@quantakrypto/core 0.1.0

package/dist/detectors/source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../src/detectors/source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAW,MAAM,aAAa,CAAC;AA+rBrD,0DAA0D;AAC1D,eAAO,MAAM,eAAe,EAAE,QAAQ,EAOrC,CAAC"}

package/dist/detectors/source.js

@@ -0,0 +1,575 @@
+import { JS_TS_EXTENSIONS, eachMatch, hasExtension, makeFinding, nearSortedCall, } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION, CWE_WEAK_STRENGTH } from "../cwe.js";
+/* -------------------------------------------------------------------------- */
+/* Precompiled regexes (module scope — never recreated per file)              */
+/* -------------------------------------------------------------------------- */
+const RE_GENERATE_KEYPAIR = /generateKeyPair(?:Sync)?\s*\(\s*['"`](rsa|ec|dsa|dh|x25519|x448|ed25519|ed448)['"`]/g;
+const RE_CREATE_SIGN_VERIFY = /create(?:Sign|Verify)\s*\(/g;
+// One-shot crypto.sign/verify(algorithm, data, key). Anchored so it doesn't
+// fire inside identifiers like `assign(` or `createSign(` (which the dedicated
+// createSign/createVerify rule handles).
+const RE_ONESHOT_SIGN_VERIFY = /(?:^|[^.\w])(?:crypto\.)?(sign|verify)\s*\(\s*['"`][\w.-]+['"`]\s*,/g;
+const RE_CREATE_DH = /createDiffieHellman(?:Group)?\s*\(/g;
+const RE_GET_DH = /getDiffieHellman\s*\(\s*['"`](modp\d+)['"`]\s*\)/g;
+const RE_CREATE_ECDH = /createECDH\s*\(/g;
+const RE_RSA_ENCRYPT = /(?:crypto\.)?(?:publicEncrypt|privateDecrypt)\s*\(/g;
+const RE_DH_KEYOBJECT = /(?:crypto\.)?diffieHellman\s*\(\s*\{/g;
+// WebCrypto.
+const RE_WEBCRYPTO_ALGO = /\b(RSA-OAEP|RSA-PSS|RSASSA-PKCS1-v1_5|ECDH|ECDSA)\b/gi;
+const RE_SUBTLE_CALL = /subtle\s*\.\s*(generateKey|importKey|exportKey|deriveKey|deriveBits|sign|verify|encrypt|decrypt|wrapKey|unwrapKey)\s*\(/g;
+// Libraries.
+const RE_FORGE_RSA = /pki\.rsa\.generateKeyPair\s*\(/g;
+const RE_FORGE_ED25519 = /forge\.ed25519\b/g;
+const RE_ELLIPTIC_EC = /new\s+(?:elliptic\.)?ec\s*\(/gi;
+const RE_JSRSASIGN_KEYGEN = /KEYUTIL\.generateKeypair\s*\(/g;
+const RE_JSRSASIGN_SIGN = /KJUR\.crypto\.(?:Signature|ECDSA)\b/g;
+const RE_NODE_RSA = /new\s+NodeRSA\s*\(/g;
+// secp256k1 — direct @noble/secp256k1 / secp256k1-style API usage in source.
+const RE_SECP256K1 = /\b(?:secp(?:256k1)?|secp)\s*\.\s*(?:sign|verify|getPublicKey|getSharedSecret|ecdh|recoverPublicKey)\s*\(/g;
+// JWT/JOSE.
+const RE_JWT_ALG = /['"`](RS(?:256|384|512)|PS(?:256|384|512)|ES(?:256|384|512|256K)|EdDSA)['"`]/g;
+// JOSE ECDH-ES key agreement (HNDL) and COSE algorithm identifiers.
+const RE_JOSE_ECDH = /['"`](ECDH-ES(?:\+A(?:128|192|256)KW)?)['"`]/g;
+// TLS config.
+const RE_TLS_LEGACY_VERSION = /(?:minVersion|maxVersion)\s*:\s*['"`]TLSv1(?:\.1)?['"`]|secureProtocol\s*:\s*['"`]TLSv1(?:_1)?_method['"`]/g;
+const RE_TLS_REJECT = /rejectUnauthorized\s*:\s*false/g;
+// Hardened cipher regex: bounded spans (no unbounded `[^'"`]*` straddling the
+// alternation), single-quote-style anchoring removed in favour of {0,256} bounds
+// so worst-case backtracking is linear in the bound, not the file (P0-6).
+const RE_TLS_WEAK_CIPHER = /ciphers\s*:\s*['"`][^'"`\n]{0,256}?\b(RC4|DES|3DES|MD5|NULL|EXPORT|aNULL|eNULL)\b[^'"`\n]{0,256}?['"`]/gi;
+/* -------------------------------------------------------------------------- */
+/* Node.js `crypto` module                                                    */
+/* -------------------------------------------------------------------------- */
+/** Detects classical asymmetric usage from Node's built-in `crypto` module. */
+const nodeCryptoDetector = {
+    id: "node-crypto",
+    description: "Classical asymmetric crypto via the Node.js `crypto` module",
+    scope: "source",
+    language: "js",
+    appliesTo: (f) => hasExtension(f, JS_TS_EXTENSIONS),
+    detect({ file, content }) {
+        const findings = [];
+        const push = (spec, m) => findings.push(makeFinding({ ...spec, file, content, index: m.index, matchLength: m[0].length }));
+        // generateKeyPair(Sync)('rsa' | 'ec' | 'dsa' | 'dh' | 'x25519' | 'ed25519', ...)
+        eachMatch(RE_GENERATE_KEYPAIR, content, (m) => {
+            const type = m[1].toLowerCase();
+            const map = {
+                rsa: { algo: "RSA", cat: "kem", sev: "high", hndl: true, label: "RSA" },
+                // EC keys feed BOTH ECDSA (sign) and ECDH (key agreement). ECDH is
+                // HNDL-exposed, so classify conservatively as key-exchange-capable and
+                // surface both concerns rather than asserting signature-only (P0-4).
