@quantakrypto/core 0.4.2 → 0.4.3

package/dist/remediation.js.map

@@ -1 +1 @@
-{"version":3,"file":"remediation.js","sourceRoot":"","sources":["../src/remediation.ts"],"names":[],"mappings":"AAQA,8DAA8D;AAC9D,MAAM,YAAY,GAAyC;IACzD,GAAG,EAAE;QACH,SAAS,EAAE,KAAK;QAChB,cAAc,EAAE,yDAAyD;QACzE,MAAM,EACJ,4EAA4E;YAC5E,2EAA2E;YAC3E,gEAAgE;KACnE;IACD,IAAI,EAAE;QACJ,SAAS,EAAE,MAAM;QACjB,cAAc,EAAE,oCAAoC;QACpD,MAAM,EACJ,6EAA6E;YAC7E,gFAAgF;YAChF,2DAA2D;KAC9D;IACD,KAAK,EAAE;QACL,SAAS,EAAE,OAAO;QAClB,cAAc,EAAE,sBAAsB;QACtC,MAAM,EACJ,6EAA6E;YAC7E,8EAA8E;YAC9E,wBAAwB;KAC3B;IACD,KAAK,EAAE;QACL,SAAS,EAAE,OAAO;QAClB,cAAc,EAAE,sBAAsB;QACtC,MAAM,EACJ,+EAA+E;YAC/E,iFAAiF;KACpF;IACD,EAAE,EAAE;QACF,SAAS,EAAE,IAAI;QACf,cAAc,EAAE,oCAAoC;QACpD,MAAM,EACJ,2EAA2E;YAC3E,6EAA6E;KAChF;IACD,GAAG,EAAE;QACH,SAAS,EAAE,KAAK;QAChB,cAAc,EAAE,sBAAsB;QACtC,MAAM,EACJ,gFAAgF;YAChF,0DAA0D;KAC7D;IACD,MAAM,EAAE;QACN,SAAS,EAAE,QAAQ;QACnB,cAAc,EAAE,oCAAoC;QACpD,MAAM,EACJ,gFAAgF;YAChF,gFAAgF;YAChF,+CAA+C;KAClD;IACD,IAAI,EAAE;QACJ,SAAS,EAAE,MAAM;QACjB,cAAc,EAAE,oCAAoC;QACpD,MAAM,EACJ,6EAA6E;YAC7E,+EAA+E;YAC/E,6EAA6E;KAChF;IACD,KAAK,EAAE;QACL,SAAS,EAAE,OAAO;QAClB,cAAc,EAAE,8BAA8B;QAC9C,MAAM,EACJ,6EAA6E;YAC7E,8EAA8E;YAC9E,sCAAsC;KACzC;IACD,OAAO,EAAE;QACP,SAAS,EAAE,SAAS;QACpB,cAAc,EAAE,mCAAmC;QACnD,MAAM,EACJ,6EAA6E;YAC7E,yEAAyE;KAC5E;CACF,CAAC;AAEF,kFAAkF;AAClF,MAAM,UAAU,cAAc,CAAC,SAA0B;IACvD,OAAO,YAAY,CAAC,SAAS,CAAC,CAAC;AACjC,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,eAAe,CAAC,SAA0B;IACxD,OAAO,YAAY,CAAC,SAAS,CAAC,CAAC,cAAc,CAAC;AAChD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAA0B;IAChE,OAAO,CACL,SAAS,KAAK,KAAK;QACnB,SAAS,KAAK,MAAM;QACpB,SAAS,KAAK,IAAI;QAClB,SAAS,KAAK,QAAQ;QACtB,SAAS,KAAK,MAAM;QACpB,SAAS,KAAK,OAAO,CACtB,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,iBAAiB,CAAC,SAA0B;IAC1D,OAAO,CACL,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,KAAK,KAAK,CAC7F,CAAC;AACJ,CAAC;AAcD,+CAA+C;AAC/C,MAAM,CAAC,MAAM,WAAW,GAA2E;IACjG,YAAY,EAAE;QACZ,GAAG,EAAE,uBAAuB;QAC5B,SAAS,EAAE,sBAAsB;QACjC,IAAI,EAAE,uDAAuD;KAC9D;IACD,YAAY,EAAE;QACZ,GAAG,EAAE,wBAAwB;QAC7B,SAAS,EAAE,sBAAsB;QACjC,IAAI,EAAE,yGAAyG;KAChH;CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,SAA0B,EAC1B,OAAqB,YAAY;IAEjC,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACjC,8EAA8E;IAC9E,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;IAEvD,6EAA6E;IAC7E,0EAA0E;IAC1E,8EAA8E;IAC9E,0EAA0E;IAC1E,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,MAAM;YACvB,CAAC,CAAC,kKAAkK;YACpK,CAAC,CAAC,EAAE,CAAC;QACP,OAAO;YACL,SAAS;YACT,cAAc,EAAE,GAAG,OAAO,4DAA4D;YACtF,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,iDAAiD,MAAM,CAAC,GAAG,cAAc,MAAM,CAAC,SAAS,iBAAiB,UAAU,EAAE;SAC5J,CAAC;IACJ,CAAC;IAED,OAAO;QACL,SAAS;QACT,cAAc,EAAE,GAAG,IAAI,CAAC,cAAc,MAAM,IAAI,KAAK,OAAO,EAAE;QAC9D,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,sBAAsB,MAAM,CAAC,GAAG,cAAc,MAAM,CAAC,SAAS,gBAAgB;KACpH,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAC5B,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,6EAA6E;IAC7E,mCAAmC,CAAC;AAEtC,oFAAoF;AACpF,MAAM,UAAU,kBAAkB,CAAC,SAA0B;IAC3D,+DAA+D;IAC/D,OAAO,iBAAiB,CAAC,SAAS,CAAC,CAAC;AACtC,CAAC"}
+{"version":3,"file":"remediation.js","sourceRoot":"","sources":["../src/remediation.ts"],"names":[],"mappings":"AASA,8DAA8D;AAC9D,MAAM,YAAY,GAAyC;IACzD,GAAG,EAAE;QACH,SAAS,EAAE,KAAK;QAChB,cAAc,EAAE,yDAAyD;QACzE,MAAM,EACJ,4EAA4E;YAC5E,2EAA2E;YAC3E,gEAAgE;KACnE;IACD,IAAI,EAAE;QACJ,SAAS,EAAE,MAAM;QACjB,cAAc,EAAE,oCAAoC;QACpD,MAAM,EACJ,6EAA6E;YAC7E,gFAAgF;YAChF,2DAA2D;KAC9D;IACD,KAAK,EAAE;QACL,SAAS,EAAE,OAAO;QAClB,cAAc,EAAE,sBAAsB;QACtC,MAAM,EACJ,6EAA6E;YAC7E,8EAA8E;YAC9E,wBAAwB;KAC3B;IACD,KAAK,EAAE;QACL,SAAS,EAAE,OAAO;QAClB,cAAc,EAAE,sBAAsB;QACtC,MAAM,EACJ,+EAA+E;YAC/E,iFAAiF;KACpF;IACD,EAAE,EAAE;QACF,SAAS,EAAE,IAAI;QACf,cAAc,EAAE,oCAAoC;QACpD,MAAM,EACJ,2EAA2E;YAC3E,6EAA6E;KAChF;IACD,GAAG,EAAE;QACH,SAAS,EAAE,KAAK;QAChB,cAAc,EAAE,sBAAsB;QACtC,MAAM,EACJ,gFAAgF;YAChF,0DAA0D;KAC7D;IACD,MAAM,EAAE;QACN,SAAS,EAAE,QAAQ;QACnB,cAAc,EAAE,oCAAoC;QACpD,MAAM,EACJ,gFAAgF;YAChF,gFAAgF;YAChF,+CAA+C;KAClD;IACD,IAAI,EAAE;QACJ,SAAS,EAAE,MAAM;QACjB,cAAc,EAAE,+CAA+C;QAC/D,MAAM,EACJ,6EAA6E;YAC7E,+EAA+E;YAC/E,yEAAyE;YACzE,qEAAqE;KACxE;IACD,KAAK,EAAE;QACL,SAAS,EAAE,OAAO;QAClB,cAAc,EAAE,gDAAgD;QAChE,MAAM,EACJ,6EAA6E;YAC7E,gFAAgF;YAChF,8EAA8E;YAC9E,0DAA0D;KAC7D;IACD,OAAO,EAAE;QACP,SAAS,EAAE,SAAS;QACpB,cAAc,EAAE,mCAAmC;QACnD,MAAM,EACJ,6EAA6E;YAC7E,yEAAyE;KAC5E;CACF,CAAC;AAEF,kFAAkF;AAClF,MAAM,UAAU,cAAc,CAAC,SAA0B;IACvD,OAAO,YAAY,CAAC,SAAS,CAAC,CAAC;AACjC,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,eAAe,CAAC,SAA0B;IACxD,OAAO,YAAY,CAAC,SAAS,CAAC,CAAC,cAAc,CAAC;AAChD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAA0B;IAChE,OAAO,CACL,SAAS,KAAK,KAAK;QACnB,SAAS,KAAK,MAAM;QACpB,SAAS,KAAK,IAAI;QAClB,SAAS,KAAK,QAAQ;QACtB,SAAS,KAAK,MAAM;QACpB,SAAS,KAAK,OAAO,CACtB,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,iBAAiB,CAAC,SAA0B;IAC1D,OAAO,CACL,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,KAAK,KAAK,CAC7F,CAAC;AACJ,CAAC;AAcD,+CAA+C;AAC/C,MAAM,CAAC,MAAM,WAAW,GAA2E;IACjG,YAAY,EAAE;QACZ,GAAG,EAAE,uBAAuB;QAC5B,SAAS,EAAE,sBAAsB;QACjC,IAAI,EAAE,uDAAuD;KAC9D;IACD,YAAY,EAAE;QACZ,GAAG,EAAE,wBAAwB;QAC7B,SAAS,EAAE,sBAAsB;QACjC,IAAI,EAAE,yGAAyG;KAChH;CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,SAA0B,EAC1B,OAAqB,YAAY;IAEjC,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACjC,8EAA8E;IAC9E,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;IAEvD,6EAA6E;IAC7E,0EAA0E;IAC1E,8EAA8E;IAC9E,0EAA0E;IAC1E,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,MAAM;YACvB,CAAC,CAAC,kKAAkK;YACpK,CAAC,CAAC,EAAE,CAAC;QACP,OAAO;YACL,SAAS;YACT,cAAc,EAAE,GAAG,OAAO,4DAA4D;YACtF,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,iDAAiD,MAAM,CAAC,GAAG,cAAc,MAAM,CAAC,SAAS,iBAAiB,UAAU,EAAE;SAC5J,CAAC;IACJ,CAAC;IAED,OAAO;QACL,SAAS;QACT,cAAc,EAAE,GAAG,IAAI,CAAC,cAAc,MAAM,IAAI,KAAK,OAAO,EAAE;QAC9D,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,sBAAsB,MAAM,CAAC,GAAG,cAAc,MAAM,CAAC,SAAS,gBAAgB;KACpH,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAC5B,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,6EAA6E;IAC7E,mCAAmC,CAAC;AAEtC;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAC9B,+EAA+E;IAC/E,iFAAiF;IACjF,2EAA2E;IAC3E,+EAA+E;IAC/E,+EAA+E;IAC/E,gEAAgE,CAAC;AAEnE,oFAAoF;AACpF,MAAM,UAAU,kBAAkB,CAAC,SAA0B;IAC3D,+DAA+D;IAC/D,OAAO,iBAAiB,CAAC,SAAS,CAAC,CAAC;AACtC,CAAC","sourcesContent":["/**\n * Post-quantum remediation guidance for each classical asymmetric algorithm\n * family. The recommendations follow NIST's finalized PQC algorithms — ML-KEM\n * (FIPS 203), ML-DSA (FIPS 204), SLH-DSA (FIPS 205) — and the IETF hybrid\n * key-exchange groups (X25519MLKEM768, SecP384r1MLKEM1024). Forward-looking\n * standards to track are captured in {@link PQC_TRANSITION_NOTE}.\n */\nimport type { AlgorithmFamily, Remediation } from \"./types.js\";\n\n/** Canonical remediation table, keyed by algorithm family. */\nconst REMEDIATIONS: Record<AlgorithmFamily, Remediation> = {\n  RSA: {\n    algorithm: \"RSA\",\n    recommendation: \"ML-KEM-768 for encryption/KEM; ML-DSA-65 for signatures\",\n    detail:\n      \"RSA is broken by Shor's algorithm. For key transport / encryption move to \" +\n      \"ML-KEM-768 (FIPS 203), ideally as the hybrid X25519MLKEM768. For digital \" +\n      \"signatures move to ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205).\",\n  },\n  ECDH: {\n    algorithm: \"ECDH\",\n    recommendation: \"hybrid X25519MLKEM768 (ML-KEM-768)\",\n    detail:\n      \"Elliptic-curve Diffie-Hellman is broken by Shor's algorithm and is exposed \" +\n      \"to harvest-now-decrypt-later. Adopt the hybrid X25519MLKEM768 key exchange so \" +\n      \"confidentiality survives even if one component is broken.\",\n  },\n  ECDSA: {\n    algorithm: \"ECDSA\",\n    recommendation: \"ML-DSA-65 (FIPS 204)\",\n    detail:\n      \"ECDSA signatures can be forged by a quantum attacker via Shor's algorithm. \" +\n      \"Migrate to ML-DSA (Dilithium, FIPS 204) or SLH-DSA (SPHINCS+, FIPS 205) for \" +\n      \"long-lived signatures.\",\n  },\n  EdDSA: {\n    algorithm: \"EdDSA\",\n    recommendation: \"ML-DSA-65 (FIPS 204)\",\n    detail:\n      \"Ed25519 / Ed448 (EdDSA) are classical signatures broken by Shor's algorithm. \" +\n      \"Replace with ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205) for forgery resistance.\",\n  },\n  DH: {\n    algorithm: \"DH\",\n    recommendation: \"hybrid X25519MLKEM768 (ML-KEM-768)\",\n    detail:\n      \"Finite-field Diffie-Hellman is broken by Shor's algorithm and exposed to \" +\n      \"harvest-now-decrypt-later. Move to a hybrid PQC KEM such as X25519MLKEM768.\",\n  },\n  DSA: {\n    algorithm: \"DSA\",\n    recommendation: \"ML-DSA-65 (FIPS 204)\",\n    detail:\n      \"DSA is a classical, quantum-broken signature scheme (and already deprecated). \" +\n      \"Replace with ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205).\",\n  },\n  X25519: {\n    algorithm: \"X25519\",\n    recommendation: \"hybrid X25519MLKEM768 (ML-KEM-768)\",\n    detail:\n      \"X25519 is a modern, well-built classical key-agreement primitive but is still \" +\n      \"broken by Shor's algorithm. Wrap it in the hybrid X25519MLKEM768 construction \" +\n      \"so it stays useful during the PQC transition.\",\n  },\n  X448: {\n    algorithm: \"X448\",\n    recommendation: \"hybrid SecP384r1MLKEM1024 (or X25519MLKEM768)\",\n    detail:\n      \"X448 (Goldilocks curve) is a modern classical key-agreement primitive at a \" +\n      \"higher classical security level, but it is still broken by Shor's algorithm. \" +\n      \"To preserve that assurance level, prefer the SecP384r1MLKEM1024 hybrid \" +\n      \"(ML-KEM-1024); X25519MLKEM768 is acceptable at the commercial tier.\",\n  },\n  ECIES: {\n    algorithm: \"ECIES\",\n    recommendation: \"ML-KEM-768 hybrid encryption (X-Wing for HPKE)\",\n    detail:\n      \"ECIES relies on classical ECDH for its key encapsulation and is exposed to \" +\n      \"harvest-now-decrypt-later. Replace the KEM step with ML-KEM-768 (FIPS 203) in \" +\n      \"a hybrid construction — for HPKE-style application-layer encryption, X-Wing \" +\n      \"(X25519 + ML-KEM-768) is the emerging hybrid KEM target.\",\n  },\n  unknown: {\n    algorithm: \"unknown\",\n    recommendation: \"review for post-quantum migration\",\n    detail:\n      \"This usage involves classical public-key cryptography. Audit it and plan a \" +\n      \"migration to NIST PQC standards (ML-KEM / FIPS 203, ML-DSA / FIPS 204).\",\n  },\n};\n\n/** Look up the recommended post-quantum remediation for a classical algorithm. */\nexport function remediationFor(algorithm: AlgorithmFamily): Remediation | undefined {\n  return REMEDIATIONS[algorithm];\n}\n\n/** Convenience: just the short recommendation string for a family (always defined). */\nexport function remediationText(algorithm: AlgorithmFamily): string {\n  return REMEDIATIONS[algorithm].recommendation;\n}\n\n/**\n * True when a family's PQC replacement is a KEM — i.e. it's used for\n * confidentiality / key-agreement (and is therefore harvest-now-decrypt-later\n * exposed). RSA is in both this set and {@link isSignatureFamily}. Single\n * source of truth for the family→target taxonomy used by tier guidance and the\n * multi-family remediation composer.\n */\nexport function isConfidentialityFamily(algorithm: AlgorithmFamily): boolean {\n  return (\n    algorithm === \"RSA\" ||\n    algorithm === \"ECDH\" ||\n    algorithm === \"DH\" ||\n    algorithm === \"X25519\" ||\n    algorithm === \"X448\" ||\n    algorithm === \"ECIES\"\n  );\n}\n\n/** True when a family's PQC replacement is a signature scheme (ML-DSA / SLH-DSA). */\nexport function isSignatureFamily(algorithm: AlgorithmFamily): boolean {\n  return (\n    algorithm === \"RSA\" || algorithm === \"ECDSA\" || algorithm === \"EdDSA\" || algorithm === \"DSA\"\n  );\n}\n\n/* -------------------------------------------------------------------------- */\n/* Security-tier guidance (CNSA 2.0 Category 5) + stateful HBS (SP 800-208)     */\n/* -------------------------------------------------------------------------- */\n\n/**\n * Security tier for remediation guidance.\n *  - `\"category-3\"` (default): commercial use — ML-KEM-768 / ML-DSA-65.\n *  - `\"category-5\"`: CNSA 2.0 national-security-systems / long-lived secrets —\n *    ML-KEM-1024 / ML-DSA-87.\n */\nexport type SecurityTier = \"category-3\" | \"category-5\";\n\n/** Per-tier KEM / signature parameter sets. */\nexport const TIER_PARAMS: Record<SecurityTier, { kem: string; signature: string; note: string }> = {\n  \"category-3\": {\n    kem: \"ML-KEM-768 (FIPS 203)\",\n    signature: \"ML-DSA-65 (FIPS 204)\",\n    note: \"NIST Category 3 — default for general commercial use.\",\n  },\n  \"category-5\": {\n    kem: \"ML-KEM-1024 (FIPS 203)\",\n    signature: \"ML-DSA-87 (FIPS 204)\",\n    note: \"NIST Category 5 — CNSA 2.0 for national-security systems and long-lived secrets (2030/2033 milestones).\",\n  },\n};\n\n/**\n * Tier-aware remediation. Returns the base family remediation plus the\n * parameter sets for the requested CNSA tier. Category 5 surfaces the\n * ML-KEM-1024 / ML-DSA-87 sets mandated by CNSA 2.0; category 3 is the\n * commercial default.\n */\nexport function remediationForTier(\n  algorithm: AlgorithmFamily,\n  tier: SecurityTier = \"category-3\",\n): Remediation {\n  const base = REMEDIATIONS[algorithm];\n  const params = TIER_PARAMS[tier];\n  // Confidentiality families lean on the KEM; signature families on the signer.\n  const isConf = isConfidentialityFamily(algorithm);\n  const primary = isConf ? params.kem : params.signature;\n\n  // Category-5 (CNSA 2.0 / NSS) mandates the ML-KEM-1024 / ML-DSA-87 parameter\n  // sets and must NOT surface the category-3 X25519MLKEM768 hybrid (its PQC\n  // component is ML-KEM-768 — sub-CNSA). Lead with the mandated set; only point\n  // at a hybrid TLS group at the 1024 level (audit: quantum #1, crypto S5).\n  if (tier === \"category-5\") {\n    const hybridNote = isConf\n      ? \" If a hybrid TLS group is required, use SecP384r1MLKEM1024 (draft-ietf-tls-ecdhe-mlkem) — not X25519MLKEM768, whose ML-KEM-768 component does not meet CNSA 2.0.\"\n      : \"\";\n    return {\n      algorithm,\n      recommendation: `${primary} — CNSA 2.0 mandates this parameter set (hybrids optional)`,\n      detail: `${base.detail} ${params.note} For CNSA 2.0 / national-security systems use ${params.kem} (KEM) and ${params.signature} (signatures).${hybridNote}`,\n    };\n  }\n\n  return {\n    algorithm,\n    recommendation: `${base.recommendation} — ${tier}: ${primary}`,\n    detail: `${base.detail} ${params.note} For this tier use ${params.kem} (KEM) and ${params.signature} (signatures).`,\n  };\n}\n\n/**\n * Guidance for stateful hash-based signatures (SP 800-208: LMS / XMSS / HSS).\n * These are NIST-approved for firmware / boot signing but are STATEFUL — each\n * private key may sign a bounded number of messages and the state MUST be\n * managed to avoid catastrophic key reuse. Surfaced where a long-lived,\n * low-volume signing root is appropriate.\n */\nexport const STATEFUL_HBS_NOTE =\n  \"For firmware / secure-boot signing, the stateful hash-based signatures \" +\n  \"LMS, XMSS and HSS (NIST SP 800-208) are approved alternatives to ML-DSA, \" +\n  \"but they are STATEFUL: the signer must never reuse a one-time key index. \" +\n  \"Use only with rigorous state management; otherwise prefer stateless ML-DSA \" +\n  \"(FIPS 204) or SLH-DSA (FIPS 205).\";\n\n/**\n * Forward-looking PQC standards worth tracking beyond the current FIPS 203/204/205\n * targets. Surfaced for operators planning multi-year migrations.\n */\nexport const PQC_TRANSITION_NOTE =\n  \"Migration urgency: NIST IR 8547 deprecates classical public-key crypto after \" +\n  \"2030 and disallows it after 2035 — long-lived (harvest-now-decrypt-later) data \" +\n  \"must move sooner. Standards to track: HQC (NIST's code-based backup KEM, \" +\n  \"selected March 2025; draft FIPS expected ~2026) as a diversity hedge against \" +\n  \"ML-KEM; FN-DSA / Falcon (draft FIPS 206) for compact lattice signatures; and \" +\n  \"X-Wing (X25519 + ML-KEM-768) for HPKE-style hybrid encryption.\";\n\n/** True when stateful HBS (SP 800-208) is a reasonable alternative for a family. */\nexport function statefulHbsApplies(algorithm: AlgorithmFamily): boolean {\n  // Signature families only — LMS/XMSS are signatures, not KEMs.\n  return isSignatureFamily(algorithm);\n}\n"]}

