@quantakrypto/core 0.4.4 → 0.6.0

package/dist/comments.d.ts

@@ -15,9 +15,7 @@
  * detection benchmark's recall gate.
  */
 import type { Finding } from "./types.js";
-export type CommentStyle = "c" | "hash";
-/** The comment style for a file path, or null when we don't strip comments for it. */
-export declare function commentStyleForFile(file: string): CommentStyle | null;
+type CommentStyle = "c" | "hash";
 /**
  * Compute the comment spans (`[start, end)` offsets) of `content`, skipping over
  * string literals so a comment marker inside a string is not treated as a
@@ -25,26 +23,6 @@ export declare function commentStyleForFile(file: string): CommentStyle | null;
  * makes backtick strings raw (no escapes).
  */
 export declare function commentSpans(content: string, style: CommentStyle, rawBacktick?: boolean): Array<[number, number]>;
-/**
- * Compute Python triple-quoted string spans (`"""…"""` / `'''…'''`). These are
- * docstrings / prose in practice, so a crypto *name* mentioned inside one
- * (`:param key_type: eg "ssh-ed25519"`) should not fire a token finding — but a
- * PEM key pasted into one is still real material, so {@link stripCommentFindings}
- * exempts `pem-*` rules. Comments and normal strings are skipped so a `"""`
- * delimiter inside them is not mis-detected.
- */
-export declare function pythonDocstringSpans(content: string): Array<[number, number]>;
-/** True if `offset` falls inside one of the (sorted, non-overlapping) spans. */
-export declare function offsetInSpans(spans: ReadonlyArray<[number, number]>, offset: number): boolean;
-/**
- * Line numbers (1-based) suppressed by an inline ignore directive:
- *   - `qscan-ignore-line` on a line suppresses findings on THAT line.
- *   - `qscan-ignore-next-line` on a line suppresses findings on the NEXT line.
- * The directive text is matched anywhere on the line (usually in a comment), so
- * it is language-agnostic. `qscan-ignore-line` is not a substring of
- * `qscan-ignore-next-line`, so the two never collide.
- */
-export declare function ignoredLines(content: string): Set<number>;
 /** Drop findings on lines suppressed by an inline `qscan-ignore` directive. */
 export declare function stripIgnoredFindings(findings: Finding[], content: string): Finding[];
 /**
@@ -69,4 +47,5 @@ export declare function stringSpans(content: string, style: CommentStyle, rawBac
  * through untouched.
  */
 export declare function stripStringLiteralFindings(findings: Finding[], content: string, file: string, ruleIds: ReadonlySet<string>): Finding[];
+export {};
 //# sourceMappingURL=comments.d.ts.map

package/dist/comments.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"comments.d.ts","sourceRoot":"","sources":["../src/comments.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1C,MAAM,MAAM,YAAY,GAAG,GAAG,GAAG,MAAM,CAAC;AA8BxC,sFAAsF;AACtF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAKrE;AAyCD;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,YAAY,EACnB,WAAW,UAAQ,GAClB,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAoCzB;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAsC7E;AAED,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAW7F;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CASzD;AAED,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,EAAE,CAKpF;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,GACX,OAAO,EAAE,CAyBX;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,YAAY,EACnB,WAAW,UAAQ,GAClB,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAiCzB;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,GAC3B,OAAO,EAAE,CAkBX"}
+{"version":3,"file":"comments.d.ts","sourceRoot":"","sources":["../src/comments.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1C,KAAK,YAAY,GAAG,GAAG,GAAG,MAAM,CAAC;AAgGjC;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,YAAY,EACnB,WAAW,UAAQ,GAClB,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAoCzB;AAmFD,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,EAAE,CAKpF;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,GACX,OAAO,EAAE,CAyBX;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,YAAY,EACnB,WAAW,UAAQ,GAClB,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAiCzB;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,OAAO,EAAE,EACnB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,GAC3B,OAAO,EAAE,CAkBX"}

package/dist/comments.js

@@ -21,11 +21,30 @@ const C_LIKE = [
     ".cxx",
     ".hpp",
     ".hh",
+    // PHP and Scala also use C-style `//` + `/* */` comments (PHP additionally uses
+    // `#`, handled by the hash lexer running first would miss `//`; C-style covers both
+    // since PHP `//` is the common form and `#` lines are rare in modern PHP).
+    ".php",
+    ".php3",
+    ".php4",
+    ".php5",
+    ".phtml",
+    ".scala",
+    ".sc",
+    ".swift",
+    // Objective-C (.m/.mm) and Dart (.dart) both use C-style `//` + `/* */`.
+    ".m",
+    ".mm",
+    ".dart",
+    // Smart-contract languages (Solidity/Move/Cairo) also use C-style comments.
+    ".sol",
+    ".move",
+    ".cairo",
 ];
 /** Hash-style (`#`) comment languages, by extension. */
-const HASH_LIKE = [".py", ".pyi", ".pyw", ".rb"];
+const HASH_LIKE = [".py", ".pyi", ".pyw", ".rb", ".ex", ".exs"];
 /** The comment style for a file path, or null when we don't strip comments for it. */
-export function commentStyleForFile(file) {
+function commentStyleForFile(file) {
     const lower = file.toLowerCase();
     if (C_LIKE.some((e) => lower.endsWith(e)))
         return "c";
@@ -127,7 +146,7 @@ export function commentSpans(content, style, rawBacktick = false) {
  * exempts `pem-*` rules. Comments and normal strings are skipped so a `"""`
  * delimiter inside them is not mis-detected.
  */
-export function pythonDocstringSpans(content) {
+function pythonDocstringSpans(content) {
     const spans = [];
     const n = content.length;
     let i = 0;
@@ -169,7 +188,7 @@ export function pythonDocstringSpans(content) {
     return spans;
 }
 /** True if `offset` falls inside one of the (sorted, non-overlapping) spans. */
-export function offsetInSpans(spans, offset) {
+function offsetInSpans(spans, offset) {
     let lo = 0;
     let hi = spans.length - 1;
     while (lo <= hi) {
@@ -192,7 +211,7 @@ export function offsetInSpans(spans, offset) {
  * it is language-agnostic. `qscan-ignore-line` is not a substring of
  * `qscan-ignore-next-line`, so the two never collide.
