@quantakrypto/core 0.1.0

package/dist/remediation.js

@@ -0,0 +1,131 @@
+/** Canonical remediation table, keyed by algorithm family. */
+const REMEDIATIONS = {
+    RSA: {
+        algorithm: "RSA",
+        recommendation: "ML-KEM-768 for encryption/KEM; ML-DSA-65 for signatures",
+        detail: "RSA is broken by Shor's algorithm. For key transport / encryption move to " +
+            "ML-KEM-768 (FIPS 203), ideally as the hybrid X25519MLKEM768. For digital " +
+            "signatures move to ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205).",
+    },
+    ECDH: {
+        algorithm: "ECDH",
+        recommendation: "hybrid X25519MLKEM768 (ML-KEM-768)",
+        detail: "Elliptic-curve Diffie-Hellman is broken by Shor's algorithm and is exposed " +
+            "to harvest-now-decrypt-later. Adopt the hybrid X25519MLKEM768 key exchange so " +
+            "confidentiality survives even if one component is broken.",
+    },
+    ECDSA: {
+        algorithm: "ECDSA",
+        recommendation: "ML-DSA-65 (FIPS 204)",
+        detail: "ECDSA signatures can be forged by a quantum attacker via Shor's algorithm. " +
+            "Migrate to ML-DSA (Dilithium, FIPS 204) or SLH-DSA (SPHINCS+, FIPS 205) for " +
+            "long-lived signatures.",
+    },
+    EdDSA: {
+        algorithm: "EdDSA",
+        recommendation: "ML-DSA-65 (FIPS 204)",
+        detail: "Ed25519 / Ed448 (EdDSA) are classical signatures broken by Shor's algorithm. " +
+            "Replace with ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205) for forgery resistance.",
+    },
+    DH: {
+        algorithm: "DH",
+        recommendation: "hybrid X25519MLKEM768 (ML-KEM-768)",
+        detail: "Finite-field Diffie-Hellman is broken by Shor's algorithm and exposed to " +
+            "harvest-now-decrypt-later. Move to a hybrid PQC KEM such as X25519MLKEM768.",
+    },
+    DSA: {
+        algorithm: "DSA",
+        recommendation: "ML-DSA-65 (FIPS 204)",
+        detail: "DSA is a classical, quantum-broken signature scheme (and already deprecated). " +
+            "Replace with ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205).",
+    },
+    X25519: {
+        algorithm: "X25519",
+        recommendation: "hybrid X25519MLKEM768 (ML-KEM-768)",
+        detail: "X25519 is a modern, well-built classical key-agreement primitive but is still " +
+            "broken by Shor's algorithm. Wrap it in the hybrid X25519MLKEM768 construction " +
+            "so it stays useful during the PQC transition.",
+    },
+    X448: {
+        algorithm: "X448",
+        recommendation: "hybrid X25519MLKEM768 (ML-KEM-768)",
+        detail: "X448 (Goldilocks curve) is a modern classical key-agreement primitive at a " +
+            "higher classical security level, but it is still broken by Shor's algorithm. " +
+            "Adopt a hybrid PQC KEM (X25519MLKEM768 / ML-KEM-768) during the transition.",
+    },
+    ECIES: {
+        algorithm: "ECIES",
+        recommendation: "ML-KEM-768 hybrid encryption",
+        detail: "ECIES relies on classical ECDH for its key encapsulation and is exposed to " +
+            "harvest-now-decrypt-later. Replace the KEM step with ML-KEM-768 (FIPS 203), " +
+            "preferably in a hybrid construction.",
+    },
+    unknown: {
+        algorithm: "unknown",
+        recommendation: "review for post-quantum migration",
+        detail: "This usage involves classical public-key cryptography. Audit it and plan a " +
+            "migration to NIST PQC standards (ML-KEM / FIPS 203, ML-DSA / FIPS 204).",
+    },
+};
+/** Look up the recommended post-quantum remediation for a classical algorithm. */
+export function remediationFor(algorithm) {
+    return REMEDIATIONS[algorithm];
+}
+/** Convenience: just the short recommendation string for a family (always defined). */
+export function remediationText(algorithm) {
+    return REMEDIATIONS[algorithm].recommendation;
+}
+/** Per-tier KEM / signature parameter sets. */
+export const TIER_PARAMS = {
+    "category-3": {
+        kem: "ML-KEM-768 (FIPS 203)",
+        signature: "ML-DSA-65 (FIPS 204)",
+        note: "NIST Category 3 — default for general commercial use.",
+    },
+    "category-5": {
+        kem: "ML-KEM-1024 (FIPS 203)",
+        signature: "ML-DSA-87 (FIPS 204)",
+        note: "NIST Category 5 — CNSA 2.0 for national-security systems and long-lived secrets (2030/2033 milestones).",
+    },
+};
+/**
+ * Tier-aware remediation. Returns the base family remediation plus the
+ * parameter sets for the requested CNSA tier. Category 5 surfaces the
+ * ML-KEM-1024 / ML-DSA-87 sets mandated by CNSA 2.0; category 3 is the
+ * commercial default.