+                ec: {
+                    algo: "ECDH",
+                    cat: "key-exchange",
+                    sev: "high",
+                    hndl: true,
+                    label: "EC (ECDSA/ECDH)",
+                    message: "Generates a classical EC key pair. EC keys feed BOTH ECDSA signatures " +
+                        "and ECDH key agreement; the ECDH path is harvest-now-decrypt-later exposed.",
+                    remediation: "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
+                },
+                dsa: { algo: "DSA", cat: "signature", sev: "high", hndl: false, label: "DSA" },
+                dh: { algo: "DH", cat: "key-exchange", sev: "high", hndl: true, label: "Diffie-Hellman" },
+                x25519: { algo: "X25519", cat: "key-exchange", sev: "low", hndl: true, label: "X25519" },
+                x448: { algo: "X448", cat: "key-exchange", sev: "low", hndl: true, label: "X448" },
+                ed25519: { algo: "EdDSA", cat: "signature", sev: "low", hndl: false, label: "Ed25519" },
+                ed448: { algo: "EdDSA", cat: "signature", sev: "low", hndl: false, label: "Ed448" },
+            };
+            const info = map[type];
+            push({
+                ruleId: "node-crypto-keygen",
+                title: `${info.label} key generation`,
+                category: info.cat,
+                severity: info.sev,
+                confidence: "high",
+                algorithm: info.algo,
+                hndl: info.hndl,
+                cwe: CWE_BROKEN_CRYPTO,
+                message: info.message ??
+                    `Generates a classical ${info.label} key pair, which is not quantum-safe.`,
+                ...(info.remediation ? { remediation: info.remediation } : {}),
+            }, m);
+        });
+        // createSign / createVerify — RSA / ECDSA / DSA signatures.
+        eachMatch(RE_CREATE_SIGN_VERIFY, content, (m) => {
+            push({
+                ruleId: "node-crypto-sign",
+                title: "Classical signature (createSign/createVerify)",
+                category: "signature",
+                severity: "high",
+                confidence: "medium",
+                algorithm: "unknown",
+                hndl: false,
+                cwe: CWE_BROKEN_CRYPTO,
+                message: "Uses createSign/createVerify, typically RSA, ECDSA or DSA — all forgeable by a quantum attacker.",
+                remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+            }, m);
+        });
+        // One-shot crypto.sign(algorithm, data, key) / crypto.verify(...) (Node ≥ 12).
+        eachMatch(RE_ONESHOT_SIGN_VERIFY, content, (m) => {
+            push({
+                ruleId: "node-crypto-sign-oneshot",
+                title: "Classical one-shot signature (crypto.sign/verify)",
+                category: "signature",
+                severity: "high",
+                confidence: "medium",
+                algorithm: "unknown",
+                hndl: false,
+                cwe: CWE_BROKEN_CRYPTO,
+                message: "Uses the one-shot crypto.sign/crypto.verify API, typically RSA/ECDSA/EdDSA — forgeable by a quantum attacker.",
+                remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+            }, m);
+        });
+        // createDiffieHellman / createDiffieHellmanGroup — finite-field DH key exchange.
+        eachMatch(RE_CREATE_DH, content, (m) => {
+            push({
+                ruleId: "node-crypto-dh",
+                title: "Diffie-Hellman key exchange",
+                category: "key-exchange",
+                severity: "high",
+                confidence: "high",
+                algorithm: "DH",
+                hndl: true,
+                cwe: CWE_BROKEN_CRYPTO,
+                message: "Finite-field Diffie-Hellman is broken by Shor's algorithm (harvest-now-decrypt-later).",
+            }, m);
+        });
+        // getDiffieHellman('modpN') — named built-in finite-field MODP groups.
+        eachMatch(RE_GET_DH, content, (m) => {
+            push({
+                ruleId: "node-crypto-dh-modp",
+                title: `Diffie-Hellman MODP group (${m[1]})`,
+                category: "key-exchange",
+                severity: "high",
+                confidence: "high",
+                algorithm: "DH",
+                hndl: true,
+                cwe: CWE_BROKEN_CRYPTO,
+                message: `Named finite-field DH MODP group "${m[1]}" is broken by Shor's algorithm (harvest-now-decrypt-later).`,
+            }, m);
+        });
+        // createECDH — elliptic-curve Diffie-Hellman key exchange.
+        eachMatch(RE_CREATE_ECDH, content, (m) => {
+            push({
+                ruleId: "node-crypto-ecdh",
+                title: "ECDH key exchange",
+                category: "key-exchange",
+                severity: "high",
+                confidence: "high",
+                algorithm: "ECDH",
+                hndl: true,
+                cwe: CWE_BROKEN_CRYPTO,
+                message: "Elliptic-curve Diffie-Hellman is broken by Shor's algorithm (harvest-now-decrypt-later).",
+            }, m);
+        });
+        // publicEncrypt / privateDecrypt — RSA encryption (KEM-like confidentiality).
+        eachMatch(RE_RSA_ENCRYPT, content, (m) => {
+            push({
+                ruleId: "node-crypto-rsa-encrypt",
+                title: "RSA public-key encryption",
+                category: "kem",
+                severity: "high",
+                confidence: "high",
+                algorithm: "RSA",
+                hndl: true,
+                cwe: CWE_BROKEN_CRYPTO,
+                message: "RSA public-key encryption is broken by Shor's algorithm and exposed to harvest-now-decrypt-later.",
+            }, m);
+        });
+        // diffieHellman({ privateKey, publicKey }) — KeyObject-based DH/ECDH.
+        eachMatch(RE_DH_KEYOBJECT, content, (m) => {
+            push({
+                ruleId: "node-crypto-dh-keyobject",
+                title: "Diffie-Hellman (KeyObject) key exchange",
+                category: "key-exchange",
+                severity: "high",
+                confidence: "high",
+                algorithm: "ECDH",
+                hndl: true,
+                cwe: CWE_BROKEN_CRYPTO,
+                message: "crypto.diffieHellman() performs a classical (EC)DH agreement (harvest-now-decrypt-later).",
+            }, m);
+        });
+        return findings;
+    },
+};
+/* -------------------------------------------------------------------------- */
+/* WebCrypto (SubtleCrypto)                                                    */
+/* -------------------------------------------------------------------------- */
+/**
+ * Detects classical algorithms passed to WebCrypto's SubtleCrypto methods. The
+ * algorithm name can appear as a bare string ("RSA-OAEP") or as
+ * `{ name: "ECDH" }`; we scan both forms within a window after a subtle call.
