@quantakrypto/core 0.4.2 → 0.4.4

package/dist/detectors/jose.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Config detector: classical KEY-MANAGEMENT (JWE) algorithms in JOSE. This is
+ * distinct from the JWS signature side (RS256/ES256, handled elsewhere) and from
+ * the JWK key-material detector: here we flag the `alg` values that wrap a
+ * content-encryption key with classical asymmetric crypto, because the encrypted
+ * payload is CONFIDENTIALITY — harvest-now-decrypt-later exposed. A JWE token
+ * captured today (from a log, an audit trail, a stored assertion) is decryptable
+ * once the wrapping key falls to a CRQC.
+ *
+ * Covered `alg` (RFC 7518 §4) values:
+ *  - `RSA-OAEP`, `RSA-OAEP-256`, `RSA1_5`  → RSA key encryption.
+ *  - `ECDH-ES`, `ECDH-ES+A128KW`, …        → classical EC Diffie-Hellman key agreement.
+ *
+ * These exact strings are JOSE identifiers, so a content-level match is precise;
+ * the detector applies to any file (config, JSON, source) after a fast reject.
+ */
+import type { Detector } from "../types.js";
+/** Detects classical JWE key-management (`alg`) values in JOSE tokens/config. */
+export declare const joseDetector: Detector;
+//# sourceMappingURL=jose.d.ts.map

package/dist/detectors/jose.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jose.d.ts","sourceRoot":"","sources":["../../src/detectors/jose.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAgD/D,iFAAiF;AACjF,eAAO,MAAM,YAAY,EAAE,QA4B1B,CAAC"}

package/dist/detectors/jose.js

@@ -0,0 +1,62 @@
+import { DOC_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+const JOSE_RULES = [
+    {
+        re: /"alg"\s*:\s*"RSA(?:-OAEP(?:-256)?|1_5)"/g,
+        meta: {
+            id: "jose-jwe-rsa",
+            title: "JWE RSA key wrapping",
+            description: 'JWE "alg" of RSA-OAEP / RSA-OAEP-256 / RSA1_5 (RFC 7518)',
+            category: "kem",
+            severity: "high",
+            confidence: "high",
+            algorithm: "RSA",
+            hndl: true,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: "JWE wraps the content-encryption key with classical RSA (RSA-OAEP/RSA1_5); the encrypted payload is harvest-now-decrypt-later exposed.",
+            remediation: "Plan migration to a post-quantum KEM (ML-KEM-768) for key wrapping as JOSE/COSE PQ algorithms are standardised.",
+        },
+    },
+    {
+        re: /"alg"\s*:\s*"ECDH-ES(?:\+A\d{3}KW)?"/g,
+        meta: {
+            id: "jose-jwe-ecdh",
+            title: "JWE ECDH-ES key agreement",
+            description: 'JWE "alg" of ECDH-ES / ECDH-ES+A*KW (RFC 7518)',
+            category: "key-exchange",
+            severity: "high",
+            confidence: "high",
+            algorithm: "ECDH",
+            hndl: true,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: "JWE derives the content-encryption key via classical ECDH-ES; the encrypted payload is harvest-now-decrypt-later exposed.",
+            remediation: "Plan migration to hybrid post-quantum key agreement (X25519MLKEM768) as JOSE PQ algorithms are standardised.",
+        },
+    },
+];
+/** Detects classical JWE key-management (`alg`) values in JOSE tokens/config. */
+export const joseDetector = {
+    id: "jose-jwe-keymgmt",
+    description: "Classical JWE key-management algorithms (RSA-OAEP, ECDH-ES) — confidentiality, HNDL",
+    scope: "config",
+    language: "any",
+    rules: JOSE_RULES.map((r) => r.meta),
+    // Prose examples (a README showing `"alg":"RSA-OAEP"`) are not JOSE config.
+    appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),
+    detect({ file, content }) {
+        // Fast reject: no JOSE key-management alg token present.
+        if (!content.includes("RSA-OAEP") &&
+            !content.includes("RSA1_5") &&
+            !content.includes("ECDH-ES")) {
+            return [];
+        }
+        const findings = [];
+        for (const rule of JOSE_RULES) {
+            eachMatch(rule.re, content, (m) => {
+                findings.push(findingFromRule(rule.meta, { file, content, index: m.index, matchLength: m[0].length }));
+            });
+        }
+        return findings;
+    },
+};
+//# sourceMappingURL=jose.js.map

package/dist/detectors/jose.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jose.js","sourceRoot":"","sources":["../../src/detectors/jose.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC9F,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAO9C,MAAM,UAAU,GAAe;IAC7B;QACE,EAAE,EAAE,0CAA0C;QAC9C,IAAI,EAAE;YACJ,EAAE,EAAE,cAAc;YAClB,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,0DAA0D;YACvE,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,wIAAwI;YAC1I,WAAW,EACT,iHAAiH;SACpH;KACF;IACD;QACE,EAAE,EAAE,uCAAuC;QAC3C,IAAI,EAAE;YACJ,EAAE,EAAE,eAAe;YACnB,KAAK,EAAE,2BAA2B;YAClC,WAAW,EAAE,gDAAgD;YAC7D,QAAQ,EAAE,cAAc;YACxB,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,MAAM;YACjB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,2HAA2H;YAC7H,WAAW,EACT,8GAA8G;SACjH;KACF;CACF,CAAC;AAEF,iFAAiF;AACjF,MAAM,CAAC,MAAM,YAAY,GAAa;IACpC,EAAE,EAAE,kBAAkB;IACtB,WAAW,EACT,qFAAqF;IACvF,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpC,4EAA4E;IAC5E,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,cAAc,CAAC;IAClD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,yDAAyD;QACzD,IACE,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;YAC7B,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC3B,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAC5B,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBAChC,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACxF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC","sourcesContent":["/**\n * Config detector: classical KEY-MANAGEMENT (JWE) algorithms in JOSE. This is\n * distinct from the JWS signature side (RS256/ES256, handled elsewhere) and from\n * the JWK key-material detector: here we flag the `alg` values that wrap a\n * content-encryption key with classical asymmetric crypto, because the encrypted\n * payload is CONFIDENTIALITY — harvest-now-decrypt-later exposed. A JWE token\n * captured today (from a log, an audit trail, a stored assertion) is decryptable\n * once the wrapping key falls to a CRQC.\n *\n * Covered `alg` (RFC 7518 §4) values:\n *  - `RSA-OAEP`, `RSA-OAEP-256`, `RSA1_5`  → RSA key encryption.\n *  - `ECDH-ES`, `ECDH-ES+A128KW`, …        → classical EC Diffie-Hellman key agreement.\n *\n * These exact strings are JOSE identifiers, so a content-level match is precise;\n * the detector applies to any file (config, JSON, source) after a fast reject.\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport { DOC_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from \"../detect-utils.js\";\nimport { CWE_BROKEN_CRYPTO } from \"../cwe.js\";\n\ninterface JoseRule {\n  re: RegExp;\n  meta: RuleMeta;\n}\n\nconst JOSE_RULES: JoseRule[] = [\n  {\n    re: /\"alg\"\\s*:\\s*\"RSA(?:-OAEP(?:-256)?|1_5)\"/g,\n    meta: {\n      id: \"jose-jwe-rsa\",\n      title: \"JWE RSA key wrapping\",\n      description: 'JWE \"alg\" of RSA-OAEP / RSA-OAEP-256 / RSA1_5 (RFC 7518)',\n      category: \"kem\",\n      severity: \"high\",\n      confidence: \"high\",\n      algorithm: \"RSA\",\n      hndl: true,\n      cwe: CWE_BROKEN_CRYPTO,\n      message:\n        \"JWE wraps the content-encryption key with classical RSA (RSA-OAEP/RSA1_5); the encrypted payload is harvest-now-decrypt-later exposed.\",\n      remediation:\n        \"Plan migration to a post-quantum KEM (ML-KEM-768) for key wrapping as JOSE/COSE PQ algorithms are standardised.\",\n    },\n  },\n  {\n    re: /\"alg\"\\s*:\\s*\"ECDH-ES(?:\\+A\\d{3}KW)?\"/g,\n    meta: {\n      id: \"jose-jwe-ecdh\",\n      title: \"JWE ECDH-ES key agreement\",\n      description: 'JWE \"alg\" of ECDH-ES / ECDH-ES+A*KW (RFC 7518)',\n      category: \"key-exchange\",\n      severity: \"high\",\n      confidence: \"high\",\n      algorithm: \"ECDH\",\n      hndl: true,\n      cwe: CWE_BROKEN_CRYPTO,\n      message:\n        \"JWE derives the content-encryption key via classical ECDH-ES; the encrypted payload is harvest-now-decrypt-later exposed.\",\n      remediation:\n        \"Plan migration to hybrid post-quantum key agreement (X25519MLKEM768) as JOSE PQ algorithms are standardised.\",\n    },\n  },\n];\n\n/** Detects classical JWE key-management (`alg`) values in JOSE tokens/config. */\nexport const joseDetector: Detector = {\n  id: \"jose-jwe-keymgmt\",\n  description:\n    \"Classical JWE key-management algorithms (RSA-OAEP, ECDH-ES) — confidentiality, HNDL\",\n  scope: \"config\",\n  language: \"any\",\n  rules: JOSE_RULES.map((r) => r.meta),\n  // Prose examples (a README showing `\"alg\":\"RSA-OAEP\"`) are not JOSE config.\n  appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),\n  detect({ file, content }): Finding[] {\n    // Fast reject: no JOSE key-management alg token present.\n    if (\n      !content.includes(\"RSA-OAEP\") &&\n      !content.includes(\"RSA1_5\") &&\n      !content.includes(\"ECDH-ES\")\n    ) {\n      return [];\n    }\n    const findings: Finding[] = [];\n    for (const rule of JOSE_RULES) {\n      eachMatch(rule.re, content, (m) => {\n        findings.push(\n          findingFromRule(rule.meta, { file, content, index: m.index, matchLength: m[0].length }),\n        );\n      });\n    }\n    return findings;\n  },\n};\n"]}

