@quantakrypto/core 0.4.4 → 0.6.0

package/dist/report.js

@@ -1,8 +1,24 @@
 import { VERSION } from "./version.js";
 import { SEVERITY_ORDER, sarifLevel } from "./severity.js";
 import { ANALYZABLE_LANGUAGES_LABEL } from "./detect-utils.js";
-import { remediationFor, remediationForTier } from "./remediation.js";
+import { remediationFor, remediationForTier, remediationForProfile } from "./remediation.js";
 import { fingerprintFinding } from "./baseline.js";
+import { findingFingerprint } from "./hndl.js";
+/** The per-finding exposure block emitted in JSON / SARIF, or undefined. */
+function exposureFor(f, hndl) {
+    if (!hndl)
+        return undefined;
+    return hndl.byFingerprint.get(findingFingerprint(f));
+}
+/** The repo HNDL summary block shared by JSON output and the SARIF run. */
+function hndlSummaryBlock(hndl) {
+    return {
+        modelVersion: hndl.modelVersion,
+        horizon: hndl.horizon,
+        summary: hndl.summary,
+        assets: hndl.assets,
+    };
+}
 const SARIF_SCHEMA = "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json";
 const INFORMATION_URI = "https://github.com/quantakrypto/pqc-tools";
 /**
@@ -55,6 +71,16 @@ function sarifRule(spec) {
             : {}),
     };
 }
+/** SARIF result.properties fragment for a finding's HNDL exposure, or empty. */
+function exposureProperties(exposure) {
+    if (!exposure)
+        return {};
+    return {
+        exposureScore: exposure.exposureScore,
+        dataAsset: exposure.dataAsset,
+        exposureRationale: exposure.rationale,
+    };
+}
 /** Serialize a scan result as SARIF 2.1.0. */
 export function toSarif(result, opts) {
     const redactSnippets = opts?.redactSnippets ?? false;
@@ -119,6 +145,10 @@ export function toSarif(result, opts) {
             // edit above it. `quantakrypto/v1` names our scheme.
             partialFingerprints: { "quantakrypto/v1": fingerprintFinding(f) },
             properties: {
+                // Same stable identity mirrored into properties so non-GitHub SARIF
+                // consumers (our platform ingest) can read one uniform `fingerprint`
+                // field across JSON and SARIF without reaching into partialFingerprints.
+                fingerprint: fingerprintFinding(f),
                 category: f.category,
                 severity: f.severity,
                 confidence: f.confidence,
@@ -126,6 +156,7 @@ export function toSarif(result, opts) {
                 ...(f.algorithm ? { algorithm: f.algorithm } : {}),
                 ...(f.remediation ? { remediation: f.remediation } : {}),
                 ...(f.cwe ? { cwe: f.cwe } : {}),
+                ...exposureProperties(exposureFor(f, opts?.hndl)),
             },
             ...(f.cwe
                 ? {
@@ -178,6 +209,7 @@ export function toSarif(result, opts) {
                     },
                 },
                 ...(taxonomies.length > 0 ? { taxonomies } : {}),
+                ...(opts?.hndl ? { properties: { hndl: hndlSummaryBlock(opts.hndl) } } : {}),
                 results,
             },
         ],
@@ -201,6 +233,7 @@ function securitySeverity(severity) {
 /** Serialize a scan result as a plain JSON-friendly object. */
 export function toJson(result, opts) {
     const redactSnippets = opts?.redactSnippets ?? false;
+    const hndl = opts?.hndl;
     return {
         toolVersion: result.toolVersion,
         root: result.root,
@@ -216,25 +249,48 @@ export function toJson(result, opts) {
             byCategory: result.inventory.byCategory,
             byAlgorithm: result.inventory.byAlgorithm,
         },
-        findings: result.findings.map((f) => ({
-            ruleId: f.ruleId,
-            title: f.title,
-            category: f.category,
-            severity: f.severity,
-            confidence: f.confidence,
-            algorithm: f.algorithm,
-            hndl: f.hndl,
-            message: f.message,
-            remediation: f.remediation,
-            cwe: f.cwe,
-            location: {
-                file: f.location.file,
-                line: f.location.line,
-                column: f.location.column,
-                endLine: f.location.endLine,
-                snippet: emittedSnippet(f, redactSnippets),
-            },
-        })),
+        ...(hndl ? { hndl: hndlSummaryBlock(hndl) } : {}),
+        findings: result.findings.map((f) => {
+            const exposure = exposureFor(f, hndl);
+            return {
+                // Stable, line-INSENSITIVE identity of the finding: sha256 of
+                // ruleId | normalized-POSIX-repo-relative-path | normalized-snippet
+                // (the SARIF partialFingerprints trick, line number deliberately
+                // excluded). Reused verbatim from the baseline module so JSON identity,
+                // SARIF partialFingerprints, and the baseline suppression set are one and
+                // the same value. A line move does NOT change it; when no snippet context
+                // exists it falls back to ruleId|path. This is the cross-run identity the
+                // platform keys posture drift on.
+                fingerprint: fingerprintFinding(f),
+                ruleId: f.ruleId,
+                title: f.title,
+                category: f.category,
+                severity: f.severity,
+                confidence: f.confidence,
+                algorithm: f.algorithm,
+                hndl: f.hndl,
+                message: f.message,
+                remediation: f.remediation,
+                cwe: f.cwe,
+                location: {
+                    file: f.location.file,
+                    line: f.location.line,
+                    column: f.location.column,
+                    endLine: f.location.endLine,
+                    snippet: emittedSnippet(f, redactSnippets),
+                },
+                ...(exposure
+                    ? {
+                        exposure: {
+                            fingerprint: exposure.fingerprint,
+                            exposureScore: exposure.exposureScore,
+                            dataAsset: exposure.dataAsset,
+                            rationale: exposure.rationale,
+                        },
+                    }
+                    : {}),
+            };
+        }),
     };
 }
 /* -------------------------------------------------------------------------- */
@@ -369,4 +425,34 @@ export function formatTierGuidance(byAlgorithm, tier) {
     }
     return out;
 }
+/**
+ * Per-family migration targets tailored to a selected {@link StandardsProfile}
+ * (`--profile`). Unlike {@link formatTierGuidance} (CNSA-tier only), this surfaces the
+ * regime's parameter sets AND its hybrid stance — required (ANSSI/BSI) vs recommended
+ * (NIST/NCSC) vs optional (CNSA 2.0) — so guidance isn't regime-wrong. Returns plain
+ * (un-coloured) lines; the caller styles them.
+ */
+export function formatProfileGuidance(byAlgorithm, profile) {
+    const out = [`${profile.name} migration targets:`];
+    const seen = new Set();
+    for (const [k, n] of Object.entries(byAlgorithm)) {
+        if (n <= 0)
+            continue;
+        const fam = k;
+        if (fam === "unknown" || !remediationFor(fam))
+            continue; // skip unmapped families
+        const rem = remediationForProfile(fam, profile);
+        if (seen.has(rem.recommendation))
+            continue;
+        seen.add(rem.recommendation);
+        out.push(`  ${fam} → ${rem.recommendation}`);
+    }
+    const stance = profile.hybridStance === "required"
+        ? "requires classical+PQC hybridization"
+        : profile.hybridStance === "recommended"
+            ? "recommends hybridization"
+            : "does not require hybridization";
+    out.push(`  ${profile.authority} ${stance}; classical public-key crypto disallowed after ${profile.disallowAfter} (${profile.citation}).`);
+    return out;
+}
 //# sourceMappingURL=report.js.map

package/dist/report.js.map

@@ -1 +1 @@
-{"version":3,"file":"report.js","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AA4BnD,MAAM,YAAY,GAChB,gGAAgG,CAAC;AAEnG,MAAM,eAAe,GAAG,2CAA2C,CAAC;AAEpE;;;;GAIG;AACH,SAAS,cAAc,CAAC,CAAU,EAAE,cAAuB;IACzD,IAAI,cAAc,IAAI,CAAC,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACpD,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;AAC5B,CAAC;AAED,6FAA6F;AAC7F,SAAS,SAAS,CAAC,QAAkB;IACnC,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,GAAG,CAAC;QACb,KAAK,MAAM;YACT,OAAO,EAAE,CAAC;QACZ,KAAK,QAAQ;YACX,OAAO,EAAE,CAAC;QACZ,KAAK,KAAK;YACR,OAAO,EAAE,CAAC;QACZ;YACE,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,SAAS,SAAS,CAAC,IAUlB;IACC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,IAAI,EAAE,IAAI,CAAC,EAAE;QACb,gBAAgB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE;QACtC,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE;QACvC,oBAAoB,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;QAC1F,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,gBAAgB,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,UAAU,EAAE;YACV,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,mBAAmB,EAAE,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5F,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD;QACD,GAAG,CAAC,IAAI,CAAC,GAAG;YACV,CAAC,CAAC;gBACE,aAAa,EAAE;oBACb,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE;iBAClF;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,OAAO,CAAC,MAAkB,EAAE,IAAoB;IAC9D,MAAM,cAAc,GAAG,IAAI,EAAE,cAAc,IAAI,KAAK,CAAC;IACrD,6EAA6E;IAC7E,+EAA+E;IAC/E,6EAA6E;IAC7E,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,MAAM,KAAK,GAAmC,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAElC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;QACpC,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,SAAS;QAClC,IAAI,CAAC,CAAC,GAAG;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9B,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAClC,KAAK,CAAC,IAAI,CACR,SAAS,CAAC;YACR,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CACH,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,GAAG;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,SAAS;QACtC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtC,KAAK,CAAC,IAAI,CACR,SAAS,CAAC;YACR,EAAE,EAAE,CAAC,CAAC,MAAM;YACZ,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACxC,MAAM,MAAM,GAA2B,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtE,IAAI,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ;YAAE,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAClF,IAAI,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,KAAK,QAAQ;YAAE,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;QAChF,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAElD,OAAO;YACL,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YAClC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;YAC5B,gEAAgE;YAChE,sEAAsE;YACtE,wEAAwE;YACxE,wEAAwE;YACxE,qDAAqD;YACrD,mBAAmB,EAAE,EAAE,iBAAiB,EAAE,kBAAkB,CAAC,CAAC,CAAC,EAAE;YACjE,UAAU,EAAE;gBACV,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjC;YACD,GAAG,CAAC,CAAC,CAAC,GAAG;gBACP,CAAC,CAAC;oBACE,IAAI,EAAE;wBACJ;4BACE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;yBACtD;qBACF;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,SAAS,EAAE;gBACT;oBACE,gBAAgB,EAAE;wBAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE;wBAC1C,MAAM,EAAE;4BACN,GAAG,MAAM;4BACT,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBACnD;qBACF;iBACF;aACF;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,MAAM,UAAU,GACd,OAAO,CAAC,IAAI,GAAG,CAAC;QACd,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,KAAK;gBACX,cAAc,EAAE,wBAAwB;gBACxC,YAAY,EAAE,OAAO;gBACrB,gBAAgB,EAAE,EAAE,IAAI,EAAE,uCAAuC,EAAE;gBACnE,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;oBACrC,EAAE;oBACF,OAAO,EAAE,0CAA0C,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO;iBAClF,CAAC,CAAC;aACJ;SACF;QACH,CAAC,CAAC,EAAE,CAAC;IAET,OAAO;QACL,OAAO,EAAE,YAAY;QACrB,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,OAAO;wBACb,cAAc,EAAE,eAAe;wBAC/B,OAAO,EAAE,MAAM,CAAC,WAAW,IAAI,OAAO;wBACtC,KAAK;qBACN;iBACF;gBACD,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChD,OAAO;aACR;SACF;KACF,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAS,gBAAgB,CAAC,QAAkB;IAC1C,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,KAAK,CAAC;QACf,KAAK,MAAM;YACT,OAAO,KAAK,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,KAAK,CAAC;QACf,KAAK,KAAK;YACR,OAAO,KAAK,CAAC;QACf;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,MAAM,CAAC,MAAkB,EAAE,IAAoB;IAC7D,MAAM,cAAc,GAAG,IAAI,EAAE,cAAc,IAAI,KAAK,CAAC;IACrD,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,SAAS,EAAE;YACT,cAAc,EAAE,MAAM,CAAC,SAAS,CAAC,cAAc;YAC/C,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,SAAS;YACrC,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU;YACvC,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU;YACvC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW;SAC1C;QACD,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpC,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,QAAQ,EAAE;gBACR,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI;gBACrB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI;gBACrB,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM;gBACzB,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO;gBAC3B,OAAO,EAAE,cAAc,CAAC,CAAC,EAAE,cAAc,CAAC;aAC3C;SACF,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAEhF,8DAA8D;AAC9D,MAAM,IAAI,GAAG;IACX,KAAK,EAAE,SAAS;IAChB,IAAI,EAAE,SAAS;IACf,GAAG,EAAE,SAAS;IACd,GAAG,EAAE,UAAU;IACf,KAAK,EAAE,UAAU;IACjB,MAAM,EAAE,UAAU;IAClB,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,UAAU;IACnB,IAAI,EAAE,UAAU;CACR,CAAC;AAEX,SAAS,aAAa,CAAC,GAAa;IAClC,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,UAAU;YACb,OAAO,IAAI,CAAC,OAAO,CAAC;QACtB,KAAK,MAAM;YACT,OAAO,IAAI,CAAC,GAAG,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,KAAK,KAAK;YACR,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB;YACE,OAAO,IAAI,CAAC,GAAG,CAAC;IACpB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IACnC,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC;IACpC,OAAO,IAAI,CAAC,GAAG,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAkB,EAClB,OAAkD;IAElD,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,KAAK,CAAC;IACtC,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,IAAY,EAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAEjG,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC;IAE7B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,uCAAuC,CAAC,CAAC,CAAC;IAClE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,MAAM,CAAC,WAAW,YAAY,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,0BAA0B;IAC1B,KAAK,CAAC,IAAI,CACR,oBAAoB,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,cAAc,MAAM,CAAC,EAAE,CACtG,CAAC;IACF,MAAM,QAAQ,GACZ,MAAM,CAAC,aAAa