@heossi/qnsi 0.5.5 → 0.6.0

package/dist/code-scan/rules/javascript.js

@@ -0,0 +1,179 @@
+/**
+ * JS/TS rule pack: node:crypto, WebCrypto, JWT alg strings, common libraries.
+ * Every pattern anchors on API context — never a bare algorithm word.
+ */
+import { canonicalEcCurve } from "../canonical.js";
+const LANGS = ["javascript", "typescript"];
+export const javascriptRules = [
+    {
+        id: "js-node-crypto-generate-keypair-rsa",
+        languages: LANGS,
+        pattern: /generateKeyPair(?:Sync)?\s*\(\s*["'`]rsa(?:-pss)?["'`]/,
+        algorithm: "rsa-unknown",
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "node:crypto",
+        wantsKeySize: true,
+    },
+    {
+        id: "js-node-crypto-generate-keypair-ec",
+        languages: LANGS,
+        pattern: /generateKeyPair(?:Sync)?\s*\(\s*["'`]ec["'`]/,
+        algorithm: "ecdsa-unknown",
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "node:crypto",
+    },
+    {
+        id: "js-node-crypto-named-curve",
+        languages: LANGS,
+        pattern: /namedCurve\s*:\s*["'`]([A-Za-z0-9-]+)["'`]/,
+        algorithm: (match) => canonicalEcCurve(match[1] ?? ""),
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "node:crypto",
+    },
+    {
+        id: "js-node-crypto-generate-keypair-ed25519",
+        languages: LANGS,
+        pattern: /generateKeyPair(?:Sync)?\s*\(\s*["'`](ed25519|ed448|x25519|x448)["'`]/,
+        algorithm: (match) => {
+            const name = (match[1] ?? "").toLowerCase();
+            return name === "x25519" || name === "x448" ? `ecdh-${name}` : name;
+        },
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "node:crypto",
+    },
+    {
+        id: "js-node-crypto-weak-hash",
+        languages: LANGS,
+        pattern: /createHash\s*\(\s*["'`](md5|sha1)["'`]/i,
+        algorithm: (match) => (match[1] ?? "").toLowerCase(),
+        category: "hash",
+        classification: "classical",
+        confidence: "high",
+        library: "node:crypto",
+    },
+    {
+        id: "js-node-crypto-cipheriv",
+        languages: LANGS,
+        pattern: /create(?:Cipheriv|Decipheriv)\s*\(\s*["'`]((?:aes|des|des3|des-ede3|rc4)[a-z0-9-]*)["'`]/i,
+        algorithm: (match) => {
+            const transform = (match[1] ?? "").toLowerCase();
+            if (transform.startsWith("des-ede3") || transform.startsWith("des3"))
+                return "3des";
+            if (transform.startsWith("des"))
+                return "des";
+            if (transform.startsWith("rc4"))
+                return "rc4";
+            const aes = /^aes-?(\d{3})(?:-([a-z0-9]+))?/.exec(transform);
+            if (aes) {
+                return aes[2] === "gcm" ? `aes-${aes[1]}-gcm` : `aes-${aes[1]}`;
+            }
+            return null;
+        },
+        category: "symmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "node:crypto",
+    },
+    {
+        id: "js-webcrypto-rsa",
+        languages: LANGS,
+        pattern: /["'`](RSASSA-PKCS1-v1_5|RSA-OAEP|RSA-PSS)["'`]/,
+        algorithm: "rsa-unknown",
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "WebCrypto",
+        wantsKeySize: true,
+    },
+    {
+        id: "js-webcrypto-ecdsa-ecdh",
+        languages: LANGS,
+        pattern: /name\s*:\s*["'`](ECDSA|ECDH)["'`]/,
+        algorithm: (match) => `${(match[1] ?? "").toLowerCase()}-unknown`,
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "medium",
+        library: "WebCrypto",
+    },
+    {
+        id: "js-jwt-classical-alg",
+        languages: LANGS,
+        pattern: /\balg(?:orithm)?s?\b\s*[:=]\s*\[?\s*["'`](RS256|RS384|RS512|PS256|PS384|PS512|ES256|ES384|ES512|EdDSA)["'`]/,
+        algorithm: (match) => {
+            const alg = match[1] ?? "";
+            if (alg.startsWith("RS") || alg.startsWith("PS"))
+                return "rsa-unknown";
+            if (alg === "ES256")
+                return "ecdsa-p256";
+            if (alg === "ES384")
+                return "ecdsa-p384";
+            if (alg === "ES512")
+                return "ecdsa-p521";
+            return "ed25519";
+        },
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "jose/jsonwebtoken",
+    },
+    {
+        id: "js-lib-elliptic",
+        languages: LANGS,
+        pattern: /require\s*\(\s*["'`]elliptic["'`]\s*\)|from\s+["'`]elliptic["'`]/,
+        algorithm: "ecdsa-unknown",
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "medium",
+        library: "elliptic",
+    },
+    {
+        id: "js-lib-node-forge-rsa",
+        languages: LANGS,
+        pattern: /forge\.pki\.rsa|forge\.rsa\./,
+        algorithm: "rsa-unknown",
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "node-forge",
+        wantsKeySize: true,
+    },
+    // PQC usage — counted so readiness reflects code reality, not only gaps.
+    {
+        id: "js-pqc-noble-post-quantum",
+        languages: LANGS,
+        pattern: /from\s+["'`]@noble\/post-quantum(?:\/([a-z-]+)(?:\.js)?)?["'`]/,
+        algorithm: (match) => {
+            const mod = match[1] ?? "";
+            if (mod.includes("ml-kem"))
+                return "ml-kem-768";
+            if (mod.includes("ml-dsa"))
+                return "ml-dsa-65";
+            if (mod.includes("slh-dsa"))
+                return "slh-dsa-sha2-128f";
+            return "ml-kem-768";
+        },
+        category: "asymmetric",
+        classification: "pqc",
+        confidence: "medium",
+        library: "@noble/post-quantum",
+    },
+    {
+        id: "js-pqc-explicit-mlkem-mldsa",
+        languages: LANGS,
+        pattern: /["'`](ml[-_]kem[-_](?:512|768|1024)|ml[-_]dsa[-_](?:44|65|87))["'`]/i,
+        algorithm: (match) => (match[1] ?? "").toLowerCase().replace(/_/g, "-"),
+        category: "asymmetric",
+        classification: "pqc",
+        confidence: "medium",
+        library: "pqc",
+    },
+];
+//# sourceMappingURL=javascript.js.map

