@nodatachat/guard 2.1.0 → 2.3.0

package/dist/capsule-dir.d.ts

@@ -0,0 +1,93 @@
+export interface CapsuleProof {
+    version: "1.0";
+    updated_at: string;
+    fields: ProofField[];
+}
+export interface ProofField {
+    table_hash: string;
+    column_hash: string;
+    pattern: string;
+    sentinel_prefix: string;
+    row_count: number;
+    encrypted_count: number;
+    coverage_percent: number;
+    verified_at: string;
+}
+export interface CapsuleOverride {
+    version: "1.0";
+    overrides: Override[];
+}
+export interface Override {
+    finding_id: string;
+    status: "fixed" | "accepted_risk" | "not_applicable" | "compensating_control";
+    note: string;
+    attested_by: string;
+    attested_at: string;
+    hmac: string;
+}
+export interface ScoreSnapshot {
+    date: string;
+    score: number;
+    code_score: number | null;
+    db_score: number | null;
+    pii_total: number;
+    pii_encrypted: number;
+    coverage_percent: number;
+    findings_count: number;
+    critical: number;
+    high: number;
+    medium: number;
+    low: number;
+    scan_type: "code" | "full";
+    guard_version: string;
+}
+export interface EvidenceEntry {
+    date: string;
+    action: string;
+    category: string;
+    detail: string;
+    impact: string;
+    attested_by: string;
+    hmac: string;
+}
+/**
+ * Initialize .capsule/ directory. Called on every scan.
+ * Creates missing dirs/files, never overwrites existing data.
+ */
+export declare function initCapsuleDir(projectDir: string, licenseKey: string): string;
+/**
+ * Save a score snapshot. Called after every scan.
+ */
+export declare function saveScore(capsuleDir: string, score: ScoreSnapshot): void;
+/**
+ * Update proof.json with DB-verified encryption data.
+ * Called after DB scan detects encrypted fields.
+ */
+export declare function updateProof(capsuleDir: string, fields: Array<{
+    table: string;
+    column: string;
+    pattern: string;
+    sentinel_prefix: string;
+    row_count: number;
+    encrypted_count: number;
+}>): void;
+/**
+ * Add an evidence entry. Called after scan or manual attest.
+ */
+export declare function addEvidence(capsuleDir: string, licenseKey: string, entry: Omit<EvidenceEntry, "hmac">): void;
+/**
+ * Read proof.json — used by code-scanner to check for known encryptions.
+ */
+export declare function readProof(projectDir: string): CapsuleProof | null;
+/**
+ * Read overrides.json — used by reporter to adjust scores.
+ */
+export declare function readOverrides(projectDir: string): CapsuleOverride | null;
+/**
+ * Get score history — used for trend display.
+ */
+export declare function getScoreHistory(projectDir: string): ScoreSnapshot[];
+/**
+ * Print .capsule/ status to terminal.
+ */
+export declare function printCapsuleStatus(projectDir: string, ciMode: boolean): void;