package/dist/report.d.ts

@@ -4,6 +4,7 @@
  * is emitted with raw escape codes and is off by default.
  */
 import type { RuleMeta, ScanResult } from "./types.js";
+import type { SecurityTier } from "./remediation.js";
 /** Minimal SARIF 2.1.0 log shape (kept permissive on purpose). */
 export interface SarifLog {
     $schema: string;
@@ -38,5 +39,13 @@ export declare function toJson(result: ScanResult, opts?: ReportOptions): Record
  */
 export declare function formatSummary(result: ScanResult, options?: {
     color?: boolean;
+    tier?: SecurityTier;
 }): string;
+/**
+ * Per-family migration targets for a CNSA security tier — surfaces the otherwise
+ * library-only {@link remediationForTier} in human reports. Category 5 shows the
+ * ML-KEM-1024 / ML-DSA-87 sets CNSA 2.0 mandates for national-security systems and
+ * long-lived secrets. Returns plain (un-coloured) lines; the caller styles them.
+ */
+export declare function formatTierGuidance(byAlgorithm: Record<string, number>, tier: SecurityTier): string[];
 //# sourceMappingURL=report.d.ts.map

package/dist/report.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAW,QAAQ,EAAE,UAAU,EAAY,MAAM,YAAY,CAAC;AAK1E,kEAAkE;AAClE,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,OAAO,EAAE,CAAC;CACjB;AAED,qFAAqF;AACrF,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC;CACtB;AAqED,8CAA8C;AAC9C,wBAAgB,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,QAAQ,CA6H1E;AAkBD,+DAA+D;AAC/D,wBAAgB,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAqCxF;AAwCD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAqGvF"}
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAA4B,QAAQ,EAAE,UAAU,EAAY,MAAM,YAAY,CAAC;AAK3F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,kEAAkE;AAClE,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,OAAO,EAAE,CAAC;CACjB;AAED,qFAAqF;AACrF,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC;CACtB;AAqED,8CAA8C;AAC9C,wBAAgB,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,QAAQ,CA6H1E;AAkBD,+DAA+D;AAC/D,wBAAgB,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAqCxF;AAwCD;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,UAAU,EAClB,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,YAAY,CAAA;CAAE,GACjD,MAAM,CAyGR;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,IAAI,EAAE,YAAY,GACjB,MAAM,EAAE,CAmBV"}

package/dist/report.js

@@ -1,6 +1,7 @@
 import { VERSION } from "./version.js";
 import { SEVERITY_ORDER, sarifLevel } from "./severity.js";
 import { ANALYZABLE_LANGUAGES_LABEL } from "./detect-utils.js";
+import { remediationFor, remediationForTier } from "./remediation.js";
 const SARIF_SCHEMA = "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json";
 const INFORMATION_URI = "https://github.com/quantakrypto/pqc-tools";
 /**
@@ -329,6 +330,36 @@ export function formatSummary(result, options) {
             "encrypted traffic captured today can be decrypted once a quantum computer exists. " +
             "Prioritise migrating key exchange / encryption to hybrid PQC (X25519MLKEM768)."));
     }
+    if (options?.tier) {
+        lines.push("", ...formatTierGuidance(inv.byAlgorithm, options.tier));
+    }
     return lines.join("\n");
 }
+/**
+ * Per-family migration targets for a CNSA security tier — surfaces the otherwise
+ * library-only {@link remediationForTier} in human reports. Category 5 shows the
+ * ML-KEM-1024 / ML-DSA-87 sets CNSA 2.0 mandates for national-security systems and
+ * long-lived secrets. Returns plain (un-coloured) lines; the caller styles them.
+ */
+export function formatTierGuidance(byAlgorithm, tier) {
+    const label = tier === "category-5" ? "CNSA 2.0 (Category 5)" : "Category 3 (commercial)";
+    const out = [`${label} migration targets:`];
+    const seen = new Set();
+    for (const [k, n] of Object.entries(byAlgorithm)) {
+        if (n <= 0)
+            continue;
+        const fam = k;
+        if (fam === "unknown" || !remediationFor(fam))
+            continue; // skip unmapped families
+        const rem = remediationForTier(fam, tier);
+        if (seen.has(rem.recommendation))
+            continue;
+        seen.add(rem.recommendation);
+        out.push(`  ${fam} → ${rem.recommendation}`);
+    }
+    if (tier === "category-5") {
+        out.push("  CNSA 2.0 mandates ML-KEM-1024 / ML-DSA-87 for national-security systems and long-lived secrets (2030/2033 milestones).");
+    }
+    return out;
+}
 //# sourceMappingURL=report.js.map

