@quantakrypto/core 0.4.3 → 0.4.4

package/dist/detectors/secrets.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Config detector: secrets encrypted at rest with classical asymmetric key
+ * wrapping. This is the purest "harvest now, decrypt later" surface — the
+ * ciphertext is often committed to a git repository, which means it is already
+ * replicated, effectively immortal, and retroactively un-fixable (you can
+ * re-encrypt HEAD, not history). Every recipient key here is classical.
+ *
+ * Covered:
+ *  - Mozilla SOPS / age recipients: `age1…` bech32 public keys (X25519 key
+ *    agreement wrapping the data key).
+ *  - PGP-encrypted payloads: `-----BEGIN PGP MESSAGE-----` (RSA/ElGamal ESK).
+ *  - Bitnami Sealed Secrets: `kind: SealedSecret` (controller wraps with RSA-OAEP).
+ *
+ * Symmetric-only schemes (ansible-vault AES, age with a scrypt passphrase) are
+ * intentionally NOT flagged: a strong symmetric key is only Grover-weakened, not
+ * broken, so it is out of scope for a *classical-asymmetric* readiness signal.
+ */
+import type { Detector } from "../types.js";
+/** Detects secrets encrypted at rest with classical asymmetric key wrapping. */
+export declare const secretsDetector: Detector;
+//# sourceMappingURL=secrets.d.ts.map

package/dist/detectors/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/detectors/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAmE/D,gFAAgF;AAChF,eAAO,MAAM,eAAe,EAAE,QA4B7B,CAAC"}

package/dist/detectors/secrets.js

@@ -0,0 +1,79 @@
+import { DOC_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+const SECRET_RULES = [
+    {
+        // age/SOPS recipient: `age1` + 58 bech32 chars. Distinctive enough for any file.
+        re: /\bage1[0-9a-z]{58}\b/g,
+        meta: {
+            id: "secrets-age-recipient",
+            title: "age / SOPS recipient (X25519)",
+            description: "An age (SOPS) recipient public key wraps secrets with classical X25519",
+            category: "key-exchange",
+            severity: "high",
+            confidence: "high",
+            algorithm: "X25519",
+            hndl: true,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: "Secrets are wrapped to an age/SOPS X25519 recipient (classical key agreement); harvest-now-decrypt-later exposed, and if committed to git the ciphertext is retroactively un-fixable.",
+            remediation: "Track a post-quantum age recipient / KMS (ML-KEM) and re-encrypt; rotate any secret whose ciphertext has left your control.",
+        },
+    },
+    {
+        re: /-----BEGIN PGP MESSAGE-----/g,
+        meta: {
+            id: "secrets-pgp-message",
+            title: "PGP-encrypted secret (RSA/ElGamal)",
+            description: "A PGP MESSAGE block: the session key is wrapped with classical RSA/ElGamal",
+            category: "kem",
+            severity: "high",
+            confidence: "high",
+            algorithm: "RSA",
+            hndl: true,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: "A PGP-encrypted secret whose session key is wrapped with classical RSA/ElGamal; harvest-now-decrypt-later exposed.",
+            remediation: "Re-encrypt with a post-quantum KEM (ML-KEM-768) once available; rotate the underlying secret.",
+        },
+    },
+    {
+        re: /\bkind:\s*["']?SealedSecret\b/g,
+        meta: {
+            id: "secrets-sealed-secret",
+            title: "Bitnami Sealed Secret (RSA-OAEP)",
+            description: "A SealedSecret is wrapped by the controller's classical RSA-OAEP key",
+            category: "kem",
+            severity: "high",
+            confidence: "high",
+            algorithm: "RSA",
+            hndl: true,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: "A Bitnami SealedSecret is wrapped with the controller's classical RSA-OAEP key; harvest-now-decrypt-later exposed, and typically committed to git.",
+            remediation: "Plan migration as sealed-secrets adds PQC support; rotate the sealing key and secrets when it does.",
+        },
+    },
+];
+/** Detects secrets encrypted at rest with classical asymmetric key wrapping. */
+export const secretsDetector = {
+    id: "secrets-at-rest",
+    description: "Secrets wrapped at rest with classical asymmetric crypto (SOPS/age, PGP, Sealed Secrets)",
+    scope: "config",
+    language: "any",
+    rules: SECRET_RULES.map((r) => r.meta),
+    // Skip prose/docs: a tutorial showing an example age recipient is not a secret store.
