@quantakrypto/core 0.1.0

package/dist/changed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"changed.d.ts","sourceRoot":"","sources":["../src/changed.ts"],"names":[],"mappings":"AAiCA;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CA+BlF"}

package/dist/changed.js

@@ -0,0 +1,67 @@
+/**
+ * Incremental-scan helper: list the files that changed in a git working tree,
+ * for feeding into {@link ScanOptions.files}. Tolerant of non-git directories —
+ * returns an empty list rather than throwing.
+ */
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
+/** Run a git command in `cwd`, returning stdout or `null` on any failure. */
+async function git(cwd, args) {
+    try {
+        const { stdout } = await execFileAsync("git", args, {
+            cwd,
+            maxBuffer: 64 * 1024 * 1024,
+            windowsHide: true,
+        });
+        return stdout;
+    }
+    catch {
+        return null;
+    }
+}
+/** Split git output into trimmed, non-empty, POSIX-relative path lines. */
+function toLines(stdout) {
+    if (!stdout)
+        return [];
+    return stdout
+        .split("\n")
+        .map((l) => l.trim())
+        .filter((l) => l.length > 0);
+}
+/**
+ * Return the list of changed files (relative POSIX paths) under `root`.
+ *
+ * - With `since` (a ref / range), returns `git diff --name-only --diff-filter=ACMR <since>`
+ *   plus currently-modified-but-uncommitted files, deduped.
+ * - Without `since`, returns uncommitted changes (`git diff` working+staged) plus
+ *   untracked files (`git ls-files --others --exclude-standard`).
+ * - When `root` is not a git repository (or git is unavailable), returns `[]`.
+ *
+ * Deleted files are excluded (ACMR filter / existence is the caller's concern).
+ */
+export async function changedFiles(root, since) {
+    // Confirm this is a git work tree first; bail out tolerantly if not.
+    const inside = await git(root, ["rev-parse", "--is-inside-work-tree"]);
+    if (inside === null || inside.trim() !== "true")
+        return [];
+    const out = new Set();
+    if (since) {
+        for (const f of toLines(await git(root, ["diff", "--name-only", "--diff-filter=ACMR", since]))) {
+            out.add(f);
+        }
+    }
+    // Always include local uncommitted edits (staged + unstaged), filtered to ACMR.
+    for (const f of toLines(await git(root, ["diff", "--name-only", "--diff-filter=ACMR"]))) {
+        out.add(f);
+    }
+    for (const f of toLines(await git(root, ["diff", "--name-only", "--diff-filter=ACMR", "--cached"]))) {
+        out.add(f);
+    }
+    // Untracked (but not ignored) files.
+    for (const f of toLines(await git(root, ["ls-files", "--others", "--exclude-standard"]))) {
+        out.add(f);
+    }
+    return [...out].sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
+}
+//# sourceMappingURL=changed.js.map