package/dist/report.js.map

@@ -1 +1 @@
-{"version":3,"file":"report.js","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AA4B/D,MAAM,YAAY,GAChB,gGAAgG,CAAC;AAEnG,MAAM,eAAe,GAAG,2CAA2C,CAAC;AAEpE;;;;GAIG;AACH,SAAS,cAAc,CAAC,CAAU,EAAE,cAAuB;IACzD,IAAI,cAAc,IAAI,CAAC,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACpD,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;AAC5B,CAAC;AAED,6FAA6F;AAC7F,SAAS,SAAS,CAAC,QAAkB;IACnC,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,GAAG,CAAC;QACb,KAAK,MAAM;YACT,OAAO,EAAE,CAAC;QACZ,KAAK,QAAQ;YACX,OAAO,EAAE,CAAC;QACZ,KAAK,KAAK;YACR,OAAO,EAAE,CAAC;QACZ;YACE,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,SAAS,SAAS,CAAC,IAUlB;IACC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,IAAI,EAAE,IAAI,CAAC,EAAE;QACb,gBAAgB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE;QACtC,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE;QACvC,oBAAoB,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;QAC1F,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,gBAAgB,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,UAAU,EAAE;YACV,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,mBAAmB,EAAE,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5F,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD;QACD,GAAG,CAAC,IAAI,CAAC,GAAG;YACV,CAAC,CAAC;gBACE,aAAa,EAAE;oBACb,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE;iBAClF;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,OAAO,CAAC,MAAkB,EAAE,IAAoB;IAC9D,MAAM,cAAc,GAAG,IAAI,EAAE,cAAc,IAAI,KAAK,CAAC;IACrD,6EAA6E;IAC7E,+EAA+E;IAC/E,6EAA6E;IAC7E,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,MAAM,KAAK,GAAmC,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAElC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;QACpC,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,SAAS;QAClC,IAAI,CAAC,CAAC,GAAG;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9B,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAClC,KAAK,CAAC,IAAI,CACR,SAAS,CAAC;YACR,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CACH,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,GAAG;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,SAAS;QACtC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtC,KAAK,CAAC,IAAI,CACR,SAAS,CAAC;YACR,EAAE,EAAE,CAAC,CAAC,MAAM;YACZ,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACxC,MAAM,MAAM,GAA2B,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtE,IAAI,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ;YAAE,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAClF,IAAI,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,KAAK,QAAQ;YAAE,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;QAChF,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAElD,OAAO;YACL,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YAClC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;YAC5B,UAAU,EAAE;gBACV,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjC;YACD,GAAG,CAAC,CAAC,CAAC,GAAG;gBACP,CAAC,CAAC;oBACE,IAAI,EAAE;wBACJ;4BACE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;yBACtD;qBACF;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,SAAS,EAAE;gBACT;oBACE,gBAAgB,EAAE;wBAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE;wBAC1C,MAAM,EAAE;4BACN,GAAG,MAAM;4BACT,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBACnD;qBACF;iBACF;aACF;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,MAAM,UAAU,GACd,OAAO,CAAC,IAAI,GAAG,CAAC;QACd,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,KAAK;gBACX,cAAc,EAAE,wBAAwB;gBACxC,YAAY,EAAE,OAAO;gBACrB,gBAAgB,EAAE,EAAE,IAAI,EAAE,uCAAuC,EAAE;gBACnE,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;oBACrC,EAAE;oBACF,OAAO,EAAE,0CAA0C,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO;iBAClF,CAAC,CAAC;aACJ;SACF;QACH,CAAC,CAAC,EAAE,CAAC;IAET,OAAO;QACL,OAAO,EAAE,YAAY;QACrB,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,OAAO;wBACb,cAAc,EAAE,eAAe;wBAC/B,OAAO,EAAE,MAAM,CAAC,WAAW,IAAI,OAAO;wBACtC,KAAK;qBACN;iBACF;gBACD,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChD,OAAO;aACR;SACF;KACF,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAS,gBAAgB,CAAC,QAAkB;IAC1C,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,KAAK,CAAC;QACf,KAAK,MAAM;YACT,OAAO,KAAK,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,KAAK,CAAC;QACf,KAAK,KAAK;YACR,OAAO,KAAK,CAAC;QACf;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,MAAM,CAAC,MAAkB,EAAE,IAAoB;IAC7D,MAAM,cAAc,GAAG,IAAI,EAAE,cAAc,IAAI,KAAK,CAAC;IACrD,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,SAAS,EAAE;YACT,cAAc,EAAE,MAAM,CAAC,SAAS,CAAC,cAAc;YAC/C,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,SAAS;YACrC,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU;YACvC,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU;YACvC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW;SAC1C;QACD,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpC,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,QAAQ,EAAE;gBACR,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI;gBACrB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI;gBACrB,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM;gBACzB,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO;gBAC3B,OAAO,EAAE,cAAc,CAAC,CAAC,EAAE,cAAc,CAAC;aAC3C;SACF,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAEhF,8DAA8D;AAC9D,MAAM,IAAI,GAAG;IACX,KAAK,EAAE,SAAS;IAChB,IAAI,EAAE,SAAS;IACf,GAAG,EAAE,SAAS;IACd,GAAG,EAAE,UAAU;IACf,KAAK,EAAE,UAAU;IACjB,MAAM,EAAE,UAAU;IAClB,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,UAAU;IACnB,IAAI,EAAE,UAAU;CACR,CAAC;AAEX,SAAS,aAAa,CAAC,GAAa;IAClC,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,UAAU;YACb,OAAO,IAAI,CAAC,OAAO,CAAC;QACtB,KAAK,MAAM;YACT,OAAO,IAAI,CAAC,GAAG,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,KAAK,KAAK;YACR,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB;YACE,OAAO,IAAI,CAAC,GAAG,CAAC;IACpB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IACnC,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC;IACpC,OAAO,IAAI,CAAC,GAAG,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,MAAkB,EAAE,OAA6B;IAC7E,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,KAAK,CAAC;IACtC,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,IAAY,EAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAEjG,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC;IAE7B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,uCAAuC,CAAC,CAAC,CAAC;IAClE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,MAAM,CAAC,WAAW,YAAY,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,0BAA0B;IAC1B,KAAK,CAAC,IAAI,CACR,oBAAoB,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,cAAc,MAAM,CAAC,EAAE,CACtG,CAAC;IACF,MAAM,QAAQ,GACZ,MAAM,CAAC,aAAa,KAAK,SAAS;QAChC,CAAC,CAAC,gBAAgB,0BAA0B,MAAM,MAAM,CAAC,aAAa,EAAE;QACxE,CAAC,CAAC,EAAE,CAAC;IACT,KAAK,CAAC,IAAI,CACR,oBAAoB,MAAM,CAAC,YAAY,GAAG,QAAQ,gBAAgB,MAAM,CAAC,QAAQ,CAAC,MAAM,oBAAoB,CAAC,CAC3G,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EACzC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CACtB,EAAE,CACJ,CAAC;IACF,sFAAsF;IACtF,IAAI,MAAM,CAAC,aAAa,KAAK,CAAC,IAAI,MAAM,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;QAC1D,KAAK,CAAC,IAAI,CACR,CAAC,CACC,IAAI,CAAC,MAAM,EACX,sDAAsD,0BAA0B,yDAAyD,CAC1I,CACF,CAAC;IACJ,CAAC;IACD,gFAAgF;IAChF,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC;IAChC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,IAAI,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC,EAAE,CAAC;QAC9D,KAAK,CAAC,IAAI,CACR,CAAC,CACC,IAAI,CAAC,MAAM,EACX,aAAa,IAAI,CAAC,UAAU,gBAAgB,IAAI,CAAC,eAAe,mDAAmD,CACpH,CACF,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,sBAAsB;IACtB,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7E,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAClD,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,iBAAiB,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAE9F,uBAAuB;IACvB,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;SAC9C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjC,IAAI,SAAS,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,kDAAkD,CAAC,CAAC,CAAC;QAC9E,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,iFAAiF;IACjF,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAClF,CAAC;IACF,MAAM,SAAS,GAAG,EAAE,CAAC;IACrB,KAAK,CAAC,IAAI,CACR,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAC1F,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,GAC/C,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAChD,EAAE,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,EAAE,CAAC,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,CAAC,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,MAAM,CAAC,MAAM,GAAG,SAAS,QAAQ,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,IAAI,GAAG,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CACR,CAAC,CACC,IAAI,CAAC,MAAM,EACX,SAAS,GAAG,CAAC,SAAS,4DAA4D;YAChF,oFAAoF;YACpF,gFAAgF,CACnF,CACF,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AA6BtE,MAAM,YAAY,GAChB,gGAAgG,CAAC;AAEnG,MAAM,eAAe,GAAG,2CAA2C,CAAC;AAEpE;;;;GAIG;AACH,SAAS,cAAc,CAAC,CAAU,EAAE,cAAuB;IACzD,IAAI,cAAc,IAAI,CAAC,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACpD,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;AAC5B,CAAC;AAED,6FAA6F;AAC7F,SAAS,SAAS,CAAC,QAAkB;IACnC,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,GAAG,CAAC;QACb,KAAK,MAAM;YACT,OAAO,EAAE,CAAC;QACZ,KAAK,QAAQ;YACX,OAAO,EAAE,CAAC;QACZ,KAAK,KAAK;YACR,OAAO,EAAE,CAAC;QACZ;YACE,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,SAAS,SAAS,CAAC,IAUlB;IACC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,IAAI,EAAE,IAAI,CAAC,EAAE;QACb,gBAAgB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE;QACtC,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE;QACvC,oBAAoB,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;QAC1F,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,gBAAgB,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,UAAU,EAAE;YACV,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,mBAAmB,EAAE,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5F,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD;QACD,GAAG,CAAC,IAAI,CAAC,GAAG;YACV,CAAC,CAAC;gBACE,aAAa,EAAE;oBACb,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE;iBAClF;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,OAAO,CAAC,MAAkB,EAAE,IAAoB;IAC9D,MAAM,cAAc,GAAG,IAAI,EAAE,cAAc,IAAI,KAAK,CAAC;IACrD,6EAA6E;IAC7E,+EAA+E;IAC/E,6EAA6E;IAC7E,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,MAAM,KAAK,GAAmC,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAElC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;QACpC,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,SAAS;QAClC,IAAI,CAAC,CAAC,GAAG;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9B,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAClC,KAAK,CAAC,IAAI,CACR,SAAS,CAAC;YACR,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CACH,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,GAAG;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,SAAS;QACtC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtC,KAAK,CAAC,IAAI,CACR,SAAS,CAAC;YACR,EAAE,EAAE,CAAC,CAAC,MAAM;YACZ,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACxC,MAAM,MAAM,GAA2B,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtE,IAAI,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ;YAAE,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAClF,IAAI,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,KAAK,QAAQ;YAAE,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;QAChF,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAElD,OAAO;YACL,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YAClC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;YAC5B,UAAU,EAAE;gBACV,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjC;YACD,GAAG,CAAC,CAAC,CAAC,GAAG;gBACP,CAAC,CAAC;oBACE,IAAI,EAAE;wBACJ;4BACE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;yBACtD;qBACF;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,SAAS,EAAE;gBACT;oBACE,gBAAgB,EAAE;wBAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE;wBAC1C,MAAM,EAAE;4BACN,GAAG,MAAM;4BACT,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBACnD;qBACF;iBACF;aACF;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,MAAM,UAAU,GACd,OAAO,CAAC,IAAI,GAAG,CAAC;QACd,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,KAAK;gBACX,cAAc,EAAE,wBAAwB;gBACxC,YAAY,EAAE,OAAO;gBACrB,gBAAgB,EAAE,EAAE,IAAI,EAAE,uCAAuC,EAAE;gBACnE,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;oBACrC,EAAE;oBACF,OAAO,EAAE,0CAA0C,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO;iBAClF,CAAC,CAAC;aACJ;SACF;QACH,CAAC,CAAC,EAAE,CAAC;IAET,OAAO;QACL,OAAO,EAAE,YAAY;QACrB,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,OAAO;wBACb,cAAc,EAAE,eAAe;wBAC/B,OAAO,EAAE,MAAM,CAAC,WAAW,IAAI,OAAO;wBACtC,KAAK;qBACN;iBACF;gBACD,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChD,OAAO;aACR;SACF;KACF,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAS,gBAAgB,CAAC,QAAkB;IAC1C,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,KAAK,CAAC;QACf,KAAK,MAAM;YACT,OAAO,KAAK,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,KAAK,CAAC;QACf,KAAK,KAAK;YACR,OAAO,KAAK,CAAC;QACf;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,MAAM,CAAC,MAAkB,EAAE,IAAoB;IAC7D,MAAM,cAAc,GAAG,IAAI,EAAE,cAAc,IAAI,KAAK,CAAC;IACrD,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,SAAS,EAAE;YACT,cAAc,EAAE,MAAM,CAAC,SAAS,CAAC,cAAc;YAC/C,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,SAAS;YACrC,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU;YACvC,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU;YACvC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW;SAC1C;QACD,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpC,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,QAAQ,EAAE;gBACR,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI;gBACrB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI;gBACrB,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM;gBACzB,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO;gBAC3B,OAAO,EAAE,cAAc,CAAC,CAAC,EAAE,cAAc,CAAC;aAC3C;SACF,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAEhF,8DAA8D;AAC9D,MAAM,IAAI,GAAG;IACX,KAAK,EAAE,SAAS;IAChB,IAAI,EAAE,SAAS;IACf,GAAG,EAAE,SAAS;IACd,GAAG,EAAE,UAAU;IACf,KAAK,EAAE,UAAU;IACjB,MAAM,EAAE,UAAU;IAClB,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,UAAU;IACnB,IAAI,EAAE,UAAU;CACR,CAAC;AAEX,SAAS,aAAa,CAAC,GAAa;IAClC,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,UAAU;YACb,OAAO,IAAI,CAAC,OAAO,CAAC;QACtB,KAAK,MAAM;YACT,OAAO,IAAI,CAAC,GAAG,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,KAAK,KAAK;YACR,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB;YACE,OAAO,IAAI,CAAC,GAAG,CAAC;IACpB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IACnC,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC;IACpC,OAAO,IAAI,CAAC,GAAG,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAkB,EAClB,OAAkD;IAElD,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,KAAK,CAAC;IACtC,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,IAAY,EAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAEjG,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC;IAE7B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,uCAAuC,CAAC,CAAC,CAAC;IAClE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,MAAM,CAAC,WAAW,YAAY,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,0BAA0B;IAC1B,KAAK,CAAC,IAAI,CACR,oBAAoB,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,cAAc,MAAM,CAAC,EAAE,CACtG,CAAC;IACF,MAAM,QAAQ,GACZ,MAAM,CAAC,aAAa,KAAK,SAAS;QAChC,CAAC,CAAC,gBAAgB,0BAA0B,MAAM,MAAM,CAAC,aAAa,EAAE;QACxE,CAAC,CAAC,EAAE,CAAC;IACT,KAAK,CAAC,IAAI,CACR,oBAAoB,MAAM,CAAC,YAAY,GAAG,QAAQ,gBAAgB,MAAM,CAAC,QAAQ,CAAC,MAAM,oBAAoB,CAAC,CAC3G,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EACzC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CACtB,EAAE,CACJ,CAAC;IACF,sFAAsF;IACtF,IAAI,MAAM,CAAC,aAAa,KAAK,CAAC,IAAI,MAAM,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;QAC1D,KAAK,CAAC,IAAI,CACR,CAAC,CACC,IAAI,CAAC,MAAM,EACX,sDAAsD,0BAA0B,yDAAyD,CAC1I,CACF,CAAC;IACJ,CAAC;IACD,gFAAgF;IAChF,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC;IAChC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,IAAI,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC,EAAE,CAAC;QAC9D,KAAK,CAAC,IAAI,CACR,CAAC,CACC,IAAI,CAAC,MAAM,EACX,aAAa,IAAI,CAAC,UAAU,gBAAgB,IAAI,CAAC,eAAe,mDAAmD,CACpH,CACF,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,sBAAsB;IACtB,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7E,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAClD,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,iBAAiB,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAE9F,uBAAuB;IACvB,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;SAC9C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjC,IAAI,SAAS,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,kDAAkD,CAAC,CAAC,CAAC;QAC9E,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,iFAAiF;IACjF,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAClF,CAAC;IACF,MAAM,SAAS,GAAG,EAAE,CAAC;IACrB,KAAK,CAAC,IAAI,CACR,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAC1F,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,GAC/C,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAChD,EAAE,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,EAAE,CAAC,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,CAAC,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,MAAM,CAAC,MAAM,GAAG,SAAS,QAAQ,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,IAAI,GAAG,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CACR,CAAC,CACC,IAAI,CAAC,MAAM,EACX,SAAS,GAAG,CAAC,SAAS,4DAA4D;YAChF,oFAAoF;YACpF,gFAAgF,CACnF,CACF,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,EAAE,IAAI,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,kBAAkB,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,WAAmC,EACnC,IAAkB;IAElB,MAAM,KAAK,GAAG,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,yBAAyB,CAAC;IAC1F,MAAM,GAAG,GAAa,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACrB,MAAM,GAAG,GAAG,CAAoB,CAAC;QACjC,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,yBAAyB;QAClF,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC;YAAE,SAAS;QAC3C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,MAAM,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,GAAG,CAAC,IAAI,CACN,0HAA0H,CAC3H,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC","sourcesContent":["/**\n * Reporters: turn a {@link ScanResult} into SARIF 2.1.0, a clean JSON object,\n * or a human-readable text summary. No third-party dependencies — ANSI colour\n * is emitted with raw escape codes and is off by default.\n */\nimport type { AlgorithmFamily, Finding, RuleMeta, ScanResult, Severity } from \"./types.js\";\nimport { VERSION } from \"./version.js\";\nimport { SEVERITY_ORDER, sarifLevel } from \"./severity.js\";\nimport { ANALYZABLE_LANGUAGES_LABEL } from \"./detect-utils.js\";\nimport { remediationFor, remediationForTier } from \"./remediation.js\";\nimport type { SecurityTier } from \"./remediation.js\";\n\n/** Minimal SARIF 2.1.0 log shape (kept permissive on purpose). */\nexport interface SarifLog {\n  $schema: string;\n  version: \"2.1.0\";\n  runs: unknown[];\n}\n\n/** Options shared by the structured reporters ({@link toSarif} / {@link toJson}). */\nexport interface ReportOptions {\n  /**\n   * Omit `location.snippet` from every finding in the output. Defaults to false\n   * (snippets are included). Snippets of `sensitive` findings (e.g. PEM key\n   * blocks, SSH public keys) are ALWAYS omitted regardless of this flag — the\n   * snippet there IS the sensitive value.\n   */\n  redactSnippets?: boolean;\n  /**\n   * Full rule catalog to advertise in SARIF `tool.driver.rules[]`, even for\n   * rules that produced no finding in this run. Pass\n   * `defaultRegistry.ruleCatalog()`. When omitted, only the rules that actually\n   * fired are emitted (the historical behaviour). SARIF-only; ignored by\n   * {@link toJson}.\n   */\n  catalog?: RuleMeta[];\n}\n\nconst SARIF_SCHEMA =\n  \"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json\";\n\nconst INFORMATION_URI = \"https://github.com/quantakrypto/pqc-tools\";\n\n/**\n * Resolve the snippet to emit for a finding, honouring redaction. Sensitive\n * findings (key material) never expose their snippet; otherwise the snippet is\n * dropped only when `redactSnippets` is set.\n */\nfunction emittedSnippet(f: Finding, redactSnippets: boolean): string | undefined {\n  if (redactSnippets || f.sensitive) return undefined;\n  return f.location.snippet;\n}\n\n/** Map our severity to a SARIF rule-level default (used in rules[].defaultConfiguration). */\nfunction sarifRank(severity: Severity): number {\n  switch (severity) {\n    case \"critical\":\n      return 100;\n    case \"high\":\n      return 80;\n    case \"medium\":\n      return 50;\n    case \"low\":\n      return 20;\n    default:\n      return 5;\n  }\n}\n\n/** Build a SARIF `rules[]` entry from a rule's severity/title/message/etc. */\nfunction sarifRule(spec: {\n  id: string;\n  title: string;\n  message: string;\n  severity: Severity;\n  category: string;\n  algorithm?: string;\n  hndl: boolean;\n  cwe?: string;\n  remediation?: string;\n}): Record<string, unknown> {\n  return {\n    id: spec.id,\n    name: spec.id,\n    shortDescription: { text: spec.title },\n    fullDescription: { text: spec.message },\n    defaultConfiguration: { level: sarifLevel(spec.severity), rank: sarifRank(spec.severity) },\n    ...(spec.remediation ? { help: { text: `Remediation: ${spec.remediation}` } } : {}),\n    properties: {\n      category: spec.category,\n      ...(spec.algorithm ? { algorithm: spec.algorithm } : {}),\n      hndl: spec.hndl,\n      ...(spec.cwe ? { cwe: spec.cwe, \"security-severity\": securitySeverity(spec.severity) } : {}),\n      ...(spec.cwe ? { tags: [\"security\", spec.cwe] } : {}),\n    },\n    ...(spec.cwe\n      ? {\n          relationships: [\n            { target: { id: spec.cwe, toolComponent: { name: \"CWE\" } }, kinds: [\"relevant\"] },\n          ],\n        }\n      : {}),\n  };\n}\n\n/** Serialize a scan result as SARIF 2.1.0. */\nexport function toSarif(result: ScanResult, opts?: ReportOptions): SarifLog {\n  const redactSnippets = opts?.redactSnippets ?? false;\n  // Build the rule set and collect the CWE taxa referenced by any rule. When a\n  // full catalog is supplied, advertise every rule (even ones that didn't fire);\n  // otherwise emit one rule per ruleId encountered (the historical behaviour).\n  const ruleIndex = new Map<string, number>();\n  const rules: Array<Record<string, unknown>> = [];\n  const cweTaxa = new Set<string>();\n\n  for (const r of opts?.catalog ?? []) {\n    if (ruleIndex.has(r.id)) continue;\n    if (r.cwe) cweTaxa.add(r.cwe);\n    ruleIndex.set(r.id, rules.length);\n    rules.push(\n      sarifRule({\n        id: r.id,\n        title: r.title,\n        message: r.message,\n        severity: r.severity,\n        category: r.category,\n        algorithm: r.algorithm,\n        hndl: r.hndl,\n        cwe: r.cwe,\n        remediation: r.remediation,\n      }),\n    );\n  }\n\n  for (const f of result.findings) {\n    if (f.cwe) cweTaxa.add(f.cwe);\n    if (ruleIndex.has(f.ruleId)) continue;\n    ruleIndex.set(f.ruleId, rules.length);\n    rules.push(\n      sarifRule({\n        id: f.ruleId,\n        title: f.title,\n        message: f.message,\n        severity: f.severity,\n        category: f.category,\n        algorithm: f.algorithm,\n        hndl: f.hndl,\n        cwe: f.cwe,\n        remediation: f.remediation,\n      }),\n    );\n  }\n\n  const results = result.findings.map((f) => {\n    const region: Record<string, number> = { startLine: f.location.line };\n    if (typeof f.location.column === \"number\") region.startColumn = f.location.column;\n    if (typeof f.location.endLine === \"number\") region.endLine = f.location.endLine;\n    const snippet = emittedSnippet(f, redactSnippets);\n\n    return {\n      ruleId: f.ruleId,\n      ruleIndex: ruleIndex.get(f.ruleId),\n      level: sarifLevel(f.severity),\n      message: { text: f.message },\n      properties: {\n        category: f.category,\n        severity: f.severity,\n        confidence: f.confidence,\n        hndl: f.hndl,\n        ...(f.algorithm ? { algorithm: f.algorithm } : {}),\n        ...(f.remediation ? { remediation: f.remediation } : {}),\n        ...(f.cwe ? { cwe: f.cwe } : {}),\n      },\n      ...(f.cwe\n        ? {\n            taxa: [\n              {\n                target: { id: f.cwe, toolComponent: { name: \"CWE\" } },\n              },\n            ],\n          }\n        : {}),\n      locations: [\n        {\n          physicalLocation: {\n            artifactLocation: { uri: f.location.file },\n            region: {\n              ...region,\n              ...(snippet ? { snippet: { text: snippet } } : {}),\n            },\n          },\n        },\n      ],\n    };\n  });\n\n  // CWE taxonomy component (SARIF taxonomies), referenced by rules + results.\n  const taxonomies =\n    cweTaxa.size > 0\n      ? [\n          {\n            name: \"CWE\",\n            informationUri: \"https://cwe.mitre.org/\",\n            organization: \"MITRE\",\n            shortDescription: { text: \"The MITRE Common Weakness Enumeration\" },\n            taxa: [...cweTaxa].sort().map((id) => ({\n              id,\n              helpUri: `https://cwe.mitre.org/data/definitions/${id.replace(/^CWE-/, \"\")}.html`,\n            })),\n          },\n        ]\n      : [];\n\n  return {\n    $schema: SARIF_SCHEMA,\n    version: \"2.1.0\",\n    runs: [\n      {\n        tool: {\n          driver: {\n            name: \"qScan\",\n            informationUri: INFORMATION_URI,\n            version: result.toolVersion || VERSION,\n            rules,\n          },\n        },\n        ...(taxonomies.length > 0 ? { taxonomies } : {}),\n        results,\n      },\n    ],\n  };\n}\n\n/** GitHub-code-scanning `security-severity` (0–10) derived from our severity. */\nfunction securitySeverity(severity: Severity): string {\n  switch (severity) {\n    case \"critical\":\n      return \"9.5\";\n    case \"high\":\n      return \"8.0\";\n    case \"medium\":\n      return \"5.0\";\n    case \"low\":\n      return \"3.0\";\n    default:\n      return \"1.0\";\n  }\n}\n\n/** Serialize a scan result as a plain JSON-friendly object. */\nexport function toJson(result: ScanResult, opts?: ReportOptions): Record<string, unknown> {\n  const redactSnippets = opts?.redactSnippets ?? false;\n  return {\n    toolVersion: result.toolVersion,\n    root: result.root,\n    startedAt: result.startedAt,\n    finishedAt: result.finishedAt,\n    filesScanned: result.filesScanned,\n    ...(result.analyzedFiles !== undefined ? { analyzedFiles: result.analyzedFiles } : {}),\n    ...(result.diagnostics ? { diagnostics: result.diagnostics } : {}),\n    inventory: {\n      readinessScore: result.inventory.readinessScore,\n      hndlCount: result.inventory.hndlCount,\n      bySeverity: result.inventory.bySeverity,\n      byCategory: result.inventory.byCategory,\n      byAlgorithm: result.inventory.byAlgorithm,\n    },\n    findings: result.findings.map((f) => ({\n      ruleId: f.ruleId,\n      title: f.title,\n      category: f.category,\n      severity: f.severity,\n      confidence: f.confidence,\n      algorithm: f.algorithm,\n      hndl: f.hndl,\n      message: f.message,\n      remediation: f.remediation,\n      cwe: f.cwe,\n      location: {\n        file: f.location.file,\n        line: f.location.line,\n        column: f.location.column,\n        endLine: f.location.endLine,\n        snippet: emittedSnippet(f, redactSnippets),\n      },\n    })),\n  };\n}\n\n/* -------------------------------------------------------------------------- */\n/* Human-readable summary                                                      */\n/* -------------------------------------------------------------------------- */\n\n/** Raw ANSI codes (no chalk). Disabled when colour is off. */\nconst ANSI = {\n  reset: \"\\x1b[0m\",\n  bold: \"\\x1b[1m\",\n  dim: \"\\x1b[2m\",\n  red: \"\\x1b[31m\",\n  green: \"\\x1b[32m\",\n  yellow: \"\\x1b[33m\",\n  blue: \"\\x1b[34m\",\n  magenta: \"\\x1b[35m\",\n  cyan: \"\\x1b[36m\",\n} as const;\n\nfunction severityColor(sev: Severity): string {\n  switch (sev) {\n    case \"critical\":\n      return ANSI.magenta;\n    case \"high\":\n      return ANSI.red;\n    case \"medium\":\n      return ANSI.yellow;\n    case \"low\":\n      return ANSI.blue;\n    default:\n      return ANSI.dim;\n  }\n}\n\nfunction scoreColor(score: number): string {\n  if (score >= 80) return ANSI.green;\n  if (score >= 50) return ANSI.yellow;\n  return ANSI.red;\n}\n\n/**\n * Render a human-readable summary of a scan result. Colour is off by default;\n * pass `{ color: true }` to emit ANSI escape codes.\n */\nexport function formatSummary(\n  result: ScanResult,\n  options?: { color?: boolean; tier?: SecurityTier },\n): string {\n  const color = options?.color ?? false;\n  const c = (code: string, text: string): string => (color ? `${code}${text}${ANSI.reset}` : text);\n\n  const lines: string[] = [];\n  const inv = result.inventory;\n\n  lines.push(c(ANSI.bold, \"qScan — post-quantum readiness report\"));\n  lines.push(c(ANSI.dim, `tool v${result.toolVersion} · root: ${result.root}`));\n  lines.push(\"\");\n\n  // Readiness score banner.\n  lines.push(\n    `Readiness score: ${c(`${ANSI.bold}${scoreColor(inv.readinessScore)}`, `${inv.readinessScore}/100`)}`,\n  );\n  const analyzed =\n    result.analyzedFiles !== undefined\n      ? `   Analyzed (${ANALYZABLE_LANGUAGES_LABEL}): ${result.analyzedFiles}`\n      : \"\";\n  lines.push(\n    `Files scanned:   ${result.filesScanned}${analyzed}   Findings: ${result.findings.length}   HNDL-exposed: ${c(\n      inv.hndlCount > 0 ? ANSI.red : ANSI.green,\n      String(inv.hndlCount),\n    )}`,\n  );\n  // Coverage honesty: a score over zero analyzable files is not a clean bill of health.\n  if (result.analyzedFiles === 0 && result.filesScanned > 0) {\n    lines.push(\n      c(\n        ANSI.yellow,\n        `Note: 0 files were in a supported source language (${ANALYZABLE_LANGUAGES_LABEL}) — the readiness score does not reflect this codebase.`,\n      ),\n    );\n  }\n  // Coverage diagnostics: skipped files mean the finding count may be incomplete.\n  const diag = result.diagnostics;\n  if (diag && (diag.unreadable > 0 || diag.skippedMinified > 0)) {\n    lines.push(\n      c(\n        ANSI.yellow,\n        `Coverage: ${diag.unreadable} unreadable, ${diag.skippedMinified} skipped as minified — results may be incomplete.`,\n      ),\n    );\n  }\n  lines.push(\"\");\n\n  // Severity breakdown.\n  const sevParts = SEVERITY_ORDER.filter((s) => inv.bySeverity[s] > 0).map((s) =>\n    c(severityColor(s), `${s}: ${inv.bySeverity[s]}`),\n  );\n  lines.push(`By severity:  ${sevParts.length ? sevParts.join(\"   \") : c(ANSI.green, \"none\")}`);\n\n  // Algorithm breakdown.\n  const algoParts = Object.entries(inv.byAlgorithm)\n    .sort((a, b) => b[1] - a[1])\n    .map(([k, v]) => `${k}: ${v}`);\n  if (algoParts.length) lines.push(`By algorithm: ${algoParts.join(\"   \")}`);\n  lines.push(\"\");\n\n  if (result.findings.length === 0) {\n    lines.push(c(ANSI.green, \"No classical asymmetric cryptography detected. ✓\"));\n    return lines.join(\"\\n\");\n  }\n\n  // Top findings, grouped by severity (most severe first), capped for readability.\n  const sorted = [...result.findings].sort(\n    (a, b) => SEVERITY_ORDER.indexOf(a.severity) - SEVERITY_ORDER.indexOf(b.severity),\n  );\n  const MAX_SHOWN = 25;\n  lines.push(\n    c(ANSI.bold, `Top findings (${Math.min(MAX_SHOWN, sorted.length)} of ${sorted.length}):`),\n  );\n\n  for (const f of sorted.slice(0, MAX_SHOWN)) {\n    const loc = `${f.location.file}:${f.location.line}${\n      f.location.column ? `:${f.location.column}` : \"\"\n    }`;\n    const tag = c(severityColor(f.severity), `[${f.severity}]`);\n    const hndl = f.hndl ? c(ANSI.red, \" (HNDL)\") : \"\";\n    lines.push(`  ${tag} ${f.title}${hndl}`);\n    lines.push(c(ANSI.dim, `      ${loc} — ${f.message}`));\n    if (f.remediation) lines.push(c(ANSI.cyan, `      → ${f.remediation}`));\n  }\n\n  if (sorted.length > MAX_SHOWN) {\n    lines.push(c(ANSI.dim, `  …and ${sorted.length - MAX_SHOWN} more.`));\n  }\n\n  lines.push(\"\");\n  if (inv.hndlCount > 0) {\n    lines.push(\n      c(\n        ANSI.yellow,\n        `Note: ${inv.hndlCount} finding(s) are exposed to \"harvest now, decrypt later\" — ` +\n          \"encrypted traffic captured today can be decrypted once a quantum computer exists. \" +\n          \"Prioritise migrating key exchange / encryption to hybrid PQC (X25519MLKEM768).\",\n      ),\n    );\n  }\n\n  if (options?.tier) {\n    lines.push(\"\", ...formatTierGuidance(inv.byAlgorithm, options.tier));\n  }\n\n  return lines.join(\"\\n\");\n}\n\n/**\n * Per-family migration targets for a CNSA security tier — surfaces the otherwise\n * library-only {@link remediationForTier} in human reports. Category 5 shows the\n * ML-KEM-1024 / ML-DSA-87 sets CNSA 2.0 mandates for national-security systems and\n * long-lived secrets. Returns plain (un-coloured) lines; the caller styles them.\n */\nexport function formatTierGuidance(\n  byAlgorithm: Record<string, number>,\n  tier: SecurityTier,\n): string[] {\n  const label = tier === \"category-5\" ? \"CNSA 2.0 (Category 5)\" : \"Category 3 (commercial)\";\n  const out: string[] = [`${label} migration targets:`];\n  const seen = new Set<string>();\n  for (const [k, n] of Object.entries(byAlgorithm)) {\n    if (n <= 0) continue;\n    const fam = k as AlgorithmFamily;\n    if (fam === \"unknown\" || !remediationFor(fam)) continue; // skip unmapped families\n    const rem = remediationForTier(fam, tier);\n    if (seen.has(rem.recommendation)) continue;\n    seen.add(rem.recommendation);\n    out.push(`  ${fam} → ${rem.recommendation}`);\n  }\n  if (tier === \"category-5\") {\n    out.push(\n      \"  CNSA 2.0 mandates ML-KEM-1024 / ML-DSA-87 for national-security systems and long-lived secrets (2030/2033 milestones).\",\n    );\n  }\n  return out;\n}\n"]}