+ */
+export function remediationForTier(algorithm, tier = "category-3") {
+    const base = REMEDIATIONS[algorithm];
+    const params = TIER_PARAMS[tier];
+    // Confidentiality families lean on the KEM; signature families on the signer.
+    const isConfidentiality = algorithm === "RSA" ||
+        algorithm === "ECDH" ||
+        algorithm === "DH" ||
+        algorithm === "X25519" ||
+        algorithm === "X448" ||
+        algorithm === "ECIES";
+    const primary = isConfidentiality ? params.kem : params.signature;
+    return {
+        algorithm,
+        recommendation: `${base.recommendation} — ${tier}: ${primary}`,
+        detail: `${base.detail} ${params.note} For this tier use ${params.kem} (KEM) and ${params.signature} (signatures).`,
+    };
+}
+/**
+ * Guidance for stateful hash-based signatures (SP 800-208: LMS / XMSS / HSS).
+ * These are NIST-approved for firmware / boot signing but are STATEFUL — each
+ * private key may sign a bounded number of messages and the state MUST be
+ * managed to avoid catastrophic key reuse. Surfaced where a long-lived,
+ * low-volume signing root is appropriate.
+ */
+export const STATEFUL_HBS_NOTE = "For firmware / secure-boot signing, the stateful hash-based signatures " +
+    "LMS, XMSS and HSS (NIST SP 800-208) are approved alternatives to ML-DSA, " +
+    "but they are STATEFUL: the signer must never reuse a one-time key index. " +
+    "Use only with rigorous state management; otherwise prefer stateless ML-DSA " +
+    "(FIPS 204) or SLH-DSA (FIPS 205).";
+/** True when stateful HBS (SP 800-208) is a reasonable alternative for a family. */
+export function statefulHbsApplies(algorithm) {
+    // Signature families only — LMS/XMSS are signatures, not KEMs.
+    return (algorithm === "RSA" || algorithm === "ECDSA" || algorithm === "EdDSA" || algorithm === "DSA");
+}
+//# sourceMappingURL=remediation.js.map

package/dist/remediation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remediation.js","sourceRoot":"","sources":["../src/remediation.ts"],"names":[],"mappings":"AAQA,8DAA8D;AAC9D,MAAM,YAAY,GAAyC;IACzD,GAAG,EAAE;QACH,SAAS,EAAE,KAAK;QAChB,cAAc,EAAE,yDAAyD;QACzE,MAAM,EACJ,4EAA4E;YAC5E,2EAA2E;YAC3E,gEAAgE;KACnE;IACD,IAAI,EAAE;QACJ,SAAS,EAAE,MAAM;QACjB,cAAc,EAAE,oCAAoC;QACpD,MAAM,EACJ,6EAA6E;YAC7E,gFAAgF;YAChF,2DAA2D;KAC9D;IACD,KAAK,EAAE;QACL,SAAS,EAAE,OAAO;QAClB,cAAc,EAAE,sBAAsB;QACtC,MAAM,EACJ,6EAA6E;YAC7E,8EAA8E;YAC9E,wBAAwB;KAC3B;IACD,KAAK,EAAE;QACL,SAAS,EAAE,OAAO;QAClB,cAAc,EAAE,sBAAsB;QACtC,MAAM,EACJ,+EAA+E;YAC/E,iFAAiF;KACpF;IACD,EAAE,EAAE;QACF,SAAS,EAAE,IAAI;QACf,cAAc,EAAE,oCAAoC;QACpD,MAAM,EACJ,2EAA2E;YAC3E,6EAA6E;KAChF;IACD,GAAG,EAAE;QACH,SAAS,EAAE,KAAK;QAChB,cAAc,EAAE,sBAAsB;