+    appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),
+    detect({ file, content }) {
+        // Fast reject: none of the distinctive markers present.
+        if (!content.includes("age1") &&
+            !content.includes("BEGIN PGP MESSAGE") &&
+            !content.includes("SealedSecret")) {
+            return [];
+        }
+        const findings = [];
+        for (const rule of SECRET_RULES) {
+            eachMatch(rule.re, content, (m) => {
+                findings.push(findingFromRule(rule.meta, { file, content, index: m.index, matchLength: m[0].length }));
+            });
+        }
+        return findings;
+    },
+};
+//# sourceMappingURL=secrets.js.map

package/dist/detectors/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/detectors/secrets.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC9F,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAO9C,MAAM,YAAY,GAAiB;IACjC;QACE,iFAAiF;QACjF,EAAE,EAAE,uBAAuB;QAC3B,IAAI,EAAE;YACJ,EAAE,EAAE,uBAAuB;YAC3B,KAAK,EAAE,+BAA+B;YACtC,WAAW,EAAE,wEAAwE;YACrF,QAAQ,EAAE,cAAc;YACxB,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,QAAQ;YACnB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,uLAAuL;YACzL,WAAW,EACT,6HAA6H;SAChI;KACF;IACD;QACE,EAAE,EAAE,8BAA8B;QAClC,IAAI,EAAE;YACJ,EAAE,EAAE,qBAAqB;YACzB,KAAK,EAAE,oCAAoC;YAC3C,WAAW,EAAE,4EAA4E;YACzF,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,oHAAoH;YACtH,WAAW,EACT,+FAA+F;SAClG;KACF;IACD;QACE,EAAE,EAAE,gCAAgC;QACpC,IAAI,EAAE;YACJ,EAAE,EAAE,uBAAuB;YAC3B,KAAK,EAAE,kCAAkC;YACzC,WAAW,EAAE,sEAAsE;YACnF,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,iBAAiB;YACtB,OAAO,EACL,oJAAoJ;YACtJ,WAAW,EACT,qGAAqG;SACxG;KACF;CACF,CAAC;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,eAAe,GAAa;IACvC,EAAE,EAAE,iBAAiB;IACrB,WAAW,EACT,0FAA0F;IAC5F,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACtC,sFAAsF;IACtF,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,cAAc,CAAC;IAClD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,wDAAwD;QACxD,IACE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;YACzB,CAAC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YACtC,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EACjC,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;YAChC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBAChC,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACxF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC","sourcesContent":["/**\n * Config detector: secrets encrypted at rest with classical asymmetric key\n * wrapping. This is the purest \"harvest now, decrypt later\" surface — the\n * ciphertext is often committed to a git repository, which means it is already\n * replicated, effectively immortal, and retroactively un-fixable (you can\n * re-encrypt HEAD, not history). Every recipient key here is classical.\n *\n * Covered:\n *  - Mozilla SOPS / age recipients: `age1…` bech32 public keys (X25519 key\n *    agreement wrapping the data key).\n *  - PGP-encrypted payloads: `-----BEGIN PGP MESSAGE-----` (RSA/ElGamal ESK).\n *  - Bitnami Sealed Secrets: `kind: SealedSecret` (controller wraps with RSA-OAEP).\n *\n * Symmetric-only schemes (ansible-vault AES, age with a scrypt passphrase) are\n * intentionally NOT flagged: a strong symmetric key is only Grover-weakened, not\n * broken, so it is out of scope for a *classical-asymmetric* readiness signal.\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport { DOC_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from \"../detect-utils.js\";\nimport { CWE_BROKEN_CRYPTO } from \"../cwe.js\";\n\ninterface SecretRule {\n  re: RegExp;\n  meta: RuleMeta;\n}\n\nconst SECRET_RULES: SecretRule[] = [\n  {\n    // age/SOPS recipient: `age1` + 58 bech32 chars. Distinctive enough for any file.\n    re: /\\bage1[0-9a-z]{58}\\b/g,\n    meta: {\n      id: \"secrets-age-recipient\",\n      title: \"age / SOPS recipient (X25519)\",\n      description: \"An age (SOPS) recipient public key wraps secrets with classical X25519\",\n      category: \"key-exchange\",\n      severity: \"high\",\n      confidence: \"high\",\n      algorithm: \"X25519\",\n      hndl: true,\n      cwe: CWE_BROKEN_CRYPTO,\n      message:\n        \"Secrets are wrapped to an age/SOPS X25519 recipient (classical key agreement); harvest-now-decrypt-later exposed, and if committed to git the ciphertext is retroactively un-fixable.