@quantakrypto/core 0.4.4 → 0.5.0

package/dist/comments.d.ts

@@ -15,9 +15,7 @@
  * detection benchmark's recall gate.
  */
 import type { Finding } from "./types.js";
-export type CommentStyle = "c" | "hash";
-/** The comment style for a file path, or null when we don't strip comments for it. */
-export declare function commentStyleForFile(file: string): CommentStyle | null;
+type CommentStyle = "c" | "hash";
 /**
  * Compute the comment spans (`[start, end)` offsets) of `content`, skipping over
  * string literals so a comment marker inside a string is not treated as a
@@ -25,26 +23,6 @@ export declare function commentStyleForFile(file: string): CommentStyle | null;
  * makes backtick strings raw (no escapes).
  */
 export declare function commentSpans(content: string, style: CommentStyle, rawBacktick?: boolean): Array<[number, number]>;
-/**
- * Compute Python triple-quoted string spans (`"""…"""` / `'''…'''`). These are
- * docstrings / prose in practice, so a crypto *name* mentioned inside one
- * (`:param key_type: eg "ssh-ed25519"`) should not fire a token finding — but a
- * PEM key pasted into one is still real material, so {@link stripCommentFindings}
- * exempts `pem-*` rules. Comments and normal strings are skipped so a `"""`
- * delimiter inside them is not mis-detected.
- */
-export declare function pythonDocstringSpans(content: string): Array<[number, number]>;
-/** True if `offset` falls inside one of the (sorted, non-overlapping) spans. */
-export declare function offsetInSpans(spans: ReadonlyArray<[number, number]>, offset: number): boolean;
-/**
- * Line numbers (1-based) suppressed by an inline ignore directive:
- *   - `qscan-ignore-line` on a line suppresses findings on THAT line.
- *   - `qscan-ignore-next-line` on a line suppresses findings on the NEXT line.
- * The directive text is matched anywhere on the line (usually in a comment), so
- * it is language-agnostic. `qscan-ignore-line` is not a substring of
- * `qscan-ignore-next-line`, so the two never collide.
- */
-export declare function ignoredLines(content: string): Set<number>;
 /** Drop findings on lines suppressed by an inline `qscan-ignore` directive. */
 export declare function stripIgnoredFindings(findings: Finding[], content: string): Finding[];
 /**
@@ -69,4 +47,5 @@ export declare function stringSpans(content: string, style: CommentStyle, rawBac
  * through untouched.
  */
 export declare function stripStringLiteralFindings(findings: Finding[], content: string, file: string, ruleIds: ReadonlySet<string>): Finding[];
+export {};
 //# sourceMappingURL=comments.d.ts.map

package/dist/comments.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"comments.d.ts","sourceRoot":"","sources":["../src/comments.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1C,MAAM,MAAM,YAAY,GAAG,GAAG,GAAG,MAAM,CAAC;AA8BxC,sFAAsF;AACtF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAKrE;AAyCD;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,YAAY,EACnB,WAAW,UAAQ,GAClB,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAoCzB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAsC7E;AAED,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAW7F;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CASzD;AAED,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,EAAE,CAKpF;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,GACX,OAAO,EAAE,CAyBX;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,YAAY,EACnB,WAAW,UAAQ,GAClB,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAiCzB;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,GAC3B,OAAO,EAAE,CAkBX"}
+{"version":3,"file":"comments.d.ts","sourceRoot":"","sources":["../src/comments.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1C,KAAK,YAAY,GAAG,GAAG,GAAG,MAAM,CAAC;AAgGjC;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,YAAY,EACnB,WAAW,UAAQ,GAClB,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAoCzB;AAmFD,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,EAAE,CAKpF;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,GACX,OAAO,EAAE,CAyBX;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,YAAY,EACnB,WAAW,UAAQ,GAClB,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAiCzB;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,GAC3B,OAAO,EAAE,CAkBX"}

package/dist/comments.js

@@ -21,11 +21,30 @@ const C_LIKE = [
     ".cxx",
     ".hpp",
     ".hh",
+    // PHP and Scala also use C-style `//` + `/* */` comments (PHP additionally uses
+    // `#`, handled by the hash lexer running first would miss `//`; C-style covers both
+    // since PHP `//` is the common form and `#` lines are rare in modern PHP).
+    ".php",
+    ".php3",
+    ".php4",
+    ".php5",
+    ".phtml",
+    ".scala",
+    ".sc",
+    ".swift",
+    // Objective-C (.m/.mm) and Dart (.dart) both use C-style `//` + `/* */`.
+    ".m",
+    ".mm",
+    ".dart",
+    // Smart-contract languages (Solidity/Move/Cairo) also use C-style comments.
+    ".sol",
+    ".move",
+    ".cairo",
 ];
 /** Hash-style (`#`) comment languages, by extension. */
-const HASH_LIKE = [".py", ".pyi", ".pyw", ".rb"];
+const HASH_LIKE = [".py", ".pyi", ".pyw", ".rb", ".ex", ".exs"];
 /** The comment style for a file path, or null when we don't strip comments for it. */
-export function commentStyleForFile(file) {
+function commentStyleForFile(file) {
     const lower = file.toLowerCase();
     if (C_LIKE.some((e) => lower.endsWith(e)))
         return "c";
@@ -127,7 +146,7 @@ export function commentSpans(content, style, rawBacktick = false) {
  * exempts `pem-*` rules. Comments and normal strings are skipped so a `"""`
  * delimiter inside them is not mis-detected.
  */
-export function pythonDocstringSpans(content) {
+function pythonDocstringSpans(content) {
     const spans = [];
     const n = content.length;
     let i = 0;
@@ -169,7 +188,7 @@ export function pythonDocstringSpans(content) {
     return spans;
 }
 /** True if `offset` falls inside one of the (sorted, non-overlapping) spans. */
-export function offsetInSpans(spans, offset) {
+function offsetInSpans(spans, offset) {
     let lo = 0;
     let hi = spans.length - 1;
     while (lo <= hi) {
@@ -192,7 +211,7 @@ export function offsetInSpans(spans, offset) {
  * it is language-agnostic. `qscan-ignore-line` is not a substring of
  * `qscan-ignore-next-line`, so the two never collide.
