@quantakrypto/core 0.2.1 → 0.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (58) hide show
  1. package/dist/dependencies.d.ts.map +1 -1
  2. package/dist/dependencies.js +105 -0
  3. package/dist/dependencies.js.map +1 -1
  4. package/dist/detect-utils.d.ts +26 -1
  5. package/dist/detect-utils.d.ts.map +1 -1
  6. package/dist/detect-utils.js +26 -0
  7. package/dist/detect-utils.js.map +1 -1
  8. package/dist/detectors/pem.d.ts +4 -0
  9. package/dist/detectors/pem.d.ts.map +1 -1
  10. package/dist/detectors/pem.js +113 -91
  11. package/dist/detectors/pem.js.map +1 -1
  12. package/dist/detectors/source.d.ts +9 -2
  13. package/dist/detectors/source.d.ts.map +1 -1
  14. package/dist/detectors/source.js +366 -265
  15. package/dist/detectors/source.js.map +1 -1
  16. package/dist/index.d.ts +1 -0
  17. package/dist/index.d.ts.map +1 -1
  18. package/dist/index.js +1 -1
  19. package/dist/index.js.map +1 -1
  20. package/dist/inventory.d.ts +6 -3
  21. package/dist/inventory.d.ts.map +1 -1
  22. package/dist/inventory.js +11 -6
  23. package/dist/inventory.js.map +1 -1
  24. package/dist/parallel.d.ts.map +1 -1
  25. package/dist/parallel.js +2 -0
  26. package/dist/parallel.js.map +1 -1
  27. package/dist/registry.d.ts +16 -1
  28. package/dist/registry.d.ts.map +1 -1
  29. package/dist/registry.js +31 -0
  30. package/dist/registry.js.map +1 -1
  31. package/dist/report.d.ts +9 -1
  32. package/dist/report.d.ts.map +1 -1
  33. package/dist/report.js +56 -23
  34. package/dist/report.js.map +1 -1
  35. package/dist/scan-worker.js +1 -1
  36. package/dist/scan-worker.js.map +1 -1
  37. package/dist/scan.d.ts +1 -1
  38. package/dist/scan.d.ts.map +1 -1
  39. package/dist/scan.js +8 -2
  40. package/dist/scan.js.map +1 -1
  41. package/dist/types.d.ts +53 -0
  42. package/dist/types.d.ts.map +1 -1
  43. package/dist/version.d.ts +1 -1
  44. package/dist/version.js +1 -1
  45. package/package.json +1 -1
  46. package/src/dependencies.ts +105 -0
  47. package/src/detect-utils.ts +57 -1
  48. package/src/detectors/pem.ts +124 -105
  49. package/src/detectors/source.ts +466 -343
  50. package/src/index.ts +2 -1
  51. package/src/inventory.ts +12 -6
  52. package/src/parallel.ts +9 -1
  53. package/src/registry.ts +39 -1
  54. package/src/report.ts +79 -23
  55. package/src/scan-worker.ts +12 -5
  56. package/src/scan.ts +19 -5
  57. package/src/types.ts +54 -0
  58. package/src/version.ts +1 -1
package/dist/scan.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"scan.js","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,SAAS,GAAe,CAAC,GAAG,eAAe,EAAE,WAAW,CAAC,CAAC;AAEvE,8EAA8E;AAC9E,MAAM,UAAU,eAAe,CAAC,CAAU,EAAE,CAAU;IACpD,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;IAClF,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,sFAAsF;AACtF,SAAS,gBAAgB,CAAC,OAAoB;IAC5C,OAAO,OAAO,CAAC,SAAS,IAAI,eAAe,CAAC,GAAG,EAAE,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CACxB,IAAY,EACZ,OAAe,EACf,IAAyB,EACzB,OAA4D;IAE5D,MAAM,GAAG,GAAc,EAAE,CAAC;IAE1B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC;QACjD,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM;YAAE,SAAS;QAC3D,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAoB;IAC7C,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAE7B,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;IAC1C,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC;IACnD,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAEvC,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACvE,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEvE,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,8EAA8E;IAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAElC,+EAA+E;IAC/E,MAAM,QAAQ,GAA0B,OAAO,CAAC,KAAK;QACnD,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;QAC7C,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE;YACtB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,CAAC;IAEP,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QACjC,4EAA4E;QAC5E,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,UAAU,EAAE,CAAC;QAE5C,4DAA4D;QAC5D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,YAAY,IAAI,QAAQ,EAAE,CAAC;YAC7D,MAAM,IAAI,mBAAmB,CAAC,oCAAoC,QAAQ,IAAI,CAAC,CAAC;QAClF,CAAC;QAED,4EAA4E;QAC5E,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACtF,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAEzD,OAAO,CAAC,MAAM,EAAE,CAAC,YAAY,CAAC,CAAC;QAE/B,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,qCAAqC;QACjD,CAAC;QAED,yEAAyE;QACzE,yEAAyE;QACzE,IAAI,CAAC,YAAY,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7E,SAAS;QACX,CAAC;QAED,6EAA6E;QAC7E,YAAY,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,YAAY,GAAG,QAAQ,EAAE,CAAC;YAC5D,MAAM,IAAI,mBAAmB,CAAC,oCAAoC,QAAQ,IAAI,CAAC,CAAC;QAClF,CAAC;QAED,YAAY,IAAI,CAAC,CAAC;QAClB,QAAQ,CAAC,IAAI,CACX,GAAG,UAAU,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE;YACzC,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,MAAM;SACb,CAAC,CACH,CAAC;IACJ,CAAC;IAED,oDAAoD;IACpD,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAE/B,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;IAE9B,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ;QACR,YAAY;QACZ,SAAS;QACT,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;QAClC,UAAU,EAAE,UAAU,CAAC,WAAW,EAAE;QACpC,WAAW,EAAE,OAAO;KACrB,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAwB,EACxB,OAAiD;IAEjD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC;SACpB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACZ,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACzB,IAAI,YAAY,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACpC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAClE,IAAI,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,kFAAkF;AAClF,KAAK,SAAS,CAAC,CAAC,mBAAmB,CAAC,KAAe,EAAE,OAAoB;IACvE,KAAK,MAAM,GAAG,IAAI,sBAAsB,CAAC,KAAK,EAAE,OAAO,CAAC;QAAE,MAAM,GAAG,CAAC;AACtE,CAAC;AAED,+EAA+E;AAC/E,SAAS,UAAU,CAAC,GAAW,EAAE,QAA2B;IAC1D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACjC,IAAI,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
1
+ {"version":3,"file":"scan.js","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,SAAS,GAAe,CAAC,GAAG,eAAe,EAAE,WAAW,CAAC,CAAC;AAEvE,8EAA8E;AAC9E,MAAM,UAAU,eAAe,CAAC,CAAU,EAAE,CAAU;IACpD,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;IAClF,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,sFAAsF;AACtF,SAAS,gBAAgB,CAAC,OAAoB;IAC5C,OAAO,OAAO,CAAC,SAAS,IAAI,eAAe,CAAC,GAAG,EAAE,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CACxB,IAAY,EACZ,OAAe,EACf,IAAyB,EACzB,OAA4D,EAC5D,aAAiC;IAEjC,MAAM,GAAG,GAAc,EAAE,CAAC;IAE1B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC;QACjD,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM;YAAE,SAAS;QAC3D,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,8EAA8E;IAC9E,qEAAqE;IACrE,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;QACxC,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAoB;IAC7C,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAE7B,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;IAC1C,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC;IACnD,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAEvC,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACvE,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEvE,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,8EAA8E;IAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAElC,+EAA+E;IAC/E,MAAM,QAAQ,GAA0B,OAAO,CAAC,KAAK;QACnD,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;QAC7C,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE;YACtB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,CAAC;IAEP,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QACjC,4EAA4E;QAC5E,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,UAAU,EAAE,CAAC;QAE5C,4DAA4D;QAC5D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,YAAY,IAAI,QAAQ,EAAE,CAAC;YAC7D,MAAM,IAAI,mBAAmB,CAAC,oCAAoC,QAAQ,IAAI,CAAC,CAAC;QAClF,CAAC;QAED,4EAA4E;QAC5E,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACtF,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAEzD,OAAO,CAAC,MAAM,EAAE,CAAC,YAAY,CAAC,CAAC;QAE/B,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,qCAAqC;QACjD,CAAC;QAED,yEAAyE;QACzE,yEAAyE;QACzE,IAAI,CAAC,YAAY,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7E,SAAS;QACX,CAAC;QAED,6EAA6E;QAC7E,YAAY,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,YAAY,GAAG,QAAQ,EAAE,CAAC;YAC5D,MAAM,IAAI,mBAAmB,CAAC,oCAAoC,QAAQ,IAAI,CAAC,CAAC;QAClF,CAAC;QAED,YAAY,IAAI,CAAC,CAAC;QAClB,QAAQ,CAAC,IAAI,CACX,GAAG,UAAU,CACX,YAAY,EACZ,OAAO,EACP,IAAI,EACJ;YACE,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,MAAM;SACb,EACD,OAAO,CAAC,aAAa,CACtB,CACF,CAAC;IACJ,CAAC;IAED,oDAAoD;IACpD,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAE/B,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;IAE9B,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ;QACR,YAAY;QACZ,SAAS;QACT,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;QAClC,UAAU,EAAE,UAAU,CAAC,WAAW,EAAE;QACpC,WAAW,EAAE,OAAO;KACrB,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAwB,EACxB,OAAiD;IAEjD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC;SACpB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACZ,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACzB,IAAI,YAAY,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACpC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAClE,IAAI,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,kFAAkF;AAClF,KAAK,SAAS,CAAC,CAAC,mBAAmB,CAAC,KAAe,EAAE,OAAoB;IACvE,KAAK,MAAM,GAAG,IAAI,sBAAsB,CAAC,KAAK,EAAE,OAAO,CAAC;QAAE,MAAM,GAAG,CAAC;AACtE,CAAC;AAED,+EAA+E;AAC/E,SAAS,UAAU,CAAC,GAAW,EAAE,QAA2B;IAC1D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACjC,IAAI,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
package/dist/types.d.ts CHANGED
@@ -73,6 +73,45 @@ export type DetectorScope = "source" | "config";
73
73
  * detector is language-agnostic (e.g. PEM material, config files).
