@quantakrypto/core 0.4.3 → 0.5.0

package/dist/cbom.js.map

@@ -1 +1 @@
-{"version":3,"file":"cbom.js","sourceRoot":"","sources":["../src/cbom.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAqBvC,gEAAgE;AAChE,SAAS,YAAY,CAAC,QAAyB;IAC7C,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,KAAK;YACR,OAAO,KAAK,CAAC;QACf,KAAK,cAAc;YACjB,OAAO,WAAW,CAAC;QACrB,KAAK,WAAW;YACd,OAAO,WAAW,CAAC;QACrB,KAAK,aAAa;YAChB,wEAAwE;YACxE,yEAAyE;YACzE,kEAAkE;YAClE,OAAO,OAAO,CAAC;QACjB,KAAK,KAAK;YACR,OAAO,OAAO,CAAC;QACjB;YACE,OAAO,OAAO,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,UAA2B;IACtD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,SAAS,yBAAyB,CAAC,SAA0B;IAC3D,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,KAAK,CAAC;QACX,KAAK,IAAI,CAAC;QACV,KAAK,KAAK;YACR,OAAO,GAAG,CAAC;QACb,KAAK,MAAM,CAAC;QACZ,KAAK,OAAO,CAAC;QACb,KAAK,OAAO,CAAC;QACb,KAAK,QAAQ,CAAC;QACd,KAAK,OAAO;YACV,OAAO,GAAG,CAAC;QACb,KAAK,MAAM;YACT,OAAO,GAAG,CAAC;QACb;YACE,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,SAAS,MAAM,CAAC,GAAW;IACzB,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACzF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAC,MAAkB;IACvC,6CAA6C;IAC7C,MAAM,MAAM,GAAG,IAAI,GAAG,EAGnB,CAAC;IAEJ,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,SAAS,GAAoB,CAAC,CAAC,SAAS,IAAI,SAAS,CAAC;QAC5D,MAAM,SAAS,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC;QACxC,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;YAC3C,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,CAAC;QACD,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,UAAU,GAAoB,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;SACtD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACxD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE;QAChB,MAAM,WAAW,GAAG,CAAC,CAAC,QAAQ;aAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,QAAQ,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE;YACjD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C,CAAC,CAAC;aACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEpF,MAAM,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAE/C,OAAO;YACL,IAAI,EAAE,qBAA8B;YACpC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC;YACtB,IAAI,EAAE,GAAG,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,GAAG;YACvC,gBAAgB,EAAE;gBAChB,SAAS,EAAE,WAAW;gBACtB,mBAAmB,EAAE;oBACnB,SAAS,EAAE,CAAC,CAAC,SAAS;oBACtB,sBAAsB,EAAE,CAAC,CAAC,SAAS;oBACnC,oBAAoB,EAAE,oBAAoB;oBAC1C,sBAAsB,EAAE,yBAAyB,CAAC,CAAC,CAAC,SAAS,CAAC;oBAC9D,wBAAwB,EAAE,CAAC;oBAC3B,eAAe,EACb,CAAC,CAAC,SAAS,KAAK,WAAW;wBACzB,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC;wBACpB,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK;4BACrB,CAAC,CAAC,CAAC,aAAa,EAAE,aAAa,CAAC;4BAChC,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,WAAW;gCAC3B,CAAC,CAAC,CAAC,UAAU,CAAC;gCACd,CAAC,CAAC,CAAC,OAAO,CAAC;iBACpB;gBACD,iBAAiB,EAAE,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC;gBACnD,sBAAsB,EAAE,OAAO;aAChC;YACD,QAAQ,EAAE,EAAE,WAAW,EAAE;SAC1B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,MAAM,MAAM,GAAG,YAAY,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;IAEhD,OAAO;QACL,SAAS,EAAE,WAAW;QACtB,WAAW,EAAE,KAAK;QAClB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE;YACR,SAAS,EAAE,MAAM,CAAC,UAAU;YAC5B,KAAK,EAAE;gBACL,UAAU,EAAE;oBACV;wBACE,IAAI,EAAE,aAAa;wBACnB,IAAI,EAAE,OAAO;wBACb,OAAO,EAAE,MAAM,CAAC,WAAW,IAAI,OAAO;qBACvC;iBACF;aACF;YACD,SAAS,EAAE;gBACT,IAAI,EAAE,aAAa;gBACnB,SAAS,EAAE,MAAM;gBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB;SACF;QACD,UAAU;KACX,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,MAAkB;IACpC,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC;SAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC;SAChF,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,2DAA2D;IAC3D,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;AACzG,CAAC","sourcesContent":["/**\n * CBOM (Cryptographic Bill of Materials) export — CycloneDX 1.6 with\n * `cryptographic-asset` components. Turns a {@link ScanResult} into a\n * machine-readable inventory of the classical cryptographic assets discovered,\n * for compliance / supply-chain tooling.\n *\n * Reference: CycloneDX 1.6 cryptography properties\n * (https://cyclonedx.org/capabilities/cbom/). We emit one\n * `cryptographic-asset` component per distinct (algorithm, primitive) pair\n * observed, with occurrence evidence pointing back at the findings.\n */\nimport { createHash } from \"node:crypto\";\n\nimport type { AlgorithmFamily, Finding, FindingCategory, ScanResult } from \"./types.js\";\nimport { VERSION } from \"./version.js\";\n\n/** A CycloneDX 1.6 cryptographic bill of materials (kept permissive). */\nexport interface CycloneDxBom {\n  bomFormat: \"CycloneDX\";\n  specVersion: \"1.6\";\n  serialNumber: string;\n  version: number;\n  metadata: Record<string, unknown>;\n  components: CbomComponent[];\n}\n\n/** A single CycloneDX `cryptographic-asset` component. */\nexport interface CbomComponent {\n  type: \"cryptographic-asset\";\n  \"bom-ref\": string;\n  name: string;\n  cryptoProperties: Record<string, unknown>;\n  evidence?: Record<string, unknown>;\n}\n\n/** CycloneDX cryptographic primitive for a finding category. */\nfunction primitiveFor(category: FindingCategory): string {\n  switch (category) {\n    case \"kem\":\n      return \"kem\";\n    case \"key-exchange\":\n      return \"key-agree\";\n    case \"signature\":\n      return \"signature\";\n    case \"certificate\":\n      // \"pki\" is NOT a valid CycloneDX 1.6 algorithmProperties.primitive enum\n      // value; use \"other\" so the CBOM validates (audit: quantum #3). Modeling\n      // certificates as assetType:\"certificate\" is a future refinement.\n      return \"other\";\n    case \"tls\":\n      return \"other\";\n    default:\n      return \"other\";\n  }\n}\n\n/**\n * Every CBOM asset here is derived from a quantakrypto finding, and the detectors\n * only ever fire on classical (Shor-broken) public-key crypto — so an asset is\n * quantum-vulnerable by construction, even when the exact family couldn't be\n * pinned down (`unknown`). Reporting `false` for `unknown` mislabeled\n * definitionally-classical findings as safe (audit: crypto #6).\n */\nfunction isQuantumVulnerable(_algorithm: AlgorithmFamily): boolean {\n  return true;\n}\n\n/**\n * Approximate CLASSICAL security strength (bits) of the common parameterisation\n * of a classical family — RSA-2048 / DH-2048 ≈ 112-bit, 256-bit curves ≈ 128-bit,\n * X448 ≈ 224-bit. (The QUANTUM level is 0 for all of these: Shor breaks them.)\n * 0 when the family is unknown. Reported so a CBOM doesn't imply these primitives\n * have zero classical strength today.\n */\nfunction classicalSecurityLevelFor(algorithm: AlgorithmFamily): number {\n  switch (algorithm) {\n    case \"RSA\":\n    case \"DH\":\n    case \"DSA\":\n      return 112;\n    case \"ECDH\":\n    case \"ECDSA\":\n    case \"EdDSA\":\n    case \"X25519\":\n    case \"ECIES\":\n      return 128;\n    case \"X448\":\n      return 224;\n    default:\n      return 0;\n  }\n}\n\n/** Deterministic bom-ref for a (algorithm, primitive) asset key. */\nfunction bomRef(key: string): string {\n  return `crypto:${createHash(\"sha256\").update(key, \"utf8\").digest(\"hex\").slice(0, 16)}`;\n}\n\n/**\n * Build a CycloneDX 1.6 CBOM from a scan result. One component per distinct\n * (algorithm + primitive) pair, with occurrence evidence (file:line) per\n * finding. Output is deterministic (components and occurrences are sorted).\n */\nexport function toCbom(result: ScanResult): CycloneDxBom {\n  // Group findings by (algorithm | primitive).\n  const groups = new Map<\n    string,\n    { algorithm: AlgorithmFamily; primitive: string; findings: Finding[] }\n  >();\n\n  for (const f of result.findings) {\n    const algorithm: AlgorithmFamily = f.algorithm ?? \"unknown\";\n    const primitive = primitiveFor(f.category);\n    const key = `${algorithm}|${primitive}`;\n    let g = groups.get(key);\n    if (!g) {\n      g = { algorithm, primitive, findings: [] };\n      groups.set(key, g);\n    }\n    g.findings.push(f);\n  }\n\n  const components: CbomComponent[] = [...groups.entries()]\n    .sort((a, b) => (a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0))\n    .map(([key, g]) => {\n      const occurrences = g.findings\n        .map((f) => ({\n          location: `${f.location.file}:${f.location.line}`,\n          ...(f.cwe ? { additionalContext: f.cwe } : {}),\n        }))\n        .sort((a, b) => (a.location < b.location ? -1 : a.location > b.location ? 