@quantakrypto/core 0.4.4 → 0.6.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (302) hide show
  1. package/README.md +76 -27
  2. package/dist/cbom-merge.d.ts.map +1 -1
  3. package/dist/cbom-merge.js +30 -8
  4. package/dist/cbom-merge.js.map +1 -1
  5. package/dist/cbom.d.ts +5 -0
  6. package/dist/cbom.d.ts.map +1 -1
  7. package/dist/cbom.js +132 -37
  8. package/dist/cbom.js.map +1 -1
  9. package/dist/comments.d.ts +2 -23
  10. package/dist/comments.d.ts.map +1 -1
  11. package/dist/comments.js +24 -5
  12. package/dist/comments.js.map +1 -1
  13. package/dist/crypto-agility.d.ts +158 -0
  14. package/dist/crypto-agility.d.ts.map +1 -0
  15. package/dist/crypto-agility.js +285 -0
  16. package/dist/crypto-agility.js.map +1 -0
  17. package/dist/dependencies.d.ts.map +1 -1
  18. package/dist/dependencies.js +180 -18
  19. package/dist/dependencies.js.map +1 -1
  20. package/dist/detect-utils.d.ts +55 -21
  21. package/dist/detect-utils.d.ts.map +1 -1
  22. package/dist/detect-utils.js +133 -7
  23. package/dist/detect-utils.js.map +1 -1
  24. package/dist/detectors/age.d.ts +16 -0
  25. package/dist/detectors/age.d.ts.map +1 -0
  26. package/dist/detectors/age.js +40 -0
  27. package/dist/detectors/age.js.map +1 -0
  28. package/dist/detectors/ansible.d.ts +13 -0
  29. package/dist/detectors/ansible.d.ts.map +1 -0
  30. package/dist/detectors/ansible.js +108 -0
  31. package/dist/detectors/ansible.js.map +1 -0
  32. package/dist/detectors/bicep.d.ts +20 -0
  33. package/dist/detectors/bicep.d.ts.map +1 -0
  34. package/dist/detectors/bicep.js +74 -0
  35. package/dist/detectors/bicep.js.map +1 -0
  36. package/dist/detectors/c.d.ts.map +1 -1
  37. package/dist/detectors/c.js +30 -3
  38. package/dist/detectors/c.js.map +1 -1
  39. package/dist/detectors/cicd.d.ts.map +1 -1
  40. package/dist/detectors/cicd.js +18 -5
  41. package/dist/detectors/cicd.js.map +1 -1
  42. package/dist/detectors/cloud-kms.d.ts +8 -5
  43. package/dist/detectors/cloud-kms.d.ts.map +1 -1
  44. package/dist/detectors/cloud-kms.js +62 -20
  45. package/dist/detectors/cloud-kms.js.map +1 -1
  46. package/dist/detectors/cloudformation.d.ts +8 -0
  47. package/dist/detectors/cloudformation.d.ts.map +1 -1
  48. package/dist/detectors/cloudformation.js +41 -10
  49. package/dist/detectors/cloudformation.js.map +1 -1
  50. package/dist/detectors/codesign.d.ts +50 -0
  51. package/dist/detectors/codesign.d.ts.map +1 -0
  52. package/dist/detectors/codesign.js +143 -0
  53. package/dist/detectors/codesign.js.map +1 -0
  54. package/dist/detectors/csharp.d.ts.map +1 -1
  55. package/dist/detectors/csharp.js +13 -3
  56. package/dist/detectors/csharp.js.map +1 -1
  57. package/dist/detectors/dart.d.ts +35 -0
  58. package/dist/detectors/dart.d.ts.map +1 -0
  59. package/dist/detectors/dart.js +177 -0
  60. package/dist/detectors/dart.js.map +1 -0
  61. package/dist/detectors/database.d.ts +5 -3
  62. package/dist/detectors/database.d.ts.map +1 -1
  63. package/dist/detectors/database.js +45 -8
  64. package/dist/detectors/database.js.map +1 -1
  65. package/dist/detectors/dkim.d.ts +54 -0
  66. package/dist/detectors/dkim.d.ts.map +1 -0
  67. package/dist/detectors/dkim.js +92 -0
  68. package/dist/detectors/dkim.js.map +1 -0
  69. package/dist/detectors/dnssec.d.ts.map +1 -1
  70. package/dist/detectors/dnssec.js +19 -10
  71. package/dist/detectors/dnssec.js.map +1 -1
  72. package/dist/detectors/elixir.d.ts.map +1 -1
  73. package/dist/detectors/elixir.js +34 -2
  74. package/dist/detectors/elixir.js.map +1 -1
  75. package/dist/detectors/java.d.ts.map +1 -1
  76. package/dist/detectors/java.js +33 -3
  77. package/dist/detectors/java.js.map +1 -1
  78. package/dist/detectors/jose.d.ts.map +1 -1
  79. package/dist/detectors/jose.js +13 -3
  80. package/dist/detectors/jose.js.map +1 -1
  81. package/dist/detectors/jwk.d.ts +7 -7
  82. package/dist/detectors/jwk.d.ts.map +1 -1
  83. package/dist/detectors/jwk.js +44 -8
  84. package/dist/detectors/jwk.js.map +1 -1
  85. package/dist/detectors/k8s.d.ts.map +1 -1
  86. package/dist/detectors/k8s.js +5 -2
  87. package/dist/detectors/k8s.js.map +1 -1
  88. package/dist/detectors/keystore.d.ts +19 -0
  89. package/dist/detectors/keystore.d.ts.map +1 -0
  90. package/dist/detectors/keystore.js +76 -0
  91. package/dist/detectors/keystore.js.map +1 -0
  92. package/dist/detectors/mesh.d.ts +7 -8
  93. package/dist/detectors/mesh.d.ts.map +1 -1
  94. package/dist/detectors/mesh.js +17 -35
