@quantakrypto/core 0.3.0 → 0.4.0

package/dist/agent-types.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Shared types for the agent (BYOK) plane. These live in `@quantakrypto/core`
+ * (offline) so both the deterministic MCP tools and the networked
+ * `@quantakrypto/agent` package speak the same shapes without the offline side
+ * ever importing the network client.
+ */
+import type { Severity, TriageAnnotation } from "./types.js";
+/** How much source context a redacted request carries. */
+export type ContextLevel = "metadata" | "snippet" | "function" | "file";
+/** A finding's context, redacted to a {@link ContextLevel} and secret-stripped. */
+export interface RedactedContext {
+    level: ContextLevel;
+    meta: {
+        ruleId: string;
+        algorithm?: string;
+        severity: Severity;
+        hndl: boolean;
+        file: string;
+        line: number;
+        message: string;
+    };
+    /** Redacted source, or null at `metadata` level / for a `sensitive` finding. */
+    code: string | null;
+    /** True when key material was stripped from the context. */
+    redactedSecret: boolean;
+}
+/** An LLM triage verdict for a single finding (never suppresses it). The
+ * exposure/priority/rationale body is the {@link TriageAnnotation} that gets
+ * attached to the finding; `fingerprint` links it back to that finding. */
+export interface TriageVerdict extends TriageAnnotation {
+    fingerprint: string;
+}
+/** A concrete proposed edit: the full new content for a single file. */
+export interface Patch {
+    path: string;
+    /** Full replacement content for `path` after the fix. */
+    newContent: string;
+    ruleId: string;
+    source: "codemod" | "llm";
+}
+/** An LLM-proposed fix before it enters the deterministic pipeline. */
+export interface FixProposal {
+    fingerprint: string;
+    path: string;
+    newContent: string;
+    explanation: string;
+}
+//# sourceMappingURL=agent-types.d.ts.map

package/dist/agent-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-types.d.ts","sourceRoot":"","sources":["../src/agent-types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE7D,0DAA0D;AAC1D,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,SAAS,GAAG,UAAU,GAAG,MAAM,CAAC;AAExE,mFAAmF;AACnF,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,YAAY,CAAC;IACpB,IAAI,EAAE;QACJ,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,QAAQ,CAAC;QACnB,IAAI,EAAE,OAAO,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,gFAAgF;IAChF,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,4DAA4D;IAC5D,cAAc,EAAE,OAAO,CAAC;CACzB;AAED;;2EAE2E;AAC3E,MAAM,WAAW,aAAc,SAAQ,gBAAgB;IACrD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wEAAwE;AACxE,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,GAAG,KAAK,CAAC;CAC3B;AAED,uEAAuE;AACvE,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB"}

package/dist/agent-types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=agent-types.js.map

package/dist/agent-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-types.js","sourceRoot":"","sources":["../src/agent-types.ts"],"names":[],"mappings":""}

package/dist/cache.d.ts

@@ -0,0 +1,27 @@
+import type { Detector, Finding } from "./types.js";
+/** One cached file: the content hash it was computed for, and its findings. */
+export interface CacheEntry {
+    hash: string;
+    findings: Finding[];
+}
+/** sha256 of a file's content (hex). */
+export declare function hashContent(content: string): string;
+/**
+ * Fingerprint of everything that changes what a scan produces: the tool version,
+ * the active detector ids (sorted), and the disabled-rule set (sorted). A change
+ * to any of these invalidates the whole cache.
+ */
+export declare function rulesetFingerprint(detectors: readonly Detector[], disabledRules: readonly string[] | undefined): string;
+/**
+ * Load the cache file into a `Map<relPath, CacheEntry>`. Returns an empty map
+ * when the file is missing, unparseable, the wrong version, or was written for a
+ * different ruleset (in which case its entries are stale and must not be reused).
+ */
+export declare function loadCache(cacheFile: string, ruleset: string): Promise<Map<string, CacheEntry>>;
+/**
+ * Write the cache atomically (temp file + rename) so a concurrent reader never
+ * sees a half-written file. Errors are swallowed — a cache is an optimization,
+ * never a reason to fail a scan.
+ */
+export declare function saveCache(cacheFile: string, ruleset: string, entries: Map<string, CacheEntry>): Promise<void>;
+//# sourceMappingURL=cache.d.ts.map

package/dist/cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAKpD,+EAA+E;AAC/E,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,EAAE,CAAC;CACrB;AAQD,wCAAwC;AACxC,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,SAAS,QAAQ,EAAE,EAC9B,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,GAC3C,MAAM,CAIR;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAC7B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CA8BlC;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAC7B,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAC/B,OAAO,CAAC,IAAI,CAAC,CAef"}

