@quantakrypto/core 0.4.3 → 0.5.0

package/dist/standards.d.ts

@@ -0,0 +1,96 @@
+/**
+ * Single source of truth for the post-quantum standards this tool depends on.
+ *
+ * The scanner's credibility rests on its recommendations tracking the current
+ * NIST / CNSA / IETF state. That tracking used to be ad-hoc — facts were spread
+ * across `remediation.ts` with no dates, no citations, and nothing to catch code
+ * drifting from the published standards. This module makes the standards facts
+ * explicit, dated, and cited, and the companion drift test
+ * (`test/standards.test.ts`) fails the build if the runtime constants
+ * (`TIER_PARAMS`, `PQC_TRANSITION_NOTE`, `STATEFUL_HBS_NOTE`) fall out of sync
+ * with what is recorded here.
+ *
+ * ## Cadence
+ *
+ * Re-verify every quarter (see `docs/standards/pqc-standards.md` for the runbook).
+ * On each review: check the sources below for changes, update the facts + their
+ * `asOf`, and roll `lastReviewed` / `nextReview` forward. `scripts/standards-check.mjs`
+ * (advisory, runs in CI) flags when `nextReview` has passed so a review can't be
+ * silently skipped. `standardsReviewStatus(now)` is the pure predicate behind it.
+ */
+/** A single standards fact with its citation and when it was last verified. */
+export interface StandardsCitation {
+    /** One-line statement of the fact. */
+    readonly summary: string;
+    /** Spec identifier / publication (and URL where stable). */
+    readonly source: string;
+    /** `YYYY-MM` — when this fact was last verified against its source. */
+    readonly asOf: string;
+}
+/** The full post-quantum standards snapshot the tool tracks. */
+export interface PqcStandards {
+    /** `YYYY-MM-DD` — when the whole snapshot was last reviewed. */
+    readonly lastReviewed: string;
+    /** `YYYY-MM-DD` — when the next review is due. */
+    readonly nextReview: string;
+    /** Cadence, in months, between reviews. */
+    readonly reviewIntervalMonths: number;
+    /** NIST's finalized PQC FIPS (the recommendation targets). */
+    readonly fips: {
+        readonly mlKem: StandardsCitation;
+        readonly mlDsa: StandardsCitation;
+        readonly slhDsa: StandardsCitation;
+    };
+    /**
+     * CNSA 2.0 security tiers → the KEM / signature parameter sets. These MUST
+     * mirror `remediation.TIER_PARAMS`; the drift test asserts they stay identical.
+     */
+    readonly cnsa: {
+        readonly category3: {
+            readonly kem: string;
+            readonly signature: string;
+        };
+        readonly category5: {
+            readonly kem: string;
+            readonly signature: string;
+        };
+        readonly source: string;
+        readonly asOf: string;
+    };
+    /** Stateful hash-based signatures (firmware / boot signing). */
+    readonly statefulHbs: StandardsCitation;
+    /** The migration deadline the transition note surfaces. */
+    readonly transitionTimeline: {
+        /** Year after which classical public-key crypto is deprecated. */
+        readonly deprecateAfter: number;
+        /** Year after which it is disallowed. */
+        readonly disallowAfter: number;
+        readonly source: string;
+        readonly asOf: string;
+    };
+    /** Emerging / backup standards worth tracking beyond the current FIPS. */
+    readonly emerging: readonly StandardsCitation[];
+    /** Recommended hybrid key-exchange groups. */
+    readonly hybrids: readonly StandardsCitation[];
+}
+/**
+ * The current snapshot. Update on each quarterly review; the drift test keeps the
+ * runtime remediation constants aligned with it.
+ */
+export declare const PQC_STANDARDS: PqcStandards;
+/** Result of {@link standardsReviewStatus}. */
+export interface StandardsReviewStatus {
+    /** True when `now` is on or after `nextReview` — a review is due. */
+    readonly due: boolean;
+    /** The `nextReview` date being compared against (`YYYY-MM-DD`). */
+    readonly nextReview: string;
+    /** Whole days from `now` until `nextReview` (negative when overdue). */
+    readonly daysUntil: number;
+}
+/**
+ * Whether a standards review is due as of `now`. Pure (takes `now` explicitly) so
+ * it is deterministic in tests; the CI script passes the real clock. Compares on
+ * whole UTC days so a same-day run is not spuriously "overdue".
+ */
+export declare function standardsReviewStatus(now: Date, standards?: PqcStandards): StandardsReviewStatus;
+//# sourceMappingURL=standards.d.ts.map

package/dist/standards.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"standards.d.ts","sourceRoot":"","sources":["../src/standards.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,+EAA+E;AAC/E,MAAM,WAAW,iBAAiB;IAChC,sCAAsC;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,4DAA4D;IAC5D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,uEAAuE;IACvE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,gEAAgE;AAChE,MAAM,WAAW,YAAY;IAC3B,gEAAgE;IAChE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,kDAAkD;IAClD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,2CAA2C;IAC3C,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IAEtC,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;QAClC,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;QAClC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;KACpC,CAAC;IAEF;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,SAAS,EAAE;YAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC;QACzE,QAAQ,CAAC,SAAS,EAAE;YAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC;QACzE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;KACvB,CAAC;IAEF,gEAAgE;IAChE,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IAExC,2DAA2D;IAC3D,QAAQ,CAAC,kBAAkB,EAAE;QAC3B,kEAAkE;QAClE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,yCAAyC;QACzC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;KACvB,CAAC;IAEF,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAEhD,8CAA8C;IAC9C,QAAQ,CAAC,OAAO,EAAE,SAAS,iBAAiB,EAAE,CAAC;CAChD;AAED;;;GAGG;AACH,eAAO,MAAM,aAAa,EAAE,YA6E3B,CAAC;AAEF,+CAA+C;AAC/C,MAAM,WAAW,qBAAqB;IACpC,qEAAqE;IACrE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,mEAAmE;IACnE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,wEAAwE;IACxE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,IAAI,EACT,SAAS,GAAE,YAA4B,GACtC,qBAAqB,CAMvB"}

package/dist/standards.js

@@ -0,0 +1,107 @@
+/**
+ * Single source of truth for the post-quantum standards this tool depends on.
+ *
+ * The scanner's credibility rests on its recommendations tracking the current
+ * NIST / CNSA / IETF state. That tracking used to be ad-hoc — facts were spread
+ * across `remediation.ts` with no dates, no citations, and nothing to catch code
+ * drifting from the published standards. This module makes the standards facts
+ * explicit, dated, and cited, and the companion drift test
+ * (`test/standards.test.ts`) fails the build if the runtime constants
+ * (`TIER_PARAMS`, `PQC_TRANSITION_NOTE`, `STATEFUL_HBS_NOTE`) fall out of sync
+ * with what is recorded here.
+ *
+ * ## Cadence
+ *
+ * Re-verify every quarter (see `docs/standards/pqc-standards.md` for the runbook).
+ * On each review: check the sources below for changes, update the facts + their
+ * `asOf`, and roll `lastReviewed` / `nextReview` forward. `scripts/standards-check.mjs`
+ * (advisory, runs in CI) flags when `nextReview` has passed so a review can't be
+ * silently skipped. `standardsReviewStatus(now)` is the pure predicate behind it.
+ */
+/**
+ * The current snapshot. Update on each quarterly review; the drift test keeps the
+ * runtime remediation constants aligned with it.
+ */
+export const PQC_STANDARDS = {
+    lastReviewed: "2026-07-19",
+    nextReview: "2026-10-19",
+    reviewIntervalMonths: 3,
+    fips: {
+        mlKem: {
+            summary: "ML-KEM (Kyber) key encapsulation — finalized August 2024.",
+            source: "NIST FIPS 203",
+            asOf: "2026-07",
+        },
+        mlDsa: {
+            summary: "ML-DSA (Dilithium) lattice signatures — finalized August 2024.",
+            source: "NIST FIPS 204",
+            asOf: "2026-07",
+        },
+        slhDsa: {
+            summary: "SLH-DSA (SPHINCS+) stateless hash-based signatures — finalized August 2024.",
+            source: "NIST FIPS 205",
+            asOf: "2026-07",
+        },
+    },
+    cnsa: {
+        category3: { kem: "ML-KEM-768 (FIPS 203)", signature: "ML-DSA-65 (FIPS 204)" },
+        category5: { kem: "ML-KEM-1024 (FIPS 203)", signature: "ML-DSA-87 (FIPS 204)" },
+        source: "NSA CNSA 2.0 (national-security systems; 2030/2033 migration milestones)",
+        asOf: "2026-07",
+    },
+    statefulHbs: {
+        summary: "LMS/HSS and XMSS/XMSSMT stateful hash-based signatures (incl. the SHAKE256 and " +
+            "192-bit parameter sets) are approved for firmware/boot signing, but are STATEFUL.",
+        source: "NIST SP 800-208",
+        asOf: "2026-07",
+    },
+    transitionTimeline: {
+        deprecateAfter: 2030,
+        disallowAfter: 2035,
+        source: "NIST IR 8547 (transition to post-quantum cryptography standards)",
+        asOf: "2026-07",
+    },
+    emerging: [
+        {
+            summary: "HQC — NIST's code-based backup KEM (selected March 2025; draft FIPS expected ~2026), a " +
+                "diversity hedge against ML-KEM's lattice assumption.",
+            source: "NIST PQC (HQC selection)",
+            asOf: "2026-07",
+        },
+        {
+            summary: "FN-DSA / Falcon — compact lattice signatures.",
+            source: "NIST draft FIPS 206",
+            asOf: "2026-07",
+        },
+        {
+            summary: "X-Wing — X25519 + ML-KEM-768 hybrid KEM for HPKE-style encryption.",
+            source: "IETF draft-connolly-cfrg-xwing-kem",
+            asOf: "2026-07",
+        },
+    ],
+    hybrids: [
+        {
+            summary: "X25519MLKEM768 — the default TLS 1.3 hybrid key-exchange group.",
+            source: "IETF draft-ietf-tls-ecdhe-mlkem",
+            asOf: "2026-07",
+        },
+        {
+            summary: "SecP384r1MLKEM1024 — the Category-5 / CNSA hybrid key-exchange group.",
+            source: "IETF draft-ietf-tls-ecdhe-mlkem",
+            asOf: "2026-07",
+        },
+    ],
+};
+/**
+ * Whether a standards review is due as of `now`. Pure (takes `now` explicitly) so
+ * it is deterministic in tests; the CI script passes the real clock. Compares on
+ * whole UTC days so a same-day run is not spuriously "overdue".
+ */
+export function standardsReviewStatus(now, standards = PQC_STANDARDS) {
+    const MS_PER_DAY = 86_400_000;
+    const next = Date.parse(`${standards.nextReview}T00:00:00Z`);
+    const today = Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate());
+    const daysUntil = Math.round((next - today) / MS_PER_DAY);
+    return { due: daysUntil <= 0, nextReview: standards.nextReview, daysUntil };
+}
+//# sourceMappingURL=standards.js.map