1 : 0));\n\n      const anyHndl = g.findings.some((f) => f.hndl);\n\n      return {\n        type: \"cryptographic-asset\" as const,\n        \"bom-ref\": bomRef(key),\n        name: `${g.algorithm} (${g.primitive})`,\n        cryptoProperties: {\n          assetType: \"algorithm\",\n          algorithmProperties: {\n            primitive: g.primitive,\n            parameterSetIdentifier: g.algorithm,\n            executionEnvironment: \"software-plain-ram\",\n            classicalSecurityLevel: classicalSecurityLevelFor(g.algorithm),\n            nistQuantumSecurityLevel: 0,\n            cryptoFunctions:\n              g.primitive === \"signature\"\n                ? [\"sign\", \"verify\"]\n                : g.primitive === \"kem\"\n                  ? [\"encapsulate\", \"decapsulate\"]\n                  : g.primitive === \"key-agree\"\n                    ? [\"keyagree\"]\n                    : [\"other\"],\n          },\n          quantumVulnerable: isQuantumVulnerable(g.algorithm),\n          harvestNowDecryptLater: anyHndl,\n        },\n        evidence: { occurrences },\n      };\n    });\n\n  const serial = `urn:uuid:${stableUuid(result)}`;\n\n  return {\n    bomFormat: \"CycloneDX\",\n    specVersion: \"1.6\",\n    serialNumber: serial,\n    version: 1,\n    metadata: {\n      timestamp: result.finishedAt,\n      tools: {\n        components: [\n          {\n            type: \"application\",\n            name: \"qScan\",\n            version: result.toolVersion || VERSION,\n          },\n        ],\n      },\n      component: {\n        type: \"application\",\n        \"bom-ref\": \"root\",\n        name: result.root,\n      },\n    },\n    components,\n  };\n}\n\n/**\n * Derive a stable UUID-shaped serial from the scan result so re-exporting the\n * same result yields the same serial number (deterministic output).\n */\nfunction stableUuid(result: ScanResult): string {\n  const h = createHash(\"sha256\")\n    .update(`${result.root}|${result.toolVersion}|${result.findings.length}`, \"utf8\")\n    .digest(\"hex\");\n  // Shape as a v4-ish UUID (variant/version nibbles forced).\n  return `${h.slice(0, 8)}-${h.slice(8, 12)}-4${h.slice(13, 16)}-8${h.slice(17, 20)}-${h.slice(20, 32)}`;\n}\n"]}
+{"version":3,"file":"cbom.js","sourceRoot":"","sources":["../src/cbom.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAuBvC,wFAAwF;AACxF,SAAS,YAAY,CAAC,QAAyB;IAC7C,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,KAAK;YACR,OAAO,KAAK,CAAC;QACf,KAAK,cAAc;YACjB,OAAO,WAAW,CAAC;QACrB,KAAK,WAAW;YACd,OAAO,WAAW,CAAC;QACrB,KAAK,MAAM;YACT,OAAO,MAAM,CAAC;QAChB;YACE,oEAAoE;YACpE,uEAAuE;YACvE,4DAA4D;YAC5D,OAAO,OAAO,CAAC;IACnB,CAAC;AACH,CAAC;AAKD;;;;;;;;;GASG;AACH,SAAS,aAAa,CAAC,CAAU;IAM/B,IAAI,CAAC,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;QACzB,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IAC9E,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;QACjC,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAClC,uEAAuE;QACvE,IAAI,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1D,OAAO;gBACL,SAAS,EAAE,yBAAyB;gBACpC,aAAa,EAAE,aAAa;gBAC5B,YAAY,EAAE,aAAa;aAC5B,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9B,OAAO;gBACL,SAAS,EAAE,yBAAyB;gBACpC,aAAa,EAAE,YAAY;gBAC3B,YAAY,EAAE,YAAY;aAC3B,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3B,OAAO;gBACL,SAAS,EAAE,yBAAyB;gBACpC,aAAa,EAAE,YAAY;gBAC3B,YAAY,EAAE,YAAY;aAC3B,CAAC;QACJ,CAAC;QACD,mEAAmE;QACnE,2EAA2E;QAC3E,4EAA4E;QAC5E,0EAA0E;QAC1E,yEAAyE;QACzE,uEAAuE;QACvE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;IACzD,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,UAA2B;IACtD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,SAAS,yBAAyB,CAAC,SAA0B;IAC3D,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,KAAK,CAAC;QACX,KAAK,IAAI,CAAC;QACV,KAAK,KAAK;YACR,OAAO,GAAG,CAAC;QACb,KAAK,MAAM,CAAC;QACZ,KAAK,OAAO,CAAC;QACb,KAAK,OAAO,CAAC;QACb,KAAK,QAAQ,CAAC;QACd,KAAK,OAAO;YACV,OAAO,GAAG,CAAC;QACb,KAAK,MAAM;YACT,OAAO,GAAG,CAAC;QACb;YACE,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,SAAS,MAAM,CAAC,GAAW;IACzB,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACzF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAC,MAAkB;IACvC,6EAA6E;IAC7E,8EAA8E;IAC9E,wCAAwC;IACxC,MAAM,MAAM,GAAG,IAAI,GAAG,EAUnB,CAAC;IAEJ,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,SAAS,GAAoB,CAAC,CAAC,SAAS,IAAI,SAAS,CAAC;QAC5D,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,SAAS,IAAI,SAAS,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;QACjE,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;YACxC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,CAAC;QACD,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,UAAU,GAAoB,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;SACtD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACxD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE;QAChB,MAAM,WAAW,GAAG,CAAC,CAAC,QAAQ;aAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,QAAQ,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE;YACjD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C,CAAC,CAAC;aACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEpF,MAAM,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAE/C,6EAA6E;QAC7E,IAAI,SAAkC,CAAC;QACvC,IAAI,KAAa,CAAC;QAClB,QAAQ,CAAC,CAAC,SAAS,EAAE,CAAC;YACpB,KAAK,aAAa;gBAChB,uEAAuE;gBACvE,wEAAwE;gBACxE,gEAAgE;gBAChE,SAAS,GAAG,EAAE,qBAAqB,EAAE,EAAE,EAAE,CAAC;gBAC1C,KAAK,GAAG,aAAa,CAAC;gBACtB,MAAM;YACR,KAAK,yBAAyB;gBAC5B,SAAS,GAAG;oBACV,+BAA+B,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,IAAI,KAAK,EAAE;iBACnE,CAAC;gBACF,KAAK,GAAG,CAAC,CAAC,YAAY,IAAI,KAAK,CAAC;gBAChC,MAAM;YACR,KAAK,UAAU;gBACb,SAAS,GAAG,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,IAAI,KAAK,EAAE,EAAE,CAAC;gBACtE,KAAK,GAAG,CAAC,CAAC,YAAY,IAAI,KAAK,CAAC;gBAChC,MAAM;YACR,KAAK,WAAW,CAAC;YACjB;gBACE,SAAS,GAAG;oBACV,mBAAmB,EAAE;wBACnB,SAAS,EAAE,CAAC,CAAC,aAAa;wBAC1B,sBAAsB,EAAE,CAAC,CAAC,SAAS;wBACnC,oBAAoB,EAAE,oBAAoB;wBAC1C,sBAAsB,EAAE,yBAAyB,CAAC,CAAC,CAAC,SAAS,CAAC;wBAC9D,wBAAwB,EAAE,CAAC;wBAC3B,eAAe,EACb,CAAC,CAAC,aAAa,KAAK,WAAW;4BAC7B,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC;4BACpB,CAAC,CAAC,CAAC,CAAC,aAAa,KAAK,KAAK;gCACzB,CAAC,CAAC,CAAC,aAAa,EAAE,aAAa,CAAC;gCAChC,CAAC,CAAC,6DAA6D;oCAC7D,iDAAiD;oCACjD,CAAC,OAAO,CAAC;qBAClB;iBACF,CAAC;gBACF,KAAK,GAAG,CAAC,CAAC,aAAa,CAAC;gBACxB,MAAM;QACV,CAAC;QAED,OAAO;YACL,IAAI,EAAE,qBAA8B;YACpC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC;YACtB,IAAI,EAAE,GAAG,CAAC,CAAC,SAAS,KAAK,KAAK,GAAG;YACjC,gBAAgB,EAAE;gBAChB,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,GAAG,SAAS;aACb;YACD,4EAA4E;YAC5E,yEAAyE;YACzE,sEAAsE;YACtE,wEAAwE;YACxE,UAAU,EAAE;gBACV;oBACE,IAAI,EAAE,gCAAgC;oBACtC,KAAK,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;iBAChD;gBACD,EAAE,IAAI,EAAE,qCAAqC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE;aACxE;YACD,QAAQ,EAAE,EAAE,WAAW,EAAE;SAC1B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,MAAM,MAAM,GAAG,YAAY,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;IAEhD,OAAO;QACL,SAAS,EAAE,WAAW;QACtB,WAAW,EAAE,KAAK;QAClB,YAAY,EAAE,MAAM;QACpB,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE;YACR,SAAS,EAAE,MAAM,CAAC,UAAU;YAC5B,KAAK,EAAE;gBACL,UAAU,EAAE;oBACV;wBACE,IAAI,EAAE,aAAa;wBACnB,IAAI,EAAE,OAAO;wBACb,OAAO,EAAE,MAAM,CAAC,WAAW,IAAI,OAAO;qBACvC;iBACF;aACF;YACD,SAAS,EAAE;gBACT,IAAI,EAAE,aAAa;gBACnB,SAAS,EAAE,MAAM;gBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB;SACF;QACD,UAAU;KACX,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,UAAU,CAAC,MAAkB;IACpC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;IACzF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,2DAA2D;IAC3D,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;AACzG,CAAC","sourcesContent":["/**\n * CBOM (Cryptographic Bill of Materials) export — CycloneDX 1.6 with\n * `cryptographic-asset` components. Turns a {@link ScanResult} into a\n * machine-readable inventory of the classical cryptographic assets discovered,\n * for compliance / supply-chain tooling.\n *\n * Reference: CycloneDX 1.6 cryptography properties\n * (https://cyclonedx.org/capabilities/cbom/). Each finding is classified into\n * its CycloneDX `assetType` — `algorithm` (usage), `certificate` (X.509),\n * `related-crypto-material` (private/public key material), or `protocol` (TLS) —\n * and we emit one `cryptographic-asset` component per distinct\n * (assetType, algorithm, discriminator), with occurrence evidence pointing back\n * at the findings. Every asset carries the quantum posture flags.