@quantakrypto/core 0.2.1 → 0.2.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (13) hide show
  1. package/dist/dependencies.d.ts.map +1 -1
  2. package/dist/dependencies.js +105 -0
  3. package/dist/dependencies.js.map +1 -1
  4. package/dist/inventory.d.ts +6 -3
  5. package/dist/inventory.d.ts.map +1 -1
  6. package/dist/inventory.js +11 -6
  7. package/dist/inventory.js.map +1 -1
  8. package/dist/version.d.ts +1 -1
  9. package/dist/version.js +1 -1
  10. package/package.json +1 -1
  11. package/src/dependencies.ts +105 -0
  12. package/src/inventory.ts +12 -6
  13. package/src/version.ts +1 -1
package/dist/dependencies.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"dependencies.d.ts","sourceRoot":"","sources":["../src/dependencies.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAmB,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAKjF,iDAAiD;AACjD,eAAO,MAAM,sBAAsB,EAAE,oBAAoB,EA6IxD,CAAC;AAwCF,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGpD;AA2CD;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,EAAE,CA8CrE"}
1
+ {"version":3,"file":"dependencies.d.ts","sourceRoot":"","sources":["../src/dependencies.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAmB,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAKjF,iDAAiD;AACjD,eAAO,MAAM,sBAAsB,EAAE,oBAAoB,EAsPxD,CAAC;AAwCF,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGpD;AA2CD;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,EAAE,CA8CrE"}
package/dist/dependencies.js CHANGED
@@ -143,6 +143,111 @@ export const vulnerableDependencies = [
143
143
  algorithms: ["RSA"],
144
144
  severity: "high",
145
145
  },
146
+ {
147
+ name: "ethers",
148
+ ecosystem: "npm",
149
+ reason: "Ethereum library built on secp256k1 ECDSA signing and key derivation.",
150
+ algorithms: ["ECDSA"],
151
+ severity: "high",
152
+ },
153
+ {
154
+ name: "web3",
155
+ ecosystem: "npm",
156
+ reason: "Ethereum library using secp256k1 ECDSA for accounts and signing.",
157
+ algorithms: ["ECDSA"],
158
+ severity: "high",
159
+ },
160
+ {
161
+ name: "bitcoinjs-lib",
162
+ ecosystem: "npm",
163
+ reason: "Bitcoin library built on secp256k1 ECDSA/Schnorr keys and signatures.",
164
+ algorithms: ["ECDSA"],
165
+ severity: "high",
166
+ },
167
+ {
168
+ name: "ethereumjs-util",
169
+ ecosystem: "npm",
170
+ reason: "secp256k1 ECDSA utilities for Ethereum keys and signatures.",
171
+ algorithms: ["ECDSA"],
172
+ severity: "medium",
173
+ },
174
+ {
175
+ name: "openpgp",
176
+ ecosystem: "npm",
177
+ reason: "OpenPGP.js: RSA, ECDSA, ECDH, and EdDSA public-key crypto.",
178
+ algorithms: ["RSA", "ECDSA", "ECDH", "EdDSA"],
179
+ severity: "high",
180
+ },
181
+ {
182
+ name: "node-jose",
183
+ ecosystem: "npm",
184
+ reason: "JOSE (JWS/JWE/JWK) with classical RSA and EC algorithms.",
185
+ algorithms: ["RSA", "ECDSA", "ECDH"],
186
+ severity: "high",
187
+ },
188
+ {
189
+ name: "jwa",
190
+ ecosystem: "npm",
191
+ reason: "JSON Web Algorithms: RSA (RS/PS) and EC (ES) signatures.",
192
+ algorithms: ["RSA", "ECDSA"],
193
+ severity: "medium",
194
+ },
195
+ {
196
+ name: "jwk-to-pem",
197
+ ecosystem: "npm",
198
+ reason: "Converts RSA/EC JWKs to PEM — classical public keys.",
199
+ algorithms: ["RSA", "ECDSA"],
200
+ severity: "medium",
201
+ },
202
+ {
203
+ name: "fast-jwt",
204
+ ecosystem: "npm",
205
+ reason: "JWT signing/verification with classical RS/PS/ES algorithms.",
206
+ algorithms: ["RSA", "ECDSA"],
207
+ severity: "medium",
208
+ },
209
+ {
210
+ name: "ssh2",
211
+ ecosystem: "npm",
212
+ reason: "SSH client/server using classical RSA/ECDSA/Ed25519 host and user keys.",
213
+ algorithms: ["RSA", "ECDSA", "EdDSA"],
214
+ severity: "high",
215
+ },
216
+ {
217
+ name: "@peculiar/x509",
218
+ ecosystem: "npm",
219
+ reason: "X.509 certificate library over classical RSA/EC keys.",
220
+ algorithms: ["RSA", "ECDSA"],
221
+ severity: "medium",
222
+ },
223
+ {
224
+ name: "pkijs",
225
+ ecosystem: "npm",
226
+ reason: "PKI (X.509/CMS) built on classical RSA and EC public-key crypto.",
227
+ algorithms: ["RSA", "ECDSA", "ECDH"],
228
+ severity: "medium",
229
+ },
230
+ {
231
+ name: "http-signature",
232
+ ecosystem: "npm",
233
+ reason: "HTTP request signing with classical RSA/ECDSA keys.",
234
+ algorithms: ["RSA", "ECDSA"],
235
+ severity: "medium",
236
+ },
237
+ {
238
+ name: "libsodium-wrappers",
239
+ ecosystem: "npm",
240