  */
-export function ignoredLines(content) {
+function ignoredLines(content) {
     const ignored = new Set();
     const lines = content.split("\n");
     for (let i = 0; i < lines.length; i++) {

package/dist/comments.js.map

@@ -1 +1 @@
-{"version":3,"file":"comments.js","sourceRoot":"","sources":["../src/comments.ts"],"names":[],"mappings":"AAoBA,8DAA8D;AAC9D,MAAM,MAAM,GAAsB;IAChC,KAAK;IACL,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,SAAS;IACT,KAAK;IACL,OAAO;IACP,KAAK;IACL,MAAM;IACN,KAAK;IACL,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;CACN,CAAC;AAEF,wDAAwD;AACxD,MAAM,SAAS,GAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAEpE,sFAAsF;AACtF,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC;IACtD,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IAC5D,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,UAAU,CAAC,OAAe,EAAE,CAAS,EAAE,CAAS,EAAE,WAAoB;IAC7E,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,GAAG,KAAK,EAAE,CAAC;YACjB,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACxB,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YACrC,CAAC,EAAE,CAAC;QACN,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,oDAAoD;IACpE,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,KAAK,GAAG,IAAI,WAAW,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACnC,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAe,EACf,KAAmB,EACnB,WAAW,GAAG,KAAK;IAEnB,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,uFAAuF;QACvF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;YAC3C,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACzD,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACzD,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;gBAAE,CAAC,EAAE,CAAC;YACrE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7E,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;gBAAE,CAAC,EAAE,CAAC;YACzF,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACb,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBACxB,CAAC,IAAI,CAAC,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;oBACrB,CAAC,EAAE,CAAC;oBACJ,MAAM;gBACR,CAAC;gBACD,CAAC,EAAE,CAAC;YACN,CAAC;YACD,SAAS;QACX,CAAC;QACD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,aAAa,CAAC,KAAsC,EAAE,MAAc;IAClF,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,EAAE,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,MAAM,GAAG,CAAC;YAAE,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;aACxB,IAAI,MAAM,IAAI,CAAC;YAAE,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;;YAC9B,OAAO,IAAI,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;aAC3D,IAAI,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,QAAmB,EAAE,OAAe;IACvE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChF,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACxC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAmB,EACnB,OAAe,EACf,IAAY;IAEZ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC3C,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5B,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEjE,+EAA+E;IAC/E,wEAAwE;IACxE,MAAM,UAAU,GAAa,CAAC,CAAC,CAAC,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,IAAI,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;YAC3F,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CACzB,OAAe,EACf,KAAmB,EACnB,WAAW,GAAG,KAAK;IAEnB,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACzD,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACzD,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;gBAAE,CAAC,EAAE,CAAC;YACrE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAClC,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;YACnD,wEAAwE;YACxE,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,GAAG,KAAK,GAAG,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;YAC3D,CAAC,GAAG,GAAG,CAAC;YACR,SAAS;QACX,CAAC;QACD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAAmB,EACnB,OAAe,EACf,IAAY,EACZ,OAA4B;IAE5B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC3F,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5B,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAExC,MAAM,UAAU,GAAa,CAAC,CAAC,CAAC,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Comment-aware false-positive suppression.\n *\n * The detectors are lexical (regex over source text), so a crypto API name\n * written in a COMMENT — `// migrated off createECDH()` — fires a finding just\n * like real code. This module computes the comment spans of a file (respecting\n * string literals, so a `//` inside a string is not a comment) and drops any\n * finding whose match starts inside one.\n *\n * The lexer is deliberately conservative: it only ever ENTERS a comment on a\n * literal line comment, block comment, or `#` in code position (all of which ARE\n * comments), so it never mis-classifies code as a comment and can only reduce\n * false positives, not recall. The one inherent lexical ambiguity — a regex\n * literal that looks like a block-comment open — is rare and guarded by the\n * detection benchmark's recall gate.\n */\nimport type { Finding } from \"./types.js\";\n\nexport type CommentStyle = \"c\" | \"hash\";\n\n/** C-style (line + block) comment languages, by extension. */\nconst C_LIKE: readonly string[] = [\n  \".js\",\n  \".jsx\",\n  \".ts\",\n  \".tsx\",\n  \".mjs\",\n  \".cjs\",\n  \".vue\",\n  \".svelte\",\n  \".go\",\n  \".java\",\n  \".kt\",\n  \".kts\",\n  \".cs\",\n  \".rs\",\n  \".c\",\n  \".h\",\n  \".cc\",\n  \".cpp\",\n  \".cxx\",\n  \".hpp\",\n  \".hh\",\n];\n\n/** Hash-style (`#`) comment languages, by extension. */\nconst HASH_LIKE: readonly string[] = [\".py\", \".pyi\", \".pyw\", \".rb\"];\n\n/** The comment style for a file path, or null when we don't strip comments for it. */\nexport function commentStyleForFile(file: string): CommentStyle | null {\n  const lower = file.toLowerCase();\n  if (C_LIKE.some((e) => lower.endsWith(e))) return \"c\";\n  if (HASH_LIKE.some((e) => lower.endsWith(e))) return \"hash\";\n  return null;\n}\n\n/**\n * Advance past a string / char literal starting at `content[i]` (a quote char);\n * returns the index just after it. Two correctness rules a naive escape-scan got\n * wrong (both verified as real bugs):\n *   - a `'` char literal must close within a short window (`'\\u{10FFFF}'` is ~11\n *     chars); otherwise it is a Rust lifetime (`'a`) or a stray apostrophe, NOT a\n *     literal — return `i + 1` so the scan continues instead of consuming the\n *     rest of the file.