@heossi/qnsi 0.5.5 → 0.6.0

package/dist/code-scan/rules/c.js

@@ -0,0 +1,77 @@
+/**
+ * C/C++ rule pack: OpenSSL EVP/legacy APIs.
+ */
+const LANGS = ["c", "cpp"];
+export const cRules = [
+    {
+        id: "c-openssl-rsa",
+        languages: LANGS,
+        pattern: /\b(RSA_generate_key(?:_ex)?|EVP_PKEY_RSA|EVP_RSA_gen)\b/,
+        algorithm: "rsa-unknown",
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "OpenSSL",
+        wantsKeySize: true,
+    },
+    {
+        id: "c-openssl-ec",
+        languages: LANGS,
+        pattern: /\b(EC_KEY_new(?:_by_curve_name)?|EVP_PKEY_EC|NID_(?:X9_62_prime256v1|secp384r1|secp521r1))\b/,
+        algorithm: (match) => {
+            const token = match[1] ?? "";
+            if (token.includes("prime256v1"))
+                return "ecdsa-p256";
+            if (token.includes("secp384r1"))
+                return "ecdsa-p384";
+            if (token.includes("secp521r1"))
+                return "ecdsa-p521";
+            return "ecdsa-unknown";
+        },
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "OpenSSL",
+    },
+    {
+        id: "c-openssl-weak-digest",
+        languages: LANGS,
+        pattern: /\bEVP_(md5|sha1)\s*\(\s*\)|\b(MD5|SHA1)_(?:Init|Update|Final)\b/,
+        algorithm: (match) => ((match[1] ?? match[2] ?? "").toLowerCase() === "md5" ? "md5" : "sha1"),
+        category: "hash",
+        classification: "classical",
+        confidence: "high",
+        library: "OpenSSL",
+    },
+    {
+        id: "c-openssl-weak-cipher",
+        languages: LANGS,
+        pattern: /\bEVP_(des_ede3[a-z0-9_]*|des_[a-z0-9_]+|rc4[a-z0-9_]*)\s*\(/,
+        algorithm: (match) => {
+            const name = (match[1] ?? "").toLowerCase();
+            if (name.startsWith("des_ede3"))
+                return "3des";
+            if (name.startsWith("des"))
+                return "des";
+            return "rc4";
+        },
+        category: "symmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "OpenSSL",
+    },
+    {
+        id: "c-pqc-liboqs",
+        languages: LANGS,
+        pattern: /\bOQS_(?:KEM|SIG)_(?:new\s*\(\s*)?(?:OQS_(?:KEM|SIG)_alg_)?([a-z0-9_]+)/i,
+        algorithm: (match) => {
+            const name = (match[1] ?? "").toLowerCase().replace(/_/g, "-");
+            return name.length > 2 ? name : null;
+        },
+        category: "asymmetric",
+        classification: "pqc",
+        confidence: "medium",
+        library: "liboqs",
+    },
+];
+//# sourceMappingURL=c.js.map

package/dist/code-scan/rules/c.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"c.js","sourceRoot":"","sources":["../../../src/code-scan/rules/c.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,MAAM,KAAK,GAAG,CAAC,GAAG,EAAE,KAAK,CAAU,CAAC;AAEpC,MAAM,CAAC,MAAM,MAAM,GAAmC;IACrD;QACC,EAAE,EAAE,eAAe;QACnB,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,yDAAyD;QAClE,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,SAAS;QAClB,YAAY,EAAE,IAAI;KAClB;IACD;QACC,EAAE,EAAE,cAAc;QAClB,SAAS,EAAE,KAAK;QAChB,OAAO,EACN,8FAA8F;QAC/F,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7B,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAAE,OAAO,YAAY,CAAC;YACtD,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAAE,OAAO,YAAY,CAAC;YACrD,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAAE,OAAO,YAAY,CAAC;YACrD,OAAO,eAAe,CAAC;QACxB,CAAC;QACD,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,SAAS;KAClB;IACD;QACC,EAAE,EAAE,uBAAuB;QAC3B,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,iEAAiE;QAC1E,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAC7F,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,SAAS;KAClB;IACD;QACC,EAAE,EAAE,uBAAuB;QAC3B,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,8DAA8D;QACvE,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAC5C,IAAI,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;gBAAE,OAAO,MAAM,CAAC;YAC/C,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YACzC,OAAO,KAAK,CAAC;QACd,CAAC;QACD,QAAQ,EAAE,WAAW;QACrB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,SAAS;KAClB;IACD;QACC,EAAE,EAAE,cAAc;QAClB,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,0EAA0E;QACnF,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC/D,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QACtC,CAAC;QACD,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,KAAK;QACrB,UAAU,EAAE,QAAQ;QACpB,OAAO,EAAE,QAAQ;KACjB;CACD,CAAC"}