  */
-export function ignoredLines(content) {
+function ignoredLines(content) {
     const ignored = new Set();
     const lines = content.split("\n");
     for (let i = 0; i < lines.length; i++) {

package/dist/comments.js.map

@@ -1 +1 @@
-{"version":3,"file":"comments.js","sourceRoot":"","sources":["../src/comments.ts"],"names":[],"mappings":"AAoBA,8DAA8D;AAC9D,MAAM,MAAM,GAAsB;IAChC,KAAK;IACL,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,SAAS;IACT,KAAK;IACL,OAAO;IACP,KAAK;IACL,MAAM;IACN,KAAK;IACL,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;CACN,CAAC;AAEF,wDAAwD;AACxD,MAAM,SAAS,GAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAEpE,sFAAsF;AACtF,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC;IACtD,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IAC5D,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,UAAU,CAAC,OAAe,EAAE,CAAS,EAAE,CAAS,EAAE,WAAoB;IAC7E,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,GAAG,KAAK,EAAE,CAAC;YACjB,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACxB,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YACrC,CAAC,EAAE,CAAC;QACN,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,oDAAoD;IACpE,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,KAAK,GAAG,IAAI,WAAW,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACnC,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAe,EACf,KAAmB,EACnB,WAAW,GAAG,KAAK;IAEnB,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,uFAAuF;QACvF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;YAC3C,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACzD,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACzD,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;gBAAE,CAAC,EAAE,CAAC;YACrE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7E,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;gBAAE,CAAC,EAAE,CAAC;YACzF,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACb,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBACxB,CAAC,IAAI,CAAC,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;oBACrB,CAAC,EAAE,CAAC;oBACJ,MAAM;gBACR,CAAC;gBACD,CAAC,EAAE,CAAC;YACN,CAAC;YACD,SAAS;QACX,CAAC;QACD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,aAAa,CAAC,KAAsC,EAAE,MAAc;IAClF,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,EAAE,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,MAAM,GAAG,CAAC;YAAE,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;aACxB,IAAI,MAAM,IAAI,CAAC;YAAE,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;;YAC9B,OAAO,IAAI,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;aAC3D,IAAI,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,QAAmB,EAAE,OAAe;IACvE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChF,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACxC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAmB,EACnB,OAAe,EACf,IAAY;IAEZ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC3C,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5B,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEjE,+EAA+E;IAC/E,wEAAwE;IACxE,MAAM,UAAU,GAAa,CAAC,CAAC,CAAC,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,IAAI,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;YAC3F,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CACzB,OAAe,EACf,KAAmB,EACnB,WAAW,GAAG,KAAK;IAEnB,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACzD,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACzD,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;gBAAE,CAAC,EAAE,CAAC;YACrE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAClC,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;YACnD,wEAAwE;YACxE,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,GAAG,KAAK,GAAG,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;YAC3D,CAAC,GAAG,GAAG,CAAC;YACR,SAAS;QACX,CAAC;QACD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAAmB,EACnB,OAAe,EACf,IAAY,EACZ,OAA4B;IAE5B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC3F,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5B,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAExC,MAAM,UAAU,GAAa,CAAC,CAAC,CAAC,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Comment-aware false-positive suppression.\n *\n * The detectors are lexical (regex over source text), so a crypto API name\n * written in a COMMENT — `// migrated off createECDH()` — fires a finding just\n * like real code. This module computes the comment spans of a file (respecting\n * string literals, so a `//` inside a string is not a comment) and drops any\n * finding whose match starts inside one.\n *\n * The lexer is deliberately conservative: it only ever ENTERS a comment on a\n * literal line comment, block comment, or `#` in code position (all of which ARE\n * comments), so it never mis-classifies code as a comment and can only reduce\n * false positives, not recall. The one inherent lexical ambiguity — a regex\n * literal that looks like a block-comment open — is rare and guarded by the\n * detection benchmark's recall gate.\n */\nimport type { Finding } from \"./types.js\";\n\nexport type CommentStyle = \"c\" | \"hash\";\n\n/** C-style (line + block) comment languages, by extension. */\nconst C_LIKE: readonly string[] = [\n  \".js\",\n  \".jsx\",\n  \".ts\",\n  \".tsx\",\n  \".mjs\",\n  \".cjs\",\n  \".vue\",\n  \".svelte\",\n  \".go\",\n  \".java\",\n  \".kt\",\n  \".kts\",\n  \".cs\",\n  \".rs\",\n  \".c\",\n  \".h\",\n  \".cc\",\n  \".cpp\",\n  \".cxx\",\n  \".hpp\",\n  \".hh\",\n];\n\n/** Hash-style (`#`) comment languages, by extension. */\nconst HASH_LIKE: readonly string[] = [\".py\", \".pyi\", \".pyw\", \".rb\"];\n\n/** The comment style for a file path, or null when we don't strip comments for it. */\nexport function commentStyleForFile(file: string): CommentStyle | null {\n  const lower = file.toLowerCase();\n  if (C_LIKE.some((e) => lower.endsWith(e))) return \"c\";\n  if (HASH_LIKE.some((e) => lower.endsWith(e))) return \"hash\";\n  return null;\n}\n\n/**\n * Advance past a string / char literal starting at `content[i]` (a quote char);\n * returns the index just after it. Two correctness rules a naive escape-scan got\n * wrong (both verified as real bugs):\n *   - a `'` char literal must close within a short window (`'\\u{10FFFF}'` is ~11\n *     chars); otherwise it is a Rust lifetime (`'a`) or a stray apostrophe, NOT a\n *     literal — return `i + 1` so the scan continues instead of consuming the\n *     rest of the file.\n *   - Go raw strings (backtick, when `rawBacktick`) do NOT process escapes, so a\n *     trailing backslash (`` `C:\\` ``) must not swallow the closing delimiter.\n */\nfunction skipQuoted(content: string, i: number, n: number, rawBacktick: boolean): number {\n  const quote = content[i];\n  if (quote === \"'\") {\n    const limit = Math.min(n, i + 1 + 12);\n    let j = i + 1;\n    while (j < limit) {\n      if (content[j] === \"\\\\\") {\n        j += 2;\n        continue;\n      }\n      if (content[j] === \"'\") return j + 1;\n      j++;\n    }\n    return i + 1; // a lifetime / stray apostrophe, not a char literal\n  }\n  const escapes = !(quote === \"`\" && rawBacktick);\n  let j = i + 1;\n  while (j < n) {\n    if (escapes && content[j] === \"\\\\\") {\n      j += 2;\n      continue;\n    }\n    if (content[j] === quote) return j + 1;\n    j++;\n  }\n  return n;\n}\n\n/**\n * Compute the comment spans (`[start, end)` offsets) of `content`, skipping over\n * string literals so a comment marker inside a string is not treated as a\n * comment. Spans are returned sorted and non-overlapping. `rawBacktick` (Go)\n * makes backtick strings raw (no escapes).\n */\nexport function commentSpans(\n  content: string,\n  style: CommentStyle,\n  rawBacktick = false,\n): Array<[number, number]> {\n  const spans: Array<[number, number]> = [];\n  const n = content.length;\n  let i = 0;\n  while (i < n) {\n    const c = content[i];\n    // String / char literal: skip past it (lexically correct for lifetimes + raw strings).\n    if (c === '\"' || c === \"'\" || c === \"`\") {\n      i = skipQuoted(content, i, n, rawBacktick);\n      continue;\n    }\n    if (style === \"c\" && c === \"/\" && content[i + 1] === \"/\") {\n      const start = i;\n      i += 2;\n      while (i < n && content[i] !