+ reason: "libsodium: Ed25519 signatures and X25519 key exchange (classical).",
241
+ algorithms: ["EdDSA", "X25519"],
242
+ severity: "medium",
243
+ },
244
+ {
245
+ name: "ecdsa-sig-formatter",
246
+ ecosystem: "npm",
247
+ reason: "Formats ECDSA signatures — a marker of classical EC signing.",
248
+ algorithms: ["ECDSA"],
249
+ severity: "low",
250
+ },
146
251
  ];
147
252
  /** Fast lookup map by package name. */
148
253
  const BY_NAME = new Map(vulnerableDependencies.map((d) => [d.name, d]));
package/dist/dependencies.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"dependencies.js","sourceRoot":"","sources":["../src/dependencies.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAE7C,iDAAiD;AACjD,MAAM,CAAC,MAAM,sBAAsB,GAA2B;IAC5D;QACE,IAAI,EAAE,YAAY;QAClB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,yDAAyD;QACjE,UAAU,EAAE,CAAC,KAAK,CAAC;QACnB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,uDAAuD;QAC/D,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;QACtC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,mDAAmD;QAC3D,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC;QACnC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,uCAAuC;QAC/C,UAAU,EAAE,CAAC,KAAK,CAAC;QACnB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,qDAAqD;QAC7D,UAAU,EAAE,CAAC,KAAK,CAAC;QACnB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,OAAO;QACb,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,6DAA6D;QACrE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC;QAC5C,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,8DAA8D;QACtE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,8DAA8D;QACtE,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;QAC7C,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,KAAK;QACX,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,uDAAuD;QAC/D,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,qDAAqD;QAC7D,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;QACtC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,kDAAkD;QAC1D,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,oEAAoE;QAC5E,UAAU,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC/B,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,iCAAiC;QACzC,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,oEAAoE;QAC5E,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;QAChD,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,mCAAmC;QAC3C,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,yDAAyD;QACjE,UAAU,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC;QAC/B,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,oEAAoE;QAC5E,UAAU,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC;QAC5B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,+DAA+D;QACvE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;QACpD,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,wCAAwC;QAChD,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,kCAAkC;QAC1C,UAAU,EAAE,CAAC,KAAK,CAAC;QACnB,QAAQ,EAAE,MAAM;KACjB;CACF,CAAC;AAEF,uCAAuC;AACvC,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAC/C,CAAC;AAEF;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAC/B,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAoB,EAAE;IACjD,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;IAC/D,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,OAAO,QAAQ,CAAC,CAAC,CAAC;AACnD,CAAC,CAAC,CACH,CAAC;AAEF,sFAAsF;AACtF,MAAM,wBAAwB,GAAiC,IAAI,GAAG,CAAkB;IACtF,KAAK;IACL,MAAM;IACN,IAAI;IACJ,OAAO;IACP,QAAQ;IACR,MAAM;CACP,CAAC,CAAC;AAEH;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,UAAsC;IACpE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,UAAU;QAAE,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC;IAC3C,OAAO,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,mBAAmB,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CACxB,GAAyB,EACzB,IAAY,EACZ,OAAe,EACf,KAAa;IAEb,yEAAyE;IACzE,0DAA0D;IAC1D,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;IACjD,OAAO,WAAW,CAAC;QACjB,MAAM,EAAE,gBAAgB;QACxB,KAAK,EAAE,kCAAkC,GAAG,CAAC,IAAI,EAAE;QACnD,QAAQ,EAAE,YAAY;QACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,UAAU,EAAE,MAAM;QAClB,SAAS;QACT,sEAAsE;QACtE,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACjE,GAAG,EAAE,iBAAiB;QACtB,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,MAAM,EAAE;QACtC,WAAW,EAAE,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC;QACnD,IAAI;QACJ,OAAO;QACP,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED,4EAA4E;AAC5E,SAAS,WAAW,CAAC,OAAe,EAAE,IAAY;IAChD,0EAA0E;IAC1E,MAAM,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,CAAC;IAClB,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3B,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,OAAe;IACxD,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,iCAAiC;IAC9C,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAEzD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,GAAG,GAAG,IAA+B,CAAC;IAE5C,MAAM,iBAAiB,GAAG,CAAC,GAAY,EAAQ,EAAE;QAC/C,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO;QACpD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAA8B,CAAC,EAAE,CAAC;YAC9D,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC;IAEF,oCAAoC;IACpC,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACpC,iBAAiB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACvC,iBAAiB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACxC,iBAAiB,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAE5C,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC9B,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACtD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAmC,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC,GAAG;gBAAE,SAAS,CAAC,qBAAqB;YACzC,MAAM,MAAM,GAAG,eAAe,CAAC;YAC/B,MAAM,GAAG,GAAG,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YAC7D,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;IACD,0CAA0C;IAC1C,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,OAAO,QAAQ,CAAC;AAClB,CAAC"}
1
+ {"version":3,"file":"dependencies.js","sourceRoot":"","sources":["../src/dependencies.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAE7C,iDAAiD;AACjD,MAAM,CAAC,MAAM,sBAAsB,GAA2B;IAC5D;QACE,IAAI,EAAE,YAAY;QAClB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,yDAAyD;QACjE,UAAU,EAAE,CAAC,KAAK,CAAC;QACnB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,uDAAuD;QAC/D,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;QACtC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,mDAAmD;QAC3D,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC;QACnC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,uCAAuC;QAC/C,UAAU,EAAE,CAAC,KAAK,CAAC;QACnB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,qDAAqD;QAC7D,UAAU,EAAE,CAAC,KAAK,CAAC;QACnB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,OAAO;QACb,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,6DAA6D;QACrE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC;QAC5C,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,8DAA8D;QACtE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,8DAA8D;QACtE,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;QAC7C,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,KAAK;QACX,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,uDAAuD;QAC/D,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,qDAAqD;QAC7D,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;QACtC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,kDAAkD;QAC1D,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,oEAAoE;QAC5E,UAAU,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC/B,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,iCAAiC;QACzC,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,oEAAoE;QAC5E,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;QAChD,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,mCAAmC;QAC3C,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,yDAAyD;QACjE,UAAU,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC;QAC/B,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,oEAAoE;QAC5E,UAAU,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC;QAC5B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,+DAA+D;QACvE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;QACpD,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,wCAAwC;QAChD,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,kCAAkC;QAC1C,UAAU,EAAE,CAAC,KAAK,CAAC;QACnB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,uEAAuE;QAC/E,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,kEAAkE;QAC1E,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,uEAAuE;QAC/E,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,6DAA6D;QACrE,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,4DAA4D;QACpE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;QAC7C,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,0DAA0D;QAClE