package/dist/code-scan/rules/csharp.d.ts

@@ -0,0 +1,6 @@
+/**
+ * C# rule pack: System.Security.Cryptography.
+ */
+import type { CryptoDetectionRule } from "../types.js";
+export declare const csharpRules: readonly CryptoDetectionRule[];
+//# sourceMappingURL=csharp.d.ts.map

package/dist/code-scan/rules/csharp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csharp.d.ts","sourceRoot":"","sources":["../../../src/code-scan/rules/csharp.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAIvD,eAAO,MAAM,WAAW,EAAE,SAAS,mBAAmB,EA0DrD,CAAC"}

package/dist/code-scan/rules/csharp.js

@@ -0,0 +1,67 @@
+/**
+ * C# rule pack: System.Security.Cryptography.
+ */
+const LANGS = ["csharp"];
+export const csharpRules = [
+    {
+        id: "cs-rsa",
+        languages: LANGS,
+        pattern: /\b(RSACryptoServiceProvider|RSA\.Create|RSACng|RSAOpenSsl)\b\s*\(?/,
+        algorithm: "rsa-unknown",
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "System.Security.Cryptography",
+        wantsKeySize: true,
+    },
+    {
+        id: "cs-ecdsa-ecdh",
+        languages: LANGS,
+        pattern: /\b(ECDsa(?:Cng|OpenSsl)?\.Create|ECDiffieHellman(?:Cng)?\.Create)\b/,
+        algorithm: (match) => ((match[1] ?? "").startsWith("ECDsa") ? "ecdsa-unknown" : "ecdh-unknown"),
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "System.Security.Cryptography",
+    },
+    {
+        id: "cs-named-curve",
+        languages: LANGS,
+        pattern: /ECCurve\.NamedCurves\.nistP(256|384|521)/,
+        algorithm: (match) => `ecdsa-p${match[1] ?? "256"}`,
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "System.Security.Cryptography",
+    },
+    {
+        id: "cs-weak-hash",
+        languages: LANGS,
+        pattern: /\b(MD5|SHA1)(?:CryptoServiceProvider|Managed|Cng)?\.Create\s*\(/,
+        algorithm: (match) => (match[1] ?? "").toLowerCase(),
+        category: "hash",
+        classification: "classical",
+        confidence: "high",
+        library: "System.Security.Cryptography",
+    },
+    {
+        id: "cs-weak-cipher",
+        languages: LANGS,
+        pattern: /\b(DES|TripleDES|RC2|Aes)(?:CryptoServiceProvider|Managed|Cng)?\.Create\s*\(/,
+        algorithm: (match) => {
+            const name = match[1] ?? "";
+            if (name === "TripleDES")
+                return "3des";
+            if (name === "DES")
+                return "des";
+            if (name === "RC2")
+                return "rc2";
+            return "aes-unknown";
+        },
+        category: "symmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "System.Security.Cryptography",
+    },
+];
+//# sourceMappingURL=csharp.js.map

