@quantakrypto/core 0.4.1 → 0.4.3

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 quantakrypto / Dandelion Labs JSC
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -58,7 +58,7 @@ interface ScanOptions {
   exclude?: string[];           // extra exclude patterns (substring/prefix)
   noDefaultIgnores?: boolean;   // disable node_modules/.git/dist/… ignores
   source?: boolean;             // scan source files (default true)
-  dependencies?: boolean;       // scan package.json / package-lock.json (default true)
+  dependencies?: boolean;       // scan manifests/lockfiles across 6 ecosystems (default true)
   config?: boolean;             // scan PEM/TLS/cert config (default true)
   maxFileSize?: number;         // bytes; default 2 MiB (manifests are exempt)
   scanMinified?: boolean;       // scan minified/generated files (default false: skip them)
@@ -138,6 +138,20 @@ drives the source/config scope toggles from the detector's **declared `scope`**
 | `pem-material` | config | PEM keys/certs in any file: `RSA/EC/DSA/PKCS#8/OPENSSH/PGP PRIVATE KEY`, `PGP MESSAGE`, `CERTIFICATE` |
 | `ssh-cert` | config | SSH public keys (`ssh-rsa`, `ssh-ed25519`, `ecdsa-sha2-*`) and X.509 certificate signature algorithms (`sha256WithRSAEncryption`, `ecdsa-with-SHA256`, …) |
 
+The rows above cover JavaScript/TypeScript plus the language-agnostic PEM/SSH/TLS
+surfaces. Seven further **language packs** apply the same RSA/EC/DSA/DH/Ed25519
+detection to other ecosystems (each is a single umbrella detector):
+
+| Detector | Scope | Language |
+| --- | --- | --- |
+| `python-crypto` | source | Python (`cryptography`, PyCryptodome, `pyca`) |
+| `go-crypto` | source | Go (`crypto/rsa`, `crypto/ecdsa`, `crypto/ecdh`, `crypto/ed25519`, …) |
+| `java-crypto` | source | Java/Kotlin (JCA `KeyPairGenerator`/`Signature`/`KeyAgreement`, BouncyCastle) |
+| `csharp-crypto` | source | C#/.NET (`RSA`, `ECDsa`, `ECDiffieHellman`, `DSA`) |
+| `rust-crypto` | source | Rust (`rsa`, `p256`/`k256` ECDSA, `x25519-dalek`, `ed25519-dalek`) |
+| `ruby-crypto` | source | Ruby (`OpenSSL::PKey::{RSA,EC,DSA,DH}`) |
+| `c-crypto` | source | C/C++ (OpenSSL `EVP_PKEY_*` / `RSA_*` / `EC_*` / `DSA_*` / `DH_*`) |
+
 `defaultRegistry` is a `DetectorRegistry` preloaded with these built-ins. The
 registry is the plugin point:
 
@@ -154,8 +168,8 @@ const result = await scan({ root: ".", detectors: registry.all() });
 #### Adding a detector / language
 
 1. Create `src/detectors/<lang>.ts` exporting one or more `Detector`s. Set
-   `language` (`"js" | "python" | "go" | "java" | "any"`), `scope`
-   (`"source" | "config"`), an `appliesTo(path)` extension check, and a pure
+   `language` (`"js" | "python" | "go" | "java" | "csharp" | "rust" | "ruby" | "c" | "any"`),
+   `scope` (`"source" | "config"`), an `appliesTo(path)` extension check, and a pure
    `detect({ file, content })` returning `Finding[]` (use `makeFinding` from
    `detect-utils` for consistent location/remediation/CWE handling).
 2. If the language uses new file extensions, ensure the walker treats them as
@@ -168,13 +182,17 @@ const result = await scan({ root: ".", detectors: registry.all() });
 
 ### `vulnerableDependencies: VulnerableDependency[]`
 
-Curated database (~20 entries) of npm packages whose purpose is classical
-asymmetric crypto: `node-forge`, `elliptic`, `jsrsasign`, `node-rsa`, `ursa`,
-`sshpk`, `jsonwebtoken`, `jose`, `jws`, `eccrypto`, `secp256k1`, `tweetnacl`,
-`ed25519`, `@noble/curves`, `@noble/secp256k1`, `@noble/ed25519`, `paseto`,
-`bcrypto`, `ecpair`, `keypair`. `scan()` matches these against `package.json`
-and `package-lock.json` and emits `category: "dependency"` findings located at
-the manifest.
+Curated database (**61 entries**) of packages whose purpose is classical
+asymmetric crypto, spanning **six ecosystems** — npm, PyPI, Cargo, Go modules,
+Maven, and RubyGems (`VulnerableDependency.ecosystem`). The npm subset includes
+`node-forge`, `elliptic`, `jsrsasign`, `node-rsa`, `ursa`, `sshpk`,
+`jsonwebtoken`, `jose`, `jws`, `eccrypto`, `secp256k1`, `tweetnacl`, `ed25519`,
+`@noble/curves`, `@noble/secp256k1`, `@noble/ed25519`, `paseto`, `bcrypto`,
+`ecpair`, `keypair`. `scan()` matches these against each ecosystem's manifests
+and lockfiles — `package.json` / `package-lock.json` / `yarn.lock` /
+`pnpm-lock.yaml`, `requirements.txt` / `pyproject.toml` / `Pipfile`, `Cargo.toml`,
+`go.mod`, `pom.xml` / `build.gradle`, `Gemfile` / `*.gemspec` — and emits
+`category: "dependency"` findings located at the manifest.
 
 ### `buildInventory(findings: Finding[]): CryptoInventory`
 
@@ -267,6 +285,16 @@ Tool version surfaced in reports (kept in sync with `package.json`).
 | `remediationFor`, `remediationForTier`, `TIER_PARAMS` | fn/const | PQC remediation (family + CNSA tier) |
 | `STATEFUL_HBS_NOTE`, `statefulHbsApplies` | const/fn | SP 800-208 LMS/XMSS guidance |
 | `fingerprintFinding`, `baselineFromFindings`, `applyBaseline`, `loadBaseline`, `saveBaseline`, `BASELINE_VERSION` | fn/const | Canonical baseline |
+| `verifyFix`, `languageToExtension` | fn | Snippet-level fix verification (crypto finding removed?) + language→extension map |
+| `buildContext`, `renderPreflight` | fn | Redacted source-context builder + preflight preview (secrets stripped) |
+| `TRIAGE_RUBRIC`, `TRIAGE_VERDICT_SCHEMA`, `buildTriageRequest` | const/fn | Deterministic, offline triage-request bundle (rubric + verdict schema) |
+| `REMEDIATE_RUBRIC`, `FIX_REQUEST_SCHEMA`, `buildRemediateRequest` | const/fn | Deterministic, offline remediation-request bundle (rubric + fix schema) |
+| `checkPatchPolicy` | fn | Patch-policy gate — only files with findings + dependency manifests |
+| `withWorktree` | fn | Run a callback inside an ephemeral git worktree (isolates writes; no auto-merge) |
+| `codemodRegistry`, `codemodFor`, `configToggleCodemod` | const/fn | Deterministic codemod registry + per-finding lookup |
+| `remediateFindings` | fn | Remediation pipeline: propose → policy + verify gate → verified patches |
+| `loadConfig`, `ConfigError`, `CONFIG_FILENAME` | fn/const | `quantakrypto.config.json` loader |
+| `AbortError`, `BudgetExceededError` | class | Scan cancellation / work-budget overflow errors |
 | `CWE_BROKEN_CRYPTO`, `CWE_WEAK_STRENGTH`, `CWE_CERT_VALIDATION`, `CWE_HARDCODED_KEY`, `CWE_RISKY_PRIMITIVE` | const | CWE identifiers |
 | `VERSION` | const | Tool version |
 

