@quantakrypto/core 0.4.1 → 0.4.3

package/dist/scan.js

@@ -13,7 +13,13 @@ import { readFile, stat } from "node:fs/promises";
 import * as path from "node:path";
 import { walkFiles, toPosix, isBinaryPath, looksMinified, matchesAny } from "./walk.js";
 import { isAnalyzableSource } from "./detect-utils.js";
-import { stripCommentFindings, stripIgnoredFindings } from "./comments.js";
+import { stripCommentFindings, stripIgnoredFindings, stripStringLiteralFindings, } from "./comments.js";
+/**
+ * Rules whose token is only meaningful as code, never inside a string literal.
+ * A match inside a string (e.g. `t.Error("SigningMethodPS256 …")`) is prose and
+ * is dropped. Rules that legitimately match quoted tokens are NOT listed here.
+ */
+const CODE_ONLY_RULES = new Set(["go-jwt-signingmethod"]);
 import { hashContent, loadCache, rulesetFingerprint, saveCache } from "./cache.js";
 import { builtinDetectors, defaultRegistry, detectorScope } from "./registry.js";
 import { isManifestFile, scanManifest } from "./dependencies.js";
@@ -60,6 +66,7 @@ export function detectFile(file, content, dets, toggles, disabledRules) {
     // `qscan-ignore-next-line` directives. Both run before the dependency scan
     // appends its findings (manifests carry neither).
     out = stripCommentFindings(out, content, file);
+    out = stripStringLiteralFindings(out, content, file, CODE_ONLY_RULES);
     out = stripIgnoredFindings(out, content);
     if (toggles.deps && isManifestFile(file)) {
         out.push(...scanManifest(file, content));
@@ -99,7 +106,14 @@ export async function scan(options) {
     const cacheFile = options.cacheFile;
     const ruleset = cacheFile ? rulesetFingerprint(dets, options.disabledRules) : "";
     const cache = cacheFile ? await loadCache(cacheFile, ruleset) : null;
-    const nextEntries = cacheFile ? new Map() : null;
+    // A full scan starts with an empty next-cache so files that vanished are
+    // evicted. An INCREMENTAL scan (explicit `files` list) only visits a subset,
+    // so seed the next-cache with the existing entries — otherwise saving would
+    // drop every file we didn't happen to scan this run (audit: arch #4).
+    const incremental = Array.isArray(options.files);
+    const nextEntries = cacheFile
+        ? new Map(incremental && cache ? cache : [])
+        : null;
     // Work-budget / cancellation controls (all optional, unlimited when omitted).
     const signal = options.signal;
     const maxFiles = options.maxFiles;

