@quantakrypto/core 0.2.2 → 0.3.0

package/dist/detect-utils.d.ts

@@ -3,7 +3,7 @@
  * into a 1-based line/column, extracting a trimmed single-line snippet, and a
  * small factory for building Finding objects with consistent remediation text.
  */
-import type { AlgorithmFamily, Confidence, Finding, FindingCategory, Severity } from "./types.js";
+import type { AlgorithmFamily, Confidence, Finding, FindingCategory, RuleMeta, Severity } from "./types.js";
 /** A 1-based line/column position derived from a character offset. */
 export interface LineCol {
     line: number;
@@ -46,6 +46,31 @@ export interface FindingSpec {
  * remediation text for that family is used.
  */
 export declare function makeFinding(spec: FindingSpec): Finding;
+/** Where a match occurred, plus optional per-finding field overrides. */
+export interface RuleMatch {
+    file: string;
+    content: string;
+    /** Match start offset within `content`. */
+    index: number;
+    /** Length of the match (used to compute endLine for multi-line matches). */
+    matchLength?: number;
+}
+/**
+ * Fields of a {@link RuleMeta} a detector may refine at match time. Multi-variant
+ * rules (e.g. key generation across algorithm families) override these; fixed
+ * rules pass none and inherit the catalog metadata verbatim.
+ */
+export type RuleOverrides = Partial<Pick<RuleMeta, "title" | "category" | "severity" | "confidence" | "algorithm" | "hndl" | "message" | "cwe">> & {
+    remediation?: string;
+};
+/**
+ * Build a {@link Finding} from a rule's catalog metadata plus a match location,
+ * applying any per-finding overrides. This is the single construction path for
+ * detector findings: the invariant fields (title/severity/category/…) live once
+ * in the {@link RuleMeta} declaration, so they can't drift from what the SARIF
+ * catalog and the MCP resolver report.
+ */
+export declare function findingFromRule(rule: RuleMeta, at: RuleMatch, overrides?: RuleOverrides): Finding;
 /** True if `filePath` has one of the given (lower-case, dotted) extensions. */
 export declare function hasExtension(filePath: string, exts: readonly string[]): boolean;
 /** JavaScript / TypeScript source extensions handled by the source detectors. */

package/dist/detect-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"detect-utils.d.ts","sourceRoot":"","sources":["../src/detect-utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAGlG,sEAAsE;AACtE,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAUxE;AAED,oEAAoE;AACpE,wBAAgB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAM9D;AAED,sCAAsC;AACtC,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,QAAQ,CAAC;IACnB,UAAU,EAAE,UAAU,CAAC;IACvB,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0CAA0C;IAC1C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAmCtD;AAED,+EAA+E;AAC/E,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAG/E;AAED,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAAmD,CAAC;AAElG;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GACb,OAAO,CAgBT;AAED;;;GAGG;AACH,wBAAgB,SAAS,CACvB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,GACxC,IAAI,CAQN"}
+{"version":3,"file":"detect-utils.d.ts","sourceRoot":"","sources":["../src/detect-utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EACV,eAAe,EACf,UAAU,EACV,OAAO,EACP,eAAe,EACf,QAAQ,EACR,QAAQ,EACT,MAAM,YAAY,CAAC;AAGpB,sEAAsE;AACtE,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAUxE;AAED,oEAAoE;AACpE,wBAAgB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAM9D;AAED,sCAAsC;AACtC,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,QAAQ,CAAC;IACnB,UAAU,EAAE,UAAU,CAAC;IACvB,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0CAA0C;IAC1C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAmCtD;AAED,yEAAyE;AACzE,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,2CAA2C;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,CACjC,IAAI,CACF,QAAQ,EACR,OAAO,GAAG,UAAU,GAAG,UAAU,GAAG,YAAY,GAAG,WAAW,GAAG,MAAM,GAAG,SAAS,GAAG,KAAK,CAC5F,CACF,GAAG;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7B;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,aAAa,GAAG,OAAO,CAkBjG;AAED,+EAA+E;AAC/E,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAG/E;AAED,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAAmD,CAAC;AAElG;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GACb,OAAO,CAgBT;AAED;;;GAGG;AACH,wBAAgB,SAAS,CACvB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,GACxC,IAAI,CAQN"}