+ */
+const webCryptoDetector = {
+    id: "webcrypto",
+    description: "Classical asymmetric algorithms via WebCrypto SubtleCrypto",
+    scope: "source",
+    language: "js",
+    appliesTo: (f) => hasExtension(f, JS_TS_EXTENSIONS),
+    detect({ file, content }) {
+        const findings = [];
+        // Only consider names that appear near a subtle.* call to reduce noise.
+        // callIndexes is collected in ascending order (regex scans left→right), so
+        // proximity is resolved with a binary search instead of an O(M·C) scan.
+        const callIndexes = [];
+        eachMatch(RE_SUBTLE_CALL, content, (m) => callIndexes.push(m.index));
+        if (callIndexes.length === 0)
+            return findings;
+        eachMatch(RE_WEBCRYPTO_ALGO, content, (m) => {
+            if (!nearSortedCall(callIndexes, m.index, 400))
+                return;
+            const name = m[1].toUpperCase();
+            const isKem = name === "RSA-OAEP";
+            const isEcdh = name === "ECDH";
+            const algorithm = name.startsWith("RSA")
+                ? "RSA"
+                : isEcdh
+                    ? "ECDH"
+                    : "ECDSA";
+            const category = isEcdh ? "key-exchange" : isKem ? "kem" : "signature";
+            const hndl = isKem || isEcdh;
+            findings.push(makeFinding({
+                ruleId: "webcrypto-classical",
+                title: `WebCrypto ${m[1]}`,
+                category,
+                severity: "high",
+                confidence: "high",
+                algorithm,
+                hndl,
+                cwe: CWE_BROKEN_CRYPTO,
+                message: `WebCrypto algorithm "${m[1]}" is classical asymmetric crypto and not quantum-safe.`,
+                file,
+                content,
+                index: m.index,
+                matchLength: m[0].length,
+            }));
+        });
+        return findings;
+    },
+};
+/* -------------------------------------------------------------------------- */
+/* Popular crypto libraries                                                    */
+/* -------------------------------------------------------------------------- */
+/** Detects classical crypto from popular npm libraries used in source. */
+const libraryDetector = {
+    id: "crypto-libs",
+    description: "Classical asymmetric crypto via node-forge, elliptic, jsrsasign, node-rsa",
+    scope: "source",
+    language: "js",
+    appliesTo: (f) => hasExtension(f, JS_TS_EXTENSIONS),
+    detect({ file, content }) {
+        const findings = [];
+        const add = (re, spec) => eachMatch(re, content, (m) => findings.push(makeFinding({ ...spec, file, content, index: m.index, matchLength: m[0].length })));
+        // node-forge: pki.rsa.generateKeyPair(...)
+        add(RE_FORGE_RSA, {
+            ruleId: "forge-rsa-keygen",
+            title: "node-forge RSA key generation",
+            category: "kem",
+            severity: "high",
+            confidence: "high",
+            algorithm: "RSA",
+            hndl: true,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: "node-forge generates a classical RSA key pair, which is not quantum-safe.",
+        });
+        // node-forge: forge.ed25519.* (classical EdDSA)
+        add(RE_FORGE_ED25519, {
+            ruleId: "forge-ed25519",
+            title: "node-forge Ed25519 usage",
+            category: "signature",
+            severity: "low",
+            confidence: "high",
+            algorithm: "EdDSA",
+            hndl: false,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: "node-forge Ed25519 is a modern but still classical signature scheme.",
+        });
+        // elliptic: new EC('secp256k1') / new ec(...)
+        add(RE_ELLIPTIC_EC, {
+            ruleId: "elliptic-ec",
+            title: "elliptic curve instantiation",
+            category: "signature",
+            severity: "high",
+            confidence: "high",
+            algorithm: "ECDSA",
+            hndl: false,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: "The `elliptic` library implements classical ECDSA/ECDH, both broken by Shor's algorithm.",
+        });
+        // Direct secp256k1 API usage: secp.sign / getPublicKey / getSharedSecret.
+        add(RE_SECP256K1, {
+            ruleId: "secp256k1-usage",
+            title: "secp256k1 ECDSA/ECDH usage",
+            category: "signature",
+            severity: "high",
+            confidence: "medium",
+            algorithm: "ECDSA",
+            hndl: false,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: "Direct secp256k1 usage (ECDSA signatures / ECDH agreement) is classical and broken by Shor's algorithm.",
+            remediation: "ML-DSA-65 (FIPS 204) for signatures; hybrid X25519MLKEM768 for key agreement.",
+        });
+        // jsrsasign: KEYUTIL.generateKeypair('RSA'|'EC', ...) or KJUR.crypto.*
+        add(RE_JSRSASIGN_KEYGEN, {
+            ruleId: "jsrsasign-keygen",
+            title: "jsrsasign key generation",
+            category: "signature",
+            severity: "high",
+            confidence: "high",
+            algorithm: "unknown",
+            hndl: false,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: "jsrsasign generates classical RSA/EC key pairs, which are not quantum-safe.",
+            remediation: "ML-KEM-768 (FIPS 203) / ML-DSA-65 (FIPS 204)",
+        });
+        add(RE_JSRSASIGN_SIGN, {
+            ruleId: "jsrsasign-sign",
+            title: "jsrsasign signature",
+            category: "signature",
+            severity: "high",
+            confidence: "high",
+            algorithm: "unknown",
+            hndl: false,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: "jsrsasign signing uses classical RSA/ECDSA signatures, forgeable by a quantum attacker.",
+            remediation: "ML-DSA-65 (FIPS 204)",
+        });
+        // node-rsa: new NodeRSA(...)
+        add(RE_NODE_RSA, {
+            ruleId: "node-rsa",
+            title: "node-rsa key/usage",
+            category: "kem",
+            severity: "high",
+            confidence: "high",
+            algorithm: "RSA",
+            hndl: true,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: "node-rsa wraps classical RSA encryption/signing, which is not quantum-safe.",
+        });
+        return findings;
+    },
+};
+/* -------------------------------------------------------------------------- */
+/* JWT / JOSE / COSE algorithm strings                                         */
+/* -------------------------------------------------------------------------- */
+/**
+ * Detects classical signature algorithm identifiers used by JWT/JOSE, plus
+ * ECDH-ES key-agreement identifiers (HNDL-exposed). These appear as string
+ * literals: `alg: "RS256"`, `algorithms: ["ES256"]`, `enc: "ECDH-ES+A256KW"`.