package/dist/agent-types.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-types.js","sourceRoot":"","sources":["../src/agent-types.ts"],"names":[],"mappings":""}
+{"version":3,"file":"agent-types.js","sourceRoot":"","sources":["../src/agent-types.ts"],"names":[],"mappings":"","sourcesContent":["/**\n * Shared types for the agent (BYOK) plane. These live in `@quantakrypto/core`\n * (offline) so both the deterministic MCP tools and the networked\n * `@quantakrypto/agent` package speak the same shapes without the offline side\n * ever importing the network client.\n */\nimport type { Severity, TriageAnnotation } from \"./types.js\";\n\n/** How much source context a redacted request carries. */\nexport type ContextLevel = \"metadata\" | \"snippet\" | \"function\" | \"file\";\n\n/** A finding's context, redacted to a {@link ContextLevel} and secret-stripped. */\nexport interface RedactedContext {\n  level: ContextLevel;\n  meta: {\n    ruleId: string;\n    algorithm?: string;\n    severity: Severity;\n    hndl: boolean;\n    file: string;\n    line: number;\n    message: string;\n  };\n  /** Redacted source, or null at `metadata` level / for a `sensitive` finding. */\n  code: string | null;\n  /** True when key material was stripped from the context. */\n  redactedSecret: boolean;\n}\n\n/** An LLM triage verdict for a single finding (never suppresses it). The\n * exposure/priority/rationale body is the {@link TriageAnnotation} that gets\n * attached to the finding; `fingerprint` links it back to that finding. */\nexport interface TriageVerdict extends TriageAnnotation {\n  fingerprint: string;\n}\n\n/** A concrete proposed edit: the full new content for a single file. */\nexport interface Patch {\n  path: string;\n  /** Full replacement content for `path` after the fix. */\n  newContent: string;\n  ruleId: string;\n  source: \"codemod\" | \"llm\";\n}\n\n/** An LLM-proposed fix before it enters the deterministic pipeline. */\nexport interface FixProposal {\n  fingerprint: string;\n  path: string;\n  newContent: string;\n  explanation: string;\n}\n"]}

package/dist/baseline.js.map

@@ -1 +1 @@
-{"version":3,"file":"baseline.js","sourceRoot":"","sources":["../src/baseline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAIvD,+CAA+C;AAC/C,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAU,CAAC;AAQ3C,kFAAkF;AAClF,SAAS,gBAAgB,CAAC,OAA2B;IACnD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,CAAU;IAC3C,MAAM,OAAO,GAAG,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;IAC1D,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,oBAAoB,CAAC,QAA4B;IAC/D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,OAAO;QACL,OAAO,EAAE,gBAAgB;QACzB,YAAY,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE;KAC9B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,QAA4B,EAC5B,QAAkB;IAElB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAChD,MAAM,WAAW,GAAc,EAAE,CAAC;IAClC,MAAM,UAAU,GAAc,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;YACvD,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;AACrC,CAAC;AAED,0EAA0E;AAC1E,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IACzD,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC;IACjF,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAClD,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACpE,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IACzD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,QAA4B;IAC3E,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxE,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"baseline.js","sourceRoot":"","sources":["../src/baseline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAIvD,+CAA+C;AAC/C,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAU,CAAC;AAQ3C,kFAAkF;AAClF,SAAS,gBAAgB,CAAC,OAA2B;IACnD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,CAAU;IAC3C,MAAM,OAAO,GAAG,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;IAC1D,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,oBAAoB,CAAC,QAA4B;IAC/D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,OAAO;QACL,OAAO,EAAE,gBAAgB;QACzB,YAAY,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE;KAC9B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,QAA4B,EAC5B,QAAkB;IAElB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAChD,MAAM,WAAW,GAAc,EAAE,CAAC;IAClC,MAAM,UAAU,GAAc,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;YACvD,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;AACrC,CAAC;AAED,0EAA0E;AAC1E,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IACzD,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC;IACjF,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAClD,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QACpE,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IACzD,CAAC;IACD,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IACzD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,QAA4B;IAC3E,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxE,OAAO,QAAQ,CAAC;AAClB,CAAC","sourcesContent":["/**\n * Canonical baseline module — the single source of truth for suppressing known\n * findings across qScan and the GitHub Action (replacing their two divergent,\n * mutually-unintelligible schemes).\n *\n * A baseline is a versioned set of finding fingerprints. A fingerprint is\n * **line-insensitive** (so unrelated edits that shift line numbers don't\n * invalidate it) and snippet-whitespace-normalized (so reformatting doesn't\n * either). Identity = `sha256(ruleId | file | normalizedSnippet)`.\n */\nimport { createHash } from \"node:crypto\";\nimport { readFile, writeFile } from \"node:fs/promises\";\n\nimport type { Finding } from \"./types.js\";\n\n/** Current on-disk baseline schema version. */\nexport const BASELINE_VERSION = 1 as const;\n\n/** The on-disk baseline shape: a version tag and a set of fingerprints. */\nexport interface Baseline {\n  version: number;\n  fingerprints: string[];\n}\n\n/** Collapse all whitespace runs to single spaces and trim (snippet stability). */\nfunction normalizeSnippet(snippet: string | undefined): string {\n  if (!snippet) return \"\";\n  return snippet.replace(/\\s+/g, \" \").trim();\n}\n\n/**\n * Stable, line-INSENSITIVE fingerprint of a finding: the hex SHA-256 of\n * `ruleId|file|normalizedSnippet`. The line number is deliberately excluded so\n * the fingerprint survives line shifts; the snippet's whitespace is normalized\n * so it survives reformatting.\n */\nexport function fingerprintFinding(f: Finding): string {\n  const snippet = normalizeSnippet(f.location.snippet);\n  const input = `${f.ruleId}|${f.location.file}|${snippet}`;\n  return createHash(\"sha256\").update(input, \"utf8\").digest(\"hex\");\n}\n\n/** Build a {@link Baseline} from a set of findings (deduped, sorted). */\nexport function baselineFromFindings(findings: readonly Finding[]): Baseline {\n  const set = new Set<string>();\n  for (const f of findings) set.add(fingerprintFinding(f));\n  return {\n    version: BASELINE_VERSION,\n    fingerprints: [...set].sort(),\n  };\n}\n\n/**\n * Split findings into those NOT in the baseline (`newFindings`) and those that\n * ARE (`suppressed`). Order within each group is preserved from the input.\n */\nexport function applyBaseline(\n  findings: readonly Finding[],\n  baseline: Baseline,\n): { newFindings: Finding[]; suppressed: Finding[] } {\n  const accepted = new Set(baseline.fingerprints);\n  const newFindings: Finding[] = [];\n  const suppressed: Finding[] = [];\n  for (const f of findings) {\n    if (accepted.has(fingerprintFinding(f))) suppressed.push(f);\n    else newFindings.push(f);\n  }\n  return { newFindings, suppressed };\n}\n\n/** Normalize an arbitrary parsed object into a valid {@link Baseline}. */\nfunction coerceBaseline(value: unknown): Baseline {\n  if (value === null || typeof value !== \"object\") {\n    return { version: BASELINE_VERSION, fingerprints: [] };\n  }\n  const obj = value as Record<string, unknown>;\n  const version = typeof obj.version === \"number\" ? obj.version : BASELINE_VERSION;\n  const fingerprints = Array.isArray(obj.fingerprints)\n    ? obj.fingerprints.filter((x): x is string => typeof x === \"string\")\n    : [];\n  return { version, fingerprints };\n}\n\n/**\n * Load a baseline from disk. Returns an empty baseline (rather than throwing)\n * when the file is missing or unparseable, so callers can treat \"no baseline\"\n * and \"absent baseline\" uniformly.\n */\nexport async function loadBaseline(path: string): Promise<Baseline> {\n  let text: string;\n  try {\n    text = await readFile(path, \"utf8\");\n  } catch {\n    return { version: BASELINE_VERSION, fingerprints: [] };\n  }\n  try {\n    return coerceBaseline(JSON.parse(text));\n  } catch {\n    return { version: BASELINE_VERSION, fingerprints: [] };\n  }\n}\n\n/**\n * Write a baseline derived from the given findings to disk as pretty JSON\n * (trailing newline). Returns the baseline that was written.\n */\nexport async function saveBaseline(path: string, findings: readonly Finding[]): Promise<Baseline> {\n  const baseline = baselineFromFindings(findings);\n  await writeFile(path, `${JSON.stringify(baseline, null, 2)}\\n`, \"utf8\");\n  return baseline;\n}\n"]}

