@heossi/qnsi 0.5.6 → 0.6.0

package/dist/cli/commands/crypto-scan.d.ts

@@ -0,0 +1,13 @@
+/**
+ * `qnsi crypto scan` — source-code cryptography scanning.
+ *
+ * Runs the @heossi/qnsi/code-scan engine locally (parse-only, zero network in
+ * scan mode) and prints findings as a table, JSON, or a CycloneDX 1.5 CBOM.
+ * With --upload, submits a findings-only report (never source code) to
+ * POST /proxy/crypto/v1/code-scan-reports using the same HMAC agent protocol
+ * as the qnsp host agent. Design: docs/design/code-crypto-scanner.md.
+ */
+import type { Command } from "commander";
+import type { CliConfig } from "../config.js";
+export declare function registerCryptoScanCommands(program: Command, config: CliConfig): void;
+//# sourceMappingURL=crypto-scan.d.ts.map

package/dist/cli/commands/crypto-scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-scan.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/crypto-scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKzC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AA4L9C,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,GAAG,IAAI,CA2FpF"}

package/dist/cli/commands/crypto-scan.js

@@ -0,0 +1,247 @@
+/**
+ * `qnsi crypto scan` — source-code cryptography scanning.
+ *
+ * Runs the @heossi/qnsi/code-scan engine locally (parse-only, zero network in
+ * scan mode) and prints findings as a table, JSON, or a CycloneDX 1.5 CBOM.
+ * With --upload, submits a findings-only report (never source code) to
+ * POST /proxy/crypto/v1/code-scan-reports using the same HMAC agent protocol
+ * as the qnsp host agent. Design: docs/design/code-crypto-scanner.md.
+ */
+import { createHash, createHmac, randomBytes } from "node:crypto";
+import { writeFile } from "node:fs/promises";
+import { basename, resolve } from "node:path";
+import cliPackage from "../../../package.json" with { type: "json" };
+import { RULE_SET_VERSION, scanDirectory } from "../../code-scan/index.js";
+import { EXIT_CODES } from "../config.js";
+import { printError, printJson, printSuccess, printTable } from "../utils/output.js";
+const UPLOAD_TIMEOUT_MS = 30_000;
+/** Server-side cap on findings per report (route schema). */
+const MAX_UPLOAD_FINDINGS = 10_000;
+/**
+ * Derive the HMAC key from the agent bootstrap secret: SHA-256 over the
+ * DECODED bytes of the hex secret. Matches agent-auth.ts / qnsp-agent.
+ */
+function deriveHmacKey(secret) {
+    return createHash("sha256").update(Buffer.from(secret, "hex")).digest();
+}
+function signReport(agentId, secret, rawBody) {
+    const timestamp = new Date().toISOString();
+    const nonce = randomBytes(16).toString("hex");
+    const bodyHash = createHash("sha256").update(rawBody).digest("hex");
+    const signature = createHmac("sha256", deriveHmacKey(secret))
+        .update(`${timestamp}.${nonce}.${bodyHash}`)
+        .digest("hex");
+    return {
+        "x-agent-id": agentId,
+        "x-agent-timestamp": timestamp,
+        "x-agent-nonce": nonce,
+        "x-agent-body-hash": bodyHash,
+        "x-agent-signature": signature,
+    };
+}
+/**
+ * Wire shape for one finding — matches codeScanReportSchema exactly. The
+ * engine's `classification` field is intentionally NOT sent: the server
+ * derives isPqc/isHybrid from the canonical algorithm id and the strict
+ * schema rejects unknown keys.
+ */
+function toWireFinding(finding) {
+    return {
+        path: finding.path,
+        line: finding.line,
+        language: finding.language,
+        library: finding.library,
+        ruleId: finding.ruleId,
+        algorithm: finding.algorithm,
+        category: finding.category,
+        confidence: finding.confidence,
+        lineHash: finding.lineHash,
+        ...(finding.keySize !== undefined ? { keySize: finding.keySize } : {}),
+        ...(finding.testContext !== undefined ? { testContext: finding.testContext } : {}),
+    };
+}
+/** Minimal CycloneDX 1.5 CBOM built locally from scan findings. */
+function buildLocalCbom(summary, scannedPath) {
+    const byAlgorithm = new Map();
+    for (const finding of summary.findings) {
+        const entry = byAlgorithm.get(finding.algorithm);
+        if (entry) {
+            entry.count += 1;
+        }
+        else {
+            byAlgorithm.set(finding.algorithm, {
+                count: 1,
+                classification: finding.classification,
+            });
+        }
+    }
+    return {
+        bomFormat: "CycloneDX",
+        specVersion: "1.5",
+        metadata: {
+            timestamp: new Date().toISOString(),
+            tools: [{ name: "qnsi crypto scan", version: cliPackage.version }],
+            component: { type: "application", name: scannedPath },
+        },
+        components: Array.from(byAlgorithm.entries()).map(([algorithm, info]) => ({
+            type: "crypto-asset",
+            name: algorithm,
+            postureClass: info.classification,
+            occurrences: info.count,
+            cryptoProperties: { assetType: "algorithm" },
+        })),
+        summary: {
+            filesScanned: summary.filesScanned,
+            filesSkipped: summary.filesSkipped,
+            totalFindings: summary.findings.length,
+            classical: summary.findings.filter((f) => f.classification === "classical").length,
+            pqc: summary.findings.filter((f) => f.classification === "pqc").length,
+            hybrid: summary.findings.filter((f) => f.classification === "hybrid").length,
+            truncated: summary.truncated,
+        },
+    };
+}
+async function uploadReport(config, options, summary, scannedPath) {
+    const agentId = options.agentId ?? process.env["QNSI_AGENT_ID"];
+    const agentSecret = options.agentSecret ?? process.env["QNSI_AGENT_SECRET"];
+    const tenantId = config.tenantId;
+    const edgeGatewayUrl = config.edgeGatewayUrl;
+    if (!agentId || !agentSecret) {
+        printError("--upload requires agent credentials (--agent-id/--agent-secret or QNSI_AGENT_ID/QNSI_AGENT_SECRET). Register a scanner agent under Crypto Posture → Agents.");
+        return false;