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;QACpC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,KAAK;QACX,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,0DAA0D;QAClE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,YAAY;QAClB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,sDAAsD;QAC9D,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,8DAA8D;QACtE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,yEAAyE;QACjF,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC;QACrC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,uDAAuD;QAC/D,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,OAAO;QACb,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,kEAAkE;QAC1E,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;QACpC,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,qDAAqD;QAC7D,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,oEAAoE;QAC5E,UAAU,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC;QAC/B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,8DAA8D;QACtE,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,KAAK;KAChB;CACF,CAAC;AAEF,uCAAuC;AACvC,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAC/C,CAAC;AAEF;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAC/B,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAoB,EAAE;IACjD,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;IAC/D,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,OAAO,QAAQ,CAAC,CAAC,CAAC;AACnD,CAAC,CAAC,CACH,CAAC;AAEF,sFAAsF;AACtF,MAAM,wBAAwB,GAAiC,IAAI,GAAG,CAAkB;IACtF,KAAK;IACL,MAAM;IACN,IAAI;IACJ,OAAO;IACP,QAAQ;IACR,MAAM;CACP,CAAC,CAAC;AAEH;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,UAAsC;IACpE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,UAAU;QAAE,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC;IAC3C,OAAO,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,mBAAmB,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CACxB,GAAyB,EACzB,IAAY,EACZ,OAAe,EACf,KAAa;IAEb,yEAAyE;IACzE,0DAA0D;IAC1D,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;IACjD,OAAO,WAAW,CAAC;QACjB,MAAM,EAAE,gBAAgB;QACxB,KAAK,EAAE,kCAAkC,GAAG,CAAC,IAAI,EAAE;QACnD,QAAQ,EAAE,YAAY;QACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,UAAU,EAAE,MAAM;QAClB,SAAS;QACT,sEAAsE;QACtE,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACjE,GAAG,EAAE,iBAAiB;QACtB,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,MAAM,EAAE;QACtC,WAAW,EAAE,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC;QACnD,IAAI;QACJ,OAAO;QACP,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED,4EAA4E;AAC5E,SAAS,WAAW,CAAC,OAAe,EAAE,IAAY;IAChD,0EAA0E;IAC1E,MAAM,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,CAAC;IAClB,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3B,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,OAAe;IACxD,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,iCAAiC;IAC9C,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAEzD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,GAAG,GAAG,IAA+B,CAAC;IAE5C,MAAM,iBAAiB,GAAG,CAAC,GAAY,EAAQ,EAAE;QAC/C,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO;QACpD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAA8B,CAAC,EAAE,CAAC;YAC9D,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC;IAEF,oCAAoC;IACpC,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACpC,iBAAiB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACvC,iBAAiB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACxC,iBAAiB,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAE5C,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC9B,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACtD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAmC,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC,GAAG;gBAAE,SAAS,CAAC,qBAAqB;YACzC,MAAM,MAAM,GAAG,eAAe,CAAC;YAC/B,MAAM,GAAG,GAAG,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YAC7D,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;IACD,0CAA0C;IAC1C,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,OAAO,QAAQ,CAAC;AAClB,CAAC"}
package/dist/inventory.d.ts CHANGED
@@ -5,9 +5,12 @@
5
5
  */
6
6
  import type { CryptoInventory, Finding } from "./types.js";
7
7
  /**
8
- * Compute a 0–100 readiness score. Starts at 100 and subtracts severity-weighted
9
- * penalties with diminishing returns per severity bucket. 100 means no classical
10
- * asymmetric crypto was found; the score is clamped to [0, 100].