74
74
  */
75
75
  export type DetectorLanguage = "js" | "python" | "go" | "java" | "any";
76
+ /**
77
+ * Declarative metadata for a single rule a detector can emit. This is the
78
+ * catalog entry: the stable, queryable description of a rule keyed by the
79
+ * `ruleId` it stamps onto findings. It is the single source of truth for a
80
+ * rule's title / severity / category / remediation, consumed by the SARIF
81
+ * `rules[]` block, the MCP `explain_finding` resolver, and future per-rule
82
+ * enable/disable + language-pack work.
83
+ *
84
+ * For most rules the metadata is fixed and `detect()` builds findings straight
85
+ * from it (see `findingFromRule`). A few rules are inherently multi-variant
86
+ * (e.g. `node-crypto-keygen` spans RSA/EC/DSA/DH/Ed25519 at different
87
+ * severities); for those the metadata here is a REPRESENTATIVE umbrella and
88
+ * `detect()` refines the per-finding fields at match time. The catalog always
89
+ * enumerates every emittable ruleId regardless.
90
+ */
91
+ export interface RuleMeta {
92
+ /** Stable rule id — matches {@link Finding.ruleId}. Unique across the catalog. */
93
+ id: string;
94
+ /** Canonical human title. */
95
+ title: string;
96
+ category: FindingCategory;
97
+ severity: Severity;
98
+ /** Default confidence for findings of this rule. */
99
+ confidence: Confidence;
100
+ /** Harvest-now-decrypt-later exposure. */
101
+ hndl: boolean;
102
+ /** Representative classical algorithm family; refined per-finding when it varies. */
103
+ algorithm?: AlgorithmFamily;
104
+ /** Associated CWE identifier (e.g. "CWE-327"). */
105
+ cwe?: string;
106
+ /** Suggested post-quantum remediation. When omitted, derived from {@link algorithm}. */
107
+ remediation?: string;
108
+ /** Canonical one-line human explanation; may be refined per-finding. */
109
+ message: string;
110
+ /** True when this rule's matched snippet IS sensitive key material. */
111
+ sensitive?: boolean;
112
+ /** Short description of what the rule detects (for catalog / MCP surfaces). */
113
+ description?: string;
114
+ }
76
115
  /** A pluggable source detector. Detectors are pure and stateless. */
77
116
  export interface Detector {
78
117
  /** Unique id, used as the Finding.ruleId prefix space. */
@@ -90,6 +129,13 @@ export interface Detector {
90
129
  * Defaults to `"js"` when omitted.
91
130
  */
92
131
  language?: DetectorLanguage;
132
+ /**
133
+ * The rules this detector can emit, as declarative metadata. Together across
134
+ * all detectors these form the rule catalog ({@link DetectorRegistry.ruleCatalog}).
135
+ * Optional for backward compatibility with externally-defined detectors, but
136
+ * all built-in detectors declare it.
137
+ */
138
+ rules?: RuleMeta[];
93
139
  /** Whether this detector should run against the given file path. */
94
140
  appliesTo(filePath: string): boolean;
95
141
  /** Inspect a single file's contents and return zero or more findings. */
@@ -140,6 +186,13 @@ export interface ScanOptions {
140
186
  * registry's detectors are used.
141
187
  */
142
188
  detectors?: Detector[];
189
+ /**
190
+ * Rule ids to suppress. Any finding whose `ruleId` is listed here is dropped
191
+ * after detection. Serializable (a plain string array), so it is honoured on
192
+ * both the serial and the worker-thread (`scanParallel`) paths. See the rule
193
+ * catalog ({@link DetectorRegistry.ruleCatalog}) for the valid ids.
194
+ */
195
+ disabledRules?: string[];
143
196
  /** Optional progress callback. */
144
197
  onFile?: (file: string) => void;
145
198
  /**
@@ -1 +1 @@
1
- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,6DAA6D;AAC7D,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAEvE,gFAAgF;AAChF,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEnD,+DAA+D;AAC/D,MAAM,MAAM,eAAe,GACvB,KAAK,GACL,cAAc,GACd,WAAW,GACX,KAAK,GACL,aAAa,GACb,YAAY,GACZ,MAAM,GACN,KAAK,CAAC;AAEV,yEAAyE;AACzE,MAAM,MAAM,eAAe,GACvB,KAAK,GACL,MAAM,GACN,OAAO,GACP,OAAO,GACP,IAAI,GACJ,KAAK,GACL,QAAQ,GACR,MAAM,GACN,OAAO,GACP,SAAS,CAAC;AAEd,gDAAgD;AAChD,MAAM,WAAW,cAAc;IAC7B,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,iCAAiC;AACjC,MAAM,WAAW,OAAO;IACtB,uGAAuG;IACvG,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,QAAQ,CAAC;IACnB,UAAU,EAAE,UAAU,CAAC;IACvB,yDAAyD;IACzD,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,iEAAiE;IACjE,IAAI,EAAE,OAAO,CAAC;IACd,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAED,mDAAmD;AACnD,MAAM,WAAW,oBAAoB;IACnC,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,KAAK,CAAC;IACjB,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEhD;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,GAAG,QAAQ,GAAG,IAAI,GAAG,MAAM,GAAG,KAAK,CAAC;AAEvE,qEAAqE;AACrE,MAAM,WAAW,QAAQ;IACvB,0DAA0D;IAC1D,EAAE,EAAE,MAAM,CAAC;IACX,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,oEAAoE;IACpE,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