@quantakrypto/core 0.4.3 → 0.5.0

package/dist/walk.js.map

@@ -1 +1 @@
-{"version":3,"file":"walk.js","sourceRoot":"","sources":["../src/walk.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,cAAc;IACd,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,KAAK;IACL,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,QAAQ;CACT,CAAC;AAEF,gDAAgD;AAChD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAErD;;;GAGG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAS;IACxC,SAAS;IACT,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,MAAM;IACN,MAAM;IACN,MAAM;IACN,wBAAwB;IACxB,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,MAAM;IACN,MAAM;IACN,QAAQ;IACR,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,uBAAuB;IACvB,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,KAAK;IACL,QAAQ;IACR,MAAM;IACN,IAAI;IACJ,IAAI;IACJ,QAAQ;IACR,OAAO;IACP,kBAAkB;IAClB,KAAK;IACL,SAAS;IACT,UAAU;IACV,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,OAAO;IACP,MAAM;IACN,SAAS;IACT,OAAO;CACR,CAAC,CAAC;AAiBH,0DAA0D;AAC1D,MAAM,UAAU,OAAO,CAAC,CAAS;IAC/B,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACrC,CAAC;AAED,mFAAmF;AACnF,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACxB,CAAC,EAAE,CAAC,CAAC,yBAAyB;gBAC9B,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBACxB,CAAC,EAAE,CAAC,CAAC,2BAA2B;oBAChC,EAAE,IAAI,UAAU,CAAC,CAAC,6BAA6B;gBACjD,CAAC;qBAAM,CAAC;oBACN,EAAE,IAAI,IAAI,CAAC,CAAC,yBAAyB;gBACvC,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,EAAE,IAAI,OAAO,CAAC,CAAC,uBAAuB;YACxC,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,EAAE,IAAI,MAAM,CAAC;QACf,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,wDAAwD;YACxD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACrC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;gBACf,EAAE,IAAI,KAAK,CAAC;YACd,CAAC;iBAAM,CAAC;gBACN,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;gBAC7B,CAAC,GAAG,GAAG,CAAC;YACV,CAAC;QACH,CAAC;aAAM,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,EAAE,IAAI,IAAI,GAAG,CAAC,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,EAAE,IAAI,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;AAC7C,SAAS,UAAU,CAAC,OAAe;IACjC,IAAI,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QAC3B,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,QAA2B;IACjE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YACnB,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzC,SAAS;QACX,CAAC;QACD,wEAAwE;QACxE,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACjC,uEAAuE;QACvE,IAAI,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yEAAyE;AACzE,SAAS,UAAU,CAAC,GAAW,EAAE,OAA0B;IACzD,OAAO,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,GAAW,EAAE,OAA0B;IACzD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,mDAAmD;IACnD,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,iBAAiB,GACrB,gHAAgH,CAAC;AAEnH,wEAAwE;AACxE,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC5E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC;YACzC,IAAI,GAAG,GAAG,OAAO;gBAAE,OAAO,GAAG,GAAG,CAAC;YACjC,GAAG,GAAG,CAAC,CAAC;YACR,KAAK,EAAE,CAAC;QACV,CAAC;aAAM,CAAC;YACN,GAAG,EAAE,CAAC;QACR,CAAC;IACH,CAAC;IACD,IAAI,GAAG,GAAG,OAAO;QAAE,OAAO,GAAG,GAAG,CAAC;IACjC,IAAI,OAAO,GAAG,MAAM;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC;IACtC,OAAO,OAAO,GAAG,KAAK,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,SAAS,CAAC,IAAY,EAAE,UAAuB,EAAE;IACtE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,qBAAqB,CAAC;IACjE,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;IAEhE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IAElC,8EAA8E;IAC9E,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,IACE,CAAC,YAAY,CAAC,IAAI,CAAC;YACnB,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC;YACzB,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,EACjD,CAAC;YACD,MAAM,IAAI,CAAC;QACb,CAAC;QACD,OAAO;IACT,CAAC;IAED,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;AACvE,CAAC;AASD;;;;GAIG;AACH,SAAS,eAAe,CAAC,GAAW,EAAE,IAAY,EAAE,WAAmB;IACrE,+EAA+E;IAC/E,iFAAiF;IACjF,IAAI,cAAc,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,IAAI,IAAI,WAAW,CAAC;AAC7B,CAAC;AAED,mFAAmF;AACnF,KAAK,SAAS,CAAC,CAAC,OAAO,CAAC,MAAc,EAAE,MAAc,EAAE,GAAgB;IACtE,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,OAAO;IACT,CAAC;IAED,yDAAyD;IACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEzE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAE1C,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;YAC3B,8DAA8D;YAC9D,SAAS;QACX,CAAC;QAED,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC/C,IAAI,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC;gBAAE,SAAS;YAC3C,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YAC9B,SAAS;QACX,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,SAAS;QAC9B,IAAI,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAC3C,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAC5C,4EAA4E;QAC5E,8EAA8E;QAC9E,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,GAAG,CAAC;YAAE,SAAS;QAC7C,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC;YAAE,SAAS;QAEhD,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,WAAW,CAAC;gBAAE,SAAS;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["/**\n * Filesystem walker. A zero-dependency recursive async generator that yields\n * scannable text files as relative POSIX paths. It honours a default ignore\n * list, user-supplied exclude patterns, a max file size, and a binary-extension\n * filter. The root may be a directory or a single file.\n */\nimport { readdir, stat } from \"node:fs/promises\";\nimport type { Dirent } from \"node:fs\";\nimport * as path from \"node:path\";\n\nimport { isManifestFile } from \"./dependencies.js\";\n\n/** Directories ignored by default (can be disabled with noDefaultIgnores). */\nexport const DEFAULT_IGNORES: readonly string[] = [\n  \"node_modules\",\n  \".git\",\n  \"dist\",\n  \"build\",\n  \".next\",\n  \"out\",\n  \"coverage\",\n  \"vendor\",\n  \".turbo\",\n  \".cache\",\n];\n\n/** Default maximum file size to read: 2 MiB. */\nexport const DEFAULT_MAX_FILE_SIZE = 2 * 1024 * 1024;\n\n/**\n * File extensions we treat as binary / non-text and therefore skip. Keeping this\n * as an extension allow-list-by-exclusion is cheap and avoids reading bytes.