package/dist/cache.js

@@ -0,0 +1,93 @@
+/**
+ * Optional on-disk scan cache. Keyed by file content hash so an unchanged file
+ * reuses its previous findings instead of re-running every detector — the big
+ * win on large monorepos where most files don't change between runs.
+ *
+ * Invalidation is conservative and whole-cache: the cache stores a RULESET
+ * FINGERPRINT (tool version + the active detector ids + disabled rules). If any
+ * of those differ from the current run, the entire cache is discarded and
+ * rebuilt, so upgrading the tool or changing the rules never serves stale
+ * results. Per file, a content-hash mismatch re-scans just that file.
+ *
+ * The cache is opt-in (`ScanOptions.cacheFile`); with no cache file, scans are
+ * exactly as before. A corrupt / unreadable / wrong-version cache file is
+ * ignored (treated as empty), never fatal.
+ */
+import { createHash } from "node:crypto";
+import { readFile, writeFile, mkdir } from "node:fs/promises";
+import * as path from "node:path";
+import { VERSION } from "./version.js";
+const CACHE_VERSION = 1;
+/** sha256 of a file's content (hex). */
+export function hashContent(content) {
+    return createHash("sha256").update(content, "utf8").digest("hex");
+}
+/**
+ * Fingerprint of everything that changes what a scan produces: the tool version,
+ * the active detector ids (sorted), and the disabled-rule set (sorted). A change
+ * to any of these invalidates the whole cache.
+ */
+export function rulesetFingerprint(detectors, disabledRules) {
+    const ids = detectors.map((d) => d.id).sort();
+    const disabled = [...(disabledRules ?? [])].sort();
+    return `v${VERSION}|d:${ids.join(",")}|x:${disabled.join(",")}`;
+}
+/**
+ * Load the cache file into a `Map<relPath, CacheEntry>`. Returns an empty map
+ * when the file is missing, unparseable, the wrong version, or was written for a
+ * different ruleset (in which case its entries are stale and must not be reused).
+ */
+export async function loadCache(cacheFile, ruleset) {
+    let raw;
+    try {
+        raw = await readFile(cacheFile, "utf8");
+    }
+    catch {
+        return new Map();
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return new Map();
+    }
+    if (parsed === null ||
+        typeof parsed !== "object" ||
+        parsed.version !== CACHE_VERSION ||
+        parsed.ruleset !== ruleset ||
+        typeof parsed.entries !== "object" ||
+        parsed.entries === null) {
+        return new Map();
+    }
+    const map = new Map();
+    for (const [file, entry] of Object.entries(parsed.entries)) {
+        if (entry && typeof entry.hash === "string" && Array.isArray(entry.findings)) {
+            map.set(file, entry);
+        }
+    }
+    return map;
+}
+/**
+ * Write the cache atomically (temp file + rename) so a concurrent reader never
+ * sees a half-written file. Errors are swallowed — a cache is an optimization,
+ * never a reason to fail a scan.
+ */
+export async function saveCache(cacheFile, ruleset, entries) {
+    const doc = {
+        version: CACHE_VERSION,
+        ruleset,
+        entries: Object.fromEntries(entries),
+    };
+    try {
+        await mkdir(path.dirname(cacheFile), { recursive: true });
+        const tmp = `${cacheFile}.tmp-${process.pid}`;
+        await writeFile(tmp, JSON.stringify(doc), "utf8");
+        const { rename } = await import("node:fs/promises");
+        await rename(tmp, cacheFile);
+    }
+    catch {
+        // best effort
+    }
+}
+//# sourceMappingURL=cache.js.map

package/dist/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,MAAM,aAAa,GAAG,CAAC,CAAC;AAcxB,wCAAwC;AACxC,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,SAA8B,EAC9B,aAA4C;IAE5C,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACnD,OAAO,IAAI,OAAO,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,SAAiB,EACjB,OAAe;IAEf,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,IAAI,MAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,IACE,MAAM,KAAK,IAAI;QACf,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,CAAC,OAAO,KAAK,aAAa;QAChC,MAAM,CAAC,OAAO,KAAK,OAAO;QAC1B,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;QAClC,MAAM,CAAC,OAAO,KAAK,IAAI,EACvB,CAAC;QACD,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3D,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7E,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,SAAiB,EACjB,OAAe,EACf,OAAgC;IAEhC,MAAM,GAAG,GAAmB;QAC1B,OAAO,EAAE,aAAa;QACtB,OAAO;QACP,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC;KACrC,CAAC;IACF,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,GAAG,SAAS,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;QAC9C,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;QAClD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACpD,MAAM,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;AACH,CAAC"}

package/dist/cbom.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cbom.d.ts","sourceRoot":"","sources":["../src/cbom.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAA6C,UAAU,EAAE,MAAM,YAAY,CAAC;AAGxF,yEAAyE;AACzE,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,WAAW,CAAC;IACvB,WAAW,EAAE,KAAK,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,UAAU,EAAE,aAAa,EAAE,CAAC;CAC7B;AAED,0DAA0D;AAC1D,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,qBAAqB,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AA8BD;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,YAAY,CAqFvD"}
+{"version":3,"file":"cbom.d.ts","sourceRoot":"","sources":["../src/cbom.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAA6C,UAAU,EAAE,MAAM,YAAY,CAAC;AAGxF,yEAAyE;AACzE,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,WAAW,CAAC;IACvB,WAAW,EAAE,KAAK,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,UAAU,EAAE,aAAa,EAAE,CAAC;CAC7B;AAED,0DAA0D;AAC1D,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,qBAAqB,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAwDD;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,YAAY,CAqFvD"}