package/dist/code-scan/rules/csharp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csharp.js","sourceRoot":"","sources":["../../../src/code-scan/rules/csharp.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAU,CAAC;AAElC,MAAM,CAAC,MAAM,WAAW,GAAmC;IAC1D;QACC,EAAE,EAAE,QAAQ;QACZ,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,oEAAoE;QAC7E,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,8BAA8B;QACvC,YAAY,EAAE,IAAI;KAClB;IACD;QACC,EAAE,EAAE,eAAe;QACnB,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,qEAAqE;QAC9E,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC;QAC/F,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,8BAA8B;KACvC;IACD;QACC,EAAE,EAAE,gBAAgB;QACpB,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,0CAA0C;QACnD,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE;QACnD,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,8BAA8B;KACvC;IACD;QACC,EAAE,EAAE,cAAc;QAClB,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,iEAAiE;QAC1E,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;QACpD,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,8BAA8B;KACvC;IACD;QACC,EAAE,EAAE,gBAAgB;QACpB,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,8EAA8E;QACvF,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,IAAI,KAAK,WAAW;gBAAE,OAAO,MAAM,CAAC;YACxC,IAAI,IAAI,KAAK,KAAK;gBAAE,OAAO,KAAK,CAAC;YACjC,IAAI,IAAI,KAAK,KAAK;gBAAE,OAAO,KAAK,CAAC;YACjC,OAAO,aAAa,CAAC;QACtB,CAAC;QACD,QAAQ,EAAE,WAAW;QACrB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,8BAA8B;KACvC;CACD,CAAC"}

package/dist/code-scan/rules/go.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Go rule pack: standard library crypto/* imports and call sites.
+ * Import lines are unambiguous evidence in Go — an unused import fails the
+ * Go compiler, so an import IS usage.
+ */
+import type { CryptoDetectionRule } from "../types.js";
+export declare const goRules: readonly CryptoDetectionRule[];
+//# sourceMappingURL=go.d.ts.map

package/dist/code-scan/rules/go.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"go.d.ts","sourceRoot":"","sources":["../../../src/code-scan/rules/go.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAIvD,eAAO,MAAM,OAAO,EAAE,SAAS,mBAAmB,EA+EjD,CAAC"}

package/dist/code-scan/rules/go.js

@@ -0,0 +1,93 @@
+/**
+ * Go rule pack: standard library crypto/* imports and call sites.
+ * Import lines are unambiguous evidence in Go — an unused import fails the
+ * Go compiler, so an import IS usage.
+ */
+const LANGS = ["go"];
+export const goRules = [
+    {
+        id: "go-import-classical-asymmetric",
+        languages: LANGS,
+        pattern: /"crypto\/(rsa|ecdsa|elliptic|dsa|ed25519)"/,
+        algorithm: (match) => {
+            const pkg = match[1] ?? "";
+            if (pkg === "rsa")
+                return "rsa-unknown";
+            if (pkg === "dsa")
+                return "dsa-unknown";
+            if (pkg === "ed25519")
+                return "ed25519";
+            return "ecdsa-unknown";
+        },
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "go stdlib",
+    },
+    {
+        id: "go-rsa-generatekey",
+        languages: LANGS,
+        pattern: /rsa\.GenerateKey\s*\(/,
+        algorithm: "rsa-unknown",
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "crypto/rsa",
+        wantsKeySize: true,
+    },
+    {
+        id: "go-elliptic-curve",
+        languages: LANGS,
+        pattern: /elliptic\.(P224|P256|P384|P521)\s*\(/,
+        algorithm: (match) => {
+            const curve = match[1] ?? "";
+            if (curve === "P256")
+                return "ecdsa-p256";
+            if (curve === "P384")
+                return "ecdsa-p384";
+            if (curve === "P521")
+                return "ecdsa-p521";
+            return "ecdsa-unknown";
+        },
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "crypto/elliptic",
+    },
+    {
+        id: "go-import-weak-hash",
+        languages: LANGS,
+        pattern: /"crypto\/(md5|sha1)"/,
+        algorithm: (match) => match[1] ?? "md5",
+        category: "hash",
+        classification: "classical",
+        confidence: "high",
+        library: "go stdlib",
+    },
+    {
+        id: "go-import-weak-cipher",
+        languages: LANGS,
+        pattern: /"crypto\/(des|rc4)"/,
+        algorithm: (match) => match[1] ?? "des",
+        category: "symmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "go stdlib",
+    },
+    {
+        id: "go-pqc-imports",
+        languages: LANGS,
+        pattern: /"(?:crypto\/mlkem|github\.com\/[^"]*(?:mlkem|ml-kem|mldsa|ml-dsa|kyber|dilithium)[^"]*)"/,
+        algorithm: (match) => {
+            const path = match[0].toLowerCase();
+            if (path.includes("dsa") || path.includes("dilithium"))
+                return "ml-dsa-65";
+            return "ml-kem-768";
+        },
+        category: "asymmetric",
+        classification: "pqc",
+        confidence: "medium",
+        library: "go pqc",
+    },
+];
+//# sourceMappingURL=go.js.map