package/dist/changed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"changed.js","sourceRoot":"","sources":["../src/changed.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,6EAA6E;AAC7E,KAAK,UAAU,GAAG,CAAC,GAAW,EAAE,IAAc;IAC5C,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE;YAClD,GAAG;YACH,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;YAC3B,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,SAAS,OAAO,CAAC,MAAqB;IACpC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,OAAO,MAAM;SACV,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,KAAc;IAC7D,qEAAqE;IACrE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC,CAAC;IACvE,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM;QAAE,OAAO,EAAE,CAAC;IAE3D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAE9B,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,MAAM,CAAC,IAAI,OAAO,CACrB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,oBAAoB,EAAE,KAAK,CAAC,CAAC,CACtE,EAAE,CAAC;YACF,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACb,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,CACrB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,oBAAoB,EAAE,UAAU,CAAC,CAAC,CAC3E,EAAE,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACb,CAAC;IAED,qCAAqC;IACrC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC;QACzF,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACb,CAAC;IAED,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,55 @@
+import type { ScanOptions, Severity } from "./types.js";
+/** Canonical config file name discovered at a scan root. */
+export declare const CONFIG_FILENAME = "quantakrypto.config.json";
+/**
+ * The slice of options a `quantakrypto.config.json` can set. A subset of
+ * {@link ScanOptions} (the file-selection + scope keys) extended with the two
+ * policy keys qScan owns: `severityThreshold` and `baseline`.
+ *
+ * `root`, `files`, `detectors` (the programmatic detector array), and `onFile`
+ * are intentionally NOT configurable from a file — they are call-site concerns.
+ */
+export interface QuantakryptoFileConfig extends Partial<Pick<ScanOptions, "include" | "exclude" | "noDefaultIgnores" | "maxFileSize" | "scanMinified" | "source" | "dependencies" | "config">> {
+    /** Gate severity (drives the exit code). Maps to qScan's `severityThreshold`. */
+    severityThreshold?: Severity;
+    /** Path to a baseline file, relative to the config file's directory. */
+    baseline?: string;
+}
+/** Result of {@link loadConfig}: the resolved config plus where it came from. */
+export interface LoadConfigResult {
+    /** Validated, mapped config. Empty object when no file was found. */
+    config: QuantakryptoFileConfig;
+    /** Absolute path of the file that was loaded, when one was. */
+    path?: string;
+    /**
+     * Non-fatal warnings (unknown keys, unknown future `version`). The caller may
+     * surface these; they never abort the load.
+     */
+    warnings: string[];
+}
+/** Thrown when a known key has a malformed *value* (a usage error: exit 2). */
+export declare class ConfigError extends Error {
+    readonly name = "ConfigError";
+    /** The config file path the error relates to, when known. */
+    readonly path: string | undefined;
+    constructor(message: string, configPath?: string);
+}
+/**
+ * Load a `quantakrypto.config.json` for a scan.
+ *
+ * By default reads `<root>/quantakrypto.config.json`. Pass an explicit file path as
+ * `root` (or via the caller's `--config` flag) to read a named file instead —
+ * if the path's basename is `quantakrypto.config.json` it is read directly; otherwise
+ * the path is treated as a directory and the file is looked up inside it. When
+ * an explicit path is given but missing, that is an error; an *absent*
+ * auto-discovered file is tolerated (returns an empty config).
+ *
+ * @param root Directory to look in, OR an explicit config file path.
+ * @param opts.explicit When true, a missing file is an error (the user named it).
+ * @throws {ConfigError} On malformed JSON, a bad value for a known key, or a
+ *   missing explicitly-named file.
+ */
+export declare function loadConfig(root: string, opts?: {
+    explicit?: boolean;
+}): Promise<LoadConfigResult>;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAExD,4DAA4D;AAC5D,eAAO,MAAM,eAAe,6BAA6B,CAAC;AAgB1D;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAuB,SAAQ,OAAO,CACrD,IAAI,CACF,WAAW,EACT,SAAS,GACT,SAAS,GACT,kBAAkB,GAClB,aAAa,GACb,cAAc,GACd,QAAQ,GACR,cAAc,GACd,QAAQ,CACX,CACF;IACC,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,QAAQ,CAAC;IAC7B,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,iFAAiF;AACjF,MAAM,WAAW,gBAAgB;IAC/B,qEAAqE;IACrE,MAAM,EAAE,sBAAsB,CAAC;IAC/B,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,+EAA+E;AAC/E,qBAAa,WAAY,SAAQ,KAAK;IACpC,SAAkB,IAAI,iBAAiB;IACvC,6DAA6D;IAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;gBACtB,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;CAIjD;AA8JD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAO,GAChC,OAAO,CAAC,gBAAgB,CAAC,CAgC3B"}

