@quantakrypto/core 0.4.3 → 0.4.4

package/dist/cbom-merge.d.ts

@@ -0,0 +1,9 @@
+import type { CycloneDxBom } from "./cbom.js";
+/**
+ * Merge CBOMs into one. Components with the same `bom-ref` (same algorithm +
+ * primitive) are combined; their occurrence evidence is unioned and their
+ * harvest-now-decrypt-later flag is OR-ed. Tool and root metadata from every input
+ * is preserved.
+ */
+export declare function mergeCboms(boms: readonly CycloneDxBom[]): CycloneDxBom;
+//# sourceMappingURL=cbom-merge.d.ts.map

package/dist/cbom-merge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cbom-merge.d.ts","sourceRoot":"","sources":["../src/cbom-merge.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,YAAY,EAAiB,MAAM,WAAW,CAAC;AA6B7D;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,SAAS,YAAY,EAAE,GAAG,YAAY,CAkEtE"}

package/dist/cbom-merge.js

@@ -0,0 +1,99 @@
+/**
+ * Merge multiple CycloneDX 1.6 CBOMs into one combined cryptographic bill of
+ * materials. This is what turns the "code + infra + live-endpoint" story into a
+ * single artifact: a qScan CBOM (code + infrastructure-as-code/config) and a
+ * qProbe CBOM (live endpoints) both emit `cryptographic-asset` components keyed by
+ * a deterministic `bom-ref` per (algorithm, primitive), so merging is a union with
+ * dedup — the same crypto seen by two planes collapses to one component whose
+ * occurrence evidence spans both.
+ *
+ * Output is deterministic (components sorted by bom-ref, occurrences sorted by
+ * location, a stable serial derived from the merged content), so re-merging the
+ * same inputs yields byte-identical output.
+ */
+import { createHash } from "node:crypto";
+function occurrencesOf(c) {
+    const ev = c.evidence;
+    const occ = ev?.occurrences;
+    return Array.isArray(occ) ? occ : [];
+}
+function hndlOf(c) {
+    return (c.cryptoProperties.harvestNowDecryptLater === true);
+}
+/** Union + dedup occurrences by `location`, sorted deterministically. */
+function mergeOccurrences(a, b) {
+    const byLoc = new Map();
+    for (const o of [...a, ...b])
+        if (!byLoc.has(o.location))
+            byLoc.set(o.location, o);
+    return [...byLoc.values()].sort((x, y) => x.location < y.location ? -1 : x.location > y.location ? 1 : 0);
+}
+/**
+ * Merge CBOMs into one. Components with the same `bom-ref` (same algorithm +
+ * primitive) are combined; their occurrence evidence is unioned and their
+ * harvest-now-decrypt-later flag is OR-ed. Tool and root metadata from every input
+ * is preserved.
+ */
+export function mergeCboms(boms) {
+    const byRef = new Map();
+    const toolComponents = [];
+    const toolSeen = new Set();
+    const roots = [];
+    for (const bom of boms) {
+        // Collect tool + root metadata (dedup tools by name@version).
+        const tools = bom.metadata?.tools?.components;
+        if (Array.isArray(tools)) {
+            for (const t of tools) {
+                const tc = t;
+                const key = `${tc.name}@${tc.version}`;
+                if (!toolSeen.has(key)) {
+                    toolSeen.add(key);
+                    toolComponents.push(t);
+                }
+            }
+        }
+        const root = bom.metadata?.component?.name;
+        if (typeof root === "string" && root && !roots.includes(root))
+            roots.push(root);
+        for (const c of bom.components) {
+            const ref = c["bom-ref"];
+            const existing = byRef.get(ref);
+            if (!existing) {
+                // Deep-ish copy so we can mutate evidence/hndl without touching the input.
+                byRef.set(ref, {
+                    ...c,
+                    cryptoProperties: { ...c.cryptoProperties },
+                    evidence: { occurrences: occurrencesOf(c) },
+                });
+            }
+            else {
+                const merged = mergeOccurrences(occurrencesOf(existing), occurrencesOf(c));
+                existing.evidence = { occurrences: merged };
+                existing.cryptoProperties = {
+                    ...existing.cryptoProperties,
+                    harvestNowDecryptLater: hndlOf(existing) || hndlOf(c),
+                };
+            }
+        }
+    }
+    const components = [...byRef.values()].sort((a, b) => a["bom-ref"] < b["bom-ref"] ? -1 : a["bom-ref"] > b["bom-ref"] ? 1 : 0);
+    const serialSeed = components.map((c) => c["bom-ref"]).join("|") + `|${roots.join(",")}`;
+    const h = createHash("sha256").update(serialSeed, "utf8").digest("hex");
+    const serial = `${h.slice(0, 8)}-${h.slice(8, 12)}-4${h.slice(13, 16)}-8${h.slice(17, 20)}-${h.slice(20, 32)}`;
+    return {
+        bomFormat: "CycloneDX",
+        specVersion: "1.6",
+        serialNumber: `urn:uuid:${serial}`,
+        version: 1,
+        metadata: {
+            tools: { components: toolComponents },
+            component: {
+                type: "application",
+                "bom-ref": "root",
+                name: roots.length ? `combined: ${roots.join(" + ")}` : "combined",
+            },
+        },
+        components,
+    };
+}
+//# sourceMappingURL=cbom-merge.js.map

