@quantakrypto/core 0.1.0

package/dist/index.js

@@ -0,0 +1,39 @@
+/**
+ * @quantakrypto/core — public API (LOCKED CONTRACT).
+ *
+ * The exported NAMES and SIGNATURES below are the stable contract that
+ * @quantakrypto/qscan, @quantakrypto/mcp and the GitHub Action depend on — do not change
+ * them without updating all consumers. The implementations live in focused
+ * modules under src/ and are re-exported here; the public surface is identical
+ * to the original stub file.
+ */
+export * from "./types.js";
+// Tool version, surfaced in reports. Keep in sync with package.json.
+export { VERSION } from "./version.js";
+// Core orchestration + built-in detector set.
+export { scan, detectors, detectFile, compareFindings } from "./scan.js";
+// Parallel scanning (worker_threads pool) + pure merge/chunk helpers.
+export { scanParallel, mergeChunkResults, chunkByBytes } from "./parallel.js";
+// Detector registry (plugin point) + helpers.
+export { DetectorRegistry, defaultRegistry, detectorScope } from "./registry.js";
+// Canonical baseline (shared by qScan + the Action).
+export { fingerprintFinding, baselineFromFindings, applyBaseline, loadBaseline, saveBaseline, BASELINE_VERSION, } from "./baseline.js";
+// Incremental scanning: changed-files helper (git-aware, tolerant).
+export { changedFiles } from "./changed.js";
+// Optional `quantakrypto.config.json` loader (P2-9; see docs/CONFIG.md).
+export { loadConfig, ConfigError, CONFIG_FILENAME } from "./config.js";
+// Filesystem walker (relative POSIX paths, default ignores, size/binary filters).
+export { walkFiles, isBinaryPath, isGeneratedPath, looksMinified } from "./walk.js";
+// Inventory + readiness score.
+export { buildInventory } from "./inventory.js";
+// Vulnerable-dependency database (the manifest scanner is used internally by scan()).
+export { vulnerableDependencies } from "./dependencies.js";
+// Reporters.
+export { toSarif, toJson, formatSummary } from "./report.js";
+// CycloneDX 1.6 cryptographic bill of materials (CBOM) export.
+export { toCbom } from "./cbom.js";
+// Remediation lookup (family + tier-aware) and stateful-HBS guidance.
+export { remediationFor, remediationForTier, TIER_PARAMS, STATEFUL_HBS_NOTE, statefulHbsApplies, } from "./remediation.js";
+// CWE identifier constants.
+export { CWE_BROKEN_CRYPTO, CWE_WEAK_STRENGTH, CWE_CERT_VALIDATION, CWE_HARDCODED_KEY, CWE_RISKY_PRIMITIVE, } from "./cwe.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,cAAc,YAAY,CAAC;AAE3B,qEAAqE;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAKvC,8CAA8C;AAC9C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEzE,sEAAsE;AACtE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG9E,8CAA8C;AAC9C,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEjF,qDAAqD;AACrD,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAGvB,oEAAoE;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,yEAAyE;AACzE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAGvE,kFAAkF;AAClF,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAEpF,+BAA+B;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,sFAAsF;AACtF,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,aAAa;AACb,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE7D,+DAA+D;AAC/D,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAGnC,sEAAsE;AACtE,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,WAAW,EACX,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAG1B,4BAA4B;AAC5B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,UAAU,CAAC"}

package/dist/inventory.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Aggregates findings into a {@link CryptoInventory}: per-algorithm,
+ * per-category and per-severity counts, the harvest-now-decrypt-later count,
+ * and a 0–100 readiness score.
+ */
+import type { CryptoInventory, Finding } from "./types.js";
+/**
+ * Compute a 0–100 readiness score. Starts at 100 and subtracts severity-weighted
+ * penalties with diminishing returns per severity bucket. 100 means no classical
+ * asymmetric crypto was found; the score is clamped to [0, 100].
+ */
+export declare function readinessScore(findings: Finding[]): number;
+/** Build the full inventory (counts + HNDL + score) from a set of findings. */
+export declare function buildInventory(findings: Finding[]): CryptoInventory;
+//# sourceMappingURL=inventory.d.ts.map