package/dist/detectors/jwk.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Config detector: classical key material in JSON Web Keys (JWK / JWKS, RFC 7517
+ * / 7518). JWKs appear in `.json` / `.jwks` files, OIDC discovery documents, and
+ * config — a real key-material surface the source packs (which look at *code*)
+ * and the PEM detector (which looks at PEM markers) both miss.
+ *
+ * Detection keys off the JWK's distinctive JSON fields:
+ *  - `"kty":"RSA"`                          → classical RSA key.
+ *  - `"crv":"P-256"|"P-384"|"P-521"|…`      → classical EC key (ECDSA + ECDH).
+ *  - `"crv":"Ed25519"|"Ed448"`              → EdDSA signing key.
+ *  - `"crv":"X25519"|"X448"`                → classical Montgomery-curve key agreement.
+ *
+ * Keying EC/OKP off `crv` (present in every EC/OKP JWK) rather than `kty` avoids
+ * double-counting a single key, and `"kty"`/`"crv"` are specific enough to RFC
+ * 7517 that the false-positive risk on ordinary JSON is low.
+ *
+ * HNDL: RSA and (EC)DH / X25519 / X448 key agreement are harvest-now-decrypt-later
+ * exposed (hndl:true); EdDSA signing keys are hndl:false but forgeable. A JWKS is
+ * usually PUBLIC keys, so severity is medium — the exposure is a classical key
+ * pair, not necessarily an embedded secret.
+ */
+import type { Detector } from "../types.js";
+/** Detects classical JSON Web Key (JWK/JWKS) material in any JSON/text file. */
+export declare const jwkDetector: Detector;
+//# sourceMappingURL=jwk.d.ts.map

package/dist/detectors/jwk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwk.d.ts","sourceRoot":"","sources":["../../src/detectors/jwk.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAgF/D,gFAAgF;AAChF,eAAO,MAAM,WAAW,EAAE,QAyBzB,CAAC"}

package/dist/detectors/jwk.js

@@ -0,0 +1,95 @@
+import { eachMatch, findingFromRule } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+const JWK_RULES = [
+    {
+        re: /"kty"\s*:\s*"RSA"/g,
+        meta: {
+            id: "jwk-rsa",
+            title: "RSA JSON Web Key (JWK)",
+            description: 'JWK with "kty":"RSA" (RFC 7518)',
+            category: "certificate",
+            severity: "medium",
+            confidence: "high",
+            algorithm: "RSA",
+            hndl: true,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: "RSA JSON Web Key (JWK); classical RSA, not quantum-safe.",
+            remediation: "Re-issue with PQC keys (ML-KEM-768 for encryption, ML-DSA-65 for signatures).",
+        },
+    },
+    {
+        re: /"crv"\s*:\s*"(?:P-256K?|P-384|P-521|secp256k1)"/g,
+        meta: {
+            id: "jwk-ec",
+            title: "EC JSON Web Key (JWK)",
+            description: 'JWK with an "crv" naming a NIST/secp curve (RFC 7518)',
+            category: "key-exchange",
+            severity: "medium",
+            confidence: "high",
+            algorithm: "ECDH",
+            hndl: true,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: "Elliptic-curve JSON Web Key (JWK); a classical EC key feeds BOTH ECDSA signatures and ECDH key agreement — the ECDH path is harvest-now-decrypt-later exposed.",
+            remediation: "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
+        },
+    },
+    {
+        re: /"crv"\s*:\s*"Ed(?:25519|448)"/g,
+        meta: {
+            id: "jwk-eddsa",
+            title: "EdDSA JSON Web Key (JWK)",
+            description: 'JWK OKP key with "crv":"Ed25519"/"Ed448" (RFC 8037)',
+            category: "signature",
+            severity: "low",
+            confidence: "high",
+            algorithm: "EdDSA",
+            hndl: false,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: "EdDSA (Ed25519/Ed448) JSON Web Key (JWK); classical and forgeable by a quantum attacker.",
+            remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205).",
+        },
+    },
+    {
+        re: /"crv"\s*:\s*"X(?:25519|448)"/g,
+        meta: {
+            id: "jwk-xdh",
+            title: "X25519/X448 JSON Web Key (JWK)",
+            description: 'JWK OKP key with "crv":"X25519"/"X448" (RFC 8037)',
+            category: "key-exchange",
+            severity: "medium",
+            confidence: "high",
+            algorithm: "X25519",
+            hndl: true,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: "X25519/X448 JSON Web Key (JWK); modern but classical key agreement, and harvest-now-decrypt-later exposed.",
+            remediation: "Migrate key agreement to hybrid X25519MLKEM768 (ML-KEM-768).",
+        },
+    },
+];
+/** Detects classical JSON Web Key (JWK/JWKS) material in any JSON/text file. */
+export const jwkDetector = {
+    id: "jwk-material",
+    description: "Classical key material in JSON Web Keys (JWK / JWKS)",
+    scope: "config",
+    language: "any",
+    rules: JWK_RULES.map((r) => r.meta),
+    appliesTo: () => true,
+    detect({ file, content }) {
+        // Fast reject: a JWK always has one of these two members.
+        if (!content.includes('"kty"') && !content.includes('"crv"'))
+            return [];
+        const findings = [];
+        for (const rule of JWK_RULES) {
+            eachMatch(rule.re, content, (m) => {
+                findings.push(findingFromRule(rule.meta, {
+                    file,
+                    content,
+                    index: m.index,
+                    matchLength: m[0].length,
+                }));
+            });
+        }
+        return findings;
+    },
+};
+//# sourceMappingURL=jwk.js.map