  95. package/dist/detectors/mesh.js.map +1 -1
  96. package/dist/detectors/messaging.d.ts +2 -2
  97. package/dist/detectors/messaging.d.ts.map +1 -1
  98. package/dist/detectors/messaging.js +19 -12
  99. package/dist/detectors/messaging.js.map +1 -1
  100. package/dist/detectors/objc.d.ts +41 -0
  101. package/dist/detectors/objc.d.ts.map +1 -0
  102. package/dist/detectors/objc.js +146 -0
  103. package/dist/detectors/objc.js.map +1 -0
  104. package/dist/detectors/openpgp.d.ts +20 -0
  105. package/dist/detectors/openpgp.d.ts.map +1 -0
  106. package/dist/detectors/openpgp.js +151 -0
  107. package/dist/detectors/openpgp.js.map +1 -0
  108. package/dist/detectors/pem.d.ts.map +1 -1
  109. package/dist/detectors/pem.js +32 -0
  110. package/dist/detectors/pem.js.map +1 -1
  111. package/dist/detectors/php.d.ts +2 -1
  112. package/dist/detectors/php.d.ts.map +1 -1
  113. package/dist/detectors/php.js +7 -3
  114. package/dist/detectors/php.js.map +1 -1
  115. package/dist/detectors/pkcs11.d.ts +17 -0
  116. package/dist/detectors/pkcs11.d.ts.map +1 -0
  117. package/dist/detectors/pkcs11.js +87 -0
  118. package/dist/detectors/pkcs11.js.map +1 -0
  119. package/dist/detectors/proxy.d.ts +52 -0
  120. package/dist/detectors/proxy.d.ts.map +1 -0
  121. package/dist/detectors/proxy.js +157 -0
  122. package/dist/detectors/proxy.js.map +1 -0
  123. package/dist/detectors/pulumi.d.ts +19 -0
  124. package/dist/detectors/pulumi.d.ts.map +1 -0
  125. package/dist/detectors/pulumi.js +80 -0
  126. package/dist/detectors/pulumi.js.map +1 -0
  127. package/dist/detectors/rust.d.ts.map +1 -1
  128. package/dist/detectors/rust.js +5 -0
  129. package/dist/detectors/rust.js.map +1 -1
  130. package/dist/detectors/secrets.d.ts +4 -1
  131. package/dist/detectors/secrets.d.ts.map +1 -1
  132. package/dist/detectors/secrets.js +5 -21
  133. package/dist/detectors/secrets.js.map +1 -1
  134. package/dist/detectors/solidity.d.ts +50 -0
  135. package/dist/detectors/solidity.d.ts.map +1 -0
  136. package/dist/detectors/solidity.js +108 -0
  137. package/dist/detectors/solidity.js.map +1 -0
  138. package/dist/detectors/source.d.ts.map +1 -1
  139. package/dist/detectors/source.js +105 -6
  140. package/dist/detectors/source.js.map +1 -1
  141. package/dist/detectors/spire.d.ts +49 -0
  142. package/dist/detectors/spire.d.ts.map +1 -0
  143. package/dist/detectors/spire.js +77 -0
  144. package/dist/detectors/spire.js.map +1 -0
  145. package/dist/detectors/ssh-ca.d.ts +72 -0
  146. package/dist/detectors/ssh-ca.d.ts.map +1 -0
  147. package/dist/detectors/ssh-ca.js +119 -0
  148. package/dist/detectors/ssh-ca.js.map +1 -0
  149. package/dist/detectors/supply-chain.d.ts +17 -0
  150. package/dist/detectors/supply-chain.d.ts.map +1 -0
  151. package/dist/detectors/supply-chain.js +89 -0
  152. package/dist/detectors/supply-chain.js.map +1 -0
  153. package/dist/detectors/swift.d.ts +22 -0
  154. package/dist/detectors/swift.d.ts.map +1 -0
  155. package/dist/detectors/swift.js +120 -0
  156. package/dist/detectors/swift.js.map +1 -0
  157. package/dist/detectors/terraform.d.ts.map +1 -1
  158. package/dist/detectors/terraform.js +35 -8
  159. package/dist/detectors/terraform.js.map +1 -1
  160. package/dist/detectors/vault.d.ts +15 -0
  161. package/dist/detectors/vault.d.ts.map +1 -0
  162. package/dist/detectors/vault.js +97 -0
  163. package/dist/detectors/vault.js.map +1 -0
  164. package/dist/detectors/vpn.d.ts +8 -8
  165. package/dist/detectors/vpn.d.ts.map +1 -1
  166. package/dist/detectors/vpn.js +12 -38
  167. package/dist/detectors/vpn.js.map +1 -1
  168. package/dist/detectors/weak-hash.d.ts +71 -0
  169. package/dist/detectors/weak-hash.d.ts.map +1 -0
  170. package/dist/detectors/weak-hash.js +116 -0
  171. package/dist/detectors/weak-hash.js.map +1 -0
  172. package/dist/detectors/webauthn.d.ts +61 -0
  173. package/dist/detectors/webauthn.d.ts.map +1 -0
  174. package/dist/detectors/webauthn.js +109 -0
  175. package/dist/detectors/webauthn.js.map +1 -0
  176. package/dist/detectors/xmldsig.d.ts +23 -0
  177. package/dist/detectors/xmldsig.d.ts.map +1 -0
  178. package/dist/detectors/xmldsig.js +84 -0
  179. package/dist/detectors/xmldsig.js.map +1 -0
  180. package/dist/evidence.d.ts +74 -4
  181. package/dist/evidence.d.ts.map +1 -1
  182. package/dist/evidence.js +71 -0
  183. package/dist/evidence.js.map +1 -1
  184. package/dist/hndl.d.ts +241 -0
  185. package/dist/hndl.d.ts.map +1 -0
  186. package/dist/hndl.js +752 -0