package/dist/cbom-merge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cbom-merge.js","sourceRoot":"","sources":["../src/cbom-merge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AASzC,SAAS,aAAa,CAAC,CAAgB;IACrC,MAAM,EAAE,GAAG,CAAC,CAAC,QAAiD,CAAC;IAC/D,MAAM,GAAG,GAAG,EAAE,EAAE,WAAW,CAAC;IAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAAoB,CAAC,CAAC,CAAC,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,MAAM,CAAC,CAAgB;IAC9B,OAAO,CACJ,CAAC,CAAC,gBAAyD,CAAC,sBAAsB,KAAK,IAAI,CAC7F,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,SAAS,gBAAgB,CAAC,CAAe,EAAE,CAAe;IACxD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IACnF,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACvC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAC/D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,IAA6B;IACtD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC/C,MAAM,cAAc,GAAc,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,8DAA8D;QAC9D,MAAM,KAAK,GAAI,GAAG,CAAC,QAAmD,EAAE,KAAK,EAAE,UAAU,CAAC;QAC1F,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACtB,MAAM,EAAE,GAAG,CAAwC,CAAC;gBACpD,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;gBACvC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBACvB,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAClB,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACzB,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAI,GAAG,CAAC,QAA8C,EAAE,SAAS,EAAE,IAAI,CAAC;QAClF,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEhF,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;YACzB,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,2EAA2E;gBAC3E,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;oBACb,GAAG,CAAC;oBACJ,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC,gBAAgB,EAAE;oBAC3C,QAAQ,EAAE,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC,EAAE;iBAC5C,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,MAAM,MAAM,GAAG,gBAAgB,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3E,QAAQ,CAAC,QAAQ,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;gBAC5C,QAAQ,CAAC,gBAAgB,GAAG;oBAC1B,GAAG,QAAQ,CAAC,gBAAgB;oBAC5B,sBAAsB,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC;iBACtD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACnD,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACvE,CAAC;IAEF,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACzF,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;IAE/G,OAAO;QACL,SAAS,EAAE,WAAW;QACtB,WAAW,EAAE,KAAK;QAClB,YAAY,EAAE,YAAY,MAAM,EAAE;QAClC,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE;YACR,KAAK,EAAE,EAAE,UAAU,EAAE,cAAc,EAAE;YACrC,SAAS,EAAE;gBACT,IAAI,EAAE,aAAa;gBACnB,SAAS,EAAE,MAAM;gBACjB,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU;aACnE;SACF;QACD,UAAU;KACX,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Merge multiple CycloneDX 1.6 CBOMs into one combined cryptographic bill of\n * materials. This is what turns the \"code + infra + live-endpoint\" story into a\n * single artifact: a qScan CBOM (code + infrastructure-as-code/config) and a\n * qProbe CBOM (live endpoints) both emit `cryptographic-asset` components keyed by\n * a deterministic `bom-ref` per (algorithm, primitive), so merging is a union with\n * dedup — the same crypto seen by two planes collapses to one component whose\n * occurrence evidence spans both.\n *\n * Output is deterministic (components sorted by bom-ref, occurrences sorted by\n * location, a stable serial derived from the merged content), so re-merging the\n * same inputs yields byte-identical output.\n */\nimport { createHash } from \"node:crypto\";\nimport type { CycloneDxBom, CbomComponent } from \"./cbom.js\";\n\n/** Occurrence record shape inside a component's `evidence.occurrences`. */\ninterface Occurrence {\n  location: string;\n  additionalContext?: string;\n}\n\nfunction occurrencesOf(c: CbomComponent): Occurrence[] {\n  const ev = c.evidence as { occurrences?: unknown } | undefined;\n  const occ = ev?.occurrences;\n  return Array.isArray(occ) ? (occ as Occurrence[]) : [];\n}\n\nfunction hndlOf(c: CbomComponent): boolean {\n  return (\n    (c.cryptoProperties as { harvestNowDecryptLater?: unknown }).harvestNowDecryptLater === true\n  );\n}\n\n/** Union + dedup occurrences by `location`, sorted deterministically. */\nfunction mergeOccurrences(a: Occurrence[], b: Occurrence[]): Occurrence[] {\n  const byLoc = new Map<string, Occurrence>();\n  for (const o of [...a, ...b]) if (!byLoc.has(o.location)) byLoc.set(o.location, o);\n  return [...byLoc.values()].sort((x, y) =>\n    x.location < y.location ? -1 : x.location > y.location ? 1 : 0,\n  );\n}\n\n/**\n * Merge CBOMs into one. Components with the same `bom-ref` (same algorithm +\n * primitive) are combined; their occurrence evidence is unioned and their\n * harvest-now-decrypt-later flag is OR-ed. Tool and root metadata from every input\n * is preserved.\n */\nexport function mergeCboms(boms: readonly CycloneDxBom[]): CycloneDxBom {\n  const byRef = new Map<string, CbomComponent>();\n  const toolComponents: unknown[] = [];\n  const toolSeen = new Set<string>();\n  const roots: string[] = [];\n\n  for (const bom of boms) {\n    // Collect tool + root metadata (dedup tools by name@version).\n    const tools = (bom.metadata as { tools?: { components?: unknown[] } })?.tools?.components;\n    if (Array.isArray(tools)) {\n      for (const t of tools) {\n        const tc = t as { name?: string; version?: string };\n        const key = `${tc.name}@${tc.version}`;\n        if (!toolSeen.has(key)) {\n          toolSeen.add(key);\n          toolComponents.push(t);\n        }\n      }\n    }\n    const root = (bom.metadata as { component?: { name?: string } })?.component?.name;\n    if (typeof root === \"string\" && root && !roots.includes(root)) roots.push(root);\n\n    for (const c of bom.components) {\n      const ref = c[\"bom-ref\"];\n      const existing = byRef.get(ref);\n      if (!existing) {\n        // Deep-ish copy so we can mutate evidence/hndl without touching the input.\n        byRef.set(ref, {\n          ...c,\n          cryptoProperties: { ...c.cryptoProperties },\n          evidence: { occurrences: occurrencesOf(c) },\n        });\n      } else {\n        const merged = mergeOccurrences(occurrencesOf(existing), occurrencesOf(c));\n        existing.evidence = { occurrences: merged };\n        existing.cryptoProperties = {\n          ...existing.cryptoProperties,\n          harvestNowDecryptLater: hndlOf(existing) || hndlOf(c),\n        };\n      }\n    }\n  }\n\n  const components = [...byRef.values()].sort((a, b) =>\n    a[\"bom-ref\"] < b[\"bom-ref\"] ? -1 : a[\"bom-ref\"] > b[\"bom-ref\"] ? 1 : 0,\n  );\n\n  const serialSeed = components.map((c) => c[\"bom-ref\"]).join(\"|\") + `|${roots.join(\",\")}`;\n  const h = createHash(\"sha256\").update(serialSeed, \"utf8\").digest(\"hex\");\n  const serial = `${h.slice(0, 8)}-${h.slice(8, 12)}-4${h.slice(13, 16)}-8${h.slice(17, 20)}-${h.slice(20, 32)}`;\n\n  return {\n    bomFormat: \"CycloneDX\",\n    specVersion: \"1.6\",\n    serialNumber: `urn:uuid:${serial}`,\n    version: 1,\n    metadata: {\n      tools: { components: toolComponents },\n      component: {\n        type: \"application\",\n        \"bom-ref\": \"root\",\n        name: roots.length ? `combined: ${roots.join(\" + \")}` : \"combined\",\n      },\n    },\n    components,\n  };\n}\n"]}