\n */\nimport { createHash } from \"node:crypto\";\n\nimport type { AlgorithmFamily, Finding, FindingCategory, ScanResult } from \"./types.js\";\nimport { VERSION } from \"./version.js\";\n\n/** A CycloneDX 1.6 cryptographic bill of materials (kept permissive). */\nexport interface CycloneDxBom {\n  bomFormat: \"CycloneDX\";\n  specVersion: \"1.6\";\n  serialNumber: string;\n  version: number;\n  metadata: Record<string, unknown>;\n  components: CbomComponent[];\n}\n\n/** A single CycloneDX `cryptographic-asset` component. */\nexport interface CbomComponent {\n  type: \"cryptographic-asset\";\n  \"bom-ref\": string;\n  name: string;\n  cryptoProperties: Record<string, unknown>;\n  /** CycloneDX component name/value properties (carries the quantum posture flags). */\n  properties?: { name: string; value: string }[];\n  evidence?: Record<string, unknown>;\n}\n\n/** CycloneDX cryptographic primitive for a finding category (algorithm assets only). */\nfunction primitiveFor(category: FindingCategory): string {\n  switch (category) {\n    case \"kem\":\n      return \"kem\";\n    case \"key-exchange\":\n      return \"key-agree\";\n    case \"signature\":\n      return \"signature\";\n    case \"hash\":\n      return \"hash\";\n    default:\n      // `certificate` / `tls` no longer route here (they become their own\n      // assetType — see {@link classifyAsset}); `dependency` / `rng` and any\n      // future category fall back to the valid \"other\" primitive.\n      return \"other\";\n  }\n}\n\n/** The CycloneDX 1.6 `cryptoProperties.assetType` a finding maps to. */\ntype CbomAssetType = \"algorithm\" | \"certificate\" | \"protocol\" | \"related-crypto-material\";\n\n/**\n * Classify a finding into its CycloneDX 1.6 asset type. Most findings are\n * algorithm USAGE (`kem` / `key-exchange` / `signature` / `hash` / …). The\n * `certificate` category is a mix of real X.509 certificates and raw key\n * material, disambiguated by rule id; `tls` findings are protocol configuration.\n *\n * `discriminator` keeps distinct kinds in separate components (it is the algorithm\n * primitive for `algorithm`, the material type for `related-crypto-material`, the\n * protocol type for `protocol`, and empty for `certificate`).\n */\nfunction classifyAsset(f: Finding): {\n  assetType: CbomAssetType;\n  discriminator: string;\n  materialType?: string;\n  protocolType?: string;\n} {\n  if (f.category === \"tls\") {\n    return { assetType: \"protocol\", discriminator: \"tls\", protocolType: \"tls\" };\n  }\n  if (f.category === \"certificate\") {\n    const id = f.ruleId.toLowerCase();\n    // Route the explicitly key-SHAPED material to related-crypto-material…\n    if (id.includes(\"private-key\") || id.includes(\"keystore\")) {\n      return {\n        assetType: \"related-crypto-material\",\n        discriminator: \"private-key\",\n        materialType: \"private-key\",\n      };\n    }\n    if (id.includes(\"public-key\")) {\n      return {\n        assetType: \"related-crypto-material\",\n        discriminator: \"public-key\",\n        materialType: \"public-key\",\n      };\n    }\n    if (id.includes(\"message\")) {\n      return {\n        assetType: \"related-crypto-material\",\n        discriminator: \"ciphertext\",\n        materialType: \"ciphertext\",\n      };\n    }\n    // …and DEFAULT the rest of the `certificate` category to assetType\n    // \"certificate\" — the category's own meaning. This covers real X.509 certs\n    // and CSRs (pem-certificate/pem-cert-request) plus PKI trust material whose\n    // ids don't spell \"cert\": ACM certs (cfn-acm-*), Vault PKI (vault-pki-*),\n    // mesh identity, and SPIFFE X.509-SVIDs (spire-*). Previously these fell\n    // through to related-crypto-material \"key\", mislabelling certificates.\n    return { assetType: \"certificate\", discriminator: \"\" };\n  }\n  return { assetType: \"algorithm\", discriminator: primitiveFor(f.category) };\n}\n\n/**\n * Every CBOM asset here is derived from a quantakrypto finding, and the detectors\n * only ever fire on classical (Shor-broken) public-key crypto — so an asset is\n * quantum-vulnerable by construction, even when the exact family couldn't be\n * pinned down (`unknown`). Reporting `false` for `unknown` mislabeled\n * definitionally-classical findings as safe (audit: crypto #6).\n */\nfunction isQuantumVulnerable(_algorithm: AlgorithmFamily): boolean {\n  return true;\n}\n\n/**\n * Approximate CLASSICAL security strength (bits) of the common parameterisation\n * of a classical family — RSA-2048 / DH-2048 ≈ 112-bit, 256-bit curves ≈ 128-bit,\n * X448 ≈ 224-bit. (The QUANTUM level is 0 for all of these: Shor breaks them.)\n * 0 when the family is unknown. Reported so a CBOM doesn't imply these primitives\n * have zero classical strength today.\n */\nfunction classicalSecurityLevelFor(algorithm: AlgorithmFamily): number {\n  switch (algorithm) {\n    case \"RSA\":\n    case \"DH\":\n    case \"DSA\":\n      return 112;\n    case \"ECDH\":\n    case \"ECDSA\":\n    case \"EdDSA\":\n    case \"X25519\":\n    case \"ECIES\":\n      return 128;\n    case \"X448\":\n      return 224;\n    default:\n      return 0;\n  }\n}\n\n/** Deterministic bom-ref for a (algorithm, primitive) asset key. */\nfunction bomRef(key: string): string {\n  return `crypto:${createHash(\"sha256\").update(key, \"utf8\").digest(\"hex\").slice(0, 16)}`;\n}\n\n/**\n * Build a CycloneDX 1.6 CBOM from a scan result. One component per distinct\n * (algorithm + primitive) pair, with occurrence evidence (file:line) per\n * finding. Output is deterministic (components and occurrences are sorted).\n */\nexport function toCbom(result: ScanResult): CycloneDxBom {\n  // Group findings by (assetType | algorithm | discriminator) so each distinct\n  // cryptographic asset — an algorithm usage, a certificate, key material, or a\n  // protocol — becomes its own component.\n  const groups = new Map<\n    string,\n    {\n      assetType: CbomAssetType;\n      algorithm: AlgorithmFamily;\n      discriminator: string;\n      materialType?: string;\n      protocolType?: string;\n      findings: Finding[];\n    }\n  >();\n\n  for (const f of result.findings) {\n    const algorithm: AlgorithmFamily = f.algorithm ?? \"unknown\";\n    const cls = classifyAsset(f);\n    const key = `${cls.assetType}|${algorithm}|${cls.discriminator}`;\n    let g = groups.get(key);\n    if (!g) {\n      g = { ...cls, algorithm, findings: [] };\n      groups.set(key, g);\n    }\n    g.findings.push(f);\n  }\n\n  const components: CbomComponent[] = [...groups.entries()]\n    .sort((a, b) => (a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0))\n    .map(([key, g]) => {\n      const occurrences = g.findings\n        .map((f) => ({\n          location: `${f.location.file}:${f.location.line}`,\n          ...(f.cwe ? { additionalContext: f.cwe } : {}),\n        }))\n        .sort((a, b) => (a.location < b.location ? -1 : a.location > b.location ? 1 : 0));\n\n      const anyHndl = g.findings.some((f) => f.hndl);\n\n      // The type-specific CycloneDX properties block + a human label for the name.\n      let typeProps: Record<string, unknown>;\n      let label: string;\n      switch (g.assetType) {\n        case \"certificate\":\n          // A certificate / CSR: we know the public-key family but not the X.509\n          // fields (subject, validity, refs) from a lexical scan, so the block is\n          // left minimal — all certificateProperties are optional in 1.6.\n          typeProps = { certificateProperties: {} };\n          label = \"certificate\";\n          break;\n        case \"related-crypto-material\":\n          typeProps = {\n            relatedCryptoMaterialProperties: { type: g.materialType ?? \"key\" },\n          };\n          label = g.materialType ?? \"key\";\n          break;\n        case \"protocol\":\n          typeProps = { protocolProperties: { type: g.protocolType ?? \"tls\" } };\n          label = g.protocolType ?? \"tls\";\n          break;\n        case \"algorithm\":\n        default:\n          typeProps = {\n            algorithmProperties: {\n              primitive: g.discriminator,\n              parameterSetIdentifier: g.algorithm,\n              executionEnvironment: \"software-plain-ram\",\n              classicalSecurityLevel: classicalSecurityLevelFor(g.algorithm),\n              nistQuantumSecurityLevel: 0,\n              cryptoFunctions:\n                g.discriminator === \"signature\"\n                  ? [\"sign\", \"verify\"]\n                  : g.discriminator === \"kem\"\n                    ? [\"encapsulate\", \"decapsulate\"]\n                    : // CycloneDX 1.6 has no \"keyagree\" cryptoFunction; \"other\" is\n                      // the valid value for a key-agreement primitive.\n                      [\"other\"],\n            },\n          };\n          label = g.discriminator;\n          break;\n      }\n\n      return {\n        type: \"cryptographic-asset\" as const,\n        \"bom-ref\": bomRef(key),\n        name: `${g.algorithm} (${label})`,\n        cryptoProperties: {\n          assetType: g.assetType,\n          ...typeProps,\n        },\n        // The quantum posture flags are carried as CycloneDX component `properties`\n        // (an open name/value list) rather than inside `cryptoProperties`, whose\n        // 1.6 schema is `additionalProperties: false` — so a strict validator\n        // accepts the BOM. Namespaced to avoid clashing with other tools' keys.