  187. package/dist/hndl.js.map +1 -0
  188. package/dist/index.d.ts +18 -11
  189. package/dist/index.d.ts.map +1 -1
  190. package/dist/index.js +21 -11
  191. package/dist/index.js.map +1 -1
  192. package/dist/inventory.d.ts +0 -2
  193. package/dist/inventory.d.ts.map +1 -1
  194. package/dist/inventory.js +15 -6
  195. package/dist/inventory.js.map +1 -1
  196. package/dist/parallel.d.ts.map +1 -1
  197. package/dist/parallel.js +22 -23
  198. package/dist/parallel.js.map +1 -1
  199. package/dist/registry.d.ts +9 -4
  200. package/dist/registry.d.ts.map +1 -1
  201. package/dist/registry.js +51 -4
  202. package/dist/registry.js.map +1 -1
  203. package/dist/remediate-pipeline.d.ts +0 -3
  204. package/dist/remediate-pipeline.d.ts.map +1 -1
  205. package/dist/remediate-pipeline.js +1 -1
  206. package/dist/remediate-pipeline.js.map +1 -1
  207. package/dist/remediation.d.ts +10 -0
  208. package/dist/remediation.d.ts.map +1 -1
  209. package/dist/remediation.js +32 -0
  210. package/dist/remediation.js.map +1 -1
  211. package/dist/report.d.ts +17 -0
  212. package/dist/report.d.ts.map +1 -1
  213. package/dist/report.js +106 -20
  214. package/dist/report.js.map +1 -1
  215. package/dist/scan-worker.js +5 -3
  216. package/dist/scan-worker.js.map +1 -1
  217. package/dist/scan.d.ts.map +1 -1
  218. package/dist/scan.js +35 -6
  219. package/dist/scan.js.map +1 -1
  220. package/dist/standards-profiles.d.ts +58 -0
  221. package/dist/standards-profiles.d.ts.map +1 -0
  222. package/dist/standards-profiles.js +100 -0
  223. package/dist/standards-profiles.js.map +1 -0
  224. package/dist/types.d.ts +7 -6
  225. package/dist/types.d.ts.map +1 -1
  226. package/dist/types.js.map +1 -1
  227. package/dist/version.d.ts +1 -1
  228. package/dist/version.js +1 -1
  229. package/dist/version.js.map +1 -1
  230. package/dist/vex.d.ts +39 -0
  231. package/dist/vex.d.ts.map +1 -0
  232. package/dist/vex.js +87 -0
  233. package/dist/vex.js.map +1 -0
  234. package/dist/walk.d.ts +39 -4
  235. package/dist/walk.d.ts.map +1 -1
  236. package/dist/walk.js +62 -10
  237. package/dist/walk.js.map +1 -1
  238. package/package.json +1 -1
  239. package/src/cbom-merge.ts +38 -8
  240. package/src/cbom.ts +153 -39
  241. package/src/comments.ts +25 -6
  242. package/src/crypto-agility.ts +407 -0
  243. package/src/dependencies.ts +182 -16
  244. package/src/detect-utils.ts +133 -11
  245. package/src/detectors/age.ts +60 -0
  246. package/src/detectors/ansible.ts +140 -0
  247. package/src/detectors/bicep.ts +107 -0
  248. package/src/detectors/c.ts +31 -3
  249. package/src/detectors/cicd.ts +18 -5
  250. package/src/detectors/cloud-kms.ts +79 -25
  251. package/src/detectors/cloudformation.ts +45 -10
  252. package/src/detectors/codesign.ts +214 -0
  253. package/src/detectors/csharp.ts +13 -3
  254. package/src/detectors/dart.ts +237 -0
  255. package/src/detectors/database.ts +64 -11
  256. package/src/detectors/dkim.ts +172 -0
  257. package/src/detectors/dnssec.ts +19 -10
  258. package/src/detectors/elixir.ts +33 -2
  259. package/src/detectors/java.ts +37 -3
  260. package/src/detectors/jose.ts +19 -3
  261. package/src/detectors/jwk.ts +59 -17
  262. package/src/detectors/k8s.ts +5 -2
  263. package/src/detectors/keystore.ts +109 -0
  264. package/src/detectors/mesh.ts +21 -45
  265. package/src/detectors/messaging.ts +22 -14
  266. package/src/detectors/objc.ts +209 -0
  267. package/src/detectors/openpgp.ts +194 -0
  268. package/src/detectors/pem.ts +30 -0
  269. package/src/detectors/php.ts +9 -4
  270. package/src/detectors/pkcs11.ts +113 -0
  271. package/src/detectors/proxy.ts +236 -0
  272. package/src/detectors/pulumi.ts +106 -0
  273. package/src/detectors/rust.ts +5 -0
  274. package/src/detectors/secrets.ts +15 -26
  275. package/src/detectors/solidity.ts +176 -0
  276. package/src/detectors/source.ts +110 -5
  277. package/src/detectors/spire.ts +143 -0
  278. package/src/detectors/ssh-ca.ts +215 -0
  279. package/src/detectors/supply-chain.ts +117 -0
  280. package/src/detectors/swift.ts +149 -0
  281. package/src/detectors/terraform.ts +42 -8
  282. package/src/detectors/vault.ts +120 -0
  283. package/src/detectors/vpn.ts +20 -48
  284. package/src/detectors/weak-hash.ts +217 -0
  285. package/src/detectors/webauthn.ts +205 -0
  286. package/src/detectors/xmldsig.ts +115 -0
  287. package/src/evidence.ts +127 -4
  288. package/src/hndl.ts +1012 -0
  289. package/src/index.ts +93 -13
  290. package/src/inventory.ts +15 -7
