@quantakrypto/core 0.4.3 → 0.5.0

package/dist/detectors/codesign.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Config detector: classical **code-signing CLI** invocations in build scripts —
+ * the tools that sign long-lived, distributable artifacts (Windows installers,
+ * Android APKs, RPM/deb packages, NuGet packages, macOS apps) with a classical
+ * RSA/ECDSA signing identity.
+ *
+ * Why this is quantum-migration debt: a code signature produced today keeps
+ * verifying against its classical public key for the life of the artifact
+ * (installers and packages linger on mirrors and machines for years). Once a
+ * cryptographically-relevant quantum computer (CRQC) can recover the signing
+ * key from that public key, every such signature becomes *forgeable* — an
+ * attacker can mint a validly-signed trojaned installer. This is the
+ * signature-side analogue of harvest-now-decrypt-later: there is no
+ * confidentiality to harvest, so findings are `category:"signature"`,
+ * `hndl:false`, but they are real debt to inventory now.
+ *
+ * How this differs from the two neighbouring signing detectors — kept
+ * deliberately non-overlapping:
+ *
+ *  - `cicd.ts` (cicdDetector) is gated to CI *pipeline* files
+ *    (`.github/workflows/*.yml`, `.gitlab-ci.yml`, Jenkinsfile, azure-pipelines,
+ *    CircleCI) and matches the release-automation signers there
+ *    (cosign / gpg / jarsigner / codesign / minisign). It intentionally does
+ *    NOT fire on a plain `build.sh`, `build.ps1`, `build.gradle`, or Makefile.
+ *  - `supply-chain.ts` (supplyChainDetector) covers container/artifact signing
+ *    (Docker Content Trust, CNCF Notation, in-toto) in CI files, Dockerfiles,
+ *    and shell scripts.
+ *
+ * This detector fills the gap: the *native platform* code-signing CLIs
+ * (`signtool`, `osslsigncode`, `Set-AuthenticodeSignature`, `apksigner`, Gradle
+ * `signingConfigs`, `rpmsign`/`dpkg-sig`, `nuget sign`, `notarytool`) as they
+ * appear in a build script of ANY extension — because that is where developers
+ * actually run them. It applies everywhere except documentation
+ * (a README showing `signtool sign` is prose, not a build step). One token
+ * (`codesign`) can also be matched by `cicd.ts` when it appears inside a CI
+ * file; a duplicate finding across the two detectors is acceptable, and keeping
+ * `codesign` here means a `codesign --sign` in a hand-written `build.sh` — which
+ * `cicd.ts`'s CI-file gate deliberately skips — is still caught.
+ *
+ * Precision comes from two gates, mirroring `dnssec.ts`: a cheap file-level
+ * fast-reject (bail unless some signing-command marker is present) and
+ * comment-line masking (`#` for shell/PowerShell/Makefile/Gradle, `//` for
+ * Gradle/Groovy) so a commented-out signing step never fires. The rule regexes
+ * themselves key on distinctive `<tool> sign` command shapes, so the residual
+ * false-positive risk is low and confidence is `high`.
+ */
+import type { Detector } from "../types.js";
+/** Detects classical code-signing CLI invocations in build scripts. */
+export declare const codesignDetector: Detector;
+//# sourceMappingURL=codesign.d.ts.map

package/dist/detectors/codesign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codesign.d.ts","sourceRoot":"","sources":["../../src/detectors/codesign.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAwI/D,uEAAuE;AACvE,eAAO,MAAM,gBAAgB,EAAE,QA8B9B,CAAC"}

package/dist/detectors/codesign.js

@@ -0,0 +1,143 @@
+import { eachMatch, findingFromRule, hasExtension, maskCommentLines, DOC_EXTENSIONS, } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+/** Shared one-line explanation, parameterised by the signing tool named in the finding. */
+function signMessage(tool) {
+    return (`${tool} signs an artifact with a classical RSA/ECDSA key; the signature is ` +
+        `forgeable once a CRQC can recover the signing key — inventory the signing ` +
+        `identity and plan PQC migration.`);
+}
+/** Shared remediation: no PQC code-signing format is broadly standardized yet. */
+const REMEDIATION = "No PQC code-signing format is broadly standardized yet; track platform roadmaps " +
+    "(e.g. Sigstore/PQC, Authenticode); keep signing-key rotation ready.";
+/**
+ * Distinctive markers for the file-level fast-reject. Kept as a SUPERSET of the
+ * rule tokens below so the cheap gate can never exclude a file one of the rules
+ * would match: it includes every rule's trigger token (`--addsign`, `%_gpg_name`,
+ * `codesign`, `nuget`, …), not only the headline command names.
+ */
+const MARKER_RE = /signtool|osslsigncode|AuthenticodeSignature|apksigner|signingConfigs|rpmsign|--addsign|%_gpg_name|dpkg-sig|nuget|notarytool|codesign/;
+const CS_RULES = [
+    {
+        // Windows Authenticode: `signtool sign …` (optionally `signtool.exe`),
+        // `osslsigncode sign …`, or the PowerShell `Set-AuthenticodeSignature` cmdlet.
+        re: /\bsigntool(?:\.exe)?\s+sign\b|\bosslsigncode\s+sign\b|\bSet-AuthenticodeSignature\b/g,
+        meta: {
+            id: "codesign-authenticode",
+            title: "Windows Authenticode code signing (RSA)",
+            description: "signtool / osslsigncode / Set-AuthenticodeSignature Authenticode signing",
+            category: "signature",
+            severity: "medium",
+            confidence: "high",
+            algorithm: "RSA",
+            hndl: false,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: signMessage("Windows Authenticode (signtool/osslsigncode/Set-AuthenticodeSignature)"),
+            remediation: REMEDIATION,
+        },
+    },
+    {
+        // Android: `apksigner sign …` (covers `--ks` / `--ks-key-alias` forms), or a
+        // Gradle `signingConfigs { … }` block (which carries `storeFile`/`keyAlias`).
+        re: /\bapksigner\s+sign\b|\bsigningConfigs\s*\{/g,
+        meta: {
+            id: "codesign-apk",
+            title: "Android APK signing (RSA)",
+            description: "apksigner / Gradle signingConfigs APK signing",
+            category: "signature",
+            severity: "medium",
+            confidence: "high",
+            algorithm: "RSA",
+            hndl: false,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: signMessage("Android APK signing (apksigner/Gradle signingConfigs)"),
+            remediation: REMEDIATION,
+        },
+    },
+    {
+        // RPM/deb: `rpmsign --addsign`, `rpm --addsign`, the `%_gpg_name` rpmmacro, or
+        // `dpkg-sig --sign`. All ultimately GPG (classically RSA) signatures.
+        re: /\brpmsign\s+--addsign\b|\brpm\s+--addsign\b|%_gpg_name\b|\bdpkg-sig\s+--sign\b/g,
+        meta: {
+            id: "codesign-rpm",
+            title: "RPM/deb package signing (RSA)",
+            description: "rpmsign / rpm --addsign / %_gpg_name / dpkg-sig package signing",
+            category: "signature",
+            severity: "medium",
+            confidence: "high",
+            algorithm: "RSA",
+            hndl: false,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: signMessage("RPM/deb package signing (rpmsign/rpm --addsign/dpkg-sig, GPG)"),
+            remediation: REMEDIATION,
+        },
+    },
+    {
+        // NuGet: `nuget sign …` — also matches `dotnet nuget sign …` (the `nuget sign`
+        // token is a substring of it), typically paired with `--certificate-*` flags.
+        re: /\bnuget\s+sign\b/g,
+        meta: {
+            id: "codesign-nuget",
+            title: "NuGet package signing (RSA)",
+            description: "nuget sign / dotnet nuget sign package signing",
+            category: "signature",
+            severity: "medium",
+            confidence: "high",
+            algorithm: "RSA",
+            hndl: false,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: signMessage("NuGet package signing (nuget sign/dotnet nuget sign)"),
+            remediation: REMEDIATION,
+        },
+    },
+    {
+        // Apple: `xcrun notarytool submit …`, or `codesign --sign` / `codesign -s`.
+        // Allow intervening flags before `--sign`/`-s`, bounded to the codesign
+        // invocation so it can't latch onto a later command's flag across `&&`/`|`/`;`
+        // (same shape as cicd.ts's codesign rule). Algorithm is "unknown": an Apple
+        // signing identity may be RSA or ECDSA.
+        re: /\bnotarytool\s+submit\b|\bcodesign\b[^\n&|;]{0,120}?\s(?:-s\b|--sign\b)/g,
+        meta: {
+            id: "codesign-apple",
+            title: "Apple code signing / notarization",
+            description: "codesign --sign / xcrun notarytool submit macOS signing",
+            category: "signature",
+            severity: "medium",
+            confidence: "high",
+            algorithm: "unknown",
+            hndl: false,
+            cwe: CWE_BROKEN_CRYPTO,
+            message: signMessage("Apple code signing (codesign/notarytool)"),
+            remediation: REMEDIATION,
+        },
+    },
+];
+/** Detects classical code-signing CLI invocations in build scripts. */
+export const codesignDetector = {
+    id: "codesign-signing",
+    description: "Classical code-signing CLIs in build scripts (Authenticode, APK, RPM, NuGet, Apple)",
+    scope: "config",
+    language: "any",
+    rules: CS_RULES.map((r) => r.meta),
+    // Applies to build scripts of any extension EXCEPT documentation: a README that
+    // shows `signtool sign` in an example is prose, not a build step.
+    appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),
+    detect({ file, content }) {
+        // Cheap fast-reject: bail unless some signing-command marker is present, so
+        // the per-rule regexes never run on the overwhelming majority of files.
+        if (!MARKER_RE.test(content))
+            return [];
+        // Mask whole comment lines so a commented-out signing step can't fire.
+        // `#` covers shell / PowerShell / Makefile / Gradle(Groovy & Kotlin DSL);
+        // `//` covers Gradle/Groovy. Offsets are preserved so finding locations stay
+        // exact (see maskCommentLines).
+        const scan = maskCommentLines(content, ["#", "//"]);
+        const findings = [];
+        for (const rule of CS_RULES) {
+            eachMatch(rule.re, scan, (m) => {
+                findings.push(findingFromRule(rule.meta, { file, content, index: m.index, matchLength: m[0].length }));
+            });
+        }
+        return findings;
+    },
+};
+//# sourceMappingURL=codesign.js.map