\n */\nconst BINARY_EXTENSIONS = new Set<string>([\n  // images\n  \".png\",\n  \".jpg\",\n  \".jpeg\",\n  \".gif\",\n  \".webp\",\n  \".bmp\",\n  \".ico\",\n  \".tiff\",\n  \".avif\",\n  // fonts\n  \".woff\",\n  \".woff2\",\n  \".ttf\",\n  \".otf\",\n  \".eot\",\n  // archives / compressed\n  \".zip\",\n  \".gz\",\n  \".tgz\",\n  \".bz2\",\n  \".xz\",\n  \".7z\",\n  \".rar\",\n  \".tar\",\n  // media\n  \".mp3\",\n  \".mp4\",\n  \".mov\",\n  \".avi\",\n  \".mkv\",\n  \".wav\",\n  \".flac\",\n  \".ogg\",\n  \".webm\",\n  // documents / binaries\n  \".pdf\",\n  \".doc\",\n  \".docx\",\n  \".xls\",\n  \".xlsx\",\n  \".ppt\",\n  \".pptx\",\n  \".exe\",\n  \".dll\",\n  \".so\",\n  \".dylib\",\n  \".bin\",\n  \".o\",\n  \".a\",\n  \".class\",\n  \".wasm\",\n  // data blobs / db\n  \".db\",\n  \".sqlite\",\n  \".sqlite3\",\n  \".dat\",\n  \".pack\",\n  \".idx\",\n  // misc\n  \".lock\",\n  \".map\",\n  \".min.js\",\n  \".node\",\n]);\n\n/** Options accepted by {@link walkFiles}. */\nexport interface WalkOptions {\n  /**\n   * Restrict to paths matching one of these include patterns (substring or\n   * relative-path-prefix match). When omitted/empty, all files pass.\n   */\n  include?: string[];\n  /** Extra exclude patterns (substring or relative-path-prefix match). */\n  exclude?: string[];\n  /** Disable the built-in directory ignore list. */\n  noDefaultIgnores?: boolean;\n  /** Max file size in bytes; larger files are skipped. */\n  maxFileSize?: number;\n}\n\n/** Normalise a path to forward-slash POSIX separators. */\nexport function toPosix(p: string): string {\n  return p.split(path.sep).join(\"/\");\n}\n\n/** A pattern is treated as a glob when it contains one of these metacharacters. */\nfunction hasGlobMeta(pattern: string): boolean {\n  return /[*?[]/.test(pattern);\n}\n\n/**\n * Translate a glob into an anchored RegExp: `*` matches within a path segment\n * (not `/`), `**` matches across segments, a leading `**` before a slash is an\n * optional path prefix, `?` matches a single non-`/` char, `[...]` is a\n * character class. Other regex\n * metacharacters are escaped.\n */\nfunction globToRegExp(glob: string): RegExp {\n  let re = \"\";\n  for (let i = 0; i < glob.length; i++) {\n    const c = glob[i];\n    if (c === \"*\") {\n      if (glob[i + 1] === \"*\") {\n        i++; // consume the second '*'\n        if (glob[i + 1] === \"/\") {\n          i++; // consume the trailing '/'\n          re += \"(?:.*/)?\"; // zero or more path segments\n        } else {\n          re += \".*\"; // '**' spanning segments\n        }\n      } else {\n        re += \"[^/]*\"; // '*' within a segment\n      }\n    } else if (c === \"?\") {\n      re += \"[^/]\";\n    } else if (c === \"[\") {\n      // Pass a character class through; find its closing ']'.\n      const end = glob.indexOf(\"]\", i + 1);\n      if (end === -1) {\n        re += \"\\\\[\";\n      } else {\n        re += glob.slice(i, end + 1);\n        i = end;\n      }\n    } else if (\"\\\\^$.|+(){}\".includes(c)) {\n      re += \"\\\\\" + c;\n    } else {\n      re += c;\n    }\n  }\n  return new RegExp(`^${re}$`);\n}\n\n/** Memoized glob→RegExp so a pattern is compiled once, not once per file. */\nconst GLOB_CACHE = new Map<string, RegExp>();\nfunction globRegExp(pattern: string): RegExp {\n  let re = GLOB_CACHE.get(pattern);\n  if (!re) {\n    re = globToRegExp(pattern);\n    GLOB_CACHE.set(pattern, re);\n  }\n  return re;\n}\n\n/**\n * True if `rel` (a POSIX relative path) matches any pattern. A pattern with a\n * glob metacharacter (`*`, `?`, `[`) is matched as an anchored glob; a plain\n * pattern keeps the historical substring / path-prefix semantics (so `\"src\"`\n * still matches `src/a.ts` and `\"secrets\"` matches anywhere).\n */\nexport function matchesAny(rel: string, patterns: readonly string[]): boolean {\n  for (const pattern of patterns) {\n    if (!pattern) continue;\n    const p = toPosix(pattern).replace(/\\/+$/, \"\");\n    if (hasGlobMeta(p)) {\n      if (globRegExp(p).test(rel)) return true;\n      continue;\n    }\n    // Plain pattern: substring match (handles \"src/legacy\" or \"secrets\")...\n    if (rel.includes(p)) return true;\n    // ...and explicit path-prefix match (\"foo\" should match \"foo/bar.ts\").\n    if (rel === p || rel.startsWith(`${p}/`)) return true;\n  }\n  return false;\n}\n\n/** True if `rel` (a POSIX relative path) matches any exclude pattern. */\nfunction isExcluded(rel: string, exclude: readonly string[]): boolean {\n  return matchesAny(rel, exclude);\n}\n\n/**\n * True if `rel` passes the include filter. An empty include list means \"include\n * everything\"; otherwise the file must match at least one include pattern.\n */\nfunction isIncluded(rel: string, include: readonly string[]): boolean {\n  if (include.length === 0) return true;\n  return matchesAny(rel, include);\n}\n\n/** True if the file's extension marks it as binary / non-text. */\nexport function isBinaryPath(rel: string): boolean {\n  const lower = rel.toLowerCase();\n  // Handle compound extensions like \".min.js\" first.\n  if (lower.endsWith(\".min.js\")) return true;\n  const ext = path.posix.extname(lower);\n  return BINARY_EXTENSIONS.has(ext);\n}\n\n/**\n * Compound / pattern extensions that mark generated or bundled output we skip\n * by default (beyond `.min.js` / `.map`, which {@link isBinaryPath} handles).\n */\nconst GENERATED_PATH_RE =\n  /(?:\\.min\\.[mc]?js|[.-]min\\.[mc]?js|\\.bundle\\.[mc]?js|\\.chunk\\.[mc]?js|\\.generated\\.[jt]sx?|_pb\\.js|\\.pb\\.go)$/i;\n\n/** True if the path looks like generated / bundled output (by name). */\nexport function isGeneratedPath(rel: string): boolean {\n  return GENERATED_PATH_RE.test(rel.toLowerCase());\n}\n\n/**\n * Heuristic content check for machine-minified / generated files with no\n * telltale extension: a very long average line length, or any single line over\n * ~50 KB, in the first ~64 KB sampled. Used at read time, not in the walker.