  291. package/src/parallel.ts +21 -20
  292. package/src/registry.ts +51 -4
  293. package/src/remediate-pipeline.ts +1 -1
  294. package/src/remediation.ts +39 -0
  295. package/src/report.ts +120 -20
  296. package/src/scan-worker.ts +5 -3
  297. package/src/scan.ts +41 -6
  298. package/src/standards-profiles.ts +136 -0
  299. package/src/types.ts +18 -5
  300. package/src/version.ts +1 -1
  301. package/src/vex.ts +122 -0
  302. package/src/walk.ts +80 -12
@@ -1 +1 @@
1
- {"version":3,"file":"dependencies.js","sourceRoot":"","sources":["../src/dependencies.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAE7C;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAa;IAC3C,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,+BAA+B;IACtC,QAAQ,EAAE,YAAY;IACtB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,8EAA8E;QAC9E,yEAAyE;IAC3E,WAAW,EACT,8EAA8E;QAC9E,2EAA2E;IAC7E,WAAW,EACT,gFAAgF;QAChF,0DAA0D;CAC7D,CAAC;AAEF,iDAAiD;AACjD,MAAM,CAAC,MAAM,sBAAsB,GAA2B;IAC5D;QACE,IAAI,EAAE,YAAY;QAClB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,yDAAyD;QACjE,UAAU,EAAE,CAAC,KAAK,CAAC;QACnB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,uDAAuD;QAC/D,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;QACtC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,mDAAmD;QAC3D,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC;QACnC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,uCAAuC;QAC/C,UAAU,EAAE,CAAC,KAAK,CAAC;QACnB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,qDAAqD;QAC7D,UAAU,EAAE,CAAC,KAAK,CAAC;QACnB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,OAAO;QACb,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,6DAA6D;QACrE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC;QAC5C,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,8DAA8D;QACtE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,8DAA8D;QACtE,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;QAC7C,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,KAAK;QACX,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,uDAAuD;QAC/D,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,qDAAqD;QAC7D,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;QACtC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,kDAAkD;QAC1D,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,oEAAoE;QAC5E,UAAU,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC/B,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,iCAAiC;QACzC,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,oEAAoE;QAC5E,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;QAChD,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,mCAAmC;QAC3C,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,yDAAyD;QACjE,UAAU,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC;QAC/B,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,oEAAoE;QAC5E,UAAU,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,+DAA+D;QACvE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;QACpD,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,wCAAwC;QAChD,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,kCAAkC;QAC1C,UAAU,EAAE,CAAC,KAAK,CAAC;QACnB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,uEAAuE;QAC/E,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,kEAAkE;QAC1E,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,uEAAuE;QAC/E,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,6DAA6D;QACrE,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,4DAA4D;QACpE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;QAC7C,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,0DAA0D;QAClE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;QACpC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,KAAK;QACX,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,0DAA0D;QAClE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,YAAY;QAClB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,sDAAsD;QAC9D,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,8DAA8D;QACtE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,yEAAyE;QACjF,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC;QACrC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,uDAAuD;QAC/D,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,OAAO;QACb,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,kEAAkE;QAC1E,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;QACpC,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,qDAAqD;QAC7D,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