package/dist/cache.js.map

@@ -1 +1 @@
-{"version":3,"file":"cache.js","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,MAAM,aAAa,GAAG,CAAC,CAAC;AAcxB,wCAAwC;AACxC,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,SAA8B,EAC9B,aAA4C;IAE5C,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACnD,OAAO,IAAI,OAAO,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,SAAiB,EACjB,OAAe;IAEf,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,IAAI,MAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,IACE,MAAM,KAAK,IAAI;QACf,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,CAAC,OAAO,KAAK,aAAa;QAChC,MAAM,CAAC,OAAO,KAAK,OAAO;QAC1B,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;QAClC,MAAM,CAAC,OAAO,KAAK,IAAI,EACvB,CAAC;QACD,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3D,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7E,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,SAAiB,EACjB,OAAe,EACf,OAAgC;IAEhC,MAAM,GAAG,GAAmB;QAC1B,OAAO,EAAE,aAAa;QACtB,OAAO;QACP,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC;KACrC,CAAC;IACF,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,GAAG,SAAS,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;QAC9C,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;QAClD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACpD,MAAM,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;AACH,CAAC"}
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../src/cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,MAAM,aAAa,GAAG,CAAC,CAAC;AAcxB,wCAAwC;AACxC,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,SAA8B,EAC9B,aAA4C;IAE5C,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9C,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACnD,OAAO,IAAI,OAAO,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,SAAiB,EACjB,OAAe;IAEf,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,IAAI,MAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,IACE,MAAM,KAAK,IAAI;QACf,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,CAAC,OAAO,KAAK,aAAa;QAChC,MAAM,CAAC,OAAO,KAAK,OAAO;QAC1B,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;QAClC,MAAM,CAAC,OAAO,KAAK,IAAI,EACvB,CAAC;QACD,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3D,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7E,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,SAAiB,EACjB,OAAe,EACf,OAAgC;IAEhC,MAAM,GAAG,GAAmB;QAC1B,OAAO,EAAE,aAAa;QACtB,OAAO;QACP,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC;KACrC,CAAC;IACF,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,GAAG,SAAS,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;QAC9C,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;QAClD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACpD,MAAM,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;AACH,CAAC","sourcesContent":["/**\n * Optional on-disk scan cache. Keyed by file content hash so an unchanged file\n * reuses its previous findings instead of re-running every detector — the big\n * win on large monorepos where most files don't change between runs.\n *\n * Invalidation is conservative and whole-cache: the cache stores a RULESET\n * FINGERPRINT (tool version + the active detector ids + disabled rules). If any\n * of those differ from the current run, the entire cache is discarded and\n * rebuilt, so upgrading the tool or changing the rules never serves stale\n * results. Per file, a content-hash mismatch re-scans just that file.\n *\n * The cache is opt-in (`ScanOptions.cacheFile`); with no cache file, scans are\n * exactly as before. A corrupt / unreadable / wrong-version cache file is\n * ignored (treated as empty), never fatal.\n */\nimport { createHash } from \"node:crypto\";\nimport { readFile, writeFile, mkdir } from \"node:fs/promises\";\nimport * as path from \"node:path\";\n\nimport type { Detector, Finding } from \"./types.js\";\nimport { VERSION } from \"./version.js\";\n\nconst CACHE_VERSION = 1;\n\n/** One cached file: the content hash it was computed for, and its findings. */\nexport interface CacheEntry {\n  hash: string;\n  findings: Finding[];\n}\n\ninterface CacheFileShape {\n  version: number;\n  ruleset: string;\n  entries: Record<string, CacheEntry>;\n}\n\n/** sha256 of a file's content (hex). */\nexport function hashContent(content: string): string {\n  return createHash(\"sha256\").update(content, \"utf8\").digest(\"hex\");\n}\n\n/**\n * Fingerprint of everything that changes what a scan produces: the tool version,\n * the active detector ids (sorted), and the disabled-rule set (sorted). A change\n * to any of these invalidates the whole cache.\n */\nexport function rulesetFingerprint(\n  detectors: readonly Detector[],\n  disabledRules: readonly string[] | undefined,\n): string {\n  const ids = detectors.map((d) => d.id).sort();\n  const disabled = [...(disabledRules ?? [])].sort();\n  return `v${VERSION}|d:${ids.join(\",\")}|x:${disabled.join(\",\")}`;\n}\n\n/**\n * Load the cache file into a `Map<relPath, CacheEntry>`. Returns an empty map\n * when the file is missing, unparseable, the wrong version, or was written for a\n * different ruleset (in which case its entries are stale and must not be reused).\n */\nexport async function loadCache(\n  cacheFile: string,\n  ruleset: string,\n): Promise<Map<string, CacheEntry>> {\n  let raw: string;\n  try {\n    raw = await readFile(cacheFile, \"utf8\");\n  } catch {\n    return new Map();\n  }\n  let parsed: CacheFileShape;\n  try {\n    parsed = JSON.parse(raw) as CacheFileShape;\n  } catch {\n    return new Map();\n  }\n  if (\n    parsed === null ||\n    typeof parsed !== \"object\" ||\n    parsed.version !== CACHE_VERSION ||\n    parsed.ruleset !== ruleset ||\n    typeof parsed.entries !== \"object\" ||\n    parsed.entries === null\n  ) {\n    return new Map();\n  }\n  const map = new Map<string, CacheEntry>();\n  for (const [file, entry] of Object.entries(parsed.entries)) {\n    if (entry && typeof entry.hash === \"string\" && Array.isArray(entry.findings)) {\n      map.set(file, entry);\n    }\n  }\n  return map;\n}\n\n/**\n * Write the cache atomically (temp file + rename) so a concurrent reader never\n * sees a half-written file. Errors are swallowed — a cache is an optimization,\n * never a reason to fail a scan.\n */\nexport async function saveCache(\n  cacheFile: string,\n  ruleset: string,\n  entries: Map<string, CacheEntry>,\n): Promise<void> {\n  const doc: CacheFileShape = {\n    version: CACHE_VERSION,\n    ruleset,\n    entries: Object.fromEntries(entries),\n  };\n  try {\n    await mkdir(path.dirname(cacheFile), { recursive: true });\n    const tmp = `${cacheFile}.tmp-${process.pid}`;\n    await writeFile(tmp, JSON.stringify(doc), \"utf8\");\n    const { rename } = await import(\"node:fs/promises\");\n    await rename(tmp, cacheFile);\n  } catch {\n    // best effort\n  }\n}\n"]}