package/dist/code-scan/rules/go.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"go.js","sourceRoot":"","sources":["../../../src/code-scan/rules/go.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,KAAK,GAAG,CAAC,IAAI,CAAU,CAAC;AAE9B,MAAM,CAAC,MAAM,OAAO,GAAmC;IACtD;QACC,EAAE,EAAE,gCAAgC;QACpC,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,4CAA4C;QACrD,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3B,IAAI,GAAG,KAAK,KAAK;gBAAE,OAAO,aAAa,CAAC;YACxC,IAAI,GAAG,KAAK,KAAK;gBAAE,OAAO,aAAa,CAAC;YACxC,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YACxC,OAAO,eAAe,CAAC;QACxB,CAAC;QACD,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,WAAW;KACpB;IACD;QACC,EAAE,EAAE,oBAAoB;QACxB,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,uBAAuB;QAChC,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,YAAY;QACrB,YAAY,EAAE,IAAI;KAClB;IACD;QACC,EAAE,EAAE,mBAAmB;QACvB,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,sCAAsC;QAC/C,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7B,IAAI,KAAK,KAAK,MAAM;gBAAE,OAAO,YAAY,CAAC;YAC1C,IAAI,KAAK,KAAK,MAAM;gBAAE,OAAO,YAAY,CAAC;YAC1C,IAAI,KAAK,KAAK,MAAM;gBAAE,OAAO,YAAY,CAAC;YAC1C,OAAO,eAAe,CAAC;QACxB,CAAC;QACD,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,iBAAiB;KAC1B;IACD;QACC,EAAE,EAAE,qBAAqB;QACzB,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,sBAAsB;QAC/B,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK;QACvC,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,WAAW;KACpB;IACD;QACC,EAAE,EAAE,uBAAuB;QAC3B,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,qBAAqB;QAC9B,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK;QACvC,QAAQ,EAAE,WAAW;QACrB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,WAAW;KACpB;IACD;QACC,EAAE,EAAE,gBAAgB;QACpB,SAAS,EAAE,KAAK;QAChB,OAAO,EACN,0FAA0F;QAC3F,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACpC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAAE,OAAO,WAAW,CAAC;YAC3E,OAAO,YAAY,CAAC;QACrB,CAAC;QACD,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,KAAK;QACrB,UAAU,EAAE,QAAQ;QACpB,OAAO,EAAE,QAAQ;KACjB;CACD,CAAC"}

package/dist/code-scan/rules/index.d.ts

@@ -0,0 +1,8 @@
+import type { CryptoDetectionRule } from "../types.js";
+/**
+ * The complete v1 rule set. RULE_SET_VERSION is reported with every scan so
+ * ingested findings are traceable to the rules that produced them.
+ */
+export declare const RULE_SET_VERSION = "1.0.0";
+export declare const ALL_RULES: readonly CryptoDetectionRule[];
+//# sourceMappingURL=index.d.ts.map

package/dist/code-scan/rules/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/code-scan/rules/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAUvD;;;GAGG;AACH,eAAO,MAAM,gBAAgB,UAAU,CAAC;AAExC,eAAO,MAAM,SAAS,EAAE,SAAS,mBAAmB,EASnD,CAAC"}