+    }
+    if (!tenantId) {
+        printError("--upload requires QNSI_TENANT_ID");
+        return false;
+    }
+    if (!edgeGatewayUrl) {
+        printError("--upload requires QNSI_EDGE_GATEWAY_URL");
+        return false;
+    }
+    if (!options.repoId) {
+        printError("--upload requires --repo-id (stable identifier used to dedupe rescans)");
+        return false;
+    }
+    if (summary.findings.length > MAX_UPLOAD_FINDINGS) {
+        printError(`Scan produced ${summary.findings.length} findings; the ingest cap is ${MAX_UPLOAD_FINDINGS}. Narrow the scan with --exclude.`);
+        return false;
+    }
+    const report = {
+        agentId,
+        repo: {
+            id: options.repoId,
+            name: options.repoName ?? basename(scannedPath),
+            ...(options.ref ? { ref: options.ref } : {}),
+            ...(options.commit ? { commitSha: options.commit } : {}),
+        },
+        scannedAt: new Date().toISOString(),
+        scannerVersion: cliPackage.version,
+        ruleSetVersion: RULE_SET_VERSION,
+        findings: summary.findings.map(toWireFinding),
+    };
+    const rawBody = Buffer.from(JSON.stringify(report), "utf8");
+    const url = `${edgeGatewayUrl.replace(/\/$/, "")}/proxy/crypto/v1/code-scan-reports`;
+    const response = await fetch(url, {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            "x-qnsp-tenant": tenantId,
+            ...signReport(agentId, agentSecret, rawBody),
+        },
+        body: rawBody,
+        signal: AbortSignal.timeout(UPLOAD_TIMEOUT_MS),
+    });
+    if (response.status !== 202) {
+        const errorText = await response.text();
+        printError(`Upload failed: ${response.status} ${errorText}`);
+        return false;
+    }
+    const accepted = (await response.json());
+    printSuccess(`Uploaded ${accepted.findingCount ?? summary.findings.length} findings (bodyHash ${accepted.bodyHash ?? "n/a"}). They enter the CBOM on the next discovery run of the code_repo source.`);
+    return true;
+}
+export function registerCryptoScanCommands(program, config) {
+    const crypto = program
+        .command("crypto")
+        .description("Cryptographic inventory commands (source-code scanning)");
+    crypto
+        .command("scan [directory]")
+        .description("Scan source code for classical/PQC cryptography usage (local, parse-only; code never leaves this machine)")
+        .option("--format <format>", "Output format: table | json | cbom", "table")
+        .option("--output <file>", "Write output to a file instead of stdout")
+        .option("--exclude <dirs>", "Comma-separated extra directory names to skip")
+        .option("--max-findings <n>", "Stop after N findings (reported as truncated)")
+        .option("--upload", "Upload findings to the QNSI crypto inventory (requires agent credentials)")
+        .option("--repo-id <id>", "Stable repository id for upload dedup (required with --upload)")
+        .option("--repo-name <name>", "Repository display name (default: directory basename)")
+        .option("--ref <ref>", "Git ref being scanned (upload metadata)")
+        .option("--commit <sha>", "Git commit SHA being scanned (upload metadata)")
+        .option("--agent-id <id>", "Scanner agent id (or QNSI_AGENT_ID)")
+        .option("--agent-secret <secret>", "Scanner agent secret (or QNSI_AGENT_SECRET)")
+        .action(async (directory, options) => {
+        const scannedPath = resolve(directory ?? ".");
+        let summary;
+        try {
+            summary = await scanDirectory({
+                rootDir: scannedPath,
+                ...(options.exclude
+                    ? { excludeDirs: options.exclude.split(",").map((d) => d.trim()) }
+                    : {}),
+                ...(options.maxFindings ? { maxFindings: Number.parseInt(options.maxFindings, 10) } : {}),
+            });
+        }
+        catch (err) {
+            printError(`Scan failed: ${err instanceof Error ? err.message : String(err)}`);
+            process.exit(EXIT_CODES.GENERAL_ERROR);
+            return;
+        }
+        if (summary.truncated) {
+            printError(`Warning: finding cap reached — results are TRUNCATED (${summary.findings.length} findings).`);
+        }
+        const format = options.format ?? "table";
+        if (format === "cbom") {
+            const cbom = buildLocalCbom(summary, scannedPath);
+            if (options.output) {
+                await writeFile(options.output, `${JSON.stringify(cbom, null, "\t")}\n`, "utf8");
+                printSuccess(`CBOM written to ${options.output}`);
+            }
+            else {
+                printJson(cbom);
+            }
+        }
+        else if (format === "json") {
+            const payload = {
+                scannedPath,
+                filesScanned: summary.filesScanned,
+                filesSkipped: summary.filesSkipped,
+                truncated: summary.truncated,
+                findings: summary.findings,
+            };
+            if (options.output) {
+                await writeFile(options.output, `${JSON.stringify(payload, null, "\t")}\n`, "utf8");
+                printSuccess(`Findings written to ${options.output}`);
+            }
+            else {
+                printJson(payload);
+            }
+        }
+        else {
+            printTable(summary.findings.map((f) => ({
+                path: `${f.path}:${f.line}`,
+                algorithm: f.algorithm,
+                class: f.classification,
+                confidence: f.confidence,
+                rule: f.ruleId,
+            })));
+            printSuccess(`${summary.findings.length} findings in ${summary.filesScanned} files (${summary.filesSkipped} skipped)`);
+        }
+        if (options.upload) {
+            const ok = await uploadReport(config, options, summary, scannedPath);
+            if (!ok) {
+                process.exit(EXIT_CODES.INVALID_ARGUMENTS);
+                return;
+            }
+        }
+    });
+}
+//# sourceMappingURL=crypto-scan.js.map