\n */\nexport function looksMinified(content: string): boolean {\n  const sample = content.length > 65_536 ? content.slice(0, 65_536) : content;\n  if (sample.length === 0) return false;\n  let maxLine = 0;\n  let cur = 0;\n  let lines = 1;\n  for (let i = 0; i < sample.length; i++) {\n    if (sample.charCodeAt(i) === 10 /* \\n */) {\n      if (cur > maxLine) maxLine = cur;\n      cur = 0;\n      lines++;\n    } else {\n      cur++;\n    }\n  }\n  if (cur > maxLine) maxLine = cur;\n  if (maxLine > 50_000) return true;\n  const avgLine = sample.length / lines;\n  return avgLine > 1_000;\n}\n\n/**\n * Recursively yield scannable file paths (relative to `root`, POSIX) under a\n * directory. If `root` points at a single file, yields just that file's\n * basename (subject to the size / binary filters).\n */\nexport async function* walkFiles(root: string, options: WalkOptions = {}): AsyncGenerator<string> {\n  const include = options.include ?? [];\n  const exclude = options.exclude ?? [];\n  const maxFileSize = options.maxFileSize ?? DEFAULT_MAX_FILE_SIZE;\n  const ignores = options.noDefaultIgnores ? [] : DEFAULT_IGNORES;\n\n  const rootStat = await stat(root);\n\n  // Single-file mode: yield the file itself (by basename) if it passes filters.\n  if (rootStat.isFile()) {\n    const name = toPosix(path.basename(root));\n    if (\n      !isBinaryPath(name) &&\n      isIncluded(name, include) &&\n      passesSizeLimit(name, rootStat.size, maxFileSize)\n    ) {\n      yield name;\n    }\n    return;\n  }\n\n  yield* walkDir(root, \"\", { include, exclude, maxFileSize, ignores });\n}\n\ninterface WalkContext {\n  include: readonly string[];\n  exclude: readonly string[];\n  maxFileSize: number;\n  ignores: readonly string[];\n}\n\n/**\n * True if a file passes the size limit. Dependency manifests (package.json /\n * package-lock.json) are exempt from the cap so large lockfiles still get\n * scanned for vulnerable dependencies instead of being silently dropped.\n */\nfunction passesSizeLimit(rel: string, size: number, maxFileSize: number): boolean {\n  // Dependency manifests are always read (they can exceed the size cap but carry\n  // the whole dependency tree). Uses the single {@link isManifestFile} definition.\n  if (isManifestFile(rel)) return true;\n  return size <= maxFileSize;\n}\n\n/** Internal recursive directory walker. `relDir` is POSIX-relative to the root. */\nasync function* walkDir(absDir: string, relDir: string, ctx: WalkContext): AsyncGenerator<string> {\n  let entries: Dirent[];\n  try {\n    entries = await readdir(absDir, { withFileTypes: true });\n  } catch {\n    // Unreadable directory (permissions, transient races) — skip silently.\n    return;\n  }\n\n  // Stable, deterministic ordering for reproducible scans.\n  entries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));\n\n  for (const entry of entries) {\n    const rel = relDir ? `${relDir}/${entry.name}` : entry.name;\n    const abs = path.join(absDir, entry.name);\n\n    if (entry.isSymbolicLink()) {\n      // Don't follow symlinks: avoids cycles and escaping the root.\n      continue;\n    }\n\n    if (entry.isDirectory()) {\n      if (ctx.ignores.includes(entry.name)) continue;\n      if (isExcluded(rel, ctx.exclude)) continue;\n      yield* walkDir(abs, rel, ctx);\n      continue;\n    }\n\n    if (!entry.isFile()) continue;\n    if (isExcluded(rel, ctx.exclude)) continue;\n    if (!isIncluded(rel, ctx.include)) continue;\n    // Dependency manifests (incl. yarn.lock / pnpm-lock.yaml) are always read —\n    // they carry the dependency tree and must not be dropped as binary/generated.\n    const manifest = isManifestFile(rel);\n    if (!manifest && isBinaryPath(rel)) continue;\n    if (!manifest && isGeneratedPath(rel)) continue;\n\n    try {\n      const s = await stat(abs);\n      if (!passesSizeLimit(rel, s.size, ctx.maxFileSize)) continue;\n    } catch {\n      continue;\n    }\n\n    yield rel;\n  }\n}\n"]}
+{"version":3,"file":"walk.js","sourceRoot":"","sources":["../src/walk.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,8EAA8E;AAC9E,MAAM,eAAe,GAAsB;IACzC,cAAc;IACd,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,KAAK;IACL,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,QAAQ;CACT,CAAC;AAEF,gDAAgD;AAChD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAErD;;;GAGG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAS;IACxC,SAAS;IACT,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,MAAM;IACN,MAAM;IACN,MAAM;IACN,wBAAwB;IACxB,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,MAAM;IACN,MAAM;IACN,QAAQ;IACR,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,uBAAuB;IACvB,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,KAAK;IACL,QAAQ;IACR,MAAM;IACN,IAAI;IACJ,IAAI;IACJ,QAAQ;IACR,OAAO;IACP,kBAAkB;IAClB,KAAK;IACL,SAAS;IACT,UAAU;IACV,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,OAAO;IACP,MAAM;IACN,SAAS;IACT,OAAO;CACR,CAAC,CAAC;AAiBH,0DAA0D;AAC1D,MAAM,UAAU,OAAO,CAAC,CAAS;IAC/B,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACrC,CAAC;AAED,mFAAmF;AACnF,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACxB,CAAC,EAAE,CAAC,CAAC,yBAAyB;gBAC9B,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBACxB,CAAC,EAAE,CAAC,CAAC,2BAA2B;oBAChC,EAAE,IAAI,UAAU,CAAC,CAAC,6BAA6B;gBACjD,CAAC;qBAAM,CAAC;oBACN,EAAE,IAAI,IAAI,CAAC,CAAC,yBAAyB;gBACvC,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,EAAE,IAAI,OAAO,CAAC,CAAC,uBAAuB;YACxC,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,EAAE,IAAI,MAAM,CAAC;QACf,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,wDAAwD;YACxD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACrC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;gBACf,EAAE,IAAI,KAAK,CAAC;YACd,CAAC;iBAAM,CAAC;gBACN,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;gBAC7B,CAAC,GAAG,GAAG,CAAC;YACV,CAAC;QACH,CAAC;aAAM,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,EAAE,IAAI,IAAI,GAAG,CAAC,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,EAAE,IAAI,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;AAC7C,SAAS,UAAU,CAAC,OAAe;IACjC,IAAI,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QAC3B,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,QAA2B;IACjE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YACnB,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzC,SAAS;QACX,CAAC;QACD,wEAAwE;QACxE,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACjC,uEAAuE;QACvE,IAAI,