\",\n      remediation:\n        \"Track a post-quantum age recipient / KMS (ML-KEM) and re-encrypt; rotate any secret whose ciphertext has left your control.\",\n    },\n  },\n  {\n    re: /-----BEGIN PGP MESSAGE-----/g,\n    meta: {\n      id: \"secrets-pgp-message\",\n      title: \"PGP-encrypted secret (RSA/ElGamal)\",\n      description: \"A PGP MESSAGE block: the session key is wrapped with classical RSA/ElGamal\",\n      category: \"kem\",\n      severity: \"high\",\n      confidence: \"high\",\n      algorithm: \"RSA\",\n      hndl: true,\n      cwe: CWE_BROKEN_CRYPTO,\n      message:\n        \"A PGP-encrypted secret whose session key is wrapped with classical RSA/ElGamal; harvest-now-decrypt-later exposed.\",\n      remediation:\n        \"Re-encrypt with a post-quantum KEM (ML-KEM-768) once available; rotate the underlying secret.\",\n    },\n  },\n  {\n    re: /\\bkind:\\s*[\"']?SealedSecret\\b/g,\n    meta: {\n      id: \"secrets-sealed-secret\",\n      title: \"Bitnami Sealed Secret (RSA-OAEP)\",\n      description: \"A SealedSecret is wrapped by the controller's classical RSA-OAEP key\",\n      category: \"kem\",\n      severity: \"high\",\n      confidence: \"high\",\n      algorithm: \"RSA\",\n      hndl: true,\n      cwe: CWE_BROKEN_CRYPTO,\n      message:\n        \"A Bitnami SealedSecret is wrapped with the controller's classical RSA-OAEP key; harvest-now-decrypt-later exposed, and typically committed to git.\",\n      remediation:\n        \"Plan migration as sealed-secrets adds PQC support; rotate the sealing key and secrets when it does.\",\n    },\n  },\n];\n\n/** Detects secrets encrypted at rest with classical asymmetric key wrapping. */\nexport const secretsDetector: Detector = {\n  id: \"secrets-at-rest\",\n  description:\n    \"Secrets wrapped at rest with classical asymmetric crypto (SOPS/age, PGP, Sealed Secrets)\",\n  scope: \"config\",\n  language: \"any\",\n  rules: SECRET_RULES.map((r) => r.meta),\n  // Skip prose/docs: a tutorial showing an example age recipient is not a secret store.\n  appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),\n  detect({ file, content }): Finding[] {\n    // Fast reject: none of the distinctive markers present.\n    if (\n      !content.includes(\"age1\") &&\n      !content.includes(\"BEGIN PGP MESSAGE\") &&\n      !content.includes(\"SealedSecret\")\n    ) {\n      return [];\n    }\n    const findings: Finding[] = [];\n    for (const rule of SECRET_RULES) {\n      eachMatch(rule.re, content, (m) => {\n        findings.push(\n          findingFromRule(rule.meta, { file, content, index: m.index, matchLength: m[0].length }),\n        );\n      });\n    }\n    return findings;\n  },\n};\n"]}

package/dist/detectors/source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../src/detectors/source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AA4/B/D,0DAA0D;AAC1D,eAAO,MAAM,eAAe,EAAE,QAAQ,EAQrC,CAAC"}
+{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../src/detectors/source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAmqC/D,0DAA0D;AAC1D,eAAO,MAAM,eAAe,EAAE,QAAQ,EAQrC,CAAC"}

package/dist/detectors/source.js

@@ -6,6 +6,107 @@ import { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION, CWE_WEAK_STRENGTH } from "../cw
 // `rsa-pss` is listed before `rsa` so the alternation consumes the full token
 // (ordered alternation would otherwise match `rsa` and reject the `-pss` tail).
 const RE_GENERATE_KEYPAIR = /generateKeyPair(?:Sync)?\s*\(\s*['"`](rsa-pss|rsa|ec|dsa|dh|x25519|x448|ed25519|ed448)['"`]/g;
+const KEYGEN_INFO = {
+    rsa: { algo: "RSA", cat: "kem", sev: "high", hndl: true, label: "RSA" },
+    // RSA-PSS is signature-only, so classify it as a (forgeable) signature
+    // rather than a KEM — no HNDL confidentiality exposure.
