@heossi/qnsi 0.5.5 → 0.6.0

package/dist/code-scan/scanner.js

@@ -0,0 +1,254 @@
+/**
+ * File walker + rule matcher. Parse-only: files are read as text, comments
+ * are stripped, rules are matched line-by-line. Nothing is executed and no
+ * network is touched — scanning an untrusted repository is safe by
+ * construction.
+ */
+import { createHash } from "node:crypto";
+import { readdir, readFile, stat } from "node:fs/promises";
+import { join, relative, sep } from "node:path";
+import { canonicalRsa, findKeySizeNear } from "./canonical.js";
+import { ALL_RULES } from "./rules/index.js";
+import { stripComments } from "./strip.js";
+const DEFAULT_MAX_FILE_BYTES = 2 * 1024 * 1024;
+const DEFAULT_MAX_FINDINGS = 50_000;
+const BINARY_SNIFF_BYTES = 8 * 1024;
+/** Directories never worth scanning (build output, VCS, dependencies). */
+const SKIP_DIRS = new Set([
+    ".git",
+    ".hg",
+    ".svn",
+    "node_modules",
+    "vendor",
+    "dist",
+    "build",
+    "out",
+    "target",
+    "bin",
+    "obj",
+    ".next",
+    ".turbo",
+    "coverage",
+    "__pycache__",
+    ".venv",
+    "venv",
+    ".terraform",
+]);
+const SKIP_FILES = new Set([
+    "pnpm-lock.yaml",
+    "package-lock.json",
+    "yarn.lock",
+    "Cargo.lock",
+    "go.sum",
+    "poetry.lock",
+    "uv.lock",
+]);
+const EXTENSION_LANGUAGE = {
+    ".js": "javascript",
+    ".mjs": "javascript",
+    ".cjs": "javascript",
+    ".jsx": "javascript",
+    ".ts": "typescript",
+    ".mts": "typescript",
+    ".cts": "typescript",
+    ".tsx": "typescript",
+    ".py": "python",
+    ".java": "java",
+    ".kt": "kotlin",
+    ".kts": "kotlin",
+    ".go": "go",
+    ".c": "c",
+    ".h": "c",
+    ".cc": "cpp",
+    ".cpp": "cpp",
+    ".cxx": "cpp",
+    ".hpp": "cpp",
+    ".hh": "cpp",
+    ".cs": "csharp",
+    ".rs": "rust",
+    ".yaml": "config",
+    ".yml": "config",
+    ".toml": "config",
+    ".json": "config",
+    ".conf": "config",
+    ".cfg": "config",
+    ".ini": "config",
+    ".properties": "config",
+    ".pem": "config",
+    ".crt": "config",
+    ".cer": "config",
+    ".pub": "config",
+};
+const TEST_PATH_SEGMENTS = ["test", "tests", "__tests__", "spec", "specs", "testdata", "fixtures"];
+const TEST_FILE_PATTERN = /(\.test\.|\.spec\.|_test\.(?:go|py|rb)$|Tests?\.(?:java|kt|cs)$)/;
+export function detectLanguage(fileName) {
+    const lower = fileName.toLowerCase();
+    if (lower.endsWith(".min.js") || lower.endsWith(".min.mjs")) {
+        return null; // minified bundles: line-based findings are meaningless
+    }
+    const dot = lower.lastIndexOf(".");
+    if (dot === -1) {
+        return fileName === "Dockerfile" ? "config" : null;
+    }
+    return EXTENSION_LANGUAGE[lower.slice(dot)] ?? null;
+}
+export function isTestPath(relativePath) {
+    const posixPath = relativePath.split(sep).join("/");
+    const segments = posixPath.toLowerCase().split("/");
+    if (segments.some((segment) => TEST_PATH_SEGMENTS.includes(segment))) {
+        return true;
+    }
+    const base = segments[segments.length - 1] ?? "";
+    return TEST_FILE_PATTERN.test(base);
+}
+function looksBinary(buffer) {
+    const limit = Math.min(buffer.length, BINARY_SNIFF_BYTES);
+    for (let i = 0; i < limit; i++) {
+        if (buffer[i] === 0) {
+            return true;
+        }
+    }
+    return false;
+}
+export function hashLine(line) {
+    const normalized = line.trim().replace(/\s+/g, " ");
+    return createHash("sha256").update(normalized).digest("hex");
+}
+function resolveAlgorithm(rule, match, line, strippedLines, lineIndex) {
+    const base = typeof rule.algorithm === "function" ? rule.algorithm(match, line) : rule.algorithm;
+    if (base === null || base.length === 0) {
+        return null;
+    }
+    if (!rule.wantsKeySize) {
+        return { algorithm: base, keySize: null };
+    }
+    const keySize = findKeySizeNear(strippedLines, lineIndex);
+    if (base.startsWith("rsa")) {
+        return { algorithm: canonicalRsa(keySize), keySize };
+    }
+    if (base.startsWith("dsa") && keySize === 1024) {
+        return { algorithm: "dsa-1024", keySize };
+    }
+    return { algorithm: base, keySize };
+}
+/**
+ * Scan a single file's content. Exported for tests, the CLI's single-file
+ * mode, and future host integrations (qnsp-agent).
+ */
+export function scanFileContent(relativePath, content, language) {
+    const rules = ALL_RULES.filter((rule) => rule.languages.includes(language));
+    if (rules.length === 0) {
+        return [];
+    }
+    const strippedLines = stripComments(content, language);
+    const findings = [];
+    const testContext = isTestPath(relativePath);
+    const seen = new Set();
+    for (let i = 0; i < strippedLines.length; i++) {
+        const line = strippedLines[i] ?? "";
+        if (line.length === 0) {
+            continue;
+        }
+        for (const rule of rules) {
+            // Fresh exec per line: rule patterns are not /g, so lastIndex is 0.
+            const match = rule.pattern.exec(line);
+            if (!match) {
+                continue;
+            }
+            const resolved = resolveAlgorithm(rule, match, line, strippedLines, i);
+            if (!resolved) {
+                continue;
+            }
+            const dedupKey = `${rule.id}:${i}`;
+            if (seen.has(dedupKey)) {
+                continue;
+            }
+            seen.add(dedupKey);
+            findings.push({
+                path: relativePath.split(sep).join("/"),
+                line: i + 1,
+                language,
+                ruleId: rule.id,
+                library: rule.library,
+                algorithm: resolved.algorithm,
+                category: rule.category,
+                classification: rule.classification,
+                confidence: rule.confidence,
+                lineHash: hashLine(line),
+                ...(resolved.keySize !== null ? { keySize: resolved.keySize } : {}),
+                ...(testContext ? { testContext: true } : {}),
+            });
+        }
+    }
+    return findings;
+}
+/** Recursively scan a directory tree. */
+export async function scanDirectory(options) {
+    const maxFileBytes = options.maxFileBytes ?? DEFAULT_MAX_FILE_BYTES;
+    const maxFindings = options.maxFindings ?? DEFAULT_MAX_FINDINGS;
+    const skipDirs = new Set([...SKIP_DIRS, ...(options.excludeDirs ?? [])]);
+    const findings = [];
+    let filesScanned = 0;
+    let filesSkipped = 0;
+    let truncated = false;
+    async function walk(dir) {
+        if (truncated) {
+            return;
+        }
+        const entries = await readdir(dir, { withFileTypes: true });
+        // Deterministic order — identical trees produce identical summaries.
+        entries.sort((a, b) => a.name.localeCompare(b.name));
+        for (const entry of entries) {
+            if (truncated) {
+                return;
+            }
+            const fullPath = join(dir, entry.name);
+            if (entry.isSymbolicLink()) {
+                filesSkipped++;
+                continue; // never follow symlinks out of the scan root
+            }
+            if (entry.isDirectory()) {
+                if (skipDirs.has(entry.name)) {
+                    continue;
+                }
+                await walk(fullPath);
+                continue;
+            }
+            if (!entry.isFile()) {
+                continue;
+            }
+            if (SKIP_FILES.has(entry.name)) {
+                filesSkipped++;
+                continue;
+            }
+            const language = detectLanguage(entry.name);
+            if (!language) {
+                filesSkipped++;
+                continue;
+            }
+            const info = await stat(fullPath);
+            if (info.size > maxFileBytes) {
+                filesSkipped++;
+                continue;
+            }
+            const buffer = await readFile(fullPath);
+            if (looksBinary(buffer)) {
+                filesSkipped++;
+                continue;
+            }
+            filesScanned++;
+            const relPath = relative(options.rootDir, fullPath);
+            const fileFindings = scanFileContent(relPath, buffer.toString("utf8"), language);
+            for (const finding of fileFindings) {
+                if (findings.length >= maxFindings) {
+                    truncated = true;
+                    break;
+                }
+                findings.push(finding);
+            }
+        }
+    }
+    await walk(options.rootDir);
+    return { filesScanned, filesSkipped, findings, truncated };
+}
+//# sourceMappingURL=scanner.js.map

