@nodatachat/guard 2.2.0 → 2.3.0

package/dist/capsule-dir.d.ts

@@ -0,0 +1,93 @@
+export interface CapsuleProof {
+    version: "1.0";
+    updated_at: string;
+    fields: ProofField[];
+}
+export interface ProofField {
+    table_hash: string;
+    column_hash: string;
+    pattern: string;
+    sentinel_prefix: string;
+    row_count: number;
+    encrypted_count: number;
+    coverage_percent: number;
+    verified_at: string;
+}
+export interface CapsuleOverride {
+    version: "1.0";
+    overrides: Override[];
+}
+export interface Override {
+    finding_id: string;
+    status: "fixed" | "accepted_risk" | "not_applicable" | "compensating_control";
+    note: string;
+    attested_by: string;
+    attested_at: string;
+    hmac: string;
+}
+export interface ScoreSnapshot {
+    date: string;
+    score: number;
+    code_score: number | null;
+    db_score: number | null;
+    pii_total: number;
+    pii_encrypted: number;
+    coverage_percent: number;
+    findings_count: number;
+    critical: number;
+    high: number;
+    medium: number;
+    low: number;
+    scan_type: "code" | "full";
+    guard_version: string;
+}
+export interface EvidenceEntry {
+    date: string;
+    action: string;
+    category: string;
+    detail: string;
+    impact: string;
+    attested_by: string;
+    hmac: string;
+}
+/**
+ * Initialize .capsule/ directory. Called on every scan.
+ * Creates missing dirs/files, never overwrites existing data.
+ */
+export declare function initCapsuleDir(projectDir: string, licenseKey: string): string;
+/**
+ * Save a score snapshot. Called after every scan.
+ */
+export declare function saveScore(capsuleDir: string, score: ScoreSnapshot): void;
+/**
+ * Update proof.json with DB-verified encryption data.
+ * Called after DB scan detects encrypted fields.
+ */
+export declare function updateProof(capsuleDir: string, fields: Array<{
+    table: string;
+    column: string;
+    pattern: string;
+    sentinel_prefix: string;
+    row_count: number;
+    encrypted_count: number;
+}>): void;
+/**
+ * Add an evidence entry. Called after scan or manual attest.
+ */
+export declare function addEvidence(capsuleDir: string, licenseKey: string, entry: Omit<EvidenceEntry, "hmac">): void;
+/**
+ * Read proof.json — used by code-scanner to check for known encryptions.
+ */
+export declare function readProof(projectDir: string): CapsuleProof | null;
+/**
+ * Read overrides.json — used by reporter to adjust scores.
+ */
+export declare function readOverrides(projectDir: string): CapsuleOverride | null;
+/**
+ * Get score history — used for trend display.
+ */
+export declare function getScoreHistory(projectDir: string): ScoreSnapshot[];
+/**
+ * Print .capsule/ status to terminal.
+ */
+export declare function printCapsuleStatus(projectDir: string, ciMode: boolean): void;