package/dist/scan.js.map

@@ -1 +1 @@
-{"version":3,"file":"scan.js","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEnF,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,SAAS,GAAe,gBAAgB,CAAC;AAEtD,8EAA8E;AAC9E,MAAM,UAAU,eAAe,CAAC,CAAU,EAAE,CAAU;IACpD,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;IAClF,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,sFAAsF;AACtF,SAAS,gBAAgB,CAAC,OAAoB;IAC5C,OAAO,OAAO,CAAC,SAAS,IAAI,eAAe,CAAC,GAAG,EAAE,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CACxB,IAAY,EACZ,OAAe,EACf,IAAyB,EACzB,OAA4D,EAC5D,aAAiC;IAEjC,IAAI,GAAG,GAAc,EAAE,CAAC;IAExB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC;QACjD,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM;YAAE,SAAS;QAC3D,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,2EAA2E;IAC3E,8DAA8D;IAC9D,2EAA2E;IAC3E,kDAAkD;IAClD,GAAG,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/C,GAAG,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAEzC,IAAI,OAAO,CAAC,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,8EAA8E;IAC9E,qEAAqE;IACrE,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;QACxC,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAoB;IAC7C,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAE7B,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;IAC1C,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC;IACnD,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAEvC,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACvE,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEvE,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,eAAe,GAAG,CAAC,CAAC;IAExB,0EAA0E;IAC1E,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACpC,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,MAAM,WAAW,GAAmC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAEjF,8EAA8E;IAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAElC,+EAA+E;IAC/E,MAAM,QAAQ,GAA0B,OAAO,CAAC,KAAK;QACnD,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;QAC7C,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE;YACtB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,CAAC;IAEP,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QACjC,4EAA4E;QAC5E,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,UAAU,EAAE,CAAC;QAE5C,4DAA4D;QAC5D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,YAAY,IAAI,QAAQ,EAAE,CAAC;YAC7D,MAAM,IAAI,mBAAmB,CAAC,oCAAoC,QAAQ,IAAI,CAAC,CAAC;QAClF,CAAC;QAED,4EAA4E;QAC5E,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACtF,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAEzD,OAAO,CAAC,MAAM,EAAE,CAAC,YAAY,CAAC,CAAC;QAE/B,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,IAAI,CAAC,CAAC,CAAC,iEAAiE;YAClF,SAAS;QACX,CAAC;QAED,yEAAyE;QACzE,yEAAyE;QACzE,IAAI,CAAC,YAAY,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7E,eAAe,IAAI,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QAED,6EAA6E;QAC7E,YAAY,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,YAAY,GAAG,QAAQ,EAAE,CAAC;YAC5D,MAAM,IAAI,mBAAmB,CAAC,oCAAoC,QAAQ,IAAI,CAAC,CAAC;QAClF,CAAC;QAED,YAAY,IAAI,CAAC,CAAC;QAClB,IAAI,kBAAkB,CAAC,YAAY,CAAC;YAAE,aAAa,IAAI,CAAC,CAAC;QAEzD,4EAA4E;QAC5E,6EAA6E;QAC7E,IAAI,YAAuB,CAAC;QAC5B,IAAI,KAAK,IAAI,WAAW,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;YAClC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACpC,YAAY;gBACV,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI;oBACtB,CAAC,CAAC,GAAG,CAAC,QAAQ;oBACd,CAAC,CAAC,UAAU,CACR,YAAY,EACZ,OAAO,EACP,IAAI,EACJ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EACpD,OAAO,CAAC,aAAa,CACtB,CAAC;YACR,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QAClE,CAAC;aAAM,CAAC;YACN,YAAY,GAAG,UAAU,CACvB,YAAY,EACZ,OAAO,EACP,IAAI,EACJ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EACpD,OAAO,CAAC,aAAa,CACtB,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;IACjC,CAAC;IAED,6DAA6D;IAC7D,IAAI,SAAS,IAAI,WAAW;QAAE,MAAM,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IAE/E,oDAAoD;IACpD,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAE/B,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;IAE9B,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ;QACR,YAAY;QACZ,aAAa;QACb,WAAW,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE;QAC5C,SAAS;QACT,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;QAClC,UAAU,EAAE,UAAU,CAAC,WAAW,EAAE;QACpC,WAAW,EAAE,OAAO;KACrB,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAwB,EACxB,OAAiD;IAEjD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC;SACpB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACZ,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACzB,IAAI,YAAY,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACpC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAClE,IAAI,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,kFAAkF;AAClF,KAAK,SAAS,CAAC,CAAC,mBAAmB,CAAC,KAAe,EAAE,OAAoB;IACvE,KAAK,MAAM,GAAG,IAAI,sBAAsB,CAAC,KAAK,EAAE,OAAO,CAAC;QAAE,MAAM,GAAG,CAAC;AACtE,CAAC"}
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAEvB;;;;GAIG;AACH,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC;AAC/E,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEnF,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,SAAS,GAAe,gBAAgB,CAAC;AAEtD,8EAA8E;AAC9E,MAAM,UAAU,eAAe,CAAC,CAAU,EAAE,CAAU;IACpD,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;IAClF,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,sFAAsF;AACtF,SAAS,gBAAgB,CAAC,OAAoB;IAC5C,OAAO,OAAO,CAAC,SAAS,IAAI,eAAe,CAAC,GAAG,EAAE,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CACxB,IAAY,EACZ,OAAe,EACf,IAAyB,EACzB,OAA4D,EAC5D,aAAiC;IAEjC,IAAI,GAAG,GAAc,EAAE,CAAC;IAExB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC;QACjD,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM;YAAE,SAAS;QAC3D,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,2EAA2E;IAC3E,8DAA8D;IAC9D,2EAA2E;IAC3E,kDAAkD;IAClD,GAAG,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/C,GAAG,GAAG,0BAA0B,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;IACtE,GAAG,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAEzC,IAAI,OAAO,CAAC,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,8EAA8E;IAC9E,qEAAqE;IACrE,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;QACxC,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAoB;IAC7C,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAE7B,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;IAC1C,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC;IACnD,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAEvC,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACvE,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEvE,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,eAAe,GAAG,CAAC,CAAC;IAExB,0EAA0E;IAC1E,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACpC,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,yEAAyE;IACzE,6EAA6E;IAC7E,4EAA4E;IAC5E,sEAAsE;IACtE,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,WAAW,GAAmC,SAAS;QAC3D,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,CAAC,CAAC,IAAI,CAAC;IAET,8EAA8E;IAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAElC,+EAA+E;IAC/E,MAAM,QAAQ,GAA0B,OAAO,CAAC,KAAK;QACnD,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;QAC7C,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE;YACtB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,CAAC;IAEP,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QACjC,4EAA4E;QAC5E,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,UAAU,EAAE,CAAC;QAE5C,4DAA4D;QAC5D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,YAAY,IAAI,QAAQ,EAAE,CAAC;YAC7D,MAAM,IAAI,mBAAmB,CAAC,oCAAoC,QAAQ,IAAI,CAAC,CAAC;QAClF,CAAC;QAED,4EAA4E;QAC5E,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACtF,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAEzD,OAAO,CAAC,MAAM,EAAE,CAAC,YAAY,CAAC,CAAC;QAE/B,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,IAAI,CAAC,CAAC,CAAC,iEAAiE;YAClF,SAAS;QACX,CAAC;QAED,yEAAyE;QACzE,yEAAyE;QACzE,IAAI,CAAC,YAAY,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7E,eAAe,IAAI,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QAED,6EAA6E;QAC7E,YAAY,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,YAAY,GAAG,QAAQ,EAAE,CAAC;YAC5D,MAAM,IAAI,mBAAmB,CAAC,oCAAoC,QAAQ,IAAI,CAAC,CAAC;QAClF,CAAC;QAED,YAAY,IAAI,CAAC,CAAC;QAClB,IAAI,kBAAkB,CAAC,YAAY,CAAC;YAAE,aAAa,IAAI,CAAC,CAAC;QAEzD,4EAA4E;QAC5E,6EAA6E;QAC7E,IAAI,YAAuB,CAAC;QAC5B,IAAI,KAAK,IAAI,WAAW,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;YAClC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACpC,YAAY;gBACV,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI;oBACtB,CAAC,CAAC,GAAG,CAAC,QAAQ;oBACd,CAAC,CAAC,UAAU,CACR,YAAY,EACZ,OAAO,EACP,IAAI,EACJ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EACpD,OAAO,CAAC,aAAa,CACtB,CAAC;YACR,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QAClE,CAAC;aAAM,CAAC;YACN,YAAY,GAAG,UAAU,CACvB,YAAY,EACZ,OAAO,EACP,IAAI,EACJ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EACpD,OAAO,CAAC,aAAa,CACtB,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;IACjC,CAAC;IAED,6DAA6D;IAC7D,IAAI,SAAS,IAAI,WAAW;QAAE,MAAM,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IAE/E,oDAAoD;IACpD,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAE/B,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;IAE9B,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ;QACR,YAAY;QACZ,aAAa;QACb,WAAW,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE;QAC5C,SAAS;QACT,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;QAClC,UAAU,EAAE,UAAU,CAAC,WAAW,EAAE;QACpC,WAAW,EAAE,OAAO;KACrB,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAwB,EACxB,OAAiD;IAEjD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC;SACpB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACZ,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACzB,IAAI,YAAY,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACpC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAClE,IAAI,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,kFAAkF;AAClF,KAAK,SAAS,CAAC,CAAC,mBAAmB,CAAC,KAAe,EAAE,OAAoB;IACvE,KAAK,MAAM,GAAG,IAAI,sBAAsB,CAAC,KAAK,EAAE,OAAO,CAAC;QAAE,MAAM,GAAG,CAAC;AACtE,CAAC","sourcesContent":["/**\n * Scan orchestrator. Walks the target (or an explicit file list), runs the\n * applicable detectors over each file, parses dependency manifests, aggregates\n * everything into an inventory, and returns a {@link ScanResult} with timing and\n * the tool version.\n *\n * Detector scope (source vs config) is driven by each {@link Detector}'s\n * declared `scope` (defaulting to \"source\"), not by ruleId prefixes. The\n * detector set comes from {@link defaultRegistry} unless overridden via\n * `options.detectors`.\n */\nimport { readFile, stat } from \"node:fs/promises\";\nimport * as path from \"node:path\";\n\nimport type { Detector, Finding, ScanOptions, ScanResult } from \"./types.js\";\nimport { walkFiles, toPosix, isBinaryPath, looksMinified, matchesAny } from \"./walk.js\";\nimport { isAnalyzableSource } from \"./detect-utils.js\";\nimport {\n  stripCommentFindings,\n  stripIgnoredFindings,\n  stripStringLiteralFindings,\n} from \"./comments.js\";\n\n/**\n * Rules whose token is only meaningful as code, never inside a string literal.\n * A match inside a string (e.g. `t.Error(\"SigningMethodPS256 …\")`) is prose and\n * is dropped. Rules that legitimately match quoted tokens are NOT listed here.\n */\nconst CODE_ONLY_RULES: ReadonlySet<string> = new Set([\"go-jwt-signingmethod\"]);\nimport { hashContent, loadCache, rulesetFingerprint, saveCache } from \"./cache.js\";\nimport type { CacheEntry } from \"./cache.js\";\nimport { builtinDetectors, defaultRegistry, detectorScope } from \"./registry.js\";\nimport { isManifestFile, scanManifest } from \"./dependencies.js\";\nimport { buildInventory } from \"./inventory.js\";\nimport { AbortError, BudgetExceededError } from \"./errors.js\";\nimport { VERSION } from \"./version.js\";\n\n/**\n * The full set of built-in detectors exposed on the public API. Re-exported\n * from {@link builtinDetectors} in `registry.ts` — the single source of truth\n * the {@link defaultRegistry} is also built from — so the public array and the\n * registry can never drift apart. The manifest scanner is handled separately\n * (it parses JSON rather than running a Detector).\n */\nexport const detectors: Detector[] = builtinDetectors;\n\n/** Stable comparator: by file, then line, then ruleId. Exported for reuse. */\nexport function compareFindings(a: Finding, b: Finding): number {\n  if (a.location.file !== b.location.file) return a.location.file < b.location.file ? -1 : 1;\n  if (a.location.line !== b.location.line) return a.location.line - b.location.line;\n  return a.ruleId < b.ruleId ? -1 : a.ruleId > b.ruleId ? 1 : 0;\n}\n\n/** Resolve the active detector list for a scan (override or the default registry). */\nfunction resolveDetectors(options: ScanOptions): Detector[] {\n  return options.detectors ?? defaultRegistry.all();\n}\n\n/**\n * Run all applicable detectors + the manifest scanner over a single file's\n * contents, honouring the source / config / dependencies toggles. Pure: no I/O.\n * Exported so the parallel worker and unit tests can drive it directly.\n */\nexport function detectFile(\n  file: string,\n  content: string,\n  dets: readonly Detector[],\n  toggles: { source: boolean; config: boolean; deps: boolean },\n  disabledRules?: readonly string[],\n): Finding[] {\n  let out: Finding[] = [];\n\n  for (const det of dets) {\n    if (!det.appliesTo(file)) continue;\n    const isConfig = detectorScope(det) === \"config\";\n    if (isConfig ? !toggles.config : !toggles.source) continue;\n    out.push(...det.detect({ file, content }));\n  }\n\n  // Drop lexical false positives that land inside comments (`// migrated off\n  // createECDH()`), then honour inline `// qscan-ignore-line` /\n  // `qscan-ignore-next-line` directives. Both run before the dependency scan\n  // appends its findings (manifests carry neither).\n  out = stripCommentFindings(out, content, file);\n  out = stripStringLiteralFindings(out, content, file, CODE_ONLY_RULES);\n  out = stripIgnoredFindings(out, content);\n\n  if (toggles.deps && isManifestFile(file)) {\n    out.push(...scanManifest(file, content));\n  }\n\n  // Per-rule suppression: drop findings whose ruleId was disabled. Applied here\n  // so both the serial scan and the worker path honour it identically.\n  if (disabledRules && disabledRules.length > 0) {\n    const disabled = new Set(disabledRules);\n    return out.filter((f) => !disabled.has(f.ruleId));\n  }\n\n  return out;\n}\n\n/**\n * Recursively scan a directory (or single file, or explicit file list) for\n * classical asymmetric crypto. Honours the source / dependencies / config\n * toggles (all default true) and reports progress through `options.onFile`.\n */\nexport async function scan(options: ScanOptions): Promise<ScanResult> {\n  const startedAt = new Date();\n\n  const doSource = options.source !== false;\n  const doDeps = options.dependencies !== false;\n  const doConfig = options.config !== false;\n  const scanMinified = options.scanMinified === true;\n  const dets = resolveDetectors(options);\n\n  // Resolve whether the root is a file so we can rebuild absolute paths to read.\n  const rootStat = await stat(options.root);\n  const rootIsFile = rootStat.isFile();\n  const baseDir = rootIsFile ? path.dirname(options.root) : options.root;\n  const singleFileName = rootIsFile ? path.basename(options.root) : null;\n\n  const findings: Finding[] = [];\n  let filesScanned = 0;\n  let analyzedFiles = 0;\n  let bytesScanned = 0;\n  let unreadable = 0;\n  let skippedMinified = 0;\n\n  // Optional content-hash scan cache: unchanged files reuse prior findings.\n  const cacheFile = options.cacheFile;\n  const ruleset = cacheFile ? rulesetFingerprint(dets, options.disabledRules) : \"\";\n  const cache = cacheFile ? await loadCache(cacheFile, ruleset) : null;\n  // A full scan starts with an empty next-cache so files that vanished are\n  // evicted. An INCREMENTAL scan (explicit `files` list) only visits a subset,\n  // so seed the next-cache with the existing entries — otherwise saving would\n  // drop every file we didn't happen to scan this run (audit: arch #4).\n  const incremental = Array.isArray(options.files);\n  const nextEntries: Map<string, CacheEntry> | null = cacheFile\n    ? new Map(incremental && cache ? cache : [])\n    : null;\n\n  // Work-budget / cancellation controls (all optional, unlimited when omitted).\n  const signal = options.signal;\n  const maxFiles = options.maxFiles;\n  const maxBytes = options.maxBytes;\n\n  // Source of relative paths: an explicit file list (incremental) or the walker.\n  const relPaths: AsyncIterable<string> = options.files\n    ? filterExplicitFiles(options.files, options)\n    : walkFiles(options.root, {\n        include: options.include,\n        exclude: options.exclude,\n        noDefaultIgnores: options.noDefaultIgnores,\n        maxFileSize: options.maxFileSize,\n      });\n\n  for await (const rel of relPaths) {\n    // Cooperative cancellation: check the signal at the top of every iteration.\n    if (signal?.aborted) throw new AbortError();\n\n    // File-count budget: enforced before reading the next file.\n    if (typeof maxFiles === \"number\" && filesScanned >= maxFiles) {\n      throw new BudgetExceededError(`maxFiles budget exceeded (limit: ${maxFiles}).`);\n    }\n\n    // In single-file mode, walkFiles yields the basename; map back to the file.\n    const absPath = singleFileName ? options.root : path.join(baseDir, ...rel.split(\"/\"));\n    const reportedPath = singleFileName ? toPosix(rel) : rel;\n\n    options.onFile?.(reportedPath);\n\n    let content: string;\n    try {\n      content = await readFile(absPath, \"utf8\");\n    } catch {\n      unreadable += 1; // permissions / vanished / decode failure — tracked, not silent.\n      continue;\n    }\n\n    // Skip machine-minified / generated content (unless explicitly enabled).\n    // Manifests are always scanned (their findings are dependency findings).\n    if (!scanMinified && !isManifestFile(reportedPath) && looksMinified(content)) {\n      skippedMinified += 1;\n      continue;\n    }\n\n    // Cumulative-byte budget: enforced once this file's bytes are accounted for.\n    bytesScanned += Buffer.byteLength(content, \"utf8\");\n    if (typeof maxBytes === \"number\" && bytesScanned > maxBytes) {\n      throw new BudgetExceededError(`maxBytes budget exceeded (limit: ${maxBytes}).`);\n    }\n\n    filesScanned += 1;\n    if (isAnalyzableSource(reportedPath)) analyzedFiles += 1;\n\n    // Cache: reuse prior findings when the content hash matches; otherwise scan\n    // and record. `nextEntries` becomes the new cache (dropping vanished files).\n    let fileFindings: Finding[];\n    if (cache && nextEntries) {\n      const hash = hashContent(content);\n      const hit = cache.get(reportedPath);\n      fileFindings =\n        hit && hit.hash === hash\n          ? hit.findings\n          : detectFile(\n              reportedPath,\n              content,\n              dets,\n              { source: doSource, config: doConfig, deps: doDeps },\n              options.disabledRules,\n            );\n      nextEntries.set(reportedPath, { hash, findings: fileFindings });\n    } else {\n      fileFindings = detectFile(\n        reportedPath,\n        content,\n        dets,\n        { source: doSource, config: doConfig, deps: doDeps },\n        options.disabledRules,\n      );\n    }\n    findings.push(...fileFindings);\n  }\n\n  // Persist the cache (best effort) before ordering/returning.\n  if (cacheFile && nextEntries) await saveCache(cacheFile, ruleset, nextEntries);\n\n  // Stable ordering: by file, then line, then ruleId.\n  findings.sort(compareFindings);\n\n  const inventory = buildInventory(findings);\n  const finishedAt = new Date();\n\n  return {\n    root: options.root,\n    findings,\n    filesScanned,\n    analyzedFiles,\n    diagnostics: { unreadable, skippedMinified },\n    inventory,\n    startedAt: startedAt.toISOString(),\n    finishedAt: finishedAt.toISOString(),\n    toolVersion: VERSION,\n  };\n}\n\n/**\n * Filter an explicit relative file list down to the paths that pass the binary\n * filter and the include/exclude patterns, returning them deduped and sorted for\n * deterministic output. Size limits are enforced later (we still read manifests\n * over the cap). Non-existent files are simply skipped at read time.\n *\n * Pure + synchronous, and exported so the parallel enumerator applies the EXACT\n * same filtering for explicit file lists as the serial path (byte-for-byte\n * identical results under `--parallel`).\n */\nexport function filterExplicitFileList(\n  files: readonly string[],\n  options: Pick<ScanOptions, \"include\" | \"exclude\">,\n): string[] {\n  const include = options.include ?? [];\n  const exclude = options.exclude ?? [];\n  const seen = new Set<string>();\n  const list = [...files]\n    .map((f) => toPosix(f))\n    .filter((f) => {\n      if (seen.has(f)) return false;\n      seen.add(f);\n      return true;\n    })\n    .sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));\n\n  return list.filter((rel) => {\n    if (isBinaryPath(rel)) return false;\n    if (include.length > 0 && !matchesAny(rel, include)) return false;\n    if (matchesAny(rel, exclude)) return false;\n    return true;\n  });\n}\n\n/** Async-generator wrapper around {@link filterExplicitFileList} for `scan()`. */\nasync function* filterExplicitFiles(files: string[], options: ScanOptions): AsyncGenerator<string> {\n  for (const rel of filterExplicitFileList(files, options)) yield rel;\n}\n"]}