+    "rsa-pss": {
+        algo: "RSA",
+        cat: "signature",
+        sev: "high",
+        hndl: false,
+        label: "RSA-PSS",
+        message: "Generates a classical RSA-PSS signing key, which is forgeable by a quantum attacker.",
+        remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
+    },
+    // EC keys feed BOTH ECDSA (sign) and ECDH (key agreement). ECDH is
+    // HNDL-exposed, so classify conservatively as key-exchange-capable and
+    // surface both concerns rather than asserting signature-only (P0-4).
+    ec: {
+        algo: "ECDH",
+        cat: "key-exchange",
+        sev: "high",
+        hndl: true,
+        label: "EC (ECDSA/ECDH)",
+        message: "Generates a classical EC key pair. EC keys feed BOTH ECDSA signatures " +
+            "and ECDH key agreement; the ECDH path is harvest-now-decrypt-later exposed.",
+        remediation: "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
+    },
+    dsa: { algo: "DSA", cat: "signature", sev: "high", hndl: false, label: "DSA" },
+    dh: { algo: "DH", cat: "key-exchange", sev: "high", hndl: true, label: "Diffie-Hellman" },
+    x25519: { algo: "X25519", cat: "key-exchange", sev: "medium", hndl: true, label: "X25519" },
+    x448: { algo: "X448", cat: "key-exchange", sev: "medium", hndl: true, label: "X448" },
+    ed25519: { algo: "EdDSA", cat: "signature", sev: "low", hndl: false, label: "Ed25519" },
+    ed448: { algo: "EdDSA", cat: "signature", sev: "low", hndl: false, label: "Ed448" },
+};
+/** Emit a keygen finding for `generateKeyPair(Sync)('<type>')` at [index]. Shared
+ * by the direct matcher and the import-alias pass so both classify identically. */
+function pushKeygenFinding(findings, rawType, file, content, index, matchLength) {
+    const info = KEYGEN_INFO[rawType.toLowerCase()];
+    if (!info)
+        return;
+    findings.push(findingFromRule(RULE_NODE_KEYGEN, { file, content, index, matchLength }, {
+        title: `${info.label} key generation`,
+        category: info.cat,
+        severity: info.sev,
+        algorithm: info.algo,
+        hndl: info.hndl,
+        message: info.message ??
+            `Generates a classical ${info.label} key pair, which is not quantum-safe.`,
+        ...(info.remediation ? { remediation: info.remediation } : {}),
+    }));
+}
+/** Canonical Node-crypto call names whose import-aliases we resolve. */
+const ALIASABLE = [
+    "generateKeyPairSync",
+    "generateKeyPair",
+    "createECDH",
+    "createDiffieHellman",
+    "createDiffieHellmanGroup",
+];
+/**
+ * Collect import-aliases for the canonical crypto calls we resolve, so
+ * `import { generateKeyPairSync as gk } from 'node:crypto'` (or the CommonJS
+ * `const { generateKeyPairSync: gk } = require('crypto')`) is followed when `gk`
+ * is called later. Returns Map<canonical, alias[]>. An alias equal to its own
+ * canonical name is skipped (already matched directly). Precision-safe: the
+ * alias is only ever bound to a known crypto symbol, so a later `gk(` call is
+ * unambiguously that symbol.
+ */
+function collectCryptoAliases(content) {
+    const out = new Map();
+    const add = (canonical, alias) => {
+        if (!alias || alias === canonical)
+            return;
+        const list = out.get(canonical) ?? [];
+        if (!list.includes(alias))
+            list.push(alias);
+        out.set(canonical, list);
+    };
+    // ESM named imports: `import { A as B, C as D } from '...'`.
+    const esm = /import\s*(?:type\s+)?\{([^}]*)\}\s*from\s*['"][^'"]*['"]/g;
+    for (let m = esm.exec(content); m; m = esm.exec(content)) {
+        const spec = /([A-Za-z_$][\w$]*)\s+as\s+([A-Za-z_$][\w$]*)/g;
+        for (let s = spec.exec(m[1]); s; s = spec.exec(m[1])) {
+            if (ALIASABLE.includes(s[1]))
+                add(s[1], s[2]);
+        }
+    }
+    // CommonJS destructure-rename: `const { A: B } = require('...')`.
