@quantakrypto/core 0.4.4 → 0.6.0

package/src/index.ts

@@ -56,13 +56,14 @@ export type {
 // Scan cancellation / work-budget errors.
 export { AbortError, BudgetExceededError } from "./errors.js";
 
-// Parallel scanning (worker_threads pool) + pure merge/chunk helpers.
-export { scanParallel, mergeChunkResults, chunkByBytes } from "./parallel.js";
-export type { ScanChunk, ChunkResult, SizedFile } from "./parallel.js";
+// Parallel scanning (worker_threads pool). The chunk/merge helpers and their
+// SizedFile/ChunkResult types are internal plumbing (not part of the public API).
+export { scanParallel } from "./parallel.js";
+export type { ScanChunk } from "./parallel.js";
 
-// Detector registry (plugin point) + helpers + the rule catalog.
-export { DetectorRegistry, defaultRegistry, detectorScope } from "./registry.js";
-export type { RuleCatalogEntry } from "./registry.js";
+// Detector registry (plugin point). `detectorScope` and the rule-catalog type are
+// internal.
+export { DetectorRegistry, defaultRegistry } from "./registry.js";
 
 // Canonical baseline (shared by qScan + the Action).
 export {
@@ -82,8 +83,44 @@ export { changedFiles } from "./changed.js";
 export { loadConfig, ConfigError, CONFIG_FILENAME } from "./config.js";
 export type { QuantakryptoFileConfig, LoadConfigResult } from "./config.js";
 
+// HNDL (harvest-now-decrypt-later) data-risk quantifier (see docs/HNDL.md).
+export {
+  HNDL_MODEL_VERSION,
+  HNDL_FILENAME,
+  SEVERITY_VULNERABILITY,
+  CONFIDENCE_WEIGHT,
+  CLASSIFICATION_SENSITIVITY,
+  NON_HNDL_DISCOUNT,
+  DEFAULT_QUANTUM_THREAT_YEARS,
+  DEFAULT_MIGRATION_HORIZON_YEARS,
+  DEFAULT_UNBOUND_CLASSIFICATION,
+  HndlError,
+  computeHndl,
+  vulnerabilityFactor,
+  moscaFactor,
+  globMatch,
+  findingFingerprint,
+  findingScope,
+  parseHndlMap,
+  loadHndlMap,
+  scaffoldHndlYaml,
+} from "./hndl.js";
+export type {
+  DataClassification,
+  HndlScope,
+  HndlDataAsset,
+  HndlHorizon,
+  HndlDefaults,
+  HndlMap,
+  ExposureRationale,
+  FindingExposure,
+  AssetExposure,
+  HndlSummary,
+  HndlReport,
+} from "./hndl.js";
+
 // Filesystem walker (relative POSIX paths, default ignores, size/binary filters).
-export { walkFiles, isBinaryPath, isGeneratedPath, looksMinified } from "./walk.js";
+export { walkFiles, isBinaryPath, looksMinified } from "./walk.js";
 
 // Analyzable-language coverage (which source languages the scanner inspects).
 export {
@@ -104,7 +141,13 @@ export { vulnerableDependencies, DEP_VULNERABLE_RULE, isManifestFile } from "./d
 export { SEVERITY_ORDER, severityRank, meetsThreshold, sarifLevel } from "./severity.js";
 
 // Reporters.
-export { toSarif, toJson, formatSummary, formatTierGuidance } from "./report.js";
+export {
+  toSarif,
+  toJson,
+  formatSummary,
+  formatTierGuidance,
+  formatProfileGuidance,
+} from "./report.js";
 export type { ReportOptions } from "./report.js";
 