\n *   - Go raw strings (backtick, when `rawBacktick`) do NOT process escapes, so a\n *     trailing backslash (`` `C:\\` ``) must not swallow the closing delimiter.\n */\nfunction skipQuoted(content: string, i: number, n: number, rawBacktick: boolean): number {\n  const quote = content[i];\n  if (quote === \"'\") {\n    const limit = Math.min(n, i + 1 + 12);\n    let j = i + 1;\n    while (j < limit) {\n      if (content[j] === \"\\\\\") {\n        j += 2;\n        continue;\n      }\n      if (content[j] === \"'\") return j + 1;\n      j++;\n    }\n    return i + 1; // a lifetime / stray apostrophe, not a char literal\n  }\n  const escapes = !(quote === \"`\" && rawBacktick);\n  let j = i + 1;\n  while (j < n) {\n    if (escapes && content[j] === \"\\\\\") {\n      j += 2;\n      continue;\n    }\n    if (content[j] === quote) return j + 1;\n    j++;\n  }\n  return n;\n}\n\n/**\n * Compute the comment spans (`[start, end)` offsets) of `content`, skipping over\n * string literals so a comment marker inside a string is not treated as a\n * comment. Spans are returned sorted and non-overlapping. `rawBacktick` (Go)\n * makes backtick strings raw (no escapes).\n */\nexport function commentSpans(\n  content: string,\n  style: CommentStyle,\n  rawBacktick = false,\n): Array<[number, number]> {\n  const spans: Array<[number, number]> = [];\n  const n = content.length;\n  let i = 0;\n  while (i < n) {\n    const c = content[i];\n    // String / char literal: skip past it (lexically correct for lifetimes + raw strings).\n    if (c === '\"' || c === \"'\" || c === \"`\") {\n      i = skipQuoted(content, i, n, rawBacktick);\n      continue;\n    }\n    if (style === \"c\" && c === \"/\" && content[i + 1] === \"/\") {\n      const start = i;\n      i += 2;\n      while (i < n && content[i] !== \"\\n\") i++;\n      spans.push([start, i]);\n      continue;\n    }\n    if (style === \"c\" && c === \"/\" && content[i + 1] === \"*\") {\n      const start = i;\n      i += 2;\n      while (i < n && !(content[i] === \"*\" && content[i + 1] === \"/\")) i++;\n      i = Math.min(n, i + 2);\n      spans.push([start, i]);\n      continue;\n    }\n    if (style === \"hash\" && c === \"#\") {\n      const start = i;\n      i++;\n      while (i < n && content[i] !== \"\\n\") i++;\n      spans.push([start, i]);\n      continue;\n    }\n    i++;\n  }\n  return spans;\n}\n\n/**\n * Compute Python triple-quoted string spans (`\"\"\"…\"\"\"` / `'''…'''`). These are\n * docstrings / prose in practice, so a crypto *name* mentioned inside one\n * (`:param key_type: eg \"ssh-ed25519\"`) should not fire a token finding — but a\n * PEM key pasted into one is still real material, so {@link stripCommentFindings}\n * exempts `pem-*` rules. Comments and normal strings are skipped so a `\"\"\"`\n * delimiter inside them is not mis-detected.\n */\nexport function pythonDocstringSpans(content: string): Array<[number, number]> {\n  const spans: Array<[number, number]> = [];\n  const n = content.length;\n  let i = 0;\n  while (i < n) {\n    const c = content[i];\n    if (c === \"#\") {\n      i++;\n      while (i < n && content[i] !== \"\\n\") i++;\n      continue;\n    }\n    if ((c === '\"' || c === \"'\") && content[i + 1] === c && content[i + 2] === c) {\n      const start = i;\n      i += 3;\n      while (i < n && !(content[i] === c && content[i + 1] === c && content[i + 2] === c)) i++;\n      i = Math.min(n, i + 3);\n      spans.push([start, i]);\n      continue;\n    }\n    if (c === '\"' || c === \"'\") {\n      const q = c;\n      i++;\n      while (i < n) {\n        if (content[i] === \"\\\\\") {\n          i += 2;\n          continue;\n        }\n        if (content[i] === q) {\n          i++;\n          break;\n        }\n        i++;\n      }\n      continue;\n    }\n    i++;\n  }\n  return spans;\n}\n\n/** True if `offset` falls inside one of the (sorted, non-overlapping) spans. */\nexport function offsetInSpans(spans: ReadonlyArray<[number, number]>, offset: number): boolean {\n  let lo = 0;\n  let hi = spans.length - 1;\n  while (lo <= hi) {\n    const mid = (lo + hi) >>> 1;\n    const [s, e] = spans[mid];\n    if (offset < s) hi = mid - 1;\n    else if (offset >= e) lo = mid + 1;\n    else return true;\n  }\n  return false;\n}\n\n/**\n * Line numbers (1-based) suppressed by an inline ignore directive:\n *   - `qscan-ignore-line` on a line suppresses findings on THAT line.\n *   - `qscan-ignore-next-line` on a line suppresses findings on the NEXT line.\n * The directive text is matched anywhere on the line (usually in a comment), so\n * it is language-agnostic. `qscan-ignore-line` is not a substring of\n * `qscan-ignore-next-line`, so the two never collide.\n */\nexport function ignoredLines(content: string): Set<number> {\n  const ignored = new Set<number>();\n  const lines = content.split(\"\\n\");\n  for (let i = 0; i < lines.length; i++) {\n    const line = lines[i];\n    if (line.includes(\"qscan-ignore-next-line\")) ignored.add(i + 2);\n    else if (line.includes(\"qscan-ignore-line\")) ignored.add(i + 1);\n  }\n  return ignored;\n}\n\n/** Drop findings on lines suppressed by an inline `qscan-ignore` directive. */\nexport function stripIgnoredFindings(findings: Finding[], content: string): Finding[] {\n  if (findings.length === 0 || !content.includes(\"qscan-ignore\")) return findings;\n  const ignored = ignoredLines(content);\n  if (ignored.size === 0) return findings;\n  return findings.filter((f) => !ignored.has(f.location.line));\n}\n\n/**\n * Drop findings whose match starts inside a comment. No-op when the file's\n * language has no comment style we handle, or when it has no comments.