package/dist/capsule-dir.js

@@ -0,0 +1,248 @@
+"use strict";
+// ═══════════════════════════════════════════════════════════
+// .capsule/ Directory Manager
+//
+// Creates and maintains a local evidence directory in the customer's project.
+// Everything stays local. NoData receives ONLY metadata (scores, counts).
+//
+// Structure:
+//   .capsule/
+//   ├── config.json          ← Scanner settings, license, thresholds
+//   ├── proof.json           ← Encryption sentinels, verified patterns
+//   ├── overrides.json       ← Manual attestations ("I fixed this")
+//   ├── scores/
+//   │   └── YYYY-MM-DD.json  ← Score snapshots per scan
+//   └── evidence/
+//       └── YYYY-MM-DD.json  ← What was fixed, by whom, when
+//
+// Privacy:
+//   - No PII, table names, column names, or data values are stored
+//   - Sentinels are prefix-only (first 12 chars) — never full encrypted values
+//   - HMAC signature prevents tampering (proves the evidence is authentic)
+//   - NoData receives: score, date, finding_count, coverage_percent — NOTHING else
+// ═══════════════════════════════════════════════════════════
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.initCapsuleDir = initCapsuleDir;
+exports.saveScore = saveScore;
+exports.updateProof = updateProof;
+exports.addEvidence = addEvidence;
+exports.readProof = readProof;
+exports.readOverrides = readOverrides;
+exports.getScoreHistory = getScoreHistory;
+exports.printCapsuleStatus = printCapsuleStatus;
+const path_1 = require("path");
+const fs_1 = require("fs");
+const crypto_1 = require("crypto");
+const DIR_NAME = ".capsule";
+const HMAC_KEY_DOMAIN = "capsule:evidence:integrity";
+// ── Helpers ──
+function hashName(name) {
+    return (0, crypto_1.createHash)("sha256").update(`capsule:name:${name}`).digest("hex").slice(0, 16);
+}
+function signEvidence(data, licenseKey) {
+    return (0, crypto_1.createHmac)("sha256", `${HMAC_KEY_DOMAIN}:${licenseKey}`)
+        .update(data)
+        .digest("hex")
+        .slice(0, 32);
+}
+function ensureDir(dir) {
+    if (!(0, fs_1.existsSync)(dir))
+        (0, fs_1.mkdirSync)(dir, { recursive: true });
+}
+// ── Public API ──
+/**
+ * Initialize .capsule/ directory. Called on every scan.
+ * Creates missing dirs/files, never overwrites existing data.
+ */
+function initCapsuleDir(projectDir, licenseKey) {
+    const capsuleDir = (0, path_1.resolve)(projectDir, DIR_NAME);
+    ensureDir(capsuleDir);
+    ensureDir((0, path_1.join)(capsuleDir, "scores"));
+    ensureDir((0, path_1.join)(capsuleDir, "evidence"));
+    // Config — create only if missing
+    const configPath = (0, path_1.join)(capsuleDir, "config.json");
+    if (!(0, fs_1.existsSync)(configPath)) {
+        (0, fs_1.writeFileSync)(configPath, JSON.stringify({
+            version: "1.0",
+            created_at: new Date().toISOString(),
+            license_prefix: licenseKey.slice(0, 12) + "...",
+            thresholds: {
+                fail_on: "critical",
+                target_score: 85,
+                encryption_target: 90,
+            },
+            scan_schedule: "manual",
+            notes: "This directory contains local evidence for SOC compliance. Commit to git for audit history. NoData never receives this data.",
+        }, null, 2), "utf-8");
+    }
+    // Proof — create only if missing
+    const proofPath = (0, path_1.join)(capsuleDir, "proof.json");
+    if (!(0, fs_1.existsSync)(proofPath)) {
+        const proof = { version: "1.0", updated_at: new Date().toISOString(), fields: [] };
+        (0, fs_1.writeFileSync)(proofPath, JSON.stringify(proof, null, 2), "utf-8");
+    }
+    // Overrides — create only if missing
+    const overridesPath = (0, path_1.join)(capsuleDir, "overrides.json");
+    if (!(0, fs_1.existsSync)(overridesPath)) {
+        const overrides = { version: "1.0", overrides: [] };
+        (0, fs_1.writeFileSync)(overridesPath, JSON.stringify(overrides, null, 2), "utf-8");
+    }
+    // Ensure .gitignore does NOT exclude .capsule/
+    // (It should be committed for audit trail)
+    const gitignorePath = (0, path_1.resolve)(projectDir, ".gitignore");
+    if ((0, fs_1.existsSync)(gitignorePath)) {
+        const content = (0, fs_1.readFileSync)(gitignorePath, "utf-8");
+        if (content.includes(".capsule")) {
+            // Remove .capsule from gitignore if present — it should be tracked
+            const lines = content.split("\n").filter(l => !l.trim().startsWith(".capsule"));
+            (0, fs_1.writeFileSync)(gitignorePath, lines.join("\n"), "utf-8");
+        }
+    }
+    return capsuleDir;
+}
+/**
+ * Save a score snapshot. Called after every scan.
+ */
+function saveScore(capsuleDir, score) {
+    const date = new Date().toISOString().slice(0, 10);
+    const scoresDir = (0, path_1.join)(capsuleDir, "scores");
+    ensureDir(scoresDir);
+    (0, fs_1.writeFileSync)((0, path_1.join)(scoresDir, `${date}.json`), JSON.stringify(score, null, 2), "utf-8");
+}
+/**
+ * Update proof.json with DB-verified encryption data.
+ * Called after DB scan detects encrypted fields.
+ */
+function updateProof(capsuleDir, fields) {
+    const proofPath = (0, path_1.join)(capsuleDir, "proof.json");
