@quantakrypto/core 0.4.4 → 0.5.0

package/dist/detectors/webauthn.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Config detector: classical asymmetric signature algorithms pinned by
+ * WebAuthn / FIDO2 / passkey attestation & assertion, expressed as COSE
+ * algorithm identifiers in relying-party code and config
+ * (@simplewebauthn/server, py_webauthn, go-webauthn, webauthn4j).
+ *
+ * WHY WebAuthn is PQC-relevant: a WebAuthn credential is an asymmetric key
+ * pair whose PUBLIC key the authenticator returns (COSE-encoded) at
+ * registration; every subsequent assertion is a classical signature over the
+ * authentication challenge, and attestation statements are classical
+ * signatures over the credential. These are AUTHENTICATION signatures, not
+ * confidentiality — there is nothing to "harvest now" — but the moment a
+ * cryptographically-relevant quantum computer (CRQC) exists, an attacker who
+ * has a user's registered public key (or an attestation CA's key) can FORGE
+ * assertions/attestations and impersonate the user or a genuine authenticator.
+ * So every finding here is `category: "signature"`, `hndl: false`.
+ *
+ * The relying party pins which algorithms it will accept: `pubKeyCredParams`
+ * (registration) and `supportedAlgorithmIDs` (verification) enumerate COSE
+ * `alg` values, and the classical ones — ES256 (COSE -7, ECDSA P-256),
+ * RS256 (-257, RSA), EdDSA (-8) and their P-384/P-521/RSA-2048+ siblings — are
+ * exactly the ones a PQC migration must inventory and replace once FIDO/COSE
+ * standardise post-quantum algorithm identifiers.
+ *
+ * WHY numeric COSE ids need their own detector: the existing JWT/JOSE rule
+ * only matches QUOTED alg strings (`"ES256"`, `"RS256"`). WebAuthn libraries
+ * almost never write those strings — they use the NUMERIC COSE ids
+ * (`alg: -7`, `supportedAlgorithmIDs: [-7, -257]`) and language-level enum
+ * identifiers (`COSEAlgorithmIdentifier.ES256`, `webauthncose.AlgES256`,
+ * `COSEAlgorithmIdentifier.EDDSA`). None of those carry the quote characters
+ * the JWT rule keys off, so the entire WebAuthn surface is invisible today.
+ *
+ * Two independent match shapes per family, both gated by a file-level WebAuthn
+ * marker (see `hasWebauthnMarker`) so the generic numeric `alg: -7` form can't
+ * fire on unrelated code that happens to assign a small negative number:
+ *
+ *  1. NUMERIC form — the COSE `alg` value as an integer, either as an object
+ *     member (`alg: -7`, `alg = -257`) or inside a `supportedAlgorithmIDs`
+ *     array (`supportedAlgorithmIDs: [-7, -257]`). Restricted to the classical
+ *     COSE numbers only; symmetric / KDF / "direct" ids (e.g. -6, HS*) are
+ *     never in the alternation, so they cannot match.
+ *  2. ENUM form — the COSE algorithm's identifier as written in each library:
+ *     `COSEAlgorithmIdentifier.ES256|RS256|EdDSA|ECDSA_SHA_256` (webauthn4j,
+ *     py_webauthn) and Go's `webauthncose.AlgES256` / `AlgRS256` / `AlgEdDSA`
+ *     constants.
+ *
+ * COSE algorithm numbers → {@link AlgorithmFamily} (per the COSE registry, using
+ * the mapping this detector is specified against):
+ *  - ES256 (-7), ES384 (-35), ES512 (-36)      → ECDSA
+ *  - RS256 (-257), RS384 (-258), RS512 (-259)  → RSA
+ *  - EdDSA (-8)                                 → EdDSA
+ *
+ * Fast reject: `detect()` bails unless the file carries a distinctive WebAuthn
+ * API token (`pubKeyCredParams`, `PublicKeyCredential`, `webauthn`,
+ * `COSEAlgorithm`, `supportedAlgorithmIDs`, `navigator.credentials`). Those
+ * tokens are the marker gate ONLY — they never produce a standalone finding.
+ */
+import type { Detector } from "../types.js";
+/** Detects classical COSE signature algorithms pinned by WebAuthn/FIDO2 relying parties. */
+export declare const webauthnDetector: Detector;
+//# sourceMappingURL=webauthn.d.ts.map

package/dist/detectors/webauthn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn.d.ts","sourceRoot":"","sources":["../../src/detectors/webauthn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAwH/D,4FAA4F;AAC5F,eAAO,MAAM,gBAAgB,EAAE,QA0B9B,CAAC"}

package/dist/detectors/webauthn.js

@@ -0,0 +1,109 @@
+import { DOC_EXTENSIONS, eachMatch, findingFromRule, hasExtension, maskBlockComments, maskCommentLines, } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+// Classical COSE algorithm numbers, grouped by family (see module docstring).
+const NUM_ECDSA = "7|35|36"; // ES256, ES384, ES512
+const NUM_RSA = "257|258|259"; // RS256, RS384, RS512
+const NUM_EDDSA = "8"; // EdDSA
+// --- NUMERIC form: a COSE `alg` value written as an integer. ---
+// (a) object member: `alg: -7`, `alg = -257` (JS/JSON, Python `alg=-7`).
+// `["']?alg["']?` tolerates the JSON/serialized form `"alg": -7` (the WebAuthn
+// options object is JSON-serializable and often stored/transmitted/tested as JSON
+// with a quoted key), as well as the unquoted `alg: -7` / `alg = -7` (audit M2).
+const RE_NUM_ECDSA = new RegExp(`["']?\\balg\\b["']?\\s*[:=]\\s*-(?:${NUM_ECDSA})\\b`, "g");
+const RE_NUM_RSA = new RegExp(`["']?\\balg\\b["']?\\s*[:=]\\s*-(?:${NUM_RSA})\\b`, "g");
+const RE_NUM_EDDSA = new RegExp(`["']?\\balg\\b["']?\\s*[:=]\\s*-(?:${NUM_EDDSA})\\b`, "g");
+// (b) `supportedAlgorithmIDs: [-7, -257]` array (@simplewebauthn verify option).
+// `[^\]]*` stays inside a single array literal; one match per family even when
+// the array lists several ids of that family.
+const RE_IDS_ECDSA = new RegExp(`supportedAlgorithmIDs\\s*[:=]\\s*\\[[^\\]]*-(?:${NUM_ECDSA})\\b`, "g");
+const RE_IDS_RSA = new RegExp(`supportedAlgorithmIDs\\s*[:=]\\s*\\[[^\\]]*-(?:${NUM_RSA})\\b`, "g");
+const RE_IDS_EDDSA = new RegExp(`supportedAlgorithmIDs\\s*[:=]\\s*\\[[^\\]]*-(?:${NUM_EDDSA})\\b`, "g");
+// --- ENUM form: the COSE algorithm's language-level identifier. ---
+// webauthn4j / py_webauthn: `COSEAlgorithmIdentifier.<name>`; go-webauthn:
+// `webauthncose.Alg<name>` (matched bare as `Alg<name>`).
+const RE_ENUM_ECDSA = /\bCOSEAlgorithmIdentifier\.(?:ES(?:256|384|512)|ECDSA_SHA_(?:256|384|512))\b|\bAlgES(?:256|384|512)\b/g;
+const RE_ENUM_RSA = /\bCOSEAlgorithmIdentifier\.(?:RS(?:256|384|512)|RSASSA_[A-Za-z0-9_]+)\b|\bAlgRS(?:256|384|512)\b/g;
+const RE_ENUM_EDDSA = /\bCOSEAlgorithmIdentifier\.(?:EdDSA|EDDSA)\b|\bAlgEdDSA\b/g;
+const REMEDIATION = "WebAuthn/FIDO2 is standardizing PQC COSE algorithms; inventory the classical attestation/assertion algs now and plan migration.";
+const RULE_WEBAUTHN_ECDSA = {
+    id: "webauthn-ecdsa",
+    title: "WebAuthn ECDSA COSE algorithm",
+    description: "WebAuthn/FIDO2 credential pins a classical ECDSA COSE algorithm (ES256/ES384/ES512)",
+    category: "signature",
+    severity: "medium",
+    confidence: "high",
+    algorithm: "ECDSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "WebAuthn/FIDO2 relying party accepts a classical ECDSA COSE algorithm (ES256/ES384/ES512); attestation/assertion signatures become forgeable once a CRQC exists.",
+    remediation: REMEDIATION,
+};
+const RULE_WEBAUTHN_RSA = {
+    id: "webauthn-rsa",
+    title: "WebAuthn RSA COSE algorithm",
+    description: "WebAuthn/FIDO2 credential pins a classical RSA COSE algorithm (RS256/RS384/RS512)",
+    category: "signature",
+    severity: "medium",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "WebAuthn/FIDO2 relying party accepts a classical RSA COSE algorithm (RS256/RS384/RS512); attestation/assertion signatures become forgeable once a CRQC exists.",
+    remediation: REMEDIATION,
+};
+const RULE_WEBAUTHN_EDDSA = {
+    id: "webauthn-eddsa",
+    title: "WebAuthn EdDSA COSE algorithm",
+    description: "WebAuthn/FIDO2 credential pins the classical EdDSA COSE algorithm (COSE -8)",
+    category: "signature",
+    severity: "medium",
+    confidence: "high",
+    algorithm: "EdDSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "WebAuthn/FIDO2 relying party accepts the classical EdDSA COSE algorithm (Ed25519); modern but still classical — attestation/assertion signatures become forgeable once a CRQC exists.",
+    remediation: REMEDIATION,
+};
+const WEBAUTHN_RULES = [
+    { meta: RULE_WEBAUTHN_ECDSA, res: [RE_NUM_ECDSA, RE_IDS_ECDSA, RE_ENUM_ECDSA] },
+    { meta: RULE_WEBAUTHN_RSA, res: [RE_NUM_RSA, RE_IDS_RSA, RE_ENUM_RSA] },
+    { meta: RULE_WEBAUTHN_EDDSA, res: [RE_NUM_EDDSA, RE_IDS_EDDSA, RE_ENUM_EDDSA] },
+];
+/**
+ * True when `content` carries a distinctive WebAuthn API token. Used ONLY as
+ * the fast-reject marker gate — none of these tokens produce a finding — so the
+ * generic numeric `alg: -7` form can't fire on unrelated code.
+ */
+function hasWebauthnMarker(content) {
+    return (content.includes("pubKeyCredParams") ||
+        content.includes("PublicKeyCredential") ||
+        content.includes("COSEAlgorithm") ||
+        content.includes("supportedAlgorithmIDs") ||
+        content.includes("navigator.credentials") ||
+        /webauthn/i.test(content));
+}
+/** Detects classical COSE signature algorithms pinned by WebAuthn/FIDO2 relying parties. */
+export const webauthnDetector = {
+    id: "webauthn-crypto",
+    description: "Classical COSE signature algorithms in WebAuthn/FIDO2/passkey relying-party code",
+    scope: "config",
+    language: "any",
+    rules: WEBAUTHN_RULES.map((r) => r.meta),
+    appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),
+    detect({ file, content }) {
+        if (!hasWebauthnMarker(content))
+            return [];
+        // Mask C-style (`//`, `/* */`) and hash (`#`) comments so a commented-out
+        // options object can't fire. Offsets are preserved so finding locations stay
+        // exact.
+        const scan = maskCommentLines(maskBlockComments(content), ["//", "#"]);
+        const findings = [];
+        for (const { meta, res } of WEBAUTHN_RULES) {
+            for (const re of res) {
+                eachMatch(re, scan, (m) => findings.push(findingFromRule(meta, { file, content, index: m.index, matchLength: m[0].length })));
+            }
+        }
+        return findings;
+    },
+};
+//# sourceMappingURL=webauthn.js.map