package/dist/cbom.js

@@ -32,6 +32,31 @@ function primitiveFor(category) {
 function isQuantumVulnerable(algorithm) {
     return algorithm !== "unknown";
 }
+/**
+ * Approximate CLASSICAL security strength (bits) of the common parameterisation
+ * of a classical family — RSA-2048 / DH-2048 ≈ 112-bit, 256-bit curves ≈ 128-bit,
+ * X448 ≈ 224-bit. (The QUANTUM level is 0 for all of these: Shor breaks them.)
+ * 0 when the family is unknown. Reported so a CBOM doesn't imply these primitives
+ * have zero classical strength today.
+ */
+function classicalSecurityLevelFor(algorithm) {
+    switch (algorithm) {
+        case "RSA":
+        case "DH":
+        case "DSA":
+            return 112;
+        case "ECDH":
+        case "ECDSA":
+        case "EdDSA":
+        case "X25519":
+        case "ECIES":
+            return 128;
+        case "X448":
+            return 224;
+        default:
+            return 0;
+    }
+}
 /** Deterministic bom-ref for a (algorithm, primitive) asset key. */
 function bomRef(key) {
     return `crypto:${createHash("sha256").update(key, "utf8").digest("hex").slice(0, 16)}`;
@@ -75,7 +100,7 @@ export function toCbom(result) {
                     primitive: g.primitive,
                     parameterSetIdentifier: g.algorithm,
                     executionEnvironment: "software-plain-ram",
-                    classicalSecurityLevel: 0,
+                    classicalSecurityLevel: classicalSecurityLevelFor(g.algorithm),
                     nistQuantumSecurityLevel: 0,
                     cryptoFunctions: g.primitive === "signature"
                         ? ["sign", "verify"]

package/dist/cbom.js.map

@@ -1 +1 @@
-{"version":3,"file":"cbom.js","sourceRoot":"","sources":["../src/cbom.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAqBvC,gEAAgE;AAChE,SAAS,YAAY,CAAC,QAAyB;IAC7C,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,KAAK;YACR,OAAO,KAAK,CAAC;QACf,KAAK,cAAc;YACjB,OAAO,WAAW,CAAC;QACrB,KAAK,WAAW;YACd,OAAO,WAAW,CAAC;QACrB,KAAK,aAAa;YAChB,OAAO,KAAK,CAAC;QACf,KAAK,KAAK;YACR,OAAO,OAAO,CAAC;QACjB;YACE,OAAO,OAAO,CAAC;IACnB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,SAAS,mBAAmB,CAAC,SAA0B;IACrD,OAAO,SAAS,KAAK,SAAS,CAAC;AACjC,CAAC;AAED,oEAAoE;AACpE,SAAS,MAAM,CAAC,GAAW;IACzB,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACzF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAC,MAAkB;IACvC,6CAA6C;IAC7C,MAAM,MAAM,GAAG,IAAI,GAAG,EAGnB,CAAC;IAEJ,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,SAAS,GAAoB,CAAC,CAAC,SAAS,IAAI,SAAS,CAAC;QAC5D,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC;QACxC,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;YAC3C,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,CAAC;QACD,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,UAAU,GAAoB,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;SACtD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACxD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE;QAChB,MAAM,WAAW,GAAG,CAAC,CAAC,QAAQ;aAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,QAAQ,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE;YACjD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C,CAAC,CAAC;aACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEpF,MAAM,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAE/C,OAAO;YACL,IAAI,EAAE,qBAA8B;YACpC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC;YACtB,IAAI,EAAE,GAAG,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,GAAG;YACvC,gBAAgB,EAAE;gBAChB,SAAS,EAAE,WAAW;gBACtB,mBAAmB,EAAE;oBACnB,SAAS,EAAE,CAAC,CAAC,SAAS;oBACtB,sBAAsB,EAAE,CAAC,CAAC,SAAS;oBACnC,oBAAoB,EAAE,oBAAoB;oBAC1C,sBAAsB,EAAE,CAAC;oBACzB,wBAAwB,EAAE,CAAC;oBAC3B,eAAe,EACb,CAAC,CAAC,SAAS,KAAK,WAAW;wBACzB,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC;wBACpB,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK;4BACrB,CAAC,CAAC,CAAC,aAAa,EAAE,aAAa,CAAC;4BAChC,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,WAAW;gCAC3B,CAAC,CAAC,CAAC,UAAU,CAAC;gCACd,CAAC,CAAC,CAAC,OAAO,CAAC;iBACpB;gBACD,iBAAiB,EAAE,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC;gBACnD,sBAAsB,EAAE,OAAO;aAChC;YACD,QAAQ,EAAE,EAAE,WAAW,EAAE;SAC1B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,MAAM,MAAM,GAAG,YAAY,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;IAEhD,OAAO;QACL,SAAS,EAAE,WAAW;QACtB,WAAW,EAAE,KAAK;QAClB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE;YACR,SAAS,EAAE,MAAM,CAAC,UAAU;YAC5B,KAAK,EAAE;gBACL,UAAU,EAAE;oBACV;wBACE,IAAI,EAAE,aAAa;wBACnB,IAAI,EAAE,OAAO;wBACb,OAAO,EAAE,MAAM,CAAC,WAAW,IAAI,OAAO;qBACvC;iBACF;aACF;YACD,SAAS,EAAE;gBACT,IAAI,EAAE,aAAa;gBACnB,SAAS,EAAE,MAAM;gBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB;SACF;QACD,UAAU;KACX,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,MAAkB;IACpC,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC;SAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC;SAChF,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,2DAA2D;IAC3D,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;AACzG,CAAC"}
+{"version":3,"file":"cbom.js","sourceRoot":"","sources":["../src/cbom.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAqBvC,gEAAgE;AAChE,SAAS,YAAY,CAAC,QAAyB;IAC7C,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,KAAK;YACR,OAAO,KAAK,CAAC;QACf,KAAK,cAAc;YACjB,OAAO,WAAW,CAAC;QACrB,KAAK,WAAW;YACd,OAAO,WAAW,CAAC;QACrB,KAAK,aAAa;YAChB,OAAO,KAAK,CAAC;QACf,KAAK,KAAK;YACR,OAAO,OAAO,CAAC;QACjB;YACE,OAAO,OAAO,CAAC;IACnB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,SAAS,mBAAmB,CAAC,SAA0B;IACrD,OAAO,SAAS,KAAK,SAAS,CAAC;AACjC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,yBAAyB,CAAC,SAA0B;IAC3D,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,KAAK,CAAC;QACX,KAAK,IAAI,CAAC;QACV,KAAK,KAAK;YACR,OAAO,GAAG,CAAC;QACb,KAAK,MAAM,CAAC;QACZ,KAAK,OAAO,CAAC;QACb,KAAK,OAAO,CAAC;QACb,KAAK,QAAQ,CAAC;QACd,KAAK,OAAO;YACV,OAAO,GAAG,CAAC;QACb,KAAK,MAAM;YACT,OAAO,GAAG,CAAC;QACb;YACE,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,SAAS,MAAM,CAAC,GAAW;IACzB,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACzF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAC,MAAkB;IACvC,6CAA6C;IAC7C,MAAM,MAAM,GAAG,IAAI,GAAG,EAGnB,CAAC;IAEJ,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,SAAS,GAAoB,CAAC,CAAC,SAAS,IAAI,SAAS,CAAC;QAC5D,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC;QACxC,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;YAC3C,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,CAAC;QACD,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,UAAU,GAAoB,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;SACtD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACxD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE;QAChB,MAAM,WAAW,GAAG,CAAC,CAAC,QAAQ;aAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,QAAQ,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE;YACjD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C,CAAC,CAAC;aACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEpF,MAAM,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAE/C,OAAO;YACL,IAAI,EAAE,qBAA8B;YACpC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC;YACtB,IAAI,EAAE,GAAG,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,GAAG;YACvC,gBAAgB,EAAE;gBAChB,SAAS,EAAE,WAAW;gBACtB,mBAAmB,EAAE;oBACnB,SAAS,EAAE,CAAC,CAAC,SAAS;oBACtB,sBAAsB,EAAE,CAAC,CAAC,SAAS;oBACnC,oBAAoB,EAAE,oBAAoB;oBAC1C,sBAAsB,EAAE,yBAAyB,CAAC,CAAC,CAAC,SAAS,CAAC;oBAC9D,wBAAwB,EAAE,CAAC;oBAC3B,eAAe,EACb,CAAC,CAAC,SAAS,KAAK,WAAW;wBACzB,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC;wBACpB,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK;4BACrB,CAAC,CAAC,CAAC,aAAa,EAAE,aAAa,CAAC;4BAChC,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,WAAW;gCAC3B,CAAC,CAAC,CAAC,UAAU,CAAC;gCACd,CAAC,CAAC,CAAC,OAAO,CAAC;iBACpB;gBACD,iBAAiB,EAAE,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC;gBACnD,sBAAsB,EAAE,OAAO;aAChC;YACD,QAAQ,EAAE,EAAE,WAAW,EAAE;SAC1B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,MAAM,MAAM,GAAG,YAAY,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;IAEhD,OAAO;QACL,SAAS,EAAE,WAAW;QACtB,WAAW,EAAE,KAAK;QAClB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE;YACR,SAAS,EAAE,MAAM,CAAC,UAAU;YAC5B,KAAK,EAAE;gBACL,UAAU,EAAE;oBACV;wBACE,IAAI,EAAE,aAAa;wBACnB,IAAI,EAAE,OAAO;wBACb,OAAO,EAAE,MAAM,CAAC,WAAW,IAAI,OAAO;qBACvC;iBACF;aACF;YACD,SAAS,EAAE;gBACT,IAAI,EAAE,aAAa;gBACnB,SAAS,EAAE,MAAM;gBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB;SACF;QACD,UAAU;KACX,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,MAAkB;IACpC,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC;SAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC;SAChF,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,2DAA2D;IAC3D,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;AACzG,CAAC"}