+    const proof = (0, fs_1.existsSync)(proofPath)
+        ? JSON.parse((0, fs_1.readFileSync)(proofPath, "utf-8"))
+        : { version: "1.0", updated_at: "", fields: [] };
+    for (const f of fields) {
+        const tableHash = hashName(f.table);
+        const columnHash = hashName(f.column);
+        const coverage = f.row_count > 0 ? Math.round((f.encrypted_count / f.row_count) * 100) : 0;
+        // Update existing or add new
+        const existing = proof.fields.find(p => p.table_hash === tableHash && p.column_hash === columnHash);
+        if (existing) {
+            existing.pattern = f.pattern;
+            existing.sentinel_prefix = f.sentinel_prefix.slice(0, 12);
+            existing.row_count = f.row_count;
+            existing.encrypted_count = f.encrypted_count;
+            existing.coverage_percent = coverage;
+            existing.verified_at = new Date().toISOString();
+        }
+        else {
+            proof.fields.push({
+                table_hash: tableHash,
+                column_hash: columnHash,
+                pattern: f.pattern,
+                sentinel_prefix: f.sentinel_prefix.slice(0, 12),
+                row_count: f.row_count,
+                encrypted_count: f.encrypted_count,
+                coverage_percent: coverage,
+                verified_at: new Date().toISOString(),
+            });
+        }
+    }
+    proof.updated_at = new Date().toISOString();
+    (0, fs_1.writeFileSync)(proofPath, JSON.stringify(proof, null, 2), "utf-8");
+}
+/**
+ * Add an evidence entry. Called after scan or manual attest.
+ */
+function addEvidence(capsuleDir, licenseKey, entry) {
+    const date = new Date().toISOString().slice(0, 10);
+    const evidenceDir = (0, path_1.join)(capsuleDir, "evidence");
+    ensureDir(evidenceDir);
+    const filePath = (0, path_1.join)(evidenceDir, `${date}.json`);
+    const entries = (0, fs_1.existsSync)(filePath)
+        ? JSON.parse((0, fs_1.readFileSync)(filePath, "utf-8"))
+        : [];
+    // Sign the entry — proves it wasn't tampered with
+    const payload = JSON.stringify({ ...entry });
+    const hmac = signEvidence(payload, licenseKey);
+    entries.push({ ...entry, hmac });
+    (0, fs_1.writeFileSync)(filePath, JSON.stringify(entries, null, 2), "utf-8");
+}
+/**
+ * Read proof.json — used by code-scanner to check for known encryptions.
+ */
+function readProof(projectDir) {
+    const proofPath = (0, path_1.join)(projectDir, DIR_NAME, "proof.json");
+    if (!(0, fs_1.existsSync)(proofPath))
+        return null;
+    try {
+        return JSON.parse((0, fs_1.readFileSync)(proofPath, "utf-8"));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Read overrides.json — used by reporter to adjust scores.
+ */
+function readOverrides(projectDir) {
+    const overridesPath = (0, path_1.join)(projectDir, DIR_NAME, "overrides.json");
+    if (!(0, fs_1.existsSync)(overridesPath))
+        return null;
+    try {
+        return JSON.parse((0, fs_1.readFileSync)(overridesPath, "utf-8"));
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Get score history — used for trend display.
+ */
+function getScoreHistory(projectDir) {
+    const scoresDir = (0, path_1.join)(projectDir, DIR_NAME, "scores");
+    if (!(0, fs_1.existsSync)(scoresDir))
+        return [];
+    const files = require("fs").readdirSync(scoresDir)
+        .filter((f) => f.endsWith(".json"))
+        .sort();
+    return files.map((f) => {
+        try {
+            return JSON.parse((0, fs_1.readFileSync)((0, path_1.join)(scoresDir, f), "utf-8"));
+        }
+        catch {
+            return null;
+        }
+    }).filter(Boolean);
+}
+/**
+ * Print .capsule/ status to terminal.
+ */
+function printCapsuleStatus(projectDir, ciMode) {
+    const capsuleDir = (0, path_1.join)(projectDir, DIR_NAME);
+    if (!(0, fs_1.existsSync)(capsuleDir))
+        return;
+    if (ciMode)
+        return;
+    const history = getScoreHistory(projectDir);
+    const proof = readProof(projectDir);
+    const overrides = readOverrides(projectDir);
+    console.log("");
+    console.log("  ══════════════════════════════════════");
+    console.log("  .capsule/ LOCAL EVIDENCE");
+    console.log("  ══════════════════════════════════════");
+    console.log(`  Score history:   ${history.length} scan(s)`);
+    if (history.length >= 2) {
+        const first = history[0];
+        const last = history[history.length - 1];
+        const delta = last.score - first.score;
+        const arrow = delta > 0 ? `\x1b[32m↑${delta}%\x1b[0m` : delta < 0 ? `\x1b[31m↓${Math.abs(delta)}%\x1b[0m` : "→ no change";
+        console.log(`  Trend:           ${first.score}% → ${last.score}% ${arrow}`);
+    }
+    if (proof) {
+        console.log(`  Proven fields:   ${proof.fields.length} (DB-verified encryption)`);
+    }
+    if (overrides && overrides.overrides.length > 0) {
+        console.log(`  Overrides:       ${overrides.overrides.length} manual attestation(s)`);
+    }
+    console.log("  ──────────────────────────────────────");
+    console.log("  \x1b[2mAll evidence stays local. Commit to git for audit trail.\x1b[0m");
+    console.log("  ══════════════════════════════════════\n");
+}