IACrC,yEAAyE;IACzE,MAAM,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,aAAa;IAC5B,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,kCAAkC;AAClC,MAAM,WAAW,WAAW;IAC1B,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,gEAAgE;IAChE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,mFAAmF;IACnF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;OAGG;IACH,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;IACvB,kCAAkC;IAClC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC;;;;OAIG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,gFAAgF;AAChF,MAAM,WAAW,mBAAoB,SAAQ,WAAW;IACtD;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,kFAAkF;IAClF,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,yDAAyD;AACzD,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrC,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,iCAAiC;AACjC,MAAM,WAAW,UAAU;IACzB,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,eAAe,CAAC;IAC3B,sBAAsB;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,iDAAiD;AACjD,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;AAEtD,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,eAAe,CAAC;IAC3B,gFAAgF;IAChF,cAAc,EAAE,MAAM,CAAC;IACvB,wBAAwB;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB"}
1
+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,6DAA6D;AAC7D,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAEvE,gFAAgF;AAChF,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEnD,+DAA+D;AAC/D,MAAM,MAAM,eAAe,GACvB,KAAK,GACL,cAAc,GACd,WAAW,GACX,KAAK,GACL,aAAa,GACb,YAAY,GACZ,MAAM,GACN,KAAK,CAAC;AAEV,yEAAyE;AACzE,MAAM,MAAM,eAAe,GACvB,KAAK,GACL,MAAM,GACN,OAAO,GACP,OAAO,GACP,IAAI,GACJ,KAAK,GACL,QAAQ,GACR,MAAM,GACN,OAAO,GACP,SAAS,CAAC;AAEd,gDAAgD;AAChD,MAAM,WAAW,cAAc;IAC7B,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,iCAAiC;AACjC,MAAM,WAAW,OAAO;IACtB,uGAAuG;IACvG,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,QAAQ,CAAC;IACnB,UAAU,EAAE,UAAU,CAAC;IACvB,yDAAyD;IACzD,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,iEAAiE;IACjE,IAAI,EAAE,OAAO,CAAC;IACd,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAED,mDAAmD;AACnD,MAAM,WAAW,oBAAoB;IACnC,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,KAAK,CAAC;IACjB,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEhD;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,GAAG,QAAQ,GAAG,IAAI,GAAG,MAAM,GAAG,KAAK,CAAC;AAEvE;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,QAAQ;IACvB,kFAAkF;IAClF,EAAE,EAAE,MAAM,CAAC;IACX,6BAA6B;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,QAAQ,CAAC;IACnB,oDAAoD;IACpD,UAAU,EAAE,UAAU,CAAC;IACvB,0CAA0C;IAC1C,IAAI,EAAE,OAAO,CAAC;IACd,qFAAqF;IACrF,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,kDAAkD;IAClD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,qEAAqE;AACrE,MAAM,WAAW,QAAQ;IACvB,0DAA0D;IAC1D,EAAE,EAAE,MAAM,CAAC;IACX,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B;;;;;OAKG;IACH,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IACnB,oEAAoE;IACpE,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IACrC,yEAAyE;IACzE,MAAM,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,aAAa;IAC5B,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,kCAAkC;AAClC,MAAM,WAAW,WAAW;IAC1B,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,gEAAgE;IAChE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,mFAAmF;IACnF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;OAGG;IACH,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;IACvB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,kCAAkC;IAClC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC;;;;OAIG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,gFAAgF;AAChF,MAAM,WAAW,mBAAoB,SAAQ,WAAW;IACtD;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,kFAAkF;IAClF,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,yDAAyD;AACzD,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrC,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,iCAAiC;AACjC,MAAM,WAAW,UAAU;IACzB,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,eAAe,CAAC;IAC3B,sBAAsB;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,iDAAiD;AACjD,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;AAEtD,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,eAAe,CAAC;IAC3B,gFAAgF;IAChF,cAAc,EAAE,MAAM,CAAC;IACvB,wBAAwB;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB"}
package/dist/version.d.ts CHANGED
@@ -3,5 +3,5 @@
3
3
  * the scan orchestrator can import it without creating a cycle through index.ts.
4
4
  * Keep in sync with packages/core/package.json.
5
5
  */
6
- export declare const VERSION = "0.2.1";
6
+ export declare const VERSION = "0.3.0";
7
7
  //# sourceMappingURL=version.d.ts.map
package/dist/version.js CHANGED
@@ -3,5 +3,5 @@
3
3
  * the scan orchestrator can import it without creating a cycle through index.ts.
4
4
  * Keep in sync with packages/core/package.json.