\n        properties: [\n          {\n            name: \"quantakrypto:quantumVulnerable\",\n            value: String(isQuantumVulnerable(g.algorithm)),\n          },\n          { name: \"quantakrypto:harvestNowDecryptLater\", value: String(anyHndl) },\n        ],\n        evidence: { occurrences },\n      };\n    });\n\n  const serial = `urn:uuid:${stableUuid(result)}`;\n\n  return {\n    bomFormat: \"CycloneDX\",\n    specVersion: \"1.6\",\n    serialNumber: serial,\n    version: 1,\n    metadata: {\n      timestamp: result.finishedAt,\n      tools: {\n        components: [\n          {\n            type: \"application\",\n            name: \"qScan\",\n            version: result.toolVersion || VERSION,\n          },\n        ],\n      },\n      component: {\n        type: \"application\",\n        \"bom-ref\": \"root\",\n        name: result.root,\n      },\n    },\n    components,\n  };\n}\n\n/**\n * Derive a stable UUID-shaped serial from the scan result so re-exporting the\n * same result yields the same serial number (deterministic output). Hashed over the\n * actual finding set (ruleId + location per finding), NOT just the COUNT — two scans\n * with the same number of totally different findings must not collide, since a\n * CycloneDX serialNumber identifies a specific BOM instance. Findings are already in\n * a stable order (scan.ts sorts by file/line/ruleId).\n */\nfunction stableUuid(result: ScanResult): string {\n  const hash = createHash(\"sha256\").update(`${result.root}|${result.toolVersion}`, \"utf8\");\n  for (const f of result.findings) {\n    hash.update(`\\n${f.ruleId}@${f.location.file}:${f.location.line}:${f.location.column ?? 0}`);\n  }\n  const h = hash.digest(\"hex\");\n  // Shape as a v4-ish UUID (variant/version nibbles forced).\n  return `${h.slice(0, 8)}-${h.slice(8, 12)}-4${h.slice(13, 16)}-8${h.slice(17, 20)}-${h.slice(20, 32)}`;\n}\n"]}

package/dist/comments.d.ts

@@ -15,35 +15,14 @@
  * detection benchmark's recall gate.
  */
 import type { Finding } from "./types.js";
-export type CommentStyle = "c" | "hash";
-/** The comment style for a file path, or null when we don't strip comments for it. */
-export declare function commentStyleForFile(file: string): CommentStyle | null;
+type CommentStyle = "c" | "hash";
 /**
  * Compute the comment spans (`[start, end)` offsets) of `content`, skipping over
  * string literals so a comment marker inside a string is not treated as a
- * comment. Spans are returned sorted and non-overlapping.
+ * comment. Spans are returned sorted and non-overlapping. `rawBacktick` (Go)
+ * makes backtick strings raw (no escapes).
  */
-export declare function commentSpans(content: string, style: CommentStyle): Array<[number, number]>;
-/**
- * Compute Python triple-quoted string spans (`"""…"""` / `'''…'''`). These are
- * docstrings / prose in practice, so a crypto *name* mentioned inside one
- * (`:param key_type: eg "ssh-ed25519"`) should not fire a token finding — but a
- * PEM key pasted into one is still real material, so {@link stripCommentFindings}
- * exempts `pem-*` rules. Comments and normal strings are skipped so a `"""`
- * delimiter inside them is not mis-detected.
- */
-export declare function pythonDocstringSpans(content: string): Array<[number, number]>;
-/** True if `offset` falls inside one of the (sorted, non-overlapping) spans. */
-export declare function offsetInSpans(spans: ReadonlyArray<[number, number]>, offset: number): boolean;
-/**
- * Line numbers (1-based) suppressed by an inline ignore directive:
- *   - `qscan-ignore-line` on a line suppresses findings on THAT line.
- *   - `qscan-ignore-next-line` on a line suppresses findings on the NEXT line.
- * The directive text is matched anywhere on the line (usually in a comment), so
- * it is language-agnostic. `qscan-ignore-line` is not a substring of
- * `qscan-ignore-next-line`, so the two never collide.
- */
-export declare function ignoredLines(content: string): Set<number>;
+export declare function commentSpans(content: string, style: CommentStyle, rawBacktick?: boolean): Array<[number, number]>;
 /** Drop findings on lines suppressed by an inline `qscan-ignore` directive. */
 export declare function stripIgnoredFindings(findings: Finding[], content: string): Finding[];
 /**
@@ -57,7 +36,7 @@ export declare function stripCommentFindings(findings: Finding[], content: strin
  * suppress findings from IDENTIFIER-only rules (e.g. a Go `SigningMethodRS256`
  * mentioned inside an error-message string) — the mirror of {@link commentSpans}.
  */
-export declare function stringSpans(content: string, style: CommentStyle): Array<[number, number]>;
+export declare function stringSpans(content: string, style: CommentStyle, rawBacktick?: boolean): Array<[number, number]>;
 /**
  * Drop findings of "code-only" rules (`ruleIds`) whose match starts inside a
  * string literal. Some rules — an identifier-form JWT signing method, a Go
@@ -68,4 +47,5 @@ export declare function stringSpans(content: string, style: CommentStyle): Array
  * through untouched.
  */
 export declare function stripStringLiteralFindings(findings: Finding[], content: string, file: string, ruleIds: ReadonlySet<string>): Finding[];
+export {};
 //# sourceMappingURL=comments.d.ts.map

package/dist/comments.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"comments.d.ts","sourceRoot":"","sources":["../src/comments.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1C,MAAM,MAAM,YAAY,GAAG,GAAG,GAAG,MAAM,CAAC;AA8BxC,sFAAsF;AACtF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAKrE;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAgD1F;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAsC7E;AAED,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAW7F;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CASzD;AAED,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,EAAE,CAKpF;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,GACX,OAAO,EAAE,CAyBX;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CA2CzF;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,GAC3B,OAAO,EAAE,CAkBX"}
+{"version":3,"file":"comments.d.ts","sourceRoot":"","sources":["../src/comments.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1C,KAAK,YAAY,GAAG,GAAG,GAAG,MAAM,CAAC;AAgGjC;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,YAAY,EACnB,WAAW,UAAQ,GAClB,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAoCzB;AAmFD,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,EAAE,CAKpF;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,GACX,OAAO,EAAE,CAyBX;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,YAAY,EACnB,WAAW,UAAQ,GAClB,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAiCzB;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,GAC3B,OAAO,EAAE,CAkBX"}

package/dist/comments.js

@@ -21,11 +21,30 @@ const C_LIKE = [
     ".cxx",
     ".hpp",
     ".hh",
+    // PHP and Scala also use C-style `//` + `/* */` comments (PHP additionally uses
+    // `#`, handled by the hash lexer running first would miss `//`; C-style covers both
+    // since PHP `//` is the common form and `#` lines are rare in modern PHP).
+    ".php",
+    ".php3",
+    ".php4",
+    ".php5",
+    ".phtml",
+    ".scala",
+    ".sc",
+    ".swift",
+    // Objective-C (.m/.mm) and Dart (.dart) both use C-style `//` + `/* */`.
+    ".m",
+    ".mm",
+    ".dart",
+    // Smart-contract languages (Solidity/Move/Cairo) also use C-style comments.
+    ".sol",
+    ".move",
+    ".cairo",
 ];
 /** Hash-style (`#`) comment languages, by extension. */
-const HASH_LIKE = [".py", ".pyi", ".pyw", ".rb"];
+const HASH_LIKE = [".py", ".pyi", ".pyw", ".rb", ".ex", ".exs"];
 /** The comment style for a file path, or null when we don't strip comments for it. */
-export function commentStyleForFile(file) {
+function commentStyleForFile(file) {
     const lower = file.toLowerCase();
     if (C_LIKE.some((e) => lower.endsWith(e)))
         return "c";
@@ -33,32 +52,61 @@ export function commentStyleForFile(file) {
         return "hash";
     return null;
 }
+/**
+ * Advance past a string / char literal starting at `content[i]` (a quote char);
+ * returns the index just after it. Two correctness rules a naive escape-scan got
+ * wrong (both verified as real bugs):
+ *   - a `'` char literal must close within a short window (`'\u{10FFFF}'` is ~11
+ *     chars); otherwise it is a Rust lifetime (`'a`) or a stray apostrophe, NOT a
+ *     literal — return `i + 1` so the scan continues instead of consuming the
+ *     rest of the file.