package/dist/comments.d.ts

@@ -21,9 +21,10 @@ export declare function commentStyleForFile(file: string): CommentStyle | null;
 /**
  * Compute the comment spans (`[start, end)` offsets) of `content`, skipping over
  * string literals so a comment marker inside a string is not treated as a
- * comment. Spans are returned sorted and non-overlapping.
+ * comment. Spans are returned sorted and non-overlapping. `rawBacktick` (Go)
+ * makes backtick strings raw (no escapes).
  */
-export declare function commentSpans(content: string, style: CommentStyle): Array<[number, number]>;
+export declare function commentSpans(content: string, style: CommentStyle, rawBacktick?: boolean): Array<[number, number]>;
 /**
  * Compute Python triple-quoted string spans (`"""…"""` / `'''…'''`). These are
  * docstrings / prose in practice, so a crypto *name* mentioned inside one
@@ -57,7 +58,7 @@ export declare function stripCommentFindings(findings: Finding[], content: strin
  * suppress findings from IDENTIFIER-only rules (e.g. a Go `SigningMethodRS256`
  * mentioned inside an error-message string) — the mirror of {@link commentSpans}.
  */
-export declare function stringSpans(content: string, style: CommentStyle): Array<[number, number]>;
+export declare function stringSpans(content: string, style: CommentStyle, rawBacktick?: boolean): Array<[number, number]>;
 /**
  * Drop findings of "code-only" rules (`ruleIds`) whose match starts inside a
  * string literal. Some rules — an identifier-form JWT signing method, a Go

package/dist/comments.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"comments.d.ts","sourceRoot":"","sources":["../src/comments.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1C,MAAM,MAAM,YAAY,GAAG,GAAG,GAAG,MAAM,CAAC;AA8BxC,sFAAsF;AACtF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAKrE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAgD1F;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAsC7E;AAED,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAW7F;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CASzD;AAED,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,EAAE,CAKpF;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,GACX,OAAO,EAAE,CAyBX;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CA2CzF;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,GAC3B,OAAO,EAAE,CAkBX"}
+{"version":3,"file":"comments.d.ts","sourceRoot":"","sources":["../src/comments.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1C,MAAM,MAAM,YAAY,GAAG,GAAG,GAAG,MAAM,CAAC;AA8BxC,sFAAsF;AACtF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAKrE;AAyCD;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,YAAY,EACnB,WAAW,UAAQ,GAClB,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAoCzB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAsC7E;AAED,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAW7F;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CASzD;AAED,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,EAAE,CAKpF;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,GACX,OAAO,EAAE,CAyBX;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,YAAY,EACnB,WAAW,UAAQ,GAClB,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAiCzB;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,GAC3B,OAAO,EAAE,CAkBX"}

package/dist/comments.js

@@ -33,32 +33,61 @@ export function commentStyleForFile(file) {
         return "hash";
     return null;
 }
+/**
+ * Advance past a string / char literal starting at `content[i]` (a quote char);
+ * returns the index just after it. Two correctness rules a naive escape-scan got
+ * wrong (both verified as real bugs):
+ *   - a `'` char literal must close within a short window (`'\u{10FFFF}'` is ~11
+ *     chars); otherwise it is a Rust lifetime (`'a`) or a stray apostrophe, NOT a
+ *     literal — return `i + 1` so the scan continues instead of consuming the
+ *     rest of the file.
+ *   - Go raw strings (backtick, when `rawBacktick`) do NOT process escapes, so a
+ *     trailing backslash (`` `C:\` ``) must not swallow the closing delimiter.
+ */
+function skipQuoted(content, i, n, rawBacktick) {
+    const quote = content[i];
+    if (quote === "'") {
+        const limit = Math.min(n, i + 1 + 12);
+        let j = i + 1;
+        while (j < limit) {
+            if (content[j] === "\\") {
+                j += 2;
+                continue;
+            }
+            if (content[j] === "'")
+                return j + 1;
+            j++;
+        }
+        return i + 1; // a lifetime / stray apostrophe, not a char literal
+    }
+    const escapes = !(quote === "`" && rawBacktick);
+    let j = i + 1;
+    while (j < n) {
+        if (escapes && content[j] === "\\") {
+            j += 2;
+            continue;
+        }
+        if (content[j] === quote)
+            return j + 1;
+        j++;
+    }
+    return n;
+}
 /**
  * Compute the comment spans (`[start, end)` offsets) of `content`, skipping over
  * string literals so a comment marker inside a string is not treated as a
- * comment. Spans are returned sorted and non-overlapping.
+ * comment. Spans are returned sorted and non-overlapping. `rawBacktick` (Go)
+ * makes backtick strings raw (no escapes).
  */
-export function commentSpans(content, style) {
+export function commentSpans(content, style, rawBacktick = false) {
     const spans = [];
     const n = content.length;
     let i = 0;
     while (i < n) {
         const c = content[i];
-        // String / template literal: skip to the matching unescaped delimiter.
+        // String / char literal: skip past it (lexically correct for lifetimes + raw strings).
         if (c === '"' || c === "'" || c === "`") {
-            const quote = c;
-            i++;
-            while (i < n) {
-                if (content[i] === "\\") {
-                    i += 2;
-                    continue;
-                }
-                if (content[i] === quote) {
-                    i++;
-                    break;
-                }
-                i++;
-            }
+            i = skipQuoted(content, i, n, rawBacktick);
             continue;
         }
         if (style === "c" && c === "/" && content[i + 1] === "/") {
@@ -194,7 +223,7 @@ export function stripCommentFindings(findings, content, file) {
     const style = commentStyleForFile(file);
     if (!style)
         return findings;
-    const spans = commentSpans(content, style);
+    const spans = commentSpans(content, style, /\.go$/i.test(file));
     // Python docstrings suppress prose *token* rules but keep real PEM material.
     const docSpans = style === "hash" ? pythonDocstringSpans(content) : [];
     if (spans.length === 0 && docSpans.length === 0)
@@ -223,7 +252,7 @@ export function stripCommentFindings(findings, content, file) {
  * suppress findings from IDENTIFIER-only rules (e.g. a Go `SigningMethodRS256`
  * mentioned inside an error-message string) — the mirror of {@link commentSpans}.
  */
-export function stringSpans(content, style) {
+export function stringSpans(content, style, rawBacktick = false) {
     const spans = [];
     const n = content.length;
     let i = 0;
@@ -249,21 +278,12 @@ export function stringSpans(content, style) {
             continue;
         }
         if (c === '"' || c === "'" || c === "`") {
-            const quote = c;
             const start = i;
-            i++;
-            while (i < n) {
-                if (content[i] === "\\") {
-                    i += 2;
-                    continue;
-                }
-                if (content[i] === quote) {
-                    i++;
-                    break;
-                }
-                i++;
-            }
-            spans.push([start, i]);
+            const end = skipQuoted(content, i, n, rawBacktick);
+            // A lone `'` (Rust lifetime, end === start+1) is not a string; skip it.
+            if (c !== "'" || end > start + 1)
+                spans.push([start, end]);
+            i = end;
             continue;
         }
         i++;
@@ -285,7 +305,7 @@ export function stripStringLiteralFindings(findings, content, file, ruleIds) {
     const style = commentStyleForFile(file);
     if (!style)
         return findings;
-    const spans = stringSpans(content, style);
+    const spans = stringSpans(content, style, /\.go$/i.test(file));
     if (spans.length === 0)
         return findings;
     const lineStarts = [0];

