@quantakrypto/core 0.4.4 → 0.6.0

package/dist/crypto-agility.js

@@ -0,0 +1,285 @@
+/**
+ * Crypto-agility manifest: an agent-consumable crypto-posture document.
+ *
+ * A small, versioned JSON manifest a project publishes at a well-known URL
+ * (`/.well-known/crypto-agility.json`, see docs/CRYPTO-AGILITY-MANIFEST.md) so any
+ * agent, scanner, or CI bot can read the project's cryptographic posture the way it
+ * reads `security.txt` or `robots.txt`. It is a compact, decision-oriented summary
+ * DERIVED from a qScan result: the readiness score, the count of quantum-vulnerable
+ * findings by severity, the CBOM's algorithm families, an optional attestation URL,
+ * and the migration-policy deadlines.
+ *
+ * This module owns two pure operations and their shared schema:
+ *   - {@link buildCryptoAgilityManifest}: derive a manifest from a {@link ScanResult}.
+ *   - {@link validateCryptoAgilityManifest}: check an untrusted value against the
+ *     schema, returning a list of problems (used by the local validator; a network
+ *     fetch-and-validate lives on the website, never in this offline-boundary tool).
+ *
+ * Zero dependencies; hand-rolled JSON shape and validation so the package stays
+ * runtime-dependency-free.
+ */
+import { toCbom } from "./cbom.js";
+import { PQC_STANDARDS } from "./standards.js";
+import { SEVERITY_ORDER } from "./severity.js";
+import { VERSION } from "./version.js";
+/**
+ * Schema version of the manifest this module emits and validates. Bumped only on a
+ * breaking change to the manifest shape; consumers key their parsing off it.
+ */
+export const CRYPTO_AGILITY_MANIFEST_VERSION = 1;
+/** The conventional path a manifest is served from, relative to the site origin. */
+export const CRYPTO_AGILITY_WELL_KNOWN_PATH = "/.well-known/crypto-agility.json";
+/**
+ * Build a crypto-agility manifest from a scan result. Pure: every runtime input
+ * (timestamp, attestation, hybrid-KEX assertion, policy) arrives via `opts`.
+ *
+ * The posture and CBOM summary are derived straight from the scan's inventory and
+ * its CycloneDX CBOM, so the manifest can never disagree with the full `--cbom` /
+ * `--format json` outputs of the same scan.
+ */
+export function buildCryptoAgilityManifest(result, opts) {
+    const cbom = toCbom(result);
+    const inv = result.inventory;
+    const algorithmFamilies = Object.entries(inv.byAlgorithm)
+        .filter(([, count]) => (count ?? 0) > 0)
+        .map(([family, count]) => ({
+        family,
+        count: count,
+        // Every family the detectors surface is classical, hence quantum-vulnerable
+        // by construction (mirrors cbom.ts `isQuantumVulnerable`).
+        quantumVulnerable: true,
+    }))
+        .sort((a, b) => b.count - a.count || a.family.localeCompare(b.family));
+    const bySeverity = { ...inv.bySeverity };
+    // Default policy: the NIST IR 8547 transition timeline. An operator crypto policy
+    // (`--policy`) does not override the standards deadlines but layers its own
+    // `transitionDeadline` on top and re-labels the source as operator-declared.
+    const timeline = PQC_STANDARDS.transitionTimeline;
+    const policy = {
+        source: opts.policy ? "operator-declared" : timeline.source,
+        deprecateClassicalAfter: timeline.deprecateAfter,
+        disallowClassicalAfter: timeline.disallowAfter,
+        transitionDeadline: opts.policy?.transitionDeadline ?? null,
+        citation: timeline.source,
+    };
+    const manifest = {
+        version: CRYPTO_AGILITY_MANIFEST_VERSION,
+        manifestType: "crypto-agility",
+        generatedAt: opts.generatedAt,
+        generator: { name: "qScan", version: result.toolVersion || VERSION },
+        subject: {
+            root: result.root,
+            repository: opts.repository ?? null,
+            commit: opts.commit ?? null,
+        },
+        posture: {
+            readinessScore: inv.readinessScore,
+            hybridKexInUse: opts.hybridKexInUse ?? null,
+            quantumVulnerable: {
+                total: result.findings.length,
+                bySeverity,
+            },
+            hndlExposedCount: inv.hndlCount,
+        },
+        cbomSummary: {
+            serialNumber: cbom.serialNumber,
+            assetCount: cbom.components.length,
+            algorithmFamilies,
+        },
+        ...(opts.attestationUrl ? { attestation: { url: opts.attestationUrl } } : {}),
+        policy,
+    };
+    return manifest;
+}
+/** True for a plain (non-array, non-null) object. */
+function isObject(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+/**
+ * Validate an untrusted value against the crypto-agility manifest schema.
+ *
+ * Checks structure, required fields, types, and the schema version. Purely local:
+ * it parses an already-in-memory value and NEVER performs I/O or network fetches;
+ * a fetch-and-validate of a remote manifest is a website-side concern, deliberately
+ * kept out of this offline-boundary tool. Returns every problem it finds rather than
+ * throwing on the first, so a caller can report them all at once.