package/dist/standards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"standards.js","sourceRoot":"","sources":["../src/standards.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AA2DH;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAiB;IACzC,YAAY,EAAE,YAAY;IAC1B,UAAU,EAAE,YAAY;IACxB,oBAAoB,EAAE,CAAC;IAEvB,IAAI,EAAE;QACJ,KAAK,EAAE;YACL,OAAO,EAAE,2DAA2D;YACpE,MAAM,EAAE,eAAe;YACvB,IAAI,EAAE,SAAS;SAChB;QACD,KAAK,EAAE;YACL,OAAO,EAAE,gEAAgE;YACzE,MAAM,EAAE,eAAe;YACvB,IAAI,EAAE,SAAS;SAChB;QACD,MAAM,EAAE;YACN,OAAO,EAAE,6EAA6E;YACtF,MAAM,EAAE,eAAe;YACvB,IAAI,EAAE,SAAS;SAChB;KACF;IAED,IAAI,EAAE;QACJ,SAAS,EAAE,EAAE,GAAG,EAAE,uBAAuB,EAAE,SAAS,EAAE,sBAAsB,EAAE;QAC9E,SAAS,EAAE,EAAE,GAAG,EAAE,wBAAwB,EAAE,SAAS,EAAE,sBAAsB,EAAE;QAC/E,MAAM,EAAE,0EAA0E;QAClF,IAAI,EAAE,SAAS;KAChB;IAED,WAAW,EAAE;QACX,OAAO,EACL,iFAAiF;YACjF,mFAAmF;QACrF,MAAM,EAAE,iBAAiB;QACzB,IAAI,EAAE,SAAS;KAChB;IAED,kBAAkB,EAAE;QAClB,cAAc,EAAE,IAAI;QACpB,aAAa,EAAE,IAAI;QACnB,MAAM,EAAE,kEAAkE;QAC1E,IAAI,EAAE,SAAS;KAChB;IAED,QAAQ,EAAE;QACR;YACE,OAAO,EACL,yFAAyF;gBACzF,sDAAsD;YACxD,MAAM,EAAE,0BAA0B;YAClC,IAAI,EAAE,SAAS;SAChB;QACD;YACE,OAAO,EAAE,+CAA+C;YACxD,MAAM,EAAE,qBAAqB;YAC7B,IAAI,EAAE,SAAS;SAChB;QACD;YACE,OAAO,EAAE,oEAAoE;YAC7E,MAAM,EAAE,oCAAoC;YAC5C,IAAI,EAAE,SAAS;SAChB;KACF;IAED,OAAO,EAAE;QACP;YACE,OAAO,EAAE,iEAAiE;YAC1E,MAAM,EAAE,iCAAiC;YACzC,IAAI,EAAE,SAAS;SAChB;QACD;YACE,OAAO,EAAE,uEAAuE;YAChF,MAAM,EAAE,iCAAiC;YACzC,IAAI,EAAE,SAAS;SAChB;KACF;CACF,CAAC;AAYF;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAS,EACT,YAA0B,aAAa;IAEvC,MAAM,UAAU,GAAG,UAAU,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,UAAU,YAAY,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IAClF,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,UAAU,CAAC,CAAC;IAC1D,OAAO,EAAE,GAAG,EAAE,SAAS,IAAI,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC;AAC9E,CAAC","sourcesContent":["/**\n * Single source of truth for the post-quantum standards this tool depends on.\n *\n * The scanner's credibility rests on its recommendations tracking the current\n * NIST / CNSA / IETF state. That tracking used to be ad-hoc — facts were spread\n * across `remediation.ts` with no dates, no citations, and nothing to catch code\n * drifting from the published standards. This module makes the standards facts\n * explicit, dated, and cited, and the companion drift test\n * (`test/standards.test.ts`) fails the build if the runtime constants\n * (`TIER_PARAMS`, `PQC_TRANSITION_NOTE`, `STATEFUL_HBS_NOTE`) fall out of sync\n * with what is recorded here.\n *\n * ## Cadence\n *\n * Re-verify every quarter (see `docs/standards/pqc-standards.md` for the runbook).\n * On each review: check the sources below for changes, update the facts + their\n * `asOf`, and roll `lastReviewed` / `nextReview` forward. `scripts/standards-check.mjs`\n * (advisory, runs in CI) flags when `nextReview` has passed so a review can't be\n * silently skipped. `standardsReviewStatus(now)` is the pure predicate behind it.\n */\n\n/** A single standards fact with its citation and when it was last verified. */\nexport interface StandardsCitation {\n  /** One-line statement of the fact. */\n  readonly summary: string;\n  /** Spec identifier / publication (and URL where stable). */\n  readonly source: string;\n  /** `YYYY-MM` — when this fact was last verified against its source. */\n  readonly asOf: string;\n}\n\n/** The full post-quantum standards snapshot the tool tracks. */\nexport interface PqcStandards {\n  /** `YYYY-MM-DD` — when the whole snapshot was last reviewed. */\n  readonly lastReviewed: string;\n  /** `YYYY-MM-DD` — when the next review is due. */\n  readonly nextReview: string;\n  /** Cadence, in months, between reviews. */\n  readonly reviewIntervalMonths: number;\n\n  /** NIST's finalized PQC FIPS (the recommendation targets). */\n  readonly fips: {\n    readonly mlKem: StandardsCitation; // FIPS 203\n    readonly mlDsa: StandardsCitation; // FIPS 204\n    readonly slhDsa: StandardsCitation; // FIPS 205\n  };\n\n  /**\n   * CNSA 2.0 security tiers → the KEM / signature parameter sets. These MUST\n   * mirror `remediation.TIER_PARAMS`; the drift test asserts they stay identical.\n   */\n  readonly cnsa: {\n    readonly category3: { readonly kem: string; readonly signature: string };\n    readonly category5: { readonly kem: string; readonly signature: string };\n    readonly source: string;\n    readonly asOf: string;\n  };\n\n  /** Stateful hash-based signatures (firmware / boot signing). */\n  readonly statefulHbs: StandardsCitation; // SP 800-208\n\n  /** The migration deadline the transition note surfaces. */\n  readonly transitionTimeline: {\n    /** Year after which classical public-key crypto is deprecated. */\n    readonly deprecateAfter: number;\n    /** Year after which it is disallowed. */\n    readonly disallowAfter: number;\n    readonly source: string;\n    readonly asOf: string;\n  };\n\n  /** Emerging / backup standards worth tracking beyond the current FIPS. */\n  readonly emerging: readonly StandardsCitation[];\n\n  /** Recommended hybrid key-exchange groups. */\n  readonly hybrids: readonly StandardsCitation[];\n}\n\n/**\n * The current snapshot. Update on each quarterly review; the drift test keeps the\n * runtime remediation constants aligned with it.\n */\nexport const PQC_STANDARDS: PqcStandards = {\n  lastReviewed: \"2026-07-19\",\n  nextReview: \"2026-10-19\",\n  reviewIntervalMonths: 3,\n\n  fips: {\n    mlKem: {\n      summary: \"ML-KEM (Kyber) key encapsulation — finalized August 2024.\",\n      source: \"NIST FIPS 203\",\n      asOf: \"2026-07\",\n    },\n    mlDsa: {\n      summary: \"ML-DSA (Dilithium) lattice signatures — finalized August 2024.\",\n      source: \"NIST FIPS 204\",\n      asOf: \"2026-07\",\n    },\n    slhDsa: {\n      summary: \"SLH-DSA (SPHINCS+) stateless hash-based signatures — finalized August 2024.\",\n      source: \"NIST FIPS 205\",\n      asOf: \"2026-07\",\n    },\n  },\n\n  cnsa: {\n    category3: { kem: \"ML-KEM-768 (FIPS 203)\", signature: \"ML-DSA-65 (FIPS 204)\" },\n    category5: { kem: \"ML-KEM-1024 (FIPS 203)\", signature: \"ML-DSA-87 (FIPS 204)\" },\n    source: \"NSA CNSA 2.0 (national-security systems; 2030/2033 migration milestones)\",\n    asOf: \"2026-07\",\n  },\n\n  statefulHbs: {\n    summary:\n      \"LMS/HSS and XMSS/XMSSMT stateful hash-based signatures (incl. the SHAKE256 and \" +\n      \"192-bit parameter sets) are approved for firmware/boot signing, but are STATEFUL.\",\n    source: \"NIST SP 800-208\",\n    asOf: \"2026-07\",\n  },\n\n  transitionTimeline: {\n    deprecateAfter: 2030,\n    disallowAfter: 2035,\n    source: \"NIST IR 8547 (transition to post-quantum cryptography standards)\",\n    asOf: \"2026-07\",\n  },\n\n  emerging: [\n    {\n      summary:\n        \"HQC — NIST's code-based backup KEM (selected March 2025; draft FIPS expected ~2026), a \" +\n        \"diversity hedge against ML-KEM's lattice assumption.\",\n      source: \"NIST PQC (HQC selection)\",\n      asOf: \"2026-07\",\n    },\n    {\n      summary: \"FN-DSA / Falcon — compact lattice signatures.\",\n      source: \"NIST draft FIPS 206\",\n      asOf: \"2026-07\",\n    },\n    {\n      summary: \"X-Wing — X25519 + ML-KEM-768 hybrid KEM for HPKE-style encryption.\",\n      source: \"IETF draft-connolly-cfrg-xwing-kem\",\n      asOf: \"2026-07\",\n    },\n  ],\n\n  hybrids: [\n    {\n      summary: \"X25519MLKEM768 — the default TLS 1.3 hybrid key-exchange group.\",\n      source: \"IETF draft-ietf-tls-ecdhe-mlkem\",\n      asOf: \"2026-07\",\n    },\n    {\n      summary: \"SecP384r1MLKEM1024 — the Category-5 / CNSA hybrid key-exchange group.\",\n      source: \"IETF draft-ietf-tls-ecdhe-mlkem\",\n      asOf: \"2026-07\",\n    },\n  ],\n};\n\n/** Result of {@link standardsReviewStatus}. */\nexport interface StandardsReviewStatus {\n  /** True when `now` is on or after `nextReview` — a review is due. */\n  readonly due: boolean;\n  /** The `nextReview` date being compared against (`YYYY-MM-DD`). */\n  readonly nextReview: string;\n  /** Whole days from `now` until `nextReview` (negative when overdue). */\n  readonly daysUntil: number;\n}\n\n/**\n * Whether a standards review is due as of `now`. Pure (takes `now` explicitly) so\n * it is deterministic in tests; the CI script passes the real clock. Compares on\n * whole UTC days so a same-day run is not spuriously \"overdue\".\n */\nexport function standardsReviewStatus(\n  now: Date,\n  standards: PqcStandards = PQC_STANDARDS,\n): StandardsReviewStatus {\n  const MS_PER_DAY = 86_400_000;\n  const next = Date.parse(`${standards.nextReview}T00:00:00Z`);\n  const today = Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate());\n  const daysUntil = Math.round((next - today) / MS_PER_DAY);\n  return { due: daysUntil <= 0, nextReview: standards.nextReview, daysUntil };\n}\n"]}