package/dist/cli/commands/crypto-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-scan.js","sourceRoot":"","sources":["../../../src/cli/commands/crypto-scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAI9C,OAAO,UAAU,MAAM,uBAAuB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAErE,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAE3E,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErF,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACjC,6DAA6D;AAC7D,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC;;;GAGG;AACH,SAAS,aAAa,CAAC,MAAc;IACpC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,UAAU,CAAC,OAAe,EAAE,MAAc,EAAE,OAAe;IACnE,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;SAC3D,MAAM,CAAC,GAAG,SAAS,IAAI,KAAK,IAAI,QAAQ,EAAE,CAAC;SAC3C,MAAM,CAAC,KAAK,CAAC,CAAC;IAEhB,OAAO;QACN,YAAY,EAAE,OAAO;QACrB,mBAAmB,EAAE,SAAS;QAC9B,eAAe,EAAE,KAAK;QACtB,mBAAmB,EAAE,QAAQ;QAC7B,mBAAmB,EAAE,SAAS;KAC9B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,OAA0B;IAChD,OAAO;QACN,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClF,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,SAAS,cAAc,CAAC,OAAoB,EAAE,WAAmB;IAChE,MAAM,WAAW,GAAG,IAAI,GAAG,EAAqD,CAAC;IACjF,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,KAAK,EAAE,CAAC;YACX,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;QAClB,CAAC;aAAM,CAAC;YACP,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE;gBAClC,KAAK,EAAE,CAAC;gBACR,cAAc,EAAE,OAAO,CAAC,cAAc;aACtC,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,OAAO;QACN,SAAS,EAAE,WAAW;QACtB,WAAW,EAAE,KAAK;QAClB,QAAQ,EAAE;YACT,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC;YAClE,SAAS,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW,EAAE;SACrD;QACD,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACzE,IAAI,EAAE,cAAc;YACpB,IAAI,EAAE,SAAS;YACf,YAAY,EAAE,IAAI,CAAC,cAAc;YACjC,WAAW,EAAE,IAAI,CAAC,KAAK;YACvB,gBAAgB,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE;SAC5C,CAAC,CAAC;QACH,OAAO,EAAE;YACR,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM;YACtC,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,WAAW,CAAC,CAAC,MAAM;YAClF,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,KAAK,CAAC,CAAC,MAAM;YACtE,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,MAAM;YAC5E,SAAS,EAAE,OAAO,CAAC,SAAS;SAC5B;KACD,CAAC;AACH,CAAC;AAgBD,KAAK,UAAU,YAAY,CAC1B,MAAiB,EACjB,OAA0B,EAC1B,OAAoB,EACpB,WAAmB;IAEnB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAChE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;IAE7C,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;QAC9B,UAAU,CACT,6JAA6J,CAC7J,CAAC;QACF,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,UAAU,CAAC,kCAAkC,CAAC,CAAC;QAC/C,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC,cAAc,EAAE,CAAC;QACrB,UAAU,CAAC,yCAAyC,CAAC,CAAC;QACtD,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACrB,UAAU,CAAC,wEAAwE,CAAC,CAAC;QACrF,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;QACnD,UAAU,CACT,iBAAiB,OAAO,CAAC,QAAQ,CAAC,MAAM,gCAAgC,mBAAmB,mCAAmC,CAC9H,CAAC;QACF,OAAO,KAAK,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG;QACd,OAAO;QACP,IAAI,EAAE;YACL,EAAE,EAAE,OAAO,CAAC,MAAM;YAClB,IAAI,EAAE,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,WAAW,CAAC;YAC/C,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD;QACD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,cAAc,EAAE,UAAU,CAAC,OAAO;QAClC,cAAc,EAAE,gBAAgB;QAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC;KAC7C,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,oCAAoC,CAAC;IAErF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