package/dist/capsule-dir.js

@@ -0,0 +1,248 @@
+"use strict";
+// ═══════════════════════════════════════════════════════════
+// .capsule/ Directory Manager
+//
+// Creates and maintains a local evidence directory in the customer's project.
+// Everything stays local. NoData receives ONLY metadata (scores, counts).
+//
+// Structure:
+//   .capsule/
+//   ├── config.json          ← Scanner settings, license, thresholds
+//   ├── proof.json           ← Encryption sentinels, verified patterns
+//   ├── overrides.json       ← Manual attestations ("I fixed this")
+//   ├── scores/
+//   │   └── YYYY-MM-DD.json  ← Score snapshots per scan
+//   └── evidence/
+//       └── YYYY-MM-DD.json  ← What was fixed, by whom, when
+//
+// Privacy:
+//   - No PII, table names, column names, or data values are stored
+//   - Sentinels are prefix-only (first 12 chars) — never full encrypted values
+//   - HMAC signature prevents tampering (proves the evidence is authentic)
+//   - NoData receives: score, date, finding_count, coverage_percent — NOTHING else
+// ═══════════════════════════════════════════════════════════
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.initCapsuleDir = initCapsuleDir;
+exports.saveScore = saveScore;
+exports.updateProof = updateProof;
+exports.addEvidence = addEvidence;
+exports.readProof = readProof;
+exports.readOverrides = readOverrides;
+exports.getScoreHistory = getScoreHistory;
+exports.printCapsuleStatus = printCapsuleStatus;
+const path_1 = require("path");
+const fs_1 = require("fs");
+const crypto_1 = require("crypto");
+const DIR_NAME = ".capsule";
+const HMAC_KEY_DOMAIN = "capsule:evidence:integrity";
+// ── Helpers ──
+function hashName(name) {
+    return (0, crypto_1.createHash)("sha256").update(`capsule:name:${name}`).digest("hex").slice(0, 16);
+}
+function signEvidence(data, licenseKey) {
+    return (0, crypto_1.createHmac)("sha256", `${HMAC_KEY_DOMAIN}:${licenseKey}`)
+        .update(data)
+        .digest("hex")
+        .slice(0, 32);
+}
+function ensureDir(dir) {
+    if (!(0, fs_1.existsSync)(dir))
+        (0, fs_1.mkdirSync)(dir, { recursive: true });
+}
+// ── Public API ──
+/**
+ * Initialize .capsule/ directory. Called on every scan.
+ * Creates missing dirs/files, never overwrites existing data.
+ */
+function initCapsuleDir(projectDir, licenseKey) {
+    const capsuleDir = (0, path_1.resolve)(projectDir, DIR_NAME);
+    ensureDir(capsuleDir);
+    ensureDir((0, path_1.join)(capsuleDir, "scores"));
+    ensureDir((0, path_1.join)(capsuleDir, "evidence"));
+    // Config — create only if missing
+    const configPath = (0, path_1.join)(capsuleDir, "config.json");
+    if (!(0, fs_1.existsSync)(configPath)) {
+        (0, fs_1.writeFileSync)(configPath, JSON.stringify({
+            version: "1.0",
+            created_at: new Date().toISOString(),
+            license_prefix: licenseKey.slice(0, 12) + "...",
+            thresholds: {
+                fail_on: "critical",
+                target_score: 85,
+                encryption_target: 90,
+            },
+            scan_schedule: "manual",
+            notes: "This directory contains local evidence for SOC compliance. Commit to git for audit history. NoData never receives this data.",
+        }, null, 2), "utf-8");
+    }
+    // Proof — create only if missing
+    const proofPath = (0, path_1.join)(capsuleDir, "proof.json");
+    if (!(0, fs_1.existsSync)(proofPath)) {
+        const proof = { version: "1.0", updated_at: new Date().toISOString(), fields: [] };
+        (0, fs_1.writeFileSync)(proofPath, JSON.stringify(proof, null, 2), "utf-8");
+    }
+    // Overrides — create only if missing
+    const overridesPath = (0, path_1.join)(capsuleDir, "overrides.json");
+    if (!(0, fs_1.existsSync)(overridesPath)) {
+        const overrides = { version: "1.0", overrides: [] };
+        (0, fs_1.writeFileSync)(overridesPath, JSON.stringify(overrides, null, 2), "utf-8");
+    }
+    // Ensure .gitignore does NOT exclude .capsule/
+    // (It should be committed for audit trail)
+    const gitignorePath = (0, path_1.resolve)(projectDir, ".gitignore");
+    if ((0, fs_1.existsSync)(gitignorePath)) {
+        const content = (0, fs_1.readFileSync)(gitignorePath, "utf-8");
+        if (content.includes(".capsule")) {
+            // Remove .capsule from gitignore if present — it should be tracked
+            const lines = content.split("\n").filter(l => !l.trim().startsWith(".capsule"));
+            (0, fs_1.writeFileSync)(gitignorePath, lines.join("\n"), "utf-8");
+        }
+    }
+    return capsuleDir;
+}
+/**
+ * Save a score snapshot. Called after every scan.
+ */
+function saveScore(capsuleDir, score) {
+    const date = new Date().toISOString().slice(0, 10);
+    const scoresDir = (0, path_1.join)(capsuleDir, "scores");
+    ensureDir(scoresDir);
+    (0, fs_1.writeFileSync)((0, path_1.join)(scoresDir, `${date}.json`), JSON.stringify(score, null, 2), "utf-8");
+}
+/**
+ * Update proof.json with DB-verified encryption data.
+ * Called after DB scan detects encrypted fields.
+ */
+function updateProof(capsuleDir, fields) {
+    const proofPath = (0, path_1.join)(capsuleDir, "proof.json");
+    const proof = (0, fs_1.existsSync)(proofPath)
+        ? JSON.parse((0, fs_1.readFileSync)(proofPath, "utf-8"))
+        : { version: "1.0", updated_at: "", fields: [] };
+    for (const f of fields) {
+        const tableHash = hashName(f.table);
+        const columnHash = hashName(f.column);
+        const coverage = f.row_count > 0 ? Math.round((f.encrypted_count / f.row_count) * 100) : 0;
+        // Update existing or add new
+        const existing = proof.fields.find(p => p.table_hash === tableHash && p.column_hash === columnHash);
+        if (existing) {
+            existing.pattern = f.pattern;
+            existing.sentinel_prefix = f.sentinel_prefix.slice(0, 12);
+            existing.row_count = f.row_count;
+            existing.encrypted_count = f.encrypted_count;
+            existing.coverage_percent = coverage;
+            existing.verified_at = new Date().toISOString();
+        }
+        else {
+            proof.fields.push({
+                table_hash: tableHash,
+                column_hash: columnHash,
+                pattern: f.pattern,
+                sentinel_prefix: f.sentinel_prefix.slice(0, 12),
+                row_count: f.row_count,
+                encrypted_count: f.encrypted_count,
+                coverage_percent: coverage,
+                verified_at: new Date().toISOString(),
+            });
+        }
+    }
+    proof.updated_at = new Date().toISOString();
+    (0, fs_1.writeFileSync)(proofPath, JSON.stringify(proof, null, 2), "utf-8");
+}
+/**
+ * Add an evidence entry. Called after scan or manual attest.
+ */
+function addEvidence(capsuleDir, licenseKey, entry) {
+    const date = new Date().toISOString().slice(0, 10);
+    const evidenceDir = (0, path_1.join)(capsuleDir, "evidence");
+    ensureDir(evidenceDir);
+    const filePath = (0, path_1.join)(evidenceDir, `${date}.json`);
+    const entries = (0, fs_1.existsSync)(filePath)
+        ? JSON.parse((0, fs_1.readFileSync)(filePath, "utf-8"))
+        : [];
+    // Sign the entry — proves it wasn't tampered with
+    const payload = JSON.stringify({ ...entry });
+    const hmac = signEvidence(payload, licenseKey);
+    entries.push({ ...entry, hmac });
+    (0, fs_1.writeFileSync)(filePath, JSON.stringify(entries, null, 2), "utf-8");
+}
+/**
+ * Read proof.json — used by code-scanner to check for known encryptions.
+ */
+function readProof(projectDir) {
+    const proofPath = (0, path_1.join)(projectDir, DIR_NAME, "proof.json");
+    if (!(0, fs_1.existsSync)(proofPath))
+        return null;
+    try {
+        return JSON.parse((0, fs_1.readFileSync)(proofPath, "utf-8"));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Read overrides.json — used by reporter to adjust scores.
+ */
+function readOverrides(projectDir) {
+    const overridesPath = (0, path_1.join)(projectDir, DIR_NAME, "overrides.json");
+    if (!(0, fs_1.existsSync)(overridesPath))
+        return null;
+    try {
+        return JSON.parse((0, fs_1.readFileSync)(overridesPath, "utf-8"));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Get score history — used for trend display.
+ */
+function getScoreHistory(projectDir) {
+    const scoresDir = (0, path_1.join)(projectDir, DIR_NAME, "scores");
+    if (!(0, fs_1.existsSync)(scoresDir))
+        return [];
+    const files = require("fs").readdirSync(scoresDir)
+        .filter((f) => f.endsWith(".json"))
+        .sort();
+    return files.map((f) => {
+        try {
+            return JSON.parse((0, fs_1.readFileSync)((0, path_1.join)(scoresDir, f), "utf-8"));
+        }
+        catch {
+            return null;
+        }
+    }).filter(Boolean);
+}
+/**
+ * Print .capsule/ status to terminal.
+ */
+function printCapsuleStatus(projectDir, ciMode) {
+    const capsuleDir = (0, path_1.join)(projectDir, DIR_NAME);
+    if (!(0, fs_1.existsSync)(capsuleDir))
+        return;
+    if (ciMode)
+        return;
+    const history = getScoreHistory(projectDir);
+    const proof = readProof(projectDir);
+    const overrides = readOverrides(projectDir);
+    console.log("");
+    console.log("  ══════════════════════════════════════");
+    console.log("  .capsule/ LOCAL EVIDENCE");
+    console.log("  ══════════════════════════════════════");
+    console.log(`  Score history:   ${history.length} scan(s)`);
+    if (history.length >= 2) {
+        const first = history[0];
+        const last = history[history.length - 1];
+        const delta = last.score - first.score;
+        const arrow = delta > 0 ? `\x1b[32m↑${delta}%\x1b[0m` : delta < 0 ? `\x1b[31m↓${Math.abs(delta)}%\x1b[0m` : "→ no change";
+        console.log(`  Trend:           ${first.score}% → ${last.score}% ${arrow}`);
+    }
+    if (proof) {
+        console.log(`  Proven fields:   ${proof.fields.length} (DB-verified encryption)`);
+    }
+    if (overrides && overrides.overrides.length > 0) {
+        console.log(`  Overrides:       ${overrides.overrides.length} manual attestation(s)`);
+    }
+    console.log("  ──────────────────────────────────────");
+    console.log("  \x1b[2mAll evidence stays local. Commit to git for audit trail.\x1b[0m");
+    console.log("  ══════════════════════════════════════\n");
+}