package/dist/code-scan/scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../../src/code-scan/scanner.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAEhD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAS3C,MAAM,sBAAsB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAC/C,MAAM,oBAAoB,GAAG,MAAM,CAAC;AACpC,MAAM,kBAAkB,GAAG,CAAC,GAAG,IAAI,CAAC;AAEpC,0EAA0E;AAC1E,MAAM,SAAS,GAAwB,IAAI,GAAG,CAAC;IAC9C,MAAM;IACN,KAAK;IACL,MAAM;IACN,cAAc;IACd,QAAQ;IACR,MAAM;IACN,OAAO;IACP,KAAK;IACL,QAAQ;IACR,KAAK;IACL,KAAK;IACL,OAAO;IACP,QAAQ;IACR,UAAU;IACV,aAAa;IACb,OAAO;IACP,MAAM;IACN,YAAY;CACZ,CAAC,CAAC;AAEH,MAAM,UAAU,GAAwB,IAAI,GAAG,CAAC;IAC/C,gBAAgB;IAChB,mBAAmB;IACnB,WAAW;IACX,YAAY;IACZ,QAAQ;IACR,aAAa;IACb,SAAS;CACT,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAA6B;IACpD,KAAK,EAAE,YAAY;IACnB,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,YAAY;IACpB,KAAK,EAAE,YAAY;IACnB,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,YAAY;IACpB,KAAK,EAAE,QAAQ;IACf,OAAO,EAAE,MAAM;IACf,KAAK,EAAE,QAAQ;IACf,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,IAAI;IACX,IAAI,EAAE,GAAG;IACT,IAAI,EAAE,GAAG;IACT,KAAK,EAAE,KAAK;IACZ,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,KAAK;IACb,KAAK,EAAE,KAAK;IACZ,KAAK,EAAE,QAAQ;IACf,KAAK,EAAE,MAAM;IACb,OAAO,EAAE,QAAQ;IACjB,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,QAAQ;IACjB,OAAO,EAAE,QAAQ;IACjB,OAAO,EAAE,QAAQ;IACjB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,aAAa,EAAE,QAAQ;IACvB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;CAChB,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;AACnG,MAAM,iBAAiB,GAAG,kEAAkE,CAAC;AAE7F,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC9C,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7D,OAAO,IAAI,CAAC,CAAC,wDAAwD;IACtE,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;QAChB,OAAO,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,CAAC;IACD,OAAO,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,YAAoB;IAC9C,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACtE,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,OAAO,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC1D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAY;IACpC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACpD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,gBAAgB,CACxB,IAAyB,EACzB,KAAsB,EACtB,IAAY,EACZ,aAAgC,EAChC,SAAiB;IAEjB,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;IACjG,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACxB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IAC1D,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC9B,YAAoB,EACpB,OAAe,EACf,QAAkB;IAElB,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5E,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACX,CAAC;IAED,MAAM,aAAa,GAAG,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,MAAM,WAAW,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,SAAS;QACV,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC1B,oEAAoE;YACpE,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACZ,SAAS;YACV,CAAC;YACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;YACvE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACf,SAAS;YACV,CAAC;YACD,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;YACnC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACxB,SAAS;YACV,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC;gBACb,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBACvC,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,QAAQ;gBACR,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC;gBACxB,GAAG,CAAC,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7C,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,yCAAyC;AACzC,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAoB;IACvD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,sBAAsB,CAAC;IACpE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAEzE,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,KAAK,UAAU,IAAI,CAAC,GAAW;QAC9B,IAAI,SAAS,EAAE,CAAC;YACf,OAAO;QACR,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,qEAAqE;QACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAErD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,SAAS,EAAE,CAAC;gBACf,OAAO;YACR,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC5B,YAAY,EAAE,CAAC;gBACf,SAAS,CAAC,6CAA6C;YACxD,CAAC;YACD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACzB,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9B,SAAS;gBACV,CAAC;gBACD,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACrB,SAAS;YACV,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBACrB,SAAS;YACV,CAAC;YACD,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChC,YAAY,EAAE,CAAC;gBACf,SAAS;YACV,CAAC;YACD,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACf,YAAY,EAAE,CAAC;gBACf,SAAS;YACV,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;YAClC,IAAI,IAAI,CAAC,IAAI,GAAG,YAAY,EAAE,CAAC;gBAC9B,YAAY,EAAE,CAAC;gBACf,SAAS;YACV,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACxC,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,YAAY,EAAE,CAAC;gBACf,SAAS;YACV,CAAC;YAED,YAAY,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACpD,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC;YACjF,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;gBACpC,IAAI,QAAQ,CAAC,MAAM,IAAI,WAAW,EAAE,CAAC;oBACpC,SAAS,GAAG,IAAI,CAAC;oBACjB,MAAM;gBACP,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC;QACF,CAAC;IACF,CAAC;IAED,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAE5B,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AAC5D,CAAC"}

package/dist/code-scan/strip.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Comment stripping — string-aware, per language family.