== \"\\n\") i++;\n      spans.push([start, i]);\n      continue;\n    }\n    if (style === \"c\" && c === \"/\" && content[i + 1] === \"*\") {\n      const start = i;\n      i += 2;\n      while (i < n && !(content[i] === \"*\" && content[i + 1] === \"/\")) i++;\n      i = Math.min(n, i + 2);\n      spans.push([start, i]);\n      continue;\n    }\n    if (style === \"hash\" && c === \"#\") {\n      const start = i;\n      i++;\n      while (i < n && content[i] !== \"\\n\") i++;\n      spans.push([start, i]);\n      continue;\n    }\n    i++;\n  }\n  return spans;\n}\n\n/**\n * Compute Python triple-quoted string spans (`\"\"\"…\"\"\"` / `'''…'''`). These are\n * docstrings / prose in practice, so a crypto *name* mentioned inside one\n * (`:param key_type: eg \"ssh-ed25519\"`) should not fire a token finding — but a\n * PEM key pasted into one is still real material, so {@link stripCommentFindings}\n * exempts `pem-*` rules. Comments and normal strings are skipped so a `\"\"\"`\n * delimiter inside them is not mis-detected.\n */\nexport function pythonDocstringSpans(content: string): Array<[number, number]> {\n  const spans: Array<[number, number]> = [];\n  const n = content.length;\n  let i = 0;\n  while (i < n) {\n    const c = content[i];\n    if (c === \"#\") {\n      i++;\n      while (i < n && content[i] !== \"\\n\") i++;\n      continue;\n    }\n    if ((c === '\"' || c === \"'\") && content[i + 1] === c && content[i + 2] === c) {\n      const start = i;\n      i += 3;\n      while (i < n && !(content[i] === c && content[i + 1] === c && content[i + 2] === c)) i++;\n      i = Math.min(n, i + 3);\n      spans.push([start, i]);\n      continue;\n    }\n    if (c === '\"' || c === \"'\") {\n      const q = c;\n      i++;\n      while (i < n) {\n        if (content[i] === \"\\\\\") {\n          i += 2;\n          continue;\n        }\n        if (content[i] === q) {\n          i++;\n          break;\n        }\n        i++;\n      }\n      continue;\n    }\n    i++;\n  }\n  return spans;\n}\n\n/** True if `offset` falls inside one of the (sorted, non-overlapping) spans. */\nexport function offsetInSpans(spans: ReadonlyArray<[number, number]>, offset: number): boolean {\n  let lo = 0;\n  let hi = spans.length - 1;\n  while (lo <= hi) {\n    const mid = (lo + hi) >>> 1;\n    const [s, e] = spans[mid];\n    if (offset < s) hi = mid - 1;\n    else if (offset >= e) lo = mid + 1;\n    else return true;\n  }\n  return false;\n}\n\n/**\n * Line numbers (1-based) suppressed by an inline ignore directive:\n *   - `qscan-ignore-line` on a line suppresses findings on THAT line.\n *   - `qscan-ignore-next-line` on a line suppresses findings on the NEXT line.\n * The directive text is matched anywhere on the line (usually in a comment), so\n * it is language-agnostic. `qscan-ignore-line` is not a substring of\n * `qscan-ignore-next-line`, so the two never collide.\n */\nexport function ignoredLines(content: string): Set<number> {\n  const ignored = new Set<number>();\n  const lines = content.split(\"\\n\");\n  for (let i = 0; i < lines.length; i++) {\n    const line = lines[i];\n    if (line.includes(\"qscan-ignore-next-line\")) ignored.add(i + 2);\n    else if (line.includes(\"qscan-ignore-line\")) ignored.add(i + 1);\n  }\n  return ignored;\n}\n\n/** Drop findings on lines suppressed by an inline `qscan-ignore` directive. */\nexport function stripIgnoredFindings(findings: Finding[], content: string): Finding[] {\n  if (findings.length === 0 || !content.includes(\"qscan-ignore\")) return findings;\n  const ignored = ignoredLines(content);\n  if (ignored.size === 0) return findings;\n  return findings.filter((f) => !ignored.has(f.location.line));\n}\n\n/**\n * Drop findings whose match starts inside a comment. No-op when the file's\n * language has no comment style we handle, or when it has no comments.\n */\nexport function stripCommentFindings(\n  findings: Finding[],\n  content: string,\n  file: string,\n): Finding[] {\n  if (findings.length === 0) return findings;\n  const style = commentStyleForFile(file);\n  if (!style) return findings;\n  const spans = commentSpans(content, style, /\\.go$/i.test(file));\n  // Python docstrings suppress prose *token* rules but keep real PEM material.\n  const docSpans = style === \"hash\" ? pythonDocstringSpans(content) : [];\n  if (spans.length === 0 && docSpans.length === 0) return findings;\n\n  // 1-based line → start offset, to turn a finding's (line, column) back into an\n  // absolute offset (column is 1-based: offset = lineStart + column - 1).\n  const lineStarts: number[] = [0];\n  for (let i = 0; i < content.length; i++) {\n    if (content[i] === \"\\n\") lineStarts.push(i + 1);\n  }\n\n  return findings.filter((f) => {\n    const start = lineStarts[f.location.line - 1] ?? 0;\n    const offset = start + ((f.location.column ?? 1) - 1);\n    if (offsetInSpans(spans, offset)) return false;\n    if (docSpans.length > 0 && !f.ruleId.startsWith(\"pem-\") && offsetInSpans(docSpans, offset)) {\n      return false;\n    }\n    return true;\n  });\n}\n\n/**\n * Compute the string-literal spans (`[start, end)`) of `content`, skipping over\n * comments so a quote inside a comment is not treated as a string. Used to\n * suppress findings from IDENTIFIER-only rules (e.g. a Go `SigningMethodRS256`\n * mentioned inside an error-message string) — the mirror of {@link commentSpans}.\n */\nexport function stringSpans(\n  content: string,\n  style: CommentStyle,\n  rawBacktick = false,\n): Array<[number, number]> {\n  const spans: Array<[number, number]> = [];\n  const n = content.length;\n  let i = 0;\n  while (i < n) {\n    const c = content[i];\n    if (style === \"c\" && c === \"/\" && content[i + 1] === \"/\") {\n      i += 2;\n      while (i < n && content[i] !== \"\\n\") i++;\n      continue;\n    }\n    if (style === \"c\" && c === \"/\" && content[i + 1] === \"*\") {\n      i += 2;\n      while (i < n && !(content[i] === \"*\" && content[i + 1] === \"/\")) i++;\n      i = Math.min(n, i + 2);\n      continue;\n    }\n    if (style === \"hash\" && c === \"#\") {\n      i++;\n      while (i < n && content[i] !== \"\\n\") i++;\n      continue;\n    }\n    if (c === '\"' || c === \"'\" || c === \"`\") {\n      const start = i;\n      const end = skipQuoted(content, i, n, rawBacktick);\n      // A lone `'` (Rust lifetime, end === start+1) is not a string; skip it.\n      if (c !== \"'\" || end > start + 1) spans.push([start, end]);\n      i = end;\n      continue;\n    }\n    i++;\n  }\n  return spans;\n}\n\n/**\n * Drop findings of \"code-only\" rules (`ruleIds`) whose match starts inside a\n * string literal. Some rules — an identifier-form JWT signing method, a Go\n * `SigningMethodRS256` — are only meaningful as code; when the same token appears\n * inside a string (a test's `t.Error(\"SigningMethodPS256 …\")`) it is prose, not a\n * usage. Rules that legitimately match inside strings (quoted `\"RS256\"` alg\n * tokens, cipher-suite strings, ssh-key tokens) are NOT in `ruleIds` and pass\n * through untouched.\n */\nexport function stripStringLiteralFindings(\n  findings: Finding[],\n  content: string,\n  file: string,\n  ruleIds: ReadonlySet<string>,\n): Finding[] {\n  if (findings.length === 0 || !findings.some((f) => ruleIds.has(f.ruleId))) return findings;\n  const style = commentStyleForFile(file);\n  if (!style) return findings;\n  const spans = stringSpans(content, style, /\\.go$/i.test(file));\n  if (spans.length === 0) return findings;\n\n  const lineStarts: number[] = [0];\n  for (let i = 0; i < content.length; i++) {\n    if (content[i] === \"\\n\") lineStarts.push(i + 1);\n  }\n\n  return findings.filter((f) => {\n    if (!ruleIds.has(f.ruleId)) return true;\n    const start = lineStarts[f.location.line - 1] ?? 0;\n    const offset = start + ((f.location.column ?? 1) - 1);\n    return !offsetInSpans(spans, offset);\n  });\n}\n"]}