package/dist/cli.js

@@ -18,13 +18,15 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const path_1 = require("path");
 const fs_1 = require("fs");
+const crypto_1 = require("crypto");
 const activation_1 = require("./activation");
 const code_scanner_1 = require("./code-scanner");
 const db_scanner_1 = require("./db-scanner");
 const reporter_1 = require("./reporter");
-const registry_1 = require("./fixers/registry");
 const scheduler_1 = require("./fixers/scheduler");
-const VERSION = "2.0.0";
+const vault_crypto_1 = require("./vault-crypto");
+const capsule_dir_1 = require("./capsule-dir");
+const VERSION = "2.3.0";
 async function main() {
     const args = process.argv.slice(2);
     // Parse args
@@ -35,10 +37,10 @@ async function main() {
     let failOn = null;
     let outputDir = process.cwd();
     let skipSend = false;
-    let fixMode = "none";
+    let vaultPin;
+    let vaultDevice;
     let schedulePreset;
     let ciProvider;
-    let onlyFixers;
     for (let i = 0; i < args.length; i++) {
         switch (args[i]) {
             case "--license-key":
@@ -62,14 +64,21 @@ async function main() {
             case "--skip-send":
                 skipSend = true;
                 break;
+            case "--vault-pin":
+                vaultPin = args[++i];
+                break;
+            case "--vault-device":
+                vaultDevice = args[++i];
+                break;
             case "--fix-plan":
-                fixMode = "plan";
+                console.log("\n  ⚠  --fix-plan is deprecated. Capsule provides recommendations only.\n  Run without this flag to see recommendations.\n");
                 break;
             case "--fix":
-                fixMode = "apply";
+                console.log("\n  ⚠  --fix is deprecated. Capsule does not modify your code.\n  Recommendations are provided in the scan output.\n");
                 break;
             case "--fix-only":
-                onlyFixers = args[++i]?.split(",");
+                i++;
+                console.log("\n  ⚠  --fix-only is deprecated. Capsule provides recommendations only.\n");
                 break;
             case "--schedule":
                 schedulePreset = args[++i] || "weekly";
@@ -168,6 +177,9 @@ async function main() {
         process.exit(1);
     }
     log(ciMode, `Activated. Tier: ${activation.tier} | Scan ID: ${activation.scan_id}`);
+    // ── Step 1.5: Initialize .capsule/ directory ──
+    const capsuleDir = (0, capsule_dir_1.initCapsuleDir)(projectDir, licenseKey);
+    log(ciMode, `.capsule/ directory ready: ${capsuleDir}`);
     // ── Step 2: Code scan ──
     log(ciMode, "Scanning code...");
     const files = (0, code_scanner_1.readProjectFiles)(projectDir, (count) => {
@@ -231,6 +243,59 @@ async function main() {
     (0, fs_1.writeFileSync)(metaPath, JSON.stringify(metadata, null, 2), "utf-8");
     log(ciMode, `Full report:     ${fullPath}`);
     log(ciMode, `Metadata only:   ${metaPath}`);
+    // ── Step 5.5: Save to .capsule/ ──
+    try {
+        // Save score snapshot
+        (0, capsule_dir_1.saveScore)(capsuleDir, {
+            date: new Date().toISOString().slice(0, 10),
+            score: full.overall_score,
+            code_score: full.code_score ?? null,
+            db_score: full.db_score ?? null,
+            pii_total: full.summary.total_pii_fields,
+            pii_encrypted: full.summary.encrypted_fields,
+            coverage_percent: full.summary.coverage_percent,
+            findings_count: metadata.findings?.length || 0,
+            critical: full.summary.critical_issues,
+            high: full.summary.high_issues,
+            medium: full.summary.medium_issues ?? 0,
+            low: full.summary.low_issues ?? 0,
+            scan_type: dbUrl ? "full" : "code",
+            guard_version: VERSION,
+        });
+        // Update proof.json from DB results (if DB scan was done)
+        if (full.db?.pii_fields) {
+            const proofFields = full.db.pii_fields
+                .filter((f) => f.encrypted && f.encryption_pattern)
+                .map((f) => ({
+                table: f.table,
+                column: f.column,
+                pattern: f.encryption_pattern,
+                sentinel_prefix: f.sentinel_prefix || f.encryption_pattern,
+                row_count: f.row_count || 0,
+                encrypted_count: f.encrypted_count || 0,
+            }));
+            if (proofFields.length > 0) {
+                (0, capsule_dir_1.updateProof)(capsuleDir, proofFields);
+                log(ciMode, `Updated proof.json: ${proofFields.length} DB-verified encrypted fields`);
+            }
+        }
+        // Log scan as evidence
+        const deviceHash = (0, crypto_1.createHash)("sha256")
+            .update(`capsule:device:${require("os").hostname()}`)
+            .digest("hex").slice(0, 12);
+        (0, capsule_dir_1.addEvidence)(capsuleDir, licenseKey, {
+            date: new Date().toISOString(),
+            action: "scan_completed",
+            category: "scan",
+            detail: `Guard v${VERSION} scan: score ${full.overall_score}%, ${metadata.findings?.length || 0} findings, ${full.summary.encrypted_fields}/${full.summary.total_pii_fields} PII encrypted`,
+            impact: `Score: ${full.overall_score}%`,
+            attested_by: deviceHash,
+        });
+        log(ciMode, "Evidence saved to .capsule/");
+    }
+    catch (err) {
+        log(ciMode, `.capsule/ save failed (non-blocking): ${err instanceof Error ? err.message : err}`);
+    }
     // ── Step 6: Send metadata to NoData ──
     let serverResponse = {};
     if (!skipSend) {
@@ -259,6 +324,43 @@ async function main() {
             log(ciMode, "Could not reach NoData API — report saved locally");
         }
     }
+    // ── Step 6b: Encrypt & upload to vault (if --vault-pin) ──
+    let vaultUploaded = false;
+    if (vaultPin && !skipSend) {
+        log(ciMode, "Encrypting full report for vault...");
+        try {
+            const fullJson = JSON.stringify(full);
+            const { ciphertext, iv, salt } = (0, vault_crypto_1.encryptForVault)(vaultPin, fullJson);
+            const vaultRes = await fetch("https://nodatacapsule.com/api/guard/vault", {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json",
+                    "X-License-Key": licenseKey || "",
+                },
+                body: JSON.stringify({
+                    encrypted_blob: ciphertext,
+                    iv,
+                    salt,
+                    score: full.overall_score,
+                    findings_count: metadata.findings?.length || 0,
+                    scan_id: activation.scan_id,
+                    device_id: vaultDevice || undefined,
+                }),
+                signal: AbortSignal.timeout(15000),
+            });
+            if (vaultRes.ok) {
+                vaultUploaded = true;
+                log(ciMode, "Report encrypted & saved to vault");
+            }
+            else {
+                const errBody = await vaultRes.text().catch(() => "");
