@quantakrypto/core 0.3.0 → 0.4.0

package/dist/detectors/go.js

@@ -0,0 +1,132 @@
+import { GO_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+/* -------------------------------------------------------------------------- */
+/* Precompiled regexes (module scope)                                         */
+/* -------------------------------------------------------------------------- */
+const RE_GO_RSA_KEYGEN = /\brsa\.GenerateKey\s*\(|\brsa\.GenerateMultiPrimeKey\s*\(/g;
+const RE_GO_RSA_ENCRYPT = /\brsa\.EncryptOAEP\s*\(|\brsa\.EncryptPKCS1v15\s*\(/g;
+const RE_GO_RSA_SIGN = /\brsa\.SignPKCS1v15\s*\(|\brsa\.SignPSS\s*\(/g;
+const RE_GO_ECDSA = /\becdsa\.GenerateKey\s*\(|\becdsa\.SignASN1\s*\(|\becdsa\.Sign\s*\(/g;
+const RE_GO_ECDH = /\becdh\.(?:P256|P384|P521|X25519)\s*\(/g;
+const RE_GO_ED25519 = /\bed25519\.GenerateKey\s*\(|\bed25519\.Sign\s*\(/g;
+const RE_GO_DSA = /\bdsa\.GenerateKey\s*\(|\bdsa\.GenerateParameters\s*\(/g;
+/* -------------------------------------------------------------------------- */
+/* Rule catalog                                                               */
+/* -------------------------------------------------------------------------- */
+const RULE_GO_RSA_KEYGEN = {
+    id: "go-rsa-keygen",
+    title: "Go RSA key generation",
+    description: "crypto/rsa GenerateKey / GenerateMultiPrimeKey",
+    category: "kem",
+    severity: "high",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Generates a classical RSA key pair (Go), which is not quantum-safe.",
+};
+const RULE_GO_RSA_ENCRYPT = {
+    id: "go-rsa-encrypt",
+    title: "Go RSA public-key encryption",
+    description: "crypto/rsa EncryptOAEP / EncryptPKCS1v15",
+    category: "kem",
+    severity: "high",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "RSA public-key encryption (Go) is broken by Shor's algorithm and exposed to harvest-now-decrypt-later.",
+};
+const RULE_GO_RSA_SIGN = {
+    id: "go-rsa-sign",
+    title: "Go RSA signature",
+    description: "crypto/rsa SignPKCS1v15 / SignPSS",
+    category: "signature",
+    severity: "high",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Classical RSA signing (Go) is forgeable by a quantum attacker.",
+    remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_GO_ECDSA = {
+    id: "go-ecdsa",
+    title: "Go ECDSA key/signature",
+    description: "crypto/ecdsa GenerateKey / Sign / SignASN1",
+    category: "signature",
+    severity: "high",
+    confidence: "high",
+    algorithm: "ECDSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Classical ECDSA (Go) is forgeable by a quantum attacker.",
+    remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_GO_ECDH = {
+    id: "go-ecdh",
+    title: "Go ECDH key exchange",
+    description: "crypto/ecdh P256/P384/P521/X25519 key agreement",
+    category: "key-exchange",
+    severity: "high",
+    confidence: "high",
+    algorithm: "ECDH",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Elliptic-curve Diffie-Hellman (Go crypto/ecdh) is broken by Shor's algorithm (harvest-now-decrypt-later).",
+};
+const RULE_GO_ED25519 = {
+    id: "go-ed25519",
+    title: "Go Ed25519 signature",
+    description: "crypto/ed25519 GenerateKey / Sign",
+    category: "signature",
+    severity: "low",
+    confidence: "high",
+    algorithm: "EdDSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Ed25519 (Go) is a modern but still classical signature scheme.",
+};
+const RULE_GO_DSA = {
+    id: "go-dsa",
+    title: "Go DSA key/usage",
+    description: "crypto/dsa GenerateKey / GenerateParameters",
+    category: "signature",
+    severity: "high",
+    confidence: "high",
+    algorithm: "DSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Classical DSA (Go) is deprecated and forgeable by a quantum attacker.",
+    remediation: "Rotate off DSA and migrate to ML-DSA-65 (FIPS 204).",
+};
+/** Detects classical asymmetric crypto in Go source (crypto/* standard library). */
+export const goDetector = {
+    id: "go-crypto",
+    description: "Classical asymmetric crypto in Go (crypto/rsa, ecdsa, ecdh, ed25519, dsa)",
+    scope: "source",
+    language: "go",
+    rules: [
+        RULE_GO_RSA_KEYGEN,
+        RULE_GO_RSA_ENCRYPT,
+        RULE_GO_RSA_SIGN,
+        RULE_GO_ECDSA,
+        RULE_GO_ECDH,
+        RULE_GO_ED25519,
+        RULE_GO_DSA,
+    ],
+    appliesTo: (f) => hasExtension(f, GO_EXTENSIONS),
+    detect({ file, content }) {
+        const findings = [];
+        const add = (re, rule) => eachMatch(re, content, (m) => findings.push(findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length })));
+        add(RE_GO_RSA_KEYGEN, RULE_GO_RSA_KEYGEN);
+        add(RE_GO_RSA_ENCRYPT, RULE_GO_RSA_ENCRYPT);
+        add(RE_GO_RSA_SIGN, RULE_GO_RSA_SIGN);
+        add(RE_GO_ECDSA, RULE_GO_ECDSA);
+        add(RE_GO_ECDH, RULE_GO_ECDH);
+        add(RE_GO_ED25519, RULE_GO_ED25519);
+        add(RE_GO_DSA, RULE_GO_DSA);
+        return findings;
+    },
+};
+//# sourceMappingURL=go.js.map