package/dist/detect-utils.js

@@ -66,6 +66,32 @@ export function makeFinding(spec) {
         finding.sensitive = true;
     return finding;
 }
+/**
+ * Build a {@link Finding} from a rule's catalog metadata plus a match location,
+ * applying any per-finding overrides. This is the single construction path for
+ * detector findings: the invariant fields (title/severity/category/…) live once
+ * in the {@link RuleMeta} declaration, so they can't drift from what the SARIF
+ * catalog and the MCP resolver report.
+ */
+export function findingFromRule(rule, at, overrides) {
+    return makeFinding({
+        ruleId: rule.id,
+        title: overrides?.title ?? rule.title,
+        category: overrides?.category ?? rule.category,
+        severity: overrides?.severity ?? rule.severity,
+        confidence: overrides?.confidence ?? rule.confidence,
+        algorithm: overrides?.algorithm ?? rule.algorithm,
+        hndl: overrides?.hndl ?? rule.hndl,
+        cwe: overrides?.cwe ?? rule.cwe,
+        remediation: overrides?.remediation ?? rule.remediation,
+        sensitive: rule.sensitive,
+        message: overrides?.message ?? rule.message,
+        file: at.file,
+        content: at.content,
+        index: at.index,
+        matchLength: at.matchLength,
+    });
+}
 /** True if `filePath` has one of the given (lower-case, dotted) extensions. */
 export function hasExtension(filePath, exts) {
     const lower = filePath.toLowerCase();