package/dist/severity.js.map

@@ -1 +1 @@
-{"version":3,"file":"severity.js","sourceRoot":"","sources":["../src/severity.ts"],"names":[],"mappings":"AAQA,0EAA0E;AAC1E,MAAM,CAAC,MAAM,cAAc,GAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAEjG;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,CAAW;IACtC,MAAM,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACpC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,QAAkB,EAAE,SAAmB;IACpE,OAAO,YAAY,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC,SAAS,CAAC,CAAC;AAC3D,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,UAAU,CAAC,QAAkB;IAC3C,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,OAAO,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,SAAS,CAAC;QACnB;YACE,OAAO,MAAM,CAAC;IAClB,CAAC;AACH,CAAC"}
+{"version":3,"file":"severity.js","sourceRoot":"","sources":["../src/severity.ts"],"names":[],"mappings":"AAQA,0EAA0E;AAC1E,MAAM,CAAC,MAAM,cAAc,GAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAEjG;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,CAAW;IACtC,MAAM,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACpC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,QAAkB,EAAE,SAAmB;IACpE,OAAO,YAAY,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC,SAAS,CAAC,CAAC;AAC3D,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,UAAU,CAAC,QAAkB;IAC3C,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,OAAO,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,SAAS,CAAC;QACnB;YACE,OAAO,MAAM,CAAC;IAClB,CAAC;AACH,CAAC","sourcesContent":["/**\n * Severity utilities shared across the monorepo (qScan, the MCP server, the\n * GitHub Action). Lifts the previously-duplicated ordering / threshold / SARIF\n * mapping logic into one place so every consumer agrees on what \"at or above a\n * threshold\" means and how a severity maps to a SARIF level.\n */\nimport type { Severity } from \"./types.js\";\n\n/** Severity ordering, most → least severe. Index 0 is the most severe. */\nexport const SEVERITY_ORDER: readonly Severity[] = [\"critical\", \"high\", \"medium\", \"low\", \"info\"];\n\n/**\n * Rank of a severity within {@link SEVERITY_ORDER} (0 = most severe). Lower\n * ranks are more severe; unknown values fall to the end.\n */\nexport function severityRank(s: Severity): number {\n  const i = SEVERITY_ORDER.indexOf(s);\n  return i < 0 ? SEVERITY_ORDER.length : i;\n}\n\n/**\n * True when `severity` is at or above `threshold` (i.e. at least as severe).\n * Because lower ranks are more severe, \"at or above\" is `rank <= threshold`.\n */\nexport function meetsThreshold(severity: Severity, threshold: Severity): boolean {\n  return severityRank(severity) <= severityRank(threshold);\n}\n\n/** Map our severity to a SARIF 2.1.0 result level. */\nexport function sarifLevel(severity: Severity): \"error\" | \"warning\" | \"note\" {\n  switch (severity) {\n    case \"critical\":\n    case \"high\":\n      return \"error\";\n    case \"medium\":\n      return \"warning\";\n    default:\n      return \"note\";\n  }\n}\n"]}

package/dist/triage.js.map

@@ -1 +1 @@
-{"version":3,"file":"triage.js","sourceRoot":"","sources":["../src/triage.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,qEAAqE;AACrE,MAAM,CAAC,MAAM,aAAa,GACxB,kFAAkF;IAClF,8EAA8E;IAC9E,kFAAkF;IAClF,8EAA8E;IAC9E,kFAAkF;IAClF,oFAAoF;IACpF,kFAAkF;IAClF,mFAAmF;IACnF,qEAAqE,CAAC;AAExE,qDAAqD;AACrD,MAAM,CAAC,MAAM,qBAAqB,GAA4B;IAC5D,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,CAAC,eAAe,EAAE,UAAU,EAAE,WAAW,CAAC;IACpD,UAAU,EAAE;QACV,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE;QAC3D,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAC5C,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KAC9B;CACF,CAAC;AASF;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAA4B,EAC5B,QAAsB,UAAU,EAChC,WAA0C;IAE1C,MAAM,cAAc,GAAiB,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;IACtE,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAClC,YAAY,CAAC,CAAC,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CACnE,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,qBAAqB,EAAE,QAAQ,EAAE,CAAC;AAC5E,CAAC"}
+{"version":3,"file":"triage.js","sourceRoot":"","sources":["../src/triage.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,qEAAqE;AACrE,MAAM,CAAC,MAAM,aAAa,GACxB,kFAAkF;IAClF,8EAA8E;IAC9E,kFAAkF;IAClF,8EAA8E;IAC9E,kFAAkF;IAClF,oFAAoF;IACpF,kFAAkF;IAClF,mFAAmF;IACnF,qEAAqE,CAAC;AAExE,qDAAqD;AACrD,MAAM,CAAC,MAAM,qBAAqB,GAA4B;IAC5D,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,CAAC,eAAe,EAAE,UAAU,EAAE,WAAW,CAAC;IACpD,UAAU,EAAE;QACV,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE;QAC3D,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAC5C,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KAC9B;CACF,CAAC;AASF;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAA4B,EAC5B,QAAsB,UAAU,EAChC,WAA0C;IAE1C,MAAM,cAAc,GAAiB,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;IACtE,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAClC,YAAY,CAAC,CAAC,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CACnE,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,qBAAqB,EAAE,QAAQ,EAAE,CAAC;AAC5E,CAAC","sourcesContent":["/**\n * Triage rubric, verdict schema, and request-bundle builder — all offline and\n * deterministic. Both planes share them: `@quantakrypto/agent` (networked)\n * prompts a model with the rubric, while the MCP `triage_findings` tool emits a\n * request bundle for the HOST agent to reason over. Keeping them here means the\n * MCP server never imports the networked package and both sides use one rubric.\n */\nimport type { Finding } from \"./types.js\";\nimport type { ContextLevel, RedactedContext } from \"./agent-types.js\";\nimport { buildContext } from \"./redact.js\";\n\n/** The system rubric that defines what an exposure verdict means. */\nexport const TRIAGE_RUBRIC =\n  \"You are a post-quantum cryptography triage assistant. You are given ONE finding \" +\n  \"of classical (quantum-vulnerable) cryptography detected in a codebase, with \" +\n  \"limited, possibly-redacted context. Assess its REAL-WORLD exposure and urgency. \" +\n  \"exposureScore (0-100): how exploitable/exposed this usage is — a long-lived \" +\n  \"confidentiality key over the network (harvest-now-decrypt-later) scores high; a \" +\n  \"short-lived local signature scores lower. priority: 'now' for HNDL/high-exposure, \" +\n  \"'soon' for important-but-not-urgent, 'later' for low-exposure. You NEVER decide \" +\n  \"whether the finding is valid and you NEVER suppress it — you only rank exposure. \" +\n  \"Base your rationale only on the given context; do not invent facts.\";\n\n/** JSON Schema every triage verdict must satisfy. */\nexport const TRIAGE_VERDICT_SCHEMA: Record<string, unknown> = {\n  type: \"object\",\n  required: [\"exposureScore\", \"priority\", \"rationale\"],\n  properties: {\n    exposureScore: { type: \"number\", minimum: 0, maximum: 100 },\n    priority: { enum: [\"now\", \"soon\", \"later\"] },\n    rationale: { type: \"string\" },\n  },\n};\n\n/** A triage request bundle: the rubric, the verdict schema, and redacted contexts. */\nexport interface TriageRequest {\n  rubric: string;\n  schema: Record<string, unknown>;\n  contexts: RedactedContext[];\n}\n\n/**\n * Build a triage request bundle for a set of findings. Offline: for non-metadata\n * levels, pass `readContent` to supply each finding's file text; without it,\n * contexts are built at `metadata` level (no source), which is the safe default\n * for the MCP plane where the host agent already has the code open.\n */\nexport function buildTriageRequest(\n  findings: readonly Finding[],\n  level: ContextLevel = \"metadata\",\n  readContent?: (finding: Finding) => string,\n): TriageRequest {\n  const effectiveLevel: ContextLevel = readContent ? level : \"metadata\";\n  const contexts = findings.map((f) =>\n    buildContext(f, effectiveLevel, readContent ? readContent(f) : \"\"),\n  );\n  return { rubric: TRIAGE_RUBRIC, schema: TRIAGE_VERDICT_SCHEMA, contexts };\n}\n"]}

package/dist/types.d.ts

@@ -68,7 +68,7 @@ export interface Finding {
     location: SourceLocation;
 }
 /** Package ecosystems the dependency scanner understands. */
-export type DependencyEcosystem = "npm" | "pypi" | "cargo" | "go" | "maven" | "rubygems";
+export type DependencyEcosystem = "npm" | "pypi" | "cargo" | "go" | "maven" | "rubygems" | "nuget";
 /** A known quantum-vulnerable dependency entry. */
 export interface VulnerableDependency {
     /** Package name (as written in the ecosystem's manifest). */
@@ -79,6 +79,13 @@ export interface VulnerableDependency {
     /** Algorithm families the package primarily exposes. */
     algorithms: AlgorithmFamily[];
     severity: Severity;
+    /**
+     * Explicit harvest-now-decrypt-later override. When omitted, HNDL is inferred
+     * from whether any listed family is a confidentiality family. Set `false` for
+     * signing-only packages (e.g. JWS/JWT libraries) that list RSA/EC as families
+     * but never do key transport or key agreement — signatures are not HNDL-exposed.
+     */
+    hndl?: boolean;
 }
 /**
  * Which logical scope a detector belongs to. Drives the source/config scope

