@quantakrypto/core 0.2.2 → 0.4.0

package/dist/walk.js

@@ -6,6 +6,7 @@
  */
 import { readdir, stat } from "node:fs/promises";
 import * as path from "node:path";
+import { isManifestFile } from "./dependencies.js";
 /** Directories ignored by default (can be disabled with noDefaultIgnores). */
 export const DEFAULT_IGNORES = [
     "node_modules",
@@ -95,13 +96,86 @@ const BINARY_EXTENSIONS = new Set([
 export function toPosix(p) {
     return p.split(path.sep).join("/");
 }
-/** True if `rel` (a POSIX relative path) matches any pattern (substring/prefix). */
-function matchesAny(rel, patterns) {
+/** A pattern is treated as a glob when it contains one of these metacharacters. */
+function hasGlobMeta(pattern) {
+    return /[*?[]/.test(pattern);
+}
+/**
+ * Translate a glob into an anchored RegExp: `*` matches within a path segment
+ * (not `/`), `**` matches across segments, a leading `**` before a slash is an
+ * optional path prefix, `?` matches a single non-`/` char, `[...]` is a
+ * character class. Other regex
+ * metacharacters are escaped.
+ */
+function globToRegExp(glob) {
+    let re = "";
+    for (let i = 0; i < glob.length; i++) {
+        const c = glob[i];
+        if (c === "*") {
+            if (glob[i + 1] === "*") {
+                i++; // consume the second '*'
+                if (glob[i + 1] === "/") {
+                    i++; // consume the trailing '/'
+                    re += "(?:.*/)?"; // zero or more path segments
+                }
+                else {
+                    re += ".*"; // '**' spanning segments
+                }
+            }
+            else {
+                re += "[^/]*"; // '*' within a segment
+            }
+        }
+        else if (c === "?") {
+            re += "[^/]";
+        }
+        else if (c === "[") {
+            // Pass a character class through; find its closing ']'.
+            const end = glob.indexOf("]", i + 1);
+            if (end === -1) {
+                re += "\\[";
+            }
+            else {
+                re += glob.slice(i, end + 1);
+                i = end;
+            }
+        }
+        else if ("\\^$.|+(){}".includes(c)) {
+            re += "\\" + c;
+        }
+        else {
+            re += c;
+        }
+    }
+    return new RegExp(`^${re}$`);
+}
+/** Memoized glob→RegExp so a pattern is compiled once, not once per file. */
+const GLOB_CACHE = new Map();
+function globRegExp(pattern) {
+    let re = GLOB_CACHE.get(pattern);
+    if (!re) {
+        re = globToRegExp(pattern);
+        GLOB_CACHE.set(pattern, re);
+    }
+    return re;
+}
+/**
+ * True if `rel` (a POSIX relative path) matches any pattern. A pattern with a
+ * glob metacharacter (`*`, `?`, `[`) is matched as an anchored glob; a plain
+ * pattern keeps the historical substring / path-prefix semantics (so `"src"`
+ * still matches `src/a.ts` and `"secrets"` matches anywhere).
+ */
+export function matchesAny(rel, patterns) {
     for (const pattern of patterns) {
         if (!pattern)
             continue;
         const p = toPosix(pattern).replace(/\/+$/, "");
-        // Substring match (handles "src/legacy" or "secrets")...
+        if (hasGlobMeta(p)) {
+            if (globRegExp(p).test(rel))
+                return true;
+            continue;
+        }
+        // Plain pattern: substring match (handles "src/legacy" or "secrets")...
         if (rel.includes(p))
             return true;
         // ...and explicit path-prefix match ("foo" should match "foo/bar.ts").
@@ -200,15 +274,12 @@ export async function* walkFiles(root, options = {}) {
  * scanned for vulnerable dependencies instead of being silently dropped.
  */
 function passesSizeLimit(rel, size, maxFileSize) {
-    if (isManifestPath(rel))
+    // Dependency manifests are always read (they can exceed the size cap but carry
+    // the whole dependency tree). Uses the single {@link isManifestFile} definition.
+    if (isManifestFile(rel))
         return true;
     return size <= maxFileSize;
 }
-/** True if the path's basename is a dependency manifest we always read. */
-function isManifestPath(rel) {
-    const base = rel.split("/").pop() ?? rel;
-    return base === "package.json" || base === "package-lock.json";
-}
 /** Internal recursive directory walker. `relDir` is POSIX-relative to the root. */
 async function* walkDir(absDir, relDir, ctx) {
     let entries;
@@ -242,9 +313,12 @@ async function* walkDir(absDir, relDir, ctx) {
             continue;
         if (!isIncluded(rel, ctx.include))
             continue;
-        if (isBinaryPath(rel))
+        // Dependency manifests (incl. yarn.lock / pnpm-lock.yaml) are always read —
+        // they carry the dependency tree and must not be dropped as binary/generated.
+        const manifest = isManifestFile(rel);
+        if (!manifest && isBinaryPath(rel))
             continue;
-        if (isGeneratedPath(rel))
+        if (!manifest && isGeneratedPath(rel))
             continue;
         try {
             const s = await stat(abs);