package/dist/scan-worker.js.map

@@ -1 +1 @@
-{"version":3,"file":"scan-worker.js","sourceRoot":"","sources":["../src/scan-worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAG7D,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAenD,IAAI,UAAU,EAAE,CAAC;IACf,MAAM,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAgD,CAAC;IAC/E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,UAAU,CAAC;IAExB,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAiB,EAAE,EAAE;QACvC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAc,EAAE,CAAC;YAC/B,IAAI,YAAY,GAAG,CAAC,CAAC;YACrB,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,IAAI,eAAe,GAAG,CAAC,CAAC;YACxB,MAAM,YAAY,GAAa,EAAE,CAAC;YAElC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBAClD,IAAI,OAAe,CAAC;gBACpB,IAAI,CAAC;oBACH,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBACtC,CAAC;gBAAC,MAAM,CAAC;oBACP,UAAU,IAAI,CAAC,CAAC;oBAChB,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC5E,eAAe,IAAI,CAAC,CAAC;oBACrB,SAAS;gBACX,CAAC;gBACD,YAAY,IAAI,CAAC,CAAC;gBAClB,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACvB,QAAQ,CAAC,IAAI,CACX,GAAG,UAAU,CACX,GAAG,EACH,OAAO,EACP,IAAI,EACJ;oBACE,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,IAAI,EAAE,OAAO,CAAC,IAAI;iBACnB,EACD,OAAO,CAAC,aAAa,CACtB,CACF,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,WAAW,CAAC;gBACf,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,KAAK,EAAE,YAAY;gBACnB,MAAM,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE;aAChE,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,WAAW,CAAC;gBACf,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"scan-worker.js","sourceRoot":"","sources":["../src/scan-worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAG7D,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAenD,IAAI,UAAU,EAAE,CAAC;IACf,MAAM,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAgD,CAAC;IAC/E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,UAAU,CAAC;IAExB,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAiB,EAAE,EAAE;QACvC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAc,EAAE,CAAC;YAC/B,IAAI,YAAY,GAAG,CAAC,CAAC;YACrB,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,IAAI,eAAe,GAAG,CAAC,CAAC;YACxB,MAAM,YAAY,GAAa,EAAE,CAAC;YAElC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBAClD,IAAI,OAAe,CAAC;gBACpB,IAAI,CAAC;oBACH,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBACtC,CAAC;gBAAC,MAAM,CAAC;oBACP,UAAU,IAAI,CAAC,CAAC;oBAChB,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC5E,eAAe,IAAI,CAAC,CAAC;oBACrB,SAAS;gBACX,CAAC;gBACD,YAAY,IAAI,CAAC,CAAC;gBAClB,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACvB,QAAQ,CAAC,IAAI,CACX,GAAG,UAAU,CACX,GAAG,EACH,OAAO,EACP,IAAI,EACJ;oBACE,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,IAAI,EAAE,OAAO,CAAC,IAAI;iBACnB,EACD,OAAO,CAAC,aAAa,CACtB,CACF,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,WAAW,CAAC;gBACf,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,KAAK,EAAE,YAAY;gBACnB,MAAM,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE;aAChE,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,WAAW,CAAC;gBACf,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Worker-thread entry for {@link scanParallel}. Built to `dist/scan-worker.js`\n * and spawned by `parallel.ts`. Each worker reads its assigned files and runs\n * the SAME pure detector pipeline as the serial scan (`detectFile`), returning\n * `{ findings, filesScanned }` per chunk. No shared mutable state.\n *\n * This file performs side effects (wires up message handlers) only when it is\n * actually running inside a worker thread, so importing it from the main thread\n * (e.g. for coverage) is harmless.\n */\nimport { readFileSync } from \"node:fs\";\nimport * as path from \"node:path\";\nimport { parentPort, workerData } from \"node:worker_threads\";\n\nimport type { Finding } from \"./types.js\";\nimport { defaultRegistry } from \"./registry.js\";\nimport { detectFile } from \"./scan.js\";\nimport { looksMinified } from \"./walk.js\";\nimport { isManifestFile } from \"./dependencies.js\";\n\ninterface WorkerToggles {\n  source: boolean;\n  config: boolean;\n  deps: boolean;\n  scanMinified: boolean;\n  disabledRules?: string[];\n}\n\ninterface ChunkRequest {\n  index: number;\n  files: string[];\n}\n\nif (parentPort) {\n  const data = (workerData ?? {}) as { baseDir: string; toggles: WorkerToggles };\n  const baseDir = data.baseDir;\n  const toggles = data.toggles;\n  const dets = defaultRegistry.all();\n  const port = parentPort;\n\n  port.on(\"message\", (req: ChunkRequest) => {\n    try {\n      const findings: Finding[] = [];\n      let filesScanned = 0;\n      let unreadable = 0;\n      let skippedMinified = 0;\n      const scannedNames: string[] = [];\n\n      for (const rel of req.files) {\n        const abs = path.join(baseDir, ...rel.split(\"/\"));\n        let content: string;\n        try {\n          content = readFileSync(abs, \"utf8\");\n        } catch {\n          unreadable += 1;\n          continue;\n        }\n        if (!toggles.scanMinified && !isManifestFile(rel) && looksMinified(content)) {\n          skippedMinified += 1;\n          continue;\n        }\n        filesScanned += 1;\n        scannedNames.push(rel);\n        findings.push(\n          ...detectFile(\n            rel,\n            content,\n            dets,\n            {\n              source: toggles.source,\n              config: toggles.config,\n              deps: toggles.deps,\n            },\n            toggles.disabledRules,\n          ),\n        );\n      }\n\n      port.postMessage({\n        index: req.index,\n        files: scannedNames,\n        result: { findings, filesScanned, unreadable, skippedMinified },\n      });\n    } catch (err) {\n      port.postMessage({\n        index: req.index,\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n  });\n}\n"]}

package/dist/scan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAY7E;;;;;;GAMG;AACH,eAAO,MAAM,SAAS,EAAE,QAAQ,EAAqB,CAAC;AAEtD,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,MAAM,CAI9D;AAOD;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,QAAQ,EAAE,EACzB,OAAO,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,EAC5D,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,GAChC,OAAO,EAAE,CA6BX;AAED;;;;GAIG;AACH,wBAAsB,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CA0IpE;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,GAAG,SAAS,CAAC,GAChD,MAAM,EAAE,CAmBV"}
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAuB7E;;;;;;GAMG;AACH,eAAO,MAAM,SAAS,EAAE,QAAQ,EAAqB,CAAC;AAEtD,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,MAAM,CAI9D;AAOD;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,QAAQ,EAAE,EACzB,OAAO,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,EAC5D,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,GAChC,OAAO,EAAE,CA8BX;AAED;;;;GAIG;AACH,wBAAsB,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CA0IpE;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,GAAG,SAAS,CAAC,GAChD,MAAM,EAAE,CAmBV"}

package/dist/scan.js

@@ -13,7 +13,13 @@ import { readFile, stat } from "node:fs/promises";
 import * as path from "node:path";
 import { walkFiles, toPosix, isBinaryPath, looksMinified, matchesAny } from "./walk.js";
 import { isAnalyzableSource } from "./detect-utils.js";
-import { stripCommentFindings, stripIgnoredFindings } from "./comments.js";
+import { stripCommentFindings, stripIgnoredFindings, stripStringLiteralFindings, } from "./comments.js";
+/**
+ * Rules whose token is only meaningful as code, never inside a string literal.
+ * A match inside a string (e.g. `t.Error("SigningMethodPS256 …")`) is prose and
+ * is dropped. Rules that legitimately match quoted tokens are NOT listed here.
+ */
+const CODE_ONLY_RULES = new Set(["go-jwt-signingmethod"]);
 import { hashContent, loadCache, rulesetFingerprint, saveCache } from "./cache.js";
 import { builtinDetectors, defaultRegistry, detectorScope } from "./registry.js";
 import { isManifestFile, scanManifest } from "./dependencies.js";
@@ -60,6 +66,7 @@ export function detectFile(file, content, dets, toggles, disabledRules) {
     // `qscan-ignore-next-line` directives. Both run before the dependency scan
     // appends its findings (manifests carry neither).
     out = stripCommentFindings(out, content, file);
+    out = stripStringLiteralFindings(out, content, file, CODE_ONLY_RULES);
     out = stripIgnoredFindings(out, content);
     if (toggles.deps && isManifestFile(file)) {
         out.push(...scanManifest(file, content));