package/dist/code-scan/rules/index.js

@@ -0,0 +1,24 @@
+import { artifactRules } from "./artifacts.js";
+import { cRules } from "./c.js";
+import { csharpRules } from "./csharp.js";
+import { goRules } from "./go.js";
+import { javaRules } from "./java.js";
+import { javascriptRules } from "./javascript.js";
+import { pythonRules } from "./python.js";
+import { rustRules } from "./rust.js";
+/**
+ * The complete v1 rule set. RULE_SET_VERSION is reported with every scan so
+ * ingested findings are traceable to the rules that produced them.
+ */
+export const RULE_SET_VERSION = "1.0.0";
+export const ALL_RULES = [
+    ...javascriptRules,
+    ...pythonRules,
+    ...javaRules,
+    ...goRules,
+    ...cRules,
+    ...csharpRules,
+    ...rustRules,
+    ...artifactRules,
+];
+//# sourceMappingURL=index.js.map

package/dist/code-scan/rules/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/code-scan/rules/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AAExC,MAAM,CAAC,MAAM,SAAS,GAAmC;IACxD,GAAG,eAAe;IAClB,GAAG,WAAW;IACd,GAAG,SAAS;IACZ,GAAG,OAAO;IACV,GAAG,MAAM;IACT,GAAG,WAAW;IACd,GAAG,SAAS;IACZ,GAAG,aAAa;CAChB,CAAC"}

package/dist/code-scan/rules/java.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Java/Kotlin rule pack: JCA/JCE getInstance() families, BouncyCastle.
+ * JCA takes algorithms as string arguments, so the string content is the
+ * signal — anchored on the API call, never matched bare.
+ */
+import type { CryptoDetectionRule } from "../types.js";
+export declare const javaRules: readonly CryptoDetectionRule[];
+//# sourceMappingURL=java.d.ts.map

package/dist/code-scan/rules/java.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"java.d.ts","sourceRoot":"","sources":["../../../src/code-scan/rules/java.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAcvD,eAAO,MAAM,SAAS,EAAE,SAAS,mBAAmB,EA0HnD,CAAC"}