package/dist/inventory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inventory.d.ts","sourceRoot":"","sources":["../src/inventory.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAEV,eAAe,EACf,OAAO,EAGR,MAAM,YAAY,CAAC;AAwBpB;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAkB1D;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,eAAe,CAgCnE"}

package/dist/inventory.js

@@ -0,0 +1,74 @@
+/** All severities, most → least severe (used to seed the counts record). */
+const SEVERITIES = ["critical", "high", "medium", "low", "info"];
+/** Base penalty applied to the readiness score for the first finding of a severity. */
+const SEVERITY_WEIGHT = {
+    critical: 30,
+    high: 18,
+    medium: 8,
+    low: 3,
+    info: 1,
+};
+/**
+ * Apply diminishing returns to repeated findings of the same severity: the Nth
+ * finding contributes `weight / sqrt(N)`. This keeps a single critical hit very
+ * impactful while a codebase with hundreds of medium findings doesn't underflow
+ * past zero on the first few — the score still saturates toward 0 sensibly.
+ */
+function penaltyFor(weight, occurrence) {
+    return weight / Math.sqrt(occurrence);
+}
+/**
+ * Compute a 0–100 readiness score. Starts at 100 and subtracts severity-weighted
+ * penalties with diminishing returns per severity bucket. 100 means no classical
+ * asymmetric crypto was found; the score is clamped to [0, 100].
+ */
+export function readinessScore(findings) {
+    if (findings.length === 0)
+        return 100;
+    const seen = {
+        critical: 0,
+        high: 0,
+        medium: 0,
+        low: 0,
+        info: 0,
+    };
+    let score = 100;
+    for (const f of findings) {
+        seen[f.severity] += 1;
+        score -= penaltyFor(SEVERITY_WEIGHT[f.severity], seen[f.severity]);
+    }
+    return Math.max(0, Math.min(100, Math.round(score)));
+}
+/** Build the full inventory (counts + HNDL + score) from a set of findings. */
+export function buildInventory(findings) {
+    const byAlgorithm = {};
+    const byCategory = {};
+    const bySeverity = {
+        critical: 0,
+        high: 0,
+        medium: 0,
+        low: 0,
+        info: 0,
+    };
+    let hndlCount = 0;
+    for (const f of findings) {
+        if (f.algorithm) {
+            byAlgorithm[f.algorithm] = (byAlgorithm[f.algorithm] ?? 0) + 1;
+        }
+        byCategory[f.category] = (byCategory[f.category] ?? 0) + 1;
+        bySeverity[f.severity] += 1;
+        if (f.hndl)
+            hndlCount += 1;
+    }
+    // Ensure all severities are present (seeded above to 0). SEVERITIES is the
+    // canonical ordering and guards against missing keys if the type changes.
+    void SEVERITIES;
+    return {
+        byAlgorithm,
+        byCategory,
+        bySeverity,
+        hndlCount,
+        readinessScore: readinessScore(findings),
+    };
+}
+//# sourceMappingURL=inventory.js.map

package/dist/inventory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inventory.js","sourceRoot":"","sources":["../src/inventory.ts"],"names":[],"mappings":"AAaA,4EAA4E;AAC5E,MAAM,UAAU,GAAe,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAE7E,uFAAuF;AACvF,MAAM,eAAe,GAA6B;IAChD,QAAQ,EAAE,EAAE;IACZ,IAAI,EAAE,EAAE;IACR,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;IACN,IAAI,EAAE,CAAC;CACR,CAAC;AAEF;;;;;GAKG;AACH,SAAS,UAAU,CAAC,MAAc,EAAE,UAAkB;IACpD,OAAO,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,QAAmB;IAChD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IAEtC,MAAM,IAAI,GAA6B;QACrC,QAAQ,EAAE,CAAC;QACX,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,CAAC;QACT,GAAG,EAAE,CAAC;QACN,IAAI,EAAE,CAAC;KACR,CAAC;IAEF,IAAI,KAAK,GAAG,GAAG,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtB,KAAK,IAAI,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAC,QAAmB;IAChD,MAAM,WAAW,GAA6C,EAAE,CAAC;IACjE,MAAM,UAAU,GAA6C,EAAE,CAAC;IAChE,MAAM,UAAU,GAA6B;QAC3C,QAAQ,EAAE,CAAC;QACX,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,CAAC;QACT,GAAG,EAAE,CAAC;QACN,IAAI,EAAE,CAAC;KACR,CAAC;IACF,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;YAChB,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACjE,CAAC;QACD,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3D,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,CAAC,IAAI;YAAE,SAAS,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,KAAK,UAAU,CAAC;IAEhB,OAAO;QACL,WAAW;QACX,UAAU;QACV,UAAU;QACV,SAAS;QACT,cAAc,EAAE,cAAc,CAAC,QAAQ,CAAC;KACzC,CAAC;AACJ,CAAC"}

