@quantakrypto/core 0.4.4 → 0.5.0

package/dist/remediation.js.map

@@ -1 +1 @@
-{"version":3,"file":"remediation.js","sourceRoot":"","sources":["../src/remediation.ts"],"names":[],"mappings":"AASA,8DAA8D;AAC9D,MAAM,YAAY,GAAyC;IACzD,GAAG,EAAE;QACH,SAAS,EAAE,KAAK;QAChB,cAAc,EAAE,yDAAyD;QACzE,MAAM,EACJ,4EAA4E;YAC5E,2EAA2E;YAC3E,gEAAgE;KACnE;IACD,IAAI,EAAE;QACJ,SAAS,EAAE,MAAM;QACjB,cAAc,EAAE,oCAAoC;QACpD,MAAM,EACJ,6EAA6E;YAC7E,gFAAgF;YAChF,2DAA2D;KAC9D;IACD,KAAK,EAAE;QACL,SAAS,EAAE,OAAO;QAClB,cAAc,EAAE,sBAAsB;QACtC,MAAM,EACJ,6EAA6E;YAC7E,8EAA8E;YAC9E,wBAAwB;KAC3B;IACD,KAAK,EAAE;QACL,SAAS,EAAE,OAAO;QAClB,cAAc,EAAE,sBAAsB;QACtC,MAAM,EACJ,+EAA+E;YAC/E,iFAAiF;KACpF;IACD,EAAE,EAAE;QACF,SAAS,EAAE,IAAI;QACf,cAAc,EAAE,oCAAoC;QACpD,MAAM,EACJ,2EAA2E;YAC3E,6EAA6E;KAChF;IACD,GAAG,EAAE;QACH,SAAS,EAAE,KAAK;QAChB,cAAc,EAAE,sBAAsB;QACtC,MAAM,EACJ,gFAAgF;YAChF,0DAA0D;KAC7D;IACD,MAAM,EAAE;QACN,SAAS,EAAE,QAAQ;QACnB,cAAc,EAAE,oCAAoC;QACpD,MAAM,EACJ,gFAAgF;YAChF,gFAAgF;YAChF,+CAA+C;KAClD;IACD,IAAI,EAAE;QACJ,SAAS,EAAE,MAAM;QACjB,cAAc,EAAE,+CAA+C;QAC/D,MAAM,EACJ,6EAA6E;YAC7E,+EAA+E;YAC/E,yEAAyE;YACzE,qEAAqE;KACxE;IACD,KAAK,EAAE;QACL,SAAS,EAAE,OAAO;QAClB,cAAc,EAAE,gDAAgD;QAChE,MAAM,EACJ,6EAA6E;YAC7E,gFAAgF;YAChF,8EAA8E;YAC9E,0DAA0D;KAC7D;IACD,OAAO,EAAE;QACP,SAAS,EAAE,SAAS;QACpB,cAAc,EAAE,mCAAmC;QACnD,MAAM,EACJ,6EAA6E;YAC7E,yEAAyE;KAC5E;CACF,CAAC;AAEF,kFAAkF;AAClF,MAAM,UAAU,cAAc,CAAC,SAA0B;IACvD,OAAO,YAAY,CAAC,SAAS,CAAC,CAAC;AACjC,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,eAAe,CAAC,SAA0B;IACxD,OAAO,YAAY,CAAC,SAAS,CAAC,CAAC,cAAc,CAAC;AAChD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAA0B;IAChE,OAAO,CACL,SAAS,KAAK,KAAK;QACnB,SAAS,KAAK,MAAM;QACpB,SAAS,KAAK,IAAI;QAClB,SAAS,KAAK,QAAQ;QACtB,SAAS,KAAK,MAAM;QACpB,SAAS,KAAK,OAAO,CACtB,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,iBAAiB,CAAC,SAA0B;IAC1D,OAAO,CACL,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,KAAK,KAAK,CAC7F,CAAC;AACJ,CAAC;AAcD,+CAA+C;AAC/C,MAAM,CAAC,MAAM,WAAW,GAA2E;IACjG,YAAY,EAAE;QACZ,GAAG,EAAE,uBAAuB;QAC5B,SAAS,EAAE,sBAAsB;QACjC,IAAI,EAAE,uDAAuD;KAC9D;IACD,YAAY,EAAE;QACZ,GAAG,EAAE,wBAAwB;QAC7B,SAAS,EAAE,sBAAsB;QACjC,IAAI,EAAE,yGAAyG;KAChH;CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,SAA0B,EAC1B,OAAqB,YAAY;IAEjC,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACjC,8EAA8E;IAC9E,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;IAEvD,6EAA6E;IAC7E,0EAA0E;IAC1E,8EAA8E;IAC9E,0EAA0E;IAC1E,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,MAAM;YACvB,CAAC,CAAC,kKAAkK;YACpK,CAAC,CAAC,EAAE,CAAC;QACP,OAAO;YACL,SAAS;YACT,cAAc,EAAE,GAAG,OAAO,4DAA4D;YACtF,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,iDAAiD,MAAM,CAAC,GAAG,cAAc,MAAM,CAAC,SAAS,iBAAiB,UAAU,EAAE;SAC5J,CAAC;IACJ,CAAC;IAED,OAAO;QACL,SAAS;QACT,cAAc,EAAE,GAAG,IAAI,CAAC,cAAc,MAAM,IAAI,KAAK,OAAO,EAAE;QAC9D,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,sBAAsB,MAAM,CAAC,GAAG,cAAc,MAAM,CAAC,SAAS,gBAAgB;KACpH,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAC5B,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,6EAA6E;IAC7E,mCAAmC,CAAC;AAEtC;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAC9B,+EAA+E;IAC/E,iFAAiF;IACjF,2EAA2E;IAC3E,+EAA+E;IAC/E,+EAA+E;IAC/E,gEAAgE,CAAC;AAEnE,oFAAoF;AACpF,MAAM,UAAU,kBAAkB,CAAC,SAA0B;IAC3D,+DAA+D;IAC/D,OAAO,iBAAiB,CAAC,SAAS,CAAC,CAAC;AACtC,CAAC","sourcesContent":["/**\n * Post-quantum remediation guidance for each classical asymmetric algorithm\n * family. The recommendations follow NIST's finalized PQC algorithms — ML-KEM\n * (FIPS 203), ML-DSA (FIPS 204), SLH-DSA (FIPS 205) — and the IETF hybrid\n * key-exchange groups (X25519MLKEM768, SecP384r1MLKEM1024). Forward-looking\n * standards to track are captured in {@link PQC_TRANSITION_NOTE}.\n */\nimport type { AlgorithmFamily, Remediation } from \"./types.js\";\n\n/** Canonical remediation table, keyed by algorithm family. */\nconst REMEDIATIONS: Record<AlgorithmFamily, Remediation> = {\n  RSA: {\n    algorithm: \"RSA\",\n    recommendation: \"ML-KEM-768 for encryption/KEM; ML-DSA-65 for signatures\",\n    detail:\n      \"RSA is broken by Shor's algorithm. For key transport / encryption move to \" +\n      \"ML-KEM-768 (FIPS 203), ideally as the hybrid X25519MLKEM768. For digital \" +\n      \"signatures move to ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205).\",\n  },\n  ECDH: {\n    algorithm: \"ECDH\",\n    recommendation: \"hybrid X25519MLKEM768 (ML-KEM-768)\",\n    detail:\n      \"Elliptic-curve Diffie-Hellman is broken by Shor's algorithm and is exposed \" +\n      \"to harvest-now-decrypt-later. Adopt the hybrid X25519MLKEM768 key exchange so \" +\n      \"confidentiality survives even if one component is broken.\",\n  },\n  ECDSA: {\n    algorithm: \"ECDSA\",\n    recommendation: \"ML-DSA-65 (FIPS 204)\",\n    detail:\n      \"ECDSA signatures can be forged by a quantum attacker via Shor's algorithm. \" +\n      \"Migrate to ML-DSA (Dilithium, FIPS 204) or SLH-DSA (SPHINCS+, FIPS 205) for \" +\n      \"long-lived signatures.\",\n  },\n  EdDSA: {\n    algorithm: \"EdDSA\",\n    recommendation: \"ML-DSA-65 (FIPS 204)\",\n    detail:\n      \"Ed25519 / Ed448 (EdDSA) are classical signatures broken by Shor's algorithm. \" +\n      \"Replace with ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205) for forgery resistance.\",\n  },\n  DH: {\n    algorithm: \"DH\",\n    recommendation: \"hybrid X25519MLKEM768 (ML-KEM-768)\",\n    detail:\n      \"Finite-field Diffie-Hellman is broken by Shor's algorithm and exposed to \" +\n      \"harvest-now-decrypt-later. Move to a hybrid PQC KEM such as X25519MLKEM768.\",\n  },\n  DSA: {\n    algorithm: \"DSA\",\n    recommendation: \"ML-DSA-65 (FIPS 204)\",\n    detail:\n      \"DSA is a classical, quantum-broken signature scheme (and already deprecated). \" +\n      \"Replace with ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205).\",\n  },\n  X25519: {\n    algorithm: \"X25519\",\n    recommendation: \"hybrid X25519MLKEM768 (ML-KEM-768)\",\n    detail:\n      \"X25519 is a modern, well-built classical key-agreement primitive but is still \" +\n      \"broken by Shor's algorithm. Wrap it in the hybrid X25519MLKEM768 construction \" +\n      \"so it stays useful during the PQC transition.\",\n  },\n  X448: {\n    algorithm: \"X448\",\n    recommendation: \"hybrid SecP384r1MLKEM1024 (or X25519MLKEM768)\",\n    detail:\n      \"X448 (Goldilocks curve) is a modern classical key-agreement primitive at a \" +\n      \"higher classical security level, but it is still broken by Shor's algorithm. \" +\n      \"To preserve that assurance level, prefer the SecP384r1MLKEM1024 hybrid \" +\n      \"(ML-KEM-1024); X25519MLKEM768 is acceptable at the commercial tier.\",\n  },\n  ECIES: {\n    algorithm: \"ECIES\",\n    recommendation: \"ML-KEM-768 hybrid encryption (X-Wing for HPKE)\",\n    detail:\n      \"ECIES relies on classical ECDH for its key encapsulation and is exposed to \" +\n      \"harvest-now-decrypt-later. Replace the KEM step with ML-KEM-768 (FIPS 203) in \" +\n      \"a hybrid construction — for HPKE-style application-layer encryption, X-Wing \" +\n      \"(X25519 + ML-KEM-768) is the emerging hybrid KEM target.\",\n  },\n  unknown: {\n    algorithm: \"unknown\",\n    recommendation: \"review for post-quantum migration\",\n    detail:\n      \"This usage involves classical public-key cryptography. Audit it and plan a \" +\n      \"migration to NIST PQC standards (ML-KEM / FIPS 203, ML-DSA / FIPS 204).\",\n  },\n};\n\n/** Look up the recommended post-quantum remediation for a classical algorithm. */\nexport function remediationFor(algorithm: AlgorithmFamily): Remediation | undefined {\n  return REMEDIATIONS[algorithm];\n}\n\n/** Convenience: just the short recommendation string for a family (always defined). */\nexport function remediationText(algorithm: AlgorithmFamily): string {\n  return REMEDIATIONS[algorithm].recommendation;\n}\n\n/**\n * True when a family's PQC replacement is a KEM — i.e. it's used for\n * confidentiality / key-agreement (and is therefore harvest-now-decrypt-later\n * exposed). RSA is in both this set and {@link isSignatureFamily}. Single\n * source of truth for the family→target taxonomy used by tier guidance and the\n * multi-family remediation composer.\n */\nexport function isConfidentialityFamily(algorithm: AlgorithmFamily): boolean {\n  return (\n    algorithm === \"RSA\" ||\n    algorithm === \"ECDH\" ||\n    algorithm === \"DH\" ||\n    algorithm === \"X25519\" ||\n    algorithm === \"X448\" ||\n    algorithm === \"ECIES\"\n  );\n}\n\n/** True when a family's PQC replacement is a signature scheme (ML-DSA / SLH-DSA). */\nexport function isSignatureFamily(algorithm: AlgorithmFamily): boolean {\n  return (\n    algorithm === \"RSA\" || algorithm === \"ECDSA\" || algorithm === \"EdDSA\" || algorithm === \"DSA\"\n  );\n}\n\n/* -------------------------------------------------------------------------- */\n/* Security-tier guidance (CNSA 2.0 Category 5) + stateful HBS (SP 800-208)     */\n/* -------------------------------------------------------------------------- */\n\n/**\n * Security tier for remediation guidance.\n *  - `\"category-3\"` (default): commercial use — ML-KEM-768 / ML-DSA-65.\n *  - `\"category-5\"`: CNSA 2.0 national-security-systems / long-lived secrets —\n *    ML-KEM-1024 / ML-DSA-87.\n */\nexport type SecurityTier = \"category-3\" | \"category-5\";\n\n/** Per-tier KEM / signature parameter sets. */\nexport const TIER_PARAMS: Record<SecurityTier, { kem: string; signature: string; note: string }> = {\n  \"category-3\": {\n    kem: \"ML-KEM-768 (FIPS 203)\",\n    signature: \"ML-DSA-65 (FIPS 204)\",\n    note: \"NIST Category 3 — default for general commercial use.\",\n  },\n  \"category-5\": {\n    kem: \"ML-KEM-1024 (FIPS 203)\",\n    signature: \"ML-DSA-87 (FIPS 204)\",\n    note: \"NIST Category 5 — CNSA 2.0 for national-security systems and long-lived secrets (2030/2033 milestones).\",\n  },\n};\n\n/**\n * Tier-aware remediation. Returns the base family remediation plus the\n * parameter sets for the requested CNSA tier. Category 5 surfaces the\n * ML-KEM-1024 / ML-DSA-87 sets mandated by CNSA 2.0; category 3 is the\n * commercial default.\n */\nexport function remediationForTier(\n  algorithm: AlgorithmFamily,\n  tier: SecurityTier = \"category-3\",\n): Remediation {\n  const base = REMEDIATIONS[algorithm];\n  const params = TIER_PARAMS[tier];\n  // Confidentiality families lean on the KEM; signature families on the signer.\n  const isConf = isConfidentialityFamily(algorithm);\n  const primary = isConf ? params.kem : params.signature;\n\n  // Category-5 (CNSA 2.0 / NSS) mandates the ML-KEM-1024 / ML-DSA-87 parameter\n  // sets and must NOT surface the category-3 X25519MLKEM768 hybrid (its PQC\n  // component is ML-KEM-768 — sub-CNSA). Lead with the mandated set; only point\n  // at a hybrid TLS group at the 1024 level (audit: quantum #1, crypto S5).\n  if (tier === \"category-5\") {\n    const hybridNote = isConf\n      ? \" If a hybrid TLS group is required, use SecP384r1MLKEM1024 (draft-ietf-tls-ecdhe-mlkem) — not X25519MLKEM768, whose ML-KEM-768 component does not meet CNSA 2.0.\"\n      : \"\";\n    return {\n      algorithm,\n      recommendation: `${primary} — CNSA 2.0 mandates this parameter set (hybrids optional)`,\n      detail: `${base.detail} ${params.note} For CNSA 2.0 / national-security systems use ${params.kem} (KEM) and ${params.signature} (signatures).${hybridNote}`,\n    };\n  }\n\n  return {\n    algorithm,\n    recommendation: `${base.recommendation} — ${tier}: ${primary}`,\n    detail: `${base.detail} ${params.note} For this tier use ${params.kem} (KEM) and ${params.signature} (signatures).`,\n  };\n}\n\n/**\n * Guidance for stateful hash-based signatures (SP 800-208: LMS / XMSS / HSS).\n * These are NIST-approved for firmware / boot signing but are STATEFUL — each\n * private key may sign a bounded number of messages and the state MUST be\n * managed to avoid catastrophic key reuse. Surfaced where a long-lived,\n * low-volume signing root is appropriate.\n */\nexport const STATEFUL_HBS_NOTE =\n  \"For firmware / secure-boot signing, the stateful hash-based signatures \" +\n  \"LMS, XMSS and HSS (NIST SP 800-208) are approved alternatives to ML-DSA, \" +\n  \"but they are STATEFUL: the signer must never reuse a one-time key index. \" +\n  \"Use only with rigorous state management; otherwise prefer stateless ML-DSA \" +\n  \"(FIPS 204) or SLH-DSA (FIPS 205).\";\n\n/**\n * Forward-looking PQC standards worth tracking beyond the current FIPS 203/204/205\n * targets. Surfaced for operators planning multi-year migrations.\n */\nexport const PQC_TRANSITION_NOTE =\n  \"Migration urgency: NIST IR 8547 deprecates classical public-key crypto after \" +\n  \"2030 and disallows it after 2035 — long-lived (harvest-now-decrypt-later) data \" +\n  \"must move sooner. Standards to track: HQC (NIST's code-based backup KEM, \" +\n  \"selected March 2025; draft FIPS expected ~2026) as a diversity hedge against \" +\n  \"ML-KEM; FN-DSA / Falcon (draft FIPS 206) for compact lattice signatures; and \" +\n  \"X-Wing (X25519 + ML-KEM-768) for HPKE-style hybrid encryption.\";\n\n/** True when stateful HBS (SP 800-208) is a reasonable alternative for a family. */\nexport function statefulHbsApplies(algorithm: AlgorithmFamily): boolean {\n  // Signature families only — LMS/XMSS are signatures, not KEMs.\n  return isSignatureFamily(algorithm);\n}\n"]}
+{"version":3,"file":"remediation.js","sourceRoot":"","sources":["../src/remediation.ts"],"names":[],"mappings":"AAUA,8DAA8D;AAC9D,MAAM,YAAY,GAAyC;IACzD,GAAG,EAAE;QACH,SAAS,EAAE,KAAK;QAChB,cAAc,EAAE,yDAAyD;QACzE,MAAM,EACJ,4EAA4E;YAC5E,2EAA2E;YAC3E,gEAAgE;KACnE;IACD,IAAI,EAAE;QACJ,SAAS,EAAE,MAAM;QACjB,cAAc,EAAE,oCAAoC;QACpD,MAAM,EACJ,6EAA6E;YAC7E,gFAAgF;YAChF,2DAA2D;KAC9D;IACD,KAAK,EAAE;QACL,SAAS,EAAE,OAAO;QAClB,cAAc,EAAE,sBAAsB;QACtC,MAAM,EACJ,6EAA6E;YAC7E,8EAA8E;YAC9E,wBAAwB;KAC3B;IACD,KAAK,EAAE;QACL,SAAS,EAAE,OAAO;QAClB,cAAc,EAAE,sBAAsB;QACtC,MAAM,EACJ,+EAA+E;YAC/E,iFAAiF;KACpF;IACD,EAAE,EAAE;QACF,SAAS,EAAE,IAAI;QACf,cAAc,EAAE,oCAAoC;QACpD,MAAM,EACJ,2EAA2E;YAC3E,6EAA6E;KAChF;IACD,GAAG,EAAE;QACH,SAAS,EAAE,KAAK;QAChB,cAAc,EAAE,sBAAsB;QACtC,MAAM,EACJ,gFAAgF;YAChF,0DAA0D;KAC7D;IACD,MAAM,EAAE;QACN,SAAS,EAAE,QAAQ;QACnB,cAAc,EAAE,oCAAoC;QACpD,MAAM,EACJ,gFAAgF;YAChF,gFAAgF;YAChF,+CAA+C;KAClD;IACD,IAAI,EAAE;QACJ,SAAS,EAAE,MAAM;QACjB,cAAc,EAAE,+CAA+C;QAC/D,MAAM,EACJ,6EAA6E;YAC7E,+EAA+E;YAC/E,yEAAyE;YACzE,qEAAqE;KACxE;IACD,KAAK,EAAE;QACL,SAAS,EAAE,OAAO;QAClB,cAAc,EAAE,gDAAgD;QAChE,MAAM,EACJ,6EAA6E;YAC7E,gFAAgF;YAChF,8EAA8E;YAC9E,0DAA0D;KAC7D;IACD,OAAO,EAAE;QACP,SAAS,EAAE,SAAS;QACpB,cAAc,EAAE,mCAAmC;QACnD,MAAM,EACJ,6EAA6E;YAC7E,yEAAyE;KAC5E;CACF,CAAC;AAEF,kFAAkF;AAClF,MAAM,UAAU,cAAc,CAAC,SAA0B;IACvD,OAAO,YAAY,CAAC,SAAS,CAAC,CAAC;AACjC,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,eAAe,CAAC,SAA0B;IACxD,OAAO,YAAY,CAAC,SAAS,CAAC,CAAC,cAAc,CAAC;AAChD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAA0B;IAChE,OAAO,CACL,SAAS,KAAK,KAAK;QACnB,SAAS,KAAK,MAAM;QACpB,SAAS,KAAK,IAAI;QAClB,SAAS,KAAK,QAAQ;QACtB,SAAS,KAAK,MAAM;QACpB,SAAS,KAAK,OAAO,CACtB,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,iBAAiB,CAAC,SAA0B;IAC1D,OAAO,CACL,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,KAAK,KAAK,CAC7F,CAAC;AACJ,CAAC;AAcD,+CAA+C;AAC/C,MAAM,CAAC,MAAM,WAAW,GAA2E;IACjG,YAAY,EAAE;QACZ,GAAG,EAAE,uBAAuB;QAC5B,SAAS,EAAE,sBAAsB;QACjC,IAAI,EAAE,uDAAuD;KAC9D;IACD,YAAY,EAAE;QACZ,GAAG,EAAE,wBAAwB;QAC7B,SAAS,EAAE,sBAAsB;QACjC,IAAI,EAAE,yGAAyG;KAChH;CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,SAA0B,EAC1B,OAAqB,YAAY;IAEjC,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACjC,8EAA8E;IAC9E,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;IAEvD,6EAA6E;IAC7E,0EAA0E;IAC1E,8EAA8E;IAC9E,0EAA0E;IAC1E,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,MAAM;YACvB,CAAC,CAAC,kKAAkK;YACpK,CAAC,CAAC,EAAE,CAAC;QACP,OAAO;YACL,SAAS;YACT,cAAc,EAAE,GAAG,OAAO,4DAA4D;YACtF,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,iDAAiD,MAAM,CAAC,GAAG,cAAc,MAAM,CAAC,SAAS,iBAAiB,UAAU,EAAE;SAC5J,CAAC;IACJ,CAAC;IAED,OAAO;QACL,SAAS;QACT,cAAc,EAAE,GAAG,IAAI,CAAC,cAAc,MAAM,IAAI,KAAK,OAAO,EAAE;QAC9D,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,sBAAsB,MAAM,CAAC,GAAG,cAAc,MAAM,CAAC,SAAS,gBAAgB;KACpH,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAA0B,EAC1B,OAAyB;IAEzB,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC;IAC7E,qFAAqF;IACrF,2EAA2E;IAC3E,MAAM,UAAU,GACd,OAAO,CAAC,YAAY,KAAK,UAAU;QACjC,CAAC,CAAC,iBAAiB;QACnB,CAAC,CAAC,OAAO,CAAC,YAAY,KAAK,aAAa;YACtC,CAAC,CAAC,oBAAoB;YACtB,CAAC,CAAC,kBAAkB,CAAC;IAC3B,MAAM,cAAc,GAAG,MAAM;QAC3B,CAAC,CAAC,GAAG,OAAO,MAAM,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE;QAC/C,CAAC,CAAC,GAAG,OAAO,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,OAAO;QACL,SAAS;QACT,cAAc;QACd,MAAM,EACJ,GAAG,IAAI,CAAC,MAAM,UAAU,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,QAAQ,UAAU,OAAO,CAAC,SAAS,CAAC,GAAG,OAAO;YAC/F,yBAAyB,OAAO,CAAC,SAAS,CAAC,SAAS,wCAAwC;YAC5F,8BAA8B,OAAO,CAAC,cAAc,yBAAyB,OAAO,CAAC,aAAa,GAAG;YACrG,YAAY;KACf,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAC5B,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,6EAA6E;IAC7E,mCAAmC,CAAC;AAEtC;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAC9B,+EAA+E;IAC/E,iFAAiF;IACjF,2EAA2E;IAC3E,+EAA+E;IAC/E,+EAA+E;IAC/E,gEAAgE,CAAC;AAEnE,oFAAoF;AACpF,MAAM,UAAU,kBAAkB,CAAC,SAA0B;IAC3D,+DAA+D;IAC/D,OAAO,iBAAiB,CAAC,SAAS,CAAC,CAAC;AACtC,CAAC","sourcesContent":["/**\n * Post-quantum remediation guidance for each classical asymmetric algorithm\n * family. The recommendations follow NIST's finalized PQC algorithms — ML-KEM\n * (FIPS 203), ML-DSA (FIPS 204), SLH-DSA (FIPS 205) — and the IETF hybrid\n * key-exchange groups (X25519MLKEM768, SecP384r1MLKEM1024). Forward-looking\n * standards to track are captured in {@link PQC_TRANSITION_NOTE}.\n */\nimport type { AlgorithmFamily, Remediation } from \"./types.js\";\nimport type { StandardsProfile } from \"./standards-profiles.js\";\n\n/** Canonical remediation table, keyed by algorithm family. */\nconst REMEDIATIONS: Record<AlgorithmFamily, Remediation> = {\n  RSA: {\n    algorithm: \"RSA\",\n    recommendation: \"ML-KEM-768 for encryption/KEM; ML-DSA-65 for signatures\",\n    detail:\n      \"RSA is broken by Shor's algorithm. For key transport / encryption move to \" +\n      \"ML-KEM-768 (FIPS 203), ideally as the hybrid X25519MLKEM768. For digital \" +\n      \"signatures move to ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205).\",\n  },\n  ECDH: {\n    algorithm: \"ECDH\",\n    recommendation: \"hybrid X25519MLKEM768 (ML-KEM-768)\",\n    detail:\n      \"Elliptic-curve Diffie-Hellman is broken by Shor's algorithm and is exposed \" +\n      \"to harvest-now-decrypt-later. Adopt the hybrid X25519MLKEM768 key exchange so \" +\n      \"confidentiality survives even if one component is broken.\",\n  },\n  ECDSA: {\n    algorithm: \"ECDSA\",\n    recommendation: \"ML-DSA-65 (FIPS 204)\",\n    detail:\n      \"ECDSA signatures can be forged by a quantum attacker via Shor's algorithm. \" +\n      \"Migrate to ML-DSA (Dilithium, FIPS 204) or SLH-DSA (SPHINCS+, FIPS 205) for \" +\n      \"long-lived signatures.\",\n  },\n  EdDSA: {\n    algorithm: \"EdDSA\",\n    recommendation: \"ML-DSA-65 (FIPS 204)\",\n    detail:\n      \"Ed25519 / Ed448 (EdDSA) are classical signatures broken by Shor's algorithm. \" +\n      \"Replace with ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205) for forgery resistance.\",\n  },\n  DH: {\n    algorithm: \"DH\",\n    recommendation: \"hybrid X25519MLKEM768 (ML-KEM-768)\",\n    detail:\n      \"Finite-field Diffie-Hellman is broken by Shor's algorithm and exposed to \" +\n      \"harvest-now-decrypt-later. Move to a hybrid PQC KEM such as X25519MLKEM768.\",\n  },\n  DSA: {\n    algorithm: \"DSA\",\n    recommendation: \"ML-DSA-65 (FIPS 204)\",\n    detail:\n      \"DSA is a classical, quantum-broken signature scheme (and already deprecated). \" +\n      \"Replace with ML-DSA-65 (FIPS 204) or SLH-DSA (FIPS 205).\",\n  },\n  X25519: {\n    algorithm: \"X25519\",\n    recommendation: \"hybrid X25519MLKEM768 (ML-KEM-768)\",\n    detail:\n      \"X25519 is a modern, well-built classical key-agreement primitive but is still \" +\n      \"broken by Shor's algorithm. Wrap it in the hybrid X25519MLKEM768 construction \" +\n      \"so it stays useful during the PQC transition.\",\n  },\n  X448: {\n    algorithm: \"X448\",\n    recommendation: \"hybrid SecP384r1MLKEM1024 (or X25519MLKEM768)\",\n    detail:\n      \"X448 (Goldilocks curve) is a modern classical key-agreement primitive at a \" +\n      \"higher classical security level, but it is still broken by Shor's algorithm. \" +\n      \"To preserve that assurance level, prefer the SecP384r1MLKEM1024 hybrid \" +\n      \"(ML-KEM-1024); X25519MLKEM768 is acceptable at the commercial tier.\",\n  },\n  ECIES: {\n    algorithm: \"ECIES\",\n    recommendation: \"ML-KEM-768 hybrid encryption (X-Wing for HPKE)\",\n    detail:\n      \"ECIES relies on classical ECDH for its key encapsulation and is exposed to \" +\n      \"harvest-now-decrypt-later. Replace the KEM step with ML-KEM-768 (FIPS 203) in \" +\n      \"a hybrid construction — for HPKE-style application-layer encryption, X-Wing \" +\n      \"(X25519 + ML-KEM-768) is the emerging hybrid KEM target.\",\n  },\n  unknown: {\n    algorithm: \"unknown\",\n    recommendation: \"review for post-quantum migration\",\n    detail:\n      \"This usage involves classical public-key cryptography. Audit it and plan a \" +\n      \"migration to NIST PQC standards (ML-KEM / FIPS 203, ML-DSA / FIPS 204).\",\n  },\n};\n\n/** Look up the recommended post-quantum remediation for a classical algorithm. */\nexport function remediationFor(algorithm: AlgorithmFamily): Remediation | undefined {\n  return REMEDIATIONS[algorithm];\n}\n\n/** Convenience: just the short recommendation string for a family (always defined). */\nexport function remediationText(algorithm: AlgorithmFamily): string {\n  return REMEDIATIONS[algorithm].recommendation;\n}\n\n/**\n * True when a family's PQC replacement is a KEM — i.e. it's used for\n * confidentiality / key-agreement (and is therefore harvest-now-decrypt-later\n * exposed). RSA is in both this set and {@link isSignatureFamily}. Single\n * source of truth for the family→target taxonomy used by tier guidance and the\n * multi-family remediation composer.\n */\nexport function isConfidentialityFamily(algorithm: AlgorithmFamily): boolean {\n  return (\n    algorithm === \"RSA\" ||\n    algorithm === \"ECDH\" ||\n    algorithm === \"DH\" ||\n    algorithm === \"X25519\" ||\n    algorithm === \"X448\" ||\n    algorithm === \"ECIES\"\n  );\n}\n\n/** True when a family's PQC replacement is a signature scheme (ML-DSA / SLH-DSA). */\nexport function isSignatureFamily(algorithm: AlgorithmFamily): boolean {\n  return (\n    algorithm === \"RSA\" || algorithm === \"ECDSA\" || algorithm === \"EdDSA\" || algorithm === \"DSA\"\n  );\n}\n\n/* -------------------------------------------------------------------------- */\n/* Security-tier guidance (CNSA 2.0 Category 5) + stateful HBS (SP 800-208)     */\n/* -------------------------------------------------------------------------- */\n\n/**\n * Security tier for remediation guidance.\n *  - `\"category-3\"` (default): commercial use — ML-KEM-768 / ML-DSA-65.\n *  - `\"category-5\"`: CNSA 2.0 national-security-systems / long-lived secrets —\n *    ML-KEM-1024 / ML-DSA-87.\n */\nexport type SecurityTier = \"category-3\" | \"category-5\";\n\n/** Per-tier KEM / signature parameter sets. */\nexport const TIER_PARAMS: Record<SecurityTier, { kem: string; signature: string; note: string }> = {\n  \"category-3\": {\n    kem: \"ML-KEM-768 (FIPS 203)\",\n    signature: \"ML-DSA-65 (FIPS 204)\",\n    note: \"NIST Category 3 — default for general commercial use.\",\n  },\n  \"category-5\": {\n    kem: \"ML-KEM-1024 (FIPS 203)\",\n    signature: \"ML-DSA-87 (FIPS 204)\",\n    note: \"NIST Category 5 — CNSA 2.0 for national-security systems and long-lived secrets (2030/2033 milestones).\",\n  },\n};\n\n/**\n * Tier-aware remediation. Returns the base family remediation plus the\n * parameter sets for the requested CNSA tier. Category 5 surfaces the\n * ML-KEM-1024 / ML-DSA-87 sets mandated by CNSA 2.0; category 3 is the\n * commercial default.\n */\nexport function remediationForTier(\n  algorithm: AlgorithmFamily,\n  tier: SecurityTier = \"category-3\",\n): Remediation {\n  const base = REMEDIATIONS[algorithm];\n  const params = TIER_PARAMS[tier];\n  // Confidentiality families lean on the KEM; signature families on the signer.\n  const isConf = isConfidentialityFamily(algorithm);\n  const primary = isConf ? params.kem : params.signature;\n\n  // Category-5 (CNSA 2.0 / NSS) mandates the ML-KEM-1024 / ML-DSA-87 parameter\n  // sets and must NOT surface the category-3 X25519MLKEM768 hybrid (its PQC\n  // component is ML-KEM-768 — sub-CNSA). Lead with the mandated set; only point\n  // at a hybrid TLS group at the 1024 level (audit: quantum #1, crypto S5).\n  if (tier === \"category-5\") {\n    const hybridNote = isConf\n      ? \" If a hybrid TLS group is required, use SecP384r1MLKEM1024 (draft-ietf-tls-ecdhe-mlkem) — not X25519MLKEM768, whose ML-KEM-768 component does not meet CNSA 2.0.\"\n      : \"\";\n    return {\n      algorithm,\n      recommendation: `${primary} — CNSA 2.0 mandates this parameter set (hybrids optional)`,\n      detail: `${base.detail} ${params.note} For CNSA 2.0 / national-security systems use ${params.kem} (KEM) and ${params.signature} (signatures).${hybridNote}`,\n    };\n  }\n\n  return {\n    algorithm,\n    recommendation: `${base.recommendation} — ${tier}: ${primary}`,\n    detail: `${base.detail} ${params.note} For this tier use ${params.kem} (KEM) and ${params.signature} (signatures).`,\n  };\n}\n\n/**\n * Regime-aware remediation. Composes the base family guidance with a\n * {@link StandardsProfile}'s parameter sets, HYBRID STANCE, and deprecation\n * deadlines, so an ANSSI/BSI audience is told hybrid is *required* while a CNSA 2.0\n * audience is told it is *optional* (and pointed at the 1024-level hybrid). This is\n * the profile-driven successor to {@link remediationForTier}; `--tier category-5`\n * resolves to the `cnsa-2.0` profile.\n */\nexport function remediationForProfile(\n  algorithm: AlgorithmFamily,\n  profile: StandardsProfile,\n): Remediation {\n  const base = REMEDIATIONS[algorithm];\n  const isConf = isConfidentialityFamily(algorithm);\n  const primary = isConf ? profile.paramSets.kem : profile.paramSets.signature;\n  // The hybrid stance governs KEY ESTABLISHMENT, so it is surfaced for confidentiality\n  // families; signature families migrate to a stateless PQC signer directly.\n  const stanceWord =\n    profile.hybridStance === \"required\"\n      ? \"hybrid required\"\n      : profile.hybridStance === \"recommended\"\n        ? \"hybrid recommended\"\n        : \"hybrids optional\";\n  const recommendation = isConf\n    ? `${primary} — ${profile.name}: ${stanceWord}`\n    : `${primary} — ${profile.name}`;\n  const hybridClause = isConf ? ` ${profile.hybridGuidance}` : \"\";\n  return {\n    algorithm,\n    recommendation,\n    detail:\n      `${base.detail} Under ${profile.name} (${profile.citation}), use ${profile.paramSets.kem} for ` +\n      `key establishment and ${profile.paramSets.signature} for signatures; classical public-key ` +\n      `crypto is deprecated after ${profile.deprecateAfter} and disallowed after ${profile.disallowAfter}.` +\n      hybridClause,\n  };\n}\n\n/**\n * Guidance for stateful hash-based signatures (SP 800-208: LMS / XMSS / HSS).\n * These are NIST-approved for firmware / boot signing but are STATEFUL — each\n * private key may sign a bounded number of messages and the state MUST be\n * managed to avoid catastrophic key reuse. Surfaced where a long-lived,\n * low-volume signing root is appropriate.\n */\nexport const STATEFUL_HBS_NOTE =\n  \"For firmware / secure-boot signing, the stateful hash-based signatures \" +\n  \"LMS, XMSS and HSS (NIST SP 800-208) are approved alternatives to ML-DSA, \" +\n  \"but they are STATEFUL: the signer must never reuse a one-time key index. \" +\n  \"Use only with rigorous state management; otherwise prefer stateless ML-DSA \" +\n  \"(FIPS 204) or SLH-DSA (FIPS 205).\";\n\n/**\n * Forward-looking PQC standards worth tracking beyond the current FIPS 203/204/205\n * targets. Surfaced for operators planning multi-year migrations.\n */\nexport const PQC_TRANSITION_NOTE =\n  \"Migration urgency: NIST IR 8547 deprecates classical public-key crypto after \" +\n  \"2030 and disallows it after 2035 — long-lived (harvest-now-decrypt-later) data \" +\n  \"must move sooner. Standards to track: HQC (NIST's code-based backup KEM, \" +\n  \"selected March 2025; draft FIPS expected ~2026) as a diversity hedge against \" +\n  \"ML-KEM; FN-DSA / Falcon (draft FIPS 206) for compact lattice signatures; and \" +\n  \"X-Wing (X25519 + ML-KEM-768) for HPKE-style hybrid encryption.\";\n\n/** True when stateful HBS (SP 800-208) is a reasonable alternative for a family. */\nexport function statefulHbsApplies(algorithm: AlgorithmFamily): boolean {\n  // Signature families only — LMS/XMSS are signatures, not KEMs.\n  return isSignatureFamily(algorithm);\n}\n"]}