package/dist/detectors/jwk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwk.js","sourceRoot":"","sources":["../../src/detectors/jwk.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAO9C,MAAM,SAAS,GAAc;IAC3B;QACE,EAAE,EAAE,oBAAoB;QACxB,IAAI,EAAE;YACJ,EAAE,EAAE,SAAS;YACb,KAAK,EAAE,wBAAwB;YAC/B,WAAW,EAAE,iCAAiC;YAC9C,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,OAAO,EAAE,0DAA0D;YACnE,WAAW,EAAE,+EAA+E;SAC7F;KACF;IACD;QACE,EAAE,EAAE,kDAAkD;QACtD,IAAI,EAAE;YACJ,EAAE,EAAE,QAAQ;YACZ,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,uDAAuD;YACpE,QAAQ,EAAE,cAAc;YACxB,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,MAAM;YACjB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,gKAAgK;YAClK,WAAW,EACT,8FAA8F;SACjG;KACF;IACD;QACE,EAAE,EAAE,gCAAgC;QACpC,IAAI,EAAE;YACJ,EAAE,EAAE,WAAW;YACf,KAAK,EAAE,0BAA0B;YACjC,WAAW,EAAE,qDAAqD;YAClE,QAAQ,EAAE,WAAW;YACrB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,OAAO;YAClB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,0FAA0F;YAC5F,WAAW,EAAE,6CAA6C;SAC3D;KACF;IACD;QACE,EAAE,EAAE,+BAA+B;QACnC,IAAI,EAAE;YACJ,EAAE,EAAE,SAAS;YACb,KAAK,EAAE,gCAAgC;YACvC,WAAW,EAAE,mDAAmD;YAChE,QAAQ,EAAE,cAAc;YACxB,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,QAAQ;YACnB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,4GAA4G;YAC9G,WAAW,EAAE,8DAA8D;SAC5E;KACF;CACF,CAAC;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,WAAW,GAAa;IACnC,EAAE,EAAE,cAAc;IAClB,WAAW,EAAE,sDAAsD;IACnE,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACnC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI;IACrB,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,0DAA0D;QAC1D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;QACxE,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBAChC,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE;oBACzB,IAAI;oBACJ,OAAO;oBACP,KAAK,EAAE,CAAC,CAAC,KAAK;oBACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;iBACzB,CAAC,CACH,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC","sourcesContent":["/**\n * Config detector: classical key material in JSON Web Keys (JWK / JWKS, RFC 7517\n * / 7518). JWKs appear in `.json` / `.jwks` files, OIDC discovery documents, and\n * config — a real key-material surface the source packs (which look at *code*)\n * and the PEM detector (which looks at PEM markers) both miss.\n *\n * Detection keys off the JWK's distinctive JSON fields:\n *  - `\"kty\":\"RSA\"`                          → classical RSA key.\n *  - `\"crv\":\"P-256\"|\"P-384\"|\"P-521\"|…`      → classical EC key (ECDSA + ECDH).\n *  - `\"crv\":\"Ed25519\"|\"Ed448\"`              → EdDSA signing key.\n *  - `\"crv\":\"X25519\"|\"X448\"`                → classical Montgomery-curve key agreement.\n *\n * Keying EC/OKP off `crv` (present in every EC/OKP JWK) rather than `kty` avoids\n * double-counting a single key, and `\"kty\"`/`\"crv\"` are specific enough to RFC\n * 7517 that the false-positive risk on ordinary JSON is low.\n *\n * HNDL: RSA and (EC)DH / X25519 / X448 key agreement are harvest-now-decrypt-later\n * exposed (hndl:true); EdDSA signing keys are hndl:false but forgeable. A JWKS is\n * usually PUBLIC keys, so severity is medium — the exposure is a classical key\n * pair, not necessarily an embedded secret.\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport { eachMatch, findingFromRule } from \"../detect-utils.js\";\nimport { CWE_BROKEN_CRYPTO } from \"../cwe.js\";\n\ninterface JwkRule {\n  re: RegExp;\n  meta: RuleMeta;\n}\n\nconst JWK_RULES: JwkRule[] = [\n  {\n    re: /\"kty\"\\s*:\\s*\"RSA\"/g,\n    meta: {\n      id: \"jwk-rsa\",\n      title: \"RSA JSON Web Key (JWK)\",\n      description: 'JWK with \"kty\":\"RSA\" (RFC 7518)',\n      category: \"certificate\",\n      severity: \"medium\",\n      confidence: \"high\",\n      algorithm: \"RSA\",\n      hndl: true,\n      cwe: CWE_BROKEN_CRYPTO,\n      message: \"RSA JSON Web Key (JWK); classical RSA, not quantum-safe.\",\n      remediation: \"Re-issue with PQC keys (ML-KEM-768 for encryption, ML-DSA-65 for signatures).\",\n    },\n  },\n  {\n    re: /\"crv\"\\s*:\\s*\"(?:P-256K?|P-384|P-521|secp256k1)\"/g,\n    meta: {\n      id: \"jwk-ec\",\n      title: \"EC JSON Web Key (JWK)\",\n      description: 'JWK with an \"crv\" naming a NIST/secp curve (RFC 7518)',\n      category: \"key-exchange\",\n      severity: \"medium\",\n      confidence: \"high\",\n      algorithm: \"ECDH\",\n      hndl: true,\n      cwe: CWE_BROKEN_CRYPTO,\n      message:\n        \"Elliptic-curve JSON Web Key (JWK); a classical EC key feeds BOTH ECDSA signatures and ECDH key agreement — the ECDH path is harvest-now-decrypt-later exposed.\",\n      remediation:\n        \"For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).\",\n    },\n  },\n  {\n    re: /\"crv\"\\s*:\\s*\"Ed(?:25519|448)\"/g,\n    meta: {\n      id: \"jwk-eddsa\",\n      title: \"EdDSA JSON Web Key (JWK)\",\n      description: 'JWK OKP key with \"crv\":\"Ed25519\"/\"Ed448\" (RFC 8037)',\n      category: \"signature\",\n      severity: \"low\",\n      confidence: \"high\",\n      algorithm: \"EdDSA\",\n      hndl: false,\n      cwe: CWE_BROKEN_CRYPTO,\n      message:\n        \"EdDSA (Ed25519/Ed448) JSON Web Key (JWK); classical and forgeable by a quantum attacker.\",\n      remediation: \"ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205).\",\n    },\n  },\n  {\n    re: /\"crv\"\\s*:\\s*\"X(?:25519|448)\"/g,\n    meta: {\n      id: \"jwk-xdh\",\n      title: \"X25519/X448 JSON Web Key (JWK)\",\n      description: 'JWK OKP key with \"crv\":\"X25519\"/\"X448\" (RFC 8037)',\n      category: \"key-exchange\",\n      severity: \"medium\",\n      confidence: \"high\",\n      algorithm: \"X25519\",\n      hndl: true,\n      cwe: CWE_BROKEN_CRYPTO,\n      message:\n        \"X25519/X448 JSON Web Key (JWK); modern but classical key agreement, and harvest-now-decrypt-later exposed.\",\n      remediation: \"Migrate key agreement to hybrid X25519MLKEM768 (ML-KEM-768).\",\n    },\n  },\n];\n\n/** Detects classical JSON Web Key (JWK/JWKS) material in any JSON/text file. */\nexport const jwkDetector: Detector = {\n  id: \"jwk-material\",\n  description: \"Classical key material in JSON Web Keys (JWK / JWKS)\",\n  scope: \"config\",\n  language: \"any\",\n  rules: JWK_RULES.map((r) => r.meta),\n  appliesTo: () => true,\n  detect({ file, content }): Finding[] {\n    // Fast reject: a JWK always has one of these two members.\n    if (!content.includes('\"kty\"') && !content.includes('\"crv\"')) return [];\n    const findings: Finding[] = [];\n    for (const rule of JWK_RULES) {\n      eachMatch(rule.re, content, (m) => {\n        findings.push(\n          findingFromRule(rule.meta, {\n            file,\n            content,\n            index: m.index,\n            matchLength: m[0].length,\n          }),\n        );\n      });\n    }\n    return findings;\n  },\n};\n"]}