package/dist/detectors/go.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"go.js","sourceRoot":"","sources":["../../src/detectors/go.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC7F,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,MAAM,gBAAgB,GAAG,4DAA4D,CAAC;AACtF,MAAM,iBAAiB,GAAG,sDAAsD,CAAC;AACjF,MAAM,cAAc,GAAG,+CAA+C,CAAC;AACvE,MAAM,WAAW,GAAG,sEAAsE,CAAC;AAC3F,MAAM,UAAU,GAAG,yCAAyC,CAAC;AAC7D,MAAM,aAAa,GAAG,mDAAmD,CAAC;AAC1E,MAAM,SAAS,GAAG,yDAAyD,CAAC;AAE5E,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,MAAM,kBAAkB,GAAa;IACnC,EAAE,EAAE,eAAe;IACnB,KAAK,EAAE,uBAAuB;IAC9B,WAAW,EAAE,gDAAgD;IAC7D,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,qEAAqE;CAC/E,CAAC;AACF,MAAM,mBAAmB,GAAa;IACpC,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,8BAA8B;IACrC,WAAW,EAAE,0CAA0C;IACvD,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,wGAAwG;CAC3G,CAAC;AACF,MAAM,gBAAgB,GAAa;IACjC,EAAE,EAAE,aAAa;IACjB,KAAK,EAAE,kBAAkB;IACzB,WAAW,EAAE,mCAAmC;IAChD,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,gEAAgE;IACzE,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,aAAa,GAAa;IAC9B,EAAE,EAAE,UAAU;IACd,KAAK,EAAE,wBAAwB;IAC/B,WAAW,EAAE,4CAA4C;IACzD,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,0DAA0D;IACnE,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,YAAY,GAAa;IAC7B,EAAE,EAAE,SAAS;IACb,KAAK,EAAE,sBAAsB;IAC7B,WAAW,EAAE,iDAAiD;IAC9D,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,2GAA2G;CAC9G,CAAC;AACF,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,YAAY;IAChB,KAAK,EAAE,sBAAsB;IAC7B,WAAW,EAAE,mCAAmC;IAChD,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,KAAK;IACf,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,gEAAgE;CAC1E,CAAC;AACF,MAAM,WAAW,GAAa;IAC5B,EAAE,EAAE,QAAQ;IACZ,KAAK,EAAE,kBAAkB;IACzB,WAAW,EAAE,6CAA6C;IAC1D,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,uEAAuE;IAChF,WAAW,EAAE,qDAAqD;CACnE,CAAC;AAEF,oFAAoF;AACpF,MAAM,CAAC,MAAM,UAAU,GAAa;IAClC,EAAE,EAAE,WAAW;IACf,WAAW,EAAE,2EAA2E;IACxF,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,IAAI;IACd,KAAK,EAAE;QACL,kBAAkB;QAClB,mBAAmB;QACnB,gBAAgB;QAChB,aAAa;QACb,YAAY;QACZ,eAAe;QACf,WAAW;KACZ;IACD,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,aAAa,CAAC;IAChD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,IAAc,EAAE,EAAE,CACzC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAC3B,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACnF,CACF,CAAC;QAEJ,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;QAC1C,GAAG,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;QAC5C,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;QACtC,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAChC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAC9B,GAAG,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QACpC,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAE5B,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC"}

package/dist/detectors/java.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Source-code detector for classical, non-quantum-safe asymmetric cryptography
+ * in Java / Kotlin (the JCA — Java Cryptography Architecture). Same lexical
+ * strategy as the other language packs.
+ *
+ * The JCA funnels almost everything through a handful of factory methods keyed
+ * by an ALGORITHM STRING: `KeyPairGenerator.getInstance("RSA")`,
+ * `Signature.getInstance("SHA256withECDSA")`, `Cipher.getInstance("RSA/ECB/…")`,
+ * `KeyAgreement.getInstance("ECDH")`. So detection here is two steps: match the
+ * `<Factory>.getInstance("<alg>")` call, then classify the (factory, alg) pair
+ * into a rule. Symmetric / hashing algorithms ("AES", "HmacSHA256", …) classify
+ * to nothing and are ignored. A small set of BouncyCastle lightweight-API class
+ * names (`new ECDSASigner()`, `new X25519Agreement()`, …) is matched directly.
+ *
+ * HNDL policy mirrors the other detectors: KEM / key agreement (RSA encryption,
+ * (EC)DH, X25519/X448) is harvest-now-decrypt-later exposed (hndl:true);
+ * signatures (RSA/ECDSA/DSA/EdDSA) are hndl:false but forgeable by a quantum
+ * attacker. `KeyPairGenerator.getInstance("EC")` is ambiguous (an EC key feeds
+ * both ECDSA and ECDH), so it is classified conservatively as
+ * key-exchange-capable (hndl:true), exactly as the Node/Python EC keygen rules.
+ */
+import type { Detector } from "../types.js";
+/** Detects classical asymmetric crypto in Java / Kotlin (JCA + BouncyCastle). */
+export declare const javaDetector: Detector;
+//# sourceMappingURL=java.d.ts.map