package/dist/report.d.ts

@@ -5,6 +5,7 @@
  */
 import type { RuleMeta, ScanResult } from "./types.js";
 import type { SecurityTier } from "./remediation.js";
+import type { StandardsProfile } from "./standards-profiles.js";
 /** Minimal SARIF 2.1.0 log shape (kept permissive on purpose). */
 export interface SarifLog {
     $schema: string;
@@ -48,4 +49,12 @@ export declare function formatSummary(result: ScanResult, options?: {
  * long-lived secrets. Returns plain (un-coloured) lines; the caller styles them.
  */
 export declare function formatTierGuidance(byAlgorithm: Record<string, number>, tier: SecurityTier): string[];
+/**
+ * Per-family migration targets tailored to a selected {@link StandardsProfile}
+ * (`--profile`). Unlike {@link formatTierGuidance} (CNSA-tier only), this surfaces the
+ * regime's parameter sets AND its hybrid stance — required (ANSSI/BSI) vs recommended
+ * (NIST/NCSC) vs optional (CNSA 2.0) — so guidance isn't regime-wrong. Returns plain
+ * (un-coloured) lines; the caller styles them.
+ */
+export declare function formatProfileGuidance(byAlgorithm: Record<string, number>, profile: StandardsProfile): string[];
 //# sourceMappingURL=report.d.ts.map