package/dist/detectors/codesign.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codesign.js","sourceRoot":"","sources":["../../src/detectors/codesign.ts"],"names":[],"mappings":"AA+CA,OAAO,EACL,SAAS,EACT,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,cAAc,GACf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,2FAA2F;AAC3F,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,CACL,GAAG,IAAI,sEAAsE;QAC7E,4EAA4E;QAC5E,kCAAkC,CACnC,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,WAAW,GACf,kFAAkF;IAClF,qEAAqE,CAAC;AAExE;;;;;GAKG;AACH,MAAM,SAAS,GACb,sIAAsI,CAAC;AAOzI,MAAM,QAAQ,GAAa;IACzB;QACE,uEAAuE;QACvE,+EAA+E;QAC/E,EAAE,EAAE,sFAAsF;QAC1F,IAAI,EAAE;YACJ,EAAE,EAAE,uBAAuB;YAC3B,KAAK,EAAE,yCAAyC;YAChD,WAAW,EAAE,0EAA0E;YACvF,QAAQ,EAAE,WAAW;YACrB,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,OAAO,EAAE,WAAW,CAClB,wEAAwE,CACzE;YACD,WAAW,EAAE,WAAW;SACzB;KACF;IACD;QACE,6EAA6E;QAC7E,8EAA8E;QAC9E,EAAE,EAAE,6CAA6C;QACjD,IAAI,EAAE;YACJ,EAAE,EAAE,cAAc;YAClB,KAAK,EAAE,2BAA2B;YAClC,WAAW,EAAE,+CAA+C;YAC5D,QAAQ,EAAE,WAAW;YACrB,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,OAAO,EAAE,WAAW,CAAC,uDAAuD,CAAC;YAC7E,WAAW,EAAE,WAAW;SACzB;KACF;IACD;QACE,+EAA+E;QAC/E,sEAAsE;QACtE,EAAE,EAAE,iFAAiF;QACrF,IAAI,EAAE;YACJ,EAAE,EAAE,cAAc;YAClB,KAAK,EAAE,+BAA+B;YACtC,WAAW,EAAE,iEAAiE;YAC9E,QAAQ,EAAE,WAAW;YACrB,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,OAAO,EAAE,WAAW,CAAC,+DAA+D,CAAC;YACrF,WAAW,EAAE,WAAW;SACzB;KACF;IACD;QACE,+EAA+E;QAC/E,8EAA8E;QAC9E,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE;YACJ,EAAE,EAAE,gBAAgB;YACpB,KAAK,EAAE,6BAA6B;YACpC,WAAW,EAAE,gDAAgD;YAC7D,QAAQ,EAAE,WAAW;YACrB,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,KAAK;YAChB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,OAAO,EAAE,WAAW,CAAC,sDAAsD,CAAC;YAC5E,WAAW,EAAE,WAAW;SACzB;KACF;IACD;QACE,4EAA4E;QAC5E,wEAAwE;QACxE,+EAA+E;QAC/E,4EAA4E;QAC5E,wCAAwC;QACxC,EAAE,EAAE,0EAA0E;QAC9E,IAAI,EAAE;YACJ,EAAE,EAAE,gBAAgB;YACpB,KAAK,EAAE,mCAAmC;YAC1C,WAAW,EAAE,yDAAyD;YACtE,QAAQ,EAAE,WAAW;YACrB,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,MAAM;YAClB,SAAS,EAAE,SAAS;YACpB,IAAI,EAAE,KAAK;YACX,GAAG,EAAE,iBAAiB;YACtB,OAAO,EAAE,WAAW,CAAC,0CAA0C,CAAC;YAChE,WAAW,EAAE,WAAW;SACzB;KACF;CACF,CAAC;AAEF,uEAAuE;AACvE,MAAM,CAAC,MAAM,gBAAgB,GAAa;IACxC,EAAE,EAAE,kBAAkB;IACtB,WAAW,EACT,qFAAqF;IACvF,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAClC,gFAAgF;IAChF,kEAAkE;IAClE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,cAAc,CAAC;IAClD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,4EAA4E;QAC5E,wEAAwE;QACxE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;QAExC,uEAAuE;QACvE,0EAA0E;QAC1E,6EAA6E;QAC7E,gCAAgC;QAChC,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE;gBAC7B,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACxF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC","sourcesContent":["/**\n * Config detector: classical **code-signing CLI** invocations in build scripts —\n * the tools that sign long-lived, distributable artifacts (Windows installers,\n * Android APKs, RPM/deb packages, NuGet packages, macOS apps) with a classical\n * RSA/ECDSA signing identity.\n *\n * Why this is quantum-migration debt: a code signature produced today keeps\n * verifying against its classical public key for the life of the artifact\n * (installers and packages linger on mirrors and machines for years). Once a\n * cryptographically-relevant quantum computer (CRQC) can recover the signing\n * key from that public key, every such signature becomes *forgeable* — an\n * attacker can mint a validly-signed trojaned installer. This is the\n * signature-side analogue of harvest-now-decrypt-later: there is no\n * confidentiality to harvest, so findings are `category:\"signature\"`,\n * `hndl:false`, but they are real debt to inventory now.\n *\n * How this differs from the two neighbouring signing detectors — kept\n * deliberately non-overlapping:\n *\n *  - `cicd.ts` (cicdDetector) is gated to CI *pipeline* files\n *    (`.github/workflows/*.yml`, `.gitlab-ci.yml`, Jenkinsfile, azure-pipelines,\n *    CircleCI) and matches the release-automation signers there\n *    (cosign / gpg / jarsigner / codesign / minisign). It intentionally does\n *    NOT fire on a plain `build.sh`, `build.ps1`, `build.gradle`, or Makefile.\n *  - `supply-chain.ts` (supplyChainDetector) covers container/artifact signing\n *    (Docker Content Trust, CNCF Notation, in-toto) in CI files, Dockerfiles,\n *    and shell scripts.\n *\n * This detector fills the gap: the *native platform* code-signing CLIs\n * (`signtool`, `osslsigncode`, `Set-AuthenticodeSignature`, `apksigner`, Gradle\n * `signingConfigs`, `rpmsign`/`dpkg-sig`, `nuget sign`, `notarytool`) as they\n * appear in a build script of ANY extension — because that is where developers\n * actually run them. It applies everywhere except documentation\n * (a README showing `signtool sign` is prose, not a build step). One token\n * (`codesign`) can also be matched by `cicd.ts` when it appears inside a CI\n * file; a duplicate finding across the two detectors is acceptable, and keeping\n * `codesign` here means a `codesign --sign` in a hand-written `build.sh` — which\n * `cicd.ts`'s CI-file gate deliberately skips — is still caught.\n *\n * Precision comes from two gates, mirroring `dnssec.ts`: a cheap file-level\n * fast-reject (bail unless some signing-command marker is present) and\n * comment-line masking (`#` for shell/PowerShell/Makefile/Gradle, `//` for\n * Gradle/Groovy) so a commented-out signing step never fires. The rule regexes\n * themselves key on distinctive `<tool> sign` command shapes, so the residual\n * false-positive risk is low and confidence is `high`.\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport {\n  eachMatch,\n  findingFromRule,\n  hasExtension,\n  maskCommentLines,\n  DOC_EXTENSIONS,\n} from \"../detect-utils.js\";\nimport { CWE_BROKEN_CRYPTO } from \"../cwe.js\";\n\n/** Shared one-line explanation, parameterised by the signing tool named in the finding. */\nfunction signMessage(tool: string): string {\n  return (\n    `${tool} signs an artifact with a classical RSA/ECDSA key; the signature is ` +\n    `forgeable once a CRQC can recover the signing key — inventory the signing ` +\n    `identity and plan PQC migration.`\n  );\n}\n\n/** Shared remediation: no PQC code-signing format is broadly standardized yet. */\nconst REMEDIATION =\n  \"No PQC code-signing format is broadly standardized yet; track platform roadmaps \" +\n  \"(e.g. Sigstore/PQC, Authenticode); keep signing-key rotation ready.\";\n\n/**\n * Distinctive markers for the file-level fast-reject. Kept as a SUPERSET of the\n * rule tokens below so the cheap gate can never exclude a file one of the rules\n * would match: it includes every rule's trigger token (`--addsign`, `%_gpg_name`,\n * `codesign`, `nuget`, …), not only the headline command names.\n */\nconst MARKER_RE =\n  /signtool|osslsigncode|AuthenticodeSignature|apksigner|signingConfigs|rpmsign|--addsign|%_gpg_name|dpkg-sig|nuget|notarytool|codesign/;\n\ninterface CsRule {\n  re: RegExp;\n  meta: RuleMeta;\n}\n\nconst CS_RULES: CsRule[] = [\n  {\n    // Windows Authenticode: `signtool sign …` (optionally `signtool.exe`),\n    // `osslsigncode sign …`, or the PowerShell `Set-AuthenticodeSignature` cmdlet.\n    re: /\\bsigntool(?:\\.exe)?\\s+sign\\b|\\bosslsigncode\\s+sign\\b|\\bSet-AuthenticodeSignature\\b/g,\n    meta: {\n      id: \"codesign-authenticode\",\n      title: \"Windows Authenticode code signing (RSA)\",\n      description: \"signtool / osslsigncode / Set-AuthenticodeSignature Authenticode signing\",\n      category: \"signature\",\n      severity: \"medium\",\n      confidence: \"high\",\n      algorithm: \"RSA\",\n      hndl: false,\n      cwe: CWE_BROKEN_CRYPTO,\n      message: signMessage(\n        \"Windows Authenticode (signtool/osslsigncode/Set-AuthenticodeSignature)\",\n      ),\n      remediation: REMEDIATION,\n    },\n  },\n  {\n    // Android: `apksigner sign …` (covers `--ks` / `--ks-key-alias` forms), or a\n    // Gradle `signingConfigs { … }` block (which carries `storeFile`/`keyAlias`).\n    re: /\\bapksigner\\s+sign\\b|\\bsigningConfigs\\s*\\{/g,\n    meta: {\n      id: \"codesign-apk\",\n      title: \"Android APK signing (RSA)\",\n      description: \"apksigner / Gradle signingConfigs APK signing\",\n      category: \"signature\",\n      severity: \"medium\",\n      confidence: \"high\",\n      algorithm: \"RSA\",\n      hndl: false,\n      cwe: CWE_BROKEN_CRYPTO,\n      message: signMessage(\"Android APK signing (apksigner/Gradle signingConfigs)\"),\n      remediation: REMEDIATION,\n    },\n  },\n  {\n    // RPM/deb: `rpmsign --addsign`, `rpm --addsign`, the `%_gpg_name` rpmmacro, or\n    // `dpkg-sig --sign`. All ultimately GPG (classically RSA) signatures.\n    re: /\\brpmsign\\s+--addsign\\b|\\brpm\\s+--addsign\\b|%_gpg_name\\b|\\bdpkg-sig\\s+--sign\\b/g,\n    meta: {\n      id: \"codesign-rpm\",\n      title: \"RPM/deb package signing (RSA)\",\n      description: \"rpmsign / rpm --addsign / %_gpg_name / dpkg-sig package signing\",\n      category: \"signature\",\n      severity: \"medium\",\n      confidence: \"high\",\n      algorithm: \"RSA\",\n      hndl: false,\n      cwe: CWE_BROKEN_CRYPTO,\n      message: signMessage(\"RPM/deb package signing (rpmsign/rpm --addsign/dpkg-sig, GPG)\"),\n      remediation: REMEDIATION,\n    },\n  },\n  {\n    // NuGet: `nuget sign …` — also matches `dotnet nuget sign …` (the `nuget sign`\n    // token is a substring of it), typically paired with `--certificate-*` flags.\n    re: /\\bnuget\\s+sign\\b/g,\n    meta: {\n      id: \"codesign-nuget\",\n      title: \"NuGet package signing (RSA)\",\n      description: \"nuget sign / dotnet nuget sign package signing\",\n      category: \"signature\",\n      severity: \"medium\",\n      confidence: \"high\",\n      algorithm: \"RSA\",\n      hndl: false,\n      cwe: CWE_BROKEN_CRYPTO,\n      message: signMessage(\"NuGet package signing (nuget sign/dotnet nuget sign)\"),\n      remediation: REMEDIATION,\n    },\n  },\n  {\n    // Apple: `xcrun notarytool submit …`, or `codesign --sign` / `codesign -s`.\n    // Allow intervening flags before `--sign`/`-s`, bounded to the codesign\n    // invocation so it can't latch onto a later command's flag across `&&`/`|`/`;`\n    // (same shape as cicd.ts's codesign rule). Algorithm is \"unknown\": an Apple\n    // signing identity may be RSA or ECDSA.\n    re: /\\bnotarytool\\s+submit\\b|\\bcodesign\\b[^\\n&|;]{0,120}?\\s(?:-s\\b|--sign\\b)/g,\n    meta: {\n      id: \"codesign-apple\",\n      title: \"Apple code signing / notarization\",\n      description: \"codesign --sign / xcrun notarytool submit macOS signing\",\n      category: \"signature\",\n      severity: \"medium\",\n      confidence: \"high\",\n      algorithm: \"unknown\",\n      hndl: false,\n      cwe: CWE_BROKEN_CRYPTO,\n      message: signMessage(\"Apple code signing (codesign/notarytool)\"),\n      remediation: REMEDIATION,\n    },\n  },\n];\n\n/** Detects classical code-signing CLI invocations in build scripts. */\nexport const codesignDetector: Detector = {\n  id: \"codesign-signing\",\n  description:\n    \"Classical code-signing CLIs in build scripts (Authenticode, APK, RPM, NuGet, Apple)\",\n  scope: \"config\",\n  language: \"any\",\n  rules: CS_RULES.map((r) => r.meta),\n  // Applies to build scripts of any extension EXCEPT documentation: a README that\n  // shows `signtool sign` in an example is prose, not a build step.\n  appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),\n  detect({ file, content }): Finding[] {\n    // Cheap fast-reject: bail unless some signing-command marker is present, so\n    // the per-rule regexes never run on the overwhelming majority of files.\n    if (!MARKER_RE.test(content)) return [];\n\n    // Mask whole comment lines so a commented-out signing step can't fire.\n    // `#` covers shell / PowerShell / Makefile / Gradle(Groovy & Kotlin DSL);\n    // `//` covers Gradle/Groovy. Offsets are preserved so finding locations stay\n    // exact (see maskCommentLines).\n    const scan = maskCommentLines(content, [\"#\", \"//\"]);\n    const findings: Finding[] = [];\n    for (const rule of CS_RULES) {\n      eachMatch(rule.re, scan, (m) => {\n        findings.push(\n          findingFromRule(rule.meta, { file, content, index: m.index, matchLength: m[0].length }),\n        );\n      });\n    }\n    return findings;\n  },\n};\n"]}