+ *   - Go raw strings (backtick, when `rawBacktick`) do NOT process escapes, so a
+ *     trailing backslash (`` `C:\` ``) must not swallow the closing delimiter.
+ */
+function skipQuoted(content, i, n, rawBacktick) {
+    const quote = content[i];
+    if (quote === "'") {
+        const limit = Math.min(n, i + 1 + 12);
+        let j = i + 1;
+        while (j < limit) {
+            if (content[j] === "\\") {
+                j += 2;
+                continue;
+            }
+            if (content[j] === "'")
+                return j + 1;
+            j++;
+        }
+        return i + 1; // a lifetime / stray apostrophe, not a char literal
+    }
+    const escapes = !(quote === "`" && rawBacktick);
+    let j = i + 1;
+    while (j < n) {
+        if (escapes && content[j] === "\\") {
+            j += 2;
+            continue;
+        }
+        if (content[j] === quote)
+            return j + 1;
+        j++;
+    }
+    return n;
+}
 /**
  * Compute the comment spans (`[start, end)` offsets) of `content`, skipping over
  * string literals so a comment marker inside a string is not treated as a
- * comment. Spans are returned sorted and non-overlapping.
+ * comment. Spans are returned sorted and non-overlapping. `rawBacktick` (Go)
+ * makes backtick strings raw (no escapes).
  */
-export function commentSpans(content, style) {
+export function commentSpans(content, style, rawBacktick = false) {
     const spans = [];
     const n = content.length;
     let i = 0;
     while (i < n) {
         const c = content[i];
-        // String / template literal: skip to the matching unescaped delimiter.
+        // String / char literal: skip past it (lexically correct for lifetimes + raw strings).
         if (c === '"' || c === "'" || c === "`") {
-            const quote = c;
-            i++;
-            while (i < n) {
-                if (content[i] === "\\") {
-                    i += 2;
-                    continue;
-                }
-                if (content[i] === quote) {
-                    i++;
-                    break;
-                }
-                i++;
-            }
+            i = skipQuoted(content, i, n, rawBacktick);
             continue;
         }
         if (style === "c" && c === "/" && content[i + 1] === "/") {
@@ -98,7 +146,7 @@ export function commentSpans(content, style) {
  * exempts `pem-*` rules. Comments and normal strings are skipped so a `"""`
  * delimiter inside them is not mis-detected.
  */
-export function pythonDocstringSpans(content) {
+function pythonDocstringSpans(content) {
     const spans = [];
     const n = content.length;
     let i = 0;
@@ -140,7 +188,7 @@ export function pythonDocstringSpans(content) {
     return spans;
 }
 /** True if `offset` falls inside one of the (sorted, non-overlapping) spans. */
-export function offsetInSpans(spans, offset) {
+function offsetInSpans(spans, offset) {
     let lo = 0;
     let hi = spans.length - 1;
     while (lo <= hi) {
@@ -163,7 +211,7 @@ export function offsetInSpans(spans, offset) {
  * it is language-agnostic. `qscan-ignore-line` is not a substring of
  * `qscan-ignore-next-line`, so the two never collide.
  */
-export function ignoredLines(content) {
+function ignoredLines(content) {
     const ignored = new Set();
     const lines = content.split("\n");
     for (let i = 0; i < lines.length; i++) {
@@ -194,7 +242,7 @@ export function stripCommentFindings(findings, content, file) {
     const style = commentStyleForFile(file);
     if (!style)
         return findings;
-    const spans = commentSpans(content, style);
+    const spans = commentSpans(content, style, /\.go$/i.test(file));
     // Python docstrings suppress prose *token* rules but keep real PEM material.
     const docSpans = style === "hash" ? pythonDocstringSpans(content) : [];
     if (spans.length === 0 && docSpans.length === 0)
@@ -223,7 +271,7 @@ export function stripCommentFindings(findings, content, file) {
  * suppress findings from IDENTIFIER-only rules (e.g. a Go `SigningMethodRS256`
  * mentioned inside an error-message string) — the mirror of {@link commentSpans}.
  */
-export function stringSpans(content, style) {
+export function stringSpans(content, style, rawBacktick = false) {
     const spans = [];
     const n = content.length;
     let i = 0;
@@ -249,21 +297,12 @@ export function stringSpans(content, style) {
             continue;
         }
         if (c === '"' || c === "'" || c === "`") {
-            const quote = c;
             const start = i;
-            i++;
-            while (i < n) {
-                if (content[i] === "\\") {
-                    i += 2;
-                    continue;
-                }
-                if (content[i] === quote) {
-                    i++;
-                    break;
-                }
-                i++;
-            }
-            spans.push([start, i]);
+            const end = skipQuoted(content, i, n, rawBacktick);
+            // A lone `'` (Rust lifetime, end === start+1) is not a string; skip it.
+            if (c !== "'" || end > start + 1)
+                spans.push([start, end]);
+            i = end;
             continue;
         }
         i++;
@@ -285,7 +324,7 @@ export function stripStringLiteralFindings(findings, content, file, ruleIds) {
     const style = commentStyleForFile(file);
     if (!style)
         return findings;
-    const spans = stringSpans(content, style);
+    const spans = stringSpans(content, style, /\.go$/i.test(file));
     if (spans.length === 0)
         return findings;
     const lineStarts = [0];

package/dist/comments.js.map

@@ -1 +1 @@
-{"version":3,"file":"comments.js","sourceRoot":"","sources":["../src/comments.ts"],"names":[],"mappings":"AAoBA,8DAA8D;AAC9D,MAAM,MAAM,GAAsB;IAChC,KAAK;IACL,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,SAAS;IACT,KAAK;IACL,OAAO;IACP,KAAK;IACL,MAAM;IACN,KAAK;IACL,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;CACN,CAAC;AAEF,wDAAwD;AACxD,MAAM,SAAS,GAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAEpE,sFAAsF;AACtF,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC;IACtD,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IAC5D,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,KAAmB;IAC/D,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,uEAAuE;QACvE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACb,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBACxB,CAAC,IAAI,CAAC,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;oBACzB,CAAC,EAAE,CAAC;oBACJ,MAAM;gBACR,CAAC;gBACD,CAAC,EAAE,CAAC;YACN,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACzD,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACzD,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;gBAAE,CAAC,EAAE,CAAC;YACrE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7E,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;gBAAE,CAAC,EAAE,CAAC;YACzF,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACb,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBACxB,CAAC,IAAI,CAAC,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;oBACrB,CAAC,EAAE,CAAC;oBACJ,MAAM;gBACR,CAAC;gBACD,CAAC,EAAE,CAAC;YACN,CAAC;YACD,SAAS;QACX,CAAC;QACD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,aAAa,CAAC,KAAsC,EAAE,MAAc;IAClF,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,EAAE,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,MAAM,GAAG,CAAC;YAAE,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;aACxB,IAAI,MAAM,IAAI,CAAC;YAAE,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;;YAC9B,OAAO,IAAI,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;aAC3D,IAAI,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,QAAmB,EAAE,OAAe;IACvE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChF,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACxC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAmB,EACnB,OAAe,EACf,IAAY;IAEZ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC3C,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5B,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC3C,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEjE,+EAA+E;IAC/E,wEAAwE;IACxE,MAAM,UAAU,GAAa,CAAC,CAAC,CAAC,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,IAAI,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;YAC3F,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,KAAmB;IAC9D,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACzD,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACzD,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;gBAAE,CAAC,EAAE,CAAC;YACrE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAClC,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACb,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBACxB,CAAC,IAAI,CAAC,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;oBACzB,CAAC,EAAE,CAAC;oBACJ,MAAM;gBACR,CAAC;gBACD,CAAC,EAAE,CAAC;YACN,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAAmB,EACnB,OAAe,EACf,IAAY,EACZ,OAA4B;IAE5B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC3F,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5B,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAExC,MAAM,UAAU,GAAa,CAAC,CAAC,CAAC,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Comment-aware false-positive suppression.\n *\n * The detectors are lexical (regex over source text), so a crypto API name\n * written in a COMMENT — `// migrated off createECDH()` — fires a finding just\n * like real code. This module computes the comment spans of a file (respecting\n * string literals, so a `//` inside a string is not a comment) and drops any\n * finding whose match starts inside one.