package/dist/comments.js.map

@@ -1 +1 @@
-{"version":3,"file":"comments.js","sourceRoot":"","sources":["../src/comments.ts"],"names":[],"mappings":"AAoBA,8DAA8D;AAC9D,MAAM,MAAM,GAAsB;IAChC,KAAK;IACL,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,SAAS;IACT,KAAK;IACL,OAAO;IACP,KAAK;IACL,MAAM;IACN,KAAK;IACL,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;CACN,CAAC;AAEF,wDAAwD;AACxD,MAAM,SAAS,GAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAEpE,sFAAsF;AACtF,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC;IACtD,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IAC5D,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,KAAmB;IAC/D,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,uEAAuE;QACvE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACb,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBACxB,CAAC,IAAI,CAAC,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;oBACzB,CAAC,EAAE,CAAC;oBACJ,MAAM;gBACR,CAAC;gBACD,CAAC,EAAE,CAAC;YACN,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACzD,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACzD,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;gBAAE,CAAC,EAAE,CAAC;YACrE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7E,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;gBAAE,CAAC,EAAE,CAAC;YACzF,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACb,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBACxB,CAAC,IAAI,CAAC,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;oBACrB,CAAC,EAAE,CAAC;oBACJ,MAAM;gBACR,CAAC;gBACD,CAAC,EAAE,CAAC;YACN,CAAC;YACD,SAAS;QACX,CAAC;QACD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,aAAa,CAAC,KAAsC,EAAE,MAAc;IAClF,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,EAAE,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,MAAM,GAAG,CAAC;YAAE,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;aACxB,IAAI,MAAM,IAAI,CAAC;YAAE,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;;YAC9B,OAAO,IAAI,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;aAC3D,IAAI,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,QAAmB,EAAE,OAAe;IACvE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChF,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACxC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAmB,EACnB,OAAe,EACf,IAAY;IAEZ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC3C,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5B,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC3C,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEjE,+EAA+E;IAC/E,wEAAwE;IACxE,MAAM,UAAU,GAAa,CAAC,CAAC,CAAC,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,IAAI,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;YAC3F,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,KAAmB;IAC9D,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACzD,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACzD,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;gBAAE,CAAC,EAAE,CAAC;YACrE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAClC,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACb,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBACxB,CAAC,IAAI,CAAC,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;oBACzB,CAAC,EAAE,CAAC;oBACJ,MAAM;gBACR,CAAC;gBACD,CAAC,EAAE,CAAC;YACN,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAAmB,EACnB,OAAe,EACf,IAAY,EACZ,OAA4B;IAE5B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC3F,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5B,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAExC,MAAM,UAAU,GAAa,CAAC,CAAC,CAAC,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Comment-aware false-positive suppression.\n *\n * The detectors are lexical (regex over source text), so a crypto API name\n * written in a COMMENT — `// migrated off createECDH()` — fires a finding just\n * like real code. This module computes the comment spans of a file (respecting\n * string literals, so a `//` inside a string is not a comment) and drops any\n * finding whose match starts inside one.\n *\n * The lexer is deliberately conservative: it only ever ENTERS a comment on a\n * literal line comment, block comment, or `#` in code position (all of which ARE\n * comments), so it never mis-classifies code as a comment and can only reduce\n * false positives, not recall. The one inherent lexical ambiguity — a regex\n * literal that looks like a block-comment open — is rare and guarded by the\n * detection benchmark's recall gate.\n */\nimport type { Finding } from \"./types.js\";\n\nexport type CommentStyle = \"c\" | \"hash\";\n\n/** C-style (line + block) comment languages, by extension. */\nconst C_LIKE: readonly string[] = [\n  \".js\",\n  \".jsx\",\n  \".ts\",\n  \".tsx\",\n  \".mjs\",\n  \".cjs\",\n  \".vue\",\n  \".svelte\",\n  \".go\",\n  \".java\",\n  \".kt\",\n  \".kts\",\n  \".cs\",\n  \".rs\",\n  \".c\",\n  \".h\",\n  \".cc\",\n  \".cpp\",\n  \".cxx\",\n  \".hpp\",\n  \".hh\",\n];\n\n/** Hash-style (`#`) comment languages, by extension. */\nconst HASH_LIKE: readonly string[] = [\".py\", \".pyi\", \".pyw\", \".rb\"];\n\n/** The comment style for a file path, or null when we don't strip comments for it. */\nexport function commentStyleForFile(file: string): CommentStyle | null {\n  const lower = file.toLowerCase();\n  if (C_LIKE.some((e) => lower.endsWith(e))) return \"c\";\n  if (HASH_LIKE.some((e) => lower.endsWith(e))) return \"hash\";\n  return null;\n}\n\n/**\n * Compute the comment spans (`[start, end)` offsets) of `content`, skipping over\n * string literals so a comment marker inside a string is not treated as a\n * comment. Spans are returned sorted and non-overlapping.\n */\nexport function commentSpans(content: string, style: CommentStyle): Array<[number, number]> {\n  const spans: Array<[number, number]> = [];\n  const n = content.length;\n  let i = 0;\n  while (i < n) {\n    const c = content[i];\n    // String / template literal: skip to the matching unescaped delimiter.\n    if (c === '\"' || c === \"'\" || c === \"`\") {\n      const quote = c;\n      i++;\n      while (i < n) {\n        if (content[i] === \"\\\\\") {\n          i += 2;\n          continue;\n        }\n        if (content[i] === quote) {\n          i++;\n          break;\n        }\n        i++;\n      }\n      continue;\n    }\n    if (style === \"c\" && c === \"/\" && content[i + 1] === \"/\") {\n      const start = i;\n      i += 2;\n      while (i < n && content[i] !== \"\\n\") i++;\n      spans.push([start, i]);\n      continue;\n    }\n    if (style === \"c\" && c === \"/\" && content[i + 1] === \"*\") {\n      const start = i;\n      i += 2;\n      while (i < n && !(content[i] === \"*\" && content[i + 1] === \"/\")) i++;\n      i = Math.min(n, i + 2);\n      spans.push([start, i]);\n      continue;\n    }\n    if (style === \"hash\" && c === \"#\") {\n      const start = i;\n      i++;\n      while (i < n && content[i] !== \"\\n\") i++;\n      spans.push([start, i]);\n      continue;\n    }\n    i++;\n  }\n  return spans;\n}\n\n/**\n * Compute Python triple-quoted string spans (`\"\"\"…\"\"\"` / `'''…'''`). These are\n * docstrings / prose in practice, so a crypto *name* mentioned inside one\n * (`:param key_type: eg \"ssh-ed25519\"`) should not fire a token finding — but a\n * PEM key pasted into one is still real material, so {@link stripCommentFindings}\n * exempts `pem-*` rules. Comments and normal strings are skipped so a `\"\"\"`\n * delimiter inside them is not mis-detected.