 // CycloneDX 1.6 cryptographic bill of materials (CBOM) export.
@@ -112,18 +155,45 @@ export { toCbom } from "./cbom.js";
 export type { CycloneDxBom, CbomComponent } from "./cbom.js";
 // Merge multiple CBOMs (code + infra + live endpoints) into one combined BOM.
 export { mergeCboms } from "./cbom-merge.js";
+// OpenVEX 0.2.0 export — quantum-readiness posture as VEX statements.
+export { toOpenVex } from "./vex.js";
+export type { OpenVexDocument, OpenVexStatement, OpenVexOptions } from "./vex.js";
+// Crypto-agility manifest: agent-consumable crypto-posture document.
+export {
+  buildCryptoAgilityManifest,
+  validateCryptoAgilityManifest,
+  CRYPTO_AGILITY_MANIFEST_VERSION,
+  CRYPTO_AGILITY_WELL_KNOWN_PATH,
+} from "./crypto-agility.js";
+export type {
+  CryptoAgilityManifest,
+  CryptoAgilityManifestOptions,
+  CryptoAgilityPosture,
+  CryptoAgilityCbomSummary,
+  CryptoAgilityFamily,
+  CryptoAgilityPolicy,
+  ManifestValidation,
+} from "./crypto-agility.js";
 // ISO/IEC 27001 A.8.24 evidence-chain readiness report.
-export { buildReadinessReport } from "./evidence.js";
-export type { ReadinessReport, EvidenceFinding, ReadinessReportOptions } from "./evidence.js";
+export { buildReadinessReport, signReadinessReport, verifyReadinessReport } from "./evidence.js";
+export type {
+  ReadinessReport,
+  EvidenceFinding,
+  ReadinessReportOptions,
+  EvidenceSigner,
+  SignEvidenceOptions,
+  VerifyReadinessResult,
+} from "./evidence.js";
 
 // Cryptography policy → per-finding verdicts (A.8.24 evidence §4).
-export { buildPolicyMapping, parseCryptoPolicy, verdictForAlgorithm } from "./policy.js";
+export { buildPolicyMapping, parseCryptoPolicy } from "./policy.js";
 export type { CryptoPolicy, PolicyVerdict, PolicyMapping, PolicyFindingVerdict } from "./policy.js";
 
-// Remediation lookup (family + tier-aware) and stateful-HBS guidance.
+// Remediation lookup (family + tier-aware + profile-aware) and stateful-HBS guidance.
 export {
   remediationFor,
   remediationForTier,
+  remediationForProfile,
   TIER_PARAMS,
   STATEFUL_HBS_NOTE,
   PQC_TRANSITION_NOTE,
@@ -132,9 +202,19 @@ export {
 export type { SecurityTier } from "./remediation.js";
 
 // Post-quantum standards source of truth + review cadence.
-export { PQC_STANDARDS, standardsReviewStatus } from "./standards.js";
+export { PQC_STANDARDS } from "./standards.js";
 export type { PqcStandards, StandardsCitation, StandardsReviewStatus } from "./standards.js";
 
+// Selectable standards regime profiles (NIST / CNSA / BSI / ANSSI / NCSC).
+export {
+  STANDARDS_PROFILES,
+  DEFAULT_PROFILE_ID,
+  standardsProfileIds,
+  getStandardsProfile,
+  defaultStandardsProfile,
+} from "./standards-profiles.js";
+export type { StandardsProfile, HybridStance } from "./standards-profiles.js";
+
 // CWE identifier constants.
 export {
   CWE_BROKEN_CRYPTO,

package/src/inventory.ts

@@ -48,7 +48,7 @@ const SCORE_SCALE = 100;
 const TEST_PATH_WEIGHT = 0.15;
 
 /** True when a finding's file path is test / fixture / example / documentation. */
-export function isTestOrFixturePath(file: string): boolean {
+function isTestOrFixturePath(file: string): boolean {
   const f = file.toLowerCase().replace(/\\/g, "/");
   if (
     /(?:^|\/)(?:tests?|__tests__|testdata|test-data|fixtures?|examples?|demos?|samples?|specs?|mocks?|docs?|benchmarks?|e2e)\//.test(
@@ -75,20 +75,28 @@ export function isTestOrFixturePath(file: string): boolean {
 export function readinessScore(findings: Finding[]): number {
   if (findings.length === 0) return 100;
 
-  const seen: Record<Severity, number> = {
+  // Diminishing-returns occurrence counters, kept SEPARATE for full-weight vs
+  // test-path findings. Sharing one counter per severity let whichever finding came
+  // first in the (path-sorted) list claim the `1/√1` slot, so a directory rename — or
+  // a test finding sorting ahead of a real one — changed the score. Bucketing makes
+  // the penalty independent of file order and of test/real interleaving.
+  const zero = (): Record<Severity, number> => ({
     critical: 0,
     high: 0,
     medium: 0,
     low: 0,
     info: 0,
-  };
+  });
+  const seenReal = zero();
+  const seenTest = zero();
 