package/dist/changed.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"changed.d.ts","sourceRoot":"","sources":["../src/changed.ts"],"names":[],"mappings":"AAiCA;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAsClF"}
+{"version":3,"file":"changed.d.ts","sourceRoot":"","sources":["../src/changed.ts"],"names":[],"mappings":"AAiCA;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CA+ClF"}

package/dist/changed.js

@@ -50,9 +50,21 @@ export async function changedFiles(root, since) {
     // than repo-root-relative, so `scan()` can join them against a sub-directory
     // root. Without it, a `--changed` scan of a subdirectory resolves nothing.
     if (since) {
-        for (const f of toLines(await git(root, ["diff", "--name-only", "--relative", "--diff-filter=ACMR", since]))) {
-            out.add(f);
+        // A `git diff` against `since` returns null ONLY when the command failed —
+        // almost always an unknown ref/range (a typo like `--since maiin`). Surface
+        // it instead of silently scanning just the uncommitted files and passing CI.
+        const diff = await git(root, [
+            "diff",
+            "--name-only",
+            "--relative",
+            "--diff-filter=ACMR",
+            since,
+        ]);
+        if (diff === null) {
+            throw new Error(`--since: git could not diff against "${since}" (unknown ref or range).`);
         }
+        for (const f of toLines(diff))
+            out.add(f);
     }
     // Always include local uncommitted edits (staged + unstaged), filtered to ACMR.
     for (const f of toLines(await git(root, ["diff", "--name-only", "--relative", "--diff-filter=ACMR"]))) {