8
+ * Compute a 0–100 readiness score. 100 means no classical asymmetric crypto was
9
+ * found. Findings accrue a severity-weighted penalty (with per-bucket diminishing
10
+ * returns), then the score is `100 * e^(-penalty/scale)`. Exponential decay keeps
11
+ * the score responsive across the whole range — fixing findings always raises it,
12
+ * and a large legacy repo lands low without pinning flat at 0 (which made progress
13
+ * invisible under the old linear model). Tuned so one low ~97, one critical ~74.
11
14
  */
12
15
  export declare function readinessScore(findings: Finding[]): number;
13
16
  /** Build the full inventory (counts + HNDL + score) from a set of findings. */
package/dist/inventory.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"inventory.d.ts","sourceRoot":"","sources":["../src/inventory.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAEV,eAAe,EACf,OAAO,EAGR,MAAM,YAAY,CAAC;AAwBpB;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAkB1D;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,eAAe,CAgCnE"}
1
+ {"version":3,"file":"inventory.d.ts","sourceRoot":"","sources":["../src/inventory.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAEV,eAAe,EACf,OAAO,EAGR,MAAM,YAAY,CAAC;AA2BpB;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAkB1D;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,eAAe,CAgCnE"}
package/dist/inventory.js CHANGED
@@ -17,10 +17,15 @@ const SEVERITY_WEIGHT = {
17
17
  function penaltyFor(weight, occurrence) {
18
18
  return weight / Math.sqrt(occurrence);
19
19
  }
20
+ /** Decay constant for the readiness score (larger = more forgiving). */
21
+ const SCORE_SCALE = 100;
20
22
  /**
21
- * Compute a 0–100 readiness score. Starts at 100 and subtracts severity-weighted
22
- * penalties with diminishing returns per severity bucket. 100 means no classical
23
- * asymmetric crypto was found; the score is clamped to [0, 100].
23
+ * Compute a 0–100 readiness score. 100 means no classical asymmetric crypto was
24
+ * found. Findings accrue a severity-weighted penalty (with per-bucket diminishing
25
+ * returns), then the score is `100 * e^(-penalty/scale)`. Exponential decay keeps
26
+ * the score responsive across the whole range — fixing findings always raises it,
27
+ * and a large legacy repo lands low without pinning flat at 0 (which made progress
28
+ * invisible under the old linear model). Tuned so one low ~97, one critical ~74.
24
29
  */
25
30
  export function readinessScore(findings) {
26
31
  if (findings.length === 0)
@@ -32,12 +37,12 @@ export function readinessScore(findings) {
32
37
  low: 0,
33
38
  info: 0,
34
39
  };
35
- let score = 100;
40
+ let penalty = 0;
36
41
  for (const f of findings) {
37
42
  seen[f.severity] += 1;
38
- score -= penaltyFor(SEVERITY_WEIGHT[f.severity], seen[f.severity]);
43
+ penalty += penaltyFor(SEVERITY_WEIGHT[f.severity], seen[f.severity]);
39
44
  }
40
- return Math.max(0, Math.min(100, Math.round(score)));
45
+ return Math.max(0, Math.min(100, Math.round(100 * Math.exp(-penalty / SCORE_SCALE))));
41
46
  }
42
47
  /** Build the full inventory (counts + HNDL + score) from a set of findings. */
43
48
  export function buildInventory(findings) {
