@quantakrypto/core 0.2.2 → 0.3.0

package/dist/types.d.ts

@@ -73,6 +73,45 @@ export type DetectorScope = "source" | "config";
  * detector is language-agnostic (e.g. PEM material, config files).
  */
 export type DetectorLanguage = "js" | "python" | "go" | "java" | "any";
+/**
+ * Declarative metadata for a single rule a detector can emit. This is the
+ * catalog entry: the stable, queryable description of a rule keyed by the
+ * `ruleId` it stamps onto findings. It is the single source of truth for a
+ * rule's title / severity / category / remediation, consumed by the SARIF
+ * `rules[]` block, the MCP `explain_finding` resolver, and future per-rule
+ * enable/disable + language-pack work.
+ *
+ * For most rules the metadata is fixed and `detect()` builds findings straight
+ * from it (see `findingFromRule`). A few rules are inherently multi-variant
+ * (e.g. `node-crypto-keygen` spans RSA/EC/DSA/DH/Ed25519 at different
+ * severities); for those the metadata here is a REPRESENTATIVE umbrella and
+ * `detect()` refines the per-finding fields at match time. The catalog always
+ * enumerates every emittable ruleId regardless.
+ */
+export interface RuleMeta {
+    /** Stable rule id — matches {@link Finding.ruleId}. Unique across the catalog. */
+    id: string;
+    /** Canonical human title. */
+    title: string;
+    category: FindingCategory;
+    severity: Severity;
+    /** Default confidence for findings of this rule. */
+    confidence: Confidence;
+    /** Harvest-now-decrypt-later exposure. */
+    hndl: boolean;
+    /** Representative classical algorithm family; refined per-finding when it varies. */
+    algorithm?: AlgorithmFamily;
+    /** Associated CWE identifier (e.g. "CWE-327"). */
+    cwe?: string;
+    /** Suggested post-quantum remediation. When omitted, derived from {@link algorithm}. */
+    remediation?: string;
+    /** Canonical one-line human explanation; may be refined per-finding. */
+    message: string;
+    /** True when this rule's matched snippet IS sensitive key material. */
+    sensitive?: boolean;
+    /** Short description of what the rule detects (for catalog / MCP surfaces). */
+    description?: string;
+}
 /** A pluggable source detector. Detectors are pure and stateless. */
 export interface Detector {
     /** Unique id, used as the Finding.ruleId prefix space. */
@@ -90,6 +129,13 @@ export interface Detector {
      * Defaults to `"js"` when omitted.
      */
     language?: DetectorLanguage;
+    /**
+     * The rules this detector can emit, as declarative metadata. Together across
+     * all detectors these form the rule catalog ({@link DetectorRegistry.ruleCatalog}).
+     * Optional for backward compatibility with externally-defined detectors, but
+     * all built-in detectors declare it.
+     */
+    rules?: RuleMeta[];
     /** Whether this detector should run against the given file path. */
     appliesTo(filePath: string): boolean;
     /** Inspect a single file's contents and return zero or more findings. */
@@ -140,6 +186,13 @@ export interface ScanOptions {
      * registry's detectors are used.
      */
     detectors?: Detector[];
+    /**
+     * Rule ids to suppress. Any finding whose `ruleId` is listed here is dropped
+     * after detection. Serializable (a plain string array), so it is honoured on
+     * both the serial and the worker-thread (`scanParallel`) paths. See the rule
+     * catalog ({@link DetectorRegistry.ruleCatalog}) for the valid ids.
+     */
+    disabledRules?: string[];
     /** Optional progress callback. */
     onFile?: (file: string) => void;
     /**