+ */
+const jwtDetector = {
+    id: "jwt-jose",
+    description: "Classical JWT/JOSE algorithms (RS/PS/ES/EdDSA) and ECDH-ES key agreement",
+    scope: "source",
+    language: "js",
+    appliesTo: (f) => hasExtension(f, JS_TS_EXTENSIONS),
+    detect({ file, content }) {
+        const findings = [];
+        // Classical JWS signature alg tokens. Anchored to quotes to avoid words.
+        eachMatch(RE_JWT_ALG, content, (m) => {
+            const alg = m[1];
+            let algorithm;
+            if (alg.startsWith("RS") || alg.startsWith("PS"))
+                algorithm = "RSA";
+            else if (alg === "EdDSA")
+                algorithm = "EdDSA";
+            else
+                algorithm = "ECDSA"; // ES*
+            findings.push(makeFinding({
+                ruleId: "jwt-classical-alg",
+                title: `JWT/JOSE algorithm ${alg}`,
+                category: "signature",
+                severity: "high",
+                confidence: "medium",
+                algorithm,
+                hndl: false,
+                cwe: CWE_BROKEN_CRYPTO,
+                message: `JWT/JOSE algorithm "${alg}" is a classical signature, forgeable by a quantum attacker.`,
+                remediation: "ML-DSA-65 (FIPS 204); track IETF PQC JOSE/COSE algorithms",
+                file,
+                content,
+                index: m.index,
+                matchLength: m[0].length,
+            }));
+        });
+        // JOSE ECDH-ES key agreement (and ECDH-ES+A*KW) — confidentiality, HNDL.
+        eachMatch(RE_JOSE_ECDH, content, (m) => {
+            findings.push(makeFinding({
+                ruleId: "jose-ecdh-es",
+                title: `JOSE key agreement ${m[1]}`,
+                category: "key-exchange",
+                severity: "high",
+                confidence: "medium",
+                algorithm: "ECDH",
+                hndl: true,
+                cwe: CWE_BROKEN_CRYPTO,
+                message: `JOSE "${m[1]}" performs classical ECDH key agreement — harvest-now-decrypt-later exposed.`,
+                remediation: "Track IETF PQC JOSE/COSE; adopt hybrid X25519MLKEM768 KEM-based encryption.",
+                file,
+                content,
+                index: m.index,
+                matchLength: m[0].length,
+            }));
+        });
+        return findings;
+    },
+};
+/* -------------------------------------------------------------------------- */
+/* TLS legacy configuration                                                    */
+/* -------------------------------------------------------------------------- */
+/**
+ * Detects legacy / insecure TLS configuration expressed as JS object literals:
+ * forced TLS 1.0/1.1, disabled certificate verification, and weak ciphers.
+ * These aren't quantum-specific but materially weaken transport security and
+ * are squarely in qScan's "config" scope.
+ */
+const tlsDetector = {
+    id: "tls-config",
+    description: "Legacy / insecure TLS configuration in JS objects",
+    scope: "config",
+    language: "js",
+    appliesTo: (f) => hasExtension(f, JS_TS_EXTENSIONS),
+    detect({ file, content }) {
+        const findings = [];
+        // minVersion / maxVersion / secureProtocol pinned to TLS 1.0 or 1.1.
+        eachMatch(RE_TLS_LEGACY_VERSION, content, (m) => {
+            findings.push(makeFinding({
+                ruleId: "tls-legacy-version",
+                title: "Legacy TLS version pinned",
+                category: "tls",
+                severity: "medium",
+                confidence: "high",
+                hndl: false,
+                cwe: CWE_WEAK_STRENGTH,
+                message: "TLS 1.0/1.1 are deprecated and insecure; require TLS 1.3.",
+                remediation: "Set minVersion: 'TLSv1.3' and prefer PQC-hybrid key exchange.",
+                file,
+                content,
+                index: m.index,
+                matchLength: m[0].length,
+            }));
+        });
+        // rejectUnauthorized: false — disables certificate verification.
+        eachMatch(RE_TLS_REJECT, content, (m) => {
+            findings.push(makeFinding({
+                ruleId: "tls-reject-unauthorized",
+                title: "TLS certificate verification disabled",
+                category: "tls",
+                severity: "high",
+                confidence: "high",
+                hndl: false,
+                cwe: CWE_CERT_VALIDATION,
+                message: "rejectUnauthorized:false disables TLS certificate verification (MITM risk).",
+                remediation: "Remove rejectUnauthorized:false; verify certificates properly.",
+                file,
+                content,
+                index: m.index,
+                matchLength: m[0].length,
+            }));
+        });
+        // Weak / export ciphers referenced in a ciphers string (bounded regex).
+        eachMatch(RE_TLS_WEAK_CIPHER, content, (m) => {
+            findings.push(makeFinding({
+                ruleId: "tls-weak-cipher",
+                title: "Weak TLS cipher configured",
+                category: "tls",
+                severity: "medium",
+                confidence: "medium",
+                hndl: false,
+                cwe: CWE_WEAK_STRENGTH,
+                message: `Weak cipher (${m[1]}) configured in the TLS ciphers list.`,
+                remediation: "Use a modern AEAD cipher suite (TLS 1.3 defaults).",
+                file,
+                content,
+                index: m.index,
+                matchLength: m[0].length,
+            }));
+        });
+        return findings;
+    },
+};
+/* -------------------------------------------------------------------------- */
+/* SSH public keys + TLS certificate signature algorithms (config scope)       */
+/* -------------------------------------------------------------------------- */
+const RE_SSH_PUBKEY = /\b(ssh-rsa|ssh-ed25519|ssh-dss|ecdsa-sha2-nistp(?:256|384|521))\b/g;
+const RE_CERT_SIG_ALG = /\b(sha(?:1|256|384|512)WithRSAEncryption|ecdsa-with-SHA(?:1|256|384|512)|rsassaPss|dsaWithSHA(?:1|256))\b/g;
+/**
+ * Detects classical SSH public keys (`authorized_keys` / `known_hosts` lines)
+ * and X.509 certificate signature-algorithm identifiers in any text file. These
+ * are language-agnostic config surfaces — the SSH-key forgery surface and the
+ * PKI signature surface that lexical PEM detection misses.