package/dist/code-scan/rules/javascript.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"javascript.js","sourceRoot":"","sources":["../../../src/code-scan/rules/javascript.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAGnD,MAAM,KAAK,GAAG,CAAC,YAAY,EAAE,YAAY,CAAU,CAAC;AAEpD,MAAM,CAAC,MAAM,eAAe,GAAmC;IAC9D;QACC,EAAE,EAAE,qCAAqC;QACzC,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,wDAAwD;QACjE,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,aAAa;QACtB,YAAY,EAAE,IAAI;KAClB;IACD;QACC,EAAE,EAAE,oCAAoC;QACxC,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,8CAA8C;QACvD,SAAS,EAAE,eAAe;QAC1B,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,aAAa;KACtB;IACD;QACC,EAAE,EAAE,4BAA4B;QAChC,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,4CAA4C;QACrD,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,aAAa;KACtB;IACD;QACC,EAAE,EAAE,yCAAyC;QAC7C,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,uEAAuE;QAChF,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAC5C,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACrE,CAAC;QACD,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,aAAa;KACtB;IACD;QACC,EAAE,EAAE,0BAA0B;QAC9B,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,yCAAyC;QAClD,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;QACpD,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,aAAa;KACtB;IACD;QACC,EAAE,EAAE,yBAAyB;QAC7B,SAAS,EAAE,KAAK;QAChB,OAAO,EACN,2FAA2F;QAC5F,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YACjD,IAAI,SAAS,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,OAAO,MAAM,CAAC;YACpF,IAAI,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC9C,IAAI,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC9C,MAAM,GAAG,GAAG,gCAAgC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC7D,IAAI,GAAG,EAAE,CAAC;gBACT,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,CAAC;YACD,OAAO,IAAI,CAAC;QACb,CAAC;QACD,QAAQ,EAAE,WAAW;QACrB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,aAAa;KACtB;IACD;QACC,EAAE,EAAE,kBAAkB;QACtB,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,gDAAgD;QACzD,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,WAAW;QACpB,YAAY,EAAE,IAAI;KAClB;IACD;QACC,EAAE,EAAE,yBAAyB;QAC7B,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,mCAAmC;QAC5C,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,UAAU;QACjE,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,QAAQ;QACpB,OAAO,EAAE,WAAW;KACpB;IACD;QACC,EAAE,EAAE,sBAAsB;QAC1B,SAAS,EAAE,KAAK;QAChB,OAAO,EACN,6GAA6G;QAC9G,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3B,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,aAAa,CAAC;YACvE,IAAI,GAAG,KAAK,OAAO;gBAAE,OAAO,YAAY,CAAC;YACzC,IAAI,GAAG,KAAK,OAAO;gBAAE,OAAO,YAAY,CAAC;YACzC,IAAI,GAAG,KAAK,OAAO;gBAAE,OAAO,YAAY,CAAC;YACzC,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,mBAAmB;KAC5B;IACD;QACC,EAAE,EAAE,iBAAiB;QACrB,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,kEAAkE;QAC3E,SAAS,EAAE,eAAe;QAC1B,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,QAAQ;QACpB,OAAO,EAAE,UAAU;KACnB;IACD;QACC,EAAE,EAAE,uBAAuB;QAC3B,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,8BAA8B;QACvC,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,YAAY;QACrB,YAAY,EAAE,IAAI;KAClB;IACD,yEAAyE;IACzE;QACC,EAAE,EAAE,2BAA2B;QAC/B,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,gEAAgE;QACzE,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3B,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAAE,OAAO,YAAY,CAAC;YAChD,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAAE,OAAO,WAAW,CAAC;YAC/C,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,OAAO,mBAAmB,CAAC;YACxD,OAAO,YAAY,CAAC;QACrB,CAAC;QACD,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,KAAK;QACrB,UAAU,EAAE,QAAQ;QACpB,OAAO,EAAE,qBAAqB;KAC9B;IACD;QACC,EAAE,EAAE,6BAA6B;QACjC,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,sEAAsE;QAC/E,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;QACvE,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,KAAK;QACrB,UAAU,EAAE,QAAQ;QACpB,OAAO,EAAE,KAAK;KACd;CACD,CAAC"}