package/dist/detectors/webauthn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webauthn.js","sourceRoot":"","sources":["../../src/detectors/webauthn.ts"],"names":[],"mappings":"AA0DA,OAAO,EACL,cAAc,EACd,SAAS,EACT,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,8EAA8E;AAC9E,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,sBAAsB;AACnD,MAAM,OAAO,GAAG,aAAa,CAAC,CAAC,sBAAsB;AACrD,MAAM,SAAS,GAAG,GAAG,CAAC,CAAC,QAAQ;AAE/B,kEAAkE;AAClE,yEAAyE;AACzE,+EAA+E;AAC/E,kFAAkF;AAClF,iFAAiF;AACjF,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC,sCAAsC,SAAS,MAAM,EAAE,GAAG,CAAC,CAAC;AAC5F,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,sCAAsC,OAAO,MAAM,EAAE,GAAG,CAAC,CAAC;AACxF,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC,sCAAsC,SAAS,MAAM,EAAE,GAAG,CAAC,CAAC;AAC5F,iFAAiF;AACjF,+EAA+E;AAC/E,8CAA8C;AAC9C,MAAM,YAAY,GAAG,IAAI,MAAM,CAC7B,kDAAkD,SAAS,MAAM,EACjE,GAAG,CACJ,CAAC;AACF,MAAM,UAAU,GAAG,IAAI,MAAM,CAAC,kDAAkD,OAAO,MAAM,EAAE,GAAG,CAAC,CAAC;AACpG,MAAM,YAAY,GAAG,IAAI,MAAM,CAC7B,kDAAkD,SAAS,MAAM,EACjE,GAAG,CACJ,CAAC;AAEF,qEAAqE;AACrE,2EAA2E;AAC3E,0DAA0D;AAC1D,MAAM,aAAa,GACjB,wGAAwG,CAAC;AAC3G,MAAM,WAAW,GACf,mGAAmG,CAAC;AACtG,MAAM,aAAa,GAAG,4DAA4D,CAAC;AAEnF,MAAM,WAAW,GACf,iIAAiI,CAAC;AAEpI,MAAM,mBAAmB,GAAa;IACpC,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,+BAA+B;IACtC,WAAW,EACT,qFAAqF;IACvF,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,kKAAkK;IACpK,WAAW,EAAE,WAAW;CACzB,CAAC;AACF,MAAM,iBAAiB,GAAa;IAClC,EAAE,EAAE,cAAc;IAClB,KAAK,EAAE,6BAA6B;IACpC,WAAW,EAAE,mFAAmF;IAChG,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,gKAAgK;IAClK,WAAW,EAAE,WAAW;CACzB,CAAC;AACF,MAAM,mBAAmB,GAAa;IACpC,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,+BAA+B;IACtC,WAAW,EAAE,6EAA6E;IAC1F,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,uLAAuL;IACzL,WAAW,EAAE,WAAW;CACzB,CAAC;AAOF,MAAM,cAAc,GAA4B;IAC9C,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,aAAa,CAAC,EAAE;IAC/E,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,WAAW,CAAC,EAAE;IACvE,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,CAAC,YAAY,EAAE,YAAY,EAAE,aAAa,CAAC,EAAE;CAChF,CAAC;AAEF;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,OAAe;IACxC,OAAO,CACL,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QACpC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QACvC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;QACjC,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC;QACzC,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAC;QACzC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAC1B,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,gBAAgB,GAAa;IACxC,EAAE,EAAE,iBAAiB;IACrB,WAAW,EAAE,kFAAkF;IAC/F,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,KAAK;IACf,KAAK,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACxC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,cAAc,CAAC;IAClD,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,CAAC;QAE3C,0EAA0E;QAC1E,6EAA6E;QAC7E,SAAS;QACT,MAAM,IAAI,GAAG,gBAAgB,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,KAAK,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,cAAc,EAAE,CAAC;YAC3C,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;gBACrB,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CACxB,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACnF,CACF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC","sourcesContent":["/**\n * Config detector: classical asymmetric signature algorithms pinned by\n * WebAuthn / FIDO2 / passkey attestation & assertion, expressed as COSE\n * algorithm identifiers in relying-party code and config\n * (@simplewebauthn/server, py_webauthn, go-webauthn, webauthn4j).\n *\n * WHY WebAuthn is PQC-relevant: a WebAuthn credential is an asymmetric key\n * pair whose PUBLIC key the authenticator returns (COSE-encoded) at\n * registration; every subsequent assertion is a classical signature over the\n * authentication challenge, and attestation statements are classical\n * signatures over the credential. These are AUTHENTICATION signatures, not\n * confidentiality — there is nothing to \"harvest now\" — but the moment a\n * cryptographically-relevant quantum computer (CRQC) exists, an attacker who\n * has a user's registered public key (or an attestation CA's key) can FORGE\n * assertions/attestations and impersonate the user or a genuine authenticator.\n * So every finding here is `category: \"signature\"`, `hndl: false`.\n *\n * The relying party pins which algorithms it will accept: `pubKeyCredParams`\n * (registration) and `supportedAlgorithmIDs` (verification) enumerate COSE\n * `alg` values, and the classical ones — ES256 (COSE -7, ECDSA P-256),\n * RS256 (-257, RSA), EdDSA (-8) and their P-384/P-521/RSA-2048+ siblings — are\n * exactly the ones a PQC migration must inventory and replace once FIDO/COSE\n * standardise post-quantum algorithm identifiers.\n *\n * WHY numeric COSE ids need their own detector: the existing JWT/JOSE rule\n * only matches QUOTED alg strings (`\"ES256\"`, `\"RS256\"`). WebAuthn libraries\n * almost never write those strings — they use the NUMERIC COSE ids\n * (`alg: -7`, `supportedAlgorithmIDs: [-7, -257]`) and language-level enum\n * identifiers (`COSEAlgorithmIdentifier.ES256`, `webauthncose.AlgES256`,\n * `COSEAlgorithmIdentifier.EDDSA`). None of those carry the quote characters\n * the JWT rule keys off, so the entire WebAuthn surface is invisible today.\n *\n * Two independent match shapes per family, both gated by a file-level WebAuthn\n * marker (see `hasWebauthnMarker`) so the generic numeric `alg: -7` form can't\n * fire on unrelated code that happens to assign a small negative number:\n *\n *  1. NUMERIC form — the COSE `alg` value as an integer, either as an object\n *     member (`alg: -7`, `alg = -257`) or inside a `supportedAlgorithmIDs`\n *     array (`supportedAlgorithmIDs: [-7, -257]`). Restricted to the classical\n *     COSE numbers only; symmetric / KDF / \"direct\" ids (e.g. -6, HS*) are\n *     never in the alternation, so they cannot match.\n *  2. ENUM form — the COSE algorithm's identifier as written in each library:\n *     `COSEAlgorithmIdentifier.ES256|RS256|EdDSA|ECDSA_SHA_256` (webauthn4j,\n *     py_webauthn) and Go's `webauthncose.AlgES256` / `AlgRS256` / `AlgEdDSA`\n *     constants.\n *\n * COSE algorithm numbers → {@link AlgorithmFamily} (per the COSE registry, using\n * the mapping this detector is specified against):\n *  - ES256 (-7), ES384 (-35), ES512 (-36)      → ECDSA\n *  - RS256 (-257), RS384 (-258), RS512 (-259)  → RSA\n *  - EdDSA (-8)                                 → EdDSA\n *\n * Fast reject: `detect()` bails unless the file carries a distinctive WebAuthn\n * API token (`pubKeyCredParams`, `PublicKeyCredential`, `webauthn`,\n * `COSEAlgorithm`, `supportedAlgorithmIDs`, `navigator.credentials`). Those\n * tokens are the marker gate ONLY — they never produce a standalone finding.\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport {\n  DOC_EXTENSIONS,\n  eachMatch,\n  findingFromRule,\n  hasExtension,\n  maskBlockComments,\n  maskCommentLines,\n} from \"../detect-utils.js\";\nimport { CWE_BROKEN_CRYPTO } from \"../cwe.js\";\n\n// Classical COSE algorithm numbers, grouped by family (see module docstring).\nconst NUM_ECDSA = \"7|35|36\"; // ES256, ES384, ES512\nconst NUM_RSA = \"257|258|259\"; // RS256, RS384, RS512\nconst NUM_EDDSA = \"8\"; // EdDSA\n\n// --- NUMERIC form: a COSE `alg` value written as an integer. ---\n// (a) object member: `alg: -7`, `alg = -257` (JS/JSON, Python `alg=-7`).\n// `[\"']?alg[\"']?` tolerates the JSON/serialized form `\"alg\": -7` (the WebAuthn\n// options object is JSON-serializable and often stored/transmitted/tested as JSON\n// with a quoted key), as well as the unquoted `alg: -7` / `alg = -7` (audit M2).\nconst RE_NUM_ECDSA = new RegExp(`[\"']?\\\\balg\\\\b[\"']?\\\\s*[:=]\\\\s*-(?:${NUM_ECDSA})\\\\b`, \"g\");\nconst RE_NUM_RSA = new RegExp(`[\"']?\\\\balg\\\\b[\"']?\\\\s*[:=]\\\\s*-(?:${NUM_RSA})\\\\b`, \"g\");\nconst RE_NUM_EDDSA = new RegExp(`[\"']?\\\\balg\\\\b[\"']?\\\\s*[:=]\\\\s*-(?:${NUM_EDDSA})\\\\b`, \"g\");\n// (b) `supportedAlgorithmIDs: [-7, -257]` array (@simplewebauthn verify option).\n// `[^\\]]*` stays inside a single array literal; one match per family even when\n// the array lists several ids of that family.\nconst RE_IDS_ECDSA = new RegExp(\n  `supportedAlgorithmIDs\\\\s*[:=]\\\\s*\\\\[[^\\\\]]*-(?:${NUM_ECDSA})\\\\b`,\n  \"g\",\n);\nconst RE_IDS_RSA = new RegExp(`supportedAlgorithmIDs\\\\s*[:=]\\\\s*\\\\[[^\\\\]]*-(?:${NUM_RSA})\\\\b`, \"g\");\nconst RE_IDS_EDDSA = new RegExp(\n  `supportedAlgorithmIDs\\\\s*[:=]\\\\s*\\\\[[^\\\\]]*-(?:${NUM_EDDSA})\\\\b`,\n  \"g\",\n);\n\n// --- ENUM form: the COSE algorithm's language-level identifier. ---\n// webauthn4j / py_webauthn: `COSEAlgorithmIdentifier.<name>`; go-webauthn:\n// `webauthncose.Alg<name>` (matched bare as `Alg<name>`).\nconst RE_ENUM_ECDSA =\n  /\\bCOSEAlgorithmIdentifier\\.(?:ES(?:256|384|512)|ECDSA_SHA_(?:256|384|512))\\b|\\bAlgES(?:256|384|512)\\b/g;\nconst RE_ENUM_RSA =\n  /\\bCOSEAlgorithmIdentifier\\.(?:RS(?:256|384|512)|RSASSA_[A-Za-z0-9_]+)\\b|\\bAlgRS(?:256|384|512)\\b/g;\nconst RE_ENUM_EDDSA = /\\bCOSEAlgorithmIdentifier\\.(?:EdDSA|EDDSA)\\b|\\bAlgEdDSA\\b/g;\n\nconst REMEDIATION =\n  \"WebAuthn/FIDO2 is standardizing PQC COSE algorithms; inventory the classical attestation/assertion algs now and plan migration.\";\n\nconst RULE_WEBAUTHN_ECDSA: RuleMeta = {\n  id: \"webauthn-ecdsa\",\n  title: \"WebAuthn ECDSA COSE algorithm\",\n  description:\n    \"WebAuthn/FIDO2 credential pins a classical ECDSA COSE algorithm (ES256/ES384/ES512)\",\n  category: \"signature\",\n  severity: \"medium\",\n  confidence: \"high\",\n  algorithm: \"ECDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"WebAuthn/FIDO2 relying party accepts a classical ECDSA COSE algorithm (ES256/ES384/ES512); attestation/assertion signatures become forgeable once a CRQC exists.\",\n  remediation: REMEDIATION,\n};\nconst RULE_WEBAUTHN_RSA: RuleMeta = {\n  id: \"webauthn-rsa\",\n  title: \"WebAuthn RSA COSE algorithm\",\n  description: \"WebAuthn/FIDO2 credential pins a classical RSA COSE algorithm (RS256/RS384/RS512)\",\n  category: \"signature\",\n  severity: \"medium\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"WebAuthn/FIDO2 relying party accepts a classical RSA COSE algorithm (RS256/RS384/RS512); attestation/assertion signatures become forgeable once a CRQC exists.\",\n  remediation: REMEDIATION,\n};\nconst RULE_WEBAUTHN_EDDSA: RuleMeta = {\n  id: \"webauthn-eddsa\",\n  title: \"WebAuthn EdDSA COSE algorithm\",\n  description: \"WebAuthn/FIDO2 credential pins the classical EdDSA COSE algorithm (COSE -8)\",\n  category: \"signature\",\n  severity: \"medium\",\n  confidence: \"high\",\n  algorithm: \"EdDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"WebAuthn/FIDO2 relying party accepts the classical EdDSA COSE algorithm (Ed25519); modern but still classical — attestation/assertion signatures become forgeable once a CRQC exists.\",\n  remediation: REMEDIATION,\n};\n\ninterface WebauthnRule {\n  meta: RuleMeta;\n  res: readonly RegExp[];\n}\n\nconst WEBAUTHN_RULES: readonly WebauthnRule[] = [\n  { meta: RULE_WEBAUTHN_ECDSA, res: [RE_NUM_ECDSA, RE_IDS_ECDSA, RE_ENUM_ECDSA] },\n  { meta: RULE_WEBAUTHN_RSA, res: [RE_NUM_RSA, RE_IDS_RSA, RE_ENUM_RSA] },\n  { meta: RULE_WEBAUTHN_EDDSA, res: [RE_NUM_EDDSA, RE_IDS_EDDSA, RE_ENUM_EDDSA] },\n];\n\n/**\n * True when `content` carries a distinctive WebAuthn API token. Used ONLY as\n * the fast-reject marker gate — none of these tokens produce a finding — so the\n * generic numeric `alg: -7` form can't fire on unrelated code.\n */\nfunction hasWebauthnMarker(content: string): boolean {\n  return (\n    content.includes(\"pubKeyCredParams\") ||\n    content.includes(\"PublicKeyCredential\") ||\n    content.includes(\"COSEAlgorithm\") ||\n    content.includes(\"supportedAlgorithmIDs\") ||\n    content.includes(\"navigator.credentials\") ||\n    /webauthn/i.test(content)\n  );\n}\n\n/** Detects classical COSE signature algorithms pinned by WebAuthn/FIDO2 relying parties. */\nexport const webauthnDetector: Detector = {\n  id: \"webauthn-crypto\",\n  description: \"Classical COSE signature algorithms in WebAuthn/FIDO2/passkey relying-party code\",\n  scope: \"config\",\n  language: \"any\",\n  rules: WEBAUTHN_RULES.map((r) => r.meta),\n  appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),\n  detect({ file, content }): Finding[] {\n    if (!hasWebauthnMarker(content)) return [];\n\n    // Mask C-style (`//`, `/* */`) and hash (`#`) comments so a commented-out\n    // options object can't fire. Offsets are preserved so finding locations stay\n    // exact.\n    const scan = maskCommentLines(maskBlockComments(content), [\"//\", \"#\"]);\n    const findings: Finding[] = [];\n    for (const { meta, res } of WEBAUTHN_RULES) {\n      for (const re of res) {\n        eachMatch(re, scan, (m) =>\n          findings.push(\n            findingFromRule(meta, { file, content, index: m.index, matchLength: m[0].length }),\n          ),\n        );\n      }\n    }\n    return findings;\n  },\n};\n"]}