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,6DAA6D;AAC7D,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAEvE,gFAAgF;AAChF,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEnD,+DAA+D;AAC/D,MAAM,MAAM,eAAe,GACvB,KAAK,GACL,cAAc,GACd,WAAW,GACX,KAAK,GACL,aAAa,GACb,YAAY,GACZ,MAAM,GACN,KAAK,CAAC;AAEV,yEAAyE;AACzE,MAAM,MAAM,eAAe,GACvB,KAAK,GACL,MAAM,GACN,OAAO,GACP,OAAO,GACP,IAAI,GACJ,KAAK,GACL,QAAQ,GACR,MAAM,GACN,OAAO,GACP,SAAS,CAAC;AAEd,gDAAgD;AAChD,MAAM,WAAW,cAAc;IAC7B,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,gEAAgE;AAChE,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC;AAEtD;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,yDAAyD;IACzD,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,cAAc,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,iCAAiC;AACjC,MAAM,WAAW,OAAO;IACtB,uGAAuG;IACvG,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,QAAQ,CAAC;IACnB,UAAU,EAAE,UAAU,CAAC;IACvB,yDAAyD;IACzD,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,iEAAiE;IACjE,IAAI,EAAE,OAAO,CAAC;IACd,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,kFAAkF;IAClF,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAED,6DAA6D;AAC7D,MAAM,MAAM,mBAAmB,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,OAAO,GAAG,UAAU,CAAC;AAEzF,mDAAmD;AACnD,MAAM,WAAW,oBAAoB;IACnC,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,mBAAmB,CAAC;IAC/B,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEhD;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GACxB,IAAI,GACJ,QAAQ,GACR,IAAI,GACJ,MAAM,GACN,QAAQ,GACR,MAAM,GACN,MAAM,GACN,GAAG,GACH,KAAK,CAAC;AAEV;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,QAAQ;IACvB,kFAAkF;IAClF,EAAE,EAAE,MAAM,CAAC;IACX,6BAA6B;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,QAAQ,CAAC;IACnB,oDAAoD;IACpD,UAAU,EAAE,UAAU,CAAC;IACvB,0CAA0C;IAC1C,IAAI,EAAE,OAAO,CAAC;IACd,qFAAqF;IACrF,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,kDAAkD;IAClD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,qEAAqE;AACrE,MAAM,WAAW,QAAQ;IACvB,0DAA0D;IAC1D,EAAE,EAAE,MAAM,CAAC;IACX,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B;;;;;OAKG;IACH,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IACnB,oEAAoE;IACpE,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IACrC,yEAAyE;IACzE,MAAM,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,aAAa;IAC5B,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,kCAAkC;AAClC,MAAM,WAAW,WAAW;IAC1B,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,gEAAgE;IAChE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,mFAAmF;IACnF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;OAGG;IACH,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;IACvB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kCAAkC;IAClC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC;;;;OAIG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,gFAAgF;AAChF,MAAM,WAAW,mBAAoB,SAAQ,WAAW;IACtD;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,kFAAkF;IAClF,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,yDAAyD;AACzD,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrC,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,6FAA6F;IAC7F,UAAU,EAAE,MAAM,CAAC;IACnB,0GAA0G;IAC1G,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,iCAAiC;AACjC,MAAM,WAAW,UAAU;IACzB,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,eAAe,CAAC;IAC3B,sBAAsB;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,iDAAiD;AACjD,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;AAEtD,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,eAAe,CAAC;IAC3B,gFAAgF;IAChF,cAAc,EAAE,MAAM,CAAC;IACvB,wBAAwB;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,6DAA6D;AAC7D,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAEvE,gFAAgF;AAChF,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEnD,+DAA+D;AAC/D,MAAM,MAAM,eAAe,GACvB,KAAK,GACL,cAAc,GACd,WAAW,GACX,KAAK,GACL,aAAa,GACb,YAAY,GACZ,MAAM,GACN,KAAK,CAAC;AAEV,yEAAyE;AACzE,MAAM,MAAM,eAAe,GACvB,KAAK,GACL,MAAM,GACN,OAAO,GACP,OAAO,GACP,IAAI,GACJ,KAAK,GACL,QAAQ,GACR,MAAM,GACN,OAAO,GACP,SAAS,CAAC;AAEd,gDAAgD;AAChD,MAAM,WAAW,cAAc;IAC7B,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,gEAAgE;AAChE,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC;AAEtD;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,yDAAyD;IACzD,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,cAAc,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,iCAAiC;AACjC,MAAM,WAAW,OAAO;IACtB,uGAAuG;IACvG,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,QAAQ,CAAC;IACnB,UAAU,EAAE,UAAU,CAAC;IACvB,yDAAyD;IACzD,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,iEAAiE;IACjE,IAAI,EAAE,OAAO,CAAC;IACd,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,kFAAkF;IAClF,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAED,6DAA6D;AAC7D,MAAM,MAAM,mBAAmB,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,CAAC;AAEnG,mDAAmD;AACnD,MAAM,WAAW,oBAAoB;IACnC,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,mBAAmB,CAAC;IAC/B,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,QAAQ,EAAE,QAAQ,CAAC;IACnB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEhD;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GACxB,IAAI,GACJ,QAAQ,GACR,IAAI,GACJ,MAAM,GACN,QAAQ,GACR,MAAM,GACN,MAAM,GACN,GAAG,GACH,KAAK,CAAC;AAEV;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,QAAQ;IACvB,kFAAkF;IAClF,EAAE,EAAE,MAAM,CAAC;IACX,6BAA6B;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,QAAQ,CAAC;IACnB,oDAAoD;IACpD,UAAU,EAAE,UAAU,CAAC;IACvB,0CAA0C;IAC1C,IAAI,EAAE,OAAO,CAAC;IACd,qFAAqF;IACrF,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,kDAAkD;IAClD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,qEAAqE;AACrE,MAAM,WAAW,QAAQ;IACvB,0DAA0D;IAC1D,EAAE,EAAE,MAAM,CAAC;IACX,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B;;;;;OAKG;IACH,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IACnB,oEAAoE;IACpE,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IACrC,yEAAyE;IACzE,MAAM,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,aAAa;IAC5B,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,kCAAkC;AAClC,MAAM,WAAW,WAAW;IAC1B,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,gEAAgE;IAChE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,mFAAmF;IACnF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;OAGG;IACH,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;IACvB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kCAAkC;IAClC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC;;;;OAIG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,gFAAgF;AAChF,MAAM,WAAW,mBAAoB,SAAQ,WAAW;IACtD;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,kFAAkF;IAClF,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,yDAAyD;AACzD,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrC,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,6FAA6F;IAC7F,UAAU,EAAE,MAAM,CAAC;IACnB,0GAA0G;IAC1G,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,iCAAiC;AACjC,MAAM,WAAW,UAAU;IACzB,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,eAAe,CAAC;IAC3B,sBAAsB;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,iDAAiD;AACjD,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;AAEtD,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,eAAe,CAAC;IAC3B,gFAAgF;IAChF,cAAc,EAAE,MAAM,CAAC;IACvB,wBAAwB;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB"}

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG","sourcesContent":["/**\n * @quantakrypto/core — shared types (the locked public contract).\n *\n * These types are the stable interface between every tool in the monorepo\n * (qScan, the MCP server, the GitHub Action). Treat additions as backwards\n * compatible; treat renames/removals as breaking.\n */\n\n/** How serious a finding is, ordered most → least severe. */\nexport type Severity = \"critical\" | \"high\" | \"medium\" | \"low\" | \"info\";\n\n/** How sure the detector is that the finding is a real use of the algorithm. */\nexport type Confidence = \"high\" | \"medium\" | \"low\";\n\n/** What kind of cryptographic concern a finding represents. */\nexport type FindingCategory =\n  | \"kem\" // key encapsulation / public-key encryption (e.g. RSA-OAEP)\n  | \"key-exchange\" // (EC)DH\n  | \"signature\" // RSA/ECDSA/EdDSA signing\n  | \"tls\" // transport configuration\n  | \"certificate\" // X.509 / PKI material\n  | \"dependency\" // a quantum-vulnerable library in the dependency tree\n  | \"hash\" // weak / pre-quantum hash usage\n  | \"rng\"; // randomness concerns\n\n/** Classical asymmetric algorithm families that are not quantum-safe. */\nexport type AlgorithmFamily =\n  | \"RSA\"\n  | \"ECDH\"\n  | \"ECDSA\"\n  | \"EdDSA\"\n  | \"DH\"\n  | \"DSA\"\n  | \"X25519\"\n  | \"X448\"\n  | \"ECIES\"\n  | \"unknown\";\n\n/** A precise location inside a scanned file. */\nexport interface SourceLocation {\n  /** Path relative to the scan root, using POSIX separators. */\n  file: string;\n  /** 1-based line number. */\n  line: number;\n  /** 1-based column number, if known. */\n  column?: number;\n  /** 1-based end line, for multi-line matches. */\n  endLine?: number;\n  /** The matched source text (trimmed, single line). */\n  snippet?: string;\n}\n\n/** Relative urgency an LLM triage pass assigns to a finding. */\nexport type TriagePriority = \"now\" | \"soon\" | \"later\";\n\n/**\n * Optional LLM triage annotation attached to a finding by `qscan --triage`.\n * Purely additive: it re-ranks and explains, it never suppresses a finding and\n * never influences the exit code (which is computed from `severity` alone).\n */\nexport interface TriageAnnotation {\n  /** 0–100 real-world exposure/exploitability estimate. */\n  exposureScore: number;\n  priority: TriagePriority;\n  rationale: string;\n}\n\n/** A single detected concern. */\nexport interface Finding {\n  /** Stable rule identifier, e.g. \"rsa-keygen\", \"ecdh-usage\", \"tls-legacy-version\", \"dep-vulnerable\". */\n  ruleId: string;\n  title: string;\n  category: FindingCategory;\n  severity: Severity;\n  confidence: Confidence;\n  /** The classical algorithm involved, when applicable. */\n  algorithm?: AlgorithmFamily;\n  /** True when this is exposed to \"harvest now, decrypt later\". */\n  hndl: boolean;\n  /** One-line human explanation of the concern. */\n  message: string;\n  /** Suggested post-quantum remediation (e.g. ML-KEM, hybrid X25519MLKEM768). */\n  remediation?: string;\n  /** Associated CWE identifier, e.g. \"CWE-327\" (broken crypto), \"CWE-326\" (weak strength). */\n  cwe?: string;\n  /**\n   * True when the matched snippet IS the sensitive value (e.g. a PEM private/\n   * public key block, an `ssh-rsa AAAA…` public key). Reporters ALWAYS drop the\n   * snippet for such findings, regardless of any redaction flag.\n   */\n  sensitive?: boolean;\n  /** Optional LLM triage annotation (`qscan --triage`); never affects exit code. */\n  triage?: TriageAnnotation;\n  location: SourceLocation;\n}\n\n/** Package ecosystems the dependency scanner understands. */\nexport type DependencyEcosystem = \"npm\" | \"pypi\" | \"cargo\" | \"go\" | \"maven\" | \"rubygems\" | \"nuget\";\n\n/** A known quantum-vulnerable dependency entry. */\nexport interface VulnerableDependency {\n  /** Package name (as written in the ecosystem's manifest). */\n  name: string;\n  ecosystem: DependencyEcosystem;\n  /** Why it's flagged (what classical crypto it provides). */\n  reason: string;\n  /** Algorithm families the package primarily exposes. */\n  algorithms: AlgorithmFamily[];\n  severity: Severity;\n  /**\n   * Explicit harvest-now-decrypt-later override. When omitted, HNDL is inferred\n   * from whether any listed family is a confidentiality family. Set `false` for\n   * signing-only packages (e.g. JWS/JWT libraries) that list RSA/EC as families\n   * but never do key transport or key agreement — signatures are not HNDL-exposed.\n   */\n  hndl?: boolean;\n}\n\n/**\n * Which logical scope a detector belongs to. Drives the source/config scope\n * toggles in {@link ScanOptions} (replacing the old ruleId-prefix inference).\n */\nexport type DetectorScope = \"source\" | \"config\";\n\n/**\n * The programming language / surface a detector targets. `\"any\"` means the\n * detector is language-agnostic (e.g. PEM material, config files).\n */\nexport type DetectorLanguage =\n  | \"js\"\n  | \"python\"\n  | \"go\"\n  | \"java\"\n  | \"csharp\"\n  | \"rust\"\n  | \"ruby\"\n  | \"c\"\n  | \"any\";\n\n/**\n * Declarative metadata for a single rule a detector can emit. This is the\n * catalog entry: the stable, queryable description of a rule keyed by the\n * `ruleId` it stamps onto findings. It is the single source of truth for a\n * rule's title / severity / category / remediation, consumed by the SARIF\n * `rules[]` block, the MCP `explain_finding` resolver, and future per-rule\n * enable/disable + language-pack work.\n *\n * For most rules the metadata is fixed and `detect()` builds findings straight\n * from it (see `findingFromRule`). A few rules are inherently multi-variant\n * (e.g. `node-crypto-keygen` spans RSA/EC/DSA/DH/Ed25519 at different\n * severities); for those the metadata here is a REPRESENTATIVE umbrella and\n * `detect()` refines the per-finding fields at match time. The catalog always\n * enumerates every emittable ruleId regardless.\n */\nexport interface RuleMeta {\n  /** Stable rule id — matches {@link Finding.ruleId}. Unique across the catalog. */\n  id: string;\n  /** Canonical human title. */\n  title: string;\n  category: FindingCategory;\n  severity: Severity;\n  /** Default confidence for findings of this rule. */\n  confidence: Confidence;\n  /** Harvest-now-decrypt-later exposure. */\n  hndl: boolean;\n  /** Representative classical algorithm family; refined per-finding when it varies. */\n  algorithm?: AlgorithmFamily;\n  /** Associated CWE identifier (e.g. \"CWE-327\"). */\n  cwe?: string;\n  /** Suggested post-quantum remediation. When omitted, derived from {@link algorithm}. */\n  remediation?: string;\n  /** Canonical one-line human explanation; may be refined per-finding. */\n  message: string;\n  /** True when this rule's matched snippet IS sensitive key material. */\n  sensitive?: boolean;\n  /** Short description of what the rule detects (for catalog / MCP surfaces). */\n  description?: string;\n}\n\n/** A pluggable source detector. Detectors are pure and stateless. */\nexport interface Detector {\n  /** Unique id, used as the Finding.ruleId prefix space. */\n  id: string;\n  /** Human description of what the detector looks for. */\n  description: string;\n  /**\n   * Logical scope of this detector's findings. Used by `scan()` to honour the\n   * `config` / `source` toggles. Defaults to `\"source\"` when omitted (for\n   * backward compatibility with externally-defined detectors).\n   */\n  scope?: DetectorScope;\n  /**\n   * Language this detector targets, for documentation / registry filtering.\n   * Defaults to `\"js\"` when omitted.\n   */\n  language?: DetectorLanguage;\n  /**\n   * The rules this detector can emit, as declarative metadata. Together across\n   * all detectors these form the rule catalog ({@link DetectorRegistry.ruleCatalog}).\n   * Optional for backward compatibility with externally-defined detectors, but\n   * all built-in detectors declare it.\n   */\n  rules?: RuleMeta[];\n  /** Whether this detector should run against the given file path. */\n  appliesTo(filePath: string): boolean;\n  /** Inspect a single file's contents and return zero or more findings. */\n  detect(input: DetectorInput): Finding[];\n}\n\nexport interface DetectorInput {\n  /** Path relative to the scan root (POSIX). */\n  file: string;\n  /** Full file contents. */\n  content: string;\n}\n\n/** Options controlling a scan. */\nexport interface ScanOptions {\n  /** Absolute or relative directory (or single file) to scan. */\n  root: string;\n  /**\n   * Restrict the walk to paths matching one of these include patterns\n   * (substring or relative-path-prefix match). When omitted, all non-excluded\n   * files are scanned. Wired into the walker.\n   */\n  include?: string[];\n  /** Extra exclude patterns (in addition to the built-in defaults). */\n  exclude?: string[];\n  /** Disable the built-in ignore list (node_modules, .git, dist, …). */\n  noDefaultIgnores?: boolean;\n  /** Scan source files for inline crypto usage. Default: true. */\n  source?: boolean;\n  /** Scan dependency manifests/lockfiles for vulnerable libraries. Default: true. */\n  dependencies?: boolean;\n  /** Scan config files (TLS, certificates). Default: true. */\n  config?: boolean;\n  /** Max file size to read, in bytes. Default: 2 MiB. */\n  maxFileSize?: number;\n  /**\n   * Scan minified / generated / bundled files (large single-line content)\n   * instead of skipping them. Default: false (skip them for speed).\n   */\n  scanMinified?: boolean;\n  /**\n   * Explicit relative file list (POSIX, relative to `root`) to scan instead of\n   * walking the tree. Used for incremental / changed-files scans. Each path is\n   * still subject to the binary / size filters. When set, the directory walk is\n   * bypassed entirely.\n   */\n  files?: string[];\n  /**\n   * Override / extend the built-in detector set. When omitted, the default\n   * registry's detectors are used.\n   */\n  detectors?: Detector[];\n  /**\n   * Rule ids to suppress. Any finding whose `ruleId` is listed here is dropped\n   * after detection. Serializable (a plain string array), so it is honoured on\n   * both the serial and the worker-thread (`scanParallel`) paths. See the rule\n   * catalog ({@link DetectorRegistry.ruleCatalog}) for the valid ids.\n   */\n  disabledRules?: string[];\n  /**\n   * Path to an on-disk scan cache. When set, unchanged files (same content hash)\n   * reuse their previous findings instead of re-running detectors, and the cache\n   * is rewritten after the scan. Invalidated wholesale when the tool version,\n   * detector set, or `disabledRules` change. Optional; omitted = no caching.\n   * The cache forces the in-process (serial) path.\n   */\n  cacheFile?: string;\n  /** Optional progress callback. */\n  onFile?: (file: string) => void;\n  /**\n   * Optional abort signal. When it fires mid-walk the scan stops cooperatively\n   * and rejects with an `AbortError` (a `DOMException`-like error with\n   * `name === \"AbortError\"`).\n   */\n  signal?: AbortSignal;\n  /**\n   * Work budget: maximum number of files to scan. When exceeded mid-walk the\n   * scan stops and throws a `BudgetExceededError`. Unlimited when omitted.\n   */\n  maxFiles?: number;\n  /**\n   * Work budget: maximum cumulative bytes of scanned file content. When\n   * exceeded mid-walk the scan stops and throws a `BudgetExceededError`.\n   * Unlimited when omitted.\n   */\n  maxBytes?: number;\n}\n\n/** Extra options for {@link scanParallel}, layered onto {@link ScanOptions}. */\nexport interface ParallelScanOptions extends ScanOptions {\n  /**\n   * Number of worker threads. Default: `os.availableParallelism()`. A value of\n   * 0 or 1 forces the in-process serial path.\n   */\n  concurrency?: number;\n  /**\n   * Combined-size floor (bytes) below which the scan always runs in-process.\n   * Default: 2 MiB. Also stays serial below `parallelFileThreshold` files.\n   */\n  parallelThresholdBytes?: number;\n  /** File-count floor below which the scan always runs in-process. Default: 200. */\n  parallelFileThreshold?: number;\n  /** Target bytes per worker chunk. Default: 4 MiB. */\n  chunkBytes?: number;\n}\n\n/** Aggregated counts produced from a scan's findings. */\nexport interface CryptoInventory {\n  byAlgorithm: Partial<Record<AlgorithmFamily, number>>;\n  byCategory: Partial<Record<FindingCategory, number>>;\n  bySeverity: Record<Severity, number>;\n  /** Number of findings exposed to harvest-now-decrypt-later. */\n  hndlCount: number;\n  /** 0–100 readiness score (100 = no classical asymmetric crypto found). */\n  readinessScore: number;\n}\n\n/**\n * Non-fatal things that happened during a scan that reduce coverage. Surfaced so\n * a silent under-scan (e.g. half the tree was unreadable) can't masquerade as a\n * clean \"0 findings\" result — reporters warn when any count is non-zero.\n */\nexport interface ScanDiagnostics {\n  /** Files that could not be read (permissions, vanished, decode failure) and were skipped. */\n  unreadable: number;\n  /** Files skipped because they look machine-minified / generated (scan with `scanMinified` to include). */\n  skippedMinified: number;\n}\n\n/** The full result of a scan. */\nexport interface ScanResult {\n  /** The scan root (as provided). */\n  root: string;\n  findings: Finding[];\n  filesScanned: number;\n  /**\n   * Coverage diagnostics: counts of files skipped as unreadable or minified.\n   * Optional for backward compatibility with hand-built results.\n   */\n  diagnostics?: ScanDiagnostics;\n  /**\n   * Of `filesScanned`, how many were in a source language the scanner can\n   * actually analyze for inline crypto (JS/TS, Python, Go, Java). When this is 0 but\n   * `filesScanned` > 0, the readiness score reflects NO analyzable code — the\n   * crypto likely lives in an unsupported language (Go, Java, Rust, …) — and\n   * reporters surface that so a bare 100/100 can't read as \"safe\". Optional for\n   * backward compatibility with hand-built results.\n   */\n  analyzedFiles?: number;\n  inventory: CryptoInventory;\n  /** ISO timestamps. */\n  startedAt: string;\n  finishedAt: string;\n  /** Tool version that produced the result. */\n  toolVersion: string;\n}\n\n/** Output formats qScan / reporters can emit. */\nexport type ReportFormat = \"human\" | \"json\" | \"sarif\";\n\n/** A remediation recommendation for a classical algorithm. */\nexport interface Remediation {\n  algorithm: AlgorithmFamily;\n  /** Short recommended replacement, e.g. \"ML-KEM-768 (hybrid X25519MLKEM768)\". */\n  recommendation: string;\n  /** Longer rationale. */\n  detail: string;\n}\n"]}