package/dist/detect-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"detect-utils.js","sourceRoot":"","sources":["../src/detect-utils.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAQnD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,MAAc;IAC7D,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,WAAW,GAAG,CAAC,CAAC,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtD,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC;YAC1C,IAAI,EAAE,CAAC;YACP,WAAW,GAAG,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,WAAW,EAAE,CAAC;AAChD,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,MAAM,CAAC,OAAe,EAAE,MAAc;IACpD,IAAI,KAAK,GAAG,MAAM,CAAC;IACnB,OAAO,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,CAAC;IAClE,IAAI,GAAG,GAAG,MAAM,CAAC;IACjB,OAAO,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE;QAAE,GAAG,EAAE,CAAC;IACrE,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAC7D,CAAC;AA0BD;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,IAAiB;IAC3C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAEjD,MAAM,WAAW,GACf,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAErF,MAAM,QAAQ,GAAwB;QACpC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI;QACJ,MAAM;QACN,OAAO,EAAE,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO;KACxE,CAAC;IAEF,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;QAC9E,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACvD,IAAI,UAAU,GAAG,CAAC;YAAE,QAAQ,CAAC,OAAO,GAAG,IAAI,GAAG,UAAU,CAAC;IAC3D,CAAC;IAED,MAAM,OAAO,GAAY;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ;KACT,CAAC;IACF,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACvD,IAAI,WAAW;QAAE,OAAO,CAAC,WAAW,GAAG,WAAW,CAAC;IACnD,IAAI,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrC,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAC7C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,IAAuB;IACpE,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAElG;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,WAA8B,EAC9B,GAAW,EACX,MAAc;IAEd,qCAAqC;IACrC,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,EAAE,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;IAChC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC;IACd,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;YAC5B,IAAI,GAAG,GAAG,CAAC;YACX,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;QACf,CAAC;aAAM,CAAC;YACN,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;QACf,CAAC;IACH,CAAC;IACD,IAAI,IAAI,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CACvB,EAAU,EACV,OAAe,EACf,OAAyC;IAEzC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC;IACjE,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC;IAChB,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACtC,OAAO,CAAC,CAAC,CAAC,CAAC;QACX,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,SAAS;YAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,qCAAqC;IACnF,CAAC;AACH,CAAC"}
+{"version":3,"file":"detect-utils.js","sourceRoot":"","sources":["../src/detect-utils.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAQnD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,MAAc;IAC7D,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,WAAW,GAAG,CAAC,CAAC,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtD,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC;YAC1C,IAAI,EAAE,CAAC;YACP,WAAW,GAAG,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,GAAG,WAAW,EAAE,CAAC;AAChD,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,MAAM,CAAC,OAAe,EAAE,MAAc;IACpD,IAAI,KAAK,GAAG,MAAM,CAAC;IACnB,OAAO,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,CAAC;IAClE,IAAI,GAAG,GAAG,MAAM,CAAC;IACjB,OAAO,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE;QAAE,GAAG,EAAE,CAAC;IACrE,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAC7D,CAAC;AA0BD;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,IAAiB;IAC3C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAEjD,MAAM,WAAW,GACf,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAErF,MAAM,QAAQ,GAAwB;QACpC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI;QACJ,MAAM;QACN,OAAO,EAAE,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO;KACxE,CAAC;IAEF,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;QAC9E,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACvD,IAAI,UAAU,GAAG,CAAC;YAAE,QAAQ,CAAC,OAAO,GAAG,IAAI,GAAG,UAAU,CAAC;IAC3D,CAAC;IAED,MAAM,OAAO,GAAY;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ;KACT,CAAC;IACF,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACvD,IAAI,WAAW;QAAE,OAAO,CAAC,WAAW,GAAG,WAAW,CAAC;IACnD,IAAI,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrC,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAC7C,OAAO,OAAO,CAAC;AACjB,CAAC;AAwBD;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAc,EAAE,EAAa,EAAE,SAAyB;IACtF,OAAO,WAAW,CAAC;QACjB,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,KAAK,EAAE,SAAS,EAAE,KAAK,IAAI,IAAI,CAAC,KAAK;QACrC,QAAQ,EAAE,SAAS,EAAE,QAAQ,IAAI,IAAI,CAAC,QAAQ;QAC9C,QAAQ,EAAE,SAAS,EAAE,QAAQ,IAAI,IAAI,CAAC,QAAQ;QAC9C,UAAU,EAAE,SAAS,EAAE,UAAU,IAAI,IAAI,CAAC,UAAU;QACpD,SAAS,EAAE,SAAS,EAAE,SAAS,IAAI,IAAI,CAAC,SAAS;QACjD,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,IAAI,CAAC,IAAI;QAClC,GAAG,EAAE,SAAS,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG;QAC/B,WAAW,EAAE,SAAS,EAAE,WAAW,IAAI,IAAI,CAAC,WAAW;QACvD,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,OAAO,EAAE,SAAS,EAAE,OAAO,IAAI,IAAI,CAAC,OAAO;QAC3C,IAAI,EAAE,EAAE,CAAC,IAAI;QACb,OAAO,EAAE,EAAE,CAAC,OAAO;QACnB,KAAK,EAAE,EAAE,CAAC,KAAK;QACf,WAAW,EAAE,EAAE,CAAC,WAAW;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,IAAuB;IACpE,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAElG;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,WAA8B,EAC9B,GAAW,EACX,MAAc;IAEd,qCAAqC;IACrC,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,EAAE,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;IAChC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC;IACd,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;YAC5B,IAAI,GAAG,GAAG,CAAC;YACX,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;QACf,CAAC;aAAM,CAAC;YACN,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;QACf,CAAC;IACH,CAAC;IACD,IAAI,IAAI,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CACvB,EAAU,EACV,OAAe,EACf,OAAyC;IAEzC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC;IACjE,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC;IAChB,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACtC,OAAO,CAAC,CAAC,CAAC,CAAC;QACX,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,SAAS;YAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,qCAAqC;IACnF,CAAC;AACH,CAAC"}