package/dist/config.js

@@ -0,0 +1,232 @@
+/**
+ * `quantakrypto.config.json` loader (ROADMAP P2-9, see docs/CONFIG.md).
+ *
+ * Reads an optional project configuration file, validates the *types* of known
+ * keys, ignores unknown keys (forward compatibility), and maps it onto a
+ * `Partial<ScanOptions>` plus the two policy keys qScan consumes
+ * (`severityThreshold`, `baseline`). It performs NO scanning and has no
+ * side-effects beyond a single `readFile`.
+ *
+ * Precedence (resolved by the consumer, not here): flags > config > defaults.
+ *
+ * The parsed object is treated as **untrusted input** in the same spirit as a
+ * scanned manifest (THREAT-MODEL Q-09): we only membership-test known keys and
+ * never deep-merge the parsed object into anything.
+ */
+import { readFile } from "node:fs/promises";
+import * as path from "node:path";
+/** Canonical config file name discovered at a scan root. */
+export const CONFIG_FILENAME = "quantakrypto.config.json";
+/** Severity levels accepted by `severityThreshold`, for validation. */
+const SEVERITIES = ["critical", "high", "medium", "low", "info"];
+/** Detector-family toggle names recognised in the `detectors` object. */
+const DETECTOR_FAMILIES = [
+    "node-crypto",
+    "webcrypto",
+    "crypto-libs",
+    "jwt-jose",
+    "tls-config",
+    "pem-material",
+    "dependencies",
+];
+/** Thrown when a known key has a malformed *value* (a usage error: exit 2). */
+export class ConfigError extends Error {
+    name = "ConfigError";
+    /** The config file path the error relates to, when known. */
+    path;
+    constructor(message, configPath) {
+        super(message);
+        this.path = configPath;
+    }
+}
+function isObject(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+/** Validate an optional boolean field; returns it or undefined, or throws. */
+function asBool(obj, key, file) {
+    if (!(key in obj))
+        return undefined;
+    const v = obj[key];
+    if (typeof v !== "boolean") {
+        throw new ConfigError(`"${key}" must be a boolean (got ${typeof v})`, file);
+    }
+    return v;
+}
+/** Validate an optional non-negative-integer field. */
+function asInt(obj, key, file) {
+    if (!(key in obj))
+        return undefined;
+    const v = obj[key];
+    if (typeof v !== "number" || !Number.isInteger(v) || v < 0) {
+        throw new ConfigError(`"${key}" must be a non-negative integer`, file);
+    }
+    return v;
+}
+/** Validate an optional string[] field (every element must be a string). */
+function asStringArray(obj, key, file) {
+    if (!(key in obj))
+        return undefined;
+    const v = obj[key];
+    if (!Array.isArray(v) || !v.every((x) => typeof x === "string")) {
+        throw new ConfigError(`"${key}" must be an array of strings`, file);
+    }
+    return [...v];
+}
+/**
+ * Map the validated raw JSON object onto a {@link QuantakryptoFileConfig}. Throws
+ * {@link ConfigError} on a malformed *value* for any known key; collects
+ * warnings for unknown keys and unrecognised `version`.
+ */
+function mapConfig(raw, file, warnings) {
+    // Known top-level keys. Anything else is a warning, not an error.
+    const KNOWN = new Set([
+        "$schema",
+        "version",
+        "include",
+        "exclude",
+        "noDefaultIgnores",
+        "maxFileSize",
+        "scanMinified",
+        "detectors",
+        "languages",
+        "severityThreshold",
+        "baseline",
+    ]);
+    for (const key of Object.keys(raw)) {
+        if (!KNOWN.has(key))
+            warnings.push(`unknown config key "${key}" ignored`);
+    }
+    // version: known forward-compat warning only.