package/dist/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAElD;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3D,MAAM,GAAG,GAA2B;QAClC,EAAE,EAAE,KAAK;QACT,UAAU,EAAE,KAAK;QACjB,GAAG,EAAE,MAAM;QACX,EAAE,EAAE,KAAK;QACT,UAAU,EAAE,KAAK;QACjB,GAAG,EAAE,MAAM;QACX,GAAG,EAAE,MAAM;QACX,GAAG,EAAE,MAAM;QACX,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,KAAK;QACb,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,KAAK;QACb,EAAE,EAAE,KAAK;QACT,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,KAAK;QACb,EAAE,EAAE,KAAK;QACT,IAAI,EAAE,KAAK;QACX,EAAE,EAAE,KAAK;QACT,IAAI,EAAE,KAAK;QACX,CAAC,EAAE,IAAI;QACP,KAAK,EAAE,MAAM;QACb,GAAG,EAAE,MAAM;QACX,EAAE,EAAE,KAAK;QACT,CAAC,EAAE,IAAI;QACP,GAAG,EAAE,MAAM;KACZ,CAAC;IACF,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACxB,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,SAAS,CACvB,IAAY,EACZ,IAA8C;IAE9C,IAAI,IAAY,CAAC;IACjB,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1C,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;SAAM,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QACjD,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACpD,IAAI,GAAG,UAAU,GAAG,EAAE,CAAC;IACzB,CAAC;SAAM,CAAC;QACN,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;IACvD,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/F,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACjC,CAAC"}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAElD;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3D,MAAM,GAAG,GAA2B;QAClC,EAAE,EAAE,KAAK;QACT,UAAU,EAAE,KAAK;QACjB,GAAG,EAAE,MAAM;QACX,EAAE,EAAE,KAAK;QACT,UAAU,EAAE,KAAK;QACjB,GAAG,EAAE,MAAM;QACX,GAAG,EAAE,MAAM;QACX,GAAG,EAAE,MAAM;QACX,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,KAAK;QACb,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,KAAK;QACb,EAAE,EAAE,KAAK;QACT,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,KAAK;QACb,EAAE,EAAE,KAAK;QACT,IAAI,EAAE,KAAK;QACX,EAAE,EAAE,KAAK;QACT,IAAI,EAAE,KAAK;QACX,CAAC,EAAE,IAAI;QACP,KAAK,EAAE,MAAM;QACb,GAAG,EAAE,MAAM;QACX,EAAE,EAAE,KAAK;QACT,CAAC,EAAE,IAAI;QACP,GAAG,EAAE,MAAM;KACZ,CAAC;IACF,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACxB,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,SAAS,CACvB,IAAY,EACZ,IAA8C;IAE9C,IAAI,IAAY,CAAC;IACjB,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1C,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;SAAM,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QACjD,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACpD,IAAI,GAAG,UAAU,GAAG,EAAE,CAAC;IACzB,CAAC;SAAM,CAAC;QACN,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;IACvD,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/F,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACjC,CAAC","sourcesContent":["/**\n * Snippet-level fix verification: run the detectors over a piece of code (NOT\n * the filesystem) and report any classical crypto that remains. This is the\n * deterministic gate a fix must pass — the same logic the MCP `verify_fix` tool\n * and the remediation pipeline both use, so they can never disagree on what\n * \"the finding is gone\" means.\n */\nimport type { Finding } from \"./types.js\";\nimport { detectFile, detectors } from \"./scan.js\";\n\n/**\n * Map a language name (or a bare extension) to a source extension whose\n * detectors we run. Returns null for languages the scanner does not analyze.\n */\nexport function languageToExtension(language: string): string | null {\n  const l = language.trim().toLowerCase().replace(/^\\./, \"\");\n  const map: Record<string, string> = {\n    js: \".js\",\n    javascript: \".js\",\n    jsx: \".jsx\",\n    ts: \".ts\",\n    typescript: \".ts\",\n    tsx: \".tsx\",\n    mjs: \".mjs\",\n    cjs: \".cjs\",\n    py: \".py\",\n    python: \".py\",\n    go: \".go\",\n    golang: \".go\",\n    java: \".java\",\n    kotlin: \".kt\",\n    kt: \".kt\",\n    cs: \".cs\",\n    csharp: \".cs\",\n    \"c#\": \".cs\",\n    dotnet: \".cs\",\n    rs: \".rs\",\n    rust: \".rs\",\n    rb: \".rb\",\n    ruby: \".rb\",\n    c: \".c\",\n    \"c++\": \".cpp\",\n    cpp: \".cpp\",\n    cc: \".cc\",\n    h: \".h\",\n    hpp: \".hpp\",\n  };\n  return map[l] ?? null;\n}\n\n/** Result of {@link verifyFix}: the findings that remain, and whether the\n * language is one the scanner actually analyzes (so `findings: []` on an\n * unsupported language is NOT a clean verification). */\nexport interface VerifyResult {\n  supported: boolean;\n  findings: Finding[];\n}\n\n/**\n * Run all detectors over `code`, selecting them by `filename` (extension) or\n * `language`. Pure: no I/O. When neither identifies an analyzable language,\n * `supported` is false and the empty findings list must not be read as \"fixed\".\n */\nexport function verifyFix(\n  code: string,\n  opts: { filename?: string; language?: string },\n): VerifyResult {\n  let name: string;\n  if (opts.filename && opts.filename.trim()) {\n    name = opts.filename.trim();\n  } else if (opts.language && opts.language.trim()) {\n    const ext = languageToExtension(opts.language);\n    if (!ext) return { supported: false, findings: [] };\n    name = `snippet${ext}`;\n  } else {\n    return { supported: false, findings: [] };\n  }\n  const dotExt = name.replace(/^.*(\\.[^.]+)$/, \"$1\");\n  const supported = languageToExtension(dotExt) !== null;\n  const findings = detectFile(name, code, detectors, { source: true, config: true, deps: true });\n  return { supported, findings };\n}\n"]}