package/dist/changed.js.map

@@ -1 +1 @@
-{"version":3,"file":"changed.js","sourceRoot":"","sources":["../src/changed.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,6EAA6E;AAC7E,KAAK,UAAU,GAAG,CAAC,GAAW,EAAE,IAAc;IAC5C,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE;YAClD,GAAG;YACH,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;YAC3B,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,SAAS,OAAO,CAAC,MAAqB;IACpC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,OAAO,MAAM;SACV,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,KAAc;IAC7D,qEAAqE;IACrE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC,CAAC;IACvE,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM;QAAE,OAAO,EAAE,CAAC;IAE3D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAE9B,6EAA6E;IAC7E,6EAA6E;IAC7E,2EAA2E;IAC3E,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,MAAM,CAAC,IAAI,OAAO,CACrB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,oBAAoB,EAAE,KAAK,CAAC,CAAC,CACpF,EAAE,CAAC;YACF,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,KAAK,MAAM,CAAC,IAAI,OAAO,CACrB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,oBAAoB,CAAC,CAAC,CAC7E,EAAE,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACb,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,CACrB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,oBAAoB,EAAE,UAAU,CAAC,CAAC,CACzF,EAAE,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACb,CAAC;IAED,qCAAqC;IACrC,KAAK,MAAM,CAAC,IAAI,OAAO,CACrB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,oBAAoB,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAC3E,EAAE,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACb,CAAC;IAED,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC"}
+{"version":3,"file":"changed.js","sourceRoot":"","sources":["../src/changed.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,6EAA6E;AAC7E,KAAK,UAAU,GAAG,CAAC,GAAW,EAAE,IAAc;IAC5C,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE;YAClD,GAAG;YACH,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;YAC3B,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,SAAS,OAAO,CAAC,MAAqB;IACpC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,OAAO,MAAM;SACV,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,KAAc;IAC7D,qEAAqE;IACrE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC,CAAC;IACvE,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM;QAAE,OAAO,EAAE,CAAC;IAE3D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAE9B,6EAA6E;IAC7E,6EAA6E;IAC7E,2EAA2E;IAC3E,IAAI,KAAK,EAAE,CAAC;QACV,2EAA2E;QAC3E,4EAA4E;QAC5E,6EAA6E;QAC7E,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE;YAC3B,MAAM;YACN,aAAa;YACb,YAAY;YACZ,oBAAoB;YACpB,KAAK;SACN,CAAC,CAAC;QACH,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,wCAAwC,KAAK,2BAA2B,CAAC,CAAC;QAC5F,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,gFAAgF;IAChF,KAAK,MAAM,CAAC,IAAI,OAAO,CACrB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,oBAAoB,CAAC,CAAC,CAC7E,EAAE,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACb,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,CACrB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,oBAAoB,EAAE,UAAU,CAAC,CAAC,CACzF,EAAE,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACb,CAAC;IAED,qCAAqC;IACrC,KAAK,MAAM,CAAC,IAAI,OAAO,CACrB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,oBAAoB,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAC3E,EAAE,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACb,CAAC;IAED,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC"}

package/dist/codemods/config-toggle.d.ts

@@ -0,0 +1,3 @@
+import type { Codemod } from "./registry.js";
+export declare const configToggleCodemod: Codemod;
+//# sourceMappingURL=config-toggle.d.ts.map

package/dist/codemods/config-toggle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-toggle.d.ts","sourceRoot":"","sources":["../../src/codemods/config-toggle.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAE7C,eAAO,MAAM,mBAAmB,EAAE,OAsBjC,CAAC"}

package/dist/codemods/config-toggle.js

@@ -0,0 +1,26 @@
+export const configToggleCodemod = {
+    id: "config-toggle",
+    applies(finding) {
+        return finding.ruleId === "tls-legacy-version" || finding.ruleId === "tls-reject-unauthorized";
+    },
+    apply(content, finding) {
+        let out = content;
+        if (finding.ruleId === "tls-legacy-version") {
+            out = out
+                .replace(/((?:minVersion|maxVersion)\s*:\s*['"`])TLSv1(?:\.1)?(['"`])/g, "$1TLSv1.3$2")
+                .replace(/(secureProtocol\s*:\s*['"`])TLSv1(?:_1)?_method(['"`])/g, "$1TLSv1_3_method$2");
+        }
+        else if (finding.ruleId === "tls-reject-unauthorized") {
+            out = out.replace(/(rejectUnauthorized\s*:\s*)false/g, "$1true");
+        }
+        if (out === content)
+            return null;
+        return {
+            path: finding.location.file,
+            newContent: out,
+            ruleId: finding.ruleId,
+            source: "codemod",
+        };
+    },
+};
+//# sourceMappingURL=config-toggle.js.map