+ */
+export function validateCryptoAgilityManifest(value) {
+    const errors = [];
+    const err = (m) => void errors.push(m);
+    if (!isObject(value)) {
+        return { valid: false, errors: ["manifest must be a JSON object"] };
+    }
+    // version
+    if (value.version === undefined) {
+        err("missing required field: version");
+    }
+    else if (typeof value.version !== "number" || !Number.isInteger(value.version)) {
+        err("version must be an integer");
+    }
+    else if (value.version !== CRYPTO_AGILITY_MANIFEST_VERSION) {
+        err(`unsupported version ${value.version} (this validator understands version ${CRYPTO_AGILITY_MANIFEST_VERSION})`);
+    }
+    // manifestType
+    if (value.manifestType === undefined) {
+        err("missing required field: manifestType");
+    }
+    else if (value.manifestType !== "crypto-agility") {
+        err('manifestType must be the string "crypto-agility"');
+    }
+    // generatedAt
+    if (value.generatedAt === undefined) {
+        err("missing required field: generatedAt");
+    }
+    else if (typeof value.generatedAt !== "string" || value.generatedAt.length === 0) {
+        err("generatedAt must be a non-empty ISO 8601 string");
+    }
+    else if (Number.isNaN(Date.parse(value.generatedAt))) {
+        err("generatedAt must be a parseable ISO 8601 timestamp");
+    }
+    // generator
+    if (value.generator === undefined) {
+        err("missing required field: generator");
+    }
+    else if (!isObject(value.generator)) {
+        err("generator must be an object");
+    }
+    else {
+        if (typeof value.generator.name !== "string")
+            err("generator.name must be a string");
+        if (typeof value.generator.version !== "string")
+            err("generator.version must be a string");
+    }
+    // subject
+    if (value.subject === undefined) {
+        err("missing required field: subject");
+    }
+    else if (!isObject(value.subject)) {
+        err("subject must be an object");
+    }
+    else {
+        if (typeof value.subject.root !== "string")
+            err("subject.root must be a string");
+        if (value.subject.repository !== null && typeof value.subject.repository !== "string") {
+            err("subject.repository must be a string or null");
+        }
+        if (value.subject.commit !== null && typeof value.subject.commit !== "string") {
+            err("subject.commit must be a string or null");
+        }
+    }
+    // posture
+    validatePosture(value.posture, err);
+    // cbomSummary
+    validateCbomSummary(value.cbomSummary, err);
+    // attestation (optional)
+    if (value.attestation !== undefined) {
+        if (!isObject(value.attestation)) {
+            err("attestation must be an object when present");
+        }
+        else if (typeof value.attestation.url !== "string" || value.attestation.url.length === 0) {
+            err("attestation.url must be a non-empty string");
+        }
+    }
+    // policy
+    validatePolicy(value.policy, err);
+    return { valid: errors.length === 0, errors };
+}
+/** Validate the `posture` block. */
+function validatePosture(posture, err) {
+    if (posture === undefined) {
+        err("missing required field: posture");
+        return;
+    }
+    if (!isObject(posture)) {
+        err("posture must be an object");
+        return;
+    }
+    if (typeof posture.readinessScore !== "number" ||
+        posture.readinessScore < 0 ||
+        posture.readinessScore > 100) {
+        err("posture.readinessScore must be a number between 0 and 100");
+    }
+    if (posture.hybridKexInUse !== null && typeof posture.hybridKexInUse !== "boolean") {
+        err("posture.hybridKexInUse must be a boolean or null");
+    }
+    if (typeof posture.hndlExposedCount !== "number" || posture.hndlExposedCount < 0) {
+        err("posture.hndlExposedCount must be a non-negative number");
+    }
+    const qv = posture.quantumVulnerable;
+    if (!isObject(qv)) {
+        err("posture.quantumVulnerable must be an object");
+        return;
+    }
+    if (typeof qv.total !== "number" || qv.total < 0) {
+        err("posture.quantumVulnerable.total must be a non-negative number");
+    }
+    if (!isObject(qv.bySeverity)) {
+        err("posture.quantumVulnerable.bySeverity must be an object");
+    }
+    else {
+        for (const sev of SEVERITY_ORDER) {
+            if (typeof qv.bySeverity[sev] !== "number") {
+                err(`posture.quantumVulnerable.bySeverity.${sev} must be a number`);
+            }
+        }
+    }
+}
+/** Validate the `cbomSummary` block. */
+function validateCbomSummary(summary, err) {
+    if (summary === undefined) {
+        err("missing required field: cbomSummary");
+        return;
+    }
+    if (!isObject(summary)) {
+        err("cbomSummary must be an object");
+        return;
+    }
+    if (typeof summary.serialNumber !== "string")
+        err("cbomSummary.serialNumber must be a string");
+    if (typeof summary.assetCount !== "number" || summary.assetCount < 0) {
+        err("cbomSummary.assetCount must be a non-negative number");
+    }
+    if (!Array.isArray(summary.algorithmFamilies)) {
+        err("cbomSummary.algorithmFamilies must be an array");
+        return;
+    }
+    summary.algorithmFamilies.forEach((fam, i) => {
+        if (!isObject(fam)) {
+            err(`cbomSummary.algorithmFamilies[${i}] must be an object`);
+            return;
+        }
+        if (typeof fam.family !== "string")
+            err(`cbomSummary.algorithmFamilies[${i}].family must be a string`);
+        if (typeof fam.count !== "number" || fam.count < 0) {
+            err(`cbomSummary.algorithmFamilies[${i}].count must be a non-negative number`);
+        }
+        if (typeof fam.quantumVulnerable !== "boolean") {
+            err(`cbomSummary.algorithmFamilies[${i}].quantumVulnerable must be a boolean`);
+        }
+    });
+}
+/** Validate the `policy` block. */
+function validatePolicy(policy, err) {
+    if (policy === undefined) {