package/dist/types.d.ts

@@ -96,7 +96,7 @@ export type DetectorScope = "source" | "config";
  * The programming language / surface a detector targets. `"any"` means the
  * detector is language-agnostic (e.g. PEM material, config files).
  */
-export type DetectorLanguage = "js" | "python" | "go" | "java" | "csharp" | "rust" | "ruby" | "c" | "any";
+export type DetectorLanguage = "js" | "python" | "go" | "java" | "csharp" | "rust" | "ruby" | "php" | "elixir" | "c" | "swift" | "objc" | "dart" | "solidity" | "any";
 /**
  * Declarative metadata for a single rule a detector can emit. This is the
  * catalog entry: the stable, queryable description of a rule keyed by the
@@ -295,10 +295,11 @@ export interface ScanResult {
      */
     diagnostics?: ScanDiagnostics;
     /**
-     * Of `filesScanned`, how many were in a source language the scanner can
-     * actually analyze for inline crypto (JS/TS, Python, Go, Java). When this is 0 but
-     * `filesScanned` > 0, the readiness score reflects NO analyzable code — the
-     * crypto likely lives in an unsupported language (Go, Java, Rust, …) — and
+     * Of `filesScanned`, how many were in a source language the scanner can actually
+     * analyze for inline crypto (the 13 packs: JS/TS, Python, Go, Java/Kotlin/Scala,
+     * C#, Rust, Ruby, PHP, Elixir, C/C++, Swift, Objective-C, Dart). When this is 0
+     * but `filesScanned` > 0, the readiness score reflects NO analyzable code — the
+     * crypto likely lives in an unsupported language (Lua, Perl, …) — and
      * reporters surface that so a bare 100/100 can't read as "safe". Optional for
      * backward compatibility with hand-built results.
      */

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,6DAA6D;AAC7D,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAEvE,gFAAgF;AAChF,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEnD,+DAA+D;AAC/D,MAAM,MAAM,eAAe,GACvB,KAAK,GACL,cAAc,GACd,WAAW,GACX,KAAK,GACL,aAAa,GACb,YAAY,GACZ,MAAM,GACN,KAAK,CAAC;AAEV,yEAAyE;AACzE,MAAM,MAAM,eAAe,GACvB,KAAK,GACL,MAAM,GACN,OAAO,GACP,OAAO,GACP,IAAI,GACJ,KAAK,GACL,QAAQ,GACR,MAAM,GACN,OAAO,GACP,SAAS,CAAC;AAEd,gDAAgD;AAChD,MAAM,WAAW,cAAc;IAC7B,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,gEAAgE;AAChE,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC;AAEtD;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,yDAAyD;IACzD,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,cAAc,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,iCAAiC;AACjC,MAAM,WAAW,OAAO;IACtB,uGAAuG;IACvG,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,QAAQ,CAAC;IACnB,UAAU,EAAE,UAAU,CAAC;IACvB,yDAAyD;IACzD,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,iEAAiE;IACjE,IAAI,EAAE,OAAO,CAAC;IACd,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,kFAAkF;IAClF,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAED,6DAA6D;AAC7D,MAAM,MAAM,mBAAmB,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,CAAC;AAEnG,mDAAmD;AACnD,MAAM,WAAW,oBAAoB;IACnC,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,mBAAmB,CAAC;IAC/B,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,QAAQ,EAAE,QAAQ,CAAC;IACnB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEhD;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GACxB,IAAI,GACJ,QAAQ,GACR,IAAI,GACJ,MAAM,GACN,QAAQ,GACR,MAAM,GACN,MAAM,GACN,GAAG,GACH,KAAK,CAAC;AAEV;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,QAAQ;IACvB,kFAAkF;IAClF,EAAE,EAAE,MAAM,CAAC;IACX,6BAA6B;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,QAAQ,CAAC;IACnB,oDAAoD;IACpD,UAAU,EAAE,UAAU,CAAC;IACvB,0CAA0C;IAC1C,IAAI,EAAE,OAAO,CAAC;IACd,qFAAqF;IACrF,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,kDAAkD;IAClD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,qEAAqE;AACrE,MAAM,WAAW,QAAQ;IACvB,0DAA0D;IAC1D,EAAE,EAAE,MAAM,CAAC;IACX,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B;;;;;OAKG;IACH,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IACnB,oEAAoE;IACpE,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IACrC,yEAAyE;IACzE,MAAM,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,aAAa;IAC5B,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,kCAAkC;AAClC,MAAM,WAAW,WAAW;IAC1B,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,gEAAgE;IAChE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,mFAAmF;IACnF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;OAGG;IACH,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;IACvB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kCAAkC;IAClC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC;;;;OAIG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,gFAAgF;AAChF,MAAM,WAAW,mBAAoB,SAAQ,WAAW;IACtD;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,kFAAkF;IAClF,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,yDAAyD;AACzD,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrC,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,6FAA6F;IAC7F,UAAU,EAAE,MAAM,CAAC;IACnB,0GAA0G;IAC1G,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,iCAAiC;AACjC,MAAM,WAAW,UAAU;IACzB,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,eAAe,CAAC;IAC3B,sBAAsB;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,iDAAiD;AACjD,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;AAEtD,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,eAAe,CAAC;IAC3B,gFAAgF;IAChF,cAAc,EAAE,MAAM,CAAC;IACvB,wBAAwB;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,6DAA6D;AAC7D,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAEvE,gFAAgF;AAChF,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEnD,+DAA+D;AAC/D,MAAM,MAAM,eAAe,GACvB,KAAK,GACL,cAAc,GACd,WAAW,GACX,KAAK,GACL,aAAa,GACb,YAAY,GACZ,MAAM,GACN,KAAK,CAAC;AAEV,yEAAyE;AACzE,MAAM,MAAM,eAAe,GACvB,KAAK,GACL,MAAM,GACN,OAAO,GACP,OAAO,GACP,IAAI,GACJ,KAAK,GACL,QAAQ,GACR,MAAM,GACN,OAAO,GACP,SAAS,CAAC;AAEd,gDAAgD;AAChD,MAAM,WAAW,cAAc;IAC7B,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,gEAAgE;AAChE,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC;AAEtD;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,yDAAyD;IACzD,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,cAAc,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,iCAAiC;AACjC,MAAM,WAAW,OAAO;IACtB,uGAAuG;IACvG,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,QAAQ,CAAC;IACnB,UAAU,EAAE,UAAU,CAAC;IACvB,yDAAyD;IACzD,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,iEAAiE;IACjE,IAAI,EAAE,OAAO,CAAC;IACd,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4FAA4F;IAC5F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,kFAAkF;IAClF,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAED,6DAA6D;AAC7D,MAAM,MAAM,mBAAmB,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,CAAC;AAEnG,mDAAmD;AACnD,MAAM,WAAW,oBAAoB;IACnC,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,mBAAmB,CAAC;IAC/B,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,QAAQ,EAAE,QAAQ,CAAC;IACnB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEhD;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GACxB,IAAI,GACJ,QAAQ,GACR,IAAI,GACJ,MAAM,GACN,QAAQ,GACR,MAAM,GACN,MAAM,GACN,KAAK,GACL,QAAQ,GACR,GAAG,GACH,OAAO,GACP,MAAM,GACN,MAAM,GACN,UAAU,GACV,KAAK,CAAC;AAEV;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,QAAQ;IACvB,kFAAkF;IAClF,EAAE,EAAE,MAAM,CAAC;IACX,6BAA6B;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,QAAQ,CAAC;IACnB,oDAAoD;IACpD,UAAU,EAAE,UAAU,CAAC;IACvB,0CAA0C;IAC1C,IAAI,EAAE,OAAO,CAAC;IACd,qFAAqF;IACrF,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,kDAAkD;IAClD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,qEAAqE;AACrE,MAAM,WAAW,QAAQ;IACvB,0DAA0D;IAC1D,EAAE,EAAE,MAAM,CAAC;IACX,wDAAwD;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B;;;;;OAKG;IACH,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;IACnB,oEAAoE;IACpE,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IACrC,yEAAyE;IACzE,MAAM,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,aAAa;IAC5B,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,kCAAkC;AAClC,MAAM,WAAW,WAAW;IAC1B,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,sEAAsE;IACtE,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,gEAAgE;IAChE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,mFAAmF;IACnF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,4DAA4D;IAC5D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;OAGG;IACH,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;IACvB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kCAAkC;IAClC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC;;;;OAIG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,gFAAgF;AAChF,MAAM,WAAW,mBAAoB,SAAQ,WAAW;IACtD;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,kFAAkF;IAClF,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,yDAAyD;AACzD,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACrC,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,6FAA6F;IAC7F,UAAU,EAAE,MAAM,CAAC;IACnB,0GAA0G;IAC1G,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,iCAAiC;AACjC,MAAM,WAAW,UAAU;IACzB,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,EAAE,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,eAAe,CAAC;IAC3B,sBAAsB;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,iDAAiD;AACjD,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC;AAEtD,8DAA8D;AAC9D,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,eAAe,CAAC;IAC3B,gFAAgF;IAChF,cAAc,EAAE,MAAM,CAAC;IACvB,wBAAwB;IACxB,MAAM,EAAE,MAAM,CAAC;CAChB"}