package/dist/detectors/xmldsig.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Config detector: classical crypto in XML Digital Signature / XML Encryption
+ * (W3C XML-DSig / XML-Enc), the algorithm layer under SAML SSO, WS-Security /
+ * SOAP, and signed XML documents. Enterprise identity is ubiquitous and its IdP
+ * signing keys are long-lived, so a forged SAML assertion is a prime quantum
+ * forgery surface; an encrypted SAML assertion (RSA key transport) is
+ * harvest-now-decrypt-later exposed.
+ *
+ * Detection keys off the W3C algorithm URIs, which are globally-unique constant
+ * strings (RFC-precise, so a lexical match is exact):
+ *  - `…xmldsig#rsa-sha1` / `…xmldsig-more#rsa-sha256` …  → RSA signature (forgeable)
+ *  - `…xmldsig11#dsa-sha256` / `…xmldsig#dsa-sha1`       → DSA signature
+ *  - `…xmldsig-more#ecdsa-sha256` …                      → ECDSA signature
+ *  - `…xmlenc#rsa-oaep(-mgf1p)` / `…xmlenc#rsa-1_5`      → RSA key transport (HNDL)
+ *
+ * These URIs appear both in XML config (`.xml`) and as string constants in SAML
+ * library code (python3-saml, xml-crypto, OpenSAML), so the detector runs on any
+ * non-doc file.
+ */
+import type { Detector } from "../types.js";
+/** Detects classical XML-DSig / XML-Enc algorithms (SAML, WS-Security, signed XML). */
+export declare const xmldsigDetector: Detector;
+//# sourceMappingURL=xmldsig.d.ts.map