package/dist/detectors/k8s.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Config detector: classical crypto in Kubernetes manifests — cert-manager key
+ * algorithms and service-mesh (Istio) TLS floors. These mint the certificates
+ * and secure the pod-to-pod traffic of a cluster, a surface neither the language
+ * packs nor the Terraform detector see.
+ *
+ * Covered (gated by a cert-manager / Istio marker in the document to keep the
+ * generic `algorithm:` / `minProtocolVersion:` keys from firing on unrelated YAML):
+ *  - cert-manager `Certificate`/`Issuer` `privateKey.algorithm` (or legacy
+ *    `keyAlgorithm`): `RSA` | `ECDSA` | `Ed25519`.
+ *  - Istio `minProtocolVersion: TLSV1_0 | TLSV1_1` — a legacy TLS floor on mesh
+ *    traffic, whose (EC)DHE key exchange is classical and harvestable.
+ */
+import type { Detector } from "../types.js";
+/** Detects classical cert-manager keys and legacy Istio TLS floors in K8s YAML. */
+export declare const k8sDetector: Detector;
+//# sourceMappingURL=k8s.d.ts.map

package/dist/detectors/k8s.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"k8s.d.ts","sourceRoot":"","sources":["../../src/detectors/k8s.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAoE/D,mFAAmF;AACnF,eAAO,MAAM,WAAW,EAAE,QA6BzB,CAAC"}

package/dist/detectors/k8s.js

@@ -0,0 +1,85 @@
+import { eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO, CWE_RISKY_PRIMITIVE } from "../cwe.js";
+const K8S_EXTENSIONS = [".yaml", ".yml", ".json"];
+const RE_CM_RSA = /(?:algorithm|keyAlgorithm):\s*["']?RSA\b/g;
+const RE_CM_ECDSA = /(?:algorithm|keyAlgorithm):\s*["']?ECDSA\b/g;
+const RE_CM_ED25519 = /(?:algorithm|keyAlgorithm):\s*["']?Ed25519\b/g;
+const RE_ISTIO_LEGACY_TLS = /minProtocolVersion:\s*["']?TLSV1_[01]\b/g;
+const RULE_CM_RSA = {
+    id: "k8s-certmanager-rsa",
+    title: "cert-manager RSA key",
+    description: "cert-manager Certificate/Issuer privateKey.algorithm = RSA",
+    category: "certificate",
+    severity: "medium",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "cert-manager mints certificates with a classical RSA key, which is not quantum-safe.",
+    remediation: "Plan migration to PQC certificate keys (ML-DSA-65) as the CA/issuer chain adds support.",
+};
+const RULE_CM_ECDSA = {
+    id: "k8s-certmanager-ecdsa",
+    title: "cert-manager ECDSA key",
+    description: "cert-manager Certificate/Issuer privateKey.algorithm = ECDSA",
+    category: "certificate",
+    severity: "medium",
+    confidence: "high",
+    algorithm: "ECDSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "cert-manager mints certificates with a classical ECDSA key, forgeable by a quantum attacker.",
+    remediation: "Plan migration to ML-DSA-65 (FIPS 204) certificate keys.",
+};
+const RULE_CM_ED25519 = {
+    id: "k8s-certmanager-ed25519",
+    title: "cert-manager Ed25519 key",
+    description: "cert-manager Certificate/Issuer privateKey.algorithm = Ed25519",
+    category: "certificate",
+    severity: "low",
+    confidence: "high",
+    algorithm: "EdDSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "cert-manager mints certificates with a classical Ed25519 key, forgeable by a quantum attacker.",
+    remediation: "Plan migration to ML-DSA-65 (FIPS 204) certificate keys.",
+};
+const RULE_ISTIO_LEGACY_TLS = {
+    id: "k8s-istio-legacy-tls",
+    title: "Istio legacy TLS floor",
+    description: "Istio minProtocolVersion allows TLS 1.0 / 1.1 on mesh traffic",
+    category: "tls",
+    severity: "medium",
+    confidence: "high",
+    hndl: false,
+    cwe: CWE_RISKY_PRIMITIVE,
+    message: "Istio mesh TLS floor allows TLS 1.0/1.1; its classical (EC)DHE key exchange is weak and harvestable.",
+    remediation: "Raise minProtocolVersion to TLSV1_3 and track PQC-hybrid mesh KEX (X25519MLKEM768).",
+};
+/** Detects classical cert-manager keys and legacy Istio TLS floors in K8s YAML. */
+export const k8sDetector = {
+    id: "k8s-crypto",
+    description: "Classical crypto in Kubernetes manifests (cert-manager keys, Istio TLS floors)",
+    scope: "config",
+    language: "any",
+    rules: [RULE_CM_RSA, RULE_CM_ECDSA, RULE_CM_ED25519, RULE_ISTIO_LEGACY_TLS],
+    appliesTo: (f) => hasExtension(f, K8S_EXTENSIONS),
+    detect({ file, content }) {
+        const isCertManager = content.includes("cert-manager.io") ||
+            /kind:\s*["']?(?:Certificate|Issuer|ClusterIssuer)\b/.test(content);
+        const isIstio = content.includes("minProtocolVersion");
+        if (!isCertManager && !isIstio)
+            return [];
+        const findings = [];
+        const add = (re, rule) => eachMatch(re, content, (m) => findings.push(findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length })));
+        if (isCertManager) {
+            add(RE_CM_RSA, RULE_CM_RSA);
+            add(RE_CM_ECDSA, RULE_CM_ECDSA);
+            add(RE_CM_ED25519, RULE_CM_ED25519);
+        }
+        if (isIstio)
+            add(RE_ISTIO_LEGACY_TLS, RULE_ISTIO_LEGACY_TLS);
+        return findings;
+    },
+};
+//# sourceMappingURL=k8s.js.map