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG","sourcesContent":["/**\n * @quantakrypto/core — shared types (the locked public contract).\n *\n * These types are the stable interface between every tool in the monorepo\n * (qScan, the MCP server, the GitHub Action). Treat additions as backwards\n * compatible; treat renames/removals as breaking.\n */\n\n/** How serious a finding is, ordered most → least severe. */\nexport type Severity = \"critical\" | \"high\" | \"medium\" | \"low\" | \"info\";\n\n/** How sure the detector is that the finding is a real use of the algorithm. */\nexport type Confidence = \"high\" | \"medium\" | \"low\";\n\n/** What kind of cryptographic concern a finding represents. */\nexport type FindingCategory =\n  | \"kem\" // key encapsulation / public-key encryption (e.g. RSA-OAEP)\n  | \"key-exchange\" // (EC)DH\n  | \"signature\" // RSA/ECDSA/EdDSA signing\n  | \"tls\" // transport configuration\n  | \"certificate\" // X.509 / PKI material\n  | \"dependency\" // a quantum-vulnerable library in the dependency tree\n  | \"hash\" // weak / pre-quantum hash usage\n  | \"rng\"; // randomness concerns\n\n/** Classical asymmetric algorithm families that are not quantum-safe. */\nexport type AlgorithmFamily =\n  | \"RSA\"\n  | \"ECDH\"\n  | \"ECDSA\"\n  | \"EdDSA\"\n  | \"DH\"\n  | \"DSA\"\n  | \"X25519\"\n  | \"X448\"\n  | \"ECIES\"\n  | \"unknown\";\n\n/** A precise location inside a scanned file. */\nexport interface SourceLocation {\n  /** Path relative to the scan root, using POSIX separators. */\n  file: string;\n  /** 1-based line number. */\n  line: number;\n  /** 1-based column number, if known. */\n  column?: number;\n  /** 1-based end line, for multi-line matches. */\n  endLine?: number;\n  /** The matched source text (trimmed, single line). */\n  snippet?: string;\n}\n\n/** Relative urgency an LLM triage pass assigns to a finding. */\nexport type TriagePriority = \"now\" | \"soon\" | \"later\";\n\n/**\n * Optional LLM triage annotation attached to a finding by `qscan --triage`.\n * Purely additive: it re-ranks and explains, it never suppresses a finding and\n * never influences the exit code (which is computed from `severity` alone).\n */\nexport interface TriageAnnotation {\n  /** 0–100 real-world exposure/exploitability estimate. */\n  exposureScore: number;\n  priority: TriagePriority;\n  rationale: string;\n}\n\n/** A single detected concern. */\nexport interface Finding {\n  /** Stable rule identifier, e.g. \"rsa-keygen\", \"ecdh-usage\", \"tls-legacy-version\", \"dep-vulnerable\". */\n  ruleId: string;\n  title: string;\n  category: FindingCategory;\n  severity: Severity;\n  confidence: Confidence;\n  /** The classical algorithm involved, when applicable. */\n  algorithm?: AlgorithmFamily;\n  /** True when this is exposed to \"harvest now, decrypt later\". */\n  hndl: boolean;\n  /** One-line human explanation of the concern. */\n  message: string;\n  /** Suggested post-quantum remediation (e.g. ML-KEM, hybrid X25519MLKEM768). */\n  remediation?: string;\n  /** Associated CWE identifier, e.g. \"CWE-327\" (broken crypto), \"CWE-326\" (weak strength). */\n  cwe?: string;\n  /**\n   * True when the matched snippet IS the sensitive value (e.g. a PEM private/\n   * public key block, an `ssh-rsa AAAA…` public key). Reporters ALWAYS drop the\n   * snippet for such findings, regardless of any redaction flag.\n   */\n  sensitive?: boolean;\n  /** Optional LLM triage annotation (`qscan --triage`); never affects exit code. */\n  triage?: TriageAnnotation;\n  location: SourceLocation;\n}\n\n/** Package ecosystems the dependency scanner understands. */\nexport type DependencyEcosystem = \"npm\" | \"pypi\" | \"cargo\" | \"go\" | \"maven\" | \"rubygems\" | \"nuget\";\n\n/** A known quantum-vulnerable dependency entry. */\nexport interface VulnerableDependency {\n  /** Package name (as written in the ecosystem's manifest). */\n  name: string;\n  ecosystem: DependencyEcosystem;\n  /** Why it's flagged (what classical crypto it provides). */\n  reason: string;\n  /** Algorithm families the package primarily exposes. */\n  algorithms: AlgorithmFamily[];\n  severity: Severity;\n  /**\n   * Explicit harvest-now-decrypt-later override. When omitted, HNDL is inferred\n   * from whether any listed family is a confidentiality family. Set `false` for\n   * signing-only packages (e.g. JWS/JWT libraries) that list RSA/EC as families\n   * but never do key transport or key agreement — signatures are not HNDL-exposed.\n   */\n  hndl?: boolean;\n}\n\n/**\n * Which logical scope a detector belongs to. Drives the source/config scope\n * toggles in {@link ScanOptions} (replacing the old ruleId-prefix inference).\n */\nexport type DetectorScope = \"source\" | \"config\";\n\n/**\n * The programming language / surface a detector targets. `\"any\"` means the\n * detector is language-agnostic (e.g. PEM material, config files).\n */\nexport type DetectorLanguage =\n  | \"js\"\n  | \"python\"\n  | \"go\"\n  | \"java\"\n  | \"csharp\"\n  | \"rust\"\n  | \"ruby\"\n  | \"c\"\n  | \"any\";\n\n/**\n * Declarative metadata for a single rule a detector can emit. This is the\n * catalog entry: the stable, queryable description of a rule keyed by the\n * `ruleId` it stamps onto findings. It is the single source of truth for a\n * rule's title / severity / category / remediation, consumed by the SARIF\n * `rules[]` block, the MCP `explain_finding` resolver, and future per-rule\n * enable/disable + language-pack work.\n *\n * For most rules the metadata is fixed and `detect()` builds findings straight\n * from it (see `findingFromRule`). A few rules are inherently multi-variant\n * (e.g. `node-crypto-keygen` spans RSA/EC/DSA/DH/Ed25519 at different\n * severities); for those the metadata here is a REPRESENTATIVE umbrella and\n * `detect()` refines the per-finding fields at match time. The catalog always\n * enumerates every emittable ruleId regardless.\n */\nexport interface RuleMeta {\n  /** Stable rule id — matches {@link Finding.ruleId}. Unique across the catalog. */\n  id: string;\n  /** Canonical human title. */\n  title: string;\n  category: FindingCategory;\n  severity: Severity;\n  /** Default confidence for findings of this rule. */\n  confidence: Confidence;\n  /** Harvest-now-decrypt-later exposure. */\n  hndl: boolean;\n  /** Representative classical algorithm family; refined per-finding when it varies. */\n  algorithm?: AlgorithmFamily;\n  /** Associated CWE identifier (e.g. \"CWE-327\"). */\n  cwe?: string;\n  /** Suggested post-quantum remediation. When omitted, derived from {@link algorithm}. */\n  remediation?: string;\n  /** Canonical one-line human explanation; may be refined per-finding. */\n  message: string;\n  /** True when this rule's matched snippet IS sensitive key material. */\n  sensitive?: boolean;\n  /** Short description of what the rule detects (for catalog / MCP surfaces). */\n  description?: string;\n}\n\n/** A pluggable source detector. Detectors are pure and stateless. */\nexport interface Detector {\n  /** Unique id, used as the Finding.ruleId prefix space. */\n  id: string;\n  /** Human description of what the detector looks for. */\n  description: string;\n  /**\n   * Logical scope of this detector's findings. Used by `scan()` to honour the\n   * `config` / `source` toggles. Defaults to `\"source\"` when omitted (for\n   * backward compatibility with externally-defined detectors).\n   */\n  scope?: DetectorScope;\n  /**\n   * Language this detector targets, for documentation / registry filtering.\n   * Defaults to `\"js\"` when omitted.\n   */\n  language?: DetectorLanguage;\n  /**\n   * The rules this detector can emit, as declarative metadata. Together across\n   * all detectors these form the rule catalog ({@link DetectorRegistry.ruleCatalog}).\n   * Optional for backward compatibility with externally-defined detectors, but\n   * all built-in detectors declare it.\n   */\n  rules?: RuleMeta[];\n  /** Whether this detector should run against the given file path. */\n  appliesTo(filePath: string): boolean;\n  /** Inspect a single file's contents and return zero or more findings. */\n  detect(input: DetectorInput): Finding[];\n}\n\nexport interface DetectorInput {\n  /** Path relative to the scan root (POSIX). */\n  file: string;\n  /** Full file contents. */\n  content: string;\n}\n\n/** Options controlling a scan. */\nexport interface ScanOptions {\n  /** Absolute or relative directory (or single file) to scan. */\n  root: string;\n  /**\n   * Restrict the walk to paths matching one of these include patterns\n   * (substring or relative-path-prefix match). When omitted, all non-excluded\n   * files are scanned. Wired into the walker.\n   */\n  include?: string[];\n  /** Extra exclude patterns (in addition to the built-in defaults). */\n  exclude?: string[];\n  /** Disable the built-in ignore list (node_modules, .git, dist, …). */\n  noDefaultIgnores?: boolean;\n  /** Scan source files for inline crypto usage. Default: true. */\n  source?: boolean;\n  /** Scan dependency manifests/lockfiles for vulnerable libraries. Default: true. */\n  dependencies?: boolean;\n  /** Scan config files (TLS, certificates). Default: true. */\n  config?: boolean;\n  /** Max file size to read, in bytes. Default: 2 MiB. */\n  maxFileSize?: number;\n  /**\n   * Scan minified / generated / bundled files (large single-line content)\n   * instead of skipping them. Default: false (skip them for speed).\n   */\n  scanMinified?: boolean;\n  /**\n   * Explicit relative file list (POSIX, relative to `root`) to scan instead of\n   * walking the tree. Used for incremental / changed-files scans. Each path is\n   * still subject to the binary / size filters. When set, the directory walk is\n   * bypassed entirely.