package/dist/report.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAA4B,QAAQ,EAAE,UAAU,EAAY,MAAM,YAAY,CAAC;AAK3F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAGrD,kEAAkE;AAClE,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,OAAO,EAAE,CAAC;CACjB;AAED,qFAAqF;AACrF,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC;CACtB;AAqED,8CAA8C;AAC9C,wBAAgB,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,QAAQ,CAmI1E;AAkBD,+DAA+D;AAC/D,wBAAgB,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAqCxF;AAwCD;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,UAAU,EAClB,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,YAAY,CAAA;CAAE,GACjD,MAAM,CAyGR;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,IAAI,EAAE,YAAY,GACjB,MAAM,EAAE,CAmBV"}
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAA4B,QAAQ,EAAE,UAAU,EAAY,MAAM,YAAY,CAAC;AAK3F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAGhE,kEAAkE;AAClE,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,OAAO,EAAE,CAAC;CACjB;AAED,qFAAqF;AACrF,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAC;CACtB;AAqED,8CAA8C;AAC9C,wBAAgB,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,QAAQ,CAmI1E;AAkBD,+DAA+D;AAC/D,wBAAgB,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAqCxF;AAwCD;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,UAAU,EAClB,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,YAAY,CAAA;CAAE,GACjD,MAAM,CAyGR;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,IAAI,EAAE,YAAY,GACjB,MAAM,EAAE,CAmBV;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,OAAO,EAAE,gBAAgB,GACxB,MAAM,EAAE,CAsBV"}

package/dist/report.js

@@ -1,7 +1,7 @@
 import { VERSION } from "./version.js";
 import { SEVERITY_ORDER, sarifLevel } from "./severity.js";
 import { ANALYZABLE_LANGUAGES_LABEL } from "./detect-utils.js";
-import { remediationFor, remediationForTier } from "./remediation.js";
+import { remediationFor, remediationForTier, remediationForProfile } from "./remediation.js";
 import { fingerprintFinding } from "./baseline.js";
 const SARIF_SCHEMA = "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json";
 const INFORMATION_URI = "https://github.com/quantakrypto/pqc-tools";
@@ -369,4 +369,34 @@ export function formatTierGuidance(byAlgorithm, tier) {
     }
     return out;
 }
+/**
+ * Per-family migration targets tailored to a selected {@link StandardsProfile}
+ * (`--profile`). Unlike {@link formatTierGuidance} (CNSA-tier only), this surfaces the
+ * regime's parameter sets AND its hybrid stance — required (ANSSI/BSI) vs recommended
+ * (NIST/NCSC) vs optional (CNSA 2.0) — so guidance isn't regime-wrong. Returns plain
+ * (un-coloured) lines; the caller styles them.
+ */
+export function formatProfileGuidance(byAlgorithm, profile) {
+    const out = [`${profile.name} migration targets:`];
+    const seen = new Set();
+    for (const [k, n] of Object.entries(byAlgorithm)) {
+        if (n <= 0)
+            continue;
+        const fam = k;
+        if (fam === "unknown" || !remediationFor(fam))
+            continue; // skip unmapped families
+        const rem = remediationForProfile(fam, profile);
+        if (seen.has(rem.recommendation))
+            continue;
+        seen.add(rem.recommendation);
+        out.push(`  ${fam} → ${rem.recommendation}`);
+    }
+    const stance = profile.hybridStance === "required"
+        ? "requires classical+PQC hybridization"
+        : profile.hybridStance === "recommended"
+            ? "recommends hybridization"
+            : "does not require hybridization";
+    out.push(`  ${profile.authority} ${stance}; classical public-key crypto disallowed after ${profile.disallowAfter} (${profile.citation}).`);
+    return out;
+}
 //# sourceMappingURL=report.js.map