+        err("missing required field: policy");
+        return;
+    }
+    if (!isObject(policy)) {
+        err("policy must be an object");
+        return;
+    }
+    if (typeof policy.source !== "string")
+        err("policy.source must be a string");
+    if (typeof policy.deprecateClassicalAfter !== "number") {
+        err("policy.deprecateClassicalAfter must be a number (year)");
+    }
+    if (typeof policy.disallowClassicalAfter !== "number") {
+        err("policy.disallowClassicalAfter must be a number (year)");
+    }
+    if (policy.transitionDeadline !== null && typeof policy.transitionDeadline !== "string") {
+        err("policy.transitionDeadline must be a string or null");
+    }
+    if (typeof policy.citation !== "string")
+        err("policy.citation must be a string");
+}
+//# sourceMappingURL=crypto-agility.js.map

package/dist/crypto-agility.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-agility.js","sourceRoot":"","sources":["../src/crypto-agility.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAG/C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC;AAEjD,oFAAoF;AACpF,MAAM,CAAC,MAAM,8BAA8B,GAAG,kCAAkC,CAAC;AAqGjF;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAkB,EAClB,IAAkC;IAElC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC;IAE7B,MAAM,iBAAiB,GAA0B,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;SAC7E,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;SACvC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QACzB,MAAM;QACN,KAAK,EAAE,KAAe;QACtB,4EAA4E;QAC5E,2DAA2D;QAC3D,iBAAiB,EAAE,IAAI;KACxB,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAEzE,MAAM,UAAU,GAAG,EAAE,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC;IAEzC,kFAAkF;IAClF,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,aAAa,CAAC,kBAAkB,CAAC;IAClD,MAAM,MAAM,GAAwB;QAClC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM;QAC3D,uBAAuB,EAAE,QAAQ,CAAC,cAAc;QAChD,sBAAsB,EAAE,QAAQ,CAAC,aAAa;QAC9C,kBAAkB,EAAE,IAAI,CAAC,MAAM,EAAE,kBAAkB,IAAI,IAAI;QAC3D,QAAQ,EAAE,QAAQ,CAAC,MAAM;KAC1B,CAAC;IAEF,MAAM,QAAQ,GAA0B;QACtC,OAAO,EAAE,+BAA+B;QACxC,YAAY,EAAE,gBAAgB;QAC9B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,WAAW,IAAI,OAAO,EAAE;QACpE,OAAO,EAAE;YACP,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;SAC5B;QACD,OAAO,EAAE;YACP,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,IAAI;YAC3C,iBAAiB,EAAE;gBACjB,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;gBAC7B,UAAU;aACX;YACD,gBAAgB,EAAE,GAAG,CAAC,SAAS;SAChC;QACD,WAAW,EAAE;YACX,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM;YAClC,iBAAiB;SAClB;QACD,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,MAAM;KACP,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAUD,qDAAqD;AACrD,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,6BAA6B,CAAC,KAAc;IAC1D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,CAAC,CAAS,EAAQ,EAAE,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAErD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,gCAAgC,CAAC,EAAE,CAAC;IACtE,CAAC;IAED,UAAU;IACV,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChC,GAAG,CAAC,iCAAiC,CAAC,CAAC;IACzC,CAAC;SAAM,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACjF,GAAG,CAAC,4BAA4B,CAAC,CAAC;IACpC,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,KAAK,+BAA+B,EAAE,CAAC;QAC7D,GAAG,CACD,uBAAuB,KAAK,CAAC,OAAO,wCAAwC,+BAA+B,GAAG,CAC/G,CAAC;IACJ,CAAC;IAED,eAAe;IACf,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACrC,GAAG,CAAC,sCAAsC,CAAC,CAAC;IAC9C,CAAC;SAAM,IAAI,KAAK,CAAC,YAAY,KAAK,gBAAgB,EAAE,CAAC;QACnD,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAC1D,CAAC;IAED,cAAc;IACd,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACpC,GAAG,CAAC,qCAAqC,CAAC,CAAC;IAC7C,CAAC;SAAM,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnF,GAAG,CAAC,iDAAiD,CAAC,CAAC;IACzD,CAAC;SAAM,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAC5D,CAAC;IAED,YAAY;IACZ,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAClC,GAAG,CAAC,mCAAmC,CAAC,CAAC;IAC3C,CAAC;SAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,IAAI,OAAO,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,QAAQ;YAAE,GAAG,CAAC,iCAAiC,CAAC,CAAC;QACrF,IAAI,OAAO,KAAK,CAAC,SAAS,CAAC,OAAO,KAAK,QAAQ;YAAE,GAAG,CAAC,oCAAoC,CAAC,CAAC;IAC7F,CAAC;IAED,UAAU;IACV,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChC,GAAG,CAAC,iCAAiC,CAAC,CAAC;IACzC,CAAC;SAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IACnC,CAAC;SAAM,CAAC;QACN,IAAI,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ;YAAE,GAAG,CAAC,+BAA+B,CAAC,CAAC;QACjF,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,KAAK,IAAI,IAAI,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACtF,GAAG,CAAC,6CAA6C,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC9E,GAAG,CAAC,yCAAyC,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAED,UAAU;IACV,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAEpC,cAAc;IACd,mBAAmB,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAE5C,yBAAyB;IACzB,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;YACjC,GAAG,CAAC,4CAA4C,CAAC,CAAC;QACpD,CAAC;aAAM,IAAI,OAAO,KAAK,CAAC,WAAW,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3F,GAAG,CAAC,4CAA4C,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,SAAS;IACT,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAElC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,oCAAoC;AACpC,SAAS,eAAe,CAAC,OAAgB,EAAE,GAAwB;IACjE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,GAAG,CAAC,iCAAiC,CAAC,CAAC;QACvC,OAAO;IACT,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,2BAA2B,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IACD,IACE,OAAO,OAAO,CAAC,cAAc,KAAK,QAAQ;QAC1C,OAAO,CAAC,cAAc,GAAG,CAAC;QAC1B,OAAO,CAAC,cAAc,GAAG,GAAG,EAC5B,CAAC;QACD,GAAG,CAAC,2DAA2D,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,KAAK,IAAI,IAAI,OAAO,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACnF,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,gBAAgB,KAAK,QAAQ,IAAI,OAAO,CAAC,gBAAgB,GAAG,CAAC,EAAE,CAAC;QACjF,GAAG,CAAC,wDAAwD,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,EAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC;IACrC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QAClB,GAAG,CAAC,6CAA6C,CAAC,CAAC;QACnD,OAAO;IACT,CAAC;IACD,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ,IAAI,EAAE,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,+DAA+D,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,wDAAwD,CAAC,CAAC;IAChE,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;YACjC,IAAI,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC3C,GAAG,CAAC,wCAAwC,GAAG,mBAAmB,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,wCAAwC;AACxC,SAAS,mBAAmB,CAAC,OAAgB,EAAE,GAAwB;IACrE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,GAAG,CAAC,qCAAqC,CAAC,CAAC;QAC3C,OAAO;IACT,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,+BAA+B,CAAC,CAAC;QACrC,OAAO;IACT,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ;QAAE,GAAG,CAAC,2CAA2C,CAAC,CAAC;IAC/F,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,sDAAsD,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,gDAAgD,CAAC,CAAC;QACtD,OAAO;IACT,CAAC;IACD,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QAC3C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,GAAG,CAAC,iCAAiC,CAAC,qBAAqB,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;YAChC,GAAG,CAAC,iCAAiC,CAAC,2BAA2B,CAAC,CAAC;QACrE,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,iCAAiC,CAAC,uCAAuC,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YAC/C,GAAG,CAAC,iCAAiC,CAAC,uCAAuC,CAAC,CAAC;QACjF,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,mCAAmC;AACnC,SAAS,cAAc,CAAC,MAAe,EAAE,GAAwB;IAC/D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,GAAG,CAAC,gCAAgC,CAAC,CAAC;QACtC,OAAO;IACT,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,GAAG,CAAC,0BAA0B,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;QAAE,GAAG,CAAC,gCAAgC,CAAC,CAAC;IAC7E,IAAI,OAAO,MAAM,CAAC,uBAAuB,KAAK,QAAQ,EAAE,CAAC;QACvD,GAAG,CAAC,wDAAwD,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,sBAAsB,KAAK,QAAQ,EAAE,CAAC;QACtD,GAAG,CAAC,uDAAuD,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,MAAM,CAAC,kBAAkB,KAAK,IAAI,IAAI,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,EAAE,CAAC;QACxF,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,GAAG,CAAC,kCAAkC,CAAC,CAAC;AACnF,CAAC","sourcesContent":["/**\n * Crypto-agility manifest: an agent-consumable crypto-posture document.\n *\n * A small, versioned JSON manifest a project publishes at a well-known URL\n * (`/.well-known/crypto-agility.json`, see docs/CRYPTO-AGILITY-MANIFEST.md) so any\n * agent, scanner, or CI bot can read the project's cryptographic posture the way it\n * reads `security.txt` or `robots.txt`. It is a compact, decision-oriented summary\n * DERIVED from a qScan result: the readiness score, the count of quantum-vulnerable\n * findings by severity, the CBOM's algorithm families, an optional attestation URL,\n * and the migration-policy deadlines.\n *\n * This module owns two pure operations and their shared schema:\n *   - {@link buildCryptoAgilityManifest}: derive a manifest from a {@link ScanResult}.\n *   - {@link validateCryptoAgilityManifest}: check an untrusted value against the\n *     schema, returning a list of problems (used by the local validator; a network\n *     fetch-and-validate lives on the website, never in this offline-boundary tool).\n *\n * Zero dependencies; hand-rolled JSON shape and validation so the package stays\n * runtime-dependency-free.\n */\n\nimport { toCbom } from \"./cbom.js\";\nimport { PQC_STANDARDS } from \"./standards.js\";\nimport { SEVERITY_ORDER } from \"./severity.js\";\nimport type { CryptoPolicy } from \"./policy.js\";\nimport type { ScanResult, Severity } from \"./types.js\";\nimport { VERSION } from \"./version.js\";\n\n/**\n * Schema version of the manifest this module emits and validates. Bumped only on a\n * breaking change to the manifest shape; consumers key their parsing off it.\n */\nexport const CRYPTO_AGILITY_MANIFEST_VERSION = 1;\n\n/** The conventional path a manifest is served from, relative to the site origin. */\nexport const CRYPTO_AGILITY_WELL_KNOWN_PATH = \"/.well-known/crypto-agility.json\";\n\n/** A single algorithm family in use, mirroring the CBOM's grouping. */\nexport interface CryptoAgilityFamily {\n  /** The algorithm family (e.g. `RSA`, `ECDH`, `ECDSA`), or `unknown`. */\n  family: string;\n  /** How many findings referenced this family. */\n  count: number;\n  /** Always true today: every detected family is classical (Shor-broken). */\n  quantumVulnerable: boolean;\n}\n\n/** The project's cryptographic posture, distilled from the scan inventory. */\nexport interface CryptoAgilityPosture {\n  /** qScan readiness score, 0–100 (100 = no classical asymmetric crypto found). */\n  readinessScore: number;\n  /**\n   * Whether the project negotiates hybrid post-quantum key exchange. qScan is a\n   * static scanner and cannot observe a negotiated TLS group, so this is `null`\n   * (\"not determined by this generator\") unless the operator asserts it\n   * (`--hybrid-kex` / `--no-hybrid-kex`). A live probe (qProbe) or the website can\n   * fill it authoritatively.