QACtC,MAAM,EACJ,gFAAgF;YAChF,0DAA0D;KAC7D;IACD,MAAM,EAAE;QACN,SAAS,EAAE,QAAQ;QACnB,cAAc,EAAE,oCAAoC;QACpD,MAAM,EACJ,gFAAgF;YAChF,gFAAgF;YAChF,+CAA+C;KAClD;IACD,IAAI,EAAE;QACJ,SAAS,EAAE,MAAM;QACjB,cAAc,EAAE,oCAAoC;QACpD,MAAM,EACJ,6EAA6E;YAC7E,+EAA+E;YAC/E,6EAA6E;KAChF;IACD,KAAK,EAAE;QACL,SAAS,EAAE,OAAO;QAClB,cAAc,EAAE,8BAA8B;QAC9C,MAAM,EACJ,6EAA6E;YAC7E,8EAA8E;YAC9E,sCAAsC;KACzC;IACD,OAAO,EAAE;QACP,SAAS,EAAE,SAAS;QACpB,cAAc,EAAE,mCAAmC;QACnD,MAAM,EACJ,6EAA6E;YAC7E,yEAAyE;KAC5E;CACF,CAAC;AAEF,kFAAkF;AAClF,MAAM,UAAU,cAAc,CAAC,SAA0B;IACvD,OAAO,YAAY,CAAC,SAAS,CAAC,CAAC;AACjC,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,eAAe,CAAC,SAA0B;IACxD,OAAO,YAAY,CAAC,SAAS,CAAC,CAAC,cAAc,CAAC;AAChD,CAAC;AAcD,+CAA+C;AAC/C,MAAM,CAAC,MAAM,WAAW,GAA2E;IACjG,YAAY,EAAE;QACZ,GAAG,EAAE,uBAAuB;QAC5B,SAAS,EAAE,sBAAsB;QACjC,IAAI,EAAE,uDAAuD;KAC9D;IACD,YAAY,EAAE;QACZ,GAAG,EAAE,wBAAwB;QAC7B,SAAS,EAAE,sBAAsB;QACjC,IAAI,EAAE,yGAAyG;KAChH;CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,SAA0B,EAC1B,OAAqB,YAAY;IAEjC,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACjC,8EAA8E;IAC9E,MAAM,iBAAiB,GACrB,SAAS,KAAK,KAAK;QACnB,SAAS,KAAK,MAAM;QACpB,SAAS,KAAK,IAAI;QAClB,SAAS,KAAK,QAAQ;QACtB,SAAS,KAAK,MAAM;QACpB,SAAS,KAAK,OAAO,CAAC;IACxB,MAAM,OAAO,GAAG,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;IAClE,OAAO;QACL,SAAS;QACT,cAAc,EAAE,GAAG,IAAI,CAAC,cAAc,MAAM,IAAI,KAAK,OAAO,EAAE;QAC9D,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,sBAAsB,MAAM,CAAC,GAAG,cAAc,MAAM,CAAC,SAAS,gBAAgB;KACpH,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAC5B,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,6EAA6E;IAC7E,mCAAmC,CAAC;AAEtC,oFAAoF;AACpF,MAAM,UAAU,kBAAkB,CAAC,SAA0B;IAC3D,+DAA+D;IAC/D,OAAO,CACL,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,KAAK,KAAK,CAC7F,CAAC;AACJ,CAAC"}

package/dist/report.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Reporters: turn a {@link ScanResult} into SARIF 2.1.0, a clean JSON object,
+ * or a human-readable text summary. No third-party dependencies — ANSI colour
+ * is emitted with raw escape codes and is off by default.
+ */
+import type { ScanResult } from "./types.js";
+/** Minimal SARIF 2.1.0 log shape (kept permissive on purpose). */
+export interface SarifLog {
+    $schema: string;
+    version: "2.1.0";
+    runs: unknown[];
+}
+/** Serialize a scan result as SARIF 2.1.0. */
+export declare function toSarif(result: ScanResult): SarifLog;
+/** Serialize a scan result as a plain JSON-friendly object. */
+export declare function toJson(result: ScanResult): Record<string, unknown>;
+/**
+ * Render a human-readable summary of a scan result. Colour is off by default;
+ * pass `{ color: true }` to emit ANSI escape codes.