package/dist/report.js.map

@@ -1 +1 @@
-{"version":3,"file":"report.js","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AA4BnD,MAAM,YAAY,GAChB,gGAAgG,CAAC;AAEnG,MAAM,eAAe,GAAG,2CAA2C,CAAC;AAEpE;;;;GAIG;AACH,SAAS,cAAc,CAAC,CAAU,EAAE,cAAuB;IACzD,IAAI,cAAc,IAAI,CAAC,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACpD,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;AAC5B,CAAC;AAED,6FAA6F;AAC7F,SAAS,SAAS,CAAC,QAAkB;IACnC,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,GAAG,CAAC;QACb,KAAK,MAAM;YACT,OAAO,EAAE,CAAC;QACZ,KAAK,QAAQ;YACX,OAAO,EAAE,CAAC;QACZ,KAAK,KAAK;YACR,OAAO,EAAE,CAAC;QACZ;YACE,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,SAAS,SAAS,CAAC,IAUlB;IACC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,IAAI,EAAE,IAAI,CAAC,EAAE;QACb,gBAAgB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE;QACtC,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE;QACvC,oBAAoB,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;QAC1F,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,gBAAgB,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,UAAU,EAAE;YACV,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,mBAAmB,EAAE,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5F,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD;QACD,GAAG,CAAC,IAAI,CAAC,GAAG;YACV,CAAC,CAAC;gBACE,aAAa,EAAE;oBACb,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE;iBAClF;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,OAAO,CAAC,MAAkB,EAAE,IAAoB;IAC9D,MAAM,cAAc,GAAG,IAAI,EAAE,cAAc,IAAI,KAAK,CAAC;IACrD,6EAA6E;IAC7E,+EAA+E;IAC/E,6EAA6E;IAC7E,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,MAAM,KAAK,GAAmC,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAElC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;QACpC,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,SAAS;QAClC,IAAI,CAAC,CAAC,GAAG;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9B,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAClC,KAAK,CAAC,IAAI,CACR,SAAS,CAAC;YACR,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CACH,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,GAAG;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,SAAS;QACtC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtC,KAAK,CAAC,IAAI,CACR,SAAS,CAAC;YACR,EAAE,EAAE,CAAC,CAAC,MAAM;YACZ,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACxC,MAAM,MAAM,GAA2B,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtE,IAAI,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ;YAAE,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAClF,IAAI,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,KAAK,QAAQ;YAAE,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;QAChF,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAElD,OAAO;YACL,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YAClC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;YAC5B,gEAAgE;YAChE,sEAAsE;YACtE,wEAAwE;YACxE,wEAAwE;YACxE,qDAAqD;YACrD,mBAAmB,EAAE,EAAE,iBAAiB,EAAE,kBAAkB,CAAC,CAAC,CAAC,EAAE;YACjE,UAAU,EAAE;gBACV,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjC;YACD,GAAG,CAAC,CAAC,CAAC,GAAG;gBACP,CAAC,CAAC;oBACE,IAAI,EAAE;wBACJ;4BACE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;yBACtD;qBACF;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,SAAS,EAAE;gBACT;oBACE,gBAAgB,EAAE;wBAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE;wBAC1C,MAAM,EAAE;4BACN,GAAG,MAAM;4BACT,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBACnD;qBACF;iBACF;aACF;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,MAAM,UAAU,GACd,OAAO,CAAC,IAAI,GAAG,CAAC;QACd,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,KAAK;gBACX,cAAc,EAAE,wBAAwB;gBACxC,YAAY,EAAE,OAAO;gBACrB,gBAAgB,EAAE,EAAE,IAAI,EAAE,uCAAuC,EAAE;gBACnE,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;oBACrC,EAAE;oBACF,OAAO,EAAE,0CAA0C,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO;iBAClF,CAAC,CAAC;aACJ;SACF;QACH,CAAC,CAAC,EAAE,CAAC;IAET,OAAO;QACL,OAAO,EAAE,YAAY;QACrB,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,OAAO;wBACb,cAAc,EAAE,eAAe;wBAC/B,OAAO,EAAE,MAAM,CAAC,WAAW,IAAI,OAAO;wBACtC,KAAK;qBACN;iBACF;gBACD,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChD,OAAO;aACR;SACF;KACF,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAS,gBAAgB,CAAC,QAAkB;IAC1C,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,KAAK,CAAC;QACf,KAAK,MAAM;YACT,OAAO,KAAK,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,KAAK,CAAC;QACf,KAAK,KAAK;YACR,OAAO,KAAK,CAAC;QACf;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,MAAM,CAAC,MAAkB,EAAE,IAAoB;IAC7D,MAAM,cAAc,GAAG,IAAI,EAAE,cAAc,IAAI,KAAK,CAAC;IACrD,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,SAAS,EAAE;YACT,cAAc,EAAE,MAAM,CAAC,SAAS,CAAC,cAAc;YAC/C,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,SAAS;YACrC,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU;YACvC,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU;YACvC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW;SAC1C;QACD,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpC,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,QAAQ,EAAE;gBACR,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI;gBACrB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI;gBACrB,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM;gBACzB,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO;gBAC3B,OAAO,EAAE,cAAc,CAAC,CAAC,EAAE,cAAc,CAAC;aAC3C;SACF,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAEhF,8DAA8D;AAC9D,MAAM,IAAI,GAAG;IACX,KAAK,EAAE,SAAS;IAChB,IAAI,EAAE,SAAS;IACf,GAAG,EAAE,SAAS;IACd,GAAG,EAAE,UAAU;IACf,KAAK,EAAE,UAAU;IACjB,MAAM,EAAE,UAAU;IAClB,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,UAAU;IACnB,IAAI,EAAE,UAAU;CACR,CAAC;AAEX,SAAS,aAAa,CAAC,GAAa;IAClC,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,UAAU;YACb,OAAO,IAAI,CAAC,OAAO,CAAC;QACtB,KAAK,MAAM;YACT,OAAO,IAAI,CAAC,GAAG,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,KAAK,KAAK;YACR,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB;YACE,OAAO,IAAI,CAAC,GAAG,CAAC;IACpB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IACnC,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC;IACpC,OAAO,IAAI,CAAC,GAAG,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAkB,EAClB,OAAkD;IAElD,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,KAAK,CAAC;IACtC,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,IAAY,EAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAEjG,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC;IAE7B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,uCAAuC,CAAC,CAAC,CAAC;IAClE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,MAAM,CAAC,WAAW,YAAY,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,0BAA0B;IAC1B,KAAK,CAAC,IAAI,CACR,oBAAoB,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,cAAc,MAAM,CAAC,EAAE,CACtG,CAAC;IACF,MAAM,QAAQ,GACZ,MAAM,CAAC,aAAa,KAAK,SAAS;QAChC,CAAC,CAAC,gBAAgB,0BAA0B,MAAM,MAAM,CAAC,aAAa,EAAE;QACxE,CAAC,CAAC,EAAE,CAAC;IACT,KAAK,CAAC,IAAI,CACR,oBAAoB,MAAM,CAAC,YAAY,GAAG,QAAQ,gBAAgB,MAAM,CAAC,QAAQ,CAAC,MAAM,oBAAoB,CAAC,CAC3G,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EACzC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CACtB,EAAE,CACJ,CAAC;IACF,sFAAsF;IACtF,IAAI,MAAM,CAAC,aAAa,KAAK,CAAC,IAAI,MAAM,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;QAC1D,KAAK,CAAC,IAAI,CACR,CAAC,CACC,IAAI,CAAC,MAAM,EACX,sDAAsD,0BAA0B,yDAAyD,CAC1I,CACF,CAAC;IACJ,CAAC;IACD,gFAAgF;IAChF,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC;IAChC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,IAAI,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC,EAAE,CAAC;QAC9D,KAAK,CAAC,IAAI,CACR,CAAC,CACC,IAAI,CAAC,MAAM,EACX,aAAa,IAAI,CAAC,UAAU,gBAAgB,IAAI,CAAC,eAAe,mDAAmD,CACpH,CACF,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,sBAAsB;IACtB,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7E,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAClD,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,iBAAiB,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAE9F,uBAAuB;IACvB,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;SAC9C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjC,IAAI,SAAS,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,kDAAkD,CAAC,CAAC,CAAC;QAC9E,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,iFAAiF;IACjF,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAClF,CAAC;IACF,MAAM,SAAS,GAAG,EAAE,CAAC;IACrB,KAAK,CAAC,IAAI,CACR,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAC1F,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,GAC/C,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAChD,EAAE,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,EAAE,CAAC,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,CAAC,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,MAAM,CAAC,MAAM,GAAG,SAAS,QAAQ,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,IAAI,GAAG,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CACR,CAAC,CACC,IAAI,CAAC,MAAM,EACX,SAAS,GAAG,CAAC,SAAS,4DAA4D;YAChF,oFAAoF;YACpF,gFAAgF,CACnF,CACF,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,EAAE,IAAI,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,kBAAkB,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,WAAmC,EACnC,IAAkB;IAElB,MAAM,KAAK,GAAG,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,yBAAyB,CAAC;IAC1F,MAAM,GAAG,GAAa,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACrB,MAAM,GAAG,GAAG,CAAoB,CAAC;QACjC,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,yBAAyB;QAClF,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC;YAAE,SAAS;QAC3C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,MAAM,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,GAAG,CAAC,IAAI,CACN,0HAA0H,CAC3H,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC","sourcesContent":["/**\n * Reporters: turn a {@link ScanResult} into SARIF 2.1.0, a clean JSON object,\n * or a human-readable text summary. No third-party dependencies — ANSI colour\n * is emitted with raw escape codes and is off by default.\n */\nimport type { AlgorithmFamily, Finding, RuleMeta, ScanResult, Severity } from \"./types.js\";\nimport { VERSION } from \"./version.js\";\nimport { SEVERITY_ORDER, sarifLevel } from \"./severity.js\";\nimport { ANALYZABLE_LANGUAGES_LABEL } from \"./detect-utils.js\";\nimport { remediationFor, remediationForTier } from \"./remediation.js\";\nimport type { SecurityTier } from \"./remediation.js\";\nimport { fingerprintFinding } from \"./baseline.js\";\n\n/** Minimal SARIF 2.1.0 log shape (kept permissive on purpose). */\nexport interface SarifLog {\n  $schema: string;\n  version: \"2.1.0\";\n  runs: unknown[];\n}\n\n/** Options shared by the structured reporters ({@link toSarif} / {@link toJson}). */\nexport interface ReportOptions {\n  /**\n   * Omit `location.snippet` from every finding in the output. Defaults to false\n   * (snippets are included). Snippets of `sensitive` findings (e.g. PEM key\n   * blocks, SSH public keys) are ALWAYS omitted regardless of this flag — the\n   * snippet there IS the sensitive value.\n   */\n  redactSnippets?: boolean;\n  /**\n   * Full rule catalog to advertise in SARIF `tool.driver.rules[]`, even for\n   * rules that produced no finding in this run. Pass\n   * `defaultRegistry.ruleCatalog()`. When omitted, only the rules that actually\n   * fired are emitted (the historical behaviour). SARIF-only; ignored by\n   * {@link toJson}.\n   */\n  catalog?: RuleMeta[];\n}\n\nconst SARIF_SCHEMA =\n  \"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json\";\n\nconst INFORMATION_URI = \"https://github.com/quantakrypto/pqc-tools\";\n\n/**\n * Resolve the snippet to emit for a finding, honouring redaction. Sensitive\n * findings (key material) never expose their snippet; otherwise the snippet is\n * dropped only when `redactSnippets` is set.\n */\nfunction emittedSnippet(f: Finding, redactSnippets: boolean): string | undefined {\n  if (redactSnippets || f.sensitive) return undefined;\n  return f.location.snippet;\n}\n\n/** Map our severity to a SARIF rule-level default (used in rules[].defaultConfiguration). */\nfunction sarifRank(severity: Severity): number {\n  switch (severity) {\n    case \"critical\":\n      return 100;\n    case \"high\":\n      return 80;\n    case \"medium\":\n      return 50;\n    case \"low\":\n      return 20;\n    default:\n      return 5;\n  }\n}\n\n/** Build a SARIF `rules[]` entry from a rule's severity/title/message/etc. */\nfunction sarifRule(spec: {\n  id: string;\n  title: string;\n  message: string;\n  severity: Severity;\n  category: string;\n  algorithm?: string;\n  hndl: boolean;\n  cwe?: string;\n  remediation?: string;\n}): Record<string, unknown> {\n  return {\n    id: spec.id,\n    name: spec.id,\n    shortDescription: { text: spec.title },\n    fullDescription: { text: spec.message },\n    defaultConfiguration: { level: sarifLevel(spec.severity), rank: sarifRank(spec.severity) },\n    ...(spec.remediation ? { help: { text: `Remediation: ${spec.remediation}` } } : {}),\n    properties: {\n      category: spec.category,\n      ...(spec.algorithm ? { algorithm: spec.algorithm } : {}),\n      hndl: spec.hndl,\n      ...(spec.cwe ? { cwe: spec.cwe, \"security-severity\": securitySeverity(spec.severity) } : {}),\n      ...(spec.cwe ? { tags: [\"security\", spec.cwe] } : {}),\n    },\n    ...(spec.cwe\n      ? {\n          relationships: [\n            { target: { id: spec.cwe, toolComponent: { name: \"CWE\" } }, kinds: [\"relevant\"] },\n          ],\n        }\n      : {}),\n  };\n}\n\n/** Serialize a scan result as SARIF 2.1.0. */\nexport function toSarif(result: ScanResult, opts?: ReportOptions): SarifLog {\n  const redactSnippets = opts?.redactSnippets ?? false;\n  // Build the rule set and collect the CWE taxa referenced by any rule. When a\n  // full catalog is supplied, advertise every rule (even ones that didn't fire);\n  // otherwise emit one rule per ruleId encountered (the historical behaviour).\n  const ruleIndex = new Map<string, number>();\n  const rules: Array<Record<string, unknown>> = [];\n  const cweTaxa = new Set<string>();\n\n  for (const r of opts?.catalog ?? []) {\n    if (ruleIndex.has(r.id)) continue;\n    if (r.cwe) cweTaxa.add(r.cwe);\n    ruleIndex.set(r.id, rules.length);\n    rules.push(\n      sarifRule({\n        id: r.id,\n        title: r.title,\n        message: r.message,\n        severity: r.severity,\n        category: r.category,\n        algorithm: r.algorithm,\n        hndl: r.hndl,\n        cwe: r.cwe,\n        remediation: r.remediation,\n      }),\n    );\n  }\n\n  for (const f of result.findings) {\n    if (f.cwe) cweTaxa.add(f.cwe);\n    if (ruleIndex.has(f.ruleId)) continue;\n    ruleIndex.set(f.ruleId, rules.length);\n    rules.push(\n      sarifRule({\n        id: f.ruleId,\n        title: f.title,\n        message: f.message,\n        severity: f.severity,\n        category: f.category,\n        algorithm: f.algorithm,\n        hndl: f.hndl,\n        cwe: f.cwe,\n        remediation: f.remediation,\n      }),\n    );\n  }\n\n  const results = result.findings.map((f) => {\n    const region: Record<string, number> = { startLine: f.location.line };\n    if (typeof f.location.column === \"number\") region.startColumn = f.location.column;\n    if (typeof f.location.endLine === \"number\") region.endLine = f.location.endLine;\n    const snippet = emittedSnippet(f, redactSnippets);\n\n    return {\n      ruleId: f.ruleId,\n      ruleIndex: ruleIndex.get(f.ruleId),\n      level: sarifLevel(f.severity),\n      message: { text: f.message },\n      // Line-INSENSITIVE fingerprint (the same one the baseline uses:\n      // sha256 of ruleId|file|normalizedSnippet). GitHub code scanning keys\n      // alert identity + dedup off partialFingerprints, so a finding survives\n      // line shifts and reformatting instead of re-alerting as \"new\" on every\n      // edit above it. `quantakrypto/v1` names our scheme.\n      partialFingerprints: { \"quantakrypto/v1\": fingerprintFinding(f) },\n      properties: {\n        category: f.category,\n        severity: f.severity,\n        confidence: f.confidence,\n        hndl: f.hndl,\n        ...(f.algorithm ? { algorithm: f.algorithm } : {}),\n        ...(f.remediation ? { remediation: f.remediation } : {}),\n        ...(f.cwe ? { cwe: f.cwe } : {}),\n      },\n      ...(f.cwe\n        ? {\n            taxa: [\n              {\n                target: { id: f.cwe, toolComponent: { name: \"CWE\" } },\n              },\n            ],\n          }\n        : {}),\n      locations: [\n        {\n          physicalLocation: {\n            artifactLocation: { uri: f.location.file },\n            region: {\n              ...region,\n              ...(snippet ? { snippet: { text: snippet } } : {}),\n            },\n          },\n        },\n      ],\n    };\n  });\n\n  // CWE taxonomy component (SARIF taxonomies), referenced by rules + results.\n  const taxonomies =\n    cweTaxa.size > 0\n      ? [\n          {\n            name: \"CWE\",\n            informationUri: \"https://cwe.mitre.org/\",\n            organization: \"MITRE\",\n            shortDescription: { text: \"The MITRE Common Weakness Enumeration\" },\n            taxa: [...cweTaxa].sort().map((id) => ({\n              id,\n              helpUri: `https://cwe.mitre.org/data/definitions/${id.replace(/^CWE-/, \"\")}.html`,\n            })),\n          },\n        ]\n      : [];\n\n  return {\n    $schema: SARIF_SCHEMA,\n    version: \"2.1.0\",\n    runs: [\n      {\n        tool: {\n          driver: {\n            name: \"qScan\",\n            informationUri: INFORMATION_URI,\n            version: result.toolVersion || VERSION,\n            rules,\n          },\n        },\n        ...(taxonomies.length > 0 ? { taxonomies } : {}),\n        results,\n      },\n    ],\n  };\n}\n\n/** GitHub-code-scanning `security-severity` (0–10) derived from our severity. */\nfunction securitySeverity(severity: Severity): string {\n  switch (severity) {\n    case \"critical\":\n      return \"9.5\";\n    case \"high\":\n      return \"8.0\";\n    case \"medium\":\n      return \"5.0\";\n    case \"low\":\n      return \"3.0\";\n    default:\n      return \"1.0\";\n  }\n}\n\n/** Serialize a scan result as a plain JSON-friendly object. */\nexport function toJson(result: ScanResult, opts?: ReportOptions): Record<string, unknown> {\n  const redactSnippets = opts?.redactSnippets ?? false;\n  return {\n    toolVersion: result.toolVersion,\n    root: result.root,\n    startedAt: result.startedAt,\n    finishedAt: result.finishedAt,\n    filesScanned: result.filesScanned,\n    ...(result.analyzedFiles !== undefined ? { analyzedFiles: result.analyzedFiles } : {}),\n    ...(result.diagnostics ? { diagnostics: result.diagnostics } : {}),\n    inventory: {\n      readinessScore: result.inventory.readinessScore,\n      hndlCount: result.inventory.hndlCount,\n      bySeverity: result.inventory.bySeverity,\n      byCategory: result.inventory.byCategory,\n      byAlgorithm: result.inventory.byAlgorithm,\n    },\n    findings: result.findings.map((f) => ({\n      ruleId: f.ruleId,\n      title: f.title,\n      category: f.category,\n      severity: f.severity,\n      confidence: f.confidence,\n      algorithm: f.algorithm,\n      hndl: f.hndl,\n      message: f.message,\n      remediation: f.remediation,\n      cwe: f.cwe,\n      location: {\n        file: f.location.file,\n        line: f.location.line,\n        column: f.location.column,\n        endLine: f.location.endLine,\n        snippet: emittedSnippet(f, redactSnippets),\n      },\n    })),\n  };\n}\n\n/* -------------------------------------------------------------------------- */\n/* Human-readable summary                                                      */\n/* -------------------------------------------------------------------------- */\n\n/** Raw ANSI codes (no chalk). Disabled when colour is off. */\nconst ANSI = {\n  reset: \"\\x1b[0m\",\n  bold: \"\\x1b[1m\",\n  dim: \"\\x1b[2m\",\n  red: \"\\x1b[31m\",\n  green: \"\\x1b[32m\",\n  yellow: \"\\x1b[33m\",\n  blue: \"\\x1b[34m\",\n  magenta: \"\\x1b[35m\",\n  cyan: \"\\x1b[36m\",\n} as const;\n\nfunction severityColor(sev: Severity): string {\n  switch (sev) {\n    case \"critical\":\n      return ANSI.magenta;\n    case \"high\":\n      return ANSI.red;\n    case \"medium\":\n      return ANSI.yellow;\n    case \"low\":\n      return ANSI.blue;\n    default:\n      return ANSI.dim;\n  }\n}\n\nfunction scoreColor(score: number): string {\n  if (score >= 80) return ANSI.green;\n  if (score >= 50) return ANSI.yellow;\n  return ANSI.red;\n}\n\n/**\n * Render a human-readable summary of a scan result. Colour is off by default;\n * pass `{ color: true }` to emit ANSI escape codes.\n */\nexport function formatSummary(\n  result: ScanResult,\n  options?: { color?: boolean; tier?: SecurityTier },\n): string {\n  const color = options?.color ?? false;\n  const c = (code: string, text: string): string => (color ? `${code}${text}${ANSI.reset}` : text);\n\n  const lines: string[] = [];\n  const inv = result.inventory;\n\n  lines.push(c(ANSI.bold, \"qScan — post-quantum readiness report\"));\n  lines.push(c(ANSI.dim, `tool v${result.toolVersion} · root: ${result.root}`));\n  lines.push(\"\");\n\n  // Readiness score banner.\n  lines.push(\n    `Readiness score: ${c(`${ANSI.bold}${scoreColor(inv.readinessScore)}`, `${inv.readinessScore}/100`)}`,\n  );\n  const analyzed =\n    result.analyzedFiles !== undefined\n      ? `   Analyzed (${ANALYZABLE_LANGUAGES_LABEL}): ${result.analyzedFiles}`\n      : \"\";\n  lines.push(\n    `Files scanned:   ${result.filesScanned}${analyzed}   Findings: ${result.findings.length}   HNDL-exposed: ${c(\n      inv.hndlCount > 0 ? ANSI.red : ANSI.green,\n      String(inv.hndlCount),\n    )}`,\n  );\n  // Coverage honesty: a score over zero analyzable files is not a clean bill of health.\n  if (result.analyzedFiles === 0 && result.filesScanned > 0) {\n    lines.push(\n      c(\n        ANSI.yellow,\n        `Note: 0 files were in a supported source language (${ANALYZABLE_LANGUAGES_LABEL}) — the readiness score does not reflect this codebase.`,\n      ),\n    );\n  }\n  // Coverage diagnostics: skipped files mean the finding count may be incomplete.\n  const diag = result.diagnostics;\n  if (diag && (diag.unreadable > 0 || diag.skippedMinified > 0)) {\n    lines.push(\n      c(\n        ANSI.yellow,\n        `Coverage: ${diag.unreadable} unreadable, ${diag.skippedMinified} skipped as minified — results may be incomplete.`,\n      ),\n    );\n  }\n  lines.push(\"\");\n\n  // Severity breakdown.\n  const sevParts = SEVERITY_ORDER.filter((s) => inv.bySeverity[s] > 0).map((s) =>\n    c(severityColor(s), `${s}: ${inv.bySeverity[s]}`),\n  );\n  lines.push(`By severity:  ${sevParts.length ? sevParts.join(\"   \") : c(ANSI.green, \"none\")}`);\n\n  // Algorithm breakdown.\n  const algoParts = Object.entries(inv.byAlgorithm)\n    .sort((a, b) => b[1] - a[1])\n    .map(([k, v]) => `${k}: ${v}`);\n  if (algoParts.length) lines.push(`By algorithm: ${algoParts.join(\"   \")}`);\n  lines.push(\"\");\n\n  if (result.findings.length === 0) {\n    lines.push(c(ANSI.green, \"No classical asymmetric cryptography detected. ✓\"));\n    return lines.join(\"\\n\");\n  }\n\n  // Top findings, grouped by severity (most severe first), capped for readability.\n  const sorted = [...result.findings].sort(\n    (a, b) => SEVERITY_ORDER.indexOf(a.severity) - SEVERITY_ORDER.indexOf(b.severity),\n  );\n  const MAX_SHOWN = 25;\n  lines.push(\n    c(ANSI.bold, `Top findings (${Math.min(MAX_SHOWN, sorted.length)} of ${sorted.length}):`),\n  );\n\n  for (const f of sorted.slice(0, MAX_SHOWN)) {\n    const loc = `${f.location.file}:${f.location.line}${\n      f.location.column ? `:${f.location.column}` : \"\"\n    }`;\n    const tag = c(severityColor(f.severity), `[${f.severity}]`);\n    const hndl = f.hndl ? c(ANSI.red, \" (HNDL)\") : \"\";\n    lines.push(`  ${tag} ${f.title}${hndl}`);\n    lines.push(c(ANSI.dim, `      ${loc} — ${f.message}`));\n    if (f.remediation) lines.push(c(ANSI.cyan, `      → ${f.remediation}`));\n  }\n\n  if (sorted.length > MAX_SHOWN) {\n    lines.push(c(ANSI.dim, `  …and ${sorted.length - MAX_SHOWN} more.`));\n  }\n\n  lines.push(\"\");\n  if (inv.hndlCount > 0) {\n    lines.push(\n      c(\n        ANSI.yellow,\n        `Note: ${inv.hndlCount} finding(s) are exposed to \"harvest now, decrypt later\" — ` +\n          \"encrypted traffic captured today can be decrypted once a quantum computer exists. \" +\n          \"Prioritise migrating key exchange / encryption to hybrid PQC (X25519MLKEM768).\",\n      ),\n    );\n  }\n\n  if (options?.tier) {\n    lines.push(\"\", ...formatTierGuidance(inv.byAlgorithm, options.tier));\n  }\n\n  return lines.join(\"\\n\");\n}\n\n/**\n * Per-family migration targets for a CNSA security tier — surfaces the otherwise\n * library-only {@link remediationForTier} in human reports. Category 5 shows the\n * ML-KEM-1024 / ML-DSA-87 sets CNSA 2.0 mandates for national-security systems and\n * long-lived secrets. Returns plain (un-coloured) lines; the caller styles them.\n */\nexport function formatTierGuidance(\n  byAlgorithm: Record<string, number>,\n  tier: SecurityTier,\n): string[] {\n  const label = tier === \"category-5\" ? \"CNSA 2.0 (Category 5)\" : \"Category 3 (commercial)\";\n  const out: string[] = [`${label} migration targets:`];\n  const seen = new Set<string>();\n  for (const [k, n] of Object.entries(byAlgorithm)) {\n    if (n <= 0) continue;\n    const fam = k as AlgorithmFamily;\n    if (fam === \"unknown\" || !remediationFor(fam)) continue; // skip unmapped families\n    const rem = remediationForTier(fam, tier);\n    if (seen.has(rem.recommendation)) continue;\n    seen.add(rem.recommendation);\n    out.push(`  ${fam} → ${rem.recommendation}`);\n  }\n  if (tier === \"category-5\") {\n    out.push(\n      \"  CNSA 2.0 mandates ML-KEM-1024 / ML-DSA-87 for national-security systems and long-lived secrets (2030/2033 milestones).\",\n    );\n  }\n  return out;\n}\n"]}