package/dist/detectors/xmldsig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"xmldsig.d.ts","sourceRoot":"","sources":["../../src/detectors/xmldsig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AAsE/D,uFAAuF;AACvF,eAAO,MAAM,eAAe,EAAE,QAwB7B,CAAC"}

package/dist/detectors/xmldsig.js

@@ -0,0 +1,84 @@
+import { DOC_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+// The `#fragment` of the W3C XML-DSig / XML-Enc algorithm URIs. Anchored on the
+// namespace fragment (`xmldsig…#` / `xmlenc#`) so a bare `rsa-sha256` elsewhere
+// doesn't misfire.
+const RE_XMLDSIG_RSA = /\bxmldsig(?:-more|11)?#rsa-sha(?:1|224|256|384|512)\b/g;
+const RE_XMLDSIG_DSA = /\bxmldsig(?:11)?#dsa-sha(?:1|256)\b/g;
+const RE_XMLDSIG_ECDSA = /\bxmldsig-more#ecdsa-sha(?:1|224|256|384|512)\b/g;
+const RE_XMLENC_RSA = /\bxmlenc#rsa-(?:oaep(?:-mgf1p)?|1_5)\b/g;
+const RULE_XMLDSIG_RSA = {
+    id: "xmldsig-rsa-sign",
+    title: "XML-DSig RSA signature",
+    description: "XML Digital Signature with an RSA-SHA* algorithm (SAML/WS-Security)",
+    category: "signature",
+    severity: "medium",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "XML signatures (SAML / WS-Security) use classical RSA (rsa-sha*); a quantum attacker could forge assertions signed with this key.",
+    remediation: "Track PQC XML-DSig / SAML profiles (ML-DSA); rotate to a PQC signing key as tooling and IdPs add support.",
+};
+const RULE_XMLDSIG_DSA = {
+    id: "xmldsig-dsa-sign",
+    title: "XML-DSig DSA signature",
+    description: "XML Digital Signature with a DSA-SHA* algorithm",
+    category: "signature",
+    severity: "medium",
+    confidence: "high",
+    algorithm: "DSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "XML signatures use classical DSA (dsa-sha*) — deprecated and quantum-forgeable.",
+    remediation: "Migrate off DSA now; track PQC XML-DSig profiles (ML-DSA).",
+};
+const RULE_XMLDSIG_ECDSA = {
+    id: "xmldsig-ecdsa-sign",
+    title: "XML-DSig ECDSA signature",
+    description: "XML Digital Signature with an ECDSA-SHA* algorithm",
+    category: "signature",
+    severity: "medium",
+    confidence: "high",
+    algorithm: "ECDSA",
+    hndl: false,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "XML signatures use classical ECDSA (ecdsa-sha*); forgeable by a quantum attacker.",
+    remediation: "Track PQC XML-DSig / SAML profiles (ML-DSA); rotate the signing key when supported.",
+};
+const RULE_XMLENC_RSA = {
+    id: "xmlenc-rsa-keytransport",
+    title: "XML-Enc RSA key transport",
+    description: "XML Encryption with RSA-OAEP / RSA-1_5 key transport (encrypted SAML assertions)",
+    category: "kem",
+    severity: "high",
+    confidence: "high",
+    algorithm: "RSA",
+    hndl: true,
+    cwe: CWE_BROKEN_CRYPTO,
+    message: "XML Encryption wraps the content key with classical RSA (rsa-oaep / rsa-1_5); encrypted XML (e.g. SAML assertions) is harvest-now-decrypt-later exposed.",
+    remediation: "Plan migration to a post-quantum KEM (ML-KEM-768) for key transport as XML-Enc / SAML PQC profiles mature.",
+};
+/** Detects classical XML-DSig / XML-Enc algorithms (SAML, WS-Security, signed XML). */
+export const xmldsigDetector = {
+    id: "xmldsig-crypto",
+    description: "Classical XML-DSig / XML-Enc algorithms (SAML, WS-Security, signed XML)",
+    scope: "config",
+    language: "any",
+    // Skip prose/docs: a page explaining the SAML algorithm URIs is not live config.
+    appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),
+    rules: [RULE_XMLDSIG_RSA, RULE_XMLDSIG_DSA, RULE_XMLDSIG_ECDSA, RULE_XMLENC_RSA],
+    detect({ file, content }) {
+        // Fast reject: only proceed if an XML-DSig / XML-Enc namespace fragment is present.
+        if (!content.includes("xmldsig") && !content.includes("xmlenc"))
+            return [];
+        const findings = [];
+        const add = (re, rule) => eachMatch(re, content, (m) => findings.push(findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length })));
+        add(RE_XMLDSIG_RSA, RULE_XMLDSIG_RSA);
+        add(RE_XMLDSIG_DSA, RULE_XMLDSIG_DSA);
+        add(RE_XMLDSIG_ECDSA, RULE_XMLDSIG_ECDSA);
+        add(RE_XMLENC_RSA, RULE_XMLENC_RSA);
+        return findings;
+    },
+};
+//# sourceMappingURL=xmldsig.js.map

package/dist/detectors/xmldsig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"xmldsig.js","sourceRoot":"","sources":["../../src/detectors/xmldsig.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC9F,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAE9C,gFAAgF;AAChF,gFAAgF;AAChF,mBAAmB;AACnB,MAAM,cAAc,GAAG,wDAAwD,CAAC;AAChF,MAAM,cAAc,GAAG,sCAAsC,CAAC;AAC9D,MAAM,gBAAgB,GAAG,kDAAkD,CAAC;AAC5E,MAAM,aAAa,GAAG,yCAAyC,CAAC;AAEhE,MAAM,gBAAgB,GAAa;IACjC,EAAE,EAAE,kBAAkB;IACtB,KAAK,EAAE,wBAAwB;IAC/B,WAAW,EAAE,qEAAqE;IAClF,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,mIAAmI;IACrI,WAAW,EACT,2GAA2G;CAC9G,CAAC;AACF,MAAM,gBAAgB,GAAa;IACjC,EAAE,EAAE,kBAAkB;IACtB,KAAK,EAAE,wBAAwB;IAC/B,WAAW,EAAE,iDAAiD;IAC9D,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,iFAAiF;IAC1F,WAAW,EAAE,4DAA4D;CAC1E,CAAC;AACF,MAAM,kBAAkB,GAAa;IACnC,EAAE,EAAE,oBAAoB;IACxB,KAAK,EAAE,0BAA0B;IACjC,WAAW,EAAE,oDAAoD;IACjE,QAAQ,EAAE,WAAW;IACrB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,OAAO;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,mFAAmF;IAC5F,WAAW,EACT,qFAAqF;CACxF,CAAC;AACF,MAAM,eAAe,GAAa;IAChC,EAAE,EAAE,yBAAyB;IAC7B,KAAK,EAAE,2BAA2B;IAClC,WAAW,EAAE,kFAAkF;IAC/F,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,SAAS,EAAE,KAAK;IAChB,IAAI,EAAE,IAAI;IACV,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,0JAA0J;IAC5J,WAAW,EACT,4GAA4G;CAC/G,CAAC;AAEF,uFAAuF;AACvF,MAAM,CAAC,MAAM,eAAe,GAAa;IACvC,EAAE,EAAE,gBAAgB;IACpB,WAAW,EAAE,yEAAyE;IACtF,KAAK,EAAE,QAAQ;IACf,QAAQ,EAAE,KAAK;IACf,iFAAiF;IACjF,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,cAAc,CAAC;IAClD,KAAK,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,eAAe,CAAC;IAChF,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QACtB,oFAAoF;QACpF,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QAC3E,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,IAAc,EAAQ,EAAE,CAC/C,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAC3B,QAAQ,CAAC,IAAI,CACX,eAAe,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CACnF,CACF,CAAC;QACJ,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;QACtC,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;QACtC,GAAG,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;QAC1C,GAAG,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QACpC,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC","sourcesContent":["/**\n * Config detector: classical crypto in XML Digital Signature / XML Encryption\n * (W3C XML-DSig / XML-Enc), the algorithm layer under SAML SSO, WS-Security /\n * SOAP, and signed XML documents. Enterprise identity is ubiquitous and its IdP\n * signing keys are long-lived, so a forged SAML assertion is a prime quantum\n * forgery surface; an encrypted SAML assertion (RSA key transport) is\n * harvest-now-decrypt-later exposed.\n *\n * Detection keys off the W3C algorithm URIs, which are globally-unique constant\n * strings (RFC-precise, so a lexical match is exact):\n *  - `…xmldsig#rsa-sha1` / `…xmldsig-more#rsa-sha256` …  → RSA signature (forgeable)\n *  - `…xmldsig11#dsa-sha256` / `…xmldsig#dsa-sha1`       → DSA signature\n *  - `…xmldsig-more#ecdsa-sha256` …                      → ECDSA signature\n *  - `…xmlenc#rsa-oaep(-mgf1p)` / `…xmlenc#rsa-1_5`      → RSA key transport (HNDL)\n *\n * These URIs appear both in XML config (`.xml`) and as string constants in SAML\n * library code (python3-saml, xml-crypto, OpenSAML), so the detector runs on any\n * non-doc file.\n */\nimport type { Detector, Finding, RuleMeta } from \"../types.js\";\nimport { DOC_EXTENSIONS, eachMatch, findingFromRule, hasExtension } from \"../detect-utils.js\";\nimport { CWE_BROKEN_CRYPTO } from \"../cwe.js\";\n\n// The `#fragment` of the W3C XML-DSig / XML-Enc algorithm URIs. Anchored on the\n// namespace fragment (`xmldsig…#` / `xmlenc#`) so a bare `rsa-sha256` elsewhere\n// doesn't misfire.\nconst RE_XMLDSIG_RSA = /\\bxmldsig(?:-more|11)?#rsa-sha(?:1|224|256|384|512)\\b/g;\nconst RE_XMLDSIG_DSA = /\\bxmldsig(?:11)?#dsa-sha(?:1|256)\\b/g;\nconst RE_XMLDSIG_ECDSA = /\\bxmldsig-more#ecdsa-sha(?:1|224|256|384|512)\\b/g;\nconst RE_XMLENC_RSA = /\\bxmlenc#rsa-(?:oaep(?:-mgf1p)?|1_5)\\b/g;\n\nconst RULE_XMLDSIG_RSA: RuleMeta = {\n  id: \"xmldsig-rsa-sign\",\n  title: \"XML-DSig RSA signature\",\n  description: \"XML Digital Signature with an RSA-SHA* algorithm (SAML/WS-Security)\",\n  category: \"signature\",\n  severity: \"medium\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"XML signatures (SAML / WS-Security) use classical RSA (rsa-sha*); a quantum attacker could forge assertions signed with this key.\",\n  remediation:\n    \"Track PQC XML-DSig / SAML profiles (ML-DSA); rotate to a PQC signing key as tooling and IdPs add support.\",\n};\nconst RULE_XMLDSIG_DSA: RuleMeta = {\n  id: \"xmldsig-dsa-sign\",\n  title: \"XML-DSig DSA signature\",\n  description: \"XML Digital Signature with a DSA-SHA* algorithm\",\n  category: \"signature\",\n  severity: \"medium\",\n  confidence: \"high\",\n  algorithm: \"DSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"XML signatures use classical DSA (dsa-sha*) — deprecated and quantum-forgeable.\",\n  remediation: \"Migrate off DSA now; track PQC XML-DSig profiles (ML-DSA).\",\n};\nconst RULE_XMLDSIG_ECDSA: RuleMeta = {\n  id: \"xmldsig-ecdsa-sign\",\n  title: \"XML-DSig ECDSA signature\",\n  description: \"XML Digital Signature with an ECDSA-SHA* algorithm\",\n  category: \"signature\",\n  severity: \"medium\",\n  confidence: \"high\",\n  algorithm: \"ECDSA\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message: \"XML signatures use classical ECDSA (ecdsa-sha*); forgeable by a quantum attacker.\",\n  remediation:\n    \"Track PQC XML-DSig / SAML profiles (ML-DSA); rotate the signing key when supported.\",\n};\nconst RULE_XMLENC_RSA: RuleMeta = {\n  id: \"xmlenc-rsa-keytransport\",\n  title: \"XML-Enc RSA key transport\",\n  description: \"XML Encryption with RSA-OAEP / RSA-1_5 key transport (encrypted SAML assertions)\",\n  category: \"kem\",\n  severity: \"high\",\n  confidence: \"high\",\n  algorithm: \"RSA\",\n  hndl: true,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"XML Encryption wraps the content key with classical RSA (rsa-oaep / rsa-1_5); encrypted XML (e.g. SAML assertions) is harvest-now-decrypt-later exposed.\",\n  remediation:\n    \"Plan migration to a post-quantum KEM (ML-KEM-768) for key transport as XML-Enc / SAML PQC profiles mature.\",\n};\n\n/** Detects classical XML-DSig / XML-Enc algorithms (SAML, WS-Security, signed XML). */\nexport const xmldsigDetector: Detector = {\n  id: \"xmldsig-crypto\",\n  description: \"Classical XML-DSig / XML-Enc algorithms (SAML, WS-Security, signed XML)\",\n  scope: \"config\",\n  language: \"any\",\n  // Skip prose/docs: a page explaining the SAML algorithm URIs is not live config.\n  appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),\n  rules: [RULE_XMLDSIG_RSA, RULE_XMLDSIG_DSA, RULE_XMLDSIG_ECDSA, RULE_XMLENC_RSA],\n  detect({ file, content }): Finding[] {\n    // Fast reject: only proceed if an XML-DSig / XML-Enc namespace fragment is present.\n    if (!content.includes(\"xmldsig\") && !content.includes(\"xmlenc\")) return [];\n    const findings: Finding[] = [];\n    const add = (re: RegExp, rule: RuleMeta): void =>\n      eachMatch(re, content, (m) =>\n        findings.push(\n          findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),\n        ),\n      );\n    add(RE_XMLDSIG_RSA, RULE_XMLDSIG_RSA);\n    add(RE_XMLDSIG_DSA, RULE_XMLDSIG_DSA);\n    add(RE_XMLDSIG_ECDSA, RULE_XMLDSIG_ECDSA);\n    add(RE_XMLENC_RSA, RULE_XMLENC_RSA);\n    return findings;\n  },\n};\n"]}

