@heossi/qnsi 0.5.6 → 0.6.0

package/dist/code-scan/rules/python.js

@@ -0,0 +1,133 @@
+/**
+ * Python rule pack: pyca/cryptography, PyCryptodome, hashlib, PyJWT.
+ */
+const LANGS = ["python"];
+export const pythonRules = [
+    {
+        id: "py-cryptography-rsa-generate",
+        languages: LANGS,
+        pattern: /rsa\.generate_private_key\s*\(/,
+        algorithm: "rsa-unknown",
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "pyca/cryptography",
+        wantsKeySize: true,
+    },
+    {
+        id: "py-cryptography-ec-curve",
+        languages: LANGS,
+        pattern: /\bec\.(SECP192R1|SECP256R1|SECP256K1|SECP384R1|SECP521R1)\b/,
+        algorithm: (match) => {
+            const curve = match[1] ?? "";
+            if (curve.includes("192"))
+                return "ecdsa-p192";
+            if (curve.includes("256"))
+                return "ecdsa-p256";
+            if (curve.includes("384"))
+                return "ecdsa-p384";
+            return "ecdsa-p521";
+        },
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "pyca/cryptography",
+    },
+    {
+        id: "py-cryptography-pkcs1v15",
+        languages: LANGS,
+        pattern: /padding\.PKCS1v15\s*\(/,
+        algorithm: "rsa-unknown",
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "pyca/cryptography",
+    },
+    {
+        id: "py-cryptography-ed25519",
+        languages: LANGS,
+        pattern: /\b(Ed25519PrivateKey|Ed448PrivateKey|X25519PrivateKey|X448PrivateKey)\b/,
+        algorithm: (match) => {
+            const cls = match[1] ?? "";
+            if (cls.startsWith("Ed25519"))
+                return "ed25519";
+            if (cls.startsWith("Ed448"))
+                return "ed448";
+            return cls.startsWith("X25519") ? "ecdh-x25519" : "ecdh-x448";
+        },
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "pyca/cryptography",
+    },
+    {
+        id: "py-pycryptodome-rsa",
+        languages: LANGS,
+        pattern: /\bRSA\.generate\s*\(\s*(\d{3,5})?/,
+        algorithm: "rsa-unknown",
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "PyCryptodome",
+        wantsKeySize: true,
+    },
+    {
+        id: "py-pycryptodome-weak-cipher",
+        languages: LANGS,
+        pattern: /from\s+Crypto(?:dome)?\.Cipher\s+import\s+.*\b(DES3|DES|ARC4|ARC2)\b|\b(DES3|DES|ARC4)\.new\s*\(/,
+        algorithm: (match) => {
+            const name = (match[1] ?? match[2] ?? "").toUpperCase();
+            if (name === "DES3")
+                return "3des";
+            if (name === "DES")
+                return "des";
+            return "rc4";
+        },
+        category: "symmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "PyCryptodome",
+    },
+    {
+        id: "py-hashlib-weak-hash",
+        languages: LANGS,
+        pattern: /hashlib\.(md5|sha1)\s*\(/,
+        algorithm: (match) => (match[1] ?? "").toLowerCase(),
+        category: "hash",
+        classification: "classical",
+        confidence: "high",
+        library: "hashlib",
+    },
+    {
+        id: "py-jwt-classical-alg",
+        languages: LANGS,
+        pattern: /algorithms?\s*=\s*\[?\s*["'](RS256|RS384|RS512|PS256|PS384|PS512|ES256|ES384|ES512|EdDSA)["']/,
+        algorithm: (match) => {
+            const alg = match[1] ?? "";
+            if (alg.startsWith("RS") || alg.startsWith("PS"))
+                return "rsa-unknown";
+            if (alg === "ES256")
+                return "ecdsa-p256";
+            if (alg === "ES384")
+                return "ecdsa-p384";
+            if (alg === "ES512")
+                return "ecdsa-p521";
+            return "ed25519";
+        },
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "PyJWT",
+    },
+    {
+        id: "py-pqc-liboqs",
+        languages: LANGS,
+        pattern: /\boqs\.(KeyEncapsulation|Signature)\s*\(\s*["']([A-Za-z0-9_-]+)["']/,
+        algorithm: (match) => (match[2] ?? "").toLowerCase().replace(/_/g, "-"),
+        category: "asymmetric",
+        classification: "pqc",
+        confidence: "high",
+        library: "liboqs-python",
+    },
+];
+//# sourceMappingURL=python.js.map