QACjC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACR,cAAc,EAAE,kBAAkB;YAClC,eAAe,EAAE,QAAQ;YACzB,GAAG,UAAU,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC;SAC5C;QACD,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,iBAAiB,CAAC;KAC9C,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACxC,UAAU,CAAC,kBAAkB,QAAQ,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAC;QAC7D,OAAO,KAAK,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAiD,CAAC;IACzF,YAAY,CACX,YAAY,QAAQ,CAAC,YAAY,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,uBAAuB,QAAQ,CAAC,QAAQ,IAAI,KAAK,2EAA2E,CACxL,CAAC;IACF,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,OAAgB,EAAE,MAAiB;IAC7E,MAAM,MAAM,GAAG,OAAO;SACpB,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,yDAAyD,CAAC,CAAC;IAEzE,MAAM;SACJ,OAAO,CAAC,kBAAkB,CAAC;SAC3B,WAAW,CACX,2GAA2G,CAC3G;SACA,MAAM,CAAC,mBAAmB,EAAE,oCAAoC,EAAE,OAAO,CAAC;SAC1E,MAAM,CAAC,iBAAiB,EAAE,0CAA0C,CAAC;SACrE,MAAM,CAAC,kBAAkB,EAAE,+CAA+C,CAAC;SAC3E,MAAM,CAAC,oBAAoB,EAAE,+CAA+C,CAAC;SAC7E,MAAM,CAAC,UAAU,EAAE,2EAA2E,CAAC;SAC/F,MAAM,CAAC,gBAAgB,EAAE,gEAAgE,CAAC;SAC1F,MAAM,CAAC,oBAAoB,EAAE,uDAAuD,CAAC;SACrF,MAAM,CAAC,aAAa,EAAE,yCAAyC,CAAC;SAChE,MAAM,CAAC,gBAAgB,EAAE,gDAAgD,CAAC;SAC1E,MAAM,CAAC,iBAAiB,EAAE,qCAAqC,CAAC;SAChE,MAAM,CAAC,yBAAyB,EAAE,6CAA6C,CAAC;SAChF,MAAM,CAAC,KAAK,EAAE,SAA6B,EAAE,OAA0B,EAAE,EAAE;QAC3E,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,IAAI,GAAG,CAAC,CAAC;QAE9C,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACJ,OAAO,GAAG,MAAM,aAAa,CAAC;gBAC7B,OAAO,EAAE,WAAW;gBACpB,GAAG,CAAC,OAAO,CAAC,OAAO;oBAClB,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE;oBAClE,CAAC,CAAC,EAAE,CAAC;gBACN,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACzF,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,UAAU,CAAC,gBAAgB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/E,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;YACvC,OAAO;QACR,CAAC;QAED,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACvB,UAAU,CACT,yDAAyD,OAAO,CAAC,QAAQ,CAAC,MAAM,aAAa,CAC7F,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC;QACzC,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAClD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACpB,MAAM,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACjF,YAAY,CAAC,mBAAmB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACnD,CAAC;iBAAM,CAAC;gBACP,SAAS,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC;QACF,CAAC;aAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG;gBACf,WAAW;gBACX,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC1B,CAAC;YACF,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACpB,MAAM,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACpF,YAAY,CAAC,uBAAuB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACvD,CAAC;iBAAM,CAAC;gBACP,SAAS,CAAC,OAAO,CAAC,CAAC;YACpB,CAAC;QACF,CAAC;aAAM,CAAC;YACP,UAAU,CACT,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC5B,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE;gBAC3B,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,KAAK,EAAE,CAAC,CAAC,cAAc;gBACvB,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,IAAI,EAAE,CAAC,CAAC,MAAM;aACd,CAAC,CAAC,CACH,CAAC;YACF,YAAY,CACX,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,gBAAgB,OAAO,CAAC,YAAY,WAAW,OAAO,CAAC,YAAY,WAAW,CACxG,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;YACrE,IAAI,CAAC,EAAE,EAAE,CAAC;gBACT,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;gBAC3C,OAAO;YACR,CAAC;QACF,CAAC;IACF,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/index.js