+ */
+const sshCertDetector = {
+    id: "ssh-cert",
+    description: "SSH public keys and TLS/X.509 certificate signature algorithms in config",
+    scope: "config",
+    language: "any",
+    appliesTo: () => true,
+    detect({ file, content }) {
+        const findings = [];
+        // SSH public keys: ssh-rsa AAAA…, ecdsa-sha2-nistp256 …, ssh-ed25519 …
+        eachMatch(RE_SSH_PUBKEY, content, (m) => {
+            const tok = m[1];
+            const algorithm = tok.startsWith("ssh-rsa")
+                ? "RSA"
+                : tok === "ssh-ed25519"
+                    ? "EdDSA"
+                    : tok === "ssh-dss"
+                        ? "DSA"
+                        : "ECDSA";
+            findings.push(makeFinding({
+                ruleId: "ssh-public-key",
+                title: `Classical SSH public key (${tok})`,
+                category: "certificate",
+                severity: "low",
+                confidence: "medium",
+                algorithm,
+                hndl: false,
+                cwe: CWE_BROKEN_CRYPTO,
+                message: `SSH public key type "${tok}" is a classical key forgeable by a quantum attacker.`,
+                remediation: "Plan migration to PQC-capable SSH (e.g. sntrup761x25519 KEX, PQC host keys).",
+                file,
+                content,
+                index: m.index,
+                matchLength: m[0].length,
+            }));
+        });
+        // X.509 / TLS certificate signature algorithm identifiers (forgery surface).
+        eachMatch(RE_CERT_SIG_ALG, content, (m) => {
+            const tok = m[1];
+            const algorithm = /RSA|rsassa/i.test(tok)
+                ? "RSA"
+                : tok.startsWith("ecdsa")
+                    ? "ECDSA"
+                    : "DSA";
+            findings.push(makeFinding({
+                ruleId: "cert-signature-algorithm",
+                title: `Classical certificate signature algorithm (${tok})`,
+                category: "certificate",
+                severity: "low",
+                confidence: "medium",
+                algorithm,
+                hndl: false,
+                cwe: CWE_BROKEN_CRYPTO,
+                message: `Certificate signature algorithm "${tok}" is classical (RSA/ECDSA/DSA) — a quantum forgery surface.`,
+                remediation: "Plan re-issuance with PQC-capable CAs as ML-DSA certificate profiles mature.",
+                file,
+                content,
+                index: m.index,
+                matchLength: m[0].length,
+            }));
+        });
+        return findings;
+    },
+};
+/** All built-in source/config detectors, in run order. */
+export const sourceDetectors = [
+    nodeCryptoDetector,
+    webCryptoDetector,
+    libraryDetector,
+    jwtDetector,
+    tlsDetector,
+    sshCertDetector,
+];
+//# sourceMappingURL=source.js.map

package/dist/detectors/source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source.js","sourceRoot":"","sources":["../../src/detectors/source.ts"],"names":[],"mappings":"AAsBA,OAAO,EACL,gBAAgB,EAChB,SAAS,EACT,YAAY,EACZ,WAAW,EACX,cAAc,GACf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEtF,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,MAAM,mBAAmB,GACvB,sFAAsF,CAAC;AACzF,MAAM,qBAAqB,GAAG,6BAA6B,CAAC;AAC5D,4EAA4E;AAC5E,+EAA+E;AAC/E,yCAAyC;AACzC,MAAM,sBAAsB,GAC1B,sEAAsE,CAAC;AACzE,MAAM,YAAY,GAAG,qCAAqC,CAAC;AAC3D,MAAM,SAAS,GAAG,mDAAmD,CAAC;AACtE,MAAM,cAAc,GAAG,kBAAkB,CAAC;AAC1C,MAAM,cAAc,GAAG,qDAAqD,CAAC;AAC7E,MAAM,eAAe,GAAG,uCAAuC,CAAC;AAEhE,aAAa;AACb,MAAM,iBAAiB,GAAG,uDAAuD,CAAC;AAClF,MAAM,cAAc,GAClB,0HAA0H,CAAC;AAE7H,aAAa;AACb,MAAM,YAAY,GAAG,iCAAiC,CAAC;AACvD,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAC7C,MAAM,cAAc,GAAG,gCAAgC,CAAC;AACxD,MAAM,mBAAmB,GAAG,gCAAgC,CAAC;AAC7D,MAAM,iBAAiB,GAAG,sCAAsC,CAAC;AACjE,MAAM,WAAW,GAAG,qBAAqB,CAAC;AAC1C,6EAA6E;AAC7E,MAAM,YAAY,GAChB,2GAA2G,CAAC;AAE9G,YAAY;AACZ,MAAM,UAAU,GAAG,+EAA+E,CAAC;AACnG,oEAAoE;AACpE,MAAM,YAAY,GAAG,+CAA+C,CAAC;AAErE,cAAc;AACd,MAAM,qBAAqB,GACzB,6GAA6G,CAAC;AAChH,MAAM,aAAa,GAAG,iCAAiC,CAAC;AACxD,8EAA8E;AAC9E,iFAAiF;AACjF,0EAA0E;AAC1E,MAAM,kBAAkB,GACtB,0GAA0G,CAAC;AAE7G,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,+EAA+E;AAC/E,MAAM,kBAAkB,GAAa;IACnC,EAAE,EAAE,aAAa;IACjB,WAAW,EAAE,6DAA6D;IAC1E,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,IAAI;IACd,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,gBAAgB,CAAC;IACnD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,CACX,IAA2F,EAC3F,CAAkB,EAClB,EAAE,CACF,QAAQ,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAClF,CAAC;QAEJ,iFAAiF;QACjF,SAAS,CAAC,mBAAmB,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YAC5C,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YAChC,MAAM,GAAG,GAWL;gBACF,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE;gBACvE,mEAAmE;gBACnE,uEAAuE;gBACvE,qEAAqE;gBACrE,EAAE,EAAE;oBACF,IAAI,EAAE,MAAM;oBACZ,GAAG,EAAE,cAAc;oBACnB,GAAG,EAAE,MAAM;oBACX,IAAI,EAAE,IAAI;oBACV,KAAK,EAAE,iBAAiB;oBACxB,OAAO,EACL,wEAAwE;wBACxE,6EAA6E;oBAC/E,WAAW,EACT,8FAA8F;iBACjG;gBACD,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE;gBAC9E,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