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yEAAyE;AACzE,SAAS,UAAU,CAAC,GAAW,EAAE,OAA0B;IACzD,OAAO,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,GAAW,EAAE,OAA0B;IACzD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,mDAAmD;IACnD,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAS;IAC1C,MAAM;IACN,WAAW;IACX,QAAQ;IACR,MAAM;IACN,MAAM;IACN,MAAM;IACN,gFAAgF;IAChF,MAAM;IACN,MAAM;IACN,MAAM;CACP,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,mBAAmB;QAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IAC5E,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,iBAAiB,GACrB,gHAAgH,CAAC;AAEnH,wEAAwE;AACxE,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC5E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC;YACzC,IAAI,GAAG,GAAG,OAAO;gBAAE,OAAO,GAAG,GAAG,CAAC;YACjC,GAAG,GAAG,CAAC,CAAC;YACR,KAAK,EAAE,CAAC;QACV,CAAC;aAAM,CAAC;YACN,GAAG,EAAE,CAAC;QACR,CAAC;IACH,CAAC;IACD,IAAI,GAAG,GAAG,OAAO;QAAE,OAAO,GAAG,GAAG,CAAC;IACjC,IAAI,OAAO,GAAG,MAAM;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC;IACtC,OAAO,OAAO,GAAG,KAAK,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,SAAS,CAAC,IAAY,EAAE,UAAuB,EAAE;IACtE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,qBAAqB,CAAC;IACjE,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;IAEhE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IAElC,8EAA8E;IAC9E,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,IACE,CAAC,YAAY,CAAC,IAAI,CAAC;YACnB,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC;YACzB,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,EACjD,CAAC;YACD,MAAM,IAAI,CAAC;QACb,CAAC;QACD,OAAO;IACT,CAAC;IAED,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;AACvE,CAAC;AASD;;;;GAIG;AACH,SAAS,eAAe,CAAC,GAAW,EAAE,IAAY,EAAE,WAAmB;IACrE,+EAA+E;IAC/E,iFAAiF;IACjF,IAAI,cAAc,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,IAAI,IAAI,WAAW,CAAC;AAC7B,CAAC;AAED,mFAAmF;AACnF,KAAK,SAAS,CAAC,CAAC,OAAO,CAAC,MAAc,EAAE,MAAc,EAAE,GAAgB;IACtE,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,OAAO;IACT,CAAC;IAED,yDAAyD;IACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEzE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAE1C,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;YAC3B,8DAA8D;YAC9D,SAAS;QACX,CAAC;QAED,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC/C,IAAI,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC;gBAAE,SAAS;YAC3C,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YAC9B,SAAS;QACX,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,SAAS;QAC9B,IAAI,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAC3C,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAC5C,4EAA4E;QAC5E,8EAA8E;QAC9E,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,GAAG,CAAC;YAAE,SAAS;QAC7C,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC;YAAE,SAAS;QAEhD,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,WAAW,CAAC;gBAAE,SAAS;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["/**\n * Filesystem walker. A zero-dependency recursive async generator that yields\n * scannable text files as relative POSIX paths. It honours a default ignore\n * list, user-supplied exclude patterns, a max file size, and a binary-extension\n * filter. The root may be a directory or a single file.\n */\nimport { readdir, stat } from \"node:fs/promises\";\nimport type { Dirent } from \"node:fs\";\nimport * as path from \"node:path\";\n\nimport { isManifestFile } from \"./dependencies.js\";\n\n/** Directories ignored by default (can be disabled with noDefaultIgnores). */\nconst DEFAULT_IGNORES: readonly string[] = [\n  \"node_modules\",\n  \".git\",\n  \"dist\",\n  \"build\",\n  \".next\",\n  \"out\",\n  \"coverage\",\n  \"vendor\",\n  \".turbo\",\n  \".cache\",\n];\n\n/** Default maximum file size to read: 2 MiB. */\nexport const DEFAULT_MAX_FILE_SIZE = 2 * 1024 * 1024;\n\n/**\n * File extensions we treat as binary / non-text and therefore skip. Keeping this\n * as an extension allow-list-by-exclusion is cheap and avoids reading bytes.\n */\nconst BINARY_EXTENSIONS = new Set<string>([\n  // images\n  \".png\",\n  \".jpg\",\n  \".jpeg\",\n  \".gif\",\n  \".webp\",\n  \".bmp\",\n  \".ico\",\n  \".tiff\",\n  \".avif\",\n  // fonts\n  \".woff\",\n  \".woff2\",\n  \".ttf\",\n  \".otf\",\n  \".eot\",\n  // archives / compressed\n  \".zip\",\n  \".gz\",\n  \".tgz\",\n  \".bz2\",\n  \".xz\",\n  \".7z\",\n  \".rar\",\n  \".tar\",\n  // media\n  \".mp3\",\n  \".mp4\",\n  \".mov\",\n  \".avi\",\n  \".mkv\",\n  \".wav\",\n  \".flac\",\n  \".ogg\",\n  \".webm\",\n  // documents / binaries\n  \".pdf\",\n  \".doc\",\n  \".docx\",\n  \".xls\",\n  \".xlsx\",\n  \".ppt\",\n  \".pptx\",\n  \".exe\",\n  \".dll\",\n  \".so\",\n  \".dylib\",\n  \".bin\",\n  \".o\",\n  \".a\",\n  \".class\",\n  \".wasm\",\n  // data blobs / db\n  \".db\",\n  \".sqlite\",\n  \".sqlite3\",\n  \".dat\",\n  \".pack\",\n  \".idx\",\n  // misc\n  \".lock\",\n  \".map\",\n  \".min.js\",\n  \".node\",\n]);\n\n/** Options accepted by {@link walkFiles}. */\ninterface WalkOptions {\n  /**\n   * Restrict to paths matching one of these include patterns (substring or\n   * relative-path-prefix match). When omitted/empty, all files pass.\n   */\n  include?: string[];\n  /** Extra exclude patterns (substring or relative-path-prefix match). */\n  exclude?: string[];\n  /** Disable the built-in directory ignore list. */\n  noDefaultIgnores?: boolean;\n  /** Max file size in bytes; larger files are skipped. */\n  maxFileSize?: number;\n}\n\n/** Normalise a path to forward-slash POSIX separators. */\nexport function toPosix(p: string): string {\n  return p.split(path.sep).join(\"/\");\n}\n\n/** A pattern is treated as a glob when it contains one of these metacharacters. */\nfunction hasGlobMeta(pattern: string): boolean {\n  return /[*?[]/.test(pattern);\n}\n\n/**\n * Translate a glob into an anchored RegExp: `*` matches within a path segment\n * (not `/`), `**` matches across segments, a leading `**` before a slash is an\n * optional path prefix, `?` matches a single non-`/` char, `[...]` is a\n * character class. Other regex\n * metacharacters are escaped.