package/dist/detectors/java.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"java.d.ts","sourceRoot":"","sources":["../../src/detectors/java.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AA8K/D,iFAAiF;AACjF,eAAO,MAAM,YAAY,EAAE,QAsC1B,CAAC"}

package/dist/detectors/java.js

@@ -0,0 +1,200 @@
+import { JAVA_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+/* -------------------------------------------------------------------------- */
+/* Regexes                                                                    */
+/* -------------------------------------------------------------------------- */
+// <Factory>.getInstance("<alg>") — the JCA entry points that carry asymmetric
+// algorithms. KeyGenerator/MessageDigest/Mac are intentionally excluded (they
+// are symmetric / hashing only).
+const RE_JAVA_GETINSTANCE = /\b(KeyPairGenerator|Signature|Cipher|KeyAgreement|KeyFactory)\s*\.\s*getInstance\s*\(\s*"([^"]+)"/g;
+// BouncyCastle lightweight-API class instantiations.
+const RE_JAVA_BC = /\bnew\s+(RSAKeyPairGenerator|DSAKeyPairGenerator|ECKeyPairGenerator|ECDSASigner|Ed25519Signer|Ed448Signer|X25519Agreement|X448Agreement)\s*\(/g;
+/* -------------------------------------------------------------------------- */
+/* Rule catalog                                                               */
+/* -------------------------------------------------------------------------- */
+const RULE_JAVA_RSA = {
+    id: "java-rsa",
+    title: "Java RSA key/encryption",
+    description: "JCA RSA KeyPairGenerator / Cipher / KeyFactory",
+    category: "kem",
+    severity: "high",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Classical RSA (Java/JCA) is not quantum-safe and RSA encryption is HNDL-exposed.",
+};
+const RULE_JAVA_RSA_SIGN = {
+    id: "java-rsa-sign",
+    title: "Java RSA signature",
+    description: 'JCA Signature.getInstance("…withRSA")',
+    category: "signature",
+    severity: "high",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Classical RSA signing (Java/JCA) is forgeable by a quantum attacker.",
+    remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_JAVA_EC_KEYGEN = {
+    id: "java-ec-keygen",
+    title: "Java EC key generation",
+    description: 'JCA KeyPairGenerator.getInstance("EC")',
+    category: "key-exchange",
+    severity: "high",
+    confidence: "high",
+    algorithm: "ECDH",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Generates a classical EC key pair (Java/JCA). EC keys feed BOTH ECDSA signatures and ECDH key agreement; the ECDH path is harvest-now-decrypt-later exposed.",
+    remediation: "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
+};
+const RULE_JAVA_ECDSA_SIGN = {
+    id: "java-ecdsa-sign",
+    title: "Java ECDSA signature",
+    description: 'JCA Signature.getInstance("…withECDSA")',
+    category: "signature",
+    severity: "high",
+    confidence: "high",
+    algorithm: "ECDSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Classical ECDSA signing (Java/JCA) is forgeable by a quantum attacker.",
+    remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_JAVA_ECDH = {
+    id: "java-ecdh",
+    title: "Java ECDH key agreement",
+    description: 'JCA KeyAgreement.getInstance("ECDH")',
+    category: "key-exchange",
+    severity: "high",
+    confidence: "high",
+    algorithm: "ECDH",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Elliptic-curve Diffie-Hellman (Java/JCA) is broken by Shor's algorithm (harvest-now-decrypt-later).",
+};
+const RULE_JAVA_DSA = {
+    id: "java-dsa",
+    title: "Java DSA key/signature",
+    description: "JCA DSA KeyPairGenerator / Signature",
+    category: "signature",
+    severity: "high",
+    confidence: "high",
+    algorithm: "DSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Classical DSA (Java/JCA) is deprecated and forgeable by a quantum attacker.",
+    remediation: "Rotate off DSA and migrate to ML-DSA-65 (FIPS 204).",
+};
+const RULE_JAVA_DH = {
+    id: "java-dh",
+    title: "Java Diffie-Hellman key exchange",