package/dist/detectors/pem.d.ts

@@ -2,6 +2,10 @@
  * Config / certificate detector: finds PEM-encoded cryptographic material in
  * any text file (source, config, .pem, .key, .crt, .env, …). This catches
  * embedded private keys and X.509 certificates regardless of language.
+ *
+ * Every rule's metadata lives in the {@link RuleMeta} declaration below (the
+ * catalog entry); `detect()` builds findings straight from it via
+ * `findingFromRule`. All PEM findings are high-confidence exact-marker matches.
  */
 import type { Detector } from "../types.js";
 /** Detects PEM key/certificate material in arbitrary files. */

package/dist/detectors/pem.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pem.d.ts","sourceRoot":"","sources":["../../src/detectors/pem.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAW,MAAM,aAAa,CAAC;AA+HrD,+DAA+D;AAC/D,eAAO,MAAM,WAAW,EAAE,QAqCzB,CAAC"}
+{"version":3,"file":"pem.d.ts","sourceRoot":"","sources":["../../src/detectors/pem.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAwJ/D,+DAA+D;AAC/D,eAAO,MAAM,WAAW,EAAE,QA2BzB,CAAC"}

package/dist/detectors/pem.js

@@ -1,107 +1,139 @@
-import { eachMatch, makeFinding } from "../detect-utils.js";
+import { eachMatch, findingFromRule } from "../detect-utils.js";
 import { CWE_BROKEN_CRYPTO, CWE_HARDCODED_KEY } from "../cwe.js";
 const PEM_RULES = [
     {
         re: /-----BEGIN RSA PRIVATE KEY-----/g,
-        ruleId: "pem-rsa-private-key",
-        title: "RSA private key (PEM)",
-        category: "certificate",
-        severity: "critical",
-        algorithm: "RSA",
-        hndl: true,
-        cwe: CWE_HARDCODED_KEY,
-        sensitive: true,
-        message: "Embedded RSA private key (PKCS#1 PEM); classical and not quantum-safe.",
-        remediation: "Migrate to ML-DSA / ML-KEM keys and remove embedded private keys from source.",
+        meta: {
+            id: "pem-rsa-private-key",
+            title: "RSA private key (PEM)",
+            description: "PKCS#1 RSA private key block",
+            category: "certificate",
+            severity: "critical",
+            confidence: "high",
+            algorithm: "RSA",
+            hndl: true,
+            cwe: CWE_HARDCODED_KEY,
+            sensitive: true,
+            message: "Embedded RSA private key (PKCS#1 PEM); classical and not quantum-safe.",
+            remediation: "Migrate to ML-DSA / ML-KEM keys and remove embedded private keys from source.",
+        },
     },
     {
         re: /-----BEGIN EC PRIVATE KEY-----/g,
-        ruleId: "pem-ec-private-key",
-        title: "EC private key (PEM)",
-        category: "certificate",
-        severity: "critical",
-        algorithm: "ECDSA",
-        hndl: true,
-        cwe: CWE_HARDCODED_KEY,
-        sensitive: true,
-        message: "Embedded EC private key (SEC1 PEM); classical ECDSA/ECDH key, not quantum-safe.",
-        remediation: "Migrate to ML-DSA (FIPS 204) keys and remove embedded private keys from source.",
+        meta: {
+            id: "pem-ec-private-key",
+            title: "EC private key (PEM)",
+            description: "SEC1 EC private key block",
+            category: "certificate",
+            severity: "critical",
+            confidence: "high",
+            algorithm: "ECDSA",
+            hndl: true,
+            cwe: CWE_HARDCODED_KEY,
+            sensitive: true,
+            message: "Embedded EC private key (SEC1 PEM); classical ECDSA/ECDH key, not quantum-safe.",
+            remediation: "Migrate to ML-DSA (FIPS 204) keys and remove embedded private keys from source.",
+        },
     },
     {
         re: /-----BEGIN DSA PRIVATE KEY-----/g,
-        ruleId: "pem-dsa-private-key",
-        title: "DSA private key (PEM)",
-        category: "certificate",
-        severity: "critical",
-        algorithm: "DSA",
-        hndl: false,