5
5
  */
6
- export const VERSION = "0.2.1";
6
+ export const VERSION = "0.3.0";
7
7
  //# sourceMappingURL=version.js.map
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@quantakrypto/core",
3
- "version": "0.2.1",
3
+ "version": "0.3.0",
4
4
  "description": "Shared post-quantum readiness library: crypto detectors, vulnerable-dependency database, inventory + SARIF reporting. Zero runtime dependencies.",
5
5
  "license": "Apache-2.0",
6
6
  "author": "Dandelion Labs <hello@dandelionlabs.io> (https://dandelionlabs.io)",
@@ -154,6 +154,111 @@ export const vulnerableDependencies: VulnerableDependency[] = [
154
154
  algorithms: ["RSA"],
155
155
  severity: "high",
156
156
  },
157
+ {
158
+ name: "ethers",
159
+ ecosystem: "npm",
160
+ reason: "Ethereum library built on secp256k1 ECDSA signing and key derivation.",
161
+ algorithms: ["ECDSA"],
162
+ severity: "high",
163
+ },
164
+ {
165
+ name: "web3",
166
+ ecosystem: "npm",
167
+ reason: "Ethereum library using secp256k1 ECDSA for accounts and signing.",
168
+ algorithms: ["ECDSA"],
169
+ severity: "high",
170
+ },
171
+ {
172
+ name: "bitcoinjs-lib",
173
+ ecosystem: "npm",
174
+ reason: "Bitcoin library built on secp256k1 ECDSA/Schnorr keys and signatures.",
175
+ algorithms: ["ECDSA"],
176
+ severity: "high",
177
+ },
178
+ {
179
+ name: "ethereumjs-util",
180
+ ecosystem: "npm",
181
+ reason: "secp256k1 ECDSA utilities for Ethereum keys and signatures.",
182
+ algorithms: ["ECDSA"],
183
+ severity: "medium",
184
+ },
185
+ {
186
+ name: "openpgp",
187
+ ecosystem: "npm",
188
+ reason: "OpenPGP.js: RSA, ECDSA, ECDH, and EdDSA public-key crypto.",
189
+ algorithms: ["RSA", "ECDSA", "ECDH", "EdDSA"],
190
+ severity: "high",
191
+ },
192
+ {
193
+ name: "node-jose",
194
+ ecosystem: "npm",
195
+ reason: "JOSE (JWS/JWE/JWK) with classical RSA and EC algorithms.",
196
+ algorithms: ["RSA", "ECDSA", "ECDH"],
197
+ severity: "high",
198
+ },
199
+ {
200
+ name: "jwa",
201
+ ecosystem: "npm",
202
+ reason: "JSON Web Algorithms: RSA (RS/PS) and EC (ES) signatures.",
203
+ algorithms: ["RSA", "ECDSA"],
204
+ severity: "medium",
205
+ },
206
+ {
207
+ name: "jwk-to-pem",
208
+ ecosystem: "npm",
209
+ reason: "Converts RSA/EC JWKs to PEM — classical public keys.",
210
+ algorithms: ["RSA", "ECDSA"],
211
+ severity: "medium",
212
+ },
213
+ {
214
+ name: "fast-jwt",
215
+ ecosystem: "npm",
216
+ reason: "JWT signing/verification with classical RS/PS/ES algorithms.",
217
+ algorithms: ["RSA", "ECDSA"],
218
+ severity: "medium",
219
+ },
220
+ {
221
+ name: "ssh2",
222
+ ecosystem: "npm",
223
+ reason: "SSH client/server using classical RSA/ECDSA/Ed25519 host and user keys.",
224
+ algorithms: ["RSA", "ECDSA", "EdDSA"],
225
+ severity: "high",
226
+ },
227
+ {
228
+ name: "@peculiar/x509",
229
+ ecosystem: "npm",
230
+ reason: "X.509 certificate library over classical RSA/EC keys.",
231
+ algorithms: ["RSA", "ECDSA"],
232
+ severity: "medium",
233
+ },
234
+ {
235
+ name: "pkijs",
236
+ ecosystem: "npm",
237
+ reason: "PKI (X.509/CMS) built on classical RSA and EC public-key crypto.",
238
+ algorithms: ["RSA", "ECDSA", "ECDH"],
239
+ severity: "medium",
240
+ },
241
+ {
242
+ name: "http-signature",
243
+ ecosystem: "npm",
244
+ reason: "HTTP request signing with classical RSA/ECDSA keys.",
245
+ algorithms: ["RSA", "ECDSA"],
246
+ severity: "medium",
247
+ },
248
+ {
249
+ name: "libsodium-wrappers",
250
+ ecosystem: "npm",
251
+ reason: "libsodium: Ed25519 signatures and X25519 key exchange (classical).",
252
+ algorithms: ["EdDSA", "X25519"],
253
+ severity: "medium",
254
+ },
255
+ {
256
+ name: "ecdsa-sig-formatter",
257
+ ecosystem: "npm",
258
+ reason: "Formats ECDSA signatures — a marker of classical EC signing.",
259
+ algorithms: ["ECDSA"],
260
+ severity: "low",
261
+ },
157
262
  ];
158
263
 
159
264
  /** Fast lookup map by package name. */
@@ -3,7 +3,14 @@
3
3
  * into a 1-based line/column, extracting a trimmed single-line snippet, and a
4
4
  * small factory for building Finding objects with consistent remediation text.