package/dist/code-scan/rules/python.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"python.js","sourceRoot":"","sources":["../../../src/code-scan/rules/python.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAU,CAAC;AAElC,MAAM,CAAC,MAAM,WAAW,GAAmC;IAC1D;QACC,EAAE,EAAE,8BAA8B;QAClC,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,gCAAgC;QACzC,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,mBAAmB;QAC5B,YAAY,EAAE,IAAI;KAClB;IACD;QACC,EAAE,EAAE,0BAA0B;QAC9B,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,6DAA6D;QACtE,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7B,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,OAAO,YAAY,CAAC;YAC/C,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,OAAO,YAAY,CAAC;YAC/C,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,OAAO,YAAY,CAAC;YAC/C,OAAO,YAAY,CAAC;QACrB,CAAC;QACD,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,mBAAmB;KAC5B;IACD;QACC,EAAE,EAAE,0BAA0B;QAC9B,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,wBAAwB;QACjC,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,mBAAmB;KAC5B;IACD;QACC,EAAE,EAAE,yBAAyB;QAC7B,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,yEAAyE;QAClF,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3B,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;gBAAE,OAAO,SAAS,CAAC;YAChD,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;gBAAE,OAAO,OAAO,CAAC;YAC5C,OAAO,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC;QAC/D,CAAC;QACD,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,mBAAmB;KAC5B;IACD;QACC,EAAE,EAAE,qBAAqB;QACzB,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,mCAAmC;QAC5C,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,cAAc;QACvB,YAAY,EAAE,IAAI;KAClB;IACD;QACC,EAAE,EAAE,6BAA6B;QACjC,SAAS,EAAE,KAAK;QAChB,OAAO,EACN,kGAAkG;QACnG,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YACxD,IAAI,IAAI,KAAK,MAAM;gBAAE,OAAO,MAAM,CAAC;YACnC,IAAI,IAAI,KAAK,KAAK;gBAAE,OAAO,KAAK,CAAC;YACjC,OAAO,KAAK,CAAC;QACd,CAAC;QACD,QAAQ,EAAE,WAAW;QACrB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,cAAc;KACvB;IACD;QACC,EAAE,EAAE,sBAAsB;QAC1B,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,0BAA0B;QACnC,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE;QACpD,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,SAAS;KAClB;IACD;QACC,EAAE,EAAE,sBAAsB;QAC1B,SAAS,EAAE,KAAK;QAChB,OAAO,EACN,+FAA+F;QAChG,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3B,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,aAAa,CAAC;YACvE,IAAI,GAAG,KAAK,OAAO;gBAAE,OAAO,YAAY,CAAC;YACzC,IAAI,GAAG,KAAK,OAAO;gBAAE,OAAO,YAAY,CAAC;YACzC,IAAI,GAAG,KAAK,OAAO;gBAAE,OAAO,YAAY,CAAC;YACzC,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,OAAO;KAChB;IACD;QACC,EAAE,EAAE,eAAe;QACnB,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,qEAAqE;QAC9E,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;QACvE,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,KAAK;QACrB,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,eAAe;KACxB;CACD,CAAC"}

package/dist/code-scan/rules/rust.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Rust rule pack: rsa/p256/p384/ed25519-dalek/ring/openssl crates.
+ * `use` declarations are strong evidence; Cargo.toml dependency lines are
+ * matched by the artifacts pack (config language).
+ */
+import type { CryptoDetectionRule } from "../types.js";
+export declare const rustRules: readonly CryptoDetectionRule[];
+//# sourceMappingURL=rust.d.ts.map

package/dist/code-scan/rules/rust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rust.d.ts","sourceRoot":"","sources":["../../../src/code-scan/rules/rust.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAIvD,eAAO,MAAM,SAAS,EAAE,SAAS,mBAAmB,EAuEnD,CAAC"}