   let penalty = 0;
   for (const f of findings) {
-    seen[f.severity] += 1;
-    const weight =
-      SEVERITY_WEIGHT[f.severity] * (isTestOrFixturePath(f.location.file) ? TEST_PATH_WEIGHT : 1);
-    penalty += penaltyFor(weight, seen[f.severity]);
+    const isTest = isTestOrFixturePath(f.location.file);
+    const bucket = isTest ? seenTest : seenReal;
+    bucket[f.severity] += 1;
+    const weight = SEVERITY_WEIGHT[f.severity] * (isTest ? TEST_PATH_WEIGHT : 1);
+    penalty += penaltyFor(weight, bucket[f.severity]);
   }
 
   return Math.max(0, Math.min(100, Math.round(100 * Math.exp(-penalty / SCORE_SCALE))));

package/src/parallel.ts

@@ -17,7 +17,7 @@ import { fileURLToPath } from "node:url";
 import type { Worker as NodeWorker } from "node:worker_threads";
 
 import type { Finding, ParallelScanOptions, ScanResult } from "./types.js";
-import { walkFiles } from "./walk.js";
+import { walkFilesSized } from "./walk.js";
 import { isAnalyzableSource } from "./detect-utils.js";
 import { buildInventory } from "./inventory.js";
 import { compareFindings, filterExplicitFileList, scan } from "./scan.js";
@@ -115,30 +115,31 @@ function shouldParallelize(options: ParallelScanOptions, files: SizedFile[]): bo
  * explicit `files` list or the walker. Sizes power byte-balanced chunking.
  */
 async function enumerateFiles(options: ParallelScanOptions, baseDir: string): Promise<SizedFile[]> {
-  const rels: string[] = [];
+  const sized: SizedFile[] = [];
   if (options.files) {
+    // Explicit file list: the walker isn't involved, so stat each once here.
     // Apply the SAME include/exclude/binary filtering the serial path uses via
-    // `filterExplicitFiles`, so `--parallel` is byte-for-byte identical to serial.
-    for (const rel of filterExplicitFileList(options.files, options)) rels.push(rel);
-  } else {
-    for await (const rel of walkFiles(options.root, {
-      include: options.include,
-      exclude: options.exclude,
-      noDefaultIgnores: options.noDefaultIgnores,
-      maxFileSize: options.maxFileSize,
-    })) {
-      rels.push(rel);
+    // `filterExplicitFileList`, so `--parallel` is byte-for-byte identical to serial.
+    for (const rel of filterExplicitFileList(options.files, options)) {
+      let size = 0;
+      try {
+        size = (await stat(path.join(baseDir, ...rel.split("/")))).size;
+      } catch {
+        // Unreadable now; keep with size 0 (the worker read will skip if it's gone).
+      }
+      sized.push({ rel, size });
     }
+    return sized;
   }
 
-  const sized: SizedFile[] = [];
-  for (const rel of rels) {
-    let size = 0;
-    try {
-      size = (await stat(path.join(baseDir, ...rel.split("/")))).size;
-    } catch {
-      // Unreadable now; keep with size 0 — worker read will skip if it's gone.
-    }
+  // Directory walk: reuse the size the walker already stat'd while enforcing the
+  // size limit, so files are not stat'd a second time here (double-stat fix).
+  for await (const { rel, size } of walkFilesSized(options.root, {
+    include: options.include,
+    exclude: options.exclude,
+    noDefaultIgnores: options.noDefaultIgnores,
+    maxFileSize: options.maxFileSize,
+  })) {
     sized.push({ rel, size });
   }
   return sized;