package/dist/cli.js

@@ -18,12 +18,15 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const path_1 = require("path");
 const fs_1 = require("fs");
+const crypto_1 = require("crypto");
 const activation_1 = require("./activation");
 const code_scanner_1 = require("./code-scanner");
 const db_scanner_1 = require("./db-scanner");
 const reporter_1 = require("./reporter");
 const scheduler_1 = require("./fixers/scheduler");
-const VERSION = "2.0.0";
+const vault_crypto_1 = require("./vault-crypto");
+const capsule_dir_1 = require("./capsule-dir");
+const VERSION = "2.3.0";
 async function main() {
     const args = process.argv.slice(2);
     // Parse args
@@ -34,6 +37,8 @@ async function main() {
     let failOn = null;
     let outputDir = process.cwd();
     let skipSend = false;
+    let vaultPin;
+    let vaultDevice;
     let schedulePreset;
     let ciProvider;
     for (let i = 0; i < args.length; i++) {
@@ -59,6 +64,12 @@ async function main() {
             case "--skip-send":
                 skipSend = true;
                 break;
+            case "--vault-pin":
+                vaultPin = args[++i];
+                break;
+            case "--vault-device":
+                vaultDevice = args[++i];
+                break;
             case "--fix-plan":
                 console.log("\n  ⚠  --fix-plan is deprecated. Capsule provides recommendations only.\n  Run without this flag to see recommendations.\n");
                 break;
@@ -166,6 +177,9 @@ async function main() {
         process.exit(1);
     }
     log(ciMode, `Activated. Tier: ${activation.tier} | Scan ID: ${activation.scan_id}`);
+    // ── Step 1.5: Initialize .capsule/ directory ──
+    const capsuleDir = (0, capsule_dir_1.initCapsuleDir)(projectDir, licenseKey);
+    log(ciMode, `.capsule/ directory ready: ${capsuleDir}`);
     // ── Step 2: Code scan ──
     log(ciMode, "Scanning code...");
     const files = (0, code_scanner_1.readProjectFiles)(projectDir, (count) => {
@@ -229,6 +243,59 @@ async function main() {
     (0, fs_1.writeFileSync)(metaPath, JSON.stringify(metadata, null, 2), "utf-8");
     log(ciMode, `Full report:     ${fullPath}`);
     log(ciMode, `Metadata only:   ${metaPath}`);
+    // ── Step 5.5: Save to .capsule/ ──
+    try {
+        // Save score snapshot
+        (0, capsule_dir_1.saveScore)(capsuleDir, {
+            date: new Date().toISOString().slice(0, 10),
+            score: full.overall_score,
+            code_score: full.code_score ?? null,
+            db_score: full.db_score ?? null,
+            pii_total: full.summary.total_pii_fields,
+            pii_encrypted: full.summary.encrypted_fields,
+            coverage_percent: full.summary.coverage_percent,
+            findings_count: metadata.findings?.length || 0,
+            critical: full.summary.critical_issues,
+            high: full.summary.high_issues,
+            medium: full.summary.medium_issues ?? 0,
+            low: full.summary.low_issues ?? 0,
+            scan_type: dbUrl ? "full" : "code",
+            guard_version: VERSION,
+        });
+        // Update proof.json from DB results (if DB scan was done)
+        if (full.db?.pii_fields) {
+            const proofFields = full.db.pii_fields
+                .filter((f) => f.encrypted && f.encryption_pattern)
+                .map((f) => ({
+                table: f.table,
+                column: f.column,
+                pattern: f.encryption_pattern,
+                sentinel_prefix: f.sentinel_prefix || f.encryption_pattern,
+                row_count: f.row_count || 0,
+                encrypted_count: f.encrypted_count || 0,
+            }));
+            if (proofFields.length > 0) {
+                (0, capsule_dir_1.updateProof)(capsuleDir, proofFields);
+                log(ciMode, `Updated proof.json: ${proofFields.length} DB-verified encrypted fields`);
+            }
+        }
+        // Log scan as evidence
+        const deviceHash = (0, crypto_1.createHash)("sha256")
+            .update(`capsule:device:${require("os").hostname()}`)
+            .digest("hex").slice(0, 12);
+        (0, capsule_dir_1.addEvidence)(capsuleDir, licenseKey, {
+            date: new Date().toISOString(),
+            action: "scan_completed",
+            category: "scan",
+            detail: `Guard v${VERSION} scan: score ${full.overall_score}%, ${metadata.findings?.length || 0} findings, ${full.summary.encrypted_fields}/${full.summary.total_pii_fields} PII encrypted`,
+            impact: `Score: ${full.overall_score}%`,
+            attested_by: deviceHash,
+        });
+        log(ciMode, "Evidence saved to .capsule/");
+    }
+    catch (err) {
+        log(ciMode, `.capsule/ save failed (non-blocking): ${err instanceof Error ? err.message : err}`);
+    }
     // ── Step 6: Send metadata to NoData ──
     let serverResponse = {};
     if (!skipSend) {
@@ -257,6 +324,43 @@ async function main() {
             log(ciMode, "Could not reach NoData API — report saved locally");
         }
     }
+    // ── Step 6b: Encrypt & upload to vault (if --vault-pin) ──
+    let vaultUploaded = false;
+    if (vaultPin && !skipSend) {
+        log(ciMode, "Encrypting full report for vault...");
+        try {
+            const fullJson = JSON.stringify(full);
+            const { ciphertext, iv, salt } = (0, vault_crypto_1.encryptForVault)(vaultPin, fullJson);
+            const vaultRes = await fetch("https://nodatacapsule.com/api/guard/vault", {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json",
+                    "X-License-Key": licenseKey || "",
+                },
+                body: JSON.stringify({
+                    encrypted_blob: ciphertext,
+                    iv,
+                    salt,
+                    score: full.overall_score,
+                    findings_count: metadata.findings?.length || 0,
+                    scan_id: activation.scan_id,
+                    device_id: vaultDevice || undefined,
+                }),
+                signal: AbortSignal.timeout(15000),
+            });
+            if (vaultRes.ok) {
+                vaultUploaded = true;
+                log(ciMode, "Report encrypted & saved to vault");
+            }
+            else {
+                const errBody = await vaultRes.text().catch(() => "");
+                log(ciMode, `Vault upload failed (${vaultRes.status}): ${errBody}`);