package/dist/code-scan/rules/rust.js

@@ -0,0 +1,86 @@
+/**
+ * Rust rule pack: rsa/p256/p384/ed25519-dalek/ring/openssl crates.
+ * `use` declarations are strong evidence; Cargo.toml dependency lines are
+ * matched by the artifacts pack (config language).
+ */
+const LANGS = ["rust"];
+export const rustRules = [
+    {
+        id: "rs-use-classical-crates",
+        languages: LANGS,
+        pattern: /\buse\s+(rsa|p256|p384|k256|ed25519_dalek|x25519_dalek)\b/,
+        algorithm: (match) => {
+            const crate = match[1] ?? "";
+            if (crate === "rsa")
+                return "rsa-unknown";
+            if (crate === "p256" || crate === "k256")
+                return "ecdsa-p256";
+            if (crate === "p384")
+                return "ecdsa-p384";
+            if (crate === "ed25519_dalek")
+                return "ed25519";
+            return "ecdh-x25519";
+        },
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "rust crates",
+    },
+    {
+        id: "rs-rsa-generate",
+        languages: LANGS,
+        pattern: /RsaPrivateKey::new\s*\(/,
+        algorithm: "rsa-unknown",
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "rsa crate",
+        wantsKeySize: true,
+    },
+    {
+        id: "rs-ring-classical",
+        languages: LANGS,
+        pattern: /ring::signature::(?:RSA|ECDSA|ED25519)[A-Z0-9_]*/,
+        algorithm: (match) => {
+            const token = match[0];
+            if (token.includes("RSA"))
+                return "rsa-unknown";
+            if (token.includes("ECDSA"))
+                return "ecdsa-unknown";
+            return "ed25519";
+        },
+        category: "asymmetric",
+        classification: "classical",
+        confidence: "high",
+        library: "ring",
+    },
+    {
+        id: "rs-weak-hash-crates",
+        languages: LANGS,
+        pattern: /\buse\s+(md5|md_5|sha1|sha_1)\b|\b(Md5|Sha1)::(?:new|digest)\b/,
+        algorithm: (match) => {
+            const token = (match[1] ?? match[2] ?? "").toLowerCase().replace(/_/g, "");
+            return token.includes("md5") ? "md5" : "sha1";
+        },
+        category: "hash",
+        classification: "classical",
+        confidence: "high",
+        library: "rust crates",
+    },
+    {
+        id: "rs-pqc-crates",
+        languages: LANGS,
+        pattern: /\buse\s+(?:pqcrypto|ml_kem|ml_dsa|fips203|fips204|fips205|oqs)\b/,
+        algorithm: (match) => {
+            const token = match[0];
+            if (token.includes("dsa") || token.includes("204"))
+                return "ml-dsa-65";
+            return "ml-kem-768";
+        },
+        category: "asymmetric",
+        classification: "pqc",
+        confidence: "medium",
+        library: "rust pqc crates",
+    },
+];
+//# sourceMappingURL=rust.js.map

package/dist/code-scan/rules/rust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rust.js","sourceRoot":"","sources":["../../../src/code-scan/rules/rust.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,MAAM,KAAK,GAAG,CAAC,MAAM,CAAU,CAAC;AAEhC,MAAM,CAAC,MAAM,SAAS,GAAmC;IACxD;QACC,EAAE,EAAE,yBAAyB;QAC7B,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,2DAA2D;QACpE,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7B,IAAI,KAAK,KAAK,KAAK;gBAAE,OAAO,aAAa,CAAC;YAC1C,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM;gBAAE,OAAO,YAAY,CAAC;YAC9D,IAAI,KAAK,KAAK,MAAM;gBAAE,OAAO,YAAY,CAAC;YAC1C,IAAI,KAAK,KAAK,eAAe;gBAAE,OAAO,SAAS,CAAC;YAChD,OAAO,aAAa,CAAC;QACtB,CAAC;QACD,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,aAAa;KACtB;IACD;QACC,EAAE,EAAE,iBAAiB;QACrB,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,yBAAyB;QAClC,SAAS,EAAE,aAAa;QACxB,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,WAAW;QACpB,YAAY,EAAE,IAAI;KAClB;IACD;QACC,EAAE,EAAE,mBAAmB;QACvB,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,kDAAkD;QAC3D,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACvB,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,OAAO,aAAa,CAAC;YAChD,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO,eAAe,CAAC;YACpD,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,MAAM;KACf;IACD;QACC,EAAE,EAAE,qBAAqB;QACzB,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,gEAAgE;QACzE,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC3E,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAC/C,CAAC;QACD,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,WAAW;QAC3B,UAAU,EAAE,MAAM;QAClB,OAAO,EAAE,aAAa;KACtB;IACD;QACC,EAAE,EAAE,eAAe;QACnB,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,kEAAkE;QAC3E,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACvB,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,OAAO,WAAW,CAAC;YACvE,OAAO,YAAY,CAAC;QACrB,CAAC;QACD,QAAQ,EAAE,YAAY;QACtB,cAAc,EAAE,KAAK;QACrB,UAAU,EAAE,QAAQ;QACpB,OAAO,EAAE,iBAAiB;KAC1B;CACD,CAAC"}