package/dist/codemods/config-toggle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-toggle.js","sourceRoot":"","sources":["../../src/codemods/config-toggle.ts"],"names":[],"mappings":"AAYA,MAAM,CAAC,MAAM,mBAAmB,GAAY;IAC1C,EAAE,EAAE,eAAe;IACnB,OAAO,CAAC,OAAgB;QACtB,OAAO,OAAO,CAAC,MAAM,KAAK,oBAAoB,IAAI,OAAO,CAAC,MAAM,KAAK,yBAAyB,CAAC;IACjG,CAAC;IACD,KAAK,CAAC,OAAe,EAAE,OAAgB;QACrC,IAAI,GAAG,GAAG,OAAO,CAAC;QAClB,IAAI,OAAO,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;YAC5C,GAAG,GAAG,GAAG;iBACN,OAAO,CAAC,8DAA8D,EAAE,aAAa,CAAC;iBACtF,OAAO,CAAC,yDAAyD,EAAE,oBAAoB,CAAC,CAAC;QAC9F,CAAC;aAAM,IAAI,OAAO,CAAC,MAAM,KAAK,yBAAyB,EAAE,CAAC;YACxD,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,mCAAmC,EAAE,QAAQ,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,GAAG,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QACjC,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI;YAC3B,UAAU,EAAE,GAAG;YACf,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,MAAM,EAAE,SAAS;SAClB,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/codemods/registry.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Codemod registry — deterministic, template-able fixes keyed by finding.
+ *
+ * A codemod only earns a place here if its output reliably CLEARS the finding
+ * (the remediation pipeline enforces this with the `verify_fix` gate). That
+ * makes the set deliberately small: mechanical config toggles qualify;
+ * dependency swaps and source crypto rewrites generally do NOT (there is no
+ * safe drop-in replacement, and a manifest fix can't "remove" the finding
+ * without deleting the dependency) — those are left to triage + the LLM
+ * remediation layer, not an auto-codemod.
+ */
+import type { Finding } from "../types.js";
+import type { Patch } from "../agent-types.js";
+/** A deterministic fix for a class of findings. */
+export interface Codemod {
+    id: string;
+    /** True when this codemod can produce a deterministic fix for the finding. */
+    applies(finding: Finding): boolean;
+    /** Produce a patch (full new file content), or null if it changed nothing. */
+    apply(content: string, finding: Finding): Patch | null;
+}
+/** All registered codemods, in priority order. */
+export declare const codemodRegistry: Codemod[];
+/** The first codemod that applies to `finding`, or undefined. */
+export declare function codemodFor(finding: Finding): Codemod | undefined;
+//# sourceMappingURL=registry.d.ts.map

package/dist/codemods/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/codemods/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAG/C,mDAAmD;AACnD,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,8EAA8E;IAC9E,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC;IACnC,8EAA8E;IAC9E,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,KAAK,GAAG,IAAI,CAAC;CACxD;AAED,kDAAkD;AAClD,eAAO,MAAM,eAAe,EAAE,OAAO,EAA0B,CAAC;AAEhE,iEAAiE;AACjE,wBAAgB,UAAU,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,CAEhE"}

package/dist/codemods/registry.js

@@ -0,0 +1,8 @@
+import { configToggleCodemod } from "./config-toggle.js";
+/** All registered codemods, in priority order. */
+export const codemodRegistry = [configToggleCodemod];
+/** The first codemod that applies to `finding`, or undefined. */
+export function codemodFor(finding) {
+    return codemodRegistry.find((c) => c.applies(finding));
+}
+//# sourceMappingURL=registry.js.map

package/dist/codemods/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/codemods/registry.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAWzD,kDAAkD;AAClD,MAAM,CAAC,MAAM,eAAe,GAAc,CAAC,mBAAmB,CAAC,CAAC;AAEhE,iEAAiE;AACjE,MAAM,UAAU,UAAU,CAAC,OAAgB;IACzC,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;AACzD,CAAC"}

package/dist/comments.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Comment-aware false-positive suppression.
+ *
+ * The detectors are lexical (regex over source text), so a crypto API name
+ * written in a COMMENT — `// migrated off createECDH()` — fires a finding just
+ * like real code. This module computes the comment spans of a file (respecting
+ * string literals, so a `//` inside a string is not a comment) and drops any
+ * finding whose match starts inside one.
+ *
+ * The lexer is deliberately conservative: it only ever ENTERS a comment on a
+ * literal line comment, block comment, or `#` in code position (all of which ARE
+ * comments), so it never mis-classifies code as a comment and can only reduce
+ * false positives, not recall. The one inherent lexical ambiguity — a regex
+ * literal that looks like a block-comment open — is rare and guarded by the
+ * detection benchmark's recall gate.
+ */
+import type { Finding } from "./types.js";
+export type CommentStyle = "c" | "hash";
+/** The comment style for a file path, or null when we don't strip comments for it. */
+export declare function commentStyleForFile(file: string): CommentStyle | null;
+/**
+ * Compute the comment spans (`[start, end)` offsets) of `content`, skipping over
+ * string literals so a comment marker inside a string is not treated as a
+ * comment. Spans are returned sorted and non-overlapping.
+ */
+export declare function commentSpans(content: string, style: CommentStyle): Array<[number, number]>;
+/** True if `offset` falls inside one of the (sorted, non-overlapping) spans. */
+export declare function offsetInSpans(spans: ReadonlyArray<[number, number]>, offset: number): boolean;
+/**
+ * Line numbers (1-based) suppressed by an inline ignore directive:
+ *   - `qscan-ignore-line` on a line suppresses findings on THAT line.
+ *   - `qscan-ignore-next-line` on a line suppresses findings on the NEXT line.
+ * The directive text is matched anywhere on the line (usually in a comment), so
+ * it is language-agnostic. `qscan-ignore-line` is not a substring of
+ * `qscan-ignore-next-line`, so the two never collide.
+ */
+export declare function ignoredLines(content: string): Set<number>;
+/** Drop findings on lines suppressed by an inline `qscan-ignore` directive. */
+export declare function stripIgnoredFindings(findings: Finding[], content: string): Finding[];
+/**
+ * Drop findings whose match starts inside a comment. No-op when the file's
+ * language has no comment style we handle, or when it has no comments.
+ */
+export declare function stripCommentFindings(findings: Finding[], content: string, file: string): Finding[];
+//# sourceMappingURL=comments.d.ts.map