\n   */\n  hybridKexInUse: boolean | null;\n  /** Count of quantum-vulnerable findings, total and broken down by severity. */\n  quantumVulnerable: {\n    total: number;\n    bySeverity: Record<Severity, number>;\n  };\n  /** How many findings are exposed to harvest-now-decrypt-later. */\n  hndlExposedCount: number;\n}\n\n/** A compact summary of the full CBOM, linking to it by serial number. */\nexport interface CryptoAgilityCbomSummary {\n  /** The CycloneDX `serialNumber` of the full CBOM this summary was derived from. */\n  serialNumber: string;\n  /** Number of distinct cryptographic-asset components in the full CBOM. */\n  assetCount: number;\n  /** Algorithm families in use, most-referenced first. */\n  algorithmFamilies: CryptoAgilityFamily[];\n}\n\n/** The migration policy the project declares it is measured against. */\nexport interface CryptoAgilityPolicy {\n  /** Human label for the policy source (a standard name, or `operator-declared`). */\n  source: string;\n  /** Year after which classical public-key crypto is deprecated. */\n  deprecateClassicalAfter: number;\n  /** Year after which classical public-key crypto is disallowed. */\n  disallowClassicalAfter: number;\n  /** Operator-declared migration deadline (ISO date / year), or `null`. */\n  transitionDeadline: string | null;\n  /** Citation for the deadlines (spec / publication). */\n  citation: string;\n}\n\n/** The full crypto-agility manifest. */\nexport interface CryptoAgilityManifest {\n  /** Manifest schema version ({@link CRYPTO_AGILITY_MANIFEST_VERSION}). */\n  version: number;\n  /** Discriminator so a consumer can tell this document apart from other JSON. */\n  manifestType: \"crypto-agility\";\n  /** ISO 8601 timestamp the manifest was generated (caller-supplied). */\n  generatedAt: string;\n  /** What produced the manifest. */\n  generator: { name: string; version: string };\n  /** What the manifest describes. */\n  subject: { root: string; repository: string | null; commit: string | null };\n  /** The distilled cryptographic posture. */\n  posture: CryptoAgilityPosture;\n  /** A compact summary of the CBOM. */\n  cbomSummary: CryptoAgilityCbomSummary;\n  /** Optional link to a quantakrypto (or other) posture credential. */\n  attestation?: { url: string };\n  /** The declared migration policy / deadlines. */\n  policy: CryptoAgilityPolicy;\n}\n\n/** Inputs the CLI/runtime supplies that are not derivable from the scan. */\nexport interface CryptoAgilityManifestOptions {\n  /**\n   * ISO 8601 generation timestamp. The caller supplies it (`Date.now()` is fine in\n   * the CLI runtime) so the builder itself stays pure and deterministic.\n   */\n  generatedAt: string;\n  /** Optional URL to a posture credential (recorded verbatim, never fetched here). */\n  attestationUrl?: string;\n  /**\n   * Operator assertion of hybrid-KEX use. `undefined` leaves the manifest's\n   * `hybridKexInUse` as `null` (not determined).\n   */\n  hybridKexInUse?: boolean;\n  /** Optional org crypto policy; its `transitionDeadline` overlays the defaults. */\n  policy?: CryptoPolicy;\n  /** Repository URL (e.g. `GITHUB_REPOSITORY`); omitted → null. */\n  repository?: string;\n  /** Commit SHA (e.g. `GITHUB_SHA`); omitted → null. */\n  commit?: string;\n}\n\n/**\n * Build a crypto-agility manifest from a scan result. Pure: every runtime input\n * (timestamp, attestation, hybrid-KEX assertion, policy) arrives via `opts`.\n *\n * The posture and CBOM summary are derived straight from the scan's inventory and\n * its CycloneDX CBOM, so the manifest can never disagree with the full `--cbom` /\n * `--format json` outputs of the same scan.\n */\nexport function buildCryptoAgilityManifest(\n  result: ScanResult,\n  opts: CryptoAgilityManifestOptions,\n): CryptoAgilityManifest {\n  const cbom = toCbom(result);\n  const inv = result.inventory;\n\n  const algorithmFamilies: CryptoAgilityFamily[] = Object.entries(inv.byAlgorithm)\n    .filter(([, count]) => (count ?? 0) > 0)\n    .map(([family, count]) => ({\n      family,\n      count: count as number,\n      // Every family the detectors surface is classical, hence quantum-vulnerable\n      // by construction (mirrors cbom.ts `isQuantumVulnerable`).\n      quantumVulnerable: true,\n    }))\n    .sort((a, b) => b.count - a.count || a.family.localeCompare(b.family));\n\n  const bySeverity = { ...inv.bySeverity };\n\n  // Default policy: the NIST IR 8547 transition timeline. An operator crypto policy\n  // (`--policy`) does not override the standards deadlines but layers its own\n  // `transitionDeadline` on top and re-labels the source as operator-declared.\n  const timeline = PQC_STANDARDS.transitionTimeline;\n  const policy: CryptoAgilityPolicy = {\n    source: opts.policy ? \"operator-declared\" : timeline.source,\n    deprecateClassicalAfter: timeline.deprecateAfter,\n    disallowClassicalAfter: timeline.disallowAfter,\n    transitionDeadline: opts.policy?.transitionDeadline ?? null,\n    citation: timeline.source,\n  };\n\n  const manifest: CryptoAgilityManifest = {\n    version: CRYPTO_AGILITY_MANIFEST_VERSION,\n    manifestType: \"crypto-agility\",\n    generatedAt: opts.generatedAt,\n    generator: { name: \"qScan\", version: result.toolVersion || VERSION },\n    subject: {\n      root: result.root,\n      repository: opts.repository ?? null,\n      commit: opts.commit ?? null,\n    },\n    posture: {\n      readinessScore: inv.readinessScore,\n      hybridKexInUse: opts.hybridKexInUse ?? null,\n      quantumVulnerable: {\n        total: result.findings.length,\n        bySeverity,\n      },\n      hndlExposedCount: inv.hndlCount,\n    },\n    cbomSummary: {\n      serialNumber: cbom.serialNumber,\n      assetCount: cbom.components.length,\n      algorithmFamilies,\n    },\n    ...(opts.attestationUrl ? { attestation: { url: opts.attestationUrl } } : {}),\n    policy,\n  };\n  return manifest;\n}\n\n/** Outcome of {@link validateCryptoAgilityManifest}. */\nexport interface ManifestValidation {\n  /** True when the value satisfies the manifest schema. */\n  valid: boolean;\n  /** One human-readable message per problem found (empty when `valid`). */\n  errors: string[];\n}\n\n/** True for a plain (non-array, non-null) object. */\nfunction isObject(v: unknown): v is Record<string, unknown> {\n  return typeof v === \"object\" && v !== null && !Array.isArray(v);\n}\n\n/**\n * Validate an untrusted value against the crypto-agility manifest schema.\n *\n * Checks structure, required fields, types, and the schema version. Purely local:\n * it parses an already-in-memory value and NEVER performs I/O or network fetches;\n * a fetch-and-validate of a remote manifest is a website-side concern, deliberately\n * kept out of this offline-boundary tool. Returns every problem it finds rather than\n * throwing on the first, so a caller can report them all at once.