package/dist/evidence.d.ts

@@ -30,10 +30,21 @@ export interface ReadinessReport {
     attestation: {
         /** sha256 over the canonicalized deterministic body (excludes scanTimeUtc). */
         contentHash: string;
-        /** RFC-3161 / transparency-log token — filled by an external signer. */
-        timestamp: null;
-        /** Detached signature over `contentHash` — filled by an external signer. */
-        signature: null;
+        /**
+         * RFC-3161 / transparency-log token over `contentHash`, produced by an EXTERNAL
+         * timestamper (opaque string, e.g. base64). `null` until {@link signReadinessReport}
+         * runs one.
+         */
+        timestamp: string | null;
+        /**
+         * Detached signature over `contentHash`, produced by an EXTERNAL signer (opaque
+         * string, e.g. base64/PEM). `null` until {@link signReadinessReport} runs one.
+         */
+        signature: string | null;
+        /** Non-sensitive provenance label of the signer (e.g. "openssl", "cosign"). */
+        signedWith?: string;
+        /** Non-sensitive provenance label of the timestamper (e.g. "openssl-ts"). */
+        timestampedWith?: string;
     };
 }
 export interface ReadinessReportOptions {
@@ -50,4 +61,63 @@ export interface ReadinessReportOptions {
  * block itself, so re-running the same scan on the same commit is verifiable.
  */
 export declare function buildReadinessReport(result: ScanResult, opts?: ReadinessReportOptions): ReadinessReport;
+/** The result of {@link verifyReadinessReport}. */
+export interface VerifyReadinessResult {
+    /** True iff the recomputed body hash equals the hash claimed in the attestation. */
+    valid: boolean;
+    /** The hash recomputed over the report's CURRENT body. */
+    computedHash: string;
+    /** The hash claimed in the report's attestation (`attestation.contentHash`). */
+    claimedHash: string;
+    /** A short human reason; present only when `valid` is false. */
+    reason?: string;
+}
+/**
+ * Recompute the deterministic content hash over a readiness report's body and
+ * compare it to the hash the attestation claims. Detects tampering with ANY
+ * hashed field — a finding, the inventory, a policy verdict, or subject/tool
+ * metadata: editing it after the fact changes the recomputed hash, so `valid`
+ * becomes false.
+ *
+ * By construction the scan timestamp, the CBOM envelope, and the attestation
+ * block itself are EXCLUDED from the hash (see {@link buildReadinessReport}), so
+ * touching those does not fail verification — their integrity follows from their
+ * hashed inputs. The body is reconstructed from the report's OWN stored fields
+ * (including `tool.version`), so a report built by an older qScan still verifies.
+ *
+ * This checks the INTEGRITY hash only. It does NOT validate the detached
+ * signature or RFC-3161 timestamp: those are opaque tokens from an external
+ * signer (ADR-0004) and are verified with that signer's own tooling.
+ */
+export declare function verifyReadinessReport(report: ReadinessReport): VerifyReadinessResult;
+/**
+ * An EXTERNAL signer/timestamper the tool orchestrates. Per ADR-0004 the tool
+ * implements no cryptography: it hands the payload to an operator-provided signer
+ * (an `openssl`/`cosign` invocation, an RFC-3161 TSA client, …) and records what
+ * comes back. `label` is a short, non-sensitive provenance string (e.g. the signer
+ * program name) — NOT the full command, which may contain a key path.
+ */
+export interface EvidenceSigner {
+    label: string;
+    /**
+     * Produce a detached signature / timestamp token (opaque string) over `payload`.
+     * May be async so a future signer can shell out OR call a KMS / RFC-3161 TSA over
+     * the network without foreclosing that once this contract freezes at 1.0.
+     */
+    sign(payload: string): string | Promise<string>;
+}
+/** Options for {@link signReadinessReport}: a detached-signature and/or a timestamp signer. */
+export interface SignEvidenceOptions {
+    signer?: EvidenceSigner;
+    timestamper?: EvidenceSigner;
+}
+/**
+ * Fill a readiness report's attestation with a detached signature and/or RFC-3161
+ * timestamp, produced by EXTERNAL signers over the report's `contentHash`. Pure
+ * orchestration: it invokes the injected signers and records their opaque output
+ * plus a provenance label — it performs no cryptography itself (ADR-0004). Returns a
+ * NEW report; the hashed body is untouched (attestation is excluded from the hash),
+ * so signing never changes `contentHash`.
+ */
+export declare function signReadinessReport(report: ReadinessReport, opts: SignEvidenceOptions): Promise<ReadinessReport>;
 //# sourceMappingURL=evidence.d.ts.map