\n */\nexport function pythonDocstringSpans(content: string): Array<[number, number]> {\n  const spans: Array<[number, number]> = [];\n  const n = content.length;\n  let i = 0;\n  while (i < n) {\n    const c = content[i];\n    if (c === \"#\") {\n      i++;\n      while (i < n && content[i] !== \"\\n\") i++;\n      continue;\n    }\n    if ((c === '\"' || c === \"'\") && content[i + 1] === c && content[i + 2] === c) {\n      const start = i;\n      i += 3;\n      while (i < n && !(content[i] === c && content[i + 1] === c && content[i + 2] === c)) i++;\n      i = Math.min(n, i + 3);\n      spans.push([start, i]);\n      continue;\n    }\n    if (c === '\"' || c === \"'\") {\n      const q = c;\n      i++;\n      while (i < n) {\n        if (content[i] === \"\\\\\") {\n          i += 2;\n          continue;\n        }\n        if (content[i] === q) {\n          i++;\n          break;\n        }\n        i++;\n      }\n      continue;\n    }\n    i++;\n  }\n  return spans;\n}\n\n/** True if `offset` falls inside one of the (sorted, non-overlapping) spans. */\nexport function offsetInSpans(spans: ReadonlyArray<[number, number]>, offset: number): boolean {\n  let lo = 0;\n  let hi = spans.length - 1;\n  while (lo <= hi) {\n    const mid = (lo + hi) >>> 1;\n    const [s, e] = spans[mid];\n    if (offset < s) hi = mid - 1;\n    else if (offset >= e) lo = mid + 1;\n    else return true;\n  }\n  return false;\n}\n\n/**\n * Line numbers (1-based) suppressed by an inline ignore directive:\n *   - `qscan-ignore-line` on a line suppresses findings on THAT line.\n *   - `qscan-ignore-next-line` on a line suppresses findings on the NEXT line.\n * The directive text is matched anywhere on the line (usually in a comment), so\n * it is language-agnostic. `qscan-ignore-line` is not a substring of\n * `qscan-ignore-next-line`, so the two never collide.\n */\nexport function ignoredLines(content: string): Set<number> {\n  const ignored = new Set<number>();\n  const lines = content.split(\"\\n\");\n  for (let i = 0; i < lines.length; i++) {\n    const line = lines[i];\n    if (line.includes(\"qscan-ignore-next-line\")) ignored.add(i + 2);\n    else if (line.includes(\"qscan-ignore-line\")) ignored.add(i + 1);\n  }\n  return ignored;\n}\n\n/** Drop findings on lines suppressed by an inline `qscan-ignore` directive. */\nexport function stripIgnoredFindings(findings: Finding[], content: string): Finding[] {\n  if (findings.length === 0 || !content.includes(\"qscan-ignore\")) return findings;\n  const ignored = ignoredLines(content);\n  if (ignored.size === 0) return findings;\n  return findings.filter((f) => !ignored.has(f.location.line));\n}\n\n/**\n * Drop findings whose match starts inside a comment. No-op when the file's\n * language has no comment style we handle, or when it has no comments.\n */\nexport function stripCommentFindings(\n  findings: Finding[],\n  content: string,\n  file: string,\n): Finding[] {\n  if (findings.length === 0) return findings;\n  const style = commentStyleForFile(file);\n  if (!style) return findings;\n  const spans = commentSpans(content, style);\n  // Python docstrings suppress prose *token* rules but keep real PEM material.\n  const docSpans = style === \"hash\" ? pythonDocstringSpans(content) : [];\n  if (spans.length === 0 && docSpans.length === 0) return findings;\n\n  // 1-based line → start offset, to turn a finding's (line, column) back into an\n  // absolute offset (column is 1-based: offset = lineStart + column - 1).\n  const lineStarts: number[] = [0];\n  for (let i = 0; i < content.length; i++) {\n    if (content[i] === \"\\n\") lineStarts.push(i + 1);\n  }\n\n  return findings.filter((f) => {\n    const start = lineStarts[f.location.line - 1] ?? 0;\n    const offset = start + ((f.location.column ?? 1) - 1);\n    if (offsetInSpans(spans, offset)) return false;\n    if (docSpans.length > 0 && !f.ruleId.startsWith(\"pem-\") && offsetInSpans(docSpans, offset)) {\n      return false;\n    }\n    return true;\n  });\n}\n\n/**\n * Compute the string-literal spans (`[start, end)`) of `content`, skipping over\n * comments so a quote inside a comment is not treated as a string. Used to\n * suppress findings from IDENTIFIER-only rules (e.g. a Go `SigningMethodRS256`\n * mentioned inside an error-message string) — the mirror of {@link commentSpans}.\n */\nexport function stringSpans(content: string, style: CommentStyle): Array<[number, number]> {\n  const spans: Array<[number, number]> = [];\n  const n = content.length;\n  let i = 0;\n  while (i < n) {\n    const c = content[i];\n    if (style === \"c\" && c === \"/\" && content[i + 1] === \"/\") {\n      i += 2;\n      while (i < n && content[i] !== \"\\n\") i++;\n      continue;\n    }\n    if (style === \"c\" && c === \"/\" && content[i + 1] === \"*\") {\n      i += 2;\n      while (i < n && !(content[i] === \"*\" && content[i + 1] === \"/\")) i++;\n      i = Math.min(n, i + 2);\n      continue;\n    }\n    if (style === \"hash\" && c === \"#\") {\n      i++;\n      while (i < n && content[i] !== \"\\n\") i++;\n      continue;\n    }\n    if (c === '\"' || c === \"'\" || c === \"`\") {\n      const quote = c;\n      const start = i;\n      i++;\n      while (i < n) {\n        if (content[i] === \"\\\\\") {\n          i += 2;\n          continue;\n        }\n        if (content[i] === quote) {\n          i++;\n          break;\n        }\n        i++;\n      }\n      spans.push([start, i]);\n      continue;\n    }\n    i++;\n  }\n  return spans;\n}\n\n/**\n * Drop findings of \"code-only\" rules (`ruleIds`) whose match starts inside a\n * string literal. Some rules — an identifier-form JWT signing method, a Go\n * `SigningMethodRS256` — are only meaningful as code; when the same token appears\n * inside a string (a test's `t.Error(\"SigningMethodPS256 …\")`) it is prose, not a\n * usage. Rules that legitimately match inside strings (quoted `\"RS256\"` alg\n * tokens, cipher-suite strings, ssh-key tokens) are NOT in `ruleIds` and pass\n * through untouched.\n */\nexport function stripStringLiteralFindings(\n  findings: Finding[],\n  content: string,\n  file: string,\n  ruleIds: ReadonlySet<string>,\n): Finding[] {\n  if (findings.length === 0 || !findings.some((f) => ruleIds.has(f.ruleId))) return findings;\n  const style = commentStyleForFile(file);\n  if (!style) return findings;\n  const spans = stringSpans(content, style);\n  if (spans.length === 0) return findings;\n\n  const lineStarts: number[] = [0];\n  for (let i = 0; i < content.length; i++) {\n    if (content[i] === \"\\n\") lineStarts.push(i + 1);\n  }\n\n  return findings.filter((f) => {\n    if (!ruleIds.has(f.ruleId)) return true;\n    const start = lineStarts[f.location.line - 1] ?? 0;\n    const offset = start + ((f.location.column ?? 1) - 1);\n    return !offsetInSpans(spans, offset);\n  });\n}\n"]}