package/dist/walk.js.map

@@ -1 +1 @@
-{"version":3,"file":"walk.js","sourceRoot":"","sources":["../src/walk.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,8EAA8E;AAC9E,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,cAAc;IACd,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,KAAK;IACL,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,QAAQ;CACT,CAAC;AAEF,gDAAgD;AAChD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAErD;;;GAGG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAS;IACxC,SAAS;IACT,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,MAAM;IACN,MAAM;IACN,MAAM;IACN,wBAAwB;IACxB,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,MAAM;IACN,MAAM;IACN,QAAQ;IACR,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,uBAAuB;IACvB,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,KAAK;IACL,QAAQ;IACR,MAAM;IACN,IAAI;IACJ,IAAI;IACJ,QAAQ;IACR,OAAO;IACP,kBAAkB;IAClB,KAAK;IACL,SAAS;IACT,UAAU;IACV,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,OAAO;IACP,MAAM;IACN,SAAS;IACT,OAAO;CACR,CAAC,CAAC;AAiBH,0DAA0D;AAC1D,MAAM,UAAU,OAAO,CAAC,CAAS;IAC/B,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACrC,CAAC;AAED,oFAAoF;AACpF,SAAS,UAAU,CAAC,GAAW,EAAE,QAA2B;IAC1D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/C,yDAAyD;QACzD,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACjC,uEAAuE;QACvE,IAAI,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yEAAyE;AACzE,SAAS,UAAU,CAAC,GAAW,EAAE,OAA0B;IACzD,OAAO,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,GAAW,EAAE,OAA0B;IACzD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,mDAAmD;IACnD,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,iBAAiB,GACrB,gHAAgH,CAAC;AAEnH,wEAAwE;AACxE,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC5E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC;YACzC,IAAI,GAAG,GAAG,OAAO;gBAAE,OAAO,GAAG,GAAG,CAAC;YACjC,GAAG,GAAG,CAAC,CAAC;YACR,KAAK,EAAE,CAAC;QACV,CAAC;aAAM,CAAC;YACN,GAAG,EAAE,CAAC;QACR,CAAC;IACH,CAAC;IACD,IAAI,GAAG,GAAG,OAAO;QAAE,OAAO,GAAG,GAAG,CAAC;IACjC,IAAI,OAAO,GAAG,MAAM;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC;IACtC,OAAO,OAAO,GAAG,KAAK,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,SAAS,CAAC,IAAY,EAAE,UAAuB,EAAE;IACtE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,qBAAqB,CAAC;IACjE,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;IAEhE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IAElC,8EAA8E;IAC9E,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,IACE,CAAC,YAAY,CAAC,IAAI,CAAC;YACnB,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC;YACzB,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,EACjD,CAAC;YACD,MAAM,IAAI,CAAC;QACb,CAAC;QACD,OAAO;IACT,CAAC;IAED,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;AACvE,CAAC;AASD;;;;GAIG;AACH,SAAS,eAAe,CAAC,GAAW,EAAE,IAAY,EAAE,WAAmB;IACrE,IAAI,cAAc,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,IAAI,IAAI,WAAW,CAAC;AAC7B,CAAC;AAED,2EAA2E;AAC3E,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC;IACzC,OAAO,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,mBAAmB,CAAC;AACjE,CAAC;AAED,mFAAmF;AACnF,KAAK,SAAS,CAAC,CAAC,OAAO,CAAC,MAAc,EAAE,MAAc,EAAE,GAAgB;IACtE,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,OAAO;IACT,CAAC;IAED,yDAAyD;IACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEzE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAE1C,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;YAC3B,8DAA8D;YAC9D,SAAS;QACX,CAAC;QAED,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC/C,IAAI,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC;gBAAE,SAAS;YAC3C,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YAC9B,SAAS;QACX,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,SAAS;QAC9B,IAAI,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAC3C,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAC5C,IAAI,YAAY,CAAC,GAAG,CAAC;YAAE,SAAS;QAChC,IAAI,eAAe,CAAC,GAAG,CAAC;YAAE,SAAS;QAEnC,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,WAAW,CAAC;gBAAE,SAAS;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}