+                log(ciMode, `Vault upload failed (${vaultRes.status}): ${errBody}`);
+            }
+        }
+        catch (err) {
+            log(ciMode, `Vault upload error: ${err instanceof Error ? err.message : err}`);
+        }
+    }
     // ── Step 7: Print summary ──
     if (!ciMode) {
         console.log("");
@@ -280,107 +382,133 @@ async function main() {
         console.log(`  Sent to NoData:  ${metaPath}`);
         console.log(`  Proof hash:      ${full.proof_hash.slice(0, 16)}...`);
         console.log("  ══════════════════════════════════════");
+        if (vaultUploaded) {
+            console.log("  Vault:           Encrypted & saved to dashboard");
+        }
         console.log("  Your data never left your machine.");
         console.log("  Diff the two files to verify.\n");
     }
-    // ── Step 8: Capsule — Fix Plan / Apply ──
-    if (fixMode !== "none") {
-        const config = loadOrCreateConfig(projectDir, { dbUrl, failOn });
-        const fixerContext = {
-            projectDir,
-            dbUrl,
-            config,
-            scanResults: {
-                piiFields: piiFields.map(f => ({
-                    table: f.table, column: f.column, pii_type: f.pii_type,
-                    encrypted: f.encrypted, encryption_pattern: f.encryption_pattern,
-                })),
-                routes: routes.map(r => ({ path: r.path, has_auth: r.has_auth, auth_type: r.auth_type })),
-                secrets: secrets.map(s => ({
-                    file: s.file, line: s.line, type: s.type,
-                    severity: s.severity, is_env_interpolated: s.is_env_interpolated,
-                })),
-                rls: dbResult?.rls || [],
-                framework: stack.framework,
-                database: stack.database,
-            },
-            stack: {
-                framework: stack.framework,
-                database: stack.database,
-                language: "typescript",
-                hosting: "vercel",
-            },
-        };
-        const capsuleResult = await (0, registry_1.runCapsule)(fixerContext, {
-            mode: fixMode === "plan" ? "plan" : "apply",
-            fixers: onlyFixers,
-            dryRun: fixMode === "plan",
-        }, (msg) => log(ciMode, msg));
-        if (!ciMode) {
+    // ── Step 8: Recommendations ──
+    // NOTE: Capsule does NOT auto-fix code. We provide recommendations only.
+    // Applying fixes requires understanding of the target system — tables,
+    // relationships, business logic — and must be done by the customer's team.
+    if (!ciMode) {
+        const topFindings = metadata.findings || [];
+        if (topFindings.length > 0) {
             console.log("");
             console.log("  ══════════════════════════════════════");
-            console.log(`  CAPSULE ${fixMode === "plan" ? "PLAN" : "RESULTS"}`);
+            console.log("  RECOMMENDATIONS");
             console.log("  ══════════════════════════════════════");
-            console.log(`  Total actions:   ${capsuleResult.totalActions}`);
-            if (fixMode === "apply") {
-                console.log(`  Applied:         ${capsuleResult.applied}`);
-                console.log(`  Failed:          ${capsuleResult.failed}`);
-                console.log(`  Skipped:         ${capsuleResult.skipped}`);
+            console.log(`  ${topFindings.length} issues found. Top priorities:\n`);
+            const shown = topFindings.slice(0, 10);
+            for (const f of shown) {
+                const sev = f.severity === "critical" ? "\x1b[31mCRITICAL\x1b[0m"
+                    : f.severity === "high" ? "\x1b[33mHIGH\x1b[0m"
+                        : "\x1b[36mMEDIUM\x1b[0m";
+                console.log(`  ${sev}  ${f.title}`);
+                console.log(`         \x1b[32m→ ${f.fix_suggestion}\x1b[0m`);
+                if (f.soc_control)
+                    console.log(`         SOC: ${f.soc_control}`);
+                console.log("");
             }
-            console.log(`  Manual pending:  ${capsuleResult.manualPending}`);
-            console.log(`  Est. impact:     +${capsuleResult.estimatedScoreImpact}% score`);
-            console.log(`  Proof hash:      ${capsuleResult.proofHash.slice(0, 16)}...`);
-            console.log("  ──────────────────────────────────────");
-            // Print per-fixer summary
-            for (const plan of capsuleResult.plans) {
-                const icon = plan.actions.every(a => a.status === "applied") ? "✅"
-                    : plan.actions.some(a => a.status === "failed") ? "❌" : "📋";
-                console.log(`  ${icon} ${plan.nameHe}: ${plan.totalActions} actions (${plan.autoFixable} auto, ${plan.manualRequired} manual)`);
+            if (topFindings.length > 10) {
+                console.log(`  ... and ${topFindings.length - 10} more. See full report.\n`);
             }
+            console.log("  ──────────────────────────────────────");
+            console.log("  ⚠  Capsule provides recommendations only.");
+            console.log("     Fixes require understanding of your system —");
+            console.log("     tables, relationships, and business logic.");
+            console.log("     Work with your team to apply changes safely.");
             console.log("  ══════════════════════════════════════\n");
-            // Write fix plans to output dir
-            if (capsuleResult.plans.length > 0) {
-                const plansPath = (0, path_1.resolve)(outputDir, "nodata-fix-plan.json");
-                (0, fs_1.writeFileSync)(plansPath, JSON.stringify(capsuleResult, null, 2), "utf-8");
-                log(ciMode, `Fix plan saved: ${plansPath}`);
-                // Write SQL migrations to files
-                for (const plan of capsuleResult.plans) {
-                    for (const action of plan.actions) {
-                        if (action.type === "file-create" && action.target.includes("migrations/")) {
-                            const migPath = (0, path_1.resolve)(outputDir, action.target);
-                            const migDir = (0, path_1.resolve)(outputDir, "migrations");
-                            if (!(0, fs_1.existsSync)(migDir)) {
-                                const { mkdirSync } = require("fs");
-                                mkdirSync(migDir, { recursive: true });
-                            }
-                            (0, fs_1.writeFileSync)(migPath, action.content, "utf-8");
-                            log(ciMode, `Migration: ${migPath}`);
-                        }
-                    }
-                }
+            // Save recommendations to file
+            const recsPath = (0, path_1.resolve)(outputDir, "nodata-recommendations.json");
+            (0, fs_1.writeFileSync)(recsPath, JSON.stringify({
+                generated_at: new Date().toISOString(),
+                score: full.overall_score,
+                total_findings: topFindings.length,