+            }
+        }
+        catch (err) {
+            log(ciMode, `Vault upload error: ${err instanceof Error ? err.message : err}`);
+        }
+    }
     // ── Step 7: Print summary ──
     if (!ciMode) {
         console.log("");
@@ -278,6 +382,9 @@ async function main() {
         console.log(`  Sent to NoData:  ${metaPath}`);
         console.log(`  Proof hash:      ${full.proof_hash.slice(0, 16)}...`);
         console.log("  ══════════════════════════════════════");
+        if (vaultUploaded) {
+            console.log("  Vault:           Encrypted & saved to dashboard");
+        }
         console.log("  Your data never left your machine.");
         console.log("  Diff the two files to verify.\n");
     }
@@ -325,6 +432,83 @@ async function main() {
             log(ciMode, `Recommendations: ${recsPath}`);
         }
     }
+    // ── Step 8.5: Remediation Guide (non-CI) ──
+    if (!ciMode && metadata.findings?.length > 0) {
+        const fs = metadata.findings;
+        const hasPII = fs.some((f) => f.category === "encryption" || f.title?.toLowerCase().includes("pii") || f.title?.toLowerCase().includes("encrypt"));
+        const hasRLS = fs.some((f) => f.title?.toLowerCase().includes("rls") || f.title?.toLowerCase().includes("row level") || f.category === "access_control");
+        const hasSecrets = fs.some((f) => f.title?.toLowerCase().includes("secret") || f.title?.toLowerCase().includes("hardcoded") || f.category === "secrets");
+        const hasHeaders = fs.some((f) => f.title?.toLowerCase().includes("header") || f.category === "headers");
+        if (hasPII || hasRLS || hasSecrets || hasHeaders) {
+            console.log("  ══════════════════════════════════════");
+            console.log("  \x1b[33mREMEDIATION GUIDE\x1b[0m — General commands");
+            console.log("  ══════════════════════════════════════");
+            console.log("  \x1b[2mThese are general recommendations.");
+            console.log("  A qualified technical professional should review");
+            console.log("  and adapt them to your specific system.\x1b[0m\n");
+            if (hasPII) {
+                console.log("  \x1b[33m── ENCRYPT PII FIELDS ──\x1b[0m");
+                console.log("  \x1b[36mOption A:\x1b[0m Database-level (PostgreSQL)");
+                console.log("    CREATE EXTENSION IF NOT EXISTS pgcrypto;");
+                console.log("    ALTER TABLE <table> ADD COLUMN <field>_encrypted BYTEA;");
+                console.log("    UPDATE <table> SET <field>_encrypted =");
+                console.log("      pgp_sym_encrypt(<field>::TEXT, '<key>');");
+                console.log("");
+                console.log("  \x1b[36mOption B:\x1b[0m Application-level (Capsule SDK)");
+                console.log("    npm install @nodatachat/sdk");
+                console.log("    encrypt(value, process.env.FIELD_ENCRYPTION_KEY)");
+                console.log("");
+                console.log("  \x1b[36mOption C:\x1b[0m Encrypt .env at rest");
+                console.log("    npx @nodatachat/protect encrypt .env\n");
+            }
+            if (hasRLS) {
+                console.log("  \x1b[33m── ROW LEVEL SECURITY ──\x1b[0m");
+                console.log("    ALTER TABLE <table> ENABLE ROW LEVEL SECURITY;");
+                console.log("    ALTER TABLE <table> FORCE ROW LEVEL SECURITY;");
+                console.log("    CREATE POLICY \"users_own\" ON <table>");
+                console.log("      FOR ALL USING (user_id = auth.uid());\n");
+            }
+            if (hasSecrets) {
+                console.log("  \x1b[33m── REMOVE SECRETS FROM CODE ──\x1b[0m");
+                console.log("    1. Move to .env.local");
+                console.log("    2. Reference: process.env.SECRET_NAME");
+                console.log("    3. echo '.env*.local' >> .gitignore");
+                console.log("    4. npx @nodatachat/protect encrypt .env\n");
+            }
+            if (hasHeaders) {
+                console.log("  \x1b[33m── SECURITY HEADERS ──\x1b[0m");
+                console.log("    Strict-Transport-Security: max-age=63072000");
+                console.log("    X-Content-Type-Options: nosniff");
+                console.log("    X-Frame-Options: DENY");
+                console.log("    Referrer-Policy: strict-origin-when-cross-origin\n");
+            }
+            console.log("  ──────────────────────────────────────\n");
+        }
+    }
+    // ── Step 9: What's next (non-CI) ──
+    if (!ciMode) {
+        console.log("  ══════════════════════════════════════");
+        console.log("  WHAT TO DO NEXT");
+        console.log("  ══════════════════════════════════════");
+        if (vaultUploaded) {
+            console.log("  1. Open your dashboard: https://nodatacapsule.com/my-capsule");
+            console.log("  2. Go to the \x1b[36mVault\x1b[0m tab");
+            console.log("  3. Enter your PIN to see the full report");
+            console.log("  4. Share the score with your team (no sensitive data)");
+            console.log("  5. Fix findings and re-scan to improve your score\n");
+        }
+        else {
+            console.log("  1. Review \x1b[36mnodata-full-report.json\x1b[0m (stays local)");
+            console.log("  2. Open your dashboard: https://nodatacapsule.com/my-capsule");
+            console.log("  3. Share the score with your team");
+            console.log("  4. Fix findings and re-scan to improve your score");
+            console.log("");
+            console.log("  \x1b[33mTip:\x1b[0m Add \x1b[36m--vault-pin 1234\x1b[0m to auto-encrypt");
+            console.log("  and upload the full report to your vault.\n");
+        }
+    }
+    // ── Step 10: Print .capsule/ status ──
+    (0, capsule_dir_1.printCapsuleStatus)(projectDir, ciMode);
     // ── CI mode: exit code ──
     if (ciMode && failOn) {
         const { critical_issues, high_issues, medium_issues } = full.summary;
@@ -388,6 +572,8 @@ function printHelp() {
     --ci                   CI mode — minimal output, exit codes
     --fail-on <level>      Exit 1 if issues at: critical | high | medium
     --skip-send            Don't send metadata to NoData
+    --vault-pin <pin>      Encrypt full report & save to vault (AES-256-GCM)
+    --vault-device <id>    Link vault report to your dashboard device
 