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAG7F,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AA4BnD,MAAM,YAAY,GAChB,gGAAgG,CAAC;AAEnG,MAAM,eAAe,GAAG,2CAA2C,CAAC;AAEpE;;;;GAIG;AACH,SAAS,cAAc,CAAC,CAAU,EAAE,cAAuB;IACzD,IAAI,cAAc,IAAI,CAAC,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACpD,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;AAC5B,CAAC;AAED,6FAA6F;AAC7F,SAAS,SAAS,CAAC,QAAkB;IACnC,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,GAAG,CAAC;QACb,KAAK,MAAM;YACT,OAAO,EAAE,CAAC;QACZ,KAAK,QAAQ;YACX,OAAO,EAAE,CAAC;QACZ,KAAK,KAAK;YACR,OAAO,EAAE,CAAC;QACZ;YACE,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,SAAS,SAAS,CAAC,IAUlB;IACC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,IAAI,EAAE,IAAI,CAAC,EAAE;QACb,gBAAgB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE;QACtC,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE;QACvC,oBAAoB,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;QAC1F,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,gBAAgB,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,UAAU,EAAE;YACV,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,mBAAmB,EAAE,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5F,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD;QACD,GAAG,CAAC,IAAI,CAAC,GAAG;YACV,CAAC,CAAC;gBACE,aAAa,EAAE;oBACb,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE;iBAClF;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,OAAO,CAAC,MAAkB,EAAE,IAAoB;IAC9D,MAAM,cAAc,GAAG,IAAI,EAAE,cAAc,IAAI,KAAK,CAAC;IACrD,6EAA6E;IAC7E,+EAA+E;IAC/E,6EAA6E;IAC7E,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,MAAM,KAAK,GAAmC,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAElC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;QACpC,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,SAAS;QAClC,IAAI,CAAC,CAAC,GAAG;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9B,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAClC,KAAK,CAAC,IAAI,CACR,SAAS,CAAC;YACR,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CACH,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,GAAG;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,SAAS;QACtC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtC,KAAK,CAAC,IAAI,CACR,SAAS,CAAC;YACR,EAAE,EAAE,CAAC,CAAC,MAAM;YACZ,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACxC,MAAM,MAAM,GAA2B,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtE,IAAI,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ;YAAE,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAClF,IAAI,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,KAAK,QAAQ;YAAE,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;QAChF,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAElD,OAAO;YACL,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YAClC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;YAC5B,gEAAgE;YAChE,sEAAsE;YACtE,wEAAwE;YACxE,wEAAwE;YACxE,qDAAqD;YACrD,mBAAmB,EAAE,EAAE,iBAAiB,EAAE,kBAAkB,CAAC,CAAC,CAAC,EAAE;YACjE,UAAU,EAAE;gBACV,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjC;YACD,GAAG,CAAC,CAAC,CAAC,GAAG;gBACP,CAAC,CAAC;oBACE,IAAI,EAAE;wBACJ;4BACE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;yBACtD;qBACF;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,SAAS,EAAE;gBACT;oBACE,gBAAgB,EAAE;wBAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE;wBAC1C,MAAM,EAAE;4BACN,GAAG,MAAM;4BACT,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBACnD;qBACF;iBACF;aACF;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,MAAM,UAAU,GACd,OAAO,CAAC,IAAI,GAAG,CAAC;QACd,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,KAAK;gBACX,cAAc,EAAE,wBAAwB;gBACxC,YAAY,EAAE,OAAO;gBACrB,gBAAgB,EAAE,EAAE,IAAI,EAAE,uCAAuC,EAAE;gBACnE,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;oBACrC,EAAE;oBACF,OAAO,EAAE,0CAA0C,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO;iBAClF,CAAC,CAAC;aACJ;SACF;QACH,CAAC,CAAC,EAAE,CAAC;IAET,OAAO;QACL,OAAO,EAAE,YAAY;QACrB,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,OAAO;wBACb,cAAc,EAAE,eAAe;wBAC/B,OAAO,EAAE,MAAM,CAAC,WAAW,IAAI,OAAO;wBACtC,KAAK;qBACN;iBACF;gBACD,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChD,OAAO;aACR;SACF;KACF,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAS,gBAAgB,CAAC,QAAkB;IAC1C,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,KAAK,CAAC;QACf,KAAK,MAAM;YACT,OAAO,KAAK,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,KAAK,CAAC;QACf,KAAK,KAAK;YACR,OAAO,KAAK,CAAC;QACf;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,MAAM,CAAC,MAAkB,EAAE,IAAoB;IAC7D,MAAM,cAAc,GAAG,IAAI,EAAE,cAAc,IAAI,KAAK,CAAC;IACrD,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,SAAS,EAAE;YACT,cAAc,EAAE,MAAM,CAAC,SAAS,CAAC,cAAc;YAC/C,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,SAAS;YACrC,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU;YACvC,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU;YACvC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW;SAC1C;QACD,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpC,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,QAAQ,EAAE;gBACR,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI;gBACrB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI;gBACrB,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM;gBACzB,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO;gBAC3B,OAAO,EAAE,cAAc,CAAC,CAAC,EAAE,cAAc,CAAC;aAC3C;SACF,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAEhF,8DAA8D;AAC9D,MAAM,IAAI,GAAG;IACX,KAAK,EAAE,SAAS;IAChB,IAAI,EAAE,SAAS;IACf,GAAG,EAAE,SAAS;IACd,GAAG,EAAE,UAAU;IACf,KAAK,EAAE,UAAU;IACjB,MAAM,EAAE,UAAU;IAClB,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,UAAU;IACnB,IAAI,EAAE,UAAU;CACR,CAAC;AAEX,SAAS,aAAa,CAAC,GAAa;IAClC,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,UAAU;YACb,OAAO,IAAI,CAAC,OAAO,CAAC;QACtB,KAAK,MAAM;YACT,OAAO,IAAI,CAAC,GAAG,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,KAAK,KAAK;YACR,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB;YACE,OAAO,IAAI,CAAC,GAAG,CAAC;IACpB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IACnC,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC;IACpC,OAAO,IAAI,CAAC,GAAG,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAkB,EAClB,OAAkD;IAElD,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,KAAK,CAAC;IACtC,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,IAAY,EAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAEjG,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC;IAE7B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,uCAAuC,CAAC,CAAC,CAAC;IAClE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,MAAM,CAAC,WAAW,YAAY,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,0BAA0B;IAC1B,KAAK,CAAC,IAAI,CACR,oBAAoB,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,cAAc,MAAM,CAAC,EAAE,CACtG,CAAC;IACF,MAAM,QAAQ,GACZ,MAAM,CAAC,aAAa,KAAK,SAAS;QAChC,CAAC,CAAC,gBAAgB,0BAA0B,MAAM,MAAM,CAAC,aAAa,EAAE;QACxE,CAAC,CAAC,EAAE,CAAC;IACT,KAAK,CAAC,IAAI,CACR,oBAAoB,MAAM,CAAC,YAAY,GAAG,QAAQ,gBAAgB,MAAM,CAAC,QAAQ,CAAC,MAAM,oBAAoB,CAAC,CAC3G,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EACzC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CACtB,EAAE,CACJ,CAAC;IACF,sFAAsF;IACtF,IAAI,MAAM,CAAC,aAAa,KAAK,CAAC,IAAI,MAAM,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;QAC1D,KAAK,CAAC,IAAI,CACR,CAAC,CACC,IAAI,CAAC,MAAM,EACX,sDAAsD,0BAA0B,yDAAyD,CAC1I,CACF,CAAC;IACJ,CAAC;IACD,gFAAgF;IAChF,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC;IAChC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,IAAI,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC,EAAE,CAAC;QAC9D,KAAK,CAAC,IAAI,CACR,CAAC,CACC,IAAI,CAAC,MAAM,EACX,aAAa,IAAI,CAAC,UAAU,gBAAgB,IAAI,CAAC,eAAe,mDAAmD,CACpH,CACF,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,sBAAsB;IACtB,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7E,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAClD,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,iBAAiB,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAE9F,uBAAuB;IACvB,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;SAC9C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjC,IAAI,SAAS,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,kDAAkD,CAAC,CAAC,CAAC;QAC9E,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,iFAAiF;IACjF,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAClF,CAAC;IACF,MAAM,SAAS,GAAG,EAAE,CAAC;IACrB,KAAK,CAAC,IAAI,CACR,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAC1F,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,GAC/C,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAChD,EAAE,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,EAAE,CAAC,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,CAAC,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,MAAM,CAAC,MAAM,GAAG,SAAS,QAAQ,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,IAAI,GAAG,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CACR,CAAC,CACC,IAAI,CAAC,MAAM,EACX,SAAS,GAAG,CAAC,SAAS,4DAA4D;YAChF,oFAAoF;YACpF,gFAAgF,CACnF,CACF,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,EAAE,IAAI,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,kBAAkB,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,WAAmC,EACnC,IAAkB;IAElB,MAAM,KAAK,GAAG,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,yBAAyB,CAAC;IAC1F,MAAM,GAAG,GAAa,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACrB,MAAM,GAAG,GAAG,CAAoB,CAAC;QACjC,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,yBAAyB;QAClF,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC;YAAE,SAAS;QAC3C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,MAAM,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,GAAG,CAAC,IAAI,CACN,0HAA0H,CAC3H,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,WAAmC,EACnC,OAAyB;IAEzB,MAAM,GAAG,GAAa,CAAC,GAAG,OAAO,CAAC,IAAI,qBAAqB,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACrB,MAAM,GAAG,GAAG,CAAoB,CAAC;QACjC,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,yBAAyB;QAClF,MAAM,GAAG,GAAG,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC;YAAE,SAAS;QAC3C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,MAAM,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,MAAM,GACV,OAAO,CAAC,YAAY,KAAK,UAAU;QACjC,CAAC,CAAC,sCAAsC;QACxC,CAAC,CAAC,OAAO,CAAC,YAAY,KAAK,aAAa;YACtC,CAAC,CAAC,0BAA0B;YAC5B,CAAC,CAAC,gCAAgC,CAAC;IACzC,GAAG,CAAC,IAAI,CACN,KAAK,OAAO,CAAC,SAAS,IAAI,MAAM,kDAAkD,OAAO,CAAC,aAAa,KAAK,OAAO,CAAC,QAAQ,IAAI,CACjI,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC","sourcesContent":["/**\n * Reporters: turn a {@link ScanResult} into SARIF 2.1.0, a clean JSON object,\n * or a human-readable text summary. No third-party dependencies — ANSI colour\n * is emitted with raw escape codes and is off by default.\n */\nimport type { AlgorithmFamily, Finding, RuleMeta, ScanResult, Severity } from \"./types.js\";\nimport { VERSION } from \"./version.js\";\nimport { SEVERITY_ORDER, sarifLevel } from \"./severity.js\";\nimport { ANALYZABLE_LANGUAGES_LABEL } from \"./detect-utils.js\";\nimport { remediationFor, remediationForTier, remediationForProfile } from \"./remediation.js\";\nimport type { SecurityTier } from \"./remediation.js\";\nimport type { StandardsProfile } from \"./standards-profiles.js\";\nimport { fingerprintFinding } from \"./baseline.js\";\n\n/** Minimal SARIF 2.1.0 log shape (kept permissive on purpose). */\nexport interface SarifLog {\n  $schema: string;\n  version: \"2.1.0\";\n  runs: unknown[];\n}\n\n/** Options shared by the structured reporters ({@link toSarif} / {@link toJson}). */\nexport interface ReportOptions {\n  /**\n   * Omit `location.snippet` from every finding in the output. Defaults to false\n   * (snippets are included). Snippets of `sensitive` findings (e.g. PEM key\n   * blocks, SSH public keys) are ALWAYS omitted regardless of this flag — the\n   * snippet there IS the sensitive value.\n   */\n  redactSnippets?: boolean;\n  /**\n   * Full rule catalog to advertise in SARIF `tool.driver.rules[]`, even for\n   * rules that produced no finding in this run. Pass\n   * `defaultRegistry.ruleCatalog()`. When omitted, only the rules that actually\n   * fired are emitted (the historical behaviour). SARIF-only; ignored by\n   * {@link toJson}.\n   */\n  catalog?: RuleMeta[];\n}\n\nconst SARIF_SCHEMA =\n  \"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json\";\n\nconst INFORMATION_URI = \"https://github.com/quantakrypto/pqc-tools\";\n\n/**\n * Resolve the snippet to emit for a finding, honouring redaction. Sensitive\n * findings (key material) never expose their snippet; otherwise the snippet is\n * dropped only when `redactSnippets` is set.\n */\nfunction emittedSnippet(f: Finding, redactSnippets: boolean): string | undefined {\n  if (redactSnippets || f.sensitive) return undefined;\n  return f.location.snippet;\n}\n\n/** Map our severity to a SARIF rule-level default (used in rules[].defaultConfiguration). */\nfunction sarifRank(severity: Severity): number {\n  switch (severity) {\n    case \"critical\":\n      return 100;\n    case \"high\":\n      return 80;\n    case \"medium\":\n      return 50;\n    case \"low\":\n      return 20;\n    default:\n      return 5;\n  }\n}\n\n/** Build a SARIF `rules[]` entry from a rule's severity/title/message/etc. */\nfunction sarifRule(spec: {\n  id: string;\n  title: string;\n  message: string;\n  severity: Severity;\n  category: string;\n  algorithm?: string;\n  hndl: boolean;\n  cwe?: string;\n  remediation?: string;\n}): Record<string, unknown> {\n  return {\n    id: spec.id,\n    name: spec.id,\n    shortDescription: { text: spec.title },\n    fullDescription: { text: spec.message },\n    defaultConfiguration: { level: sarifLevel(spec.severity), rank: sarifRank(spec.severity) },\n    ...(spec.remediation ? { help: { text: `Remediation: ${spec.remediation}` } } : {}),\n    properties: {\n      category: spec.category,\n      ...(spec.algorithm ? { algorithm: spec.algorithm } : {}),\n      hndl: spec.hndl,\n      ...(spec.cwe ? { cwe: spec.cwe, \"security-severity\": securitySeverity(spec.severity) } : {}),\n      ...(spec.cwe ? { tags: [\"security\", spec.cwe] } : {}),\n    },\n    ...(spec.cwe\n      ? {\n          relationships: [\n            { target: { id: spec.cwe, toolComponent: { name: \"CWE\" } }, kinds: [\"relevant\"] },\n          ],\n        }\n      : {}),\n  };\n}\n\n/** Serialize a scan result as SARIF 2.1.0. */\nexport function toSarif(result: ScanResult, opts?: ReportOptions): SarifLog {\n  const redactSnippets = opts?.redactSnippets ?? false;\n  // Build the rule set and collect the CWE taxa referenced by any rule. When a\n  // full catalog is supplied, advertise every rule (even ones that didn't fire);\n  // otherwise emit one rule per ruleId encountered (the historical behaviour).\n  const ruleIndex = new Map<string, number>();\n  const rules: Array<Record<string, unknown>> = [];\n  const cweTaxa = new Set<string>();\n\n  for (const r of opts?.catalog ?? []) {\n    if (ruleIndex.has(r.id)) continue;\n    if (r.cwe) cweTaxa.add(r.cwe);\n    ruleIndex.set(r.id, rules.length);\n    rules.push(\n      sarifRule({\n        id: r.id,\n        title: r.title,\n        message: r.message,\n        severity: r.severity,\n        category: r.category,\n        algorithm: r.algorithm,\n        hndl: r.hndl,\n        cwe: r.cwe,\n        remediation: r.remediation,\n      }),\n    );\n  }\n\n  for (const f of result.findings) {\n    if (f.cwe) cweTaxa.add(f.cwe);\n    if (ruleIndex.has(f.ruleId)) continue;\n    ruleIndex.set(f.ruleId, rules.length);\n    rules.push(\n      sarifRule({\n        id: f.ruleId,\n        title: f.title,\n        message: f.message,\n        severity: f.severity,\n        category: f.category,\n        algorithm: f.algorithm,\n        hndl: f.hndl,\n        cwe: f.cwe,\n        remediation: f.remediation,\n      }),\n    );\n  }\n\n  const results = result.findings.map((f) => {\n    const region: Record<string, number> = { startLine: f.location.line };\n    if (typeof f.location.column === \"number\") region.startColumn = f.location.column;\n    if (typeof f.location.endLine === \"number\") region.endLine = f.location.endLine;\n    const snippet = emittedSnippet(f, redactSnippets);\n\n    return {\n      ruleId: f.ruleId,\n      ruleIndex: ruleIndex.get(f.ruleId),\n      level: sarifLevel(f.severity),\n      message: { text: f.message },\n      // Line-INSENSITIVE fingerprint (the same one the baseline uses:\n      // sha256 of ruleId|file|normalizedSnippet). GitHub code scanning keys\n      // alert identity + dedup off partialFingerprints, so a finding survives\n      // line shifts and reformatting instead of re-alerting as \"new\" on every\n      // edit above it. `quantakrypto/v1` names our scheme.\n      partialFingerprints: { \"quantakrypto/v1\": fingerprintFinding(f) },\n      properties: {\n        category: f.category,\n        severity: f.severity,\n        confidence: f.confidence,\n        hndl: f.hndl,\n        ...(f.algorithm ? { algorithm: f.algorithm } : {}),\n        ...(f.remediation ? { remediation: f.remediation } : {}),\n        ...(f.cwe ? { cwe: f.cwe } : {}),\n      },\n      ...(f.cwe\n        ? {\n            taxa: [\n              {\n                target: { id: f.cwe, toolComponent: { name: \"CWE\" } },\n              },\n            ],\n          }\n        : {}),\n      locations: [\n        {\n          physicalLocation: {\n            artifactLocation: { uri: f.location.file },\n            region: {\n              ...region,\n              ...(snippet ? { snippet: { text: snippet } } : {}),\n            },\n          },\n        },\n      ],\n    };\n  });\n\n  // CWE taxonomy component (SARIF taxonomies), referenced by rules + results.\n  const taxonomies =\n    cweTaxa.size > 0\n      ? [\n          {\n            name: \"CWE\",\n            informationUri: \"https://cwe.mitre.org/\",\n            organization: \"MITRE\",\n            shortDescription: { text: \"The MITRE Common Weakness Enumeration\" },\n            taxa: [...cweTaxa].sort().map((id) => ({\n              id,\n              helpUri: `https://cwe.mitre.org/data/definitions/${id.replace(/^CWE-/, \"\")}.html`,\n            })),\n          },\n        ]\n      : [];\n\n  return {\n    $schema: SARIF_SCHEMA,\n    version: \"2.1.0\",\n    runs: [\n      {\n        tool: {\n          driver: {\n            name: \"qScan\",\n            informationUri: INFORMATION_URI,\n            version: result.toolVersion || VERSION,\n            rules,\n          },\n        },\n        ...(taxonomies.length > 0 ? { taxonomies } : {}),\n        results,\n      },\n    ],\n  };\n}\n\n/** GitHub-code-scanning `security-severity` (0–10) derived from our severity. */\nfunction securitySeverity(severity: Severity): string {\n  switch (severity) {\n    case \"critical\":\n      return \"9.5\";\n    case \"high\":\n      return \"8.0\";\n    case \"medium\":\n      return \"5.0\";\n    case \"low\":\n      return \"3.0\";\n    default:\n      return \"1.0\";\n  }\n}\n\n/** Serialize a scan result as a plain JSON-friendly object. */\nexport function toJson(result: ScanResult, opts?: ReportOptions): Record<string, unknown> {\n  const redactSnippets = opts?.redactSnippets ?? false;\n  return {\n    toolVersion: result.toolVersion,\n    root: result.root,\n    startedAt: result.startedAt,\n    finishedAt: result.finishedAt,\n    filesScanned: result.filesScanned,\n    ...(result.analyzedFiles !== undefined ? { analyzedFiles: result.analyzedFiles } : {}),\n    ...(result.diagnostics ? { diagnostics: result.diagnostics } : {}),\n    inventory: {\n      readinessScore: result.inventory.readinessScore,\n      hndlCount: result.inventory.hndlCount,\n      bySeverity: result.inventory.bySeverity,\n      byCategory: result.inventory.byCategory,\n      byAlgorithm: result.inventory.byAlgorithm,\n    },\n    findings: result.findings.map((f) => ({\n      ruleId: f.ruleId,\n      title: f.title,\n      category: f.category,\n      severity: f.severity,\n      confidence: f.confidence,\n      algorithm: f.algorithm,\n      hndl: f.hndl,\n      message: f.message,\n      remediation: f.remediation,\n      cwe: f.cwe,\n      location: {\n        file: f.location.file,\n        line: f.location.line,\n        column: f.location.column,\n        endLine: f.location.endLine,\n        snippet: emittedSnippet(f, redactSnippets),\n      },\n    })),\n  };\n}\n\n/* -------------------------------------------------------------------------- */\n/* Human-readable summary                                                      */\n/* -------------------------------------------------------------------------- */\n\n/** Raw ANSI codes (no chalk). Disabled when colour is off. */\nconst ANSI = {\n  reset: \"\\x1b[0m\",\n  bold: \"\\x1b[1m\",\n  dim: \"\\x1b[2m\",\n  red: \"\\x1b[31m\",\n  green: \"\\x1b[32m\",\n  yellow: \"\\x1b[33m\",\n  blue: \"\\x1b[34m\",\n  magenta: \"\\x1b[35m\",\n  cyan: \"\\x1b[36m\",\n} as const;\n\nfunction severityColor(sev: Severity): string {\n  switch (sev) {\n    case \"critical\":\n      return ANSI.magenta;\n    case \"high\":\n      return ANSI.red;\n    case \"medium\":\n      return ANSI.yellow;\n    case \"low\":\n      return ANSI.blue;\n    default:\n      return ANSI.dim;\n  }\n}\n\nfunction scoreColor(score: number): string {\n  if (score >= 80) return ANSI.green;\n  if (score >= 50) return ANSI.yellow;\n  return ANSI.red;\n}\n\n/**\n * Render a human-readable summary of a scan result. Colour is off by default;\n * pass `{ color: true }` to emit ANSI escape codes.\n */\nexport function formatSummary(\n  result: ScanResult,\n  options?: { color?: boolean; tier?: SecurityTier },\n): string {\n  const color = options?.color ?? false;\n  const c = (code: string, text: string): string => (color ? `${code}${text}${ANSI.reset}` : text);\n\n  const lines: string[] = [];\n  const inv = result.inventory;\n\n  lines.push(c(ANSI.bold, \"qScan — post-quantum readiness report\"));\n  lines.push(c(ANSI.dim, `tool v${result.toolVersion} · root: ${result.root}`));\n  lines.push(\"\");\n\n  // Readiness score banner.\n  lines.push(\n    `Readiness score: ${c(`${ANSI.bold}${scoreColor(inv.readinessScore)}`, `${inv.readinessScore}/100`)}`,\n  );\n  const analyzed =\n    result.analyzedFiles !== undefined\n      ? `   Analyzed (${ANALYZABLE_LANGUAGES_LABEL}): ${result.analyzedFiles}`\n      : \"\";\n  lines.push(\n    `Files scanned:   ${result.filesScanned}${analyzed}   Findings: ${result.findings.length}   HNDL-exposed: ${c(\n      inv.hndlCount > 0 ? ANSI.red : ANSI.green,\n      String(inv.hndlCount),\n    )}`,\n  );\n  // Coverage honesty: a score over zero analyzable files is not a clean bill of health.\n  if (result.analyzedFiles === 0 && result.filesScanned > 0) {\n    lines.push(\n      c(\n        ANSI.yellow,\n        `Note: 0 files were in a supported source language (${ANALYZABLE_LANGUAGES_LABEL}) — the readiness score does not reflect this codebase.`,\n      ),\n    );\n  }\n  // Coverage diagnostics: skipped files mean the finding count may be incomplete.\n  const diag = result.diagnostics;\n  if (diag && (diag.unreadable > 0 || diag.skippedMinified > 0)) {\n    lines.push(\n      c(\n        ANSI.yellow,\n        `Coverage: ${diag.unreadable} unreadable, ${diag.skippedMinified} skipped as minified — results may be incomplete.`,\n      ),\n    );\n  }\n  lines.push(\"\");\n\n  // Severity breakdown.\n  const sevParts = SEVERITY_ORDER.filter((s) => inv.bySeverity[s] > 0).map((s) =>\n    c(severityColor(s), `${s}: ${inv.bySeverity[s]}`),\n  );\n  lines.push(`By severity:  ${sevParts.length ? sevParts.join(\"   \") : c(ANSI.green, \"none\")}`);\n\n  // Algorithm breakdown.\n  const algoParts = Object.entries(inv.byAlgorithm)\n    .sort((a, b) => b[1] - a[1])\n    .map(([k, v]) => `${k}: ${v}`);\n  if (algoParts.length) lines.push(`By algorithm: ${algoParts.join(\"   \")}`);\n  lines.push(\"\");\n\n  if (result.findings.length === 0) {\n    lines.push(c(ANSI.green, \"No classical asymmetric cryptography detected. ✓\"));\n    return lines.join(\"\\n\");\n  }\n\n  // Top findings, grouped by severity (most severe first), capped for readability.\n  const sorted = [...result.findings].sort(\n    (a, b) => SEVERITY_ORDER.indexOf(a.severity) - SEVERITY_ORDER.indexOf(b.severity),\n  );\n  const MAX_SHOWN = 25;\n  lines.push(\n    c(ANSI.bold, `Top findings (${Math.min(MAX_SHOWN, sorted.length)} of ${sorted.length}):`),\n  );\n\n  for (const f of sorted.slice(0, MAX_SHOWN)) {\n    const loc = `${f.location.file}:${f.location.line}${\n      f.location.column ? `:${f.location.column}` : \"\"\n    }`;\n    const tag = c(severityColor(f.severity), `[${f.severity}]`);\n    const hndl = f.hndl ? c(ANSI.red, \" (HNDL)\") : \"\";\n    lines.push(`  ${tag} ${f.title}${hndl}`);\n    lines.push(c(ANSI.dim, `      ${loc} — ${f.message}`));\n    if (f.remediation) lines.push(c(ANSI.cyan, `      → ${f.remediation}`));\n  }\n\n  if (sorted.length > MAX_SHOWN) {\n    lines.push(c(ANSI.dim, `  …and ${sorted.length - MAX_SHOWN} more.`));\n  }\n\n  lines.push(\"\");\n  if (inv.hndlCount > 0) {\n    lines.push(\n      c(\n        ANSI.yellow,\n        `Note: ${inv.hndlCount} finding(s) are exposed to \"harvest now, decrypt later\" — ` +\n          \"encrypted traffic captured today can be decrypted once a quantum computer exists. \" +\n          \"Prioritise migrating key exchange / encryption to hybrid PQC (X25519MLKEM768).\",\n      ),\n    );\n  }\n\n  if (options?.tier) {\n    lines.push(\"\", ...formatTierGuidance(inv.byAlgorithm, options.tier));\n  }\n\n  return lines.join(\"\\n\");\n}\n\n/**\n * Per-family migration targets for a CNSA security tier — surfaces the otherwise\n * library-only {@link remediationForTier} in human reports. Category 5 shows the\n * ML-KEM-1024 / ML-DSA-87 sets CNSA 2.0 mandates for national-security systems and\n * long-lived secrets. Returns plain (un-coloured) lines; the caller styles them.\n */\nexport function formatTierGuidance(\n  byAlgorithm: Record<string, number>,\n  tier: SecurityTier,\n): string[] {\n  const label = tier === \"category-5\" ? \"CNSA 2.0 (Category 5)\" : \"Category 3 (commercial)\";\n  const out: string[] = [`${label} migration targets:`];\n  const seen = new Set<string>();\n  for (const [k, n] of Object.entries(byAlgorithm)) {\n    if (n <= 0) continue;\n    const fam = k as AlgorithmFamily;\n    if (fam === \"unknown\" || !remediationFor(fam)) continue; // skip unmapped families\n    const rem = remediationForTier(fam, tier);\n    if (seen.has(rem.recommendation)) continue;\n    seen.add(rem.recommendation);\n    out.push(`  ${fam} → ${rem.recommendation}`);\n  }\n  if (tier === \"category-5\") {\n    out.push(\n      \"  CNSA 2.0 mandates ML-KEM-1024 / ML-DSA-87 for national-security systems and long-lived secrets (2030/2033 milestones).\",\n    );\n  }\n  return out;\n}\n\n/**\n * Per-family migration targets tailored to a selected {@link StandardsProfile}\n * (`--profile`). Unlike {@link formatTierGuidance} (CNSA-tier only), this surfaces the\n * regime's parameter sets AND its hybrid stance — required (ANSSI/BSI) vs recommended\n * (NIST/NCSC) vs optional (CNSA 2.0) — so guidance isn't regime-wrong. Returns plain\n * (un-coloured) lines; the caller styles them.\n */\nexport function formatProfileGuidance(\n  byAlgorithm: Record<string, number>,\n  profile: StandardsProfile,\n): string[] {\n  const out: string[] = [`${profile.name} migration targets:`];\n  const seen = new Set<string>();\n  for (const [k, n] of Object.entries(byAlgorithm)) {\n    if (n <= 0) continue;\n    const fam = k as AlgorithmFamily;\n    if (fam === \"unknown\" || !remediationFor(fam)) continue; // skip unmapped families\n    const rem = remediationForProfile(fam, profile);\n    if (seen.has(rem.recommendation)) continue;\n    seen.add(rem.recommendation);\n    out.push(`  ${fam} → ${rem.recommendation}`);\n  }\n  const stance =\n    profile.hybridStance === \"required\"\n      ? \"requires classical+PQC hybridization\"\n      : profile.hybridStance === \"recommended\"\n        ? \"recommends hybridization\"\n        : \"does not require hybridization\";\n  out.push(\n    `  ${profile.authority} ${stance}; classical public-key crypto disallowed after ${profile.disallowAfter} (${profile.citation}).`,\n  );\n  return out;\n}\n"]}