package/dist/cbom.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cbom.d.ts","sourceRoot":"","sources":["../src/cbom.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAA6C,UAAU,EAAE,MAAM,YAAY,CAAC;AAGxF,yEAAyE;AACzE,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,WAAW,CAAC;IACvB,WAAW,EAAE,KAAK,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,UAAU,EAAE,aAAa,EAAE,CAAC;CAC7B;AAED,0DAA0D;AAC1D,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,qBAAqB,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAwDD;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,YAAY,CAqFvD"}
+{"version":3,"file":"cbom.d.ts","sourceRoot":"","sources":["../src/cbom.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAA6C,UAAU,EAAE,MAAM,YAAY,CAAC;AAGxF,yEAAyE;AACzE,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,WAAW,CAAC;IACvB,WAAW,EAAE,KAAK,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,UAAU,EAAE,aAAa,EAAE,CAAC;CAC7B;AAED,0DAA0D;AAC1D,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,qBAAqB,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAiED;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,YAAY,CAqFvD"}

package/dist/cbom.js

@@ -21,16 +21,25 @@ function primitiveFor(category) {
         case "signature":
             return "signature";
         case "certificate":
-            return "pki";
+            // "pki" is NOT a valid CycloneDX 1.6 algorithmProperties.primitive enum
+            // value; use "other" so the CBOM validates (audit: quantum #3). Modeling
+            // certificates as assetType:"certificate" is a future refinement.
+            return "other";
         case "tls":
             return "other";
         default:
             return "other";
     }
 }
-/** True when the algorithm family is broken by Shor's algorithm (quantum). */
-function isQuantumVulnerable(algorithm) {
-    return algorithm !== "unknown";
+/**
+ * Every CBOM asset here is derived from a quantakrypto finding, and the detectors
+ * only ever fire on classical (Shor-broken) public-key crypto — so an asset is
+ * quantum-vulnerable by construction, even when the exact family couldn't be
+ * pinned down (`unknown`). Reporting `false` for `unknown` mislabeled
+ * definitionally-classical findings as safe (audit: crypto #6).
+ */
+function isQuantumVulnerable(_algorithm) {
+    return true;
 }
 /**
  * Approximate CLASSICAL security strength (bits) of the common parameterisation