\n */\nexport function validateCryptoAgilityManifest(value: unknown): ManifestValidation {\n  const errors: string[] = [];\n  const err = (m: string): void => void errors.push(m);\n\n  if (!isObject(value)) {\n    return { valid: false, errors: [\"manifest must be a JSON object\"] };\n  }\n\n  // version\n  if (value.version === undefined) {\n    err(\"missing required field: version\");\n  } else if (typeof value.version !== \"number\" || !Number.isInteger(value.version)) {\n    err(\"version must be an integer\");\n  } else if (value.version !== CRYPTO_AGILITY_MANIFEST_VERSION) {\n    err(\n      `unsupported version ${value.version} (this validator understands version ${CRYPTO_AGILITY_MANIFEST_VERSION})`,\n    );\n  }\n\n  // manifestType\n  if (value.manifestType === undefined) {\n    err(\"missing required field: manifestType\");\n  } else if (value.manifestType !== \"crypto-agility\") {\n    err('manifestType must be the string \"crypto-agility\"');\n  }\n\n  // generatedAt\n  if (value.generatedAt === undefined) {\n    err(\"missing required field: generatedAt\");\n  } else if (typeof value.generatedAt !== \"string\" || value.generatedAt.length === 0) {\n    err(\"generatedAt must be a non-empty ISO 8601 string\");\n  } else if (Number.isNaN(Date.parse(value.generatedAt))) {\n    err(\"generatedAt must be a parseable ISO 8601 timestamp\");\n  }\n\n  // generator\n  if (value.generator === undefined) {\n    err(\"missing required field: generator\");\n  } else if (!isObject(value.generator)) {\n    err(\"generator must be an object\");\n  } else {\n    if (typeof value.generator.name !== \"string\") err(\"generator.name must be a string\");\n    if (typeof value.generator.version !== \"string\") err(\"generator.version must be a string\");\n  }\n\n  // subject\n  if (value.subject === undefined) {\n    err(\"missing required field: subject\");\n  } else if (!isObject(value.subject)) {\n    err(\"subject must be an object\");\n  } else {\n    if (typeof value.subject.root !== \"string\") err(\"subject.root must be a string\");\n    if (value.subject.repository !== null && typeof value.subject.repository !== \"string\") {\n      err(\"subject.repository must be a string or null\");\n    }\n    if (value.subject.commit !== null && typeof value.subject.commit !== \"string\") {\n      err(\"subject.commit must be a string or null\");\n    }\n  }\n\n  // posture\n  validatePosture(value.posture, err);\n\n  // cbomSummary\n  validateCbomSummary(value.cbomSummary, err);\n\n  // attestation (optional)\n  if (value.attestation !== undefined) {\n    if (!isObject(value.attestation)) {\n      err(\"attestation must be an object when present\");\n    } else if (typeof value.attestation.url !== \"string\" || value.attestation.url.length === 0) {\n      err(\"attestation.url must be a non-empty string\");\n    }\n  }\n\n  // policy\n  validatePolicy(value.policy, err);\n\n  return { valid: errors.length === 0, errors };\n}\n\n/** Validate the `posture` block. */\nfunction validatePosture(posture: unknown, err: (m: string) => void): void {\n  if (posture === undefined) {\n    err(\"missing required field: posture\");\n    return;\n  }\n  if (!isObject(posture)) {\n    err(\"posture must be an object\");\n    return;\n  }\n  if (\n    typeof posture.readinessScore !== \"number\" ||\n    posture.readinessScore < 0 ||\n    posture.readinessScore > 100\n  ) {\n    err(\"posture.readinessScore must be a number between 0 and 100\");\n  }\n  if (posture.hybridKexInUse !== null && typeof posture.hybridKexInUse !== \"boolean\") {\n    err(\"posture.hybridKexInUse must be a boolean or null\");\n  }\n  if (typeof posture.hndlExposedCount !== \"number\" || posture.hndlExposedCount < 0) {\n    err(\"posture.hndlExposedCount must be a non-negative number\");\n  }\n  const qv = posture.quantumVulnerable;\n  if (!isObject(qv)) {\n    err(\"posture.quantumVulnerable must be an object\");\n    return;\n  }\n  if (typeof qv.total !== \"number\" || qv.total < 0) {\n    err(\"posture.quantumVulnerable.total must be a non-negative number\");\n  }\n  if (!isObject(qv.bySeverity)) {\n    err(\"posture.quantumVulnerable.bySeverity must be an object\");\n  } else {\n    for (const sev of SEVERITY_ORDER) {\n      if (typeof qv.bySeverity[sev] !== \"number\") {\n        err(`posture.quantumVulnerable.bySeverity.${sev} must be a number`);\n      }\n    }\n  }\n}\n\n/** Validate the `cbomSummary` block. */\nfunction validateCbomSummary(summary: unknown, err: (m: string) => void): void {\n  if (summary === undefined) {\n    err(\"missing required field: cbomSummary\");\n    return;\n  }\n  if (!isObject(summary)) {\n    err(\"cbomSummary must be an object\");\n    return;\n  }\n  if (typeof summary.serialNumber !== \"string\") err(\"cbomSummary.serialNumber must be a string\");\n  if (typeof summary.assetCount !== \"number\" || summary.assetCount < 0) {\n    err(\"cbomSummary.assetCount must be a non-negative number\");\n  }\n  if (!Array.isArray(summary.algorithmFamilies)) {\n    err(\"cbomSummary.algorithmFamilies must be an array\");\n    return;\n  }\n  summary.algorithmFamilies.forEach((fam, i) => {\n    if (!isObject(fam)) {\n      err(`cbomSummary.algorithmFamilies[${i}] must be an object`);\n      return;\n    }\n    if (typeof fam.family !== \"string\")\n      err(`cbomSummary.algorithmFamilies[${i}].family must be a string`);\n    if (typeof fam.count !== \"number\" || fam.count < 0) {\n      err(`cbomSummary.algorithmFamilies[${i}].count must be a non-negative number`);\n    }\n    if (typeof fam.quantumVulnerable !== \"boolean\") {\n      err(`cbomSummary.algorithmFamilies[${i}].quantumVulnerable must be a boolean`);\n    }\n  });\n}\n\n/** Validate the `policy` block. */\nfunction validatePolicy(policy: unknown, err: (m: string) => void): void {\n  if (policy === undefined) {\n    err(\"missing required field: policy\");\n    return;\n  }\n  if (!isObject(policy)) {\n    err(\"policy must be an object\");\n    return;\n  }\n  if (typeof policy.source !== \"string\") err(\"policy.source must be a string\");\n  if (typeof policy.deprecateClassicalAfter !== \"number\") {\n    err(\"policy.deprecateClassicalAfter must be a number (year)\");\n  }\n  if (typeof policy.disallowClassicalAfter !== \"number\") {\n    err(\"policy.disallowClassicalAfter must be a number (year)\");\n  }\n  if (policy.transitionDeadline !== null && typeof policy.transitionDeadline !== \"string\") {\n    err(\"policy.transitionDeadline must be a string or null\");\n  }\n  if (typeof policy.citation !== \"string\") err(\"policy.citation must be a string\");\n}\n"]}