+    description: "JCA DiffieHellman KeyPairGenerator / KeyAgreement",
+    category: "key-exchange",
+    severity: "high",
+    confidence: "high",
+    algorithm: "DH",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Finite-field Diffie-Hellman (Java/JCA) is broken by Shor's algorithm (harvest-now-decrypt-later).",
+};
+const RULE_JAVA_XDH = {
+    id: "java-xdh",
+    title: "Java X25519/X448 key agreement",
+    description: "JCA XDH / X25519 / X448 (KeyPairGenerator / KeyAgreement)",
+    category: "key-exchange",
+    severity: "low",
+    confidence: "high",
+    algorithm: "X25519",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "X25519/X448 (Java/JCA) is modern but still classical key agreement — harvest-now-decrypt-later.",
+};
+const RULE_JAVA_EDDSA = {
+    id: "java-eddsa",
+    title: "Java Ed25519/Ed448 signature",
+    description: "JCA EdDSA / Ed25519 / Ed448",
+    category: "signature",
+    severity: "low",
+    confidence: "high",
+    algorithm: "EdDSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Ed25519/Ed448 (Java/JCA) is a modern but still classical signature scheme.",
+};
+/**
+ * Classify a `<factory>.getInstance("<alg>")` pair into a rule, or null when the
+ * algorithm is not classical asymmetric crypto (AES, HMAC, PBKDF2, hashes, …).
+ * `alg` is normalised to upper-case with any Cipher transformation suffix
+ * (`RSA/ECB/OAEPPadding` → `RSA`) stripped.
+ */
+function classifyGetInstance(factory, rawAlg) {
+    const alg = rawAlg.split("/")[0].trim().toUpperCase();
+    const isSignature = factory === "Signature";
+    if (alg.includes("ECDSA"))
+        return RULE_JAVA_ECDSA_SIGN;
+    if (alg.includes("ECDH"))
+        return RULE_JAVA_ECDH;
+    if (alg === "EC")
+        return isSignature ? RULE_JAVA_ECDSA_SIGN : RULE_JAVA_EC_KEYGEN;
+    if (alg.includes("ED25519") || alg.includes("ED448") || alg.includes("EDDSA"))
+        return RULE_JAVA_EDDSA;
+    if (alg.includes("X25519") || alg.includes("X448") || alg === "XDH")
+        return RULE_JAVA_XDH;
+    if (alg.includes("RSA"))
+        return isSignature ? RULE_JAVA_RSA_SIGN : RULE_JAVA_RSA;
+    if (alg.includes("DSA"))
+        return RULE_JAVA_DSA; // ECDSA already handled above
+    if (alg.includes("DH") || alg.includes("DIFFIEHELLMAN"))
+        return RULE_JAVA_DH;
+    return null;
+}
+/** BouncyCastle lightweight-API class name → rule. */
+const BC_CLASS_RULES = {
+    RSAKeyPairGenerator: RULE_JAVA_RSA,
+    DSAKeyPairGenerator: RULE_JAVA_DSA,
+    ECKeyPairGenerator: RULE_JAVA_EC_KEYGEN,
+    ECDSASigner: RULE_JAVA_ECDSA_SIGN,
+    Ed25519Signer: RULE_JAVA_EDDSA,
+    Ed448Signer: RULE_JAVA_EDDSA,
+    X25519Agreement: RULE_JAVA_XDH,
+    X448Agreement: RULE_JAVA_XDH,
+};
+/** Detects classical asymmetric crypto in Java / Kotlin (JCA + BouncyCastle). */
+export const javaDetector = {
+    id: "java-crypto",
+    description: "Classical asymmetric crypto in Java/Kotlin (JCA getInstance + BouncyCastle)",
+    scope: "source",
+    language: "java",
+    rules: [
+        RULE_JAVA_RSA,
+        RULE_JAVA_RSA_SIGN,
+        RULE_JAVA_EC_KEYGEN,
+        RULE_JAVA_ECDSA_SIGN,
+        RULE_JAVA_ECDH,
+        RULE_JAVA_DSA,
+        RULE_JAVA_DH,
+        RULE_JAVA_XDH,
+        RULE_JAVA_EDDSA,
+    ],
+    appliesTo: (f) => hasExtension(f, JAVA_EXTENSIONS),
+    detect({ file, content }) {
+        const findings = [];
+        eachMatch(RE_JAVA_GETINSTANCE, content, (m) => {
+            const rule = classifyGetInstance(m[1], m[2]);
+            if (!rule)
+                return; // symmetric / hashing algorithm — not our concern.
+            findings.push(findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }));
+        });
+        eachMatch(RE_JAVA_BC, content, (m) => {
+            const rule = BC_CLASS_RULES[m[1]];
+            if (!rule)
+                return;
+            findings.push(findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }));
+        });
+        return findings;
+    },
+};
+//# sourceMappingURL=java.js.map