+ *
+ * Comments are removed BEFORE rule matching so a migration note that merely
+ * mentions a crypto API can never become a finding (the
+ * guard-that-reads-its-own-comment failure class, see
+ * .claude/rules/toolchain-single-source.md). String literals are KEPT:
+ * crypto APIs take algorithm names as string arguments
+ * (`Cipher.getInstance("RSA")`), so rules anchor on API context instead.
+ */
+import type { Language } from "./types.js";
+interface StripState {
+    /** Inside a C-style block comment. */
+    inBlockComment: boolean;
+    /** Python triple-quote delimiter currently open, or null. */
+    inTripleQuote: string | null;
+}
+export declare function createStripState(): StripState;
+/**
+ * Strip comments from a full file, returning one entry per original line so
+ * finding line numbers stay 1:1 with the source.
+ */
+export declare function stripComments(content: string, language: Language): string[];
+export {};
+//# sourceMappingURL=strip.d.ts.map

package/dist/code-scan/strip.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"strip.d.ts","sourceRoot":"","sources":["../../src/code-scan/strip.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAkB3C,UAAU,UAAU;IACnB,sCAAsC;IACtC,cAAc,EAAE,OAAO,CAAC;IACxB,6DAA6D;IAC7D,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,wBAAgB,gBAAgB,IAAI,UAAU,CAE7C;AA0HD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,MAAM,EAAE,CAiB3E"}

package/dist/code-scan/strip.js

@@ -0,0 +1,150 @@
+/**
+ * Comment stripping — string-aware, per language family.
+ *
+ * Comments are removed BEFORE rule matching so a migration note that merely
+ * mentions a crypto API can never become a finding (the
+ * guard-that-reads-its-own-comment failure class, see
+ * .claude/rules/toolchain-single-source.md). String literals are KEPT:
+ * crypto APIs take algorithm names as string arguments
+ * (`Cipher.getInstance("RSA")`), so rules anchor on API context instead.
+ */
+const COMMENT_STYLE = {
+    javascript: "c",
+    typescript: "c",
+    java: "c",
+    kotlin: "c",
+    go: "c",
+    c: "c",
+    cpp: "c",
+    csharp: "c",
+    rust: "c",
+    python: "hash",
+    config: "hash",
+};
+export function createStripState() {
+    return { inBlockComment: false, inTripleQuote: null };
+}
+function isEscaped(line, index) {
+    let backslashes = 0;
+    for (let i = index - 1; i >= 0 && line[i] === "\\"; i--) {
+        backslashes++;
+    }
+    return backslashes % 2 === 1;
+}
+/**
+ * Strip C-family comments from one line, tracking block-comment state across
+ * lines and skipping comment tokens that appear inside string literals.
+ */
+function stripCFamilyLine(line, state) {
+    let out = "";
+    let inString = null;
+    let i = 0;
+    while (i < line.length) {
+        const ch = line[i] ?? "";
+        const next = line[i + 1] ?? "";
+        if (state.inBlockComment) {
+            if (ch === "*" && next === "/") {
+                state.inBlockComment = false;
+                i += 2;
+                continue;
+            }
+            i++;
+            continue;
+        }
+        if (inString !== null) {
+            out += ch;
+            if (ch === inString && !isEscaped(line, i)) {
+                inString = null;
+            }
+            i++;
+            continue;
+        }
+        if (ch === '"' || ch === "'" || ch === "`") {
+            inString = ch;
+            out += ch;
+            i++;
+            continue;
+        }
+        if (ch === "/" && next === "/") {
+            break; // line comment — drop the rest
+        }
+        if (ch === "/" && next === "*") {
+            state.inBlockComment = true;
+            i += 2;
+            continue;
+        }
+        out += ch;
+        i++;
+    }
+    return out;
+}
+/**
+ * Strip hash-family comments (Python, YAML, TOML, shell-style configs) from
+ * one line, tracking Python triple-quoted blocks across lines and skipping
+ * `#` characters that appear inside string literals.