package/dist/inventory.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"inventory.js","sourceRoot":"","sources":["../src/inventory.ts"],"names":[],"mappings":"AAaA,4EAA4E;AAC5E,MAAM,UAAU,GAAe,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAE7E,uFAAuF;AACvF,MAAM,eAAe,GAA6B;IAChD,QAAQ,EAAE,EAAE;IACZ,IAAI,EAAE,EAAE;IACR,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;IACN,IAAI,EAAE,CAAC;CACR,CAAC;AAEF;;;;;GAKG;AACH,SAAS,UAAU,CAAC,MAAc,EAAE,UAAkB;IACpD,OAAO,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,QAAmB;IAChD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IAEtC,MAAM,IAAI,GAA6B;QACrC,QAAQ,EAAE,CAAC;QACX,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,CAAC;QACT,GAAG,EAAE,CAAC;QACN,IAAI,EAAE,CAAC;KACR,CAAC;IAEF,IAAI,KAAK,GAAG,GAAG,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtB,KAAK,IAAI,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAC,QAAmB;IAChD,MAAM,WAAW,GAA6C,EAAE,CAAC;IACjE,MAAM,UAAU,GAA6C,EAAE,CAAC;IAChE,MAAM,UAAU,GAA6B;QAC3C,QAAQ,EAAE,CAAC;QACX,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,CAAC;QACT,GAAG,EAAE,CAAC;QACN,IAAI,EAAE,CAAC;KACR,CAAC;IACF,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;YAChB,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACjE,CAAC;QACD,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3D,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,CAAC,IAAI;YAAE,SAAS,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,KAAK,UAAU,CAAC;IAEhB,OAAO;QACL,WAAW;QACX,UAAU;QACV,UAAU;QACV,SAAS;QACT,cAAc,EAAE,cAAc,CAAC,QAAQ,CAAC;KACzC,CAAC;AACJ,CAAC"}
1
+ {"version":3,"file":"inventory.js","sourceRoot":"","sources":["../src/inventory.ts"],"names":[],"mappings":"AAaA,4EAA4E;AAC5E,MAAM,UAAU,GAAe,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAE7E,uFAAuF;AACvF,MAAM,eAAe,GAA6B;IAChD,QAAQ,EAAE,EAAE;IACZ,IAAI,EAAE,EAAE;IACR,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;IACN,IAAI,EAAE,CAAC;CACR,CAAC;AAEF;;;;;GAKG;AACH,SAAS,UAAU,CAAC,MAAc,EAAE,UAAkB;IACpD,OAAO,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AACxC,CAAC;AAED,wEAAwE;AACxE,MAAM,WAAW,GAAG,GAAG,CAAC;AAExB;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,QAAmB;IAChD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IAEtC,MAAM,IAAI,GAA6B;QACrC,QAAQ,EAAE,CAAC;QACX,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,CAAC;QACT,GAAG,EAAE,CAAC;QACN,IAAI,EAAE,CAAC;KACR,CAAC;IAEF,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACtB,OAAO,IAAI,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAC,QAAmB;IAChD,MAAM,WAAW,GAA6C,EAAE,CAAC;IACjE,MAAM,UAAU,GAA6C,EAAE,CAAC;IAChE,MAAM,UAAU,GAA6B;QAC3C,QAAQ,EAAE,CAAC;QACX,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,CAAC;QACT,GAAG,EAAE,CAAC;QACN,IAAI,EAAE,CAAC;KACR,CAAC;IACF,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;YAChB,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACjE,CAAC;QACD,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3D,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,CAAC,IAAI;YAAE,SAAS,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,KAAK,UAAU,CAAC;IAEhB,OAAO;QACL,WAAW;QACX,UAAU;QACV,UAAU;QACV,SAAS;QACT,cAAc,EAAE,cAAc,CAAC,QAAQ,CAAC;KACzC,CAAC;AACJ,CAAC"}
package/dist/version.d.ts CHANGED
@@ -3,5 +3,5 @@
3
3
  * the scan orchestrator can import it without creating a cycle through index.ts.
4
4
  * Keep in sync with packages/core/package.json.
5
5
  */
6
- export declare const VERSION = "0.2.1";
6
+ export declare const VERSION = "0.2.2";
7
7
  //# sourceMappingURL=version.d.ts.map
package/dist/version.js CHANGED
@@ -3,5 +3,5 @@
3
3
  * the scan orchestrator can import it without creating a cycle through index.ts.