+{"version":3,"file":"comments.js","sourceRoot":"","sources":["../src/comments.ts"],"names":[],"mappings":"AAoBA,8DAA8D;AAC9D,MAAM,MAAM,GAAsB;IAChC,KAAK;IACL,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,SAAS;IACT,KAAK;IACL,OAAO;IACP,KAAK;IACL,MAAM;IACN,KAAK;IACL,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;CACN,CAAC;AAEF,wDAAwD;AACxD,MAAM,SAAS,GAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAEpE,sFAAsF;AACtF,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC;IACtD,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IAC5D,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,UAAU,CAAC,OAAe,EAAE,CAAS,EAAE,CAAS,EAAE,WAAoB;IAC7E,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,GAAG,KAAK,EAAE,CAAC;YACjB,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACxB,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YACrC,CAAC,EAAE,CAAC;QACN,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,oDAAoD;IACpE,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,KAAK,GAAG,IAAI,WAAW,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACnC,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAe,EACf,KAAmB,EACnB,WAAW,GAAG,KAAK;IAEnB,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,uFAAuF;QACvF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;YAC3C,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACzD,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACzD,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;gBAAE,CAAC,EAAE,CAAC;YACrE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7E,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;gBAAE,CAAC,EAAE,CAAC;YACzF,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACb,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBACxB,CAAC,IAAI,CAAC,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;oBACrB,CAAC,EAAE,CAAC;oBACJ,MAAM;gBACR,CAAC;gBACD,CAAC,EAAE,CAAC;YACN,CAAC;YACD,SAAS;QACX,CAAC;QACD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,aAAa,CAAC,KAAsC,EAAE,MAAc;IAClF,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,EAAE,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,MAAM,GAAG,CAAC;YAAE,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;aACxB,IAAI,MAAM,IAAI,CAAC;YAAE,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;;YAC9B,OAAO,IAAI,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;aAC3D,IAAI,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,QAAmB,EAAE,OAAe;IACvE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChF,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACxC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAmB,EACnB,OAAe,EACf,IAAY;IAEZ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC3C,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5B,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEjE,+EAA+E;IAC/E,wEAAwE;IACxE,MAAM,UAAU,GAAa,CAAC,CAAC,CAAC,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,IAAI,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;YAC3F,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CACzB,OAAe,EACf,KAAmB,EACnB,WAAW,GAAG,KAAK;IAEnB,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACzD,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACzD,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;gBAAE,CAAC,EAAE,CAAC;YACrE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAClC,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;YACnD,wEAAwE;YACxE,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,GAAG,KAAK,GAAG,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;YAC3D,CAAC,GAAG,GAAG,CAAC;YACR,SAAS;QACX,CAAC;QACD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAAmB,EACnB,OAAe,EACf,IAAY,EACZ,OAA4B;IAE5B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC3F,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5B,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAExC,MAAM,UAAU,GAAa,CAAC,CAAC,CAAC,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Comment-aware false-positive suppression.\n *\n * The detectors are lexical (regex over source text), so a crypto API name\n * written in a COMMENT — `// migrated off createECDH()` — fires a finding just\n * like real code. This module computes the comment spans of a file (respecting\n * string literals, so a `//` inside a string is not a comment) and drops any\n * finding whose match starts inside one.\n *\n * The lexer is deliberately conservative: it only ever ENTERS a comment on a\n * literal line comment, block comment, or `#` in code position (all of which ARE\n * comments), so it never mis-classifies code as a comment and can only reduce\n * false positives, not recall. The one inherent lexical ambiguity — a regex\n * literal that looks like a block-comment open — is rare and guarded by the\n * detection benchmark's recall gate.\n */\nimport type { Finding } from \"./types.js\";\n\nexport type CommentStyle = \"c\" | \"hash\";\n\n/** C-style (line + block) comment languages, by extension. */\nconst C_LIKE: readonly string[] = [\n  \".js\",\n  \".jsx\",\n  \".ts\",\n  \".tsx\",\n  \".mjs\",\n  \".cjs\",\n  \".vue\",\n  \".svelte\",\n  \".go\",\n  \".java\",\n  \".kt\",\n  \".kts\",\n  \".cs\",\n  \".rs\",\n  \".c\",\n  \".h\",\n  \".cc\",\n  \".cpp\",\n  \".cxx\",\n  \".hpp\",\n  \".hh\",\n];\n\n/** Hash-style (`#`) comment languages, by extension. */\nconst HASH_LIKE: readonly string[] = [\".py\", \".pyi\", \".pyw\", \".rb\"];\n\n/** The comment style for a file path, or null when we don't strip comments for it. */\nexport function commentStyleForFile(file: string): CommentStyle | null {\n  const lower = file.toLowerCase();\n  if (C_LIKE.some((e) => lower.endsWith(e))) return \"c\";\n  if (HASH_LIKE.some((e) => lower.endsWith(e))) return \"hash\";\n  return null;\n}\n\n/**\n * Advance past a string / char literal starting at `content[i]` (a quote char);\n * returns the index just after it. Two correctness rules a naive escape-scan got\n * wrong (both verified as real bugs):\n *   - a `'` char literal must close within a short window (`'\\u{10FFFF}'` is ~11\n *     chars); otherwise it is a Rust lifetime (`'a`) or a stray apostrophe, NOT a\n *     literal — return `i + 1` so the scan continues instead of consuming the\n *     rest of the file.\n *   - Go raw strings (backtick, when `rawBacktick`) do NOT process escapes, so a\n *     trailing backslash (`` `C:\\` ``) must not swallow the closing delimiter.\n */\nfunction skipQuoted(content: string, i: number, n: number, rawBacktick: boolean): number {\n  const quote = content[i];\n  if (quote === \"'\") {\n    const limit = Math.min(n, i + 1 + 12);\n    let j = i + 1;\n    while (j < limit) {\n      if (content[j] === \"\\\\\") {\n        j += 2;\n        continue;\n      }\n      if (content[j] === \"'\") return j + 1;\n      j++;\n    }\n    return i + 1; // a lifetime / stray apostrophe, not a char literal\n  }\n  const escapes = !(quote === \"`\" && rawBacktick);\n  let j = i + 1;\n  while (j < n) {\n    if (escapes && content[j] === \"\\\\\") {\n      j += 2;\n      continue;\n    }\n    if (content[j] === quote) return j + 1;\n    j++;\n  }\n  return n;\n}\n\n/**\n * Compute the comment spans (`[start, end)` offsets) of `content`, skipping over\n * string literals so a comment marker inside a string is not treated as a\n * comment. Spans are returned sorted and non-overlapping. `rawBacktick` (Go)\n * makes backtick strings raw (no escapes).\n */\nexport function commentSpans(\n  content: string,\n  style: CommentStyle,\n  rawBacktick = false,\n): Array<[number, number]> {\n  const spans: Array<[number, number]> = [];\n  const n = content.length;\n  let i = 0;\n  while (i < n) {\n    const c = content[i];\n    // String / char literal: skip past it (lexically correct for lifetimes + raw strings).\n    if (c === '\"' || c === \"'\" || c === \"`\") {\n      i = skipQuoted(content, i, n, rawBacktick);\n      continue;\n    }\n    if (style === \"c\" && c === \"/\" && content[i + 1] === \"/\") {\n      const start = i;\n      i += 2;\n      while (i < n && content[i] !== \"\\n\") i++;\n      spans.push([start, i]);\n      continue;\n    }\n    if (style === \"c\" && c === \"/\" && content[i + 1] === \"*\") {\n      const start = i;\n      i += 2;\n      while (i < n && !(content[i] === \"*\" && content[i + 1] === \"/\")) i++;\n      i = Math.min(n, i + 2);\n      spans.push([start, i]);\n      continue;\n    }\n    if (style === \"hash\" && c === \"#\") {\n      const start = i;\n      i++;\n      while (i < n && content[i] !