package/dist/cbom.js.map

@@ -1 +1 @@
-{"version":3,"file":"cbom.js","sourceRoot":"","sources":["../src/cbom.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAqBvC,gEAAgE;AAChE,SAAS,YAAY,CAAC,QAAyB;IAC7C,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,KAAK;YACR,OAAO,KAAK,CAAC;QACf,KAAK,cAAc;YACjB,OAAO,WAAW,CAAC;QACrB,KAAK,WAAW;YACd,OAAO,WAAW,CAAC;QACrB,KAAK,aAAa;YAChB,OAAO,KAAK,CAAC;QACf,KAAK,KAAK;YACR,OAAO,OAAO,CAAC;QACjB;YACE,OAAO,OAAO,CAAC;IACnB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,SAAS,mBAAmB,CAAC,SAA0B;IACrD,OAAO,SAAS,KAAK,SAAS,CAAC;AACjC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,yBAAyB,CAAC,SAA0B;IAC3D,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,KAAK,CAAC;QACX,KAAK,IAAI,CAAC;QACV,KAAK,KAAK;YACR,OAAO,GAAG,CAAC;QACb,KAAK,MAAM,CAAC;QACZ,KAAK,OAAO,CAAC;QACb,KAAK,OAAO,CAAC;QACb,KAAK,QAAQ,CAAC;QACd,KAAK,OAAO;YACV,OAAO,GAAG,CAAC;QACb,KAAK,MAAM;YACT,OAAO,GAAG,CAAC;QACb;YACE,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,SAAS,MAAM,CAAC,GAAW;IACzB,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACzF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAC,MAAkB;IACvC,6CAA6C;IAC7C,MAAM,MAAM,GAAG,IAAI,GAAG,EAGnB,CAAC;IAEJ,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,SAAS,GAAoB,CAAC,CAAC,SAAS,IAAI,SAAS,CAAC;QAC5D,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC;QACxC,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;YAC3C,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,CAAC;QACD,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,UAAU,GAAoB,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;SACtD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACxD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE;QAChB,MAAM,WAAW,GAAG,CAAC,CAAC,QAAQ;aAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,QAAQ,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE;YACjD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C,CAAC,CAAC;aACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEpF,MAAM,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAE/C,OAAO;YACL,IAAI,EAAE,qBAA8B;YACpC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC;YACtB,IAAI,EAAE,GAAG,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,GAAG;YACvC,gBAAgB,EAAE;gBAChB,SAAS,EAAE,WAAW;gBACtB,mBAAmB,EAAE;oBACnB,SAAS,EAAE,CAAC,CAAC,SAAS;oBACtB,sBAAsB,EAAE,CAAC,CAAC,SAAS;oBACnC,oBAAoB,EAAE,oBAAoB;oBAC1C,sBAAsB,EAAE,yBAAyB,CAAC,CAAC,CAAC,SAAS,CAAC;oBAC9D,wBAAwB,EAAE,CAAC;oBAC3B,eAAe,EACb,CAAC,CAAC,SAAS,KAAK,WAAW;wBACzB,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC;wBACpB,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK;4BACrB,CAAC,CAAC,CAAC,aAAa,EAAE,aAAa,CAAC;4BAChC,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,WAAW;gCAC3B,CAAC,CAAC,CAAC,UAAU,CAAC;gCACd,CAAC,CAAC,CAAC,OAAO,CAAC;iBACpB;gBACD,iBAAiB,EAAE,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC;gBACnD,sBAAsB,EAAE,OAAO;aAChC;YACD,QAAQ,EAAE,EAAE,WAAW,EAAE;SAC1B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,MAAM,MAAM,GAAG,YAAY,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;IAEhD,OAAO;QACL,SAAS,EAAE,WAAW;QACtB,WAAW,EAAE,KAAK;QAClB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE;YACR,SAAS,EAAE,MAAM,CAAC,UAAU;YAC5B,KAAK,EAAE;gBACL,UAAU,EAAE;oBACV;wBACE,IAAI,EAAE,aAAa;wBACnB,IAAI,EAAE,OAAO;wBACb,OAAO,EAAE,MAAM,CAAC,WAAW,IAAI,OAAO;qBACvC;iBACF;aACF;YACD,SAAS,EAAE;gBACT,IAAI,EAAE,aAAa;gBACnB,SAAS,EAAE,MAAM;gBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB;SACF;QACD,UAAU;KACX,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,MAAkB;IACpC,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC;SAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC;SAChF,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,2DAA2D;IAC3D,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;AACzG,CAAC"}
+{"version":3,"file":"cbom.js","sourceRoot":"","sources":["../src/cbom.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAqBvC,gEAAgE;AAChE,SAAS,YAAY,CAAC,QAAyB;IAC7C,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,KAAK;YACR,OAAO,KAAK,CAAC;QACf,KAAK,cAAc;YACjB,OAAO,WAAW,CAAC;QACrB,KAAK,WAAW;YACd,OAAO,WAAW,CAAC;QACrB,KAAK,aAAa;YAChB,wEAAwE;YACxE,yEAAyE;YACzE,kEAAkE;YAClE,OAAO,OAAO,CAAC;QACjB,KAAK,KAAK;YACR,OAAO,OAAO,CAAC;QACjB;YACE,OAAO,OAAO,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,UAA2B;IACtD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,SAAS,yBAAyB,CAAC,SAA0B;IAC3D,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,KAAK,CAAC;QACX,KAAK,IAAI,CAAC;QACV,KAAK,KAAK;YACR,OAAO,GAAG,CAAC;QACb,KAAK,MAAM,CAAC;QACZ,KAAK,OAAO,CAAC;QACb,KAAK,OAAO,CAAC;QACb,KAAK,QAAQ,CAAC;QACd,KAAK,OAAO;YACV,OAAO,GAAG,CAAC;QACb,KAAK,MAAM;YACT,OAAO,GAAG,CAAC;QACb;YACE,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,SAAS,MAAM,CAAC,GAAW;IACzB,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACzF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAC,MAAkB;IACvC,6CAA6C;IAC7C,MAAM,MAAM,GAAG,IAAI,GAAG,EAGnB,CAAC;IAEJ,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,SAAS,GAAoB,CAAC,CAAC,SAAS,IAAI,SAAS,CAAC;QAC5D,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC;QACxC,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;YAC3C,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,CAAC;QACD,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,UAAU,GAAoB,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;SACtD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACxD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE;QAChB,MAAM,WAAW,GAAG,CAAC,CAAC,QAAQ;aAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,QAAQ,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE;YACjD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C,CAAC,CAAC;aACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEpF,MAAM,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAE/C,OAAO;YACL,IAAI,EAAE,qBAA8B;YACpC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC;YACtB,IAAI,EAAE,GAAG,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,GAAG;YACvC,gBAAgB,EAAE;gBAChB,SAAS,EAAE,WAAW;gBACtB,mBAAmB,EAAE;oBACnB,SAAS,EAAE,CAAC,CAAC,SAAS;oBACtB,sBAAsB,EAAE,CAAC,CAAC,SAAS;oBACnC,oBAAoB,EAAE,oBAAoB;oBAC1C,sBAAsB,EAAE,yBAAyB,CAAC,CAAC,CAAC,SAAS,CAAC;oBAC9D,wBAAwB,EAAE,CAAC;oBAC3B,eAAe,EACb,CAAC,CAAC,SAAS,KAAK,WAAW;wBACzB,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC;wBACpB,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK;4BACrB,CAAC,CAAC,CAAC,aAAa,EAAE,aAAa,CAAC;4BAChC,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,WAAW;gCAC3B,CAAC,CAAC,CAAC,UAAU,CAAC;gCACd,CAAC,CAAC,CAAC,OAAO,CAAC;iBACpB;gBACD,iBAAiB,EAAE,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC;gBACnD,sBAAsB,EAAE,OAAO;aAChC;YACD,QAAQ,EAAE,EAAE,WAAW,EAAE;SAC1B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,MAAM,MAAM,GAAG,YAAY,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;IAEhD,OAAO;QACL,SAAS,EAAE,WAAW;QACtB,WAAW,EAAE,KAAK;QAClB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE;YACR,SAAS,EAAE,MAAM,CAAC,UAAU;YAC5B,KAAK,EAAE;gBACL,UAAU,EAAE;oBACV;wBACE,IAAI,EAAE,aAAa;wBACnB,IAAI,EAAE,OAAO;wBACb,OAAO,EAAE,MAAM,CAAC,WAAW,IAAI,OAAO;qBACvC;iBACF;aACF;YACD,SAAS,EAAE;gBACT,IAAI,EAAE,aAAa;gBACnB,SAAS,EAAE,MAAM;gBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB;SACF;QACD,UAAU;KACX,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,MAAkB;IACpC,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC;SAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC;SAChF,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,2DAA2D;IAC3D,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;AACzG,CAAC","sourcesContent":["/**\n * CBOM (Cryptographic Bill of Materials) export — CycloneDX 1.6 with\n * `cryptographic-asset` components. Turns a {@link ScanResult} into a\n * machine-readable inventory of the classical cryptographic assets discovered,\n * for compliance / supply-chain tooling.