5
5
  */
6
- import type { AlgorithmFamily, Confidence, Finding, FindingCategory, Severity } from "./types.js";
6
+ import type {
7
+ AlgorithmFamily,
8
+ Confidence,
9
+ Finding,
10
+ FindingCategory,
11
+ RuleMeta,
12
+ Severity,
13
+ } from "./types.js";
7
14
  import { remediationText } from "./remediation.js";
8
15
 
9
16
  /** A 1-based line/column position derived from a character offset. */
@@ -104,6 +111,55 @@ export function makeFinding(spec: FindingSpec): Finding {
104
111
  return finding;
105
112
  }
106
113
 
114
+ /** Where a match occurred, plus optional per-finding field overrides. */
115
+ export interface RuleMatch {
116
+ file: string;
117
+ content: string;
118
+ /** Match start offset within `content`. */
119
+ index: number;
120
+ /** Length of the match (used to compute endLine for multi-line matches). */
121
+ matchLength?: number;
122
+ }
123
+
124
+ /**
125
+ * Fields of a {@link RuleMeta} a detector may refine at match time. Multi-variant
126
+ * rules (e.g. key generation across algorithm families) override these; fixed
127
+ * rules pass none and inherit the catalog metadata verbatim.
128
+ */
129
+ export type RuleOverrides = Partial<
130
+ Pick<
131
+ RuleMeta,
132
+ "title" | "category" | "severity" | "confidence" | "algorithm" | "hndl" | "message" | "cwe"
133
+ >
134
+ > & { remediation?: string };
135
+
136
+ /**
137
+ * Build a {@link Finding} from a rule's catalog metadata plus a match location,
138
+ * applying any per-finding overrides. This is the single construction path for
139
+ * detector findings: the invariant fields (title/severity/category/…) live once
140
+ * in the {@link RuleMeta} declaration, so they can't drift from what the SARIF
141
+ * catalog and the MCP resolver report.
142
+ */
143
+ export function findingFromRule(rule: RuleMeta, at: RuleMatch, overrides?: RuleOverrides): Finding {
144
+ return makeFinding({
145
+ ruleId: rule.id,
146
+ title: overrides?.title ?? rule.title,
147
+ category: overrides?.category ?? rule.category,
148
+ severity: overrides?.severity ?? rule.severity,
149
+ confidence: overrides?.confidence ?? rule.confidence,
150
+ algorithm: overrides?.algorithm ?? rule.algorithm,
151
+ hndl: overrides?.hndl ?? rule.hndl,
152
+ cwe: overrides?.cwe ?? rule.cwe,
153
+ remediation: overrides?.remediation ?? rule.remediation,
154
+ sensitive: rule.sensitive,
155
+ message: overrides?.message ?? rule.message,
156
+ file: at.file,
157
+ content: at.content,
158
+ index: at.index,
159
+ matchLength: at.matchLength,
160
+ });
161
+ }
162
+
107
163
  /** True if `filePath` has one of the given (lower-case, dotted) extensions. */
108
164
  export function hasExtension(filePath: string, exts: readonly string[]): boolean {
109
165
  const lower = filePath.toLowerCase();
@@ -2,131 +2,160 @@
2
2
  * Config / certificate detector: finds PEM-encoded cryptographic material in
3
3
  * any text file (source, config, .pem, .key, .crt, .env, …). This catches
4
4
  * embedded private keys and X.509 certificates regardless of language.
5
+ *
6
+ * Every rule's metadata lives in the {@link RuleMeta} declaration below (the
7
+ * catalog entry); `detect()` builds findings straight from it via
8
+ * `findingFromRule`. All PEM findings are high-confidence exact-marker matches.
5
9
  */
6
- import type { Detector, Finding } from "../types.js";
7
- import { eachMatch, makeFinding } from "../detect-utils.js";
10
+ import type { Detector, Finding, RuleMeta } from "../types.js";
11
+ import { eachMatch, findingFromRule } from "../detect-utils.js";
8
12
  import { CWE_BROKEN_CRYPTO, CWE_HARDCODED_KEY } from "../cwe.js";
9
13
 
14
+ /** A PEM rule: its catalog metadata plus the begin-marker regex that triggers it. */
10
15
  interface PemRule {
11
16
  /** Regex matching the PEM begin marker. */
12
17
  re: RegExp;
13
- ruleId: string;
14
- title: string;
15
- category: Finding["category"];
16
- severity: Finding["severity"];
17
- algorithm?: Finding["algorithm"];
18
- message: string;
19
- remediation: string;
20
- hndl: boolean;
21
- cwe: string;
22
- /** True when the matched snippet IS key material (reporters drop the snippet). */
23
- sensitive?: boolean;
18
+ meta: RuleMeta;
24
19
  }
25
20
 
26
21
  const PEM_RULES: PemRule[] = [
27
22
  {
28
23
  re: /-----BEGIN RSA PRIVATE KEY-----/g,
29
- ruleId: "pem-rsa-private-key",
30
- title: "RSA private key (PEM)",
31
- category: "certificate",
32