+{"version":3,"file":"walk.js","sourceRoot":"","sources":["../src/walk.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,cAAc;IACd,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,KAAK;IACL,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,QAAQ;CACT,CAAC;AAEF,gDAAgD;AAChD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAErD;;;GAGG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAS;IACxC,SAAS;IACT,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,MAAM;IACN,MAAM;IACN,MAAM;IACN,wBAAwB;IACxB,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,MAAM;IACN,MAAM;IACN,QAAQ;IACR,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,uBAAuB;IACvB,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,KAAK;IACL,QAAQ;IACR,MAAM;IACN,IAAI;IACJ,IAAI;IACJ,QAAQ;IACR,OAAO;IACP,kBAAkB;IAClB,KAAK;IACL,SAAS;IACT,UAAU;IACV,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,OAAO;IACP,MAAM;IACN,SAAS;IACT,OAAO;CACR,CAAC,CAAC;AAiBH,0DAA0D;AAC1D,MAAM,UAAU,OAAO,CAAC,CAAS;IAC/B,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACrC,CAAC;AAED,mFAAmF;AACnF,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACxB,CAAC,EAAE,CAAC,CAAC,yBAAyB;gBAC9B,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBACxB,CAAC,EAAE,CAAC,CAAC,2BAA2B;oBAChC,EAAE,IAAI,UAAU,CAAC,CAAC,6BAA6B;gBACjD,CAAC;qBAAM,CAAC;oBACN,EAAE,IAAI,IAAI,CAAC,CAAC,yBAAyB;gBACvC,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,EAAE,IAAI,OAAO,CAAC,CAAC,uBAAuB;YACxC,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,EAAE,IAAI,MAAM,CAAC;QACf,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,wDAAwD;YACxD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACrC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;gBACf,EAAE,IAAI,KAAK,CAAC;YACd,CAAC;iBAAM,CAAC;gBACN,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;gBAC7B,CAAC,GAAG,GAAG,CAAC;YACV,CAAC;QACH,CAAC;aAAM,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,EAAE,IAAI,IAAI,GAAG,CAAC,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,EAAE,IAAI,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;AAC7C,SAAS,UAAU,CAAC,OAAe;IACjC,IAAI,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QAC3B,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,QAA2B;IACjE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YACnB,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzC,SAAS;QACX,CAAC;QACD,wEAAwE;QACxE,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACjC,uEAAuE;QACvE,IAAI,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yEAAyE;AACzE,SAAS,UAAU,CAAC,GAAW,EAAE,OAA0B;IACzD,OAAO,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,GAAW,EAAE,OAA0B;IACzD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,mDAAmD;IACnD,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,iBAAiB,GACrB,gHAAgH,CAAC;AAEnH,wEAAwE;AACxE,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC5E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC;YACzC,IAAI,GAAG,GAAG,OAAO;gBAAE,OAAO,GAAG,GAAG,CAAC;YACjC,GAAG,GAAG,CAAC,CAAC;YACR,KAAK,EAAE,CAAC;QACV,CAAC;aAAM,CAAC;YACN,GAAG,EAAE,CAAC;QACR,CAAC;IACH,CAAC;IACD,IAAI,GAAG,GAAG,OAAO;QAAE,OAAO,GAAG,GAAG,CAAC;IACjC,IAAI,OAAO,GAAG,MAAM;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC;IACtC,OAAO,OAAO,GAAG,KAAK,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,SAAS,CAAC,IAAY,EAAE,UAAuB,EAAE;IACtE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,qBAAqB,CAAC;IACjE,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;IAEhE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IAElC,8EAA8E;IAC9E,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,IACE,CAAC,YAAY,CAAC,IAAI,CAAC;YACnB,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC;YACzB,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,EACjD,CAAC;YACD,MAAM,IAAI,CAAC;QACb,CAAC;QACD,OAAO;IACT,CAAC;IAED,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;AACvE,CAAC;AASD;;;;GAIG;AACH,SAAS,eAAe,CAAC,GAAW,EAAE,IAAY,EAAE,WAAmB;IACrE,+EAA+E;IAC/E,iFAAiF;IACjF,IAAI,cAAc,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,IAAI,IAAI,WAAW,CAAC;AAC7B,CAAC;AAED,mFAAmF;AACnF,KAAK,SAAS,CAAC,CAAC,OAAO,CAAC,MAAc,EAAE,MAAc,EAAE,GAAgB;IACtE,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,OAAO;IACT,CAAC;IAED,yDAAyD;IACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEzE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAE1C,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;YAC3B,8DAA8D;YAC9D,SAAS;QACX,CAAC;QAED,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC/C,IAAI,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC;gBAAE,SAAS;YAC3C,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YAC9B,SAAS;QACX,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,SAAS;QAC9B,IAAI,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAC3C,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAC5C,4EAA4E;QAC5E,8EAA8E;QAC9E,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,GAAG,CAAC;YAAE,SAAS;QAC7C,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC;YAAE,SAAS;QAEhD,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,WAAW,CAAC;gBAAE,SAAS;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/worktree.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Create a detached worktree of `repoRoot` at HEAD, run `fn` with its path, and
+ * always tear it down. Throws if `repoRoot` is not a git repository.
+ */
+export declare function withWorktree<T>(repoRoot: string, fn: (dir: string) => Promise<T>): Promise<T>;
+//# sourceMappingURL=worktree.d.ts.map