package/dist/code-scan/rules/java.js

@@ -0,0 +1,160 @@
+/**
+ * Java/Kotlin rule pack: JCA/JCE getInstance() families, BouncyCastle.
+ * JCA takes algorithms as string arguments, so the string content is the
+ * signal — anchored on the API call, never matched bare.
+ */
+const LANGS = ["java", "kotlin"];
+function jcaSignatureAlgorithm(spec) {
+    const upper = spec.toUpperCase();
+    if (upper.includes("WITHRSA"))
+        return "rsa-unknown";
+    if (upper.includes("WITHECDSA"))
+        return "ecdsa-unknown";
+    if (upper.includes("WITHDSA"))
+        return "dsa-unknown";
+    if (upper === "ED25519")
+        return "ed25519";
+    if (upper === "ED448")
+        return "ed448";
+    return null;
+}
+export const javaRules = [
+    {
+        id: "java-jca-keypairgenerator",
+        languages: LANGS,
+        pattern: /KeyPairGenerator\.getInstance\s*\(\s*"(RSA|EC|DSA|DiffieHellman|DH|Ed25519|Ed448|X25519|X448)"/,
+        algorithm: (match) => {
+            const name = match[1] ?? "";
+            if (name === "RSA")
+                return "rsa-unknown";
+            if (name === "EC")
+                return "ecdsa-unknown";
+            if (name === "DSA")
+                return "dsa-unknown";
+            if (name === "Ed25519")
+                return "ed25519";
+            if (name === "Ed448")
+                return "ed448";
+            if (name === "X25519")
+                return "ecdh-x25519";
+            if (name === "X448")
+                return "ecdh-x448";
+            return "ecdh-unknown";
+        },
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "JCA",
+        wantsKeySize: true,
+    },
+    {
+        id: "java-jca-cipher-rsa",
+        languages: LANGS,
+        pattern: /Cipher\.getInstance\s*\(\s*"RSA[^"]*"/,
+        algorithm: "rsa-unknown",
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "JCA",
+    },
+    {
+        id: "java-jca-cipher-symmetric",
+        languages: LANGS,
+        pattern: /Cipher\.getInstance\s*\(\s*"((?:AES|DES|DESede|RC4|ARCFOUR|Blowfish)[^"]*)"/,
+        algorithm: (match) => {
+            const transform = (match[1] ?? "").toUpperCase();
+            if (transform.startsWith("DESEDE"))
+                return "3des";
+            if (transform.startsWith("DES"))
+                return "des";
+            if (transform.startsWith("RC4") || transform.startsWith("ARCFOUR"))
+                return "rc4";
+            if (transform.startsWith("AES")) {
+                return transform.includes("GCM") ? "aes-unknown-gcm" : "aes-unknown";
+            }
+            return "blowfish";
+        },
+        category: "symmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "JCA",
+    },
+    {
+        id: "java-jca-signature",
+        languages: LANGS,
+        pattern: /Signature\.getInstance\s*\(\s*"([A-Za-z0-9/]+)"/,
+        algorithm: (match) => jcaSignatureAlgorithm(match[1] ?? ""),
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "JCA",
+    },
+    {
+        id: "java-jca-weak-digest",
+        languages: LANGS,
+        pattern: /MessageDigest\.getInstance\s*\(\s*"(MD5|SHA-?1)"/i,
+        algorithm: (match) => ((match[1] ?? "").toUpperCase() === "MD5" ? "md5" : "sha1"),
+        category: "hash",
+        classification: "classical",
+        confidence: "high",
+        library: "JCA",
+    },
+    {
+        id: "java-jca-keyagreement",
+        languages: LANGS,
+        pattern: /KeyAgreement\.getInstance\s*\(\s*"(ECDH|DH|DiffieHellman|X25519|X448)"/,
+        algorithm: (match) => {
+            const name = match[1] ?? "";
+            if (name === "ECDH")
+                return "ecdh-unknown";
+            if (name === "X25519")
+                return "ecdh-x25519";
+            if (name === "X448")
+                return "ecdh-x448";
+            return "dh-unknown";
+        },
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "JCA",
+    },
+    {
+        id: "java-bouncycastle-classical",
+        languages: LANGS,
+        pattern: /org\.bouncycastle\.(?:crypto\.generators\.(RSAKeyPairGenerator|ECKeyPairGenerator|DSAKeyPairGenerator)|jce\.provider)/,
+        algorithm: (match) => {
+            const cls = match[1] ?? "";
+            if (cls.startsWith("RSA"))
+                return "rsa-unknown";
+            if (cls.startsWith("EC"))
+                return "ecdsa-unknown";
+            if (cls.startsWith("DSA"))
+                return "dsa-unknown";
+            return null;
+        },
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "medium",
+        library: "BouncyCastle",
+    },
+    {
+        id: "java-pqc-bouncycastle",
+        languages: LANGS,
+        pattern: /org\.bouncycastle\.pqc\.|"(ML-KEM(?:-512|-768|-1024)?|ML-DSA(?:-44|-65|-87)?|SLH-DSA[A-Za-z0-9-]*)"/,
+        algorithm: (match) => {
+            const name = (match[1] ?? "").toLowerCase();
+            if (!name)
+                return "ml-kem-768";
+            if (name === "ml-kem")
+                return "ml-kem-768";
+            if (name === "ml-dsa")
+                return "ml-dsa-65";
+            return name;
+        },
+        category: "asymmetric",
+        classification: "pqc",
+        confidence: "medium",
+        library: "BouncyCastle PQC",
+    },
+];
+//# sourceMappingURL=java.js.map