,KAAK,SAAS;QAChC,CAAC,CAAC,gBAAgB,0BAA0B,MAAM,MAAM,CAAC,aAAa,EAAE;QACxE,CAAC,CAAC,EAAE,CAAC;IACT,KAAK,CAAC,IAAI,CACR,oBAAoB,MAAM,CAAC,YAAY,GAAG,QAAQ,gBAAgB,MAAM,CAAC,QAAQ,CAAC,MAAM,oBAAoB,CAAC,CAC3G,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EACzC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CACtB,EAAE,CACJ,CAAC;IACF,sFAAsF;IACtF,IAAI,MAAM,CAAC,aAAa,KAAK,CAAC,IAAI,MAAM,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;QAC1D,KAAK,CAAC,IAAI,CACR,CAAC,CACC,IAAI,CAAC,MAAM,EACX,sDAAsD,0BAA0B,yDAAyD,CAC1I,CACF,CAAC;IACJ,CAAC;IACD,gFAAgF;IAChF,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC;IAChC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,IAAI,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC,EAAE,CAAC;QAC9D,KAAK,CAAC,IAAI,CACR,CAAC,CACC,IAAI,CAAC,MAAM,EACX,aAAa,IAAI,CAAC,UAAU,gBAAgB,IAAI,CAAC,eAAe,mDAAmD,CACpH,CACF,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,sBAAsB;IACtB,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7E,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAClD,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,iBAAiB,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAE9F,uBAAuB;IACvB,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;SAC9C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjC,IAAI,SAAS,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,kDAAkD,CAAC,CAAC,CAAC;QAC9E,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,iFAAiF;IACjF,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAClF,CAAC;IACF,MAAM,SAAS,GAAG,EAAE,CAAC;IACrB,KAAK,CAAC,IAAI,CACR,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAC1F,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,GAC/C,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAChD,EAAE,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,EAAE,CAAC,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,CAAC,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,MAAM,CAAC,MAAM,GAAG,SAAS,QAAQ,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,IAAI,GAAG,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CACR,CAAC,CACC,IAAI,CAAC,MAAM,EACX,SAAS,GAAG,CAAC,SAAS,4DAA4D;YAChF,oFAAoF;YACpF,gFAAgF,CACnF,CACF,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,EAAE,IAAI,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,kBAAkB,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,WAAmC,EACnC,IAAkB;IAElB,MAAM,KAAK,GAAG,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,yBAAyB,CAAC;IAC1F,MAAM,GAAG,GAAa,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACrB,MAAM,GAAG,GAAG,CAAoB,CAAC;QACjC,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,yBAAyB;QAClF,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC;YAAE,SAAS;QAC3C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,MAAM,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,GAAG,CAAC,IAAI,CACN,0HAA0H,CAC3H,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC","sourcesContent":["/**\n * Reporters: turn a {@link ScanResult} into SARIF 2.1.0, a clean JSON object,\n * or a human-readable text summary. No third-party dependencies — ANSI colour\n * is emitted with raw escape codes and is off by default.\n */\nimport type { AlgorithmFamily, Finding, RuleMeta, ScanResult, Severity } from \"./types.js\";\nimport { VERSION } from \"./version.js\";\nimport { SEVERITY_ORDER, sarifLevel } from \"./severity.js\";\nimport { ANALYZABLE_LANGUAGES_LABEL } from \"./detect-utils.js\";\nimport { remediationFor, remediationForTier } from \"./remediation.js\";\nimport type { SecurityTier } from \"./remediation.js\";\nimport { fingerprintFinding } from \"./baseline.js\";\n\n/** Minimal SARIF 2.1.0 log shape (kept permissive on purpose). */\nexport interface SarifLog {\n  $schema: string;\n  version: \"2.1.0\";\n  runs: unknown[];\n}\n\n/** Options shared by the structured reporters ({@link toSarif} / {@link toJson}). */\nexport interface ReportOptions {\n  /**\n   * Omit `location.snippet` from every finding in the output. Defaults to false\n   * (snippets are included). Snippets of `sensitive` findings (e.g. PEM key\n   * blocks, SSH public keys) are ALWAYS omitted regardless of this flag — the\n   * snippet there IS the sensitive value.\n   */\n  redactSnippets?: boolean;\n  /**\n   * Full rule catalog to advertise in SARIF `tool.driver.rules[]`, even for\n   * rules that produced no finding in this run. Pass\n   * `defaultRegistry.ruleCatalog()`. When omitted, only the rules that actually\n   * fired are emitted (the historical behaviour). SARIF-only; ignored by\n   * {@link toJson}.\n   */\n  catalog?: RuleMeta[];\n}\n\nconst SARIF_SCHEMA =\n  \"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json\";\n\nconst INFORMATION_URI = \"https://github.com/quantakrypto/pqc-tools\";\n\n/**\n * Resolve the snippet to emit for a finding, honouring redaction. Sensitive\n * findings (key material) never expose their snippet; otherwise the snippet is\n * dropped only when `redactSnippets` is set.\n */\nfunction emittedSnippet(f: Finding, redactSnippets: boolean): string | undefined {\n  if (redactSnippets || f.sensitive) return undefined;\n  return f.location.snippet;\n}\n\n/** Map our severity to a SARIF rule-level default (used in rules[].defaultConfiguration). */\nfunction sarifRank(severity: Severity): number {\n  switch (severity) {\n    case \"critical\":\n      return 100;\n    case \"high\":\n      return 80;\n    case \"medium\":\n      return 50;\n    case \"low\":\n      return 20;\n    default:\n      return 5;\n  }\n}\n\n/** Build a SARIF `rules[]` entry from a rule's severity/title/message/etc. */\nfunction sarifRule(spec: {\n  id: string;\n  title: string;\n  message: string;\n  severity: Severity;\n  category: string;\n  algorithm?: string;\n  hndl: boolean;\n  cwe?: string;\n  remediation?: string;\n}): Record<string, unknown> {\n  return {\n    id: spec.id,\n    name: spec.id,\n    shortDescription: { text: spec.title },\n    fullDescription: { text: spec.message },\n    defaultConfiguration: { level: sarifLevel(spec.severity), rank: sarifRank(spec.severity) },\n    ...(spec.remediation ? { help: { text: `Remediation: ${spec.remediation}` } } : {}),\n    properties: {\n      category: spec.category,\n      ...(spec.algorithm ? { algorithm: spec.algorithm } : {}),\n      hndl: spec.hndl,\n      ...(spec.cwe ? { cwe: spec.cwe, \"security-severity\": securitySeverity(spec.severity) } : {}),\n      ...(spec.cwe ? { tags: [\"security\", spec.cwe] } : {}),\n    },\n    ...(spec.cwe\n      ? {\n          relationships: [\n            { target: { id: spec.cwe, toolComponent: { name: \"CWE\" } }, kinds: [\"relevant\"] },\n          ],\n        }\n      : {}),\n  };\n}\n\n/** Serialize a scan result as SARIF 2.1.0. */\nexport function toSarif(result: ScanResult, opts?: ReportOptions): SarifLog {\n  const redactSnippets = opts?.redactSnippets ?? false;\n  // Build the rule set and collect the CWE taxa referenced by any rule. When a\n  // full catalog is supplied, advertise every rule (even ones that didn't fire);\n  // otherwise emit one rule per ruleId encountered (the historical behaviour).\n  const ruleIndex = new Map<string, number>();\n  const rules: Array<Record<string, unknown>> = [];\n  const cweTaxa = new Set<string>();\n\n  for (const r of opts?.catalog ?? []) {\n    if (ruleIndex.has(r.id)) continue;\n    if (r.cwe) cweTaxa.add(r.cwe);\n    ruleIndex.set(r.id, rules.length);\n    rules.push(\n      sarifRule({\n        id: r.id,\n        title: r.title,\n        message: r.message,\n        severity: r.severity,\n        category: r.category,\n        algorithm: r.algorithm,\n        hndl: r.hndl,\n        cwe: r.cwe,\n        remediation: r.remediation,\n      }),\n    );\n  }\n\n  for (const f of result.findings) {\n    if (f.cwe) cweTaxa.add(f.cwe);\n    if (ruleIndex.has(f.ruleId)) continue;\n    ruleIndex.set(f.ruleId, rules.length);\n    rules.push(\n      sarifRule({\n        id: f.ruleId,\n        title: f.title,\n        message: f.message,\n        severity: f.severity,\n        category: f.category,\n        algorithm: f.algorithm,\n        hndl: f.hndl,\n        cwe: f.cwe,\n        remediation: f.remediation,\n      }),\n    );\n  }\n\n  const results = result.findings.map((f) => {\n    const region: Record<string, number> = { startLine: f.location.line };\n    if (typeof f.location.column === \"number\") region.startColumn = f.location.column;\n    if (typeof f.location.endLine === \"number\") region.endLine = f.location.endLine;\n    const snippet = emittedSnippet(f, redactSnippets);\n\n    return {\n      ruleId: f.ruleId,\n      ruleIndex: ruleIndex.get(f.ruleId),\n      level: sarifLevel(f.severity),\n      message: { text: f.message },\n      // Line-INSENSITIVE fingerprint (the same one the baseline uses:\n      // sha256 of ruleId|file|normalizedSnippet). GitHub code scanning keys\n      // alert identity + dedup off partialFingerprints, so a finding survives\n      // line shifts and reformatting instead of re-alerting as \"new\" on every\n      // edit above it. `quantakrypto/v1` names our scheme.\n      partialFingerprints: { \"quantakrypto/v1\": fingerprintFinding(f) },\n      properties: {\n        category: f.category,\n        severity: f.severity,\n        confidence: f.confidence,\n        hndl: f.hndl,\n        ...(f.algorithm ? { algorithm: f.algorithm } : {}),\n        ...(f.remediation ? { remediation: f.remediation } : {}),\n        ...(f.cwe ? { cwe: f.cwe } : {}),\n      },\n      ...(f.cwe\n        ? {\n            taxa: [\n              {\n                target: { id: f.cwe, toolComponent: { name: \"CWE\" } },\n              },\n            ],\n          }\n        : {}),\n      locations: [\n        {\n          physicalLocation: {\n            artifactLocation: { uri: f.location.file },\n            region: {\n              ...region,\n              ...(snippet ? { snippet: { text: snippet } } : {}),\n            },\n          },\n        },\n      ],\n    };\n  });\n\n  // CWE taxonomy component (SARIF taxonomies), referenced by rules + results.\n  const taxonomies =\n    cweTaxa.size > 0\n      ? [\n          {\n            name: \"CWE\",\n            informationUri: \"https://cwe.mitre.org/\",\n            organization: \"MITRE\",\n            shortDescription: { text: \"The MITRE Common Weakness Enumeration\" },\n            taxa: [...cweTaxa].sort().map((id) => ({\n              id,\n              helpUri: `https://cwe.mitre.org/data/definitions/${id.replace(/^CWE-/, \"\")}.html`,\n            })),\n          },\n        ]\n      : [];\n\n  return {\n    $schema: SARIF_SCHEMA,\n    version: \"2.1.0\",\n    runs: [\n      {\n        tool: {\n          driver: {\n            name: \"qScan\",\n            informationUri: INFORMATION_URI,\n            version: result.toolVersion || VERSION,\n            rules,\n          },\n        },\n        ...(taxonomies.length > 0 ? { taxonomies } : {}),\n        results,\n      },\n    ],\n  };\n}\n\n/** GitHub-code-scanning `security-severity` (0–10) derived from our severity. */\nfunction securitySeverity(severity: Severity): string {\n  switch (severity) {\n    case \"critical\":\n      return \"9.5\";\n    case \"high\":\n      return \"8.0\";\n    case \"medium\":\n      return \"5.0\";\n    case \"low\":\n      return \"3.0\";\n    default:\n      return \"1.0\";\n  }\n}\n\n/** Serialize a scan result as a plain JSON-friendly object. */\nexport function toJson(result: ScanResult, opts?: ReportOptions): Record<string, unknown> {\n  const redactSnippets = opts?.redactSnippets ?? false;\n  return {\n    toolVersion: result.toolVersion,\n    root: result.root,\n    startedAt: result.startedAt,\n    finishedAt: result.finishedAt,\n    filesScanned: result.filesScanned,\n    ...(result.analyzedFiles !== undefined ? { analyzedFiles: result.analyzedFiles } : {}),\n    ...(result.diagnostics ? { diagnostics: result.diagnostics } : {}),\n    inventory: {\n      readinessScore: result.inventory.readinessScore,\n      hndlCount: result.inventory.hndlCount,\n      bySeverity: result.inventory.bySeverity,\n      byCategory: result.inventory.byCategory,\n      byAlgorithm: result.inventory.byAlgorithm,\n    },\n    findings: result.findings.map((f) => ({\n      ruleId: f.ruleId,\n      title: f.title,\n      category: f.category,\n      severity: f.severity,\n      confidence: f.confidence,\n      algorithm: f.algorithm,\n      hndl: f.hndl,\n      message: f.message,\n      remediation: f.remediation,\n      cwe: f.cwe,\n      location: {\n        file: f.location.file,\n        line: f.location.line,\n        column: f.location.column,\n        endLine: f.location.endLine,\n        snippet: emittedSnippet(f, redactSnippets),\n      },\n    })),\n  };\n}\n\n/* -------------------------------------------------------------------------- */\n/* Human-readable summary                                                      */\n/* -------------------------------------------------------------------------- */\n\n/** Raw ANSI codes (no chalk). Disabled when colour is off. */\nconst ANSI = {\n  reset: \"\\x1b[0m\",\n  bold: \"\\x1b[1m\",\n  dim: \"\\x1b[2m\",\n  red: \"\\x1b[31m\",\n  green: \"\\x1b[32m\",\n  yellow: \"\\x1b[33m\",\n  blue: \"\\x1b[34m\",\n  magenta: \"\\x1b[35m\",\n  cyan: \"\\x1b[36m\",\n} as const;\n\nfunction severityColor(sev: Severity): string {\n  switch (sev) {\n    case \"critical\":\n      return ANSI.magenta;\n    case \"high\":\n      return ANSI.red;\n    case \"medium\":\n      return ANSI.yellow;\n    case \"low\":\n      return ANSI.blue;\n    default:\n      return ANSI.dim;\n  }\n}\n\nfunction scoreColor(score: number): string {\n  if (score >= 80) return ANSI.green;\n  if (score >= 50) return ANSI.yellow;\n  return ANSI.red;\n}\n\n/**\n * Render a human-readable summary of a scan result. Colour is off by default;\n * pass `{ color: true }` to emit ANSI escape codes.\n */\nexport function formatSummary(\n  result: ScanResult,\n  options?: { color?: boolean; tier?: SecurityTier },\n): string {\n  const color = options?.color ?? false;\n  const c = (code: string, text: string): string => (color ? `${code}${text}${ANSI.reset}` : text);\n\n  const lines: string[] = [];\n  const inv = result.inventory;\n\n  lines.push(c(ANSI.bold, \"qScan — post-quantum readiness report\"));\n  lines.push(c(ANSI.dim, `tool v${result.toolVersion} · root: ${result.root}`));\n  lines.push(\"\");\n\n  // Readiness score banner.\n  lines.push(\n    `Readiness score: ${c(`${ANSI.bold}${scoreColor(inv.readinessScore)}`, `${inv.readinessScore}/100`)}`,\n  );\n  const analyzed =\n    result.analyzedFiles !