package/dist/detectors/csharp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"csharp.d.ts","sourceRoot":"","sources":["../../src/detectors/csharp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AA8L/D,gFAAgF;AAChF,eAAO,MAAM,cAAc,EAAE,QA8C5B,CAAC"}
+{"version":3,"file":"csharp.d.ts","sourceRoot":"","sources":["../../src/detectors/csharp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAwM/D,gFAAgF;AAChF,eAAO,MAAM,cAAc,EAAE,QA8C5B,CAAC"}

package/dist/detectors/csharp.js

@@ -12,13 +12,23 @@ const RE_CS_DSA = /\bDSA\.Create\s*\(|\bnew\s+DSACryptoServiceProvider\s*\(|\bne
 //   - SslProtocols.Ssl3 / .Tls / .Tls11 → deprecated SSL 3.0 / TLS 1.0 / 1.1.
 // `SslProtocols.Tls` (no suffix) is the legacy TLS 1.0 constant; `Tls12`/`Tls13`
 // are excluded by the trailing \b (the following digit is a word char).
-const RE_CS_TLS_CERT_VALIDATION = /\bDangerousAcceptAnyServerCertificateValidator\b|ServerCertificateCustomValidationCallback\s*=/g;
+// Only the genuinely-permissive forms: the built-in accept-any validator, or a
+// callback assigned an always-`true` lambda. A callback assigned a NAMED validator
+// method is typically certificate PINNING (stricter than default) and must NOT fire.
+// An accept-any server-certificate callback: the BouncyCastle helper, or a
+// ServerCertificateCustomValidationCallback that unconditionally yields `true` — as an
+// expression lambda (`=> true`), a block-body lambda (`=> { return true; }`), or a
+// `delegate { return true; }`. Requiring a literal `true` (not just any `=>`) keeps
+// certificate PINNING — which returns a comparison, `=> cert.Thumbprint == pinned` —
+// from being flagged as a disabled validator.
+const RE_CS_TLS_CERT_VALIDATION = /\bDangerousAcceptAnyServerCertificateValidator\b|ServerCertificateCustomValidationCallback\s*=\s*(?:[^;\n]{0,80}=>\s*(?:true\b|\{\s*return\s+true\b)|delegate\s*(?:\([^)]{0,80}\))?\s*\{\s*return\s+true\b)/g;
 const RE_CS_TLS_LEGACY_VERSION = /\bSslProtocols\.(?:Tls|Tls11|Ssl3)\b/g;
 // Identifier-form JWT/JOSE signature algorithms (audit F7). The quoted-string
 // alg token ("RS256") is caught by the language-agnostic jwt-jose detector, but
 // Microsoft.IdentityModel passes the alg as an IDENTIFIER, not a string literal:
-// SecurityAlgorithms.RsaSha256 / SecurityAlgorithms.EcdsaSha256.
-const RE_CS_JWT_ALG = /\bSecurityAlgorithms\.(?:Rsa|Ecdsa)Sha(?:256|384|512)\b/g;
+// SecurityAlgorithms.RsaSha256 / SecurityAlgorithms.EcdsaSha256, and the
+// `…Signature`-suffixed constants used in SigningCredentials (RsaSha256Signature).
+const RE_CS_JWT_ALG = /\bSecurityAlgorithms\.(?:Rsa|Ecdsa)Sha(?:256|384|512)(?:Signature)?\b/g;
 // BouncyCastle (Org.BouncyCastle) modern-curve and finite-field DH primitives,
 // which System.Security.Cryptography does not expose directly. Each regex is
 // anchored to the distinctive BouncyCastle class names for one family so it