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,6DAA6D;AAC7D,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAEvE,gFAAgF;AAChF,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEnD,+DAA+D;AAC/D,MAAM,MAAM,eAAe,GACvB,KAAK,GACL,cAAc,GACd,WAAW,GACX,KAAK,GACL,aAAa,GACb,YAAY,GACZ,MAAM,GACN,KAAK,CAAC;AAEV,yEAAyE;AACzE,MAAM,MAAM,eAAe,GACvB,KAAK,GACL,MAAM,GACN,OAAO,GACP,OAAO,GACP,IAAI,GACJ,KAAK,GACL,QAAQ,GACR,MAAM,GACN,OAAO,GACP,SAAS,CAAC;AAEd,gDAAgD;AAChD,MAAM,WAAW,cAAc;IAC7B,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,iCAAiC;AACjC,MAAM,WAAW,OAAO;IACtB,uGAAuG;IACvG,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,QAAQ,CAAC;IACnB,UAAU,EAAE,UAAU,CAAC;IACvB,yDAAyD;IACzD,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,iEAAiE;IACjE,IAAI,EAAE,OAAO,CAAC;IACd,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAED,mDAAmD;AACnD,MAAM,WAAW,oBAAoB;IACnC,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,KAAK,CAAC;IACjB,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEhD;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,GAAG,QAAQ,GAAG,IAAI,GAAG,MAAM,GAAG,KAAK,CAAC;AAEvE,qEAAqE;AACrE,MAAM,WAAW,QAAQ;IACvB,0DAA0D;IAC1D,EAAE,EAAE,MAAM,CAAC;IACX,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B,oEAAoE;IACpE,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IACrC,yEAAyE;IACzE,MAAM,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,aAAa;IAC5B,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,kCAAkC;AAClC,MAAM,WAAW,WAAW;IAC1B,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,gEAAgE;IAChE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,mFAAmF;IACnF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;OAGG;IACH,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;IACvB,kCAAkC;IAClC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC;;;;OAIG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,gFAAgF;AAChF,MAAM,WAAW,mBAAoB,SAAQ,WAAW;IACtD;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,kFAAkF;IAClF,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,yDAAyD;AACzD,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrC,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,iCAAiC;AACjC,MAAM,WAAW,UAAU;IACzB,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,eAAe,CAAC;IAC3B,sBAAsB;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,iDAAiD;AACjD,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;AAEtD,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,eAAe,CAAC;IAC3B,gFAAgF;IAChF,cAAc,EAAE,MAAM,CAAC;IACvB,wBAAwB;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,6DAA6D;AAC7D,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAEvE,gFAAgF;AAChF,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEnD,+DAA+D;AAC/D,MAAM,MAAM,eAAe,GACvB,KAAK,GACL,cAAc,GACd,WAAW,GACX,KAAK,GACL,aAAa,GACb,YAAY,GACZ,MAAM,GACN,KAAK,CAAC;AAEV,yEAAyE;AACzE,MAAM,MAAM,eAAe,GACvB,KAAK,GACL,MAAM,GACN,OAAO,GACP,OAAO,GACP,IAAI,GACJ,KAAK,GACL,QAAQ,GACR,MAAM,GACN,OAAO,GACP,SAAS,CAAC;AAEd,gDAAgD;AAChD,MAAM,WAAW,cAAc;IAC7B,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,iCAAiC;AACjC,MAAM,WAAW,OAAO;IACtB,uGAAuG;IACvG,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,QAAQ,CAAC;IACnB,UAAU,EAAE,UAAU,CAAC;IACvB,yDAAyD;IACzD,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,iEAAiE;IACjE,IAAI,EAAE,OAAO,CAAC;IACd,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAED,mDAAmD;AACnD,MAAM,WAAW,oBAAoB;IACnC,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,KAAK,CAAC;IACjB,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEhD;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,GAAG,QAAQ,GAAG,IAAI,GAAG,MAAM,GAAG,KAAK,CAAC;AAEvE;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,QAAQ;IACvB,kFAAkF;IAClF,EAAE,EAAE,MAAM,CAAC;IACX,6BAA6B;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,QAAQ,CAAC;IACnB,oDAAoD;IACpD,UAAU,EAAE,UAAU,CAAC;IACvB,0CAA0C;IAC1C,IAAI,EAAE,OAAO,CAAC;IACd,qFAAqF;IACrF,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,kDAAkD;IAClD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,qEAAqE;AACrE,MAAM,WAAW,QAAQ;IACvB,0DAA0D;IAC1D,EAAE,EAAE,MAAM,CAAC;IACX,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B;;;;;OAKG;IACH,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IACnB,oEAAoE;IACpE,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IACrC,yEAAyE;IACzE,MAAM,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,aAAa;IAC5B,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,kCAAkC;AAClC,MAAM,WAAW,WAAW;IAC1B,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,gEAAgE;IAChE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,mFAAmF;IACnF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;OAGG;IACH,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;IACvB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,kCAAkC;IAClC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC;;;;OAIG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,gFAAgF;AAChF,MAAM,WAAW,mBAAoB,SAAQ,WAAW;IACtD;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,kFAAkF;IAClF,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,yDAAyD;AACzD,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrC,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,iCAAiC;AACjC,MAAM,WAAW,UAAU;IACzB,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,eAAe,CAAC;IAC3B,sBAAsB;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,iDAAiD;AACjD,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;AAEtD,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,eAAe,CAAC;IAC3B,gFAAgF;IAChF,cAAc,EAAE,MAAM,CAAC;IACvB,wBAAwB;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB"}