   Schedule Options:
     --schedule <preset>    Install CI workflow: daily | weekly | monthly
@@ -420,6 +606,9 @@ function printHelp() {
     # Scan and get recommendations
     npx nodata-guard --license-key NDC-XXXX
 
+    # Scan + auto-save encrypted report to vault
+    npx nodata-guard --license-key NDC-XXXX --vault-pin 1234
+
     # Full scan with DB probe
     npx nodata-guard --license-key NDC-XXXX --db $DATABASE_URL
 

package/dist/code-scanner.js

@@ -159,7 +159,7 @@ function scanPIIFields(files) {
             const proof = JSON.parse(proofFile.content);
             if (proof.version === "1.0" && Array.isArray(proof.fields)) {
                 for (const f of proof.fields) {
-                    if (f.sentinel_encrypted?.startsWith("aes256gcm:v1:")) {
+                    if (f.sentinel_encrypted?.startsWith("aes256gcm:v1:") || f.sentinel_encrypted?.startsWith("enc:v1:") || f.sentinel_encrypted?.startsWith("ndc_enc_")) {
                         proofFields.add(`${f.table}.${f.column}`);
                     }
                 }
@@ -201,7 +201,7 @@ function scanPIIFields(files) {
                 for (let i = 0; i < lines.length; i++) {
                     if (lines[i].includes(field.column)) {
                         const context = lines.slice(Math.max(0, i - 10), Math.min(lines.length, i + 10)).join("\n");
-                        if (/createCipheriv|encrypt\(|encryptPII|nodata_encrypt|encryptField/i.test(context)) {
+                        if (/createCipheriv|encrypt\(|encryptPII|nodata_encrypt|encryptField|NoDataProxy|proxy\.seal|proxy\.unseal|enc:v1:/i.test(context)) {
                             field.encrypted = true;
                             field.encryption_pattern = "code_encrypt";
                             break;

package/dist/db-scanner.js

@@ -6,7 +6,10 @@
 // READS ONLY:
 //   - Schema (table/column names, data types)
 //   - Counts (row counts, encrypted counts)
-//   - Prefixes (LEFT(value, 13) — detects "aes256gcm:v1:" without reading data)
+//   - Prefixes (LEFT(value, N) — detects encryption without reading data):
+//       "aes256gcm:v1:" (13 chars) — direct AES-256-GCM
+//       "enc:v1:"       (7 chars)  — Capsule Proxy encryption
+//       "ndc_enc_"      (8 chars)  — @nodatachat/protect format
 //   - System tables (pg_policies, pg_user, pg_settings, pg_extension)
 //
 // NEVER READS: actual data values, passwords, tokens, emails, phones
@@ -101,12 +104,18 @@ async function scanDatabase(connectionString, onProgress) {
             }
             for (const { col, isCompanion } of columnsToCheck) {
                 try {
-                    // SAFE: LEFT(value, 13) reads only the prefix — never actual data
+                    // SAFE: LEFT(value, N) reads only the prefix — never actual data
+                    // Detects multiple encryption formats:
+                    //   aes256gcm:v1:  — legacy direct encryption (13 chars)
+                    //   enc:v1:        — Capsule Proxy encryption (7 chars)
+                    //   ndc_enc_       — @nodatachat/protect format (8 chars)
                     const { rows } = await client.query(`
             SELECT
               count(*) as total,
               count(${quoteIdent(col)}) as non_null,
               count(*) FILTER (WHERE LEFT(${quoteIdent(col)}::text, 13) = 'aes256gcm:v1:') as aes_gcm,
+              count(*) FILTER (WHERE LEFT(${quoteIdent(col)}::text, 7) = 'enc:v1:') as enc_v1,
+              count(*) FILTER (WHERE LEFT(${quoteIdent(col)}::text, 8) = 'ndc_enc_') as ndc_enc,
               count(*) FILTER (WHERE LENGTH(${quoteIdent(col)}::text) > 80
                 AND ${quoteIdent(col)}::text ~ '^[A-Za-z0-9+/=]+$') as base64_long
             FROM ${quoteIdent(field.table)}
@@ -114,18 +123,26 @@ async function scanDatabase(connectionString, onProgress) {
                     const total = parseInt(rows[0].total);
                     const nonNull = parseInt(rows[0].non_null);
                     const aesGcm = parseInt(rows[0].aes_gcm);
+                    const encV1 = parseInt(rows[0].enc_v1);
+                    const ndcEnc = parseInt(rows[0].ndc_enc);
                     const b64 = parseInt(rows[0].base64_long);
-                    const encCount = aesGcm + b64;
+                    const encCount = aesGcm + encV1 + ndcEnc + b64;
+                    // Determine pattern name for reporting
+                    const pattern = aesGcm > 0 ? "aes256gcm:v1"
+                        : encV1 > 0 ? "enc:v1 (Capsule Proxy)"
+                            : ndcEnc > 0 ? "ndc_enc (Protect)"
+                                : b64 > 0 ? "base64_long"
+                                    : "unknown";
                     if (isCompanion && encCount > 0) {
                         field.encrypted = true;
-                        field.encryption_pattern = aesGcm > 0 ? "aes256gcm:v1" : "base64_long";
+                        field.encryption_pattern = pattern;
                         field.encrypted_count = encCount;
                     }
                     else if (!isCompanion) {
                         field.row_count = total;
                         if (encCount > 0 && encCount >= nonNull * 0.9) {
                             field.encrypted = true;
-                            field.encryption_pattern = aesGcm > 0 ? "aes256gcm:v1" : "base64_long";
+                            field.encryption_pattern = pattern;
                             field.encrypted_count = encCount;
                         }
                     }