+                disclaimer: "These are recommendations only. Capsule does not modify your code. Fixes require understanding of your system architecture, database schema, and business logic. Work with your development team to implement changes safely.",
+                recommendations: topFindings,
+            }, null, 2), "utf-8");
+            log(ciMode, `Recommendations: ${recsPath}`);
+        }
+    }
+    // ── Step 8.5: Remediation Guide (non-CI) ──
+    if (!ciMode && metadata.findings?.length > 0) {
+        const fs = metadata.findings;
+        const hasPII = fs.some((f) => f.category === "encryption" || f.title?.toLowerCase().includes("pii") || f.title?.toLowerCase().includes("encrypt"));
+        const hasRLS = fs.some((f) => f.title?.toLowerCase().includes("rls") || f.title?.toLowerCase().includes("row level") || f.category === "access_control");
+        const hasSecrets = fs.some((f) => f.title?.toLowerCase().includes("secret") || f.title?.toLowerCase().includes("hardcoded") || f.category === "secrets");
+        const hasHeaders = fs.some((f) => f.title?.toLowerCase().includes("header") || f.category === "headers");
+        if (hasPII || hasRLS || hasSecrets || hasHeaders) {
+            console.log("  ══════════════════════════════════════");
+            console.log("  \x1b[33mREMEDIATION GUIDE\x1b[0m — General commands");
+            console.log("  ══════════════════════════════════════");
+            console.log("  \x1b[2mThese are general recommendations.");
+            console.log("  A qualified technical professional should review");
+            console.log("  and adapt them to your specific system.\x1b[0m\n");
+            if (hasPII) {
+                console.log("  \x1b[33m── ENCRYPT PII FIELDS ──\x1b[0m");
+                console.log("  \x1b[36mOption A:\x1b[0m Database-level (PostgreSQL)");
+                console.log("    CREATE EXTENSION IF NOT EXISTS pgcrypto;");
+                console.log("    ALTER TABLE <table> ADD COLUMN <field>_encrypted BYTEA;");
+                console.log("    UPDATE <table> SET <field>_encrypted =");
+                console.log("      pgp_sym_encrypt(<field>::TEXT, '<key>');");
+                console.log("");
+                console.log("  \x1b[36mOption B:\x1b[0m Application-level (Capsule SDK)");
+                console.log("    npm install @nodatachat/sdk");
+                console.log("    encrypt(value, process.env.FIELD_ENCRYPTION_KEY)");
+                console.log("");
+                console.log("  \x1b[36mOption C:\x1b[0m Encrypt .env at rest");
+                console.log("    npx @nodatachat/protect encrypt .env\n");
+            }
+            if (hasRLS) {
+                console.log("  \x1b[33m── ROW LEVEL SECURITY ──\x1b[0m");
+                console.log("    ALTER TABLE <table> ENABLE ROW LEVEL SECURITY;");
+                console.log("    ALTER TABLE <table> FORCE ROW LEVEL SECURITY;");
+                console.log("    CREATE POLICY \"users_own\" ON <table>");
+                console.log("      FOR ALL USING (user_id = auth.uid());\n");
             }
+            if (hasSecrets) {
+                console.log("  \x1b[33m── REMOVE SECRETS FROM CODE ──\x1b[0m");
+                console.log("    1. Move to .env.local");
+                console.log("    2. Reference: process.env.SECRET_NAME");
+                console.log("    3. echo '.env*.local' >> .gitignore");
+                console.log("    4. npx @nodatachat/protect encrypt .env\n");
+            }
+            if (hasHeaders) {
+                console.log("  \x1b[33m── SECURITY HEADERS ──\x1b[0m");
+                console.log("    Strict-Transport-Security: max-age=63072000");
+                console.log("    X-Content-Type-Options: nosniff");
+                console.log("    X-Frame-Options: DENY");
+                console.log("    Referrer-Policy: strict-origin-when-cross-origin\n");
+            }
+            console.log("  ──────────────────────────────────────\n");
         }
-        // Send notifications if configured
-        if (config.notify && fixMode === "apply") {
-            const notifyPayload = {
-                event: capsuleResult.applied > 0 ? "fix-applied" : "scan-complete",
-                timestamp: new Date().toISOString(),
-                projectName: full.project_name || "unknown",
-                projectHash: full.proof_hash?.slice(0, 16) || "",
-                score: full.overall_score,
-                previousScore: serverResponse.previous_score ?? null,
-                delta: serverResponse.previous_score != null ? full.overall_score - serverResponse.previous_score : 0,
-                critical: full.summary.critical_issues,
-                high: full.summary.high_issues,
-                medium: full.summary.medium_issues,
-                fixesApplied: capsuleResult.applied,
-                fixesFailed: capsuleResult.failed,
-                scanId: activation.scan_id,
-                proofHash: capsuleResult.proofHash,
-            };
-            await (0, registry_1.sendNotifications)(config, notifyPayload.event, notifyPayload, (msg) => log(ciMode, msg));
+    }
+    // ── Step 9: What's next (non-CI) ──
+    if (!ciMode) {
+        console.log("  ══════════════════════════════════════");
+        console.log("  WHAT TO DO NEXT");
+        console.log("  ══════════════════════════════════════");
+        if (vaultUploaded) {
+            console.log("  1. Open your dashboard: https://nodatacapsule.com/my-capsule");
+            console.log("  2. Go to the \x1b[36mVault\x1b[0m tab");
+            console.log("  3. Enter your PIN to see the full report");
+            console.log("  4. Share the score with your team (no sensitive data)");
+            console.log("  5. Fix findings and re-scan to improve your score\n");
+        }
+        else {
+            console.log("  1. Review \x1b[36mnodata-full-report.json\x1b[0m (stays local)");
+            console.log("  2. Open your dashboard: https://nodatacapsule.com/my-capsule");
+            console.log("  3. Share the score with your team");
+            console.log("  4. Fix findings and re-scan to improve your score");
+            console.log("");
+            console.log("  \x1b[33mTip:\x1b[0m Add \x1b[36m--vault-pin 1234\x1b[0m to auto-encrypt");
+            console.log("  and upload the full report to your vault.\n");
         }
     }
+    // ── Step 10: Print .capsule/ status ──
+    (0, capsule_dir_1.printCapsuleStatus)(projectDir, ciMode);
     // ── CI mode: exit code ──
     if (ciMode && failOn) {
         const { critical_issues, high_issues, medium_issues } = full.summary;
@@ -425,14 +553,16 @@ function loadOrCreateConfig(projectDir, overrides) {
 }
 function printHelp() {
     console.log(`
-  NoData Guard v${VERSION} — Security Scanner + Auto-Remediation Capsule
+  NoData Guard v${VERSION} — Security Scanner + Recommendations
+
+  Scans your project locally for security issues and provides
+  actionable recommendations. Your code never leaves your machine.
+  Capsule does NOT modify your code — only you and your team can.
 