+ */
+export declare function formatSummary(result: ScanResult, options?: {
+    color?: boolean;
+}): string;
+//# sourceMappingURL=report.d.ts.map

package/dist/report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,UAAU,EAAY,MAAM,YAAY,CAAC;AAGvD,kEAAkE;AAClE,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,OAAO,EAAE,CAAC;CACjB;AAoCD,8CAA8C;AAC9C,wBAAgB,OAAO,CAAC,MAAM,EAAE,UAAU,GAAG,QAAQ,CA+GpD;AAkBD,+DAA+D;AAC/D,wBAAgB,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAkClE;AA2CD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CA8EvF"}

package/dist/report.js

@@ -0,0 +1,286 @@
+import { VERSION } from "./version.js";
+const SARIF_SCHEMA = "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json";
+const INFORMATION_URI = "https://github.com/qproof-tools/qproof";
+/** Map our severity to a SARIF result level. */
+function sarifLevel(severity) {
+    switch (severity) {
+        case "critical":
+        case "high":
+            return "error";
+        case "medium":
+            return "warning";
+        default:
+            return "note";
+    }
+}
+/** Map our severity to a SARIF rule-level default (used in rules[].defaultConfiguration). */
+function sarifRank(severity) {
+    switch (severity) {
+        case "critical":
+            return 100;
+        case "high":
+            return 80;
+        case "medium":
+            return 50;
+        case "low":
+            return 20;
+        default:
+            return 5;
+    }
+}
+/** Serialize a scan result as SARIF 2.1.0. */
+export function toSarif(result) {
+    // Build the unique rule set (one rule per ruleId encountered) and collect the
+    // set of CWE taxa referenced by any rule.
+    const ruleIndex = new Map();
+    const rules = [];
+    const cweTaxa = new Set();
+    for (const f of result.findings) {
+        if (f.cwe)
+            cweTaxa.add(f.cwe);
+        if (ruleIndex.has(f.ruleId))
+            continue;
+        ruleIndex.set(f.ruleId, rules.length);
+        rules.push({
+            id: f.ruleId,
+            name: f.ruleId,
+            shortDescription: { text: f.title },
+            fullDescription: { text: f.message },
+            defaultConfiguration: { level: sarifLevel(f.severity), rank: sarifRank(f.severity) },
+            ...(f.remediation ? { help: { text: `Remediation: ${f.remediation}` } } : {}),
+            properties: {
+                category: f.category,
+                ...(f.algorithm ? { algorithm: f.algorithm } : {}),
+                hndl: f.hndl,
+                ...(f.cwe ? { cwe: f.cwe, "security-severity": securitySeverity(f.severity) } : {}),
+                ...(f.cwe ? { tags: ["security", f.cwe] } : {}),
+            },
+            ...(f.cwe
+                ? {
+                    relationships: [
+                        { target: { id: f.cwe, toolComponent: { name: "CWE" } }, kinds: ["relevant"] },
+                    ],
+                }
+                : {}),
+        });
+    }
+    const results = result.findings.map((f) => {
+        const region = { startLine: f.location.line };
+        if (typeof f.location.column === "number")
+            region.startColumn = f.location.column;
+        if (typeof f.location.endLine === "number")
+            region.endLine = f.location.endLine;
+        return {
+            ruleId: f.ruleId,
+            ruleIndex: ruleIndex.get(f.ruleId),
+            level: sarifLevel(f.severity),
+            message: { text: f.message },
+            properties: {
+                category: f.category,
+                severity: f.severity,
+                confidence: f.confidence,
+                hndl: f.hndl,
+                ...(f.algorithm ? { algorithm: f.algorithm } : {}),
+                ...(f.remediation ? { remediation: f.remediation } : {}),
+                ...(f.cwe ? { cwe: f.cwe } : {}),
+            },
+            ...(f.cwe
+                ? {
+                    taxa: [
+                        {
+                            target: { id: f.cwe, toolComponent: { name: "CWE" } },
+                        },
+                    ],
+                }
+                : {}),
+            locations: [
+                {
+                    physicalLocation: {
+                        artifactLocation: { uri: f.location.file },
+                        region: {
+                            ...region,
+                            ...(f.location.snippet ? { snippet: { text: f.location.snippet } } : {}),
+                        },
+                    },
+                },
+            ],
+        };
+    });
+    // CWE taxonomy component (SARIF taxonomies), referenced by rules + results.