package/dist/version.d.ts

@@ -3,5 +3,5 @@
  * the scan orchestrator can import it without creating a cycle through index.ts.
  * Keep in sync with packages/core/package.json.
  */
-export declare const VERSION = "0.2.2";
+export declare const VERSION = "0.3.0";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -3,5 +3,5 @@
  * the scan orchestrator can import it without creating a cycle through index.ts.
  * Keep in sync with packages/core/package.json.
  */
-export const VERSION = "0.2.2";
+export const VERSION = "0.3.0";
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quantakrypto/core",
-  "version": "0.2.2",
+  "version": "0.3.0",
   "description": "Shared post-quantum readiness library: crypto detectors, vulnerable-dependency database, inventory + SARIF reporting. Zero runtime dependencies.",
   "license": "Apache-2.0",
   "author": "Dandelion Labs <hello@dandelionlabs.io> (https://dandelionlabs.io)",

package/src/detect-utils.ts

@@ -3,7 +3,14 @@
  * into a 1-based line/column, extracting a trimmed single-line snippet, and a
  * small factory for building Finding objects with consistent remediation text.
  */
-import type { AlgorithmFamily, Confidence, Finding, FindingCategory, Severity } from "./types.js";
+import type {
+  AlgorithmFamily,
+  Confidence,
+  Finding,
+  FindingCategory,
+  RuleMeta,
+  Severity,
+} from "./types.js";
 import { remediationText } from "./remediation.js";
 
 /** A 1-based line/column position derived from a character offset. */
@@ -104,6 +111,55 @@ export function makeFinding(spec: FindingSpec): Finding {
   return finding;
 }
 
+/** Where a match occurred, plus optional per-finding field overrides. */
+export interface RuleMatch {
+  file: string;
+  content: string;
+  /** Match start offset within `content`. */
+  index: number;
+  /** Length of the match (used to compute endLine for multi-line matches). */
+  matchLength?: number;
+}
+
+/**
+ * Fields of a {@link RuleMeta} a detector may refine at match time. Multi-variant
+ * rules (e.g. key generation across algorithm families) override these; fixed
+ * rules pass none and inherit the catalog metadata verbatim.
+ */
+export type RuleOverrides = Partial<
+  Pick<
+    RuleMeta,
+    "title" | "category" | "severity" | "confidence" | "algorithm" | "hndl" | "message" | "cwe"
+  >
+> & { remediation?: string };
+
+/**
+ * Build a {@link Finding} from a rule's catalog metadata plus a match location,
+ * applying any per-finding overrides. This is the single construction path for
+ * detector findings: the invariant fields (title/severity/category/…) live once
+ * in the {@link RuleMeta} declaration, so they can't drift from what the SARIF
+ * catalog and the MCP resolver report.
+ */
+export function findingFromRule(rule: RuleMeta, at: RuleMatch, overrides?: RuleOverrides): Finding {
+  return makeFinding({
+    ruleId: rule.id,
+    title: overrides?.title ?? rule.title,
+    category: overrides?.category ?? rule.category,
+    severity: overrides?.severity ?? rule.severity,
+    confidence: overrides?.confidence ?? rule.confidence,
+    algorithm: overrides?.algorithm ?? rule.algorithm,
+    hndl: overrides?.hndl ?? rule.hndl,
+    cwe: overrides?.cwe ?? rule.cwe,
+    remediation: overrides?.remediation ?? rule.remediation,
+    sensitive: rule.sensitive,
+    message: overrides?.message ?? rule.message,
+    file: at.file,
+    content: at.content,
+    index: at.index,
+    matchLength: at.matchLength,
+  });
+}
+
 /** True if `filePath` has one of the given (lower-case, dotted) extensions. */
 export function hasExtension(filePath: string, exts: readonly string[]): boolean {
   const lower = filePath.toLowerCase();