package/dist/comments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"comments.d.ts","sourceRoot":"","sources":["../src/comments.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1C,MAAM,MAAM,YAAY,GAAG,GAAG,GAAG,MAAM,CAAC;AA8BxC,sFAAsF;AACtF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAKrE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAgD1F;AAED,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAW7F;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CASzD;AAED,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,EAAE,CAKpF;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,GACX,OAAO,EAAE,CAmBX"}

package/dist/comments.js

@@ -0,0 +1,164 @@
+/** C-style (line + block) comment languages, by extension. */
+const C_LIKE = [
+    ".js",
+    ".jsx",
+    ".ts",
+    ".tsx",
+    ".mjs",
+    ".cjs",
+    ".vue",
+    ".svelte",
+    ".go",
+    ".java",
+    ".kt",
+    ".kts",
+    ".cs",
+    ".rs",
+    ".c",
+    ".h",
+    ".cc",
+    ".cpp",
+    ".cxx",
+    ".hpp",
+    ".hh",
+];
+/** Hash-style (`#`) comment languages, by extension. */
+const HASH_LIKE = [".py", ".pyi", ".pyw", ".rb"];
+/** The comment style for a file path, or null when we don't strip comments for it. */
+export function commentStyleForFile(file) {
+    const lower = file.toLowerCase();
+    if (C_LIKE.some((e) => lower.endsWith(e)))
+        return "c";
+    if (HASH_LIKE.some((e) => lower.endsWith(e)))
+        return "hash";
+    return null;
+}
+/**
+ * Compute the comment spans (`[start, end)` offsets) of `content`, skipping over
+ * string literals so a comment marker inside a string is not treated as a
+ * comment. Spans are returned sorted and non-overlapping.
+ */
+export function commentSpans(content, style) {
+    const spans = [];
+    const n = content.length;
+    let i = 0;
+    while (i < n) {
+        const c = content[i];
+        // String / template literal: skip to the matching unescaped delimiter.
+        if (c === '"' || c === "'" || c === "`") {
+            const quote = c;
+            i++;
+            while (i < n) {
+                if (content[i] === "\\") {
+                    i += 2;
+                    continue;
+                }
+                if (content[i] === quote) {
+                    i++;
+                    break;
+                }
+                i++;
+            }
+            continue;
+        }
+        if (style === "c" && c === "/" && content[i + 1] === "/") {
+            const start = i;
+            i += 2;
+            while (i < n && content[i] !== "\n")
+                i++;
+            spans.push([start, i]);
+            continue;
+        }
+        if (style === "c" && c === "/" && content[i + 1] === "*") {
+            const start = i;
+            i += 2;
+            while (i < n && !(content[i] === "*" && content[i + 1] === "/"))
+                i++;
+            i = Math.min(n, i + 2);
+            spans.push([start, i]);
+            continue;
+        }
+        if (style === "hash" && c === "#") {
+            const start = i;
+            i++;
+            while (i < n && content[i] !== "\n")
+                i++;
+            spans.push([start, i]);
+            continue;
+        }
+        i++;
+    }
+    return spans;
+}
+/** True if `offset` falls inside one of the (sorted, non-overlapping) spans. */
+export function offsetInSpans(spans, offset) {
+    let lo = 0;
+    let hi = spans.length - 1;
+    while (lo <= hi) {
+        const mid = (lo + hi) >>> 1;
+        const [s, e] = spans[mid];
+        if (offset < s)
+            hi = mid - 1;
+        else if (offset >= e)
+            lo = mid + 1;
+        else
+            return true;
+    }
+    return false;
+}
+/**
+ * Line numbers (1-based) suppressed by an inline ignore directive:
+ *   - `qscan-ignore-line` on a line suppresses findings on THAT line.
+ *   - `qscan-ignore-next-line` on a line suppresses findings on the NEXT line.
+ * The directive text is matched anywhere on the line (usually in a comment), so
+ * it is language-agnostic. `qscan-ignore-line` is not a substring of
+ * `qscan-ignore-next-line`, so the two never collide.
+ */
+export function ignoredLines(content) {
+    const ignored = new Set();
+    const lines = content.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (line.includes("qscan-ignore-next-line"))
+            ignored.add(i + 2);
+        else if (line.includes("qscan-ignore-line"))
+            ignored.add(i + 1);
+    }
+    return ignored;
+}
+/** Drop findings on lines suppressed by an inline `qscan-ignore` directive. */
+export function stripIgnoredFindings(findings, content) {
+    if (findings.length === 0 || !content.includes("qscan-ignore"))
+        return findings;
+    const ignored = ignoredLines(content);
+    if (ignored.size === 0)
+        return findings;
+    return findings.filter((f) => !ignored.has(f.location.line));
+}
+/**
+ * Drop findings whose match starts inside a comment. No-op when the file's
+ * language has no comment style we handle, or when it has no comments.
+ */
+export function stripCommentFindings(findings, content, file) {
+    if (findings.length === 0)
+        return findings;
+    const style = commentStyleForFile(file);
+    if (!style)
+        return findings;
+    const spans = commentSpans(content, style);
+    if (spans.length === 0)
+        return findings;
+    // 1-based line → start offset, to turn a finding's (line, column) back into an
+    // absolute offset (column is 1-based: offset = lineStart + column - 1).
+    const lineStarts = [0];
+    for (let i = 0; i < content.length; i++) {
+        if (content[i] === "\n")
+            lineStarts.push(i + 1);
+    }
+    return findings.filter((f) => {
+        const start = lineStarts[f.location.line - 1] ?? 0;
+        const offset = start + ((f.location.column ?? 1) - 1);
+        return !offsetInSpans(spans, offset);
+    });
+}
+//# sourceMappingURL=comments.js.map