+{"version":3,"file":"comments.js","sourceRoot":"","sources":["../src/comments.ts"],"names":[],"mappings":"AAoBA,8DAA8D;AAC9D,MAAM,MAAM,GAAsB;IAChC,KAAK;IACL,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,SAAS;IACT,KAAK;IACL,OAAO;IACP,KAAK;IACL,MAAM;IACN,KAAK;IACL,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,gFAAgF;IAChF,oFAAoF;IACpF,2EAA2E;IAC3E,MAAM;IACN,OAAO;IACP,OAAO;IACP,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,KAAK;IACL,QAAQ;IACR,yEAAyE;IACzE,IAAI;IACJ,KAAK;IACL,OAAO;IACP,4EAA4E;IAC5E,MAAM;IACN,OAAO;IACP,QAAQ;CACT,CAAC;AAEF,wDAAwD;AACxD,MAAM,SAAS,GAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAEnF,sFAAsF;AACtF,SAAS,mBAAmB,CAAC,IAAY;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC;IACtD,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IAC5D,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,UAAU,CAAC,OAAe,EAAE,CAAS,EAAE,CAAS,EAAE,WAAoB;IAC7E,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,GAAG,KAAK,EAAE,CAAC;YACjB,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACxB,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YACrC,CAAC,EAAE,CAAC;QACN,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,oDAAoD;IACpE,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,KAAK,GAAG,IAAI,WAAW,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACnC,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAe,EACf,KAAmB,EACnB,WAAW,GAAG,KAAK;IAEnB,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,uFAAuF;QACvF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;YAC3C,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACzD,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACzD,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;gBAAE,CAAC,EAAE,CAAC;YACrE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,OAAe;IAC3C,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7E,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;gBAAE,CAAC,EAAE,CAAC;YACzF,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACb,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBACxB,CAAC,IAAI,CAAC,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;oBACrB,CAAC,EAAE,CAAC;oBACJ,MAAM;gBACR,CAAC;gBACD,CAAC,EAAE,CAAC;YACN,CAAC;YACD,SAAS;QACX,CAAC;QACD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAChF,SAAS,aAAa,CAAC,KAAsC,EAAE,MAAc;IAC3E,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,EAAE,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,MAAM,GAAG,CAAC;YAAE,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;aACxB,IAAI,MAAM,IAAI,CAAC;YAAE,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;;YAC9B,OAAO,IAAI,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;aAC3D,IAAI,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,QAAmB,EAAE,OAAe;IACvE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChF,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACxC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAmB,EACnB,OAAe,EACf,IAAY;IAEZ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC3C,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5B,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEjE,+EAA+E;IAC/E,wEAAwE;IACxE,MAAM,UAAU,GAAa,CAAC,CAAC,CAAC,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,IAAI,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;YAC3F,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CACzB,OAAe,EACf,KAAmB,EACnB,WAAW,GAAG,KAAK;IAEnB,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACzD,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACzD,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;gBAAE,CAAC,EAAE,CAAC;YACrE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAClC,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;YACnD,wEAAwE;YACxE,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,GAAG,KAAK,GAAG,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;YAC3D,CAAC,GAAG,GAAG,CAAC;YACR,SAAS;QACX,CAAC;QACD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAAmB,EACnB,OAAe,EACf,IAAY,EACZ,OAA4B;IAE5B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC3F,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5B,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAExC,MAAM,UAAU,GAAa,CAAC,CAAC,CAAC,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Comment-aware false-positive suppression.\n *\n * The detectors are lexical (regex over source text), so a crypto API name\n * written in a COMMENT — `// migrated off createECDH()` — fires a finding just\n * like real code. This module computes the comment spans of a file (respecting\n * string literals, so a `//` inside a string is not a comment) and drops any\n * finding whose match starts inside one.\n *\n * The lexer is deliberately conservative: it only ever ENTERS a comment on a\n * literal line comment, block comment, or `#` in code position (all of which ARE\n * comments), so it never mis-classifies code as a comment and can only reduce\n * false positives, not recall. The one inherent lexical ambiguity — a regex\n * literal that looks like a block-comment open — is rare and guarded by the\n * detection benchmark's recall gate.\n */\nimport type { Finding } from \"./types.js\";\n\ntype CommentStyle = \"c\" | \"hash\";\n\n/** C-style (line + block) comment languages, by extension. */\nconst C_LIKE: readonly string[] = [\n  \".js\",\n  \".jsx\",\n  \".ts\",\n  \".tsx\",\n  \".mjs\",\n  \".cjs\",\n  \".vue\",\n  \".svelte\",\n  \".go\",\n  \".java\",\n  \".kt\",\n  \".kts\",\n  \".cs\",\n  \".rs\",\n  \".c\",\n  \".h\",\n  \".cc\",\n  \".cpp\",\n  \".cxx\",\n  \".hpp\",\n  \".hh\",\n  // PHP and Scala also use C-style `//` + `/* */` comments (PHP additionally uses\n  // `#`, handled by the hash lexer running first would miss `//`; C-style covers both\n  // since PHP `//` is the common form and `#` lines are rare in modern PHP).\n  \".php\",\n  \".php3\",\n  \".php4\",\n  \".php5\",\n  \".phtml\",\n  \".scala\",\n  \".sc\",\n  \".swift\",\n  // Objective-C (.m/.mm) and Dart (.dart) both use C-style `//` + `/* */`.\n  \".m\",\n  \".mm\",\n  \".dart\",\n  // Smart-contract languages (Solidity/Move/Cairo) also use C-style comments.\n  \".sol\",\n  \".move\",\n  \".cairo\",\n];\n\n/** Hash-style (`#`) comment languages, by extension. */\nconst HASH_LIKE: readonly string[] = [\".py\", \".pyi\", \".pyw\", \".rb\", \".ex\", \".exs\"];\n\n/** The comment style for a file path, or null when we don't strip comments for it. */\nfunction commentStyleForFile(file: string): CommentStyle | null {\n  const lower = file.toLowerCase();\n  if (C_LIKE.some((e) => lower.endsWith(e))) return \"c\";\n  if (HASH_LIKE.some((e) => lower.endsWith(e))) return \"hash\";\n  return null;\n}\n\n/**\n * Advance past a string / char literal starting at `content[i]` (a quote char);\n * returns the index just after it. Two correctness rules a naive escape-scan got\n * wrong (both verified as real bugs):\n *   - a `'` char literal must close within a short window (`'\\u{10FFFF}'` is ~11\n *     chars); otherwise it is a Rust lifetime (`'a`) or a stray apostrophe, NOT a\n *     literal — return `i + 1` so the scan continues instead of consuming the\n *     rest of the file.\n *   - Go raw strings (backtick, when `rawBacktick`) do NOT process escapes, so a\n *     trailing backslash (`` `C:\\` ``) must not swallow the closing delimiter.\n */\nfunction skipQuoted(content: string, i: number, n: number, rawBacktick: boolean): number {\n  const quote = content[i];\n  if (quote === \"'\") {\n    const limit = Math.min(n, i + 1 + 12);\n    let j = i + 1;\n    while (j < limit) {\n      if (content[j] === \"\\\\\") {\n        j += 2;\n        continue;\n      }\n      if (content[j] === \"'\") return j + 1;\n      j++;\n    }\n    return i + 1; // a lifetime / stray apostrophe, not a char literal\n  }\n  const escapes = !(quote === \"`\" && rawBacktick);\n  let j = i + 1;\n  while (j < n) {\n    if (escapes && content[j] === \"\\\\\") {\n      j += 2;\n      continue;\n    }\n    if (content[j] === quote) return j + 1;\n    j++;\n  }\n  return n;\n}\n\n/**\n * Compute the comment spans (`[start, end)` offsets) of `content`, skipping over\n * string literals so a comment marker inside a string is not treated as a\n * comment. Spans are returned sorted and non-overlapping. `rawBacktick` (Go)\n * makes backtick strings raw (no escapes).\n */\nexport function commentSpans(\n  content: string,\n  style: CommentStyle,\n  rawBacktick = false,\n): Array<[number, number]> {\n  const spans: Array<[number, number]> = [];\n  const n = content.length;\n  let i = 0;\n  while (i < n) {\n    const c = content[i];\n    // String / char literal: skip past it (lexically correct for lifetimes + raw strings).