package/src/registry.ts

@@ -21,6 +21,10 @@ import { rubyDetector } from "./detectors/ruby.js";
 import { phpDetector } from "./detectors/php.js";
 import { elixirDetector } from "./detectors/elixir.js";
 import { cDetector } from "./detectors/c.js";
+import { swiftDetector } from "./detectors/swift.js";
+import { objcDetector } from "./detectors/objc.js";
+import { dartDetector } from "./detectors/dart.js";
+import { solidityDetector } from "./detectors/solidity.js";
 import { pemDetector } from "./detectors/pem.js";
 import { jwkDetector } from "./detectors/jwk.js";
 import { terraformDetector } from "./detectors/terraform.js";
@@ -31,10 +35,27 @@ import { joseDetector } from "./detectors/jose.js";
 import { k8sDetector } from "./detectors/k8s.js";
 import { messagingDetector } from "./detectors/messaging.js";
 import { databaseDetector } from "./detectors/database.js";
+import { xmldsigDetector } from "./detectors/xmldsig.js";
+import { pkcs11Detector } from "./detectors/pkcs11.js";
+import { dkimDetector } from "./detectors/dkim.js";
+import { sshCaDetector } from "./detectors/ssh-ca.js";
+import { spireDetector } from "./detectors/spire.js";
+import { proxyDetector } from "./detectors/proxy.js";
+import { webauthnDetector } from "./detectors/webauthn.js";
+import { codesignDetector } from "./detectors/codesign.js";
+import { weakHashDetector } from "./detectors/weak-hash.js";
 import { cloudformationDetector } from "./detectors/cloudformation.js";
+import { bicepDetector } from "./detectors/bicep.js";
+import { pulumiDetector } from "./detectors/pulumi.js";
 import { meshDetector } from "./detectors/mesh.js";
 import { dnssecDetector } from "./detectors/dnssec.js";
 import { vpnDetector } from "./detectors/vpn.js";
+import { ansibleDetector } from "./detectors/ansible.js";
+import { ageDetector } from "./detectors/age.js";
+import { supplyChainDetector } from "./detectors/supply-chain.js";
+import { vaultDetector } from "./detectors/vault.js";
+import { keystoreDetector } from "./detectors/keystore.js";
+import { openpgpDetector } from "./detectors/openpgp.js";
 import { statefulHbsDetector } from "./detectors/stateful-hbs.js";
 
 /** Normalised scope of a detector (defaults to "source" when undeclared). */
@@ -125,10 +146,15 @@ export class DetectorRegistry {
 }
 
 /**
- * The built-in detectors, in run order: the JS/TS source + config detectors,
- * then the per-language detectors (Python, Go, Java, C#, Rust, Ruby, C/C++),
- * then the language-agnostic PEM and stateful-HBS (SP 800-208) detectors. The
- * manifest (dependency) scanner is handled separately by `scan()`.
+ * The built-in detectors, in run order: the JS/TS source + language-agnostic config
+ * detectors, the per-language source packs (Python, Go, Java/Kotlin/Scala, C#, Rust,
+ * Ruby, PHP, Elixir, C/C++, Swift, Objective-C, Dart, Solidity/Move/Cairo), the
+ * infrastructure/config detectors (Terraform, Bicep, Pulumi, CloudFormation, cloud-KMS,
+ * k8s, mesh, DNSSEC, Vault, database/TDE, messaging, VPN, Ansible, supply-chain, CI/CD,
+ * secrets, age, keystore, OpenPGP, JWK, XML-DSig/SAML, PKCS#11/HSM, DKIM, SSH-CA,
+ * SPIFFE/SPIRE, reverse-proxy/gRPC TLS, WebAuthn/FIDO2, code-signing, weak-hash-in-
+ * signature), and the stateful-HBS (SP 800-208) detector. The manifest (dependency)
+ * scanner is handled separately by `scan()`.
  *
  * This is the single source of truth for the default detector set: both
  * {@link defaultRegistry} and the public `detectors` export (re-exported from
@@ -145,6 +171,10 @@ export const builtinDetectors: Detector[] = [
   phpDetector,
   elixirDetector,
   cDetector,
+  swiftDetector,
+  objcDetector,
+  dartDetector,
+  solidityDetector,
   pemDetector,
   jwkDetector,
   terraformDetector,
@@ -155,10 +185,27 @@ export const builtinDetectors: Detector[] = [
   k8sDetector,
   messagingDetector,
   databaseDetector,
+  xmldsigDetector,
+  pkcs11Detector,
+  dkimDetector,
+  sshCaDetector,
+  spireDetector,
+  proxyDetector,
+  webauthnDetector,
+  codesignDetector,
+  weakHashDetector,
   cloudformationDetector,
+  bicepDetector,
+  pulumiDetector,
   meshDetector,
   dnssecDetector,
   vpnDetector,
+  ansibleDetector,
+  ageDetector,
+  supplyChainDetector,
+  vaultDetector,
+  keystoreDetector,
+  openpgpDetector,
   statefulHbsDetector,
 ];
 

package/src/remediate-pipeline.ts

@@ -69,7 +69,7 @@ const NEW_SINK_LINE_RE = new RegExp(NEW_SINK_RE.source);
 