\n */\nexport function stripCommentFindings(\n  findings: Finding[],\n  content: string,\n  file: string,\n): Finding[] {\n  if (findings.length === 0) return findings;\n  const style = commentStyleForFile(file);\n  if (!style) return findings;\n  const spans = commentSpans(content, style, /\\.go$/i.test(file));\n  // Python docstrings suppress prose *token* rules but keep real PEM material.\n  const docSpans = style === \"hash\" ? pythonDocstringSpans(content) : [];\n  if (spans.length === 0 && docSpans.length === 0) return findings;\n\n  // 1-based line → start offset, to turn a finding's (line, column) back into an\n  // absolute offset (column is 1-based: offset = lineStart + column - 1).\n  const lineStarts: number[] = [0];\n  for (let i = 0; i < content.length; i++) {\n    if (content[i] === \"\\n\") lineStarts.push(i + 1);\n  }\n\n  return findings.filter((f) => {\n    const start = lineStarts[f.location.line - 1] ?? 0;\n    const offset = start + ((f.location.column ?? 1) - 1);\n    if (offsetInSpans(spans, offset)) return false;\n    if (docSpans.length > 0 && !f.ruleId.startsWith(\"pem-\") && offsetInSpans(docSpans, offset)) {\n      return false;\n    }\n    return true;\n  });\n}\n\n/**\n * Compute the string-literal spans (`[start, end)`) of `content`, skipping over\n * comments so a quote inside a comment is not treated as a string. Used to\n * suppress findings from IDENTIFIER-only rules (e.g. a Go `SigningMethodRS256`\n * mentioned inside an error-message string) — the mirror of {@link commentSpans}.\n */\nexport function stringSpans(\n  content: string,\n  style: CommentStyle,\n  rawBacktick = false,\n): Array<[number, number]> {\n  const spans: Array<[number, number]> = [];\n  const n = content.length;\n  let i = 0;\n  while (i < n) {\n    const c = content[i];\n    if (style === \"c\" && c === \"/\" && content[i + 1] === \"/\") {\n      i += 2;\n      while (i < n && content[i] !== \"\\n\") i++;\n      continue;\n    }\n    if (style === \"c\" && c === \"/\" && content[i + 1] === \"*\") {\n      i += 2;\n      while (i < n && !(content[i] === \"*\" && content[i + 1] === \"/\")) i++;\n      i = Math.min(n, i + 2);\n      continue;\n    }\n    if (style === \"hash\" && c === \"#\") {\n      i++;\n      while (i < n && content[i] !== \"\\n\") i++;\n      continue;\n    }\n    if (c === '\"' || c === \"'\" || c === \"`\") {\n      const start = i;\n      const end = skipQuoted(content, i, n, rawBacktick);\n      // A lone `'` (Rust lifetime, end === start+1) is not a string; skip it.\n      if (c !== \"'\" || end > start + 1) spans.push([start, end]);\n      i = end;\n      continue;\n    }\n    i++;\n  }\n  return spans;\n}\n\n/**\n * Drop findings of \"code-only\" rules (`ruleIds`) whose match starts inside a\n * string literal. Some rules — an identifier-form JWT signing method, a Go\n * `SigningMethodRS256` — are only meaningful as code; when the same token appears\n * inside a string (a test's `t.Error(\"SigningMethodPS256 …\")`) it is prose, not a\n * usage. Rules that legitimately match inside strings (quoted `\"RS256\"` alg\n * tokens, cipher-suite strings, ssh-key tokens) are NOT in `ruleIds` and pass\n * through untouched.\n */\nexport function stripStringLiteralFindings(\n  findings: Finding[],\n  content: string,\n  file: string,\n  ruleIds: ReadonlySet<string>,\n): Finding[] {\n  if (findings.length === 0 || !findings.some((f) => ruleIds.has(f.ruleId))) return findings;\n  const style = commentStyleForFile(file);\n  if (!style) return findings;\n  const spans = stringSpans(content, style, /\\.go$/i.test(file));\n  if (spans.length === 0) return findings;\n\n  const lineStarts: number[] = [0];\n  for (let i = 0; i < content.length; i++) {\n    if (content[i] === \"\\n\") lineStarts.push(i + 1);\n  }\n\n  return findings.filter((f) => {\n    if (!ruleIds.has(f.ruleId)) return true;\n    const start = lineStarts[f.location.line - 1] ?? 0;\n    const offset = start + ((f.location.column ?? 1) - 1);\n    return !offsetInSpans(spans, offset);\n  });\n}\n"]}
+{"version":3,"file":"comments.js","sourceRoot":"","sources":["../src/comments.ts"],"names":[],"mappings":"AAoBA,8DAA8D;AAC9D,MAAM,MAAM,GAAsB;IAChC,KAAK;IACL,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,SAAS;IACT,KAAK;IACL,OAAO;IACP,KAAK;IACL,MAAM;IACN,KAAK;IACL,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,gFAAgF;IAChF,oFAAoF;IACpF,2EAA2E;IAC3E,MAAM;IACN,OAAO;IACP,OAAO;IACP,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,KAAK;IACL,QAAQ;IACR,yEAAyE;IACzE,IAAI;IACJ,KAAK;IACL,OAAO;IACP,4EAA4E;IAC5E,MAAM;IACN,OAAO;IACP,QAAQ;CACT,CAAC;AAEF,wDAAwD;AACxD,MAAM,SAAS,GAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAEnF,sFAAsF;AACtF,SAAS,mBAAmB,CAAC,IAAY;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,GAAG,CAAC;IACtD,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IAC5D,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,UAAU,CAAC,OAAe,EAAE,CAAS,EAAE,CAAS,EAAE,WAAoB;IAC7E,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,GAAG,KAAK,EAAE,CAAC;YACjB,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACxB,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG;gBAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YACrC,CAAC,EAAE,CAAC;QACN,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,oDAAoD;IACpE,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,KAAK,GAAG,IAAI,WAAW,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACd,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,IAAI,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACnC,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAe,EACf,KAAmB,EACnB,WAAW,GAAG,KAAK;IAEnB,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,uFAAuF;QACvF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;YAC3C,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACzD,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACzD,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;gBAAE,CAAC,EAAE,CAAC;YACrE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,OAAe;IAC3C,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