-        cwe: CWE_HARDCODED_KEY,
-        sensitive: true,
-        message: "Embedded DSA private key (PEM); classical, already deprecated, and not quantum-safe.",
-        remediation: "Rotate immediately (DSA is deprecated) and migrate to ML-DSA-65 (FIPS 204).",
+        meta: {
+            id: "pem-dsa-private-key",
+            title: "DSA private key (PEM)",
+            description: "DSA private key block",
+            category: "certificate",
+            severity: "critical",
+            confidence: "high",
+            algorithm: "DSA",
+            hndl: false,
+            cwe: CWE_HARDCODED_KEY,
+            sensitive: true,
+            message: "Embedded DSA private key (PEM); classical, already deprecated, and not quantum-safe.",
+            remediation: "Rotate immediately (DSA is deprecated) and migrate to ML-DSA-65 (FIPS 204).",
+        },
     },
     {
         re: /-----BEGIN OPENSSH PRIVATE KEY-----/g,
-        ruleId: "pem-openssh-private-key",
-        title: "OpenSSH private key",
-        category: "certificate",
-        severity: "critical",
-        algorithm: "unknown",
-        hndl: true,
-        cwe: CWE_HARDCODED_KEY,
-        sensitive: true,
-        message: "Embedded OpenSSH private key (RSA/ECDSA/Ed25519); classical and not quantum-safe.",
-        remediation: "Rotate the key; plan migration to PQC-capable SSH (e.g. sntrup761x25519).",
+        meta: {
+            id: "pem-openssh-private-key",
+            title: "OpenSSH private key",
+            description: "OpenSSH private key block",
+            category: "certificate",
+            severity: "critical",
+            confidence: "high",
+            algorithm: "unknown",
+            hndl: true,
+            cwe: CWE_HARDCODED_KEY,
+            sensitive: true,
+            message: "Embedded OpenSSH private key (RSA/ECDSA/Ed25519); classical and not quantum-safe.",
+            remediation: "Rotate the key; plan migration to PQC-capable SSH (e.g. sntrup761x25519).",
+        },
     },
     {
         re: /-----BEGIN PGP PRIVATE KEY BLOCK-----/g,
-        ruleId: "pem-pgp-private-key",
-        title: "PGP/GPG private key block",
-        category: "certificate",
-        severity: "critical",
-        algorithm: "unknown",
-        hndl: true,
-        cwe: CWE_HARDCODED_KEY,
-        sensitive: true,
-        message: "Embedded PGP/GPG private key block (RSA/ECDSA/EdDSA/ElGamal); classical and not quantum-safe.",
-        remediation: "Rotate the key; track OpenPGP PQC drafts for migration.",
+        meta: {
+            id: "pem-pgp-private-key",
+            title: "PGP/GPG private key block",
+            description: "OpenPGP private key block",
+            category: "certificate",
+            severity: "critical",
+            confidence: "high",
+            algorithm: "unknown",
+            hndl: true,
+            cwe: CWE_HARDCODED_KEY,
+            sensitive: true,
+            message: "Embedded PGP/GPG private key block (RSA/ECDSA/EdDSA/ElGamal); classical and not quantum-safe.",
+            remediation: "Rotate the key; track OpenPGP PQC drafts for migration.",
+        },
     },
     {
         re: /-----BEGIN PGP MESSAGE-----/g,
-        ruleId: "pem-pgp-message",
-        title: "PGP/GPG encrypted message",
-        category: "certificate",
-        severity: "low",
-        algorithm: "unknown",
-        hndl: true,
-        cwe: CWE_BROKEN_CRYPTO,
-        message: "Embedded PGP/GPG message; likely encrypted with classical RSA/ElGamal (harvest-now-decrypt-later).",
-        remediation: "Re-encrypt with PQC-capable tooling as OpenPGP PQC profiles mature.",
+        meta: {
+            id: "pem-pgp-message",
+            title: "PGP/GPG encrypted message",
+            description: "OpenPGP encrypted message block",
+            category: "certificate",