package/dist/detectors/csharp.js.map

@@ -1 +1 @@
-{"version":3,"file":"csharp.js","sourceRoot":"","sources":["../../src/detectors/csharp.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACjG,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEtF,MAAM,SAAS,GACb,uGAAuG,CAAC;AAC1G,MAAM,WAAW,GAAG,uEAAuE,CAAC;AAC5F,MAAM,UAAU,GACd,qGAAqG,CAAC;AACxG,MAAM,SAAS,GAAG,+EAA+E,CAAC;AAClG,gFAAgF;AAChF,iFAAiF;AACjF,0DAA0D;AAC1D,8DAA8D;AAC9D,2EAA2E;AAC3E,8EAA8E;AAC9E,iFAAiF;AACjF,wEAAwE;AACxE,MAAM,yBAAyB,GAC7B,iGAAiG,CAAC;AACpG,MAAM,wBAAwB,GAAG,uCAAuC,CAAC;AACzE,8EAA8E;AAC9E,gFAAgF;AAChF,iFAAiF;AACjF,iEAAiE;AACjE,MAAM,aAAa,GAAG,0DAA0D,CAAC;AACjF,+EAA+E;AAC/E,6EAA6E;AAC7E,4EAA4E;AAC5E,0CAA0C;AAC1C,oFAAoF;AACpF,qFAAqF;AACrF,6EAA6E;AAC7E,+FAA+F;AAC/F,+EAA+E;AAC/E,4EAA4E;AAC5E,MAAM,cAAc,GAAG,8DAA8D,CAAC;AACtF,MAAM,eAAe,GAAG,gEAAgE,CAAC;AACzF,MAAM,aAAa,GAAG,8DAA8D,CAAC;AACrF,MAAM,WAAW,GACf,iGAAiG,CAAC;AAEpG,MAAM,WAAW,GAAa;IAC5B,EAAE,EAAE,YAAY;IAChB,KAAK,EAAE,kBAAkB;IACzB,WAAW,EAAE,6EAA6E;IAC1F,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,8EAA8E;CACxF,CAAC;AACF,MAAM,aAAa,GAAa;IAC9B,EAAE,EAAE,cAAc;IAClB,KAAK,EAAE,oBAAoB;IAC3B,WAAW,EAAE,sDAAsD;IACnE,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,oEAAoE;IAC7E,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,YAAY,GAAa;IAC7B,EAAE,EAAE,aAAa;IACjB,KAAK,EAAE,uBAAuB;IAC9B,WAAW,EAAE,0EAA0E;IACvF,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,iGAAiG;CACpG,CAAC;AACF,MAAM,WAAW,GAAa;IAC5B,EAAE,EAAE,YAAY;IAChB,KAAK,EAAE,sBAAsB;IAC7B,WAAW,EAAE,oEAAoE;IACjF,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,yEAAyE;IAClF,WAAW,EAAE,qDAAqD;CACnE,CAAC;AACF,MAAM,gBAAgB,GAAa;IACjC,EAAE,EAAE,4BAA4B;IAChC,KAAK,EAAE,0CAA0C;IACjD,WAAW,EACT,mGAAmG;IACrG,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,mBAAmB;IACxB,OAAO,EAAE,qFAAqF;IAC9F,WAAW,EACT,+FAA+F;CAClG,CAAC;AACF,MAAM,kBAAkB,GAAa;IACnC,EAAE,EAAE,2BAA2B;IAC/B,KAAK,EAAE,kCAAkC;IACzC,WAAW,EAAE,iDAAiD;IAC9D,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,yFAAyF;IAC3F,WAAW,EAAE,uEAAuE;CACrF,CAAC;AACF,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,uCAAuC;IAC9C,WAAW,EAAE,gEAAgE;IAC7E,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,SAAS;IACpB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,4GAA4G;IAC9G,WAAW,EAAE,2DAA2D;CACzE,CAAC;AACF,MAAM,gBAAgB,GAAa;IACjC,EAAE,EAAE,2BAA2B;IAC/B,KAAK,EAAE,qCAAqC;IAC5C,WAAW,EACT,wFAAwF;IAC1F,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,8EAA8E;IACvF,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,iBAAiB,GAAa;IAClC,EAAE,EAAE,4BAA4B;IAChC,KAAK,EAAE,wCAAwC;IAC/C,WAAW,EACT,wFAAwF;IAC1F,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,QAAQ;IACnB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,+GAA+G;CAClH,CAAC;AACF,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,0BAA0B;IAC9B,KAAK,EAAE,sCAAsC;IAC7C,WAAW,EAAE,kFAAkF;IAC/F,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,6GAA6G;CAChH,CAAC;AACF,MAAM,aAAa,GAAa;IAC9B,EAAE,EAAE,wBAAwB;IAC5B,KAAK,EAAE,+CAA+C;IACtD,WAAW,EACT,+FAA+F;IACjG,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,IAAI;IACf,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,uGAAuG;CAC1G,CAAC;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAa;IACtC,EAAE,EAAE,eAAe;IACnB,WAAW,EACT,+FAA+F;IACjG,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,QAAQ;IAClB,KAAK,EAAE;QACL,WAAW;QACX,aAAa;QACb,YAAY;QACZ,WAAW;QACX,gBAAgB;QAChB,kBAAkB;QAClB,eAAe;QACf,gBAAgB;QAChB,iBAAiB;QACjB,eAAe;QACf,aAAa;KACd;IACD,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,iBAAiB,CAAC;IACpD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,IAAc,EAAE,EAAE,CACzC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAC3B,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACnF,CACF,CAAC;QACJ,gEAAgE;QAChE,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAChC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAC9B,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC5B,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC5B,yEAAyE;QACzE,GAAG,CAAC,yBAAyB,EAAE,gBAAgB,CAAC,CAAC;QACjD,GAAG,CAAC,wBAAwB,EAAE,kBAAkB,CAAC,CAAC;QAClD,2EAA2E;QAC3E,GAAG,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QACpC,0EAA0E;QAC1E,yDAAyD;QACzD,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;QACtC,GAAG,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QACxC,GAAG,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QACpC,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAChC,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC","sourcesContent":["/**\n * Source-code detector for classical asymmetric cryptography in C# / .NET\n * (`System.Security.Cryptography`). Same lexical strategy as the other packs.\n * .NET exposes each algorithm through a factory (`RSA.Create()`,\n * `ECDsa.Create()`, `ECDiffieHellman.Create()`) or a concrete CSP/CNG class\n * (`RSACryptoServiceProvider`, `ECDsaCng`, …), all of which are precise signals.\n *\n * HNDL: RSA (keygen/encryption) and (EC)DH key agreement are harvest-now-\n * decrypt-later exposed (hndl:true); ECDSA/DSA signatures are hndl:false but\n * forgeable by a quantum attacker.\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport { CSHARP_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from \"../detect-utils.js\";\nimport { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION, CWE_WEAK_STRENGTH } from \"../cwe.js\";\n\nconst RE_CS_RSA =\n  /\\bRSA\\.Create\\s*\\(|\\bnew\\s+RSACryptoServiceProvider\\s*\\(|\\bnew\\s+RSACng\\s*\\(|\\bnew\\s+RSAOpenSsl\\s*\\(/g;\nconst RE_CS_ECDSA = /\\bECDsa\\.Create\\s*\\(|\\bnew\\s+ECDsaCng\\s*\\(|\\bnew\\s+ECDsaOpenSsl\\s*\\(/g;\nconst RE_CS_ECDH =\n  /\\bECDiffieHellman\\.Create\\s*\\(|\\bnew\\s+ECDiffieHellmanCng\\s*\\(|\\bnew\\s+ECDiffieHellmanOpenSsl\\s*\\(/g;\nconst RE_CS_DSA = /\\bDSA\\.Create\\s*\\(|\\bnew\\s+DSACryptoServiceProvider\\s*\\(|\\bnew\\s+DSACng\\s*\\(/g;\n// Insecure TLS configuration (.NET). Mirrors source.ts's tlsDetector split of a\n// cert-verification-disabled rule (tls-reject-unauthorized) and a legacy-version\n// rule (tls-legacy-version) for the equivalent C# idioms:\n//   - DangerousAcceptAnyServerCertificateValidator / a custom\n//     ServerCertificateCustomValidationCallback → accepts any cert (MITM).\n//   - SslProtocols.Ssl3 / .Tls / .Tls11 → deprecated SSL 3.0 / TLS 1.0 / 1.1.\n// `SslProtocols.Tls` (no suffix) is the legacy TLS 1.0 constant; `Tls12`/`Tls13`\n// are excluded by the trailing \\b (the following digit is a word char).\nconst RE_CS_TLS_CERT_VALIDATION =\n  /\\bDangerousAcceptAnyServerCertificateValidator\\b|ServerCertificateCustomValidationCallback\\s*=/g;\nconst RE_CS_TLS_LEGACY_VERSION = /\\bSslProtocols\\.(?:Tls|Tls11|Ssl3)\\b/g;\n// Identifier-form JWT/JOSE signature algorithms (audit F7). The quoted-string\n// alg token (\"RS256\") is caught by the language-agnostic jwt-jose detector, but\n// Microsoft.IdentityModel passes the alg as an IDENTIFIER, not a string literal:\n// SecurityAlgorithms.RsaSha256 / SecurityAlgorithms.EcdsaSha256.\nconst RE_CS_JWT_ALG = /\\bSecurityAlgorithms\\.(?:Rsa|Ecdsa)Sha(?:256|384|512)\\b/g;\n// BouncyCastle (Org.BouncyCastle) modern-curve and finite-field DH primitives,\n// which System.Security.Cryptography does not expose directly. Each regex is\n// anchored to the distinctive BouncyCastle class names for one family so it\n// can't misfire on unrelated identifiers:\n//   - Ed25519KeyPairGenerator / Ed25519Signer / Ed25519PrivateKeyParameters → EdDSA\n//   - X25519KeyPairGenerator / X25519Agreement / X25519PrivateKeyParameters → X25519\n//   - X448KeyPairGenerator / X448Agreement / X448PrivateKeyParameters → X448\n//   - DHParametersGenerator / DHBasicAgreement / DH(Basic)KeyPairGenerator / DHParameters → DH\n// The trailing \\b keeps each token whole (e.g. Ed25519KeyGenerationParameters,\n// X25519PublicKeyParameters and DHKeyGenerationParameters are NOT matched).\nconst RE_CS_BC_EDDSA = /\\bEd25519(?:KeyPairGenerator|Signer|PrivateKeyParameters)\\b/g;\nconst RE_CS_BC_X25519 = /\\bX25519(?:KeyPairGenerator|Agreement|PrivateKeyParameters)\\b/g;\nconst RE_CS_BC_X448 = /\\bX448(?:KeyPairGenerator|Agreement|PrivateKeyParameters)\\b/g;\nconst RE_CS_BC_DH =\n  /\\bDH(?:ParametersGenerator|BasicAgreement|BasicKeyPairGenerator|KeyPairGenerator|Parameters)\\b/g;\n\nconst RULE_CS_RSA: RuleMeta = {\n  id: \"csharp-rsa\",\n  title: \"C# RSA key/usage\",\n  description: \"System.Security.Cryptography RSA.Create / RSACryptoServiceProvider / RSACng\",\n  category: \"kem\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Classical RSA (.NET) is not quantum-safe and RSA encryption is HNDL-exposed.\",\n};\nconst RULE_CS_ECDSA: RuleMeta = {\n  id: \"csharp-ecdsa\",\n  title: \"C# ECDSA signature\",\n  description: \"System.Security.Cryptography ECDsa.Create / ECDsaCng\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Classical ECDSA signing (.NET) is forgeable by a quantum attacker.\",\n  remediation: \"ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)\",\n};\nconst RULE_CS_ECDH: RuleMeta = {\n  id: \"csharp-ecdh\",\n  title: \"C# ECDH key agreement\",\n  description: \"System.Security.Cryptography ECDiffieHellman.Create / ECDiffieHellmanCng\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Elliptic-curve Diffie-Hellman (.NET) is broken by Shor's algorithm (harvest-now-decrypt-later).\",\n};\nconst RULE_CS_DSA: RuleMeta = {\n  id: \"csharp-dsa\",\n  title: \"C# DSA key/signature\",\n  description: \"System.Security.Cryptography DSA.Create / DSACryptoServiceProvider\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"DSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Classical DSA (.NET) is deprecated and forgeable by a quantum attacker.\",\n  remediation: \"Rotate off DSA and migrate to ML-DSA-65 (FIPS 204).\",\n};\nconst RULE_CS_TLS_CERT: RuleMeta = {\n  id: \"csharp-tls-cert-validation\",\n  title: \"C# TLS certificate verification disabled\",\n  description:\n    \"DangerousAcceptAnyServerCertificateValidator / ServerCertificateCustomValidationCallback override\",\n  category: \"tls\",\n  severity: \"high\",\n  confidence: \"high\",\n  hndl: false,\n  cwe: CWE_CERT_VALIDATION,\n  message: \"Accepting any server certificate disables TLS certificate verification (MITM risk).\",\n  remediation:\n    \"Remove the custom validator and verify certificates properly; prefer PQC-hybrid key exchange.\",\n};\nconst RULE_CS_TLS_LEGACY: RuleMeta = {\n  id: \"csharp-tls-legacy-version\",\n  title: \"C# legacy TLS/SSL version pinned\",\n  description: \"SslProtocols pinned to Ssl3 / TLS 1.0 / TLS 1.1\",\n  category: \"tls\",\n  severity: \"medium\",\n  confidence: \"high\",\n  hndl: false,\n  cwe: CWE_WEAK_STRENGTH,\n  message:\n    \"SSL 3.0 / TLS 1.0 / TLS 1.1 are deprecated and insecure; require TLS 1.2+ (prefer 1.3).\",\n  remediation: \"Use SslProtocols.Tls13 (or Tls12) and prefer PQC-hybrid key exchange.\",\n};\nconst RULE_CS_JWT_ALG: RuleMeta = {\n  id: \"csharp-jwt-alg\",\n  title: \"C# identifier-form JWT/JOSE algorithm\",\n  description: \"Microsoft.IdentityModel SecurityAlgorithms.RsaSha* / EcdsaSha*\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"unknown\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"A classical JWT/JOSE signature algorithm (.NET, identifier form) is used, forgeable by a quantum attacker.\",\n  remediation: \"ML-DSA-65 (FIPS 204); track IETF PQC JOSE/COSE algorithms\",\n};\nconst RULE_CS_BC_EDDSA: RuleMeta = {\n  id: \"csharp-bouncycastle-eddsa\",\n  title: \"C# Ed25519 signature (BouncyCastle)\",\n  description:\n    \"Org.BouncyCastle Ed25519KeyPairGenerator / Ed25519Signer / Ed25519PrivateKeyParameters\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"EdDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Classical Ed25519 signing (BouncyCastle) is forgeable by a quantum attacker.\",\n  remediation: \"ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)\",\n};\nconst RULE_CS_BC_X25519: RuleMeta = {\n  id: \"csharp-bouncycastle-x25519\",\n  title: \"C# X25519 key agreement (BouncyCastle)\",\n  description:\n    \"Org.BouncyCastle X25519KeyPairGenerator / X25519Agreement / X25519PrivateKeyParameters\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"X25519\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"X25519 Diffie-Hellman key agreement (BouncyCastle) is broken by Shor's algorithm (harvest-now-decrypt-later).\",\n};\nconst RULE_CS_BC_X448: RuleMeta = {\n  id: \"csharp-bouncycastle-x448\",\n  title: \"C# X448 key agreement (BouncyCastle)\",\n  description: \"Org.BouncyCastle X448KeyPairGenerator / X448Agreement / X448PrivateKeyParameters\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"X448\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"X448 Diffie-Hellman key agreement (BouncyCastle) is broken by Shor's algorithm (harvest-now-decrypt-later).\",\n};\nconst RULE_CS_BC_DH: RuleMeta = {\n  id: \"csharp-bouncycastle-dh\",\n  title: \"C# finite-field Diffie-Hellman (BouncyCastle)\",\n  description:\n    \"Org.BouncyCastle DHParametersGenerator / DHBasicAgreement / DHKeyPairGenerator / DHParameters\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"DH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Finite-field Diffie-Hellman (BouncyCastle) is broken by Shor's algorithm (harvest-now-decrypt-later).\",\n};\n\n/** Detects classical asymmetric crypto in C# (System.Security.Cryptography). */\nexport const csharpDetector: Detector = {\n  id: \"csharp-crypto\",\n  description:\n    \"Classical asymmetric crypto (System.Security.Cryptography) and insecure TLS config in C#/.NET\",\n  scope: \"source\",\n  language: \"csharp\",\n  rules: [\n    RULE_CS_RSA,\n    RULE_CS_ECDSA,\n    RULE_CS_ECDH,\n    RULE_CS_DSA,\n    RULE_CS_TLS_CERT,\n    RULE_CS_TLS_LEGACY,\n    RULE_CS_JWT_ALG,\n    RULE_CS_BC_EDDSA,\n    RULE_CS_BC_X25519,\n    RULE_CS_BC_X448,\n    RULE_CS_BC_DH,\n  ],\n  appliesTo: (f) => hasExtension(f, CSHARP_EXTENSIONS),\n  detect({ file, content }): Finding[] {\n    const findings: Finding[] = [];\n    const add = (re: RegExp, rule: RuleMeta) =>\n      eachMatch(re, content, (m) =>\n        findings.push(\n          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),\n        ),\n      );\n    // ECDSA / ECDH before RSA/DSA so the specific EC factories win.\n    add(RE_CS_ECDSA, RULE_CS_ECDSA);\n    add(RE_CS_ECDH, RULE_CS_ECDH);\n    add(RE_CS_RSA, RULE_CS_RSA);\n    add(RE_CS_DSA, RULE_CS_DSA);\n    // Insecure TLS configuration (disjoint from the crypto factories above).\n    add(RE_CS_TLS_CERT_VALIDATION, RULE_CS_TLS_CERT);\n    add(RE_CS_TLS_LEGACY_VERSION, RULE_CS_TLS_LEGACY);\n    // Identifier-form JWT/JOSE signature algorithms (Microsoft.IdentityModel).\n    add(RE_CS_JWT_ALG, RULE_CS_JWT_ALG);\n    // BouncyCastle (Org.BouncyCastle) curve / finite-field DH primitives that\n    // System.Security.Cryptography does not expose directly.\n    add(RE_CS_BC_EDDSA, RULE_CS_BC_EDDSA);\n    add(RE_CS_BC_X25519, RULE_CS_BC_X25519);\n    add(RE_CS_BC_X448, RULE_CS_BC_X448);\n    add(RE_CS_BC_DH, RULE_CS_BC_DH);\n    return findings;\n  },\n};\n"]}