 /** Max changed lines allowed in an auto-verified LLM patch — a real crypto fix
  * is localized; a sprawling rewrite is not reviewable as "just the fix". */
-export const LLM_PATCH_MAX_CHANGED_LINES = 60;
+const LLM_PATCH_MAX_CHANGED_LINES = 60;
 
 function countMatches(re: RegExp, s: string): number {
   return (s.match(re) ?? []).length;

package/src/remediation.ts

@@ -6,6 +6,7 @@
  * standards to track are captured in {@link PQC_TRANSITION_NOTE}.
  */
 import type { AlgorithmFamily, Remediation } from "./types.js";
+import type { StandardsProfile } from "./standards-profiles.js";
 
 /** Canonical remediation table, keyed by algorithm family. */
 const REMEDIATIONS: Record<AlgorithmFamily, Remediation> = {
@@ -188,6 +189,44 @@ export function remediationForTier(
   };
 }
 
+/**
+ * Regime-aware remediation. Composes the base family guidance with a
+ * {@link StandardsProfile}'s parameter sets, HYBRID STANCE, and deprecation
+ * deadlines, so an ANSSI/BSI audience is told hybrid is *required* while a CNSA 2.0
+ * audience is told it is *optional* (and pointed at the 1024-level hybrid). This is
+ * the profile-driven successor to {@link remediationForTier}; `--tier category-5`
+ * resolves to the `cnsa-2.0` profile.
+ */
+export function remediationForProfile(
+  algorithm: AlgorithmFamily,
+  profile: StandardsProfile,
+): Remediation {
+  const base = REMEDIATIONS[algorithm];
+  const isConf = isConfidentialityFamily(algorithm);
+  const primary = isConf ? profile.paramSets.kem : profile.paramSets.signature;
+  // The hybrid stance governs KEY ESTABLISHMENT, so it is surfaced for confidentiality
+  // families; signature families migrate to a stateless PQC signer directly.
+  const stanceWord =
+    profile.hybridStance === "required"
+      ? "hybrid required"
+      : profile.hybridStance === "recommended"
+        ? "hybrid recommended"
+        : "hybrids optional";
+  const recommendation = isConf
+    ? `${primary} — ${profile.name}: ${stanceWord}`
+    : `${primary} — ${profile.name}`;
+  const hybridClause = isConf ? ` ${profile.hybridGuidance}` : "";
+  return {
+    algorithm,
+    recommendation,
+    detail:
+      `${base.detail} Under ${profile.name} (${profile.citation}), use ${profile.paramSets.kem} for ` +
+      `key establishment and ${profile.paramSets.signature} for signatures; classical public-key ` +
+      `crypto is deprecated after ${profile.deprecateAfter} and disallowed after ${profile.disallowAfter}.` +
+      hybridClause,
+  };
+}
+
 /**
  * Guidance for stateful hash-based signatures (SP 800-208: LMS / XMSS / HSS).
  * These are NIST-approved for firmware / boot signing but are STATEFUL — each

package/src/report.ts

@@ -7,9 +7,12 @@ import type { AlgorithmFamily, Finding, RuleMeta, ScanResult, Severity } from ".
 import { VERSION } from "./version.js";
 import { SEVERITY_ORDER, sarifLevel } from "./severity.js";
 import { ANALYZABLE_LANGUAGES_LABEL } from "./detect-utils.js";
-import { remediationFor, remediationForTier } from "./remediation.js";
+import { remediationFor, remediationForTier, remediationForProfile } from "./remediation.js";
 import type { SecurityTier } from "./remediation.js";
+import type { StandardsProfile } from "./standards-profiles.js";
 import { fingerprintFinding } from "./baseline.js";
+import { findingFingerprint } from "./hndl.js";
+import type { FindingExposure, HndlReport } from "./hndl.js";
 