== undefined\n      ? `   Analyzed (${ANALYZABLE_LANGUAGES_LABEL}): ${result.analyzedFiles}`\n      : \"\";\n  lines.push(\n    `Files scanned:   ${result.filesScanned}${analyzed}   Findings: ${result.findings.length}   HNDL-exposed: ${c(\n      inv.hndlCount > 0 ? ANSI.red : ANSI.green,\n      String(inv.hndlCount),\n    )}`,\n  );\n  // Coverage honesty: a score over zero analyzable files is not a clean bill of health.\n  if (result.analyzedFiles === 0 && result.filesScanned > 0) {\n    lines.push(\n      c(\n        ANSI.yellow,\n        `Note: 0 files were in a supported source language (${ANALYZABLE_LANGUAGES_LABEL}) — the readiness score does not reflect this codebase.`,\n      ),\n    );\n  }\n  // Coverage diagnostics: skipped files mean the finding count may be incomplete.\n  const diag = result.diagnostics;\n  if (diag && (diag.unreadable > 0 || diag.skippedMinified > 0)) {\n    lines.push(\n      c(\n        ANSI.yellow,\n        `Coverage: ${diag.unreadable} unreadable, ${diag.skippedMinified} skipped as minified — results may be incomplete.`,\n      ),\n    );\n  }\n  lines.push(\"\");\n\n  // Severity breakdown.\n  const sevParts = SEVERITY_ORDER.filter((s) => inv.bySeverity[s] > 0).map((s) =>\n    c(severityColor(s), `${s}: ${inv.bySeverity[s]}`),\n  );\n  lines.push(`By severity:  ${sevParts.length ? sevParts.join(\"   \") : c(ANSI.green, \"none\")}`);\n\n  // Algorithm breakdown.\n  const algoParts = Object.entries(inv.byAlgorithm)\n    .sort((a, b) => b[1] - a[1])\n    .map(([k, v]) => `${k}: ${v}`);\n  if (algoParts.length) lines.push(`By algorithm: ${algoParts.join(\"   \")}`);\n  lines.push(\"\");\n\n  if (result.findings.length === 0) {\n    lines.push(c(ANSI.green, \"No classical asymmetric cryptography detected. ✓\"));\n    return lines.join(\"\\n\");\n  }\n\n  // Top findings, grouped by severity (most severe first), capped for readability.\n  const sorted = [...result.findings].sort(\n    (a, b) => SEVERITY_ORDER.indexOf(a.severity) - SEVERITY_ORDER.indexOf(b.severity),\n  );\n  const MAX_SHOWN = 25;\n  lines.push(\n    c(ANSI.bold, `Top findings (${Math.min(MAX_SHOWN, sorted.length)} of ${sorted.length}):`),\n  );\n\n  for (const f of sorted.slice(0, MAX_SHOWN)) {\n    const loc = `${f.location.file}:${f.location.line}${\n      f.location.column ? `:${f.location.column}` : \"\"\n    }`;\n    const tag = c(severityColor(f.severity), `[${f.severity}]`);\n    const hndl = f.hndl ? c(ANSI.red, \" (HNDL)\") : \"\";\n    lines.push(`  ${tag} ${f.title}${hndl}`);\n    lines.push(c(ANSI.dim, `      ${loc} — ${f.message}`));\n    if (f.remediation) lines.push(c(ANSI.cyan, `      → ${f.remediation}`));\n  }\n\n  if (sorted.length > MAX_SHOWN) {\n    lines.push(c(ANSI.dim, `  …and ${sorted.length - MAX_SHOWN} more.`));\n  }\n\n  lines.push(\"\");\n  if (inv.hndlCount > 0) {\n    lines.push(\n      c(\n        ANSI.yellow,\n        `Note: ${inv.hndlCount} finding(s) are exposed to \"harvest now, decrypt later\" — ` +\n          \"encrypted traffic captured today can be decrypted once a quantum computer exists. \" +\n          \"Prioritise migrating key exchange / encryption to hybrid PQC (X25519MLKEM768).\",\n      ),\n    );\n  }\n\n  if (options?.tier) {\n    lines.push(\"\", ...formatTierGuidance(inv.byAlgorithm, options.tier));\n  }\n\n  return lines.join(\"\\n\");\n}\n\n/**\n * Per-family migration targets for a CNSA security tier — surfaces the otherwise\n * library-only {@link remediationForTier} in human reports. Category 5 shows the\n * ML-KEM-1024 / ML-DSA-87 sets CNSA 2.0 mandates for national-security systems and\n * long-lived secrets. Returns plain (un-coloured) lines; the caller styles them.\n */\nexport function formatTierGuidance(\n  byAlgorithm: Record<string, number>,\n  tier: SecurityTier,\n): string[] {\n  const label = tier === \"category-5\" ? \"CNSA 2.0 (Category 5)\" : \"Category 3 (commercial)\";\n  const out: string[] = [`${label} migration targets:`];\n  const seen = new Set<string>();\n  for (const [k, n] of Object.entries(byAlgorithm)) {\n    if (n <= 0) continue;\n    const fam = k as AlgorithmFamily;\n    if (fam === \"unknown\" || !remediationFor(fam)) continue; // skip unmapped families\n    const rem = remediationForTier(fam, tier);\n    if (seen.has(rem.recommendation)) continue;\n    seen.add(rem.recommendation);\n    out.push(`  ${fam} → ${rem.recommendation}`);\n  }\n  if (tier === \"category-5\") {\n    out.push(\n      \"  CNSA 2.0 mandates ML-KEM-1024 / ML-DSA-87 for national-security systems and long-lived secrets (2030/2033 milestones).\",\n    );\n  }\n  return out;\n}\n"]}
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAG7F,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAoC/C,4EAA4E;AAC5E,SAAS,WAAW,CAAC,CAAU,EAAE,IAA4B;IAC3D,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,2EAA2E;AAC3E,SAAS,gBAAgB,CAAC,IAAgB;IACxC,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC;AACJ,CAAC;AAED,MAAM,YAAY,GAChB,gGAAgG,CAAC;AAEnG,MAAM,eAAe,GAAG,2CAA2C,CAAC;AAEpE;;;;GAIG;AACH,SAAS,cAAc,CAAC,CAAU,EAAE,cAAuB;IACzD,IAAI,cAAc,IAAI,CAAC,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACpD,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;AAC5B,CAAC;AAED,6FAA6F;AAC7F,SAAS,SAAS,CAAC,QAAkB;IACnC,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,GAAG,CAAC;QACb,KAAK,MAAM;YACT,OAAO,EAAE,CAAC;QACZ,KAAK,QAAQ;YACX,OAAO,EAAE,CAAC;QACZ,KAAK,KAAK;YACR,OAAO,EAAE,CAAC;QACZ;YACE,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,SAAS,SAAS,CAAC,IAUlB;IACC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,IAAI,EAAE,IAAI,CAAC,EAAE;QACb,gBAAgB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE;QACtC,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE;QACvC,oBAAoB,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;QAC1F,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,gBAAgB,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,UAAU,EAAE;YACV,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,mBAAmB,EAAE,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5F,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD;QACD,GAAG,CAAC,IAAI,CAAC,GAAG;YACV,CAAC,CAAC;gBACE,aAAa,EAAE;oBACb,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,UAAU,CAAC,EAAE;iBAClF;aACF;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,SAAS,kBAAkB,CAAC,QAAqC;IAC/D,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzB,OAAO;QACL,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,iBAAiB,EAAE,QAAQ,CAAC,SAAS;KACtC,CAAC;AACJ,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,OAAO,CAAC,MAAkB,EAAE,IAAoB;IAC9D,MAAM,cAAc,GAAG,IAAI,EAAE,cAAc,IAAI,KAAK,CAAC;IACrD,6EAA6E;IAC7E,+EAA+E;IAC/E,6EAA6E;IAC7E,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC5C,MAAM,KAAK,GAAmC,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAElC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;QACpC,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,SAAS;QAClC,IAAI,CAAC,CAAC,GAAG;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9B,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAClC,KAAK,CAAC,IAAI,CACR,SAAS,CAAC;YACR,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CACH,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,IAAI,CAAC,CAAC,GAAG;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,SAAS;QACtC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtC,KAAK,CAAC,IAAI,CACR,SAAS,CAAC;YACR,EAAE,EAAE,CAAC,CAAC,MAAM;YACZ,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CACH,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACxC,MAAM,MAAM,GAA2B,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtE,IAAI,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,QAAQ;YAAE,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAClF,IAAI,OAAO,CAAC,CAAC,QAAQ,CAAC,OAAO,KAAK,QAAQ;YAAE,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;QAChF,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAElD,OAAO;YACL,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YAClC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;YAC5B,gEAAgE;YAChE,sEAAsE;YACtE,wEAAwE;YACxE,wEAAwE;YACxE,qDAAqD;YACrD,mBAAmB,EAAE,EAAE,iBAAiB,EAAE,kBAAkB,CAAC,CAAC,CAAC,EAAE;YACjE,UAAU,EAAE;gBACV,oEAAoE;gBACpE,qEAAqE;gBACrE,yEAAyE;gBACzE,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC;gBAClC,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChC,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;aAClD;YACD,GAAG,CAAC,CAAC,CAAC,GAAG;gBACP,CAAC,CAAC;oBACE,IAAI,EAAE;wBACJ;4BACE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;yBACtD;qBACF;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,SAAS,EAAE;gBACT;oBACE,gBAAgB,EAAE;wBAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE;wBAC1C,MAAM,EAAE;4BACN,GAAG,MAAM;4BACT,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBACnD;qBACF;iBACF;aACF;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,4EAA4E;IAC5E,MAAM,UAAU,GACd,OAAO,CAAC,IAAI,GAAG,CAAC;QACd,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,KAAK;gBACX,cAAc,EAAE,wBAAwB;gBACxC,YAAY,EAAE,OAAO;gBACrB,gBAAgB,EAAE,EAAE,IAAI,EAAE,uCAAuC,EAAE;gBACnE,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;oBACrC,EAAE;oBACF,OAAO,EAAE,0CAA0C,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO;iBAClF,CAAC,CAAC;aACJ;SACF;QACH,CAAC,CAAC,EAAE,CAAC;IAET,OAAO;QACL,OAAO,EAAE,YAAY;QACrB,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,OAAO;wBACb,cAAc,EAAE,eAAe;wBAC/B,OAAO,EAAE,MAAM,CAAC,WAAW,IAAI,OAAO;wBACtC,KAAK;qBACN;iBACF;gBACD,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChD,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5E,OAAO;aACR;SACF;KACF,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAS,gBAAgB,CAAC,QAAkB;IAC1C,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,KAAK,CAAC;QACf,KAAK,MAAM;YACT,OAAO,KAAK,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,KAAK,CAAC;QACf,KAAK,KAAK;YACR,OAAO,KAAK,CAAC;QACf;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,MAAM,CAAC,MAAkB,EAAE,IAAoB;IAC7D,MAAM,cAAc,GAAG,IAAI,EAAE,cAAc,IAAI,KAAK,CAAC;IACrD,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC;IACxB,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,SAAS,EAAE;YACT,cAAc,EAAE,MAAM,CAAC,SAAS,CAAC,cAAc;YAC/C,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,SAAS;YACrC,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU;YACvC,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU;YACvC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW;SAC1C;QACD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAClC,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YACtC,OAAO;gBACL,8DAA8D;gBAC9D,oEAAoE;gBACpE,iEAAiE;gBACjE,wEAAwE;gBACxE,0EAA0E;gBAC1E,0EAA0E;gBAC1E,0EAA0E;gBAC1E,kCAAkC;gBAClC,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC;gBAClC,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,GAAG,EAAE,CAAC,CAAC,GAAG;gBACV,QAAQ,EAAE;oBACR,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI;oBACrB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI;oBACrB,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM;oBACzB,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO;oBAC3B,OAAO,EAAE,cAAc,CAAC,CAAC,EAAE,cAAc,CAAC;iBAC3C;gBACD,GAAG,CAAC,QAAQ;oBACV,CAAC,CAAC;wBACE,QAAQ,EAAE;4BACR,WAAW,EAAE,QAAQ,CAAC,WAAW;4BACjC,aAAa,EAAE,QAAQ,CAAC,aAAa;4BACrC,SAAS,EAAE,QAAQ,CAAC,SAAS;4BAC7B,SAAS,EAAE,QAAQ,CAAC,SAAS;yBAC9B;qBACF;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC,CAAC;KACH,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAEhF,8DAA8D;AAC9D,MAAM,IAAI,GAAG;IACX,KAAK,EAAE,SAAS;IAChB,IAAI,EAAE,SAAS;IACf,GAAG,EAAE,SAAS;IACd,GAAG,EAAE,UAAU;IACf,KAAK,EAAE,UAAU;IACjB,MAAM,EAAE,UAAU;IAClB,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,UAAU;IACnB,IAAI,EAAE,UAAU;CACR,CAAC;AAEX,SAAS,aAAa,CAAC,GAAa;IAClC,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,UAAU;YACb,OAAO,IAAI,CAAC,OAAO,CAAC;QACtB,KAAK,MAAM;YACT,OAAO,IAAI,CAAC,GAAG,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,KAAK,KAAK;YACR,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB;YACE,OAAO,IAAI,CAAC,GAAG,CAAC;IACpB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IACnC,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC;IACpC,OAAO,IAAI,CAAC,GAAG,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAkB,EAClB,OAAkD;IAElD,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,KAAK,CAAC;IACtC,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,IAAY,EAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAEjG,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC;IAE7B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,uCAAuC,CAAC,CAAC,CAAC;IAClE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,MAAM,CAAC,WAAW,YAAY,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,0BAA0B;IAC1B,KAAK,CAAC,IAAI,CACR,oBAAoB,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,cAAc,MAAM,CAAC,EAAE,CACtG,CAAC;IACF,MAAM,QAAQ,GACZ,MAAM,CAAC,aAAa,KAAK,SAAS;QAChC,CAAC,CAAC,gBAAgB,0BAA0B,MAAM,MAAM,CAAC,aAAa,EAAE;QACxE,CAAC,CAAC,EAAE,CAAC;IACT,KAAK,CAAC,IAAI,CACR,oBAAoB,MAAM,CAAC,YAAY,GAAG,QAAQ,gBAAgB,MAAM,CAAC,QAAQ,CAAC,MAAM,oBAAoB,CAAC,CAC3G,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EACzC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CACtB,EAAE,CACJ,CAAC;IACF,sFAAsF;IACtF,IAAI,MAAM,CAAC,aAAa,KAAK,CAAC,IAAI,MAAM,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;QAC1D,KAAK,CAAC,IAAI,CACR,CAAC,CACC,IAAI,CAAC,MAAM,EACX,sDAAsD,0BAA0B,yDAAyD,CAC1I,CACF,CAAC;IACJ,CAAC;IACD,gFAAgF;IAChF,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC;IAChC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,IAAI,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC,EAAE,CAAC;QAC9D,KAAK,CAAC,IAAI,CACR,CAAC,CACC,IAAI,CAAC,MAAM,EACX,aAAa,IAAI,CAAC,UAAU,gBAAgB,IAAI,CAAC,eAAe,mDAAmD,CACpH,CACF,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,sBAAsB;IACtB,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7E,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAClD,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,iBAAiB,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAE9F,uBAAuB;IACvB,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;SAC9C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjC,IAAI,SAAS,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,kDAAkD,CAAC,CAAC,CAAC;QAC9E,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,iFAAiF;IACjF,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAClF,CAAC;IACF,MAAM,SAAS,GAAG,EAAE,CAAC;IACrB,KAAK,CAAC,IAAI,CACR,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAC1F,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,GAC/C,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAChD,EAAE,CAAC;QACH,MAAM,GAAG,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,EAAE,CAAC,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC,CAAC,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,MAAM,CAAC,MAAM,GAAG,SAAS,QAAQ,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,IAAI,GAAG,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CACR,CAAC,CACC,IAAI,CAAC,MAAM,EACX,SAAS,GAAG,CAAC,SAAS,4DAA4D;YAChF,oFAAoF;YACpF,gFAAgF,CACnF,CACF,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,EAAE,IAAI,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,kBAAkB,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,WAAmC,EACnC,IAAkB;IAElB,MAAM,KAAK,GAAG,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,yBAAyB,CAAC;IAC1F,MAAM,GAAG,GAAa,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACrB,MAAM,GAAG,GAAG,CAAoB,CAAC;QACjC,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,yBAAyB;QAClF,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC;YAAE,SAAS;QAC3C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,MAAM,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;QAC1B,GAAG,CAAC,IAAI,CACN,0HAA0H,CAC3H,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,WAAmC,EACnC,OAAyB;IAEzB,MAAM,GAAG,GAAa,CAAC,GAAG,OAAO,CAAC,IAAI,qBAAqB,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACrB,MAAM,GAAG,GAAG,CAAoB,CAAC;QACjC,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,yBAAyB;QAClF,MAAM,GAAG,GAAG,qBAAqB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC;YAAE,SAAS;QAC3C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,MAAM,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,MAAM,MAAM,GACV,OAAO,CAAC,YAAY,KAAK,UAAU;QACjC,CAAC,CAAC,sCAAsC;QACxC,CAAC,CAAC,OAAO,CAAC,YAAY,KAAK,aAAa;YACtC,CAAC,CAAC,0BAA0B;YAC5B,CAAC,CAAC,gCAAgC,CAAC;IACzC,GAAG,CAAC,IAAI,CACN,KAAK,OAAO,CAAC,SAAS,IAAI,MAAM,kDAAkD,OAAO,CAAC,aAAa,KAAK,OAAO,CAAC,QAAQ,IAAI,CACjI,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC","sourcesContent":["/**\n * Reporters: turn a {@link ScanResult} into SARIF 2.1.0, a clean JSON object,\n * or a human-readable text summary. No third-party dependencies — ANSI colour\n * is emitted with raw escape codes and is off by default.