package/dist/comments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"comments.js","sourceRoot":"","sources":["../src/comments.ts"],"names":[],"mappings":"AAoBA,8DAA8D;AAC9D,MAAM,MAAM,GAAsB;IAChC,KAAK;IACL,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,SAAS;IACT,KAAK;IACL,OAAO;IACP,KAAK;IACL,MAAM;IACN,KAAK;IACL,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;CACN,CAAC;AAEF,wDAAwD;AACxD,MAAM,SAAS,GAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAEpE,sFAAsF;AACtF,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC;IACtD,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IAC5D,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,KAAmB;IAC/D,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,uEAAuE;QACvE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACb,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBACxB,CAAC,IAAI,CAAC,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;oBACzB,CAAC,EAAE,CAAC;oBACJ,MAAM;gBACR,CAAC;gBACD,CAAC,EAAE,CAAC;YACN,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACzD,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACzD,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;gBAAE,CAAC,EAAE,CAAC;YACrE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,aAAa,CAAC,KAAsC,EAAE,MAAc;IAClF,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,EAAE,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,MAAM,GAAG,CAAC;YAAE,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;aACxB,IAAI,MAAM,IAAI,CAAC;YAAE,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;;YAC9B,OAAO,IAAI,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;aAC3D,IAAI,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,QAAmB,EAAE,OAAe;IACvE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChF,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACxC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAmB,EACnB,OAAe,EACf,IAAY;IAEZ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC3C,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5B,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAExC,+EAA+E;IAC/E,wEAAwE;IACxE,MAAM,UAAU,GAAa,CAAC,CAAC,CAAC,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/config.d.ts

@@ -9,7 +9,7 @@ export declare const CONFIG_FILENAME = "quantakrypto.config.json";
  * `root`, `files`, `detectors` (the programmatic detector array), and `onFile`
  * are intentionally NOT configurable from a file — they are call-site concerns.
  */
-export interface QuantakryptoFileConfig extends Partial<Pick<ScanOptions, "include" | "exclude" | "noDefaultIgnores" | "maxFileSize" | "scanMinified" | "source" | "dependencies" | "config">> {
+export interface QuantakryptoFileConfig extends Partial<Pick<ScanOptions, "include" | "exclude" | "noDefaultIgnores" | "maxFileSize" | "scanMinified" | "source" | "dependencies" | "config" | "disabledRules">> {
     /** Gate severity (drives the exit code). Maps to qScan's `severityThreshold`. */
     severityThreshold?: Severity;
     /** Path to a baseline file, relative to the config file's directory. */

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAExD,4DAA4D;AAC5D,eAAO,MAAM,eAAe,6BAA6B,CAAC;AAgB1D;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAuB,SAAQ,OAAO,CACrD,IAAI,CACF,WAAW,EACT,SAAS,GACT,SAAS,GACT,kBAAkB,GAClB,aAAa,GACb,cAAc,GACd,QAAQ,GACR,cAAc,GACd,QAAQ,CACX,CACF;IACC,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,QAAQ,CAAC;IAC7B,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,iFAAiF;AACjF,MAAM,WAAW,gBAAgB;IAC/B,qEAAqE;IACrE,MAAM,EAAE,sBAAsB,CAAC;IAC/B,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,+EAA+E;AAC/E,qBAAa,WAAY,SAAQ,KAAK;IACpC,SAAkB,IAAI,iBAAiB;IACvC,6DAA6D;IAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;gBACtB,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;CAIjD;AA8JD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAO,GAChC,OAAO,CAAC,gBAAgB,CAAC,CAgC3B"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAExD,4DAA4D;AAC5D,eAAO,MAAM,eAAe,6BAA6B,CAAC;AAgB1D;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAuB,SAAQ,OAAO,CACrD,IAAI,CACF,WAAW,EACT,SAAS,GACT,SAAS,GACT,kBAAkB,GAClB,aAAa,GACb,cAAc,GACd,QAAQ,GACR,cAAc,GACd,QAAQ,GACR,eAAe,CAClB,CACF;IACC,iFAAiF;IACjF,iBAAiB,CAAC,EAAE,QAAQ,CAAC;IAC7B,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,iFAAiF;AACjF,MAAM,WAAW,gBAAgB;IAC/B,qEAAqE;IACrE,MAAM,EAAE,sBAAsB,CAAC;IAC/B,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,+EAA+E;AAC/E,qBAAa,WAAY,SAAQ,KAAK;IACpC,SAAkB,IAAI,iBAAiB;IACvC,6DAA6D;IAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;gBACtB,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM;CAIjD;AAqKD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAO,GAChC,OAAO,CAAC,gBAAgB,CAAC,CAgC3B"}