+{"version":3,"file":"csharp.js","sourceRoot":"","sources":["../../src/detectors/csharp.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACjG,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAEtF,MAAM,SAAS,GACb,uGAAuG,CAAC;AAC1G,MAAM,WAAW,GAAG,uEAAuE,CAAC;AAC5F,MAAM,UAAU,GACd,qGAAqG,CAAC;AACxG,MAAM,SAAS,GAAG,+EAA+E,CAAC;AAClG,gFAAgF;AAChF,iFAAiF;AACjF,0DAA0D;AAC1D,8DAA8D;AAC9D,2EAA2E;AAC3E,8EAA8E;AAC9E,iFAAiF;AACjF,wEAAwE;AACxE,+EAA+E;AAC/E,mFAAmF;AACnF,qFAAqF;AACrF,2EAA2E;AAC3E,uFAAuF;AACvF,mFAAmF;AACnF,oFAAoF;AACpF,qFAAqF;AACrF,8CAA8C;AAC9C,MAAM,yBAAyB,GAC7B,8MAA8M,CAAC;AACjN,MAAM,wBAAwB,GAAG,uCAAuC,CAAC;AACzE,8EAA8E;AAC9E,gFAAgF;AAChF,iFAAiF;AACjF,yEAAyE;AACzE,mFAAmF;AACnF,MAAM,aAAa,GAAG,wEAAwE,CAAC;AAC/F,+EAA+E;AAC/E,6EAA6E;AAC7E,4EAA4E;AAC5E,0CAA0C;AAC1C,oFAAoF;AACpF,qFAAqF;AACrF,6EAA6E;AAC7E,+FAA+F;AAC/F,+EAA+E;AAC/E,4EAA4E;AAC5E,MAAM,cAAc,GAAG,8DAA8D,CAAC;AACtF,MAAM,eAAe,GAAG,gEAAgE,CAAC;AACzF,MAAM,aAAa,GAAG,8DAA8D,CAAC;AACrF,MAAM,WAAW,GACf,iGAAiG,CAAC;AAEpG,MAAM,WAAW,GAAa;IAC5B,EAAE,EAAE,YAAY;IAChB,KAAK,EAAE,kBAAkB;IACzB,WAAW,EAAE,6EAA6E;IAC1F,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,8EAA8E;CACxF,CAAC;AACF,MAAM,aAAa,GAAa;IAC9B,EAAE,EAAE,cAAc;IAClB,KAAK,EAAE,oBAAoB;IAC3B,WAAW,EAAE,sDAAsD;IACnE,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,oEAAoE;IAC7E,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,YAAY,GAAa;IAC7B,EAAE,EAAE,aAAa;IACjB,KAAK,EAAE,uBAAuB;IAC9B,WAAW,EAAE,0EAA0E;IACvF,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,iGAAiG;CACpG,CAAC;AACF,MAAM,WAAW,GAAa;IAC5B,EAAE,EAAE,YAAY;IAChB,KAAK,EAAE,sBAAsB;IAC7B,WAAW,EAAE,oEAAoE;IACjF,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,yEAAyE;IAClF,WAAW,EAAE,qDAAqD;CACnE,CAAC;AACF,MAAM,gBAAgB,GAAa;IACjC,EAAE,EAAE,4BAA4B;IAChC,KAAK,EAAE,0CAA0C;IACjD,WAAW,EACT,mGAAmG;IACrG,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,mBAAmB;IACxB,OAAO,EAAE,qFAAqF;IAC9F,WAAW,EACT,+FAA+F;CAClG,CAAC;AACF,MAAM,kBAAkB,GAAa;IACnC,EAAE,EAAE,2BAA2B;IAC/B,KAAK,EAAE,kCAAkC;IACzC,WAAW,EAAE,iDAAiD;IAC9D,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,yFAAyF;IAC3F,WAAW,EAAE,uEAAuE;CACrF,CAAC;AACF,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,uCAAuC;IAC9C,WAAW,EAAE,gEAAgE;IAC7E,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,SAAS;IACpB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,4GAA4G;IAC9G,WAAW,EAAE,2DAA2D;CACzE,CAAC;AACF,MAAM,gBAAgB,GAAa;IACjC,EAAE,EAAE,2BAA2B;IAC/B,KAAK,EAAE,qCAAqC;IAC5C,WAAW,EACT,wFAAwF;IAC1F,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,8EAA8E;IACvF,WAAW,EAAE,4CAA4C;CAC1D,CAAC;AACF,MAAM,iBAAiB,GAAa;IAClC,EAAE,EAAE,4BAA4B;IAChC,KAAK,EAAE,wCAAwC;IAC/C,WAAW,EACT,wFAAwF;IAC1F,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,QAAQ;IACnB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,+GAA+G;CAClH,CAAC;AACF,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,0BAA0B;IAC9B,KAAK,EAAE,sCAAsC;IAC7C,WAAW,EAAE,kFAAkF;IAC/F,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,6GAA6G;CAChH,CAAC;AACF,MAAM,aAAa,GAAa;IAC9B,EAAE,EAAE,wBAAwB;IAC5B,KAAK,EAAE,+CAA+C;IACtD,WAAW,EACT,+FAA+F;IACjG,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,IAAI;IACf,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,uGAAuG;CAC1G,CAAC;AAEF,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAa;IACtC,EAAE,EAAE,eAAe;IACnB,WAAW,EACT,+FAA+F;IACjG,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,QAAQ;IAClB,KAAK,EAAE;QACL,WAAW;QACX,aAAa;QACb,YAAY;QACZ,WAAW;QACX,gBAAgB;QAChB,kBAAkB;QAClB,eAAe;QACf,gBAAgB;QAChB,iBAAiB;QACjB,eAAe;QACf,aAAa;KACd;IACD,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,iBAAiB,CAAC;IACpD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,IAAc,EAAE,EAAE,CACzC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAC3B,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACnF,CACF,CAAC;QACJ,gEAAgE;QAChE,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAChC,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QAC9B,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC5B,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC5B,yEAAyE;QACzE,GAAG,CAAC,yBAAyB,EAAE,gBAAgB,CAAC,CAAC;QACjD,GAAG,CAAC,wBAAwB,EAAE,kBAAkB,CAAC,CAAC;QAClD,2EAA2E;QAC3E,GAAG,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QACpC,0EAA0E;QAC1E,yDAAyD;QACzD,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;QACtC,GAAG,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QACxC,GAAG,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QACpC,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QAChC,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC","sourcesContent":["/**\n * Source-code detector for classical asymmetric cryptography in C# / .NET\n * (`System.Security.Cryptography`). Same lexical strategy as the other packs.\n * .NET exposes each algorithm through a factory (`RSA.Create()`,\n * `ECDsa.Create()`, `ECDiffieHellman.Create()`) or a concrete CSP/CNG class\n * (`RSACryptoServiceProvider`, `ECDsaCng`, …), all of which are precise signals.\n *\n * HNDL: RSA (keygen/encryption) and (EC)DH key agreement are harvest-now-\n * decrypt-later exposed (hndl:true); ECDSA/DSA signatures are hndl:false but\n * forgeable by a quantum attacker.\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport { CSHARP_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from \"../detect-utils.js\";\nimport { CWE_BROKEN_CRYPTO, CWE_CERT_VALIDATION, CWE_WEAK_STRENGTH } from \"../cwe.js\";\n\nconst RE_CS_RSA =\n  /\\bRSA\\.Create\\s*\\(|\\bnew\\s+RSACryptoServiceProvider\\s*\\(|\\bnew\\s+RSACng\\s*\\(|\\bnew\\s+RSAOpenSsl\\s*\\(/g;\nconst RE_CS_ECDSA = /\\bECDsa\\.Create\\s*\\(|\\bnew\\s+ECDsaCng\\s*\\(|\\bnew\\s+ECDsaOpenSsl\\s*\\(/g;\nconst RE_CS_ECDH =\n  /\\bECDiffieHellman\\.Create\\s*\\(|\\bnew\\s+ECDiffieHellmanCng\\s*\\(|\\bnew\\s+ECDiffieHellmanOpenSsl\\s*\\(/g;\nconst RE_CS_DSA = /\\bDSA\\.Create\\s*\\(|\\bnew\\s+DSACryptoServiceProvider\\s*\\(|\\bnew\\s+DSACng\\s*\\(/g;\n// Insecure TLS configuration (.NET). Mirrors source.ts's tlsDetector split of a\n// cert-verification-disabled rule (tls-reject-unauthorized) and a legacy-version\n// rule (tls-legacy-version) for the equivalent C# idioms:\n//   - DangerousAcceptAnyServerCertificateValidator / a custom\n//     ServerCertificateCustomValidationCallback → accepts any cert (MITM).\n//   - SslProtocols.Ssl3 / .Tls / .Tls11 → deprecated SSL 3.0 / TLS 1.0 / 1.1.\n// `SslProtocols.Tls` (no suffix) is the legacy TLS 1.0 constant; `Tls12`/`Tls13`\n// are excluded by the trailing \\b (the following digit is a word char).\n// Only the genuinely-permissive forms: the built-in accept-any validator, or a\n// callback assigned an always-`true` lambda. A callback assigned a NAMED validator\n// method is typically certificate PINNING (stricter than default) and must NOT fire.\n// An accept-any server-certificate callback: the BouncyCastle helper, or a\n// ServerCertificateCustomValidationCallback that unconditionally yields `true` — as an\n// expression lambda (`=> true`), a block-body lambda (`=> { return true; }`), or a\n// `delegate { return true; }`. Requiring a literal `true` (not just any `=>`) keeps\n// certificate PINNING — which returns a comparison, `=> cert.Thumbprint == pinned` —\n// from being flagged as a disabled validator.\nconst RE_CS_TLS_CERT_VALIDATION =\n  /\\bDangerousAcceptAnyServerCertificateValidator\\b|ServerCertificateCustomValidationCallback\\s*=\\s*(?:[^;\\n]{0,80}=>\\s*(?:true\\b|\\{\\s*return\\s+true\\b)|delegate\\s*(?:\\([^)]{0,80}\\))?\\s*\\{\\s*return\\s+true\\b)/g;\nconst RE_CS_TLS_LEGACY_VERSION = /\\bSslProtocols\\.(?:Tls|Tls11|Ssl3)\\b/g;\n// Identifier-form JWT/JOSE signature algorithms (audit F7). The quoted-string\n// alg token (\"RS256\") is caught by the language-agnostic jwt-jose detector, but\n// Microsoft.IdentityModel passes the alg as an IDENTIFIER, not a string literal:\n// SecurityAlgorithms.RsaSha256 / SecurityAlgorithms.EcdsaSha256, and the\n// `…Signature`-suffixed constants used in SigningCredentials (RsaSha256Signature).\nconst RE_CS_JWT_ALG = /\\bSecurityAlgorithms\\.(?:Rsa|Ecdsa)Sha(?:256|384|512)(?:Signature)?\\b/g;\n// BouncyCastle (Org.BouncyCastle) modern-curve and finite-field DH primitives,\n// which System.Security.Cryptography does not expose directly. Each regex is\n// anchored to the distinctive BouncyCastle class names for one family so it\n// can't misfire on unrelated identifiers:\n//   - Ed25519KeyPairGenerator / Ed25519Signer / Ed25519PrivateKeyParameters → EdDSA\n//   - X25519KeyPairGenerator / X25519Agreement / X25519PrivateKeyParameters → X25519\n//   - X448KeyPairGenerator / X448Agreement / X448PrivateKeyParameters → X448\n//   - DHParametersGenerator / DHBasicAgreement / DH(Basic)KeyPairGenerator / DHParameters → DH\n// The trailing \\b keeps each token whole (e.g. Ed25519KeyGenerationParameters,\n// X25519PublicKeyParameters and DHKeyGenerationParameters are NOT matched).\nconst RE_CS_BC_EDDSA = /\\bEd25519(?:KeyPairGenerator|Signer|PrivateKeyParameters)\\b/g;\nconst RE_CS_BC_X25519 = /\\bX25519(?:KeyPairGenerator|Agreement|PrivateKeyParameters)\\b/g;\nconst RE_CS_BC_X448 = /\\bX448(?:KeyPairGenerator|Agreement|PrivateKeyParameters)\\b/g;\nconst RE_CS_BC_DH =\n  /\\bDH(?:ParametersGenerator|BasicAgreement|BasicKeyPairGenerator|KeyPairGenerator|Parameters)\\b/g;\n\nconst RULE_CS_RSA: RuleMeta = {\n  id: \"csharp-rsa\",\n  title: \"C# RSA key/usage\",\n  description: \"System.Security.Cryptography RSA.Create / RSACryptoServiceProvider / RSACng\",\n  category: \"kem\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Classical RSA (.NET) is not quantum-safe and RSA encryption is HNDL-exposed.\",\n};\nconst RULE_CS_ECDSA: RuleMeta = {\n  id: \"csharp-ecdsa\",\n  title: \"C# ECDSA signature\",\n  description: \"System.Security.Cryptography ECDsa.Create / ECDsaCng\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Classical ECDSA signing (.NET) is forgeable by a quantum attacker.\",\n  remediation: \"ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)\",\n};\nconst RULE_CS_ECDH: RuleMeta = {\n  id: \"csharp-ecdh\",\n  title: \"C# ECDH key agreement\",\n  description: \"System.Security.Cryptography ECDiffieHellman.Create / ECDiffieHellmanCng\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Elliptic-curve Diffie-Hellman (.NET) is broken by Shor's algorithm (harvest-now-decrypt-later).\",\n};\nconst RULE_CS_DSA: RuleMeta = {\n  id: \"csharp-dsa\",\n  title: \"C# DSA key/signature\",\n  description: \"System.Security.Cryptography DSA.Create / DSACryptoServiceProvider\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"DSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Classical DSA (.NET) is deprecated and forgeable by a quantum attacker.\",\n  remediation: \"Rotate off DSA and migrate to ML-DSA-65 (FIPS 204).\",\n};\nconst RULE_CS_TLS_CERT: RuleMeta = {\n  id: \"csharp-tls-cert-validation\",\n  title: \"C# TLS certificate verification disabled\",\n  description:\n    \"DangerousAcceptAnyServerCertificateValidator / ServerCertificateCustomValidationCallback override\",\n  category: \"tls\",\n  severity: \"high\",\n  confidence: \"high\",\n  hndl: false,\n  cwe: CWE_CERT_VALIDATION,\n  message: \"Accepting any server certificate disables TLS certificate verification (MITM risk).\",\n  remediation:\n    \"Remove the custom validator and verify certificates properly; prefer PQC-hybrid key exchange.\",\n};\nconst RULE_CS_TLS_LEGACY: RuleMeta = {\n  id: \"csharp-tls-legacy-version\",\n  title: \"C# legacy TLS/SSL version pinned\",\n  description: \"SslProtocols pinned to Ssl3 / TLS 1.0 / TLS 1.1\",\n  category: \"tls\",\n  severity: \"medium\",\n  confidence: \"high\",\n  hndl: false,\n  cwe: CWE_WEAK_STRENGTH,\n  message:\n    \"SSL 3.0 / TLS 1.0 / TLS 1.1 are deprecated and insecure; require TLS 1.2+ (prefer 1.3).\",\n  remediation: \"Use SslProtocols.Tls13 (or Tls12) and prefer PQC-hybrid key exchange.\",\n};\nconst RULE_CS_JWT_ALG: RuleMeta = {\n  id: \"csharp-jwt-alg\",\n  title: \"C# identifier-form JWT/JOSE algorithm\",\n  description: \"Microsoft.IdentityModel SecurityAlgorithms.RsaSha* / EcdsaSha*\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"unknown\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"A classical JWT/JOSE signature algorithm (.NET, identifier form) is used, forgeable by a quantum attacker.\",\n  remediation: \"ML-DSA-65 (FIPS 204); track IETF PQC JOSE/COSE algorithms\",\n};\nconst RULE_CS_BC_EDDSA: RuleMeta = {\n  id: \"csharp-bouncycastle-eddsa\",\n  title: \"C# Ed25519 signature (BouncyCastle)\",\n  description:\n    \"Org.BouncyCastle Ed25519KeyPairGenerator / Ed25519Signer / Ed25519PrivateKeyParameters\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"EdDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Classical Ed25519 signing (BouncyCastle) is forgeable by a quantum attacker.\",\n  remediation: \"ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205)\",\n};\nconst RULE_CS_BC_X25519: RuleMeta = {\n  id: \"csharp-bouncycastle-x25519\",\n  title: \"C# X25519 key agreement (BouncyCastle)\",\n  description:\n    \"Org.BouncyCastle X25519KeyPairGenerator / X25519Agreement / X25519PrivateKeyParameters\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"X25519\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"X25519 Diffie-Hellman key agreement (BouncyCastle) is broken by Shor's algorithm (harvest-now-decrypt-later).\",\n};\nconst RULE_CS_BC_X448: RuleMeta = {\n  id: \"csharp-bouncycastle-x448\",\n  title: \"C# X448 key agreement (BouncyCastle)\",\n  description: \"Org.BouncyCastle X448KeyPairGenerator / X448Agreement / X448PrivateKeyParameters\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"X448\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"X448 Diffie-Hellman key agreement (BouncyCastle) is broken by Shor's algorithm (harvest-now-decrypt-later).\",\n};\nconst RULE_CS_BC_DH: RuleMeta = {\n  id: \"csharp-bouncycastle-dh\",\n  title: \"C# finite-field Diffie-Hellman (BouncyCastle)\",\n  description:\n    \"Org.BouncyCastle DHParametersGenerator / DHBasicAgreement / DHKeyPairGenerator / DHParameters\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"DH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Finite-field Diffie-Hellman (BouncyCastle) is broken by Shor's algorithm (harvest-now-decrypt-later).\",\n};\n\n/** Detects classical asymmetric crypto in C# (System.Security.Cryptography). */\nexport const csharpDetector: Detector = {\n  id: \"csharp-crypto\",\n  description:\n    \"Classical asymmetric crypto (System.Security.Cryptography) and insecure TLS config in C#/.NET\",\n  scope: \"source\",\n  language: \"csharp\",\n  rules: [\n    RULE_CS_RSA,\n    RULE_CS_ECDSA,\n    RULE_CS_ECDH,\n    RULE_CS_DSA,\n    RULE_CS_TLS_CERT,\n    RULE_CS_TLS_LEGACY,\n    RULE_CS_JWT_ALG,\n    RULE_CS_BC_EDDSA,\n    RULE_CS_BC_X25519,\n    RULE_CS_BC_X448,\n    RULE_CS_BC_DH,\n  ],\n  appliesTo: (f) => hasExtension(f, CSHARP_EXTENSIONS),\n  detect({ file, content }): Finding[] {\n    const findings: Finding[] = [];\n    const add = (re: RegExp, rule: RuleMeta) =>\n      eachMatch(re, content, (m) =>\n        findings.push(\n          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),\n        ),\n      );\n    // ECDSA / ECDH before RSA/DSA so the specific EC factories win.\n    add(RE_CS_ECDSA, RULE_CS_ECDSA);\n    add(RE_CS_ECDH, RULE_CS_ECDH);\n    add(RE_CS_RSA, RULE_CS_RSA);\n    add(RE_CS_DSA, RULE_CS_DSA);\n    // Insecure TLS configuration (disjoint from the crypto factories above).\n    add(RE_CS_TLS_CERT_VALIDATION, RULE_CS_TLS_CERT);\n    add(RE_CS_TLS_LEGACY_VERSION, RULE_CS_TLS_LEGACY);\n    // Identifier-form JWT/JOSE signature algorithms (Microsoft.IdentityModel).\n    add(RE_CS_JWT_ALG, RULE_CS_JWT_ALG);\n    // BouncyCastle (Org.BouncyCastle) curve / finite-field DH primitives that\n    // System.Security.Cryptography does not expose directly.\n    add(RE_CS_BC_EDDSA, RULE_CS_BC_EDDSA);\n    add(RE_CS_BC_X25519, RULE_CS_BC_X25519);\n    add(RE_CS_BC_X448, RULE_CS_BC_X448);\n    add(RE_CS_BC_DH, RULE_CS_BC_DH);\n    return findings;\n  },\n};\n"]}