package/dist/detectors/k8s.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"k8s.js","sourceRoot":"","sources":["../../src/detectors/k8s.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEnE,MAAM,cAAc,GAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAErE,MAAM,SAAS,GAAG,2CAA2C,CAAC;AAC9D,MAAM,WAAW,GAAG,6CAA6C,CAAC;AAClE,MAAM,aAAa,GAAG,+CAA+C,CAAC;AACtE,MAAM,mBAAmB,GAAG,0CAA0C,CAAC;AAEvE,MAAM,WAAW,GAAa;IAC5B,EAAE,EAAE,qBAAqB;IACzB,KAAK,EAAE,sBAAsB;IAC7B,WAAW,EAAE,4DAA4D;IACzE,QAAQ,EAAE,aAAa;IACvB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,sFAAsF;IAC/F,WAAW,EACT,yFAAyF;CAC5F,CAAC;AACF,MAAM,aAAa,GAAa;IAC9B,EAAE,EAAE,uBAAuB;IAC3B,KAAK,EAAE,wBAAwB;IAC/B,WAAW,EAAE,8DAA8D;IAC3E,QAAQ,EAAE,aAAa;IACvB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,8FAA8F;IAChG,WAAW,EAAE,0DAA0D;CACxE,CAAC;AACF,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,yBAAyB;IAC7B,KAAK,EAAE,0BAA0B;IACjC,WAAW,EAAE,gEAAgE;IAC7E,QAAQ,EAAE,aAAa;IACvB,QAAQ,EAAE,KAAK;IACf,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,gGAAgG;IAClG,WAAW,EAAE,0DAA0D;CACxE,CAAC;AACF,MAAM,qBAAqB,GAAa;IACtC,EAAE,EAAE,sBAAsB;IAC1B,KAAK,EAAE,wBAAwB;IAC/B,WAAW,EAAE,+DAA+D;IAC5E,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,mBAAmB;IACxB,OAAO,EACL,sGAAsG;IACxG,WAAW,EACT,qFAAqF;CACxF,CAAC;AAEF,mFAAmF;AACnF,MAAM,CAAC,MAAM,WAAW,GAAa;IACnC,EAAE,EAAE,YAAY;IAChB,WAAW,EAAE,gFAAgF;IAC7F,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,CAAC,WAAW,EAAE,aAAa,EAAE,eAAe,EAAE,qBAAqB,CAAC;IAC3E,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,cAAc,CAAC;IACjD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,aAAa,GACjB,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YACnC,qDAAqD,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;QACvD,IAAI,CAAC,aAAa,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;QAE1C,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,IAAc,EAAE,EAAE,CACzC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAC3B,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACnF,CACF,CAAC;QACJ,IAAI,aAAa,EAAE,CAAC;YAClB,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YAC5B,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;YAChC,GAAG,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,OAAO;YAAE,GAAG,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAAC;QAC7D,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC","sourcesContent":["/**\n * Config detector: classical crypto in Kubernetes manifests — cert-manager key\n * algorithms and service-mesh (Istio) TLS floors. These mint the certificates\n * and secure the pod-to-pod traffic of a cluster, a surface neither the language\n * packs nor the Terraform detector see.\n *\n * Covered (gated by a cert-manager / Istio marker in the document to keep the\n * generic `algorithm:` / `minProtocolVersion:` keys from firing on unrelated YAML):\n *  - cert-manager `Certificate`/`Issuer` `privateKey.algorithm` (or legacy\n *    `keyAlgorithm`): `RSA` | `ECDSA` | `Ed25519`.\n *  - Istio `minProtocolVersion: TLSV1_0 | TLSV1_1` — a legacy TLS floor on mesh\n *    traffic, whose (EC)DHE key exchange is classical and harvestable.\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport { eachMatch, findingFromRule, hasExtension } from \"../detect-utils.js\";\nimport { CWE_BROKEN_CRYPTO, CWE_RISKY_PRIMITIVE } from \"../cwe.js\";\n\nconst K8S_EXTENSIONS: readonly string[] = [\".yaml\", \".yml\", \".json\"];\n\nconst RE_CM_RSA = /(?:algorithm|keyAlgorithm):\\s*[\"']?RSA\\b/g;\nconst RE_CM_ECDSA = /(?:algorithm|keyAlgorithm):\\s*[\"']?ECDSA\\b/g;\nconst RE_CM_ED25519 = /(?:algorithm|keyAlgorithm):\\s*[\"']?Ed25519\\b/g;\nconst RE_ISTIO_LEGACY_TLS = /minProtocolVersion:\\s*[\"']?TLSV1_[01]\\b/g;\n\nconst RULE_CM_RSA: RuleMeta = {\n  id: \"k8s-certmanager-rsa\",\n  title: \"cert-manager RSA key\",\n  description: \"cert-manager Certificate/Issuer privateKey.algorithm = RSA\",\n  category: \"certificate\",\n  severity: \"medium\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"cert-manager mints certificates with a classical RSA key, which is not quantum-safe.\",\n  remediation:\n    \"Plan migration to PQC certificate keys (ML-DSA-65) as the CA/issuer chain adds support.\",\n};\nconst RULE_CM_ECDSA: RuleMeta = {\n  id: \"k8s-certmanager-ecdsa\",\n  title: \"cert-manager ECDSA key\",\n  description: \"cert-manager Certificate/Issuer privateKey.algorithm = ECDSA\",\n  category: \"certificate\",\n  severity: \"medium\",\n  confidence: \"high\",\n  algorithm: \"ECDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"cert-manager mints certificates with a classical ECDSA key, forgeable by a quantum attacker.\",\n  remediation: \"Plan migration to ML-DSA-65 (FIPS 204) certificate keys.\",\n};\nconst RULE_CM_ED25519: RuleMeta = {\n  id: \"k8s-certmanager-ed25519\",\n  title: \"cert-manager Ed25519 key\",\n  description: \"cert-manager Certificate/Issuer privateKey.algorithm = Ed25519\",\n  category: \"certificate\",\n  severity: \"low\",\n  confidence: \"high\",\n  algorithm: \"EdDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"cert-manager mints certificates with a classical Ed25519 key, forgeable by a quantum attacker.\",\n  remediation: \"Plan migration to ML-DSA-65 (FIPS 204) certificate keys.\",\n};\nconst RULE_ISTIO_LEGACY_TLS: RuleMeta = {\n  id: \"k8s-istio-legacy-tls\",\n  title: \"Istio legacy TLS floor\",\n  description: \"Istio minProtocolVersion allows TLS 1.0 / 1.1 on mesh traffic\",\n  category: \"tls\",\n  severity: \"medium\",\n  confidence: \"high\",\n  hndl: false,\n  cwe: CWE_RISKY_PRIMITIVE,\n  message:\n    \"Istio mesh TLS floor allows TLS 1.0/1.1; its classical (EC)DHE key exchange is weak and harvestable.\",\n  remediation:\n    \"Raise minProtocolVersion to TLSV1_3 and track PQC-hybrid mesh KEX (X25519MLKEM768).\",\n};\n\n/** Detects classical cert-manager keys and legacy Istio TLS floors in K8s YAML. */\nexport const k8sDetector: Detector = {\n  id: \"k8s-crypto\",\n  description: \"Classical crypto in Kubernetes manifests (cert-manager keys, Istio TLS floors)\",\n  scope: \"config\",\n  language: \"any\",\n  rules: [RULE_CM_RSA, RULE_CM_ECDSA, RULE_CM_ED25519, RULE_ISTIO_LEGACY_TLS],\n  appliesTo: (f) => hasExtension(f, K8S_EXTENSIONS),\n  detect({ file, content }): Finding[] {\n    const isCertManager =\n      content.includes(\"cert-manager.io\") ||\n      /kind:\\s*[\"']?(?:Certificate|Issuer|ClusterIssuer)\\b/.test(content);\n    const isIstio = content.includes(\"minProtocolVersion\");\n    if (!isCertManager && !isIstio) return [];\n\n    const findings: Finding[] = [];\n    const add = (re: RegExp, rule: RuleMeta) =>\n      eachMatch(re, content, (m) =>\n        findings.push(\n          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),\n        ),\n      );\n    if (isCertManager) {\n      add(RE_CM_RSA, RULE_CM_RSA);\n      add(RE_CM_ECDSA, RULE_CM_ECDSA);\n      add(RE_CM_ED25519, RULE_CM_ED25519);\n    }\n    if (isIstio) add(RE_ISTIO_LEGACY_TLS, RULE_ISTIO_LEGACY_TLS);\n    return findings;\n  },\n};\n"]}