@@ -6,6 +6,7 @@ import { registerAuditCommands } from "./commands/audit.js";
 import { registerAuthCommands } from "./commands/auth.js";
 import { registerBillingCommands } from "./commands/billing.js";
 import { registerCryptoPolicyCommands } from "./commands/crypto-policy.js";
+import { registerCryptoScanCommands } from "./commands/crypto-scan.js";
 import { registerKmsCommands } from "./commands/kms.js";
 import { registerObservabilityCommands } from "./commands/observability.js";
 import { registerSearchCommands } from "./commands/search.js";
@@ -62,6 +63,7 @@ registerStorageCommands(program, config);
 registerSearchCommands(program, config);
 registerTenantCommands(program, config);
 registerCryptoPolicyCommands(program, config);
+registerCryptoScanCommands(program, config);
 registerBillingCommands(program, config);
 registerAccessControlCommands(program, config);
 registerObservabilityCommands(program, config);

package/dist/cli/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,UAAU,MAAM,oBAAoB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAClE,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEtD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACL,IAAI,CAAC,MAAM,CAAC;KACZ,WAAW,CAAC,yDAAyD,CAAC;KACtE,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;KAC3B,MAAM,CAAC,0BAA0B,EAAE,0CAA0C,CAAC;KAC9E,MAAM,CAAC,0BAA0B,EAAE,6CAA6C,CAAC;KACjF,MAAM,CAAC,0BAA0B,EAAE,kBAAkB,CAAC;KACtD,MAAM,CAAC,mBAAmB,EAAE,oBAAoB,CAAC;KACjD,MAAM,CAAC,2BAA2B,EAAE,wBAAwB,CAAC;KAC7D,MAAM,CAAC,kBAAkB,EAAE,mBAAmB,CAAC;KAC/C,MAAM,CAAC,yBAAyB,EAAE,iBAAiB,CAAC;KACpD,MAAM,CAAC,2BAA2B,EAAE,mBAAmB,CAAC;KACxD,MAAM,CAAC,2BAA2B,EAAE,mBAAmB,CAAC;KACxD,MAAM,CAAC,4BAA4B,EAAE,oBAAoB,CAAC;KAC1D,MAAM,CAAC,6BAA6B,EAAE,qBAAqB,CAAC;KAC5D,MAAM,CAAC,oCAAoC,EAAE,4BAA4B,CAAC;KAC1E,MAAM,CAAC,yCAAyC,EAAE,iCAAiC,CAAC;KACpF,MAAM,CAAC,6BAA6B,EAAE,qBAAqB,CAAC;KAC5D,MAAM,CAAC,4BAA4B,EAAE,oBAAoB,CAAC;KAC1D,MAAM,CAAC,mCAAmC,EAAE,2BAA2B,CAAC;KACxE,MAAM,CAAC,mBAAmB,EAAE,kCAAkC,EAAE,OAAO,CAAC;KACxE,MAAM,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC;AAE/C,MAAM,UAAU,GAAG,UAAU,EAAE,CAAC;AAEhC;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,GACX,UAAU,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ;IACxC,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC,UAAU,CAAC,EAAE;IACpE,CAAC,CAAC,UAAU,CAAC;AAEf,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACtC,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACrC,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACvC,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACvC,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACzC,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACxC,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACxC,4BAA4B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAC9C,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACzC,6BAA6B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAC/C,6BAA6B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAC/C,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAE1C,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,UAAU,MAAM,oBAAoB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAClE,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEtD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACL,IAAI,CAAC,MAAM,CAAC;KACZ,WAAW,CAAC,yDAAyD,CAAC;KACtE,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC;KAC3B,MAAM,CAAC,0BAA0B,EAAE,0CAA0C,CAAC;KAC9E,MAAM,CAAC,0BAA0B,EAAE,6CAA6C,CAAC;KACjF,MAAM,CAAC,0BAA0B,EAAE,kBAAkB,CAAC;KACtD,MAAM,CAAC,mBAAmB,EAAE,oBAAoB,CAAC;KACjD,MAAM,CAAC,2BAA2B,EAAE,wBAAwB,CAAC;KAC7D,MAAM,CAAC,kBAAkB,EAAE,mBAAmB,CAAC;KAC/C,MAAM,CAAC,yBAAyB,EAAE,iBAAiB,CAAC;KACpD,MAAM,CAAC,2BAA2B,EAAE,mBAAmB,CAAC;KACxD,MAAM,CAAC,2BAA2B,EAAE,mBAAmB,CAAC;KACxD,MAAM,CAAC,4BAA4B,EAAE,oBAAoB,CAAC;KAC1D,MAAM,CAAC,6BAA6B,EAAE,qBAAqB,CAAC;KAC5D,MAAM,CAAC,oCAAoC,EAAE,4BAA4B,CAAC;KAC1E,MAAM,CAAC,yCAAyC,EAAE,iCAAiC,CAAC;KACpF,MAAM,CAAC,6BAA6B,EAAE,qBAAqB,CAAC;KAC5D,MAAM,CAAC,4BAA4B,EAAE,oBAAoB,CAAC;KAC1D,MAAM,CAAC,mCAAmC,EAAE,2BAA2B,CAAC;KACxE,MAAM,CAAC,mBAAmB,EAAE,kCAAkC,EAAE,OAAO,CAAC;KACxE,MAAM,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC;AAE/C,MAAM,UAAU,GAAG,UAAU,EAAE,CAAC;AAEhC;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,GACX,UAAU,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ;IACxC,CAAC,CAAC,EAAE,GAAG,UAAU,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC,UAAU,CAAC,EAAE;IACpE,CAAC,CAAC,UAAU,CAAC;AAEf,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACtC,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACrC,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACvC,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACvC,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACzC,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACxC,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACxC,4BAA4B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAC9C,0BAA0B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAC5C,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACzC,6BAA6B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAC/C,6BAA6B,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAC/C,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAE1C,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC"}

package/dist/code-scan/canonical.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Canonical algorithm ids — MUST stay aligned with the keys consumed by
+ * crypto-inventory-service's PqcReadinessAssessor (ALGORITHM_BASE_URGENCY /
+ * RECOMMENDED_REPLACEMENT) and isPqcAlgorithm(). An id the assessor does not
+ * know falls back to migration urgency "high", which is fail-safe.
+ */
+/** rsa + optional size → "rsa-2048" | "rsa-unknown". */
+export declare function canonicalRsa(keySize: number | null): string;
+/**
+ * Curve name → canonical "ecdsa-p256"-style id. `usage` distinguishes
+ * signing (ecdsa) from key agreement (ecdh); default is ecdsa.
+ */
+export declare function canonicalEcCurve(curve: string, usage?: "ecdsa" | "ecdh"): string | null;
+/**
+ * Normalize an algorithm token the way the assessor does (lowercase,
+ * underscores → dashes).
+ */
+export declare function normalizeAlgorithmId(algorithm: string): string;
+/**
+ * Search adjacent lines for a key-size literal near a size-parameterized
+ * finding (e.g. `modulusLength: 2048` on the line after `generateKeyPair`).
+ * Window is deliberately small to avoid picking up unrelated numbers.
+ */
+export declare function findKeySizeNear(lines: readonly string[], lineIndex: number): number | null;
+//# sourceMappingURL=canonical.d.ts.map