,gBAAgB,EAAE;gBACzF,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE;gBACxF,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE;gBAClF,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE;gBACvF,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE;aACpF,CAAC;YACF,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;YACvB,IAAI,CACF;gBACE,MAAM,EAAE,oBAAoB;gBAC5B,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,iBAAiB;gBACrC,QAAQ,EAAE,IAAI,CAAC,GAAG;gBAClB,QAAQ,EAAE,IAAI,CAAC,GAAG;gBAClB,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,IAAI,CAAC,IAAI;gBACpB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,GAAG,EAAE,iBAAiB;gBACtB,OAAO,EACL,IAAI,CAAC,OAAO;oBACZ,yBAAyB,IAAI,CAAC,KAAK,uCAAuC;gBAC5E,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,EACD,CAAC,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,4DAA4D;QAC5D,SAAS,CAAC,qBAAqB,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YAC9C,IAAI,CACF;gBACE,MAAM,EAAE,kBAAkB;gBAC1B,KAAK,EAAE,+CAA+C;gBACtD,QAAQ,EAAE,WAAW;gBACrB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,QAAQ;gBACpB,SAAS,EAAE,SAAS;gBACpB,IAAI,EAAE,KAAK;gBACX,GAAG,EAAE,iBAAiB;gBACtB,OAAO,EACL,kGAAkG;gBACpG,WAAW,EAAE,4CAA4C;aAC1D,EACD,CAAC,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,+EAA+E;QAC/E,SAAS,CAAC,sBAAsB,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YAC/C,IAAI,CACF;gBACE,MAAM,EAAE,0BAA0B;gBAClC,KAAK,EAAE,mDAAmD;gBAC1D,QAAQ,EAAE,WAAW;gBACrB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,QAAQ;gBACpB,SAAS,EAAE,SAAS;gBACpB,IAAI,EAAE,KAAK;gBACX,GAAG,EAAE,iBAAiB;gBACtB,OAAO,EACL,+GAA+G;gBACjH,WAAW,EAAE,4CAA4C;aAC1D,EACD,CAAC,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,iFAAiF;QACjF,SAAS,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACrC,IAAI,CACF;gBACE,MAAM,EAAE,gBAAgB;gBACxB,KAAK,EAAE,6BAA6B;gBACpC,QAAQ,EAAE,cAAc;gBACxB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,IAAI;gBACf,IAAI,EAAE,IAAI;gBACV,GAAG,EAAE,iBAAiB;gBACtB,OAAO,EACL,wFAAwF;aAC3F,EACD,CAAC,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,uEAAuE;QACvE,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YAClC,IAAI,CACF;gBACE,MAAM,EAAE,qBAAqB;gBAC7B,KAAK,EAAE,8BAA8B,CAAC,CAAC,CAAC,CAAC,GAAG;gBAC5C,QAAQ,EAAE,cAAc;gBACxB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,IAAI;gBACf,IAAI,EAAE,IAAI;gBACV,GAAG,EAAE,iBAAiB;gBACtB,OAAO,EAAE,qCAAqC,CAAC,CAAC,CAAC,CAAC,8DAA8D;aACjH,EACD,CAAC,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,2DAA2D;QAC3D,SAAS,CAAC,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACvC,IAAI,CACF;gBACE,MAAM,EAAE,kBAAkB;gBAC1B,KAAK,EAAE,mBAAmB;gBAC1B,QAAQ,EAAE,cAAc;gBACxB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,MAAM;gBACjB,IAAI,EAAE,IAAI;gBACV,GAAG,EAAE,iBAAiB;gBACtB,OAAO,EACL,0FAA0F;aAC7F,EACD,CAAC,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,8EAA8E;QAC9E,SAAS,CAAC,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACvC,IAAI,CACF;gBACE,MAAM,EAAE,yBAAyB;gBACjC,KAAK,EAAE,2BAA2B;gBAClC,QAAQ,EAAE,KAAK;gBACf,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,KAAK;gBAChB,IAAI,EAAE,IAAI;gBACV,GAAG,EAAE,iBAAiB;gBACtB,OAAO,EACL,mGAAmG;aACtG,EACD,CAAC,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,sEAAsE;QACtE,SAAS,CAAC,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACxC,IAAI,CACF;gBACE,MAAM,EAAE,0BAA0B;gBAClC,KAAK,EAAE,yCAAyC;gBAChD,QAAQ,EAAE,cAAc;gBACxB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,MAAM;gBACjB,IAAI,EAAE,IAAI;gBACV,GAAG,EAAE,iBAAiB;gBACtB,OAAO,EACL,2FAA2F;aAC9F,EACD,CAAC,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,iBAAiB,GAAa;IAClC,EAAE,EAAE,WAAW;IACf,WAAW,EAAE,4DAA4D;IACzE,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,IAAI;IACd,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,gBAAgB,CAAC;IACnD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,wEAAwE;QACxE,2EAA2E;QAC3E,wEAAwE;QACxE,MAAM,WAAW,GAAa,EAAE,CAAC;QACjC,SAAS,CAAC,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QAE9C,SAAS,CAAC,iBAAiB,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YAC1C,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC;gBAAE,OAAO;YACvD,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,IAAI,KAAK,UAAU,CAAC;YAClC,MAAM,MAAM,GAAG,IAAI,KAAK,MAAM,CAAC;YAC/B,MAAM,SAAS,GAAyB,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;gBAC5D,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,MAAM;oBACN,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,OAAO,CAAC;YACd,MAAM,QAAQ,GAAwB,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC;YAC5F,MAAM,IAAI,GAAG,KAAK,IAAI,MAAM,CAAC;YAC7B,QAAQ,CAAC,IAAI,CACX,WAAW,CAAC;gBACV,MAAM,EAAE,qBAAqB;gBAC7B,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC1B,QAAQ;gBACR,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,MAAM;gBAClB,SAAS;gBACT,IAAI;gBACJ,GAAG,EAAE,iBAAiB;gBACtB,OAAO,EAAE,wBAAwB,CAAC,CAAC,CAAC,CAAC,wDAAwD;gBAC7F,IAAI;gBACJ,OAAO;gBACP,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;aACzB,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAEhF,0EAA0E;AAC1E,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,aAAa;IACjB,WAAW,EAAE,2EAA2E;IACxF,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,IAAI;IACd,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