4
4
  * Keep in sync with packages/core/package.json.
5
5
  */
6
- export const VERSION = "0.2.1";
6
+ export const VERSION = "0.2.2";
7
7
  //# sourceMappingURL=version.js.map
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@quantakrypto/core",
3
- "version": "0.2.1",
3
+ "version": "0.2.2",
4
4
  "description": "Shared post-quantum readiness library: crypto detectors, vulnerable-dependency database, inventory + SARIF reporting. Zero runtime dependencies.",
5
5
  "license": "Apache-2.0",
6
6
  "author": "Dandelion Labs <hello@dandelionlabs.io> (https://dandelionlabs.io)",
package/src/dependencies.ts CHANGED
@@ -154,6 +154,111 @@ export const vulnerableDependencies: VulnerableDependency[] = [
154
154
  algorithms: ["RSA"],
155
155
  severity: "high",
156
156
  },
157
+ {
158
+ name: "ethers",
159
+ ecosystem: "npm",
160
+ reason: "Ethereum library built on secp256k1 ECDSA signing and key derivation.",
161
+ algorithms: ["ECDSA"],
162
+ severity: "high",
163
+ },
164
+ {
165
+ name: "web3",
166
+ ecosystem: "npm",
167
+ reason: "Ethereum library using secp256k1 ECDSA for accounts and signing.",
168
+ algorithms: ["ECDSA"],
169
+ severity: "high",
170
+ },
171
+ {
172
+ name: "bitcoinjs-lib",
173
+ ecosystem: "npm",
174
+ reason: "Bitcoin library built on secp256k1 ECDSA/Schnorr keys and signatures.",
175
+ algorithms: ["ECDSA"],
176
+ severity: "high",
177
+ },
178
+ {
179
+ name: "ethereumjs-util",
180
+ ecosystem: "npm",
181
+ reason: "secp256k1 ECDSA utilities for Ethereum keys and signatures.",
182
+ algorithms: ["ECDSA"],
183
+ severity: "medium",
184
+ },
185
+ {
186
+ name: "openpgp",
187
+ ecosystem: "npm",
188
+ reason: "OpenPGP.js: RSA, ECDSA, ECDH, and EdDSA public-key crypto.",
189
+ algorithms: ["RSA", "ECDSA", "ECDH", "EdDSA"],
190
+ severity: "high",
191
+ },
192
+ {
193
+ name: "node-jose",
194
+ ecosystem: "npm",
195
+ reason: "JOSE (JWS/JWE/JWK) with classical RSA and EC algorithms.",
196
+ algorithms: ["RSA", "ECDSA", "ECDH"],
197
+ severity: "high",
198
+ },
199
+ {
200
+ name: "jwa",
201
+ ecosystem: "npm",
202
+ reason: "JSON Web Algorithms: RSA (RS/PS) and EC (ES) signatures.",
203
+ algorithms: ["RSA", "ECDSA"],
204
+ severity: "medium",
205
+ },
206
+ {
207
+ name: "jwk-to-pem",
208
+ ecosystem: "npm",
209
+ reason: "Converts RSA/EC JWKs to PEM — classical public keys.",
210
+ algorithms: ["RSA", "ECDSA"],
211
+ severity: "medium",
212
+ },
213
+ {
214
+ name: "fast-jwt",
215
+ ecosystem: "npm",
216
+ reason: "JWT signing/verification with classical RS/PS/ES algorithms.",
217
+ algorithms: ["RSA", "ECDSA"],
218
+ severity: "medium",
219
+ },
220
+ {
221
+ name: "ssh2",
222
+ ecosystem: "npm",
223
+ reason: "SSH client/server using classical RSA/ECDSA/Ed25519 host and user keys.",
224
+ algorithms: ["RSA", "ECDSA", "EdDSA"],
225
+ severity: "high",
226
+ },
227
+ {
228
+ name: "@peculiar/x509",
229
+ ecosystem: "npm",
230
+ reason: "X.509 certificate library over classical RSA/EC keys.",
231
+ algorithms: ["RSA", "ECDSA"],
232
+ severity: "medium",
233
+ },