package/dist/scan-worker.js

@@ -13,7 +13,7 @@ import * as path from "node:path";
 import { parentPort, workerData } from "node:worker_threads";
 import { defaultRegistry } from "./registry.js";
 import { detectFile } from "./scan.js";
-import { looksMinified } from "./walk.js";
+import { isKeystorePath, looksMinified } from "./walk.js";
 import { isManifestFile } from "./dependencies.js";
 if (parentPort) {
     const data = (workerData ?? {});
@@ -30,15 +30,17 @@ if (parentPort) {
             const scannedNames = [];
             for (const rel of req.files) {
                 const abs = path.join(baseDir, ...rel.split("/"));
+                // Keystores (.jks/.p12/…) are read byte-preserving (latin1); see scan.ts.
+                const keystore = isKeystorePath(rel);
                 let content;
                 try {
-                    content = readFileSync(abs, "utf8");
+                    content = readFileSync(abs, keystore ? "latin1" : "utf8");
                 }
                 catch {
                     unreadable += 1;
                     continue;
                 }
-                if (!toggles.scanMinified && !isManifestFile(rel) && looksMinified(content)) {
+                if (!toggles.scanMinified && !isManifestFile(rel) && !keystore && looksMinified(content)) {
                     skippedMinified += 1;
                     continue;
                 }

package/dist/scan-worker.js.map

@@ -1 +1 @@
-{"version":3,"file":"scan-worker.js","sourceRoot":"","sources":["../src/scan-worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAG7D,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAenD,IAAI,UAAU,EAAE,CAAC;IACf,MAAM,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAgD,CAAC;IAC/E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,UAAU,CAAC;IAExB,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAiB,EAAE,EAAE;QACvC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAc,EAAE,CAAC;YAC/B,IAAI,YAAY,GAAG,CAAC,CAAC;YACrB,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,IAAI,eAAe,GAAG,CAAC,CAAC;YACxB,MAAM,YAAY,GAAa,EAAE,CAAC;YAElC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBAClD,IAAI,OAAe,CAAC;gBACpB,IAAI,CAAC;oBACH,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBACtC,CAAC;gBAAC,MAAM,CAAC;oBACP,UAAU,IAAI,CAAC,CAAC;oBAChB,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC5E,eAAe,IAAI,CAAC,CAAC;oBACrB,SAAS;gBACX,CAAC;gBACD,YAAY,IAAI,CAAC,CAAC;gBAClB,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACvB,QAAQ,CAAC,IAAI,CACX,GAAG,UAAU,CACX,GAAG,EACH,OAAO,EACP,IAAI,EACJ;oBACE,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,IAAI,EAAE,OAAO,CAAC,IAAI;iBACnB,EACD,OAAO,CAAC,aAAa,CACtB,CACF,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,WAAW,CAAC;gBACf,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,KAAK,EAAE,YAAY;gBACnB,MAAM,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE;aAChE,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,WAAW,CAAC;gBACf,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Worker-thread entry for {@link scanParallel}. Built to `dist/scan-worker.js`\n * and spawned by `parallel.ts`. Each worker reads its assigned files and runs\n * the SAME pure detector pipeline as the serial scan (`detectFile`), returning\n * `{ findings, filesScanned }` per chunk. No shared mutable state.\n *\n * This file performs side effects (wires up message handlers) only when it is\n * actually running inside a worker thread, so importing it from the main thread\n * (e.g. for coverage) is harmless.\n */\nimport { readFileSync } from \"node:fs\";\nimport * as path from \"node:path\";\nimport { parentPort, workerData } from \"node:worker_threads\";\n\nimport type { Finding } from \"./types.js\";\nimport { defaultRegistry } from \"./registry.js\";\nimport { detectFile } from \"./scan.js\";\nimport { looksMinified } from \"./walk.js\";\nimport { isManifestFile } from \"./dependencies.js\";\n\ninterface WorkerToggles {\n  source: boolean;\n  config: boolean;\n  deps: boolean;\n  scanMinified: boolean;\n  disabledRules?: string[];\n}\n\ninterface ChunkRequest {\n  index: number;\n  files: string[];\n}\n\nif (parentPort) {\n  const data = (workerData ?? {}) as { baseDir: string; toggles: WorkerToggles };\n  const baseDir = data.baseDir;\n  const toggles = data.toggles;\n  const dets = defaultRegistry.all();\n  const port = parentPort;\n\n  port.on(\"message\", (req: ChunkRequest) => {\n    try {\n      const findings: Finding[] = [];\n      let filesScanned = 0;\n      let unreadable = 0;\n      let skippedMinified = 0;\n      const scannedNames: string[] = [];\n\n      for (const rel of req.files) {\n        const abs = path.join(baseDir, ...rel.split(\"/\"));\n        let content: string;\n        try {\n          content = readFileSync(abs, \"utf8\");\n        } catch {\n          unreadable += 1;\n          continue;\n        }\n        if (!toggles.scanMinified && !isManifestFile(rel) && looksMinified(content)) {\n          skippedMinified += 1;\n          continue;\n        }\n        filesScanned += 1;\n        scannedNames.push(rel);\n        findings.push(\n          ...detectFile(\n            rel,\n            content,\n            dets,\n            {\n              source: toggles.source,\n              config: toggles.config,\n              deps: toggles.deps,\n            },\n            toggles.disabledRules,\n          ),\n        );\n      }\n\n      port.postMessage({\n        index: req.index,\n        files: scannedNames,\n        result: { findings, filesScanned, unreadable, skippedMinified },\n      });\n    } catch (err) {\n      port.postMessage({\n        index: req.index,\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n  });\n}\n"]}
+{"version":3,"file":"scan-worker.js","sourceRoot":"","sources":["../src/scan-worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAG7D,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAenD,IAAI,UAAU,EAAE,CAAC;IACf,MAAM,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAgD,CAAC;IAC/E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,UAAU,CAAC;IAExB,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAiB,EAAE,EAAE;QACvC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAc,EAAE,CAAC;YAC/B,IAAI,YAAY,GAAG,CAAC,CAAC;YACrB,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,IAAI,eAAe,GAAG,CAAC,CAAC;YACxB,MAAM,YAAY,GAAa,EAAE,CAAC;YAElC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBAClD,0EAA0E;gBAC1E,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;gBACrC,IAAI,OAAe,CAAC;gBACpB,IAAI,CAAC;oBACH,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBAC5D,CAAC;gBAAC,MAAM,CAAC;oBACP,UAAU,IAAI,CAAC,CAAC;oBAChB,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;oBACzF,eAAe,IAAI,CAAC,CAAC;oBACrB,SAAS;gBACX,CAAC;gBACD,YAAY,IAAI,CAAC,CAAC;gBAClB,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACvB,QAAQ,CAAC,IAAI,CACX,GAAG,UAAU,CACX,GAAG,EACH,OAAO,EACP,IAAI,EACJ;oBACE,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,IAAI,EAAE,OAAO,CAAC,IAAI;iBACnB,EACD,OAAO,CAAC,aAAa,CACtB,CACF,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,WAAW,CAAC;gBACf,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,KAAK,EAAE,YAAY;gBACnB,MAAM,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE;aAChE,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,WAAW,CAAC;gBACf,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Worker-thread entry for {@link scanParallel}. Built to `dist/scan-worker.js`\n * and spawned by `parallel.ts`. Each worker reads its assigned files and runs\n * the SAME pure detector pipeline as the serial scan (`detectFile`), returning\n * `{ findings, filesScanned }` per chunk. No shared mutable state.\n *\n * This file performs side effects (wires up message handlers) only when it is\n * actually running inside a worker thread, so importing it from the main thread\n * (e.g. for coverage) is harmless.\n */\nimport { readFileSync } from \"node:fs\";\nimport * as path from \"node:path\";\nimport { parentPort, workerData } from \"node:worker_threads\";\n\nimport type { Finding } from \"./types.js\";\nimport { defaultRegistry } from \"./registry.js\";\nimport { detectFile } from \"./scan.js\";\nimport { isKeystorePath, looksMinified } from \"./walk.js\";\nimport { isManifestFile } from \"./dependencies.js\";\n\ninterface WorkerToggles {\n  source: boolean;\n  config: boolean;\n  deps: boolean;\n  scanMinified: boolean;\n  disabledRules?: string[];\n}\n\ninterface ChunkRequest {\n  index: number;\n  files: string[];\n}\n\nif (parentPort) {\n  const data = (workerData ?? {}) as { baseDir: string; toggles: WorkerToggles };\n  const baseDir = data.baseDir;\n  const toggles = data.toggles;\n  const dets = defaultRegistry.all();\n  const port = parentPort;\n\n  port.on(\"message\", (req: ChunkRequest) => {\n    try {\n      const findings: Finding[] = [];\n      let filesScanned = 0;\n      let unreadable = 0;\n      let skippedMinified = 0;\n      const scannedNames: string[] = [];\n\n      for (const rel of req.files) {\n        const abs = path.join(baseDir, ...rel.split(\"/\"));\n        // Keystores (.jks/.p12/…) are read byte-preserving (latin1); see scan.ts.\n        const keystore = isKeystorePath(rel);\n        let content: string;\n        try {\n          content = readFileSync(abs, keystore ? \"latin1\" : \"utf8\");\n        } catch {\n          unreadable += 1;\n          continue;\n        }\n        if (!toggles.scanMinified && !isManifestFile(rel) && !keystore && looksMinified(content)) {\n          skippedMinified += 1;\n          continue;\n        }\n        filesScanned += 1;\n        scannedNames.push(rel);\n        findings.push(\n          ...detectFile(\n            rel,\n            content,\n            dets,\n            {\n              source: toggles.source,\n              config: toggles.config,\n              deps: toggles.deps,\n            },\n            toggles.disabledRules,\n          ),\n        );\n      }\n\n      port.postMessage({\n        index: req.index,\n        files: scannedNames,\n        result: { findings, filesScanned, unreadable, skippedMinified },\n      });\n    } catch (err) {\n      port.postMessage({\n        index: req.index,\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n  });\n}\n"]}

package/dist/scan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAuB7E;;;;;;GAMG;AACH,eAAO,MAAM,SAAS,EAAE,QAAQ,EAAqB,CAAC;AAEtD,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,MAAM,CAI9D;AAOD;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,QAAQ,EAAE,EACzB,OAAO,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,EAC5D,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,GAChC,OAAO,EAAE,CA8BX;AAED;;;;GAIG;AACH,wBAAsB,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CA0IpE;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,GAAG,SAAS,CAAC,GAChD,MAAM,EAAE,CAmBV"}
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAwC7E;;;;;;GAMG;AACH,eAAO,MAAM,SAAS,EAAE,QAAQ,EAAqB,CAAC;AAEtD,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,MAAM,CAI9D;AAOD;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,QAAQ,EAAE,EACzB,OAAO,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,EAC5D,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,GAChC,OAAO,EAAE,CA8BX;AAED;;;;GAIG;AACH,wBAAsB,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CA4JpE;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,GAAG,SAAS,CAAC,GAChD,MAAM,EAAE,CAmBV"}

package/dist/scan.js

@@ -11,7 +11,7 @@
  */
 import { readFile, stat } from "node:fs/promises";
 import * as path from "node:path";
-import { walkFiles, toPosix, isBinaryPath, looksMinified, matchesAny } from "./walk.js";
+import { walkFiles, toPosix, isBinaryPath, isKeystorePath, looksMinified, matchesAny, DEFAULT_MAX_FILE_SIZE, } from "./walk.js";
 import { isAnalyzableSource } from "./detect-utils.js";
 import { stripCommentFindings, stripIgnoredFindings, stripStringLiteralFindings, } from "./comments.js";
 /**
@@ -19,7 +19,16 @@ import { stripCommentFindings, stripIgnoredFindings, stripStringLiteralFindings,
  * A match inside a string (e.g. `t.Error("SigningMethodPS256 …")`) is prose and
  * is dropped. Rules that legitimately match quoted tokens are NOT listed here.
  */
-const CODE_ONLY_RULES = new Set(["go-jwt-signingmethod"]);
+const CODE_ONLY_RULES = new Set([
+    "go-jwt-signingmethod",
+    // Identifier-form JWT alg constants (jjwt `SignatureAlgorithm.RS256`, auth0
+    // `Algorithm.RSA256`, C# `SecurityAlgorithms.*`, Rust `Algorithm::RS256`). Like the
+    // Go rule, these are only meaningful as code; the SAME token inside a string literal
+    // (an error message that names/forbids the alg) is prose, not a usage.
+    "java-jwt-alg",
+    "csharp-jwt-alg",
+    "rust-jwt-algorithm",
+]);
 import { hashContent, loadCache, rulesetFingerprint, saveCache } from "./cache.js";
 import { builtinDetectors, defaultRegistry, detectorScope } from "./registry.js";
 import { isManifestFile, scanManifest } from "./dependencies.js";
@@ -139,22 +148,42 @@ export async function scan(options) {
         const absPath = singleFileName ? options.root : path.join(baseDir, ...rel.split("/"));
         const reportedPath = singleFileName ? toPosix(rel) : rel;
         options.onFile?.(reportedPath);
+        // Cryptographic keystores (.jks/.p12/…) are binary; read them byte-preserving
+        // (latin1) so the keystore detector can inspect magic bytes.
+        const keystore = isKeystorePath(reportedPath);
+        // Keystores are read whole into memory as latin1. The walker already caps file
+        // size, but the explicit-file-list (incremental) path does not — so stat and
+        // skip an oversized binary here to avoid reading a huge encrypted archive
+        // (`.gpg`) into a string.
+        if (keystore) {
+            try {
+                const { size } = await stat(absPath);
+                if (size > (options.maxFileSize ?? DEFAULT_MAX_FILE_SIZE))
+                    continue;
+            }
+            catch {
+                unreadable += 1;
+                continue;
+            }
+        }
         let content;
         try {
-            content = await readFile(absPath, "utf8");
+            content = await readFile(absPath, keystore ? "latin1" : "utf8");
         }
         catch {
             unreadable += 1; // permissions / vanished / decode failure — tracked, not silent.
             continue;
         }
         // Skip machine-minified / generated content (unless explicitly enabled).
-        // Manifests are always scanned (their findings are dependency findings).
-        if (!scanMinified && !isManifestFile(reportedPath) && looksMinified(content)) {
+        // Manifests and keystores are always scanned.
+        if (!scanMinified && !isManifestFile(reportedPath) && !keystore && looksMinified(content)) {
             skippedMinified += 1;
             continue;
         }
         // Cumulative-byte budget: enforced once this file's bytes are accounted for.
-        bytesScanned += Buffer.byteLength(content, "utf8");
+        // Use the read encoding so a latin1 keystore is counted at its on-disk size
+        // (a utf8 byteLength would double-count every byte ≥ 0x80).
+        bytesScanned += Buffer.byteLength(content, keystore ? "latin1" : "utf8");
         if (typeof maxBytes === "number" && bytesScanned > maxBytes) {
             throw new BudgetExceededError(`maxBytes budget exceeded (limit: ${maxBytes}).`);
         }