\n   */\n  files?: string[];\n  /**\n   * Override / extend the built-in detector set. When omitted, the default\n   * registry's detectors are used.\n   */\n  detectors?: Detector[];\n  /**\n   * Rule ids to suppress. Any finding whose `ruleId` is listed here is dropped\n   * after detection. Serializable (a plain string array), so it is honoured on\n   * both the serial and the worker-thread (`scanParallel`) paths. See the rule\n   * catalog ({@link DetectorRegistry.ruleCatalog}) for the valid ids.\n   */\n  disabledRules?: string[];\n  /**\n   * Path to an on-disk scan cache. When set, unchanged files (same content hash)\n   * reuse their previous findings instead of re-running detectors, and the cache\n   * is rewritten after the scan. Invalidated wholesale when the tool version,\n   * detector set, or `disabledRules` change. Optional; omitted = no caching.\n   * The cache forces the in-process (serial) path.\n   */\n  cacheFile?: string;\n  /** Optional progress callback. */\n  onFile?: (file: string) => void;\n  /**\n   * Optional abort signal. When it fires mid-walk the scan stops cooperatively\n   * and rejects with an `AbortError` (a `DOMException`-like error with\n   * `name === \"AbortError\"`).\n   */\n  signal?: AbortSignal;\n  /**\n   * Work budget: maximum number of files to scan. When exceeded mid-walk the\n   * scan stops and throws a `BudgetExceededError`. Unlimited when omitted.\n   */\n  maxFiles?: number;\n  /**\n   * Work budget: maximum cumulative bytes of scanned file content. When\n   * exceeded mid-walk the scan stops and throws a `BudgetExceededError`.\n   * Unlimited when omitted.\n   */\n  maxBytes?: number;\n}\n\n/** Extra options for {@link scanParallel}, layered onto {@link ScanOptions}. */\nexport interface ParallelScanOptions extends ScanOptions {\n  /**\n   * Number of worker threads. Default: `os.availableParallelism()`. A value of\n   * 0 or 1 forces the in-process serial path.\n   */\n  concurrency?: number;\n  /**\n   * Combined-size floor (bytes) below which the scan always runs in-process.\n   * Default: 2 MiB. Also stays serial below `parallelFileThreshold` files.\n   */\n  parallelThresholdBytes?: number;\n  /** File-count floor below which the scan always runs in-process. Default: 200. */\n  parallelFileThreshold?: number;\n  /** Target bytes per worker chunk. Default: 4 MiB. */\n  chunkBytes?: number;\n}\n\n/** Aggregated counts produced from a scan's findings. */\nexport interface CryptoInventory {\n  byAlgorithm: Partial<Record<AlgorithmFamily, number>>;\n  byCategory: Partial<Record<FindingCategory, number>>;\n  bySeverity: Record<Severity, number>;\n  /** Number of findings exposed to harvest-now-decrypt-later. */\n  hndlCount: number;\n  /** 0–100 readiness score (100 = no classical asymmetric crypto found). */\n  readinessScore: number;\n}\n\n/**\n * Non-fatal things that happened during a scan that reduce coverage. Surfaced so\n * a silent under-scan (e.g. half the tree was unreadable) can't masquerade as a\n * clean \"0 findings\" result — reporters warn when any count is non-zero.\n */\nexport interface ScanDiagnostics {\n  /** Files that could not be read (permissions, vanished, decode failure) and were skipped. */\n  unreadable: number;\n  /** Files skipped because they look machine-minified / generated (scan with `scanMinified` to include). */\n  skippedMinified: number;\n}\n\n/** The full result of a scan. */\nexport interface ScanResult {\n  /** The scan root (as provided). */\n  root: string;\n  findings: Finding[];\n  filesScanned: number;\n  /**\n   * Coverage diagnostics: counts of files skipped as unreadable or minified.\n   * Optional for backward compatibility with hand-built results.\n   */\n  diagnostics?: ScanDiagnostics;\n  /**\n   * Of `filesScanned`, how many were in a source language the scanner can\n   * actually analyze for inline crypto (JS/TS, Python, Go, Java). When this is 0 but\n   * `filesScanned` > 0, the readiness score reflects NO analyzable code — the\n   * crypto likely lives in an unsupported language (Go, Java, Rust, …) — and\n   * reporters surface that so a bare 100/100 can't read as \"safe\". Optional for\n   * backward compatibility with hand-built results.\n   */\n  analyzedFiles?: number;\n  inventory: CryptoInventory;\n  /** ISO timestamps. */\n  startedAt: string;\n  finishedAt: string;\n  /** Tool version that produced the result. */\n  toolVersion: string;\n}\n\n/** Output formats qScan / reporters can emit. */\nexport type ReportFormat = \"human\" | \"json\" | \"sarif\";\n\n/** A remediation recommendation for a classical algorithm. */\nexport interface Remediation {\n  algorithm: AlgorithmFamily;\n  /** Short recommended replacement, e.g. \"ML-KEM-768 (hybrid X25519MLKEM768)\". */\n  recommendation: string;\n  /** Longer rationale. */\n  detail: string;\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG","sourcesContent":["/**\n * @quantakrypto/core — shared types (the locked public contract).\n *\n * These types are the stable interface between every tool in the monorepo\n * (qScan, the MCP server, the GitHub Action). Treat additions as backwards\n * compatible; treat renames/removals as breaking.\n */\n\n/** How serious a finding is, ordered most → least severe. */\nexport type Severity = \"critical\" | \"high\" | \"medium\" | \"low\" | \"info\";\n\n/** How sure the detector is that the finding is a real use of the algorithm. */\nexport type Confidence = \"high\" | \"medium\" | \"low\";\n\n/** What kind of cryptographic concern a finding represents. */\nexport type FindingCategory =\n  | \"kem\" // key encapsulation / public-key encryption (e.g. RSA-OAEP)\n  | \"key-exchange\" // (EC)DH\n  | \"signature\" // RSA/ECDSA/EdDSA signing\n  | \"tls\" // transport configuration\n  | \"certificate\" // X.509 / PKI material\n  | \"dependency\" // a quantum-vulnerable library in the dependency tree\n  | \"hash\" // weak / pre-quantum hash usage\n  | \"rng\"; // randomness concerns\n\n/** Classical asymmetric algorithm families that are not quantum-safe. */\nexport type AlgorithmFamily =\n  | \"RSA\"\n  | \"ECDH\"\n  | \"ECDSA\"\n  | \"EdDSA\"\n  | \"DH\"\n  | \"DSA\"\n  | \"X25519\"\n  | \"X448\"\n  | \"ECIES\"\n  | \"unknown\";\n\n/** A precise location inside a scanned file. */\nexport interface SourceLocation {\n  /** Path relative to the scan root, using POSIX separators. */\n  file: string;\n  /** 1-based line number. */\n  line: number;\n  /** 1-based column number, if known. */\n  column?: number;\n  /** 1-based end line, for multi-line matches. */\n  endLine?: number;\n  /** The matched source text (trimmed, single line). */\n  snippet?: string;\n}\n\n/** Relative urgency an LLM triage pass assigns to a finding. */\nexport type TriagePriority = \"now\" | \"soon\" | \"later\";\n\n/**\n * Optional LLM triage annotation attached to a finding by `qscan --triage`.\n * Purely additive: it re-ranks and explains, it never suppresses a finding and\n * never influences the exit code (which is computed from `severity` alone).\n */\nexport interface TriageAnnotation {\n  /** 0–100 real-world exposure/exploitability estimate. */\n  exposureScore: number;\n  priority: TriagePriority;\n  rationale: string;\n}\n\n/** A single detected concern. */\nexport interface Finding {\n  /** Stable rule identifier, e.g. \"rsa-keygen\", \"ecdh-usage\", \"tls-legacy-version\", \"dep-vulnerable\". */\n  ruleId: string;\n  title: string;\n  category: FindingCategory;\n  severity: Severity;\n  confidence: Confidence;\n  /** The classical algorithm involved, when applicable. */\n  algorithm?: AlgorithmFamily;\n  /** True when this is exposed to \"harvest now, decrypt later\". */\n  hndl: boolean;\n  /** One-line human explanation of the concern. */\n  message: string;\n  /** Suggested post-quantum remediation (e.g. ML-KEM, hybrid X25519MLKEM768). */\n  remediation?: string;\n  /** Associated CWE identifier, e.g. \"CWE-327\" (broken crypto), \"CWE-326\" (weak strength). */\n  cwe?: string;\n  /**\n   * True when the matched snippet IS the sensitive value (e.g. a PEM private/\n   * public key block, an `ssh-rsa AAAA…` public key). Reporters ALWAYS drop the\n   * snippet for such findings, regardless of any redaction flag.\n   */\n  sensitive?: boolean;\n  /** Optional LLM triage annotation (`qscan --triage`); never affects exit code. */\n  triage?: TriageAnnotation;\n  location: SourceLocation;\n}\n\n/** Package ecosystems the dependency scanner understands. */\nexport type DependencyEcosystem = \"npm\" | \"pypi\" | \"cargo\" | \"go\" | \"maven\" | \"rubygems\" | \"nuget\";\n\n/** A known quantum-vulnerable dependency entry. */\nexport interface VulnerableDependency {\n  /** Package name (as written in the ecosystem's manifest). */\n  name: string;\n  ecosystem: DependencyEcosystem;\n  /** Why it's flagged (what classical crypto it provides). */\n  reason: string;\n  /** Algorithm families the package primarily exposes. */\n  algorithms: AlgorithmFamily[];\n  severity: Severity;\n  /**\n   * Explicit harvest-now-decrypt-later override. When omitted, HNDL is inferred\n   * from whether any listed family is a confidentiality family. Set `false` for\n   * signing-only packages (e.g. JWS/JWT libraries) that list RSA/EC as families\n   * but never do key transport or key agreement — signatures are not HNDL-exposed.\n   */\n  hndl?: boolean;\n}\n\n/**\n * Which logical scope a detector belongs to. Drives the source/config scope\n * toggles in {@link ScanOptions} (replacing the old ruleId-prefix inference).\n */\nexport type DetectorScope = \"source\" | \"config\";\n\n/**\n * The programming language / surface a detector targets. `\"any\"` means the\n * detector is language-agnostic (e.g. PEM material, config files).