\n */\nimport type { AlgorithmFamily, Finding, RuleMeta, ScanResult, Severity } from \"./types.js\";\nimport { VERSION } from \"./version.js\";\nimport { SEVERITY_ORDER, sarifLevel } from \"./severity.js\";\nimport { ANALYZABLE_LANGUAGES_LABEL } from \"./detect-utils.js\";\nimport { remediationFor, remediationForTier, remediationForProfile } from \"./remediation.js\";\nimport type { SecurityTier } from \"./remediation.js\";\nimport type { StandardsProfile } from \"./standards-profiles.js\";\nimport { fingerprintFinding } from \"./baseline.js\";\nimport { findingFingerprint } from \"./hndl.js\";\nimport type { FindingExposure, HndlReport } from \"./hndl.js\";\n\n/** Minimal SARIF 2.1.0 log shape (kept permissive on purpose). */\nexport interface SarifLog {\n  $schema: string;\n  version: \"2.1.0\";\n  runs: unknown[];\n}\n\n/** Options shared by the structured reporters ({@link toSarif} / {@link toJson}). */\nexport interface ReportOptions {\n  /**\n   * Omit `location.snippet` from every finding in the output. Defaults to false\n   * (snippets are included). Snippets of `sensitive` findings (e.g. PEM key\n   * blocks, SSH public keys) are ALWAYS omitted regardless of this flag — the\n   * snippet there IS the sensitive value.\n   */\n  redactSnippets?: boolean;\n  /**\n   * Full rule catalog to advertise in SARIF `tool.driver.rules[]`, even for\n   * rules that produced no finding in this run. Pass\n   * `defaultRegistry.ruleCatalog()`. When omitted, only the rules that actually\n   * fired are emitted (the historical behaviour). SARIF-only; ignored by\n   * {@link toJson}.\n   */\n  catalog?: RuleMeta[];\n  /**\n   * Optional HNDL exposure analysis ({@link computeHndl}). When supplied, each\n   * finding gains its `exposure` fields (score, bound data asset, rationale)\n   * keyed by fingerprint, and the report carries the repo-level HNDL summary.\n   * Purely additive: it never changes finding identity, ordering, or exit codes.\n   */\n  hndl?: HndlReport;\n}\n\n/** The per-finding exposure block emitted in JSON / SARIF, or undefined. */\nfunction exposureFor(f: Finding, hndl: HndlReport | undefined): FindingExposure | undefined {\n  if (!hndl) return undefined;\n  return hndl.byFingerprint.get(findingFingerprint(f));\n}\n\n/** The repo HNDL summary block shared by JSON output and the SARIF run. */\nfunction hndlSummaryBlock(hndl: HndlReport): Record<string, unknown> {\n  return {\n    modelVersion: hndl.modelVersion,\n    horizon: hndl.horizon,\n    summary: hndl.summary,\n    assets: hndl.assets,\n  };\n}\n\nconst SARIF_SCHEMA =\n  \"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json\";\n\nconst INFORMATION_URI = \"https://github.com/quantakrypto/pqc-tools\";\n\n/**\n * Resolve the snippet to emit for a finding, honouring redaction. Sensitive\n * findings (key material) never expose their snippet; otherwise the snippet is\n * dropped only when `redactSnippets` is set.\n */\nfunction emittedSnippet(f: Finding, redactSnippets: boolean): string | undefined {\n  if (redactSnippets || f.sensitive) return undefined;\n  return f.location.snippet;\n}\n\n/** Map our severity to a SARIF rule-level default (used in rules[].defaultConfiguration). */\nfunction sarifRank(severity: Severity): number {\n  switch (severity) {\n    case \"critical\":\n      return 100;\n    case \"high\":\n      return 80;\n    case \"medium\":\n      return 50;\n    case \"low\":\n      return 20;\n    default:\n      return 5;\n  }\n}\n\n/** Build a SARIF `rules[]` entry from a rule's severity/title/message/etc. */\nfunction sarifRule(spec: {\n  id: string;\n  title: string;\n  message: string;\n  severity: Severity;\n  category: string;\n  algorithm?: string;\n  hndl: boolean;\n  cwe?: string;\n  remediation?: string;\n}): Record<string, unknown> {\n  return {\n    id: spec.id,\n    name: spec.id,\n    shortDescription: { text: spec.title },\n    fullDescription: { text: spec.message },\n    defaultConfiguration: { level: sarifLevel(spec.severity), rank: sarifRank(spec.severity) },\n    ...(spec.remediation ? { help: { text: `Remediation: ${spec.remediation}` } } : {}),\n    properties: {\n      category: spec.category,\n      ...(spec.algorithm ? { algorithm: spec.algorithm } : {}),\n      hndl: spec.hndl,\n      ...(spec.cwe ? { cwe: spec.cwe, \"security-severity\": securitySeverity(spec.severity) } : {}),\n      ...(spec.cwe ? { tags: [\"security\", spec.cwe] } : {}),\n    },\n    ...(spec.cwe\n      ? {\n          relationships: [\n            { target: { id: spec.cwe, toolComponent: { name: \"CWE\" } }, kinds: [\"relevant\"] },\n          ],\n        }\n      : {}),\n  };\n}\n\n/** SARIF result.properties fragment for a finding's HNDL exposure, or empty. */\nfunction exposureProperties(exposure: FindingExposure | undefined): Record<string, unknown> {\n  if (!exposure) return {};\n  return {\n    exposureScore: exposure.exposureScore,\n    dataAsset: exposure.dataAsset,\n    exposureRationale: exposure.rationale,\n  };\n}\n\n/** Serialize a scan result as SARIF 2.1.0. */\nexport function toSarif(result: ScanResult, opts?: ReportOptions): SarifLog {\n  const redactSnippets = opts?.redactSnippets ?? false;\n  // Build the rule set and collect the CWE taxa referenced by any rule. When a\n  // full catalog is supplied, advertise every rule (even ones that didn't fire);\n  // otherwise emit one rule per ruleId encountered (the historical behaviour).\n  const ruleIndex = new Map<string, number>();\n  const rules: Array<Record<string, unknown>> = [];\n  const cweTaxa = new Set<string>();\n\n  for (const r of opts?.catalog ?? []) {\n    if (ruleIndex.has(r.id)) continue;\n    if (r.cwe) cweTaxa.add(r.cwe);\n    ruleIndex.set(r.id, rules.length);\n    rules.push(\n      sarifRule({\n        id: r.id,\n        title: r.title,\n        message: r.message,\n        severity: r.severity,\n        category: r.category,\n        algorithm: r.algorithm,\n        hndl: r.hndl,\n        cwe: r.cwe,\n        remediation: r.remediation,\n      }),\n    );\n  }\n\n  for (const f of result.findings) {\n    if (f.cwe) cweTaxa.add(f.cwe);\n    if (ruleIndex.has(f.ruleId)) continue;\n    ruleIndex.set(f.ruleId, rules.length);\n    rules.push(\n      sarifRule({\n        id: f.ruleId,\n        title: f.title,\n        message: f.message,\n        severity: f.severity,\n        category: f.category,\n        algorithm: f.algorithm,\n        hndl: f.hndl,\n        cwe: f.cwe,\n        remediation: f.remediation,\n      }),\n    );\n  }\n\n  const results = result.findings.map((f) => {\n    const region: Record<string, number> = { startLine: f.location.line };\n    if (typeof f.location.column === \"number\") region.startColumn = f.location.column;\n    if (typeof f.location.endLine === \"number\") region.endLine = f.location.endLine;\n    const snippet = emittedSnippet(f, redactSnippets);\n\n    return {\n      ruleId: f.ruleId,\n      ruleIndex: ruleIndex.get(f.ruleId),\n      level: sarifLevel(f.severity),\n      message: { text: f.message },\n      // Line-INSENSITIVE fingerprint (the same one the baseline uses:\n      // sha256 of ruleId|file|normalizedSnippet). GitHub code scanning keys\n      // alert identity + dedup off partialFingerprints, so a finding survives\n      // line shifts and reformatting instead of re-alerting as \"new\" on every\n      // edit above it. `quantakrypto/v1` names our scheme.\n      partialFingerprints: { \"quantakrypto/v1\": fingerprintFinding(f) },\n      properties: {\n        // Same stable identity mirrored into properties so non-GitHub SARIF\n        // consumers (our platform ingest) can read one uniform `fingerprint`\n        // field across JSON and SARIF without reaching into partialFingerprints.\n        fingerprint: fingerprintFinding(f),\n        category: f.category,\n        severity: f.severity,\n        confidence: f.confidence,\n        hndl: f.hndl,\n        ...(f.algorithm ? { algorithm: f.algorithm } : {}),\n        ...(f.remediation ? { remediation: f.remediation } : {}),\n        ...(f.cwe ? { cwe: f.cwe } : {}),\n        ...exposureProperties(exposureFor(f, opts?.hndl)),\n      },\n      ...(f.cwe\n        ? {\n            taxa: [\n              {\n                target: { id: f.cwe, toolComponent: { name: \"CWE\" } },\n              },\n            ],\n          }\n        : {}),\n      locations: [\n        {\n          physicalLocation: {\n            artifactLocation: { uri: f.location.file },\n            region: {\n              ...region,\n              ...(snippet ? { snippet: { text: snippet } } : {}),\n            },\n          },\n        },\n      ],\n    };\n  });\n\n  // CWE taxonomy component (SARIF taxonomies), referenced by rules + results.\n  const taxonomies =\n    cweTaxa.size > 0\n      ? [\n          {\n            name: \"CWE\",\n            informationUri: \"https://cwe.mitre.org/\",\n            organization: \"MITRE\",\n            shortDescription: { text: \"The MITRE Common Weakness Enumeration\" },\n            taxa: [...cweTaxa].sort().map((id) => ({\n              id,\n              helpUri: `https://cwe.mitre.org/data/definitions/${id.replace(/^CWE-/, \"\")}.html`,\n            })),\n          },\n        ]\n      : [];\n\n  return {\n    $schema: SARIF_SCHEMA,\n    version: \"2.1.0\",\n    runs: [\n      {\n        tool: {\n          driver: {\n            name: \"qScan\",\n            informationUri: INFORMATION_URI,\n            version: result.toolVersion || VERSION,\n            rules,\n          },\n        },\n        ...(taxonomies.length > 0 ? { taxonomies } : {}),\n        ...(opts?.hndl ? { properties: { hndl: hndlSummaryBlock(opts.hndl) } } : {}),\n        results,\n      },\n    ],\n  };\n}\n\n/** GitHub-code-scanning `security-severity` (0–10) derived from our severity. */\nfunction securitySeverity(severity: Severity): string {\n  switch (severity) {\n    case \"critical\":\n      return \"9.5\";\n    case \"high\":\n      return \"8.0\";\n    case \"medium\":\n      return \"5.0\";\n    case \"low\":\n      return \"3.0\";\n    default:\n      return \"1.0\";\n  }\n}\n\n/** Serialize a scan result as a plain JSON-friendly object. */\nexport function toJson(result: ScanResult, opts?: ReportOptions): Record<string, unknown> {\n  const redactSnippets = opts?.redactSnippets ?? false;\n  const hndl = opts?.hndl;\n  return {\n    toolVersion: result.toolVersion,\n    root: result.root,\n    startedAt: result.startedAt,\n    finishedAt: result.finishedAt,\n    filesScanned: result.filesScanned,\n    ...(result.analyzedFiles !== undefined ? { analyzedFiles: result.analyzedFiles } : {}),\n    ...(result.diagnostics ? { diagnostics: result.diagnostics } : {}),\n    inventory: {\n      readinessScore: result.inventory.readinessScore,\n      hndlCount: result.inventory.hndlCount,\n      bySeverity: result.inventory.bySeverity,\n      byCategory: result.inventory.byCategory,\n      byAlgorithm: result.inventory.byAlgorithm,\n    },\n    ...(hndl ? { hndl: hndlSummaryBlock(hndl) } : {}),\n    findings: result.findings.map((f) => {\n      const exposure = exposureFor(f, hndl);\n      return {\n        // Stable, line-INSENSITIVE identity of the finding: sha256 of\n        // ruleId | normalized-POSIX-repo-relative-path | normalized-snippet\n        // (the SARIF partialFingerprints trick, line number deliberately\n        // excluded). Reused verbatim from the baseline module so JSON identity,\n        // SARIF partialFingerprints, and the baseline suppression set are one and\n        // the same value. A line move does NOT change it; when no snippet context\n        // exists it falls back to ruleId|path. This is the cross-run identity the\n        // platform keys posture drift on.\n        fingerprint: fingerprintFinding(f),\n        ruleId: f.ruleId,\n        title: f.title,\n        category: f.category,\n        severity: f.severity,\n        confidence: f.confidence,\n        algorithm: f.algorithm,\n        hndl: f.hndl,\n        message: f.message,\n        remediation: f.remediation,\n        cwe: f.cwe,\n        location: {\n          file: f.location.file,\n          line: f.location.line,\n          column: f.location.column,\n          endLine: f.location.endLine,\n          snippet: emittedSnippet(f, redactSnippets),\n        },\n        ...