package/dist/worktree.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worktree.d.ts","sourceRoot":"","sources":["../src/worktree.ts"],"names":[],"mappings":"AAkBA;;;GAGG;AACH,wBAAsB,YAAY,CAAC,CAAC,EAClC,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAC9B,OAAO,CAAC,CAAC,CAAC,CAmBZ"}

package/dist/worktree.js

@@ -0,0 +1,43 @@
+/**
+ * Ephemeral git worktree runner. Remediation applies candidate patches inside a
+ * throwaway `git worktree` checked out at HEAD, so the user's working tree is
+ * never touched while patches are being tried and verified. The worktree is
+ * always removed afterwards, even if the callback throws.
+ */
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+const exec = promisify(execFile);
+async function git(args, cwd) {
+    await exec("git", args, { cwd });
+}
+/**
+ * Create a detached worktree of `repoRoot` at HEAD, run `fn` with its path, and
+ * always tear it down. Throws if `repoRoot` is not a git repository.
+ */
+export async function withWorktree(repoRoot, fn) {
+    try {
+        await git(["rev-parse", "--is-inside-work-tree"], repoRoot);
+    }
+    catch {
+        throw new Error(`withWorktree: "${repoRoot}" is not a git repository`);
+    }
+    const base = await mkdtemp(join(tmpdir(), "quantakrypto-wt-"));
+    const dir = join(base, "wt");
+    await git(["worktree", "add", "--detach", dir], repoRoot);
+    try {
+        return await fn(dir);
+    }
+    finally {
+        try {
+            await git(["worktree", "remove", "--force", dir], repoRoot);
+        }
+        catch {
+            // best effort — the temp dir removal below still reclaims the disk.
+        }
+        await rm(base, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=worktree.js.map

package/dist/worktree.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worktree.js","sourceRoot":"","sources":["../src/worktree.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEjC,KAAK,UAAU,GAAG,CAAC,IAAc,EAAE,GAAY;IAC7C,MAAM,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,EAA+B;IAE/B,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,CAAC,WAAW,EAAE,uBAAuB,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,2BAA2B,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7B,MAAM,GAAG,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;QACtE,CAAC;QACD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quantakrypto/core",
-  "version": "0.2.2",
+  "version": "0.4.0",
   "description": "Shared post-quantum readiness library: crypto detectors, vulnerable-dependency database, inventory + SARIF reporting. Zero runtime dependencies.",
   "license": "Apache-2.0",
   "author": "Dandelion Labs <hello@dandelionlabs.io> (https://dandelionlabs.io)",