package/dist/scan.js.map

@@ -1 +1 @@
-{"version":3,"file":"scan.js","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEnF,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,SAAS,GAAe,gBAAgB,CAAC;AAEtD,8EAA8E;AAC9E,MAAM,UAAU,eAAe,CAAC,CAAU,EAAE,CAAU;IACpD,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;IAClF,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,sFAAsF;AACtF,SAAS,gBAAgB,CAAC,OAAoB;IAC5C,OAAO,OAAO,CAAC,SAAS,IAAI,eAAe,CAAC,GAAG,EAAE,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CACxB,IAAY,EACZ,OAAe,EACf,IAAyB,EACzB,OAA4D,EAC5D,aAAiC;IAEjC,IAAI,GAAG,GAAc,EAAE,CAAC;IAExB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC;QACjD,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM;YAAE,SAAS;QAC3D,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,2EAA2E;IAC3E,8DAA8D;IAC9D,2EAA2E;IAC3E,kDAAkD;IAClD,GAAG,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/C,GAAG,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAEzC,IAAI,OAAO,CAAC,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,8EAA8E;IAC9E,qEAAqE;IACrE,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;QACxC,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAoB;IAC7C,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAE7B,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;IAC1C,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC;IACnD,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAEvC,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACvE,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEvE,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,eAAe,GAAG,CAAC,CAAC;IAExB,0EAA0E;IAC1E,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACpC,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,yEAAyE;IACzE,6EAA6E;IAC7E,4EAA4E;IAC5E,sEAAsE;IACtE,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,WAAW,GAAmC,SAAS;QAC3D,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,CAAC,CAAC,IAAI,CAAC;IAET,8EAA8E;IAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAElC,+EAA+E;IAC/E,MAAM,QAAQ,GAA0B,OAAO,CAAC,KAAK;QACnD,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;QAC7C,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE;YACtB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,CAAC;IAEP,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QACjC,4EAA4E;QAC5E,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,UAAU,EAAE,CAAC;QAE5C,4DAA4D;QAC5D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,YAAY,IAAI,QAAQ,EAAE,CAAC;YAC7D,MAAM,IAAI,mBAAmB,CAAC,oCAAoC,QAAQ,IAAI,CAAC,CAAC;QAClF,CAAC;QAED,4EAA4E;QAC5E,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACtF,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAEzD,OAAO,CAAC,MAAM,EAAE,CAAC,YAAY,CAAC,CAAC;QAE/B,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,IAAI,CAAC,CAAC,CAAC,iEAAiE;YAClF,SAAS;QACX,CAAC;QAED,yEAAyE;QACzE,yEAAyE;QACzE,IAAI,CAAC,YAAY,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7E,eAAe,IAAI,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QAED,6EAA6E;QAC7E,YAAY,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,YAAY,GAAG,QAAQ,EAAE,CAAC;YAC5D,MAAM,IAAI,mBAAmB,CAAC,oCAAoC,QAAQ,IAAI,CAAC,CAAC;QAClF,CAAC;QAED,YAAY,IAAI,CAAC,CAAC;QAClB,IAAI,kBAAkB,CAAC,YAAY,CAAC;YAAE,aAAa,IAAI,CAAC,CAAC;QAEzD,4EAA4E;QAC5E,6EAA6E;QAC7E,IAAI,YAAuB,CAAC;QAC5B,IAAI,KAAK,IAAI,WAAW,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;YAClC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACpC,YAAY;gBACV,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI;oBACtB,CAAC,CAAC,GAAG,CAAC,QAAQ;oBACd,CAAC,CAAC,UAAU,CACR,YAAY,EACZ,OAAO,EACP,IAAI,EACJ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EACpD,OAAO,CAAC,aAAa,CACtB,CAAC;YACR,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QAClE,CAAC;aAAM,CAAC;YACN,YAAY,GAAG,UAAU,CACvB,YAAY,EACZ,OAAO,EACP,IAAI,EACJ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EACpD,OAAO,CAAC,aAAa,CACtB,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;IACjC,CAAC;IAED,6DAA6D;IAC7D,IAAI,SAAS,IAAI,WAAW;QAAE,MAAM,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IAE/E,oDAAoD;IACpD,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAE/B,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;IAE9B,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ;QACR,YAAY;QACZ,aAAa;QACb,WAAW,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE;QAC5C,SAAS;QACT,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;QAClC,UAAU,EAAE,UAAU,CAAC,WAAW,EAAE;QACpC,WAAW,EAAE,OAAO;KACrB,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAwB,EACxB,OAAiD;IAEjD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC;SACpB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACZ,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACzB,IAAI,YAAY,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACpC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAClE,IAAI,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,kFAAkF;AAClF,KAAK,SAAS,CAAC,CAAC,mBAAmB,CAAC,KAAe,EAAE,OAAoB;IACvE,KAAK,MAAM,GAAG,IAAI,sBAAsB,CAAC,KAAK,EAAE,OAAO,CAAC;QAAE,MAAM,GAAG,CAAC;AACtE,CAAC"}
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAEvB;;;;GAIG;AACH,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC;AAC/E,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEnF,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,SAAS,GAAe,gBAAgB,CAAC;AAEtD,8EAA8E;AAC9E,MAAM,UAAU,eAAe,CAAC,CAAU,EAAE,CAAU;IACpD,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;IAClF,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,sFAAsF;AACtF,SAAS,gBAAgB,CAAC,OAAoB;IAC5C,OAAO,OAAO,CAAC,SAAS,IAAI,eAAe,CAAC,GAAG,EAAE,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CACxB,IAAY,EACZ,OAAe,EACf,IAAyB,EACzB,OAA4D,EAC5D,aAAiC;IAEjC,IAAI,GAAG,GAAc,EAAE,CAAC;IAExB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC;QACjD,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM;YAAE,SAAS;QAC3D,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,2EAA2E;IAC3E,8DAA8D;IAC9D,2EAA2E;IAC3E,kDAAkD;IAClD,GAAG,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/C,GAAG,GAAG,0BAA0B,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;IACtE,GAAG,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAEzC,IAAI,OAAO,CAAC,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,8EAA8E;IAC9E,qEAAqE;IACrE,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;QACxC,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAoB;IAC7C,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAE7B,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;IAC1C,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC;IACnD,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAEvC,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACvE,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEvE,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,eAAe,GAAG,CAAC,CAAC;IAExB,0EAA0E;IAC1E,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACpC,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,yEAAyE;IACzE,6EAA6E;IAC7E,4EAA4E;IAC5E,sEAAsE;IACtE,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,WAAW,GAAmC,SAAS;QAC3D,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,CAAC,CAAC,IAAI,CAAC;IAET,8EAA8E;IAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAElC,+EAA+E;IAC/E,MAAM,QAAQ,GAA0B,OAAO,CAAC,KAAK;QACnD,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;QAC7C,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE;YACtB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,CAAC;IAEP,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QACjC,4EAA4E;QAC5E,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,UAAU,EAAE,CAAC;QAE5C,4DAA4D;QAC5D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,YAAY,IAAI,QAAQ,EAAE,CAAC;YAC7D,MAAM,IAAI,mBAAmB,CAAC,oCAAoC,QAAQ,IAAI,CAAC,CAAC;QAClF,CAAC;QAED,4EAA4E;QAC5E,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACtF,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAEzD,OAAO,CAAC,MAAM,EAAE,CAAC,YAAY,CAAC,CAAC;QAE/B,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,IAAI,CAAC,CAAC,CAAC,iEAAiE;YAClF,SAAS;QACX,CAAC;QAED,yEAAyE;QACzE,yEAAyE;QACzE,IAAI,CAAC,YAAY,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7E,eAAe,IAAI,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QAED,6EAA6E;QAC7E,YAAY,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,YAAY,GAAG,QAAQ,EAAE,CAAC;YAC5D,MAAM,IAAI,mBAAmB,CAAC,oCAAoC,QAAQ,IAAI,CAAC,CAAC;QAClF,CAAC;QAED,YAAY,IAAI,CAAC,CAAC;QAClB,IAAI,kBAAkB,CAAC,YAAY,CAAC;YAAE,aAAa,IAAI,CAAC,CAAC;QAEzD,4EAA4E;QAC5E,6EAA6E;QAC7E,IAAI,YAAuB,CAAC;QAC5B,IAAI,KAAK,IAAI,WAAW,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;YAClC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACpC,YAAY;gBACV,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI;oBACtB,CAAC,CAAC,GAAG,CAAC,QAAQ;oBACd,CAAC,CAAC,UAAU,CACR,YAAY,EACZ,OAAO,EACP,IAAI,EACJ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EACpD,OAAO,CAAC,aAAa,CACtB,CAAC;YACR,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QAClE,CAAC;aAAM,CAAC;YACN,YAAY,GAAG,UAAU,CACvB,YAAY,EACZ,OAAO,EACP,IAAI,EACJ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EACpD,OAAO,CAAC,aAAa,CACtB,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;IACjC,CAAC;IAED,6DAA6D;IAC7D,IAAI,SAAS,IAAI,WAAW;QAAE,MAAM,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IAE/E,oDAAoD;IACpD,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAE/B,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;IAE9B,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ;QACR,YAAY;QACZ,aAAa;QACb,WAAW,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE;QAC5C,SAAS;QACT,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;QAClC,UAAU,EAAE,UAAU,CAAC,WAAW,EAAE;QACpC,WAAW,EAAE,OAAO;KACrB,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAwB,EACxB,OAAiD;IAEjD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC;SACpB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACZ,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACzB,IAAI,YAAY,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACpC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAClE,IAAI,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,kFAAkF;AAClF,KAAK,SAAS,CAAC,CAAC,mBAAmB,CAAC,KAAe,EAAE,OAAoB;IACvE,KAAK,MAAM,GAAG,IAAI,sBAAsB,CAAC,KAAK,EAAE,OAAO,CAAC;QAAE,MAAM,GAAG,CAAC;AACtE,CAAC","sourcesContent":["/**\n * Scan orchestrator. Walks the target (or an explicit file list), runs the\n * applicable detectors over each file, parses dependency manifests, aggregates\n * everything into an inventory, and returns a {@link ScanResult} with timing and\n * the tool version.\n *\n * Detector scope (source vs config) is driven by each {@link Detector}'s\n * declared `scope` (defaulting to \"source\"), not by ruleId prefixes. The\n * detector set comes from {@link defaultRegistry} unless overridden via\n * `options.detectors`.\n */\nimport { readFile, stat } from \"node:fs/promises\";\nimport * as path from \"node:path\";\n\nimport type { Detector, Finding, ScanOptions, ScanResult } from \"./types.js\";\nimport { walkFiles, toPosix, isBinaryPath, looksMinified, matchesAny } from \"./walk.js\";\nimport { isAnalyzableSource } from \"./detect-utils.js\";\nimport {\n  stripCommentFindings,\n  stripIgnoredFindings,\n  stripStringLiteralFindings,\n} from \"./comments.js\";\n\n/**\n * Rules whose token is only meaningful as code, never inside a string literal.\n * A match inside a string (e.g. `t.Error(\"SigningMethodPS256 …\")`) is prose and\n * is dropped. Rules that legitimately match quoted tokens are NOT listed here.\n */\nconst CODE_ONLY_RULES: ReadonlySet<string> = new Set([\"go-jwt-signingmethod\"]);\nimport { hashContent, loadCache, rulesetFingerprint, saveCache } from \"./cache.js\";\nimport type { CacheEntry } from \"./cache.js\";\nimport { builtinDetectors, defaultRegistry, detectorScope } from \"./registry.js\";\nimport { isManifestFile, scanManifest } from \"./dependencies.js\";\nimport { buildInventory } from \"./inventory.js\";\nimport { AbortError, BudgetExceededError } from \"./errors.js\";\nimport { VERSION } from \"./version.js\";\n\n/**\n * The full set of built-in detectors exposed on the public API. Re-exported\n * from {@link builtinDetectors} in `registry.ts` — the single source of truth\n * the {@link defaultRegistry} is also built from — so the public array and the\n * registry can never drift apart. The manifest scanner is handled separately\n * (it parses JSON rather than running a Detector).\n */\nexport const detectors: Detector[] = builtinDetectors;\n\n/** Stable comparator: by file, then line, then ruleId. Exported for reuse. */\nexport function compareFindings(a: Finding, b: Finding): number {\n  if (a.location.file !== b.location.file) return a.location.file < b.location.file ? -1 : 1;\n  if (a.location.line !== b.location.line) return a.location.line - b.location.line;\n  return a.ruleId < b.ruleId ? -1 : a.ruleId > b.ruleId ? 1 : 0;\n}\n\n/** Resolve the active detector list for a scan (override or the default registry). */\nfunction resolveDetectors(options: ScanOptions): Detector[] {\n  return options.detectors ?? defaultRegistry.all();\n}\n\n/**\n * Run all applicable detectors + the manifest scanner over a single file's\n * contents, honouring the source / config / dependencies toggles. Pure: no I/O.\n * Exported so the parallel worker and unit tests can drive it directly.\n */\nexport function detectFile(\n  file: string,\n  content: string,\n  dets: readonly Detector[],\n  toggles: { source: boolean; config: boolean; deps: boolean },\n  disabledRules?: readonly string[],\n): Finding[] {\n  let out: Finding[] = [];\n\n  for (const det of dets) {\n    if (!det.appliesTo(file)) continue;\n    const isConfig = detectorScope(det) === \"config\";\n    if (isConfig ? !toggles.config : !toggles.source) continue;\n    out.push(...det.detect({ file, content }));\n  }\n\n  // Drop lexical false positives that land inside comments (`// migrated off\n  // createECDH()`), then honour inline `// qscan-ignore-line` /\n  // `qscan-ignore-next-line` directives. Both run before the dependency scan\n  // appends its findings (manifests carry neither).\n  out = stripCommentFindings(out, content, file);\n  out = stripStringLiteralFindings(out, content, file, CODE_ONLY_RULES);\n  out = stripIgnoredFindings(out, content);\n\n  if (toggles.deps && isManifestFile(file)) {\n    out.push(...scanManifest(file, content));\n  }\n\n  // Per-rule suppression: drop findings whose ruleId was disabled. Applied here\n  // so both the serial scan and the worker path honour it identically.\n  if (disabledRules && disabledRules.length > 0) {\n    const disabled = new Set(disabledRules);\n    return out.filter((f) => !disabled.has(f.ruleId));\n  }\n\n  return out;\n}\n\n/**\n * Recursively scan a directory (or single file, or explicit file list) for\n * classical asymmetric crypto. Honours the source / dependencies / config\n * toggles (all default true) and reports progress through `options.onFile`.\n */\nexport async function scan(options: ScanOptions): Promise<ScanResult> {\n  const startedAt = new Date();\n\n  const doSource = options.source !== false;\n  const doDeps = options.dependencies !== false;\n  const doConfig = options.config !== false;\n  const scanMinified = options.scanMinified === true;\n  const dets = resolveDetectors(options);\n\n  // Resolve whether the root is a file so we can rebuild absolute paths to read.\n  const rootStat = await stat(options.root);\n  const rootIsFile = rootStat.isFile();\n  const baseDir = rootIsFile ? path.dirname(options.root) : options.root;\n  const singleFileName = rootIsFile ? path.basename(options.root) : null;\n\n  const findings: Finding[] = [];\n  let filesScanned = 0;\n  let analyzedFiles = 0;\n  let bytesScanned = 0;\n  let unreadable = 0;\n  let skippedMinified = 0;\n\n  // Optional content-hash scan cache: unchanged files reuse prior findings.\n  const cacheFile = options.cacheFile;\n  const ruleset = cacheFile ? rulesetFingerprint(dets, options.disabledRules) : \"\";\n  const cache = cacheFile ? await loadCache(cacheFile, ruleset) : null;\n  // A full scan starts with an empty next-cache so files that vanished are\n  // evicted. An INCREMENTAL scan (explicit `files` list) only visits a subset,\n  // so seed the next-cache with the existing entries — otherwise saving would\n  // drop every file we didn't happen to scan this run (audit: arch #4).\n  const incremental = Array.isArray(options.files);\n  const nextEntries: Map<string, CacheEntry> | null = cacheFile\n    ? new Map(incremental && cache ? cache : [])\n    : null;\n\n  // Work-budget / cancellation controls (all optional, unlimited when omitted).\n  const signal = options.signal;\n  const maxFiles = options.maxFiles;\n  const maxBytes = options.maxBytes;\n\n  // Source of relative paths: an explicit file list (incremental) or the walker.\n  const relPaths: AsyncIterable<string> = options.files\n    ? filterExplicitFiles(options.files, options)\n    : walkFiles(options.root, {\n        include: options.include,\n        exclude: options.exclude,\n        noDefaultIgnores: options.noDefaultIgnores,\n        maxFileSize: options.maxFileSize,\n      });\n\n  for await (const rel of relPaths) {\n    // Cooperative cancellation: check the signal at the top of every iteration.\n    if (signal?.aborted) throw new AbortError();\n\n    // File-count budget: enforced before reading the next file.\n    if (typeof maxFiles === \"number\" && filesScanned >= maxFiles) {\n      throw new BudgetExceededError(`maxFiles budget exceeded (limit: ${maxFiles}).`);\n    }\n\n    // In single-file mode, walkFiles yields the basename; map back to the file.\n    const absPath = singleFileName ? options.root : path.join(baseDir, ...rel.split(\"/\"));\n    const reportedPath = singleFileName ? toPosix(rel) : rel;\n\n    options.onFile?.(reportedPath);\n\n    let content: string;\n    try {\n      content = await readFile(absPath, \"utf8\");\n    } catch {\n      unreadable += 1; // permissions / vanished / decode failure — tracked, not silent.\n      continue;\n    }\n\n    // Skip machine-minified / generated content (unless explicitly enabled).\n    // Manifests are always scanned (their findings are dependency findings).\n    if (!scanMinified && !isManifestFile(reportedPath) && looksMinified(content)) {\n      skippedMinified += 1;\n      continue;\n    }\n\n    // Cumulative-byte budget: enforced once this file's bytes are accounted for.\n    bytesScanned += Buffer.byteLength(content, \"utf8\");\n    if (typeof maxBytes === \"number\" && bytesScanned > maxBytes) {\n      throw new BudgetExceededError(`maxBytes budget exceeded (limit: ${maxBytes}).`);\n    }\n\n    filesScanned += 1;\n    if (isAnalyzableSource(reportedPath)) analyzedFiles += 1;\n\n    // Cache: reuse prior findings when the content hash matches; otherwise scan\n    // and record. `nextEntries` becomes the new cache (dropping vanished files).\n    let fileFindings: Finding[];\n    if (cache && nextEntries) {\n      const hash = hashContent(content);\n      const hit = cache.get(reportedPath);\n      fileFindings =\n        hit && hit.hash === hash\n          ? hit.findings\n          : detectFile(\n              reportedPath,\n              content,\n              dets,\n              { source: doSource, config: doConfig, deps: doDeps },\n              options.disabledRules,\n            );\n      nextEntries.set(reportedPath, { hash, findings: fileFindings });\n    } else {\n      fileFindings = detectFile(\n        reportedPath,\n        content,\n        dets,\n        { source: doSource, config: doConfig, deps: doDeps },\n        options.disabledRules,\n      );\n    }\n    findings.push(...fileFindings);\n  }\n\n  // Persist the cache (best effort) before ordering/returning.\n  if (cacheFile && nextEntries) await saveCache(cacheFile, ruleset, nextEntries);\n\n  // Stable ordering: by file, then line, then ruleId.\n  findings.sort(compareFindings);\n\n  const inventory = buildInventory(findings);\n  const finishedAt = new Date();\n\n  return {\n    root: options.root,\n    findings,\n    filesScanned,\n    analyzedFiles,\n    diagnostics: { unreadable, skippedMinified },\n    inventory,\n    startedAt: startedAt.toISOString(),\n    finishedAt: finishedAt.toISOString(),\n    toolVersion: VERSION,\n  };\n}\n\n/**\n * Filter an explicit relative file list down to the paths that pass the binary\n * filter and the include/exclude patterns, returning them deduped and sorted for\n * deterministic output. Size limits are enforced later (we still read manifests\n * over the cap). Non-existent files are simply skipped at read time.\n *\n * Pure + synchronous, and exported so the parallel enumerator applies the EXACT\n * same filtering for explicit file lists as the serial path (byte-for-byte\n * identical results under `--parallel`).\n */\nexport function filterExplicitFileList(\n  files: readonly string[],\n  options: Pick<ScanOptions, \"include\" | \"exclude\">,\n): string[] {\n  const include = options.include ?? [];\n  const exclude = options.exclude ?? [];\n  const seen = new Set<string>();\n  const list = [...files]\n    .map((f) => toPosix(f))\n    .filter((f) => {\n      if (seen.has(f)) return false;\n      seen.add(f);\n      return true;\n    })\n    .sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));\n\n  return list.filter((rel) => {\n    if (isBinaryPath(rel)) return false;\n    if (include.length > 0 && !matchesAny(rel, include)) return false;\n    if (matchesAny(rel, exclude)) return false;\n    return true;\n  });\n}\n\n/** Async-generator wrapper around {@link filterExplicitFileList} for `scan()`. */\nasync function* filterExplicitFiles(files: string[], options: ScanOptions): AsyncGenerator<string> {\n  for (const rel of filterExplicitFileList(files, options)) yield rel;\n}\n"]}

package/dist/severity.js.map

@@ -1 +1 @@
-{"version":3,"file":"severity.js","sourceRoot":"","sources":["../src/severity.ts"],"names":[],"mappings":"AAQA,0EAA0E;AAC1E,MAAM,CAAC,MAAM,cAAc,GAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAEjG;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,CAAW;IACtC,MAAM,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACpC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,QAAkB,EAAE,SAAmB;IACpE,OAAO,YAAY,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC,SAAS,CAAC,CAAC;AAC3D,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,UAAU,CAAC,QAAkB;IAC3C,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,OAAO,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,SAAS,CAAC;QACnB;YACE,OAAO,MAAM,CAAC;IAClB,CAAC;AACH,CAAC"}
+{"version":3,"file":"severity.js","sourceRoot":"","sources":["../src/severity.ts"],"names":[],"mappings":"AAQA,0EAA0E;AAC1E,MAAM,CAAC,MAAM,cAAc,GAAwB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAEjG;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,CAAW;IACtC,MAAM,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACpC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,QAAkB,EAAE,SAAmB;IACpE,OAAO,YAAY,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAC,SAAS,CAAC,CAAC;AAC3D,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,UAAU,CAAC,QAAkB;IAC3C,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,OAAO,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,SAAS,CAAC;QACnB;YACE,OAAO,MAAM,CAAC;IAClB,CAAC;AACH,CAAC","sourcesContent":["/**\n * Severity utilities shared across the monorepo (qScan, the MCP server, the\n * GitHub Action). Lifts the previously-duplicated ordering / threshold / SARIF\n * mapping logic into one place so every consumer agrees on what \"at or above a\n * threshold\" means and how a severity maps to a SARIF level.\n */\nimport type { Severity } from \"./types.js\";\n\n/** Severity ordering, most → least severe. Index 0 is the most severe. */\nexport const SEVERITY_ORDER: readonly Severity[] = [\"critical\", \"high\", \"medium\", \"low\", \"info\"];\n\n/**\n * Rank of a severity within {@link SEVERITY_ORDER} (0 = most severe). Lower\n * ranks are more severe; unknown values fall to the end.\n */\nexport function severityRank(s: Severity): number {\n  const i = SEVERITY_ORDER.indexOf(s);\n  return i < 0 ? SEVERITY_ORDER.length : i;\n}\n\n/**\n * True when `severity` is at or above `threshold` (i.e. at least as severe).\n * Because lower ranks are more severe, \"at or above\" is `rank <= threshold`.\n */\nexport function meetsThreshold(severity: Severity, threshold: Severity): boolean {\n  return severityRank(severity) <= severityRank(threshold);\n}\n\n/** Map our severity to a SARIF 2.1.0 result level. */\nexport function sarifLevel(severity: Severity): \"error\" | \"warning\" | \"note\" {\n  switch (severity) {\n    case \"critical\":\n    case \"high\":\n      return \"error\";\n    case \"medium\":\n      return \"warning\";\n    default:\n      return \"note\";\n  }\n}\n"]}