package/dist/version.d.ts

@@ -3,5 +3,5 @@
  * the scan orchestrator can import it without creating a cycle through index.ts.
  * Keep in sync with packages/core/package.json.
  */
-export declare const VERSION = "0.4.1";
+export declare const VERSION = "0.4.3";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -3,5 +3,5 @@
  * the scan orchestrator can import it without creating a cycle through index.ts.
  * Keep in sync with packages/core/package.json.
  */
-export const VERSION = "0.4.1";
+export const VERSION = "0.4.3";
 //# sourceMappingURL=version.js.map

package/dist/version.js.map

@@ -1 +1 @@
-{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC"}
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC","sourcesContent":["/**\n * The tool version surfaced in reports. Kept in its own module so reporters and\n * the scan orchestrator can import it without creating a cycle through index.ts.\n * Keep in sync with packages/core/package.json.\n */\nexport const VERSION = \"0.4.3\";\n"]}

package/dist/walk.js.map

@@ -1 +1 @@
-{"version":3,"file":"walk.js","sourceRoot":"","sources":["../src/walk.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,cAAc;IACd,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,KAAK;IACL,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,QAAQ;CACT,CAAC;AAEF,gDAAgD;AAChD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAErD;;;GAGG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAS;IACxC,SAAS;IACT,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,MAAM;IACN,MAAM;IACN,MAAM;IACN,wBAAwB;IACxB,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,MAAM;IACN,MAAM;IACN,QAAQ;IACR,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,uBAAuB;IACvB,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,KAAK;IACL,QAAQ;IACR,MAAM;IACN,IAAI;IACJ,IAAI;IACJ,QAAQ;IACR,OAAO;IACP,kBAAkB;IAClB,KAAK;IACL,SAAS;IACT,UAAU;IACV,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,OAAO;IACP,MAAM;IACN,SAAS;IACT,OAAO;CACR,CAAC,CAAC;AAiBH,0DAA0D;AAC1D,MAAM,UAAU,OAAO,CAAC,CAAS;IAC/B,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACrC,CAAC;AAED,mFAAmF;AACnF,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACxB,CAAC,EAAE,CAAC,CAAC,yBAAyB;gBAC9B,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBACxB,CAAC,EAAE,CAAC,CAAC,2BAA2B;oBAChC,EAAE,IAAI,UAAU,CAAC,CAAC,6BAA6B;gBACjD,CAAC;qBAAM,CAAC;oBACN,EAAE,IAAI,IAAI,CAAC,CAAC,yBAAyB;gBACvC,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,EAAE,IAAI,OAAO,CAAC,CAAC,uBAAuB;YACxC,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,EAAE,IAAI,MAAM,CAAC;QACf,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,wDAAwD;YACxD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACrC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;gBACf,EAAE,IAAI,KAAK,CAAC;YACd,CAAC;iBAAM,CAAC;gBACN,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;gBAC7B,CAAC,GAAG,GAAG,CAAC;YACV,CAAC;QACH,CAAC;aAAM,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,EAAE,IAAI,IAAI,GAAG,CAAC,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,EAAE,IAAI,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;AAC7C,SAAS,UAAU,CAAC,OAAe;IACjC,IAAI,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QAC3B,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,QAA2B;IACjE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YACnB,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzC,SAAS;QACX,CAAC;QACD,wEAAwE;QACxE,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACjC,uEAAuE;QACvE,IAAI,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yEAAyE;AACzE,SAAS,UAAU,CAAC,GAAW,EAAE,OAA0B;IACzD,OAAO,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,GAAW,EAAE,OAA0B;IACzD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,mDAAmD;IACnD,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,iBAAiB,GACrB,gHAAgH,CAAC;AAEnH,wEAAwE;AACxE,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC5E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC;YACzC,IAAI,GAAG,GAAG,OAAO;gBAAE,OAAO,GAAG,GAAG,CAAC;YACjC,GAAG,GAAG,CAAC,CAAC;YACR,KAAK,EAAE,CAAC;QACV,CAAC;aAAM,CAAC;YACN,GAAG,EAAE,CAAC;QACR,CAAC;IACH,CAAC;IACD,IAAI,GAAG,GAAG,OAAO;QAAE,OAAO,GAAG,GAAG,CAAC;IACjC,IAAI,OAAO,GAAG,MAAM;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC;IACtC,OAAO,OAAO,GAAG,KAAK,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,SAAS,CAAC,IAAY,EAAE,UAAuB,EAAE;IACtE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,qBAAqB,CAAC;IACjE,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;IAEhE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IAElC,8EAA8E;IAC9E,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,IACE,CAAC,YAAY,CAAC,IAAI,CAAC;YACnB,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC;YACzB,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,EACjD,CAAC;YACD,MAAM,IAAI,CAAC;QACb,CAAC;QACD,OAAO;IACT,CAAC;IAED,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;AACvE,CAAC;AASD;;;;GAIG;AACH,SAAS,eAAe,CAAC,GAAW,EAAE,IAAY,EAAE,WAAmB;IACrE,+EAA+E;IAC/E,iFAAiF;IACjF,IAAI,cAAc,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,IAAI,IAAI,WAAW,CAAC;AAC7B,CAAC;AAED,mFAAmF;AACnF,KAAK,SAAS,CAAC,CAAC,OAAO,CAAC,MAAc,EAAE,MAAc,EAAE,GAAgB;IACtE,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,OAAO;IACT,CAAC;IAED,yDAAyD;IACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEzE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAE1C,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;YAC3B,8DAA8D;YAC9D,SAAS;QACX,CAAC;QAED,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC/C,IAAI,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC;gBAAE,SAAS;YAC3C,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YAC9B,SAAS;QACX,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,SAAS;QAC9B,IAAI,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAC3C,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAC5C,4EAA4E;QAC5E,8EAA8E;QAC9E,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,GAAG,CAAC;YAAE,SAAS;QAC7C,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC;YAAE,SAAS;QAEhD,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,WAAW,CAAC;gBAAE,SAAS;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}
+{"version":3,"file":"walk.js","sourceRoot":"","sources":["../src/walk.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,cAAc;IACd,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,KAAK;IACL,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,QAAQ;CACT,CAAC;AAEF,gDAAgD;AAChD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAErD;;;GAGG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAS;IACxC,SAAS;IACT,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,MAAM;IACN,MAAM;IACN,MAAM;IACN,wBAAwB;IACxB,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,MAAM;IACN,MAAM;IACN,QAAQ;IACR,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,uBAAuB;IACvB,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,KAAK;IACL,QAAQ;IACR,MAAM;IACN,IAAI;IACJ,IAAI;IACJ,QAAQ;IACR,OAAO;IACP,kBAAkB;IAClB,KAAK;IACL,SAAS;IACT,UAAU;IACV,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,OAAO;IACP,MAAM;IACN,SAAS;IACT,OAAO;CACR,CAAC,CAAC;AAiBH,0DAA0D;AAC1D,MAAM,UAAU,OAAO,CAAC,CAAS;IAC/B,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACrC,CAAC;AAED,mFAAmF;AACnF,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACxB,CAAC,EAAE,CAAC,CAAC,yBAAyB;gBAC9B,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBACxB,CAAC,EAAE,CAAC,CAAC,2BAA2B;oBAChC,EAAE,IAAI,UAAU,CAAC,CAAC,6BAA6B;gBACjD,CAAC;qBAAM,CAAC;oBACN,EAAE,IAAI,IAAI,CAAC,CAAC,yBAAyB;gBACvC,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,EAAE,IAAI,OAAO,CAAC,CAAC,uBAAuB;YACxC,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,EAAE,IAAI,MAAM,CAAC;QACf,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,wDAAwD;YACxD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACrC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;gBACf,EAAE,IAAI,KAAK,CAAC;YACd,CAAC;iBAAM,CAAC;gBACN,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;gBAC7B,CAAC,GAAG,GAAG,CAAC;YACV,CAAC;QACH,CAAC;aAAM,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,EAAE,IAAI,IAAI,GAAG,CAAC,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,EAAE,IAAI,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;AAC7C,SAAS,UAAU,CAAC,OAAe;IACjC,IAAI,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QAC3B,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,QAA2B;IACjE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YACnB,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzC,SAAS;QACX,CAAC;QACD,wEAAwE;QACxE,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACjC,uEAAuE;QACvE,IAAI,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yEAAyE;AACzE,SAAS,UAAU,CAAC,GAAW,EAAE,OAA0B;IACzD,OAAO,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,GAAW,EAAE,OAA0B;IACzD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,mDAAmD;IACnD,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,iBAAiB,GACrB,gHAAgH,CAAC;AAEnH,wEAAwE;AACxE,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC5E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC;YACzC,IAAI,GAAG,GAAG,OAAO;gBAAE,OAAO,GAAG,GAAG,CAAC;YACjC,GAAG,GAAG,CAAC,CAAC;YACR,KAAK,EAAE,CAAC;QACV,CAAC;aAAM,CAAC;YACN,GAAG,EAAE,CAAC;QACR,CAAC;IACH,CAAC;IACD,IAAI,GAAG,GAAG,OAAO;QAAE,OAAO,GAAG,GAAG,CAAC;IACjC,IAAI,OAAO,GAAG,MAAM;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC;IACtC,OAAO,OAAO,GAAG,KAAK,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,SAAS,CAAC,IAAY,EAAE,UAAuB,EAAE;IACtE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,qBAAqB,CAAC;IACjE,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;IAEhE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IAElC,8EAA8E;IAC9E,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,IACE,CAAC,YAAY,CAAC,IAAI,CAAC;YACnB,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC;YACzB,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,EACjD,CAAC;YACD,MAAM,IAAI,CAAC;QACb,CAAC;QACD,OAAO;IACT,CAAC;IAED,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;AACvE,CAAC;AASD;;;;GAIG;AACH,SAAS,eAAe,CAAC,GAAW,EAAE,IAAY,EAAE,WAAmB;IACrE,+EAA+E;IAC/E,iFAAiF;IACjF,IAAI,cAAc,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,IAAI,IAAI,WAAW,CAAC;AAC7B,CAAC;AAED,mFAAmF;AACnF,KAAK,SAAS,CAAC,CAAC,OAAO,CAAC,MAAc,EAAE,MAAc,EAAE,GAAgB;IACtE,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,OAAO;IACT,CAAC;IAED,yDAAyD;IACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEzE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAE1C,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;YAC3B,8DAA8D;YAC9D,SAAS;QACX,CAAC;QAED,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC/C,IAAI,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC;gBAAE,SAAS;YAC3C,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YAC9B,SAAS;QACX,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,SAAS;QAC9B,IAAI,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAC3C,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAC5C,4EAA4E;QAC5E,8EAA8E;QAC9E,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,GAAG,CAAC;YAAE,SAAS;QAC7C,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC;YAAE,SAAS;QAEhD,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,WAAW,CAAC;gBAAE,SAAS;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["/**\n * Filesystem walker. A zero-dependency recursive async generator that yields\n * scannable text files as relative POSIX paths. It honours a default ignore\n * list, user-supplied exclude patterns, a max file size, and a binary-extension\n * filter. The root may be a directory or a single file.