+            severity: "low",
+            confidence: "high",
+            algorithm: "unknown",
+            hndl: true,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: "Embedded PGP/GPG message; likely encrypted with classical RSA/ElGamal (harvest-now-decrypt-later).",
+            remediation: "Re-encrypt with PQC-capable tooling as OpenPGP PQC profiles mature.",
+        },
     },
     {
         re: /-----BEGIN (?:ENCRYPTED )?PRIVATE KEY-----/g,
-        ruleId: "pem-pkcs8-private-key",
-        title: "Private key (PKCS#8 PEM)",
-        category: "certificate",
-        severity: "critical",
-        algorithm: "unknown",
-        hndl: true,
-        cwe: CWE_HARDCODED_KEY,
-        sensitive: true,
-        message: "Embedded PKCS#8 private key; likely classical RSA/EC, not quantum-safe.",
-        remediation: "Migrate to PQC keys and remove embedded private keys from source.",
+        meta: {
+            id: "pem-pkcs8-private-key",
+            title: "Private key (PKCS#8 PEM)",
+            description: "PKCS#8 private key block",
+            category: "certificate",
+            severity: "critical",
+            confidence: "high",
+            algorithm: "unknown",
+            hndl: true,
+            cwe: CWE_HARDCODED_KEY,
+            sensitive: true,
+            message: "Embedded PKCS#8 private key; likely classical RSA/EC, not quantum-safe.",
+            remediation: "Migrate to PQC keys and remove embedded private keys from source.",
+        },
     },
     {
         re: /-----BEGIN CERTIFICATE-----/g,
-        ruleId: "pem-certificate",
-        title: "X.509 certificate (PEM)",
-        category: "certificate",
-        severity: "low",
-        algorithm: "unknown",
-        hndl: false,
-        cwe: CWE_BROKEN_CRYPTO,
-        message: "Embedded X.509 certificate; almost certainly signed with classical RSA/ECDSA.",
-        remediation: "Plan re-issuance with PQC-capable CAs as ML-DSA certificate profiles mature.",
+        meta: {
+            id: "pem-certificate",
+            title: "X.509 certificate (PEM)",
+            description: "X.509 certificate block",
+            category: "certificate",
+            severity: "low",
+            confidence: "high",
+            algorithm: "unknown",
+            hndl: false,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: "Embedded X.509 certificate; almost certainly signed with classical RSA/ECDSA.",
+            remediation: "Plan re-issuance with PQC-capable CAs as ML-DSA certificate profiles mature.",
+        },
     },
 ];
 /** Detects PEM key/certificate material in arbitrary files. */
@@ -110,6 +142,7 @@ export const pemDetector = {
     description: "PEM-encoded private keys and X.509 certificates in any file",
     scope: "config",
     language: "any",
+    rules: PEM_RULES.map((r) => r.meta),
     // Applies to every text file; the walker already filters out binaries.
     appliesTo: () => true,
     detect({ file, content }) {
@@ -119,18 +152,7 @@ export const pemDetector = {
         const findings = [];
         for (const rule of PEM_RULES) {
             eachMatch(rule.re, content, (m) => {
-                findings.push(makeFinding({
-                    ruleId: rule.ruleId,
-                    title: rule.title,
-                    category: rule.category,
-                    severity: rule.severity,
-                    confidence: "high",
-                    algorithm: rule.algorithm,
-                    hndl: rule.hndl,
-                    cwe: rule.cwe,
-                    sensitive: rule.sensitive,
-                    message: rule.message,
-                    remediation: rule.remediation,
+                findings.push(findingFromRule(rule.meta, {
                     file,
                     content,
                     index: m.index,