package/dist/scan.js.map

@@ -1 +1 @@
-{"version":3,"file":"scan.js","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAEvB;;;;GAIG;AACH,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC;AAC/E,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEnF,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,SAAS,GAAe,gBAAgB,CAAC;AAEtD,8EAA8E;AAC9E,MAAM,UAAU,eAAe,CAAC,CAAU,EAAE,CAAU;IACpD,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;IAClF,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,sFAAsF;AACtF,SAAS,gBAAgB,CAAC,OAAoB;IAC5C,OAAO,OAAO,CAAC,SAAS,IAAI,eAAe,CAAC,GAAG,EAAE,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CACxB,IAAY,EACZ,OAAe,EACf,IAAyB,EACzB,OAA4D,EAC5D,aAAiC;IAEjC,IAAI,GAAG,GAAc,EAAE,CAAC;IAExB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC;QACjD,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM;YAAE,SAAS;QAC3D,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,2EAA2E;IAC3E,8DAA8D;IAC9D,2EAA2E;IAC3E,kDAAkD;IAClD,GAAG,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/C,GAAG,GAAG,0BAA0B,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;IACtE,GAAG,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAEzC,IAAI,OAAO,CAAC,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,8EAA8E;IAC9E,qEAAqE;IACrE,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;QACxC,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAoB;IAC7C,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAE7B,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;IAC1C,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC;IACnD,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAEvC,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACvE,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEvE,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,eAAe,GAAG,CAAC,CAAC;IAExB,0EAA0E;IAC1E,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACpC,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,yEAAyE;IACzE,6EAA6E;IAC7E,4EAA4E;IAC5E,sEAAsE;IACtE,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,WAAW,GAAmC,SAAS;QAC3D,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,CAAC,CAAC,IAAI,CAAC;IAET,8EAA8E;IAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAElC,+EAA+E;IAC/E,MAAM,QAAQ,GAA0B,OAAO,CAAC,KAAK;QACnD,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;QAC7C,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE;YACtB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,CAAC;IAEP,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QACjC,4EAA4E;QAC5E,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,UAAU,EAAE,CAAC;QAE5C,4DAA4D;QAC5D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,YAAY,IAAI,QAAQ,EAAE,CAAC;YAC7D,MAAM,IAAI,mBAAmB,CAAC,oCAAoC,QAAQ,IAAI,CAAC,CAAC;QAClF,CAAC;QAED,4EAA4E;QAC5E,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACtF,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAEzD,OAAO,CAAC,MAAM,EAAE,CAAC,YAAY,CAAC,CAAC;QAE/B,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,IAAI,CAAC,CAAC,CAAC,iEAAiE;YAClF,SAAS;QACX,CAAC;QAED,yEAAyE;QACzE,yEAAyE;QACzE,IAAI,CAAC,YAAY,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7E,eAAe,IAAI,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QAED,6EAA6E;QAC7E,YAAY,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,YAAY,GAAG,QAAQ,EAAE,CAAC;YAC5D,MAAM,IAAI,mBAAmB,CAAC,oCAAoC,QAAQ,IAAI,CAAC,CAAC;QAClF,CAAC;QAED,YAAY,IAAI,CAAC,CAAC;QAClB,IAAI,kBAAkB,CAAC,YAAY,CAAC;YAAE,aAAa,IAAI,CAAC,CAAC;QAEzD,4EAA4E;QAC5E,6EAA6E;QAC7E,IAAI,YAAuB,CAAC;QAC5B,IAAI,KAAK,IAAI,WAAW,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;YAClC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACpC,YAAY;gBACV,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI;oBACtB,CAAC,CAAC,GAAG,CAAC,QAAQ;oBACd,CAAC,CAAC,UAAU,CACR,YAAY,EACZ,OAAO,EACP,IAAI,EACJ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EACpD,OAAO,CAAC,aAAa,CACtB,CAAC;YACR,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QAClE,CAAC;aAAM,CAAC;YACN,YAAY,GAAG,UAAU,CACvB,YAAY,EACZ,OAAO,EACP,IAAI,EACJ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EACpD,OAAO,CAAC,aAAa,CACtB,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;IACjC,CAAC;IAED,6DAA6D;IAC7D,IAAI,SAAS,IAAI,WAAW;QAAE,MAAM,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IAE/E,oDAAoD;IACpD,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAE/B,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;IAE9B,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ;QACR,YAAY;QACZ,aAAa;QACb,WAAW,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE;QAC5C,SAAS;QACT,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;QAClC,UAAU,EAAE,UAAU,CAAC,WAAW,EAAE;QACpC,WAAW,EAAE,OAAO;KACrB,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAwB,EACxB,OAAiD;IAEjD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC;SACpB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACZ,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACzB,IAAI,YAAY,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACpC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAClE,IAAI,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,kFAAkF;AAClF,KAAK,SAAS,CAAC,CAAC,mBAAmB,CAAC,KAAe,EAAE,OAAoB;IACvE,KAAK,MAAM,GAAG,IAAI,sBAAsB,CAAC,KAAK,EAAE,OAAO,CAAC;QAAE,MAAM,GAAG,CAAC;AACtE,CAAC","sourcesContent":["/**\n * Scan orchestrator. Walks the target (or an explicit file list), runs the\n * applicable detectors over each file, parses dependency manifests, aggregates\n * everything into an inventory, and returns a {@link ScanResult} with timing and\n * the tool version.\n *\n * Detector scope (source vs config) is driven by each {@link Detector}'s\n * declared `scope` (defaulting to \"source\"), not by ruleId prefixes. The\n * detector set comes from {@link defaultRegistry} unless overridden via\n * `options.detectors`.\n */\nimport { readFile, stat } from \"node:fs/promises\";\nimport * as path from \"node:path\";\n\nimport type { Detector, Finding, ScanOptions, ScanResult } from \"./types.js\";\nimport { walkFiles, toPosix, isBinaryPath, looksMinified, matchesAny } from \"./walk.js\";\nimport { isAnalyzableSource } from \"./detect-utils.js\";\nimport {\n  stripCommentFindings,\n  stripIgnoredFindings,\n  stripStringLiteralFindings,\n} from \"./comments.js\";\n\n/**\n * Rules whose token is only meaningful as code, never inside a string literal.\n * A match inside a string (e.g. `t.Error(\"SigningMethodPS256 …\")`) is prose and\n * is dropped. Rules that legitimately match quoted tokens are NOT listed here.\n */\nconst CODE_ONLY_RULES: ReadonlySet<string> = new Set([\"go-jwt-signingmethod\"]);\nimport { hashContent, loadCache, rulesetFingerprint, saveCache } from \"./cache.js\";\nimport type { CacheEntry } from \"./cache.js\";\nimport { builtinDetectors, defaultRegistry, detectorScope } from \"./registry.js\";\nimport { isManifestFile, scanManifest } from \"./dependencies.js\";\nimport { buildInventory } from \"./inventory.js\";\nimport { AbortError, BudgetExceededError } from \"./errors.js\";\nimport { VERSION } from \"./version.js\";\n\n/**\n * The full set of built-in detectors exposed on the public API. Re-exported\n * from {@link builtinDetectors} in `registry.ts` — the single source of truth\n * the {@link defaultRegistry} is also built from — so the public array and the\n * registry can never drift apart. The manifest scanner is handled separately\n * (it parses JSON rather than running a Detector).\n */\nexport const detectors: Detector[] = builtinDetectors;\n\n/** Stable comparator: by file, then line, then ruleId. Exported for reuse. */\nexport function compareFindings(a: Finding, b: Finding): number {\n  if (a.location.file !== b.location.file) return a.location.file < b.location.file ? -1 : 1;\n  if (a.location.line !== b.location.line) return a.location.line - b.location.line;\n  return a.ruleId < b.ruleId ? -1 : a.ruleId > b.ruleId ? 1 : 0;\n}\n\n/** Resolve the active detector list for a scan (override or the default registry). */\nfunction resolveDetectors(options: ScanOptions): Detector[] {\n  return options.detectors ?? defaultRegistry.all();\n}\n\n/**\n * Run all applicable detectors + the manifest scanner over a single file's\n * contents, honouring the source / config / dependencies toggles. Pure: no I/O.\n * Exported so the parallel worker and unit tests can drive it directly.\n */\nexport function detectFile(\n  file: string,\n  content: string,\n  dets: readonly Detector[],\n  toggles: { source: boolean; config: boolean; deps: boolean },\n  disabledRules?: readonly string[],\n): Finding[] {\n  let out: Finding[] = [];\n\n  for (const det of dets) {\n    if (!det.appliesTo(file)) continue;\n    const isConfig = detectorScope(det) === \"config\";\n    if (isConfig ? !toggles.config : !toggles.source) continue;\n    out.push(...det.detect({ file, content }));\n  }\n\n  // Drop lexical false positives that land inside comments (`// migrated off\n  // createECDH()`), then honour inline `// qscan-ignore-line` /\n  // `qscan-ignore-next-line` directives. Both run before the dependency scan\n  // appends its findings (manifests carry neither).\n  out = stripCommentFindings(out, content, file);\n  out = stripStringLiteralFindings(out, content, file, CODE_ONLY_RULES);\n  out = stripIgnoredFindings(out, content);\n\n  if (toggles.deps && isManifestFile(file)) {\n    out.push(...scanManifest(file, content));\n  }\n\n  // Per-rule suppression: drop findings whose ruleId was disabled. Applied here\n  // so both the serial scan and the worker path honour it identically.\n  if (disabledRules && disabledRules.length > 0) {\n    const disabled = new Set(disabledRules);\n    return out.filter((f) => !disabled.has(f.ruleId));\n  }\n\n  return out;\n}\n\n/**\n * Recursively scan a directory (or single file, or explicit file list) for\n * classical asymmetric crypto. Honours the source / dependencies / config\n * toggles (all default true) and reports progress through `options.onFile`.\n */\nexport async function scan(options: ScanOptions): Promise<ScanResult> {\n  const startedAt = new Date();\n\n  const doSource = options.source !== false;\n  const doDeps = options.dependencies !== false;\n  const doConfig = options.config !== false;\n  const scanMinified = options.scanMinified === true;\n  const dets = resolveDetectors(options);\n\n  // Resolve whether the root is a file so we can rebuild absolute paths to read.\n  const rootStat = await stat(options.root);\n  const rootIsFile = rootStat.isFile();\n  const baseDir = rootIsFile ? path.dirname(options.root) : options.root;\n  const singleFileName = rootIsFile ? path.basename(options.root) : null;\n\n  const findings: Finding[] = [];\n  let filesScanned = 0;\n  let analyzedFiles = 0;\n  let bytesScanned = 0;\n  let unreadable = 0;\n  let skippedMinified = 0;\n\n  // Optional content-hash scan cache: unchanged files reuse prior findings.\n  const cacheFile = options.cacheFile;\n  const ruleset = cacheFile ? rulesetFingerprint(dets, options.disabledRules) : \"\";\n  const cache = cacheFile ? await loadCache(cacheFile, ruleset) : null;\n  // A full scan starts with an empty next-cache so files that vanished are\n  // evicted. An INCREMENTAL scan (explicit `files` list) only visits a subset,\n  // so seed the next-cache with the existing entries — otherwise saving would\n  // drop every file we didn't happen to scan this run (audit: arch #4).\n  const incremental = Array.isArray(options.files);\n  const nextEntries: Map<string, CacheEntry> | null = cacheFile\n    ? new Map(incremental && cache ? cache : [])\n    : null;\n\n  // Work-budget / cancellation controls (all optional, unlimited when omitted).\n  const signal = options.signal;\n  const maxFiles = options.maxFiles;\n  const maxBytes = options.maxBytes;\n\n  // Source of relative paths: an explicit file list (incremental) or the walker.\n  const relPaths: AsyncIterable<string> = options.files\n    ? filterExplicitFiles(options.files, options)\n    : walkFiles(options.root, {\n        include: options.include,\n        exclude: options.exclude,\n        noDefaultIgnores: options.noDefaultIgnores,\n        maxFileSize: options.maxFileSize,\n      });\n\n  for await (const rel of relPaths) {\n    // Cooperative cancellation: check the signal at the top of every iteration.\n    if (signal?.aborted) throw new AbortError();\n\n    // File-count budget: enforced before reading the next file.\n    if (typeof maxFiles === \"number\" && filesScanned >= maxFiles) {\n      throw new BudgetExceededError(`maxFiles budget exceeded (limit: ${maxFiles}).`);\n    }\n\n    // In single-file mode, walkFiles yields the basename; map back to the file.\n    const absPath = singleFileName ? options.root : path.join(baseDir, ...rel.split(\"/\"));\n    const reportedPath = singleFileName ? toPosix(rel) : rel;\n\n    options.onFile?.(reportedPath);\n\n    let content: string;\n    try {\n      content = await readFile(absPath, \"utf8\");\n    } catch {\n      unreadable += 1; // permissions / vanished / decode failure — tracked, not silent.\n      continue;\n    }\n\n    // Skip machine-minified / generated content (unless explicitly enabled).\n    // Manifests are always scanned (their findings are dependency findings).\n    if (!scanMinified && !isManifestFile(reportedPath) && looksMinified(content)) {\n      skippedMinified += 1;\n      continue;\n    }\n\n    // Cumulative-byte budget: enforced once this file's bytes are accounted for.\n    bytesScanned += Buffer.byteLength(content, \"utf8\");\n    if (typeof maxBytes === \"number\" && bytesScanned > maxBytes) {\n      throw new BudgetExceededError(`maxBytes budget exceeded (limit: ${maxBytes}).`);\n    }\n\n    filesScanned += 1;\n    if (isAnalyzableSource(reportedPath)) analyzedFiles += 1;\n\n    // Cache: reuse prior findings when the content hash matches; otherwise scan\n    // and record. `nextEntries` becomes the new cache (dropping vanished files).\n    let fileFindings: Finding[];\n    if (cache && nextEntries) {\n      const hash = hashContent(content);\n      const hit = cache.get(reportedPath);\n      fileFindings =\n        hit && hit.hash === hash\n          ? hit.findings\n          : detectFile(\n              reportedPath,\n              content,\n              dets,\n              { source: doSource, config: doConfig, deps: doDeps },\n              options.disabledRules,\n            );\n      nextEntries.set(reportedPath, { hash, findings: fileFindings });\n    } else {\n      fileFindings = detectFile(\n        reportedPath,\n        content,\n        dets,\n        { source: doSource, config: doConfig, deps: doDeps },\n        options.disabledRules,\n      );\n    }\n    findings.push(...fileFindings);\n  }\n\n  // Persist the cache (best effort) before ordering/returning.\n  if (cacheFile && nextEntries) await saveCache(cacheFile, ruleset, nextEntries);\n\n  // Stable ordering: by file, then line, then ruleId.\n  findings.sort(compareFindings);\n\n  const inventory = buildInventory(findings);\n  const finishedAt = new Date();\n\n  return {\n    root: options.root,\n    findings,\n    filesScanned,\n    analyzedFiles,\n    diagnostics: { unreadable, skippedMinified },\n    inventory,\n    startedAt: startedAt.toISOString(),\n    finishedAt: finishedAt.toISOString(),\n    toolVersion: VERSION,\n  };\n}\n\n/**\n * Filter an explicit relative file list down to the paths that pass the binary\n * filter and the include/exclude patterns, returning them deduped and sorted for\n * deterministic output. Size limits are enforced later (we still read manifests\n * over the cap). Non-existent files are simply skipped at read time.\n *\n * Pure + synchronous, and exported so the parallel enumerator applies the EXACT\n * same filtering for explicit file lists as the serial path (byte-for-byte\n * identical results under `--parallel`).\n */\nexport function filterExplicitFileList(\n  files: readonly string[],\n  options: Pick<ScanOptions, \"include\" | \"exclude\">,\n): string[] {\n  const include = options.include ?? [];\n  const exclude = options.exclude ?? [];\n  const seen = new Set<string>();\n  const list = [...files]\n    .map((f) => toPosix(f))\n    .filter((f) => {\n      if (seen.has(f)) return false;\n      seen.add(f);\n      return true;\n    })\n    .sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));\n\n  return list.filter((rel) => {\n    if (isBinaryPath(rel)) return false;\n    if (include.length > 0 && !matchesAny(rel, include)) return false;\n    if (matchesAny(rel, exclude)) return false;\n    return true;\n  });\n}\n\n/** Async-generator wrapper around {@link filterExplicitFileList} for `scan()`. */\nasync function* filterExplicitFiles(files: string[], options: ScanOptions): AsyncGenerator<string> {\n  for (const rel of filterExplicitFileList(files, options)) yield rel;\n}\n"]}
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EACL,SAAS,EACT,OAAO,EACP,YAAY,EACZ,cAAc,EACd,aAAa,EACb,UAAU,EACV,qBAAqB,GACtB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAEvB;;;;GAIG;AACH,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC;IACnD,sBAAsB;IACtB,4EAA4E;IAC5E,oFAAoF;IACpF,qFAAqF;IACrF,uEAAuE;IACvE,cAAc;IACd,gBAAgB;IAChB,oBAAoB;CACrB,CAAC,CAAC;AACH,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEnF,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,SAAS,GAAe,gBAAgB,CAAC;AAEtD,8EAA8E;AAC9E,MAAM,UAAU,eAAe,CAAC,CAAU,EAAE,CAAU;IACpD,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;IAClF,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,sFAAsF;AACtF,SAAS,gBAAgB,CAAC,OAAoB;IAC5C,OAAO,OAAO,CAAC,SAAS,IAAI,eAAe,CAAC,GAAG,EAAE,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CACxB,IAAY,EACZ,OAAe,EACf,IAAyB,EACzB,OAA4D,EAC5D,aAAiC;IAEjC,IAAI,GAAG,GAAc,EAAE,CAAC;IAExB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC;QACjD,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM;YAAE,SAAS;QAC3D,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,2EAA2E;IAC3E,8DAA8D;IAC9D,2EAA2E;IAC3E,kDAAkD;IAClD,GAAG,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/C,GAAG,GAAG,0BAA0B,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;IACtE,GAAG,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAEzC,IAAI,OAAO,CAAC,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,8EAA8E;IAC9E,qEAAqE;IACrE,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;QACxC,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAoB;IAC7C,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAE7B,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;IAC1C,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC;IACnD,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAEvC,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACvE,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEvE,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,eAAe,GAAG,CAAC,CAAC;IAExB,0EAA0E;IAC1E,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACpC,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,yEAAyE;IACzE,6EAA6E;IAC7E,4EAA4E;IAC5E,sEAAsE;IACtE,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,WAAW,GAAmC,SAAS;QAC3D,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,CAAC,CAAC,IAAI,CAAC;IAET,8EAA8E;IAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAElC,+EAA+E;IAC/E,MAAM,QAAQ,GAA0B,OAAO,CAAC,KAAK;QACnD,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;QAC7C,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE;YACtB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,CAAC;IAEP,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QACjC,4EAA4E;QAC5E,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,UAAU,EAAE,CAAC;QAE5C,4DAA4D;QAC5D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,YAAY,IAAI,QAAQ,EAAE,CAAC;YAC7D,MAAM,IAAI,mBAAmB,CAAC,oCAAoC,QAAQ,IAAI,CAAC,CAAC;QAClF,CAAC;QAED,4EAA4E;QAC5E,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACtF,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAEzD,OAAO,CAAC,MAAM,EAAE,CAAC,YAAY,CAAC,CAAC;QAE/B,8EAA8E;QAC9E,6DAA6D;QAC7D,MAAM,QAAQ,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;QAC9C,+EAA+E;QAC/E,6EAA6E;QAC7E,0EAA0E;QAC1E,0BAA0B;QAC1B,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;gBACrC,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,qBAAqB,CAAC;oBAAE,SAAS;YACtE,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU,IAAI,CAAC,CAAC;gBAChB,SAAS;YACX,CAAC;QACH,CAAC;QACD,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,IAAI,CAAC,CAAC,CAAC,iEAAiE;YAClF,SAAS;QACX,CAAC;QAED,yEAAyE;QACzE,8CAA8C;QAC9C,IAAI,CAAC,YAAY,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1F,eAAe,IAAI,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QAED,6EAA6E;QAC7E,4EAA4E;QAC5E,4DAA4D;QAC5D,YAAY,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACzE,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,YAAY,GAAG,QAAQ,EAAE,CAAC;YAC5D,MAAM,IAAI,mBAAmB,CAAC,oCAAoC,QAAQ,IAAI,CAAC,CAAC;QAClF,CAAC;QAED,YAAY,IAAI,CAAC,CAAC;QAClB,IAAI,kBAAkB,CAAC,YAAY,CAAC;YAAE,aAAa,IAAI,CAAC,CAAC;QAEzD,4EAA4E;QAC5E,6EAA6E;QAC7E,IAAI,YAAuB,CAAC;QAC5B,IAAI,KAAK,IAAI,WAAW,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;YAClC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACpC,YAAY;gBACV,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI;oBACtB,CAAC,CAAC,GAAG,CAAC,QAAQ;oBACd,CAAC,CAAC,UAAU,CACR,YAAY,EACZ,OAAO,EACP,IAAI,EACJ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EACpD,OAAO,CAAC,aAAa,CACtB,CAAC;YACR,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QAClE,CAAC;aAAM,CAAC;YACN,YAAY,GAAG,UAAU,CACvB,YAAY,EACZ,OAAO,EACP,IAAI,EACJ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EACpD,OAAO,CAAC,aAAa,CACtB,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;IACjC,CAAC;IAED,6DAA6D;IAC7D,IAAI,SAAS,IAAI,WAAW;QAAE,MAAM,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IAE/E,oDAAoD;IACpD,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAE/B,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;IAE9B,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ;QACR,YAAY;QACZ,aAAa;QACb,WAAW,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE;QAC5C,SAAS;QACT,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;QAClC,UAAU,EAAE,UAAU,CAAC,WAAW,EAAE;QACpC,WAAW,EAAE,OAAO;KACrB,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAwB,EACxB,OAAiD;IAEjD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC;SACpB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACZ,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACzB,IAAI,YAAY,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACpC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAClE,IAAI,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,kFAAkF;AAClF,KAAK,SAAS,CAAC,CAAC,mBAAmB,CAAC,KAAe,EAAE,OAAoB;IACvE,KAAK,MAAM,GAAG,IAAI,sBAAsB,CAAC,KAAK,EAAE,OAAO,CAAC;QAAE,MAAM,GAAG,CAAC;AACtE,CAAC","sourcesContent":["/**\n * Scan orchestrator. Walks the target (or an explicit file list), runs the\n * applicable detectors over each file, parses dependency manifests, aggregates\n * everything into an inventory, and returns a {@link ScanResult} with timing and\n * the tool version.\n *\n * Detector scope (source vs config) is driven by each {@link Detector}'s\n * declared `scope` (defaulting to \"source\"), not by ruleId prefixes. The\n * detector set comes from {@link defaultRegistry} unless overridden via\n * `options.detectors`.\n */\nimport { readFile, stat } from \"node:fs/promises\";\nimport * as path from \"node:path\";\n\nimport type { Detector, Finding, ScanOptions, ScanResult } from \"./types.js\";\nimport {\n  walkFiles,\n  toPosix,\n  isBinaryPath,\n  isKeystorePath,\n  looksMinified,\n  matchesAny,\n  DEFAULT_MAX_FILE_SIZE,\n} from \"./walk.js\";\nimport { isAnalyzableSource } from \"./detect-utils.js\";\nimport {\n  stripCommentFindings,\n  stripIgnoredFindings,\n  stripStringLiteralFindings,\n} from \"./comments.js\";\n\n/**\n * Rules whose token is only meaningful as code, never inside a string literal.\n * A match inside a string (e.g. `t.Error(\"SigningMethodPS256 …\")`) is prose and\n * is dropped. Rules that legitimately match quoted tokens are NOT listed here.\n */\nconst CODE_ONLY_RULES: ReadonlySet<string> = new Set([\n  \"go-jwt-signingmethod\",\n  // Identifier-form JWT alg constants (jjwt `SignatureAlgorithm.RS256`, auth0\n  // `Algorithm.RSA256`, C# `SecurityAlgorithms.*`, Rust `Algorithm::RS256`). Like the\n  // Go rule, these are only meaningful as code; the SAME token inside a string literal\n  // (an error message that names/forbids the alg) is prose, not a usage.\n  \"java-jwt-alg\",\n  \"csharp-jwt-alg\",\n  \"rust-jwt-algorithm\",\n]);\nimport { hashContent, loadCache, rulesetFingerprint, saveCache } from \"./cache.js\";\nimport type { CacheEntry } from \"./cache.js\";\nimport { builtinDetectors, defaultRegistry, detectorScope } from \"./registry.js\";\nimport { isManifestFile, scanManifest } from \"./dependencies.js\";\nimport { buildInventory } from \"./inventory.js\";\nimport { AbortError, BudgetExceededError } from \"./errors.js\";\nimport { VERSION } from \"./version.js\";\n\n/**\n * The full set of built-in detectors exposed on the public API. Re-exported\n * from {@link builtinDetectors} in `registry.ts` — the single source of truth\n * the {@link defaultRegistry} is also built from — so the public array and the\n * registry can never drift apart. The manifest scanner is handled separately\n * (it parses JSON rather than running a Detector).\n */\nexport const detectors: Detector[] = builtinDetectors;\n\n/** Stable comparator: by file, then line, then ruleId. Exported for reuse. */\nexport function compareFindings(a: Finding, b: Finding): number {\n  if (a.location.file !== b.location.file) return a.location.file < b.location.file ? -1 : 1;\n  if (a.location.line !== b.location.line) return a.location.line - b.location.line;\n  return a.ruleId < b.ruleId ? -1 : a.ruleId > b.ruleId ? 1 : 0;\n}\n\n/** Resolve the active detector list for a scan (override or the default registry). */\nfunction resolveDetectors(options: ScanOptions): Detector[] {\n  return options.detectors ?? defaultRegistry.all();\n}\n\n/**\n * Run all applicable detectors + the manifest scanner over a single file's\n * contents, honouring the source / config / dependencies toggles. Pure: no I/O.\n * Exported so the parallel worker and unit tests can drive it directly.\n */\nexport function detectFile(\n  file: string,\n  content: string,\n  dets: readonly Detector[],\n  toggles: { source: boolean; config: boolean; deps: boolean },\n  disabledRules?: readonly string[],\n): Finding[] {\n  let out: Finding[] = [];\n\n  for (const det of dets) {\n    if (!det.appliesTo(file)) continue;\n    const isConfig = detectorScope(det) === \"config\";\n    if (isConfig ? !toggles.config : !toggles.source) continue;\n    out.push(...det.detect({ file, content }));\n  }\n\n  // Drop lexical false positives that land inside comments (`// migrated off\n  // createECDH()`), then honour inline `// qscan-ignore-line` /\n  // `qscan-ignore-next-line` directives. Both run before the dependency scan\n  // appends its findings (manifests carry neither).\n  out = stripCommentFindings(out, content, file);\n  out = stripStringLiteralFindings(out, content, file, CODE_ONLY_RULES);\n  out = stripIgnoredFindings(out, content);\n\n  if (toggles.deps && isManifestFile(file)) {\n    out.push(...scanManifest(file, content));\n  }\n\n  // Per-rule suppression: drop findings whose ruleId was disabled. Applied here\n  // so both the serial scan and the worker path honour it identically.\n  if (disabledRules && disabledRules.length > 0) {\n    const disabled = new Set(disabledRules);\n    return out.filter((f) => !disabled.has(f.ruleId));\n  }\n\n  return out;\n}\n\n/**\n * Recursively scan a directory (or single file, or explicit file list) for\n * classical asymmetric crypto. Honours the source / dependencies / config\n * toggles (all default true) and reports progress through `options.onFile`.\n */\nexport async function scan(options: ScanOptions): Promise<ScanResult> {\n  const startedAt = new Date();\n\n  const doSource = options.source !== false;\n  const doDeps = options.dependencies !== false;\n  const doConfig = options.config !== false;\n  const scanMinified = options.scanMinified === true;\n  const dets = resolveDetectors(options);\n\n  // Resolve whether the root is a file so we can rebuild absolute paths to read.\n  const rootStat = await stat(options.root);\n  const rootIsFile = rootStat.isFile();\n  const baseDir = rootIsFile ? path.dirname(options.root) : options.root;\n  const singleFileName = rootIsFile ? path.basename(options.root) : null;\n\n  const findings: Finding[] = [];\n  let filesScanned = 0;\n  let analyzedFiles = 0;\n  let bytesScanned = 0;\n  let unreadable = 0;\n  let skippedMinified = 0;\n\n  // Optional content-hash scan cache: unchanged files reuse prior findings.\n  const cacheFile = options.cacheFile;\n  const ruleset = cacheFile ? rulesetFingerprint(dets, options.disabledRules) : \"\";\n  const cache = cacheFile ? await loadCache(cacheFile, ruleset) : null;\n  // A full scan starts with an empty next-cache so files that vanished are\n  // evicted. An INCREMENTAL scan (explicit `files` list) only visits a subset,\n  // so seed the next-cache with the existing entries — otherwise saving would\n  // drop every file we didn't happen to scan this run (audit: arch #4).\n  const incremental = Array.isArray(options.files);\n  const nextEntries: Map<string, CacheEntry> | null = cacheFile\n    ? new Map(incremental && cache ? cache : [])\n    : null;\n\n  // Work-budget / cancellation controls (all optional, unlimited when omitted).\n  const signal = options.signal;\n  const maxFiles = options.maxFiles;\n  const maxBytes = options.maxBytes;\n\n  // Source of relative paths: an explicit file list (incremental) or the walker.\n  const relPaths: AsyncIterable<string> = options.files\n    ? filterExplicitFiles(options.files, options)\n    : walkFiles(options.root, {\n        include: options.include,\n        exclude: options.exclude,\n        noDefaultIgnores: options.noDefaultIgnores,\n        maxFileSize: options.maxFileSize,\n      });\n\n  for await (const rel of relPaths) {\n    // Cooperative cancellation: check the signal at the top of every iteration.\n    if (signal?.aborted) throw new AbortError();\n\n    // File-count budget: enforced before reading the next file.\n    if (typeof maxFiles === \"number\" && filesScanned >= maxFiles) {\n      throw new BudgetExceededError(`maxFiles budget exceeded (limit: ${maxFiles}).`);\n    }\n\n    // In single-file mode, walkFiles yields the basename; map back to the file.\n    const absPath = singleFileName ? options.root : path.join(baseDir, ...rel.split(\"/\"));\n    const reportedPath = singleFileName ? toPosix(rel) : rel;\n\n    options.onFile?.(reportedPath);\n\n    // Cryptographic keystores (.jks/.p12/…) are binary; read them byte-preserving\n    // (latin1) so the keystore detector can inspect magic bytes.\n    const keystore = isKeystorePath(reportedPath);\n    // Keystores are read whole into memory as latin1. The walker already caps file\n    // size, but the explicit-file-list (incremental) path does not — so stat and\n    // skip an oversized binary here to avoid reading a huge encrypted archive\n    // (`.gpg`) into a string.\n    if (keystore) {\n      try {\n        const { size } = await stat(absPath);\n        if (size > (options.maxFileSize ?? DEFAULT_MAX_FILE_SIZE)) continue;\n      } catch {\n        unreadable += 1;\n        continue;\n      }\n    }\n    let content: string;\n    try {\n      content = await readFile(absPath, keystore ? \"latin1\" : \"utf8\");\n    } catch {\n      unreadable += 1; // permissions / vanished / decode failure — tracked, not silent.\n      continue;\n    }\n\n    // Skip machine-minified / generated content (unless explicitly enabled).\n    // Manifests and keystores are always scanned.\n    if (!scanMinified && !isManifestFile(reportedPath) && !keystore && looksMinified(content)) {\n      skippedMinified += 1;\n      continue;\n    }\n\n    // Cumulative-byte budget: enforced once this file's bytes are accounted for.\n    // Use the read encoding so a latin1 keystore is counted at its on-disk size\n    // (a utf8 byteLength would double-count every byte ≥ 0x80).\n    bytesScanned += Buffer.byteLength(content, keystore ? \"latin1\" : \"utf8\");\n    if (typeof maxBytes === \"number\" && bytesScanned > maxBytes) {\n      throw new BudgetExceededError(`maxBytes budget exceeded (limit: ${maxBytes}).`);\n    }\n\n    filesScanned += 1;\n    if (isAnalyzableSource(reportedPath)) analyzedFiles += 1;\n\n    // Cache: reuse prior findings when the content hash matches; otherwise scan\n    // and record. `nextEntries` becomes the new cache (dropping vanished files).\n    let fileFindings: Finding[];\n    if (cache && nextEntries) {\n      const hash = hashContent(content);\n      const hit = cache.get(reportedPath);\n      fileFindings =\n        hit && hit.hash === hash\n          ? hit.findings\n          : detectFile(\n              reportedPath,\n              content,\n              dets,\n              { source: doSource, config: doConfig, deps: doDeps },\n              options.disabledRules,\n            );\n      nextEntries.set(reportedPath, { hash, findings: fileFindings });\n    } else {\n      fileFindings = detectFile(\n        reportedPath,\n        content,\n        dets,\n        { source: doSource, config: doConfig, deps: doDeps },\n        options.disabledRules,\n      );\n    }\n    findings.push(...fileFindings);\n  }\n\n  // Persist the cache (best effort) before ordering/returning.\n  if (cacheFile && nextEntries) await saveCache(cacheFile, ruleset, nextEntries);\n\n  // Stable ordering: by file, then line, then ruleId.\n  findings.sort(compareFindings);\n\n  const inventory = buildInventory(findings);\n  const finishedAt = new Date();\n\n  return {\n    root: options.root,\n    findings,\n    filesScanned,\n    analyzedFiles,\n    diagnostics: { unreadable, skippedMinified },\n    inventory,\n    startedAt: startedAt.toISOString(),\n    finishedAt: finishedAt.toISOString(),\n    toolVersion: VERSION,\n  };\n}\n\n/**\n * Filter an explicit relative file list down to the paths that pass the binary\n * filter and the include/exclude patterns, returning them deduped and sorted for\n * deterministic output. Size limits are enforced later (we still read manifests\n * over the cap). Non-existent files are simply skipped at read time.\n *\n * Pure + synchronous, and exported so the parallel enumerator applies the EXACT\n * same filtering for explicit file lists as the serial path (byte-for-byte\n * identical results under `--parallel`).\n */\nexport function filterExplicitFileList(\n  files: readonly string[],\n  options: Pick<ScanOptions, \"include\" | \"exclude\">,\n): string[] {\n  const include = options.include ?? [];\n  const exclude = options.exclude ?? [];\n  const seen = new Set<string>();\n  const list = [...files]\n    .map((f) => toPosix(f))\n    .filter((f) => {\n      if (seen.has(f)) return false;\n      seen.add(f);\n      return true;\n    })\n    .sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));\n\n  return list.filter((rel) => {\n    if (isBinaryPath(rel)) return false;\n    if (include.length > 0 && !matchesAny(rel, include)) return false;\n    if (matchesAny(rel, exclude)) return false;\n    return true;\n  });\n}\n\n/** Async-generator wrapper around {@link filterExplicitFileList} for `scan()`. */\nasync function* filterExplicitFiles(files: string[], options: ScanOptions): AsyncGenerator<string> {\n  for (const rel of filterExplicitFileList(files, options)) yield rel;\n}\n"]}