(exposure\n          ? {\n              exposure: {\n                fingerprint: exposure.fingerprint,\n                exposureScore: exposure.exposureScore,\n                dataAsset: exposure.dataAsset,\n                rationale: exposure.rationale,\n              },\n            }\n          : {}),\n      };\n    }),\n  };\n}\n\n/* -------------------------------------------------------------------------- */\n/* Human-readable summary                                                      */\n/* -------------------------------------------------------------------------- */\n\n/** Raw ANSI codes (no chalk). Disabled when colour is off. */\nconst ANSI = {\n  reset: \"\\x1b[0m\",\n  bold: \"\\x1b[1m\",\n  dim: \"\\x1b[2m\",\n  red: \"\\x1b[31m\",\n  green: \"\\x1b[32m\",\n  yellow: \"\\x1b[33m\",\n  blue: \"\\x1b[34m\",\n  magenta: \"\\x1b[35m\",\n  cyan: \"\\x1b[36m\",\n} as const;\n\nfunction severityColor(sev: Severity): string {\n  switch (sev) {\n    case \"critical\":\n      return ANSI.magenta;\n    case \"high\":\n      return ANSI.red;\n    case \"medium\":\n      return ANSI.yellow;\n    case \"low\":\n      return ANSI.blue;\n    default:\n      return ANSI.dim;\n  }\n}\n\nfunction scoreColor(score: number): string {\n  if (score >= 80) return ANSI.green;\n  if (score >= 50) return ANSI.yellow;\n  return ANSI.red;\n}\n\n/**\n * Render a human-readable summary of a scan result. Colour is off by default;\n * pass `{ color: true }` to emit ANSI escape codes.\n */\nexport function formatSummary(\n  result: ScanResult,\n  options?: { color?: boolean; tier?: SecurityTier },\n): string {\n  const color = options?.color ?? false;\n  const c = (code: string, text: string): string => (color ? `${code}${text}${ANSI.reset}` : text);\n\n  const lines: string[] = [];\n  const inv = result.inventory;\n\n  lines.push(c(ANSI.bold, \"qScan — post-quantum readiness report\"));\n  lines.push(c(ANSI.dim, `tool v${result.toolVersion} · root: ${result.root}`));\n  lines.push(\"\");\n\n  // Readiness score banner.\n  lines.push(\n    `Readiness score: ${c(`${ANSI.bold}${scoreColor(inv.readinessScore)}`, `${inv.readinessScore}/100`)}`,\n  );\n  const analyzed =\n    result.analyzedFiles !== undefined\n      ? `   Analyzed (${ANALYZABLE_LANGUAGES_LABEL}): ${result.analyzedFiles}`\n      : \"\";\n  lines.push(\n    `Files scanned:   ${result.filesScanned}${analyzed}   Findings: ${result.findings.length}   HNDL-exposed: ${c(\n      inv.hndlCount > 0 ? ANSI.red : ANSI.green,\n      String(inv.hndlCount),\n    )}`,\n  );\n  // Coverage honesty: a score over zero analyzable files is not a clean bill of health.\n  if (result.analyzedFiles === 0 && result.filesScanned > 0) {\n    lines.push(\n      c(\n        ANSI.yellow,\n        `Note: 0 files were in a supported source language (${ANALYZABLE_LANGUAGES_LABEL}) — the readiness score does not reflect this codebase.`,\n      ),\n    );\n  }\n  // Coverage diagnostics: skipped files mean the finding count may be incomplete.\n  const diag = result.diagnostics;\n  if (diag && (diag.unreadable > 0 || diag.skippedMinified > 0)) {\n    lines.push(\n      c(\n        ANSI.yellow,\n        `Coverage: ${diag.unreadable} unreadable, ${diag.skippedMinified} skipped as minified — results may be incomplete.`,\n      ),\n    );\n  }\n  lines.push(\"\");\n\n  // Severity breakdown.\n  const sevParts = SEVERITY_ORDER.filter((s) => inv.bySeverity[s] > 0).map((s) =>\n    c(severityColor(s), `${s}: ${inv.bySeverity[s]}`),\n  );\n  lines.push(`By severity:  ${sevParts.length ? sevParts.join(\"   \") : c(ANSI.green, \"none\")}`);\n\n  // Algorithm breakdown.\n  const algoParts = Object.entries(inv.byAlgorithm)\n    .sort((a, b) => b[1] - a[1])\n    .map(([k, v]) => `${k}: ${v}`);\n  if (algoParts.length) lines.push(`By algorithm: ${algoParts.join(\"   \")}`);\n  lines.push(\"\");\n\n  if (result.findings.length === 0) {\n    lines.push(c(ANSI.green, \"No classical asymmetric cryptography detected. ✓\"));\n    return lines.join(\"\\n\");\n  }\n\n  // Top findings, grouped by severity (most severe first), capped for readability.\n  const sorted = [...result.findings].sort(\n    (a, b) => SEVERITY_ORDER.indexOf(a.severity) - SEVERITY_ORDER.indexOf(b.severity),\n  );\n  const MAX_SHOWN = 25;\n  lines.push(\n    c(ANSI.bold, `Top findings (${Math.min(MAX_SHOWN, sorted.length)} of ${sorted.length}):`),\n  );\n\n  for (const f of sorted.slice(0, MAX_SHOWN)) {\n    const loc = `${f.location.file}:${f.location.line}${\n      f.location.column ? `:${f.location.column}` : \"\"\n    }`;\n    const tag = c(severityColor(f.severity), `[${f.severity}]`);\n    const hndl = f.hndl ? c(ANSI.red, \" (HNDL)\") : \"\";\n    lines.push(`  ${tag} ${f.title}${hndl}`);\n    lines.push(c(ANSI.dim, `      ${loc} — ${f.message}`));\n    if (f.remediation) lines.push(c(ANSI.cyan, `      → ${f.remediation}`));\n  }\n\n  if (sorted.length > MAX_SHOWN) {\n    lines.push(c(ANSI.dim, `  …and ${sorted.length - MAX_SHOWN} more.`));\n  }\n\n  lines.push(\"\");\n  if (inv.hndlCount > 0) {\n    lines.push(\n      c(\n        ANSI.yellow,\n        `Note: ${inv.hndlCount} finding(s) are exposed to \"harvest now, decrypt later\" — ` +\n          \"encrypted traffic captured today can be decrypted once a quantum computer exists. \" +\n          \"Prioritise migrating key exchange / encryption to hybrid PQC (X25519MLKEM768).\",\n      ),\n    );\n  }\n\n  if (options?.tier) {\n    lines.push(\"\", ...formatTierGuidance(inv.byAlgorithm, options.tier));\n  }\n\n  return lines.join(\"\\n\");\n}\n\n/**\n * Per-family migration targets for a CNSA security tier — surfaces the otherwise\n * library-only {@link remediationForTier} in human reports. Category 5 shows the\n * ML-KEM-1024 / ML-DSA-87 sets CNSA 2.0 mandates for national-security systems and\n * long-lived secrets. Returns plain (un-coloured) lines; the caller styles them.\n */\nexport function formatTierGuidance(\n  byAlgorithm: Record<string, number>,\n  tier: SecurityTier,\n): string[] {\n  const label = tier === \"category-5\" ? \"CNSA 2.0 (Category 5)\" : \"Category 3 (commercial)\";\n  const out: string[] = [`${label} migration targets:`];\n  const seen = new Set<string>();\n  for (const [k, n] of Object.entries(byAlgorithm)) {\n    if (n <= 0) continue;\n    const fam = k as AlgorithmFamily;\n    if (fam === \"unknown\" || !remediationFor(fam)) continue; // skip unmapped families\n    const rem = remediationForTier(fam, tier);\n    if (seen.has(rem.recommendation)) continue;\n    seen.add(rem.recommendation);\n    out.push(`  ${fam} → ${rem.recommendation}`);\n  }\n  if (tier === \"category-5\") {\n    out.push(\n      \"  CNSA 2.0 mandates ML-KEM-1024 / ML-DSA-87 for national-security systems and long-lived secrets (2030/2033 milestones).\",\n    );\n  }\n  return out;\n}\n\n/**\n * Per-family migration targets tailored to a selected {@link StandardsProfile}\n * (`--profile`). Unlike {@link formatTierGuidance} (CNSA-tier only), this surfaces the\n * regime's parameter sets AND its hybrid stance — required (ANSSI/BSI) vs recommended\n * (NIST/NCSC) vs optional (CNSA 2.0) — so guidance isn't regime-wrong. Returns plain\n * (un-coloured) lines; the caller styles them.\n */\nexport function formatProfileGuidance(\n  byAlgorithm: Record<string, number>,\n  profile: StandardsProfile,\n): string[] {\n  const out: string[] = [`${profile.name} migration targets:`];\n  const seen = new Set<string>();\n  for (const [k, n] of Object.entries(byAlgorithm)) {\n    if (n <= 0) continue;\n    const fam = k as AlgorithmFamily;\n    if (fam === \"unknown\" || !remediationFor(fam)) continue; // skip unmapped families\n    const rem = remediationForProfile(fam, profile);\n    if (seen.has(rem.recommendation)) continue;\n    seen.add(rem.recommendation);\n    out.push(`  ${fam} → ${rem.recommendation}`);\n  }\n  const stance =\n    profile.hybridStance === \"required\"\n      ? \"requires classical+PQC hybridization\"\n      : profile.hybridStance === \"recommended\"\n        ? \"recommends hybridization\"\n        : \"does not require hybridization\";\n  out.push(\n    `  ${profile.authority} ${stance}; classical public-key crypto disallowed after ${profile.disallowAfter} (${profile.citation}).`,\n  );\n  return out;\n}\n"]}

package/dist/scan-worker.js

@@ -13,7 +13,7 @@ import * as path from "node:path";
 import { parentPort, workerData } from "node:worker_threads";
 import { defaultRegistry } from "./registry.js";
 import { detectFile } from "./scan.js";
-import { looksMinified } from "./walk.js";
+import { isKeystorePath, looksMinified } from "./walk.js";
 import { isManifestFile } from "./dependencies.js";
 if (parentPort) {
     const data = (workerData ?? {});
@@ -30,15 +30,17 @@ if (parentPort) {
             const scannedNames = [];
             for (const rel of req.files) {
                 const abs = path.join(baseDir, ...rel.split("/"));
+                // Keystores (.jks/.p12/…) are read byte-preserving (latin1); see scan.ts.
+                const keystore = isKeystorePath(rel);
                 let content;
                 try {
-                    content = readFileSync(abs, "utf8");
+                    content = readFileSync(abs, keystore ? "latin1" : "utf8");
                 }
                 catch {
                     unreadable += 1;
                     continue;
                 }
-                if (!toggles.scanMinified && !isManifestFile(rel) && looksMinified(content)) {
+                if (!toggles.scanMinified && !isManifestFile(rel) && !keystore && looksMinified(content)) {
                     skippedMinified += 1;
                     continue;
                 }

package/dist/scan-worker.js.map

@@ -1 +1 @@
-{"version":3,"file":"scan-worker.js","sourceRoot":"","sources":["../src/scan-worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAG7D,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAenD,IAAI,UAAU,EAAE,CAAC;IACf,MAAM,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAgD,CAAC;IAC/E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,UAAU,CAAC;IAExB,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAiB,EAAE,EAAE;QACvC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAc,EAAE,CAAC;YAC/B,IAAI,YAAY,GAAG,CAAC,CAAC;YACrB,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,IAAI,eAAe,GAAG,CAAC,CAAC;YACxB,MAAM,YAAY,GAAa,EAAE,CAAC;YAElC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBAClD,IAAI,OAAe,CAAC;gBACpB,IAAI,CAAC;oBACH,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBACtC,CAAC;gBAAC,MAAM,CAAC;oBACP,UAAU,IAAI,CAAC,CAAC;oBAChB,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC5E,eAAe,IAAI,CAAC,CAAC;oBACrB,SAAS;gBACX,CAAC;gBACD,YAAY,IAAI,CAAC,CAAC;gBAClB,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACvB,QAAQ,CAAC,IAAI,CACX,GAAG,UAAU,CACX,GAAG,EACH,OAAO,EACP,IAAI,EACJ;oBACE,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,IAAI,EAAE,OAAO,CAAC,IAAI;iBACnB,EACD,OAAO,CAAC,aAAa,CACtB,CACF,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,WAAW,CAAC;gBACf,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,KAAK,EAAE,YAAY;gBACnB,MAAM,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE;aAChE,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,WAAW,CAAC;gBACf,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Worker-thread entry for {@link scanParallel}. Built to `dist/scan-worker.js`\n * and spawned by `parallel.ts`. Each worker reads its assigned files and runs\n * the SAME pure detector pipeline as the serial scan (`detectFile`), returning\n * `{ findings, filesScanned }` per chunk. No shared mutable state.\n *\n * This file performs side effects (wires up message handlers) only when it is\n * actually running inside a worker thread, so importing it from the main thread\n * (e.g. for coverage) is harmless.\n */\nimport { readFileSync } from \"node:fs\";\nimport * as path from \"node:path\";\nimport { parentPort, workerData } from \"node:worker_threads\";\n\nimport type { Finding } from \"./types.js\";\nimport { defaultRegistry } from \"./registry.js\";\nimport { detectFile } from \"./scan.js\";\nimport { looksMinified } from \"./walk.js\";\nimport { isManifestFile } from \"./dependencies.js\";\n\ninterface WorkerToggles {\n  source: boolean;\n  config: boolean;\n  deps: boolean;\n  scanMinified: boolean;\n  disabledRules?: string[];\n}\n\ninterface ChunkRequest {\n  index: number;\n  files: string[];\n}\n\nif (parentPort) {\n  const data = (workerData ?? {}) as { baseDir: string; toggles: WorkerToggles };\n  const baseDir = data.baseDir;\n  const toggles = data.toggles;\n  const dets = defaultRegistry.all();\n  const port = parentPort;\n\n  port.on(\"message\", (req: ChunkRequest) => {\n    try {\n      const findings: Finding[] = [];\n      let filesScanned = 0;\n      let unreadable = 0;\n      let skippedMinified = 0;\n      const scannedNames: string[] = [];\n\n      for (const rel of req.files) {\n        const abs = path.join(baseDir, ...rel.split(\"/\"));\n        let content: string;\n        try {\n          content = readFileSync(abs, \"utf8\");\n        } catch {\n          unreadable += 1;\n          continue;\n        }\n        if (!toggles.scanMinified && !isManifestFile(rel) && looksMinified(content)) {\n          skippedMinified += 1;\n          continue;\n        }\n        filesScanned += 1;\n        scannedNames.push(rel);\n        findings.push(\n          ...detectFile(\n            rel,\n            content,\n            dets,\n            {\n              source: toggles.source,\n              config: toggles.config,\n              deps: toggles.deps,\n            },\n            toggles.disabledRules,\n          ),\n        );\n      }\n\n      port.postMessage({\n        index: req.index,\n        files: scannedNames,\n        result: { findings, filesScanned, unreadable, skippedMinified },\n      });\n    } catch (err) {\n      port.postMessage({\n        index: req.index,\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n  });\n}\n"]}