package/dist/parallel.d.ts

@@ -0,0 +1,34 @@
+import type { Finding, ParallelScanOptions, ScanResult } from "./types.js";
+/** One unit of work dispatched to a worker. */
+export interface ScanChunk {
+    files: string[];
+}
+/** What a worker returns for a chunk. */
+export interface ChunkResult {
+    findings: Finding[];
+    filesScanned: number;
+}
+/** A file plus its byte size, used for byte-balanced chunking. */
+export interface SizedFile {
+    rel: string;
+    size: number;
+}
+/**
+ * Bucket files into chunks of roughly `chunkBytes` total bytes each, so one
+ * large file doesn't starve a worker holding many tiny files. Pure +
+ * deterministic: input order is preserved within and across chunks.
+ */
+export declare function chunkByBytes(files: readonly SizedFile[], chunkBytes: number): ScanChunk[];
+/**
+ * Merge per-chunk results into a single ordered finding set + total file count.
+ * Pure: applies the SAME comparator as the serial scan, so the result is
+ * byte-identical regardless of chunk completion order. Exported for unit tests.
+ */
+export declare function mergeChunkResults(results: readonly ChunkResult[]): ChunkResult;
+/**
+ * Scan in parallel across a worker-thread pool, falling back to the in-process
+ * serial {@link scan} for small workloads or when workers can't be used. The
+ * result is deterministic and identical to the serial path.
+ */
+export declare function scanParallel(options: ParallelScanOptions): Promise<ScanResult>;
+//# sourceMappingURL=parallel.d.ts.map

package/dist/parallel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parallel.d.ts","sourceRoot":"","sources":["../src/parallel.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAM3E,+CAA+C;AAC/C,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,yCAAyC;AACzC,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAMD,kEAAkE;AAClE,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,CAgBzF;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,GAAG,WAAW,CAS9E;AA2DD;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,UAAU,CAAC,CAkEpF"}