package/dist/detectors/java.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"java.js","sourceRoot":"","sources":["../../src/detectors/java.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC/F,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,8EAA8E;AAC9E,8EAA8E;AAC9E,iCAAiC;AACjC,MAAM,mBAAmB,GACvB,oGAAoG,CAAC;AAEvG,qDAAqD;AACrD,MAAM,UAAU,GACd,gJAAgJ,CAAC;AAEnJ,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,MAAM,aAAa,GAAa;IAC9B,EAAE,EAAE,UAAU;IACd,KAAK,EAAE,yBAAyB;IAChC,WAAW,EAAE,gDAAgD;IAC7D,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,kFAAkF;CAC5F,CAAC;AACF,MAAM,kBAAkB,GAAa;IACnC,EAAE,EAAE,eAAe;IACnB,KAAK,EAAE,oBAAoB;IAC3B,WAAW,EAAE,uCAAuC;IACpD,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,sEAAsE;IAC/E,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,mBAAmB,GAAa;IACpC,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,wBAAwB;IAC/B,WAAW,EAAE,wCAAwC;IACrD,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,8JAA8J;IAChK,WAAW,EACT,8FAA8F;CACjG,CAAC;AACF,MAAM,oBAAoB,GAAa;IACrC,EAAE,EAAE,iBAAiB;IACrB,KAAK,EAAE,sBAAsB;IAC7B,WAAW,EAAE,yCAAyC;IACtD,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,wEAAwE;IACjF,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,cAAc,GAAa;IAC/B,EAAE,EAAE,WAAW;IACf,KAAK,EAAE,yBAAyB;IAChC,WAAW,EAAE,sCAAsC;IACnD,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,qGAAqG;CACxG,CAAC;AACF,MAAM,aAAa,GAAa;IAC9B,EAAE,EAAE,UAAU;IACd,KAAK,EAAE,wBAAwB;IAC/B,WAAW,EAAE,sCAAsC;IACnD,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,6EAA6E;IACtF,WAAW,EAAE,qDAAqD;CACnE,CAAC;AACF,MAAM,YAAY,GAAa;IAC7B,EAAE,EAAE,SAAS;IACb,KAAK,EAAE,kCAAkC;IACzC,WAAW,EAAE,mDAAmD;IAChE,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,IAAI;IACf,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,mGAAmG;CACtG,CAAC;AACF,MAAM,aAAa,GAAa;IAC9B,EAAE,EAAE,UAAU;IACd,KAAK,EAAE,gCAAgC;IACvC,WAAW,EAAE,2DAA2D;IACxE,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,KAAK;IACf,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,QAAQ;IACnB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,iGAAiG;CACpG,CAAC;AACF,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,YAAY;IAChB,KAAK,EAAE,8BAA8B;IACrC,WAAW,EAAE,6BAA6B;IAC1C,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,KAAK;IACf,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,4EAA4E;CACtF,CAAC;AAEF;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,OAAe,EAAE,MAAc;IAC1D,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtD,MAAM,WAAW,GAAG,OAAO,KAAK,WAAW,CAAC;IAE5C,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,oBAAoB,CAAC;IACvD,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,cAAc,CAAC;IAChD,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,WAAW,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,mBAAmB,CAAC;IAClF,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC3E,OAAO,eAAe,CAAC;IACzB,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAG,KAAK,KAAK;QAAE,OAAO,aAAa,CAAC;IAC1F,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,aAAa,CAAC;IACjF,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC,CAAC,8BAA8B;IAC7E,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC;QAAE,OAAO,YAAY,CAAC;IAC7E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sDAAsD;AACtD,MAAM,cAAc,GAA6B;IAC/C,mBAAmB,EAAE,aAAa;IAClC,mBAAmB,EAAE,aAAa;IAClC,kBAAkB,EAAE,mBAAmB;IACvC,WAAW,EAAE,oBAAoB;IACjC,aAAa,EAAE,eAAe;IAC9B,WAAW,EAAE,eAAe;IAC5B,eAAe,EAAE,aAAa;IAC9B,aAAa,EAAE,aAAa;CAC7B,CAAC;AAEF,iFAAiF;AACjF,MAAM,CAAC,MAAM,YAAY,GAAa;IACpC,EAAE,EAAE,aAAa;IACjB,WAAW,EAAE,6EAA6E;IAC1F,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,MAAM;IAChB,KAAK,EAAE;QACL,aAAa;QACb,kBAAkB;QAClB,mBAAmB;QACnB,oBAAoB;QACpB,cAAc;QACd,aAAa;QACb,YAAY;QACZ,aAAa;QACb,eAAe;KAChB;IACD,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,eAAe,CAAC;IAClD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,SAAS,CAAC,mBAAmB,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YAC5C,MAAM,IAAI,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7C,IAAI,CAAC,IAAI;gBAAE,OAAO,CAAC,mDAAmD;YACtE,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACnF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,SAAS,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACnC,MAAM,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAClC,IAAI,CAAC,IAAI;gBAAE,OAAO;YAClB,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACnF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC"}