package/dist/reporter.js

@@ -67,6 +67,9 @@ function generateReports(input) {
     const proofData = allPII.map(f => `${f.table}.${f.column}:${f.encrypted}`).join("|") + `|${overallScore}|${now}`;
     const proofHash = (0, crypto_1.createHash)("sha256").update(proofData).digest("hex");
     // ── Build metadata report (what we send) ──
+    // PRIVACY DOCTRINE: No structural metadata (table/column/file names) ever leaves the machine.
+    // We send ONLY: counts, scores, severity, generic category labels, SOC control IDs.
+    // The customer keeps the full report locally and can verify the diff.
     const metadata = {
         version: "1.0",
         scan_id: input.scanId,
@@ -93,13 +96,11 @@ function generateReports(input) {
             route_protection_percent: routeProtection,
             secrets_found: (input.code.secrets.filter(s => !s.is_env_interpolated)).length,
             secrets_critical: criticalSecrets,
-            // Per-field summary — NO VALUES, just table.column + status
+            // Per-field: hashed identifier + type + status — NO real names
             fields: input.code.piiFields.map(f => ({
-                table: f.table,
-                column: f.column,
+                field_hash: (0, crypto_1.createHash)("sha256").update(`${f.table}.${f.column}`).digest("hex").slice(0, 16),
                 pii_type: f.pii_type,
                 encrypted: f.encrypted,
-                pattern: f.encryption_pattern,
             })),
         } : null,
         db_summary: input.db ? {
@@ -123,32 +124,32 @@ function generateReports(input) {
             critical: criticalSecrets,
             high: highSecrets + plaintextPII,
             medium: medSecrets,
-            recommendations_available: plaintextPII, // each plaintext field has a recommendation
+            recommendations_available: plaintextPII,
         },
-        // Fix suggestions — safe to send (just recommendation text, no code/values)
+        // REDACTED findings — generic titles only, no structural metadata
         findings: [
             ...allPII.filter(f => !f.encrypted).map(f => ({
                 severity: "high",
                 category: "pii",
                 rule_id: `PII_${f.pii_type.toUpperCase()}`,
-                title: `${f.table}.${f.column} — ${f.pii_type} stored in plaintext`,
-                fix_suggestion: `Add AES-256-GCM encryption to ${f.table}.${f.column} via Capsule field permissions`,
+                title: `PII field (${f.pii_type}) stored unencrypted`,
+                fix_suggestion: "Add AES-256-GCM column encryption via Capsule Protect",
                 soc_control: "CC6.7",
             })),
             ...(input.code?.secrets.filter(s => !s.is_env_interpolated) || []).map(s => ({
                 severity: s.severity,
                 category: "secrets",
                 rule_id: `SECRET_${s.type.toUpperCase().replace(/-/g, "_")}`,
-                title: `Hardcoded ${s.type} in ${s.file}:${s.line}`,
-                fix_suggestion: `Move to .env and encrypt with @nodatachat/protect`,
+                title: `Hardcoded secret (${s.type}) in source code`,
+                fix_suggestion: "Move to .env and encrypt with @nodatachat/protect",
                 soc_control: "CC6.1",
             })),
-            ...(input.code?.routes.filter(r => !r.has_auth) || []).slice(0, 20).map(r => ({
+            ...(input.code?.routes.filter(r => !r.has_auth) || []).slice(0, 20).map(() => ({
                 severity: "high",
                 category: "auth",
                 rule_id: "ROUTE_NO_AUTH",
-                title: `Unprotected route: ${r.path}`,
-                fix_suggestion: `Add authentication middleware (withAuth or API key check)`,
+                title: "API route missing authentication",
+                fix_suggestion: "Add authentication middleware (withAuth or API key check)",
                 soc_control: "CC6.3",
             })),
         ],
@@ -159,6 +160,7 @@ function generateReports(input) {
             contains_credentials: false,
             contains_source_code: false,
             contains_file_contents: false,
+            contains_structural_metadata: false,
             customer_can_verify: true,
         },
     };
@@ -207,6 +209,36 @@ function generateReports(input) {
         },
         proof_hash: proofHash,
         metadata_preview: metadata,
+        // ── HOW TO FIX ──
+        // This section stays in the LOCAL report only. Never sent to NoData.
+        how_to_fix: {
+            summary: `This scan found ${plaintextPII} unencrypted PII fields, ${criticalSecrets} hardcoded secrets, and ${totalRoutes - protectedRoutes} unprotected routes.`,
+            steps: [
+                ...(plaintextPII > 0 ? [{
+                        priority: 1,
+                        action: "Encrypt PII fields",
+                        detail: `${plaintextPII} fields contain personal data without encryption. Each field listed below needs AES-256-GCM column-level encryption.`,
+                        fields: allPII.filter(f => !f.encrypted).map(f => `${f.table}.${f.column} (${f.pii_type})`),
+                        impact: `+${Math.min(Math.round(plaintextPII * 1.5), 30)}% score improvement`,
+                    }] : []),
+                ...(criticalSecrets > 0 ? [{
+                        priority: 2,
+                        action: "Remove hardcoded secrets",
+                        detail: `${criticalSecrets} secrets are hardcoded in source files. Move them to .env and encrypt with: npx @nodatachat/protect init`,
+                        fields: (input.code?.secrets.filter(s => !s.is_env_interpolated && s.severity === "critical") || []).map(s => `${s.file}:${s.line} (${s.type})`),
+                        impact: `+${Math.min(criticalSecrets * 5, 25)}% score improvement`,
+                    }] : []),
+                ...((totalRoutes - protectedRoutes > 0) ? [{
+                        priority: 3,
+                        action: "Add route authentication",
+                        detail: `${totalRoutes - protectedRoutes} API routes have no auth middleware. Add withAuth, API key validation, or rate limiting.`,
+                        fields: (input.code?.routes.filter(r => !r.has_auth) || []).map(r => r.path),
+                        impact: `+${Math.min(Math.round((totalRoutes - protectedRoutes) * 0.5), 15)}% score improvement`,
+                    }] : []),
+            ],
+            workflow: "Give this report to your development team or security engineer. They can review each finding and implement the fix suggestions. After fixing, re-run Guard to verify your score improved.",
+            re_scan: `npx @nodatachat/guard@latest --license-key YOUR_KEY`,
+        },
     };
     return { full, metadata };
 }