package/dist/detectors/mesh.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Config detector: classical crypto in SERVICE MESH configuration — the
+ * control-plane identity/CA systems and mesh-internal TLS settings of
+ * Linkerd, HashiCorp Consul Connect, and Istio. These mint the mTLS identity
+ * certificates that secure sidecar-to-sidecar traffic and are configured in
+ * their own Helm values / HCL / CRD surfaces, distinct from what `k8s.ts`
+ * already covers (cert-manager `Certificate`/`Issuer` keys and Istio's
+ * `minProtocolVersion` TLS floor — NOT duplicated here).
+ *
+ * Covered (gated by a mesh marker in the document to keep generic keys like
+ * `scheme:` / `private_key_type` from firing on unrelated YAML/HCL):
+ *  - Linkerd control-plane identity issuer: Helm values `identityTrustAnchorsPEM`
+ *    and `identity.issuer.scheme` / nested `issuer.scheme: linkerd.io/tls` — the
+ *    default self-managed Linkerd identity scheme, which mints workload
+ *    certificates from an ECDSA P-256 trust anchor. Flagged as a classical mesh
+ *    CA (certificate, ECDSA, hndl:false) since Linkerd's identity issuer signs
+ *    forgeable-by-quantum leaf certs, not a confidentiality key.
+ *  - HashiCorp Consul Connect: the `connect { ca_config { private_key_type =
+ *    "ec" | "rsa" } } }` mesh CA provider setting (also `ca_provider`). Flagged
+ *    as a classical mesh CA (certificate; ECDSA for "ec", RSA for "rsa").
+ *  - Istio `DestinationRule` / `Gateway` `tls.cipherSuites:` listing a classical
+ *    `ECDHE-RSA-*` / `ECDHE-ECDSA-*` suite — the (EC)DHE key exchange in these
+ *    suites is classical and harvest-now-decrypt-later exposed (tls, ECDH,
+ *    hndl:true). This complements, and does not duplicate, `k8s.ts`'s
+ *    `minProtocolVersion` legacy-TLS-floor rule.
+ */
+import type { Detector } from "../types.js";
+/**
+ * Detects classical asymmetric crypto in service-mesh configuration: Linkerd's
+ * default ECDSA identity issuer, Consul Connect's mesh CA private key type,
+ * and classical ECDHE cipher suites in Istio DestinationRule/Gateway TLS
+ * policy.
+ */
+export declare const meshDetector: Detector;
+//# sourceMappingURL=mesh.d.ts.map

package/dist/detectors/mesh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mesh.d.ts","sourceRoot":"","sources":["../../src/detectors/mesh.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAuF/D;;;;;GAKG;AACH,eAAO,MAAM,YAAY,EAAE,QAkC1B,CAAC"}

package/dist/detectors/mesh.js

@@ -0,0 +1,109 @@
+import { eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO, CWE_RISKY_PRIMITIVE } from "../cwe.js";
+const MESH_EXTENSIONS = [".yaml", ".yml", ".hcl"];
+// Linkerd's default self-managed identity scheme (`linkerd.io/tls`, as opposed
+// to a `kubernetes.io/tls` bring-your-own-cert secret) mints its trust anchor
+// and issuer credentials as ECDSA P-256 by default. Matched in both nested
+// YAML form (`scheme: linkerd.io/tls`) and the flattened Helm `--set`/values
+// key form (`identity.issuer.scheme: linkerd.io/tls`), plus the distinctive
+// `identityTrustAnchorsPEM` values key which only exists in Linkerd charts.
+const RE_MESH_LINKERD_ECDSA = /identityTrustAnchorsPEM\b|(?:identity\.issuer\.scheme|scheme)\s*[:=]\s*["']?linkerd\.io\/tls\b/g;
+// Consul Connect's CA provider config: `private_key_type = "ec" | "rsa"`
+// inside a `ca_config` block. Matched in both HCL (`=`) and JSON (`:`) forms,
+// mirroring the terraform.ts attribute-matching convention.
+const RE_MESH_CONSUL_RSA = /(?<![\w"-])"?private_key_type"?\s*[:=]\s*"rsa"/gi;
+const RE_MESH_CONSUL_EC = /(?<![\w"-])"?private_key_type"?\s*[:=]\s*"ec"/gi;
+// Istio mesh TLS cipher suites: OpenSSL-style suite names naming classical
+// ECDHE key exchange combined with an RSA or ECDSA certificate. These are
+// distinctive tokens (no generic-config collision risk).
+const RE_MESH_ISTIO_CLASSICAL_CIPHER = /\bECDHE-(?:RSA|ECDSA)-[A-Z0-9_-]+\b/g;
+const RULE_MESH_LINKERD_ECDSA = {
+    id: "mesh-linkerd-identity-ecdsa",
+    title: "Linkerd ECDSA identity issuer",
+    description: "Linkerd control-plane identity issuer (default ECDSA P-256 mesh CA)",
+    category: "certificate",
+    severity: "medium",
+    confidence: "high",
+    algorithm: "ECDSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Linkerd's control-plane identity issuer mints workload certificates from a classical ECDSA P-256 trust anchor by default, forgeable by a quantum attacker.",
+    remediation: "Plan migration to ML-DSA-65 (FIPS 204) once Linkerd's identity issuer supports PQC signing.",
+};
+const RULE_MESH_CONSUL_RSA = {
+    id: "mesh-consul-connect-rsa",
+    title: "Consul Connect RSA mesh CA",
+    description: 'Consul Connect ca_config private_key_type = "rsa"',
+    category: "certificate",
+    severity: "medium",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Consul Connect's mesh CA issues leaf certificates from a classical RSA private key, which is not quantum-safe.",
+    remediation: "Plan migration to PQC certificate keys (ML-DSA-65) as the Connect CA provider adds support.",
+};
+const RULE_MESH_CONSUL_EC = {
+    id: "mesh-consul-connect-ec",
+    title: "Consul Connect EC mesh CA",
+    description: 'Consul Connect ca_config private_key_type = "ec"',
+    category: "certificate",
+    severity: "medium",
+    confidence: "high",
+    algorithm: "ECDSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Consul Connect's mesh CA issues leaf certificates from a classical EC private key, forgeable by a quantum attacker.",
+    remediation: "Plan migration to ML-DSA-65 (FIPS 204) as the Connect CA provider adds support.",
+};
+const RULE_MESH_ISTIO_CLASSICAL_CIPHER = {
+    id: "mesh-istio-classical-cipher",
+    title: "Istio classical ECDHE cipher suite",
+    description: "Istio DestinationRule/Gateway tls.cipherSuites lists a classical ECDHE-RSA/ECDHE-ECDSA suite",
+    category: "tls",
+    severity: "medium",
+    confidence: "high",
+    algorithm: "ECDH",
+    hndl: true,
+    cwe: CWE_RISKY_PRIMITIVE,
+    message: "Istio mesh TLS cipher suite allows classical ECDHE key exchange, which is harvest-now-decrypt-later exposed.",
+    remediation: "Prefer TLS 1.3 AEAD suites and track PQC-hybrid mesh key exchange (X25519MLKEM768) as Envoy/BoringSSL adds support.",
+};
+/**
+ * Detects classical asymmetric crypto in service-mesh configuration: Linkerd's
+ * default ECDSA identity issuer, Consul Connect's mesh CA private key type,
+ * and classical ECDHE cipher suites in Istio DestinationRule/Gateway TLS
+ * policy.
+ */
+export const meshDetector = {
+    id: "service-mesh-crypto",
+    description: "Classical crypto in service-mesh config (Linkerd identity, Consul Connect CA, Istio cipher suites)",
+    scope: "config",
+    language: "any",
+    rules: [
+        RULE_MESH_LINKERD_ECDSA,
+        RULE_MESH_CONSUL_RSA,
+        RULE_MESH_CONSUL_EC,
+        RULE_MESH_ISTIO_CLASSICAL_CIPHER,
+    ],
+    appliesTo: (f) => hasExtension(f, MESH_EXTENSIONS),
+    detect({ file, content }) {
+        const isLinkerd = content.includes("linkerd") || content.includes("identityTrustAnchors");
+        const isConsulConnect = content.includes("consul") && content.includes("connect");
+        const isIstioCipher = content.includes("DestinationRule") || content.includes("cipherSuites");
+        if (!isLinkerd && !isConsulConnect && !isIstioCipher)
+            return [];
+        const findings = [];
+        const add = (re, rule) => eachMatch(re, content, (m) => findings.push(findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length })));
+        if (isLinkerd)
+            add(RE_MESH_LINKERD_ECDSA, RULE_MESH_LINKERD_ECDSA);
+        if (isConsulConnect) {
+            add(RE_MESH_CONSUL_RSA, RULE_MESH_CONSUL_RSA);
+            add(RE_MESH_CONSUL_EC, RULE_MESH_CONSUL_EC);
+        }
+        if (isIstioCipher)
+            add(RE_MESH_ISTIO_CLASSICAL_CIPHER, RULE_MESH_ISTIO_CLASSICAL_CIPHER);
+        return findings;
+    },
+};
+//# sourceMappingURL=mesh.js.map