\n */\nfunction globToRegExp(glob: string): RegExp {\n  let re = \"\";\n  for (let i = 0; i < glob.length; i++) {\n    const c = glob[i];\n    if (c === \"*\") {\n      if (glob[i + 1] === \"*\") {\n        i++; // consume the second '*'\n        if (glob[i + 1] === \"/\") {\n          i++; // consume the trailing '/'\n          re += \"(?:.*/)?\"; // zero or more path segments\n        } else {\n          re += \".*\"; // '**' spanning segments\n        }\n      } else {\n        re += \"[^/]*\"; // '*' within a segment\n      }\n    } else if (c === \"?\") {\n      re += \"[^/]\";\n    } else if (c === \"[\") {\n      // Pass a character class through; find its closing ']'.\n      const end = glob.indexOf(\"]\", i + 1);\n      if (end === -1) {\n        re += \"\\\\[\";\n      } else {\n        re += glob.slice(i, end + 1);\n        i = end;\n      }\n    } else if (\"\\\\^$.|+(){}\".includes(c)) {\n      re += \"\\\\\" + c;\n    } else {\n      re += c;\n    }\n  }\n  return new RegExp(`^${re}$`);\n}\n\n/** Memoized glob→RegExp so a pattern is compiled once, not once per file. */\nconst GLOB_CACHE = new Map<string, RegExp>();\nfunction globRegExp(pattern: string): RegExp {\n  let re = GLOB_CACHE.get(pattern);\n  if (!re) {\n    re = globToRegExp(pattern);\n    GLOB_CACHE.set(pattern, re);\n  }\n  return re;\n}\n\n/**\n * True if `rel` (a POSIX relative path) matches any pattern. A pattern with a\n * glob metacharacter (`*`, `?`, `[`) is matched as an anchored glob; a plain\n * pattern keeps the historical substring / path-prefix semantics (so `\"src\"`\n * still matches `src/a.ts` and `\"secrets\"` matches anywhere).\n */\nexport function matchesAny(rel: string, patterns: readonly string[]): boolean {\n  for (const pattern of patterns) {\n    if (!pattern) continue;\n    const p = toPosix(pattern).replace(/\\/+$/, \"\");\n    if (hasGlobMeta(p)) {\n      if (globRegExp(p).test(rel)) return true;\n      continue;\n    }\n    // Plain pattern: substring match (handles \"src/legacy\" or \"secrets\")...\n    if (rel.includes(p)) return true;\n    // ...and explicit path-prefix match (\"foo\" should match \"foo/bar.ts\").\n    if (rel === p || rel.startsWith(`${p}/`)) return true;\n  }\n  return false;\n}\n\n/** True if `rel` (a POSIX relative path) matches any exclude pattern. */\nfunction isExcluded(rel: string, exclude: readonly string[]): boolean {\n  return matchesAny(rel, exclude);\n}\n\n/**\n * True if `rel` passes the include filter. An empty include list means \"include\n * everything\"; otherwise the file must match at least one include pattern.\n */\nfunction isIncluded(rel: string, include: readonly string[]): boolean {\n  if (include.length === 0) return true;\n  return matchesAny(rel, include);\n}\n\n/** True if the file's extension marks it as binary / non-text. */\nexport function isBinaryPath(rel: string): boolean {\n  const lower = rel.toLowerCase();\n  // Handle compound extensions like \".min.js\" first.\n  if (lower.endsWith(\".min.js\")) return true;\n  const ext = path.posix.extname(lower);\n  return BINARY_EXTENSIONS.has(ext);\n}\n\n/**\n * Binary cryptographic key containers we DO want to scan — Java/PKCS#12 keystores\n * and binary OpenPGP keyrings/messages. Unlike the images/archives above these are\n * read byte-preserving (latin1) and exempted from the minified skip, so the\n * keystore + openpgp detectors can identify them by magic number / packet tag.\n * Kept separate from {@link BINARY_EXTENSIONS} so those detectors can opt in.\n */\nconst KEYSTORE_EXTENSIONS = new Set<string>([\n  \".jks\",\n  \".keystore\",\n  \".jceks\",\n  \".bks\",\n  \".p12\",\n  \".pfx\",\n  // Binary OpenPGP keyrings / messages (armored .asc is text; handled elsewhere).\n  \".gpg\",\n  \".pgp\",\n  \".kbx\",\n]);\n\n/**\n * True if the path is a binary cryptographic key container we scan byte-preserving.\n * Uses a suffix match (not `extname`) so it agrees with the detectors' `hasExtension`\n * even for a bare dotfile literally named e.g. `.gpg` (where `extname` returns \"\").\n */\nexport function isKeystorePath(rel: string): boolean {\n  const lower = rel.toLowerCase();\n  for (const ext of KEYSTORE_EXTENSIONS) if (lower.endsWith(ext)) return true;\n  return false;\n}\n\n/**\n * Compound / pattern extensions that mark generated or bundled output we skip\n * by default (beyond `.min.js` / `.map`, which {@link isBinaryPath} handles).\n */\nconst GENERATED_PATH_RE =\n  /(?:\\.min\\.[mc]?js|[.-]min\\.[mc]?js|\\.bundle\\.[mc]?js|\\.chunk\\.[mc]?js|\\.generated\\.[jt]sx?|_pb\\.js|\\.pb\\.go)$/i;\n\n/** True if the path looks like generated / bundled output (by name). */\nexport function isGeneratedPath(rel: string): boolean {\n  return GENERATED_PATH_RE.test(rel.toLowerCase());\n}\n\n/**\n * Heuristic content check for machine-minified / generated files with no\n * telltale extension: a very long average line length, or any single line over\n * ~50 KB, in the first ~64 KB sampled. Used at read time, not in the walker.\n */\nexport function looksMinified(content: string): boolean {\n  const sample = content.length > 65_536 ? content.slice(0, 65_536) : content;\n  if (sample.length === 0) return false;\n  let maxLine = 0;\n  let cur = 0;\n  let lines = 1;\n  for (let i = 0; i < sample.length; i++) {\n    if (sample.charCodeAt(i) === 10 /* \\n */) {\n      if (cur > maxLine) maxLine = cur;\n      cur = 0;\n      lines++;\n    } else {\n      cur++;\n    }\n  }\n  if (cur > maxLine) maxLine = cur;\n  if (maxLine > 50_000) return true;\n  const avgLine = sample.length / lines;\n  return avgLine > 1_000;\n}\n\n/**\n * Recursively yield scannable file paths (relative to `root`, POSIX) under a\n * directory. If `root` points at a single file, yields just that file's\n * basename (subject to the size / binary filters).\n */\nexport async function* walkFiles(root: string, options: WalkOptions = {}): AsyncGenerator<string> {\n  const include = options.include ?? [];\n  const exclude = options.exclude ?? [];\n  const maxFileSize = options.maxFileSize ?? DEFAULT_MAX_FILE_SIZE;\n  const ignores = options.noDefaultIgnores ? [] : DEFAULT_IGNORES;\n\n  const rootStat = await stat(root);\n\n  // Single-file mode: yield the file itself (by basename) if it passes filters.