+{"version":3,"file":"scan-worker.js","sourceRoot":"","sources":["../src/scan-worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAG7D,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAenD,IAAI,UAAU,EAAE,CAAC;IACf,MAAM,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAgD,CAAC;IAC/E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,UAAU,CAAC;IAExB,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAiB,EAAE,EAAE;QACvC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAc,EAAE,CAAC;YAC/B,IAAI,YAAY,GAAG,CAAC,CAAC;YACrB,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,IAAI,eAAe,GAAG,CAAC,CAAC;YACxB,MAAM,YAAY,GAAa,EAAE,CAAC;YAElC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;gBAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBAClD,0EAA0E;gBAC1E,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;gBACrC,IAAI,OAAe,CAAC;gBACpB,IAAI,CAAC;oBACH,OAAO,GAAG,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBAC5D,CAAC;gBAAC,MAAM,CAAC;oBACP,UAAU,IAAI,CAAC,CAAC;oBAChB,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;oBACzF,eAAe,IAAI,CAAC,CAAC;oBACrB,SAAS;gBACX,CAAC;gBACD,YAAY,IAAI,CAAC,CAAC;gBAClB,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACvB,QAAQ,CAAC,IAAI,CACX,GAAG,UAAU,CACX,GAAG,EACH,OAAO,EACP,IAAI,EACJ;oBACE,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,IAAI,EAAE,OAAO,CAAC,IAAI;iBACnB,EACD,OAAO,CAAC,aAAa,CACtB,CACF,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,WAAW,CAAC;gBACf,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,KAAK,EAAE,YAAY;gBACnB,MAAM,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE;aAChE,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,WAAW,CAAC;gBACf,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Worker-thread entry for {@link scanParallel}. Built to `dist/scan-worker.js`\n * and spawned by `parallel.ts`. Each worker reads its assigned files and runs\n * the SAME pure detector pipeline as the serial scan (`detectFile`), returning\n * `{ findings, filesScanned }` per chunk. No shared mutable state.\n *\n * This file performs side effects (wires up message handlers) only when it is\n * actually running inside a worker thread, so importing it from the main thread\n * (e.g. for coverage) is harmless.\n */\nimport { readFileSync } from \"node:fs\";\nimport * as path from \"node:path\";\nimport { parentPort, workerData } from \"node:worker_threads\";\n\nimport type { Finding } from \"./types.js\";\nimport { defaultRegistry } from \"./registry.js\";\nimport { detectFile } from \"./scan.js\";\nimport { isKeystorePath, looksMinified } from \"./walk.js\";\nimport { isManifestFile } from \"./dependencies.js\";\n\ninterface WorkerToggles {\n  source: boolean;\n  config: boolean;\n  deps: boolean;\n  scanMinified: boolean;\n  disabledRules?: string[];\n}\n\ninterface ChunkRequest {\n  index: number;\n  files: string[];\n}\n\nif (parentPort) {\n  const data = (workerData ?? {}) as { baseDir: string; toggles: WorkerToggles };\n  const baseDir = data.baseDir;\n  const toggles = data.toggles;\n  const dets = defaultRegistry.all();\n  const port = parentPort;\n\n  port.on(\"message\", (req: ChunkRequest) => {\n    try {\n      const findings: Finding[] = [];\n      let filesScanned = 0;\n      let unreadable = 0;\n      let skippedMinified = 0;\n      const scannedNames: string[] = [];\n\n      for (const rel of req.files) {\n        const abs = path.join(baseDir, ...rel.split(\"/\"));\n        // Keystores (.jks/.p12/…) are read byte-preserving (latin1); see scan.ts.\n        const keystore = isKeystorePath(rel);\n        let content: string;\n        try {\n          content = readFileSync(abs, keystore ? \"latin1\" : \"utf8\");\n        } catch {\n          unreadable += 1;\n          continue;\n        }\n        if (!toggles.scanMinified && !isManifestFile(rel) && !keystore && looksMinified(content)) {\n          skippedMinified += 1;\n          continue;\n        }\n        filesScanned += 1;\n        scannedNames.push(rel);\n        findings.push(\n          ...detectFile(\n            rel,\n            content,\n            dets,\n            {\n              source: toggles.source,\n              config: toggles.config,\n              deps: toggles.deps,\n            },\n            toggles.disabledRules,\n          ),\n        );\n      }\n\n      port.postMessage({\n        index: req.index,\n        files: scannedNames,\n        result: { findings, filesScanned, unreadable, skippedMinified },\n      });\n    } catch (err) {\n      port.postMessage({\n        index: req.index,\n        error: err instanceof Error ? err.message : String(err),\n      });\n    }\n  });\n}\n"]}

package/dist/scan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAuB7E;;;;;;GAMG;AACH,eAAO,MAAM,SAAS,EAAE,QAAQ,EAAqB,CAAC;AAEtD,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,MAAM,CAI9D;AAOD;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,QAAQ,EAAE,EACzB,OAAO,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,EAC5D,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,GAChC,OAAO,EAAE,CA8BX;AAED;;;;GAIG;AACH,wBAAsB,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CA0IpE;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,GAAG,SAAS,CAAC,GAChD,MAAM,EAAE,CAmBV"}
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAwC7E;;;;;;GAMG;AACH,eAAO,MAAM,SAAS,EAAE,QAAQ,EAAqB,CAAC;AAEtD,8EAA8E;AAC9E,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,MAAM,CAI9D;AAOD;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,QAAQ,EAAE,EACzB,OAAO,EAAE;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,EAC5D,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,GAChC,OAAO,EAAE,CA8BX;AAED;;;;GAIG;AACH,wBAAsB,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CA4JpE;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,GAAG,SAAS,CAAC,GAChD,MAAM,EAAE,CAmBV"}

package/dist/scan.js

@@ -11,7 +11,7 @@
  */
 import { readFile, stat } from "node:fs/promises";
 import * as path from "node:path";
-import { walkFiles, toPosix, isBinaryPath, looksMinified, matchesAny } from "./walk.js";
+import { walkFiles, toPosix, isBinaryPath, isKeystorePath, looksMinified, matchesAny, DEFAULT_MAX_FILE_SIZE, } from "./walk.js";
 import { isAnalyzableSource } from "./detect-utils.js";
 import { stripCommentFindings, stripIgnoredFindings, stripStringLiteralFindings, } from "./comments.js";
 /**
@@ -19,7 +19,16 @@ import { stripCommentFindings, stripIgnoredFindings, stripStringLiteralFindings,
  * A match inside a string (e.g. `t.Error("SigningMethodPS256 …")`) is prose and
  * is dropped. Rules that legitimately match quoted tokens are NOT listed here.
  */
-const CODE_ONLY_RULES = new Set(["go-jwt-signingmethod"]);
+const CODE_ONLY_RULES = new Set([
+    "go-jwt-signingmethod",
+    // Identifier-form JWT alg constants (jjwt `SignatureAlgorithm.RS256`, auth0
+    // `Algorithm.RSA256`, C# `SecurityAlgorithms.*`, Rust `Algorithm::RS256`). Like the
+    // Go rule, these are only meaningful as code; the SAME token inside a string literal
+    // (an error message that names/forbids the alg) is prose, not a usage.
+    "java-jwt-alg",
+    "csharp-jwt-alg",
+    "rust-jwt-algorithm",
+]);
 import { hashContent, loadCache, rulesetFingerprint, saveCache } from "./cache.js";
 import { builtinDetectors, defaultRegistry, detectorScope } from "./registry.js";
 import { isManifestFile, scanManifest } from "./dependencies.js";
@@ -139,22 +148,42 @@ export async function scan(options) {
         const absPath = singleFileName ? options.root : path.join(baseDir, ...rel.split("/"));
         const reportedPath = singleFileName ? toPosix(rel) : rel;
         options.onFile?.(reportedPath);
+        // Cryptographic keystores (.jks/.p12/…) are binary; read them byte-preserving
+        // (latin1) so the keystore detector can inspect magic bytes.
+        const keystore = isKeystorePath(reportedPath);
+        // Keystores are read whole into memory as latin1. The walker already caps file
+        // size, but the explicit-file-list (incremental) path does not — so stat and
+        // skip an oversized binary here to avoid reading a huge encrypted archive
+        // (`.gpg`) into a string.
+        if (keystore) {
+            try {
+                const { size } = await stat(absPath);
+                if (size > (options.maxFileSize ?? DEFAULT_MAX_FILE_SIZE))
+                    continue;
+            }
+            catch {
+                unreadable += 1;
+                continue;
+            }
+        }
         let content;
         try {
-            content = await readFile(absPath, "utf8");
+            content = await readFile(absPath, keystore ? "latin1" : "utf8");
         }
         catch {
             unreadable += 1; // permissions / vanished / decode failure — tracked, not silent.
             continue;
         }
         // Skip machine-minified / generated content (unless explicitly enabled).
-        // Manifests are always scanned (their findings are dependency findings).
-        if (!scanMinified && !isManifestFile(reportedPath) && looksMinified(content)) {
+        // Manifests and keystores are always scanned.
+        if (!scanMinified && !isManifestFile(reportedPath) && !keystore && looksMinified(content)) {
             skippedMinified += 1;
             continue;
         }
         // Cumulative-byte budget: enforced once this file's bytes are accounted for.
-        bytesScanned += Buffer.byteLength(content, "utf8");
+        // Use the read encoding so a latin1 keystore is counted at its on-disk size
+        // (a utf8 byteLength would double-count every byte ≥ 0x80).
+        bytesScanned += Buffer.byteLength(content, keystore ? "latin1" : "utf8");
         if (typeof maxBytes === "number" && bytesScanned > maxBytes) {
             throw new BudgetExceededError(`maxBytes budget exceeded (limit: ${maxBytes}).`);
         }

package/dist/scan.js.map

@@ -1 +1 @@
-{"version":3,"file":"scan.js","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAEvB;;;;GAIG;AACH,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC;AAC/E,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEnF,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,SAAS,GAAe,gBAAgB,CAAC;AAEtD,8EAA8E;AAC9E,MAAM,UAAU,eAAe,CAAC,CAAU,EAAE,CAAU;IACpD,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;IAClF,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,sFAAsF;AACtF,SAAS,gBAAgB,CAAC,OAAoB;IAC5C,OAAO,OAAO,CAAC,SAAS,IAAI,eAAe,CAAC,GAAG,EAAE,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CACxB,IAAY,EACZ,OAAe,EACf,IAAyB,EACzB,OAA4D,EAC5D,aAAiC;IAEjC,IAAI,GAAG,GAAc,EAAE,CAAC;IAExB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC;QACjD,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM;YAAE,SAAS;QAC3D,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,2EAA2E;IAC3E,8DAA8D;IAC9D,2EAA2E;IAC3E,kDAAkD;IAClD,GAAG,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/C,GAAG,GAAG,0BAA0B,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;IACtE,GAAG,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAEzC,IAAI,OAAO,CAAC,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,8EAA8E;IAC9E,qEAAqE;IACrE,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;QACxC,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAoB;IAC7C,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAE7B,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;IAC1C,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC;IACnD,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAEvC,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACvE,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEvE,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,eAAe,GAAG,CAAC,CAAC;IAExB,0EAA0E;IAC1E,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACpC,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,yEAAyE;IACzE,6EAA6E;IAC7E,4EAA4E;IAC5E,sEAAsE;IACtE,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,WAAW,GAAmC,SAAS;QAC3D,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,CAAC,CAAC,IAAI,CAAC;IAET,8EAA8E;IAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAElC,+EAA+E;IAC/E,MAAM,QAAQ,GAA0B,OAAO,CAAC,KAAK;QACnD,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;QAC7C,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE;YACtB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,CAAC;IAEP,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QACjC,4EAA4E;QAC5E,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,UAAU,EAAE,CAAC;QAE5C,4DAA4D;QAC5D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,YAAY,IAAI,QAAQ,EAAE,CAAC;YAC7D,MAAM,IAAI,mBAAmB,CAAC,oCAAoC,QAAQ,IAAI,CAAC,CAAC;QAClF,CAAC;QAED,4EAA4E;QAC5E,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACtF,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAEzD,OAAO,CAAC,MAAM,EAAE,CAAC,YAAY,CAAC,CAAC;QAE/B,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,IAAI,CAAC,CAAC,CAAC,iEAAiE;YAClF,SAAS;QACX,CAAC;QAED,yEAAyE;QACzE,yEAAyE;QACzE,IAAI,CAAC,YAAY,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7E,eAAe,IAAI,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QAED,6EAA6E;QAC7E,YAAY,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,YAAY,GAAG,QAAQ,EAAE,CAAC;YAC5D,MAAM,IAAI,mBAAmB,CAAC,oCAAoC,QAAQ,IAAI,CAAC,CAAC;QAClF,CAAC;QAED,YAAY,IAAI,CAAC,CAAC;QAClB,IAAI,kBAAkB,CAAC,YAAY,CAAC;YAAE,aAAa,IAAI,CAAC,CAAC;QAEzD,4EAA4E;QAC5E,6EAA6E;QAC7E,IAAI,YAAuB,CAAC;QAC5B,IAAI,KAAK,IAAI,WAAW,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;YAClC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACpC,YAAY;gBACV,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI;oBACtB,CAAC,CAAC,GAAG,CAAC,QAAQ;oBACd,CAAC,CAAC,UAAU,CACR,YAAY,EACZ,OAAO,EACP,IAAI,EACJ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EACpD,OAAO,CAAC,aAAa,CACtB,CAAC;YACR,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QAClE,CAAC;aAAM,CAAC;YACN,YAAY,GAAG,UAAU,CACvB,YAAY,EACZ,OAAO,EACP,IAAI,EACJ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EACpD,OAAO,CAAC,aAAa,CACtB,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;IACjC,CAAC;IAED,6DAA6D;IAC7D,IAAI,SAAS,IAAI,WAAW;QAAE,MAAM,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IAE/E,oDAAoD;IACpD,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAE/B,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;IAE9B,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ;QACR,YAAY;QACZ,aAAa;QACb,WAAW,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE;QAC5C,SAAS;QACT,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;QAClC,UAAU,EAAE,UAAU,CAAC,WAAW,EAAE;QACpC,WAAW,EAAE,OAAO;KACrB,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAwB,EACxB,OAAiD;IAEjD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC;SACpB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACZ,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACzB,IAAI,YAAY,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACpC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAClE,IAAI,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,kFAAkF;AAClF,KAAK,SAAS,CAAC,CAAC,mBAAmB,CAAC,KAAe,EAAE,OAAoB;IACvE,KAAK,MAAM,GAAG,IAAI,sBAAsB,CAAC,KAAK,EAAE,OAAO,CAAC;QAAE,MAAM,GAAG,CAAC;AACtE,CAAC","sourcesContent":["/**\n * Scan orchestrator. Walks the target (or an explicit file list), runs the\n * applicable detectors over each file, parses dependency manifests, aggregates\n * everything into an inventory, and returns a {@link ScanResult} with timing and\n * the tool version.\n *\n * Detector scope (source vs config) is driven by each {@link Detector}'s\n * declared `scope` (defaulting to \"source\"), not by ruleId prefixes. The\n * detector set comes from {@link defaultRegistry} unless overridden via\n * `options.detectors`.\n */\nimport { readFile, stat } from \"node:fs/promises\";\nimport * as path from \"node:path\";\n\nimport type { Detector, Finding, ScanOptions, ScanResult } from \"./types.js\";\nimport { walkFiles, toPosix, isBinaryPath, looksMinified, matchesAny } from \"./walk.js\";\nimport { isAnalyzableSource } from \"./detect-utils.js\";\nimport {\n  stripCommentFindings,\n  stripIgnoredFindings,\n  stripStringLiteralFindings,\n} from \"./comments.js\";\n\n/**\n * Rules whose token is only meaningful as code, never inside a string literal.