package/dist/standards-profiles.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Selectable STANDARDS PROFILES — the regime a scan's remediation, deadlines, and
+ * hybrid guidance are tailored to. Different national/regional authorities agree on
+ * the PQC primitives (ML-KEM / ML-DSA) but diverge on two things this tool must not
+ * hardcode: (a) the required PARAMETER SETS (a commercial ML-KEM-768 vs a
+ * national-security ML-KEM-1024), and (b) the HYBRID STANCE — whether classical+PQC
+ * hybridization is required, recommended, or optional during the transition. Baking
+ * in NIST/CNSA's "hybrids optional" is wrong for an ANSSI or BSI audience, where
+ * hybrid is required. `--profile <id>` selects the regime; `--policy` composes an
+ * org's own exceptions on top.
+ *
+ * Like {@link PqcStandards}, every profile carries a citation + `asOf` date and is
+ * re-verified on the quarterly standards cadence. These are guidance summaries, not
+ * legal advice — consult the cited source of record.
+ */
+/** Whether classical+PQC hybridization is required during the transition, per regime. */
+export type HybridStance = "required" | "recommended" | "optional";
+/** A regime's PQC guidance profile. */
+export interface StandardsProfile {
+    /** Stable id used by `--profile` (kebab-case). */
+    readonly id: string;
+    /** Human-readable name. */
+    readonly name: string;
+    /** The authority / document of record. */
+    readonly authority: string;
+    /** The KEM / signature parameter sets this regime calls for. */
+    readonly paramSets: {
+        readonly kem: string;
+        readonly signature: string;
+    };
+    /** Whether hybridization is required / recommended / optional under this regime. */
+    readonly hybridStance: HybridStance;
+    /** One-line regime-specific hybrid guidance surfaced in remediation. */
+    readonly hybridGuidance: string;
+    /** Year after which classical public-key crypto is deprecated under this regime. */
+    readonly deprecateAfter: number;
+    /** Year after which it is disallowed. */
+    readonly disallowAfter: number;
+    /** Spec identifier / publication of record. */
+    readonly citation: string;
+    /** `YYYY-MM` — when this profile was last verified against its source. */
+    readonly asOf: string;
+}
+/** The default profile id when `--profile` is not given. */
+export declare const DEFAULT_PROFILE_ID = "nist";
+/**
+ * Built-in regime profiles. Facts reflect each authority's published PQC-transition
+ * position as of the `asOf` date; verify against the cited source before relying on a
+ * deadline or a hybrid mandate for a compliance decision.
+ */
+export declare const STANDARDS_PROFILES: Readonly<Record<string, StandardsProfile>>;
+/** All built-in profile ids, in a stable order (default first). */
+export declare function standardsProfileIds(): string[];
+/** Look up a built-in profile by id, or `undefined` when unknown. */
+export declare function getStandardsProfile(id: string): StandardsProfile | undefined;
+/** The default profile (NIST). Always defined. */
+export declare function defaultStandardsProfile(): StandardsProfile;
+//# sourceMappingURL=standards-profiles.d.ts.map