package/dist/detectors/python.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Source-code detector for classical, non-quantum-safe asymmetric cryptography
+ * in Python. Same lexical (regex-over-source) strategy as the JS/TS detectors:
+ * robust to formatting, dependency-free, and confidence-tagged per pattern.
+ *
+ * Covers the three libraries that carry ~all real-world Python asymmetric
+ * crypto:
+ *   - `cryptography` (hazmat): rsa/ec/dh/x25519/x448/ed25519/ed448 + OAEP padding
+ *   - PyCryptodome (`Crypto.PublicKey`): RSA/ECC/DSA generate + PKCS1_OAEP
+ *   - paramiko (SSH): RSAKey / ECDSAKey / Ed25519Key / DSSKey
+ *
+ * JWT/JOSE algorithm strings (`algorithm="RS256"`) are NOT handled here — the
+ * language-agnostic `jwt-jose` detector now applies to Python too (a quoted
+ * `"RS256"` is the same evidence in any language).
+ *
+ * HNDL policy mirrors the JS detectors: key agreement / KEM (RSA-OAEP, ECDH, DH,
+ * X25519/X448) is harvest-now-decrypt-later exposed (hndl:true); signatures
+ * (ECDSA, DSA, Ed25519/Ed448) are hndl:false but still high/low severity because
+ * a quantum attacker can forge them. EC key generation is ambiguous (an EC key
+ * feeds both ECDSA and ECDH), so it is classified conservatively as
+ * key-exchange-capable (hndl:true), exactly as the Node `ec` keygen rule is.
+ */
+import type { Detector } from "../types.js";
+/** Detects classical asymmetric crypto in Python source. */
+export declare const pythonDetector: Detector;
+//# sourceMappingURL=python.d.ts.map

package/dist/detectors/python.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"python.d.ts","sourceRoot":"","sources":["../../src/detectors/python.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAsJ/D,4DAA4D;AAC5D,eAAO,MAAM,cAAc,EAAE,QAsC5B,CAAC"}

