpecifier":"pg","outcome":"pass","durationMs":19.633763000000002,"resolvedTo":"/workspace/node_modules/pg/lib/index.js","failure":null}],"sessions":[{"probeId":"d669b75d-84b4-4ca5-bf31-b7b52529cf99","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":321.570589998737}]},{"runId":"c739d134-1196-4ad0-9829-e537a3614c79","profileId":"bun_1_4_2","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"df01fb72-e278-47a1-bd45-e35f2e697773","profileId":"bun_1_4_2","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"f99581e0-d29b-4e1d-85c2-d144535db250","profileId":"deno_2_9_7","group":"root","mode":"esm","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":457.9770169984549,"failure":null,"entries":[{"index":0,"specifier":"pg","displaySpecifier":"pg","outcome":"pass","durationMs":26.911975999999996,"resolvedTo":"file:///workspace/node_modules/pg/esm/index.mjs","failure":null}],"sessions":[{"probeId":"371c52fa-59e0-47b4-9408-ce474c20b3c7","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":457.9770169984549}]},{"runId":"94257583-b921-4aad-a31c-820141ff8965","profileId":"deno_2_9_7","group":"root","mode":"commonjs","method":"fresh_root_v2","outcome":"pass","evidenceLevel":"smoke_tested","coverage":{"planned":1,"observed":1,"passed":1,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":439.27523200027645,"failure":null,"entries":[{"index":0,"specifier":"pg","displaySpecifier":"pg","outcome":"pass","durationMs":23.009448000000006,"resolvedTo":"/workspace/node_modules/pg/lib/index.js","failure":null}],"sessions":[{"probeId":"56171aca-4ef2-4e6e-88e0-2de451524c18","startIndex":0,"stopReason":"completed","exitCode":0,"oomKilled":false,"durationMs":439.27523200027645}]},{"runId":"9c99d71a-a147-425b-b8b4-57da95bb15c5","profileId":"deno_2_9_7","group":"subpaths","mode":"esm","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]},{"runId":"8f8102b8-f916-474c-8659-375c9cd74425","profileId":"deno_2_9_7","group":"subpaths","mode":"commonjs","method":"sequential_batch_v2","outcome":"not_applicable","evidenceLevel":"static_only","coverage":{"planned":0,"observed":0,"passed":0,"failed":0,"prerequisiteLimited":0,"interrupted":0,"untested":0,"complete":true},"durationMs":0,"failure":null,"entries":[],"sessions":[]}],"limitations":["Only installation and loading were observed; functional correctness and package safety are not established.","Subpath batches share module caches and globals; root modes use separate fresh sandboxes.","Package-visible harness observations can be tampered with. They are not adversarial attestation.","Evidence applies to these exact artifacts, dependency snapshot, runtime images and Linux amd64/glibc policy.","Runtime error codes are captured observations and can also be thrown by package code."]}}