package/dist/parallel.js

@@ -0,0 +1,237 @@
+/**
+ * Parallel scanning over a worker-thread pool (P2-1). The scan is embarrassingly
+ * parallel: each file is read and regex-scanned independently, and the merge is
+ * a concatenation + the existing deterministic sort. `Finding` is plain
+ * structured-cloneable data, so it crosses the worker boundary cleanly.
+ *
+ * The merge and chunking logic are pure and exported for direct unit testing.
+ * `scanParallel` falls back to the in-process serial path below the crossover
+ * (small file counts / small total bytes) and whenever workers are unavailable.
+ */
+import { stat } from "node:fs/promises";
+import * as os from "node:os";
+import * as path from "node:path";
+import { fileURLToPath } from "node:url";
+import { walkFiles, toPosix } from "./walk.js";
+import { buildInventory } from "./inventory.js";
+import { compareFindings, scan } from "./scan.js";
+import { VERSION } from "./version.js";
+const DEFAULT_PARALLEL_THRESHOLD_BYTES = 2 * 1024 * 1024;
+const DEFAULT_PARALLEL_FILE_THRESHOLD = 200;
+const DEFAULT_CHUNK_BYTES = 4 * 1024 * 1024;
+/**
+ * Bucket files into chunks of roughly `chunkBytes` total bytes each, so one
+ * large file doesn't starve a worker holding many tiny files. Pure +
+ * deterministic: input order is preserved within and across chunks.
+ */
+export function chunkByBytes(files, chunkBytes) {
+    const limit = Math.max(1, chunkBytes);
+    const chunks = [];
+    let current = [];
+    let currentBytes = 0;
+    for (const f of files) {
+        if (current.length > 0 && currentBytes + f.size > limit) {
+            chunks.push({ files: current });
+            current = [];
+            currentBytes = 0;
+        }
+        current.push(f.rel);
+        currentBytes += f.size;
+    }
+    if (current.length > 0)
+        chunks.push({ files: current });
+    return chunks;
+}
+/**
+ * Merge per-chunk results into a single ordered finding set + total file count.
+ * Pure: applies the SAME comparator as the serial scan, so the result is
+ * byte-identical regardless of chunk completion order. Exported for unit tests.
+ */
+export function mergeChunkResults(results) {
+    const findings = [];
+    let filesScanned = 0;
+    for (const r of results) {
+        for (const f of r.findings)
+            findings.push(f);
+        filesScanned += r.filesScanned;
+    }
+    findings.sort(compareFindings);
+    return { findings, filesScanned };
+}
+/** Resolve the worker count (>= 1). */
+function resolveConcurrency(options) {
+    const raw = options.concurrency;
+    if (typeof raw === "number" && raw >= 1)
+        return Math.floor(raw);
+    const avail = typeof os.availableParallelism === "function" ? os.availableParallelism() : os.cpus().length;
+    return Math.max(1, avail);
+}
+/** Decide whether the workload is large enough to justify spawning workers. */
+function shouldParallelize(options, files) {
+    const totalBytes = files.reduce((acc, f) => acc + f.size, 0);
+    const byteFloor = options.parallelThresholdBytes ?? DEFAULT_PARALLEL_THRESHOLD_BYTES;
+    const fileFloor = options.parallelFileThreshold ?? DEFAULT_PARALLEL_FILE_THRESHOLD;
+    if (resolveConcurrency(options) <= 1)
+        return false;
+    return totalBytes >= byteFloor && files.length >= fileFloor;
+}
+/**
+ * Enumerate the files to scan (relative POSIX paths + sizes), honouring an
+ * explicit `files` list or the walker. Sizes power byte-balanced chunking.
+ */
+async function enumerateFiles(options, baseDir) {
+    const rels = [];
+    if (options.files) {
+        for (const f of options.files)
+            rels.push(toPosix(f));
+    }
+    else {
+        for await (const rel of walkFiles(options.root, {
+            include: options.include,
+            exclude: options.exclude,
+            noDefaultIgnores: options.noDefaultIgnores,
+            maxFileSize: options.maxFileSize,
+        })) {
+            rels.push(rel);
+        }
+    }
+    const sized = [];
+    for (const rel of rels) {
+        let size = 0;
+        try {
+            size = (await stat(path.join(baseDir, ...rel.split("/")))).size;
+        }
+        catch {
+            // Unreadable now; keep with size 0 — worker read will skip if it's gone.
+        }
+        sized.push({ rel, size });
+    }
+    return sized;
+}
+/** Resolve the built worker entry (dist/scan-worker.js) next to this module. */
+function workerEntryPath() {
+    // After build this file is dist/parallel.js and the worker is dist/scan-worker.js.
+    const here = fileURLToPath(import.meta.url);