package/dist/detectors/python.js

@@ -0,0 +1,171 @@
+import { PYTHON_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+/* -------------------------------------------------------------------------- */
+/* Precompiled regexes (module scope)                                         */
+/* -------------------------------------------------------------------------- */
+// RSA key generation: cryptography `rsa.generate_private_key(`, PyCryptodome
+// `RSA.generate(`, paramiko `paramiko.RSAKey` / `RSAKey.generate(`.
+const RE_PY_RSA_KEYGEN = /\brsa\.generate_private_key\s*\(|\bRSA\.generate\s*\(|\bparamiko\.RSAKey\b|\bRSAKey\.generate\s*\(/g;
+// RSA public-key encryption padding (RSA-OAEP): confidentiality → HNDL.
+const RE_PY_RSA_ENCRYPT = /\bpadding\.OAEP\s*\(|\bPKCS1_OAEP\.new\s*\(/g;
+// EC key generation (ambiguous ECDSA/ECDH): cryptography + PyCryptodome.
+const RE_PY_EC_KEYGEN = /\bec\.generate_private_key\s*\(|\bECC\.generate\s*\(/g;
+// ECDSA signatures: cryptography `ec.ECDSA(`, paramiko ECDSAKey.
+const RE_PY_ECDSA = /\bec\.ECDSA\s*\(|\bparamiko\.ECDSAKey\b|\bECDSAKey\.generate\s*\(/g;
+// DSA: PyCryptodome `DSA.generate(`, paramiko DSSKey.
+const RE_PY_DSA = /\bDSA\.generate\s*\(|\bparamiko\.DSSKey\b|\bDSSKey\.generate\s*\(/g;
+// Finite-field Diffie-Hellman (cryptography `dh`).
+const RE_PY_DH = /\bdh\.generate_parameters\s*\(|\bdh\.DHParameterNumbers\s*\(/g;
+// Modern-but-classical curve primitives (cryptography). `.generate(` anchors so
+// a bare import of the class name does not fire.
+const RE_PY_X25519 = /\bX25519PrivateKey\.generate\s*\(/g;
+const RE_PY_X448 = /\bX448PrivateKey\.generate\s*\(/g;
+const RE_PY_EDDSA = /\b(?:Ed25519|Ed448)PrivateKey\.generate\s*\(|\bparamiko\.Ed25519Key\b/g;
+/* -------------------------------------------------------------------------- */
+/* Rule catalog                                                               */
+/* -------------------------------------------------------------------------- */
+const RULE_PY_RSA_KEYGEN = {
+    id: "python-rsa-keygen",
+    title: "Python RSA key generation",
+    description: "cryptography rsa.generate_private_key / PyCryptodome RSA.generate / paramiko RSAKey",
+    category: "kem",
+    severity: "high",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Generates a classical RSA key pair (Python), which is not quantum-safe.",
+};
+const RULE_PY_RSA_ENCRYPT = {
+    id: "python-rsa-encrypt",
+    title: "Python RSA public-key encryption",
+    description: "RSA-OAEP / PKCS1_OAEP encryption padding",
+    category: "kem",
+    severity: "high",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "RSA public-key encryption (OAEP) is broken by Shor's algorithm and exposed to harvest-now-decrypt-later.",
+};
+const RULE_PY_EC_KEYGEN = {
+    id: "python-ec-keygen",
+    title: "Python EC key generation",
+    description: "cryptography ec.generate_private_key / PyCryptodome ECC.generate",
+    category: "key-exchange",
+    severity: "high",
+    confidence: "high",
+    algorithm: "ECDH",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Generates a classical EC key pair (Python). EC keys feed BOTH ECDSA signatures and ECDH key agreement; the ECDH path is harvest-now-decrypt-later exposed.",
+    remediation: "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
+};
+const RULE_PY_ECDSA = {
+    id: "python-ecdsa",
+    title: "Python ECDSA signature",
+    description: "cryptography ec.ECDSA / paramiko ECDSAKey",
+    category: "signature",
+    severity: "high",
+    confidence: "medium",
+    algorithm: "ECDSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Classical ECDSA signing (Python) is forgeable by a quantum attacker.",
+    remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+};
+const RULE_PY_DSA = {
+    id: "python-dsa",
+    title: "Python DSA key/usage",
+    description: "PyCryptodome DSA.generate / paramiko DSSKey",
+    category: "signature",
+    severity: "high",
+    confidence: "high",
+    algorithm: "DSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Classical DSA (Python) is deprecated and forgeable by a quantum attacker.",
+    remediation: "Rotate off DSA and migrate to ML-DSA-65 (FIPS 204).",
+};
+const RULE_PY_DH = {
+    id: "python-dh",
+    title: "Python Diffie-Hellman key exchange",
+    description: "cryptography dh.generate_parameters / DHParameterNumbers",
+    category: "key-exchange",
+    severity: "high",
+    confidence: "high",
+    algorithm: "DH",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Finite-field Diffie-Hellman (Python) is broken by Shor's algorithm (harvest-now-decrypt-later).",
+};
+const RULE_PY_X25519 = {
+    id: "python-x25519",
+    title: "Python X25519 key exchange",
+    description: "cryptography X25519PrivateKey.generate",
+    category: "key-exchange",
+    severity: "low",
+    confidence: "high",
+    algorithm: "X25519",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "X25519 (Python) is modern but still classical key agreement — harvest-now-decrypt-later.",
+};
+const RULE_PY_X448 = {
+    id: "python-x448",
+    title: "Python X448 key exchange",
+    description: "cryptography X448PrivateKey.generate",
+    category: "key-exchange",
+    severity: "low",
+    confidence: "high",
+    algorithm: "X448",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "X448 (Python) is modern but still classical key agreement — harvest-now-decrypt-later.",
+};
+const RULE_PY_EDDSA = {
+    id: "python-eddsa",
+    title: "Python Ed25519/Ed448 signature",
+    description: "cryptography Ed25519/Ed448 PrivateKey.generate / paramiko Ed25519Key",
+    category: "signature",
+    severity: "low",
+    confidence: "high",
+    algorithm: "EdDSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Ed25519/Ed448 (Python) is a modern but still classical signature scheme.",
+};
+/** Detects classical asymmetric crypto in Python source. */
+export const pythonDetector = {
+    id: "python-crypto",
+    description: "Classical asymmetric crypto in Python (cryptography, PyCryptodome, paramiko)",
+    scope: "source",
+    language: "python",
+    rules: [
+        RULE_PY_RSA_KEYGEN,
+        RULE_PY_RSA_ENCRYPT,
+        RULE_PY_EC_KEYGEN,
+        RULE_PY_ECDSA,
+        RULE_PY_DSA,
+        RULE_PY_DH,
+        RULE_PY_X25519,
+        RULE_PY_X448,
+        RULE_PY_EDDSA,
+    ],
+    appliesTo: (f) => hasExtension(f, PYTHON_EXTENSIONS),
+    detect({ file, content }) {
+        const findings = [];
+        const add = (re, rule) => eachMatch(re, content, (m) => findings.push(findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length })));
+        add(RE_PY_RSA_KEYGEN, RULE_PY_RSA_KEYGEN);
+        add(RE_PY_RSA_ENCRYPT, RULE_PY_RSA_ENCRYPT);
+        add(RE_PY_EC_KEYGEN, RULE_PY_EC_KEYGEN);
+        add(RE_PY_ECDSA, RULE_PY_ECDSA);
+        add(RE_PY_DSA, RULE_PY_DSA);
+        add(RE_PY_DH, RULE_PY_DH);
+        add(RE_PY_X25519, RULE_PY_X25519);
+        add(RE_PY_X448, RULE_PY_X448);
+        add(RE_PY_EDDSA, RULE_PY_EDDSA);
+        return findings;
+    },
+};
+//# sourceMappingURL=python.js.map