,oEAAoE;QAC5E,UAAU,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC;QAC/B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,8DAA8D;QACtE,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,KAAK;KAChB;IAED,wBAAwB;IACxB;QACE,IAAI,EAAE,cAAc;QACpB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,+CAA+C;QACvD,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC;QACnC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,oEAAoE;QAC5E,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;QAC1B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,mEAAmE;QAC3E,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;QACpC,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,gEAAgE;QACxE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,eAAe;QACrB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,iEAAiE;QACzE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC;QACnC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,KAAK;QACX,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,yCAAyC;QACjD,UAAU,EAAE,CAAC,KAAK,CAAC;QACnB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,OAAO;QACb,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,sDAAsD;QAC9D,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,+EAA+E;QACvF,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;QAC3C,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,OAAO;QACb,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,gDAAgD;QACxD,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,aAAa;QACnB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,+CAA+C;QACvD,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,0EAA0E;QAClF,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC;QAC5C,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,oDAAoD;QAC5D,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,MAAM;QACjB,MAAM,EACJ,0FAA0F;QAC5F,UAAU,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC/B,QAAQ,EAAE,KAAK;KAChB;IAED,2BAA2B;IAC3B;QACE,IAAI,EAAE,KAAK;QACX,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,uCAAuC;QAC/C,UAAU,EAAE,CAAC,KAAK,CAAC;QACnB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,0CAA0C;QAClD,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC;QAC7C,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,+CAA+C;QACvD,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,qDAAqD;QAC7D,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,qDAAqD;QAC7D,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,oDAAoD;QAC5D,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,8DAA8D;QACtE,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,4CAA4C;QACpD,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,8CAA8C;QACtD,UAAU,EAAE,CAAC,QAAQ,CAAC;QACtB,QAAQ,EAAE,KAAK;KAChB;IAED,qBAAqB;IACrB;QACE,IAAI,EAAE,qBAAqB;QAC3B,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,oEAAoE;QAC5E,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC;QAC7C,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,oDAAoD;QAC5D,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,yDAAyD;QACjE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,+BAA+B;QACrC,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,yEAAyE;QACjF,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;QACpC,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,SAAS,EAAE,IAAI;QACf,MAAM,EACJ,6KAA6K;QAC/K,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;QAC7B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,2CAA2C;QACjD,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,mFAAmF;QAC3F,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,QAAQ;KACnB;IAED,uBAAuB;IACvB;QACE,IAAI,EAAE,gBAAgB;QACtB,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,kEAAkE;QAC1E,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC;QAC3C,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,kEAAkE;QAC1E,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC;QAC3C,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,2DAA2D;QACnE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,8CAA8C;QACtD,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,kEAAkE;QAC1E,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;QACpC,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,yDAAyD;QACjE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IAED,mBAAmB;IACnB;QACE,IAAI,EAAE,KAAK;QACX,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,6CAA6C;QACrD,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,UAAU;QACrB,MAAM,EACJ,0FAA0F;QAC5F,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