package/dist/code-scan/scanner.d.ts

@@ -0,0 +1,18 @@
+/**
+ * File walker + rule matcher. Parse-only: files are read as text, comments
+ * are stripped, rules are matched line-by-line. Nothing is executed and no
+ * network is touched — scanning an untrusted repository is safe by
+ * construction.
+ */
+import type { CodeCryptoFinding, Language, ScanOptions, ScanSummary } from "./types.js";
+export declare function detectLanguage(fileName: string): Language | null;
+export declare function isTestPath(relativePath: string): boolean;
+export declare function hashLine(line: string): string;
+/**
+ * Scan a single file's content. Exported for tests, the CLI's single-file
+ * mode, and future host integrations (qnsp-agent).
+ */
+export declare function scanFileContent(relativePath: string, content: string, language: Language): CodeCryptoFinding[];
+/** Recursively scan a directory tree. */
+export declare function scanDirectory(options: ScanOptions): Promise<ScanSummary>;
+//# sourceMappingURL=scanner.d.ts.map

package/dist/code-scan/scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../../src/code-scan/scanner.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,OAAO,KAAK,EACX,iBAAiB,EAEjB,QAAQ,EACR,WAAW,EACX,WAAW,EACX,MAAM,YAAY,CAAC;AA8EpB,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,IAAI,CAUhE;AAED,wBAAgB,UAAU,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAQxD;AAYD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG7C;AA4BD;;;GAGG;AACH,wBAAgB,eAAe,CAC9B,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,QAAQ,GAChB,iBAAiB,EAAE,CAiDrB;AAED,yCAAyC;AACzC,wBAAsB,aAAa,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAyE9E"}