+    return path.join(path.dirname(here), "scan-worker.js");
+}
+/**
+ * Scan in parallel across a worker-thread pool, falling back to the in-process
+ * serial {@link scan} for small workloads or when workers can't be used. The
+ * result is deterministic and identical to the serial path.
+ */
+export async function scanParallel(options) {
+    const startedAt = new Date();
+    const rootStat = await stat(options.root);
+    const baseDir = rootStat.isFile() ? path.dirname(options.root) : options.root;
+    // Single-file roots and the override-detectors path always run serially:
+    // detectors may not be structured-cloneable across the worker boundary.
+    if (rootStat.isFile() || options.detectors) {
+        return scan(options);
+    }
+    const files = await enumerateFiles(options, baseDir);
+    if (!shouldParallelize(options, files)) {
+        // In-process: reuse the exact serial path over the same file list.
+        return scan({ ...options, files: files.map((f) => f.rel) });
+    }
+    let WorkerCtor;
+    try {
+        ({ Worker: WorkerCtor } = await import("node:worker_threads"));
+    }
+    catch {
+        return scan({ ...options, files: files.map((f) => f.rel) });
+    }
+    const chunks = chunkByBytes(files, options.chunkBytes ?? DEFAULT_CHUNK_BYTES);
+    const concurrency = Math.min(resolveConcurrency(options), chunks.length);
+    const entry = workerEntryPath();
+    const toggles = {
+        source: options.source !== false,
+        config: options.config !== false,
+        deps: options.dependencies !== false,
+        scanMinified: options.scanMinified === true,
+    };
+    let results;
+    try {
+        results = await runPool(WorkerCtor, entry, baseDir, toggles, chunks, concurrency, options.onFile);
+    }
+    catch {
+        // Any worker failure → safe fallback to the serial path.
+        return scan({ ...options, files: files.map((f) => f.rel) });
+    }
+    const merged = mergeChunkResults(results);
+    const inventory = buildInventory(merged.findings);
+    const finishedAt = new Date();
+    return {
+        root: options.root,
+        findings: merged.findings,
+        filesScanned: merged.filesScanned,
+        inventory,
+        startedAt: startedAt.toISOString(),
+        finishedAt: finishedAt.toISOString(),
+        toolVersion: VERSION,
+    };
+}
+/** Worker-pool driver: at most `concurrency` workers, each pulls chunks. */
+function runPool(WorkerCtor, entry, baseDir, toggles, chunks, concurrency, onFile) {
+    return new Promise((resolve, reject) => {
+        const results = new Array(chunks.length);
+        let next = 0;
+        let done = 0;
+        let failed = false;
+        const workers = [];
+        const cleanup = () => {
+            for (const w of workers)
+                void w.terminate();
+        };
+        const dispatch = (w) => {
+            if (failed)
+                return;
+            if (next >= chunks.length) {
+                void w.terminate();
+                return;
+            }
+            const idx = next++;
+            w.postMessage({ index: idx, files: chunks[idx].files });
+        };
+        const spawn = () => {
+            const w = new WorkerCtor(entry, { workerData: { baseDir, toggles } });
+            w.on("message", (msg) => {
+                if (msg.error) {
+                    if (!failed) {
+                        failed = true;
+                        cleanup();
+                        reject(new Error(msg.error));
+                    }
+                    return;
+                }
+                if (msg.files && onFile)
+                    for (const f of msg.files)
+                        onFile(f);
+                if (msg.result) {
+                    results[msg.index] = msg.result;
+                    done++;
+                    if (done === chunks.length) {
+                        cleanup();
+                        resolve(results);
+                        return;
+                    }
+                    dispatch(w);
+                }
+            });
+            w.on("error", (err) => {
+                if (!failed) {
+                    failed = true;
+                    cleanup();
+                    reject(err);
+                }
+            });
+            return w;
+        };
+        const n = Math.max(1, Math.min(concurrency, chunks.length));
+        for (let i = 0; i < n; i++) {
+            const w = spawn();
+            workers.push(w);
+            dispatch(w);
+        }
+    });
+}
+//# sourceMappingURL=parallel.js.map