package/dist/evidence.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../src/evidence.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAI7C,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE/D,kFAAkF;AAClF,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,wBAAwB,CAAC;IACrC,WAAW,EAAE,CAAC,CAAC;IACf,OAAO,EAAE;QACP,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,IAAI,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IACnC,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,0EAA0E;IAC1E,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,EAAE;QACX,+EAA+E;QAC/E,WAAW,EAAE,MAAM,CAAC;QACpB,wEAAwE;QACxE,SAAS,EAAE,IAAI,CAAC;QAChB,4EAA4E;QAC5E,SAAS,EAAE,IAAI,CAAC;KACjB,CAAC;CACH;AAeD,MAAM,WAAW,sBAAsB;IACrC,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,UAAU,EAClB,IAAI,GAAE,sBAA2B,GAChC,eAAe,CA2CjB"}
+{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../src/evidence.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAI7C,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE/D,kFAAkF;AAClF,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,wBAAwB,CAAC;IACrC,WAAW,EAAE,CAAC,CAAC;IACf,OAAO,EAAE;QACP,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAC1B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,IAAI,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,SAAS,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IACnC,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,0EAA0E;IAC1E,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,EAAE;QACX,+EAA+E;QAC/E,WAAW,EAAE,MAAM,CAAC;QACpB;;;;WAIG;QACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB;;;WAGG;QACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,+EAA+E;QAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,6EAA6E;QAC7E,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH;AAeD,MAAM,WAAW,sBAAsB;IACrC,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,UAAU,EAClB,IAAI,GAAE,sBAA2B,GAChC,eAAe,CA2CjB;AAED,mDAAmD;AACnD,MAAM,WAAW,qBAAqB;IACpC,oFAAoF;IACpF,KAAK,EAAE,OAAO,CAAC;IACf,0DAA0D;IAC1D,YAAY,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,WAAW,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,eAAe,GAAG,qBAAqB,CA6BpF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACjD;AAED,+FAA+F;AAC/F,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,WAAW,CAAC,EAAE,cAAc,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,eAAe,EACvB,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,eAAe,CAAC,CAgB1B"}

package/dist/evidence.js

@@ -78,4 +78,75 @@ export function buildReadinessReport(result, opts = {}) {
         attestation: { contentHash, timestamp: null, signature: null },
     };
 }
+/**
+ * Recompute the deterministic content hash over a readiness report's body and
+ * compare it to the hash the attestation claims. Detects tampering with ANY
+ * hashed field — a finding, the inventory, a policy verdict, or subject/tool
+ * metadata: editing it after the fact changes the recomputed hash, so `valid`
+ * becomes false.
+ *
+ * By construction the scan timestamp, the CBOM envelope, and the attestation
+ * block itself are EXCLUDED from the hash (see {@link buildReadinessReport}), so
+ * touching those does not fail verification — their integrity follows from their
+ * hashed inputs. The body is reconstructed from the report's OWN stored fields
+ * (including `tool.version`), so a report built by an older qScan still verifies.
+ *
+ * This checks the INTEGRITY hash only. It does NOT validate the detached
+ * signature or RFC-3161 timestamp: those are opaque tokens from an external
+ * signer (ADR-0004) and are verified with that signer's own tooling.
+ */
+export function verifyReadinessReport(report) {
+    const hashableBody = {
+        reportType: report.reportType,
+        specVersion: report.specVersion,
+        subject: {
+            repository: report.subject.repository,
+            commit: report.subject.commit,
+            scannedRoot: report.subject.scannedRoot,
+        },
+        tool: { name: report.tool.name, version: report.tool.version },
+        inventory: report.inventory,
+        findings: report.findings,
+        ...(report.policyMapping ? { policyMapping: report.policyMapping } : {}),
+    };
+    const computedHash = "sha256:" +
+        createHash("sha256")
+            .update(JSON.stringify(canonicalize(hashableBody)))
+            .digest("hex");
+    const claimedHash = report.attestation.contentHash;
+    if (computedHash === claimedHash) {
+        return { valid: true, computedHash, claimedHash };
+    }
+    return {
+        valid: false,
+        computedHash,
+        claimedHash,
+        reason: "content-hash mismatch: the report body was modified after it was built",
+    };
+}
+/**
+ * Fill a readiness report's attestation with a detached signature and/or RFC-3161
+ * timestamp, produced by EXTERNAL signers over the report's `contentHash`. Pure
+ * orchestration: it invokes the injected signers and records their opaque output
+ * plus a provenance label — it performs no cryptography itself (ADR-0004). Returns a
+ * NEW report; the hashed body is untouched (attestation is excluded from the hash),
+ * so signing never changes `contentHash`.
+ */
+export async function signReadinessReport(report, opts) {
+    const payload = report.attestation.contentHash;
+    const signature = opts.signer ? await opts.signer.sign(payload) : report.attestation.signature;
+    const timestamp = opts.timestamper
+        ? await opts.timestamper.sign(payload)
+        : report.attestation.timestamp;
+    return {
+        ...report,
+        attestation: {
+            ...report.attestation,
+            signature,
+            timestamp,
+            ...(opts.signer ? { signedWith: opts.signer.label } : {}),
+            ...(opts.timestamper ? { timestampedWith: opts.timestamper.label } : {}),
+        },
+    };
+}
 //# sourceMappingURL=evidence.js.map