package/dist/code-scan/rules/python.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Python rule pack: pyca/cryptography, PyCryptodome, hashlib, PyJWT.
+ */
+import type { CryptoDetectionRule } from "../types.js";
+export declare const pythonRules: readonly CryptoDetectionRule[];
+//# sourceMappingURL=python.d.ts.map

package/dist/code-scan/rules/python.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"python.d.ts","sourceRoot":"","sources":["../../../src/code-scan/rules/python.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAIvD,eAAO,MAAM,WAAW,EAAE,SAAS,mBAAmB,EAsHrD,CAAC"}

package/dist/code-scan/rules/python.js

@@ -0,0 +1,133 @@
+/**
+ * Python rule pack: pyca/cryptography, PyCryptodome, hashlib, PyJWT.
+ */
+const LANGS = ["python"];
+export const pythonRules = [
+    {
+        id: "py-cryptography-rsa-generate",
+        languages: LANGS,
+        pattern: /rsa\.generate_private_key\s*\(/,
+        algorithm: "rsa-unknown",
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "pyca/cryptography",
+        wantsKeySize: true,
+    },
+    {
+        id: "py-cryptography-ec-curve",
+        languages: LANGS,
+        pattern: /\bec\.(SECP192R1|SECP256R1|SECP256K1|SECP384R1|SECP521R1)\b/,
+        algorithm: (match) => {
+            const curve = match[1] ?? "";
+            if (curve.includes("192"))
+                return "ecdsa-p192";
+            if (curve.includes("256"))
+                return "ecdsa-p256";
+            if (curve.includes("384"))
+                return "ecdsa-p384";
+            return "ecdsa-p521";
+        },
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "pyca/cryptography",
+    },
+    {
+        id: "py-cryptography-pkcs1v15",
+        languages: LANGS,
+        pattern: /padding\.PKCS1v15\s*\(/,
+        algorithm: "rsa-unknown",
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "pyca/cryptography",
+    },
+    {
+        id: "py-cryptography-ed25519",
+        languages: LANGS,
+        pattern: /\b(Ed25519PrivateKey|Ed448PrivateKey|X25519PrivateKey|X448PrivateKey)\b/,
+        algorithm: (match) => {
+            const cls = match[1] ?? "";
+            if (cls.startsWith("Ed25519"))
+                return "ed25519";
+            if (cls.startsWith("Ed448"))
+                return "ed448";
+            return cls.startsWith("X25519") ? "ecdh-x25519" : "ecdh-x448";
+        },
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "pyca/cryptography",
+    },
+    {
+        id: "py-pycryptodome-rsa",
+        languages: LANGS,
+        pattern: /\bRSA\.generate\s*\(\s*(\d{3,5})?/,
+        algorithm: "rsa-unknown",
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "PyCryptodome",
+        wantsKeySize: true,
+    },
+    {
+        id: "py-pycryptodome-weak-cipher",
+        languages: LANGS,
+        pattern: /from\s+Crypto(?:dome)?\.Cipher\s+import\s+.*\b(DES3|DES|ARC4|ARC2)\b|\b(DES3|DES|ARC4)\.new\s*\(/,
+        algorithm: (match) => {
+            const name = (match[1] ?? match[2] ?? "").toUpperCase();
+            if (name === "DES3")
+                return "3des";
+            if (name === "DES")
+                return "des";
+            return "rc4";
+        },
+        category: "symmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "PyCryptodome",
+    },
+    {
+        id: "py-hashlib-weak-hash",
+        languages: LANGS,
+        pattern: /hashlib\.(md5|sha1)\s*\(/,
+        algorithm: (match) => (match[1] ?? "").toLowerCase(),
+        category: "hash",
+        classification: "classical",
+        confidence: "high",
+        library: "hashlib",
+    },
+    {
+        id: "py-jwt-classical-alg",
+        languages: LANGS,
+        pattern: /algorithms?\s*=\s*\[?\s*["'](RS256|RS384|RS512|PS256|PS384|PS512|ES256|ES384|ES512|EdDSA)["']/,
+        algorithm: (match) => {
+            const alg = match[1] ?? "";
