From a8eefe0ab895f472aaacd3379d5aebec84cfaa90 Mon Sep 17 00:00:00 2001
From: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
Date: Sun, 1 Nov 2026 12:16:32 -0800
Subject: [PATCH] fix(release-exposure): count an unexpanded nested package as
 a readable member

An unencrypted nested package that inventory recognized but did not
expand is still a member its parent package already read. Count it as
readable so packaging.extractable_payload reports exposed, while its
own contents keep coverage unknown.
---
 src/artifacts/ReleaseExposureReader.test.ts | 4 ++++
 src/artifacts/ReleaseExposureReader.ts      | 8 +++++++-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/src/artifacts/ReleaseExposureReader.test.ts b/src/artifacts/ReleaseExposureReader.test.ts
index bc25604faf..8c795c4016 100644
--- a/src/artifacts/ReleaseExposureReader.test.ts
+++ b/src/artifacts/ReleaseExposureReader.test.ts
@@ -1352,6 +1352,10 @@ describe("ReleaseExposureReader source spellings", () => {
     expect(scanned.source_maps.embedded).toBe(0);
     expect(scanned.coverage).toBe("unknown");
     expect(sourceMapSourcesStatus(scanned)).toBe("unknown");
+    expect(scanned.extractable.readable_members).toBe(1);
+    expect(scanned.extractable.samples).toEqual([
+      expect.stringContaining("inner.asar"),
+    ]);
   });
 
   it("reopens a decomposed compressed .NET member", async () => {
diff --git a/src/artifacts/ReleaseExposureReader.ts b/src/artifacts/ReleaseExposureReader.ts
index 1c5c2f709b..2eea22dd82 100644
--- a/src/artifacts/ReleaseExposureReader.ts
+++ b/src/artifacts/ReleaseExposureReader.ts
@@ -482,13 +482,19 @@ const scanOccurrences = async (
       continue;
     }
     // A nested package that inventory recognized but did not expand was
-    // never assessed, so its members leave coverage unknown.
+    // never assessed, so its members leave coverage unknown. The nested
+    // package itself is still an unencrypted member of its parent that
+    // inventory already read, so it counts as a readable payload.
     if (
       packageKind !== null &&
       !parentsWithChildren.has(occurrence.occurrence_id)
     ) {
       state.formats.add(packageKind);
       noteUnexaminedPackage(state);
+      if (!occurrence.encrypted) {
+        state.readable += 1;
+        pushSample(state.memberSamples, location);
+      }
       pushLimitation(state, `Nested package ${location} was not expanded.`);
       continue;
     }