\n */\nimport { readdir, stat } from \"node:fs/promises\";\nimport type { Dirent } from \"node:fs\";\nimport * as path from \"node:path\";\n\nimport { isManifestFile } from \"./dependencies.js\";\n\n/** Directories ignored by default (can be disabled with noDefaultIgnores). */\nexport const DEFAULT_IGNORES: readonly string[] = [\n  \"node_modules\",\n  \".git\",\n  \"dist\",\n  \"build\",\n  \".next\",\n  \"out\",\n  \"coverage\",\n  \"vendor\",\n  \".turbo\",\n  \".cache\",\n];\n\n/** Default maximum file size to read: 2 MiB. */\nexport const DEFAULT_MAX_FILE_SIZE = 2 * 1024 * 1024;\n\n/**\n * File extensions we treat as binary / non-text and therefore skip. Keeping this\n * as an extension allow-list-by-exclusion is cheap and avoids reading bytes.\n */\nconst BINARY_EXTENSIONS = new Set<string>([\n  // images\n  \".png\",\n  \".jpg\",\n  \".jpeg\",\n  \".gif\",\n  \".webp\",\n  \".bmp\",\n  \".ico\",\n  \".tiff\",\n  \".avif\",\n  // fonts\n  \".woff\",\n  \".woff2\",\n  \".ttf\",\n  \".otf\",\n  \".eot\",\n  // archives / compressed\n  \".zip\",\n  \".gz\",\n  \".tgz\",\n  \".bz2\",\n  \".xz\",\n  \".7z\",\n  \".rar\",\n  \".tar\",\n  // media\n  \".mp3\",\n  \".mp4\",\n  \".mov\",\n  \".avi\",\n  \".mkv\",\n  \".wav\",\n  \".flac\",\n  \".ogg\",\n  \".webm\",\n  // documents / binaries\n  \".pdf\",\n  \".doc\",\n  \".docx\",\n  \".xls\",\n  \".xlsx\",\n  \".ppt\",\n  \".pptx\",\n  \".exe\",\n  \".dll\",\n  \".so\",\n  \".dylib\",\n  \".bin\",\n  \".o\",\n  \".a\",\n  \".class\",\n  \".wasm\",\n  // data blobs / db\n  \".db\",\n  \".sqlite\",\n  \".sqlite3\",\n  \".dat\",\n  \".pack\",\n  \".idx\",\n  // misc\n  \".lock\",\n  \".map\",\n  \".min.js\",\n  \".node\",\n]);\n\n/** Options accepted by {@link walkFiles}. */\nexport interface WalkOptions {\n  /**\n   * Restrict to paths matching one of these include patterns (substring or\n   * relative-path-prefix match). When omitted/empty, all files pass.\n   */\n  include?: string[];\n  /** Extra exclude patterns (substring or relative-path-prefix match). */\n  exclude?: string[];\n  /** Disable the built-in directory ignore list. */\n  noDefaultIgnores?: boolean;\n  /** Max file size in bytes; larger files are skipped. */\n  maxFileSize?: number;\n}\n\n/** Normalise a path to forward-slash POSIX separators. */\nexport function toPosix(p: string): string {\n  return p.split(path.sep).join(\"/\");\n}\n\n/** A pattern is treated as a glob when it contains one of these metacharacters. */\nfunction hasGlobMeta(pattern: string): boolean {\n  return /[*?[]/.test(pattern);\n}\n\n/**\n * Translate a glob into an anchored RegExp: `*` matches within a path segment\n * (not `/`), `**` matches across segments, a leading `**` before a slash is an\n * optional path prefix, `?` matches a single non-`/` char, `[...]` is a\n * character class. Other regex\n * metacharacters are escaped.\n */\nfunction globToRegExp(glob: string): RegExp {\n  let re = \"\";\n  for (let i = 0; i < glob.length; i++) {\n    const c = glob[i];\n    if (c === \"*\") {\n      if (glob[i + 1] === \"*\") {\n        i++; // consume the second '*'\n        if (glob[i + 1] === \"/\") {\n          i++; // consume the trailing '/'\n          re += \"(?:.*/)?\"; // zero or more path segments\n        } else {\n          re += \".*\"; // '**' spanning segments\n        }\n      } else {\n        re += \"[^/]*\"; // '*' within a segment\n      }\n    } else if (c === \"?\") {\n      re += \"[^/]\";\n    } else if (c === \"[\") {\n      // Pass a character class through; find its closing ']'.\n      const end = glob.indexOf(\"]\", i + 1);\n      if (end === -1) {\n        re += \"\\\\[\";\n      } else {\n        re += glob.slice(i, end + 1);\n        i = end;\n      }\n    } else if (\"\\\\^$.|+(){}\".includes(c)) {\n      re += \"\\\\\" + c;\n    } else {\n      re += c;\n    }\n  }\n  return new RegExp(`^${re}$`);\n}\n\n/** Memoized glob→RegExp so a pattern is compiled once, not once per file. */\nconst GLOB_CACHE = new Map<string, RegExp>();\nfunction globRegExp(pattern: string): RegExp {\n  let re = GLOB_CACHE.get(pattern);\n  if (!re) {\n    re = globToRegExp(pattern);\n    GLOB_CACHE.set(pattern, re);\n  }\n  return re;\n}\n\n/**\n * True if `rel` (a POSIX relative path) matches any pattern. A pattern with a\n * glob metacharacter (`*`, `?`, `[`) is matched as an anchored glob; a plain\n * pattern keeps the historical substring / path-prefix semantics (so `\"src\"`\n * still matches `src/a.ts` and `\"secrets\"` matches anywhere).\n */\nexport function matchesAny(rel: string, patterns: readonly string[]): boolean {\n  for (const pattern of patterns) {\n    if (!pattern) continue;\n    const p = toPosix(pattern).replace(/\\/+$/, \"\");\n    if (hasGlobMeta(p)) {\n      if (globRegExp(p).test(rel)) return true;\n      continue;\n    }\n    // Plain pattern: substring match (handles \"src/legacy\" or \"secrets\")...\n    if (rel.includes(p)) return true;\n    // ...and explicit path-prefix match (\"foo\" should match \"foo/bar.ts\").\n    if (rel === p || rel.startsWith(`${p}/`)) return true;\n  }\n  return false;\n}\n\n/** True if `rel` (a POSIX relative path) matches any exclude pattern. */\nfunction isExcluded(rel: string, exclude: readonly string[]): boolean {\n  return matchesAny(rel, exclude);\n}\n\n/**\n * True if `rel` passes the include filter. An empty include list means \"include\n * everything\"; otherwise the file must match at least one include pattern.\n */\nfunction isIncluded(rel: string, include: readonly string[]): boolean {\n  if (include.length === 0) return true;\n  return matchesAny(rel, include);\n}\n\n/** True if the file's extension marks it as binary / non-text. */\nexport function isBinaryPath(rel: string): boolean {\n  const lower = rel.toLowerCase();\n  // Handle compound extensions like \".min.js\" first.\n  if (lower.endsWith(\".min.js\")) return true;\n  const ext = path.posix.extname(lower);\n  return BINARY_EXTENSIONS.has(ext);\n}\n\n/**\n * Compound / pattern extensions that mark generated or bundled output we skip\n * by default (beyond `.min.js` / `.map`, which {@link isBinaryPath} handles).\n */\nconst GENERATED_PATH_RE =\n  /(?:\\.min\\.[mc]?js|[.-]min\\.[mc]?js|\\.bundle\\.[mc]?js|\\.chunk\\.[mc]?js|\\.generated\\.[jt]sx?|_pb\\.js|\\.pb\\.go)$/i;\n\n/** True if the path looks like generated / bundled output (by name). */\nexport function isGeneratedPath(rel: string): boolean {\n  return GENERATED_PATH_RE.test(rel.toLowerCase());\n}\n\n/**\n * Heuristic content check for machine-minified / generated files with no\n * telltale extension: a very long average line length, or any single line over\n * ~50 KB, in the first ~64 KB sampled. Used at read time, not in the walker.\n */\nexport function looksMinified(content: string): boolean {\n  const sample = content.length > 65_536 ? content.slice(0, 65_536) : content;\n  if (sample.length === 0) return false;\n  let maxLine = 0;\n  let cur = 0;\n  let lines = 1;\n  for (let i = 0; i < sample.length; i++) {\n    if (sample.charCodeAt(i) === 10 /* \\n */) {\n      if (cur > maxLine) maxLine = cur;\n      cur = 0;\n      lines++;\n    } else {\n      cur++;\n    }\n  }\n  if (cur > maxLine) maxLine = cur;\n  if (maxLine > 50_000) return true;\n  const avgLine = sample.length / lines;\n  return avgLine > 1_000;\n}\n\n/**\n * Recursively yield scannable file paths (relative to `root`, POSIX) under a\n * directory. If `root` points at a single file, yields just that file's\n * basename (subject to the size / binary filters).\n */\nexport async function* walkFiles(root: string, options: WalkOptions = {}): AsyncGenerator<string> {\n  const include = options.include ?? [];\n  const exclude = options.exclude ?? [];\n  const maxFileSize = options.maxFileSize ?? DEFAULT_MAX_FILE_SIZE;\n  const ignores = options.noDefaultIgnores ? [] : DEFAULT_IGNORES;\n\n  const rootStat = await stat(root);\n\n  // Single-file mode: yield the file itself (by basename) if it passes filters.\n  if (rootStat.isFile()) {\n    const name = toPosix(path.basename(root));\n    if (\n      !isBinaryPath(name) &&\n      isIncluded(name, include) &&\n      passesSizeLimit(name, rootStat.size, maxFileSize)\n    ) {\n      yield name;\n    }\n    return;\n  }\n\n  yield* walkDir(root, \"\", { include, exclude, maxFileSize, ignores });\n}\n\ninterface WalkContext {\n  include: readonly string[];\n  exclude: readonly string[];\n  maxFileSize: number;\n  ignores: readonly string[];\n}\n\n/**\n * True if a file passes the size limit. Dependency manifests (package.json /\n * package-lock.json) are exempt from the cap so large lockfiles still get\n * scanned for vulnerable dependencies instead of being silently dropped.\n */\nfunction passesSizeLimit(rel: string, size: number, maxFileSize: number): boolean {\n  // Dependency manifests are always read (they can exceed the size cap but carry\n  // the whole dependency tree). Uses the single {@link isManifestFile} definition.\n  if (isManifestFile(rel)) return true;\n  return size <= maxFileSize;\n}\n\n/** Internal recursive directory walker. `relDir` is POSIX-relative to the root. */\nasync function* walkDir(absDir: string, relDir: string, ctx: WalkContext): AsyncGenerator<string> {\n  let entries: Dirent[];\n  try {\n    entries = await readdir(absDir, { withFileTypes: true });\n  } catch {\n    // Unreadable directory (permissions, transient races) — skip silently.\n    return;\n  }\n\n  // Stable, deterministic ordering for reproducible scans.\n  entries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));\n\n  for (const entry of entries) {\n    const rel = relDir ? `${relDir}/${entry.name}` : entry.name;\n    const abs = path.join(absDir, entry.name);\n\n    if (entry.isSymbolicLink()) {\n      // Don't follow symlinks: avoids cycles and escaping the root.\n      continue;\n    }\n\n    if (entry.isDirectory()) {\n      if (ctx.ignores.includes(entry.name)) continue;\n      if (isExcluded(rel, ctx.exclude)) continue;\n      yield* walkDir(abs, rel, ctx);\n      continue;\n    }\n\n    if (!entry.isFile()) continue;\n    if (isExcluded(rel, ctx.exclude)) continue;\n    if (!isIncluded(rel, ctx.include)) continue;\n    // Dependency manifests (incl. yarn.lock / pnpm-lock.yaml) are always read —\n    // they carry the dependency tree and must not be dropped as binary/generated.\n    const manifest = isManifestFile(rel);\n    if (!manifest && isBinaryPath(rel)) continue;\n    if (!manifest && isGeneratedPath(rel)) continue;\n\n    try {\n      const s = await stat(abs);\n      if (!passesSizeLimit(rel, s.size, ctx.maxFileSize)) continue;\n    } catch {\n      continue;\n    }\n\n    yield rel;\n  }\n}\n"]}