;QACpC,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,mEAAmE;QAC3E,UAAU,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC/B,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,4CAA4C;QACpD,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,KAAK;KAChB;IAED,uBAAuB;IACvB;QACE,IAAI,EAAE,2BAA2B;QACjC,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,kEAAkE;QAC1E,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC;QAC3C,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,gEAAgE;QACxE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC;QAC3C,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,mEAAmE;QAC3E,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,kEAAkE;QAC1E,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;CACF,CAAC;AAEF;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,SAA8B,EAAE,IAAY;IACjE,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,IAAI,SAAS,KAAK,MAAM;QAAE,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACzE,IAAI,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC;IACxD,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;AACzB,CAAC;AAED,qFAAqF;AACrF,MAAM,YAAY,GAAgE,CAAC,GAAG,EAAE;IACtF,MAAM,CAAC,GAAG,IAAI,GAAG,EAA0D,CAAC;IAC5E,KAAK,MAAM,CAAC,IAAI,sBAAsB,EAAE,CAAC;QACvC,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5B,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,EAAE,GAAG,IAAI,GAAG,EAAE,CAAC;YACf,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACzB,CAAC;QACD,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC,CAAC,EAAE,CAAC;AAEL;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAC/B,sBAAsB;KACnB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC;KACpC,GAAG,CAAC,CAAC,CAAC,EAAoB,EAAE;IAC3B,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;IAC/D,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,OAAO,QAAQ,CAAC,CAAC,CAAC;AACnD,CAAC,CAAC,CACL,CAAC;AAEF;;;;;;;;GAQG;AACH,SAAS,sBAAsB,CAAC,UAAsC;IACpE,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,uBAAuB,CAAC,CAAC,CAAC;YAAE,QAAQ,GAAG,IAAI,CAAC;QAChD,IAAI,iBAAiB,CAAC,CAAC,CAAC;YAAE,QAAQ,GAAG,IAAI,CAAC;QAC1C,IAAI,CAAC,KAAK,SAAS;YAAE,WAAW,GAAG,IAAI,CAAC;IAC1C,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,QAAQ;QACV,KAAK,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;IACzF,IAAI,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IAChE,6EAA6E;IAC7E,IAAI,WAAW,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9E,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3D,IACE,IAAI,KAAK,cAAc;QACvB,IAAI,KAAK,mBAAmB;QAC5B,IAAI,KAAK,qBAAqB;QAC9B,IAAI,KAAK,WAAW;QACpB,IAAI,KAAK,gBAAgB,EACzB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,KAAK,kBAAkB,IAAI,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IAC1F,IAAI,IAAI,KAAK,gBAAgB,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACnE,IAAI,IAAI,KAAK,YAAY;QAAE,OAAO,OAAO,CAAC;IAC1C,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,kBAAkB;QAAE,OAAO,OAAO,CAAC;IACjG,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IACvE,IAAI,IAAI,KAAK,iBAAiB,IAAI,IAAI,KAAK,0BAA0B,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC/F,OAAO,OAAO,CAAC;IACjB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,iBAAiB,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,SAA8B,EAAE,OAAe;IACrE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,4EAA4E;YAC5E,wEAAwE;YACxE,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;gBACxB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBACpE,MAAM,IAAI,GAAG,iCAAiC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC1D,IAAI,IAAI;oBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC9B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,gCAAgC,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpF,CAAC;YACD,MAAM;QACR,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,2EAA2E;YAC3E,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;gBACxB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAC5C,MAAM,GAAG,GAAG,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC1D,IAAI,GAAG;oBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5B,MAAM,KAAK,GAAG,uDAAuD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjF,IAAI,KAAK;oBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAClC,CAAC;YACD,MAAM;QACR,CAAC;QACD,KAAK,IAAI,CAAC,CAAC,CAAC;YACV,qEAAqE;YACrE,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,qCAAqC,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1F,MAAM;QACR,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,uEAAuE;YACvE,