package/dist/detectors/pem.js.map

@@ -1 +1 @@
-{"version":3,"file":"pem.js","sourceRoot":"","sources":["../../src/detectors/pem.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAkBjE,MAAM,SAAS,GAAc;IAC3B;QACE,EAAE,EAAE,kCAAkC;QACtC,MAAM,EAAE,qBAAqB;QAC7B,KAAK,EAAE,uBAAuB;QAC9B,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,KAAK;QAChB,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,iBAAiB;QACtB,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,wEAAwE;QACjF,WAAW,EAAE,+EAA+E;KAC7F;IACD;QACE,EAAE,EAAE,iCAAiC;QACrC,MAAM,EAAE,oBAAoB;QAC5B,KAAK,EAAE,sBAAsB;QAC7B,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,OAAO;QAClB,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,iBAAiB;QACtB,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,iFAAiF;QAC1F,WAAW,EAAE,iFAAiF;KAC/F;IACD;QACE,EAAE,EAAE,kCAAkC;QACtC,MAAM,EAAE,qBAAqB;QAC7B,KAAK,EAAE,uBAAuB;QAC9B,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,KAAK;QAChB,IAAI,EAAE,KAAK;QACX,GAAG,EAAE,iBAAiB;QACtB,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,sFAAsF;QAC/F,WAAW,EAAE,6EAA6E;KAC3F;IACD;QACE,EAAE,EAAE,sCAAsC;QAC1C,MAAM,EAAE,yBAAyB;QACjC,KAAK,EAAE,qBAAqB;QAC5B,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,SAAS;QACpB,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,iBAAiB;QACtB,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,mFAAmF;QAC5F,WAAW,EAAE,2EAA2E;KACzF;IACD;QACE,EAAE,EAAE,wCAAwC;QAC5C,MAAM,EAAE,qBAAqB;QAC7B,KAAK,EAAE,2BAA2B;QAClC,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,SAAS;QACpB,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,iBAAiB;QACtB,SAAS,EAAE,IAAI;QACf,OAAO,EACL,+FAA+F;QACjG,WAAW,EAAE,yDAAyD;KACvE;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,MAAM,EAAE,iBAAiB;QACzB,KAAK,EAAE,2BAA2B;QAClC,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,SAAS;QACpB,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,iBAAiB;QACtB,OAAO,EACL,oGAAoG;QACtG,WAAW,EAAE,qEAAqE;KACnF;IACD;QACE,EAAE,EAAE,6CAA6C;QACjD,MAAM,EAAE,uBAAuB;QAC/B,KAAK,EAAE,0BAA0B;QACjC,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,UAAU;QACpB,SAAS,EAAE,SAAS;QACpB,IAAI,EAAE,IAAI;QACV,GAAG,EAAE,iBAAiB;QACtB,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,yEAAyE;QAClF,WAAW,EAAE,mEAAmE;KACjF;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,MAAM,EAAE,iBAAiB;QACzB,KAAK,EAAE,yBAAyB;QAChC,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,KAAK;QACf,SAAS,EAAE,SAAS;QACpB,IAAI,EAAE,KAAK;QACX,GAAG,EAAE,iBAAiB;QACtB,OAAO,EAAE,+EAA+E;QACxF,WAAW,EAAE,8EAA8E;KAC5F;CACF,CAAC;AAEF,+DAA+D;AAC/D,MAAM,CAAC,MAAM,WAAW,GAAa;IACnC,EAAE,EAAE,cAAc;IAClB,WAAW,EAAE,6DAA6D;IAC1E,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,KAAK;IACf,uEAAuE;IACvE,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI;IACrB,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,+DAA+D;QAC/D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,OAAO,EAAE,CAAC;QAEhD,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBAChC,QAAQ,CAAC,IAAI,CACX,WAAW,CAAC;oBACV,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,UAAU,EAAE,MAAM;oBAClB,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,IAAI;oBACJ,OAAO;oBACP,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;iBACzB,CAAC,CACH,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC"}
+{"version":3,"file":"pem.js","sourceRoot":"","sources":["../../src/detectors/pem.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AASjE,MAAM,SAAS,GAAc;IAC3B;QACE,EAAE,EAAE,kCAAkC;QACtC,IAAI,EAAE;YACJ,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,8BAA8B;YAC3C,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,wEAAwE;YACjF,WAAW,EAAE,+EAA+E;SAC7F;KACF;IACD;QACE,EAAE,EAAE,iCAAiC;QACrC,IAAI,EAAE;YACJ,EAAE,EAAE,oBAAoB;YACxB,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,2BAA2B;YACxC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,OAAO;YAClB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,iFAAiF;YAC1F,WAAW,EACT,iFAAiF;SACpF;KACF;IACD;QACE,EAAE,EAAE,kCAAkC;QACtC,IAAI,EAAE;YACJ,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,uBAAuB;YACpC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EACL,sFAAsF;YACxF,WAAW,EAAE,6EAA6E;SAC3F;KACF;IACD;QACE,EAAE,EAAE,sCAAsC;QAC1C,IAAI,EAAE;YACJ,EAAE,EAAE,yBAAyB;YAC7B,KAAK,EAAE,qBAAqB;YAC5B,WAAW,EAAE,2BAA2B;YACxC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,mFAAmF;YAC5F,WAAW,EAAE,2EAA2E;SACzF;KACF;IACD;QACE,EAAE,EAAE,wCAAwC;QAC5C,IAAI,EAAE;YACJ,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,2BAA2B;YAClC,WAAW,EAAE,2BAA2B;YACxC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EACL,+FAA+F;YACjG,WAAW,EAAE,yDAAyD;SACvE;KACF;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,IAAI,EAAE;YACJ,EAAE,EAAE,iBAAiB;YACrB,KAAK,EAAE,2BAA2B;YAClC,WAAW,EAAE,iCAAiC;YAC9C,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,oGAAoG;YACtG,WAAW,EAAE,qEAAqE;SACnF;KACF;IACD;QACE,EAAE,EAAE,6CAA6C;QACjD,IAAI,EAAE;YACJ,EAAE,EAAE,uBAAuB;YAC3B,KAAK,EAAE,0BAA0B;YACjC,WAAW,EAAE,0BAA0B;YACvC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,yEAAyE;YAClF,WAAW,EAAE,mEAAmE;SACjF;KACF;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,IAAI,EAAE;YACJ,EAAE,EAAE,iBAAiB;YACrB,KAAK,EAAE,yBAAyB;YAChC,WAAW,EAAE,yBAAyB;YACtC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,OAAO,EAAE,+EAA+E;YACxF,WAAW,EAAE,8EAA8E;SAC5F;KACF;CACF,CAAC;AAEF,+DAA+D;AAC/D,MAAM,CAAC,MAAM,WAAW,GAAa;IACnC,EAAE,EAAE,cAAc;IAClB,WAAW,EAAE,6DAA6D;IAC1E,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,uEAAuE;IACvE,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI;IACrB,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,+DAA+D;QAC/D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,OAAO,EAAE,CAAC;QAEhD,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBAChC,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE;oBACzB,IAAI;oBACJ,OAAO;oBACP,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;iBACzB,CAAC,CACH,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC"}