\n *\n * The lexer is deliberately conservative: it only ever ENTERS a comment on a\n * literal line comment, block comment, or `#` in code position (all of which ARE\n * comments), so it never mis-classifies code as a comment and can only reduce\n * false positives, not recall. The one inherent lexical ambiguity — a regex\n * literal that looks like a block-comment open — is rare and guarded by the\n * detection benchmark's recall gate.\n */\nimport type { Finding } from \"./types.js\";\n\nexport type CommentStyle = \"c\" | \"hash\";\n\n/** C-style (line + block) comment languages, by extension. */\nconst C_LIKE: readonly string[] = [\n  \".js\",\n  \".jsx\",\n  \".ts\",\n  \".tsx\",\n  \".mjs\",\n  \".cjs\",\n  \".vue\",\n  \".svelte\",\n  \".go\",\n  \".java\",\n  \".kt\",\n  \".kts\",\n  \".cs\",\n  \".rs\",\n  \".c\",\n  \".h\",\n  \".cc\",\n  \".cpp\",\n  \".cxx\",\n  \".hpp\",\n  \".hh\",\n];\n\n/** Hash-style (`#`) comment languages, by extension. */\nconst HASH_LIKE: readonly string[] = [\".py\", \".pyi\", \".pyw\", \".rb\"];\n\n/** The comment style for a file path, or null when we don't strip comments for it. */\nexport function commentStyleForFile(file: string): CommentStyle | null {\n  const lower = file.toLowerCase();\n  if (C_LIKE.some((e) => lower.endsWith(e))) return \"c\";\n  if (HASH_LIKE.some((e) => lower.endsWith(e))) return \"hash\";\n  return null;\n}\n\n/**\n * Compute the comment spans (`[start, end)` offsets) of `content`, skipping over\n * string literals so a comment marker inside a string is not treated as a\n * comment. Spans are returned sorted and non-overlapping.\n */\nexport function commentSpans(content: string, style: CommentStyle): Array<[number, number]> {\n  const spans: Array<[number, number]> = [];\n  const n = content.length;\n  let i = 0;\n  while (i < n) {\n    const c = content[i];\n    // String / template literal: skip to the matching unescaped delimiter.\n    if (c === '\"' || c === \"'\" || c === \"`\") {\n      const quote = c;\n      i++;\n      while (i < n) {\n        if (content[i] === \"\\\\\") {\n          i += 2;\n          continue;\n        }\n        if (content[i] === quote) {\n          i++;\n          break;\n        }\n        i++;\n      }\n      continue;\n    }\n    if (style === \"c\" && c === \"/\" && content[i + 1] === \"/\") {\n      const start = i;\n      i += 2;\n      while (i < n && content[i] !== \"\\n\") i++;\n      spans.push([start, i]);\n      continue;\n    }\n    if (style === \"c\" && c === \"/\" && content[i + 1] === \"*\") {\n      const start = i;\n      i += 2;\n      while (i < n && !(content[i] === \"*\" && content[i + 1] === \"/\")) i++;\n      i = Math.min(n, i + 2);\n      spans.push([start, i]);\n      continue;\n    }\n    if (style === \"hash\" && c === \"#\") {\n      const start = i;\n      i++;\n      while (i < n && content[i] !== \"\\n\") i++;\n      spans.push([start, i]);\n      continue;\n    }\n    i++;\n  }\n  return spans;\n}\n\n/**\n * Compute Python triple-quoted string spans (`\"\"\"…\"\"\"` / `'''…'''`). These are\n * docstrings / prose in practice, so a crypto *name* mentioned inside one\n * (`:param key_type: eg \"ssh-ed25519\"`) should not fire a token finding — but a\n * PEM key pasted into one is still real material, so {@link stripCommentFindings}\n * exempts `pem-*` rules. Comments and normal strings are skipped so a `\"\"\"`\n * delimiter inside them is not mis-detected.\n */\nexport function pythonDocstringSpans(content: string): Array<[number, number]> {\n  const spans: Array<[number, number]> = [];\n  const n = content.length;\n  let i = 0;\n  while (i < n) {\n    const c = content[i];\n    if (c === \"#\") {\n      i++;\n      while (i < n && content[i] !== \"\\n\") i++;\n      continue;\n    }\n    if ((c === '\"' || c === \"'\") && content[i + 1] === c && content[i + 2] === c) {\n      const start = i;\n      i += 3;\n      while (i < n && !(content[i] === c && content[i + 1] === c && content[i + 2] === c)) i++;\n      i = Math.min(n, i + 3);\n      spans.push([start, i]);\n      continue;\n    }\n    if (c === '\"' || c === \"'\") {\n      const q = c;\n      i++;\n      while (i < n) {\n        if (content[i] === \"\\\\\") {\n          i += 2;\n          continue;\n        }\n        if (content[i] === q) {\n          i++;\n          break;\n        }\n        i++;\n      }\n      continue;\n    }\n    i++;\n  }\n  return spans;\n}\n\n/** True if `offset` falls inside one of the (sorted, non-overlapping) spans. */\nexport function offsetInSpans(spans: ReadonlyArray<[number, number]>, offset: number): boolean {\n  let lo = 0;\n  let hi = spans.length - 1;\n  while (lo <= hi) {\n    const mid = (lo + hi) >>> 1;\n    const [s, e] = spans[mid];\n    if (offset < s) hi = mid - 1;\n    else if (offset >= e) lo = mid + 1;\n    else return true;\n  }\n  return false;\n}\n\n/**\n * Line numbers (1-based) suppressed by an inline ignore directive:\n *   - `qscan-ignore-line` on a line suppresses findings on THAT line.\n *   - `qscan-ignore-next-line` on a line suppresses findings on the NEXT line.\n * The directive text is matched anywhere on the line (usually in a comment), so\n * it is language-agnostic. `qscan-ignore-line` is not a substring of\n * `qscan-ignore-next-line`, so the two never collide.\n */\nexport function ignoredLines(content: string): Set<number> {\n  const ignored = new Set<number>();\n  const lines = content.split(\"\\n\");\n  for (let i = 0; i < lines.length; i++) {\n    const line = lines[i];\n    if (line.includes(\"qscan-ignore-next-line\")) ignored.add(i + 2);\n    else if (line.includes(\"qscan-ignore-line\")) ignored.add(i + 1);\n  }\n  return ignored;\n}\n\n/** Drop findings on lines suppressed by an inline `qscan-ignore` directive. */\nexport function stripIgnoredFindings(findings: Finding[], content: string): Finding[] {\n  if (findings.length === 0 || !content.includes(\"qscan-ignore\")) return findings;\n  const ignored = ignoredLines(content);\n  if (ignored.size === 0) return findings;\n  return findings.filter((f) => !ignored.has(f.location.line));\n}\n\n/**\n * Drop findings whose match starts inside a comment. No-op when the file's\n * language has no comment style we handle, or when it has no comments.\n */\nexport function stripCommentFindings(\n  findings: Finding[],\n  content: string,\n  file: string,\n): Finding[] {\n  if (findings.length === 0) return findings;\n  const style = commentStyleForFile(file);\n  if (!style) return findings;\n  const spans = commentSpans(content, style);\n  // Python docstrings suppress prose *token* rules but keep real PEM material.\n  const docSpans = style === \"hash\" ? pythonDocstringSpans(content) : [];\n  if (spans.length === 0 && docSpans.length === 0) return findings;\n\n  // 1-based line → start offset, to turn a finding's (line, column) back into an\n  // absolute offset (column is 1-based: offset = lineStart + column - 1).\n  const lineStarts: number[] = [0];\n  for (let i = 0; i < content.length; i++) {\n    if (content[i] === \"\\n\") lineStarts.push(i + 1);\n  }\n\n  return findings.filter((f) => {\n    const start = lineStarts[f.location.line - 1] ?? 0;\n    const offset = start + ((f.location.column ?? 1) - 1);\n    if (offsetInSpans(spans, offset)) return false;\n    if (docSpans.length > 0 && !f.ruleId.startsWith(\"pem-\") && offsetInSpans(docSpans, offset)) {\n      return false;\n    }\n    return true;\n  });\n}\n\n/**\n * Compute the string-literal spans (`[start, end)`) of `content`, skipping over\n * comments so a quote inside a comment is not treated as a string. Used to\n * suppress findings from IDENTIFIER-only rules (e.g. a Go `SigningMethodRS256`\n * mentioned inside an error-message string) — the mirror of {@link commentSpans}.\n */\nexport function stringSpans(content: string, style: CommentStyle): Array<[number, number]> {\n  const spans: Array<[number, number]> = [];\n  const n = content.length;\n  let i = 0;\n  while (i < n) {\n    const c = content[i];\n    if (style === \"c\" && c === \"/\" && content[i + 1] === \"/\") {\n      i += 2;\n      while (i < n && content[i] !== \"\\n\") i++;\n      continue;\n    }\n    if (style === \"c\" && c === \"/\" && content[i + 1] === \"*\") {\n      i += 2;\n      while (i < n && !(content[i] === \"*\" && content[i + 1] === \"/\")) i++;\n      i = Math.min(n, i + 2);\n      continue;\n    }\n    if (style === \"hash\" && c === \"#\") {\n      i++;\n      while (i < n && content[i] !== \"\\n\") i++;\n      continue;\n    }\n    if (c === '\"' || c === \"'\" || c === \"`\") {\n      const quote = c;\n      const start = i;\n      i++;\n      while (i < n) {\n        if (content[i] === \"\\\\\") {\n          i += 2;\n          continue;\n        }\n        if (content[i] === quote) {\n          i++;\n          break;\n        }\n        i++;\n      }\n      spans.push([start, i]);\n      continue;\n    }\n    i++;\n  }\n  return spans;\n}\n\n/**\n * Drop findings of \"code-only\" rules (`ruleIds`) whose match starts inside a\n * string literal. Some rules — an identifier-form JWT signing method, a Go\n * `SigningMethodRS256` — are only meaningful as code; when the same token appears\n * inside a string (a test's `t.Error(\"SigningMethodPS256 …\")`) it is prose, not a\n * usage. Rules that legitimately match inside strings (quoted `\"RS256\"` alg\n * tokens, cipher-suite strings, ssh-key tokens) are NOT in `ruleIds` and pass\n * through untouched.\n */\nexport function stripStringLiteralFindings(\n  findings: Finding[],\n  content: string,\n  file: string,\n  ruleIds: ReadonlySet<string>,\n): Finding[] {\n  if (findings.length === 0 || !findings.some((f) => ruleIds.has(f.ruleId))) return findings;\n  const style = commentStyleForFile(file);\n  if (!style) return findings;\n  const spans = stringSpans(content, style);\n  if (spans.length === 0) return findings;\n\n  const lineStarts: number[] = [0];\n  for (let i = 0; i < content.length; i++) {\n    if (content[i] === \"\\n\") lineStarts.push(i + 1);\n  }\n\n  return findings.filter((f) => {\n    if (!ruleIds.has(f.ruleId)) return true;\n    const start = lineStarts[f.location.line - 1] ?? 0;\n    const offset = start + ((f.location.column ?? 1) - 1);\n    return !offsetInSpans(spans, offset);\n  });\n}\n"]}