\n *\n * Reference: CycloneDX 1.6 cryptography properties\n * (https://cyclonedx.org/capabilities/cbom/). We emit one\n * `cryptographic-asset` component per distinct (algorithm, primitive) pair\n * observed, with occurrence evidence pointing back at the findings.\n */\nimport { createHash } from \"node:crypto\";\n\nimport type { AlgorithmFamily, Finding, FindingCategory, ScanResult } from \"./types.js\";\nimport { VERSION } from \"./version.js\";\n\n/** A CycloneDX 1.6 cryptographic bill of materials (kept permissive). */\nexport interface CycloneDxBom {\n  bomFormat: \"CycloneDX\";\n  specVersion: \"1.6\";\n  serialNumber: string;\n  version: number;\n  metadata: Record<string, unknown>;\n  components: CbomComponent[];\n}\n\n/** A single CycloneDX `cryptographic-asset` component. */\nexport interface CbomComponent {\n  type: \"cryptographic-asset\";\n  \"bom-ref\": string;\n  name: string;\n  cryptoProperties: Record<string, unknown>;\n  evidence?: Record<string, unknown>;\n}\n\n/** CycloneDX cryptographic primitive for a finding category. */\nfunction primitiveFor(category: FindingCategory): string {\n  switch (category) {\n    case \"kem\":\n      return \"kem\";\n    case \"key-exchange\":\n      return \"key-agree\";\n    case \"signature\":\n      return \"signature\";\n    case \"certificate\":\n      // \"pki\" is NOT a valid CycloneDX 1.6 algorithmProperties.primitive enum\n      // value; use \"other\" so the CBOM validates (audit: quantum #3). Modeling\n      // certificates as assetType:\"certificate\" is a future refinement.\n      return \"other\";\n    case \"tls\":\n      return \"other\";\n    default:\n      return \"other\";\n  }\n}\n\n/**\n * Every CBOM asset here is derived from a quantakrypto finding, and the detectors\n * only ever fire on classical (Shor-broken) public-key crypto — so an asset is\n * quantum-vulnerable by construction, even when the exact family couldn't be\n * pinned down (`unknown`). Reporting `false` for `unknown` mislabeled\n * definitionally-classical findings as safe (audit: crypto #6).\n */\nfunction isQuantumVulnerable(_algorithm: AlgorithmFamily): boolean {\n  return true;\n}\n\n/**\n * Approximate CLASSICAL security strength (bits) of the common parameterisation\n * of a classical family — RSA-2048 / DH-2048 ≈ 112-bit, 256-bit curves ≈ 128-bit,\n * X448 ≈ 224-bit. (The QUANTUM level is 0 for all of these: Shor breaks them.)\n * 0 when the family is unknown. Reported so a CBOM doesn't imply these primitives\n * have zero classical strength today.\n */\nfunction classicalSecurityLevelFor(algorithm: AlgorithmFamily): number {\n  switch (algorithm) {\n    case \"RSA\":\n    case \"DH\":\n    case \"DSA\":\n      return 112;\n    case \"ECDH\":\n    case \"ECDSA\":\n    case \"EdDSA\":\n    case \"X25519\":\n    case \"ECIES\":\n      return 128;\n    case \"X448\":\n      return 224;\n    default:\n      return 0;\n  }\n}\n\n/** Deterministic bom-ref for a (algorithm, primitive) asset key. */\nfunction bomRef(key: string): string {\n  return `crypto:${createHash(\"sha256\").update(key, \"utf8\").digest(\"hex\").slice(0, 16)}`;\n}\n\n/**\n * Build a CycloneDX 1.6 CBOM from a scan result. One component per distinct\n * (algorithm + primitive) pair, with occurrence evidence (file:line) per\n * finding. Output is deterministic (components and occurrences are sorted).\n */\nexport function toCbom(result: ScanResult): CycloneDxBom {\n  // Group findings by (algorithm | primitive).\n  const groups = new Map<\n    string,\n    { algorithm: AlgorithmFamily; primitive: string; findings: Finding[] }\n  >();\n\n  for (const f of result.findings) {\n    const algorithm: AlgorithmFamily = f.algorithm ?? \"unknown\";\n    const primitive = primitiveFor(f.category);\n    const key = `${algorithm}|${primitive}`;\n    let g = groups.get(key);\n    if (!g) {\n      g = { algorithm, primitive, findings: [] };\n      groups.set(key, g);\n    }\n    g.findings.push(f);\n  }\n\n  const components: CbomComponent[] = [...groups.entries()]\n    .sort((a, b) => (a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0))\n    .map(([key, g]) => {\n      const occurrences = g.findings\n        .map((f) => ({\n          location: `${f.location.file}:${f.location.line}`,\n          ...(f.cwe ? { additionalContext: f.cwe } : {}),\n        }))\n        .sort((a, b) => (a.location < b.location ? -1 : a.location > b.location ? 1 : 0));\n\n      const anyHndl = g.findings.some((f) => f.hndl);\n\n      return {\n        type: \"cryptographic-asset\" as const,\n        \"bom-ref\": bomRef(key),\n        name: `${g.algorithm} (${g.primitive})`,\n        cryptoProperties: {\n          assetType: \"algorithm\",\n          algorithmProperties: {\n            primitive: g.primitive,\n            parameterSetIdentifier: g.algorithm,\n            executionEnvironment: \"software-plain-ram\",\n            classicalSecurityLevel: classicalSecurityLevelFor(g.algorithm),\n            nistQuantumSecurityLevel: 0,\n            cryptoFunctions:\n              g.primitive === \"signature\"\n                ? [\"sign\", \"verify\"]\n                : g.primitive === \"kem\"\n                  ? [\"encapsulate\", \"decapsulate\"]\n                  : g.primitive === \"key-agree\"\n                    ? [\"keyagree\"]\n                    : [\"other\"],\n          },\n          quantumVulnerable: isQuantumVulnerable(g.algorithm),\n          harvestNowDecryptLater: anyHndl,\n        },\n        evidence: { occurrences },\n      };\n    });\n\n  const serial = `urn:uuid:${stableUuid(result)}`;\n\n  return {\n    bomFormat: \"CycloneDX\",\n    specVersion: \"1.6\",\n    serialNumber: serial,\n    version: 1,\n    metadata: {\n      timestamp: result.finishedAt,\n      tools: {\n        components: [\n          {\n            type: \"application\",\n            name: \"qScan\",\n            version: result.toolVersion || VERSION,\n          },\n        ],\n      },\n      component: {\n        type: \"application\",\n        \"bom-ref\": \"root\",\n        name: result.root,\n      },\n    },\n    components,\n  };\n}\n\n/**\n * Derive a stable UUID-shaped serial from the scan result so re-exporting the\n * same result yields the same serial number (deterministic output).\n */\nfunction stableUuid(result: ScanResult): string {\n  const h = createHash(\"sha256\")\n    .update(`${result.root}|${result.toolVersion}|${result.findings.length}`, \"utf8\")\n    .digest(\"hex\");\n  // Shape as a v4-ish UUID (variant/version nibbles forced).\n  return `${h.slice(0, 8)}-${h.slice(8, 12)}-4${h.slice(13, 16)}-8${h.slice(17, 20)}-${h.slice(20, 32)}`;\n}\n"]}