package/dist/dependencies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dependencies.d.ts","sourceRoot":"","sources":["../src/dependencies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAEV,mBAAmB,EACnB,OAAO,EACP,QAAQ,EACR,oBAAoB,EACrB,MAAM,YAAY,CAAC;AAKpB;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAkBjC,CAAC;AAEF,iDAAiD;AACjD,eAAO,MAAM,sBAAsB,EAAE,oBAAoB,EA0jBxD,CAAC;AAuEF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI,CAoB1E;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAuID;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,EAAE,CAyBrE"}
+{"version":3,"file":"dependencies.d.ts","sourceRoot":"","sources":["../src/dependencies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAEV,mBAAmB,EACnB,OAAO,EACP,QAAQ,EACR,oBAAoB,EACrB,MAAM,YAAY,CAAC;AAKpB;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAkBjC,CAAC;AAEF,iDAAiD;AACjD,eAAO,MAAM,sBAAsB,EAAE,oBAAoB,EA6pBxD,CAAC;AAwEF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI,CAqB1E;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAqJD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,EAAE,CAyBrE"}

package/dist/dependencies.js

@@ -373,6 +373,13 @@ export const vulnerableDependencies = [
         algorithms: ["X25519", "EdDSA"],
         severity: "low",
     },
+    {
+        name: "tink",
+        ecosystem: "pypi",
+        reason: "Google Tink (Python) — classical RSA/ECDSA/Ed25519 signatures and ECIES hybrid encryption.",
+        algorithms: ["RSA", "ECDSA", "EdDSA", "ECIES"],
+        severity: "high",
+    },
     // --- crates.io (Rust) ---
     {
         name: "rsa",
@@ -482,6 +489,20 @@ export const vulnerableDependencies = [
         algorithms: ["ECDSA", "ECDH"],
         severity: "medium",
     },
+    {
+        name: "github.com/tink-crypto/tink-go/v2",
+        ecosystem: "go",
+        reason: "Google Tink (Go) — classical RSA/ECDSA/Ed25519 signatures and ECIES hybrid encryption.",
+        algorithms: ["RSA", "ECDSA", "EdDSA", "ECIES"],
+        severity: "high",
+    },
+    {
+        name: "github.com/google/tink/go",
+        ecosystem: "go",
+        reason: "Google Tink (legacy Go module) — classical RSA/ECDSA/Ed25519 and ECIES hybrid.",
+        algorithms: ["RSA", "ECDSA", "EdDSA", "ECIES"],
+        severity: "high",
+    },
     // --- Maven (Java) ---
     {
         name: "bcprov-jdk18on",
@@ -527,6 +548,13 @@ export const vulnerableDependencies = [
         severity: "medium",
         hndl: false,
     },
+    {
+        name: "tink",
+        ecosystem: "maven",
+        reason: "Google Tink (com.google.crypto.tink) — classical RSA/ECDSA/Ed25519 signatures and ECIES hybrid encryption.",
+        algorithms: ["RSA", "ECDSA", "EdDSA", "ECIES"],
+        severity: "high",
+    },
     // --- RubyGems ---
     {
         name: "jwt",
@@ -588,13 +616,81 @@ export const vulnerableDependencies = [
         severity: "medium",
         hndl: false,
     },
+    // --- Composer (PHP) ---
+    {
+        name: "phpseclib/phpseclib",
+        ecosystem: "composer",
+        reason: "Pure-PHP RSA / DSA / ECDSA / Diffie-Hellman public-key crypto and X.509.",
+        algorithms: ["RSA", "DSA", "ECDSA", "DH"],
+        severity: "high",
+    },
+    {
+        name: "paragonie/sodium_compat",
+        ecosystem: "composer",
+        reason: "Pure-PHP libsodium polyfill: X25519 key agreement and Ed25519 signatures.",
+        algorithms: ["X25519", "EdDSA"],
+        severity: "low",
+    },
+    {
+        name: "paragonie/halite",
+        ecosystem: "composer",
+        reason: "libsodium wrapper: X25519 key agreement and Ed25519 signatures.",
+        algorithms: ["X25519", "EdDSA"],
+        severity: "low",
+    },
+    {
+        name: "paragonie/paseto",
+        ecosystem: "composer",
+        reason: "PASETO public tokens signed with classical Ed25519 (v2/v4) or RSA.",
+        algorithms: ["EdDSA", "RSA"],
+        severity: "medium",
+        hndl: false,
+    },
+    {
+        name: "firebase/php-jwt",
+        ecosystem: "composer",
+        reason: "PHP JWT signing/verification with classical RS*/ES* algorithms.",
+        algorithms: ["RSA", "ECDSA"],
+        severity: "medium",
+        hndl: false,
+    },
+    {
+        name: "lcobucci/jwt",
+        ecosystem: "composer",
+        reason: "PHP JWT with classical RSA/ECDSA signature algorithms.",
+        algorithms: ["RSA", "ECDSA"],
+        severity: "medium",
+        hndl: false,
+    },
+    {
+        name: "web-token/jwt-framework",
+        ecosystem: "composer",
+        reason: "JOSE (JWS/JWE) framework: classical RSA/ECDSA signatures and ECDH-ES key agreement.",
+        algorithms: ["RSA", "ECDSA", "ECDH"],
+        severity: "medium",
+    },
+    {
+        name: "mdanter/ecc",
+        ecosystem: "composer",
+        reason: "Pure-PHP elliptic-curve ECDSA signatures and ECDH key agreement.",
+        algorithms: ["ECDSA", "ECDH"],
+        severity: "high",
+    },
+    {
+        name: "simplito/elliptic-php",
+        ecosystem: "composer",
+        reason: "secp256k1 / NIST-curve ECDSA and ECDH in pure PHP (blockchain keys).",
+        algorithms: ["ECDSA", "ECDH"],
+        severity: "high",
+    },
 ];
 /**
  * Normalise a package name for matching within its ecosystem. PyPI is
  * case-insensitive and folds runs of `-_.` to a single `-` (PEP 503); cargo /
- * maven / rubygems / nuget are effectively lower-case (NuGet ids are matched
- * case-insensitively); npm and go module paths are matched verbatim (npm scopes
- * and go paths are case-sensitive).