,gBAAgB,CAAC;IACnD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,CACV,EAAU,EACV,IAA2F,EAC3F,EAAE,CACF,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAC3B,QAAQ,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAClF,CACF,CAAC;QAEJ,2CAA2C;QAC3C,GAAG,CAAC,YAAY,EAAE;YAChB,MAAM,EAAE,kBAAkB;YAC1B,KAAK,EAAE,+BAA+B;YACtC,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,OAAO,EAAE,2EAA2E;SACrF,CAAC,CAAC;QAEH,gDAAgD;QAChD,GAAG,CAAC,gBAAgB,EAAE;YACpB,MAAM,EAAE,eAAe;YACvB,KAAK,EAAE,0BAA0B;YACjC,QAAQ,EAAE,WAAW;YACrB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,OAAO;YAClB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,OAAO,EAAE,sEAAsE;SAChF,CAAC,CAAC;QAEH,8CAA8C;QAC9C,GAAG,CAAC,cAAc,EAAE;YAClB,MAAM,EAAE,aAAa;YACrB,KAAK,EAAE,8BAA8B;YACrC,QAAQ,EAAE,WAAW;YACrB,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,OAAO;YAClB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,0FAA0F;SAC7F,CAAC,CAAC;QAEH,0EAA0E;QAC1E,GAAG,CAAC,YAAY,EAAE;YAChB,MAAM,EAAE,iBAAiB;YACzB,KAAK,EAAE,4BAA4B;YACnC,QAAQ,EAAE,WAAW;YACrB,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,QAAQ;YACpB,SAAS,EAAE,OAAO;YAClB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,yGAAyG;YAC3G,WAAW,EAAE,+EAA+E;SAC7F,CAAC,CAAC;QAEH,uEAAuE;QACvE,GAAG,CAAC,mBAAmB,EAAE;YACvB,MAAM,EAAE,kBAAkB;YAC1B,KAAK,EAAE,0BAA0B;YACjC,QAAQ,EAAE,WAAW;YACrB,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,OAAO,EAAE,6EAA6E;YACtF,WAAW,EAAE,8CAA8C;SAC5D,CAAC,CAAC;QACH,GAAG,CAAC,iBAAiB,EAAE;YACrB,MAAM,EAAE,gBAAgB;YACxB,KAAK,EAAE,qBAAqB;YAC5B,QAAQ,EAAE,WAAW;YACrB,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,yFAAyF;YAC3F,WAAW,EAAE,sBAAsB;SACpC,CAAC,CAAC;QAEH,6BAA6B;QAC7B,GAAG,CAAC,WAAW,EAAE;YACf,MAAM,EAAE,UAAU;YAClB,KAAK,EAAE,oBAAoB;YAC3B,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,OAAO,EAAE,6EAA6E;SACvF,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,WAAW,GAAa;IAC5B,EAAE,EAAE,UAAU;IACd,WAAW,EAAE,0EAA0E;IACvF,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,IAAI;IACd,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,gBAAgB,CAAC;IACnD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,yEAAyE;QACzE,SAAS,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACnC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACjB,IAAI,SAA+B,CAAC;YACpC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,SAAS,GAAG,KAAK,CAAC;iBAC/D,IAAI,GAAG,KAAK,OAAO;gBAAE,SAAS,GAAG,OAAO,CAAC;;gBACzC,SAAS,GAAG,OAAO,CAAC,CAAC,MAAM;YAChC,QAAQ,CAAC,IAAI,CACX,WAAW,CAAC;gBACV,MAAM,EAAE,mBAAmB;gBAC3B,KAAK,EAAE,sBAAsB,GAAG,EAAE;gBAClC,QAAQ,EAAE,WAAW;gBACrB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,QAAQ;gBACpB,SAAS;gBACT,IAAI,EAAE,KAAK;gBACX,GAAG,EAAE,iBAAiB;gBACtB,OAAO,EAAE,uBAAuB,GAAG,8DAA8D;gBACjG,WAAW,EAAE,2DAA2D;gBACxE,IAAI;gBACJ,OAAO;gBACP,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;aACzB,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,yEAAyE;QACzE,SAAS,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACrC,QAAQ,CAAC,IAAI,CACX,WAAW,CAAC;gBACV,MAAM,EAAE,cAAc;gBACtB,KAAK,EAAE,sBAAsB,CAAC,CAAC,CAAC,CAAC,EAAE;gBACnC,QAAQ,EAAE,cAAc;gBACxB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,QAAQ;gBACpB,SAAS,EAAE,MAAM;gBACjB,IAAI,EAAE,IAAI;gBACV,GAAG,EAAE,iBAAiB;gBACtB,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,8EAA8E;gBACpG,WAAW,EACT,6EAA6E;gBAC/E,IAAI;gBACJ,OAAO;gBACP,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;aACzB,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,WAAW,GAAa;IAC5B,EAAE,EAAE,YAAY;IAChB,WAAW,EAAE,mDAAmD;IAChE,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,IAAI;IACd,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,gBAAgB,CAAC;IACnD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,qEAAqE;QACrE,SAAS,CAAC,qBAAqB,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YAC9C,QAAQ,CAAC,IAAI,CACX,WAAW,CAAC;gBACV,MAAM,EAAE,oBAAoB;gBAC5B,KAAK,EAAE,2BAA2B;gBAClC,QAAQ,EAAE,KAAK;gBACf,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,MAAM;gBAClB,IAAI,EAAE,KAAK;gBACX,GAAG,EAAE,iBAAiB;gBACtB,OAAO,EAAE,2DAA2D;gBACpE,WAAW,EAAE,+DAA+D;gBAC5E,IAAI;gBACJ,OAAO;gBACP,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;aACzB,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,iEAAiE;QACjE,SAAS,CAAC,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACtC,QAAQ,CAAC,IAAI,CACX,WAAW,CAAC;gBACV,MAAM,EAAE,yBAAyB;gBACjC,KAAK,EAAE,uCAAuC;gBAC9C,QAAQ,EAAE,KAAK;gBACf,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,MAAM;gBAClB,IAAI,EAAE,KAAK;gBACX,GAAG,EAAE,mBAAmB;gBACxB,OAAO,EAAE,6EAA6E;gBACtF,WAAW,EAAE,gEAAgE;gBAC7E,IAAI;gBACJ,OAAO;gBACP,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;aACzB,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,wEAAwE;QACxE,SAAS,CAAC,kBAAkB,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YAC3C,QAAQ,CAAC,IAAI,CACX,WAAW,CAAC;gBACV,MAAM,EAAE,iBAAiB;gBACzB,KAAK,EAAE,4BAA4B;gBACnC,QAAQ,EAAE,KAAK;gBACf,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,QAAQ;gBACpB,IAAI,EAAE,KAAK;gBACX,GAAG,EAAE,iBAAiB;gBACtB,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,uCAAuC;gBACpE,WAAW,EAAE,oDAAoD;gBACjE,IAAI;gBACJ,OAAO;gBACP,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;aACzB,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAEhF,MAAM,aAAa,GAAG,oEAAoE,CAAC;AAC3F,MAAM,eAAe,GACnB,4GAA4G,CAAC;AAE/G;;;;;GAKG;AACH,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,UAAU;IACd,WAAW,EAAE,0EAA0E;IACvF,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,KAAK;IACf,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI;IACrB,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,uEAAuE;QACvE,SAAS,CAAC,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACtC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACjB,MAAM,SAAS,GAAyB,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;gBAC/D,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,GAAG,KAAK,aAAa;oBACrB,CAAC,CAAC,OAAO;oBACT,CAAC,CAAC,GAAG,KAAK,SAAS;wBACjB,CAAC,CAAC,KAAK;wBACP,CAAC,CAAC,OAAO,CAAC;YAChB,QAAQ,CAAC,IAAI,CACX,WAAW,CAAC;gBACV,MAAM,EAAE,gBAAgB;gBACxB,KAAK,EAAE,6BAA6B,GAAG,GAAG;gBAC1C,QAAQ,EAAE,aAAa;gBACvB,QAAQ,EAAE,KAAK;gBACf,UAAU,EAAE,QAAQ;gBACpB,SAAS;gBACT,IAAI,EAAE,KAAK;gBACX,GAAG,EAAE,iBAAiB;gBACtB,OAAO,EAAE,wBAAwB,GAAG,uDAAuD;gBAC3F,WAAW,EACT,8EAA8E;gBAChF,IAAI;gBACJ,OAAO;gBACP,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;aACzB,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,6EAA6E;QAC7E,SAAS,CAAC,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACxC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACjB,MAAM,SAAS,GAAyB,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;gBAC7D,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;oBACvB,CAAC,CAAC,OAAO;oBACT,CAAC,CAAC,KAAK,CAAC;YACZ,QAAQ,CAAC,IAAI,CACX,WAAW,CAAC;gBACV,MAAM,EAAE,0BAA0B;gBAClC,KAAK,EAAE,8CAA8C,GAAG,GAAG;gBAC3D,QAAQ,EAAE,aAAa;gBACvB,QAAQ,EAAE,KAAK;gBACf,UAAU,EAAE,QAAQ;gBACpB,SAAS;gBACT,IAAI,EAAE,KAAK;gBACX,GAAG,EAAE,iBAAiB;gBACtB,OAAO,EAAE,oCAAoC,GAAG,6DAA6D;gBAC7G,WAAW,EACT,8EAA8E;gBAChF,IAAI;gBACJ,OAAO;gBACP,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;aACzB,CAAC,CACH,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,0DAA0D;AAC1D,MAAM,CAAC,MAAM,eAAe,GAAe;IACzC,kBAAkB;IAClB,iBAAiB;IACjB,eAAe;IACf,WAAW;IACX,WAAW;IACX,eAAe;CAChB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,31 @@
+/**
+ * @quantakrypto/core — public API (LOCKED CONTRACT).
+ *
+ * The exported NAMES and SIGNATURES below are the stable contract that
+ * @quantakrypto/qscan, @quantakrypto/mcp and the GitHub Action depend on — do not change
+ * them without updating all consumers. The implementations live in focused
+ * modules under src/ and are re-exported here; the public surface is identical
+ * to the original stub file.
+ */
+export * from "./types.js";
+export { VERSION } from "./version.js";
+export type { SarifLog } from "./report.js";
+export { scan, detectors, detectFile, compareFindings } from "./scan.js";
+export { scanParallel, mergeChunkResults, chunkByBytes } from "./parallel.js";
+export type { ScanChunk, ChunkResult, SizedFile } from "./parallel.js";
+export { DetectorRegistry, defaultRegistry, detectorScope } from "./registry.js";
+export { fingerprintFinding, baselineFromFindings, applyBaseline, loadBaseline, saveBaseline, BASELINE_VERSION, } from "./baseline.js";
+export type { Baseline } from "./baseline.js";
+export { changedFiles } from "./changed.js";
+export { loadConfig, ConfigError, CONFIG_FILENAME } from "./config.js";
+export type { QuantakryptoFileConfig, LoadConfigResult } from "./config.js";
+export { walkFiles, isBinaryPath, isGeneratedPath, looksMinified } from "./walk.js";
+export { buildInventory } from "./inventory.js";
+export { vulnerableDependencies } from "./dependencies.js";
+export { toSarif, toJson, formatSummary } from "./report.js";
+export { toCbom } from "./cbom.js";
+export type { CycloneDxBom, CbomComponent } from "./cbom.js";
+export { remediationFor, remediationForTier, TIER_PARAMS, STATEFUL_HBS_NOTE, statefulHbsApplies, } from "./remediation.js";
+export type { SecurityTier } from "./remediation.js";
+export { CWE_BROKEN_CRYPTO, CWE_WEAK_STRENGTH, CWE_CERT_VALIDATION, CWE_HARDCODED_KEY, CWE_RISKY_PRIMITIVE, } from "./cwe.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,cAAc,YAAY,CAAC;AAG3B,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAGvC,YAAY,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAG5C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAGzE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC9E,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGvE,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAGjF,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAG9C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAG5C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,YAAY,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAG5E,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAGpF,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGhD,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAG3D,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAG7D,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACnC,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG7D,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,WAAW,EACX,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAGrD,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,UAAU,CAAC"}