package/dist/changed.js.map

@@ -1 +1 @@
-{"version":3,"file":"changed.js","sourceRoot":"","sources":["../src/changed.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,6EAA6E;AAC7E,KAAK,UAAU,GAAG,CAAC,GAAW,EAAE,IAAc;IAC5C,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE;YAClD,GAAG;YACH,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;YAC3B,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,SAAS,OAAO,CAAC,MAAqB;IACpC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,OAAO,MAAM;SACV,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,KAAc;IAC7D,qEAAqE;IACrE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC,CAAC;IACvE,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM;QAAE,OAAO,EAAE,CAAC;IAE3D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAE9B,6EAA6E;IAC7E,6EAA6E;IAC7E,2EAA2E;IAC3E,IAAI,KAAK,EAAE,CAAC;QACV,2EAA2E;QAC3E,4EAA4E;QAC5E,6EAA6E;QAC7E,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE;YAC3B,MAAM;YACN,aAAa;YACb,YAAY;YACZ,oBAAoB;YACpB,KAAK;SACN,CAAC,CAAC;QACH,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,wCAAwC,KAAK,2BAA2B,CAAC,CAAC;QAC5F,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,gFAAgF;IAChF,KAAK,MAAM,CAAC,IAAI,OAAO,CACrB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,oBAAoB,CAAC,CAAC,CAC7E,EAAE,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACb,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,CACrB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,oBAAoB,EAAE,UAAU,CAAC,CAAC,CACzF,EAAE,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACb,CAAC;IAED,qCAAqC;IACrC,KAAK,MAAM,CAAC,IAAI,OAAO,CACrB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,oBAAoB,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAC3E,EAAE,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACb,CAAC;IAED,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC"}
+{"version":3,"file":"changed.js","sourceRoot":"","sources":["../src/changed.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,6EAA6E;AAC7E,KAAK,UAAU,GAAG,CAAC,GAAW,EAAE,IAAc;IAC5C,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE;YAClD,GAAG;YACH,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;YAC3B,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,SAAS,OAAO,CAAC,MAAqB;IACpC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,OAAO,MAAM;SACV,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,KAAc;IAC7D,qEAAqE;IACrE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC,CAAC;IACvE,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM;QAAE,OAAO,EAAE,CAAC;IAE3D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAE9B,6EAA6E;IAC7E,6EAA6E;IAC7E,2EAA2E;IAC3E,IAAI,KAAK,EAAE,CAAC;QACV,2EAA2E;QAC3E,4EAA4E;QAC5E,6EAA6E;QAC7E,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE;YAC3B,MAAM;YACN,aAAa;YACb,YAAY;YACZ,oBAAoB;YACpB,KAAK;SACN,CAAC,CAAC;QACH,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,wCAAwC,KAAK,2BAA2B,CAAC,CAAC;QAC5F,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,gFAAgF;IAChF,KAAK,MAAM,CAAC,IAAI,OAAO,CACrB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,oBAAoB,CAAC,CAAC,CAC7E,EAAE,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACb,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,CACrB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,oBAAoB,EAAE,UAAU,CAAC,CAAC,CACzF,EAAE,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACb,CAAC;IAED,qCAAqC;IACrC,KAAK,MAAM,CAAC,IAAI,OAAO,CACrB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,oBAAoB,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAC3E,EAAE,CAAC;QACF,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACb,CAAC;IAED,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC","sourcesContent":["/**\n * Incremental-scan helper: list the files that changed in a git working tree,\n * for feeding into {@link ScanOptions.files}. Tolerant of non-git directories —\n * returns an empty list rather than throwing.\n */\nimport { execFile } from \"node:child_process\";\nimport { promisify } from \"node:util\";\n\nconst execFileAsync = promisify(execFile);\n\n/** Run a git command in `cwd`, returning stdout or `null` on any failure. */\nasync function git(cwd: string, args: string[]): Promise<string | null> {\n  try {\n    const { stdout } = await execFileAsync(\"git\", args, {\n      cwd,\n      maxBuffer: 64 * 1024 * 1024,\n      windowsHide: true,\n    });\n    return stdout;\n  } catch {\n    return null;\n  }\n}\n\n/** Split git output into trimmed, non-empty, POSIX-relative path lines. */\nfunction toLines(stdout: string | null): string[] {\n  if (!stdout) return [];\n  return stdout\n    .split(\"\\n\")\n    .map((l) => l.trim())\n    .filter((l) => l.length > 0);\n}\n\n/**\n * Return the list of changed files (relative POSIX paths) under `root`.\n *\n * - With `since` (a ref / range), returns `git diff --name-only --diff-filter=ACMR <since>`\n *   plus currently-modified-but-uncommitted files, deduped.\n * - Without `since`, returns uncommitted changes (`git diff` working+staged) plus\n *   untracked files (`git ls-files --others --exclude-standard`).\n * - When `root` is not a git repository (or git is unavailable), returns `[]`.\n *\n * Deleted files are excluded (ACMR filter / existence is the caller's concern).\n */\nexport async function changedFiles(root: string, since?: string): Promise<string[]> {\n  // Confirm this is a git work tree first; bail out tolerantly if not.\n  const inside = await git(root, [\"rev-parse\", \"--is-inside-work-tree\"]);\n  if (inside === null || inside.trim() !== \"true\") return [];\n\n  const out = new Set<string>();\n\n  // `--relative` makes git emit paths relative to `root` (the scan cwd) rather\n  // than repo-root-relative, so `scan()` can join them against a sub-directory\n  // root. Without it, a `--changed` scan of a subdirectory resolves nothing.\n  if (since) {\n    // A `git diff` against `since` returns null ONLY when the command failed —\n    // almost always an unknown ref/range (a typo like `--since maiin`). Surface\n    // it instead of silently scanning just the uncommitted files and passing CI.\n    const diff = await git(root, [\n      \"diff\",\n      \"--name-only\",\n      \"--relative\",\n      \"--diff-filter=ACMR\",\n      since,\n    ]);\n    if (diff === null) {\n      throw new Error(`--since: git could not diff against \"${since}\" (unknown ref or range).`);\n    }\n    for (const f of toLines(diff)) out.add(f);\n  }\n\n  // Always include local uncommitted edits (staged + unstaged), filtered to ACMR.\n  for (const f of toLines(\n    await git(root, [\"diff\", \"--name-only\", \"--relative\", \"--diff-filter=ACMR\"]),\n  )) {\n    out.add(f);\n  }\n  for (const f of toLines(\n    await git(root, [\"diff\", \"--name-only\", \"--relative\", \"--diff-filter=ACMR\", \"--cached\"]),\n  )) {\n    out.add(f);\n  }\n\n  // Untracked (but not ignored) files.\n  for (const f of toLines(\n    await git(root, [\"ls-files\", \"--others\", \"--exclude-standard\", \"--\", \".\"]),\n  )) {\n    out.add(f);\n  }\n\n  return [...out].sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));\n}\n"]}

package/dist/codemods/config-toggle.js.map

@@ -1 +1 @@
-{"version":3,"file":"config-toggle.js","sourceRoot":"","sources":["../../src/codemods/config-toggle.ts"],"names":[],"mappings":"AAYA,MAAM,CAAC,MAAM,mBAAmB,GAAY;IAC1C,EAAE,EAAE,eAAe;IACnB,OAAO,CAAC,OAAgB;QACtB,OAAO,OAAO,CAAC,MAAM,KAAK,oBAAoB,IAAI,OAAO,CAAC,MAAM,KAAK,yBAAyB,CAAC;IACjG,CAAC;IACD,KAAK,CAAC,OAAe,EAAE,OAAgB;QACrC,yEAAyE;QACzE,6EAA6E;QAC7E,8EAA8E;QAC9E,MAAM,GAAG,GAAG,OAAO;aAChB,OAAO,CAAC,8DAA8D,EAAE,aAAa,CAAC;aACtF,OAAO,CAAC,yDAAyD,EAAE,oBAAoB,CAAC;aACxF,OAAO,CAAC,mCAAmC,EAAE,QAAQ,CAAC,CAAC;QAC1D,IAAI,GAAG,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QACjC,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI;YAC3B,UAAU,EAAE,GAAG;YACf,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,MAAM,EAAE,SAAS;SAClB,CAAC;IACJ,CAAC;CACF,CAAC"}
+{"version":3,"file":"config-toggle.js","sourceRoot":"","sources":["../../src/codemods/config-toggle.ts"],"names":[],"mappings":"AAYA,MAAM,CAAC,MAAM,mBAAmB,GAAY;IAC1C,EAAE,EAAE,eAAe;IACnB,OAAO,CAAC,OAAgB;QACtB,OAAO,OAAO,CAAC,MAAM,KAAK,oBAAoB,IAAI,OAAO,CAAC,MAAM,KAAK,yBAAyB,CAAC;IACjG,CAAC;IACD,KAAK,CAAC,OAAe,EAAE,OAAgB;QACrC,yEAAyE;QACzE,6EAA6E;QAC7E,8EAA8E;QAC9E,MAAM,GAAG,GAAG,OAAO;aAChB,OAAO,CAAC,8DAA8D,EAAE,aAAa,CAAC;aACtF,OAAO,CAAC,yDAAyD,EAAE,oBAAoB,CAAC;aACxF,OAAO,CAAC,mCAAmC,EAAE,QAAQ,CAAC,CAAC;QAC1D,IAAI,GAAG,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QACjC,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI;YAC3B,UAAU,EAAE,GAAG;YACf,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,MAAM,EAAE,SAAS;SAClB,CAAC;IACJ,CAAC;CACF,CAAC","sourcesContent":["/**\n * Config-toggle codemod: mechanical, unambiguous fixes for insecure TLS config.\n * Both target rules have a single correct replacement, so the fix is\n * deterministic and clears the finding (verified by the pipeline's gate).\n *\n *  - `tls-legacy-version`  — bump a pinned TLS 1.0/1.1 to TLS 1.3.\n *  - `tls-reject-unauthorized` — turn certificate verification back on.\n */\nimport type { Finding } from \"../types.js\";\nimport type { Patch } from \"../agent-types.js\";\nimport type { Codemod } from \"./registry.js\";\n\nexport const configToggleCodemod: Codemod = {\n  id: \"config-toggle\",\n  applies(finding: Finding): boolean {\n    return finding.ruleId === \"tls-legacy-version\" || finding.ruleId === \"tls-reject-unauthorized\";\n  },\n  apply(content: string, finding: Finding): Patch | null {\n    // Normalize ALL insecure TLS config in one pass (not just this finding's\n    // aspect), so a file with both issues is fully fixed by a single patch — the\n    // pipeline dedupes patches by file, and a partial patch would drop a sibling.\n    const out = content\n      .replace(/((?:minVersion|maxVersion)\\s*:\\s*['\"`])TLSv1(?:\\.1)?(['\"`])/g, \"$1TLSv1.3$2\")\n      .replace(/(secureProtocol\\s*:\\s*['\"`])TLSv1(?:_1)?_method(['\"`])/g, \"$1TLSv1_3_method$2\")\n      .replace(/(rejectUnauthorized\\s*:\\s*)false/g, \"$1true\");\n    if (out === content) return null;\n    return {\n      path: finding.location.file,\n      newContent: out,\n      ruleId: finding.ruleId,\n      source: \"codemod\",\n    };\n  },\n};\n"]}