\n    if (c === '\"' || c === \"'\" || c === \"`\") {\n      i = skipQuoted(content, i, n, rawBacktick);\n      continue;\n    }\n    if (style === \"c\" && c === \"/\" && content[i + 1] === \"/\") {\n      const start = i;\n      i += 2;\n      while (i < n && content[i] !== \"\\n\") i++;\n      spans.push([start, i]);\n      continue;\n    }\n    if (style === \"c\" && c === \"/\" && content[i + 1] === \"*\") {\n      const start = i;\n      i += 2;\n      while (i < n && !(content[i] === \"*\" && content[i + 1] === \"/\")) i++;\n      i = Math.min(n, i + 2);\n      spans.push([start, i]);\n      continue;\n    }\n    if (style === \"hash\" && c === \"#\") {\n      const start = i;\n      i++;\n      while (i < n && content[i] !== \"\\n\") i++;\n      spans.push([start, i]);\n      continue;\n    }\n    i++;\n  }\n  return spans;\n}\n\n/**\n * Compute Python triple-quoted string spans (`\"\"\"…\"\"\"` / `'''…'''`). These are\n * docstrings / prose in practice, so a crypto *name* mentioned inside one\n * (`:param key_type: eg \"ssh-ed25519\"`) should not fire a token finding — but a\n * PEM key pasted into one is still real material, so {@link stripCommentFindings}\n * exempts `pem-*` rules. Comments and normal strings are skipped so a `\"\"\"`\n * delimiter inside them is not mis-detected.\n */\nfunction pythonDocstringSpans(content: string): Array<[number, number]> {\n  const spans: Array<[number, number]> = [];\n  const n = content.length;\n  let i = 0;\n  while (i < n) {\n    const c = content[i];\n    if (c === \"#\") {\n      i++;\n      while (i < n && content[i] !== \"\\n\") i++;\n      continue;\n    }\n    if ((c === '\"' || c === \"'\") && content[i + 1] === c && content[i + 2] === c) {\n      const start = i;\n      i += 3;\n      while (i < n && !(content[i] === c && content[i + 1] === c && content[i + 2] === c)) i++;\n      i = Math.min(n, i + 3);\n      spans.push([start, i]);\n      continue;\n    }\n    if (c === '\"' || c === \"'\") {\n      const q = c;\n      i++;\n      while (i < n) {\n        if (content[i] === \"\\\\\") {\n          i += 2;\n          continue;\n        }\n        if (content[i] === q) {\n          i++;\n          break;\n        }\n        i++;\n      }\n      continue;\n    }\n    i++;\n  }\n  return spans;\n}\n\n/** True if `offset` falls inside one of the (sorted, non-overlapping) spans. */\nfunction offsetInSpans(spans: ReadonlyArray<[number, number]>, offset: number): boolean {\n  let lo = 0;\n  let hi = spans.length - 1;\n  while (lo <= hi) {\n    const mid = (lo + hi) >>> 1;\n    const [s, e] = spans[mid];\n    if (offset < s) hi = mid - 1;\n    else if (offset >= e) lo = mid + 1;\n    else return true;\n  }\n  return false;\n}\n\n/**\n * Line numbers (1-based) suppressed by an inline ignore directive:\n *   - `qscan-ignore-line` on a line suppresses findings on THAT line.\n *   - `qscan-ignore-next-line` on a line suppresses findings on the NEXT line.\n * The directive text is matched anywhere on the line (usually in a comment), so\n * it is language-agnostic. `qscan-ignore-line` is not a substring of\n * `qscan-ignore-next-line`, so the two never collide.\n */\nfunction ignoredLines(content: string): Set<number> {\n  const ignored = new Set<number>();\n  const lines = content.split(\"\\n\");\n  for (let i = 0; i < lines.length; i++) {\n    const line = lines[i];\n    if (line.includes(\"qscan-ignore-next-line\")) ignored.add(i + 2);\n    else if (line.includes(\"qscan-ignore-line\")) ignored.add(i + 1);\n  }\n  return ignored;\n}\n\n/** Drop findings on lines suppressed by an inline `qscan-ignore` directive. */\nexport function stripIgnoredFindings(findings: Finding[], content: string): Finding[] {\n  if (findings.length === 0 || !content.includes(\"qscan-ignore\")) return findings;\n  const ignored = ignoredLines(content);\n  if (ignored.size === 0) return findings;\n  return findings.filter((f) => !ignored.has(f.location.line));\n}\n\n/**\n * Drop findings whose match starts inside a comment. No-op when the file's\n * language has no comment style we handle, or when it has no comments.\n */\nexport function stripCommentFindings(\n  findings: Finding[],\n  content: string,\n  file: string,\n): Finding[] {\n  if (findings.length === 0) return findings;\n  const style = commentStyleForFile(file);\n  if (!style) return findings;\n  const spans = commentSpans(content, style, /\\.go$/i.test(file));\n  // Python docstrings suppress prose *token* rules but keep real PEM material.\n  const docSpans = style === \"hash\" ? pythonDocstringSpans(content) : [];\n  if (spans.length === 0 && docSpans.length === 0) return findings;\n\n  // 1-based line → start offset, to turn a finding's (line, column) back into an\n  // absolute offset (column is 1-based: offset = lineStart + column - 1).\n  const lineStarts: number[] = [0];\n  for (let i = 0; i < content.length; i++) {\n    if (content[i] === \"\\n\") lineStarts.push(i + 1);\n  }\n\n  return findings.filter((f) => {\n    const start = lineStarts[f.location.line - 1] ?? 0;\n    const offset = start + ((f.location.column ?? 1) - 1);\n    if (offsetInSpans(spans, offset)) return false;\n    if (docSpans.length > 0 && !f.ruleId.startsWith(\"pem-\") && offsetInSpans(docSpans, offset)) {\n      return false;\n    }\n    return true;\n  });\n}\n\n/**\n * Compute the string-literal spans (`[start, end)`) of `content`, skipping over\n * comments so a quote inside a comment is not treated as a string. Used to\n * suppress findings from IDENTIFIER-only rules (e.g. a Go `SigningMethodRS256`\n * mentioned inside an error-message string) — the mirror of {@link commentSpans}.\n */\nexport function stringSpans(\n  content: string,\n  style: CommentStyle,\n  rawBacktick = false,\n): Array<[number, number]> {\n  const spans: Array<[number, number]> = [];\n  const n = content.length;\n  let i = 0;\n  while (i < n) {\n    const c = content[i];\n    if (style === \"c\" && c === \"/\" && content[i + 1] === \"/\") {\n      i += 2;\n      while (i < n && content[i] !== \"\\n\") i++;\n      continue;\n    }\n    if (style === \"c\" && c === \"/\" && content[i + 1] === \"*\") {\n      i += 2;\n      while (i < n && !(content[i] === \"*\" && content[i + 1] === \"/\")) i++;\n      i = Math.min(n, i + 2);\n      continue;\n    }\n    if (style === \"hash\" && c === \"#\") {\n      i++;\n      while (i < n && content[i] !== \"\\n\") i++;\n      continue;\n    }\n    if (c === '\"' || c === \"'\" || c === \"`\") {\n      const start = i;\n      const end = skipQuoted(content, i, n, rawBacktick);\n      // A lone `'` (Rust lifetime, end === start+1) is not a string; skip it.\n      if (c !== \"'\" || end > start + 1) spans.push([start, end]);\n      i = end;\n      continue;\n    }\n    i++;\n  }\n  return spans;\n}\n\n/**\n * Drop findings of \"code-only\" rules (`ruleIds`) whose match starts inside a\n * string literal. Some rules — an identifier-form JWT signing method, a Go\n * `SigningMethodRS256` — are only meaningful as code; when the same token appears\n * inside a string (a test's `t.Error(\"SigningMethodPS256 …\")`) it is prose, not a\n * usage. Rules that legitimately match inside strings (quoted `\"RS256\"` alg\n * tokens, cipher-suite strings, ssh-key tokens) are NOT in `ruleIds` and pass\n * through untouched.\n */\nexport function stripStringLiteralFindings(\n  findings: Finding[],\n  content: string,\n  file: string,\n  ruleIds: ReadonlySet<string>,\n): Finding[] {\n  if (findings.length === 0 || !findings.some((f) => ruleIds.has(f.ruleId))) return findings;\n  const style = commentStyleForFile(file);\n  if (!style) return findings;\n  const spans = stringSpans(content, style, /\\.go$/i.test(file));\n  if (spans.length === 0) return findings;\n\n  const lineStarts: number[] = [0];\n  for (let i = 0; i < content.length; i++) {\n    if (content[i] === \"\\n\") lineStarts.push(i + 1);\n  }\n\n  return findings.filter((f) => {\n    if (!ruleIds.has(f.ruleId)) return true;\n    const start = lineStarts[f.location.line - 1] ?? 0;\n    const offset = start + ((f.location.column ?? 1) - 1);\n    return !offsetInSpans(spans, offset);\n  });\n}\n"]}

package/dist/detect-utils.d.ts

@@ -4,21 +4,8 @@
  * small factory for building Finding objects with consistent remediation text.