package/dist/detectors/python.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"python.js","sourceRoot":"","sources":["../../src/detectors/python.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACjG,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,6EAA6E;AAC7E,oEAAoE;AACpE,MAAM,gBAAgB,GACpB,qGAAqG,CAAC;AACxG,wEAAwE;AACxE,MAAM,iBAAiB,GAAG,8CAA8C,CAAC;AACzE,yEAAyE;AACzE,MAAM,eAAe,GAAG,uDAAuD,CAAC;AAChF,iEAAiE;AACjE,MAAM,WAAW,GAAG,oEAAoE,CAAC;AACzF,sDAAsD;AACtD,MAAM,SAAS,GAAG,oEAAoE,CAAC;AACvF,mDAAmD;AACnD,MAAM,QAAQ,GAAG,+DAA+D,CAAC;AACjF,gFAAgF;AAChF,iDAAiD;AACjD,MAAM,YAAY,GAAG,oCAAoC,CAAC;AAC1D,MAAM,UAAU,GAAG,kCAAkC,CAAC;AACtD,MAAM,WAAW,GAAG,wEAAwE,CAAC;AAE7F,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,MAAM,kBAAkB,GAAa;IACnC,EAAE,EAAE,mBAAmB;IACvB,KAAK,EAAE,2BAA2B;IAClC,WAAW,EACT,qFAAqF;IACvF,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,yEAAyE;CACnF,CAAC;AACF,MAAM,mBAAmB,GAAa;IACpC,EAAE,EAAE,oBAAoB;IACxB,KAAK,EAAE,kCAAkC;IACzC,WAAW,EAAE,0CAA0C;IACvD,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,0GAA0G;CAC7G,CAAC;AACF,MAAM,iBAAiB,GAAa;IAClC,EAAE,EAAE,kBAAkB;IACtB,KAAK,EAAE,0BAA0B;IACjC,WAAW,EAAE,kEAAkE;IAC/E,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,4JAA4J;IAC9J,WAAW,EACT,8FAA8F;CACjG,CAAC;AACF,MAAM,aAAa,GAAa;IAC9B,EAAE,EAAE,cAAc;IAClB,KAAK,EAAE,wBAAwB;IAC/B,WAAW,EAAE,2CAA2C;IACxD,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,QAAQ;IACpB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,sEAAsE;IAC/E,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,WAAW,GAAa;IAC5B,EAAE,EAAE,YAAY;IAChB,KAAK,EAAE,sBAAsB;IAC7B,WAAW,EAAE,6CAA6C;IAC1D,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,2EAA2E;IACpF,WAAW,EAAE,qDAAqD;CACnE,CAAC;AACF,MAAM,UAAU,GAAa;IAC3B,EAAE,EAAE,WAAW;IACf,KAAK,EAAE,oCAAoC;IAC3C,WAAW,EAAE,0DAA0D;IACvE,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,IAAI;IACf,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,iGAAiG;CACpG,CAAC;AACF,MAAM,cAAc,GAAa;IAC/B,EAAE,EAAE,eAAe;IACnB,KAAK,EAAE,4BAA4B;IACnC,WAAW,EAAE,wCAAwC;IACrD,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,KAAK;IACf,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,QAAQ;IACnB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,0FAA0F;CAC7F,CAAC;AACF,MAAM,YAAY,GAAa;IAC7B,EAAE,EAAE,aAAa;IACjB,KAAK,EAAE,0BAA0B;IACjC,WAAW,EAAE,sCAAsC;IACnD,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,KAAK;IACf,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,wFAAwF;CAClG,CAAC;AACF,MAAM,aAAa,GAAa;IAC9B,EAAE,EAAE,cAAc;IAClB,KAAK,EAAE,gCAAgC;IACvC,WAAW,EAAE,sEAAsE;IACnF,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,KAAK;IACf,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,0EAA0E;CACpF,CAAC;AAEF,4DAA4D;AAC5D,MAAM,CAAC,MAAM,cAAc,GAAa;IACtC,EAAE,EAAE,eAAe;IACnB,WAAW,EAAE,8EAA8E;IAC3F,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,QAAQ;IAClB,KAAK,EAAE;QACL,kBAAkB;QAClB,mBAAmB;QACnB,iBAAiB;QACjB,aAAa;QACb,WAAW;QACX,UAAU;QACV,cAAc;QACd,YAAY;QACZ,aAAa;KACd;IACD,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,iBAAiB,CAAC;IACpD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,IAAc,EAAE,EAAE,CACzC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAC3B,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACnF,CACF,CAAC;QAEJ,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;QAC1C,GAAG,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;QAC5C,GAAG,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QACxC,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAChC,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC5B,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC1B,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QAClC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAC9B,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAEhC,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC"}

package/dist/detectors/ruby.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Source-code detector for classical asymmetric cryptography in Ruby. Ruby's
+ * asymmetric crypto is almost entirely `OpenSSL::PKey::{RSA,EC,DSA,DH}`, which
+ * makes the signals precise. Lexical, same strategy as the other packs.
+ *
+ * HNDL: RSA (keygen/encryption) and (EC)DH key agreement are harvest-now-
+ * decrypt-later exposed (hndl:true); DSA signatures are hndl:false but forgeable.
+ * `OpenSSL::PKey::EC` is ambiguous (feeds ECDSA + ECDH), so it is classified
+ * conservatively as key-exchange-capable (hndl:true), like the other EC keygen
+ * rules.
+ */
+import type { Detector } from "../types.js";
+/** Detects classical asymmetric crypto in Ruby (OpenSSL::PKey). */
+export declare const rubyDetector: Detector;
+//# sourceMappingURL=ruby.d.ts.map

package/dist/detectors/ruby.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ruby.d.ts","sourceRoot":"","sources":["../../src/detectors/ruby.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AA+D/D,mEAAmE;AACnE,eAAO,MAAM,YAAY,EAAE,QAqB1B,CAAC"}