package/dist/codemods/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/codemods/registry.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAWzD,kDAAkD;AAClD,MAAM,CAAC,MAAM,eAAe,GAAc,CAAC,mBAAmB,CAAC,CAAC;AAEhE,iEAAiE;AACjE,MAAM,UAAU,UAAU,CAAC,OAAgB;IACzC,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;AACzD,CAAC"}
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/codemods/registry.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAWzD,kDAAkD;AAClD,MAAM,CAAC,MAAM,eAAe,GAAc,CAAC,mBAAmB,CAAC,CAAC;AAEhE,iEAAiE;AACjE,MAAM,UAAU,UAAU,CAAC,OAAgB;IACzC,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;AACzD,CAAC","sourcesContent":["/**\n * Codemod registry — deterministic, template-able fixes keyed by finding.\n *\n * A codemod only earns a place here if its output reliably CLEARS the finding\n * (the remediation pipeline enforces this with the `verify_fix` gate). That\n * makes the set deliberately small: mechanical config toggles qualify;\n * dependency swaps and source crypto rewrites generally do NOT (there is no\n * safe drop-in replacement, and a manifest fix can't \"remove\" the finding\n * without deleting the dependency) — those are left to triage + the LLM\n * remediation layer, not an auto-codemod.\n */\nimport type { Finding } from \"../types.js\";\nimport type { Patch } from \"../agent-types.js\";\nimport { configToggleCodemod } from \"./config-toggle.js\";\n\n/** A deterministic fix for a class of findings. */\nexport interface Codemod {\n  id: string;\n  /** True when this codemod can produce a deterministic fix for the finding. */\n  applies(finding: Finding): boolean;\n  /** Produce a patch (full new file content), or null if it changed nothing. */\n  apply(content: string, finding: Finding): Patch | null;\n}\n\n/** All registered codemods, in priority order. */\nexport const codemodRegistry: Codemod[] = [configToggleCodemod];\n\n/** The first codemod that applies to `finding`, or undefined. */\nexport function codemodFor(finding: Finding): Codemod | undefined {\n  return codemodRegistry.find((c) => c.applies(finding));\n}\n"]}

package/dist/comments.d.ts

@@ -24,6 +24,15 @@ export declare function commentStyleForFile(file: string): CommentStyle | null;
  * comment. Spans are returned sorted and non-overlapping.
  */
 export declare function commentSpans(content: string, style: CommentStyle): Array<[number, number]>;
+/**
+ * Compute Python triple-quoted string spans (`"""…"""` / `'''…'''`). These are
+ * docstrings / prose in practice, so a crypto *name* mentioned inside one
+ * (`:param key_type: eg "ssh-ed25519"`) should not fire a token finding — but a
+ * PEM key pasted into one is still real material, so {@link stripCommentFindings}
+ * exempts `pem-*` rules. Comments and normal strings are skipped so a `"""`
+ * delimiter inside them is not mis-detected.
+ */
+export declare function pythonDocstringSpans(content: string): Array<[number, number]>;
 /** True if `offset` falls inside one of the (sorted, non-overlapping) spans. */
 export declare function offsetInSpans(spans: ReadonlyArray<[number, number]>, offset: number): boolean;
 /**
@@ -42,4 +51,21 @@ export declare function stripIgnoredFindings(findings: Finding[], content: strin
  * language has no comment style we handle, or when it has no comments.
  */
 export declare function stripCommentFindings(findings: Finding[], content: string, file: string): Finding[];
+/**
+ * Compute the string-literal spans (`[start, end)`) of `content`, skipping over
+ * comments so a quote inside a comment is not treated as a string. Used to
+ * suppress findings from IDENTIFIER-only rules (e.g. a Go `SigningMethodRS256`
+ * mentioned inside an error-message string) — the mirror of {@link commentSpans}.
+ */
+export declare function stringSpans(content: string, style: CommentStyle): Array<[number, number]>;
+/**
+ * Drop findings of "code-only" rules (`ruleIds`) whose match starts inside a
+ * string literal. Some rules — an identifier-form JWT signing method, a Go
+ * `SigningMethodRS256` — are only meaningful as code; when the same token appears
+ * inside a string (a test's `t.Error("SigningMethodPS256 …")`) it is prose, not a
+ * usage. Rules that legitimately match inside strings (quoted `"RS256"` alg
+ * tokens, cipher-suite strings, ssh-key tokens) are NOT in `ruleIds` and pass
+ * through untouched.
+ */
+export declare function stripStringLiteralFindings(findings: Finding[], content: string, file: string, ruleIds: ReadonlySet<string>): Finding[];
 //# sourceMappingURL=comments.d.ts.map

package/dist/comments.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"comments.d.ts","sourceRoot":"","sources":["../src/comments.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1C,MAAM,MAAM,YAAY,GAAG,GAAG,GAAG,MAAM,CAAC;AA8BxC,sFAAsF;AACtF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAKrE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAgD1F;AAED,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAW7F;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CASzD;AAED,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,EAAE,CAKpF;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,GACX,OAAO,EAAE,CAmBX"}
+{"version":3,"file":"comments.d.ts","sourceRoot":"","sources":["../src/comments.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1C,MAAM,MAAM,YAAY,GAAG,GAAG,GAAG,MAAM,CAAC;AA8BxC,sFAAsF;AACtF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAKrE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAgD1F;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAsC7E;AAED,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAW7F;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CASzD;AAED,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,EAAE,CAKpF;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,GACX,OAAO,EAAE,CAyBX;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CA2CzF;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,GAC3B,OAAO,EAAE,CAkBX"}