package/dist/code-scan/canonical.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../../src/code-scan/canonical.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,wDAAwD;AACxD,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAK3D;AAqBD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,GAAE,OAAO,GAAG,MAAgB,GAAG,MAAM,GAAG,IAAI,CAMhG;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAyB1F"}

package/dist/code-scan/canonical.js

@@ -0,0 +1,80 @@
+/**
+ * Canonical algorithm ids — MUST stay aligned with the keys consumed by
+ * crypto-inventory-service's PqcReadinessAssessor (ALGORITHM_BASE_URGENCY /
+ * RECOMMENDED_REPLACEMENT) and isPqcAlgorithm(). An id the assessor does not
+ * know falls back to migration urgency "high", which is fail-safe.
+ */
+const RSA_SIZES = new Set([1024, 2048, 3072, 4096]);
+/** rsa + optional size → "rsa-2048" | "rsa-unknown". */
+export function canonicalRsa(keySize) {
+    if (keySize !== null && RSA_SIZES.has(keySize)) {
+        return `rsa-${keySize}`;
+    }
+    return "rsa-unknown";
+}
+const CURVE_MAP = {
+    // NIST P-curves under their many aliases
+    "p-192": "p192",
+    p192: "p192",
+    prime192v1: "p192",
+    secp192r1: "p192",
+    "p-256": "p256",
+    p256: "p256",
+    prime256v1: "p256",
+    secp256r1: "p256",
+    secp256k1: "p256",
+    "p-384": "p384",
+    p384: "p384",
+    secp384r1: "p384",
+    "p-521": "p521",
+    p521: "p521",
+    secp521r1: "p521",
+};
+/**
+ * Curve name → canonical "ecdsa-p256"-style id. `usage` distinguishes
+ * signing (ecdsa) from key agreement (ecdh); default is ecdsa.
+ */
+export function canonicalEcCurve(curve, usage = "ecdsa") {
+    const suffix = CURVE_MAP[curve.toLowerCase()];
+    if (!suffix) {
+        return null;
+    }
+    return `${usage}-${suffix}`;
+}
+/**
+ * Normalize an algorithm token the way the assessor does (lowercase,
+ * underscores → dashes).
+ */
+export function normalizeAlgorithmId(algorithm) {
+    return algorithm.toLowerCase().replace(/_/g, "-");
+}
+/**
+ * Search adjacent lines for a key-size literal near a size-parameterized
+ * finding (e.g. `modulusLength: 2048` on the line after `generateKeyPair`).
+ * Window is deliberately small to avoid picking up unrelated numbers.
+ */
+export function findKeySizeNear(lines, lineIndex) {
+    const SIZE_PATTERN = /(?:modulusLength|keySize|key_size|keysize|bits|size|modulus_length)\s*[:=(]\s*(\d{3,5})/i;
+    const INLINE_PATTERN = /\b(1024|2048|3072|4096)\b/;
+    const start = lineIndex;
+    const end = Math.min(lines.length - 1, lineIndex + 4);
+    for (let i = start; i <= end; i++) {
+        const line = lines[i] ?? "";
+        const named = SIZE_PATTERN.exec(line);
+        if (named?.[1]) {
+            const parsed = Number.parseInt(named[1], 10);
+            if (Number.isFinite(parsed)) {
+                return parsed;
+            }
+        }
+        // Inline literal only counts on the firing line itself, e.g. RSA.generate(2048)
+        if (i === start) {
+            const inline = INLINE_PATTERN.exec(line);
+            if (inline?.[1]) {
+                return Number.parseInt(inline[1], 10);
+            }
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=canonical.js.map

package/dist/code-scan/canonical.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../../src/code-scan/canonical.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAEpD,wDAAwD;AACxD,MAAM,UAAU,YAAY,CAAC,OAAsB;IAClD,IAAI,OAAO,KAAK,IAAI,IAAI,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,OAAO,OAAO,OAAO,EAAE,CAAC;IACzB,CAAC;IACD,OAAO,aAAa,CAAC;AACtB,CAAC;AAED,MAAM,SAAS,GAA2B;IACzC,yCAAyC;IACzC,OAAO,EAAE,MAAM;IACf,IAAI,EAAE,MAAM;IACZ,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,OAAO,EAAE,MAAM;IACf,IAAI,EAAE,MAAM;IACZ,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,SAAS,EAAE,MAAM;IACjB,OAAO,EAAE,MAAM;IACf,IAAI,EAAE,MAAM;IACZ,SAAS,EAAE,MAAM;IACjB,OAAO,EAAE,MAAM;IACf,IAAI,EAAE,MAAM;IACZ,SAAS,EAAE,MAAM;CACjB,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,QAA0B,OAAO;IAChF,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,GAAG,KAAK,IAAI,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACrD,OAAO,SAAS,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,KAAwB,EAAE,SAAiB;IAC1E,MAAM,YAAY,GACjB,0FAA0F,CAAC;IAC5F,MAAM,cAAc,GAAG,2BAA2B,CAAC;IAEnD,MAAM,KAAK,GAAG,SAAS,CAAC;IACxB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC;IACtD,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7C,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7B,OAAO,MAAM,CAAC;YACf,CAAC;QACF,CAAC;QACD,gFAAgF;QAChF,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjB,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACvC,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC"}