package/dist/detectors/dart.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Source detector for classical asymmetric cryptography in Dart / Flutter.
+ *
+ * Dart has no asymmetric crypto in its standard library, so real-world code
+ * reaches for one of the two dominant pub.dev packages, and both expose their
+ * primitives through distinctive class names — which makes a lexical scan (the
+ * same zero-dependency strategy as every other language pack here) precise:
+ *
+ *  - package:pointycastle (a Bouncy Castle port). RSA via `RSAKeyGenerator`,
+ *    `RSAEngine`, `RSASigner`, `PSSSigner`; EC via `ECKeyGenerator`,
+ *    `ECDSASigner`, `ECDHBasicAgreement`; Edwards via `Ed25519`.
+ *  - package:cryptography (Dart-native). RSA via `RsaPss`, `RsaSsaPkcs1v15`;
+ *    EC via `Ecdsa`, `Ecdh`; modern curves via `Ed25519`, `X25519`.
+ *
+ * HNDL (harvest-now-decrypt-later) reasoning — the field that drives urgency:
+ *  - RSA encryption (`RSAEngine`) and RSA key generation (`RSAKeyGenerator`,
+ *    which yields keys that can decrypt) are confidentiality surfaces → hndl:true.
+ *  - (EC)DH key agreement (`ECDHBasicAgreement`, `Ecdh`, `X25519`) is the classic
+ *    HNDL target — recorded ciphertext is decryptable once the curve falls → hndl:true.
+ *  - Signatures (`RSASigner`/`PSSSigner`/`RsaPss`/`RsaSsaPkcs1v15`, `ECDSASigner`/
+ *    `Ecdsa`, `Ed25519`) are forgeable by a quantum attacker but not retroactively
+ *    breakable → hndl:false.
+ *  - `ECKeyGenerator` is ambiguous (an EC key can feed either ECDSA or ECDH); it is
+ *    classified conservatively as an ECDSA signing key (hndl:false), the Dart default.
+ *
+ * Comment suppression is C-style (`//` line + `/* … *\/` block), matching Dart's
+ * lexer, so commented-out crypto is not reported. The regexes are `\b`-anchored on
+ * the library-specific identifiers above; none matches a bare `RSA`/`EC` substring,
+ * keeping false positives low. A cheap substring fast-reject skips the regex work on
+ * the overwhelming majority of `.dart` files that touch no asymmetric crypto.
+ */
+import type { Detector } from "../types.js";
+/** Detects classical asymmetric crypto in Dart / Flutter (pointycastle, cryptography). */
+export declare const dartDetector: Detector;
+//# sourceMappingURL=dart.d.ts.map