+            if (alg.startsWith("RS") || alg.startsWith("PS"))
+                return "rsa-unknown";
+            if (alg === "ES256")
+                return "ecdsa-p256";
+            if (alg === "ES384")
+                return "ecdsa-p384";
+            if (alg === "ES512")
+                return "ecdsa-p521";
+            return "ed25519";
+        },
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "PyJWT",
+    },
+    {
+        id: "py-pqc-liboqs",
+        languages: LANGS,
+        pattern: /\boqs\.(KeyEncapsulation|Signature)\s*\(\s*["']([A-Za-z0-9_-]+)["']/,
+        algorithm: (match) => (match[2] ?? "").toLowerCase().replace(/_/g, "-"),
+        category: "asymmetric",
+        classification: "pqc",
+        confidence: "high",
+        library: "liboqs-python",
+    },
+];
+//# sourceMappingURL=python.js.map

package/dist/code-scan/rules/python.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"python.js","sourceRoot":"","sources":["../../../src/code-scan/rules/python.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAU,CAAC;AAElC,MAAM,CAAC,MAAM,WAAW,GAAmC;IAC1D;QACC,EAAE,EAAE,8BAA8B;QAClC,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,gCAAgC;QACzC,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,mBAAmB;QAC5B,YAAY,EAAE,IAAI;KAClB;IACD;QACC,EAAE,EAAE,0BAA0B;QAC9B,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,6DAA6D;QACtE,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7B,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,OAAO,YAAY,CAAC;YAC/C,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,OAAO,YAAY,CAAC;YAC/C,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,OAAO,YAAY,CAAC;YAC/C,OAAO,YAAY,CAAC;QACrB,CAAC;QACD,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,mBAAmB;KAC5B;IACD;QACC,EAAE,EAAE,0BAA0B;QAC9B,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,wBAAwB;QACjC,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,mBAAmB;KAC5B;IACD;QACC,EAAE,EAAE,yBAAyB;QAC7B,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,yEAAyE;QAClF,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3B,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;gBAAE,OAAO,SAAS,CAAC;YAChD,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;gBAAE,OAAO,OAAO,CAAC;YAC5C,OAAO,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;QAC/D,CAAC;QACD,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,mBAAmB;KAC5B;IACD;QACC,EAAE,EAAE,qBAAqB;QACzB,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,mCAAmC;QAC5C,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,cAAc;QACvB,YAAY,EAAE,IAAI;KAClB;IACD;QACC,EAAE,EAAE,6BAA6B;QACjC,SAAS,EAAE,KAAK;QAChB,OAAO,EACN,kGAAkG;QACnG,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YACxD,IAAI,IAAI,KAAK,MAAM;gBAAE,OAAO,MAAM,CAAC;YACnC,IAAI,IAAI,KAAK,KAAK;gBAAE,OAAO,KAAK,CAAC;YACjC,OAAO,KAAK,CAAC;QACd,CAAC;QACD,QAAQ,EAAE,WAAW;QACrB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,cAAc;KACvB;IACD;QACC,EAAE,EAAE,sBAAsB;QAC1B,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,0BAA0B;QACnC,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;QACpD,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,SAAS;KAClB;IACD;QACC,EAAE,EAAE,sBAAsB;QAC1B,SAAS,EAAE,KAAK;QAChB,OAAO,EACN,+FAA+F;QAChG,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3B,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,aAAa,CAAC;YACvE,IAAI,GAAG,KAAK,OAAO;gBAAE,OAAO,YAAY,CAAC;YACzC,IAAI,GAAG,KAAK,OAAO;gBAAE,OAAO,YAAY,CAAC;YACzC,IAAI,GAAG,KAAK,OAAO;gBAAE,OAAO,YAAY,CAAC;YACzC,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,OAAO;KAChB;IACD;QACC,EAAE,EAAE,eAAe;QACnB,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,qEAAqE;QAC9E,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;QACvE,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,KAAK;QACrB,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,eAAe;KACxB;CACD,CAAC"}