package/dist/detectors/mesh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mesh.js","sourceRoot":"","sources":["../../src/detectors/mesh.ts"],"names":[],"mappings":"AA2BA,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAEnE,MAAM,eAAe,GAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAErE,+EAA+E;AAC/E,8EAA8E;AAC9E,2EAA2E;AAC3E,6EAA6E;AAC7E,4EAA4E;AAC5E,4EAA4E;AAC5E,MAAM,qBAAqB,GACzB,iGAAiG,CAAC;AAEpG,yEAAyE;AACzE,8EAA8E;AAC9E,4DAA4D;AAC5D,MAAM,kBAAkB,GAAG,kDAAkD,CAAC;AAC9E,MAAM,iBAAiB,GAAG,iDAAiD,CAAC;AAE5E,2EAA2E;AAC3E,0EAA0E;AAC1E,yDAAyD;AACzD,MAAM,8BAA8B,GAAG,sCAAsC,CAAC;AAE9E,MAAM,uBAAuB,GAAa;IACxC,EAAE,EAAE,6BAA6B;IACjC,KAAK,EAAE,+BAA+B;IACtC,WAAW,EAAE,qEAAqE;IAClF,QAAQ,EAAE,aAAa;IACvB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,4JAA4J;IAC9J,WAAW,EACT,6FAA6F;CAChG,CAAC;AACF,MAAM,oBAAoB,GAAa;IACrC,EAAE,EAAE,yBAAyB;IAC7B,KAAK,EAAE,4BAA4B;IACnC,WAAW,EAAE,mDAAmD;IAChE,QAAQ,EAAE,aAAa;IACvB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,gHAAgH;IAClH,WAAW,EACT,6FAA6F;CAChG,CAAC;AACF,MAAM,mBAAmB,GAAa;IACpC,EAAE,EAAE,wBAAwB;IAC5B,KAAK,EAAE,2BAA2B;IAClC,WAAW,EAAE,kDAAkD;IAC/D,QAAQ,EAAE,aAAa;IACvB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,qHAAqH;IACvH,WAAW,EAAE,iFAAiF;CAC/F,CAAC;AACF,MAAM,gCAAgC,GAAa;IACjD,EAAE,EAAE,6BAA6B;IACjC,KAAK,EAAE,oCAAoC;IAC3C,WAAW,EACT,8FAA8F;IAChG,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,mBAAmB;IACxB,OAAO,EACL,8GAA8G;IAChH,WAAW,EACT,qHAAqH;CACxH,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,YAAY,GAAa;IACpC,EAAE,EAAE,qBAAqB;IACzB,WAAW,EACT,oGAAoG;IACtG,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE;QACL,uBAAuB;QACvB,oBAAoB;QACpB,mBAAmB;QACnB,gCAAgC;KACjC;IACD,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,eAAe,CAAC;IAClD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;QAC1F,MAAM,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAClF,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAC9F,IAAI,CAAC,SAAS,IAAI,CAAC,eAAe,IAAI,CAAC,aAAa;YAAE,OAAO,EAAE,CAAC;QAEhE,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,IAAc,EAAE,EAAE,CACzC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAC3B,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACnF,CACF,CAAC;QACJ,IAAI,SAAS;YAAE,GAAG,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,CAAC;QACnE,IAAI,eAAe,EAAE,CAAC;YACpB,GAAG,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAAC;YAC9C,GAAG,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,aAAa;YAAE,GAAG,CAAC,8BAA8B,EAAE,gCAAgC,CAAC,CAAC;QACzF,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC","sourcesContent":["/**\n * Config detector: classical crypto in SERVICE MESH configuration — the\n * control-plane identity/CA systems and mesh-internal TLS settings of\n * Linkerd, HashiCorp Consul Connect, and Istio. These mint the mTLS identity\n * certificates that secure sidecar-to-sidecar traffic and are configured in\n * their own Helm values / HCL / CRD surfaces, distinct from what `k8s.ts`\n * already covers (cert-manager `Certificate`/`Issuer` keys and Istio's\n * `minProtocolVersion` TLS floor — NOT duplicated here).\n *\n * Covered (gated by a mesh marker in the document to keep generic keys like\n * `scheme:` / `private_key_type` from firing on unrelated YAML/HCL):\n *  - Linkerd control-plane identity issuer: Helm values `identityTrustAnchorsPEM`\n *    and `identity.issuer.scheme` / nested `issuer.scheme: linkerd.io/tls` — the\n *    default self-managed Linkerd identity scheme, which mints workload\n *    certificates from an ECDSA P-256 trust anchor. Flagged as a classical mesh\n *    CA (certificate, ECDSA, hndl:false) since Linkerd's identity issuer signs\n *    forgeable-by-quantum leaf certs, not a confidentiality key.\n *  - HashiCorp Consul Connect: the `connect { ca_config { private_key_type =\n *    \"ec\" | \"rsa\" } } }` mesh CA provider setting (also `ca_provider`). Flagged\n *    as a classical mesh CA (certificate; ECDSA for \"ec\", RSA for \"rsa\").\n *  - Istio `DestinationRule` / `Gateway` `tls.cipherSuites:` listing a classical\n *    `ECDHE-RSA-*` / `ECDHE-ECDSA-*` suite — the (EC)DHE key exchange in these\n *    suites is classical and harvest-now-decrypt-later exposed (tls, ECDH,\n *    hndl:true). This complements, and does not duplicate, `k8s.ts`'s\n *    `minProtocolVersion` legacy-TLS-floor rule.\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport { eachMatch, findingFromRule, hasExtension } from \"../detect-utils.js\";\nimport { CWE_BROKEN_CRYPTO, CWE_RISKY_PRIMITIVE } from \"../cwe.js\";\n\nconst MESH_EXTENSIONS: readonly string[] = [\".yaml\", \".yml\", \".hcl\"];\n\n// Linkerd's default self-managed identity scheme (`linkerd.io/tls`, as opposed\n// to a `kubernetes.io/tls` bring-your-own-cert secret) mints its trust anchor\n// and issuer credentials as ECDSA P-256 by default. Matched in both nested\n// YAML form (`scheme: linkerd.io/tls`) and the flattened Helm `--set`/values\n// key form (`identity.issuer.scheme: linkerd.io/tls`), plus the distinctive\n// `identityTrustAnchorsPEM` values key which only exists in Linkerd charts.\nconst RE_MESH_LINKERD_ECDSA =\n  /identityTrustAnchorsPEM\\b|(?:identity\\.issuer\\.scheme|scheme)\\s*[:=]\\s*[\"']?linkerd\\.io\\/tls\\b/g;\n\n// Consul Connect's CA provider config: `private_key_type = \"ec\" | \"rsa\"`\n// inside a `ca_config` block. Matched in both HCL (`=`) and JSON (`:`) forms,\n// mirroring the terraform.ts attribute-matching convention.\nconst RE_MESH_CONSUL_RSA = /(?<![\\w\"-])\"?private_key_type\"?\\s*[:=]\\s*\"rsa\"/gi;\nconst RE_MESH_CONSUL_EC = /(?<![\\w\"-])\"?private_key_type\"?\\s*[:=]\\s*\"ec\"/gi;\n\n// Istio mesh TLS cipher suites: OpenSSL-style suite names naming classical\n// ECDHE key exchange combined with an RSA or ECDSA certificate. These are\n// distinctive tokens (no generic-config collision risk).\nconst RE_MESH_ISTIO_CLASSICAL_CIPHER = /\\bECDHE-(?:RSA|ECDSA)-[A-Z0-9_-]+\\b/g;\n\nconst RULE_MESH_LINKERD_ECDSA: RuleMeta = {\n  id: \"mesh-linkerd-identity-ecdsa\",\n  title: \"Linkerd ECDSA identity issuer\",\n  description: \"Linkerd control-plane identity issuer (default ECDSA P-256 mesh CA)\",\n  category: \"certificate\",\n  severity: \"medium\",\n  confidence: \"high\",\n  algorithm: \"ECDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Linkerd's control-plane identity issuer mints workload certificates from a classical ECDSA P-256 trust anchor by default, forgeable by a quantum attacker.\",\n  remediation:\n    \"Plan migration to ML-DSA-65 (FIPS 204) once Linkerd's identity issuer supports PQC signing.\",\n};\nconst RULE_MESH_CONSUL_RSA: RuleMeta = {\n  id: \"mesh-consul-connect-rsa\",\n  title: \"Consul Connect RSA mesh CA\",\n  description: 'Consul Connect ca_config private_key_type = \"rsa\"',\n  category: \"certificate\",\n  severity: \"medium\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Consul Connect's mesh CA issues leaf certificates from a classical RSA private key, which is not quantum-safe.\",\n  remediation:\n    \"Plan migration to PQC certificate keys (ML-DSA-65) as the Connect CA provider adds support.\",\n};\nconst RULE_MESH_CONSUL_EC: RuleMeta = {\n  id: \"mesh-consul-connect-ec\",\n  title: \"Consul Connect EC mesh CA\",\n  description: 'Consul Connect ca_config private_key_type = \"ec\"',\n  category: \"certificate\",\n  severity: \"medium\",\n  confidence: \"high\",\n  algorithm: \"ECDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Consul Connect's mesh CA issues leaf certificates from a classical EC private key, forgeable by a quantum attacker.\",\n  remediation: \"Plan migration to ML-DSA-65 (FIPS 204) as the Connect CA provider adds support.\",\n};\nconst RULE_MESH_ISTIO_CLASSICAL_CIPHER: RuleMeta = {\n  id: \"mesh-istio-classical-cipher\",\n  title: \"Istio classical ECDHE cipher suite\",\n  description:\n    \"Istio DestinationRule/Gateway tls.cipherSuites lists a classical ECDHE-RSA/ECDHE-ECDSA suite\",\n  category: \"tls\",\n  severity: \"medium\",\n  confidence: \"high\",\n  algorithm: \"ECDH\",\n  hndl: true,\n  cwe: CWE_RISKY_PRIMITIVE,\n  message:\n    \"Istio mesh TLS cipher suite allows classical ECDHE key exchange, which is harvest-now-decrypt-later exposed.\",\n  remediation:\n    \"Prefer TLS 1.3 AEAD suites and track PQC-hybrid mesh key exchange (X25519MLKEM768) as Envoy/BoringSSL adds support.\",\n};\n\n/**\n * Detects classical asymmetric crypto in service-mesh configuration: Linkerd's\n * default ECDSA identity issuer, Consul Connect's mesh CA private key type,\n * and classical ECDHE cipher suites in Istio DestinationRule/Gateway TLS\n * policy.\n */\nexport const meshDetector: Detector = {\n  id: \"service-mesh-crypto\",\n  description:\n    \"Classical crypto in service-mesh config (Linkerd identity, Consul Connect CA, Istio cipher suites)\",\n  scope: \"config\",\n  language: \"any\",\n  rules: [\n    RULE_MESH_LINKERD_ECDSA,\n    RULE_MESH_CONSUL_RSA,\n    RULE_MESH_CONSUL_EC,\n    RULE_MESH_ISTIO_CLASSICAL_CIPHER,\n  ],\n  appliesTo: (f) => hasExtension(f, MESH_EXTENSIONS),\n  detect({ file, content }): Finding[] {\n    const isLinkerd = content.includes(\"linkerd\") || content.includes(\"identityTrustAnchors\");\n    const isConsulConnect = content.includes(\"consul\") && content.includes(\"connect\");\n    const isIstioCipher = content.includes(\"DestinationRule\") || content.includes(\"cipherSuites\");\n    if (!isLinkerd && !isConsulConnect && !isIstioCipher) return [];\n\n    const findings: Finding[] = [];\n    const add = (re: RegExp, rule: RuleMeta) =>\n      eachMatch(re, content, (m) =>\n        findings.push(\n          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),\n        ),\n      );\n    if (isLinkerd) add(RE_MESH_LINKERD_ECDSA, RULE_MESH_LINKERD_ECDSA);\n    if (isConsulConnect) {\n      add(RE_MESH_CONSUL_RSA, RULE_MESH_CONSUL_RSA);\n      add(RE_MESH_CONSUL_EC, RULE_MESH_CONSUL_EC);\n    }\n    if (isIstioCipher) add(RE_MESH_ISTIO_CLASSICAL_CIPHER, RULE_MESH_ISTIO_CLASSICAL_CIPHER);\n    return findings;\n  },\n};\n"]}