package/src/agent-types.ts

@@ -0,0 +1,52 @@
+/**
+ * Shared types for the agent (BYOK) plane. These live in `@quantakrypto/core`
+ * (offline) so both the deterministic MCP tools and the networked
+ * `@quantakrypto/agent` package speak the same shapes without the offline side
+ * ever importing the network client.
+ */
+import type { Severity, TriageAnnotation } from "./types.js";
+
+/** How much source context a redacted request carries. */
+export type ContextLevel = "metadata" | "snippet" | "function" | "file";
+
+/** A finding's context, redacted to a {@link ContextLevel} and secret-stripped. */
+export interface RedactedContext {
+  level: ContextLevel;
+  meta: {
+    ruleId: string;
+    algorithm?: string;
+    severity: Severity;
+    hndl: boolean;
+    file: string;
+    line: number;
+    message: string;
+  };
+  /** Redacted source, or null at `metadata` level / for a `sensitive` finding. */
+  code: string | null;
+  /** True when key material was stripped from the context. */
+  redactedSecret: boolean;
+}
+
+/** An LLM triage verdict for a single finding (never suppresses it). The
+ * exposure/priority/rationale body is the {@link TriageAnnotation} that gets
+ * attached to the finding; `fingerprint` links it back to that finding. */
+export interface TriageVerdict extends TriageAnnotation {
+  fingerprint: string;
+}
+
+/** A concrete proposed edit: the full new content for a single file. */
+export interface Patch {
+  path: string;
+  /** Full replacement content for `path` after the fix. */
+  newContent: string;
+  ruleId: string;
+  source: "codemod" | "llm";
+}
+
+/** An LLM-proposed fix before it enters the deterministic pipeline. */
+export interface FixProposal {
+  fingerprint: string;
+  path: string;
+  newContent: string;
+  explanation: string;
+}