\n */\nexport type DetectorLanguage =\n  | \"js\"\n  | \"python\"\n  | \"go\"\n  | \"java\"\n  | \"csharp\"\n  | \"rust\"\n  | \"ruby\"\n  | \"php\"\n  | \"elixir\"\n  | \"c\"\n  | \"swift\"\n  | \"objc\"\n  | \"dart\"\n  | \"solidity\"\n  | \"any\";\n\n/**\n * Declarative metadata for a single rule a detector can emit. This is the\n * catalog entry: the stable, queryable description of a rule keyed by the\n * `ruleId` it stamps onto findings. It is the single source of truth for a\n * rule's title / severity / category / remediation, consumed by the SARIF\n * `rules[]` block, the MCP `explain_finding` resolver, and future per-rule\n * enable/disable + language-pack work.\n *\n * For most rules the metadata is fixed and `detect()` builds findings straight\n * from it (see `findingFromRule`). A few rules are inherently multi-variant\n * (e.g. `node-crypto-keygen` spans RSA/EC/DSA/DH/Ed25519 at different\n * severities); for those the metadata here is a REPRESENTATIVE umbrella and\n * `detect()` refines the per-finding fields at match time. The catalog always\n * enumerates every emittable ruleId regardless.\n */\nexport interface RuleMeta {\n  /** Stable rule id — matches {@link Finding.ruleId}. Unique across the catalog. */\n  id: string;\n  /** Canonical human title. */\n  title: string;\n  category: FindingCategory;\n  severity: Severity;\n  /** Default confidence for findings of this rule. */\n  confidence: Confidence;\n  /** Harvest-now-decrypt-later exposure. */\n  hndl: boolean;\n  /** Representative classical algorithm family; refined per-finding when it varies. */\n  algorithm?: AlgorithmFamily;\n  /** Associated CWE identifier (e.g. \"CWE-327\"). */\n  cwe?: string;\n  /** Suggested post-quantum remediation. When omitted, derived from {@link algorithm}. */\n  remediation?: string;\n  /** Canonical one-line human explanation; may be refined per-finding. */\n  message: string;\n  /** True when this rule's matched snippet IS sensitive key material. */\n  sensitive?: boolean;\n  /** Short description of what the rule detects (for catalog / MCP surfaces). */\n  description?: string;\n}\n\n/** A pluggable source detector. Detectors are pure and stateless. */\nexport interface Detector {\n  /** Unique id, used as the Finding.ruleId prefix space. */\n  id: string;\n  /** Human description of what the detector looks for. */\n  description: string;\n  /**\n   * Logical scope of this detector's findings. Used by `scan()` to honour the\n   * `config` / `source` toggles. Defaults to `\"source\"` when omitted (for\n   * backward compatibility with externally-defined detectors).\n   */\n  scope?: DetectorScope;\n  /**\n   * Language this detector targets, for documentation / registry filtering.\n   * Defaults to `\"js\"` when omitted.\n   */\n  language?: DetectorLanguage;\n  /**\n   * The rules this detector can emit, as declarative metadata. Together across\n   * all detectors these form the rule catalog ({@link DetectorRegistry.ruleCatalog}).\n   * Optional for backward compatibility with externally-defined detectors, but\n   * all built-in detectors declare it.\n   */\n  rules?: RuleMeta[];\n  /** Whether this detector should run against the given file path. */\n  appliesTo(filePath: string): boolean;\n  /** Inspect a single file's contents and return zero or more findings. */\n  detect(input: DetectorInput): Finding[];\n}\n\nexport interface DetectorInput {\n  /** Path relative to the scan root (POSIX). */\n  file: string;\n  /** Full file contents. */\n  content: string;\n}\n\n/** Options controlling a scan. */\nexport interface ScanOptions {\n  /** Absolute or relative directory (or single file) to scan. */\n  root: string;\n  /**\n   * Restrict the walk to paths matching one of these include patterns\n   * (substring or relative-path-prefix match). When omitted, all non-excluded\n   * files are scanned. Wired into the walker.\n   */\n  include?: string[];\n  /** Extra exclude patterns (in addition to the built-in defaults). */\n  exclude?: string[];\n  /** Disable the built-in ignore list (node_modules, .git, dist, …). */\n  noDefaultIgnores?: boolean;\n  /** Scan source files for inline crypto usage. Default: true. */\n  source?: boolean;\n  /** Scan dependency manifests/lockfiles for vulnerable libraries. Default: true. */\n  dependencies?: boolean;\n  /** Scan config files (TLS, certificates). Default: true. */\n  config?: boolean;\n  /** Max file size to read, in bytes. Default: 2 MiB. */\n  maxFileSize?: number;\n  /**\n   * Scan minified / generated / bundled files (large single-line content)\n   * instead of skipping them. Default: false (skip them for speed).\n   */\n  scanMinified?: boolean;\n  /**\n   * Explicit relative file list (POSIX, relative to `root`) to scan instead of\n   * walking the tree. Used for incremental / changed-files scans. Each path is\n   * still subject to the binary / size filters. When set, the directory walk is\n   * bypassed entirely.\n   */\n  files?: string[];\n  /**\n   * Override / extend the built-in detector set. When omitted, the default\n   * registry's detectors are used.\n   */\n  detectors?: Detector[];\n  /**\n   * Rule ids to suppress. Any finding whose `ruleId` is listed here is dropped\n   * after detection. Serializable (a plain string array), so it is honoured on\n   * both the serial and the worker-thread (`scanParallel`) paths. See the rule\n   * catalog ({@link DetectorRegistry.ruleCatalog}) for the valid ids.\n   */\n  disabledRules?: string[];\n  /**\n   * Path to an on-disk scan cache. When set, unchanged files (same content hash)\n   * reuse their previous findings instead of re-running detectors, and the cache\n   * is rewritten after the scan. Invalidated wholesale when the tool version,\n   * detector set, or `disabledRules` change. Optional; omitted = no caching.\n   * The cache forces the in-process (serial) path.\n   */\n  cacheFile?: string;\n  /** Optional progress callback. */\n  onFile?: (file: string) => void;\n  /**\n   * Optional abort signal. When it fires mid-walk the scan stops cooperatively\n   * and rejects with an `AbortError` (a `DOMException`-like error with\n   * `name === \"AbortError\"`).\n   */\n  signal?: AbortSignal;\n  /**\n   * Work budget: maximum number of files to scan. When exceeded mid-walk the\n   * scan stops and throws a `BudgetExceededError`. Unlimited when omitted.\n   */\n  maxFiles?: number;\n  /**\n   * Work budget: maximum cumulative bytes of scanned file content. When\n   * exceeded mid-walk the scan stops and throws a `BudgetExceededError`.\n   * Unlimited when omitted.\n   */\n  maxBytes?: number;\n}\n\n/** Extra options for {@link scanParallel}, layered onto {@link ScanOptions}. */\nexport interface ParallelScanOptions extends ScanOptions {\n  /**\n   * Number of worker threads. Default: `os.availableParallelism()`. A value of\n   * 0 or 1 forces the in-process serial path.\n   */\n  concurrency?: number;\n  /**\n   * Combined-size floor (bytes) below which the scan always runs in-process.\n   * Default: 2 MiB. Also stays serial below `parallelFileThreshold` files.\n   */\n  parallelThresholdBytes?: number;\n  /** File-count floor below which the scan always runs in-process. Default: 200. */\n  parallelFileThreshold?: number;\n  /** Target bytes per worker chunk. Default: 4 MiB. */\n  chunkBytes?: number;\n}\n\n/** Aggregated counts produced from a scan's findings. */\nexport interface CryptoInventory {\n  byAlgorithm: Partial<Record<AlgorithmFamily, number>>;\n  byCategory: Partial<Record<FindingCategory, number>>;\n  bySeverity: Record<Severity, number>;\n  /** Number of findings exposed to harvest-now-decrypt-later. */\n  hndlCount: number;\n  /** 0–100 readiness score (100 = no classical asymmetric crypto found). */\n  readinessScore: number;\n}\n\n/**\n * Non-fatal things that happened during a scan that reduce coverage. Surfaced so\n * a silent under-scan (e.g. half the tree was unreadable) can't masquerade as a\n * clean \"0 findings\" result — reporters warn when any count is non-zero.\n */\nexport interface ScanDiagnostics {\n  /** Files that could not be read (permissions, vanished, decode failure) and were skipped. */\n  unreadable: number;\n  /** Files skipped because they look machine-minified / generated (scan with `scanMinified` to include). */\n  skippedMinified: number;\n}\n\n/** The full result of a scan. */\nexport interface ScanResult {\n  /** The scan root (as provided). */\n  root: string;\n  findings: Finding[];\n  filesScanned: number;\n  /**\n   * Coverage diagnostics: counts of files skipped as unreadable or minified.\n   * Optional for backward compatibility with hand-built results.\n   */\n  diagnostics?: ScanDiagnostics;\n  /**\n   * Of `filesScanned`, how many were in a source language the scanner can actually\n   * analyze for inline crypto (the 13 packs: JS/TS, Python, Go, Java/Kotlin/Scala,\n   * C#, Rust, Ruby, PHP, Elixir, C/C++, Swift, Objective-C, Dart). When this is 0\n   * but `filesScanned` > 0, the readiness score reflects NO analyzable code — the\n   * crypto likely lives in an unsupported language (Lua, Perl, …) — and\n   * reporters surface that so a bare 100/100 can't read as \"safe\". Optional for\n   * backward compatibility with hand-built results.\n   */\n  analyzedFiles?: number;\n  inventory: CryptoInventory;\n  /** ISO timestamps. */\n  startedAt: string;\n  finishedAt: string;\n  /** Tool version that produced the result. */\n  toolVersion: string;\n}\n\n/** Output formats qScan / reporters can emit. */\nexport type ReportFormat = \"human\" | \"json\" | \"sarif\";\n\n/** A remediation recommendation for a classical algorithm. */\nexport interface Remediation {\n  algorithm: AlgorithmFamily;\n  /** Short recommended replacement, e.g. \"ML-KEM-768 (hybrid X25519MLKEM768)\". */\n  recommendation: string;\n  /** Longer rationale. */\n  detail: string;\n}\n"]}