+ */
+function stripHashFamilyLine(line, state) {
+    let out = "";
+    let inString = null;
+    let i = 0;
+    while (i < line.length) {
+        const ch = line[i] ?? "";
+        if (state.inTripleQuote !== null) {
+            if (line.startsWith(state.inTripleQuote, i)) {
+                state.inTripleQuote = null;
+                i += 3;
+                continue;
+            }
+            i++;
+            continue;
+        }
+        if (inString !== null) {
+            out += ch;
+            if (ch === inString && !isEscaped(line, i)) {
+                inString = null;
+            }
+            i++;
+            continue;
+        }
+        if (line.startsWith('"""', i) || line.startsWith("'''", i)) {
+            state.inTripleQuote = line.slice(i, i + 3);
+            i += 3;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            inString = ch;
+            out += ch;
+            i++;
+            continue;
+        }
+        if (ch === "#") {
+            break; // comment — drop the rest
+        }
+        out += ch;
+        i++;
+    }
+    return out;
+}
+/**
+ * Strip comments from a full file, returning one entry per original line so
+ * finding line numbers stay 1:1 with the source.
+ */
+export function stripComments(content, language) {
+    const style = COMMENT_STYLE[language];
+    const lines = content.split(/\r?\n/);
+    if (style === "none") {
+        return lines;
+    }
+    const state = createStripState();
+    const stripped = [];
+    for (const line of lines) {
+        if (style === "c") {
+            stripped.push(stripCFamilyLine(line, state));
+        }
+        else {
+            stripped.push(stripHashFamilyLine(line, state));
+        }
+    }
+    return stripped;
+}
+//# sourceMappingURL=strip.js.map

package/dist/code-scan/strip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"strip.js","sourceRoot":"","sources":["../../src/code-scan/strip.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,MAAM,aAAa,GAAmC;IACrD,UAAU,EAAE,GAAG;IACf,UAAU,EAAE,GAAG;IACf,IAAI,EAAE,GAAG;IACT,MAAM,EAAE,GAAG;IACX,EAAE,EAAE,GAAG;IACP,CAAC,EAAE,GAAG;IACN,GAAG,EAAE,GAAG;IACR,MAAM,EAAE,GAAG;IACX,IAAI,EAAE,GAAG;IACT,MAAM,EAAE,MAAM;IACd,MAAM,EAAE,MAAM;CACd,CAAC;AASF,MAAM,UAAU,gBAAgB;IAC/B,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,KAAa;IAC7C,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,KAAK,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;QACzD,WAAW,EAAE,CAAC;IACf,CAAC;IACD,OAAO,WAAW,GAAG,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,IAAY,EAAE,KAAiB;IACxD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAE/B,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;YAC1B,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBAChC,KAAK,CAAC,cAAc,GAAG,KAAK,CAAC;gBAC7B,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACV,CAAC;YACD,CAAC,EAAE,CAAC;YACJ,SAAS;QACV,CAAC;QAED,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACvB,GAAG,IAAI,EAAE,CAAC;YACV,IAAI,EAAE,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC5C,QAAQ,GAAG,IAAI,CAAC;YACjB,CAAC;YACD,CAAC,EAAE,CAAC;YACJ,SAAS;QACV,CAAC;QAED,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC5C,QAAQ,GAAG,EAAE,CAAC;YACd,GAAG,IAAI,EAAE,CAAC;YACV,CAAC,EAAE,CAAC;YACJ,SAAS;QACV,CAAC;QAED,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAChC,MAAM,CAAC,+BAA+B;QACvC,CAAC;QAED,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAChC,KAAK,CAAC,cAAc,GAAG,IAAI,CAAC;YAC5B,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACV,CAAC;QAED,GAAG,IAAI,EAAE,CAAC;QACV,CAAC,EAAE,CAAC;IACL,CAAC;IAED,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,IAAY,EAAE,KAAiB;IAC3D,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAEzB,IAAI,KAAK,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YAClC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC7C,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC;gBAC3B,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACV,CAAC;YACD,CAAC,EAAE,CAAC;YACJ,SAAS;QACV,CAAC;QAED,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACvB,GAAG,IAAI,EAAE,CAAC;YACV,IAAI,EAAE,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC5C,QAAQ,GAAG,IAAI,CAAC;YACjB,CAAC;YACD,CAAC,EAAE,CAAC;YACJ,SAAS;QACV,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;YAC5D,KAAK,CAAC,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC3C,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACV,CAAC;QAED,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC9B,QAAQ,GAAG,EAAE,CAAC;YACd,GAAG,IAAI,EAAE,CAAC;YACV,CAAC,EAAE,CAAC;YACJ,SAAS;QACV,CAAC;QAED,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAChB,MAAM,CAAC,0BAA0B;QAClC,CAAC;QAED,GAAG,IAAI,EAAE,CAAC;QACV,CAAC,EAAE,CAAC;IACL,CAAC;IAED,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,QAAkB;IAChE,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,KAAK,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACP,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QACjD,CAAC;IACF,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC"}

package/dist/code-scan/types.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Core types for the source-code cryptography scanner.