package/dist/code-scan/scanner.js

@@ -0,0 +1,254 @@
+/**
+ * File walker + rule matcher. Parse-only: files are read as text, comments
+ * are stripped, rules are matched line-by-line. Nothing is executed and no
+ * network is touched — scanning an untrusted repository is safe by
+ * construction.
+ */
+import { createHash } from "node:crypto";
+import { readdir, readFile, stat } from "node:fs/promises";
+import { join, relative, sep } from "node:path";
+import { canonicalRsa, findKeySizeNear } from "./canonical.js";
+import { ALL_RULES } from "./rules/index.js";
+import { stripComments } from "./strip.js";
+const DEFAULT_MAX_FILE_BYTES = 2 * 1024 * 1024;
+const DEFAULT_MAX_FINDINGS = 50_000;
+const BINARY_SNIFF_BYTES = 8 * 1024;
+/** Directories never worth scanning (build output, VCS, dependencies). */
+const SKIP_DIRS = new Set([
+    ".git",
+    ".hg",
+    ".svn",
+    "node_modules",
+    "vendor",
+    "dist",
+    "build",
+    "out",
+    "target",
+    "bin",
+    "obj",
+    ".next",
+    ".turbo",
+    "coverage",
+    "__pycache__",
+    ".venv",
+    "venv",
+    ".terraform",
+]);
+const SKIP_FILES = new Set([
+    "pnpm-lock.yaml",
+    "package-lock.json",
+    "yarn.lock",
+    "Cargo.lock",
+    "go.sum",
+    "poetry.lock",
+    "uv.lock",
+]);
+const EXTENSION_LANGUAGE = {
+    ".js": "javascript",
+    ".mjs": "javascript",
+    ".cjs": "javascript",
+    ".jsx": "javascript",
+    ".ts": "typescript",
+    ".mts": "typescript",
+    ".cts": "typescript",
+    ".tsx": "typescript",
+    ".py": "python",
+    ".java": "java",
+    ".kt": "kotlin",
+    ".kts": "kotlin",
+    ".go": "go",
+    ".c": "c",
+    ".h": "c",
+    ".cc": "cpp",
+    ".cpp": "cpp",
+    ".cxx": "cpp",
+    ".hpp": "cpp",
+    ".hh": "cpp",
+    ".cs": "csharp",
+    ".rs": "rust",
+    ".yaml": "config",
+    ".yml": "config",
+    ".toml": "config",
+    ".json": "config",
+    ".conf": "config",
+    ".cfg": "config",
+    ".ini": "config",
+    ".properties": "config",
+    ".pem": "config",
+    ".crt": "config",
+    ".cer": "config",
+    ".pub": "config",
+};
+const TEST_PATH_SEGMENTS = ["test", "tests", "__tests__", "spec", "specs", "testdata", "fixtures"];
+const TEST_FILE_PATTERN = /(\.test\.|\.spec\.|_test\.(?:go|py|rb)$|Tests?\.(?:java|kt|cs)$)/;
+export function detectLanguage(fileName) {
+    const lower = fileName.toLowerCase();
+    if (lower.endsWith(".min.js") || lower.endsWith(".min.mjs")) {
+        return null; // minified bundles: line-based findings are meaningless
+    }
+    const dot = lower.lastIndexOf(".");
+    if (dot === -1) {
+        return fileName === "Dockerfile" ? "config" : null;
+    }
+    return EXTENSION_LANGUAGE[lower.slice(dot)] ?? null;
+}
+export function isTestPath(relativePath) {
+    const posixPath = relativePath.split(sep).join("/");
+    const segments = posixPath.toLowerCase().split("/");
+    if (segments.some((segment) => TEST_PATH_SEGMENTS.includes(segment))) {
+        return true;
+    }
+    const base = segments[segments.length - 1] ?? "";
+    return TEST_FILE_PATTERN.test(base);
+}
+function looksBinary(buffer) {
+    const limit = Math.min(buffer.length, BINARY_SNIFF_BYTES);
+    for (let i = 0; i < limit; i++) {
+        if (buffer[i] === 0) {
+            return true;
+        }
+    }
+    return false;
+}
+export function hashLine(line) {
+    const normalized = line.trim().replace(/\s+/g, " ");
+    return createHash("sha256").update(normalized).digest("hex");
+}
+function resolveAlgorithm(rule, match, line, strippedLines, lineIndex) {
+    const base = typeof rule.algorithm === "function" ? rule.algorithm(match, line) : rule.algorithm;
+    if (base === null || base.length === 0) {
+        return null;
+    }
+    if (!rule.wantsKeySize) {
+        return { algorithm: base, keySize: null };
+    }
+    const keySize = findKeySizeNear(strippedLines, lineIndex);
+    if (base.startsWith("rsa")) {
+        return { algorithm: canonicalRsa(keySize), keySize };
+    }
+    if (base.startsWith("dsa") && keySize === 1024) {
+        return { algorithm: "dsa-1024", keySize };
+    }
+    return { algorithm: base, keySize };
+}
+/**
+ * Scan a single file's content. Exported for tests, the CLI's single-file
+ * mode, and future host integrations (qnsp-agent).
+ */
+export function scanFileContent(relativePath, content, language) {
+    const rules = ALL_RULES.filter((rule) => rule.languages.includes(language));
+    if (rules.length === 0) {
+        return [];
+    }
+    const strippedLines = stripComments(content, language);
+    const findings = [];
+    const testContext = isTestPath(relativePath);
+    const seen = new Set();
+    for (let i = 0; i < strippedLines.length; i++) {
+        const line = strippedLines[i] ?? "";
+        if (line.length === 0) {
+            continue;
+        }
+        for (const rule of rules) {
+            // Fresh exec per line: rule patterns are not /g, so lastIndex is 0.
+            const match = rule.pattern.exec(line);
+            if (!match) {
+                continue;
+            }
+            const resolved = resolveAlgorithm(rule, match, line, strippedLines, i);
+            if (!resolved) {
+                continue;
+            }
+            const dedupKey = `${rule.id}:${i}`;
+            if (seen.has(dedupKey)) {
+                continue;
+            }
+            seen.add(dedupKey);
+            findings.push({
+                path: relativePath.split(sep).join("/"),
+                line: i + 1,
+                language,
+                ruleId: rule.id,
+                library: rule.library,
+                algorithm: resolved.algorithm,
+                category: rule.category,
+                classification: rule.classification,
+                confidence: rule.confidence,
+                lineHash: hashLine(line),
+                ...(resolved.keySize !== null ? { keySize: resolved.keySize } : {}),
+                ...(testContext ? { testContext: true } : {}),
+            });
+        }
+    }
+    return findings;
+}
+/** Recursively scan a directory tree. */
+export async function scanDirectory(options) {
+    const maxFileBytes = options.maxFileBytes ?? DEFAULT_MAX_FILE_BYTES;
+    const maxFindings = options.maxFindings ?? DEFAULT_MAX_FINDINGS;
+    const skipDirs = new Set([...SKIP_DIRS, ...(options.excludeDirs ?? [])]);
+    const findings = [];
+    let filesScanned = 0;
+    let filesSkipped = 0;
+    let truncated = false;
+    async function walk(dir) {
+        if (truncated) {
+            return;
+        }
+        const entries = await readdir(dir, { withFileTypes: true });
+        // Deterministic order — identical trees produce identical summaries.
+        entries.sort((a, b) => a.name.localeCompare(b.name));
+        for (const entry of entries) {
+            if (truncated) {
+                return;
+            }
+            const fullPath = join(dir, entry.name);
+            if (entry.isSymbolicLink()) {
+                filesSkipped++;
+                continue; // never follow symlinks out of the scan root
+            }
+            if (entry.isDirectory()) {
+                if (skipDirs.has(entry.name)) {
+                    continue;
+                }
+                await walk(fullPath);
+                continue;
+            }
+            if (!entry.isFile()) {
+                continue;
+            }
+            if (SKIP_FILES.has(entry.name)) {
+                filesSkipped++;
+                continue;
+            }
+            const language = detectLanguage(entry.name);
+            if (!language) {
+                filesSkipped++;
+                continue;
+            }
+            const info = await stat(fullPath);
+            if (info.size > maxFileBytes) {
+                filesSkipped++;
+                continue;
+            }
+            const buffer = await readFile(fullPath);
+            if (looksBinary(buffer)) {
+                filesSkipped++;
+                continue;
+            }
+            filesScanned++;
+            const relPath = relative(options.rootDir, fullPath);
+            const fileFindings = scanFileContent(relPath, buffer.toString("utf8"), language);
+            for (const finding of fileFindings) {
+                if (findings.length >= maxFindings) {
+                    truncated = true;
+                    break;
+                }
+                findings.push(finding);
+            }
+        }
+    }
+    await walk(options.rootDir);
+    return { filesScanned, filesSkipped, findings, truncated };
+}
+//# sourceMappingURL=scanner.js.map