package/dist/detectors/dart.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dart.d.ts","sourceRoot":"","sources":["../../src/detectors/dart.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AA8J/D,0FAA0F;AAC1F,eAAO,MAAM,YAAY,EAAE,QA8C1B,CAAC"}

package/dist/detectors/dart.js

@@ -0,0 +1,177 @@
+import { eachMatch, findingFromRule, hasExtension, maskBlockComments, maskCommentLines, DART_EXTENSIONS, } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+// RSA key generation / raw RSA encryption engine (pointycastle). Both are
+// confidentiality-capable (a keypair can decrypt; the engine encrypts) → kem.
+const RE_DART_RSA_KEYGEN = /\b(?:RSAKeyGenerator|RSAEngine)\b/g;
+// RSA signature schemes: pointycastle `RSASigner`/`PSSSigner`, cryptography
+// `RsaPss`/`RsaSsaPkcs1v15`. Distinct casing keeps these off the keygen rule.
+const RE_DART_RSA_SIGN = /\b(?:RSASigner|PSSSigner|RsaPss|RsaSsaPkcs1v15)\b/g;
+// ECDSA SIGNING: pointycastle `ECDSASigner`, cryptography `Ecdsa`. `\bEcdsa\b`
+// requires a boundary, so `EcdsaP256`-style concatenations (rare) and the all-caps
+// `ECDSASigner` don't double-fire here. (EC keygen is a SEPARATE, HNDL-exposed rule.)
+const RE_DART_ECDSA = /\b(?:ECDSASigner|Ecdsa)\b/g;
+// EC KEY GENERATION (pointycastle `ECKeyGenerator`) is ambiguous — an EC key can
+// feed ECDSA signing OR ECDH agreement — so it is classified key-exchange/ECDH/
+// hndl:true (the fleet's HNDL-safe convention), NOT folded into the signing rule.
+const RE_DART_EC_KEYGEN = /\bECKeyGenerator\b/g;
+// ECDH key agreement: pointycastle `ECDHBasicAgreement`, cryptography `Ecdh`.
+// `\bEcdh\b` cannot match inside `Ecdsa` (different letters), so no overlap.
+const RE_DART_ECDH = /\b(?:ECDHBasicAgreement|Ecdh)\b/g;
+// Ed25519 signer (both packages spell it `Ed25519`).
+const RE_DART_ED25519 = /\bEd25519\b/g;
+// X25519 key agreement (cryptography `X25519`).
+const RE_DART_X25519 = /\bX25519\b/g;
+// Cheap fast-reject: distinctive substrings that gate the (precise) regex work.
+// If none is present the file cannot contain any of the tracked identifiers.
+const DART_FAST_REJECT = [
+    "RSA",
+    "Rsa",
+    "ECDSA",
+    "Ecdsa",
+    "ECDH",
+    "Ecdh",
+    "ECKeyGenerator",
+    "PSSSigner",
+    "Ed25519",
+    "X25519",
+];
+const RULE_DART_RSA_KEYGEN = {
+    id: "dart-rsa-keygen",
+    title: "Dart RSA key generation / encryption",
+    description: "pointycastle RSAKeyGenerator / RSAEngine",
+    category: "kem",
+    severity: "high",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Classical RSA key generation / encryption (Dart, pointycastle) is not quantum-safe and RSA encryption is harvest-now-decrypt-later exposed.",
+    remediation: "Migrate to PQC (ML-KEM-768 for encryption / key transport) as Dart crypto packages add support.",
+};
+const RULE_DART_RSA_SIGN = {
+    id: "dart-rsa-sign",
+    title: "Dart RSA signature",
+    description: "pointycastle RSASigner/PSSSigner, cryptography RsaPss/RsaSsaPkcs1v15",
+    category: "signature",
+    // `high`, consistent with every sibling pack's signature severity (go/java/php/
+    // objc/elixir RSA-sign) — the same primitive must not flip CI exit codes by language.
+    severity: "high",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Classical RSA signature (Dart) is forgeable by a quantum attacker.",
+    remediation: "Migrate to PQC signatures (ML-DSA-65, FIPS 204) as Dart crypto packages add support.",
+};
+const RULE_DART_ECDSA = {
+    id: "dart-ecdsa",
+    title: "Dart ECDSA signature",
+    description: "pointycastle ECDSASigner, cryptography Ecdsa",
+    category: "signature",
+    severity: "high",
+    confidence: "high",
+    algorithm: "ECDSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Classical ECDSA signing (Dart) is forgeable by a quantum attacker.",
+    remediation: "Migrate to PQC signatures (ML-DSA-65, FIPS 204) as Dart crypto packages add support.",
+};
+const RULE_DART_EC_KEYGEN = {
+    id: "dart-ec-keygen",
+    title: "Dart EC key generation",
+    description: "pointycastle ECKeyGenerator (ambiguous EC key: ECDSA or ECDH)",
+    // Ambiguous EC keygen → key-exchange/ECDH/hndl:true (fleet HNDL-safe convention),
+    // since the key may feed ECDH agreement (harvest-now-decrypt-later exposed).
+    category: "key-exchange",
+    severity: "high",
+    confidence: "high",
+    algorithm: "ECDH",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "EC key generation (Dart, pointycastle); an EC key can feed ECDH key agreement (harvest-now-decrypt-later exposed) as well as ECDSA signing, and is not quantum-safe.",
+    remediation: "For key agreement migrate to hybrid X25519MLKEM768 (ML-KEM-768); for signatures ML-DSA-65 — as Dart crypto packages add support.",
+};
+const RULE_DART_ECDH = {
+    id: "dart-ecdh",
+    title: "Dart ECDH key agreement",
+    description: "pointycastle ECDHBasicAgreement, cryptography Ecdh",
+    category: "key-exchange",
+    severity: "high",
+    confidence: "high",
+    algorithm: "ECDH",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Elliptic-curve Diffie-Hellman key agreement (Dart) is broken by Shor's algorithm (harvest-now-decrypt-later).",
+    remediation: "Migrate key agreement to hybrid X25519MLKEM768 (ML-KEM-768) as Dart crypto packages add support.",
+};
+const RULE_DART_ED25519 = {
+    id: "dart-ed25519",
+    title: "Dart Ed25519 signature",
+    description: "pointycastle / cryptography Ed25519 signer",
+    category: "signature",
+    // `low`, aligned with Ed25519 across the other source packs (swift/rust/go/…) —
+    // the same primitive must not flip CI exit codes based on which language wrote it.
+    severity: "low",
+    confidence: "high",
+    algorithm: "EdDSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "Ed25519 (Dart) is a modern but still classical signature scheme, forgeable by a quantum attacker.",
+    remediation: "Migrate to PQC signatures (ML-DSA-65, FIPS 204) as Dart crypto packages add support.",
+};
+const RULE_DART_X25519 = {
+    id: "dart-x25519",
+    title: "Dart X25519 key agreement",
+    description: "cryptography X25519 key agreement",
+    category: "key-exchange",
+    severity: "medium",
+    confidence: "high",
+    algorithm: "X25519",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "X25519 (Dart) is modern but still classical key agreement — harvest-now-decrypt-later exposed.",
+    remediation: "Migrate key agreement to hybrid X25519MLKEM768 (ML-KEM-768) as Dart crypto packages add support.",
+};
+/** Detects classical asymmetric crypto in Dart / Flutter (pointycastle, cryptography). */
+export const dartDetector = {
+    id: "dart-crypto",
+    description: "Classical asymmetric crypto in Dart / Flutter (pointycastle, cryptography)",
+    scope: "source",
+    language: "dart",
+    rules: [
+        RULE_DART_RSA_KEYGEN,
+        RULE_DART_RSA_SIGN,
+        RULE_DART_ECDSA,
+        RULE_DART_EC_KEYGEN,
+        RULE_DART_ECDH,
+        RULE_DART_ED25519,
+        RULE_DART_X25519,
+    ],
+    appliesTo: (f) => hasExtension(f, DART_EXTENSIONS),
+    detect({ file, content }) {
+        // Fast-reject: nothing to do unless a distinctive token appears.
+        if (!DART_FAST_REJECT.some((t) => content.includes(t)))
+            return [];
+        // Suppress C-style comments so commented-out crypto isn't reported. Offsets
+        // are preserved (chars → spaces), so finding line/column stay exact.
+        const masked = maskCommentLines(maskBlockComments(content), ["//"]);
+        const findings = [];
+        // Scan the masked text, but build the finding (its snippet) from the ORIGINAL
+        // `content` so a line with a trailing comment renders live, not blanked.
+        const add = (re, rule) => eachMatch(re, masked, (m) => findings.push(findingFromRule(rule, {
+            file,
+            content,
+            index: m.index,
+            matchLength: m[0].length,
+        })));
+        add(RE_DART_RSA_KEYGEN, RULE_DART_RSA_KEYGEN);
+        add(RE_DART_RSA_SIGN, RULE_DART_RSA_SIGN);
+        add(RE_DART_ECDSA, RULE_DART_ECDSA);
+        add(RE_DART_EC_KEYGEN, RULE_DART_EC_KEYGEN);
+        add(RE_DART_ECDH, RULE_DART_ECDH);
+        add(RE_DART_ED25519, RULE_DART_ED25519);
+        add(RE_DART_X25519, RULE_DART_X25519);
+        return findings;
+    },
+};
+//# sourceMappingURL=dart.js.map