  */
 import type { AlgorithmFamily, Confidence, Finding, FindingCategory, RuleMeta, Severity } from "./types.js";
-/** A 1-based line/column position derived from a character offset. */
-export interface LineCol {
-    line: number;
-    column: number;
-}
-/**
- * Convert a 0-based character offset within `content` into a 1-based
- * line/column. Newlines are LF; CR is treated as an ordinary character, so on
- * CRLF files the column includes the trailing CR offset harmlessly.
- */
-export declare function offsetToLineCol(content: string, offset: number): LineCol;
-/** Extract the (trimmed) single source line containing `offset`. */
-export declare function lineAt(content: string, offset: number): string;
 /** Inputs for {@link makeFinding}. */
-export interface FindingSpec {
+interface FindingSpec {
     ruleId: string;
     title: string;
     category: FindingCategory;
@@ -47,7 +34,7 @@ export interface FindingSpec {
  */
 export declare function makeFinding(spec: FindingSpec): Finding;
 /** Where a match occurred, plus optional per-finding field overrides. */
-export interface RuleMatch {
+interface RuleMatch {
     file: string;
     content: string;
     /** Match start offset within `content`. */
@@ -60,7 +47,7 @@ export interface RuleMatch {
  * rules (e.g. key generation across algorithm families) override these; fixed
  * rules pass none and inherit the catalog metadata verbatim.
  */
-export type RuleOverrides = Partial<Pick<RuleMeta, "title" | "category" | "severity" | "confidence" | "algorithm" | "hndl" | "message" | "cwe">> & {
+type RuleOverrides = Partial<Pick<RuleMeta, "title" | "category" | "severity" | "confidence" | "algorithm" | "hndl" | "message" | "cwe">> & {
     remediation?: string;
 };
 /**
@@ -97,6 +84,14 @@ export declare const ELIXIR_EXTENSIONS: readonly string[];
 export declare const PHP_EXTENSIONS: readonly string[];
 /** C / C++ source extensions handled by the OpenSSL detector. */
 export declare const C_EXTENSIONS: readonly string[];
+/** Swift source extensions handled by the CryptoKit / Security-framework detector. */
+export declare const SWIFT_EXTENSIONS: readonly string[];
+/** Objective-C implementation extensions (`.h` is owned by the C pack). */
+export declare const OBJC_EXTENSIONS: readonly string[];
+/** Dart / Flutter source extensions. */
+export declare const DART_EXTENSIONS: readonly string[];
+/** Smart-contract source extensions (Solidity/EVM, Move, Cairo/Starknet). */
+export declare const SMART_CONTRACT_EXTENSIONS: readonly string[];
 /**
  * Prose/documentation extensions. The language-agnostic *token* detectors (SSH
  * public keys, TLS cipher suites, certificate signature algorithms) must not run
@@ -130,14 +125,17 @@ export declare const ANALYZABLE_SOURCE_EXTENSIONS: readonly string[];
  * crypto, shown in coverage output. Kept next to {@link
  * ANALYZABLE_SOURCE_EXTENSIONS} so a new language pack updates one place.
  */
-export declare const ANALYZABLE_LANGUAGES_LABEL = "JS/TS, Python, Go, Java/Kotlin/Scala, C#, Rust, Ruby, PHP, Elixir, C/C++";
+export declare const ANALYZABLE_LANGUAGES_LABEL = "JS/TS, Python, Go, Java/Kotlin/Scala, C#, Rust, Ruby, PHP, Elixir, C/C++, Swift, Objective-C, Dart, Solidity/Move/Cairo";
 /** True when a path is in a source language the scanner can analyze for crypto. */
 export declare function isAnalyzableSource(filePath: string): boolean;
 /**
- * Given a SORTED ascending array of call offsets, return true when `idx` is at
- * or after some call offset `c` with `idx - c < window`. Runs in O(log n) by
- * binary-searching the largest call offset ≤ `idx` and checking the gap. This
- * replaces the previous O(matches × calls) linear scan (`nearCall`).
+ * Given a SORTED ascending array of call offsets, return true when `idx` is at or
+ * after some call offset `c` with `idx - c < window`. Deliberately ONE-SIDED
+ * (forward only): the WebCrypto algorithm name follows the `subtle.*(` call it
+ * belongs to, and reaching backward would wrongly attribute an UNRELATED earlier
+ * call's argument (e.g. a Node `generateKeyPairSync('rsa-pss', …)` sitting a few
+ * lines above a subtle call) to the wrong API. Runs in O(log n) by binary-searching
+ * the largest call offset ≤ `idx` and checking the gap.
  */
 export declare function nearSortedCall(sortedCalls: readonly number[], idx: number, window: number): boolean;
 /**
@@ -145,4 +143,40 @@ export declare function nearSortedCall(sortedCalls: readonly number[], idx: numb
  * lastIndex and guards against zero-width matches (which would loop forever).
  */
 export declare function eachMatch(re: RegExp, content: string, onMatch: (match: RegExpExecArray) => void): void;
+/**
+ * Return the innermost `{ … }` object that contains `index`, as a substring — so a
+ * per-match check (e.g. a JWK's own `use`/`alg`, or whether an `alg` sits inside a
+ * JWK) analyses ONLY that object and can't be contaminated by a neighbouring object
+ * in a packed array. The scan is STRING-AWARE (braces and quotes inside JSON string
+ * values, honouring `\"`, are ignored), so a value like `"a}b{c"` can't mis-scope the
+ * object. Bounded by `maxSpan` each way so a pathological input can't blow up; falls
+ * back to a bounded ±window when no enclosing object is found in range.
+ */
+export declare function enclosingObject(content: string, index: number, maxSpan?: number): string;
+/**
+ * Blank out FULL-LINE comments so a commented-out directive isn't reported as an
+ * active setting. A line counts as a comment when its first non-whitespace characters
+ * match one of `markers` (e.g. `#`, `//`, `;`, `!`). Each such line's characters are
+ * replaced with spaces of the SAME length (newlines preserved), so every byte offset
+ * is unchanged — the finding line/column/snippet for the non-comment lines that remain
+ * stay exactly correct. Inline trailing comments are intentionally left alone (the
+ * directive before them is still active, so it should still be flagged).