package/dist/parallel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parallel.js","sourceRoot":"","sources":["../src/parallel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAKzC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAavC,MAAM,gCAAgC,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACzD,MAAM,+BAA+B,GAAG,GAAG,CAAC;AAC5C,MAAM,mBAAmB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAQ5C;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAA2B,EAAE,UAAkB;IAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IACtC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,IAAI,OAAO,GAAa,EAAE,CAAC;IAC3B,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,GAAG,CAAC,CAAC,IAAI,GAAG,KAAK,EAAE,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YAChC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACpB,YAAY,IAAI,CAAC,CAAC,IAAI,CAAC;IACzB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA+B;IAC/D,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ;YAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7C,YAAY,IAAI,CAAC,CAAC,YAAY,CAAC;IACjC,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC/B,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AACpC,CAAC;AAED,uCAAuC;AACvC,SAAS,kBAAkB,CAAC,OAA4B;IACtD,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC;IAChC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChE,MAAM,KAAK,GACT,OAAO,EAAE,CAAC,oBAAoB,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC;IAC/F,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,+EAA+E;AAC/E,SAAS,iBAAiB,CAAC,OAA4B,EAAE,KAAkB;IACzE,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,OAAO,CAAC,sBAAsB,IAAI,gCAAgC,CAAC;IACrF,MAAM,SAAS,GAAG,OAAO,CAAC,qBAAqB,IAAI,+BAA+B,CAAC;IACnF,IAAI,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,OAAO,UAAU,IAAI,SAAS,IAAI,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,cAAc,CAAC,OAA4B,EAAE,OAAe;IACzE,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK;YAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE;YAC9C,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,EAAE,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;QAC3E,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAChF,SAAS,eAAe;IACtB,mFAAmF;IACnF,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,gBAAgB,CAAC,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAA4B;IAC7D,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAE7B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAE9E,yEAAyE;IACzE,wEAAwE;IACxE,IAAI,QAAQ,CAAC,MAAM,EAAE,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAErD,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;QACvC,mEAAmE;QACnE,OAAO,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,UAAuD,CAAC;IAC5D,IAAI,CAAC;QACH,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC,CAAC;IAC9E,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAEhC,MAAM,OAAO,GAAG;QACd,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,KAAK;QAChC,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,KAAK;QAChC,IAAI,EAAE,OAAO,CAAC,YAAY,KAAK,KAAK;QACpC,YAAY,EAAE,OAAO,CAAC,YAAY,KAAK,IAAI;KAC5C,CAAC;IAEF,IAAI,OAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CACrB,UAAU,EACV,KAAK,EACL,OAAO,EACP,OAAO,EACP,MAAM,EACN,WAAW,EACX,OAAO,CAAC,MAAM,CACf,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,yDAAyD;QACzD,OAAO,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;IAE9B,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,SAAS;QACT,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;QAClC,UAAU,EAAE,UAAU,CAAC,WAAW,EAAE;QACpC,WAAW,EAAE,OAAO;KACrB,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,SAAS,OAAO,CACd,UAAuD,EACvD,KAAa,EACb,OAAe,EACf,OAAmF,EACnF,MAAmB,EACnB,WAAmB,EACnB,MAA+B;IAE/B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAkB,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,MAAM,OAAO,GAAsB,EAAE,CAAC;QAEtC,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,KAAK,MAAM,CAAC,IAAI,OAAO;gBAAE,KAAK,CAAC,CAAC,SAAS,EAAE,CAAC;QAC9C,CAAC,CAAC;QAEF,MAAM,QAAQ,GAAG,CAAC,CAAa,EAAQ,EAAE;YACvC,IAAI,MAAM;gBAAE,OAAO;YACnB,IAAI,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC1B,KAAK,CAAC,CAAC,SAAS,EAAE,CAAC;gBACnB,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,EAAE,CAAC;YACnB,CAAC,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1D,CAAC,CAAC;QAEF,MAAM,KAAK,GAAG,GAAe,EAAE;YAC7B,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;YACtE,CAAC,CAAC,EAAE,CACF,SAAS,EACT,CAAC,GAA8E,EAAE,EAAE;gBACjF,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;oBACd,IAAI,CAAC,MAAM,EAAE,CAAC;wBACZ,MAAM,GAAG,IAAI,CAAC;wBACd,OAAO,EAAE,CAAC;wBACV,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC/B,CAAC;oBACD,OAAO;gBACT,CAAC;gBACD,IAAI,GAAG,CAAC,KAAK,IAAI,MAAM;oBAAE,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK;wBAAE,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC9D,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;oBACf,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC;oBAChC,IAAI,EAAE,CAAC;oBACP,IAAI,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;wBAC3B,OAAO,EAAE,CAAC;wBACV,OAAO,CAAC,OAAO,CAAC,CAAC;wBACjB,OAAO;oBACT,CAAC;oBACD,QAAQ,CAAC,CAAC,CAAC,CAAC;gBACd,CAAC;YACH,CAAC,CACF,CAAC;YACF,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACpB,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,GAAG,IAAI,CAAC;oBACd,OAAO,EAAE,CAAC;oBACV,MAAM,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC;YACH,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,CAAC;QACX,CAAC,CAAC;QAEF,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,QAAQ,CAAC,CAAC,CAAC,CAAC;QACd,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/registry.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Detector registry — the plugin point for source/config detectors.
+ *
+ * Instead of `scan()` closing over a hardcoded array and inferring scope from
+ * ruleId prefixes, detectors are registered with a declared `scope` and
+ * `language` (see {@link Detector}). `scan()` consults a registry (the
+ * {@link defaultRegistry} by default, or an explicit `detectors` override) and
+ * honours the source/config toggles by each detector's declared scope.
+ *
+ * To add a language or detector, see the "Adding a detector / language" section
+ * of the package README.
+ */
+import type { Detector, DetectorScope } from "./types.js";
+/** Normalised scope of a detector (defaults to "source" when undeclared). */
+export declare function detectorScope(d: Detector): DetectorScope;
+/**
+ * An ordered, id-indexed collection of detectors. Registration order is
+ * preserved by {@link all} for deterministic scan output. Ids must be unique.
+ */
+export declare class DetectorRegistry {
+    private readonly byId;
+    private readonly order;
+    /** Construct a registry, optionally seeded with an initial detector set. */
+    constructor(initial?: readonly Detector[]);
+    /** Register a detector. Throws on a duplicate id. Returns `this` for chaining. */
+    register(d: Detector): this;
+    /** Look up a detector by its id (exact, not prefix). */
+    get(id: string): Detector | undefined;
+    /** True if a detector with this id is registered. */
+    has(id: string): boolean;
+    /** All registered detectors, in registration order. */
+    all(): Detector[];
+    /** A shallow copy of this registry (useful to extend the defaults). */
+    clone(): DetectorRegistry;
+}
+/**
+ * The default registry, preloaded with the built-in detectors in run order:
+ * the JS/TS source + config detectors, then the language-agnostic PEM detector.
+ * The manifest (dependency) scanner is handled separately by `scan()`.
+ */
+export declare const defaultRegistry: DetectorRegistry;
+//# sourceMappingURL=registry.d.ts.map