+ *
+ * Design: docs/design/code-crypto-scanner.md. Findings are transport-shaped
+ * for the crypto-inventory ingest path: no source-code content beyond the
+ * matched rule id and a hash of the matched line ever leaves the scan host.
+ */
+export type Language = "javascript" | "typescript" | "python" | "java" | "kotlin" | "go" | "c" | "cpp" | "csharp" | "rust" | "config";
+export type FindingCategory = "asymmetric" | "symmetric" | "hash" | "protocol" | "artifact";
+/** Whether the detected primitive is quantum-vulnerable, PQC, or a hybrid. */
+export type FindingClassification = "classical" | "pqc" | "hybrid";
+export type Confidence = "high" | "medium";
+export interface CryptoDetectionRule {
+    /** Stable rule id, e.g. "js-node-crypto-generate-keypair-rsa". */
+    readonly id: string;
+    readonly languages: readonly Language[];
+    /**
+     * Matched against a single comment-stripped line. Patterns MUST anchor on
+     * API/import context (e.g. `Cipher.getInstance("RSA`), never on a bare
+     * algorithm word — bare words in prose strings are not usage evidence.
+     */
+    readonly pattern: RegExp;
+    /**
+     * Canonical algorithm id (matching the crypto-inventory assessor keys,
+     * e.g. "rsa-2048", "ecdsa-p256", "md5"), or an extractor deriving it from
+     * the regex match. Extractors may return null to veto a match.
+     */
+    readonly algorithm: string | ((match: RegExpExecArray, line: string) => string | null);
+    readonly category: FindingCategory;
+    readonly classification: FindingClassification;
+    readonly confidence: Confidence;
+    /** Library/API family the rule targets, e.g. "node:crypto", "JCA". */
+    readonly library: string;
+    /**
+     * When true and the canonical algorithm is size-parameterized (rsa/dsa),
+     * the scanner searches a few adjacent lines for a key-size literal.
+     */
+    readonly wantsKeySize?: boolean;
+}
+export interface CodeCryptoFinding {
+    /** Repo-relative POSIX path of the file. */
+    readonly path: string;
+    /** 1-indexed line of the match. */
+    readonly line: number;
+    readonly language: Language;
+    readonly ruleId: string;
+    readonly library: string;
+    /** Canonical algorithm id, e.g. "rsa-2048", "rsa-unknown", "ml-kem-768". */
+    readonly algorithm: string;
+    readonly category: FindingCategory;
+    readonly classification: FindingClassification;
+    readonly confidence: Confidence;
+    /** SHA-256 (hex) of the whitespace-normalized matched line. */
+    readonly lineHash: string;
+    readonly keySize?: number;
+    /** True when the file path looks like test code. */
+    readonly testContext?: boolean;
+}
+export interface ScanOptions {
+    /** Absolute directory to scan. */
+    readonly rootDir: string;
+    /** Additional directory names to skip (merged with built-in skip list). */
+    readonly excludeDirs?: readonly string[];
+    /** Per-file size cap in bytes (default 2 MiB). */
+    readonly maxFileBytes?: number;
+    /** Cap on total findings (default 50_000) — the scan stops at the cap. */
+    readonly maxFindings?: number;
+}
+export interface ScanSummary {
+    readonly filesScanned: number;
+    readonly filesSkipped: number;
+    readonly findings: readonly CodeCryptoFinding[];
+    /** True when maxFindings stopped the scan early (never silently). */
+    readonly truncated: boolean;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/code-scan/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/code-scan/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,MAAM,QAAQ,GACjB,YAAY,GACZ,YAAY,GACZ,QAAQ,GACR,MAAM,GACN,QAAQ,GACR,IAAI,GACJ,GAAG,GACH,KAAK,GACL,QAAQ,GACR,MAAM,GACN,QAAQ,CAAC;AAEZ,MAAM,MAAM,eAAe,GAAG,YAAY,GAAG,WAAW,GAAG,MAAM,GAAG,UAAU,GAAG,UAAU,CAAC;AAE5F,8EAA8E;AAC9E,MAAM,MAAM,qBAAqB,GAAG,WAAW,GAAG,KAAK,GAAG,QAAQ,CAAC;AAEnE,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE3C,MAAM,WAAW,mBAAmB;IACnC,kEAAkE;IAClE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,SAAS,QAAQ,EAAE,CAAC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC;IACvF,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,cAAc,EAAE,qBAAqB,CAAC;IAC/C,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CAChC;AAED,MAAM,WAAW,iBAAiB;IACjC,4CAA4C;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mCAAmC;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,cAAc,EAAE,qBAAqB,CAAC;IAC/C,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,+DAA+D;IAC/D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,oDAAoD;IACpD,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,MAAM,WAAW,WAAW;IAC3B,kCAAkC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,kDAAkD;IAClD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,0EAA0E;IAC1E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAChD,qEAAqE;IACrE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC5B"}

package/dist/code-scan/types.js

@@ -0,0 +1,9 @@
+/**
+ * Core types for the source-code cryptography scanner.