+    const cjs = /(?:const|let|var)\s*\{([^}]*)\}\s*=\s*require\s*\(\s*['"][^'"]*['"]\s*\)/g;
+    for (let m = cjs.exec(content); m; m = cjs.exec(content)) {
+        const spec = /([A-Za-z_$][\w$]*)\s*:\s*([A-Za-z_$][\w$]*)/g;
+        for (let s = spec.exec(m[1]); s; s = spec.exec(m[1])) {
+            if (ALIASABLE.includes(s[1]))
+                add(s[1], s[2]);
+        }
+    }
+    return out;
+}
+/** Escape a string for safe interpolation into a dynamically-built RegExp. */
+function escapeRe(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
 const RE_CREATE_SIGN_VERIFY = /create(?:Sign|Verify)\s*\(/g;
 // One-shot crypto.sign/verify(algorithm, data, key). A LOOKBEHIND (not a
 // consumed char) anchors it so it doesn't fire inside identifiers like `assign(`
@@ -35,7 +136,7 @@ const RE_JSRSASIGN_KEYGEN = /KEYUTIL\.generateKeypair\s*\(/g;
 const RE_JSRSASIGN_SIGN = /KJUR\.crypto\.(?:Signature|ECDSA)\b/g;
 const RE_NODE_RSA = /new\s+NodeRSA\s*\(/g;
 // secp256k1 — direct @noble/secp256k1 / secp256k1-style API usage in source.
-const RE_SECP256K1 = /\b(?:secp(?:256k1)?|secp)\s*\.\s*(?:sign|verify|getPublicKey|getSharedSecret|ecdh|recoverPublicKey)\s*\(/g;
+const RE_SECP256K1 = /\b(?:secp(?:256k1)?|secp)\s*\.\s*(sign|verify|getPublicKey|getSharedSecret|ecdh|recoverPublicKey)\s*\(/g;
 // JWT/JOSE.
 const RE_JWT_ALG = /['"`](RS(?:256|384|512)|PS(?:256|384|512)|ES(?:256|384|512|256K)|EdDSA)['"`]/g;
 // JOSE ECDH-ES key agreement (HNDL) and COSE algorithm identifiers.
@@ -177,52 +278,41 @@ const nodeCryptoDetector = {
         const findings = [];
         // generateKeyPair(Sync)('rsa' | 'ec' | 'dsa' | 'dh' | 'x25519' | 'ed25519', ...)
         eachMatch(RE_GENERATE_KEYPAIR, content, (m) => {
-            const type = m[1].toLowerCase();
-            const map = {
-                rsa: { algo: "RSA", cat: "kem", sev: "high", hndl: true, label: "RSA" },
-                // RSA-PSS is signature-only, so classify it as a (forgeable) signature
-                // rather than a KEM — no HNDL confidentiality exposure.
-                "rsa-pss": {
-                    algo: "RSA",
-                    cat: "signature",
-                    sev: "high",
-                    hndl: false,
-                    label: "RSA-PSS",
-                    message: "Generates a classical RSA-PSS signing key, which is forgeable by a quantum attacker.",
-                    remediation: "ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)",
-                },
-                // EC keys feed BOTH ECDSA (sign) and ECDH (key agreement). ECDH is
-                // HNDL-exposed, so classify conservatively as key-exchange-capable and
-                // surface both concerns rather than asserting signature-only (P0-4).
-                ec: {
-                    algo: "ECDH",
-                    cat: "key-exchange",
-                    sev: "high",
-                    hndl: true,
-                    label: "EC (ECDSA/ECDH)",
-                    message: "Generates a classical EC key pair. EC keys feed BOTH ECDSA signatures " +
-                        "and ECDH key agreement; the ECDH path is harvest-now-decrypt-later exposed.",
-                    remediation: "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
-                },
-                dsa: { algo: "DSA", cat: "signature", sev: "high", hndl: false, label: "DSA" },
-                dh: { algo: "DH", cat: "key-exchange", sev: "high", hndl: true, label: "Diffie-Hellman" },
-                x25519: { algo: "X25519", cat: "key-exchange", sev: "medium", hndl: true, label: "X25519" },
-                x448: { algo: "X448", cat: "key-exchange", sev: "medium", hndl: true, label: "X448" },
-                ed25519: { algo: "EdDSA", cat: "signature", sev: "low", hndl: false, label: "Ed25519" },
-                ed448: { algo: "EdDSA", cat: "signature", sev: "low", hndl: false, label: "Ed448" },
-            };
-            const info = map[type];
-            findings.push(findingFromRule(RULE_NODE_KEYGEN, { file, content, index: m.index, matchLength: m[0].length }, {
-                title: `${info.label} key generation`,
-                category: info.cat,
-                severity: info.sev,
-                algorithm: info.algo,
-                hndl: info.hndl,
-                message: info.message ??