package/dist/code-scan/scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../../src/code-scan/scanner.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAEhD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAS3C,MAAM,sBAAsB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAC/C,MAAM,oBAAoB,GAAG,MAAM,CAAC;AACpC,MAAM,kBAAkB,GAAG,CAAC,GAAG,IAAI,CAAC;AAEpC,0EAA0E;AAC1E,MAAM,SAAS,GAAwB,IAAI,GAAG,CAAC;IAC9C,MAAM;IACN,KAAK;IACL,MAAM;IACN,cAAc;IACd,QAAQ;IACR,MAAM;IACN,OAAO;IACP,KAAK;IACL,QAAQ;IACR,KAAK;IACL,KAAK;IACL,OAAO;IACP,QAAQ;IACR,UAAU;IACV,aAAa;IACb,OAAO;IACP,MAAM;IACN,YAAY;CACZ,CAAC,CAAC;AAEH,MAAM,UAAU,GAAwB,IAAI,GAAG,CAAC;IAC/C,gBAAgB;IAChB,mBAAmB;IACnB,WAAW;IACX,YAAY;IACZ,QAAQ;IACR,aAAa;IACb,SAAS;CACT,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAA6B;IACpD,KAAK,EAAE,YAAY;IACnB,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,YAAY;IACpB,KAAK,EAAE,YAAY;IACnB,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,YAAY;IACpB,KAAK,EAAE,QAAQ;IACf,OAAO,EAAE,MAAM;IACf,KAAK,EAAE,QAAQ;IACf,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,IAAI;IACX,IAAI,EAAE,GAAG;IACT,IAAI,EAAE,GAAG;IACT,KAAK,EAAE,KAAK;IACZ,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,KAAK;IACb,KAAK,EAAE,KAAK;IACZ,KAAK,EAAE,QAAQ;IACf,KAAK,EAAE,MAAM;IACb,OAAO,EAAE,QAAQ;IACjB,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,QAAQ;IACjB,OAAO,EAAE,QAAQ;IACjB,OAAO,EAAE,QAAQ;IACjB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,aAAa,EAAE,QAAQ;IACvB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;CAChB,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;AACnG,MAAM,iBAAiB,GAAG,kEAAkE,CAAC;AAE7F,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC9C,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7D,OAAO,IAAI,CAAC,CAAC,wDAAwD;IACtE,CAAC;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;QAChB,OAAO,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,CAAC;IACD,OAAO,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,YAAoB;IAC9C,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACtE,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,OAAO,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IAClC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC1D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAY;IACpC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACpD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,gBAAgB,CACxB,IAAyB,EACzB,KAAsB,EACtB,IAAY,EACZ,aAAgC,EAChC,SAAiB;IAEjB,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;IACjG,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACxB,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IAC1D,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;IACtD,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC9B,YAAoB,EACpB,OAAe,EACf,QAAkB;IAElB,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5E,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC;IACX,CAAC;IAED,MAAM,aAAa,GAAG,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,MAAM,WAAW,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,SAAS;QACV,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC1B,oEAAoE;YACpE,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACZ,SAAS;YACV,CAAC;YACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;YACvE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACf,SAAS;YACV,CAAC;YACD,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;YACnC,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACxB,SAAS;YACV,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC;gBACb,IAAI,EAAE,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBACvC,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,QAAQ;gBACR,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC;gBACxB,GAAG,CAAC,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7C,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,yCAAyC;AACzC,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAoB;IACvD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,sBAAsB,CAAC;IACpE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,oBAAoB,CAAC;IAChE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAEzE,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,KAAK,UAAU,IAAI,CAAC,GAAW;QAC9B,IAAI,SAAS,EAAE,CAAC;YACf,OAAO;QACR,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,qEAAqE;QACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAErD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,SAAS,EAAE,CAAC;gBACf,OAAO;YACR,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACvC,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC5B,YAAY,EAAE,CAAC;gBACf,SAAS,CAAC,6CAA6C;YACxD,CAAC;YACD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACzB,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9B,SAAS;gBACV,CAAC;gBACD,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACrB,SAAS;YACV,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;gBACrB,SAAS;YACV,CAAC;YACD,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChC,YAAY,EAAE,CAAC;gBACf,SAAS;YACV,CAAC;YACD,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACf,YAAY,EAAE,CAAC;gBACf,SAAS;YACV,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;YAClC,IAAI,IAAI,CAAC,IAAI,GAAG,YAAY,EAAE,CAAC;gBAC9B,YAAY,EAAE,CAAC;gBACf,SAAS;YACV,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACxC,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,YAAY,EAAE,CAAC;gBACf,SAAS;YACV,CAAC;YAED,YAAY,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACpD,MAAM,YAAY,GAAG,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC;YACjF,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;gBACpC,IAAI,QAAQ,CAAC,MAAM,IAAI,WAAW,EAAE,CAAC;oBACpC,SAAS,GAAG,IAAI,CAAC;oBACjB,MAAM;gBACP,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxB,CAAC;QACF,CAAC;IACF,CAAC;IAED,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAE5B,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AAC5D,CAAC"}