package/dist/detectors/source.d.ts

@@ -1,8 +1,15 @@
 /**
  * Source-code detectors for classical, non-quantum-safe asymmetric cryptography
  * in JavaScript / TypeScript. Each detector is pure and stateless: it declares
- * which files it applies to and returns zero or more Findings for a file's
- * contents.
+ * which files it applies to, the catalog of rules it can emit (`rules`), and
+ * returns zero or more Findings for a file's contents.
+ *
+ * Rule metadata (title / severity / category / remediation / …) lives ONCE in
+ * the per-detector `RuleMeta` declarations below, not inline in `detect()`.
+ * `detect()` builds findings from those declarations via `findingFromRule`,
+ * overriding only the fields that genuinely vary per match (e.g. the concrete
+ * algorithm family of a `generateKeyPair('ec')` call). The declarations are the
+ * catalog surfaced by the registry, SARIF `rules[]`, and the MCP resolver.
  *
  * The detection strategy is deliberately lexical (regex over source text). This
  * is robust to bundling and partial files and keeps the package dependency-free.

package/dist/detectors/source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../src/detectors/source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAW,MAAM,aAAa,CAAC;AAksBrD,0DAA0D;AAC1D,eAAO,MAAM,eAAe,EAAE,QAAQ,EAOrC,CAAC"}
+{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../src/detectors/source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAszB/D,0DAA0D;AAC1D,eAAO,MAAM,eAAe,EAAE,QAAQ,EAOrC,CAAC"}