   Usage:
-    npx nodata-guard --license-key NDC-XXXX              # Scan only
-    npx nodata-guard --license-key NDC-XXXX --fix-plan    # Scan + show fix plan
-    npx nodata-guard --license-key NDC-XXXX --fix         # Scan + apply fixes
-    npx nodata-guard --license-key NDC-XXXX --schedule weekly  # Setup CI schedule
-    npx nodata-guard --license-key NDC-XXXX --db $DATABASE_URL --fix  # Full scan + fix
+    npx nodata-guard --license-key NDC-XXXX                          # Scan + recommend
+    npx nodata-guard --license-key NDC-XXXX --db $DATABASE_URL       # Full scan (code + DB)
+    npx nodata-guard --license-key NDC-XXXX --schedule weekly        # Setup CI schedule
 
   Scan Options:
     --license-key <key>    NoData license key (or set NDC_LICENSE env var)
@@ -442,13 +572,8 @@ function printHelp() {
     --ci                   CI mode — minimal output, exit codes
     --fail-on <level>      Exit 1 if issues at: critical | high | medium
     --skip-send            Don't send metadata to NoData
-
-  Capsule Options:
-    --fix-plan             Generate fix plan (dry-run, no changes)
-    --fix                  Apply all auto-fixable remediation
-    --fix-only <fixers>    Only run specific fixers (comma-separated)
-                           Fixers: pii-encrypt, rls, secrets, routes-auth,
-                                   headers, csrf, rate-limit, gitignore
+    --vault-pin <pin>      Encrypt full report & save to vault (AES-256-GCM)
+    --vault-device <id>    Link vault report to your dashboard device
 
   Schedule Options:
     --schedule <preset>    Install CI workflow: daily | weekly | monthly
@@ -458,28 +583,39 @@ function printHelp() {
     Configure in .nodata-guard.json → notify: { email, webhook, slack, telegram }
 
   Output files:
-    nodata-full-report.json      Full report — STAYS LOCAL
-    nodata-metadata-only.json    Metadata only — sent to NoData
-    nodata-fix-plan.json         Fix plan with actions
-    migrations/*.sql             Generated SQL migrations
+    nodata-full-report.json          Full report — STAYS LOCAL
+    nodata-metadata-only.json        Metadata only — sent to dashboard
+    nodata-recommendations.json      Prioritized recommendations
+
+  What we provide:
+    ✓ Scan — find weak points (PII, routes, secrets, encryption)
+    ✓ Recommend — prioritized actions with SOC control mapping
+    ✓ Prove — cryptographic proof chain of scan results
+    ✓ Monitor — track score over time via dashboard
+
+  What we NEVER do:
+    ✗ Modify your code, database, or configuration
+    ✗ Receive data values, source code, or credentials
 
-  What we NEVER receive:
-    Data values, emails, phones, passwords, source code, connection strings.
+  Important:
+    Recommendations require understanding of YOUR system —
+    tables, relationships, business logic. Work with your team
+    to implement changes safely.
 
   Examples:
-    # Quick scan
+    # Scan and get recommendations
     npx nodata-guard --license-key NDC-XXXX
 
-    # Full scan + DB probe + fix
-    npx nodata-guard --license-key NDC-XXXX --db $DATABASE_URL --fix
+    # Scan + auto-save encrypted report to vault
+    npx nodata-guard --license-key NDC-XXXX --vault-pin 1234
 
-    # Only fix security headers and CSRF
-    npx nodata-guard --license-key NDC-XXXX --fix --fix-only headers,csrf
+    # Full scan with DB probe
+    npx nodata-guard --license-key NDC-XXXX --db $DATABASE_URL
 
     # Setup weekly CI scan with GitHub Actions
     npx nodata-guard --license-key NDC-XXXX --schedule weekly
 
-    # CI pipeline
+    # CI pipeline — fail on critical issues
     npx nodata-guard --ci --fail-on critical
 
   Documentation: https://nodatacapsule.com/guard

package/dist/code-scanner.js

@@ -159,7 +159,7 @@ function scanPIIFields(files) {
             const proof = JSON.parse(proofFile.content);
             if (proof.version === "1.0" && Array.isArray(proof.fields)) {
                 for (const f of proof.fields) {
-                    if (f.sentinel_encrypted?.startsWith("aes256gcm:v1:")) {
+                    if (f.sentinel_encrypted?.startsWith("aes256gcm:v1:") || f.sentinel_encrypted?.startsWith("enc:v1:") || f.sentinel_encrypted?.startsWith("ndc_enc_")) {
                         proofFields.add(`${f.table}.${f.column}`);
                     }
                 }
@@ -201,7 +201,7 @@ function scanPIIFields(files) {
                 for (let i = 0; i < lines.length; i++) {
                     if (lines[i].includes(field.column)) {
                         const context = lines.slice(Math.max(0, i - 10), Math.min(lines.length, i + 10)).join("\n");
-                        if (/createCipheriv|encrypt\(|encryptPII|nodata_encrypt|encryptField/i.test(context)) {
+                        if (/createCipheriv|encrypt\(|encryptPII|nodata_encrypt|encryptField|NoDataProxy|proxy\.seal|proxy\.unseal|enc:v1:/i.test(context)) {
                             field.encrypted = true;
                             field.encryption_pattern = "code_encrypt";
                             break;