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,4CAA4C,CAAC,EAAE,CAAC;gBAC/E,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,uCAAuC,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5F,MAAM;QACR,CAAC;QACD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,2DAA2D;YAC3D,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACjF,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAC9B,+DAA+D,CAChE,EAAE,CAAC;gBACF,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC;YACD,MAAM;QACR,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,0EAA0E;YAC1E,kEAAkE;YAClE,0EAA0E;YAC1E,uEAAuE;YACvE,yEAAyE;YACzE,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,qDAAqD,CAAC,EAAE,CAAC;gBACxF,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,uCAAuC,CAAC,EAAE,CAAC;gBAC1E,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC;YACD,MAAM;QACR,CAAC;QACD,KAAK,KAAK;YACR,MAAM,CAAC,8CAA8C;IACzD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qFAAqF;AACrF,SAAS,YAAY,CAAC,OAAe,EAAE,IAAY;IACjD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,gBAAgB,OAAO,YAAY,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CACxB,GAAyB,EACzB,IAAY,EACZ,OAAe,EACf,KAAa;IAEb,yEAAyE;IACzE,0DAA0D;IAC1D,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;IACjD,OAAO,WAAW,CAAC;QACjB,MAAM,EAAE,gBAAgB;QACxB,KAAK,EAAE,kCAAkC,GAAG,CAAC,IAAI,EAAE;QACnD,QAAQ,EAAE,YAAY;QACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,UAAU,EAAE,MAAM;QAClB,SAAS;QACT,yEAAyE;QACzE,2EAA2E;QAC3E,wEAAwE;QACxE,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,uBAAuB,CAAC;QAC9D,GAAG,EAAE,iBAAiB;QACtB,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,MAAM,EAAE;QACtC,WAAW,EAAE,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC;QACnD,IAAI;QACJ,OAAO;QACP,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED,4EAA4E;AAC5E,SAAS,WAAW,CAAC,OAAe,EAAE,IAAY;IAChD,0EAA0E;IAC1E,MAAM,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,CAAC;IAClB,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3B,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACzB,CAAC;AAED,uDAAuD;AACvD,SAAS,WAAW,CAAC,QAAmB;IACtC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,OAAe;IACxD,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,CAAC;IAC1B,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,CAAC;IAEnB,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3D,2EAA2E;QAC3E,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACtD,OAAO,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,EAAgC,CAAC,CAAC,kBAAkB;IACzE,KAAK,MAAM,GAAG,IAAI,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;QAClD,IAAI,GAAG;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CACtB,OAAe,EACf,IAAY,EACZ,EAAqC;IAErC,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,iCAAiC;IAC9C,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAEzD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,GAAG,GAAG,IAA+B,CAAC;IAE5C,MAAM,iBAAiB,GAAG,CAAC,GAAY,EAAQ,EAAE;QAC/C,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO;QACpD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAA8B,CAAC,EAAE,CAAC;YAC9D,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,CAAC;IAEF,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACpC,iBAAiB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACvC,iBAAiB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACxC,iBAAiB,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAE5C,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC9B,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACtD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAmC,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC,GAAG;gBAAE,SAAS,CAAC,qBAAqB;YACzC,MAAM,MAAM,GAAG,eAAe,CAAC;YAC/B,MAAM,GAAG,GAAG,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YAC7D,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,qBAAqB,CAAC,OAAe;IAC5C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,EAAE,GAAG,6DAA6D,CAAC;IACzE,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI;QAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACtE,wEAAwE;IACxE,MAAM,KAAK,GAAG,4DAA4D,CAAC;IAC3E,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI;QAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACzE,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CACtB,OAAe,EACf,IAAY,EACZ,EAAqC;IAErC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAgC,CAAC;IACtD,KAAK,MAAM,IAAI,IAAI,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,GAAG;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;AAC/B,CAAC","sourcesContent":["/**\n * Curated database of packages that primarily expose classical asymmetric\n * cryptography (and are therefore quantum-vulnerable), across multiple\n * ecosystems (npm, PyPI, crates.io, Go modules, Maven, RubyGems, NuGet), plus a\n * manifest scanner that flags any of them found in the corresponding manifest\n * (package.json, requirements.txt, Cargo.toml, go.mod, pom.xml, Gemfile,\n * packages.config / *.csproj, …).