+ *
+ * Design: docs/design/code-crypto-scanner.md. Findings are transport-shaped
+ * for the crypto-inventory ingest path: no source-code content beyond the
+ * matched rule id and a hash of the matched line ever leaves the scan host.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/code-scan/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/code-scan/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/dist/index.d.ts

@@ -55,7 +55,7 @@ QnsiError as QnspError, QnsiNetworkError,
 QnsiNetworkError as QnspNetworkError, QnsiWebhookError, 
 /** @deprecated Use `QnsiWebhookError`. */
 QnsiWebhookError as QnspWebhookError, } from "./errors.js";
-export { type CreateKeyRequest, KmsClient } from "./kms.js";
+export { type CreateKeyRequest, type HspkSealRequest, type HspkSealResponse, type HspkSignRequest, KmsClient, type SealedPqcKey, } from "./kms.js";
 export { type CreateIndexRequest, type QueryRequest, SearchClient, type Vector, } from "./search.js";
 export { type PutObjectInput, StorageClient } from "./storage.js";
 export { type CreateTenantRequest, TenantClient } from "./tenant.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EACN,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,QAAQ,EACR,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,GAC1B,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,WAAW,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,KAAK,YAAY,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAGtE,OAAO,EACN,UAAU;AACV,oEAAoE;AACpE,UAAU,IAAI,UAAU,EACxB,KAAK,iBAAiB;AACtB,2CAA2C;AAC3C,KAAK,iBAAiB,IAAI,iBAAiB,GAC3C,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,qBAAqB,EAAE,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EACN,YAAY;AACZ,sCAAsC;AACtC,YAAY,IAAI,YAAY,EAC5B,aAAa;AACb,uCAAuC;AACvC,aAAa,IAAI,aAAa,EAC9B,SAAS;AACT,mCAAmC;AACnC,SAAS,IAAI,SAAS,EACtB,gBAAgB;AAChB,0CAA0C;AAC1C,gBAAgB,IAAI,gBAAgB,EACpC,gBAAgB;AAChB,0CAA0C;AAC1C,gBAAgB,IAAI,gBAAgB,GACpC,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,KAAK,gBAAgB,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC5D,OAAO,EACN,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,YAAY,EACZ,KAAK,MAAM,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,KAAK,cAAc,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,KAAK,mBAAmB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAErE,OAAO,EAAE,KAAK,mBAAmB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACnE,OAAO,EACN,mBAAmB,EACnB,gBAAgB;AAChB,0CAA0C;AAC1C,gBAAgB,IAAI,gBAAgB,EACpC,KAAK,gBAAgB;AACrB,0CAA0C;AAC1C,KAAK,gBAAgB,IAAI,gBAAgB,EACzC,0BAA0B;AAC1B,oDAAoD;AACpD,0BAA0B,IAAI,0BAA0B,GACxD,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EACN,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,QAAQ,EACR,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,GAC1B,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,WAAW,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,KAAK,YAAY,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAGtE,OAAO,EACN,UAAU;AACV,oEAAoE;AACpE,UAAU,IAAI,UAAU,EACxB,KAAK,iBAAiB;AACtB,2CAA2C;AAC3C,KAAK,iBAAiB,IAAI,iBAAiB,GAC3C,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,qBAAqB,EAAE,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EACN,YAAY;AACZ,sCAAsC;AACtC,YAAY,IAAI,YAAY,EAC5B,aAAa;AACb,uCAAuC;AACvC,aAAa,IAAI,aAAa,EAC9B,SAAS;AACT,mCAAmC;AACnC,SAAS,IAAI,SAAS,EACtB,gBAAgB;AAChB,0CAA0C;AAC1C,gBAAgB,IAAI,gBAAgB,EACpC,gBAAgB;AAChB,0CAA0C;AAC1C,gBAAgB,IAAI,gBAAgB,GACpC,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