package/dist/triage.js.map

@@ -1 +1 @@
-{"version":3,"file":"triage.js","sourceRoot":"","sources":["../src/triage.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,qEAAqE;AACrE,MAAM,CAAC,MAAM,aAAa,GACxB,kFAAkF;IAClF,8EAA8E;IAC9E,kFAAkF;IAClF,8EAA8E;IAC9E,kFAAkF;IAClF,oFAAoF;IACpF,kFAAkF;IAClF,mFAAmF;IACnF,qEAAqE,CAAC;AAExE,qDAAqD;AACrD,MAAM,CAAC,MAAM,qBAAqB,GAA4B;IAC5D,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,CAAC,eAAe,EAAE,UAAU,EAAE,WAAW,CAAC;IACpD,UAAU,EAAE;QACV,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE;QAC3D,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAC5C,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KAC9B;CACF,CAAC;AASF;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAA4B,EAC5B,QAAsB,UAAU,EAChC,WAA0C;IAE1C,MAAM,cAAc,GAAiB,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;IACtE,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAClC,YAAY,CAAC,CAAC,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CACnE,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,qBAAqB,EAAE,QAAQ,EAAE,CAAC;AAC5E,CAAC"}
+{"version":3,"file":"triage.js","sourceRoot":"","sources":["../src/triage.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,qEAAqE;AACrE,MAAM,CAAC,MAAM,aAAa,GACxB,kFAAkF;IAClF,8EAA8E;IAC9E,kFAAkF;IAClF,8EAA8E;IAC9E,kFAAkF;IAClF,oFAAoF;IACpF,kFAAkF;IAClF,mFAAmF;IACnF,qEAAqE,CAAC;AAExE,qDAAqD;AACrD,MAAM,CAAC,MAAM,qBAAqB,GAA4B;IAC5D,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,CAAC,eAAe,EAAE,UAAU,EAAE,WAAW,CAAC;IACpD,UAAU,EAAE;QACV,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE;QAC3D,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAC5C,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KAC9B;CACF,CAAC;AASF;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAA4B,EAC5B,QAAsB,UAAU,EAChC,WAA0C;IAE1C,MAAM,cAAc,GAAiB,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC;IACtE,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAClC,YAAY,CAAC,CAAC,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CACnE,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,qBAAqB,EAAE,QAAQ,EAAE,CAAC;AAC5E,CAAC","sourcesContent":["/**\n * Triage rubric, verdict schema, and request-bundle builder — all offline and\n * deterministic. Both planes share them: `@quantakrypto/agent` (networked)\n * prompts a model with the rubric, while the MCP `triage_findings` tool emits a\n * request bundle for the HOST agent to reason over. Keeping them here means the\n * MCP server never imports the networked package and both sides use one rubric.\n */\nimport type { Finding } from \"./types.js\";\nimport type { ContextLevel, RedactedContext } from \"./agent-types.js\";\nimport { buildContext } from \"./redact.js\";\n\n/** The system rubric that defines what an exposure verdict means. */\nexport const TRIAGE_RUBRIC =\n  \"You are a post-quantum cryptography triage assistant. You are given ONE finding \" +\n  \"of classical (quantum-vulnerable) cryptography detected in a codebase, with \" +\n  \"limited, possibly-redacted context. Assess its REAL-WORLD exposure and urgency. \" +\n  \"exposureScore (0-100): how exploitable/exposed this usage is — a long-lived \" +\n  \"confidentiality key over the network (harvest-now-decrypt-later) scores high; a \" +\n  \"short-lived local signature scores lower. priority: 'now' for HNDL/high-exposure, \" +\n  \"'soon' for important-but-not-urgent, 'later' for low-exposure. You NEVER decide \" +\n  \"whether the finding is valid and you NEVER suppress it — you only rank exposure. \" +\n  \"Base your rationale only on the given context; do not invent facts.\";\n\n/** JSON Schema every triage verdict must satisfy. */\nexport const TRIAGE_VERDICT_SCHEMA: Record<string, unknown> = {\n  type: \"object\",\n  required: [\"exposureScore\", \"priority\", \"rationale\"],\n  properties: {\n    exposureScore: { type: \"number\", minimum: 0, maximum: 100 },\n    priority: { enum: [\"now\", \"soon\", \"later\"] },\n    rationale: { type: \"string\" },\n  },\n};\n\n/** A triage request bundle: the rubric, the verdict schema, and redacted contexts. */\nexport interface TriageRequest {\n  rubric: string;\n  schema: Record<string, unknown>;\n  contexts: RedactedContext[];\n}\n\n/**\n * Build a triage request bundle for a set of findings. Offline: for non-metadata\n * levels, pass `readContent` to supply each finding's file text; without it,\n * contexts are built at `metadata` level (no source), which is the safe default\n * for the MCP plane where the host agent already has the code open.\n */\nexport function buildTriageRequest(\n  findings: readonly Finding[],\n  level: ContextLevel = \"metadata\",\n  readContent?: (finding: Finding) => string,\n): TriageRequest {\n  const effectiveLevel: ContextLevel = readContent ? level : \"metadata\";\n  const contexts = findings.map((f) =>\n    buildContext(f, effectiveLevel, readContent ? readContent(f) : \"\"),\n  );\n  return { rubric: TRIAGE_RUBRIC, schema: TRIAGE_VERDICT_SCHEMA, contexts };\n}\n"]}

package/dist/types.d.ts

@@ -68,7 +68,7 @@ export interface Finding {
     location: SourceLocation;
 }
 /** Package ecosystems the dependency scanner understands. */
-export type DependencyEcosystem = "npm" | "pypi" | "cargo" | "go" | "maven" | "rubygems";
+export type DependencyEcosystem = "npm" | "pypi" | "cargo" | "go" | "maven" | "rubygems" | "nuget";
 /** A known quantum-vulnerable dependency entry. */
 export interface VulnerableDependency {
     /** Package name (as written in the ecosystem's manifest). */

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,6DAA6D;AAC7D,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAEvE,gFAAgF;AAChF,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEnD,+DAA+D;AAC/D,MAAM,MAAM,eAAe,GACvB,KAAK,GACL,cAAc,GACd,WAAW,GACX,KAAK,GACL,aAAa,GACb,YAAY,GACZ,MAAM,GACN,KAAK,CAAC;AAEV,yEAAyE;AACzE,MAAM,MAAM,eAAe,GACvB,KAAK,GACL,MAAM,GACN,OAAO,GACP,OAAO,GACP,IAAI,GACJ,KAAK,GACL,QAAQ,GACR,MAAM,GACN,OAAO,GACP,SAAS,CAAC;AAEd,gDAAgD;AAChD,MAAM,WAAW,cAAc;IAC7B,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,gEAAgE;AAChE,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC;AAEtD;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,yDAAyD;IACzD,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,cAAc,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,iCAAiC;AACjC,MAAM,WAAW,OAAO;IACtB,uGAAuG;IACvG,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,QAAQ,CAAC;IACnB,UAAU,EAAE,UAAU,CAAC;IACvB,yDAAyD;IACzD,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,iEAAiE;IACjE,IAAI,EAAE,OAAO,CAAC;IACd,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,kFAAkF;IAClF,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAED,6DAA6D;AAC7D,MAAM,MAAM,mBAAmB,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,OAAO,GAAG,UAAU,CAAC;AAEzF,mDAAmD;AACnD,MAAM,WAAW,oBAAoB;IACnC,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,mBAAmB,CAAC;IAC/B,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,QAAQ,EAAE,QAAQ,CAAC;IACnB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEhD;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GACxB,IAAI,GACJ,QAAQ,GACR,IAAI,GACJ,MAAM,GACN,QAAQ,GACR,MAAM,GACN,MAAM,GACN,GAAG,GACH,KAAK,CAAC;AAEV;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,QAAQ;IACvB,kFAAkF;IAClF,EAAE,EAAE,MAAM,CAAC;IACX,6BAA6B;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,QAAQ,CAAC;IACnB,oDAAoD;IACpD,UAAU,EAAE,UAAU,CAAC;IACvB,0CAA0C;IAC1C,IAAI,EAAE,OAAO,CAAC;IACd,qFAAqF;IACrF,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,kDAAkD;IAClD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,qEAAqE;AACrE,MAAM,WAAW,QAAQ;IACvB,0DAA0D;IAC1D,EAAE,EAAE,MAAM,CAAC;IACX,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B;;;;;OAKG;IACH,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IACnB,oEAAoE;IACpE,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IACrC,yEAAyE;IACzE,MAAM,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,aAAa;IAC5B,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,kCAAkC;AAClC,MAAM,WAAW,WAAW;IAC1B,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,gEAAgE;IAChE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,mFAAmF;IACnF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;OAGG;IACH,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;IACvB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kCAAkC;IAClC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC;;;;OAIG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,gFAAgF;AAChF,MAAM,WAAW,mBAAoB,SAAQ,WAAW;IACtD;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,kFAAkF;IAClF,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,yDAAyD;AACzD,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrC,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,6FAA6F;IAC7F,UAAU,EAAE,MAAM,CAAC;IACnB,0GAA0G;IAC1G,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,iCAAiC;AACjC,MAAM,WAAW,UAAU;IACzB,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,eAAe,CAAC;IAC3B,sBAAsB;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,iDAAiD;AACjD,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;AAEtD,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,eAAe,CAAC;IAC3B,gFAAgF;IAChF,cAAc,EAAE,MAAM,CAAC;IACvB,wBAAwB;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,6DAA6D;AAC7D,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAEvE,gFAAgF;AAChF,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEnD,+DAA+D;AAC/D,MAAM,MAAM,eAAe,GACvB,KAAK,GACL,cAAc,GACd,WAAW,GACX,KAAK,GACL,aAAa,GACb,YAAY,GACZ,MAAM,GACN,KAAK,CAAC;AAEV,yEAAyE;AACzE,MAAM,MAAM,eAAe,GACvB,KAAK,GACL,MAAM,GACN,OAAO,GACP,OAAO,GACP,IAAI,GACJ,KAAK,GACL,QAAQ,GACR,MAAM,GACN,OAAO,GACP,SAAS,CAAC;AAEd,gDAAgD;AAChD,MAAM,WAAW,cAAc;IAC7B,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,gEAAgE;AAChE,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC;AAEtD;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,yDAAyD;IACzD,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,cAAc,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,iCAAiC;AACjC,MAAM,WAAW,OAAO;IACtB,uGAAuG;IACvG,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,QAAQ,CAAC;IACnB,UAAU,EAAE,UAAU,CAAC;IACvB,yDAAyD;IACzD,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,iEAAiE;IACjE,IAAI,EAAE,OAAO,CAAC;IACd,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,kFAAkF;IAClF,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAED,6DAA6D;AAC7D,MAAM,MAAM,mBAAmB,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,CAAC;AAEnG,mDAAmD;AACnD,MAAM,WAAW,oBAAoB;IACnC,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,mBAAmB,CAAC;IAC/B,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,QAAQ,EAAE,QAAQ,CAAC;IACnB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEhD;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GACxB,IAAI,GACJ,QAAQ,GACR,IAAI,GACJ,MAAM,GACN,QAAQ,GACR,MAAM,GACN,MAAM,GACN,GAAG,GACH,KAAK,CAAC;AAEV;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,QAAQ;IACvB,kFAAkF;IAClF,EAAE,EAAE,MAAM,CAAC;IACX,6BAA6B;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,QAAQ,CAAC;IACnB,oDAAoD;IACpD,UAAU,EAAE,UAAU,CAAC;IACvB,0CAA0C;IAC1C,IAAI,EAAE,OAAO,CAAC;IACd,qFAAqF;IACrF,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,kDAAkD;IAClD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,qEAAqE;AACrE,MAAM,WAAW,QAAQ;IACvB,0DAA0D;IAC1D,EAAE,EAAE,MAAM,CAAC;IACX,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B;;;;;OAKG;IACH,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IACnB,oEAAoE;IACpE,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IACrC,yEAAyE;IACzE,MAAM,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,aAAa;IAC5B,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,kCAAkC;AAClC,MAAM,WAAW,WAAW;IAC1B,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,gEAAgE;IAChE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,mFAAmF;IACnF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;OAGG;IACH,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;IACvB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kCAAkC;IAClC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC;;;;OAIG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,gFAAgF;AAChF,MAAM,WAAW,mBAAoB,SAAQ,WAAW;IACtD;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,kFAAkF;IAClF,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,yDAAyD;AACzD,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrC,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,6FAA6F;IAC7F,UAAU,EAAE,MAAM,CAAC;IACnB,0GAA0G;IAC1G,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,iCAAiC;AACjC,MAAM,WAAW,UAAU;IACzB,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,eAAe,CAAC;IAC3B,sBAAsB;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,iDAAiD;AACjD,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;AAEtD,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,eAAe,CAAC;IAC3B,gFAAgF;IAChF,cAAc,EAAE,MAAM,CAAC;IACvB,wBAAwB;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB"}

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG","sourcesContent":["/**\n * @quantakrypto/core — shared types (the locked public contract).\n *\n * These types are the stable interface between every tool in the monorepo\n * (qScan, the MCP server, the GitHub Action). Treat additions as backwards\n * compatible; treat renames/removals as breaking.\n */\n\n/** How serious a finding is, ordered most → least severe. */\nexport type Severity = \"critical\" | \"high\" | \"medium\" | \"low\" | \"info\";\n\n/** How sure the detector is that the finding is a real use of the algorithm. */\nexport type Confidence = \"high\" | \"medium\" | \"low\";\n\n/** What kind of cryptographic concern a finding represents. */\nexport type FindingCategory =\n  | \"kem\" // key encapsulation / public-key encryption (e.g. RSA-OAEP)\n  | \"key-exchange\" // (EC)DH\n  | \"signature\" // RSA/ECDSA/EdDSA signing\n  | \"tls\" // transport configuration\n  | \"certificate\" // X.509 / PKI material\n  | \"dependency\" // a quantum-vulnerable library in the dependency tree\n  | \"hash\" // weak / pre-quantum hash usage\n  | \"rng\"; // randomness concerns\n\n/** Classical asymmetric algorithm families that are not quantum-safe. */\nexport type AlgorithmFamily =\n  | \"RSA\"\n  | \"ECDH\"\n  | \"ECDSA\"\n  | \"EdDSA\"\n  | \"DH\"\n  | \"DSA\"\n  | \"X25519\"\n  | \"X448\"\n  | \"ECIES\"\n  | \"unknown\";\n\n/** A precise location inside a scanned file. */\nexport interface SourceLocation {\n  /** Path relative to the scan root, using POSIX separators. */\n  file: string;\n  /** 1-based line number. */\n  line: number;\n  /** 1-based column number, if known. */\n  column?: number;\n  /** 1-based end line, for multi-line matches. */\n  endLine?: number;\n  /** The matched source text (trimmed, single line). */\n  snippet?: string;\n}\n\n/** Relative urgency an LLM triage pass assigns to a finding. */\nexport type TriagePriority = \"now\" | \"soon\" | \"later\";\n\n/**\n * Optional LLM triage annotation attached to a finding by `qscan --triage`.\n * Purely additive: it re-ranks and explains, it never suppresses a finding and\n * never influences the exit code (which is computed from `severity` alone).\n */\nexport interface TriageAnnotation {\n  /** 0–100 real-world exposure/exploitability estimate. */\n  exposureScore: number;\n  priority: TriagePriority;\n  rationale: string;\n}\n\n/** A single detected concern. */\nexport interface Finding {\n  /** Stable rule identifier, e.g. \"rsa-keygen\", \"ecdh-usage\", \"tls-legacy-version\", \"dep-vulnerable\". */\n  ruleId: string;\n  title: string;\n  category: FindingCategory;\n  severity: Severity;\n  confidence: Confidence;\n  /** The classical algorithm involved, when applicable. */\n  algorithm?: AlgorithmFamily;\n  /** True when this is exposed to \"harvest now, decrypt later\". */\n  hndl: boolean;\n  /** One-line human explanation of the concern. */\n  message: string;\n  /** Suggested post-quantum remediation (e.g. ML-KEM, hybrid X25519MLKEM768). */\n  remediation?: string;\n  /** Associated CWE identifier, e.g. \"CWE-327\" (broken crypto), \"CWE-326\" (weak strength). */\n  cwe?: string;\n  /**\n   * True when the matched snippet IS the sensitive value (e.g. a PEM private/\n   * public key block, an `ssh-rsa AAAA…` public key). Reporters ALWAYS drop the\n   * snippet for such findings, regardless of any redaction flag.\n   */\n  sensitive?: boolean;\n  /** Optional LLM triage annotation (`qscan --triage`); never affects exit code. */\n  triage?: TriageAnnotation;\n  location: SourceLocation;\n}\n\n/** Package ecosystems the dependency scanner understands. */\nexport type DependencyEcosystem = \"npm\" | \"pypi\" | \"cargo\" | \"go\" | \"maven\" | \"rubygems\" | \"nuget\";\n\n/** A known quantum-vulnerable dependency entry. */\nexport interface VulnerableDependency {\n  /** Package name (as written in the ecosystem's manifest). */\n  name: string;\n  ecosystem: DependencyEcosystem;\n  /** Why it's flagged (what classical crypto it provides). */\n  reason: string;\n  /** Algorithm families the package primarily exposes. */\n  algorithms: AlgorithmFamily[];\n  severity: Severity;\n  /**\n   * Explicit harvest-now-decrypt-later override. When omitted, HNDL is inferred\n   * from whether any listed family is a confidentiality family. Set `false` for\n   * signing-only packages (e.g. JWS/JWT libraries) that list RSA/EC as families\n   * but never do key transport or key agreement — signatures are not HNDL-exposed.\n   */\n  hndl?: boolean;\n}\n\n/**\n * Which logical scope a detector belongs to. Drives the source/config scope\n * toggles in {@link ScanOptions} (replacing the old ruleId-prefix inference).\n */\nexport type DetectorScope = \"source\" | \"config\";\n\n/**\n * The programming language / surface a detector targets. `\"any\"` means the\n * detector is language-agnostic (e.g. PEM material, config files).\n */\nexport type DetectorLanguage =\n  | \"js\"\n  | \"python\"\n  | \"go\"\n  | \"java\"\n  | \"csharp\"\n  | \"rust\"\n  | \"ruby\"\n  | \"c\"\n  | \"any\";\n\n/**\n * Declarative metadata for a single rule a detector can emit. This is the\n * catalog entry: the stable, queryable description of a rule keyed by the\n * `ruleId` it stamps onto findings. It is the single source of truth for a\n * rule's title / severity / category / remediation, consumed by the SARIF\n * `rules[]` block, the MCP `explain_finding` resolver, and future per-rule\n * enable/disable + language-pack work.\n *\n * For most rules the metadata is fixed and `detect()` builds findings straight\n * from it (see `findingFromRule`). A few rules are inherently multi-variant\n * (e.g. `node-crypto-keygen` spans RSA/EC/DSA/DH/Ed25519 at different\n * severities); for those the metadata here is a REPRESENTATIVE umbrella and\n * `detect()` refines the per-finding fields at match time. The catalog always\n * enumerates every emittable ruleId regardless.\n */\nexport interface RuleMeta {\n  /** Stable rule id — matches {@link Finding.ruleId}. Unique across the catalog. */\n  id: string;\n  /** Canonical human title. */\n  title: string;\n  category: FindingCategory;\n  severity: Severity;\n  /** Default confidence for findings of this rule. */\n  confidence: Confidence;\n  /** Harvest-now-decrypt-later exposure. */\n  hndl: boolean;\n  /** Representative classical algorithm family; refined per-finding when it varies. */\n  algorithm?: AlgorithmFamily;\n  /** Associated CWE identifier (e.g. \"CWE-327\"). */\n  cwe?: string;\n  /** Suggested post-quantum remediation. When omitted, derived from {@link algorithm}. */\n  remediation?: string;\n  /** Canonical one-line human explanation; may be refined per-finding. */\n  message: string;\n  /** True when this rule's matched snippet IS sensitive key material. */\n  sensitive?: boolean;\n  /** Short description of what the rule detects (for catalog / MCP surfaces). */\n  description?: string;\n}\n\n/** A pluggable source detector. Detectors are pure and stateless. */\nexport interface Detector {\n  /** Unique id, used as the Finding.ruleId prefix space. */\n  id: string;\n  /** Human description of what the detector looks for. */\n  description: string;\n  /**\n   * Logical scope of this detector's findings. Used by `scan()` to honour the\n   * `config` / `source` toggles. Defaults to `\"source\"` when omitted (for\n   * backward compatibility with externally-defined detectors).\n   */\n  scope?: DetectorScope;\n  /**\n   * Language this detector targets, for documentation / registry filtering.\n   * Defaults to `\"js\"` when omitted.\n   */\n  language?: DetectorLanguage;\n  /**\n   * The rules this detector can emit, as declarative metadata. Together across\n   * all detectors these form the rule catalog ({@link DetectorRegistry.ruleCatalog}).\n   * Optional for backward compatibility with externally-defined detectors, but\n   * all built-in detectors declare it.\n   */\n  rules?: RuleMeta[];\n  /** Whether this detector should run against the given file path. */\n  appliesTo(filePath: string): boolean;\n  /** Inspect a single file's contents and return zero or more findings. */\n  detect(input: DetectorInput): Finding[];\n}\n\nexport interface DetectorInput {\n  /** Path relative to the scan root (POSIX). */\n  file: string;\n  /** Full file contents. */\n  content: string;\n}\n\n/** Options controlling a scan. */\nexport interface ScanOptions {\n  /** Absolute or relative directory (or single file) to scan. */\n  root: string;\n  /**\n   * Restrict the walk to paths matching one of these include patterns\n   * (substring or relative-path-prefix match). When omitted, all non-excluded\n   * files are scanned. Wired into the walker.\n   */\n  include?: string[];\n  /** Extra exclude patterns (in addition to the built-in defaults). */\n  exclude?: string[];\n  /** Disable the built-in ignore list (node_modules, .git, dist, …). */\n  noDefaultIgnores?: boolean;\n  /** Scan source files for inline crypto usage. Default: true. */\n  source?: boolean;\n  /** Scan dependency manifests/lockfiles for vulnerable libraries. Default: true. */\n  dependencies?: boolean;\n  /** Scan config files (TLS, certificates). Default: true. */\n  config?: boolean;\n  /** Max file size to read, in bytes. Default: 2 MiB. */\n  maxFileSize?: number;\n  /**\n   * Scan minified / generated / bundled files (large single-line content)\n   * instead of skipping them. Default: false (skip them for speed).\n   */\n  scanMinified?: boolean;\n  /**\n   * Explicit relative file list (POSIX, relative to `root`) to scan instead of\n   * walking the tree. Used for incremental / changed-files scans. Each path is\n   * still subject to the binary / size filters. When set, the directory walk is\n   * bypassed entirely.\n   */\n  files?: string[];\n  /**\n   * Override / extend the built-in detector set. When omitted, the default\n   * registry's detectors are used.\n   */\n  detectors?: Detector[];\n  /**\n   * Rule ids to suppress. Any finding whose `ruleId` is listed here is dropped\n   * after detection. Serializable (a plain string array), so it is honoured on\n   * both the serial and the worker-thread (`scanParallel`) paths. See the rule\n   * catalog ({@link DetectorRegistry.ruleCatalog}) for the valid ids.\n   */\n  disabledRules?: string[];\n  /**\n   * Path to an on-disk scan cache. When set, unchanged files (same content hash)\n   * reuse their previous findings instead of re-running detectors, and the cache\n   * is rewritten after the scan. Invalidated wholesale when the tool version,\n   * detector set, or `disabledRules` change. Optional; omitted = no caching.\n   * The cache forces the in-process (serial) path.\n   */\n  cacheFile?: string;\n  /** Optional progress callback. */\n  onFile?: (file: string) => void;\n  /**\n   * Optional abort signal. When it fires mid-walk the scan stops cooperatively\n   * and rejects with an `AbortError` (a `DOMException`-like error with\n   * `name === \"AbortError\"`).\n   */\n  signal?: AbortSignal;\n  /**\n   * Work budget: maximum number of files to scan. When exceeded mid-walk the\n   * scan stops and throws a `BudgetExceededError`. Unlimited when omitted.\n   */\n  maxFiles?: number;\n  /**\n   * Work budget: maximum cumulative bytes of scanned file content. When\n   * exceeded mid-walk the scan stops and throws a `BudgetExceededError`.\n   * Unlimited when omitted.\n   */\n  maxBytes?: number;\n}\n\n/** Extra options for {@link scanParallel}, layered onto {@link ScanOptions}. */\nexport interface ParallelScanOptions extends ScanOptions {\n  /**\n   * Number of worker threads. Default: `os.availableParallelism()`. A value of\n   * 0 or 1 forces the in-process serial path.\n   */\n  concurrency?: number;\n  /**\n   * Combined-size floor (bytes) below which the scan always runs in-process.\n   * Default: 2 MiB. Also stays serial below `parallelFileThreshold` files.\n   */\n  parallelThresholdBytes?: number;\n  /** File-count floor below which the scan always runs in-process. Default: 200. */\n  parallelFileThreshold?: number;\n  /** Target bytes per worker chunk. Default: 4 MiB. */\n  chunkBytes?: number;\n}\n\n/** Aggregated counts produced from a scan's findings. */\nexport interface CryptoInventory {\n  byAlgorithm: Partial<Record<AlgorithmFamily, number>>;\n  byCategory: Partial<Record<FindingCategory, number>>;\n  bySeverity: Record<Severity, number>;\n  /** Number of findings exposed to harvest-now-decrypt-later. */\n  hndlCount: number;\n  /** 0–100 readiness score (100 = no classical asymmetric crypto found). */\n  readinessScore: number;\n}\n\n/**\n * Non-fatal things that happened during a scan that reduce coverage. Surfaced so\n * a silent under-scan (e.g. half the tree was unreadable) can't masquerade as a\n * clean \"0 findings\" result — reporters warn when any count is non-zero.\n */\nexport interface ScanDiagnostics {\n  /** Files that could not be read (permissions, vanished, decode failure) and were skipped. */\n  unreadable: number;\n  /** Files skipped because they look machine-minified / generated (scan with `scanMinified` to include). */\n  skippedMinified: number;\n}\n\n/** The full result of a scan. */\nexport interface ScanResult {\n  /** The scan root (as provided). */\n  root: string;\n  findings: Finding[];\n  filesScanned: number;\n  /**\n   * Coverage diagnostics: counts of files skipped as unreadable or minified.\n   * Optional for backward compatibility with hand-built results.\n   */\n  diagnostics?: ScanDiagnostics;\n  /**\n   * Of `filesScanned`, how many were in a source language the scanner can\n   * actually analyze for inline crypto (JS/TS, Python, Go, Java). When this is 0 but\n   * `filesScanned` > 0, the readiness score reflects NO analyzable code — the\n   * crypto likely lives in an unsupported language (Go, Java, Rust, …) — and\n   * reporters surface that so a bare 100/100 can't read as \"safe\". Optional for\n   * backward compatibility with hand-built results.\n   */\n  analyzedFiles?: number;\n  inventory: CryptoInventory;\n  /** ISO timestamps. */\n  startedAt: string;\n  finishedAt: string;\n  /** Tool version that produced the result. */\n  toolVersion: string;\n}\n\n/** Output formats qScan / reporters can emit. */\nexport type ReportFormat = \"human\" | \"json\" | \"sarif\";\n\n/** A remediation recommendation for a classical algorithm. */\nexport interface Remediation {\n  algorithm: AlgorithmFamily;\n  /** Short recommended replacement, e.g. \"ML-KEM-768 (hybrid X25519MLKEM768)\". */\n  recommendation: string;\n  /** Longer rationale. */\n  detail: string;\n}\n"]}