package/dist/version.d.ts

@@ -3,5 +3,5 @@
  * the scan orchestrator can import it without creating a cycle through index.ts.
  * Keep in sync with packages/core/package.json.
  */
-export declare const VERSION = "0.4.3";
+export declare const VERSION = "0.5.0";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -3,5 +3,5 @@
  * the scan orchestrator can import it without creating a cycle through index.ts.
  * Keep in sync with packages/core/package.json.
  */
-export const VERSION = "0.4.3";
+export const VERSION = "0.5.0";
 //# sourceMappingURL=version.js.map

package/dist/version.js.map

@@ -1 +1 @@
-{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC","sourcesContent":["/**\n * The tool version surfaced in reports. Kept in its own module so reporters and\n * the scan orchestrator can import it without creating a cycle through index.ts.\n * Keep in sync with packages/core/package.json.\n */\nexport const VERSION = \"0.4.3\";\n"]}
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC","sourcesContent":["/**\n * The tool version surfaced in reports. Kept in its own module so reporters and\n * the scan orchestrator can import it without creating a cycle through index.ts.\n * Keep in sync with packages/core/package.json.\n */\nexport const VERSION = \"0.5.0\";\n"]}

package/dist/vex.d.ts

@@ -0,0 +1,39 @@
+import type { ScanResult } from "./types.js";
+/** A single OpenVEX statement: one synthetic vulnerability over its affected products. */
+export interface OpenVexStatement {
+    vulnerability: {
+        name: string;
+        description?: string;
+    };
+    products: {
+        "@id": string;
+    }[];
+    status: "not_affected" | "affected" | "fixed" | "under_investigation";
+    /** Recommended action for an `affected` product (the rule's remediation). */
+    action_statement?: string;
+    /** Free-form status detail — carries the `--triage` exposure verdict when present. */
+    status_notes?: string;
+}
+/** An OpenVEX 0.2.0 document. */
+export interface OpenVexDocument {
+    "@context": "https://openvex.dev/ns/v0.2.0";
+    "@id": string;
+    author: string;
+    timestamp: string;
+    version: number;
+    statements: OpenVexStatement[];
+}
+/** Options for {@link toOpenVex}. */
+export interface OpenVexOptions {
+    /** Document author (VEX issuer). Default: `"qScan"`. */
+    author?: string;
+}
+/**
+ * Build an OpenVEX 0.2.0 document from a scan result. One statement per distinct
+ * rule id, listing every affected `file:line` product. Output is deterministic
+ * (statements sorted by vulnerability name, products sorted and de-duplicated;
+ * the `@id` and `timestamp` derive from the result), so re-exporting the same
+ * scan yields byte-identical VEX.
+ */
+export declare function toOpenVex(result: ScanResult, opts?: OpenVexOptions): OpenVexDocument;
+//# sourceMappingURL=vex.d.ts.map

package/dist/vex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vex.d.ts","sourceRoot":"","sources":["../src/vex.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAW,UAAU,EAAE,MAAM,YAAY,CAAC;AAEtD,0FAA0F;AAC1F,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACtD,QAAQ,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC9B,MAAM,EAAE,cAAc,GAAG,UAAU,GAAG,OAAO,GAAG,qBAAqB,CAAC;IACtE,6EAA6E;IAC7E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sFAAsF;IACtF,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,iCAAiC;AACjC,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,+BAA+B,CAAC;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,gBAAgB,EAAE,CAAC;CAChC;AAED,qCAAqC;AACrC,MAAM,WAAW,cAAc;IAC7B,wDAAwD;IACxD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAWD;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,GAAE,cAAmB,GAAG,eAAe,CA0DxF"}

package/dist/vex.js

@@ -0,0 +1,87 @@
+/**
+ * OpenVEX export — turn a {@link ScanResult} into an OpenVEX 0.2.0 document so
+ * the quantum-readiness posture flows into the SAME supply-chain pipeline that
+ * already ingests CVE-based VEX (Vulnerability Exploitability eXchange).
+ *
+ * Reference: OpenVEX spec (https://openvex.dev/, `@context` v0.2.0).
+ *
+ * Modeling choice (documented, honest): PQC findings have no CVE, so each qScan
+ * rule becomes a synthetic vulnerability `QK-<ruleId>`. Every finding is reported
+ * `status: "affected"` — the classical, Shor-breakable primitive IS present in
+ * the product by construction — with the rule's remediation as the VEX
+ * `action_statement`. A `--triage` exposure verdict, when present, is surfaced in
+ * `status_notes` (score / priority / rationale). qScan never downgrades a finding
+ * to `not_affected`: only the operator can attest a mitigation, so that judgment
+ * is deliberately left to them (they can post-process this document).
+ */
+import { createHash } from "node:crypto";
+/**
+ * A stable product identifier for a finding as an IRI (OpenVEX requires product
+ * `@id` to be an IRI): a `file:` URI with the line in the fragment, e.g.
+ * `file:src/a.ts#L3`.
+ */
+function productId(f) {
+    return `file:${f.location.file}#L${f.location.line}`;
+}
+/**
+ * Build an OpenVEX 0.2.0 document from a scan result. One statement per distinct
+ * rule id, listing every affected `file:line` product. Output is deterministic
+ * (statements sorted by vulnerability name, products sorted and de-duplicated;
+ * the `@id` and `timestamp` derive from the result), so re-exporting the same
+ * scan yields byte-identical VEX.
+ */
+export function toOpenVex(result, opts = {}) {
+    // Group findings by rule id → one VEX statement per rule.
+    const byRule = new Map();
+    for (const f of result.findings) {
+        const list = byRule.get(f.ruleId);
+        if (list)
+            list.push(f);
+        else
+            byRule.set(f.ruleId, [f]);
+    }
+    const statements = [...byRule.entries()]
+        .sort((a, b) => (a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0))
+        .map(([ruleId, findings]) => {
+        const first = findings[0];
+        // De-duplicate + sort the affected products (a rule can fire many times).
+        const products = [...new Set(findings.map(productId))].sort().map((id) => ({ "@id": id }));
+        // Surface a triage verdict (if any finding for this rule carries one). Findings
+        // of the same rule share a rule; the most-exposed verdict is the informative one.
+        const triaged = findings
+            .filter((f) => f.triage)
+            .sort((a, b) => (b.triage?.exposureScore ?? 0) - (a.triage?.exposureScore ?? 0))[0]?.triage;
+        const statement = {
+            vulnerability: {
+                name: `QK-${ruleId}`,
+                description: first.message,
+            },
+            products,
+            status: "affected",
+            action_statement: first.remediation ?? "Migrate to a NIST PQC standard (FIPS 203/204/205).",
+        };
+        if (triaged) {
+            statement.status_notes =
+                `qScan triage — exposure ${triaged.exposureScore}/100, priority ${triaged.priority}: ` +
+                    triaged.rationale;
+        }
+        return statement;
+    });
+    // Deterministic doc id + timestamp so the same scan yields identical VEX. The
+    // triage `status_notes` are part of the identity: a triaged and an untriaged
+    // export of the same scan are DIFFERENT documents and must not share an @id.
+    const digest = createHash("sha256").update(`${result.root}|${result.toolVersion}`, "utf8");
+    for (const s of statements) {
+        digest.update(`\n${s.vulnerability.name}|${s.products.map((p) => p["@id"]).join(",")}|${s.status_notes ?? ""}`);
+    }
+    const id = `https://quantakrypto.com/vex/${digest.digest("hex").slice(0, 16)}`;
+    return {
+        "@context": "https://openvex.dev/ns/v0.2.0",
+        "@id": id,
+        author: opts.author ?? "qScan",
+        timestamp: result.finishedAt,
+        version: 1,
+        statements,
+    };
+}
+//# sourceMappingURL=vex.js.map