,SAAS,EACT,KAAK,YAAY,GACjB,MAAM,UAAU,CAAC;AAClB,OAAO,EACN,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,YAAY,EACZ,KAAK,MAAM,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,KAAK,cAAc,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,KAAK,mBAAmB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAErE,OAAO,EAAE,KAAK,mBAAmB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACnE,OAAO,EACN,mBAAmB,EACnB,gBAAgB;AAChB,0CAA0C;AAC1C,gBAAgB,IAAI,gBAAgB,EACpC,KAAK,gBAAgB;AACrB,0CAA0C;AAC1C,KAAK,gBAAgB,IAAI,gBAAgB,EACzC,0BAA0B;AAC1B,oDAAoD;AACpD,0BAA0B,IAAI,0BAA0B,GACxD,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -55,7 +55,7 @@ QnsiError as QnspError, QnsiNetworkError,
 QnsiNetworkError as QnspNetworkError, QnsiWebhookError, 
 /** @deprecated Use `QnsiWebhookError`. */
 QnsiWebhookError as QnspWebhookError, } from "./errors.js";
-export { KmsClient } from "./kms.js";
+export { KmsClient, } from "./kms.js";
 export { SearchClient, } from "./search.js";
 export { StorageClient } from "./storage.js";
 export { TenantClient } from "./tenant.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EACN,YAAY,GAIZ,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,QAAQ,GAKR,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,WAAW,EAAwB,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAqB,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,aAAa,EAA2B,MAAM,cAAc,CAAC;AACtE,8EAA8E;AAC9E,uEAAuE;AACvE,OAAO,EACN,UAAU;AACV,oEAAoE;AACpE,UAAU,IAAI,UAAU,GAIxB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,qBAAqB,EAA8B,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EACN,YAAY;AACZ,sCAAsC;AACtC,YAAY,IAAI,YAAY,EAC5B,aAAa;AACb,uCAAuC;AACvC,aAAa,IAAI,aAAa,EAC9B,SAAS;AACT,mCAAmC;AACnC,SAAS,IAAI,SAAS,EACtB,gBAAgB;AAChB,0CAA0C;AAC1C,gBAAgB,IAAI,gBAAgB,EACpC,gBAAgB;AAChB,0CAA0C;AAC1C,gBAAgB,IAAI,gBAAgB,GACpC,MAAM,aAAa,CAAC;AACrB,OAAO,EAAyB,SAAS,EAAE,MAAM,UAAU,CAAC;AAC5D,OAAO,EAGN,YAAY,GAEZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAuB,aAAa,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAA4B,YAAY,EAAE,MAAM,aAAa,CAAC;AACrE,yEAAyE;AACzE,OAAO,EAA4B,WAAW,EAAE,MAAM,YAAY,CAAC;AACnE,OAAO,EACN,mBAAmB,EACnB,gBAAgB;AAChB,0CAA0C;AAC1C,gBAAgB,IAAI,gBAAgB,EAIpC,0BAA0B;AAC1B,oDAAoD;AACpD,0BAA0B,IAAI,0BAA0B,GACxD,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EACN,YAAY,GAIZ,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,QAAQ,GAKR,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,WAAW,EAAwB,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAqB,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,aAAa,EAA2B,MAAM,cAAc,CAAC;AACtE,8EAA8E;AAC9E,uEAAuE;AACvE,OAAO,EACN,UAAU;AACV,oEAAoE;AACpE,UAAU,IAAI,UAAU,GAIxB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,qBAAqB,EAA8B,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EACN,YAAY;AACZ,sCAAsC;AACtC,YAAY,IAAI,YAAY,EAC5B,aAAa;AACb,uCAAuC;AACvC,aAAa,IAAI,aAAa,EAC9B,SAAS;AACT,mCAAmC;AACnC,SAAS,IAAI,SAAS,EACtB,gBAAgB;AAChB,0CAA0C;AAC1C,gBAAgB,IAAI,gBAAgB,EACpC,gBAAgB;AAChB,0CAA0C;AAC1C,gBAAgB,IAAI,gBAAgB,GACpC,MAAM,aAAa,CAAC;AACrB,OAAO,EAKN,SAAS,GAET,MAAM,UAAU,CAAC;AAClB,OAAO,EAGN,YAAY,GAEZ,MAAM,aAAa,CAAC;AACrB,OAAO,EAAuB,aAAa,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAA4B,YAAY,EAAE,MAAM,aAAa,CAAC;AACrE,yEAAyE;AACzE,OAAO,EAA4B,WAAW,EAAE,MAAM,YAAY,CAAC;AACnE,OAAO,EACN,mBAAmB,EACnB,gBAAgB;AAChB,0CAA0C;AAC1C,gBAAgB,IAAI,gBAAgB,EAIpC,0BAA0B;AAC1B,oDAAoD;AACpD,0BAA0B,IAAI,0BAA0B,GACxD,MAAM,eAAe,CAAC"}