+ *
+ * Config detectors run their rules over the masked content; matches can then only land
+ * on live config, not on commented examples (mosquitto.conf, CI YAML, ipsec.conf, and
+ * HCL all conventionally ship large blocks of commented-out directives).
+ */
+export declare function maskCommentLines(content: string, markers: readonly string[]): string;
+/**
+ * Blank out C-style block comments (the `slash-star … star-slash` form, multi-line
+ * included), replacing every
+ * character with a space and preserving newlines so byte offsets — and therefore
+ * finding line/column — stay exact. Complements {@link maskCommentLines}, which only
+ * masks whole single-line comments: an HCL/Bicep resource wrapped in a block comment
+ * has its inner lines mid-block (they don't START with `/*`), so a line-only masker
+ * leaves them live. Not string-aware — a literal `/*` inside a config string value is
+ * rare and, for these token detectors, a tolerable over-mask.
+ */
+export declare function maskBlockComments(content: string): string;
+export {};
 //# sourceMappingURL=detect-utils.d.ts.map

package/dist/detect-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"detect-utils.d.ts","sourceRoot":"","sources":["../src/detect-utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EACV,eAAe,EACf,UAAU,EACV,OAAO,EACP,eAAe,EACf,QAAQ,EACR,QAAQ,EACT,MAAM,YAAY,CAAC;AAGpB,sEAAsE;AACtE,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAwCD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAIxE;AAED,oEAAoE;AACpE,wBAAgB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAQ9D;AAED,sCAAsC;AACtC,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,QAAQ,CAAC;IACnB,UAAU,EAAE,UAAU,CAAC;IACvB,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0CAA0C;IAC1C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAmCtD;AAED,yEAAyE;AACzE,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,2CAA2C;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,CACjC,IAAI,CACF,QAAQ,EACR,OAAO,GAAG,UAAU,GAAG,UAAU,GAAG,YAAY,GAAG,WAAW,GAAG,MAAM,GAAG,SAAS,GAAG,KAAK,CAC5F,CACF,GAAG;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7B;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,aAAa,GAAG,OAAO,CAkBjG;AAED,+EAA+E;AAC/E,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAG/E;AAED;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAS7C,CAAC;AAEF,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAA4B,CAAC;AAE5E,uDAAuD;AACvD,eAAO,MAAM,aAAa,EAAE,SAAS,MAAM,EAAY,CAAC;AAExD,mEAAmE;AAInE,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAA8C,CAAC;AAE5F,yDAAyD;AACzD,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAAY,CAAC;AAE5D,2DAA2D;AAC3D,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAAY,CAAC;AAE1D,2DAA2D;AAC3D,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAAY,CAAC;AAE1D,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAAoB,CAAC;AAEpE,yDAAyD;AACzD,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAAkD,CAAC;AAE/F,iEAAiE;AACjE,eAAO,MAAM,YAAY,EAAE,SAAS,MAAM,EAAuD,CAAC;AAElG;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAY3C,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAKhD,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,EAAE,SAAS,MAAM,EAWzD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,6EACqC,CAAC;AAE7E,mFAAmF;AACnF,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GACb,OAAO,CAgBT;AAED;;;GAGG;AACH,wBAAgB,SAAS,CACvB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,GACxC,IAAI,CAQN"}
+{"version":3,"file":"detect-utils.d.ts","sourceRoot":"","sources":["../src/detect-utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EACV,eAAe,EACf,UAAU,EACV,OAAO,EACP,eAAe,EACf,QAAQ,EACR,QAAQ,EACT,MAAM,YAAY,CAAC;AAqEpB,sCAAsC;AACtC,UAAU,WAAW;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,QAAQ,CAAC;IACnB,UAAU,EAAE,UAAU,CAAC;IACvB,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0CAA0C;IAC1C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAmCtD;AAED,yEAAyE;AACzE,UAAU,SAAS;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,2CAA2C;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,KAAK,aAAa,GAAG,OAAO,CAC1B,IAAI,CACF,QAAQ,EACR,OAAO,GAAG,UAAU,GAAG,UAAU,GAAG,YAAY,GAAG,WAAW,GAAG,MAAM,GAAG,SAAS,GAAG,KAAK,CAC5F,CACF,GAAG;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7B;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,aAAa,GAAG,OAAO,CAkBjG;AAED,+EAA+E;AAC/E,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAG/E;AAED;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAS7C,CAAC;AAEF,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAA4B,CAAC;AAE5E,uDAAuD;AACvD,eAAO,MAAM,aAAa,EAAE,SAAS,MAAM,EAAY,CAAC;AAExD,mEAAmE;AAInE,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAA8C,CAAC;AAE5F,yDAAyD;AACzD,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAAY,CAAC;AAE5D,2DAA2D;AAC3D,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAAY,CAAC;AAE1D,2DAA2D;AAC3D,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAAY,CAAC;AAE1D,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAAoB,CAAC;AAEpE,yDAAyD;AACzD,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAAkD,CAAC;AAE/F,iEAAiE;AACjE,eAAO,MAAM,YAAY,EAAE,SAAS,MAAM,EAAuD,CAAC;AAElG,sFAAsF;AACtF,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAAe,CAAC;AAE9D,2EAA2E;AAC3E,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAAkB,CAAC;AAEhE,wCAAwC;AACxC,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAAc,CAAC;AAE5D,6EAA6E;AAC7E,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EAAgC,CAAC;AAExF;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAY3C,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAQhD,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,EAAE,SAAS,MAAM,EAezD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,4HACoF,CAAC;AAE5H,mFAAmF;AACnF,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GACb,OAAO,CAgBT;AAED;;;GAGG;AACH,wBAAgB,SAAS,CACvB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,GACxC,IAAI,CAQN;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,SAAO,GAAG,MAAM,CAkCtF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAWpF;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAiBzD"}

package/dist/detect-utils.js

@@ -43,13 +43,13 @@ function lineIndexFor(starts, offset) {
  * line/column. Newlines are LF; CR is treated as an ordinary character, so on
  * CRLF files the column includes the trailing CR offset harmlessly.
  */
-export function offsetToLineCol(content, offset) {
+function offsetToLineCol(content, offset) {
     const starts = lineStartsFor(content);
     const idx = lineIndexFor(starts, offset);
     return { line: idx + 1, column: offset - starts[idx] + 1 };
 }
 /** Extract the (trimmed) single source line containing `offset`. */
-export function lineAt(content, offset) {
+function lineAt(content, offset) {
     const starts = lineStartsFor(content);
     const idx = lineIndexFor(starts, offset);
     const start = starts[idx];
@@ -166,6 +166,14 @@ export const ELIXIR_EXTENSIONS = [".ex", ".exs"];
 export const PHP_EXTENSIONS = [".php", ".phtml", ".php3", ".php4", ".php5"];
 /** C / C++ source extensions handled by the OpenSSL detector. */
 export const C_EXTENSIONS = [".c", ".h", ".cc", ".cpp", ".cxx", ".hpp", ".hh"];
+/** Swift source extensions handled by the CryptoKit / Security-framework detector. */
+export const SWIFT_EXTENSIONS = [".swift"];
+/** Objective-C implementation extensions (`.h` is owned by the C pack). */
+export const OBJC_EXTENSIONS = [".m", ".mm"];
+/** Dart / Flutter source extensions. */
+export const DART_EXTENSIONS = [".dart"];
+/** Smart-contract source extensions (Solidity/EVM, Move, Cairo/Starknet). */
+export const SMART_CONTRACT_EXTENSIONS = [".sol", ".move", ".cairo"];
 /**
  * Prose/documentation extensions. The language-agnostic *token* detectors (SSH
  * public keys, TLS cipher suites, certificate signature algorithms) must not run
@@ -201,6 +209,9 @@ export const JWT_HOST_EXTENSIONS = [
     ...PYTHON_EXTENSIONS,
     ...GO_EXTENSIONS,
     ...RUBY_EXTENSIONS,
+    // PHP's firebase/php-jwt passes the alg as a quoted token (`'RS256'`, `'ES256'`),
+    // the same shape RE_JWT_ALG matches — so PHP files are in scope for it too.