package/dist/detectors/dart.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dart.js","sourceRoot":"","sources":["../../src/detectors/dart.ts"],"names":[],"mappings":"AAgCA,OAAO,EACL,SAAS,EACT,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,0EAA0E;AAC1E,8EAA8E;AAC9E,MAAM,kBAAkB,GAAG,oCAAoC,CAAC;AAChE,4EAA4E;AAC5E,8EAA8E;AAC9E,MAAM,gBAAgB,GAAG,oDAAoD,CAAC;AAC9E,+EAA+E;AAC/E,mFAAmF;AACnF,sFAAsF;AACtF,MAAM,aAAa,GAAG,4BAA4B,CAAC;AACnD,iFAAiF;AACjF,gFAAgF;AAChF,kFAAkF;AAClF,MAAM,iBAAiB,GAAG,qBAAqB,CAAC;AAChD,8EAA8E;AAC9E,6EAA6E;AAC7E,MAAM,YAAY,GAAG,kCAAkC,CAAC;AACxD,qDAAqD;AACrD,MAAM,eAAe,GAAG,cAAc,CAAC;AACvC,gDAAgD;AAChD,MAAM,cAAc,GAAG,aAAa,CAAC;AAErC,gFAAgF;AAChF,6EAA6E;AAC7E,MAAM,gBAAgB,GAAsB;IAC1C,KAAK;IACL,KAAK;IACL,OAAO;IACP,OAAO;IACP,MAAM;IACN,MAAM;IACN,gBAAgB;IAChB,WAAW;IACX,SAAS;IACT,QAAQ;CACT,CAAC;AAEF,MAAM,oBAAoB,GAAa;IACrC,EAAE,EAAE,iBAAiB;IACrB,KAAK,EAAE,sCAAsC;IAC7C,WAAW,EAAE,0CAA0C;IACvD,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,6IAA6I;IAC/I,WAAW,EACT,iGAAiG;CACpG,CAAC;AACF,MAAM,kBAAkB,GAAa;IACnC,EAAE,EAAE,eAAe;IACnB,KAAK,EAAE,oBAAoB;IAC3B,WAAW,EAAE,sEAAsE;IACnF,QAAQ,EAAE,WAAW;IACrB,gFAAgF;IAChF,sFAAsF;IACtF,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,oEAAoE;IAC7E,WAAW,EACT,sFAAsF;CACzF,CAAC;AACF,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,YAAY;IAChB,KAAK,EAAE,sBAAsB;IAC7B,WAAW,EAAE,8CAA8C;IAC3D,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,oEAAoE;IAC7E,WAAW,EACT,sFAAsF;CACzF,CAAC;AACF,MAAM,mBAAmB,GAAa;IACpC,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,wBAAwB;IAC/B,WAAW,EAAE,+DAA+D;IAC5E,kFAAkF;IAClF,6EAA6E;IAC7E,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,sKAAsK;IACxK,WAAW,EACT,kIAAkI;CACrI,CAAC;AACF,MAAM,cAAc,GAAa;IAC/B,EAAE,EAAE,WAAW;IACf,KAAK,EAAE,yBAAyB;IAChC,WAAW,EAAE,oDAAoD;IACjE,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,MAAM;IACjB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,+GAA+G;IACjH,WAAW,EACT,kGAAkG;CACrG,CAAC;AACF,MAAM,iBAAiB,GAAa;IAClC,EAAE,EAAE,cAAc;IAClB,KAAK,EAAE,wBAAwB;IAC/B,WAAW,EAAE,4CAA4C;IACzD,QAAQ,EAAE,WAAW;IACrB,gFAAgF;IAChF,mFAAmF;IACnF,QAAQ,EAAE,KAAK;IACf,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,mGAAmG;IACrG,WAAW,EACT,sFAAsF;CACzF,CAAC;AACF,MAAM,gBAAgB,GAAa;IACjC,EAAE,EAAE,aAAa;IACjB,KAAK,EAAE,2BAA2B;IAClC,WAAW,EAAE,mCAAmC;IAChD,QAAQ,EAAE,cAAc;IACxB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,QAAQ;IACnB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,gGAAgG;IAClG,WAAW,EACT,kGAAkG;CACrG,CAAC;AAEF,0FAA0F;AAC1F,MAAM,CAAC,MAAM,YAAY,GAAa;IACpC,EAAE,EAAE,aAAa;IACjB,WAAW,EAAE,4EAA4E;IACzF,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,MAAM;IAChB,KAAK,EAAE;QACL,oBAAoB;QACpB,kBAAkB;QAClB,eAAe;QACf,mBAAmB;QACnB,cAAc;QACd,iBAAiB;QACjB,gBAAgB;KACjB;IACD,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,eAAe,CAAC;IAClD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,iEAAiE;QACjE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC;QAElE,4EAA4E;QAC5E,qEAAqE;QACrE,MAAM,MAAM,GAAG,gBAAgB,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAEpE,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,8EAA8E;QAC9E,yEAAyE;QACzE,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,IAAc,EAAE,EAAE,CACzC,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAC1B,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,EAAE;YACpB,IAAI;YACJ,OAAO;YACP,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM;SACzB,CAAC,CACH,CACF,CAAC;QACJ,GAAG,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAAC;QAC9C,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;QAC1C,GAAG,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QACpC,GAAG,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;QAC5C,GAAG,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QAClC,GAAG,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QACxC,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;QACtC,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC","sourcesContent":["/**\n * Source detector for classical asymmetric cryptography in Dart / Flutter.\n *\n * Dart has no asymmetric crypto in its standard library, so real-world code\n * reaches for one of the two dominant pub.dev packages, and both expose their\n * primitives through distinctive class names — which makes a lexical scan (the\n * same zero-dependency strategy as every other language pack here) precise:\n *\n *  - package:pointycastle (a Bouncy Castle port). RSA via `RSAKeyGenerator`,\n *    `RSAEngine`, `RSASigner`, `PSSSigner`; EC via `ECKeyGenerator`,\n *    `ECDSASigner`, `ECDHBasicAgreement`; Edwards via `Ed25519`.\n *  - package:cryptography (Dart-native). RSA via `RsaPss`, `RsaSsaPkcs1v15`;\n *    EC via `Ecdsa`, `Ecdh`; modern curves via `Ed25519`, `X25519`.\n *\n * HNDL (harvest-now-decrypt-later) reasoning — the field that drives urgency:\n *  - RSA encryption (`RSAEngine`) and RSA key generation (`RSAKeyGenerator`,\n *    which yields keys that can decrypt) are confidentiality surfaces → hndl:true.\n *  - (EC)DH key agreement (`ECDHBasicAgreement`, `Ecdh`, `X25519`) is the classic\n *    HNDL target — recorded ciphertext is decryptable once the curve falls → hndl:true.\n *  - Signatures (`RSASigner`/`PSSSigner`/`RsaPss`/`RsaSsaPkcs1v15`, `ECDSASigner`/\n *    `Ecdsa`, `Ed25519`) are forgeable by a quantum attacker but not retroactively\n *    breakable → hndl:false.\n *  - `ECKeyGenerator` is ambiguous (an EC key can feed either ECDSA or ECDH); it is\n *    classified conservatively as an ECDSA signing key (hndl:false), the Dart default.\n *\n * Comment suppression is C-style (`//` line + `/* … *\\/` block), matching Dart's\n * lexer, so commented-out crypto is not reported. The regexes are `\\b`-anchored on\n * the library-specific identifiers above; none matches a bare `RSA`/`EC` substring,\n * keeping false positives low. A cheap substring fast-reject skips the regex work on\n * the overwhelming majority of `.dart` files that touch no asymmetric crypto.\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport {\n  eachMatch,\n  findingFromRule,\n  hasExtension,\n  maskBlockComments,\n  maskCommentLines,\n  DART_EXTENSIONS,\n} from \"../detect-utils.js\";\nimport { CWE_BROKEN_CRYPTO } from \"../cwe.js\";\n\n// RSA key generation / raw RSA encryption engine (pointycastle). Both are\n// confidentiality-capable (a keypair can decrypt; the engine encrypts) → kem.\nconst RE_DART_RSA_KEYGEN = /\\b(?:RSAKeyGenerator|RSAEngine)\\b/g;\n// RSA signature schemes: pointycastle `RSASigner`/`PSSSigner`, cryptography\n// `RsaPss`/`RsaSsaPkcs1v15`. Distinct casing keeps these off the keygen rule.\nconst RE_DART_RSA_SIGN = /\\b(?:RSASigner|PSSSigner|RsaPss|RsaSsaPkcs1v15)\\b/g;\n// ECDSA SIGNING: pointycastle `ECDSASigner`, cryptography `Ecdsa`. `\\bEcdsa\\b`\n// requires a boundary, so `EcdsaP256`-style concatenations (rare) and the all-caps\n// `ECDSASigner` don't double-fire here. (EC keygen is a SEPARATE, HNDL-exposed rule.)\nconst RE_DART_ECDSA = /\\b(?:ECDSASigner|Ecdsa)\\b/g;\n// EC KEY GENERATION (pointycastle `ECKeyGenerator`) is ambiguous — an EC key can\n// feed ECDSA signing OR ECDH agreement — so it is classified key-exchange/ECDH/\n// hndl:true (the fleet's HNDL-safe convention), NOT folded into the signing rule.\nconst RE_DART_EC_KEYGEN = /\\bECKeyGenerator\\b/g;\n// ECDH key agreement: pointycastle `ECDHBasicAgreement`, cryptography `Ecdh`.\n// `\\bEcdh\\b` cannot match inside `Ecdsa` (different letters), so no overlap.\nconst RE_DART_ECDH = /\\b(?:ECDHBasicAgreement|Ecdh)\\b/g;\n// Ed25519 signer (both packages spell it `Ed25519`).\nconst RE_DART_ED25519 = /\\bEd25519\\b/g;\n// X25519 key agreement (cryptography `X25519`).\nconst RE_DART_X25519 = /\\bX25519\\b/g;\n\n// Cheap fast-reject: distinctive substrings that gate the (precise) regex work.\n// If none is present the file cannot contain any of the tracked identifiers.\nconst DART_FAST_REJECT: readonly string[] = [\n  \"RSA\",\n  \"Rsa\",\n  \"ECDSA\",\n  \"Ecdsa\",\n  \"ECDH\",\n  \"Ecdh\",\n  \"ECKeyGenerator\",\n  \"PSSSigner\",\n  \"Ed25519\",\n  \"X25519\",\n];\n\nconst RULE_DART_RSA_KEYGEN: RuleMeta = {\n  id: \"dart-rsa-keygen\",\n  title: \"Dart RSA key generation / encryption\",\n  description: \"pointycastle RSAKeyGenerator / RSAEngine\",\n  category: \"kem\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Classical RSA key generation / encryption (Dart, pointycastle) is not quantum-safe and RSA encryption is harvest-now-decrypt-later exposed.\",\n  remediation:\n    \"Migrate to PQC (ML-KEM-768 for encryption / key transport) as Dart crypto packages add support.\",\n};\nconst RULE_DART_RSA_SIGN: RuleMeta = {\n  id: \"dart-rsa-sign\",\n  title: \"Dart RSA signature\",\n  description: \"pointycastle RSASigner/PSSSigner, cryptography RsaPss/RsaSsaPkcs1v15\",\n  category: \"signature\",\n  // `high`, consistent with every sibling pack's signature severity (go/java/php/\n  // objc/elixir RSA-sign) — the same primitive must not flip CI exit codes by language.\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Classical RSA signature (Dart) is forgeable by a quantum attacker.\",\n  remediation:\n    \"Migrate to PQC signatures (ML-DSA-65, FIPS 204) as Dart crypto packages add support.\",\n};\nconst RULE_DART_ECDSA: RuleMeta = {\n  id: \"dart-ecdsa\",\n  title: \"Dart ECDSA signature\",\n  description: \"pointycastle ECDSASigner, cryptography Ecdsa\",\n  category: \"signature\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"Classical ECDSA signing (Dart) is forgeable by a quantum attacker.\",\n  remediation:\n    \"Migrate to PQC signatures (ML-DSA-65, FIPS 204) as Dart crypto packages add support.\",\n};\nconst RULE_DART_EC_KEYGEN: RuleMeta = {\n  id: \"dart-ec-keygen\",\n  title: \"Dart EC key generation\",\n  description: \"pointycastle ECKeyGenerator (ambiguous EC key: ECDSA or ECDH)\",\n  // Ambiguous EC keygen → key-exchange/ECDH/hndl:true (fleet HNDL-safe convention),\n  // since the key may feed ECDH agreement (harvest-now-decrypt-later exposed).\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"EC key generation (Dart, pointycastle); an EC key can feed ECDH key agreement (harvest-now-decrypt-later exposed) as well as ECDSA signing, and is not quantum-safe.\",\n  remediation:\n    \"For key agreement migrate to hybrid X25519MLKEM768 (ML-KEM-768); for signatures ML-DSA-65 — as Dart crypto packages add support.\",\n};\nconst RULE_DART_ECDH: RuleMeta = {\n  id: \"dart-ecdh\",\n  title: \"Dart ECDH key agreement\",\n  description: \"pointycastle ECDHBasicAgreement, cryptography Ecdh\",\n  category: \"key-exchange\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"ECDH\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Elliptic-curve Diffie-Hellman key agreement (Dart) is broken by Shor's algorithm (harvest-now-decrypt-later).\",\n  remediation:\n    \"Migrate key agreement to hybrid X25519MLKEM768 (ML-KEM-768) as Dart crypto packages add support.\",\n};\nconst RULE_DART_ED25519: RuleMeta = {\n  id: \"dart-ed25519\",\n  title: \"Dart Ed25519 signature\",\n  description: \"pointycastle / cryptography Ed25519 signer\",\n  category: \"signature\",\n  // `low`, aligned with Ed25519 across the other source packs (swift/rust/go/…) —\n  // the same primitive must not flip CI exit codes based on which language wrote it.\n  severity: \"low\",\n  confidence: \"high\",\n  algorithm: \"EdDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"Ed25519 (Dart) is a modern but still classical signature scheme, forgeable by a quantum attacker.\",\n  remediation:\n    \"Migrate to PQC signatures (ML-DSA-65, FIPS 204) as Dart crypto packages add support.\",\n};\nconst RULE_DART_X25519: RuleMeta = {\n  id: \"dart-x25519\",\n  title: \"Dart X25519 key agreement\",\n  description: \"cryptography X25519 key agreement\",\n  category: \"key-exchange\",\n  severity: \"medium\",\n  confidence: \"high\",\n  algorithm: \"X25519\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"X25519 (Dart) is modern but still classical key agreement — harvest-now-decrypt-later exposed.\",\n  remediation:\n    \"Migrate key agreement to hybrid X25519MLKEM768 (ML-KEM-768) as Dart crypto packages add support.\",\n};\n\n/** Detects classical asymmetric crypto in Dart / Flutter (pointycastle, cryptography). */\nexport const dartDetector: Detector = {\n  id: \"dart-crypto\",\n  description: \"Classical asymmetric crypto in Dart / Flutter (pointycastle, cryptography)\",\n  scope: \"source\",\n  language: \"dart\",\n  rules: [\n    RULE_DART_RSA_KEYGEN,\n    RULE_DART_RSA_SIGN,\n    RULE_DART_ECDSA,\n    RULE_DART_EC_KEYGEN,\n    RULE_DART_ECDH,\n    RULE_DART_ED25519,\n    RULE_DART_X25519,\n  ],\n  appliesTo: (f) => hasExtension(f, DART_EXTENSIONS),\n  detect({ file, content }): Finding[] {\n    // Fast-reject: nothing to do unless a distinctive token appears.\n    if (!DART_FAST_REJECT.some((t) => content.includes(t))) return [];\n\n    // Suppress C-style comments so commented-out crypto isn't reported. Offsets\n    // are preserved (chars → spaces), so finding line/column stay exact.\n    const masked = maskCommentLines(maskBlockComments(content), [\"//\"]);\n\n    const findings: Finding[] = [];\n    // Scan the masked text, but build the finding (its snippet) from the ORIGINAL\n    // `content` so a line with a trailing comment renders live, not blanked.\n    const add = (re: RegExp, rule: RuleMeta) =>\n      eachMatch(re, masked, (m) =>\n        findings.push(\n          findingFromRule(rule, {\n            file,\n            content,\n            index: m.index,\n            matchLength: m[0].length,\n          }),\n        ),\n      );\n    add(RE_DART_RSA_KEYGEN, RULE_DART_RSA_KEYGEN);\n    add(RE_DART_RSA_SIGN, RULE_DART_RSA_SIGN);\n    add(RE_DART_ECDSA, RULE_DART_ECDSA);\n    add(RE_DART_EC_KEYGEN, RULE_DART_EC_KEYGEN);\n    add(RE_DART_ECDH, RULE_DART_ECDH);\n    add(RE_DART_ED25519, RULE_DART_ED25519);\n    add(RE_DART_X25519, RULE_DART_X25519);\n    return findings;\n  },\n};\n"]}

package/dist/detectors/database.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Config detector: classical crypto in database usage — public-key encryption of
+ * stored data (pgcrypto) and weak client TLS posture. Data-at-rest is the sharpest
+ * harvest-now-decrypt-later target: a column encrypted to an RSA key today is a
+ * time capsule an adversary can hold until key recovery is cheap.
+ *
+ * Covered:
+ *  - pgcrypto `pgp_pub_encrypt` / `pgp_pub_decrypt` in `.sql` (RSA/ElGamal public-key
+ *    encryption of column data) → `hndl:true`.
+ *  - libpq `sslmode = allow | prefer | require` in any config/connection file — a
+ *    mode that does NOT verify the server certificate, so the classical TLS session
+ *    it negotiates is both MITM-able and harvestable. `disable` is excluded: it
+ *    negotiates no TLS at all, so there is no key exchange to harvest (a plaintext
+ *    concern, out of scope for a PQC-readiness scanner).
+ */
+import type { Detector } from "../types.js";
+/** Detects classical database at-rest / transport crypto. */
+export declare const databaseDetector: Detector;
+//# sourceMappingURL=database.d.ts.map

package/dist/detectors/database.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"database.d.ts","sourceRoot":"","sources":["../../src/detectors/database.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAoE/D,6DAA6D;AAC7D,eAAO,MAAM,gBAAgB,EAAE,QAwD9B,CAAC"}