+    if ("version" in raw) {
+        const version = raw["version"];
+        if (typeof version !== "number" || !Number.isInteger(version)) {
+            throw new ConfigError(`"version" must be an integer`, file);
+        }
+        if (version !== 1) {
+            warnings.push(`config "version" ${version} is newer than supported (1); best-effort`);
+        }
+    }
+    const out = {};
+    const include = asStringArray(raw, "include", file);
+    if (include)
+        out.include = include;
+    const exclude = asStringArray(raw, "exclude", file);
+    if (exclude)
+        out.exclude = exclude;
+    const noDefaultIgnores = asBool(raw, "noDefaultIgnores", file);
+    if (noDefaultIgnores !== undefined)
+        out.noDefaultIgnores = noDefaultIgnores;
+    const scanMinified = asBool(raw, "scanMinified", file);
+    if (scanMinified !== undefined)
+        out.scanMinified = scanMinified;
+    const maxFileSize = asInt(raw, "maxFileSize", file);
+    if (maxFileSize !== undefined)
+        out.maxFileSize = maxFileSize;
+    // detectors.<family> bool map → source / dependencies / config scope toggles.
+    // A family turned off is equivalent to its `--no-*` flag (per docs/CONFIG.md
+    // §4.1). We collapse the per-family map onto the three scan-scope toggles:
+    //   dependencies → ScanOptions.dependencies
+    //   pem-material + tls-config → ScanOptions.config (config-scope detectors)
+    //   the JS source families → ScanOptions.source (source-scope detectors)
+    // Only an explicit `false` flips a toggle off; absent/true leaves the default.
+    if ("detectors" in raw) {
+        const det = raw["detectors"];
+        if (!isObject(det)) {
+            throw new ConfigError(`"detectors" must be an object of family→boolean`, file);
+        }
+        for (const key of Object.keys(det)) {
+            if (!DETECTOR_FAMILIES.includes(key)) {
+                warnings.push(`unknown detector family "${key}" ignored`);
+                continue;
+            }
+            const v = det[key];
+            if (typeof v !== "boolean") {
+                throw new ConfigError(`"detectors.${key}" must be a boolean`, file);
+            }
+            if (v)
+                continue; // true = default; nothing to disable.
+            switch (key) {
+                case "dependencies":
+                    out.dependencies = false;
+                    break;
+                case "tls-config":
+                case "pem-material":
+                    out.config = false;
+                    break;
+                default:
+                    // node-crypto / webcrypto / crypto-libs / jwt-jose are source-scope.
+                    out.source = false;
+                    break;
+            }
+        }
+    }
+    // languages: forward-looking (inert until the plugin registry lands). Validate
+    // the type so the file format is stable, but do not map it anywhere.
+    const languages = asStringArray(raw, "languages", file);
+    if (languages)
+        warnings.push(`"languages" is accepted but inert until detector plugins land`);
+    // severityThreshold: enum.
+    if ("severityThreshold" in raw) {
+        const sev = raw["severityThreshold"];
+        if (typeof sev !== "string" || !SEVERITIES.includes(sev)) {
+            throw new ConfigError(`"severityThreshold" must be one of: ${SEVERITIES.join(", ")}`, file);
+        }
+        out.severityThreshold = sev;
+    }
+    // baseline: path string, resolved relative to the config file's directory.
+    if ("baseline" in raw) {
+        const baseline = raw["baseline"];