package/dist/code-scan/index.d.ts

@@ -0,0 +1,6 @@
+export { canonicalEcCurve, canonicalRsa, findKeySizeNear, normalizeAlgorithmId, } from "./canonical.js";
+export { ALL_RULES, RULE_SET_VERSION } from "./rules/index.js";
+export { detectLanguage, hashLine, isTestPath, scanDirectory, scanFileContent } from "./scanner.js";
+export { stripComments } from "./strip.js";
+export type { CodeCryptoFinding, Confidence, CryptoDetectionRule, FindingCategory, FindingClassification, Language, ScanOptions, ScanSummary, } from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/code-scan/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/code-scan/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,oBAAoB,GACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpG,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,YAAY,EACX,iBAAiB,EACjB,UAAU,EACV,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,QAAQ,EACR,WAAW,EACX,WAAW,GACX,MAAM,YAAY,CAAC"}

package/dist/code-scan/index.js

@@ -0,0 +1,5 @@
+export { canonicalEcCurve, canonicalRsa, findKeySizeNear, normalizeAlgorithmId, } from "./canonical.js";
+export { ALL_RULES, RULE_SET_VERSION } from "./rules/index.js";
+export { detectLanguage, hashLine, isTestPath, scanDirectory, scanFileContent } from "./scanner.js";
+export { stripComments } from "./strip.js";
+//# sourceMappingURL=index.js.map

package/dist/code-scan/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/code-scan/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,oBAAoB,GACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpG,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC"}

package/dist/code-scan/rules/artifacts.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Language-independent artifact rules: PEM headers, JWK fields, TLS config
+ * cipher strings. These fire in "config" files and any source language.
+ */
+import type { CryptoDetectionRule } from "../types.js";
+export declare const artifactRules: readonly CryptoDetectionRule[];
+//# sourceMappingURL=artifacts.d.ts.map

package/dist/code-scan/rules/artifacts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifacts.d.ts","sourceRoot":"","sources":["../../../src/code-scan/rules/artifacts.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAY,MAAM,aAAa,CAAC;AAgBjE,eAAO,MAAM,aAAa,EAAE,SAAS,mBAAmB,EAyDvD,CAAC"}

package/dist/code-scan/rules/artifacts.js

@@ -0,0 +1,83 @@
+/**
+ * Language-independent artifact rules: PEM headers, JWK fields, TLS config
+ * cipher strings. These fire in "config" files and any source language.
+ */
+const ALL = [
+    "javascript",
+    "typescript",
+    "python",
+    "java",
+    "kotlin",
+    "go",
+    "c",
+    "cpp",
+    "csharp",
+    "rust",
+    "config",
+];
+export const artifactRules = [
+    {
+        id: "artifact-pem-classical-key-header",
+        languages: ALL,
+        pattern: /-----BEGIN (RSA|EC|DSA) PRIVATE KEY-----/,
+        algorithm: (match) => {
+            const kind = match[1] ?? "";
+            if (kind === "RSA")
+                return "rsa-unknown";
+            if (kind === "EC")
+                return "ecdsa-unknown";
+            return "dsa-unknown";
+        },
+        category: "artifact",
+        classification: "classical",
+        confidence: "high",
+        library: "PEM",
+    },
+    {
+        id: "artifact-jwk-classical-kty",
+        languages: ALL,
+        pattern: /"kty"\s*:\s*"(RSA|EC|OKP)"/,
+        algorithm: (match) => {
+            const kty = match[1] ?? "";
+            if (kty === "RSA")
+                return "rsa-unknown";
+            if (kty === "EC")
+                return "ecdsa-unknown";
+            return "ed25519";
+        },
+        category: "artifact",
+        classification: "classical",
+        confidence: "medium",
+        library: "JWK",
+    },
+    {
+        id: "artifact-config-hybrid-tls-group",
+        languages: ALL,
+        pattern: /\b(X25519MLKEM768|X25519Kyber768Draft00|SecP256r1MLKEM768)\b/,
+        algorithm: (match) => (match[1] ?? "").toLowerCase(),
+        category: "protocol",
+        classification: "hybrid",
+        confidence: "high",
+        library: "TLS config",
+    },
+    {
+        id: "artifact-cargo-classical-dep",
+        languages: ["config"],
+        pattern: /^\s*(rsa|p256|p384|k256|ed25519-dalek|md5|sha1)\s*=\s*["{]/,
+        algorithm: (match) => {
+            const crate = match[1] ?? "";
+            if (crate === "rsa")
+                return "rsa-unknown";
+            if (crate === "ed25519-dalek")
+                return "ed25519";
+            if (crate === "md5" || crate === "sha1")
+                return crate;
+            return `ecdsa-${crate === "p384" ? "p384" : "p256"}`;
+        },
+        category: "artifact",
+        classification: "classical",
+        confidence: "medium",
+        library: "Cargo.toml",
+    },
+];
+//# sourceMappingURL=artifacts.js.map