package/dist/code-scan/rules/java.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"java.js","sourceRoot":"","sources":["../../../src/code-scan/rules/java.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAU,CAAC;AAE1C,SAAS,qBAAqB,CAAC,IAAY;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,aAAa,CAAC;IACpD,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,eAAe,CAAC;IACxD,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,aAAa,CAAC;IACpD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IACtC,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAmC;IACxD;QACC,EAAE,EAAE,2BAA2B;QAC/B,SAAS,EAAE,KAAK;QAChB,OAAO,EACN,gGAAgG;QACjG,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,IAAI,KAAK,KAAK;gBAAE,OAAO,aAAa,CAAC;YACzC,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,eAAe,CAAC;YAC1C,IAAI,IAAI,KAAK,KAAK;gBAAE,OAAO,aAAa,CAAC;YACzC,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YACzC,IAAI,IAAI,KAAK,OAAO;gBAAE,OAAO,OAAO,CAAC;YACrC,IAAI,IAAI,KAAK,QAAQ;gBAAE,OAAO,aAAa,CAAC;YAC5C,IAAI,IAAI,KAAK,MAAM;gBAAE,OAAO,WAAW,CAAC;YACxC,OAAO,cAAc,CAAC;QACvB,CAAC;QACD,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,KAAK;QACd,YAAY,EAAE,IAAI;KAClB;IACD;QACC,EAAE,EAAE,qBAAqB;QACzB,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,uCAAuC;QAChD,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,KAAK;KACd;IACD;QACC,EAAE,EAAE,2BAA2B;QAC/B,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,6EAA6E;QACtF,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YACjD,IAAI,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,OAAO,MAAM,CAAC;YAClD,IAAI,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC9C,IAAI,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC;gBAAE,OAAO,KAAK,CAAC;YACjF,IAAI,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjC,OAAO,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,aAAa,CAAC;YACtE,CAAC;YACD,OAAO,UAAU,CAAC;QACnB,CAAC;QACD,QAAQ,EAAE,WAAW;QACrB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,KAAK;KACd;IACD;QACC,EAAE,EAAE,oBAAoB;QACxB,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,iDAAiD;QAC1D,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3D,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,KAAK;KACd;IACD;QACC,EAAE,EAAE,sBAAsB;QAC1B,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,mDAAmD;QAC5D,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACjF,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,KAAK;KACd;IACD;QACC,EAAE,EAAE,uBAAuB;QAC3B,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,wEAAwE;QACjF,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,IAAI,KAAK,MAAM;gBAAE,OAAO,cAAc,CAAC;YAC3C,IAAI,IAAI,KAAK,QAAQ;gBAAE,OAAO,aAAa,CAAC;YAC5C,IAAI,IAAI,KAAK,MAAM;gBAAE,OAAO,WAAW,CAAC;YACxC,OAAO,YAAY,CAAC;QACrB,CAAC;QACD,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,KAAK;KACd;IACD;QACC,EAAE,EAAE,6BAA6B;QACjC,SAAS,EAAE,KAAK;QAChB,OAAO,EACN,uHAAuH;QACxH,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3B,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;gBAAE,OAAO,aAAa,CAAC;YAChD,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,eAAe,CAAC;YACjD,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;gBAAE,OAAO,aAAa,CAAC;YAChD,OAAO,IAAI,CAAC;QACb,CAAC;QACD,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,QAAQ;QACpB,OAAO,EAAE,cAAc;KACvB;IACD;QACC,EAAE,EAAE,uBAAuB;QAC3B,SAAS,EAAE,KAAK;QAChB,OAAO,EACN,qGAAqG;QACtG,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAC5C,IAAI,CAAC,IAAI;gBAAE,OAAO,YAAY,CAAC;YAC/B,IAAI,IAAI,KAAK,QAAQ;gBAAE,OAAO,YAAY,CAAC;YAC3C,IAAI,IAAI,KAAK,QAAQ;gBAAE,OAAO,WAAW,CAAC;YAC1C,OAAO,IAAI,CAAC;QACb,CAAC;QACD,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,KAAK;QACrB,UAAU,EAAE,QAAQ;QACpB,OAAO,EAAE,kBAAkB;KAC3B;CACD,CAAC"}

package/dist/code-scan/rules/javascript.d.ts

@@ -0,0 +1,7 @@
+/**
+ * JS/TS rule pack: node:crypto, WebCrypto, JWT alg strings, common libraries.
+ * Every pattern anchors on API context — never a bare algorithm word.
+ */
+import type { CryptoDetectionRule } from "../types.js";
+export declare const javascriptRules: readonly CryptoDetectionRule[];
+//# sourceMappingURL=javascript.d.ts.map

package/dist/code-scan/rules/javascript.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"javascript.d.ts","sourceRoot":"","sources":["../../../src/code-scan/rules/javascript.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAIvD,eAAO,MAAM,eAAe,EAAE,SAAS,mBAAmB,EAmKzD,CAAC"}