package/dist/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAElD;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3D,MAAM,GAAG,GAA2B;QAClC,EAAE,EAAE,KAAK;QACT,UAAU,EAAE,KAAK;QACjB,GAAG,EAAE,MAAM;QACX,EAAE,EAAE,KAAK;QACT,UAAU,EAAE,KAAK;QACjB,GAAG,EAAE,MAAM;QACX,GAAG,EAAE,MAAM;QACX,GAAG,EAAE,MAAM;QACX,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,KAAK;QACb,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,KAAK;QACb,EAAE,EAAE,KAAK;QACT,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,KAAK;QACb,EAAE,EAAE,KAAK;QACT,IAAI,EAAE,KAAK;QACX,EAAE,EAAE,KAAK;QACT,IAAI,EAAE,KAAK;QACX,CAAC,EAAE,IAAI;QACP,KAAK,EAAE,MAAM;QACb,GAAG,EAAE,MAAM;QACX,EAAE,EAAE,KAAK;QACT,CAAC,EAAE,IAAI;QACP,GAAG,EAAE,MAAM;KACZ,CAAC;IACF,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACxB,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,SAAS,CACvB,IAAY,EACZ,IAA8C;IAE9C,IAAI,IAAY,CAAC;IACjB,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1C,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;SAAM,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QACjD,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACpD,IAAI,GAAG,UAAU,GAAG,EAAE,CAAC;IACzB,CAAC;SAAM,CAAC;QACN,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;IACvD,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/F,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACjC,CAAC"}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAElD;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3D,MAAM,GAAG,GAA2B;QAClC,EAAE,EAAE,KAAK;QACT,UAAU,EAAE,KAAK;QACjB,GAAG,EAAE,MAAM;QACX,EAAE,EAAE,KAAK;QACT,UAAU,EAAE,KAAK;QACjB,GAAG,EAAE,MAAM;QACX,GAAG,EAAE,MAAM;QACX,GAAG,EAAE,MAAM;QACX,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,KAAK;QACb,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,KAAK;QACb,EAAE,EAAE,KAAK;QACT,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,KAAK;QACb,EAAE,EAAE,KAAK;QACT,IAAI,EAAE,KAAK;QACX,EAAE,EAAE,KAAK;QACT,IAAI,EAAE,KAAK;QACX,CAAC,EAAE,IAAI;QACP,KAAK,EAAE,MAAM;QACb,GAAG,EAAE,MAAM;QACX,EAAE,EAAE,KAAK;QACT,CAAC,EAAE,IAAI;QACP,GAAG,EAAE,MAAM;KACZ,CAAC;IACF,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACxB,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,SAAS,CACvB,IAAY,EACZ,IAA8C;IAE9C,IAAI,IAAY,CAAC;IACjB,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1C,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;SAAM,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QACjD,MAAM,GAAG,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACpD,IAAI,GAAG,UAAU,GAAG,EAAE,CAAC;IACzB,CAAC;SAAM,CAAC;QACN,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;IACvD,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/F,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACjC,CAAC","sourcesContent":["/**\n * Snippet-level fix verification: run the detectors over a piece of code (NOT\n * the filesystem) and report any classical crypto that remains. This is the\n * deterministic gate a fix must pass — the same logic the MCP `verify_fix` tool\n * and the remediation pipeline both use, so they can never disagree on what\n * \"the finding is gone\" means.\n */\nimport type { Finding } from \"./types.js\";\nimport { detectFile, detectors } from \"./scan.js\";\n\n/**\n * Map a language name (or a bare extension) to a source extension whose\n * detectors we run. Returns null for languages the scanner does not analyze.\n */\nexport function languageToExtension(language: string): string | null {\n  const l = language.trim().toLowerCase().replace(/^\\./, \"\");\n  const map: Record<string, string> = {\n    js: \".js\",\n    javascript: \".js\",\n    jsx: \".jsx\",\n    ts: \".ts\",\n    typescript: \".ts\",\n    tsx: \".tsx\",\n    mjs: \".mjs\",\n    cjs: \".cjs\",\n    py: \".py\",\n    python: \".py\",\n    go: \".go\",\n    golang: \".go\",\n    java: \".java\",\n    kotlin: \".kt\",\n    kt: \".kt\",\n    cs: \".cs\",\n    csharp: \".cs\",\n    \"c#\": \".cs\",\n    dotnet: \".cs\",\n    rs: \".rs\",\n    rust: \".rs\",\n    rb: \".rb\",\n    ruby: \".rb\",\n    c: \".c\",\n    \"c++\": \".cpp\",\n    cpp: \".cpp\",\n    cc: \".cc\",\n    h: \".h\",\n    hpp: \".hpp\",\n  };\n  return map[l] ?? null;\n}\n\n/** Result of {@link verifyFix}: the findings that remain, and whether the\n * language is one the scanner actually analyzes (so `findings: []` on an\n * unsupported language is NOT a clean verification). */\nexport interface VerifyResult {\n  supported: boolean;\n  findings: Finding[];\n}\n\n/**\n * Run all detectors over `code`, selecting them by `filename` (extension) or\n * `language`. Pure: no I/O. When neither identifies an analyzable language,\n * `supported` is false and the empty findings list must not be read as \"fixed\".\n */\nexport function verifyFix(\n  code: string,\n  opts: { filename?: string; language?: string },\n): VerifyResult {\n  let name: string;\n  if (opts.filename && opts.filename.trim()) {\n    name = opts.filename.trim();\n  } else if (opts.language && opts.language.trim()) {\n    const ext = languageToExtension(opts.language);\n    if (!ext) return { supported: false, findings: [] };\n    name = `snippet${ext}`;\n  } else {\n    return { supported: false, findings: [] };\n  }\n  const dotExt = name.replace(/^.*(\\.[^.]+)$/, \"$1\");\n  const supported = languageToExtension(dotExt) !== null;\n  const findings = detectFile(name, code, detectors, { source: true, config: true, deps: true });\n  return { supported, findings };\n}\n"]}

package/dist/version.d.ts

@@ -3,5 +3,5 @@
  * the scan orchestrator can import it without creating a cycle through index.ts.
  * Keep in sync with packages/core/package.json.
  */
-export declare const VERSION = "0.4.2";
+export declare const VERSION = "0.4.3";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -3,5 +3,5 @@
  * the scan orchestrator can import it without creating a cycle through index.ts.
  * Keep in sync with packages/core/package.json.
  */
-export const VERSION = "0.4.2";
+export const VERSION = "0.4.3";
 //# sourceMappingURL=version.js.map

package/dist/version.js.map

@@ -1 +1 @@
-{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC"}
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC","sourcesContent":["/**\n * The tool version surfaced in reports. Kept in its own module so reporters and\n * the scan orchestrator can import it without creating a cycle through index.ts.\n * Keep in sync with packages/core/package.json.\n */\nexport const VERSION = \"0.4.3\";\n"]}