package/dist/worktree.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"worktree.d.ts","sourceRoot":"","sources":["../src/worktree.ts"],"names":[],"mappings":"AAkBA;;;GAGG;AACH,wBAAsB,YAAY,CAAC,CAAC,EAClC,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAC9B,OAAO,CAAC,CAAC,CAAC,CAmBZ"}
+{"version":3,"file":"worktree.d.ts","sourceRoot":"","sources":["../src/worktree.ts"],"names":[],"mappings":"AAkBA;;;GAGG;AACH,wBAAsB,YAAY,CAAC,CAAC,EAClC,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAC9B,OAAO,CAAC,CAAC,CAAC,CA2BZ"}

package/dist/worktree.js

@@ -26,8 +26,10 @@ export async function withWorktree(repoRoot, fn) {
     }
     const base = await mkdtemp(join(tmpdir(), "quantakrypto-wt-"));
     const dir = join(base, "wt");
-    await git(["worktree", "add", "--detach", dir], repoRoot);
+    // `worktree add` is INSIDE the try so a failure (locked index, disk full)
+    // still cleans up the temp dir in `finally` (audit: arch #6).
     try {
+        await git(["worktree", "add", "--detach", dir], repoRoot);
         return await fn(dir);
     }
     finally {
@@ -37,6 +39,13 @@ export async function withWorktree(repoRoot, fn) {
         catch {
             // best effort — the temp dir removal below still reclaims the disk.
         }
+        // Prune stale `.git/worktrees/<name>` metadata a failed add/remove can leave.
+        try {
+            await git(["worktree", "prune"], repoRoot);
+        }
+        catch {
+            // best effort
+        }
         await rm(base, { recursive: true, force: true });
     }
 }

package/dist/worktree.js.map

@@ -1 +1 @@
-{"version":3,"file":"worktree.js","sourceRoot":"","sources":["../src/worktree.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEjC,KAAK,UAAU,GAAG,CAAC,IAAc,EAAE,GAAY;IAC7C,MAAM,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,EAA+B;IAE/B,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,CAAC,WAAW,EAAE,uBAAuB,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,2BAA2B,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7B,MAAM,GAAG,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;QACtE,CAAC;QACD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;AACH,CAAC"}
+{"version":3,"file":"worktree.js","sourceRoot":"","sources":["../src/worktree.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEjC,KAAK,UAAU,GAAG,CAAC,IAAc,EAAE,GAAY;IAC7C,MAAM,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,EAA+B;IAE/B,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,CAAC,WAAW,EAAE,uBAAuB,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,2BAA2B,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7B,0EAA0E;IAC1E,8DAA8D;IAC9D,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC1D,OAAO,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;QACtE,CAAC;QACD,8EAA8E;QAC9E,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;QACD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;AACH,CAAC","sourcesContent":["/**\n * Ephemeral git worktree runner. Remediation applies candidate patches inside a\n * throwaway `git worktree` checked out at HEAD, so the user's working tree is\n * never touched while patches are being tried and verified. The worktree is\n * always removed afterwards, even if the callback throws.\n */\nimport { execFile } from \"node:child_process\";\nimport { promisify } from \"node:util\";\nimport { mkdtemp, rm } from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\n\nconst exec = promisify(execFile);\n\nasync function git(args: string[], cwd?: string): Promise<void> {\n  await exec(\"git\", args, { cwd });\n}\n\n/**\n * Create a detached worktree of `repoRoot` at HEAD, run `fn` with its path, and\n * always tear it down. Throws if `repoRoot` is not a git repository.\n */\nexport async function withWorktree<T>(\n  repoRoot: string,\n  fn: (dir: string) => Promise<T>,\n): Promise<T> {\n  try {\n    await git([\"rev-parse\", \"--is-inside-work-tree\"], repoRoot);\n  } catch {\n    throw new Error(`withWorktree: \"${repoRoot}\" is not a git repository`);\n  }\n  const base = await mkdtemp(join(tmpdir(), \"quantakrypto-wt-\"));\n  const dir = join(base, \"wt\");\n  // `worktree add` is INSIDE the try so a failure (locked index, disk full)\n  // still cleans up the temp dir in `finally` (audit: arch #6).\n  try {\n    await git([\"worktree\", \"add\", \"--detach\", dir], repoRoot);\n    return await fn(dir);\n  } finally {\n    try {\n      await git([\"worktree\", \"remove\", \"--force\", dir], repoRoot);\n    } catch {\n      // best effort — the temp dir removal below still reclaims the disk.\n    }\n    // Prune stale `.git/worktrees/<name>` metadata a failed add/remove can leave.\n    try {\n      await git([\"worktree\", \"prune\"], repoRoot);\n    } catch {\n      // best effort\n    }\n    await rm(base, { recursive: true, force: true });\n  }\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quantakrypto/core",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "description": "Shared post-quantum readiness library: crypto detectors, vulnerable-dependency database, inventory + SARIF reporting. Zero runtime dependencies.",
   "license": "Apache-2.0",
   "author": "Dandelion Labs <hello@dandelionlabs.io> (https://dandelionlabs.io)",

package/src/cbom.ts

@@ -43,7 +43,10 @@ function primitiveFor(category: FindingCategory): string {
     case "signature":
       return "signature";
     case "certificate":
-      return "pki";
+      // "pki" is NOT a valid CycloneDX 1.6 algorithmProperties.primitive enum
+      // value; use "other" so the CBOM validates (audit: quantum #3). Modeling
+      // certificates as assetType:"certificate" is a future refinement.
+      return "other";
     case "tls":
       return "other";
     default:
@@ -51,9 +54,15 @@ function primitiveFor(category: FindingCategory): string {
   }
 }
 
-/** True when the algorithm family is broken by Shor's algorithm (quantum). */
-function isQuantumVulnerable(algorithm: AlgorithmFamily): boolean {
-  return algorithm !== "unknown";
+/**
+ * Every CBOM asset here is derived from a quantakrypto finding, and the detectors
+ * only ever fire on classical (Shor-broken) public-key crypto — so an asset is
+ * quantum-vulnerable by construction, even when the exact family couldn't be
+ * pinned down (`unknown`). Reporting `false` for `unknown` mislabeled
+ * definitionally-classical findings as safe (audit: crypto #6).
+ */
+function isQuantumVulnerable(_algorithm: AlgorithmFamily): boolean {
+  return true;
 }
 
 /**

package/src/comments.ts

@@ -109,6 +109,54 @@ export function commentSpans(content: string, style: CommentStyle): Array<[numbe
   return spans;
 }
 
+/**
+ * Compute Python triple-quoted string spans (`"""…"""` / `'''…'''`). These are
+ * docstrings / prose in practice, so a crypto *name* mentioned inside one
+ * (`:param key_type: eg "ssh-ed25519"`) should not fire a token finding — but a
+ * PEM key pasted into one is still real material, so {@link stripCommentFindings}
+ * exempts `pem-*` rules. Comments and normal strings are skipped so a `"""`
+ * delimiter inside them is not mis-detected.
+ */
+export function pythonDocstringSpans(content: string): Array<[number, number]> {
+  const spans: Array<[number, number]> = [];
+  const n = content.length;
+  let i = 0;
+  while (i < n) {
+    const c = content[i];
+    if (c === "#") {
+      i++;
+      while (i < n && content[i] !== "\n") i++;
+      continue;
+    }
+    if ((c === '"' || c === "'") && content[i + 1] === c && content[i + 2] === c) {
+      const start = i;
+      i += 3;
+      while (i < n && !(content[i] === c && content[i + 1] === c && content[i + 2] === c)) i++;
+      i = Math.min(n, i + 3);
+      spans.push([start, i]);
+      continue;
+    }
+    if (c === '"' || c === "'") {
+      const q = c;
+      i++;
+      while (i < n) {
+        if (content[i] === "\\") {
+          i += 2;
+          continue;
+        }
+        if (content[i] === q) {
+          i++;
+          break;
+        }
+        i++;
+      }
+      continue;
+    }
+    i++;
+  }
+  return spans;
+}
+
 /** True if `offset` falls inside one of the (sorted, non-overlapping) spans. */
 export function offsetInSpans(spans: ReadonlyArray<[number, number]>, offset: number): boolean {
   let lo = 0;
@@ -163,7 +211,9 @@ export function stripCommentFindings(
   const style = commentStyleForFile(file);
   if (!style) return findings;
   const spans = commentSpans(content, style);
-  if (spans.length === 0) return findings;
+  // Python docstrings suppress prose *token* rules but keep real PEM material.
+  const docSpans = style === "hash" ? pythonDocstringSpans(content) : [];
+  if (spans.length === 0 && docSpans.length === 0) return findings;
 
   // 1-based line → start offset, to turn a finding's (line, column) back into an
   // absolute offset (column is 1-based: offset = lineStart + column - 1).
@@ -173,6 +223,95 @@ export function stripCommentFindings(
   }
 
   return findings.filter((f) => {
+    const start = lineStarts[f.location.line - 1] ?? 0;
+    const offset = start + ((f.location.column ?? 1) - 1);
+    if (offsetInSpans(spans, offset)) return false;
+    if (docSpans.length > 0 && !f.ruleId.startsWith("pem-") && offsetInSpans(docSpans, offset)) {
+      return false;
+    }
+    return true;
+  });
+}
+
+/**
+ * Compute the string-literal spans (`[start, end)`) of `content`, skipping over
+ * comments so a quote inside a comment is not treated as a string. Used to
+ * suppress findings from IDENTIFIER-only rules (e.g. a Go `SigningMethodRS256`
+ * mentioned inside an error-message string) — the mirror of {@link commentSpans}.
+ */
+export function stringSpans(content: string, style: CommentStyle): Array<[number, number]> {
+  const spans: Array<[number, number]> = [];
+  const n = content.length;
+  let i = 0;
+  while (i < n) {
+    const c = content[i];
+    if (style === "c" && c === "/" && content[i + 1] === "/") {
+      i += 2;
+      while (i < n && content[i] !== "\n") i++;
+      continue;
+    }
+    if (style === "c" && c === "/" && content[i + 1] === "*") {
+      i += 2;
+      while (i < n && !(content[i] === "*" && content[i + 1] === "/")) i++;
+      i = Math.min(n, i + 2);
+      continue;
+    }
+    if (style === "hash" && c === "#") {
+      i++;
+      while (i < n && content[i] !== "\n") i++;
+      continue;
+    }
+    if (c === '"' || c === "'" || c === "`") {
+      const quote = c;
+      const start = i;
+      i++;
+      while (i < n) {
+        if (content[i] === "\\") {
+          i += 2;
+          continue;
+        }
+        if (content[i] === quote) {
+          i++;
+          break;
+        }
+        i++;
+      }
+      spans.push([start, i]);
+      continue;
+    }
+    i++;
+  }
+  return spans;
+}
+
+/**
+ * Drop findings of "code-only" rules (`ruleIds`) whose match starts inside a
+ * string literal. Some rules — an identifier-form JWT signing method, a Go
+ * `SigningMethodRS256` — are only meaningful as code; when the same token appears
+ * inside a string (a test's `t.Error("SigningMethodPS256 …")`) it is prose, not a
+ * usage. Rules that legitimately match inside strings (quoted `"RS256"` alg
+ * tokens, cipher-suite strings, ssh-key tokens) are NOT in `ruleIds` and pass
+ * through untouched.
+ */
+export function stripStringLiteralFindings(
+  findings: Finding[],
+  content: string,
+  file: string,
+  ruleIds: ReadonlySet<string>,
+): Finding[] {
+  if (findings.length === 0 || !findings.some((f) => ruleIds.has(f.ruleId))) return findings;
+  const style = commentStyleForFile(file);
+  if (!style) return findings;
+  const spans = stringSpans(content, style);
+  if (spans.length === 0) return findings;
+
+  const lineStarts: number[] = [0];
+  for (let i = 0; i < content.length; i++) {
+    if (content[i] === "\n") lineStarts.push(i + 1);
+  }
+
+  return findings.filter((f) => {
+    if (!ruleIds.has(f.ruleId)) return true;
     const start = lineStarts[f.location.line - 1] ?? 0;
     const offset = start + ((f.location.column ?? 1) - 1);
     return !offsetInSpans(spans, offset);