7E,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;gBAAE,CAAC,EAAE,CAAC;YACzF,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACb,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBACxB,CAAC,IAAI,CAAC,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;oBACrB,CAAC,EAAE,CAAC;oBACJ,MAAM;gBACR,CAAC;gBACD,CAAC,EAAE,CAAC;YACN,CAAC;YACD,SAAS;QACX,CAAC;QACD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAChF,SAAS,aAAa,CAAC,KAAsC,EAAE,MAAc;IAC3E,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,EAAE,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAC1B,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;QAChB,MAAM,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,MAAM,GAAG,CAAC;YAAE,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;aACxB,IAAI,MAAM,IAAI,CAAC;YAAE,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;;YAC9B,OAAO,IAAI,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,IAAI,CAAC,QAAQ,CAAC,wBAAwB,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;aAC3D,IAAI,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,QAAmB,EAAE,OAAe;IACvE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,QAAQ,CAAC;IAChF,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACxC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,QAAmB,EACnB,OAAe,EACf,IAAY;IAEZ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC3C,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5B,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEjE,+EAA+E;IAC/E,wEAAwE;IACxE,MAAM,UAAU,GAAa,CAAC,CAAC,CAAC,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3B,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,IAAI,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;YAC3F,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CACzB,OAAe,EACf,KAAmB,EACnB,WAAW,GAAG,KAAK;IAEnB,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACzD,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACzD,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;gBAAE,CAAC,EAAE,CAAC;YACrE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,KAAK,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAClC,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACzC,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,CAAC,CAAC;YAChB,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;YACnD,wEAAwE;YACxE,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,GAAG,KAAK,GAAG,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;YAC3D,CAAC,GAAG,GAAG,CAAC;YACR,SAAS;QACX,CAAC;QACD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAAmB,EACnB,OAAe,EACf,IAAY,EACZ,OAA4B;IAE5B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC3F,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,QAAQ,CAAC;IAC5B,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAExC,MAAM,UAAU,GAAa,CAAC,CAAC,CAAC,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Comment-aware false-positive suppression.\n *\n * The detectors are lexical (regex over source text), so a crypto API name\n * written in a COMMENT — `// migrated off createECDH()` — fires a finding just\n * like real code. This module computes the comment spans of a file (respecting\n * string literals, so a `//` inside a string is not a comment) and drops any\n * finding whose match starts inside one.\n *\n * The lexer is deliberately conservative: it only ever ENTERS a comment on a\n * literal line comment, block comment, or `#` in code position (all of which ARE\n * comments), so it never mis-classifies code as a comment and can only reduce\n * false positives, not recall. The one inherent lexical ambiguity — a regex\n * literal that looks like a block-comment open — is rare and guarded by the\n * detection benchmark's recall gate.\n */\nimport type { Finding } from \"./types.js\";\n\ntype CommentStyle = \"c\" | \"hash\";\n\n/** C-style (line + block) comment languages, by extension. */\nconst C_LIKE: readonly string[] = [\n  \".js\",\n  \".jsx\",\n  \".ts\",\n  \".tsx\",\n  \".mjs\",\n  \".cjs\",\n  \".vue\",\n  \".svelte\",\n  \".go\",\n  \".java\",\n  \".kt\",\n  \".kts\",\n  \".cs\",\n  \".rs\",\n  \".c\",\n  \".h\",\n  \".cc\",\n  \".cpp\",\n  \".cxx\",\n  \".hpp\",\n  \".hh\",\n  // PHP and Scala also use C-style `//` + `/* */` comments (PHP additionally uses\n  // `#`, handled by the hash lexer running first would miss `//`; C-style covers both\n  // since PHP `//` is the common form and `#` lines are rare in modern PHP).\n  \".php\",\n  \".php3\",\n  \".php4\",\n  \".php5\",\n  \".phtml\",\n  \".scala\",\n  \".sc\",\n  \".swift\",\n  // Objective-C (.m/.mm) and Dart (.dart) both use C-style `//` + `/* */`.\n  \".m\",\n  \".mm\",\n  \".dart\",\n  // Smart-contract languages (Solidity/Move/Cairo) also use C-style comments.\n  \".sol\",\n  \".move\",\n  \".cairo\",\n];\n\n/** Hash-style (`#`) comment languages, by extension. */\nconst HASH_LIKE: readonly string[] = [\".py\", \".pyi\", \".pyw\", \".rb\", \".ex\", \".exs\"];\n\n/** The comment style for a file path, or null when we don't strip comments for it. */\nfunction commentStyleForFile(file: string): CommentStyle | null {\n  const lower = file.toLowerCase();\n  if (C_LIKE.some((e) => lower.endsWith(e))) return \"c\";\n  if (HASH_LIKE.some((e) => lower.endsWith(e))) return \"hash\";\n  return null;\n}\n\n/**\n * Advance past a string / char literal starting at `content[i]` (a quote char);\n * returns the index just after it. Two correctness rules a naive escape-scan got\n * wrong (both verified as real bugs):\n *   - a `'` char literal must close within a short window (`'\\u{10FFFF}'` is ~11\n *     chars); otherwise it is a Rust lifetime (`'a`) or a stray apostrophe, NOT a\n *     literal — return `i + 1` so the scan continues instead of consuming the\n *     rest of the file.\n *   - Go raw strings (backtick, when `rawBacktick`) do NOT process escapes, so a\n *     trailing backslash (`` `C:\\` ``) must not swallow the closing delimiter.