-                    `Generates a classical ${info.label} key pair, which is not quantum-safe.`,
-                ...(info.remediation ? { remediation: info.remediation } : {}),
-            }));
+            pushKeygenFinding(findings, m[1], file, content, m.index, m[0].length);
         });
+        // Import-alias resolution: follow `import { generateKeyPairSync as gk }` (and
+        // the CommonJS destructure-rename) so an aliased call still detects. Only the
+        // keygen / ECDH / DH constructors are resolved — their classification is
+        // unambiguous. The alias regexes run on the ORIGINAL content, so locations
+        // stay exact; it fires only when the alias was explicitly bound to a known
+        // crypto symbol, so precision is unaffected.
+        const aliases = collectCryptoAliases(content);
+        for (const [canonical, names] of aliases) {
+            for (const alias of names) {
+                const a = escapeRe(alias);
+                if (canonical === "generateKeyPairSync" || canonical === "generateKeyPair") {
+                    const re = new RegExp(`\\b${a}\\s*\\(\\s*['"\`](rsa-pss|rsa|ec|dsa|dh|x25519|x448|ed25519|ed448)['"\`]`, "g");
+                    eachMatch(re, content, (m) => pushKeygenFinding(findings, m[1], file, content, m.index, m[0].length));
+                }
+                else if (canonical === "createECDH") {
+                    eachMatch(new RegExp(`\\b${a}\\s*\\(`, "g"), content, (m) => findings.push(findingFromRule(RULE_NODE_ECDH, {
+                        file,
+                        content,
+                        index: m.index,
+                        matchLength: m[0].length,
+                    })));
+                }
+                else {
+                    // createDiffieHellman / createDiffieHellmanGroup.
+                    eachMatch(new RegExp(`\\b${a}\\s*\\(`, "g"), content, (m) => findings.push(findingFromRule(RULE_NODE_DH, {
+                        file,
+                        content,
+                        index: m.index,
+                        matchLength: m[0].length,
+                    })));
+                }
+            }
+        }
         // createSign / createVerify — RSA / ECDSA / DSA signatures.
         eachMatch(RE_CREATE_SIGN_VERIFY, content, (m) => {
             findings.push(findingFromRule(RULE_NODE_SIGN, {
@@ -485,7 +575,21 @@ const libraryDetector = {
         add(RE_FORGE_RSA, RULE_FORGE_RSA); // node-forge: pki.rsa.generateKeyPair(...)
         add(RE_FORGE_ED25519, RULE_FORGE_ED25519); // node-forge: forge.ed25519.*
         add(RE_ELLIPTIC_EC, RULE_ELLIPTIC_EC); // elliptic: new EC('secp256k1')
-        add(RE_SECP256K1, RULE_SECP256K1); // secp.sign / getPublicKey / getSharedSecret
+        // secp256k1: classify per method — getSharedSecret/ecdh are key AGREEMENT
+        // (ECDH, harvest-now-decrypt-later); sign/verify/getPublicKey/recover are
+        // ECDSA signatures (not HNDL). The old rule flagged everything as ECDSA.
+        eachMatch(RE_SECP256K1, content, (m) => {
+            const kex = m[1] === "getSharedSecret" || m[1] === "ecdh";
+            findings.push(findingFromRule(RULE_SECP256K1, { file, content, index: m.index, matchLength: m[0].length }, kex
+                ? {
+                    title: "secp256k1 ECDH key agreement",
+                    category: "key-exchange",
+                    algorithm: "ECDH",
+                    hndl: true,
+                    message: `secp256k1 ECDH key agreement (.${m[1]}()) is classical and harvest-now-decrypt-later exposed.`,
+                }
+                : undefined));
+        });
         add(RE_JSRSASIGN_KEYGEN, RULE_JSRSASIGN_KEYGEN); // jsrsasign: KEYUTIL.generateKeypair(...)
         add(RE_JSRSASIGN_SIGN, RULE_JSRSASIGN_SIGN); // jsrsasign: KJUR.crypto.*
         add(RE_NODE_RSA, RULE_NODE_RSA_LIB); // node-rsa: new NodeRSA(...)