234
+ {
235
+ name: "pkijs",
236
+ ecosystem: "npm",
237
+ reason: "PKI (X.509/CMS) built on classical RSA and EC public-key crypto.",
238
+ algorithms: ["RSA", "ECDSA", "ECDH"],
239
+ severity: "medium",
240
+ },
241
+ {
242
+ name: "http-signature",
243
+ ecosystem: "npm",
244
+ reason: "HTTP request signing with classical RSA/ECDSA keys.",
245
+ algorithms: ["RSA", "ECDSA"],
246
+ severity: "medium",
247
+ },
248
+ {
249
+ name: "libsodium-wrappers",
250
+ ecosystem: "npm",
251
+ reason: "libsodium: Ed25519 signatures and X25519 key exchange (classical).",
252
+ algorithms: ["EdDSA", "X25519"],
253
+ severity: "medium",
254
+ },
255
+ {
256
+ name: "ecdsa-sig-formatter",
257
+ ecosystem: "npm",
258
+ reason: "Formats ECDSA signatures — a marker of classical EC signing.",
259
+ algorithms: ["ECDSA"],
260
+ severity: "low",
261
+ },
157
262
  ];
158
263
 
159
264
  /** Fast lookup map by package name. */
package/src/inventory.ts CHANGED
@@ -33,10 +33,16 @@ function penaltyFor(weight: number, occurrence: number): number {
33
33
  return weight / Math.sqrt(occurrence);
34
34
  }
35
35
 
36
+ /** Decay constant for the readiness score (larger = more forgiving). */
37
+ const SCORE_SCALE = 100;
38
+
36
39
  /**
37
- * Compute a 0–100 readiness score. Starts at 100 and subtracts severity-weighted
38
- * penalties with diminishing returns per severity bucket. 100 means no classical
39
- * asymmetric crypto was found; the score is clamped to [0, 100].
40
+ * Compute a 0–100 readiness score. 100 means no classical asymmetric crypto was
41
+ * found. Findings accrue a severity-weighted penalty (with per-bucket diminishing
42
+ * returns), then the score is `100 * e^(-penalty/scale)`. Exponential decay keeps
43
+ * the score responsive across the whole range — fixing findings always raises it,
44
+ * and a large legacy repo lands low without pinning flat at 0 (which made progress
45
+ * invisible under the old linear model). Tuned so one low ~97, one critical ~74.
40
46
  */
41
47
  export function readinessScore(findings: Finding[]): number {
42
48
  if (findings.length === 0) return 100;
@@ -49,13 +55,13 @@ export function readinessScore(findings: Finding[]): number {
49
55
  info: 0,
50
56
  };
51
57
 
52
- let score = 100;
58
+ let penalty = 0;
53
59
  for (const f of findings) {
54
60
  seen[f.severity] += 1;
55
- score -= penaltyFor(SEVERITY_WEIGHT[f.severity], seen[f.severity]);
61
+ penalty += penaltyFor(SEVERITY_WEIGHT[f.severity], seen[f.severity]);
56
62
  }
57
63
 
58
- return Math.max(0, Math.min(100, Math.round(score)));
64
+ return Math.max(0, Math.min(100, Math.round(100 * Math.exp(-penalty / SCORE_SCALE))));
59
65
  }
60
66
 
61
67
  /** Build the full inventory (counts + HNDL + score) from a set of findings. */
package/src/version.ts CHANGED
@@ -3,4 +3,4 @@
3
3
  * the scan orchestrator can import it without creating a cycle through index.ts.
4
4
  * Keep in sync with packages/core/package.json.
5
5
  */
6
- export const VERSION = "0.2.1";
6
+ export const VERSION = "0.2.2";