\n */\nfunction skipQuoted(content: string, i: number, n: number, rawBacktick: boolean): number {\n  const quote = content[i];\n  if (quote === \"'\") {\n    const limit = Math.min(n, i + 1 + 12);\n    let j = i + 1;\n    while (j < limit) {\n      if (content[j] === \"\\\\\") {\n        j += 2;\n        continue;\n      }\n      if (content[j] === \"'\") return j + 1;\n      j++;\n    }\n    return i + 1; // a lifetime / stray apostrophe, not a char literal\n  }\n  const escapes = !(quote === \"`\" && rawBacktick);\n  let j = i + 1;\n  while (j < n) {\n    if (escapes && content[j] === \"\\\\\") {\n      j += 2;\n      continue;\n    }\n    if (content[j] === quote) return j + 1;\n    j++;\n  }\n  return n;\n}\n\n/**\n * Compute the comment spans (`[start, end)` offsets) of `content`, skipping over\n * string literals so a comment marker inside a string is not treated as a\n * comment. Spans are returned sorted and non-overlapping. `rawBacktick` (Go)\n * makes backtick strings raw (no escapes).\n */\nexport function commentSpans(\n  content: string,\n  style: CommentStyle,\n  rawBacktick = false,\n): Array<[number, number]> {\n  const spans: Array<[number, number]> = [];\n  const n = content.length;\n  let i = 0;\n  while (i < n) {\n    const c = content[i];\n    // String / char literal: skip past it (lexically correct for lifetimes + raw strings).\n    if (c === '\"' || c === \"'\" || c === \"`\") {\n      i = skipQuoted(content, i, n, rawBacktick);\n      continue;\n    }\n    if (style === \"c\" && c === \"/\" && content[i + 1] === \"/\") {\n      const start = i;\n      i += 2;\n      while (i < n && content[i] !== \"\\n\") i++;\n      spans.push([start, i]);\n      continue;\n    }\n    if (style === \"c\" && c === \"/\" && content[i + 1] === \"*\") {\n      const start = i;\n      i += 2;\n      while (i < n && !(content[i] === \"*\" && content[i + 1] === \"/\")) i++;\n      i = Math.min(n, i + 2);\n      spans.push([start, i]);\n      continue;\n    }\n    if (style === \"hash\" && c === \"#\") {\n      const start = i;\n      i++;\n      while (i < n && content[i] !== \"\\n\") i++;\n      spans.push([start, i]);\n      continue;\n    }\n    i++;\n  }\n  return spans;\n}\n\n/**\n * Compute Python triple-quoted string spans (`\"\"\"…\"\"\"` / `'''…'''`). These are\n * docstrings / prose in practice, so a crypto *name* mentioned inside one\n * (`:param key_type: eg \"ssh-ed25519\"`) should not fire a token finding — but a\n * PEM key pasted into one is still real material, so {@link stripCommentFindings}\n * exempts `pem-*` rules. Comments and normal strings are skipped so a `\"\"\"`\n * delimiter inside them is not mis-detected.\n */\nfunction pythonDocstringSpans(content: string): Array<[number, number]> {\n  const spans: Array<[number, number]> = [];\n  const n = content.length;\n  let i = 0;\n  while (i < n) {\n    const c = content[i];\n    if (c === \"#\") {\n      i++;\n      while (i < n && content[i] !== \"\\n\") i++;\n      continue;\n    }\n    if ((c === '\"' || c === \"'\") && content[i + 1] === c && content[i + 2] === c) {\n      const start = i;\n      i += 3;\n      while (i < n && !(content[i] === c && content[i + 1] === c && content[i + 2] === c)) i++;\n      i = Math.min(n, i + 3);\n      spans.push([start, i]);\n      continue;\n    }\n    if (c === '\"' || c === \"'\") {\n      const q = c;\n      i++;\n      while (i < n) {\n        if (content[i] === \"\\\\\") {\n          i += 2;\n          continue;\n        }\n        if (content[i] === q) {\n          i++;\n          break;\n        }\n        i++;\n      }\n      continue;\n    }\n    i++;\n  }\n  return spans;\n}\n\n/** True if `offset` falls inside one of the (sorted, non-overlapping) spans. */\nfunction offsetInSpans(spans: ReadonlyArray<[number, number]>, offset: number): boolean {\n  let lo = 0;\n  let hi = spans.length - 1;\n  while (lo <= hi) {\n    const mid = (lo + hi) >>> 1;\n    const [s, e] = spans[mid];\n    if (offset < s) hi = mid - 1;\n    else if (offset >= e) lo = mid + 1;\n    else return true;\n  }\n  return false;\n}\n\n/**\n * Line numbers (1-based) suppressed by an inline ignore directive:\n *   - `qscan-ignore-line` on a line suppresses findings on THAT line.\n *   - `qscan-ignore-next-line` on a line suppresses findings on the NEXT line.\n * The directive text is matched anywhere on the line (usually in a comment), so\n * it is language-agnostic. `qscan-ignore-line` is not a substring of\n * `qscan-ignore-next-line`, so the two never collide.\n */\nfunction ignoredLines(content: string): Set<number> {\n  const ignored = new Set<number>();\n  const lines = content.split(\"\\n\");\n  for (let i = 0; i < lines.length; i++) {\n    const line = lines[i];\n    if (line.includes(\"qscan-ignore-next-line\")) ignored.add(i + 2);\n    else if (line.includes(\"qscan-ignore-line\")) ignored.add(i + 1);\n  }\n  return ignored;\n}\n\n/** Drop findings on lines suppressed by an inline `qscan-ignore` directive. */\nexport function stripIgnoredFindings(findings: Finding[], content: string): Finding[] {\n  if (findings.length === 0 || !content.includes(\"qscan-ignore\")) return findings;\n  const ignored = ignoredLines(content);\n  if (ignored.size === 0) return findings;\n  return findings.filter((f) => !ignored.has(f.location.line));\n}\n\n/**\n * Drop findings whose match starts inside a comment. No-op when the file's\n * language has no comment style we handle, or when it has no comments.\n */\nexport function stripCommentFindings(\n  findings: Finding[],\n  content: string,\n  file: string,\n): Finding[] {\n  if (findings.length === 0) return findings;\n  const style = commentStyleForFile(file);\n  if (!style) return findings;\n  const spans = commentSpans(content, style, /\\.go$/i.test(file));\n  // Python docstrings suppress prose *token* rules but keep real PEM material.\n  const docSpans = style === \"hash\" ? pythonDocstringSpans(content) : [];\n  if (spans.length === 0 && docSpans.length === 0) return findings;\n\n  // 1-based line → start offset, to turn a finding's (line, column) back into an\n  // absolute offset (column is 1-based: offset = lineStart + column - 1).