package/dist/code-scan/rules/rust.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Rust rule pack: rsa/p256/p384/ed25519-dalek/ring/openssl crates.
+ * `use` declarations are strong evidence; Cargo.toml dependency lines are
+ * matched by the artifacts pack (config language).
+ */
+import type { CryptoDetectionRule } from "../types.js";
+export declare const rustRules: readonly CryptoDetectionRule[];
+//# sourceMappingURL=rust.d.ts.map

package/dist/code-scan/rules/rust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rust.d.ts","sourceRoot":"","sources":["../../../src/code-scan/rules/rust.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAIvD,eAAO,MAAM,SAAS,EAAE,SAAS,mBAAmB,EAuEnD,CAAC"}

package/dist/code-scan/rules/rust.js

@@ -0,0 +1,86 @@
+/**
+ * Rust rule pack: rsa/p256/p384/ed25519-dalek/ring/openssl crates.
+ * `use` declarations are strong evidence; Cargo.toml dependency lines are
+ * matched by the artifacts pack (config language).
+ */
+const LANGS = ["rust"];
+export const rustRules = [
+    {
+        id: "rs-use-classical-crates",
+        languages: LANGS,
+        pattern: /\buse\s+(rsa|p256|p384|k256|ed25519_dalek|x25519_dalek)\b/,
+        algorithm: (match) => {
+            const crate = match[1] ?? "";
+            if (crate === "rsa")
+                return "rsa-unknown";
+            if (crate === "p256" || crate === "k256")
+                return "ecdsa-p256";
+            if (crate === "p384")
+                return "ecdsa-p384";
+            if (crate === "ed25519_dalek")
+                return "ed25519";
+            return "ecdh-x25519";
+        },
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "rust crates",
+    },
+    {
+        id: "rs-rsa-generate",
+        languages: LANGS,
+        pattern: /RsaPrivateKey::new\s*\(/,
+        algorithm: "rsa-unknown",
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "rsa crate",
+        wantsKeySize: true,
+    },
+    {
+        id: "rs-ring-classical",
+        languages: LANGS,
+        pattern: /ring::signature::(?:RSA|ECDSA|ED25519)[A-Z0-9_]*/,
+        algorithm: (match) => {
+            const token = match[0];
+            if (token.includes("RSA"))
+                return "rsa-unknown";
+            if (token.includes("ECDSA"))
+                return "ecdsa-unknown";
+            return "ed25519";
+        },
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "ring",
+    },
+    {
+        id: "rs-weak-hash-crates",
+        languages: LANGS,
+        pattern: /\buse\s+(md5|md_5|sha1|sha_1)\b|\b(Md5|Sha1)::(?:new|digest)\b/,
+        algorithm: (match) => {
+            const token = (match[1] ?? match[2] ?? "").toLowerCase().replace(/_/g, "");
+            return token.includes("md5") ? "md5" : "sha1";
+        },
+        category: "hash",
+        classification: "classical",
+        confidence: "high",
+        library: "rust crates",
+    },
+    {
+        id: "rs-pqc-crates",
+        languages: LANGS,
+        pattern: /\buse\s+(?:pqcrypto|ml_kem|ml_dsa|fips203|fips204|fips205|oqs)\b/,
+        algorithm: (match) => {
+            const token = match[0];
+            if (token.includes("dsa") || token.includes("204"))
+                return "ml-dsa-65";
+            return "ml-kem-768";
+        },
+        category: "asymmetric",
+        classification: "pqc",
+        confidence: "medium",
+        library: "rust pqc crates",
+    },
+];
+//# sourceMappingURL=rust.js.map