== \"\\n\") i++;\n      spans.push([start, i]);\n      continue;\n    }\n    i++;\n  }\n  return spans;\n}\n\n/**\n * Compute Python triple-quoted string spans (`\"\"\"…\"\"\"` / `'''…'''`). These are\n * docstrings / prose in practice, so a crypto *name* mentioned inside one\n * (`:param key_type: eg \"ssh-ed25519\"`) should not fire a token finding — but a\n * PEM key pasted into one is still real material, so {@link stripCommentFindings}\n * exempts `pem-*` rules. Comments and normal strings are skipped so a `\"\"\"`\n * delimiter inside them is not mis-detected.\n */\nexport function pythonDocstringSpans(content: string): Array<[number, number]> {\n  const spans: Array<[number, number]> = [];\n  const n = content.length;\n  let i = 0;\n  while (i < n) {\n    const c = content[i];\n    if (c === \"#\") {\n      i++;\n      while (i < n && content[i] !== \"\\n\") i++;\n      continue;\n    }\n    if ((c === '\"' || c === \"'\") && content[i + 1] === c && content[i + 2] === c) {\n      const start = i;\n      i += 3;\n      while (i < n && !(content[i] === c && content[i + 1] === c && content[i + 2] === c)) i++;\n      i = Math.min(n, i + 3);\n      spans.push([start, i]);\n      continue;\n    }\n    if (c === '\"' || c === \"'\") {\n      const q = c;\n      i++;\n      while (i < n) {\n        if (content[i] === \"\\\\\") {\n          i += 2;\n          continue;\n        }\n        if (content[i] === q) {\n          i++;\n          break;\n        }\n        i++;\n      }\n      continue;\n    }\n    i++;\n  }\n  return spans;\n}\n\n/** True if `offset` falls inside one of the (sorted, non-overlapping) spans. */\nexport function offsetInSpans(spans: ReadonlyArray<[number, number]>, offset: number): boolean {\n  let lo = 0;\n  let hi = spans.length - 1;\n  while (lo <= hi) {\n    const mid = (lo + hi) >>> 1;\n    const [s, e] = spans[mid];\n    if (offset < s) hi = mid - 1;\n    else if (offset >= e) lo = mid + 1;\n    else return true;\n  }\n  return false;\n}\n\n/**\n * Line numbers (1-based) suppressed by an inline ignore directive:\n *   - `qscan-ignore-line` on a line suppresses findings on THAT line.\n *   - `qscan-ignore-next-line` on a line suppresses findings on the NEXT line.\n * The directive text is matched anywhere on the line (usually in a comment), so\n * it is language-agnostic. `qscan-ignore-line` is not a substring of\n * `qscan-ignore-next-line`, so the two never collide.\n */\nexport function ignoredLines(content: string): Set<number> {\n  const ignored = new Set<number>();\n  const lines = content.split(\"\\n\");\n  for (let i = 0; i < lines.length; i++) {\n    const line = lines[i];\n    if (line.includes(\"qscan-ignore-next-line\")) ignored.add(i + 2);\n    else if (line.includes(\"qscan-ignore-line\")) ignored.add(i + 1);\n  }\n  return ignored;\n}\n\n/** Drop findings on lines suppressed by an inline `qscan-ignore` directive. */\nexport function stripIgnoredFindings(findings: Finding[], content: string): Finding[] {\n  if (findings.length === 0 || !content.includes(\"qscan-ignore\")) return findings;\n  const ignored = ignoredLines(content);\n  if (ignored.size === 0) return findings;\n  return findings.filter((f) => !ignored.has(f.location.line));\n}\n\n/**\n * Drop findings whose match starts inside a comment. No-op when the file's\n * language has no comment style we handle, or when it has no comments.\n */\nexport function stripCommentFindings(\n  findings: Finding[],\n  content: string,\n  file: string,\n): Finding[] {\n  if (findings.length === 0) return findings;\n  const style = commentStyleForFile(file);\n  if (!style) return findings;\n  const spans = commentSpans(content, style, /\\.go$/i.test(file));\n  // Python docstrings suppress prose *token* rules but keep real PEM material.\n  const docSpans = style === \"hash\" ? pythonDocstringSpans(content) : [];\n  if (spans.length === 0 && docSpans.length === 0) return findings;\n\n  // 1-based line → start offset, to turn a finding's (line, column) back into an\n  // absolute offset (column is 1-based: offset = lineStart + column - 1).\n  const lineStarts: number[] = [0];\n  for (let i = 0; i < content.length; i++) {\n    if (content[i] === \"\\n\") lineStarts.push(i + 1);\n  }\n\n  return findings.filter((f) => {\n    const start = lineStarts[f.location.line - 1] ?? 0;\n    const offset = start + ((f.location.column ?? 1) - 1);\n    if (offsetInSpans(spans, offset)) return false;\n    if (docSpans.length > 0 && !f.ruleId.startsWith(\"pem-\") && offsetInSpans(docSpans, offset)) {\n      return false;\n    }\n    return true;\n  });\n}\n\n/**\n * Compute the string-literal spans (`[start, end)`) of `content`, skipping over\n * comments so a quote inside a comment is not treated as a string. Used to\n * suppress findings from IDENTIFIER-only rules (e.g. a Go `SigningMethodRS256`\n * mentioned inside an error-message string) — the mirror of {@link commentSpans}.\n */\nexport function stringSpans(\n  content: string,\n  style: CommentStyle,\n  rawBacktick = false,\n): Array<[number, number]> {\n  const spans: Array<[number, number]> = [];\n  const n = content.length;\n  let i = 0;\n  while (i < n) {\n    const c = content[i];\n    if (style === \"c\" && c === \"/\" && content[i + 1] === \"/\") {\n      i += 2;\n      while (i < n && content[i] !== \"\\n\") i++;\n      continue;\n    }\n    if (style === \"c\" && c === \"/\" && content[i + 1] === \"*\") {\n      i += 2;\n      while (i < n && !(content[i] === \"*\" && content[i + 1] === \"/\")) i++;\n      i = Math.min(n, i + 2);\n      continue;\n    }\n    if (style === \"hash\" && c === \"#\") {\n      i++;\n      while (i < n && content[i] !== \"\\n\") i++;\n      continue;\n    }\n    if (c === '\"' || c === \"'\" || c === \"`\") {\n      const start = i;\n      const end = skipQuoted(content, i, n, rawBacktick);\n      // A lone `'` (Rust lifetime, end === start+1) is not a string; skip it.\n      if (c !== \"'\" || end > start + 1) spans.push([start, end]);\n      i = end;\n      continue;\n    }\n    i++;\n  }\n  return spans;\n}\n\n/**\n * Drop findings of \"code-only\" rules (`ruleIds`) whose match starts inside a\n * string literal. Some rules — an identifier-form JWT signing method, a Go\n * `SigningMethodRS256` — are only meaningful as code; when the same token appears\n * inside a string (a test's `t.Error(\"SigningMethodPS256 …\")`) it is prose, not a\n * usage. Rules that legitimately match inside strings (quoted `\"RS256\"` alg\n * tokens, cipher-suite strings, ssh-key tokens) are NOT in `ruleIds` and pass\n * through untouched.\n */\nexport function stripStringLiteralFindings(\n  findings: Finding[],\n  content: string,\n  file: string,\n  ruleIds: ReadonlySet<string>,\n): Finding[] {\n  if (findings.length === 0 || !findings.some((f) => ruleIds.has(f.ruleId))) return findings;\n  const style = commentStyleForFile(file);\n  if (!style) return findings;\n  const spans = stringSpans(content, style, /\\.go$/i.test(file));\n  if (spans.length === 0) return findings;\n\n  const lineStarts: number[] = [0];\n  for (let i = 0; i < content.length; i++) {\n    if (content[i] === \"\\n\") lineStarts.push(i + 1);\n  }\n\n  return findings.filter((f) => {\n    if (!ruleIds.has(f.ruleId)) return true;\n    const start = lineStarts[f.location.line - 1] ?? 0;\n    const offset = start + ((f.location.column ?? 1) - 1);\n    return !offsetInSpans(spans, offset);\n  });\n}\n"]}