+{"version":3,"file":"comments.js","sourceRoot":"","sources":["../src/comments.ts"],"names":[],"mappings":"AAoBA,8DAA8D;AAC9D,MAAM,MAAM,GAAsB;IAChC,KAAK;IACL,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,SAAS;IACT,KAAK;IACL,OAAO;IACP,KAAK;IACL,MAAM;IACN,KAAK;IACL,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,gFAAgF;IAChF,oFAAoF;IACpF,2EAA2E;IAC3E,MAAM;IACN,OAAO;IACP,OAAO;IACP,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,KAAK;IACL,QAAQ;IACR,yEAAyE;IACzE,IAAI;IACJ,KAAK;IACL,OAAO;IACP,4EAA4E;IAC5E,MAAM;IACN,OAAO;IACP,QAAQ;CACT,CAAC;AAEF,wDAAwD;AACxD,MAAM,SAAS,GAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAEnF,sFAAsF;AACtF,SAAS,mBAAmB,CAAC,IAAY;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC;IACtD,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IAC5D,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,UAAU,CAAC,OAAe,EAAE,CAAS,EAAE,CAAS,EAAE,WAAoB;IAC7E,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,GAAG,KAAK,EAAE,CAAC;YACjB,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACxB,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YACrC,CAAC,EAAE,CAAC;QACN,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,oDAAoD;IACpE,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,KAAK,GAAG,IAAI,WAAW,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACnC,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAe,EACf,KAAmB,EACnB,WAAW,GAAG,KAAK;IAEnB,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,uFAAuF;QACvF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;YAC3C,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACzD,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACzD,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;gBAAE,CAAC,EAAE,CAAC;YACrE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,OAAe;IAC3C,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7E,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;gBAAE,CAAC,EAAE,CAAC;YACzF,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACb,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBACxB,CAAC,IAAI,CAAC,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;oBACrB,CAAC,EAAE,CAAC;oBACJ,MAAM;gBACR,CAAC;gBACD,CAAC,EAAE,CAAC;YACN,CAAC;YACD,SAAS;QACX,CAAC;QACD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAChF,SAAS,aAAa,CAAC,KAAsC,EAAE,MAAc;IAC3E,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,EAAE,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,MAAM,GAAG,CAAC;YAAE,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;aACxB,IAAI,MAAM,IAAI,CAAC;YAAE,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;;YAC9B,OAAO,IAAI,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;aAC3D,IAAI,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,QAAmB,EAAE,OAAe;IACvE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChF,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACxC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAmB,EACnB,OAAe,EACf,IAAY;IAEZ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC3C,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5B,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEjE,+EAA+E;IAC/E,wEAAwE;IACxE,MAAM,UAAU,GAAa,CAAC,CAAC,CAAC,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,IAAI,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;YAC3F,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CACzB,OAAe,EACf,KAAmB,EACnB,WAAW,GAAG,KAAK;IAEnB,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACzD,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACzD,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;gBAAE,CAAC,EAAE,CAAC;YACrE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAClC,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;YACnD,wEAAwE;YACxE,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,GAAG,KAAK,GAAG,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;YAC3D,CAAC,GAAG,GAAG,CAAC;YACR,SAAS;QACX,CAAC;QACD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAAmB,EACnB,OAAe,EACf,IAAY,EACZ,OAA4B;IAE5B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC3F,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5B,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAExC,MAAM,UAAU,GAAa,CAAC,CAAC,CAAC,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Comment-aware false-positive suppression.\n *\n * The detectors are lexical (regex over source text), so a crypto API name\n * written in a COMMENT — `// migrated off createECDH()` — fires a finding just\n * like real code. This module computes the comment spans of a file (respecting\n * string literals, so a `//` inside a string is not a comment) and drops any\n * finding whose match starts inside one.\n *\n * The lexer is deliberately conservative: it only ever ENTERS a comment on a\n * literal line comment, block comment, or `#` in code position (all of which ARE\n * comments), so it never mis-classifies code as a comment and can only reduce\n * false positives, not recall. The one inherent lexical ambiguity — a regex\n * literal that looks like a block-comment open — is rare and guarded by the\n * detection benchmark's recall gate.\n */\nimport type { Finding } from \"./types.js\";\n\ntype CommentStyle = \"c\" | \"hash\";\n\n/** C-style (line + block) comment languages, by extension. */\nconst C_LIKE: readonly string[] = [\n  \".js\",\n  \".jsx\",\n  \".ts\",\n  \".tsx\",\n  \".mjs\",\n  \".cjs\",\n  \".vue\",\n  \".svelte\",\n  \".go\",\n  \".java\",\n  \".kt\",\n  \".kts\",\n  \".cs\",\n  \".rs\",\n  \".c\",\n  \".h\",\n  \".cc\",\n  \".cpp\",\n  \".cxx\",\n  \".hpp\",\n  \".hh\",\n  // PHP and Scala also use C-style `//` + `/* */` comments (PHP additionally uses\n  // `#`, handled by the hash lexer running first would miss `//`; C-style covers both\n  // since PHP `//` is the common form and `#` lines are rare in modern PHP).\n  \".php\",\n  \".php3\",\n  \".php4\",\n  \".php5\",\n  \".phtml\",\n  \".scala\",\n  \".sc\",\n  \".swift\",\n  // Objective-C (.m/.mm) and Dart (.dart) both use C-style `//` + `/* */`.\n  \".m\",\n  \".mm\",\n  \".dart\",\n  // Smart-contract languages (Solidity/Move/Cairo) also use C-style comments.\n  \".sol\",\n  \".move\",\n  \".cairo\",\n];\n\n/** Hash-style (`#`) comment languages, by extension. */\nconst HASH_LIKE: readonly string[] = [\".py\", \".pyi\", \".pyw\", \".rb\", \".ex\", \".exs\"];\n\n/** The comment style for a file path, or null when we don't strip comments for it. */\nfunction commentStyleForFile(file: string): CommentStyle | null {\n  const lower = file.toLowerCase();\n  if (C_LIKE.some((e) => lower.endsWith(e))) return \"c\";\n  if (HASH_LIKE.some((e) => lower.endsWith(e))) return \"hash\";\n  return null;\n}\n\n/**\n * Advance past a string / char literal starting at `content[i]` (a quote char);\n * returns the index just after it. Two correctness rules a naive escape-scan got\n * wrong (both verified as real bugs):\n *   - a `'` char literal must close within a short window (`'\\u{10FFFF}'` is ~11\n *     chars); otherwise it is a Rust lifetime (`'a`) or a stray apostrophe, NOT a\n *     literal — return `i + 1` so the scan continues instead of consuming the\n *     rest of the file.\n *   - Go raw strings (backtick, when `rawBacktick`) do NOT process escapes, so a\n *     trailing backslash (`` `C:\\` ``) must not swallow the closing delimiter.\n */\nfunction skipQuoted(content: string, i: number, n: number, rawBacktick: boolean): number {\n  const quote = content[i];\n  if (quote === \"'\") {\n    const limit = Math.min(n, i + 1 + 12);\n    let j = i + 1;\n    while (j < limit) {\n      if (content[j] === \"\\\\\") {\n        j += 2;\n        continue;\n      }\n      if (content[j] === \"'\") return j + 1;\n      j++;\n    }\n    return i + 1; // a lifetime / stray apostrophe, not a char literal\n  }\n  const escapes = !(quote === \"`\" && rawBacktick);\n  let j = i + 1;\n  while (j < n) {\n    if (escapes && content[j] === \"\\\\\") {\n      j += 2;\n      continue;\n    }\n    if (content[j] === quote) return j + 1;\n    j++;\n  }\n  return n;\n}\n\n/**\n * Compute the comment spans (`[start, end)` offsets) of `content`, skipping over\n * string literals so a comment marker inside a string is not treated as a\n * comment. Spans are returned sorted and non-overlapping. `rawBacktick` (Go)\n * makes backtick strings raw (no escapes).\n */\nexport function commentSpans(\n  content: string,\n  style: CommentStyle,\n  rawBacktick = false,\n): Array<[number, number]> {\n  const spans: Array<[number, number]> = [];\n  const n = content.length;\n  let i = 0;\n  while (i < n) {\n    const c = content[i];\n    // String / char literal: skip past it (lexically correct for lifetimes + raw strings).\n    if (c === '\"' || c === \"'\" || c === \"`\") {\n      i = skipQuoted(content, i, n, rawBacktick);\n      continue;\n    }\n    if (style === \"c\" && c === \"/\" && content[i + 1] === \"/\") {\n      const start = i;\n      i += 2;\n      while (i < n && content[i] !