 /** Minimal SARIF 2.1.0 log shape (kept permissive on purpose). */
 export interface SarifLog {
@@ -35,6 +38,29 @@ export interface ReportOptions {
    * {@link toJson}.
    */
   catalog?: RuleMeta[];
+  /**
+   * Optional HNDL exposure analysis ({@link computeHndl}). When supplied, each
+   * finding gains its `exposure` fields (score, bound data asset, rationale)
+   * keyed by fingerprint, and the report carries the repo-level HNDL summary.
+   * Purely additive: it never changes finding identity, ordering, or exit codes.
+   */
+  hndl?: HndlReport;
+}
+
+/** The per-finding exposure block emitted in JSON / SARIF, or undefined. */
+function exposureFor(f: Finding, hndl: HndlReport | undefined): FindingExposure | undefined {
+  if (!hndl) return undefined;
+  return hndl.byFingerprint.get(findingFingerprint(f));
+}
+
+/** The repo HNDL summary block shared by JSON output and the SARIF run. */
+function hndlSummaryBlock(hndl: HndlReport): Record<string, unknown> {
+  return {
+    modelVersion: hndl.modelVersion,
+    horizon: hndl.horizon,
+    summary: hndl.summary,
+    assets: hndl.assets,
+  };
 }
 
 const SARIF_SCHEMA =
@@ -104,6 +130,16 @@ function sarifRule(spec: {
   };
 }
 
+/** SARIF result.properties fragment for a finding's HNDL exposure, or empty. */
+function exposureProperties(exposure: FindingExposure | undefined): Record<string, unknown> {
+  if (!exposure) return {};
+  return {
+    exposureScore: exposure.exposureScore,
+    dataAsset: exposure.dataAsset,
+    exposureRationale: exposure.rationale,
+  };
+}
+
 /** Serialize a scan result as SARIF 2.1.0. */
 export function toSarif(result: ScanResult, opts?: ReportOptions): SarifLog {
   const redactSnippets = opts?.redactSnippets ?? false;
@@ -170,6 +206,10 @@ export function toSarif(result: ScanResult, opts?: ReportOptions): SarifLog {
       // edit above it. `quantakrypto/v1` names our scheme.
       partialFingerprints: { "quantakrypto/v1": fingerprintFinding(f) },
       properties: {
+        // Same stable identity mirrored into properties so non-GitHub SARIF
+        // consumers (our platform ingest) can read one uniform `fingerprint`
+        // field across JSON and SARIF without reaching into partialFingerprints.
+        fingerprint: fingerprintFinding(f),
         category: f.category,
         severity: f.severity,
         confidence: f.confidence,
@@ -177,6 +217,7 @@ export function toSarif(result: ScanResult, opts?: ReportOptions): SarifLog {
         ...(f.algorithm ? { algorithm: f.algorithm } : {}),
         ...(f.remediation ? { remediation: f.remediation } : {}),
         ...(f.cwe ? { cwe: f.cwe } : {}),
+        ...exposureProperties(exposureFor(f, opts?.hndl)),
       },
       ...(f.cwe
         ? {
@@ -232,6 +273,7 @@ export function toSarif(result: ScanResult, opts?: ReportOptions): SarifLog {
           },
         },
         ...(taxonomies.length > 0 ? { taxonomies } : {}),
+        ...(opts?.hndl ? { properties: { hndl: hndlSummaryBlock(opts.hndl) } } : {}),
         results,
       },
     ],
@@ -257,6 +299,7 @@ function securitySeverity(severity: Severity): string {
 /** Serialize a scan result as a plain JSON-friendly object. */
 export function toJson(result: ScanResult, opts?: ReportOptions): Record<string, unknown> {
   const redactSnippets = opts?.redactSnippets ?? false;
+  const hndl = opts?.hndl;
   return {
     toolVersion: result.toolVersion,
     root: result.root,
@@ -272,25 +315,48 @@ export function toJson(result: ScanResult, opts?: ReportOptions): Record<string,
       byCategory: result.inventory.byCategory,
       byAlgorithm: result.inventory.byAlgorithm,
     },
-    findings: result.findings.map((f) => ({
-      ruleId: f.ruleId,
-      title: f.title,
-      category: f.category,
-      severity: f.severity,
-      confidence: f.confidence,
-      algorithm: f.algorithm,
-      hndl: f.hndl,
-      message: f.message,
-      remediation: f.remediation,
-      cwe: f.cwe,
-      location: {
-        file: f.location.file,
-        line: f.location.line,
-        column: f.location.column,
-        endLine: f.location.endLine,
-        snippet: emittedSnippet(f, redactSnippets),
-      },
-    })),
+    ...(hndl ? { hndl: hndlSummaryBlock(hndl) } : {}),
+    findings: result.findings.map((f) => {
+      const exposure = exposureFor(f, hndl);
+      return {
+        // Stable, line-INSENSITIVE identity of the finding: sha256 of
+        // ruleId | normalized-POSIX-repo-relative-path | normalized-snippet
+        // (the SARIF partialFingerprints trick, line number deliberately
+        // excluded). Reused verbatim from the baseline module so JSON identity,
+        // SARIF partialFingerprints, and the baseline suppression set are one and
+        // the same value. A line move does NOT change it; when no snippet context
+        // exists it falls back to ruleId|path. This is the cross-run identity the
+        // platform keys posture drift on.
+        fingerprint: fingerprintFinding(f),
+        ruleId: f.ruleId,
+        title: f.title,
+        category: f.category,
+        severity: f.severity,
+        confidence: f.confidence,
+        algorithm: f.algorithm,
+        hndl: f.hndl,
+        message: f.message,
+        remediation: f.remediation,
+        cwe: f.cwe,
+        location: {
+          file: f.location.file,
+          line: f.location.line,
+          column: f.location.column,
+          endLine: f.location.endLine,
+          snippet: emittedSnippet(f, redactSnippets),
+        },
+        ...(exposure
+          ? {
+              exposure: {
+                fingerprint: exposure.fingerprint,
+                exposureScore: exposure.exposureScore,
+                dataAsset: exposure.dataAsset,
+                rationale: exposure.rationale,
+              },
+            }
+          : {}),
+      };
+    }),
   };
 }
 