- severity: "critical",
33
- algorithm: "RSA",
34
- hndl: true,
35
- cwe: CWE_HARDCODED_KEY,
36
- sensitive: true,
37
- message: "Embedded RSA private key (PKCS#1 PEM); classical and not quantum-safe.",
38
- remediation: "Migrate to ML-DSA / ML-KEM keys and remove embedded private keys from source.",
24
+ meta: {
25
+ id: "pem-rsa-private-key",
26
+ title: "RSA private key (PEM)",
27
+ description: "PKCS#1 RSA private key block",
28
+ category: "certificate",
29
+ severity: "critical",
30
+ confidence: "high",
31
+ algorithm: "RSA",
32
+ hndl: true,
33
+ cwe: CWE_HARDCODED_KEY,
34
+ sensitive: true,
35
+ message: "Embedded RSA private key (PKCS#1 PEM); classical and not quantum-safe.",
36
+ remediation: "Migrate to ML-DSA / ML-KEM keys and remove embedded private keys from source.",
37
+ },
39
38
  },
40
39
  {
41
40
  re: /-----BEGIN EC PRIVATE KEY-----/g,
42
- ruleId: "pem-ec-private-key",
43
- title: "EC private key (PEM)",
44
- category: "certificate",
45
- severity: "critical",
46
- algorithm: "ECDSA",
47
- hndl: true,
48
- cwe: CWE_HARDCODED_KEY,
49
- sensitive: true,
50
- message: "Embedded EC private key (SEC1 PEM); classical ECDSA/ECDH key, not quantum-safe.",
51
- remediation: "Migrate to ML-DSA (FIPS 204) keys and remove embedded private keys from source.",
41
+ meta: {
42
+ id: "pem-ec-private-key",
43
+ title: "EC private key (PEM)",
44
+ description: "SEC1 EC private key block",
45
+ category: "certificate",
46
+ severity: "critical",
47
+ confidence: "high",
48
+ algorithm: "ECDSA",
49
+ hndl: true,
50
+ cwe: CWE_HARDCODED_KEY,
51
+ sensitive: true,
52
+ message: "Embedded EC private key (SEC1 PEM); classical ECDSA/ECDH key, not quantum-safe.",
53
+ remediation:
54
+ "Migrate to ML-DSA (FIPS 204) keys and remove embedded private keys from source.",
55
+ },
52
56
  },
53
57
  {
54
58
  re: /-----BEGIN DSA PRIVATE KEY-----/g,
55
- ruleId: "pem-dsa-private-key",
56
- title: "DSA private key (PEM)",
57
- category: "certificate",
58
- severity: "critical",
59
- algorithm: "DSA",
60
- hndl: false,
61
- cwe: CWE_HARDCODED_KEY,
62
- sensitive: true,
63
- message: "Embedded DSA private key (PEM); classical, already deprecated, and not quantum-safe.",
64
- remediation: "Rotate immediately (DSA is deprecated) and migrate to ML-DSA-65 (FIPS 204).",
59
+ meta: {
60
+ id: "pem-dsa-private-key",
61
+ title: "DSA private key (PEM)",
62
+ description: "DSA private key block",
63
+ category: "certificate",
64
+ severity: "critical",
65
+ confidence: "high",
66
+ algorithm: "DSA",
67
+ hndl: false,
68
+ cwe: CWE_HARDCODED_KEY,
69
+ sensitive: true,
70
+ message:
71
+ "Embedded DSA private key (PEM); classical, already deprecated, and not quantum-safe.",
72
+ remediation: "Rotate immediately (DSA is deprecated) and migrate to ML-DSA-65 (FIPS 204).",
73
+ },
65
74
  },
66
75
  {
67
76
  re: /-----BEGIN OPENSSH PRIVATE KEY-----/g,
68
- ruleId: "pem-openssh-private-key",
69
- title: "OpenSSH private key",
70
- category: "certificate",
71
- severity: "critical",
72
- algorithm: "unknown",
73
- hndl: true,
74
- cwe: CWE_HARDCODED_KEY,
75
- sensitive: true,
76
- message: "Embedded OpenSSH private key (RSA/ECDSA/Ed25519); classical and not quantum-safe.",
77
- remediation: "Rotate the key; plan migration to PQC-capable SSH (e.g. sntrup761x25519).",
77
+ meta: {
78
+ id: "pem-openssh-private-key",
79
+ title: "OpenSSH private key",
80
+ description: "OpenSSH private key block",
81
+ category: "certificate",
82
+ severity: "critical",
83
+ confidence: "high",
84
+ algorithm: "unknown",
85
+ hndl: true,
86
+ cwe: CWE_HARDCODED_KEY,
87
+ sensitive: true,
88
+ message: "Embedded OpenSSH private key (RSA/ECDSA/Ed25519); classical and not quantum-safe.",
89
+ remediation: "Rotate the key; plan migration to PQC-capable SSH (e.g. sntrup761x25519).",
90
+ },
78
91
  },
79
92
  {
80
93
  re: /-----BEGIN PGP PRIVATE KEY BLOCK-----/g,
81
- ruleId: "pem-pgp-private-key",
82
- title: "PGP/GPG private key block",
83
- category: "certificate",
84
- severity: "critical",
85
- algorithm: "unknown",
86
- hndl: true,
87
- cwe: CWE_HARDCODED_KEY,
88
- sensitive: true,
89
- message:
90
- "Embedded PGP/GPG private key block (RSA/ECDSA/EdDSA/ElGamal); classical and not quantum-safe.",
91
- remediation: "Rotate the key; track OpenPGP PQC drafts for migration.",
94
+ meta: {
95
+ id: "pem-pgp-private-key",
96
+ title: "PGP/GPG private key block",
97
+ description: "OpenPGP private key block",