package/dist/detectors/messaging.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Config detector: classical transport crypto in message brokers / event streams
+ * (Kafka, RabbitMQ, MQTT/Mosquitto, NATS). Broker traffic is "communication
+ * between things"; a legacy TLS floor or a classical (EC)DHE cipher suite makes
+ * every message in flight harvest-now-decrypt-later exposed.
+ *
+ * Covered in broker config files (`.properties`, `.conf`, `.cfg`, `.ini`):
+ *  - Kafka `ssl.protocol` / `ssl.enabled.protocols = TLSv1 | TLSv1.1` (legacy).
+ *  - MQTT/Mosquitto `tls_version tlsv1 | tlsv1.1` (legacy).
+ *  - Kafka `ssl.cipher.suites` naming a classical `ECDHE_RSA` / `ECDHE_ECDSA` /
+ *    `TLS_RSA` suite — the harvestable key-exchange path.
+ */
+import type { Detector } from "../types.js";
+/** Detects classical transport crypto in message-broker / event-stream config. */
+export declare const messagingDetector: Detector;
+//# sourceMappingURL=messaging.d.ts.map

package/dist/detectors/messaging.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"messaging.d.ts","sourceRoot":"","sources":["../../src/detectors/messaging.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAkE/D,kFAAkF;AAClF,eAAO,MAAM,iBAAiB,EAAE,QAkB/B,CAAC"}