+ * maven / rubygems / nuget / composer are effectively lower-case (NuGet ids are
+ * matched case-insensitively; Composer `vendor/package` names are lower-cased by
+ * Packagist); npm and go module paths are matched verbatim (npm scopes and go
+ * paths are case-sensitive).
  */
 function normalizeName(ecosystem, name) {
     const n = name.trim();
@@ -687,6 +783,8 @@ export function manifestEcosystem(file) {
         return "rubygems";
     if (base === "packages.config" || base === "directory.packages.props" || base.endsWith(".csproj"))
         return "nuget";
+    if (base === "composer.json" || base === "composer.lock")
+        return "composer";
     return null;
 }
 /** True if a file path looks like a manifest we can parse for dependencies. */
@@ -771,6 +869,18 @@ function candidateNames(ecosystem, content) {
             }
             break;
         }
+        case "composer": {
+            // composer.json `require`/`require-dev` maps are keyed by "vendor/package";
+            // composer.lock lists `{"name": "vendor/package", …}`. Both are JSON, so
+            // grab every quoted `vendor/package` token (a lower-case vendor + package
+            // separated by a single `/`). PHP platform requirements ("php", "ext-*")
+            // carry no slash and so are naturally excluded; the curated DB filters the
+            // rest, so over-capture is safe.
+            for (const m of content.matchAll(/["']([a-z0-9](?:[a-z0-9._-]*[a-z0-9])?\/[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?)["']/gi)) {
+                names.push(m[1]);
+            }
+            break;
+        }
         case "npm":
             break; // npm uses the JSON path, not this extractor.
     }
@@ -858,10 +968,32 @@ export function scanManifest(file, content) {
     }
     return sortByTitle(findings);
 }
+/**
+ * Resolve an npm `npm:` alias spec to the real package it installs, or null when
+ * the spec is not an alias. An aliased dependency records the alias as the map
+ * KEY and `npm:<real-name>@<range>` as the VALUE (in package.json and in a
+ * lockfile entry's `version`), so the vulnerable package hides behind a benign
+ * alias name. Keeps a leading scope `@` (only a version `@` past index 0 is a
+ * separator): `npm:node-forge@^1` → `node-forge`, `npm:@scope/pkg@1` → `@scope/pkg`.
+ */
+function npmAliasTarget(spec) {
+    if (!spec.startsWith("npm:"))
+        return null;
+    const rest = spec.slice(4);
+    const at = rest.lastIndexOf("@");
+    const name = at > 0 ? rest.slice(0, at) : rest;
+    return name || null;
+}
+/** Guard against a pathological / hostile lockfile nesting the walk unbounded. */
+const NPM_TREE_MAX_DEPTH = 64;
 /**
  * npm manifest scan.
- * - `package.json`: dependencies / devDependencies / peerDependencies / optionalDependencies.
- * - `package-lock.json` (v2/v3): the `packages` map keys (node_modules/<name>).
+ * - `package.json`: dependencies / devDependencies / peerDependencies / optionalDependencies,
+ *   including `npm:`-aliased entries (the alias key hides the real package name).
+ * - `package-lock.json` v1: the NESTED `dependencies` tree, where each entry may carry
+ *   its own `dependencies` (transitive deps) and an `npm:` alias in `version`.
+ * - `package-lock.json` v2/v3: the flat `packages` map keys (node_modules/<name>),
+ *   plus each entry's own `name` field (set for aliased installs).
  */
 function scanNpmManifest(content, file, db) {
     let json;
@@ -875,28 +1007,58 @@ function scanNpmManifest(content, file, db) {
         return [];
     const found = new Set();
     const obj = json;
-    const collectFromRecord = (rec) => {
-        if (rec === null || typeof rec !== "object")
+    const add = (name) => {
+        if (db.has(name))
+            found.add(name);
+    };
+    /**
+     * Walk a dependency map that may be either a flat package.json map
+     * (name → version-range string) or a legacy package-lock v1 tree (name →
+     * `{ version, requires, dependencies }`, arbitrarily nested). Matches keys,
+     * resolves `npm:` aliases from string values and entry `version` fields, and
+     * recurses into a nested `dependencies` sub-tree.
+     */
+    const walkDepTree = (deps, depth) => {
+        if (depth > NPM_TREE_MAX_DEPTH || deps === null || typeof deps !== "object")
             return;
-        for (const key of Object.keys(rec)) {
-            if (db.has(key))
-                found.add(key);
+        for (const [name, node] of Object.entries(deps)) {
+            add(name);
+            if (typeof node === "string") {
+                // package.json form: the value is a range, possibly `npm:<real>@<range>`.
+                const aliased = npmAliasTarget(node);
+                if (aliased)
+                    add(aliased);
+            }
+            else if (node !== null && typeof node === "object") {
+                const rec = node;
+                if (typeof rec.version === "string") {
+                    const aliased = npmAliasTarget(rec.version);
+                    if (aliased)
+                        add(aliased);
+                }
+                walkDepTree(rec.dependencies, depth + 1); // v1 nests transitive deps here
+            }
         }
     };
-    collectFromRecord(obj.dependencies);
-    collectFromRecord(obj.devDependencies);
-    collectFromRecord(obj.peerDependencies);
-    collectFromRecord(obj.optionalDependencies);
+    walkDepTree(obj.dependencies, 0);
+    walkDepTree(obj.devDependencies, 0);
+    walkDepTree(obj.peerDependencies, 0);
+    walkDepTree(obj.optionalDependencies, 0);
     const packages = obj.packages;
     if (packages !== null && typeof packages === "object") {
-        for (const key of Object.keys(packages)) {
+        for (const [key, entry] of Object.entries(packages)) {
             if (!key)
                 continue; // root package entry
             const marker = "node_modules/";
             const idx = key.lastIndexOf(marker);
-            const name = idx >= 0 ? key.slice(idx + marker.length) : key;
-            if (db.has(name))
-                found.add(name);
+            add(idx >= 0 ? key.slice(idx + marker.length) : key);
+            // Aliased install: the entry's own `name` field is the real package, which
+            // differs from the alias embedded in the node_modules/<alias> key.
+            if (entry !== null && typeof entry === "object") {
+                const realName = entry.name;
+                if (typeof realName === "string")
+                    add(realName);
+            }
         }
     }
     const findings = [];