package/dist/evidence.js.map

@@ -1 +1 @@
-{"version":3,"file":"evidence.js","sourceRoot":"","sources":["../src/evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAsCjD,mFAAmF;AACnF,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACrE,GAAG,CAAC,CAAC,CAAC,GAAG,YAAY,CAAE,KAAiC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAkB,EAClB,OAA+B,EAAE;IAEjC,MAAM,QAAQ,GAAsB,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9D,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI;QACrB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI;KACtB,CAAC,CAAC,CAAC;IAEJ,+EAA+E;IAC/E,wEAAwE;IACxE,+EAA+E;IAC/E,6EAA6E;IAC7E,gFAAgF;IAChF,0EAA0E;IAC1E,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEjG,MAAM,YAAY,GAAG;QACnB,UAAU,EAAE,wBAAwB;QACpC,WAAW,EAAE,CAAC;QACd,OAAO,EAAE;YACP,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;YAC3B,WAAW,EAAE,MAAM,CAAC,IAAI;SACzB;QACD,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE;QACzC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ;QACR,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5C,CAAC;IACF,MAAM,WAAW,GACf,SAAS;QACT,UAAU,CAAC,QAAQ,CAAC;aACjB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC;aAClD,MAAM,CAAC,KAAK,CAAC,CAAC;IAEnB,OAAO;QACL,GAAG,YAAY;QACf,OAAO,EAAE,EAAE,GAAG,YAAY,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE;QACpE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;QACpB,WAAW,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;KAC5C,CAAC;AACvB,CAAC","sourcesContent":["/**\n * ISO/IEC 27001:2022 Annex A 8.24 evidence-chain export\n * (docs/compliance/iso27001-a8.24-evidence.md).\n *\n * Emits a self-describing readiness report bundling the scan result, crypto\n * inventory, and CycloneDX CBOM, plus an attestation carrying a DETERMINISTIC\n * content hash — the same scan over the same commit + config yields the same\n * hash (the volatile scan timestamp is deliberately excluded from the hashed\n * body). Signing + RFC-3161 timestamping are left to an EXTERNAL, vetted signer\n * (ADR-0004: this project performs no cryptography itself — it orchestrates a\n * signer, it does not implement one). SHA-256 here is an integrity hash (a Node\n * built-in), not an asymmetric primitive.\n *\n * Honesty boundary: this artifact is EVIDENCE for A.8.24, not the control. The\n * organization still owns the cryptography policy, key management, and the\n * conformance judgment. A clean scan is the absence of detected candidates, not\n * proof of quantum-safety (qScan is lexical). See docs/COMPLIANCE.md §3.\n */\nimport { createHash } from \"node:crypto\";\n\nimport type { ScanResult } from \"./types.js\";\nimport { toCbom } from \"./cbom.js\";\nimport { VERSION } from \"./version.js\";\nimport { buildPolicyMapping } from \"./policy.js\";\nimport type { CryptoPolicy, PolicyMapping } from \"./policy.js\";\n\n/** Stable per-finding record for the evidence body (deterministic per commit). */\nexport interface EvidenceFinding {\n  ruleId: string;\n  algorithm?: string;\n  severity: string;\n  hndl: boolean;\n  file: string;\n  line: number;\n}\n\nexport interface ReadinessReport {\n  reportType: \"quantakrypto-readiness\";\n  specVersion: 1;\n  subject: {\n    repository: string | null;\n    commit: string | null;\n    scannedRoot: string;\n    scanTimeUtc: string;\n  };\n  tool: { name: \"qScan\"; version: string };\n  inventory: ScanResult[\"inventory\"];\n  findings: EvidenceFinding[];\n  /** §4 policy verdicts, present only when a crypto policy was supplied. */\n  policyMapping?: PolicyMapping;\n  cbom: unknown;\n  attestation: {\n    /** sha256 over the canonicalized deterministic body (excludes scanTimeUtc). */\n    contentHash: string;\n    /** RFC-3161 / transparency-log token — filled by an external signer. */\n    timestamp: null;\n    /** Detached signature over `contentHash` — filled by an external signer. */\n    signature: null;\n  };\n}\n\n/** Canonical JSON: object keys sorted recursively, so the hash is reproducible. */\nfunction canonicalize(value: unknown): unknown {\n  if (Array.isArray(value)) return value.map(canonicalize);\n  if (value && typeof value === \"object\") {\n    const out: Record<string, unknown> = {};\n    for (const k of Object.keys(value as Record<string, unknown>).sort()) {\n      out[k] = canonicalize((value as Record<string, unknown>)[k]);\n    }\n    return out;\n  }\n  return value;\n}\n\nexport interface ReadinessReportOptions {\n  /** Repository URL (e.g. from `GITHUB_REPOSITORY`); omitted → null. */\n  repository?: string;\n  /** Full commit SHA (e.g. from `GITHUB_SHA`); omitted → null. */\n  commit?: string;\n  /** Optional org cryptography policy — adds the §4 `policyMapping` verdicts. */\n  policy?: CryptoPolicy;\n}\n\n/**\n * Build the A.8.24 readiness report for a scan result. The attestation's\n * `contentHash` covers everything EXCEPT the scan timestamp and the attestation\n * block itself, so re-running the same scan on the same commit is verifiable.\n */\nexport function buildReadinessReport(\n  result: ScanResult,\n  opts: ReadinessReportOptions = {},\n): ReadinessReport {\n  const findings: EvidenceFinding[] = result.findings.map((f) => ({\n    ruleId: f.ruleId,\n    ...(f.algorithm ? { algorithm: f.algorithm } : {}),\n    severity: f.severity,\n    hndl: f.hndl,\n    file: f.location.file,\n    line: f.location.line,\n  }));\n\n  // The CBOM is a deterministic *view* of the (hashed) findings + inventory, but\n  // its CycloneDX envelope carries a volatile timestamp/serial — so it is\n  // EXCLUDED from the hashed body (its integrity follows from its hashed inputs)\n  // to keep the content hash reproducible across scan runs on the same commit.\n  // §4: if the org supplied a crypto policy, attest the per-finding verdicts too.\n  // Deterministic (same findings + policy → same mapping), so it is hashed.\n  const policyMapping = opts.policy ? buildPolicyMapping(result.findings, opts.policy) : undefined;\n\n  const hashableBody = {\n    reportType: \"quantakrypto-readiness\",\n    specVersion: 1,\n    subject: {\n      repository: opts.repository ?? null,\n      commit: opts.commit ?? null,\n      scannedRoot: result.root,\n    },\n    tool: { name: \"qScan\", version: VERSION },\n    inventory: result.inventory,\n    findings,\n    ...(policyMapping ? { policyMapping } : {}),\n  };\n  const contentHash =\n    \"sha256:\" +\n    createHash(\"sha256\")\n      .update(JSON.stringify(canonicalize(hashableBody)))\n      .digest(\"hex\");\n\n  return {\n    ...hashableBody,\n    subject: { ...hashableBody.subject, scanTimeUtc: result.finishedAt },\n    cbom: toCbom(result),\n    attestation: { contentHash, timestamp: null, signature: null },\n  } as ReadinessReport;\n}\n"]}
+{"version":3,"file":"evidence.js","sourceRoot":"","sources":["../src/evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAiDjD,mFAAmF;AACnF,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACrE,GAAG,CAAC,CAAC,CAAC,GAAG,YAAY,CAAE,KAAiC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAkB,EAClB,OAA+B,EAAE;IAEjC,MAAM,QAAQ,GAAsB,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9D,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI;QACrB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI;KACtB,CAAC,CAAC,CAAC;IAEJ,+EAA+E;IAC/E,wEAAwE;IACxE,+EAA+E;IAC/E,6EAA6E;IAC7E,gFAAgF;IAChF,0EAA0E;IAC1E,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEjG,MAAM,YAAY,GAAG;QACnB,UAAU,EAAE,wBAAwB;QACpC,WAAW,EAAE,CAAC;QACd,OAAO,EAAE;YACP,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;YAC3B,WAAW,EAAE,MAAM,CAAC,IAAI;SACzB;QACD,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE;QACzC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ;QACR,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5C,CAAC;IACF,MAAM,WAAW,GACf,SAAS;QACT,UAAU,CAAC,QAAQ,CAAC;aACjB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC;aAClD,MAAM,CAAC,KAAK,CAAC,CAAC;IAEnB,OAAO;QACL,GAAG,YAAY;QACf,OAAO,EAAE,EAAE,GAAG,YAAY,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE;QACpE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;QACpB,WAAW,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;KAC5C,CAAC;AACvB,CAAC;AAcD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAuB;IAC3D,MAAM,YAAY,GAAG;QACnB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,OAAO,EAAE;YACP,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU;YACrC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;YAC7B,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW;SACxC;QACD,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE;QAC9D,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzE,CAAC;IACF,MAAM,YAAY,GAChB,SAAS;QACT,UAAU,CAAC,QAAQ,CAAC;aACjB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC;aAClD,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC;IACnD,IAAI,YAAY,KAAK,WAAW,EAAE,CAAC;QACjC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;IACpD,CAAC;IACD,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,YAAY;QACZ,WAAW;QACX,MAAM,EAAE,wEAAwE;KACjF,CAAC;AACJ,CAAC;AAyBD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAuB,EACvB,IAAyB;IAEzB,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC;IAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC;IAC/F,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW;QAChC,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;QACtC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC;IACjC,OAAO;QACL,GAAG,MAAM;QACT,WAAW,EAAE;YACX,GAAG,MAAM,CAAC,WAAW;YACrB,SAAS;YACT,SAAS;YACT,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE;KACF,CAAC;AACJ,CAAC","sourcesContent":["/**\n * ISO/IEC 27001:2022 Annex A 8.24 evidence-chain export\n * (docs/compliance/iso27001-a8.24-evidence.md).\n *\n * Emits a self-describing readiness report bundling the scan result, crypto\n * inventory, and CycloneDX CBOM, plus an attestation carrying a DETERMINISTIC\n * content hash — the same scan over the same commit + config yields the same\n * hash (the volatile scan timestamp is deliberately excluded from the hashed\n * body). Signing + RFC-3161 timestamping are left to an EXTERNAL, vetted signer\n * (ADR-0004: this project performs no cryptography itself — it orchestrates a\n * signer, it does not implement one). SHA-256 here is an integrity hash (a Node\n * built-in), not an asymmetric primitive.\n *\n * Honesty boundary: this artifact is EVIDENCE for A.8.24, not the control. The\n * organization still owns the cryptography policy, key management, and the\n * conformance judgment. A clean scan is the absence of detected candidates, not\n * proof of quantum-safety (qScan is lexical). See docs/COMPLIANCE.md §3.\n */\nimport { createHash } from \"node:crypto\";\n\nimport type { ScanResult } from \"./types.js\";\nimport { toCbom } from \"./cbom.js\";\nimport { VERSION } from \"./version.js\";\nimport { buildPolicyMapping } from \"./policy.js\";\nimport type { CryptoPolicy, PolicyMapping } from \"./policy.js\";\n\n/** Stable per-finding record for the evidence body (deterministic per commit). */\nexport interface EvidenceFinding {\n  ruleId: string;\n  algorithm?: string;\n  severity: string;\n  hndl: boolean;\n  file: string;\n  line: number;\n}\n\nexport interface ReadinessReport {\n  reportType: \"quantakrypto-readiness\";\n  specVersion: 1;\n  subject: {\n    repository: string | null;\n    commit: string | null;\n    scannedRoot: string;\n    scanTimeUtc: string;\n  };\n  tool: { name: \"qScan\"; version: string };\n  inventory: ScanResult[\"inventory\"];\n  findings: EvidenceFinding[];\n  /** §4 policy verdicts, present only when a crypto policy was supplied. */\n  policyMapping?: PolicyMapping;\n  cbom: unknown;\n  attestation: {\n    /** sha256 over the canonicalized deterministic body (excludes scanTimeUtc). */\n    contentHash: string;\n    /**\n     * RFC-3161 / transparency-log token over `contentHash`, produced by an EXTERNAL\n     * timestamper (opaque string, e.g. base64). `null` until {@link signReadinessReport}\n     * runs one.\n     */\n    timestamp: string | null;\n    /**\n     * Detached signature over `contentHash`, produced by an EXTERNAL signer (opaque\n     * string, e.g. base64/PEM). `null` until {@link signReadinessReport} runs one.\n     */\n    signature: string | null;\n    /** Non-sensitive provenance label of the signer (e.g. \"openssl\", \"cosign\"). */\n    signedWith?: string;\n    /** Non-sensitive provenance label of the timestamper (e.g. \"openssl-ts\"). */\n    timestampedWith?: string;\n  };\n}\n\n/** Canonical JSON: object keys sorted recursively, so the hash is reproducible. */\nfunction canonicalize(value: unknown): unknown {\n  if (Array.isArray(value)) return value.map(canonicalize);\n  if (value && typeof value === \"object\") {\n    const out: Record<string, unknown> = {};\n    for (const k of Object.keys(value as Record<string, unknown>).sort()) {\n      out[k] = canonicalize((value as Record<string, unknown>)[k]);\n    }\n    return out;\n  }\n  return value;\n}\n\nexport interface ReadinessReportOptions {\n  /** Repository URL (e.g. from `GITHUB_REPOSITORY`); omitted → null. */\n  repository?: string;\n  /** Full commit SHA (e.g. from `GITHUB_SHA`); omitted → null. */\n  commit?: string;\n  /** Optional org cryptography policy — adds the §4 `policyMapping` verdicts. */\n  policy?: CryptoPolicy;\n}\n\n/**\n * Build the A.8.24 readiness report for a scan result. The attestation's\n * `contentHash` covers everything EXCEPT the scan timestamp and the attestation\n * block itself, so re-running the same scan on the same commit is verifiable.\n */\nexport function buildReadinessReport(\n  result: ScanResult,\n  opts: ReadinessReportOptions = {},\n): ReadinessReport {\n  const findings: EvidenceFinding[] = result.findings.map((f) => ({\n    ruleId: f.ruleId,\n    ...(f.algorithm ? { algorithm: f.algorithm } : {}),\n    severity: f.severity,\n    hndl: f.hndl,\n    file: f.location.file,\n    line: f.location.line,\n  }));\n\n  // The CBOM is a deterministic *view* of the (hashed) findings + inventory, but\n  // its CycloneDX envelope carries a volatile timestamp/serial — so it is\n  // EXCLUDED from the hashed body (its integrity follows from its hashed inputs)\n  // to keep the content hash reproducible across scan runs on the same commit.\n  // §4: if the org supplied a crypto policy, attest the per-finding verdicts too.\n  // Deterministic (same findings + policy → same mapping), so it is hashed.\n  const policyMapping = opts.policy ? buildPolicyMapping(result.findings, opts.policy) : undefined;\n\n  const hashableBody = {\n    reportType: \"quantakrypto-readiness\",\n    specVersion: 1,\n    subject: {\n      repository: opts.repository ?? null,\n      commit: opts.commit ?? null,\n      scannedRoot: result.root,\n    },\n    tool: { name: \"qScan\", version: VERSION },\n    inventory: result.inventory,\n    findings,\n    ...(policyMapping ? { policyMapping } : {}),\n  };\n  const contentHash =\n    \"sha256:\" +\n    createHash(\"sha256\")\n      .update(JSON.stringify(canonicalize(hashableBody)))\n      .digest(\"hex\");\n\n  return {\n    ...hashableBody,\n    subject: { ...hashableBody.subject, scanTimeUtc: result.finishedAt },\n    cbom: toCbom(result),\n    attestation: { contentHash, timestamp: null, signature: null },\n  } as ReadinessReport;\n}\n\n/** The result of {@link verifyReadinessReport}. */\nexport interface VerifyReadinessResult {\n  /** True iff the recomputed body hash equals the hash claimed in the attestation. */\n  valid: boolean;\n  /** The hash recomputed over the report's CURRENT body. */\n  computedHash: string;\n  /** The hash claimed in the report's attestation (`attestation.contentHash`). */\n  claimedHash: string;\n  /** A short human reason; present only when `valid` is false. */\n  reason?: string;\n}\n\n/**\n * Recompute the deterministic content hash over a readiness report's body and\n * compare it to the hash the attestation claims. Detects tampering with ANY\n * hashed field — a finding, the inventory, a policy verdict, or subject/tool\n * metadata: editing it after the fact changes the recomputed hash, so `valid`\n * becomes false.\n *\n * By construction the scan timestamp, the CBOM envelope, and the attestation\n * block itself are EXCLUDED from the hash (see {@link buildReadinessReport}), so\n * touching those does not fail verification — their integrity follows from their\n * hashed inputs. The body is reconstructed from the report's OWN stored fields\n * (including `tool.version`), so a report built by an older qScan still verifies.\n *\n * This checks the INTEGRITY hash only. It does NOT validate the detached\n * signature or RFC-3161 timestamp: those are opaque tokens from an external\n * signer (ADR-0004) and are verified with that signer's own tooling.\n */\nexport function verifyReadinessReport(report: ReadinessReport): VerifyReadinessResult {\n  const hashableBody = {\n    reportType: report.reportType,\n    specVersion: report.specVersion,\n    subject: {\n      repository: report.subject.repository,\n      commit: report.subject.commit,\n      scannedRoot: report.subject.scannedRoot,\n    },\n    tool: { name: report.tool.name, version: report.tool.version },\n    inventory: report.inventory,\n    findings: report.findings,\n    ...(report.policyMapping ? { policyMapping: report.policyMapping } : {}),\n  };\n  const computedHash =\n    \"sha256:\" +\n    createHash(\"sha256\")\n      .update(JSON.stringify(canonicalize(hashableBody)))\n      .digest(\"hex\");\n  const claimedHash = report.attestation.contentHash;\n  if (computedHash === claimedHash) {\n    return { valid: true, computedHash, claimedHash };\n  }\n  return {\n    valid: false,\n    computedHash,\n    claimedHash,\n    reason: \"content-hash mismatch: the report body was modified after it was built\",\n  };\n}\n\n/**\n * An EXTERNAL signer/timestamper the tool orchestrates. Per ADR-0004 the tool\n * implements no cryptography: it hands the payload to an operator-provided signer\n * (an `openssl`/`cosign` invocation, an RFC-3161 TSA client, …) and records what\n * comes back. `label` is a short, non-sensitive provenance string (e.g. the signer\n * program name) — NOT the full command, which may contain a key path.\n */\nexport interface EvidenceSigner {\n  label: string;\n  /**\n   * Produce a detached signature / timestamp token (opaque string) over `payload`.\n   * May be async so a future signer can shell out OR call a KMS / RFC-3161 TSA over\n   * the network without foreclosing that once this contract freezes at 1.0.\n   */\n  sign(payload: string): string | Promise<string>;\n}\n\n/** Options for {@link signReadinessReport}: a detached-signature and/or a timestamp signer. */\nexport interface SignEvidenceOptions {\n  signer?: EvidenceSigner;\n  timestamper?: EvidenceSigner;\n}\n\n/**\n * Fill a readiness report's attestation with a detached signature and/or RFC-3161\n * timestamp, produced by EXTERNAL signers over the report's `contentHash`. Pure\n * orchestration: it invokes the injected signers and records their opaque output\n * plus a provenance label — it performs no cryptography itself (ADR-0004). Returns a\n * NEW report; the hashed body is untouched (attestation is excluded from the hash),\n * so signing never changes `contentHash`.\n */\nexport async function signReadinessReport(\n  report: ReadinessReport,\n  opts: SignEvidenceOptions,\n): Promise<ReadinessReport> {\n  const payload = report.attestation.contentHash;\n  const signature = opts.signer ? await opts.signer.sign(payload) : report.attestation.signature;\n  const timestamp = opts.timestamper\n    ? await opts.timestamper.sign(payload)\n    : report.attestation.timestamp;\n  return {\n    ...report,\n    attestation: {\n      ...report.attestation,\n      signature,\n      timestamp,\n      ...(opts.signer ? { signedWith: opts.signer.label } : {}),\n      ...(opts.timestamper ? { timestampedWith: opts.timestamper.label } : {}),\n    },\n  };\n}\n"]}