@@ -678,6 +782,41 @@ const RE_CERT_SIG_ALG = /\b(sha(?:1|256|384|512)WithRSAEncryption|ecdsa-with-SHA
 // Shor-broken key agreement — the harvest-now-decrypt-later surface a lexical
 // scan misses when only the `crypto/*` API is matched, not the negotiated kex.
 const RE_SSH_KEX = /\b(diffie-hellman-group(?:1|14|15|16|17|18)(?:-sha1|-sha256|-sha512)?|diffie-hellman-group-exchange-sha(?:1|256)|ecdh-sha2-nistp(?:256|384|521)|curve25519-sha256)\b/g;
+// A bare key-type token (`ssh-rsa`, `ssh-ed25519`, …) is real SSH crypto only
+// when it is EITHER (a) followed by base64 key material — an actual
+// authorized_keys / known_hosts entry — OR (b) one of ≥2 DISTINCT ssh key/host-key
+// algorithm tokens on the same line — an algorithm-preference list
+// (`HostKeyAlgorithms ssh-ed25519,ecdsa-sha2-nistp256,ssh-rsa`, `%w[…]`, …). A
+// lone token, e.g. a UI label / i18n value like `"ssh-rsa": "ssh-rsa"`, is
+// neither, so it must NOT be flagged. `RE_SSH_ALGO_TOKEN` is a separate (cloned-
+// on-use) copy so counting per line never disturbs the outer `eachMatch` state.
+const RE_SSH_ALGO_TOKEN = /\b(ssh-rsa|ssh-ed25519|ssh-dss|ecdsa-sha2-nistp(?:256|384|521))\b/g;
+/** How far around a token we look for a sibling algorithm on the same line. A
+ * real `HostKeyAlgorithms` list is short; bounding the window keeps the per-token
+ * work O(1) so a pathological single huge line can't make detection quadratic. */
+const SSH_LINE_WINDOW = 512;
+function isRealSshKeyOrAlgoList(content, index, matchLen) {
+    // (a) base64 key material immediately after the token → a real SSH public key.
+    if (/^\s+[A-Za-z0-9+/]{20,}/.test(content.slice(index + matchLen, index + matchLen + 80))) {
+        return true;
+    }
+    // (b) ≥2 distinct ssh key/host-key algorithm tokens on the same line → a list.
+    // Bound both the back-scan for the line start and the window itself so the work
+    // is constant per token and never crosses a line boundary (i18n entries live on
+    // separate lines, so a lone repeated token stays a single distinct token).
+    const from = Math.max(0, index - SSH_LINE_WINDOW);
+    const pre = content.slice(from, index);
+    const preNl = pre.lastIndexOf("\n");
+    const lineStart = preNl === -1 ? from : from + preNl + 1;
+    const to = Math.min(content.length, index + matchLen + SSH_LINE_WINDOW);
+    const post = content.slice(index, to);
+    const postNl = post.indexOf("\n");
+    const lineEnd = postNl === -1 ? to : index + postNl;
+    const distinct = new Set();
+    for (const t of content.slice(lineStart, lineEnd).matchAll(RE_SSH_ALGO_TOKEN))
+        distinct.add(t[1]);
+    return distinct.size >= 2;
+}
 const RULE_SSH_PUBKEY = {
     id: "ssh-public-key",
     title: "Classical SSH public key",
@@ -737,6 +876,10 @@ const sshCertDetector = {
         const findings = [];
         // SSH public keys: ssh-rsa AAAA…, ecdsa-sha2-nistp256 …, ssh-ed25519 …
         eachMatch(RE_SSH_PUBKEY, content, (m) => {
+            // Skip a bare token that is neither a real key nor an algorithm list (e.g.
+            // a `"ssh-rsa": "ssh-rsa"` i18n label) — see `isRealSshKeyOrAlgoList`.
+            if (!isRealSshKeyOrAlgoList(content, m.index, m[0].length))
+                return;
             const tok = m[1];
             const algorithm = tok.startsWith("ssh-rsa")
                 ? "RSA"