\n  const lineStarts: number[] = [0];\n  for (let i = 0; i < content.length; i++) {\n    if (content[i] === \"\\n\") lineStarts.push(i + 1);\n  }\n\n  return findings.filter((f) => {\n    const start = lineStarts[f.location.line - 1] ?? 0;\n    const offset = start + ((f.location.column ?? 1) - 1);\n    if (offsetInSpans(spans, offset)) return false;\n    if (docSpans.length > 0 && !f.ruleId.startsWith(\"pem-\") && offsetInSpans(docSpans, offset)) {\n      return false;\n    }\n    return true;\n  });\n}\n\n/**\n * Compute the string-literal spans (`[start, end)`) of `content`, skipping over\n * comments so a quote inside a comment is not treated as a string. Used to\n * suppress findings from IDENTIFIER-only rules (e.g. a Go `SigningMethodRS256`\n * mentioned inside an error-message string) — the mirror of {@link commentSpans}.\n */\nexport function stringSpans(\n  content: string,\n  style: CommentStyle,\n  rawBacktick = false,\n): Array<[number, number]> {\n  const spans: Array<[number, number]> = [];\n  const n = content.length;\n  let i = 0;\n  while (i < n) {\n    const c = content[i];\n    if (style === \"c\" && c === \"/\" && content[i + 1] === \"/\") {\n      i += 2;\n      while (i < n && content[i] !== \"\\n\") i++;\n      continue;\n    }\n    if (style === \"c\" && c === \"/\" && content[i + 1] === \"*\") {\n      i += 2;\n      while (i < n && !(content[i] === \"*\" && content[i + 1] === \"/\")) i++;\n      i = Math.min(n, i + 2);\n      continue;\n    }\n    if (style === \"hash\" && c === \"#\") {\n      i++;\n      while (i < n && content[i] !== \"\\n\") i++;\n      continue;\n    }\n    if (c === '\"' || c === \"'\" || c === \"`\") {\n      const start = i;\n      const end = skipQuoted(content, i, n, rawBacktick);\n      // A lone `'` (Rust lifetime, end === start+1) is not a string; skip it.\n      if (c !== \"'\" || end > start + 1) spans.push([start, end]);\n      i = end;\n      continue;\n    }\n    i++;\n  }\n  return spans;\n}\n\n/**\n * Drop findings of \"code-only\" rules (`ruleIds`) whose match starts inside a\n * string literal. Some rules — an identifier-form JWT signing method, a Go\n * `SigningMethodRS256` — are only meaningful as code; when the same token appears\n * inside a string (a test's `t.Error(\"SigningMethodPS256 …\")`) it is prose, not a\n * usage. Rules that legitimately match inside strings (quoted `\"RS256\"` alg\n * tokens, cipher-suite strings, ssh-key tokens) are NOT in `ruleIds` and pass\n * through untouched.\n */\nexport function stripStringLiteralFindings(\n  findings: Finding[],\n  content: string,\n  file: string,\n  ruleIds: ReadonlySet<string>,\n): Finding[] {\n  if (findings.length === 0 || !findings.some((f) => ruleIds.has(f.ruleId))) return findings;\n  const style = commentStyleForFile(file);\n  if (!style) return findings;\n  const spans = stringSpans(content, style, /\\.go$/i.test(file));\n  if (spans.length === 0) return findings;\n\n  const lineStarts: number[] = [0];\n  for (let i = 0; i < content.length; i++) {\n    if (content[i] === \"\\n\") lineStarts.push(i + 1);\n  }\n\n  return findings.filter((f) => {\n    if (!ruleIds.has(f.ruleId)) return true;\n    const start = lineStarts[f.location.line - 1] ?? 0;\n    const offset = start + ((f.location.column ?? 1) - 1);\n    return !offsetInSpans(spans, offset);\n  });\n}\n"]}

package/dist/crypto-agility.d.ts

@@ -0,0 +1,158 @@
+/**
+ * Crypto-agility manifest: an agent-consumable crypto-posture document.
+ *
+ * A small, versioned JSON manifest a project publishes at a well-known URL
+ * (`/.well-known/crypto-agility.json`, see docs/CRYPTO-AGILITY-MANIFEST.md) so any
+ * agent, scanner, or CI bot can read the project's cryptographic posture the way it
+ * reads `security.txt` or `robots.txt`. It is a compact, decision-oriented summary
+ * DERIVED from a qScan result: the readiness score, the count of quantum-vulnerable
+ * findings by severity, the CBOM's algorithm families, an optional attestation URL,
+ * and the migration-policy deadlines.
+ *
+ * This module owns two pure operations and their shared schema:
+ *   - {@link buildCryptoAgilityManifest}: derive a manifest from a {@link ScanResult}.
+ *   - {@link validateCryptoAgilityManifest}: check an untrusted value against the
+ *     schema, returning a list of problems (used by the local validator; a network
+ *     fetch-and-validate lives on the website, never in this offline-boundary tool).
+ *
+ * Zero dependencies; hand-rolled JSON shape and validation so the package stays
+ * runtime-dependency-free.
+ */
+import type { CryptoPolicy } from "./policy.js";
+import type { ScanResult, Severity } from "./types.js";
+/**
+ * Schema version of the manifest this module emits and validates. Bumped only on a
+ * breaking change to the manifest shape; consumers key their parsing off it.
+ */
+export declare const CRYPTO_AGILITY_MANIFEST_VERSION = 1;
+/** The conventional path a manifest is served from, relative to the site origin. */
+export declare const CRYPTO_AGILITY_WELL_KNOWN_PATH = "/.well-known/crypto-agility.json";
+/** A single algorithm family in use, mirroring the CBOM's grouping. */
+export interface CryptoAgilityFamily {
+    /** The algorithm family (e.g. `RSA`, `ECDH`, `ECDSA`), or `unknown`. */
+    family: string;
+    /** How many findings referenced this family. */
+    count: number;
+    /** Always true today: every detected family is classical (Shor-broken). */
+    quantumVulnerable: boolean;
+}
+/** The project's cryptographic posture, distilled from the scan inventory. */
+export interface CryptoAgilityPosture {
+    /** qScan readiness score, 0–100 (100 = no classical asymmetric crypto found). */
+    readinessScore: number;
+    /**
+     * Whether the project negotiates hybrid post-quantum key exchange. qScan is a
+     * static scanner and cannot observe a negotiated TLS group, so this is `null`
+     * ("not determined by this generator") unless the operator asserts it
+     * (`--hybrid-kex` / `--no-hybrid-kex`). A live probe (qProbe) or the website can
+     * fill it authoritatively.