\n * A match inside a string (e.g. `t.Error(\"SigningMethodPS256 …\")`) is prose and\n * is dropped. Rules that legitimately match quoted tokens are NOT listed here.\n */\nconst CODE_ONLY_RULES: ReadonlySet<string> = new Set([\"go-jwt-signingmethod\"]);\nimport { hashContent, loadCache, rulesetFingerprint, saveCache } from \"./cache.js\";\nimport type { CacheEntry } from \"./cache.js\";\nimport { builtinDetectors, defaultRegistry, detectorScope } from \"./registry.js\";\nimport { isManifestFile, scanManifest } from \"./dependencies.js\";\nimport { buildInventory } from \"./inventory.js\";\nimport { AbortError, BudgetExceededError } from \"./errors.js\";\nimport { VERSION } from \"./version.js\";\n\n/**\n * The full set of built-in detectors exposed on the public API. Re-exported\n * from {@link builtinDetectors} in `registry.ts` — the single source of truth\n * the {@link defaultRegistry} is also built from — so the public array and the\n * registry can never drift apart. The manifest scanner is handled separately\n * (it parses JSON rather than running a Detector).\n */\nexport const detectors: Detector[] = builtinDetectors;\n\n/** Stable comparator: by file, then line, then ruleId. Exported for reuse. */\nexport function compareFindings(a: Finding, b: Finding): number {\n  if (a.location.file !== b.location.file) return a.location.file < b.location.file ? -1 : 1;\n  if (a.location.line !== b.location.line) return a.location.line - b.location.line;\n  return a.ruleId < b.ruleId ? -1 : a.ruleId > b.ruleId ? 1 : 0;\n}\n\n/** Resolve the active detector list for a scan (override or the default registry). */\nfunction resolveDetectors(options: ScanOptions): Detector[] {\n  return options.detectors ?? defaultRegistry.all();\n}\n\n/**\n * Run all applicable detectors + the manifest scanner over a single file's\n * contents, honouring the source / config / dependencies toggles. Pure: no I/O.\n * Exported so the parallel worker and unit tests can drive it directly.\n */\nexport function detectFile(\n  file: string,\n  content: string,\n  dets: readonly Detector[],\n  toggles: { source: boolean; config: boolean; deps: boolean },\n  disabledRules?: readonly string[],\n): Finding[] {\n  let out: Finding[] = [];\n\n  for (const det of dets) {\n    if (!det.appliesTo(file)) continue;\n    const isConfig = detectorScope(det) === \"config\";\n    if (isConfig ? !toggles.config : !toggles.source) continue;\n    out.push(...det.detect({ file, content }));\n  }\n\n  // Drop lexical false positives that land inside comments (`// migrated off\n  // createECDH()`), then honour inline `// qscan-ignore-line` /\n  // `qscan-ignore-next-line` directives. Both run before the dependency scan\n  // appends its findings (manifests carry neither).\n  out = stripCommentFindings(out, content, file);\n  out = stripStringLiteralFindings(out, content, file, CODE_ONLY_RULES);\n  out = stripIgnoredFindings(out, content);\n\n  if (toggles.deps && isManifestFile(file)) {\n    out.push(...scanManifest(file, content));\n  }\n\n  // Per-rule suppression: drop findings whose ruleId was disabled. Applied here\n  // so both the serial scan and the worker path honour it identically.\n  if (disabledRules && disabledRules.length > 0) {\n    const disabled = new Set(disabledRules);\n    return out.filter((f) => !disabled.has(f.ruleId));\n  }\n\n  return out;\n}\n\n/**\n * Recursively scan a directory (or single file, or explicit file list) for\n * classical asymmetric crypto. Honours the source / dependencies / config\n * toggles (all default true) and reports progress through `options.onFile`.\n */\nexport async function scan(options: ScanOptions): Promise<ScanResult> {\n  const startedAt = new Date();\n\n  const doSource = options.source !== false;\n  const doDeps = options.dependencies !== false;\n  const doConfig = options.config !== false;\n  const scanMinified = options.scanMinified === true;\n  const dets = resolveDetectors(options);\n\n  // Resolve whether the root is a file so we can rebuild absolute paths to read.\n  const rootStat = await stat(options.root);\n  const rootIsFile = rootStat.isFile();\n  const baseDir = rootIsFile ? path.dirname(options.root) : options.root;\n  const singleFileName = rootIsFile ? path.basename(options.root) : null;\n\n  const findings: Finding[] = [];\n  let filesScanned = 0;\n  let analyzedFiles = 0;\n  let bytesScanned = 0;\n  let unreadable = 0;\n  let skippedMinified = 0;\n\n  // Optional content-hash scan cache: unchanged files reuse prior findings.\n  const cacheFile = options.cacheFile;\n  const ruleset = cacheFile ? rulesetFingerprint(dets, options.disabledRules) : \"\";\n  const cache = cacheFile ? await loadCache(cacheFile, ruleset) : null;\n  // A full scan starts with an empty next-cache so files that vanished are\n  // evicted. An INCREMENTAL scan (explicit `files` list) only visits a subset,\n  // so seed the next-cache with the existing entries — otherwise saving would\n  // drop every file we didn't happen to scan this run (audit: arch #4).\n  const incremental = Array.isArray(options.files);\n  const nextEntries: Map<string, CacheEntry> | null = cacheFile\n    ? new Map(incremental && cache ? cache : [])\n    : null;\n\n  // Work-budget / cancellation controls (all optional, unlimited when omitted).\n  const signal = options.signal;\n  const maxFiles = options.maxFiles;\n  const maxBytes = options.maxBytes;\n\n  // Source of relative paths: an explicit file list (incremental) or the walker.\n  const relPaths: AsyncIterable<string> = options.files\n    ? filterExplicitFiles(options.files, options)\n    : walkFiles(options.root, {\n        include: options.include,\n        exclude: options.exclude,\n        noDefaultIgnores: options.noDefaultIgnores,\n        maxFileSize: options.maxFileSize,\n      });\n\n  for await (const rel of relPaths) {\n    // Cooperative cancellation: check the signal at the top of every iteration.\n    if (signal?.aborted) throw new AbortError();\n\n    // File-count budget: enforced before reading the next file.\n    if (typeof maxFiles === \"number\" && filesScanned >= maxFiles) {\n      throw new BudgetExceededError(`maxFiles budget exceeded (limit: ${maxFiles}).`);\n    }\n\n    // In single-file mode, walkFiles yields the basename; map back to the file.\n    const absPath = singleFileName ? options.root : path.join(baseDir, ...rel.split(\"/\"));\n    const reportedPath = singleFileName ? toPosix(rel) : rel;\n\n    options.onFile?.(reportedPath);\n\n    let content: string;\n    try {\n      content = await readFile(absPath, \"utf8\");\n    } catch {\n      unreadable += 1; // permissions / vanished / decode failure — tracked, not silent.\n      continue;\n    }\n\n    // Skip machine-minified / generated content (unless explicitly enabled).\n    // Manifests are always scanned (their findings are dependency findings).\n    if (!scanMinified && !isManifestFile(reportedPath) && looksMinified(content)) {\n      skippedMinified += 1;\n      continue;\n    }\n\n    // Cumulative-byte budget: enforced once this file's bytes are accounted for.\n    bytesScanned += Buffer.byteLength(content, \"utf8\");\n    if (typeof maxBytes === \"number\" && bytesScanned > maxBytes) {\n      throw new BudgetExceededError(`maxBytes budget exceeded (limit: ${maxBytes}).`);\n    }\n\n    filesScanned += 1;\n    if (isAnalyzableSource(reportedPath)) analyzedFiles += 1;\n\n    // Cache: reuse prior findings when the content hash matches; otherwise scan\n    // and record. `nextEntries` becomes the new cache (dropping vanished files).\n    let fileFindings: Finding[];\n    if (cache && nextEntries) {\n      const hash = hashContent(content);\n      const hit = cache.get(reportedPath);\n      fileFindings =\n        hit && hit.hash === hash\n          ? hit.findings\n          : detectFile(\n              reportedPath,\n              content,\n              dets,\n              { source: doSource, config: doConfig, deps: doDeps },\n              options.disabledRules,\n            );\n      nextEntries.set(reportedPath, { hash, findings: fileFindings });\n    } else {\n      fileFindings = detectFile(\n        reportedPath,\n        content,\n        dets,\n        { source: doSource, config: doConfig, deps: doDeps },\n        options.disabledRules,\n      );\n    }\n    findings.push(...fileFindings);\n  }\n\n  // Persist the cache (best effort) before ordering/returning.\n  if (cacheFile && nextEntries) await saveCache(cacheFile, ruleset, nextEntries);\n\n  // Stable ordering: by file, then line, then ruleId.\n  findings.sort(compareFindings);\n\n  const inventory = buildInventory(findings);\n  const finishedAt = new Date();\n\n  return {\n    root: options.root,\n    findings,\n    filesScanned,\n    analyzedFiles,\n    diagnostics: { unreadable, skippedMinified },\n    inventory,\n    startedAt: startedAt.toISOString(),\n    finishedAt: finishedAt.toISOString(),\n    toolVersion: VERSION,\n  };\n}\n\n/**\n * Filter an explicit relative file list down to the paths that pass the binary\n * filter and the include/exclude patterns, returning them deduped and sorted for\n * deterministic output. Size limits are enforced later (we still read manifests\n * over the cap). Non-existent files are simply skipped at read time.\n *\n * Pure + synchronous, and exported so the parallel enumerator applies the EXACT\n * same filtering for explicit file lists as the serial path (byte-for-byte\n * identical results under `--parallel`).\n */\nexport function filterExplicitFileList(\n  files: readonly string[],\n  options: Pick<ScanOptions, \"include\" | \"exclude\">,\n): string[] {\n  const include = options.include ?? [];\n  const exclude = options.exclude ?? [];\n  const seen = new Set<string>();\n  const list = [...files]\n    .map((f) => toPosix(f))\n    .filter((f) => {\n      if (seen.has(f)) return false;\n      seen.add(f);\n      return true;\n    })\n    .sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));\n\n  return list.filter((rel) => {\n    if (isBinaryPath(rel)) return false;\n    if (include.length > 0 && !matchesAny(rel, include)) return false;\n    if (matchesAny(rel, exclude)) return false;\n    return true;\n  });\n}\n\n/** Async-generator wrapper around {@link filterExplicitFileList} for `scan()`. */\nasync function* filterExplicitFiles(files: string[], options: ScanOptions): AsyncGenerator<string> {\n  for (const rel of filterExplicitFileList(files, options)) yield rel;\n}\n"]}
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../src/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EACL,SAAS,EACT,OAAO,EACP,YAAY,EACZ,cAAc,EACd,aAAa,EACb,UAAU,EACV,qBAAqB,GACtB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,0BAA0B,GAC3B,MAAM,eAAe,CAAC;AAEvB;;;;GAIG;AACH,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC;IACnD,sBAAsB;IACtB,4EAA4E;IAC5E,oFAAoF;IACpF,qFAAqF;IACrF,uEAAuE;IACvE,cAAc;IACd,gBAAgB;IAChB,oBAAoB;CACrB,CAAC,CAAC;AACH,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEnF,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,SAAS,GAAe,gBAAgB,CAAC;AAEtD,8EAA8E;AAC9E,MAAM,UAAU,eAAe,CAAC,CAAU,EAAE,CAAU;IACpD,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI;QAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;IAClF,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,sFAAsF;AACtF,SAAS,gBAAgB,CAAC,OAAoB;IAC5C,OAAO,OAAO,CAAC,SAAS,IAAI,eAAe,CAAC,GAAG,EAAE,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CACxB,IAAY,EACZ,OAAe,EACf,IAAyB,EACzB,OAA4D,EAC5D,aAAiC;IAEjC,IAAI,GAAG,GAAc,EAAE,CAAC;IAExB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC;QACjD,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM;YAAE,SAAS;QAC3D,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,2EAA2E;IAC3E,8DAA8D;IAC9D,2EAA2E;IAC3E,kDAAkD;IAClD,GAAG,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/C,GAAG,GAAG,0BAA0B,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;IACtE,GAAG,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAEzC,IAAI,OAAO,CAAC,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,8EAA8E;IAC9E,qEAAqE;IACrE,IAAI,aAAa,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC;QACxC,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAoB;IAC7C,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAE7B,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,KAAK,KAAK,CAAC;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;IAC1C,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC;IACnD,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAEvC,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACvE,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEvE,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,eAAe,GAAG,CAAC,CAAC;IAExB,0EAA0E;IAC1E,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACpC,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,yEAAyE;IACzE,6EAA6E;IAC7E,4EAA4E;IAC5E,sEAAsE;IACtE,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,WAAW,GAAmC,SAAS;QAC3D,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,CAAC,CAAC,IAAI,CAAC;IAET,8EAA8E;IAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAElC,+EAA+E;IAC/E,MAAM,QAAQ,GAA0B,OAAO,CAAC,KAAK;QACnD,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;QAC7C,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE;YACtB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,CAAC;IAEP,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QACjC,4EAA4E;QAC5E,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,UAAU,EAAE,CAAC;QAE5C,4DAA4D;QAC5D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,YAAY,IAAI,QAAQ,EAAE,CAAC;YAC7D,MAAM,IAAI,mBAAmB,CAAC,oCAAoC,QAAQ,IAAI,CAAC,CAAC;QAClF,CAAC;QAED,4EAA4E;QAC5E,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACtF,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAEzD,OAAO,CAAC,MAAM,EAAE,CAAC,YAAY,CAAC,CAAC;QAE/B,8EAA8E;QAC9E,6DAA6D;QAC7D,MAAM,QAAQ,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;QAC9C,+EAA+E;QAC/E,6EAA6E;QAC7E,0EAA0E;QAC1E,0BAA0B;QAC1B,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC;gBACrC,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,qBAAqB,CAAC;oBAAE,SAAS;YACtE,CAAC;YAAC,MAAM,CAAC;gBACP,UAAU,IAAI,CAAC,CAAC;gBAChB,SAAS;YACX,CAAC;QACH,CAAC;QACD,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,IAAI,CAAC,CAAC,CAAC,iEAAiE;YAClF,SAAS;QACX,CAAC;QAED,yEAAyE;QACzE,8CAA8C;QAC9C,IAAI,CAAC,YAAY,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1F,eAAe,IAAI,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QAED,6EAA6E;QAC7E,4EAA4E;QAC5E,4DAA4D;QAC5D,YAAY,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACzE,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,YAAY,GAAG,QAAQ,EAAE,CAAC;YAC5D,MAAM,IAAI,mBAAmB,CAAC,oCAAoC,QAAQ,IAAI,CAAC,CAAC;QAClF,CAAC;QAED,YAAY,IAAI,CAAC,CAAC;QAClB,IAAI,kBAAkB,CAAC,YAAY,CAAC;YAAE,aAAa,IAAI,CAAC,CAAC;QAEzD,4EAA4E;QAC5E,6EAA6E;QAC7E,IAAI,YAAuB,CAAC;QAC5B,IAAI,KAAK,IAAI,WAAW,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;YAClC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACpC,YAAY;gBACV,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI;oBACtB,CAAC,CAAC,GAAG,CAAC,QAAQ;oBACd,CAAC,CAAC,UAAU,CACR,YAAY,EACZ,OAAO,EACP,IAAI,EACJ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EACpD,OAAO,CAAC,aAAa,CACtB,CAAC;YACR,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QAClE,CAAC;aAAM,CAAC;YACN,YAAY,GAAG,UAAU,CACvB,YAAY,EACZ,OAAO,EACP,IAAI,EACJ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EACpD,OAAO,CAAC,aAAa,CACtB,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,CAAC;IACjC,CAAC;IAED,6DAA6D;IAC7D,IAAI,SAAS,IAAI,WAAW;QAAE,MAAM,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IAE/E,oDAAoD;IACpD,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAE/B,MAAM,SAAS,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;IAE9B,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ;QACR,YAAY;QACZ,aAAa;QACb,WAAW,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE;QAC5C,SAAS;QACT,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;QAClC,UAAU,EAAE,UAAU,CAAC,WAAW,EAAE;QACpC,WAAW,EAAE,OAAO;KACrB,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAwB,EACxB,OAAiD;IAEjD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC;SACpB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;SACtB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACZ,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QACzB,IAAI,YAAY,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACpC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAClE,IAAI,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,kFAAkF;AAClF,KAAK,SAAS,CAAC,CAAC,mBAAmB,CAAC,KAAe,EAAE,OAAoB;IACvE,KAAK,MAAM,GAAG,IAAI,sBAAsB,CAAC,KAAK,EAAE,OAAO,CAAC;QAAE,MAAM,GAAG,CAAC;AACtE,CAAC","sourcesContent":["/**\n * Scan orchestrator. Walks the target (or an explicit file list), runs the\n * applicable detectors over each file, parses dependency manifests, aggregates\n * everything into an inventory, and returns a {@link ScanResult} with timing and\n * the tool version.