package/src/detectors/pem.ts

@@ -2,131 +2,160 @@
  * Config / certificate detector: finds PEM-encoded cryptographic material in
  * any text file (source, config, .pem, .key, .crt, .env, …). This catches
  * embedded private keys and X.509 certificates regardless of language.
+ *
+ * Every rule's metadata lives in the {@link RuleMeta} declaration below (the
+ * catalog entry); `detect()` builds findings straight from it via
+ * `findingFromRule`. All PEM findings are high-confidence exact-marker matches.
  */
-import type { Detector, Finding } from "../types.js";
-import { eachMatch, makeFinding } from "../detect-utils.js";
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import { eachMatch, findingFromRule } from "../detect-utils.js";
 import { CWE_BROKEN_CRYPTO, CWE_HARDCODED_KEY } from "../cwe.js";
 
+/** A PEM rule: its catalog metadata plus the begin-marker regex that triggers it. */
 interface PemRule {
   /** Regex matching the PEM begin marker. */
   re: RegExp;
-  ruleId: string;
-  title: string;
-  category: Finding["category"];
-  severity: Finding["severity"];
-  algorithm?: Finding["algorithm"];
-  message: string;
-  remediation: string;
-  hndl: boolean;
-  cwe: string;
-  /** True when the matched snippet IS key material (reporters drop the snippet). */
-  sensitive?: boolean;
+  meta: RuleMeta;
 }
 