package/src/cache.ts

@@ -0,0 +1,120 @@
+/**
+ * Optional on-disk scan cache. Keyed by file content hash so an unchanged file
+ * reuses its previous findings instead of re-running every detector — the big
+ * win on large monorepos where most files don't change between runs.
+ *
+ * Invalidation is conservative and whole-cache: the cache stores a RULESET
+ * FINGERPRINT (tool version + the active detector ids + disabled rules). If any
+ * of those differ from the current run, the entire cache is discarded and
+ * rebuilt, so upgrading the tool or changing the rules never serves stale
+ * results. Per file, a content-hash mismatch re-scans just that file.
+ *
+ * The cache is opt-in (`ScanOptions.cacheFile`); with no cache file, scans are
+ * exactly as before. A corrupt / unreadable / wrong-version cache file is
+ * ignored (treated as empty), never fatal.
+ */
+import { createHash } from "node:crypto";
+import { readFile, writeFile, mkdir } from "node:fs/promises";
+import * as path from "node:path";
+
+import type { Detector, Finding } from "./types.js";
+import { VERSION } from "./version.js";
+
+const CACHE_VERSION = 1;
+
+/** One cached file: the content hash it was computed for, and its findings. */
+export interface CacheEntry {
+  hash: string;
+  findings: Finding[];
+}
+
+interface CacheFileShape {
+  version: number;
+  ruleset: string;
+  entries: Record<string, CacheEntry>;
+}
+
+/** sha256 of a file's content (hex). */
+export function hashContent(content: string): string {
+  return createHash("sha256").update(content, "utf8").digest("hex");
+}
+
+/**
+ * Fingerprint of everything that changes what a scan produces: the tool version,
+ * the active detector ids (sorted), and the disabled-rule set (sorted). A change
+ * to any of these invalidates the whole cache.
+ */
+export function rulesetFingerprint(
+  detectors: readonly Detector[],
+  disabledRules: readonly string[] | undefined,
+): string {
+  const ids = detectors.map((d) => d.id).sort();
+  const disabled = [...(disabledRules ?? [])].sort();
+  return `v${VERSION}|d:${ids.join(",")}|x:${disabled.join(",")}`;
+}
+
+/**
+ * Load the cache file into a `Map<relPath, CacheEntry>`. Returns an empty map
+ * when the file is missing, unparseable, the wrong version, or was written for a
+ * different ruleset (in which case its entries are stale and must not be reused).
+ */
+export async function loadCache(
+  cacheFile: string,
+  ruleset: string,
+): Promise<Map<string, CacheEntry>> {
+  let raw: string;
+  try {
+    raw = await readFile(cacheFile, "utf8");
+  } catch {
+    return new Map();
+  }
+  let parsed: CacheFileShape;
+  try {
+    parsed = JSON.parse(raw) as CacheFileShape;
+  } catch {
+    return new Map();
+  }
+  if (
+    parsed === null ||
+    typeof parsed !== "object" ||
+    parsed.version !== CACHE_VERSION ||
+    parsed.ruleset !== ruleset ||
+    typeof parsed.entries !== "object" ||
+    parsed.entries === null
+  ) {
+    return new Map();
+  }
+  const map = new Map<string, CacheEntry>();
+  for (const [file, entry] of Object.entries(parsed.entries)) {
+    if (entry && typeof entry.hash === "string" && Array.isArray(entry.findings)) {
+      map.set(file, entry);
+    }
+  }
+  return map;
+}
+
+/**
+ * Write the cache atomically (temp file + rename) so a concurrent reader never
+ * sees a half-written file. Errors are swallowed — a cache is an optimization,
+ * never a reason to fail a scan.
+ */
+export async function saveCache(
+  cacheFile: string,
+  ruleset: string,
+  entries: Map<string, CacheEntry>,
+): Promise<void> {
+  const doc: CacheFileShape = {
+    version: CACHE_VERSION,
+    ruleset,
+    entries: Object.fromEntries(entries),
+  };
+  try {
+    await mkdir(path.dirname(cacheFile), { recursive: true });
+    const tmp = `${cacheFile}.tmp-${process.pid}`;
+    await writeFile(tmp, JSON.stringify(doc), "utf8");
+    const { rename } = await import("node:fs/promises");
+    await rename(tmp, cacheFile);
+  } catch {
+    // best effort
+  }
+}

package/src/cbom.ts

@@ -56,6 +56,32 @@ function isQuantumVulnerable(algorithm: AlgorithmFamily): boolean {
   return algorithm !== "unknown";
 }
 
+/**
+ * Approximate CLASSICAL security strength (bits) of the common parameterisation
+ * of a classical family — RSA-2048 / DH-2048 ≈ 112-bit, 256-bit curves ≈ 128-bit,
+ * X448 ≈ 224-bit. (The QUANTUM level is 0 for all of these: Shor breaks them.)
+ * 0 when the family is unknown. Reported so a CBOM doesn't imply these primitives
+ * have zero classical strength today.
+ */
+function classicalSecurityLevelFor(algorithm: AlgorithmFamily): number {
+  switch (algorithm) {
+    case "RSA":
+    case "DH":
+    case "DSA":
+      return 112;
+    case "ECDH":
+    case "ECDSA":
+    case "EdDSA":
+    case "X25519":
+    case "ECIES":
+      return 128;
+    case "X448":
+      return 224;
+    default:
+      return 0;
+  }
+}
+
 /** Deterministic bom-ref for a (algorithm, primitive) asset key. */
 function bomRef(key: string): string {
   return `crypto:${createHash("sha256").update(key, "utf8").digest("hex").slice(0, 16)}`;
@@ -107,7 +133,7 @@ export function toCbom(result: ScanResult): CycloneDxBom {
             primitive: g.primitive,
             parameterSetIdentifier: g.algorithm,
             executionEnvironment: "software-plain-ram",
-            classicalSecurityLevel: 0,
+            classicalSecurityLevel: classicalSecurityLevelFor(g.algorithm),
             nistQuantumSecurityLevel: 0,
             cryptoFunctions:
               g.primitive === "signature"