\n *\n * Detector scope (source vs config) is driven by each {@link Detector}'s\n * declared `scope` (defaulting to \"source\"), not by ruleId prefixes. The\n * detector set comes from {@link defaultRegistry} unless overridden via\n * `options.detectors`.\n */\nimport { readFile, stat } from \"node:fs/promises\";\nimport * as path from \"node:path\";\n\nimport type { Detector, Finding, ScanOptions, ScanResult } from \"./types.js\";\nimport {\n  walkFiles,\n  toPosix,\n  isBinaryPath,\n  isKeystorePath,\n  looksMinified,\n  matchesAny,\n  DEFAULT_MAX_FILE_SIZE,\n} from \"./walk.js\";\nimport { isAnalyzableSource } from \"./detect-utils.js\";\nimport {\n  stripCommentFindings,\n  stripIgnoredFindings,\n  stripStringLiteralFindings,\n} from \"./comments.js\";\n\n/**\n * Rules whose token is only meaningful as code, never inside a string literal.\n * A match inside a string (e.g. `t.Error(\"SigningMethodPS256 …\")`) is prose and\n * is dropped. Rules that legitimately match quoted tokens are NOT listed here.\n */\nconst CODE_ONLY_RULES: ReadonlySet<string> = new Set([\n  \"go-jwt-signingmethod\",\n  // Identifier-form JWT alg constants (jjwt `SignatureAlgorithm.RS256`, auth0\n  // `Algorithm.RSA256`, C# `SecurityAlgorithms.*`, Rust `Algorithm::RS256`). Like the\n  // Go rule, these are only meaningful as code; the SAME token inside a string literal\n  // (an error message that names/forbids the alg) is prose, not a usage.\n  \"java-jwt-alg\",\n  \"csharp-jwt-alg\",\n  \"rust-jwt-algorithm\",\n]);\nimport { hashContent, loadCache, rulesetFingerprint, saveCache } from \"./cache.js\";\nimport type { CacheEntry } from \"./cache.js\";\nimport { builtinDetectors, defaultRegistry, detectorScope } from \"./registry.js\";\nimport { isManifestFile, scanManifest } from \"./dependencies.js\";\nimport { buildInventory } from \"./inventory.js\";\nimport { AbortError, BudgetExceededError } from \"./errors.js\";\nimport { VERSION } from \"./version.js\";\n\n/**\n * The full set of built-in detectors exposed on the public API. Re-exported\n * from {@link builtinDetectors} in `registry.ts` — the single source of truth\n * the {@link defaultRegistry} is also built from — so the public array and the\n * registry can never drift apart. The manifest scanner is handled separately\n * (it parses JSON rather than running a Detector).\n */\nexport const detectors: Detector[] = builtinDetectors;\n\n/** Stable comparator: by file, then line, then ruleId. Exported for reuse. */\nexport function compareFindings(a: Finding, b: Finding): number {\n  if (a.location.file !== b.location.file) return a.location.file < b.location.file ? -1 : 1;\n  if (a.location.line !== b.location.line) return a.location.line - b.location.line;\n  return a.ruleId < b.ruleId ? -1 : a.ruleId > b.ruleId ? 1 : 0;\n}\n\n/** Resolve the active detector list for a scan (override or the default registry). */\nfunction resolveDetectors(options: ScanOptions): Detector[] {\n  return options.detectors ?? defaultRegistry.all();\n}\n\n/**\n * Run all applicable detectors + the manifest scanner over a single file's\n * contents, honouring the source / config / dependencies toggles. Pure: no I/O.\n * Exported so the parallel worker and unit tests can drive it directly.\n */\nexport function detectFile(\n  file: string,\n  content: string,\n  dets: readonly Detector[],\n  toggles: { source: boolean; config: boolean; deps: boolean },\n  disabledRules?: readonly string[],\n): Finding[] {\n  let out: Finding[] = [];\n\n  for (const det of dets) {\n    if (!det.appliesTo(file)) continue;\n    const isConfig = detectorScope(det) === \"config\";\n    if (isConfig ? !toggles.config : !toggles.source) continue;\n    out.push(...det.detect({ file, content }));\n  }\n\n  // Drop lexical false positives that land inside comments (`// migrated off\n  // createECDH()`), then honour inline `// qscan-ignore-line` /\n  // `qscan-ignore-next-line` directives. Both run before the dependency scan\n  // appends its findings (manifests carry neither).\n  out = stripCommentFindings(out, content, file);\n  out = stripStringLiteralFindings(out, content, file, CODE_ONLY_RULES);\n  out = stripIgnoredFindings(out, content);\n\n  if (toggles.deps && isManifestFile(file)) {\n    out.push(...scanManifest(file, content));\n  }\n\n  // Per-rule suppression: drop findings whose ruleId was disabled. Applied here\n  // so both the serial scan and the worker path honour it identically.\n  if (disabledRules && disabledRules.length > 0) {\n    const disabled = new Set(disabledRules);\n    return out.filter((f) => !disabled.has(f.ruleId));\n  }\n\n  return out;\n}\n\n/**\n * Recursively scan a directory (or single file, or explicit file list) for\n * classical asymmetric crypto. Honours the source / dependencies / config\n * toggles (all default true) and reports progress through `options.onFile`.\n */\nexport async function scan(options: ScanOptions): Promise<ScanResult> {\n  const startedAt = new Date();\n\n  const doSource = options.source !== false;\n  const doDeps = options.dependencies !== false;\n  const doConfig = options.config !== false;\n  const scanMinified = options.scanMinified === true;\n  const dets = resolveDetectors(options);\n\n  // Resolve whether the root is a file so we can rebuild absolute paths to read.\n  const rootStat = await stat(options.root);\n  const rootIsFile = rootStat.isFile();\n  const baseDir = rootIsFile ? path.dirname(options.root) : options.root;\n  const singleFileName = rootIsFile ? path.basename(options.root) : null;\n\n  const findings: Finding[] = [];\n  let filesScanned = 0;\n  let analyzedFiles = 0;\n  let bytesScanned = 0;\n  let unreadable = 0;\n  let skippedMinified = 0;\n\n  // Optional content-hash scan cache: unchanged files reuse prior findings.\n  const cacheFile = options.cacheFile;\n  const ruleset = cacheFile ? rulesetFingerprint(dets, options.disabledRules) : \"\";\n  const cache = cacheFile ? await loadCache(cacheFile, ruleset) : null;\n  // A full scan starts with an empty next-cache so files that vanished are\n  // evicted. An INCREMENTAL scan (explicit `files` list) only visits a subset,\n  // so seed the next-cache with the existing entries — otherwise saving would\n  // drop every file we didn't happen to scan this run (audit: arch #4).\n  const incremental = Array.isArray(options.files);\n  const nextEntries: Map<string, CacheEntry> | null = cacheFile\n    ? new Map(incremental && cache ? cache : [])\n    : null;\n\n  // Work-budget / cancellation controls (all optional, unlimited when omitted).\n  const signal = options.signal;\n  const maxFiles = options.maxFiles;\n  const maxBytes = options.maxBytes;\n\n  // Source of relative paths: an explicit file list (incremental) or the walker.\n  const relPaths: AsyncIterable<string> = options.files\n    ? filterExplicitFiles(options.files, options)\n    : walkFiles(options.root, {\n        include: options.include,\n        exclude: options.exclude,\n        noDefaultIgnores: options.noDefaultIgnores,\n        maxFileSize: options.maxFileSize,\n      });\n\n  for await (const rel of relPaths) {\n    // Cooperative cancellation: check the signal at the top of every iteration.\n    if (signal?.aborted) throw new AbortError();\n\n    // File-count budget: enforced before reading the next file.\n    if (typeof maxFiles === \"number\" && filesScanned >= maxFiles) {\n      throw new BudgetExceededError(`maxFiles budget exceeded (limit: ${maxFiles}).`);\n    }\n\n    // In single-file mode, walkFiles yields the basename; map back to the file.\n    const absPath = singleFileName ? options.root : path.join(baseDir, ...rel.split(\"/\"));\n    const reportedPath = singleFileName ? toPosix(rel) : rel;\n\n    options.onFile?.(reportedPath);\n\n    // Cryptographic keystores (.jks/.p12/…) are binary; read them byte-preserving\n    // (latin1) so the keystore detector can inspect magic bytes.\n    const keystore = isKeystorePath(reportedPath);\n    // Keystores are read whole into memory as latin1. The walker already caps file\n    // size, but the explicit-file-list (incremental) path does not — so stat and\n    // skip an oversized binary here to avoid reading a huge encrypted archive\n    // (`.gpg`) into a string.\n    if (keystore) {\n      try {\n        const { size } = await stat(absPath);\n        if (size > (options.maxFileSize ?? DEFAULT_MAX_FILE_SIZE)) continue;\n      } catch {\n        unreadable += 1;\n        continue;\n      }\n    }\n    let content: string;\n    try {\n      content = await readFile(absPath, keystore ? \"latin1\" : \"utf8\");\n    } catch {\n      unreadable += 1; // permissions / vanished / decode failure — tracked, not silent.\n      continue;\n    }\n\n    // Skip machine-minified / generated content (unless explicitly enabled).\n    // Manifests and keystores are always scanned.\n    if (!scanMinified && !isManifestFile(reportedPath) && !keystore && looksMinified(content)) {\n      skippedMinified += 1;\n      continue;\n    }\n\n    // Cumulative-byte budget: enforced once this file's bytes are accounted for.\n    // Use the read encoding so a latin1 keystore is counted at its on-disk size\n    // (a utf8 byteLength would double-count every byte ≥ 0x80).\n    bytesScanned += Buffer.byteLength(content, keystore ? \"latin1\" : \"utf8\");\n    if (typeof maxBytes === \"number\" && bytesScanned > maxBytes) {\n      throw new BudgetExceededError(`maxBytes budget exceeded (limit: ${maxBytes}).`);\n    }\n\n    filesScanned += 1;\n    if (isAnalyzableSource(reportedPath)) analyzedFiles += 1;\n\n    // Cache: reuse prior findings when the content hash matches; otherwise scan\n    // and record. `nextEntries` becomes the new cache (dropping vanished files).\n    let fileFindings: Finding[];\n    if (cache && nextEntries) {\n      const hash = hashContent(content);\n      const hit = cache.get(reportedPath);\n      fileFindings =\n        hit && hit.hash === hash\n          ? hit.findings\n          : detectFile(\n              reportedPath,\n              content,\n              dets,\n              { source: doSource, config: doConfig, deps: doDeps },\n              options.disabledRules,\n            );\n      nextEntries.set(reportedPath, { hash, findings: fileFindings });\n    } else {\n      fileFindings = detectFile(\n        reportedPath,\n        content,\n        dets,\n        { source: doSource, config: doConfig, deps: doDeps },\n        options.disabledRules,\n      );\n    }\n    findings.push(...fileFindings);\n  }\n\n  // Persist the cache (best effort) before ordering/returning.\n  if (cacheFile && nextEntries) await saveCache(cacheFile, ruleset, nextEntries);\n\n  // Stable ordering: by file, then line, then ruleId.\n  findings.sort(compareFindings);\n\n  const inventory = buildInventory(findings);\n  const finishedAt = new Date();\n\n  return {\n    root: options.root,\n    findings,\n    filesScanned,\n    analyzedFiles,\n    diagnostics: { unreadable, skippedMinified },\n    inventory,\n    startedAt: startedAt.toISOString(),\n    finishedAt: finishedAt.toISOString(),\n    toolVersion: VERSION,\n  };\n}\n\n/**\n * Filter an explicit relative file list down to the paths that pass the binary\n * filter and the include/exclude patterns, returning them deduped and sorted for\n * deterministic output. Size limits are enforced later (we still read manifests\n * over the cap). Non-existent files are simply skipped at read time.\n *\n * Pure + synchronous, and exported so the parallel enumerator applies the EXACT\n * same filtering for explicit file lists as the serial path (byte-for-byte\n * identical results under `--parallel`).\n */\nexport function filterExplicitFileList(\n  files: readonly string[],\n  options: Pick<ScanOptions, \"include\" | \"exclude\">,\n): string[] {\n  const include = options.include ?? [];\n  const exclude = options.exclude ?? [];\n  const seen = new Set<string>();\n  const list = [...files]\n    .map((f) => toPosix(f))\n    .filter((f) => {\n      if (seen.has(f)) return false;\n      seen.add(f);\n      return true;\n    })\n    .sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));\n\n  return list.filter((rel) => {\n    if (isBinaryPath(rel)) return false;\n    if (include.length > 0 && !matchesAny(rel, include)) return false;\n    if (matchesAny(rel, exclude)) return false;\n    return true;\n  });\n}\n\n/** Async-generator wrapper around {@link filterExplicitFileList} for `scan()`. */\nasync function* filterExplicitFiles(files: string[], options: ScanOptions): AsyncGenerator<string> {\n  for (const rel of filterExplicitFileList(files, options)) yield rel;\n}\n"]}