package/dist/db-scanner.js

@@ -6,7 +6,10 @@
 // READS ONLY:
 //   - Schema (table/column names, data types)
 //   - Counts (row counts, encrypted counts)
-//   - Prefixes (LEFT(value, 13) — detects "aes256gcm:v1:" without reading data)
+//   - Prefixes (LEFT(value, N) — detects encryption without reading data):
+//       "aes256gcm:v1:" (13 chars) — direct AES-256-GCM
+//       "enc:v1:"       (7 chars)  — Capsule Proxy encryption
+//       "ndc_enc_"      (8 chars)  — @nodatachat/protect format
 //   - System tables (pg_policies, pg_user, pg_settings, pg_extension)
 //
 // NEVER READS: actual data values, passwords, tokens, emails, phones
@@ -101,12 +104,18 @@ async function scanDatabase(connectionString, onProgress) {
             }
             for (const { col, isCompanion } of columnsToCheck) {
                 try {
-                    // SAFE: LEFT(value, 13) reads only the prefix — never actual data
+                    // SAFE: LEFT(value, N) reads only the prefix — never actual data
+                    // Detects multiple encryption formats:
+                    //   aes256gcm:v1:  — legacy direct encryption (13 chars)
+                    //   enc:v1:        — Capsule Proxy encryption (7 chars)
+                    //   ndc_enc_       — @nodatachat/protect format (8 chars)
                     const { rows } = await client.query(`
             SELECT
               count(*) as total,
               count(${quoteIdent(col)}) as non_null,
               count(*) FILTER (WHERE LEFT(${quoteIdent(col)}::text, 13) = 'aes256gcm:v1:') as aes_gcm,
+              count(*) FILTER (WHERE LEFT(${quoteIdent(col)}::text, 7) = 'enc:v1:') as enc_v1,
+              count(*) FILTER (WHERE LEFT(${quoteIdent(col)}::text, 8) = 'ndc_enc_') as ndc_enc,
               count(*) FILTER (WHERE LENGTH(${quoteIdent(col)}::text) > 80
                 AND ${quoteIdent(col)}::text ~ '^[A-Za-z0-9+/=]+$') as base64_long
             FROM ${quoteIdent(field.table)}
@@ -114,18 +123,26 @@ async function scanDatabase(connectionString, onProgress) {
                     const total = parseInt(rows[0].total);
                     const nonNull = parseInt(rows[0].non_null);
                     const aesGcm = parseInt(rows[0].aes_gcm);
+                    const encV1 = parseInt(rows[0].enc_v1);
+                    const ndcEnc = parseInt(rows[0].ndc_enc);
                     const b64 = parseInt(rows[0].base64_long);
-                    const encCount = aesGcm + b64;
+                    const encCount = aesGcm + encV1 + ndcEnc + b64;
+                    // Determine pattern name for reporting
+                    const pattern = aesGcm > 0 ? "aes256gcm:v1"
+                        : encV1 > 0 ? "enc:v1 (Capsule Proxy)"
+                            : ndcEnc > 0 ? "ndc_enc (Protect)"
+                                : b64 > 0 ? "base64_long"
+                                    : "unknown";
                     if (isCompanion && encCount > 0) {
                         field.encrypted = true;
-                        field.encryption_pattern = aesGcm > 0 ? "aes256gcm:v1" : "base64_long";
+                        field.encryption_pattern = pattern;
                         field.encrypted_count = encCount;
                     }
                     else if (!isCompanion) {
                         field.row_count = total;
                         if (encCount > 0 && encCount >= nonNull * 0.9) {
                             field.encrypted = true;
-                            field.encryption_pattern = aesGcm > 0 ? "aes256gcm:v1" : "base64_long";
+                            field.encryption_pattern = pattern;
                             field.encrypted_count = encCount;
                         }
                     }

package/dist/reporter.js

@@ -67,6 +67,9 @@ function generateReports(input) {
     const proofData = allPII.map(f => `${f.table}.${f.column}:${f.encrypted}`).join("|") + `|${overallScore}|${now}`;
     const proofHash = (0, crypto_1.createHash)("sha256").update(proofData).digest("hex");
     // ── Build metadata report (what we send) ──
+    // PRIVACY DOCTRINE: No structural metadata (table/column/file names) ever leaves the machine.
+    // We send ONLY: counts, scores, severity, generic category labels, SOC control IDs.
+    // The customer keeps the full report locally and can verify the diff.
     const metadata = {
         version: "1.0",
         scan_id: input.scanId,
@@ -93,13 +96,11 @@ function generateReports(input) {
             route_protection_percent: routeProtection,
             secrets_found: (input.code.secrets.filter(s => !s.is_env_interpolated)).length,
             secrets_critical: criticalSecrets,
-            // Per-field summary — NO VALUES, just table.column + status
+            // Per-field: hashed identifier + type + status — NO real names
             fields: input.code.piiFields.map(f => ({
-                table: f.table,
-                column: f.column,
+                field_hash: (0, crypto_1.createHash)("sha256").update(`${f.table}.${f.column}`).digest("hex").slice(0, 16),
                 pii_type: f.pii_type,
                 encrypted: f.encrypted,
-                pattern: f.encryption_pattern,
             })),
         } : null,
         db_summary: input.db ? {
@@ -123,32 +124,32 @@ function generateReports(input) {
             critical: criticalSecrets,
             high: highSecrets + plaintextPII,
             medium: medSecrets,
-            fixes_available: plaintextPII, // each plaintext field has a migration fix
+            recommendations_available: plaintextPII,
         },
-        // Fix suggestions — safe to send (just recommendation text, no code/values)
+        // REDACTED findings — generic titles only, no structural metadata
         findings: [
             ...allPII.filter(f => !f.encrypted).map(f => ({
                 severity: "high",
                 category: "pii",
                 rule_id: `PII_${f.pii_type.toUpperCase()}`,
-                title: `${f.table}.${f.column} — ${f.pii_type} stored in plaintext`,
-                fix_suggestion: `Add AES-256-GCM encryption to ${f.table}.${f.column} via Capsule field permissions`,
+                title: `PII field (${f.pii_type}) stored unencrypted`,
+                fix_suggestion: "Add AES-256-GCM column encryption via Capsule Protect",
                 soc_control: "CC6.7",
             })),
             ...(input.code?.secrets.filter(s => !s.is_env_interpolated) || []).map(s => ({
                 severity: s.severity,
                 category: "secrets",
                 rule_id: `SECRET_${s.type.toUpperCase().replace(/-/g, "_")}`,
-                title: `Hardcoded ${s.type} in ${s.file}:${s.line}`,
-                fix_suggestion: `Move to .env and encrypt with @nodatachat/protect`,
+                title: `Hardcoded secret (${s.type}) in source code`,
+                fix_suggestion: "Move to .env and encrypt with @nodatachat/protect",
                 soc_control: "CC6.1",
             })),
-            ...(input.code?.routes.filter(r => !r.has_auth) || []).slice(0, 20).map(r => ({
+            ...(input.code?.routes.filter(r => !r.has_auth) || []).slice(0, 20).map(() => ({
                 severity: "high",
                 category: "auth",
                 rule_id: "ROUTE_NO_AUTH",
-                title: `Unprotected route: ${r.path}`,
-                fix_suggestion: `Add authentication middleware (withAuth or API key check)`,
+                title: "API route missing authentication",
+                fix_suggestion: "Add authentication middleware (withAuth or API key check)",
                 soc_control: "CC6.3",
             })),
         ],
@@ -159,6 +160,7 @@ function generateReports(input) {
             contains_credentials: false,
             contains_source_code: false,
             contains_file_contents: false,
+            contains_structural_metadata: false,
             customer_can_verify: true,
         },
     };
@@ -203,10 +205,40 @@ function generateReports(input) {
             critical_issues: criticalSecrets,
             high_issues: highSecrets + plaintextPII,
             medium_issues: medSecrets,
-            fixes_available: plaintextPII,
+            recommendations_available: plaintextPII,
         },
         proof_hash: proofHash,
         metadata_preview: metadata,
+        // ── HOW TO FIX ──
+        // This section stays in the LOCAL report only. Never sent to NoData.
+        how_to_fix: {
+            summary: `This scan found ${plaintextPII} unencrypted PII fields, ${criticalSecrets} hardcoded secrets, and ${totalRoutes - protectedRoutes} unprotected routes.`,
+            steps: [
+                ...(plaintextPII > 0 ? [{
+                        priority: 1,
+                        action: "Encrypt PII fields",
+                        detail: `${plaintextPII} fields contain personal data without encryption. Each field listed below needs AES-256-GCM column-level encryption.`,
+                        fields: allPII.filter(f => !f.encrypted).map(f => `${f.table}.${f.column} (${f.pii_type})`),
+                        impact: `+${Math.min(Math.round(plaintextPII * 1.5), 30)}% score improvement`,
+                    }] : []),
+                ...(criticalSecrets > 0 ? [{
+                        priority: 2,
+                        action: "Remove hardcoded secrets",
+                        detail: `${criticalSecrets} secrets are hardcoded in source files. Move them to .env and encrypt with: npx @nodatachat/protect init`,
+                        fields: (input.code?.secrets.filter(s => !s.is_env_interpolated && s.severity === "critical") || []).map(s => `${s.file}:${s.line} (${s.type})`),
+                        impact: `+${Math.min(criticalSecrets * 5, 25)}% score improvement`,
+                    }] : []),
+                ...((totalRoutes - protectedRoutes > 0) ? [{
+                        priority: 3,
+                        action: "Add route authentication",
+                        detail: `${totalRoutes - protectedRoutes} API routes have no auth middleware. Add withAuth, API key validation, or rate limiting.`,
+                        fields: (input.code?.routes.filter(r => !r.has_auth) || []).map(r => r.path),
+                        impact: `+${Math.min(Math.round((totalRoutes - protectedRoutes) * 0.5), 15)}% score improvement`,
+                    }] : []),
+            ],
+            workflow: "Give this report to your development team or security engineer. They can review each finding and implement the fix suggestions. After fixing, re-run Guard to verify your score improved.",
+            re_scan: `npx @nodatachat/guard@latest --license-key YOUR_KEY`,
+        },
     };
     return { full, metadata };
 }