package/src/changed.ts

@@ -53,11 +53,20 @@ export async function changedFiles(root: string, since?: string): Promise<string
   // than repo-root-relative, so `scan()` can join them against a sub-directory
   // root. Without it, a `--changed` scan of a subdirectory resolves nothing.
   if (since) {
-    for (const f of toLines(
-      await git(root, ["diff", "--name-only", "--relative", "--diff-filter=ACMR", since]),
-    )) {
-      out.add(f);
+    // A `git diff` against `since` returns null ONLY when the command failed —
+    // almost always an unknown ref/range (a typo like `--since maiin`). Surface
+    // it instead of silently scanning just the uncommitted files and passing CI.
+    const diff = await git(root, [
+      "diff",
+      "--name-only",
+      "--relative",
+      "--diff-filter=ACMR",
+      since,
+    ]);
+    if (diff === null) {
+      throw new Error(`--since: git could not diff against "${since}" (unknown ref or range).`);
     }
+    for (const f of toLines(diff)) out.add(f);
   }
 
   // Always include local uncommitted edits (staged + unstaged), filtered to ACMR.

package/src/codemods/config-toggle.ts

@@ -0,0 +1,35 @@
+/**
+ * Config-toggle codemod: mechanical, unambiguous fixes for insecure TLS config.
+ * Both target rules have a single correct replacement, so the fix is
+ * deterministic and clears the finding (verified by the pipeline's gate).
+ *
+ *  - `tls-legacy-version`  — bump a pinned TLS 1.0/1.1 to TLS 1.3.
+ *  - `tls-reject-unauthorized` — turn certificate verification back on.
+ */
+import type { Finding } from "../types.js";
+import type { Patch } from "../agent-types.js";
+import type { Codemod } from "./registry.js";
+
+export const configToggleCodemod: Codemod = {
+  id: "config-toggle",
+  applies(finding: Finding): boolean {
+    return finding.ruleId === "tls-legacy-version" || finding.ruleId === "tls-reject-unauthorized";
+  },
+  apply(content: string, finding: Finding): Patch | null {
+    let out = content;
+    if (finding.ruleId === "tls-legacy-version") {
+      out = out
+        .replace(/((?:minVersion|maxVersion)\s*:\s*['"`])TLSv1(?:\.1)?(['"`])/g, "$1TLSv1.3$2")
+        .replace(/(secureProtocol\s*:\s*['"`])TLSv1(?:_1)?_method(['"`])/g, "$1TLSv1_3_method$2");
+    } else if (finding.ruleId === "tls-reject-unauthorized") {
+      out = out.replace(/(rejectUnauthorized\s*:\s*)false/g, "$1true");
+    }
+    if (out === content) return null;
+    return {
+      path: finding.location.file,
+      newContent: out,
+      ruleId: finding.ruleId,
+      source: "codemod",
+    };
+  },
+};

package/src/codemods/registry.ts

@@ -0,0 +1,31 @@
+/**
+ * Codemod registry — deterministic, template-able fixes keyed by finding.
+ *
+ * A codemod only earns a place here if its output reliably CLEARS the finding
+ * (the remediation pipeline enforces this with the `verify_fix` gate). That
+ * makes the set deliberately small: mechanical config toggles qualify;
+ * dependency swaps and source crypto rewrites generally do NOT (there is no
+ * safe drop-in replacement, and a manifest fix can't "remove" the finding
+ * without deleting the dependency) — those are left to triage + the LLM
+ * remediation layer, not an auto-codemod.
+ */
+import type { Finding } from "../types.js";
+import type { Patch } from "../agent-types.js";
+import { configToggleCodemod } from "./config-toggle.js";
+
+/** A deterministic fix for a class of findings. */
+export interface Codemod {
+  id: string;
+  /** True when this codemod can produce a deterministic fix for the finding. */
+  applies(finding: Finding): boolean;
+  /** Produce a patch (full new file content), or null if it changed nothing. */
+  apply(content: string, finding: Finding): Patch | null;
+}
+
+/** All registered codemods, in priority order. */
+export const codemodRegistry: Codemod[] = [configToggleCodemod];
+
+/** The first codemod that applies to `finding`, or undefined. */
+export function codemodFor(finding: Finding): Codemod | undefined {
+  return codemodRegistry.find((c) => c.applies(finding));
+}