+    const taxonomies = cweTaxa.size > 0
+        ? [
+            {
+                name: "CWE",
+                informationUri: "https://cwe.mitre.org/",
+                organization: "MITRE",
+                shortDescription: { text: "The MITRE Common Weakness Enumeration" },
+                taxa: [...cweTaxa].sort().map((id) => ({
+                    id,
+                    helpUri: `https://cwe.mitre.org/data/definitions/${id.replace(/^CWE-/, "")}.html`,
+                })),
+            },
+        ]
+        : [];
+    return {
+        $schema: SARIF_SCHEMA,
+        version: "2.1.0",
+        runs: [
+            {
+                tool: {
+                    driver: {
+                        name: "qScan",
+                        informationUri: INFORMATION_URI,
+                        version: result.toolVersion || VERSION,
+                        rules,
+                    },
+                },
+                ...(taxonomies.length > 0 ? { taxonomies } : {}),
+                results,
+            },
+        ],
+    };
+}
+/** GitHub-code-scanning `security-severity` (0–10) derived from our severity. */
+function securitySeverity(severity) {
+    switch (severity) {
+        case "critical":
+            return "9.5";
+        case "high":
+            return "8.0";
+        case "medium":
+            return "5.0";
+        case "low":
+            return "3.0";
+        default:
+            return "1.0";
+    }
+}
+/** Serialize a scan result as a plain JSON-friendly object. */
+export function toJson(result) {
+    return {
+        toolVersion: result.toolVersion,
+        root: result.root,
+        startedAt: result.startedAt,
+        finishedAt: result.finishedAt,
+        filesScanned: result.filesScanned,
+        inventory: {
+            readinessScore: result.inventory.readinessScore,
+            hndlCount: result.inventory.hndlCount,
+            bySeverity: result.inventory.bySeverity,
+            byCategory: result.inventory.byCategory,
+            byAlgorithm: result.inventory.byAlgorithm,
+        },
+        findings: result.findings.map((f) => ({
+            ruleId: f.ruleId,
+            title: f.title,
+            category: f.category,
+            severity: f.severity,
+            confidence: f.confidence,
+            algorithm: f.algorithm,
+            hndl: f.hndl,
+            message: f.message,
+            remediation: f.remediation,
+            cwe: f.cwe,
+            location: {
+                file: f.location.file,
+                line: f.location.line,
+                column: f.location.column,
+                endLine: f.location.endLine,
+                snippet: f.location.snippet,
+            },
+        })),
+    };
+}
+/* -------------------------------------------------------------------------- */
+/* Human-readable summary                                                      */
+/* -------------------------------------------------------------------------- */
+/** Raw ANSI codes (no chalk). Disabled when colour is off. */
+const ANSI = {
+    reset: "\x1b[0m",
+    bold: "\x1b[1m",
+    dim: "\x1b[2m",
+    red: "\x1b[31m",
+    green: "\x1b[32m",
+    yellow: "\x1b[33m",
+    blue: "\x1b[34m",
+    magenta: "\x1b[35m",
+    cyan: "\x1b[36m",
+};
+/** Severity ordering for grouping / sorting, most → least severe. */
+const SEVERITY_ORDER = ["critical", "high", "medium", "low", "info"];
+function severityColor(sev) {
+    switch (sev) {
+        case "critical":
+            return ANSI.magenta;
+        case "high":
+            return ANSI.red;
+        case "medium":
+            return ANSI.yellow;
+        case "low":
+            return ANSI.blue;
+        default:
+            return ANSI.dim;
+    }
+}
+function scoreColor(score) {
+    if (score >= 80)
+        return ANSI.green;
+    if (score >= 50)
+        return ANSI.yellow;
+    return ANSI.red;
+}
+/**
+ * Render a human-readable summary of a scan result. Colour is off by default;
+ * pass `{ color: true }` to emit ANSI escape codes.
+ */
+export function formatSummary(result, options) {
+    const color = options?.color ?? false;
+    const c = (code, text) => (color ? `${code}${text}${ANSI.reset}` : text);
+    const lines = [];
+    const inv = result.inventory;
+    lines.push(c(ANSI.bold, "qScan — post-quantum readiness report"));
+    lines.push(c(ANSI.dim, `tool v${result.toolVersion} · root: ${result.root}`));
+    lines.push("");
+    // Readiness score banner.
+    lines.push(`Readiness score: ${c(`${ANSI.bold}${scoreColor(inv.readinessScore)}`, `${inv.readinessScore}/100`)}`);
+    lines.push(`Files scanned:   ${result.filesScanned}   Findings: ${result.findings.length}   HNDL-exposed: ${c(inv.hndlCount > 0 ? ANSI.red : ANSI.green, String(inv.hndlCount))}`);
+    lines.push("");
+    // Severity breakdown.
+    const sevParts = SEVERITY_ORDER.filter((s) => inv.bySeverity[s] > 0).map((s) => c(severityColor(s), `${s}: ${inv.bySeverity[s]}`));
+    lines.push(`By severity:  ${sevParts.length ? sevParts.join("   ") : c(ANSI.green, "none")}`);
+    // Algorithm breakdown.
+    const algoParts = Object.entries(inv.byAlgorithm)
+        .sort((a, b) => b[1] - a[1])
+        .map(([k, v]) => `${k}: ${v}`);
+    if (algoParts.length)
+        lines.push(`By algorithm: ${algoParts.join("   ")}`);
+    lines.push("");
+    if (result.findings.length === 0) {
+        lines.push(c(ANSI.green, "No classical asymmetric cryptography detected. ✓"));
+        return lines.join("\n");
+    }
+    // Top findings, grouped by severity (most severe first), capped for readability.