+     */
+    hybridKexInUse: boolean | null;
+    /** Count of quantum-vulnerable findings, total and broken down by severity. */
+    quantumVulnerable: {
+        total: number;
+        bySeverity: Record<Severity, number>;
+    };
+    /** How many findings are exposed to harvest-now-decrypt-later. */
+    hndlExposedCount: number;
+}
+/** A compact summary of the full CBOM, linking to it by serial number. */
+export interface CryptoAgilityCbomSummary {
+    /** The CycloneDX `serialNumber` of the full CBOM this summary was derived from. */
+    serialNumber: string;
+    /** Number of distinct cryptographic-asset components in the full CBOM. */
+    assetCount: number;
+    /** Algorithm families in use, most-referenced first. */
+    algorithmFamilies: CryptoAgilityFamily[];
+}
+/** The migration policy the project declares it is measured against. */
+export interface CryptoAgilityPolicy {
+    /** Human label for the policy source (a standard name, or `operator-declared`). */
+    source: string;
+    /** Year after which classical public-key crypto is deprecated. */
+    deprecateClassicalAfter: number;
+    /** Year after which classical public-key crypto is disallowed. */
+    disallowClassicalAfter: number;
+    /** Operator-declared migration deadline (ISO date / year), or `null`. */
+    transitionDeadline: string | null;
+    /** Citation for the deadlines (spec / publication). */
+    citation: string;
+}
+/** The full crypto-agility manifest. */
+export interface CryptoAgilityManifest {
+    /** Manifest schema version ({@link CRYPTO_AGILITY_MANIFEST_VERSION}). */
+    version: number;
+    /** Discriminator so a consumer can tell this document apart from other JSON. */
+    manifestType: "crypto-agility";
+    /** ISO 8601 timestamp the manifest was generated (caller-supplied). */
+    generatedAt: string;
+    /** What produced the manifest. */
+    generator: {
+        name: string;
+        version: string;
+    };
+    /** What the manifest describes. */
+    subject: {
+        root: string;
+        repository: string | null;
+        commit: string | null;
+    };
+    /** The distilled cryptographic posture. */
+    posture: CryptoAgilityPosture;
+    /** A compact summary of the CBOM. */
+    cbomSummary: CryptoAgilityCbomSummary;
+    /** Optional link to a quantakrypto (or other) posture credential. */
+    attestation?: {
+        url: string;
+    };
+    /** The declared migration policy / deadlines. */
+    policy: CryptoAgilityPolicy;
+}
+/** Inputs the CLI/runtime supplies that are not derivable from the scan. */
+export interface CryptoAgilityManifestOptions {
+    /**
+     * ISO 8601 generation timestamp. The caller supplies it (`Date.now()` is fine in
+     * the CLI runtime) so the builder itself stays pure and deterministic.
+     */
+    generatedAt: string;
+    /** Optional URL to a posture credential (recorded verbatim, never fetched here). */
+    attestationUrl?: string;
+    /**
+     * Operator assertion of hybrid-KEX use. `undefined` leaves the manifest's
+     * `hybridKexInUse` as `null` (not determined).
+     */
+    hybridKexInUse?: boolean;
+    /** Optional org crypto policy; its `transitionDeadline` overlays the defaults. */
+    policy?: CryptoPolicy;
+    /** Repository URL (e.g. `GITHUB_REPOSITORY`); omitted → null. */
+    repository?: string;
+    /** Commit SHA (e.g. `GITHUB_SHA`); omitted → null. */
+    commit?: string;
+}
+/**
+ * Build a crypto-agility manifest from a scan result. Pure: every runtime input
+ * (timestamp, attestation, hybrid-KEX assertion, policy) arrives via `opts`.
+ *
+ * The posture and CBOM summary are derived straight from the scan's inventory and
+ * its CycloneDX CBOM, so the manifest can never disagree with the full `--cbom` /
+ * `--format json` outputs of the same scan.
+ */
+export declare function buildCryptoAgilityManifest(result: ScanResult, opts: CryptoAgilityManifestOptions): CryptoAgilityManifest;
+/** Outcome of {@link validateCryptoAgilityManifest}. */
+export interface ManifestValidation {
+    /** True when the value satisfies the manifest schema. */
+    valid: boolean;
+    /** One human-readable message per problem found (empty when `valid`). */
+    errors: string[];
+}
+/**
+ * Validate an untrusted value against the crypto-agility manifest schema.
+ *
+ * Checks structure, required fields, types, and the schema version. Purely local:
+ * it parses an already-in-memory value and NEVER performs I/O or network fetches;
+ * a fetch-and-validate of a remote manifest is a website-side concern, deliberately
+ * kept out of this offline-boundary tool. Returns every problem it finds rather than
+ * throwing on the first, so a caller can report them all at once.
+ */
+export declare function validateCryptoAgilityManifest(value: unknown): ManifestValidation;
+//# sourceMappingURL=crypto-agility.d.ts.map

package/dist/crypto-agility.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-agility.d.ts","sourceRoot":"","sources":["../src/crypto-agility.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAKH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAGvD;;;GAGG;AACH,eAAO,MAAM,+BAA+B,IAAI,CAAC;AAEjD,oFAAoF;AACpF,eAAO,MAAM,8BAA8B,qCAAqC,CAAC;AAEjF,uEAAuE;AACvE,MAAM,WAAW,mBAAmB;IAClC,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAED,8EAA8E;AAC9E,MAAM,WAAW,oBAAoB;IACnC,iFAAiF;IACjF,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,cAAc,EAAE,OAAO,GAAG,IAAI,CAAC;IAC/B,+EAA+E;IAC/E,iBAAiB,EAAE;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;KACtC,CAAC;IACF,kEAAkE;IAClE,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,0EAA0E;AAC1E,MAAM,WAAW,wBAAwB;IACvC,mFAAmF;IACnF,YAAY,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,UAAU,EAAE,MAAM,CAAC;IACnB,wDAAwD;IACxD,iBAAiB,EAAE,mBAAmB,EAAE,CAAC;CAC1C;AAED,wEAAwE;AACxE,MAAM,WAAW,mBAAmB;IAClC,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,uBAAuB,EAAE,MAAM,CAAC;IAChC,kEAAkE;IAClE,sBAAsB,EAAE,MAAM,CAAC;IAC/B,yEAAyE;IACzE,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wCAAwC;AACxC,MAAM,WAAW,qBAAqB;IACpC,yEAAyE;IACzE,OAAO,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,YAAY,EAAE,gBAAgB,CAAC;IAC/B,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,kCAAkC;IAClC,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,mCAAmC;IACnC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC5E,2CAA2C;IAC3C,OAAO,EAAE,oBAAoB,CAAC;IAC9B,qCAAqC;IACrC,WAAW,EAAE,wBAAwB,CAAC;IACtC,qEAAqE;IACrE,WAAW,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9B,iDAAiD;IACjD,MAAM,EAAE,mBAAmB,CAAC;CAC7B;AAED,4EAA4E;AAC5E,MAAM,WAAW,4BAA4B;IAC3C;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,oFAAoF;IACpF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kFAAkF;IAClF,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,4BAA4B,GACjC,qBAAqB,CAyDvB;AAED,wDAAwD;AACxD,MAAM,WAAW,kBAAkB;IACjC,yDAAyD;IACzD,KAAK,EAAE,OAAO,CAAC;IACf,yEAAyE;IACzE,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAOD;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,CA+EhF"}