+        if (typeof baseline !== "string" || baseline.length === 0) {
+            throw new ConfigError(`"baseline" must be a non-empty path string`, file);
+        }
+        out.baseline = path.isAbsolute(baseline) ? baseline : path.join(path.dirname(file), baseline);
+    }
+    return out;
+}
+/**
+ * Load a `quantakrypto.config.json` for a scan.
+ *
+ * By default reads `<root>/quantakrypto.config.json`. Pass an explicit file path as
+ * `root` (or via the caller's `--config` flag) to read a named file instead —
+ * if the path's basename is `quantakrypto.config.json` it is read directly; otherwise
+ * the path is treated as a directory and the file is looked up inside it. When
+ * an explicit path is given but missing, that is an error; an *absent*
+ * auto-discovered file is tolerated (returns an empty config).
+ *
+ * @param root Directory to look in, OR an explicit config file path.
+ * @param opts.explicit When true, a missing file is an error (the user named it).
+ * @throws {ConfigError} On malformed JSON, a bad value for a known key, or a
+ *   missing explicitly-named file.
+ */
+export async function loadConfig(root, opts = {}) {
+    // Resolve the file path: an explicit *.json file is used verbatim; otherwise
+    // treat `root` as a directory and append the canonical name.
+    const base = path.basename(root);
+    const file = base === CONFIG_FILENAME || base.endsWith(".json")
+        ? path.resolve(root)
+        : path.resolve(root, CONFIG_FILENAME);
+    let text;
+    try {
+        text = await readFile(file, "utf8");
+    }
+    catch {
+        if (opts.explicit) {
+            throw new ConfigError(`config file not found: ${file}`, file);
+        }
+        return { config: {}, warnings: [] }; // tolerant when auto-discovering.
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch (err) {
+        throw new ConfigError(`invalid JSON in ${file}: ${err.message}`, file);
+    }
+    if (!isObject(parsed)) {
+        throw new ConfigError(`config must be a JSON object, got ${typeof parsed}`, file);
+    }
+    const warnings = [];
+    const config = mapConfig(parsed, file, warnings);
+    return { config, path: file, warnings };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAIlC,4DAA4D;AAC5D,MAAM,CAAC,MAAM,eAAe,GAAG,0BAA0B,CAAC;AAE1D,uEAAuE;AACvE,MAAM,UAAU,GAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAEtF,yEAAyE;AACzE,MAAM,iBAAiB,GAAG;IACxB,aAAa;IACb,WAAW;IACX,aAAa;IACb,UAAU;IACV,YAAY;IACZ,cAAc;IACd,cAAc;CACN,CAAC;AA0CX,+EAA+E;AAC/E,MAAM,OAAO,WAAY,SAAQ,KAAK;IAClB,IAAI,GAAG,aAAa,CAAC;IACvC,6DAA6D;IACpD,IAAI,CAAqB;IAClC,YAAY,OAAe,EAAE,UAAmB;QAC9C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,8EAA8E;AAC9E,SAAS,MAAM,CAAC,GAA4B,EAAE,GAAW,EAAE,IAAY;IACrE,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACpC,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,IAAI,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,IAAI,WAAW,CAAC,IAAI,GAAG,4BAA4B,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,uDAAuD;AACvD,SAAS,KAAK,CAAC,GAA4B,EAAE,GAAW,EAAE,IAAY;IACpE,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACpC,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,WAAW,CAAC,IAAI,GAAG,kCAAkC,EAAE,IAAI,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,4EAA4E;AAC5E,SAAS,aAAa,CACpB,GAA4B,EAC5B,GAAW,EACX,IAAY;IAEZ,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACpC,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,WAAW,CAAC,IAAI,GAAG,+BAA+B,EAAE,IAAI,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAChB,GAA4B,EAC5B,IAAY,EACZ,QAAkB;IAElB,kEAAkE;IAClE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC;QACpB,SAAS;QACT,SAAS;QACT,SAAS;QACT,SAAS;QACT,kBAAkB;QAClB,aAAa;QACb,cAAc;QACd,WAAW;QACX,WAAW;QACX,mBAAmB;QACnB,UAAU;KACX,CAAC,CAAC;IACH,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,uBAAuB,GAAG,WAAW,CAAC,CAAC;IAC5E,CAAC;IAED,8CAA8C;IAC9C,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,WAAW,CAAC,8BAA8B,EAAE,IAAI,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;YAClB,QAAQ,CAAC,IAAI,CAAC,oBAAoB,OAAO,2CAA2C,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAA2B,EAAE,CAAC;IAEvC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,OAAO;QAAE,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC;IACnC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,OAAO;QAAE,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC;IAEnC,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,EAAE,kBAAkB,EAAE,IAAI,CAAC,CAAC;IAC/D,IAAI,gBAAgB,KAAK,SAAS;QAAE,GAAG,CAAC,gBAAgB,GAAG,gBAAgB,CAAC;IAC5E,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;IACvD,IAAI,YAAY,KAAK,SAAS;QAAE,GAAG,CAAC,YAAY,GAAG,YAAY,CAAC;IAEhE,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,WAAW,KAAK,SAAS;QAAE,GAAG,CAAC,WAAW,GAAG,WAAW,CAAC;IAE7D,8EAA8E;IAC9E,6EAA6E;IAC7E,2EAA2E;IAC3E,4CAA4C;IAC5C,4EAA4E;IAC5E,yEAAyE;IACzE,+EAA+E;IAC/E,IAAI,WAAW,IAAI,GAAG,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,WAAW,CAAC,iDAAiD,EAAE,IAAI,CAAC,CAAC;QACjF,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,IAAI,CAAE,iBAAuC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5D,QAAQ,CAAC,IAAI,CAAC,4BAA4B,GAAG,WAAW,CAAC,CAAC;gBAC1D,SAAS;YACX,CAAC;YACD,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;YACnB,IAAI,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,WAAW,CAAC,cAAc,GAAG,qBAAqB,EAAE,IAAI,CAAC,CAAC;YACtE,CAAC;YACD,IAAI,CAAC;gBAAE,SAAS,CAAC,sCAAsC;YACvD,QAAQ,GAAG,EAAE,CAAC;gBACZ,KAAK,cAAc;oBACjB,GAAG,CAAC,YAAY,GAAG,KAAK,CAAC;oBACzB,MAAM;gBACR,KAAK,YAAY,CAAC;gBAClB,KAAK,cAAc;oBACjB,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC;oBACnB,MAAM;gBACR;oBACE,qEAAqE;oBACrE,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC;oBACnB,MAAM;YACV,CAAC;QACH,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,qEAAqE;IACrE,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;IACxD,IAAI,SAAS;QAAE,QAAQ,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;IAE9F,2BAA2B;IAC3B,IAAI,mBAAmB,IAAI,GAAG,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACrC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAE,UAAgC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAChF,MAAM,IAAI,WAAW,CAAC,uCAAuC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC9F,CAAC;QACD,GAAG,CAAC,iBAAiB,GAAG,GAAe,CAAC;IAC1C,CAAC;IAED,2EAA2E;IAC3E,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;QACjC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,WAAW,CAAC,4CAA4C,EAAE,IAAI,CAAC,CAAC;QAC5E,CAAC;QACD,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;IAChG,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAY,EACZ,OAA+B,EAAE;IAEjC,6EAA6E;IAC7E,6DAA6D;IAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,IAAI,GACR,IAAI,KAAK,eAAe,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAChD,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;QACpB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IAE1C,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,WAAW,CAAC,0BAA0B,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC,kCAAkC;IACzE,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,WAAW,CAAC,mBAAmB,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,WAAW,CAAC,qCAAqC,OAAO,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC;IACpF,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACjD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC1C,CAAC"}