package/dist/walk.js.map

@@ -1 +1 @@
-{"version":3,"file":"walk.js","sourceRoot":"","sources":["../src/walk.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,cAAc;IACd,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,KAAK;IACL,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,QAAQ;CACT,CAAC;AAEF,gDAAgD;AAChD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAErD;;;GAGG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAS;IACxC,SAAS;IACT,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,MAAM;IACN,MAAM;IACN,MAAM;IACN,wBAAwB;IACxB,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,MAAM;IACN,MAAM;IACN,QAAQ;IACR,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,uBAAuB;IACvB,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,KAAK;IACL,QAAQ;IACR,MAAM;IACN,IAAI;IACJ,IAAI;IACJ,QAAQ;IACR,OAAO;IACP,kBAAkB;IAClB,KAAK;IACL,SAAS;IACT,UAAU;IACV,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,OAAO;IACP,MAAM;IACN,SAAS;IACT,OAAO;CACR,CAAC,CAAC;AAiBH,0DAA0D;AAC1D,MAAM,UAAU,OAAO,CAAC,CAAS;IAC/B,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACrC,CAAC;AAED,mFAAmF;AACnF,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACxB,CAAC,EAAE,CAAC,CAAC,yBAAyB;gBAC9B,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBACxB,CAAC,EAAE,CAAC,CAAC,2BAA2B;oBAChC,EAAE,IAAI,UAAU,CAAC,CAAC,6BAA6B;gBACjD,CAAC;qBAAM,CAAC;oBACN,EAAE,IAAI,IAAI,CAAC,CAAC,yBAAyB;gBACvC,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,EAAE,IAAI,OAAO,CAAC,CAAC,uBAAuB;YACxC,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,EAAE,IAAI,MAAM,CAAC;QACf,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,wDAAwD;YACxD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACrC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;gBACf,EAAE,IAAI,KAAK,CAAC;YACd,CAAC;iBAAM,CAAC;gBACN,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;gBAC7B,CAAC,GAAG,GAAG,CAAC;YACV,CAAC;QACH,CAAC;aAAM,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,EAAE,IAAI,IAAI,GAAG,CAAC,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,EAAE,IAAI,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;AAC7C,SAAS,UAAU,CAAC,OAAe;IACjC,IAAI,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QAC3B,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,QAA2B;IACjE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YACnB,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzC,SAAS;QACX,CAAC;QACD,wEAAwE;QACxE,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACjC,uEAAuE;QACvE,IAAI,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yEAAyE;AACzE,SAAS,UAAU,CAAC,GAAW,EAAE,OAA0B;IACzD,OAAO,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,GAAW,EAAE,OAA0B;IACzD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,mDAAmD;IACnD,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,iBAAiB,GACrB,gHAAgH,CAAC;AAEnH,wEAAwE;AACxE,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC5E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC;YACzC,IAAI,GAAG,GAAG,OAAO;gBAAE,OAAO,GAAG,GAAG,CAAC;YACjC,GAAG,GAAG,CAAC,CAAC;YACR,KAAK,EAAE,CAAC;QACV,CAAC;aAAM,CAAC;YACN,GAAG,EAAE,CAAC;QACR,CAAC;IACH,CAAC;IACD,IAAI,GAAG,GAAG,OAAO;QAAE,OAAO,GAAG,GAAG,CAAC;IACjC,IAAI,OAAO,GAAG,MAAM;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC;IACtC,OAAO,OAAO,GAAG,KAAK,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,SAAS,CAAC,IAAY,EAAE,UAAuB,EAAE;IACtE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,qBAAqB,CAAC;IACjE,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;IAEhE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IAElC,8EAA8E;IAC9E,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,IACE,CAAC,YAAY,CAAC,IAAI,CAAC;YACnB,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC;YACzB,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,EACjD,CAAC;YACD,MAAM,IAAI,CAAC;QACb,CAAC;QACD,OAAO;IACT,CAAC;IAED,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;AACvE,CAAC;AASD;;;;GAIG;AACH,SAAS,eAAe,CAAC,GAAW,EAAE,IAAY,EAAE,WAAmB;IACrE,+EAA+E;IAC/E,iFAAiF;IACjF,IAAI,cAAc,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,IAAI,IAAI,WAAW,CAAC;AAC7B,CAAC;AAED,mFAAmF;AACnF,KAAK,SAAS,CAAC,CAAC,OAAO,CAAC,MAAc,EAAE,MAAc,EAAE,GAAgB;IACtE,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,OAAO;IACT,CAAC;IAED,yDAAyD;IACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEzE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAE1C,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;YAC3B,8DAA8D;YAC9D,SAAS;QACX,CAAC;QAED,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC/C,IAAI,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC;gBAAE,SAAS;YAC3C,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YAC9B,SAAS;QACX,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,SAAS;QAC9B,IAAI,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAC3C,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAC5C,4EAA4E;QAC5E,8EAA8E;QAC9E,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,GAAG,CAAC;YAAE,SAAS;QAC7C,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC;YAAE,SAAS;QAEhD,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,WAAW,CAAC;gBAAE,SAAS;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}
+{"version":3,"file":"walk.js","sourceRoot":"","sources":["../src/walk.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,cAAc;IACd,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,KAAK;IACL,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,QAAQ;CACT,CAAC;AAEF,gDAAgD;AAChD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAErD;;;GAGG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAS;IACxC,SAAS;IACT,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,MAAM;IACN,MAAM;IACN,MAAM;IACN,wBAAwB;IACxB,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,MAAM;IACN,MAAM;IACN,QAAQ;IACR,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,uBAAuB;IACvB,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,KAAK;IACL,QAAQ;IACR,MAAM;IACN,IAAI;IACJ,IAAI;IACJ,QAAQ;IACR,OAAO;IACP,kBAAkB;IAClB,KAAK;IACL,SAAS;IACT,UAAU;IACV,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,OAAO;IACP,MAAM;IACN,SAAS;IACT,OAAO;CACR,CAAC,CAAC;AAiBH,0DAA0D;AAC1D,MAAM,UAAU,OAAO,CAAC,CAAS;IAC/B,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACrC,CAAC;AAED,mFAAmF;AACnF,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACxB,CAAC,EAAE,CAAC,CAAC,yBAAyB;gBAC9B,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBACxB,CAAC,EAAE,CAAC,CAAC,2BAA2B;oBAChC,EAAE,IAAI,UAAU,CAAC,CAAC,6BAA6B;gBACjD,CAAC;qBAAM,CAAC;oBACN,EAAE,IAAI,IAAI,CAAC,CAAC,yBAAyB;gBACvC,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,EAAE,IAAI,OAAO,CAAC,CAAC,uBAAuB;YACxC,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,EAAE,IAAI,MAAM,CAAC;QACf,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,wDAAwD;YACxD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACrC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;gBACf,EAAE,IAAI,KAAK,CAAC;YACd,CAAC;iBAAM,CAAC;gBACN,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;gBAC7B,CAAC,GAAG,GAAG,CAAC;YACV,CAAC;QACH,CAAC;aAAM,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,EAAE,IAAI,IAAI,GAAG,CAAC,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,EAAE,IAAI,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;AAC7C,SAAS,UAAU,CAAC,OAAe;IACjC,IAAI,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QAC3B,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,QAA2B;IACjE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YACnB,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzC,SAAS;QACX,CAAC;QACD,wEAAwE;QACxE,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACjC,uEAAuE;QACvE,IAAI,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yEAAyE;AACzE,SAAS,UAAU,CAAC,GAAW,EAAE,OAA0B;IACzD,OAAO,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,GAAW,EAAE,OAA0B;IACzD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,mDAAmD;IACnD,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,iBAAiB,GACrB,gHAAgH,CAAC;AAEnH,wEAAwE;AACxE,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC5E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC;YACzC,IAAI,GAAG,GAAG,OAAO;gBAAE,OAAO,GAAG,GAAG,CAAC;YACjC,GAAG,GAAG,CAAC,CAAC;YACR,KAAK,EAAE,CAAC;QACV,CAAC;aAAM,CAAC;YACN,GAAG,EAAE,CAAC;QACR,CAAC;IACH,CAAC;IACD,IAAI,GAAG,GAAG,OAAO;QAAE,OAAO,GAAG,GAAG,CAAC;IACjC,IAAI,OAAO,GAAG,MAAM;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC;IACtC,OAAO,OAAO,GAAG,KAAK,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,SAAS,CAAC,IAAY,EAAE,UAAuB,EAAE;IACtE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,qBAAqB,CAAC;IACjE,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;IAEhE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IAElC,8EAA8E;IAC9E,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,IACE,CAAC,YAAY,CAAC,IAAI,CAAC;YACnB,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC;YACzB,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,EACjD,CAAC;YACD,MAAM,IAAI,CAAC;QACb,CAAC;QACD,OAAO;IACT,CAAC;IAED,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;AACvE,CAAC;AASD;;;;GAIG;AACH,SAAS,eAAe,CAAC,GAAW,EAAE,IAAY,EAAE,WAAmB;IACrE,+EAA+E;IAC/E,iFAAiF;IACjF,IAAI,cAAc,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,IAAI,IAAI,WAAW,CAAC;AAC7B,CAAC;AAED,mFAAmF;AACnF,KAAK,SAAS,CAAC,CAAC,OAAO,CAAC,MAAc,EAAE,MAAc,EAAE,GAAgB;IACtE,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,OAAO;IACT,CAAC;IAED,yDAAyD;IACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEzE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAE1C,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;YAC3B,8DAA8D;YAC9D,SAAS;QACX,CAAC;QAED,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC/C,IAAI,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC;gBAAE,SAAS;YAC3C,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YAC9B,SAAS;QACX,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,SAAS;QAC9B,IAAI,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAC3C,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAC5C,4EAA4E;QAC5E,8EAA8E;QAC9E,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,GAAG,CAAC;YAAE,SAAS;QAC7C,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC;YAAE,SAAS;QAEhD,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,WAAW,CAAC;gBAAE,SAAS;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["/**\n * Filesystem walker. A zero-dependency recursive async generator that yields\n * scannable text files as relative POSIX paths. It honours a default ignore\n * list, user-supplied exclude patterns, a max file size, and a binary-extension\n * filter. The root may be a directory or a single file.\n */\nimport { readdir, stat } from \"node:fs/promises\";\nimport type { Dirent } from \"node:fs\";\nimport * as path from \"node:path\";\n\nimport { isManifestFile } from \"./dependencies.js\";\n\n/** Directories ignored by default (can be disabled with noDefaultIgnores). */\nexport const DEFAULT_IGNORES: readonly string[] = [\n  \"node_modules\",\n  \".git\",\n  \"dist\",\n  \"build\",\n  \".next\",\n  \"out\",\n  \"coverage\",\n  \"vendor\",\n  \".turbo\",\n  \".cache\",\n];\n\n/** Default maximum file size to read: 2 MiB. */\nexport const DEFAULT_MAX_FILE_SIZE = 2 * 1024 * 1024;\n\n/**\n * File extensions we treat as binary / non-text and therefore skip. Keeping this\n * as an extension allow-list-by-exclusion is cheap and avoids reading bytes.\n */\nconst BINARY_EXTENSIONS = new Set<string>([\n  // images\n  \".png\",\n  \".jpg\",\n  \".jpeg\",\n  \".gif\",\n  \".webp\",\n  \".bmp\",\n  \".ico\",\n  \".tiff\",\n  \".avif\",\n  // fonts\n  \".woff\",\n  \".woff2\",\n  \".ttf\",\n  \".otf\",\n  \".eot\",\n  // archives / compressed\n  \".zip\",\n  \".gz\",\n  \".tgz\",\n  \".bz2\",\n  \".xz\",\n  \".7z\",\n  \".rar\",\n  \".tar\",\n  // media\n  \".mp3\",\n  \".mp4\",\n  \".mov\",\n  \".avi\",\n  \".mkv\",\n  \".wav\",\n  \".flac\",\n  \".ogg\",\n  \".webm\",\n  // documents / binaries\n  \".pdf\",\n  \".doc\",\n  \".docx\",\n  \".xls\",\n  \".xlsx\",\n  \".ppt\",\n  \".pptx\",\n  \".exe\",\n  \".dll\",\n  \".so\",\n  \".dylib\",\n  \".bin\",\n  \".o\",\n  \".a\",\n  \".class\",\n  \".wasm\",\n  // data blobs / db\n  \".db\",\n  \".sqlite\",\n  \".sqlite3\",\n  \".dat\",\n  \".pack\",\n  \".idx\",\n  // misc\n  \".lock\",\n  \".map\",\n  \".min.js\",\n  \".node\",\n]);\n\n/** Options accepted by {@link walkFiles}. */\nexport interface WalkOptions {\n  /**\n   * Restrict to paths matching one of these include patterns (substring or\n   * relative-path-prefix match). When omitted/empty, all files pass.\n   */\n  include?: string[];\n  /** Extra exclude patterns (substring or relative-path-prefix match). */\n  exclude?: string[];\n  /** Disable the built-in directory ignore list. */\n  noDefaultIgnores?: boolean;\n  /** Max file size in bytes; larger files are skipped. */\n  maxFileSize?: number;\n}\n\n/** Normalise a path to forward-slash POSIX separators. */\nexport function toPosix(p: string): string {\n  return p.split(path.sep).join(\"/\");\n}\n\n/** A pattern is treated as a glob when it contains one of these metacharacters. */\nfunction hasGlobMeta(pattern: string): boolean {\n  return /[*?[]/.test(pattern);\n}\n\n/**\n * Translate a glob into an anchored RegExp: `*` matches within a path segment\n * (not `/`), `**` matches across segments, a leading `**` before a slash is an\n * optional path prefix, `?` matches a single non-`/` char, `[...]` is a\n * character class. Other regex\n * metacharacters are escaped.\n */\nfunction globToRegExp(glob: string): RegExp {\n  let re = \"\";\n  for (let i = 0; i < glob.length; i++) {\n    const c = glob[i];\n    if (c === \"*\") {\n      if (glob[i + 1] === \"*\") {\n        i++; // consume the second '*'\n        if (glob[i + 1] === \"/\") {\n          i++; // consume the trailing '/'\n          re += \"(?:.*/)?\"; // zero or more path segments\n        } else {\n          re += \".*\"; // '**' spanning segments\n        }\n      } else {\n        re += \"[^/]*\"; // '*' within a segment\n      }\n    } else if (c === \"?\") {\n      re += \"[^/]\";\n    } else if (c === \"[\") {\n      // Pass a character class through; find its closing ']'.\n      const end = glob.indexOf(\"]\", i + 1);\n      if (end === -1) {\n        re += \"\\\\[\";\n      } else {\n        re += glob.slice(i, end + 1);\n        i = end;\n      }\n    } else if (\"\\\\^$.|+(){}\".includes(c)) {\n      re += \"\\\\\" + c;\n    } else {\n      re += c;\n    }\n  }\n  return new RegExp(`^${re}$`);\n}\n\n/** Memoized glob→RegExp so a pattern is compiled once, not once per file. */\nconst GLOB_CACHE = new Map<string, RegExp>();\nfunction globRegExp(pattern: string): RegExp {\n  let re = GLOB_CACHE.get(pattern);\n  if (!re) {\n    re = globToRegExp(pattern);\n    GLOB_CACHE.set(pattern, re);\n  }\n  return re;\n}\n\n/**\n * True if `rel` (a POSIX relative path) matches any pattern. A pattern with a\n * glob metacharacter (`*`, `?`, `[`) is matched as an anchored glob; a plain\n * pattern keeps the historical substring / path-prefix semantics (so `\"src\"`\n * still matches `src/a.ts` and `\"secrets\"` matches anywhere).\n */\nexport function matchesAny(rel: string, patterns: readonly string[]): boolean {\n  for (const pattern of patterns) {\n    if (!pattern) continue;\n    const p = toPosix(pattern).replace(/\\/+$/, \"\");\n    if (hasGlobMeta(p)) {\n      if (globRegExp(p).test(rel)) return true;\n      continue;\n    }\n    // Plain pattern: substring match (handles \"src/legacy\" or \"secrets\")...\n    if (rel.includes(p)) return true;\n    // ...and explicit path-prefix match (\"foo\" should match \"foo/bar.ts\").\n    if (rel === p || rel.startsWith(`${p}/`)) return true;\n  }\n  return false;\n}\n\n/** True if `rel` (a POSIX relative path) matches any exclude pattern. */\nfunction isExcluded(rel: string, exclude: readonly string[]): boolean {\n  return matchesAny(rel, exclude);\n}\n\n/**\n * True if `rel` passes the include filter. An empty include list means \"include\n * everything\"; otherwise the file must match at least one include pattern.\n */\nfunction isIncluded(rel: string, include: readonly string[]): boolean {\n  if (include.length === 0) return true;\n  return matchesAny(rel, include);\n}\n\n/** True if the file's extension marks it as binary / non-text. */\nexport function isBinaryPath(rel: string): boolean {\n  const lower = rel.toLowerCase();\n  // Handle compound extensions like \".min.js\" first.\n  if (lower.endsWith(\".min.js\")) return true;\n  const ext = path.posix.extname(lower);\n  return BINARY_EXTENSIONS.has(ext);\n}\n\n/**\n * Compound / pattern extensions that mark generated or bundled output we skip\n * by default (beyond `.min.js` / `.map`, which {@link isBinaryPath} handles).\n */\nconst GENERATED_PATH_RE =\n  /(?:\\.min\\.[mc]?js|[.-]min\\.[mc]?js|\\.bundle\\.[mc]?js|\\.chunk\\.[mc]?js|\\.generated\\.[jt]sx?|_pb\\.js|\\.pb\\.go)$/i;\n\n/** True if the path looks like generated / bundled output (by name). */\nexport function isGeneratedPath(rel: string): boolean {\n  return GENERATED_PATH_RE.test(rel.toLowerCase());\n}\n\n/**\n * Heuristic content check for machine-minified / generated files with no\n * telltale extension: a very long average line length, or any single line over\n * ~50 KB, in the first ~64 KB sampled. Used at read time, not in the walker.\n */\nexport function looksMinified(content: string): boolean {\n  const sample = content.length > 65_536 ? content.slice(0, 65_536) : content;\n  if (sample.length === 0) return false;\n  let maxLine = 0;\n  let cur = 0;\n  let lines = 1;\n  for (let i = 0; i < sample.length; i++) {\n    if (sample.charCodeAt(i) === 10 /* \\n */) {\n      if (cur > maxLine) maxLine = cur;\n      cur = 0;\n      lines++;\n    } else {\n      cur++;\n    }\n  }\n  if (cur > maxLine) maxLine = cur;\n  if (maxLine > 50_000) return true;\n  const avgLine = sample.length / lines;\n  return avgLine > 1_000;\n}\n\n/**\n * Recursively yield scannable file paths (relative to `root`, POSIX) under a\n * directory. If `root` points at a single file, yields just that file's\n * basename (subject to the size / binary filters).\n */\nexport async function* walkFiles(root: string, options: WalkOptions = {}): AsyncGenerator<string> {\n  const include = options.include ?? [];\n  const exclude = options.exclude ?? [];\n  const maxFileSize = options.maxFileSize ?? DEFAULT_MAX_FILE_SIZE;\n  const ignores = options.noDefaultIgnores ? [] : DEFAULT_IGNORES;\n\n  const rootStat = await stat(root);\n\n  // Single-file mode: yield the file itself (by basename) if it passes filters.\n  if (rootStat.isFile()) {\n    const name = toPosix(path.basename(root));\n    if (\n      !isBinaryPath(name) &&\n      isIncluded(name, include) &&\n      passesSizeLimit(name, rootStat.size, maxFileSize)\n    ) {\n      yield name;\n    }\n    return;\n  }\n\n  yield* walkDir(root, \"\", { include, exclude, maxFileSize, ignores });\n}\n\ninterface WalkContext {\n  include: readonly string[];\n  exclude: readonly string[];\n  maxFileSize: number;\n  ignores: readonly string[];\n}\n\n/**\n * True if a file passes the size limit. Dependency manifests (package.json /\n * package-lock.json) are exempt from the cap so large lockfiles still get\n * scanned for vulnerable dependencies instead of being silently dropped.\n */\nfunction passesSizeLimit(rel: string, size: number, maxFileSize: number): boolean {\n  // Dependency manifests are always read (they can exceed the size cap but carry\n  // the whole dependency tree). Uses the single {@link isManifestFile} definition.\n  if (isManifestFile(rel)) return true;\n  return size <= maxFileSize;\n}\n\n/** Internal recursive directory walker. `relDir` is POSIX-relative to the root. */\nasync function* walkDir(absDir: string, relDir: string, ctx: WalkContext): AsyncGenerator<string> {\n  let entries: Dirent[];\n  try {\n    entries = await readdir(absDir, { withFileTypes: true });\n  } catch {\n    // Unreadable directory (permissions, transient races) — skip silently.\n    return;\n  }\n\n  // Stable, deterministic ordering for reproducible scans.\n  entries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));\n\n  for (const entry of entries) {\n    const rel = relDir ? `${relDir}/${entry.name}` : entry.name;\n    const abs = path.join(absDir, entry.name);\n\n    if (entry.isSymbolicLink()) {\n      // Don't follow symlinks: avoids cycles and escaping the root.\n      continue;\n    }\n\n    if (entry.isDirectory()) {\n      if (ctx.ignores.includes(entry.name)) continue;\n      if (isExcluded(rel, ctx.exclude)) continue;\n      yield* walkDir(abs, rel, ctx);\n      continue;\n    }\n\n    if (!entry.isFile()) continue;\n    if (isExcluded(rel, ctx.exclude)) continue;\n    if (!isIncluded(rel, ctx.include)) continue;\n    // Dependency manifests (incl. yarn.lock / pnpm-lock.yaml) are always read —\n    // they carry the dependency tree and must not be dropped as binary/generated.\n    const manifest = isManifestFile(rel);\n    if (!manifest && isBinaryPath(rel)) continue;\n    if (!manifest && isGeneratedPath(rel)) continue;\n\n    try {\n      const s = await stat(abs);\n      if (!passesSizeLimit(rel, s.size, ctx.maxFileSize)) continue;\n    } catch {\n      continue;\n    }\n\n    yield rel;\n  }\n}\n"]}

package/dist/worktree.js.map

@@ -1 +1 @@
-{"version":3,"file":"worktree.js","sourceRoot":"","sources":["../src/worktree.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEjC,KAAK,UAAU,GAAG,CAAC,IAAc,EAAE,GAAY;IAC7C,MAAM,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,EAA+B;IAE/B,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,CAAC,WAAW,EAAE,uBAAuB,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,2BAA2B,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7B,0EAA0E;IAC1E,8DAA8D;IAC9D,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC1D,OAAO,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;QACtE,CAAC;QACD,8EAA8E;QAC9E,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;QACD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;AACH,CAAC"}
+{"version":3,"file":"worktree.js","sourceRoot":"","sources":["../src/worktree.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEjC,KAAK,UAAU,GAAG,CAAC,IAAc,EAAE,GAAY;IAC7C,MAAM,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,EAA+B;IAE/B,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,CAAC,WAAW,EAAE,uBAAuB,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,2BAA2B,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC7B,0EAA0E;IAC1E,8DAA8D;IAC9D,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC1D,OAAO,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,oEAAoE;QACtE,CAAC;QACD,8EAA8E;QAC9E,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;QACD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;AACH,CAAC","sourcesContent":["/**\n * Ephemeral git worktree runner. Remediation applies candidate patches inside a\n * throwaway `git worktree` checked out at HEAD, so the user's working tree is\n * never touched while patches are being tried and verified. The worktree is\n * always removed afterwards, even if the callback throws.\n */\nimport { execFile } from \"node:child_process\";\nimport { promisify } from \"node:util\";\nimport { mkdtemp, rm } from \"node:fs/promises\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\n\nconst exec = promisify(execFile);\n\nasync function git(args: string[], cwd?: string): Promise<void> {\n  await exec(\"git\", args, { cwd });\n}\n\n/**\n * Create a detached worktree of `repoRoot` at HEAD, run `fn` with its path, and\n * always tear it down. Throws if `repoRoot` is not a git repository.\n */\nexport async function withWorktree<T>(\n  repoRoot: string,\n  fn: (dir: string) => Promise<T>,\n): Promise<T> {\n  try {\n    await git([\"rev-parse\", \"--is-inside-work-tree\"], repoRoot);\n  } catch {\n    throw new Error(`withWorktree: \"${repoRoot}\" is not a git repository`);\n  }\n  const base = await mkdtemp(join(tmpdir(), \"quantakrypto-wt-\"));\n  const dir = join(base, \"wt\");\n  // `worktree add` is INSIDE the try so a failure (locked index, disk full)\n  // still cleans up the temp dir in `finally` (audit: arch #6).\n  try {\n    await git([\"worktree\", \"add\", \"--detach\", dir], repoRoot);\n    return await fn(dir);\n  } finally {\n    try {\n      await git([\"worktree\", \"remove\", \"--force\", dir], repoRoot);\n    } catch {\n      // best effort — the temp dir removal below still reclaims the disk.\n    }\n    // Prune stale `.git/worktrees/<name>` metadata a failed add/remove can leave.\n    try {\n      await git([\"worktree\", \"prune\"], repoRoot);\n    } catch {\n      // best effort\n    }\n    await rm(base, { recursive: true, force: true });\n  }\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quantakrypto/core",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "description": "Shared post-quantum readiness library: crypto detectors, vulnerable-dependency database, inventory + SARIF reporting. Zero runtime dependencies.",
   "license": "Apache-2.0",
   "author": "Dandelion Labs <hello@dandelionlabs.io> (https://dandelionlabs.io)",