package/dist/code-scan/rules/rust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rust.js","sourceRoot":"","sources":["../../../src/code-scan/rules/rust.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,KAAK,GAAG,CAAC,MAAM,CAAU,CAAC;AAEhC,MAAM,CAAC,MAAM,SAAS,GAAmC;IACxD;QACC,EAAE,EAAE,yBAAyB;QAC7B,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,2DAA2D;QACpE,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7B,IAAI,KAAK,KAAK,KAAK;gBAAE,OAAO,aAAa,CAAC;YAC1C,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM;gBAAE,OAAO,YAAY,CAAC;YAC9D,IAAI,KAAK,KAAK,MAAM;gBAAE,OAAO,YAAY,CAAC;YAC1C,IAAI,KAAK,KAAK,eAAe;gBAAE,OAAO,SAAS,CAAC;YAChD,OAAO,aAAa,CAAC;QACtB,CAAC;QACD,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,aAAa;KACtB;IACD;QACC,EAAE,EAAE,iBAAiB;QACrB,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,yBAAyB;QAClC,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,WAAW;QACpB,YAAY,EAAE,IAAI;KAClB;IACD;QACC,EAAE,EAAE,mBAAmB;QACvB,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,kDAAkD;QAC3D,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACvB,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,OAAO,aAAa,CAAC;YAChD,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO,eAAe,CAAC;YACpD,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,MAAM;KACf;IACD;QACC,EAAE,EAAE,qBAAqB;QACzB,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,gEAAgE;QACzE,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC3E,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAC/C,CAAC;QACD,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,aAAa;KACtB;IACD;QACC,EAAE,EAAE,eAAe;QACnB,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,kEAAkE;QAC3E,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACvB,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,OAAO,WAAW,CAAC;YACvE,OAAO,YAAY,CAAC;QACrB,CAAC;QACD,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,KAAK;QACrB,UAAU,EAAE,QAAQ;QACpB,OAAO,EAAE,iBAAiB;KAC1B;CACD,CAAC"}

package/dist/code-scan/scanner.d.ts

@@ -0,0 +1,18 @@
+/**
+ * File walker + rule matcher. Parse-only: files are read as text, comments
+ * are stripped, rules are matched line-by-line. Nothing is executed and no
+ * network is touched — scanning an untrusted repository is safe by
+ * construction.
+ */
+import type { CodeCryptoFinding, Language, ScanOptions, ScanSummary } from "./types.js";
+export declare function detectLanguage(fileName: string): Language | null;
+export declare function isTestPath(relativePath: string): boolean;
+export declare function hashLine(line: string): string;
+/**
+ * Scan a single file's content. Exported for tests, the CLI's single-file
+ * mode, and future host integrations (qnsp-agent).
+ */
+export declare function scanFileContent(relativePath: string, content: string, language: Language): CodeCryptoFinding[];
+/** Recursively scan a directory tree. */
+export declare function scanDirectory(options: ScanOptions): Promise<ScanSummary>;
+//# sourceMappingURL=scanner.d.ts.map

package/dist/code-scan/scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../../src/code-scan/scanner.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,OAAO,KAAK,EACX,iBAAiB,EAEjB,QAAQ,EACR,WAAW,EACX,WAAW,EACX,MAAM,YAAY,CAAC;AA8EpB,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAUhE;AAED,wBAAgB,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAQxD;AAYD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG7C;AA4BD;;;GAGG;AACH,wBAAgB,eAAe,CAC9B,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,QAAQ,GAChB,iBAAiB,EAAE,CAiDrB;AAED,yCAAyC;AACzC,wBAAsB,aAAa,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAyE9E"}