+    const sorted = [...result.findings].sort((a, b) => SEVERITY_ORDER.indexOf(a.severity) - SEVERITY_ORDER.indexOf(b.severity));
+    const MAX_SHOWN = 25;
+    lines.push(c(ANSI.bold, `Top findings (${Math.min(MAX_SHOWN, sorted.length)} of ${sorted.length}):`));
+    for (const f of sorted.slice(0, MAX_SHOWN)) {
+        const loc = `${f.location.file}:${f.location.line}${f.location.column ? `:${f.location.column}` : ""}`;
+        const tag = c(severityColor(f.severity), `[${f.severity}]`);
+        const hndl = f.hndl ? c(ANSI.red, " (HNDL)") : "";
+        lines.push(`  ${tag} ${f.title}${hndl}`);
+        lines.push(c(ANSI.dim, `      ${loc} — ${f.message}`));
+        if (f.remediation)
+            lines.push(c(ANSI.cyan, `      → ${f.remediation}`));
+    }
+    if (sorted.length > MAX_SHOWN) {
+        lines.push(c(ANSI.dim, `  …and ${sorted.length - MAX_SHOWN} more.`));
+    }
+    lines.push("");
+    if (inv.hndlCount > 0) {
+        lines.push(c(ANSI.yellow, `Note: ${inv.hndlCount} finding(s) are exposed to "harvest now, decrypt later" — ` +
+            "encrypted traffic captured today can be decrypted once a quantum computer exists. " +
+            "Prioritise migrating key exchange / encryption to hybrid PQC (X25519MLKEM768)."));
+    }
+    return lines.join("\n");
+}
+//# sourceMappingURL=report.js.map

package/dist/report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AASvC,MAAM,YAAY,GAChB,gGAAgG,CAAC;AAEnG,MAAM,eAAe,GAAG,wCAAwC,CAAC;AAEjE,gDAAgD;AAChD,SAAS,UAAU,CAAC,QAAkB;IACpC,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,OAAO,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,SAAS,CAAC;QACnB;YACE,OAAO,MAAM,CAAC;IAClB,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,SAAS,SAAS,CAAC,QAAkB;IACnC,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,GAAG,CAAC;QACb,KAAK,MAAM;YACT,OAAO,EAAE,CAAC;QACZ,KAAK,QAAQ;YACX,OAAO,EAAE,CAAC;QACZ,KAAK,KAAK;YACR,OAAO,EAAE,CAAC;QACZ;YACE,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,OAAO,CAAC,MAAkB;IACxC,8EAA8E;IAC9E,0CAA0C;IAC1C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,MAAM,KAAK,GAAmC,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,GAAG;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,SAAS;QACtC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,CAAC,CAAC,MAAM;YACZ,IAAI,EAAE,CAAC,CAAC,MAAM;YACd,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE;YACnC,eAAe,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;YACpC,oBAAoB,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE;YACpF,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,UAAU,EAAE;gBACV,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,mBAAmB,EAAE,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnF,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChD;YACD,GAAG,CAAC,CAAC,CAAC,GAAG;gBACP,CAAC,CAAC;oBACE,aAAa,EAAE;wBACb,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE;qBAC/E;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACxC,MAAM,MAAM,GAA2B,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtE,IAAI,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ;YAAE,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAClF,IAAI,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,KAAK,QAAQ;YAAE,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;QAEhF,OAAO;YACL,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YAClC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;YAC5B,UAAU,EAAE;gBACV,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjC;YACD,GAAG,CAAC,CAAC,CAAC,GAAG;gBACP,CAAC,CAAC;oBACE,IAAI,EAAE;wBACJ;4BACE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;yBACtD;qBACF;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,SAAS,EAAE;gBACT;oBACE,gBAAgB,EAAE;wBAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE;wBAC1C,MAAM,EAAE;4BACN,GAAG,MAAM;4BACT,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBACzE;qBACF;iBACF;aACF;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,MAAM,UAAU,GACd,OAAO,CAAC,IAAI,GAAG,CAAC;QACd,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,KAAK;gBACX,cAAc,EAAE,wBAAwB;gBACxC,YAAY,EAAE,OAAO;gBACrB,gBAAgB,EAAE,EAAE,IAAI,EAAE,uCAAuC,EAAE;gBACnE,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;oBACrC,EAAE;oBACF,OAAO,EAAE,0CAA0C,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO;iBAClF,CAAC,CAAC;aACJ;SACF;QACH,CAAC,CAAC,EAAE,CAAC;IAET,OAAO;QACL,OAAO,EAAE,YAAY;QACrB,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,OAAO;wBACb,cAAc,EAAE,eAAe;wBAC/B,OAAO,EAAE,MAAM,CAAC,WAAW,IAAI,OAAO;wBACtC,KAAK;qBACN;iBACF;gBACD,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChD,OAAO;aACR;SACF;KACF,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAS,gBAAgB,CAAC,QAAkB;IAC1C,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,KAAK,CAAC;QACf,KAAK,MAAM;YACT,OAAO,KAAK,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