package/dist/code-scan/rules/artifacts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifacts.js","sourceRoot":"","sources":["../../../src/code-scan/rules/artifacts.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,GAAG,GAAwB;IAChC,YAAY;IACZ,YAAY;IACZ,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,IAAI;IACJ,GAAG;IACH,KAAK;IACL,QAAQ;IACR,MAAM;IACN,QAAQ;CACR,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAmC;IAC5D;QACC,EAAE,EAAE,mCAAmC;QACvC,SAAS,EAAE,GAAG;QACd,OAAO,EAAE,0CAA0C;QACnD,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,IAAI,KAAK,KAAK;gBAAE,OAAO,aAAa,CAAC;YACzC,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,eAAe,CAAC;YAC1C,OAAO,aAAa,CAAC;QACtB,CAAC;QACD,QAAQ,EAAE,UAAU;QACpB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,KAAK;KACd;IACD;QACC,EAAE,EAAE,4BAA4B;QAChC,SAAS,EAAE,GAAG;QACd,OAAO,EAAE,4BAA4B;QACrC,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3B,IAAI,GAAG,KAAK,KAAK;gBAAE,OAAO,aAAa,CAAC;YACxC,IAAI,GAAG,KAAK,IAAI;gBAAE,OAAO,eAAe,CAAC;YACzC,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,QAAQ,EAAE,UAAU;QACpB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,QAAQ;QACpB,OAAO,EAAE,KAAK;KACd;IACD;QACC,EAAE,EAAE,kCAAkC;QACtC,SAAS,EAAE,GAAG;QACd,OAAO,EAAE,8DAA8D;QACvE,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;QACpD,QAAQ,EAAE,UAAU;QACpB,cAAc,EAAE,QAAQ;QACxB,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,YAAY;KACrB;IACD;QACC,EAAE,EAAE,8BAA8B;QAClC,SAAS,EAAE,CAAC,QAAQ,CAAC;QACrB,OAAO,EAAE,4DAA4D;QACrE,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7B,IAAI,KAAK,KAAK,KAAK;gBAAE,OAAO,aAAa,CAAC;YAC1C,IAAI,KAAK,KAAK,eAAe;gBAAE,OAAO,SAAS,CAAC;YAChD,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,MAAM;gBAAE,OAAO,KAAK,CAAC;YACtD,OAAO,SAAS,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QACtD,CAAC;QACD,QAAQ,EAAE,UAAU;QACpB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,QAAQ;QACpB,OAAO,EAAE,YAAY;KACrB;CACD,CAAC"}

package/dist/code-scan/rules/c.d.ts

@@ -0,0 +1,6 @@
+/**
+ * C/C++ rule pack: OpenSSL EVP/legacy APIs.
+ */
+import type { CryptoDetectionRule } from "../types.js";
+export declare const cRules: readonly CryptoDetectionRule[];
+//# sourceMappingURL=c.d.ts.map

package/dist/code-scan/rules/c.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"c.d.ts","sourceRoot":"","sources":["../../../src/code-scan/rules/c.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAIvD,eAAO,MAAM,MAAM,EAAE,SAAS,mBAAmB,EAmEhD,CAAC"}

package/dist/code-scan/rules/c.js

@@ -0,0 +1,77 @@
+/**
+ * C/C++ rule pack: OpenSSL EVP/legacy APIs.
+ */
+const LANGS = ["c", "cpp"];
+export const cRules = [
+    {
+        id: "c-openssl-rsa",
+        languages: LANGS,
+        pattern: /\b(RSA_generate_key(?:_ex)?|EVP_PKEY_RSA|EVP_RSA_gen)\b/,
+        algorithm: "rsa-unknown",
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "OpenSSL",
+        wantsKeySize: true,
+    },
+    {
+        id: "c-openssl-ec",
+        languages: LANGS,
+        pattern: /\b(EC_KEY_new(?:_by_curve_name)?|EVP_PKEY_EC|NID_(?:X9_62_prime256v1|secp384r1|secp521r1))\b/,
+        algorithm: (match) => {
+            const token = match[1] ?? "";
+            if (token.includes("prime256v1"))
+                return "ecdsa-p256";
+            if (token.includes("secp384r1"))
+                return "ecdsa-p384";
+            if (token.includes("secp521r1"))
+                return "ecdsa-p521";
+            return "ecdsa-unknown";
+        },
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "OpenSSL",
+    },
+    {
+        id: "c-openssl-weak-digest",
+        languages: LANGS,
+        pattern: /\bEVP_(md5|sha1)\s*\(\s*\)|\b(MD5|SHA1)_(?:Init|Update|Final)\b/,
+        algorithm: (match) => ((match[1] ?? match[2] ?? "").toLowerCase() === "md5" ? "md5" : "sha1"),
+        category: "hash",
+        classification: "classical",
+        confidence: "high",
+        library: "OpenSSL",
+    },
+    {
+        id: "c-openssl-weak-cipher",
+        languages: LANGS,
+        pattern: /\bEVP_(des_ede3[a-z0-9_]*|des_[a-z0-9_]+|rc4[a-z0-9_]*)\s*\(/,
+        algorithm: (match) => {
+            const name = (match[1] ?? "").toLowerCase();
+            if (name.startsWith("des_ede3"))
+                return "3des";
+            if (name.startsWith("des"))
+                return "des";
+            return "rc4";
+        },
+        category: "symmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "OpenSSL",
+    },
+    {
+        id: "c-pqc-liboqs",
+        languages: LANGS,
+        pattern: /\bOQS_(?:KEM|SIG)_(?:new\s*\(\s*)?(?:OQS_(?:KEM|SIG)_alg_)?([a-z0-9_]+)/i,
+        algorithm: (match) => {
+            const name = (match[1] ?? "").toLowerCase().replace(/_/g, "-");
+            return name.length > 2 ? name : null;
+        },
+        category: "asymmetric",
+        classification: "pqc",
+        confidence: "medium",
+        library: "liboqs",
+    },
+];
+//# sourceMappingURL=c.js.map