package/dist/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAI1D,6EAA6E;AAC7E,wBAAgB,aAAa,CAAC,CAAC,EAAE,QAAQ,GAAG,aAAa,CAExD;AAED;;;GAGG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA+B;IACpD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgB;IAEtC,4EAA4E;gBAChE,OAAO,GAAE,SAAS,QAAQ,EAAO;IAI7C,kFAAkF;IAClF,QAAQ,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI;IAS3B,wDAAwD;IACxD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS;IAIrC,qDAAqD;IACrD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAIxB,uDAAuD;IACvD,GAAG,IAAI,QAAQ,EAAE;IAIjB,uEAAuE;IACvE,KAAK,IAAI,gBAAgB;CAG1B;AAED;;;;GAIG;AACH,eAAO,MAAM,eAAe,kBAA0D,CAAC"}

package/dist/registry.js

@@ -0,0 +1,51 @@
+import { sourceDetectors } from "./detectors/source.js";
+import { pemDetector } from "./detectors/pem.js";
+/** Normalised scope of a detector (defaults to "source" when undeclared). */
+export function detectorScope(d) {
+    return d.scope ?? "source";
+}
+/**
+ * An ordered, id-indexed collection of detectors. Registration order is
+ * preserved by {@link all} for deterministic scan output. Ids must be unique.
+ */
+export class DetectorRegistry {
+    byId = new Map();
+    order = [];
+    /** Construct a registry, optionally seeded with an initial detector set. */
+    constructor(initial = []) {
+        for (const d of initial)
+            this.register(d);
+    }
+    /** Register a detector. Throws on a duplicate id. Returns `this` for chaining. */
+    register(d) {
+        if (this.byId.has(d.id)) {
+            throw new Error(`duplicate detector id: ${d.id}`);
+        }
+        this.byId.set(d.id, d);
+        this.order.push(d.id);
+        return this;
+    }
+    /** Look up a detector by its id (exact, not prefix). */
+    get(id) {
+        return this.byId.get(id);
+    }
+    /** True if a detector with this id is registered. */
+    has(id) {
+        return this.byId.has(id);
+    }
+    /** All registered detectors, in registration order. */
+    all() {
+        return this.order.map((id) => this.byId.get(id));
+    }
+    /** A shallow copy of this registry (useful to extend the defaults). */
+    clone() {
+        return new DetectorRegistry(this.all());
+    }
+}
+/**
+ * The default registry, preloaded with the built-in detectors in run order:
+ * the JS/TS source + config detectors, then the language-agnostic PEM detector.
+ * The manifest (dependency) scanner is handled separately by `scan()`.
+ */
+export const defaultRegistry = new DetectorRegistry([...sourceDetectors, pemDetector]);
+//# sourceMappingURL=registry.js.map