,KAAK,CAAC;QACf,KAAK,KAAK;YACR,OAAO,KAAK,CAAC;QACf;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,MAAM,CAAC,MAAkB;IACvC,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,SAAS,EAAE;YACT,cAAc,EAAE,MAAM,CAAC,SAAS,CAAC,cAAc;YAC/C,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,SAAS;YACrC,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU;YACvC,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU;YACvC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW;SAC1C;QACD,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpC,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,QAAQ,EAAE;gBACR,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI;gBACrB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI;gBACrB,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM;gBACzB,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO;gBAC3B,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO;aAC5B;SACF,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAEhF,8DAA8D;AAC9D,MAAM,IAAI,GAAG;IACX,KAAK,EAAE,SAAS;IAChB,IAAI,EAAE,SAAS;IACf,GAAG,EAAE,SAAS;IACd,GAAG,EAAE,UAAU;IACf,KAAK,EAAE,UAAU;IACjB,MAAM,EAAE,UAAU;IAClB,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,UAAU;IACnB,IAAI,EAAE,UAAU;CACR,CAAC;AAEX,qEAAqE;AACrE,MAAM,cAAc,GAAe,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAEjF,SAAS,aAAa,CAAC,GAAa;IAClC,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,UAAU;YACb,OAAO,IAAI,CAAC,OAAO,CAAC;QACtB,KAAK,MAAM;YACT,OAAO,IAAI,CAAC,GAAG,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,KAAK,KAAK;YACR,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB;YACE,OAAO,IAAI,CAAC,GAAG,CAAC;IACpB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IACnC,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC;IACpC,OAAO,IAAI,CAAC,GAAG,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,MAAkB,EAAE,OAA6B;IAC7E,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,KAAK,CAAC;IACtC,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,IAAY,EAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAEjG,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC;IAE7B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,uCAAuC,CAAC,CAAC,CAAC;IAClE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,MAAM,CAAC,WAAW,YAAY,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,0BAA0B;IAC1B,KAAK,CAAC,IAAI,CACR,oBAAoB,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,cAAc,MAAM,CAAC,EAAE,CACtG,CAAC;IACF,KAAK,CAAC,IAAI,CACR,oBAAoB,MAAM,CAAC,YAAY,gBAAgB,MAAM,CAAC,QAAQ,CAAC,MAAM,oBAAoB,CAAC,CAChG,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EACzC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CACtB,EAAE,CACJ,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,sBAAsB;IACtB,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7E,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAClD,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,iBAAiB,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAE9F,uBAAuB;IACvB,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;SAC9C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjC,IAAI,SAAS,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,kDAAkD,CAAC,CAAC,CAAC;QAC9E,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,iFAAiF;IACjF,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAClF,CAAC;IACF,MAAM,SAAS,GAAG,EAAE,CAAC;IACrB,KAAK,CAAC,IAAI,CACR,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAC1F,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,GAC/C,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAChD,EAAE,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,EAAE,CAAC,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,CAAC,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,MAAM,CAAC,MAAM,GAAG,SAAS,QAAQ,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,IAAI,GAAG,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CACR,CAAC,CACC,IAAI,CAAC,MAAM,EACX,SAAS,GAAG,CAAC,SAAS,4DAA4D;YAChF,oFAAoF;YACpF,gFAAgF,CACnF,CACF,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/scan-worker.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=scan-worker.d.ts.map

package/dist/scan-worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan-worker.d.ts","sourceRoot":"","sources":["../src/scan-worker.ts"],"names":[],"mappings":""}

package/dist/scan-worker.js

@@ -0,0 +1,63 @@
+/**
+ * Worker-thread entry for {@link scanParallel}. Built to `dist/scan-worker.js`
+ * and spawned by `parallel.ts`. Each worker reads its assigned files and runs
+ * the SAME pure detector pipeline as the serial scan (`detectFile`), returning
+ * `{ findings, filesScanned }` per chunk. No shared mutable state.
+ *
+ * This file performs side effects (wires up message handlers) only when it is
+ * actually running inside a worker thread, so importing it from the main thread
+ * (e.g. for coverage) is harmless.