package/dist/vex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vex.js","sourceRoot":"","sources":["../src/vex.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AA+BzC;;;;GAIG;AACH,SAAS,SAAS,CAAC,CAAU;IAC3B,OAAO,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;AACvD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,MAAkB,EAAE,OAAuB,EAAE;IACrE,0DAA0D;IAC1D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,IAAI;YAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;YAClB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,UAAU,GAAuB,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;SACzD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACxD,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE;QAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAY,CAAC;QACrC,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAE3F,gFAAgF;QAChF,kFAAkF;QAClF,MAAM,OAAO,GAAG,QAAQ;aACrB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;aACvB,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,aAAa,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,aAAa,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;QAE9F,MAAM,SAAS,GAAqB;YAClC,aAAa,EAAE;gBACb,IAAI,EAAE,MAAM,MAAM,EAAE;gBACpB,WAAW,EAAE,KAAK,CAAC,OAAO;aAC3B;YACD,QAAQ;YACR,MAAM,EAAE,UAAU;YAClB,gBAAgB,EAAE,KAAK,CAAC,WAAW,IAAI,oDAAoD;SAC5F,CAAC;QACF,IAAI,OAAO,EAAE,CAAC;YACZ,SAAS,CAAC,YAAY;gBACpB,2BAA2B,OAAO,CAAC,aAAa,kBAAkB,OAAO,CAAC,QAAQ,IAAI;oBACtF,OAAO,CAAC,SAAS,CAAC;QACtB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;IAEL,8EAA8E;IAC9E,6EAA6E;IAC7E,6EAA6E;IAC7E,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;IAC3F,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,CAAC,MAAM,CACX,KAAK,CAAC,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,YAAY,IAAI,EAAE,EAAE,CACjG,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,GAAG,gCAAgC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IAE/E,OAAO;QACL,UAAU,EAAE,+BAA+B;QAC3C,KAAK,EAAE,EAAE;QACT,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,OAAO;QAC9B,SAAS,EAAE,MAAM,CAAC,UAAU;QAC5B,OAAO,EAAE,CAAC;QACV,UAAU;KACX,CAAC;AACJ,CAAC","sourcesContent":["/**\n * OpenVEX export — turn a {@link ScanResult} into an OpenVEX 0.2.0 document so\n * the quantum-readiness posture flows into the SAME supply-chain pipeline that\n * already ingests CVE-based VEX (Vulnerability Exploitability eXchange).\n *\n * Reference: OpenVEX spec (https://openvex.dev/, `@context` v0.2.0).\n *\n * Modeling choice (documented, honest): PQC findings have no CVE, so each qScan\n * rule becomes a synthetic vulnerability `QK-<ruleId>`. Every finding is reported\n * `status: \"affected\"` — the classical, Shor-breakable primitive IS present in\n * the product by construction — with the rule's remediation as the VEX\n * `action_statement`. A `--triage` exposure verdict, when present, is surfaced in\n * `status_notes` (score / priority / rationale). qScan never downgrades a finding\n * to `not_affected`: only the operator can attest a mitigation, so that judgment\n * is deliberately left to them (they can post-process this document).\n */\nimport { createHash } from \"node:crypto\";\n\nimport type { Finding, ScanResult } from \"./types.js\";\n\n/** A single OpenVEX statement: one synthetic vulnerability over its affected products. */\nexport interface OpenVexStatement {\n  vulnerability: { name: string; description?: string };\n  products: { \"@id\": string }[];\n  status: \"not_affected\" | \"affected\" | \"fixed\" | \"under_investigation\";\n  /** Recommended action for an `affected` product (the rule's remediation). */\n  action_statement?: string;\n  /** Free-form status detail — carries the `--triage` exposure verdict when present. */\n  status_notes?: string;\n}\n\n/** An OpenVEX 0.2.0 document. */\nexport interface OpenVexDocument {\n  \"@context\": \"https://openvex.dev/ns/v0.2.0\";\n  \"@id\": string;\n  author: string;\n  timestamp: string;\n  version: number;\n  statements: OpenVexStatement[];\n}\n\n/** Options for {@link toOpenVex}. */\nexport interface OpenVexOptions {\n  /** Document author (VEX issuer). Default: `\"qScan\"`. */\n  author?: string;\n}\n\n/**\n * A stable product identifier for a finding as an IRI (OpenVEX requires product\n * `@id` to be an IRI): a `file:` URI with the line in the fragment, e.g.\n * `file:src/a.ts#L3`.\n */\nfunction productId(f: Finding): string {\n  return `file:${f.location.file}#L${f.location.line}`;\n}\n\n/**\n * Build an OpenVEX 0.2.0 document from a scan result. One statement per distinct\n * rule id, listing every affected `file:line` product. Output is deterministic\n * (statements sorted by vulnerability name, products sorted and de-duplicated;\n * the `@id` and `timestamp` derive from the result), so re-exporting the same\n * scan yields byte-identical VEX.\n */\nexport function toOpenVex(result: ScanResult, opts: OpenVexOptions = {}): OpenVexDocument {\n  // Group findings by rule id → one VEX statement per rule.\n  const byRule = new Map<string, Finding[]>();\n  for (const f of result.findings) {\n    const list = byRule.get(f.ruleId);\n    if (list) list.push(f);\n    else byRule.set(f.ruleId, [f]);\n  }\n\n  const statements: OpenVexStatement[] = [...byRule.entries()]\n    .sort((a, b) => (a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0))\n    .map(([ruleId, findings]) => {\n      const first = findings[0] as Finding;\n      // De-duplicate + sort the affected products (a rule can fire many times).\n      const products = [...new Set(findings.map(productId))].sort().map((id) => ({ \"@id\": id }));\n\n      // Surface a triage verdict (if any finding for this rule carries one). Findings\n      // of the same rule share a rule; the most-exposed verdict is the informative one.\n      const triaged = findings\n        .filter((f) => f.triage)\n        .sort((a, b) => (b.triage?.exposureScore ?? 0) - (a.triage?.exposureScore ?? 0))[0]?.triage;\n\n      const statement: OpenVexStatement = {\n        vulnerability: {\n          name: `QK-${ruleId}`,\n          description: first.message,\n        },\n        products,\n        status: \"affected\",\n        action_statement: first.remediation ?? \"Migrate to a NIST PQC standard (FIPS 203/204/205).\",\n      };\n      if (triaged) {\n        statement.status_notes =\n          `qScan triage — exposure ${triaged.exposureScore}/100, priority ${triaged.priority}: ` +\n          triaged.rationale;\n      }\n      return statement;\n    });\n\n  // Deterministic doc id + timestamp so the same scan yields identical VEX. The\n  // triage `status_notes` are part of the identity: a triaged and an untriaged\n  // export of the same scan are DIFFERENT documents and must not share an @id.\n  const digest = createHash(\"sha256\").update(`${result.root}|${result.toolVersion}`, \"utf8\");\n  for (const s of statements) {\n    digest.update(\n      `\\n${s.vulnerability.name}|${s.products.map((p) => p[\"@id\"]).join(\",\")}|${s.status_notes ?? \"\"}`,\n    );\n  }\n  const id = `https://quantakrypto.com/vex/${digest.digest(\"hex\").slice(0, 16)}`;\n\n  return {\n    \"@context\": \"https://openvex.dev/ns/v0.2.0\",\n    \"@id\": id,\n    author: opts.author ?? \"qScan\",\n    timestamp: result.finishedAt,\n    version: 1,\n    statements,\n  };\n}\n"]}

package/dist/walk.d.ts

@@ -1,9 +1,7 @@
-/** Directories ignored by default (can be disabled with noDefaultIgnores). */
-export declare const DEFAULT_IGNORES: readonly string[];
 /** Default maximum file size to read: 2 MiB. */
 export declare const DEFAULT_MAX_FILE_SIZE: number;
 /** Options accepted by {@link walkFiles}. */
-export interface WalkOptions {
+interface WalkOptions {
     /**
      * Restrict to paths matching one of these include patterns (substring or
      * relative-path-prefix match). When omitted/empty, all files pass.
@@ -27,6 +25,12 @@ export declare function toPosix(p: string): string;
 export declare function matchesAny(rel: string, patterns: readonly string[]): boolean;
 /** True if the file's extension marks it as binary / non-text. */
 export declare function isBinaryPath(rel: string): boolean;
+/**
+ * True if the path is a binary cryptographic key container we scan byte-preserving.
+ * Uses a suffix match (not `extname`) so it agrees with the detectors' `hasExtension`
+ * even for a bare dotfile literally named e.g. `.gpg` (where `extname` returns "").
+ */
+export declare function isKeystorePath(rel: string): boolean;
 /** True if the path looks like generated / bundled output (by name). */
 export declare function isGeneratedPath(rel: string): boolean;
 /**
@@ -41,4 +45,5 @@ export declare function looksMinified(content: string): boolean;
  * basename (subject to the size / binary filters).
  */
 export declare function walkFiles(root: string, options?: WalkOptions): AsyncGenerator<string>;
+export {};
 //# sourceMappingURL=walk.d.ts.map

package/dist/walk.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"walk.d.ts","sourceRoot":"","sources":["../src/walk.ts"],"names":[],"mappings":"AAYA,8EAA8E;AAC9E,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAW5C,CAAC;AAEF,gDAAgD;AAChD,eAAO,MAAM,qBAAqB,QAAkB,CAAC;AAyErD,6CAA6C;AAC7C,MAAM,WAAW,WAAW;IAC1B;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,wEAAwE;IACxE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,kDAAkD;IAClD,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,0DAA0D;AAC1D,wBAAgB,OAAO,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAEzC;AA6DD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAc5E;AAgBD,kEAAkE;AAClE,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAMjD;AASD,wEAAwE;AACxE,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAmBtD;AAED;;;;GAIG;AACH,wBAAuB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,cAAc,CAAC,MAAM,CAAC,CAsBhG"}
+{"version":3,"file":"walk.d.ts","sourceRoot":"","sources":["../src/walk.ts"],"names":[],"mappings":"AA0BA,gDAAgD;AAChD,eAAO,MAAM,qBAAqB,QAAkB,CAAC;AAyErD,6CAA6C;AAC7C,UAAU,WAAW;IACnB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,wEAAwE;IACxE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,kDAAkD;IAClD,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,0DAA0D;AAC1D,wBAAgB,OAAO,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAEzC;AA6DD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAc5E;AAgBD,kEAAkE;AAClE,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAMjD;AAsBD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAInD;AASD,wEAAwE;AACxE,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAmBtD;AAED;;;;GAIG;AACH,wBAAuB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,WAAgB,GAAG,cAAc,CAAC,MAAM,CAAC,CAsBhG"}

package/dist/walk.js

@@ -8,7 +8,7 @@ import { readdir, stat } from "node:fs/promises";
 import * as path from "node:path";
 import { isManifestFile } from "./dependencies.js";
 /** Directories ignored by default (can be disabled with noDefaultIgnores). */
-export const DEFAULT_IGNORES = [
+const DEFAULT_IGNORES = [
     "node_modules",
     ".git",
     "dist",
@@ -206,6 +206,37 @@ export function isBinaryPath(rel) {
     const ext = path.posix.extname(lower);
     return BINARY_EXTENSIONS.has(ext);
 }
+/**
+ * Binary cryptographic key containers we DO want to scan — Java/PKCS#12 keystores
+ * and binary OpenPGP keyrings/messages. Unlike the images/archives above these are
+ * read byte-preserving (latin1) and exempted from the minified skip, so the
+ * keystore + openpgp detectors can identify them by magic number / packet tag.
+ * Kept separate from {@link BINARY_EXTENSIONS} so those detectors can opt in.
+ */
+const KEYSTORE_EXTENSIONS = new Set([
+    ".jks",
+    ".keystore",
+    ".jceks",
+    ".bks",
+    ".p12",
+    ".pfx",
+    // Binary OpenPGP keyrings / messages (armored .asc is text; handled elsewhere).
+    ".gpg",
+    ".pgp",
+    ".kbx",
+]);
+/**
+ * True if the path is a binary cryptographic key container we scan byte-preserving.
+ * Uses a suffix match (not `extname`) so it agrees with the detectors' `hasExtension`
+ * even for a bare dotfile literally named e.g. `.gpg` (where `extname` returns "").
+ */
+export function isKeystorePath(rel) {
+    const lower = rel.toLowerCase();
+    for (const ext of KEYSTORE_EXTENSIONS)
+        if (lower.endsWith(ext))
+            return true;
+    return false;
+}
 /**
  * Compound / pattern extensions that mark generated or bundled output we skip
  * by default (beyond `.min.js` / `.map`, which {@link isBinaryPath} handles).