@@ -475,3 +541,37 @@ export function formatTierGuidance(
   }
   return out;
 }
+
+/**
+ * Per-family migration targets tailored to a selected {@link StandardsProfile}
+ * (`--profile`). Unlike {@link formatTierGuidance} (CNSA-tier only), this surfaces the
+ * regime's parameter sets AND its hybrid stance — required (ANSSI/BSI) vs recommended
+ * (NIST/NCSC) vs optional (CNSA 2.0) — so guidance isn't regime-wrong. Returns plain
+ * (un-coloured) lines; the caller styles them.
+ */
+export function formatProfileGuidance(
+  byAlgorithm: Record<string, number>,
+  profile: StandardsProfile,
+): string[] {
+  const out: string[] = [`${profile.name} migration targets:`];
+  const seen = new Set<string>();
+  for (const [k, n] of Object.entries(byAlgorithm)) {
+    if (n <= 0) continue;
+    const fam = k as AlgorithmFamily;
+    if (fam === "unknown" || !remediationFor(fam)) continue; // skip unmapped families
+    const rem = remediationForProfile(fam, profile);
+    if (seen.has(rem.recommendation)) continue;
+    seen.add(rem.recommendation);
+    out.push(`  ${fam} → ${rem.recommendation}`);
+  }
+  const stance =
+    profile.hybridStance === "required"
+      ? "requires classical+PQC hybridization"
+      : profile.hybridStance === "recommended"
+        ? "recommends hybridization"
+        : "does not require hybridization";
+  out.push(
+    `  ${profile.authority} ${stance}; classical public-key crypto disallowed after ${profile.disallowAfter} (${profile.citation}).`,
+  );
+  return out;
+}

package/src/scan-worker.ts

@@ -15,7 +15,7 @@ import { parentPort, workerData } from "node:worker_threads";
 import type { Finding } from "./types.js";
 import { defaultRegistry } from "./registry.js";
 import { detectFile } from "./scan.js";
-import { looksMinified } from "./walk.js";
+import { isKeystorePath, looksMinified } from "./walk.js";
 import { isManifestFile } from "./dependencies.js";
 
 interface WorkerToggles {
@@ -48,14 +48,16 @@ if (parentPort) {
 
       for (const rel of req.files) {
         const abs = path.join(baseDir, ...rel.split("/"));
+        // Keystores (.jks/.p12/…) are read byte-preserving (latin1); see scan.ts.
+        const keystore = isKeystorePath(rel);
         let content: string;
         try {
-          content = readFileSync(abs, "utf8");
+          content = readFileSync(abs, keystore ? "latin1" : "utf8");
         } catch {
           unreadable += 1;
           continue;
         }
-        if (!toggles.scanMinified && !isManifestFile(rel) && looksMinified(content)) {
+        if (!toggles.scanMinified && !isManifestFile(rel) && !keystore && looksMinified(content)) {
           skippedMinified += 1;
           continue;
         }