\n  if (rootStat.isFile()) {\n    const name = toPosix(path.basename(root));\n    if (\n      !isBinaryPath(name) &&\n      isIncluded(name, include) &&\n      passesSizeLimit(name, rootStat.size, maxFileSize)\n    ) {\n      yield name;\n    }\n    return;\n  }\n\n  yield* walkDir(root, \"\", { include, exclude, maxFileSize, ignores });\n}\n\ninterface WalkContext {\n  include: readonly string[];\n  exclude: readonly string[];\n  maxFileSize: number;\n  ignores: readonly string[];\n}\n\n/**\n * True if a file passes the size limit. Dependency manifests (package.json /\n * package-lock.json) are exempt from the cap so large lockfiles still get\n * scanned for vulnerable dependencies instead of being silently dropped.\n */\nfunction passesSizeLimit(rel: string, size: number, maxFileSize: number): boolean {\n  // Dependency manifests are always read (they can exceed the size cap but carry\n  // the whole dependency tree). Uses the single {@link isManifestFile} definition.\n  if (isManifestFile(rel)) return true;\n  return size <= maxFileSize;\n}\n\n/** Internal recursive directory walker. `relDir` is POSIX-relative to the root. */\nasync function* walkDir(absDir: string, relDir: string, ctx: WalkContext): AsyncGenerator<string> {\n  let entries: Dirent[];\n  try {\n    entries = await readdir(absDir, { withFileTypes: true });\n  } catch {\n    // Unreadable directory (permissions, transient races) — skip silently.\n    return;\n  }\n\n  // Stable, deterministic ordering for reproducible scans.\n  entries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));\n\n  for (const entry of entries) {\n    const rel = relDir ? `${relDir}/${entry.name}` : entry.name;\n    const abs = path.join(absDir, entry.name);\n\n    if (entry.isSymbolicLink()) {\n      // Don't follow symlinks: avoids cycles and escaping the root.\n      continue;\n    }\n\n    if (entry.isDirectory()) {\n      if (ctx.ignores.includes(entry.name)) continue;\n      if (isExcluded(rel, ctx.exclude)) continue;\n      yield* walkDir(abs, rel, ctx);\n      continue;\n    }\n\n    if (!entry.isFile()) continue;\n    if (isExcluded(rel, ctx.exclude)) continue;\n    if (!isIncluded(rel, ctx.include)) continue;\n    // Dependency manifests (incl. yarn.lock / pnpm-lock.yaml) are always read —\n    // they carry the dependency tree and must not be dropped as binary/generated.\n    const manifest = isManifestFile(rel);\n    if (!manifest && isBinaryPath(rel)) continue;\n    if (!manifest && isGeneratedPath(rel)) continue;\n\n    try {\n      const s = await stat(abs);\n      if (!passesSizeLimit(rel, s.size, ctx.maxFileSize)) continue;\n    } catch {\n      continue;\n    }\n\n    yield rel;\n  }\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quantakrypto/core",
-  "version": "0.4.3",
+  "version": "0.5.0",
   "description": "Shared post-quantum readiness library: crypto detectors, vulnerable-dependency database, inventory + SARIF reporting. Zero runtime dependencies.",
   "license": "Apache-2.0",
   "author": "Dandelion Labs <hello@dandelionlabs.io> (https://dandelionlabs.io)",

package/src/cbom-merge.ts

@@ -0,0 +1,146 @@
+/**
+ * Merge multiple CycloneDX 1.6 CBOMs into one combined cryptographic bill of
+ * materials. This is what turns the "code + infra + live-endpoint" story into a
+ * single artifact: a qScan CBOM (code + infrastructure-as-code/config) and a
+ * qProbe CBOM (live endpoints) both emit `cryptographic-asset` components keyed by
+ * a deterministic `bom-ref` per (algorithm, primitive), so merging is a union with
+ * dedup — the same crypto seen by two planes collapses to one component whose
+ * occurrence evidence spans both.
+ *
+ * Output is deterministic (components sorted by bom-ref, occurrences sorted by
+ * location, a stable serial derived from the merged content), so re-merging the
+ * same inputs yields byte-identical output.
+ */
+import { createHash } from "node:crypto";
+import type { CycloneDxBom, CbomComponent } from "./cbom.js";
+
+/** Occurrence record shape inside a component's `evidence.occurrences`. */
+interface Occurrence {
+  location: string;
+  additionalContext?: string;
+}
+
+function occurrencesOf(c: CbomComponent): Occurrence[] {
+  const ev = c.evidence as { occurrences?: unknown } | undefined;
+  const occ = ev?.occurrences;
+  return Array.isArray(occ) ? (occ as Occurrence[]) : [];
+}
+
+const HNDL_PROP = "quantakrypto:harvestNowDecryptLater";
+
+function hndlOf(c: CbomComponent): boolean {
+  // The flag is carried as a CycloneDX component `property` (name/value). Fall back
+  // to the legacy `cryptoProperties.harvestNowDecryptLater` location so an
+  // externally-authored / older CBOM still merges correctly.
+  const prop = c.properties?.find((p) => p.name === HNDL_PROP);
+  if (prop) return prop.value === "true";
+  return (
+    (c.cryptoProperties as { harvestNowDecryptLater?: unknown } | undefined)
+      ?.harvestNowDecryptLater === true
+  );
+}
+
+/** Return a copy of `props` with the HNDL flag set to `value`. */
+function withHndl(
+  props: { name: string; value: string }[] | undefined,
+  value: boolean,
+): { name: string; value: string }[] {
+  const rest = (props ?? []).filter((p) => p.name !== HNDL_PROP);
+  return [...rest, { name: HNDL_PROP, value: String(value) }];
+}
+
+/** Union + dedup occurrences by `location`, sorted deterministically. */
+function mergeOccurrences(a: Occurrence[], b: Occurrence[]): Occurrence[] {
+  const byLoc = new Map<string, Occurrence>();
+  for (const o of [...a, ...b]) if (!byLoc.has(o.location)) byLoc.set(o.location, o);
+  return [...byLoc.values()].sort((x, y) =>
+    x.location < y.location ? -1 : x.location > y.location ? 1 : 0,
+  );
+}
+
+/**
+ * Merge CBOMs into one. Components with the same `bom-ref` (same algorithm +
+ * primitive) are combined; their occurrence evidence is unioned and their
+ * harvest-now-decrypt-later flag is OR-ed. Tool and root metadata from every input
+ * is preserved.
+ */
+export function mergeCboms(boms: readonly CycloneDxBom[]): CycloneDxBom {
+  const byRef = new Map<string, CbomComponent>();
+  const toolComponents: unknown[] = [];
+  const toolSeen = new Set<string>();
+  const roots: string[] = [];
+
+  for (const bom of boms) {
+    // Collect tool + root metadata (dedup tools by name@version).