98
+ category: "certificate",
99
+ severity: "critical",
100
+ confidence: "high",
101
+ algorithm: "unknown",
102
+ hndl: true,
103
+ cwe: CWE_HARDCODED_KEY,
104
+ sensitive: true,
105
+ message:
106
+ "Embedded PGP/GPG private key block (RSA/ECDSA/EdDSA/ElGamal); classical and not quantum-safe.",
107
+ remediation: "Rotate the key; track OpenPGP PQC drafts for migration.",
108
+ },
92
109
  },
93
110
  {
94
111
  re: /-----BEGIN PGP MESSAGE-----/g,
95
- ruleId: "pem-pgp-message",
96
- title: "PGP/GPG encrypted message",
97
- category: "certificate",
98
- severity: "low",
99
- algorithm: "unknown",
100
- hndl: true,
101
- cwe: CWE_BROKEN_CRYPTO,
102
- message:
103
- "Embedded PGP/GPG message; likely encrypted with classical RSA/ElGamal (harvest-now-decrypt-later).",
104
- remediation: "Re-encrypt with PQC-capable tooling as OpenPGP PQC profiles mature.",
112
+ meta: {
113
+ id: "pem-pgp-message",
114
+ title: "PGP/GPG encrypted message",
115
+ description: "OpenPGP encrypted message block",
116
+ category: "certificate",
117
+ severity: "low",
118
+ confidence: "high",
119
+ algorithm: "unknown",
120
+ hndl: true,
121
+ cwe: CWE_BROKEN_CRYPTO,
122
+ message:
123
+ "Embedded PGP/GPG message; likely encrypted with classical RSA/ElGamal (harvest-now-decrypt-later).",
124
+ remediation: "Re-encrypt with PQC-capable tooling as OpenPGP PQC profiles mature.",
125
+ },
105
126
  },
106
127
  {
107
128
  re: /-----BEGIN (?:ENCRYPTED )?PRIVATE KEY-----/g,
108
- ruleId: "pem-pkcs8-private-key",
109
- title: "Private key (PKCS#8 PEM)",
110
- category: "certificate",
111
- severity: "critical",
112
- algorithm: "unknown",
113
- hndl: true,
114
- cwe: CWE_HARDCODED_KEY,
115
- sensitive: true,
116
- message: "Embedded PKCS#8 private key; likely classical RSA/EC, not quantum-safe.",
117
- remediation: "Migrate to PQC keys and remove embedded private keys from source.",
129
+ meta: {
130
+ id: "pem-pkcs8-private-key",
131
+ title: "Private key (PKCS#8 PEM)",
132
+ description: "PKCS#8 private key block",
133
+ category: "certificate",
134
+ severity: "critical",
135
+ confidence: "high",
136
+ algorithm: "unknown",
137
+ hndl: true,
138
+ cwe: CWE_HARDCODED_KEY,
139
+ sensitive: true,
140
+ message: "Embedded PKCS#8 private key; likely classical RSA/EC, not quantum-safe.",
141
+ remediation: "Migrate to PQC keys and remove embedded private keys from source.",
142
+ },
118
143
  },
119
144
  {
120
145
  re: /-----BEGIN CERTIFICATE-----/g,
121
- ruleId: "pem-certificate",
122
- title: "X.509 certificate (PEM)",
123
- category: "certificate",
124
- severity: "low",
125
- algorithm: "unknown",
126
- hndl: false,
127
- cwe: CWE_BROKEN_CRYPTO,
128
- message: "Embedded X.509 certificate; almost certainly signed with classical RSA/ECDSA.",
129
- remediation: "Plan re-issuance with PQC-capable CAs as ML-DSA certificate profiles mature.",
146
+ meta: {
147
+ id: "pem-certificate",
148
+ title: "X.509 certificate (PEM)",
149
+ description: "X.509 certificate block",
150
+ category: "certificate",
151
+ severity: "low",
152
+ confidence: "high",
153
+ algorithm: "unknown",
154
+ hndl: false,
155
+ cwe: CWE_BROKEN_CRYPTO,
156
+ message: "Embedded X.509 certificate; almost certainly signed with classical RSA/ECDSA.",
157
+ remediation: "Plan re-issuance with PQC-capable CAs as ML-DSA certificate profiles mature.",
158
+ },
130
159
  },
131
160
  ];
132
161
 
@@ -136,6 +165,7 @@ export const pemDetector: Detector = {
136
165
  description: "PEM-encoded private keys and X.509 certificates in any file",
137
166
  scope: "config",
138
167
  language: "any",
168
+ rules: PEM_RULES.map((r) => r.meta),
139
169
  // Applies to every text file; the walker already filters out binaries.
140
170
  appliesTo: () => true,
141
171
  detect({ file, content }): Finding[] {
@@ -146,18 +176,7 @@ export const pemDetector: Detector = {
146
176
  for (const rule of PEM_RULES) {
147
177
  eachMatch(rule.re, content, (m) => {
148
178
  findings.push(
149
- makeFinding({
150
- ruleId: rule.ruleId,
151
- title: rule.title,
152
- category: rule.category,
153
- severity: rule.severity,
154
- confidence: "high",
155
- algorithm: rule.algorithm,
156
- hndl: rule.hndl,
157
- cwe: rule.cwe,
158
- sensitive: rule.sensitive,
159
- message: rule.message,
160
- remediation: rule.remediation,
179
+ findingFromRule(rule.meta, {
161
180
  file,
162
181
  content,
163
182
  index: m.index,