package/dist/cwe.d.ts

@@ -0,0 +1,16 @@
+/**
+ * CWE (Common Weakness Enumeration) identifiers used to tag findings. These
+ * feed SARIF rule taxa / properties and the CBOM export, and let downstream
+ * compliance tooling map quantaKrypto findings to a standard weakness taxonomy.
+ */
+/** CWE-327: Use of a Broken or Risky Cryptographic Algorithm. */
+export declare const CWE_BROKEN_CRYPTO = "CWE-327";
+/** CWE-326: Inadequate Encryption Strength. */
+export declare const CWE_WEAK_STRENGTH = "CWE-326";
+/** CWE-295: Improper Certificate Validation. */
+export declare const CWE_CERT_VALIDATION = "CWE-295";
+/** CWE-798: Use of Hard-coded Credentials (embedded private keys). */
+export declare const CWE_HARDCODED_KEY = "CWE-798";
+/** CWE-1240: Use of a Cryptographic Primitive with a Risky Implementation. */
+export declare const CWE_RISKY_PRIMITIVE = "CWE-1240";
+//# sourceMappingURL=cwe.d.ts.map

package/dist/cwe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cwe.d.ts","sourceRoot":"","sources":["../src/cwe.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,iEAAiE;AACjE,eAAO,MAAM,iBAAiB,YAAY,CAAC;AAE3C,+CAA+C;AAC/C,eAAO,MAAM,iBAAiB,YAAY,CAAC;AAE3C,gDAAgD;AAChD,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAE7C,sEAAsE;AACtE,eAAO,MAAM,iBAAiB,YAAY,CAAC;AAE3C,8EAA8E;AAC9E,eAAO,MAAM,mBAAmB,aAAa,CAAC"}

package/dist/cwe.js

@@ -0,0 +1,16 @@
+/**
+ * CWE (Common Weakness Enumeration) identifiers used to tag findings. These
+ * feed SARIF rule taxa / properties and the CBOM export, and let downstream
+ * compliance tooling map quantaKrypto findings to a standard weakness taxonomy.
+ */
+/** CWE-327: Use of a Broken or Risky Cryptographic Algorithm. */
+export const CWE_BROKEN_CRYPTO = "CWE-327";
+/** CWE-326: Inadequate Encryption Strength. */
+export const CWE_WEAK_STRENGTH = "CWE-326";
+/** CWE-295: Improper Certificate Validation. */
+export const CWE_CERT_VALIDATION = "CWE-295";
+/** CWE-798: Use of Hard-coded Credentials (embedded private keys). */
+export const CWE_HARDCODED_KEY = "CWE-798";
+/** CWE-1240: Use of a Cryptographic Primitive with a Risky Implementation. */
+export const CWE_RISKY_PRIMITIVE = "CWE-1240";
+//# sourceMappingURL=cwe.js.map

package/dist/cwe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cwe.js","sourceRoot":"","sources":["../src/cwe.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,iEAAiE;AACjE,MAAM,CAAC,MAAM,iBAAiB,GAAG,SAAS,CAAC;AAE3C,+CAA+C;AAC/C,MAAM,CAAC,MAAM,iBAAiB,GAAG,SAAS,CAAC;AAE3C,gDAAgD;AAChD,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAE7C,sEAAsE;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,SAAS,CAAC;AAE3C,8EAA8E;AAC9E,MAAM,CAAC,MAAM,mBAAmB,GAAG,UAAU,CAAC"}

package/dist/dependencies.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Curated database of npm packages that primarily expose classical asymmetric
+ * cryptography (and are therefore quantum-vulnerable), plus a manifest scanner
+ * that flags any of them found in package.json / package-lock.json.
+ *
+ * The list is intentionally focused on libraries whose *purpose* is classical
+ * public-key crypto. General-purpose packages that merely call out to Node's
+ * crypto are out of scope here (those are caught by the source detectors).
+ */
+import type { Finding, VulnerableDependency } from "./types.js";
+/** Known quantum-vulnerable npm dependencies. */
+export declare const vulnerableDependencies: VulnerableDependency[];
+/** True if a file path looks like a manifest we can parse for dependencies. */
+export declare function isManifestFile(file: string): boolean;
+/**
+ * Scan a single manifest file's contents for vulnerable dependencies.
+ *
+ * - `package.json`: dependencies / devDependencies / peerDependencies / optionalDependencies.
+ * - `package-lock.json` (v2/v3): the `packages` map keys (node_modules/<name>),
+ *   plus legacy `dependencies` map for v1.
+ *
+ * Returns one finding per distinct vulnerable package name found in the file.
+ */
+export declare function scanManifest(file: string, content: string): Finding[];
+//# sourceMappingURL=dependencies.d.ts.map

package/dist/dependencies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependencies.d.ts","sourceRoot":"","sources":["../src/dependencies.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAmB,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAKjF,iDAAiD;AACjD,eAAO,MAAM,sBAAsB,EAAE,oBAAoB,EA6IxD,CAAC;AAwCF,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGpD;AA2CD;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,EAAE,CA8CrE"}