+    const tools = (bom.metadata as { tools?: { components?: unknown[] } })?.tools?.components;
+    if (Array.isArray(tools)) {
+      for (const t of tools) {
+        const tc = t as { name?: string; version?: string };
+        const key = `${tc.name}@${tc.version}`;
+        if (!toolSeen.has(key)) {
+          toolSeen.add(key);
+          toolComponents.push(t);
+        }
+      }
+    }
+    const root = (bom.metadata as { component?: { name?: string } })?.component?.name;
+    if (typeof root === "string" && root && !roots.includes(root)) roots.push(root);
+
+    // `components` is optional in the CycloneDX 1.6 spec — a legal CBOM can carry none
+    // (a scan that found nothing). Treat a missing array as empty instead of crashing.
+    for (const c of bom.components ?? []) {
+      const ref = c["bom-ref"];
+      const existing = byRef.get(ref);
+      if (!existing) {
+        // Deep-ish copy so we can mutate evidence/properties without touching the input.
+        byRef.set(ref, {
+          ...c,
+          cryptoProperties: { ...c.cryptoProperties },
+          properties: c.properties ? [...c.properties] : undefined,
+          evidence: { occurrences: occurrencesOf(c) },
+        });
+      } else {
+        const merged = mergeOccurrences(occurrencesOf(existing), occurrencesOf(c));
+        existing.evidence = { occurrences: merged };
+        // OR the harvest-now-decrypt-later flag across the merged copies.
+        existing.properties = withHndl(existing.properties, hndlOf(existing) || hndlOf(c));
+      }
+    }
+  }
+
+  const components = [...byRef.values()].sort((a, b) =>
+    a["bom-ref"] < b["bom-ref"] ? -1 : a["bom-ref"] > b["bom-ref"] ? 1 : 0,
+  );
+
+  // Content-address the serial over bom-refs AND their occurrence locations (+ roots),
+  // so two merges that differ only in occurrence evidence get distinct serials — a
+  // CycloneDX serialNumber is meant to identify a BOM *instance*, and downstream
+  // bom-link/dedup tooling relies on that. Occurrences are already sorted.
+  const serialSeed =
+    components
+      .map(
+        (c) =>
+          `${c["bom-ref"]}#${occurrencesOf(c)
+            .map((o) => o.location)
+            .join(",")}`,
+      )
+      .join("|") + `|${roots.join(",")}`;
+  const h = createHash("sha256").update(serialSeed, "utf8").digest("hex");
+  const serial = `${h.slice(0, 8)}-${h.slice(8, 12)}-4${h.slice(13, 16)}-8${h.slice(17, 20)}-${h.slice(20, 32)}`;
+
+  return {
+    bomFormat: "CycloneDX",
+    specVersion: "1.6",
+    serialNumber: `urn:uuid:${serial}`,
+    version: 1,
+    metadata: {
+      tools: { components: toolComponents },
+      component: {
+        type: "application",
+        "bom-ref": "root",
+        name: roots.length ? `combined: ${roots.join(" + ")}` : "combined",
+      },
+    },
+    components,
+  };
+}

package/src/cbom.ts

@@ -5,9 +5,12 @@
  * for compliance / supply-chain tooling.
  *
  * Reference: CycloneDX 1.6 cryptography properties
- * (https://cyclonedx.org/capabilities/cbom/). We emit one
- * `cryptographic-asset` component per distinct (algorithm, primitive) pair
- * observed, with occurrence evidence pointing back at the findings.
+ * (https://cyclonedx.org/capabilities/cbom/). Each finding is classified into
+ * its CycloneDX `assetType` — `algorithm` (usage), `certificate` (X.509),
+ * `related-crypto-material` (private/public key material), or `protocol` (TLS) —
+ * and we emit one `cryptographic-asset` component per distinct
+ * (assetType, algorithm, discriminator), with occurrence evidence pointing back
+ * at the findings. Every asset carries the quantum posture flags.
  */
 import { createHash } from "node:crypto";
 
@@ -30,10 +33,12 @@ export interface CbomComponent {
   "bom-ref": string;
   name: string;
   cryptoProperties: Record<string, unknown>;
+  /** CycloneDX component name/value properties (carries the quantum posture flags). */
+  properties?: { name: string; value: string }[];
   evidence?: Record<string, unknown>;
 }
 
-/** CycloneDX cryptographic primitive for a finding category. */
+/** CycloneDX cryptographic primitive for a finding category (algorithm assets only). */
 function primitiveFor(category: FindingCategory): string {
   switch (category) {
     case "kem":
@@ -42,18 +47,73 @@ function primitiveFor(category: FindingCategory): string {
       return "key-agree";
     case "signature":
       return "signature";
-    case "certificate":
-      // "pki" is NOT a valid CycloneDX 1.6 algorithmProperties.primitive enum
-      // value; use "other" so the CBOM validates (audit: quantum #3). Modeling
-      // certificates as assetType:"certificate" is a future refinement.
-      return "other";
-    case "tls":
-      return "other";
+    case "hash":
+      return "hash";
     default:
+      // `certificate` / `tls` no longer route here (they become their own
+      // assetType — see {@link classifyAsset}); `dependency` / `rng` and any
+      // future category fall back to the valid "other" primitive.
       return "other";
   }
 }
 
+/** The CycloneDX 1.6 `cryptoProperties.assetType` a finding maps to. */
+type CbomAssetType = "algorithm" | "certificate" | "protocol" | "related-crypto-material";
+
+/**
+ * Classify a finding into its CycloneDX 1.6 asset type. Most findings are
+ * algorithm USAGE (`kem` / `key-exchange` / `signature` / `hash` / …). The
+ * `certificate` category is a mix of real X.509 certificates and raw key
+ * material, disambiguated by rule id; `tls` findings are protocol configuration.
+ *
+ * `discriminator` keeps distinct kinds in separate components (it is the algorithm
+ * primitive for `algorithm`, the material type for `related-crypto-material`, the
+ * protocol type for `protocol`, and empty for `certificate`).
+ */
+function classifyAsset(f: Finding): {
+  assetType: CbomAssetType;
+  discriminator: string;
+  materialType?: string;
+  protocolType?: string;
+} {
+  if (f.category === "tls") {
+    return { assetType: "protocol", discriminator: "tls", protocolType: "tls" };
+  }
+  if (f.category === "certificate") {
+    const id = f.ruleId.toLowerCase();
+    // Route the explicitly key-SHAPED material to related-crypto-material…
+    if (id.includes("private-key") || id.includes("keystore")) {
+      return {
+        assetType: "related-crypto-material",
+        discriminator: "private-key",
+        materialType: "private-key",
+      };
+    }
+    if (id.includes("public-key")) {
+      return {
+        assetType: "related-crypto-material",
+        discriminator: "public-key",
+        materialType: "public-key",
+      };
+    }
+    if (id.includes("message")) {
+      return {
+        assetType: "related-crypto-material",
+        discriminator: "ciphertext",
+        materialType: "ciphertext",
+      };
+    }
+    // …and DEFAULT the rest of the `certificate` category to assetType
+    // "certificate" — the category's own meaning. This covers real X.509 certs
+    // and CSRs (pem-certificate/pem-cert-request) plus PKI trust material whose
+    // ids don't spell "cert": ACM certs (cfn-acm-*), Vault PKI (vault-pki-*),
+    // mesh identity, and SPIFFE X.509-SVIDs (spire-*). Previously these fell
+    // through to related-crypto-material "key", mislabelling certificates.