+ */
+import { readFileSync } from "node:fs";
+import * as path from "node:path";
+import { parentPort, workerData } from "node:worker_threads";
+import { defaultRegistry } from "./registry.js";
+import { detectFile } from "./scan.js";
+import { looksMinified } from "./walk.js";
+import { isManifestFile } from "./dependencies.js";
+if (parentPort) {
+    const data = (workerData ?? {});
+    const baseDir = data.baseDir;
+    const toggles = data.toggles;
+    const dets = defaultRegistry.all();
+    const port = parentPort;
+    port.on("message", (req) => {
+        try {
+            const findings = [];
+            let filesScanned = 0;
+            const scannedNames = [];
+            for (const rel of req.files) {
+                const abs = path.join(baseDir, ...rel.split("/"));
+                let content;
+                try {
+                    content = readFileSync(abs, "utf8");
+                }
+                catch {
+                    continue; // vanished / unreadable — skip.
+                }
+                if (!toggles.scanMinified && !isManifestFile(rel) && looksMinified(content)) {
+                    continue;
+                }
+                filesScanned += 1;
+                scannedNames.push(rel);
+                findings.push(...detectFile(rel, content, dets, {
+                    source: toggles.source,
+                    config: toggles.config,
+                    deps: toggles.deps,
+                }));
+            }
+            port.postMessage({
+                index: req.index,
+                files: scannedNames,
+                result: { findings, filesScanned },
+            });
+        }
+        catch (err) {
+            port.postMessage({
+                index: req.index,
+                error: err instanceof Error ? err.message : String(err),
+            });
+        }
+    });
+}
+//# sourceMappingURL=scan-worker.js.map

package/dist/scan-worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan-worker.js","sourceRoot":"","sources":["../src/scan-worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAG7D,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAcnD,IAAI,UAAU,EAAE,CAAC;IACf,MAAM,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAgD,CAAC;IAC/E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,UAAU,CAAC;IAExB,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAiB,EAAE,EAAE;QACvC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAc,EAAE,CAAC;YAC/B,IAAI,YAAY,GAAG,CAAC,CAAC;YACrB,MAAM,YAAY,GAAa,EAAE,CAAC;YAElC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBAClD,IAAI,OAAe,CAAC;gBACpB,IAAI,CAAC;oBACH,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBACtC,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS,CAAC,gCAAgC;gBAC5C,CAAC;gBACD,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC5E,SAAS;gBACX,CAAC;gBACD,YAAY,IAAI,CAAC,CAAC;gBAClB,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACvB,QAAQ,CAAC,IAAI,CACX,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE;oBAChC,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,IAAI,EAAE,OAAO,CAAC,IAAI;iBACnB,CAAC,CACH,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,WAAW,CAAC;gBACf,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,KAAK,EAAE,YAAY;gBACnB,MAAM,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE;aACnC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,WAAW,CAAC;gBACf,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/scan.d.ts

@@ -0,0 +1,27 @@
+import type { Detector, Finding, ScanOptions, ScanResult } from "./types.js";
+/**
+ * The full set of built-in detectors exposed on the public API. The PEM
+ * detector applies to every text file; the source detectors apply only to
+ * JS/TS. The manifest scanner is handled separately (it parses JSON rather than
+ * running a Detector).
+ */
+export declare const detectors: Detector[];
+/** Stable comparator: by file, then line, then ruleId. Exported for reuse. */
+export declare function compareFindings(a: Finding, b: Finding): number;
+/**
+ * Run all applicable detectors + the manifest scanner over a single file's
+ * contents, honouring the source / config / dependencies toggles. Pure: no I/O.
+ * Exported so the parallel worker and unit tests can drive it directly.
+ */
+export declare function detectFile(file: string, content: string, dets: readonly Detector[], toggles: {
+    source: boolean;
+    config: boolean;
+    deps: boolean;
+}): Finding[];
+/**
+ * Recursively scan a directory (or single file, or explicit file list) for
+ * classical asymmetric crypto. Honours the source / dependencies / config
+ * toggles (all default true) and reports progress through `options.onFile`.
+ */
+export declare function scan(options: ScanOptions): Promise<ScanResult>;
+//# sourceMappingURL=scan.d.ts.map

package/dist/scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAS7E;;;;;GAKG;AACH,eAAO,MAAM,SAAS,EAAE,QAAQ,EAAsC,CAAC;AAEvE,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,MAAM,CAI9D;AAOD;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,QAAQ,EAAE,EACzB,OAAO,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAC3D,OAAO,EAAE,CAeX;AAED;;;;GAIG;AACH,wBAAsB,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAyEpE"}