package/dist/index.d.ts

@@ -28,32 +28,35 @@ export { configToggleCodemod } from "./codemods/config-toggle.js";
 export { remediateFindings } from "./remediate-pipeline.js";
 export type { RemediateOptions, RemediationResult, VerifiedPatch, RejectedPatch, } from "./remediate-pipeline.js";
 export { AbortError, BudgetExceededError } from "./errors.js";
-export { scanParallel, mergeChunkResults, chunkByBytes } from "./parallel.js";
-export type { ScanChunk, ChunkResult, SizedFile } from "./parallel.js";
-export { DetectorRegistry, defaultRegistry, detectorScope } from "./registry.js";
-export type { RuleCatalogEntry } from "./registry.js";
+export { scanParallel } from "./parallel.js";
+export type { ScanChunk } from "./parallel.js";
+export { DetectorRegistry, defaultRegistry } from "./registry.js";
 export { fingerprintFinding, baselineFromFindings, applyBaseline, loadBaseline, saveBaseline, BASELINE_VERSION, } from "./baseline.js";
 export type { Baseline } from "./baseline.js";
 export { changedFiles } from "./changed.js";
 export { loadConfig, ConfigError, CONFIG_FILENAME } from "./config.js";
 export type { QuantakryptoFileConfig, LoadConfigResult } from "./config.js";
-export { walkFiles, isBinaryPath, isGeneratedPath, looksMinified } from "./walk.js";
+export { walkFiles, isBinaryPath, looksMinified } from "./walk.js";
 export { isAnalyzableSource, ANALYZABLE_SOURCE_EXTENSIONS, ANALYZABLE_LANGUAGES_LABEL, } from "./detect-utils.js";
 export { buildInventory } from "./inventory.js";
 export { vulnerableDependencies, DEP_VULNERABLE_RULE, isManifestFile } from "./dependencies.js";
 export { SEVERITY_ORDER, severityRank, meetsThreshold, sarifLevel } from "./severity.js";
-export { toSarif, toJson, formatSummary, formatTierGuidance } from "./report.js";
+export { toSarif, toJson, formatSummary, formatTierGuidance, formatProfileGuidance, } from "./report.js";
 export type { ReportOptions } from "./report.js";
 export { toCbom } from "./cbom.js";
 export type { CycloneDxBom, CbomComponent } from "./cbom.js";
 export { mergeCboms } from "./cbom-merge.js";
-export { buildReadinessReport } from "./evidence.js";
-export type { ReadinessReport, EvidenceFinding, ReadinessReportOptions } from "./evidence.js";
-export { buildPolicyMapping, parseCryptoPolicy, verdictForAlgorithm } from "./policy.js";
+export { toOpenVex } from "./vex.js";
+export type { OpenVexDocument, OpenVexStatement, OpenVexOptions } from "./vex.js";
+export { buildReadinessReport, signReadinessReport, verifyReadinessReport } from "./evidence.js";
+export type { ReadinessReport, EvidenceFinding, ReadinessReportOptions, EvidenceSigner, SignEvidenceOptions, VerifyReadinessResult, } from "./evidence.js";
+export { buildPolicyMapping, parseCryptoPolicy } from "./policy.js";
 export type { CryptoPolicy, PolicyVerdict, PolicyMapping, PolicyFindingVerdict } from "./policy.js";
-export { remediationFor, remediationForTier, TIER_PARAMS, STATEFUL_HBS_NOTE, PQC_TRANSITION_NOTE, statefulHbsApplies, } from "./remediation.js";
+export { remediationFor, remediationForTier, remediationForProfile, TIER_PARAMS, STATEFUL_HBS_NOTE, PQC_TRANSITION_NOTE, statefulHbsApplies, } from "./remediation.js";
 export type { SecurityTier } from "./remediation.js";
-export { PQC_STANDARDS, standardsReviewStatus } from "./standards.js";
+export { PQC_STANDARDS } from "./standards.js";
 export type { PqcStandards, StandardsCitation, StandardsReviewStatus } from "./standards.js";
+export { STANDARDS_PROFILES, DEFAULT_PROFILE_ID, standardsProfileIds, getStandardsProfile, defaultStandardsProfile, } from "./standards-profiles.js";
+export type { StandardsProfile, HybridStance } from "./standards-profiles.js";
 export { CWE_BROKEN_CRYPTO, CWE_WEAK_STRENGTH, CWE_CERT_VALIDATION, CWE_HARDCODED_KEY, CWE_RISKY_PRIMITIVE, } from "./cwe.js";
 //# sourceMappingURL=index.d.ts.map