+    return { assetType: "certificate", discriminator: "" };
+  }
+  return { assetType: "algorithm", discriminator: primitiveFor(f.category) };
+}
+
 /**
  * Every CBOM asset here is derived from a quantakrypto finding, and the detectors
  * only ever fire on classical (Shor-broken) public-key crypto — so an asset is
@@ -102,19 +162,28 @@ function bomRef(key: string): string {
  * finding. Output is deterministic (components and occurrences are sorted).
  */
 export function toCbom(result: ScanResult): CycloneDxBom {
-  // Group findings by (algorithm | primitive).
+  // Group findings by (assetType | algorithm | discriminator) so each distinct
+  // cryptographic asset — an algorithm usage, a certificate, key material, or a
+  // protocol — becomes its own component.
   const groups = new Map<
     string,
-    { algorithm: AlgorithmFamily; primitive: string; findings: Finding[] }
+    {
+      assetType: CbomAssetType;
+      algorithm: AlgorithmFamily;
+      discriminator: string;
+      materialType?: string;
+      protocolType?: string;
+      findings: Finding[];
+    }
   >();
 
   for (const f of result.findings) {
     const algorithm: AlgorithmFamily = f.algorithm ?? "unknown";
-    const primitive = primitiveFor(f.category);
-    const key = `${algorithm}|${primitive}`;
+    const cls = classifyAsset(f);
+    const key = `${cls.assetType}|${algorithm}|${cls.discriminator}`;
     let g = groups.get(key);
     if (!g) {
-      g = { algorithm, primitive, findings: [] };
+      g = { ...cls, algorithm, findings: [] };
       groups.set(key, g);
     }
     g.findings.push(f);
@@ -132,30 +201,69 @@ export function toCbom(result: ScanResult): CycloneDxBom {
 
       const anyHndl = g.findings.some((f) => f.hndl);
 
+      // The type-specific CycloneDX properties block + a human label for the name.
+      let typeProps: Record<string, unknown>;
+      let label: string;
+      switch (g.assetType) {
+        case "certificate":
+          // A certificate / CSR: we know the public-key family but not the X.509
+          // fields (subject, validity, refs) from a lexical scan, so the block is
+          // left minimal — all certificateProperties are optional in 1.6.
+          typeProps = { certificateProperties: {} };
+          label = "certificate";
+          break;
+        case "related-crypto-material":
+          typeProps = {
+            relatedCryptoMaterialProperties: { type: g.materialType ?? "key" },
+          };
+          label = g.materialType ?? "key";
+          break;
+        case "protocol":
+          typeProps = { protocolProperties: { type: g.protocolType ?? "tls" } };
+          label = g.protocolType ?? "tls";
+          break;
+        case "algorithm":
+        default:
+          typeProps = {
+            algorithmProperties: {
+              primitive: g.discriminator,
+              parameterSetIdentifier: g.algorithm,
+              executionEnvironment: "software-plain-ram",
+              classicalSecurityLevel: classicalSecurityLevelFor(g.algorithm),
+              nistQuantumSecurityLevel: 0,
+              cryptoFunctions:
+                g.discriminator === "signature"
+                  ? ["sign", "verify"]
+                  : g.discriminator === "kem"
+                    ? ["encapsulate", "decapsulate"]
+                    : // CycloneDX 1.6 has no "keyagree" cryptoFunction; "other" is
+                      // the valid value for a key-agreement primitive.
+                      ["other"],
+            },
+          };
+          label = g.discriminator;
+          break;
+      }
+
       return {
         type: "cryptographic-asset" as const,
         "bom-ref": bomRef(key),
-        name: `${g.algorithm} (${g.primitive})`,
+        name: `${g.algorithm} (${label})`,
         cryptoProperties: {
-          assetType: "algorithm",
-          algorithmProperties: {
-            primitive: g.primitive,
-            parameterSetIdentifier: g.algorithm,
-            executionEnvironment: "software-plain-ram",
-            classicalSecurityLevel: classicalSecurityLevelFor(g.algorithm),
-            nistQuantumSecurityLevel: 0,
-            cryptoFunctions:
-              g.primitive === "signature"
-                ? ["sign", "verify"]
-                : g.primitive === "kem"
-                  ? ["encapsulate", "decapsulate"]
-                  : g.primitive === "key-agree"
-                    ? ["keyagree"]
-                    : ["other"],
-          },
-          quantumVulnerable: isQuantumVulnerable(g.algorithm),
-          harvestNowDecryptLater: anyHndl,
+          assetType: g.assetType,
+          ...typeProps,
         },
+        // The quantum posture flags are carried as CycloneDX component `properties`
+        // (an open name/value list) rather than inside `cryptoProperties`, whose
+        // 1.6 schema is `additionalProperties: false` — so a strict validator
+        // accepts the BOM. Namespaced to avoid clashing with other tools' keys.
+        properties: [
+          {
+            name: "quantakrypto:quantumVulnerable",
+            value: String(isQuantumVulnerable(g.algorithm)),
+          },
+          { name: "quantakrypto:harvestNowDecryptLater", value: String(anyHndl) },
+        ],
         evidence: { occurrences },
       };
     });
@@ -190,12 +298,18 @@ export function toCbom(result: ScanResult): CycloneDxBom {
 
 /**
  * Derive a stable UUID-shaped serial from the scan result so re-exporting the
- * same result yields the same serial number (deterministic output).
+ * same result yields the same serial number (deterministic output). Hashed over the
+ * actual finding set (ruleId + location per finding), NOT just the COUNT — two scans
+ * with the same number of totally different findings must not collide, since a
+ * CycloneDX serialNumber identifies a specific BOM instance. Findings are already in
+ * a stable order (scan.ts sorts by file/line/ruleId).
  */
 function stableUuid(result: ScanResult): string {
-  const h = createHash("sha256")
-    .update(`${result.root}|${result.toolVersion}|${result.findings.length}`, "utf8")
-    .digest("hex");
+  const hash = createHash("sha256").update(`${result.root}|${result.toolVersion}`, "utf8");
+  for (const f of result.findings) {
+    hash.update(`\n${f.ruleId}@${f.location.file}:${f.location.line}:${f.location.column ?? 0}`);
+  }
+  const h = hash.digest("hex");
   // Shape as a v4-ish UUID (variant/version nibbles forced).
   return `${h.slice(0, 8)}-${h.slice(8, 12)}-4${h.slice(13, 16)}-8${h.slice(17, 20)}-${h.slice(20, 32)}`;
 }