package/dist/code-scan/strip.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Comment stripping — string-aware, per language family.
+ *
+ * Comments are removed BEFORE rule matching so a migration note that merely
+ * mentions a crypto API can never become a finding (the
+ * guard-that-reads-its-own-comment failure class, see
+ * .claude/rules/toolchain-single-source.md). String literals are KEPT:
+ * crypto APIs take algorithm names as string arguments
+ * (`Cipher.getInstance("RSA")`), so rules anchor on API context instead.
+ */
+import type { Language } from "./types.js";
+interface StripState {
+    /** Inside a C-style block comment. */
+    inBlockComment: boolean;
+    /** Python triple-quote delimiter currently open, or null. */
+    inTripleQuote: string | null;
+}
+export declare function createStripState(): StripState;
+/**
+ * Strip comments from a full file, returning one entry per original line so
+ * finding line numbers stay 1:1 with the source.
+ */
+export declare function stripComments(content: string, language: Language): string[];
+export {};
+//# sourceMappingURL=strip.d.ts.map

package/dist/code-scan/strip.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"strip.d.ts","sourceRoot":"","sources":["../../src/code-scan/strip.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAkB3C,UAAU,UAAU;IACnB,sCAAsC;IACtC,cAAc,EAAE,OAAO,CAAC;IACxB,6DAA6D;IAC7D,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,wBAAgB,gBAAgB,IAAI,UAAU,CAE7C;AA0HD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,GAAG,MAAM,EAAE,CAiB3E"}