 const PEM_RULES: PemRule[] = [
   {
     re: /-----BEGIN RSA PRIVATE KEY-----/g,
-    ruleId: "pem-rsa-private-key",
-    title: "RSA private key (PEM)",
-    category: "certificate",
-    severity: "critical",
-    algorithm: "RSA",
-    hndl: true,
-    cwe: CWE_HARDCODED_KEY,
-    sensitive: true,
-    message: "Embedded RSA private key (PKCS#1 PEM); classical and not quantum-safe.",
-    remediation: "Migrate to ML-DSA / ML-KEM keys and remove embedded private keys from source.",
+    meta: {
+      id: "pem-rsa-private-key",
+      title: "RSA private key (PEM)",
+      description: "PKCS#1 RSA private key block",
+      category: "certificate",
+      severity: "critical",
+      confidence: "high",
+      algorithm: "RSA",
+      hndl: true,
+      cwe: CWE_HARDCODED_KEY,
+      sensitive: true,
+      message: "Embedded RSA private key (PKCS#1 PEM); classical and not quantum-safe.",
+      remediation: "Migrate to ML-DSA / ML-KEM keys and remove embedded private keys from source.",
+    },
   },
   {
     re: /-----BEGIN EC PRIVATE KEY-----/g,
-    ruleId: "pem-ec-private-key",
-    title: "EC private key (PEM)",
-    category: "certificate",
-    severity: "critical",
-    algorithm: "ECDSA",
-    hndl: true,
-    cwe: CWE_HARDCODED_KEY,
-    sensitive: true,
-    message: "Embedded EC private key (SEC1 PEM); classical ECDSA/ECDH key, not quantum-safe.",
-    remediation: "Migrate to ML-DSA (FIPS 204) keys and remove embedded private keys from source.",
+    meta: {
+      id: "pem-ec-private-key",
+      title: "EC private key (PEM)",
+      description: "SEC1 EC private key block",
+      category: "certificate",
+      severity: "critical",
+      confidence: "high",
+      algorithm: "ECDSA",
+      hndl: true,
+      cwe: CWE_HARDCODED_KEY,
+      sensitive: true,
+      message: "Embedded EC private key (SEC1 PEM); classical ECDSA/ECDH key, not quantum-safe.",
+      remediation:
+        "Migrate to ML-DSA (FIPS 204) keys and remove embedded private keys from source.",
+    },
   },
   {
     re: /-----BEGIN DSA PRIVATE KEY-----/g,
-    ruleId: "pem-dsa-private-key",
-    title: "DSA private key (PEM)",
-    category: "certificate",
-    severity: "critical",
-    algorithm: "DSA",
-    hndl: false,
-    cwe: CWE_HARDCODED_KEY,
-    sensitive: true,
-    message: "Embedded DSA private key (PEM); classical, already deprecated, and not quantum-safe.",
-    remediation: "Rotate immediately (DSA is deprecated) and migrate to ML-DSA-65 (FIPS 204).",
+    meta: {
+      id: "pem-dsa-private-key",
+      title: "DSA private key (PEM)",
+      description: "DSA private key block",
+      category: "certificate",
+      severity: "critical",
+      confidence: "high",
+      algorithm: "DSA",
+      hndl: false,
+      cwe: CWE_HARDCODED_KEY,
+      sensitive: true,
+      message:
+        "Embedded DSA private key (PEM); classical, already deprecated, and not quantum-safe.",
+      remediation: "Rotate immediately (DSA is deprecated) and migrate to ML-DSA-65 (FIPS 204).",
+    },
   },
   {
     re: /-----BEGIN OPENSSH PRIVATE KEY-----/g,
-    ruleId: "pem-openssh-private-key",
-    title: "OpenSSH private key",
-    category: "certificate",
-    severity: "critical",
-    algorithm: "unknown",
-    hndl: true,
-    cwe: CWE_HARDCODED_KEY,
-    sensitive: true,
-    message: "Embedded OpenSSH private key (RSA/ECDSA/Ed25519); classical and not quantum-safe.",
-    remediation: "Rotate the key; plan migration to PQC-capable SSH (e.g. sntrup761x25519).",
+    meta: {
+      id: "pem-openssh-private-key",
+      title: "OpenSSH private key",
+      description: "OpenSSH private key block",
+      category: "certificate",
+      severity: "critical",
+      confidence: "high",
+      algorithm: "unknown",
+      hndl: true,
+      cwe: CWE_HARDCODED_KEY,
+      sensitive: true,
+      message: "Embedded OpenSSH private key (RSA/ECDSA/Ed25519); classical and not quantum-safe.",
+      remediation: "Rotate the key; plan migration to PQC-capable SSH (e.g. sntrup761x25519).",
+    },
   },
   {
     re: /-----BEGIN PGP PRIVATE KEY BLOCK-----/g,
-    ruleId: "pem-pgp-private-key",
-    title: "PGP/GPG private key block",
-    category: "certificate",
-    severity: "critical",
-    algorithm: "unknown",
-    hndl: true,
-    cwe: CWE_HARDCODED_KEY,
-    sensitive: true,
-    message:
-      "Embedded PGP/GPG private key block (RSA/ECDSA/EdDSA/ElGamal); classical and not quantum-safe.",
-    remediation: "Rotate the key; track OpenPGP PQC drafts for migration.",