package/dist/dependencies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dependencies.d.ts","sourceRoot":"","sources":["../src/dependencies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAEV,mBAAmB,EACnB,OAAO,EACP,QAAQ,EACR,oBAAoB,EACrB,MAAM,YAAY,CAAC;AAKpB;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAkBjC,CAAC;AAEF,iDAAiD;AACjD,eAAO,MAAM,sBAAsB,EAAE,oBAAoB,EAyjBxD,CAAC;AAuEF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI,CAoB1E;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAuID;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,EAAE,CAyBrE"}
+{"version":3,"file":"dependencies.d.ts","sourceRoot":"","sources":["../src/dependencies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAEV,mBAAmB,EACnB,OAAO,EACP,QAAQ,EACR,oBAAoB,EACrB,MAAM,YAAY,CAAC;AAKpB;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAkBjC,CAAC;AAEF,iDAAiD;AACjD,eAAO,MAAM,sBAAsB,EAAE,oBAAoB,EA0jBxD,CAAC;AAuEF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI,CAoB1E;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAuID;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,EAAE,CAyBrE"}

package/dist/dependencies.js

@@ -471,7 +471,7 @@ export const vulnerableDependencies = [
     {
         name: "github.com/cloudflare/circl",
         ecosystem: "go",
-        reason: "Cloudflare CIRCL — classical ECDH/EdDSA curves (X25519, X448, Ed25519, P-256).",
+        reason: "Cloudflare CIRCL — classical ECDH/EdDSA curves (X25519, X448, Ed25519, P-256); also ships PQC (ML-KEM/ML-DSA + hybrids), so migrate the classical *usage*, not the package.",
         algorithms: ["ECDH", "EdDSA"],
         severity: "medium",
     },