package/dist/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,CAAW;IACvC,OAAO,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,gBAAgB;IACV,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAC;IACnC,KAAK,GAAa,EAAE,CAAC;IAEtC,4EAA4E;IAC5E,YAAY,UAA+B,EAAE;QAC3C,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,kFAAkF;IAClF,QAAQ,CAAC,CAAW;QAClB,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,wDAAwD;IACxD,GAAG,CAAC,EAAU;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC;IAED,qDAAqD;IACrD,GAAG,CAAC,EAAU;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC;IAED,uDAAuD;IACvD,GAAG;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC,CAAC;IACpD,CAAC;IAED,uEAAuE;IACvE,KAAK;QACH,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,gBAAgB,CAAC,CAAC,GAAG,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC"}

package/dist/remediation.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Post-quantum remediation guidance for each classical asymmetric algorithm
+ * family. The recommendations follow NIST's standardized PQC algorithms
+ * (ML-KEM / FIPS 203, ML-DSA / FIPS 204, SLH-DSA / FIPS 205) and the IETF
+ * hybrid key-exchange drafts (X25519MLKEM768).
+ */
+import type { AlgorithmFamily, Remediation } from "./types.js";
+/** Look up the recommended post-quantum remediation for a classical algorithm. */
+export declare function remediationFor(algorithm: AlgorithmFamily): Remediation | undefined;
+/** Convenience: just the short recommendation string for a family (always defined). */
+export declare function remediationText(algorithm: AlgorithmFamily): string;
+/**
+ * Security tier for remediation guidance.
+ *  - `"category-3"` (default): commercial use — ML-KEM-768 / ML-DSA-65.
+ *  - `"category-5"`: CNSA 2.0 national-security-systems / long-lived secrets —
+ *    ML-KEM-1024 / ML-DSA-87.
+ */
+export type SecurityTier = "category-3" | "category-5";
+/** Per-tier KEM / signature parameter sets. */
+export declare const TIER_PARAMS: Record<SecurityTier, {
+    kem: string;
+    signature: string;
+    note: string;
+}>;
+/**
+ * Tier-aware remediation. Returns the base family remediation plus the
+ * parameter sets for the requested CNSA tier. Category 5 surfaces the
+ * ML-KEM-1024 / ML-DSA-87 sets mandated by CNSA 2.0; category 3 is the
+ * commercial default.
+ */
+export declare function remediationForTier(algorithm: AlgorithmFamily, tier?: SecurityTier): Remediation;
+/**
+ * Guidance for stateful hash-based signatures (SP 800-208: LMS / XMSS / HSS).
+ * These are NIST-approved for firmware / boot signing but are STATEFUL — each
+ * private key may sign a bounded number of messages and the state MUST be
+ * managed to avoid catastrophic key reuse. Surfaced where a long-lived,
+ * low-volume signing root is appropriate.
+ */
+export declare const STATEFUL_HBS_NOTE: string;
+/** True when stateful HBS (SP 800-208) is a reasonable alternative for a family. */
+export declare function statefulHbsApplies(algorithm: AlgorithmFamily): boolean;
+//# sourceMappingURL=remediation.d.ts.map

package/dist/remediation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remediation.d.ts","sourceRoot":"","sources":["../src/remediation.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAkF/D,kFAAkF;AAClF,wBAAgB,cAAc,CAAC,SAAS,EAAE,eAAe,GAAG,WAAW,GAAG,SAAS,CAElF;AAED,uFAAuF;AACvF,wBAAgB,eAAe,CAAC,SAAS,EAAE,eAAe,GAAG,MAAM,CAElE;AAMD;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,YAAY,GAAG,YAAY,CAAC;AAEvD,+CAA+C;AAC/C,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,YAAY,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAW9F,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,eAAe,EAC1B,IAAI,GAAE,YAA2B,GAChC,WAAW,CAiBb;AAED;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,QAKO,CAAC;AAEtC,oFAAoF;AACpF,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,eAAe,GAAG,OAAO,CAKtE"}