== \"\\n\") i++;\n      spans.push([start, i]);\n      continue;\n    }\n    if (style === \"c\" && c === \"/\" && content[i + 1] === \"*\") {\n      const start = i;\n      i += 2;\n      while (i < n && !(content[i] === \"*\" && content[i + 1] === \"/\")) i++;\n      i = Math.min(n, i + 2);\n      spans.push([start, i]);\n      continue;\n    }\n    if (style === \"hash\" && c === \"#\") {\n      const start = i;\n      i++;\n      while (i < n && content[i] !== \"\\n\") i++;\n      spans.push([start, i]);\n      continue;\n    }\n    i++;\n  }\n  return spans;\n}\n\n/**\n * Compute Python triple-quoted string spans (`\"\"\"…\"\"\"` / `'''…'''`). These are\n * docstrings / prose in practice, so a crypto *name* mentioned inside one\n * (`:param key_type: eg \"ssh-ed25519\"`) should not fire a token finding — but a\n * PEM key pasted into one is still real material, so {@link stripCommentFindings}\n * exempts `pem-*` rules. Comments and normal strings are skipped so a `\"\"\"`\n * delimiter inside them is not mis-detected.\n */\nfunction pythonDocstringSpans(content: string): Array<[number, number]> {\n  const spans: Array<[number, number]> = [];\n  const n = content.length;\n  let i = 0;\n  while (i < n) {\n    const c = content[i];\n    if (c === \"#\") {\n      i++;\n      while (i < n && content[i] !== \"\\n\") i++;\n      continue;\n    }\n    if ((c === '\"' || c === \"'\") && content[i + 1] === c && content[i + 2] === c) {\n      const start = i;\n      i += 3;\n      while (i < n && !(content[i] === c && content[i + 1] === c && content[i + 2] === c)) i++;\n      i = Math.min(n, i + 3);\n      spans.push([start, i]);\n      continue;\n    }\n    if (c === '\"' || c === \"'\") {\n      const q = c;\n      i++;\n      while (i < n) {\n        if (content[i] === \"\\\\\") {\n          i += 2;\n          continue;\n        }\n        if (content[i] === q) {\n          i++;\n          break;\n        }\n        i++;\n      }\n      continue;\n    }\n    i++;\n  }\n  return spans;\n}\n\n/** True if `offset` falls inside one of the (sorted, non-overlapping) spans. */\nfunction offsetInSpans(spans: ReadonlyArray<[number, number]>, offset: number): boolean {\n  let lo = 0;\n  let hi = spans.length - 1;\n  while (lo <= hi) {\n    const mid = (lo + hi) >>> 1;\n    const [s, e] = spans[mid];\n    if (offset < s) hi = mid - 1;\n    else if (offset >= e) lo = mid + 1;\n    else return true;\n  }\n  return false;\n}\n\n/**\n * Line numbers (1-based) suppressed by an inline ignore directive:\n *   - `qscan-ignore-line` on a line suppresses findings on THAT line.\n *   - `qscan-ignore-next-line` on a line suppresses findings on the NEXT line.\n * The directive text is matched anywhere on the line (usually in a comment), so\n * it is language-agnostic. `qscan-ignore-line` is not a substring of\n * `qscan-ignore-next-line`, so the two never collide.\n */\nfunction ignoredLines(content: string): Set<number> {\n  const ignored = new Set<number>();\n  const lines = content.split(\"\\n\");\n  for (let i = 0; i < lines.length; i++) {\n    const line = lines[i];\n    if (line.includes(\"qscan-ignore-next-line\")) ignored.add(i + 2);\n    else if (line.includes(\"qscan-ignore-line\")) ignored.add(i + 1);\n  }\n  return ignored;\n}\n\n/** Drop findings on lines suppressed by an inline `qscan-ignore` directive. */\nexport function stripIgnoredFindings(findings: Finding[], content: string): Finding[] {\n  if (findings.length === 0 || !content.includes(\"qscan-ignore\")) return findings;\n  const ignored = ignoredLines(content);\n  if (ignored.size === 0) return findings;\n  return findings.filter((f) => !ignored.has(f.location.line));\n}\n\n/**\n * Drop findings whose match starts inside a comment. No-op when the file's\n * language has no comment style we handle, or when it has no comments.\n */\nexport function stripCommentFindings(\n  findings: Finding[],\n  content: string,\n  file: string,\n): Finding[] {\n  if (findings.length === 0) return findings;\n  const style = commentStyleForFile(file);\n  if (!style) return findings;\n  const spans = commentSpans(content, style, /\\.go$/i.test(file));\n  // Python docstrings suppress prose *token* rules but keep real PEM material.\n  const docSpans = style === \"hash\" ? pythonDocstringSpans(content) : [];\n  if (spans.length === 0 && docSpans.length === 0) return findings;\n\n  // 1-based line → start offset, to turn a finding's (line, column) back into an\n  // absolute offset (column is 1-based: offset = lineStart + column - 1).\n  const lineStarts: number[] = [0];\n  for (let i = 0; i < content.length; i++) {\n    if (content[i] === \"\\n\") lineStarts.push(i + 1);\n  }\n\n  return findings.filter((f) => {\n    const start = lineStarts[f.location.line - 1] ?? 0;\n    const offset = start + ((f.location.column ?? 1) - 1);\n    if (offsetInSpans(spans, offset)) return false;\n    if (docSpans.length > 0 && !f.ruleId.startsWith(\"pem-\") && offsetInSpans(docSpans, offset)) {\n      return false;\n    }\n    return true;\n  });\n}\n\n/**\n * Compute the string-literal spans (`[start, end)`) of `content`, skipping over\n * comments so a quote inside a comment is not treated as a string. Used to\n * suppress findings from IDENTIFIER-only rules (e.g. a Go `SigningMethodRS256`\n * mentioned inside an error-message string) — the mirror of {@link commentSpans}.\n */\nexport function stringSpans(\n  content: string,\n  style: CommentStyle,\n  rawBacktick = false,\n): Array<[number, number]> {\n  const spans: Array<[number, number]> = [];\n  const n = content.length;\n  let i = 0;\n  while (i < n) {\n    const c = content[i];\n    if (style === \"c\" && c === \"/\" && content[i + 1] === \"/\") {\n      i += 2;\n      while (i < n && content[i] !== \"\\n\") i++;\n      continue;\n    }\n    if (style === \"c\" && c === \"/\" && content[i + 1] === \"*\") {\n      i += 2;\n      while (i < n && !(content[i] === \"*\" && content[i + 1] === \"/\")) i++;\n      i = Math.min(n, i + 2);\n      continue;\n    }\n    if (style === \"hash\" && c === \"#\") {\n      i++;\n      while (i < n && content[i] !== \"\\n\") i++;\n      continue;\n    }\n    if (c === '\"' || c === \"'\" || c === \"`\") {\n      const start = i;\n      const end = skipQuoted(content, i, n, rawBacktick);\n      // A lone `'` (Rust lifetime, end === start+1) is not a string; skip it.\n      if (c !== \"'\" || end > start + 1) spans.push([start, end]);\n      i = end;\n      continue;\n    }\n    i++;\n  }\n  return spans;\n}\n\n/**\n * Drop findings of \"code-only\" rules (`ruleIds`) whose match starts inside a\n * string literal. Some rules — an identifier-form JWT signing method, a Go\n * `SigningMethodRS256` — are only meaningful as code; when the same token appears\n * inside a string (a test's `t.Error(\"SigningMethodPS256 …\")`) it is prose, not a\n * usage. Rules that legitimately match inside strings (quoted `\"RS256\"` alg\n * tokens, cipher-suite strings, ssh-key tokens) are NOT in `ruleIds` and pass\n * through untouched.\n */\nexport function stripStringLiteralFindings(\n  findings: Finding[],\n  content: string,\n  file: string,\n  ruleIds: ReadonlySet<string>,\n): Finding[] {\n  if (findings.length === 0 || !findings.some((f) => ruleIds.has(f.ruleId))) return findings;\n  const style = commentStyleForFile(file);\n  if (!style) return findings;\n  const spans = stringSpans(content, style, /\\.go$/i.test(file));\n  if (spans.length === 0) return findings;\n\n  const lineStarts: number[] = [0];\n  for (let i = 0; i < content.length; i++) {\n    if (content[i] === \"\\n\") lineStarts.push(i + 1);\n  }\n\n  return findings.filter((f) => {\n    if (!ruleIds.has(f.ruleId)) return true;\n    const start = lineStarts[f.location.line - 1] ?? 0;\n    const offset = start + ((f.location.column ?? 1) - 1);\n    return !offsetInSpans(spans, offset);\n  });\n}\n"]}

package/dist/dependencies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dependencies.d.ts","sourceRoot":"","sources":["../src/dependencies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAEV,mBAAmB,EACnB,OAAO,EACP,QAAQ,EACR,oBAAoB,EACrB,MAAM,YAAY,CAAC;AAKpB;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAkBjC,CAAC;AAEF,iDAAiD;AACjD,eAAO,MAAM,sBAAsB,EAAE,oBAAoB,EAyjBxD,CAAC;AAuEF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI,CAoB1E;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAuID;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,EAAE,CAyBrE"}
+{"version":3,"file":"dependencies.d.ts","sourceRoot":"","sources":["../src/dependencies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAEV,mBAAmB,EACnB,OAAO,EACP,QAAQ,EACR,oBAAoB,EACrB,MAAM,YAAY,CAAC;AAKpB;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAkBjC,CAAC;AAEF,iDAAiD;AACjD,eAAO,MAAM,sBAAsB,EAAE,oBAAoB,EA0jBxD,CAAC;AAuEF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI,CAoB1E;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAuID;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,EAAE,CAyBrE"}

package/dist/dependencies.js

@@ -471,7 +471,7 @@ export const vulnerableDependencies = [
     {
         name: "github.com/cloudflare/circl",
         ecosystem: "go",
-        reason: "Cloudflare CIRCL — classical ECDH/EdDSA curves (X25519, X448, Ed25519, P-256).",
+        reason: "Cloudflare CIRCL — classical ECDH/EdDSA curves (X25519, X448, Ed25519, P-256); also ships PQC (ML-KEM/ML-DSA + hybrids), so migrate the classical *usage*, not the package.",
         algorithms: ["ECDH", "EdDSA"],
         severity: "medium",
     },