package/dist/types.d.ts

@@ -88,6 +88,18 @@ export interface FullReport {
     };
     proof_hash: string;
     metadata_preview: MetadataReport;
+    how_to_fix: {
+        summary: string;
+        steps: Array<{
+            priority: number;
+            action: string;
+            detail: string;
+            fields: string[];
+            impact: string;
+        }>;
+        workflow: string;
+        re_scan: string;
+    };
 }
 export interface MetadataReport {
     version: "1.0";
@@ -116,11 +128,9 @@ export interface MetadataReport {
         secrets_found: number;
         secrets_critical: number;
         fields: Array<{
-            table: string;
-            column: string;
+            field_hash: string;
             pii_type: string;
             encrypted: boolean;
-            pattern: string | null;
         }>;
     } | null;
     db_summary: {
@@ -157,6 +167,7 @@ export interface MetadataReport {
         contains_credentials: false;
         contains_source_code: false;
         contains_file_contents: false;
+        contains_structural_metadata: false;
         customer_can_verify: true;
     };
 }

package/dist/vault-crypto.d.ts

@@ -0,0 +1,6 @@
+/** Encrypt plaintext string → base64 blob + hex IV + hex salt */
+export declare function encryptForVault(pin: string, plaintext: string): {
+    ciphertext: string;
+    iv: string;
+    salt: string;
+};

package/dist/vault-crypto.js

@@ -0,0 +1,36 @@
+"use strict";
+// ══════════════════════════════════════════════════════════════
+// vault-crypto.ts — Node.js AES-256-GCM encryption for Guard CLI
+//
+// Mirrors the browser vault-crypto.ts exactly:
+//   PIN → PBKDF2 (100k iterations, SHA-256) → AES-256-GCM key
+//
+// The encrypted blob produced here can be decrypted by the
+// browser VaultReportViewer using the same PIN.
+// ══════════════════════════════════════════════════════════════
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.encryptForVault = encryptForVault;
+const crypto_1 = require("crypto");
+const ITERATIONS = 100_000;
+const KEY_LENGTH = 32; // 256 bits
+const SALT_LENGTH = 16; // bytes
+const IV_LENGTH = 12; // bytes (standard for AES-GCM)
+/** Encrypt plaintext string → base64 blob + hex IV + hex salt */
+function encryptForVault(pin, plaintext) {
+    const salt = (0, crypto_1.randomBytes)(SALT_LENGTH);
+    const iv = (0, crypto_1.randomBytes)(IV_LENGTH);
+    const key = (0, crypto_1.pbkdf2Sync)(pin, salt, ITERATIONS, KEY_LENGTH, "sha256");
+    const cipher = (0, crypto_1.createCipheriv)("aes-256-gcm", key, iv);
+    const encrypted = Buffer.concat([
+        cipher.update(plaintext, "utf8"),
+        cipher.final(),
+    ]);
+    const authTag = cipher.getAuthTag();
+    // Combine ciphertext + authTag (browser Web Crypto expects them concatenated)
+    const combined = Buffer.concat([encrypted, authTag]);
+    return {
+        ciphertext: combined.toString("base64"),
+        iv: iv.toString("hex"),
+        salt: salt.toString("hex"),
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nodatachat/guard",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "description": "NoData Guard — continuous security scanner. Runs locally, reports only metadata. Your data never leaves your machine.",
   "main": "./dist/cli.js",
   "types": "./dist/cli.d.ts",