package/dist/types.d.ts

@@ -84,10 +84,22 @@ export interface FullReport {
         critical_issues: number;
         high_issues: number;
         medium_issues: number;
-        fixes_available: number;
+        recommendations_available: number;
     };
     proof_hash: string;
     metadata_preview: MetadataReport;
+    how_to_fix: {
+        summary: string;
+        steps: Array<{
+            priority: number;
+            action: string;
+            detail: string;
+            fields: string[];
+            impact: string;
+        }>;
+        workflow: string;
+        re_scan: string;
+    };
 }
 export interface MetadataReport {
     version: "1.0";
@@ -116,11 +128,9 @@ export interface MetadataReport {
         secrets_found: number;
         secrets_critical: number;
         fields: Array<{
-            table: string;
-            column: string;
+            field_hash: string;
             pii_type: string;
             encrypted: boolean;
-            pattern: string | null;
         }>;
     } | null;
     db_summary: {
@@ -140,7 +150,7 @@ export interface MetadataReport {
         critical: number;
         high: number;
         medium: number;
-        fixes_available: number;
+        recommendations_available: number;
     };
     findings: Array<{
         severity: "critical" | "high" | "medium" | "low";
@@ -157,6 +167,7 @@ export interface MetadataReport {
         contains_credentials: false;
         contains_source_code: false;
         contains_file_contents: false;
+        contains_structural_metadata: false;
         customer_can_verify: true;
     };
 }

package/dist/vault-crypto.d.ts

@@ -0,0 +1,6 @@
+/** Encrypt plaintext string → base64 blob + hex IV + hex salt */
+export declare function encryptForVault(pin: string, plaintext: string): {
+    ciphertext: string;
+    iv: string;
+    salt: string;
+};

package/dist/vault-crypto.js

@@ -0,0 +1,36 @@
+"use strict";
+// ══════════════════════════════════════════════════════════════
+// vault-crypto.ts — Node.js AES-256-GCM encryption for Guard CLI
+//
+// Mirrors the browser vault-crypto.ts exactly:
+//   PIN → PBKDF2 (100k iterations, SHA-256) → AES-256-GCM key
+//
+// The encrypted blob produced here can be decrypted by the
+// browser VaultReportViewer using the same PIN.
+// ══════════════════════════════════════════════════════════════
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.encryptForVault = encryptForVault;
+const crypto_1 = require("crypto");
+const ITERATIONS = 100_000;
+const KEY_LENGTH = 32; // 256 bits
+const SALT_LENGTH = 16; // bytes
+const IV_LENGTH = 12; // bytes (standard for AES-GCM)
+/** Encrypt plaintext string → base64 blob + hex IV + hex salt */
+function encryptForVault(pin, plaintext) {
+    const salt = (0, crypto_1.randomBytes)(SALT_LENGTH);
+    const iv = (0, crypto_1.randomBytes)(IV_LENGTH);
+    const key = (0, crypto_1.pbkdf2Sync)(pin, salt, ITERATIONS, KEY_LENGTH, "sha256");
+    const cipher = (0, crypto_1.createCipheriv)("aes-256-gcm", key, iv);
+    const encrypted = Buffer.concat([
+        cipher.update(plaintext, "utf8"),
+        cipher.final(),
+    ]);
+    const authTag = cipher.getAuthTag();
+    // Combine ciphertext + authTag (browser Web Crypto expects them concatenated)
+    const combined = Buffer.concat([encrypted, authTag]);
+    return {
+        ciphertext: combined.toString("base64"),
+        iv: iv.toString("hex"),
+        salt: salt.toString("hex"),
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nodatachat/guard",
-  "version": "2.1.0",
+  "version": "2.3.0",
   "description": "NoData Guard — continuous security scanner. Runs locally, reports only metadata. Your data never leaves your machine.",
   "main": "./dist/cli.js",
   "types": "./dist/cli.d.ts",