+    ...PHP_EXTENSIONS,
 ];
 /**
  * Extensions the scanner can actually analyze for inline crypto usage today
@@ -221,22 +232,29 @@ export const ANALYZABLE_SOURCE_EXTENSIONS = [
     ...PHP_EXTENSIONS,
     ...ELIXIR_EXTENSIONS,
     ...C_EXTENSIONS,
+    ...SWIFT_EXTENSIONS,
+    ...OBJC_EXTENSIONS,
+    ...DART_EXTENSIONS,
+    ...SMART_CONTRACT_EXTENSIONS,
 ];
 /**
  * Human label for the source languages the scanner can analyze for inline
  * crypto, shown in coverage output. Kept next to {@link
  * ANALYZABLE_SOURCE_EXTENSIONS} so a new language pack updates one place.
  */
-export const ANALYZABLE_LANGUAGES_LABEL = "JS/TS, Python, Go, Java/Kotlin/Scala, C#, Rust, Ruby, PHP, Elixir, C/C++";
+export const ANALYZABLE_LANGUAGES_LABEL = "JS/TS, Python, Go, Java/Kotlin/Scala, C#, Rust, Ruby, PHP, Elixir, C/C++, Swift, Objective-C, Dart, Solidity/Move/Cairo";
 /** True when a path is in a source language the scanner can analyze for crypto. */
 export function isAnalyzableSource(filePath) {
     return hasExtension(filePath, ANALYZABLE_SOURCE_EXTENSIONS);
 }
 /**
- * Given a SORTED ascending array of call offsets, return true when `idx` is at
- * or after some call offset `c` with `idx - c < window`. Runs in O(log n) by
- * binary-searching the largest call offset ≤ `idx` and checking the gap. This
- * replaces the previous O(matches × calls) linear scan (`nearCall`).
+ * Given a SORTED ascending array of call offsets, return true when `idx` is at or
+ * after some call offset `c` with `idx - c < window`. Deliberately ONE-SIDED
+ * (forward only): the WebCrypto algorithm name follows the `subtle.*(` call it
+ * belongs to, and reaching backward would wrongly attribute an UNRELATED earlier
+ * call's argument (e.g. a Node `generateKeyPairSync('rsa-pss', …)` sitting a few
+ * lines above a subtle call) to the wrong API. Runs in O(log n) by binary-searching
+ * the largest call offset ≤ `idx` and checking the gap.
  */
 export function nearSortedCall(sortedCalls, idx, window) {
     // Find the rightmost element <= idx.
@@ -271,4 +289,112 @@ export function eachMatch(re, content, onMatch) {
             g.lastIndex++; // avoid infinite loop on empty match
     }
 }
+/**
+ * Return the innermost `{ … }` object that contains `index`, as a substring — so a
+ * per-match check (e.g. a JWK's own `use`/`alg`, or whether an `alg` sits inside a
+ * JWK) analyses ONLY that object and can't be contaminated by a neighbouring object
+ * in a packed array. The scan is STRING-AWARE (braces and quotes inside JSON string
+ * values, honouring `\"`, are ignored), so a value like `"a}b{c"` can't mis-scope the
+ * object. Bounded by `maxSpan` each way so a pathological input can't blow up; falls
+ * back to a bounded ±window when no enclosing object is found in range.
+ */
+export function enclosingObject(content, index, maxSpan = 4000) {
+    const lo = Math.max(0, index - maxSpan);
+    const hi = Math.min(content.length, index + maxSpan);
+    const stack = []; // positions of currently-open `{`
+    let inStr = false;
+    let esc = false;
+    let enclosingOpen = -1; // innermost `{` open at `index`
+    for (let i = lo; i < hi; i++) {
+        const c = content[i];
+        if (inStr) {
+            if (esc)
+                esc = false;
+            else if (c === "\\")
+                esc = true;
+            else if (c === '"')
+                inStr = false;
+        }
+        else if (c === '"') {
+            inStr = true;
+        }
+        else if (c === "{") {
+            stack.push(i);
+        }
+        else if (c === "}") {
+            const open = stack.pop();
+            if (open !== undefined && open === enclosingOpen) {
+                return content.slice(enclosingOpen, i + 1); // closed the enclosing object
+            }
+        }
+        if (i === index && enclosingOpen < 0 && stack.length > 0) {
+            enclosingOpen = stack[stack.length - 1];
+        }
+    }
+    // No complete enclosing object in range: if we found an (unclosed) enclosing open
+    // brace, return from it to hi. Otherwise the token is not inside any object (top-level
+    // token / brace-less config like YAML) — return a bounded ±250 window, NOT the full
+    // forward span, so a `"kty"` far AFTER the token can't pull an unrelated JWK into
+    // scope and over-suppress a legitimate standalone finding.
+    if (enclosingOpen >= 0)
+        return content.slice(enclosingOpen, hi);
+    return content.slice(Math.max(0, index - 250), Math.min(content.length, index + 250));
+}
+/**
+ * Blank out FULL-LINE comments so a commented-out directive isn't reported as an
+ * active setting. A line counts as a comment when its first non-whitespace characters
+ * match one of `markers` (e.g. `#`, `//`, `;`, `!`). Each such line's characters are
+ * replaced with spaces of the SAME length (newlines preserved), so every byte offset
+ * is unchanged — the finding line/column/snippet for the non-comment lines that remain
+ * stay exactly correct. Inline trailing comments are intentionally left alone (the
+ * directive before them is still active, so it should still be flagged).
+ *
+ * Config detectors run their rules over the masked content; matches can then only land
+ * on live config, not on commented examples (mosquitto.conf, CI YAML, ipsec.conf, and
+ * HCL all conventionally ship large blocks of commented-out directives).
+ */
+export function maskCommentLines(content, markers) {
+    if (markers.length === 0)
+        return content;
+    const lines = content.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const lead = line.trimStart();
+        if (lead !== "" && markers.some((mk) => lead.startsWith(mk))) {
+            lines[i] = " ".repeat(line.length);
+        }
+    }
+    return lines.join("\n");
+}
+/**
+ * Blank out C-style block comments (the `slash-star … star-slash` form, multi-line
+ * included), replacing every
+ * character with a space and preserving newlines so byte offsets — and therefore
+ * finding line/column — stay exact. Complements {@link maskCommentLines}, which only
+ * masks whole single-line comments: an HCL/Bicep resource wrapped in a block comment
+ * has its inner lines mid-block (they don't START with `/*`), so a line-only masker
+ * leaves them live. Not string-aware — a literal `/*` inside a config string value is
+ * rare and, for these token detectors, a tolerable over-mask.
+ */
+export function maskBlockComments(content) {
+    if (!content.includes("/*"))
+        return content;
+    const out = [];
+    let i = 0;
+    const n = content.length;
+    while (i < n) {
+        if (content[i] === "/" && content[i + 1] === "*") {
+            const end = content.indexOf("*/", i + 2);
+            const stop = end === -1 ? n : end + 2;
+            for (let j = i; j < stop; j++)
+                out.push(content[j] === "\n" ? "\n" : " ");
+            i = stop;
+        }
+        else {
+            out.push(content[i]);
+            i++;
+        }
+    }
+    return out.join("");
+}
 //# sourceMappingURL=detect-utils.js.map