+    meta: {
+      id: "pem-pgp-private-key",
+      title: "PGP/GPG private key block",
+      description: "OpenPGP private key block",
+      category: "certificate",
+      severity: "critical",
+      confidence: "high",
+      algorithm: "unknown",
+      hndl: true,
+      cwe: CWE_HARDCODED_KEY,
+      sensitive: true,
+      message:
+        "Embedded PGP/GPG private key block (RSA/ECDSA/EdDSA/ElGamal); classical and not quantum-safe.",
+      remediation: "Rotate the key; track OpenPGP PQC drafts for migration.",
+    },
   },
   {
     re: /-----BEGIN PGP MESSAGE-----/g,
-    ruleId: "pem-pgp-message",
-    title: "PGP/GPG encrypted message",
-    category: "certificate",
-    severity: "low",
-    algorithm: "unknown",
-    hndl: true,
-    cwe: CWE_BROKEN_CRYPTO,
-    message:
-      "Embedded PGP/GPG message; likely encrypted with classical RSA/ElGamal (harvest-now-decrypt-later).",
-    remediation: "Re-encrypt with PQC-capable tooling as OpenPGP PQC profiles mature.",
+    meta: {
+      id: "pem-pgp-message",
+      title: "PGP/GPG encrypted message",
+      description: "OpenPGP encrypted message block",
+      category: "certificate",
+      severity: "low",
+      confidence: "high",
+      algorithm: "unknown",
+      hndl: true,
+      cwe: CWE_BROKEN_CRYPTO,
+      message:
+        "Embedded PGP/GPG message; likely encrypted with classical RSA/ElGamal (harvest-now-decrypt-later).",
+      remediation: "Re-encrypt with PQC-capable tooling as OpenPGP PQC profiles mature.",
+    },
   },
   {
     re: /-----BEGIN (?:ENCRYPTED )?PRIVATE KEY-----/g,
-    ruleId: "pem-pkcs8-private-key",
-    title: "Private key (PKCS#8 PEM)",
-    category: "certificate",
-    severity: "critical",
-    algorithm: "unknown",
-    hndl: true,
-    cwe: CWE_HARDCODED_KEY,
-    sensitive: true,
-    message: "Embedded PKCS#8 private key; likely classical RSA/EC, not quantum-safe.",
-    remediation: "Migrate to PQC keys and remove embedded private keys from source.",
+    meta: {
+      id: "pem-pkcs8-private-key",
+      title: "Private key (PKCS#8 PEM)",
+      description: "PKCS#8 private key block",
+      category: "certificate",
+      severity: "critical",
+      confidence: "high",
+      algorithm: "unknown",
+      hndl: true,
+      cwe: CWE_HARDCODED_KEY,
+      sensitive: true,
+      message: "Embedded PKCS#8 private key; likely classical RSA/EC, not quantum-safe.",
+      remediation: "Migrate to PQC keys and remove embedded private keys from source.",
+    },
   },
   {
     re: /-----BEGIN CERTIFICATE-----/g,
-    ruleId: "pem-certificate",
-    title: "X.509 certificate (PEM)",
-    category: "certificate",
-    severity: "low",
-    algorithm: "unknown",
-    hndl: false,
-    cwe: CWE_BROKEN_CRYPTO,
-    message: "Embedded X.509 certificate; almost certainly signed with classical RSA/ECDSA.",
-    remediation: "Plan re-issuance with PQC-capable CAs as ML-DSA certificate profiles mature.",
+    meta: {
+      id: "pem-certificate",
+      title: "X.509 certificate (PEM)",
+      description: "X.509 certificate block",
+      category: "certificate",
+      severity: "low",
+      confidence: "high",
+      algorithm: "unknown",
+      hndl: false,
+      cwe: CWE_BROKEN_CRYPTO,
+      message: "Embedded X.509 certificate; almost certainly signed with classical RSA/ECDSA.",
+      remediation: "Plan re-issuance with PQC-capable CAs as ML-DSA certificate profiles mature.",
+    },
   },
 ];
 
@@ -136,6 +165,7 @@ export const pemDetector: Detector = {
   description: "PEM-encoded private keys and X.509 certificates in any file",
   scope: "config",
   language: "any",
+  rules: PEM_RULES.map((r) => r.meta),
   // Applies to every text file; the walker already filters out binaries.
   appliesTo: () => true,
   detect({ file, content }): Finding[] {
@@ -146,18 +176,7 @@ export const pemDetector: Detector = {
     for (const rule of PEM_RULES) {
       eachMatch(rule.re, content, (m) => {
         findings.push(
-          makeFinding({
-            ruleId: rule.ruleId,
-            title: rule.title,
-            category: rule.category,
-            severity: rule.severity,
-            confidence: "high",
-            algorithm: rule.algorithm,
-            hndl: rule.hndl,
-            cwe: rule.cwe,
-            sensitive: rule.sensitive,
-            message: rule.message,
-            remediation: rule.remediation,
+          findingFromRule(rule.meta, {
             file,
             content,
             index: m.index,