\n *\n * The list is intentionally focused on libraries whose *purpose* is classical\n * public-key crypto. General-purpose packages that merely call the language's\n * stdlib crypto are out of scope here (those are caught by the source detectors).\n * Extraction is generous but every finding must match a curated entry, so a new\n * manifest format is cheap to add (see `manifestEcosystem` + `candidateNames`).\n */\nimport type {\n AlgorithmFamily,\n DependencyEcosystem,\n Finding,\n RuleMeta,\n VulnerableDependency,\n} from \"./types.js\";\nimport { makeFinding } from \"./detect-utils.js\";\nimport { isConfidentialityFamily, isSignatureFamily, remediationText } from \"./remediation.js\";\nimport { CWE_BROKEN_CRYPTO } from \"./cwe.js\";\n\n/**\n * Catalog entry for the `dep-vulnerable` rule. Dependency findings are produced\n * by the manifest scanner rather than a registered {@link Detector}, so this\n * rule is absent from `defaultRegistry.ruleCatalog()`. Reporters (SARIF) merge\n * it in so the rule advertises a GENERIC description — the per-package specifics\n * (title/severity/HNDL/remediation) live on each individual finding/result, not\n * on the shared rule. Without this, SARIF would leak the first dependency's\n * package-specific text into the rule-level `shortDescription` for every dep.\n */\nexport const DEP_VULNERABLE_RULE: RuleMeta = {\n id: \"dep-vulnerable\",\n title: \"Quantum-vulnerable dependency\",\n category: \"dependency\",\n // Representative default; each SARIF result carries its own per-package level.\n severity: \"high\",\n confidence: \"high\",\n hndl: false,\n cwe: CWE_BROKEN_CRYPTO,\n message:\n \"A dependency implements classical public-key cryptography that is broken by \" +\n \"quantum computers. Replace or upgrade it to a post-quantum alternative.\",\n remediation:\n \"Move to a post-quantum alternative — ML-KEM-768 (FIPS 203) for key exchange/\" +\n \"encryption and ML-DSA-65 (FIPS 204) for signatures, ideally via a hybrid.\",\n description:\n \"Flags packages in a dependency manifest known to implement quantum-vulnerable \" +\n \"public-key cryptography (RSA, ECDH/ECDSA, DH, EdDSA, …).\",\n};\n\n/** Known quantum-vulnerable npm dependencies. */\nexport const vulnerableDependencies: VulnerableDependency[] = [\n {\n name: \"node-forge\",\n ecosystem: \"npm\",\n reason: \"Pure-JS implementation of RSA, RSA-OAEP, and X.509 PKI.\",\n algorithms: [\"RSA\"],\n severity: \"high\",\n },\n {\n name: \"elliptic\",\n ecosystem: \"npm\",\n reason: \"Elliptic-curve ECDSA/ECDH (secp256k1, p256, ed25519).\",\n algorithms: [\"ECDSA\", \"ECDH\", \"EdDSA\"],\n severity: \"high\",\n },\n {\n name: \"jsrsasign\",\n ecosystem: \"npm\",\n reason: \"RSA/ECDSA/DSA signing, JWT, and X.509 in pure JS.\",\n algorithms: [\"RSA\", \"ECDSA\", \"DSA\"],\n severity: \"high\",\n },\n {\n name: \"node-rsa\",\n ecosystem: \"npm\",\n reason: \"Classical RSA encryption and signing.\",\n algorithms: [\"RSA\"],\n severity: \"high\",\n },\n {\n name: \"ursa\",\n ecosystem: \"npm\",\n reason: \"OpenSSL-backed RSA encryption and signing bindings.\",\n algorithms: [\"RSA\"],\n severity: \"high\",\n },\n {\n name: \"sshpk\",\n ecosystem: \"npm\",\n reason: \"Parses/handles SSH and PEM keys (RSA, ECDSA, Ed25519, DSA).\",\n algorithms: [\"RSA\", \"ECDSA\", \"EdDSA\", \"DSA\"],\n severity: \"medium\",\n },\n {\n name: \"jsonwebtoken\",\n ecosystem: \"npm\",\n reason: \"JWTs commonly signed with RS256/ES256 (classical RSA/ECDSA).\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"high\",\n hndl: false,\n },\n {\n name: \"jose\",\n ecosystem: \"npm\",\n reason: \"JWS/JWE with classical RSA-OAEP, RSA-PSS, ECDH-ES and ECDSA.\",\n algorithms: [\"RSA\", \"ECDH\", \"ECDSA\", \"EdDSA\"],\n severity: \"high\",\n },\n {\n name: \"jws\",\n ecosystem: \"npm\",\n reason: \"JSON Web Signatures using classical RS/ES algorithms.\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"high\",\n hndl: false,\n },\n {\n name: \"eccrypto\",\n ecosystem: \"npm\",\n reason: \"ECIES (ECDH-based) encryption and ECDSA signatures.\",\n algorithms: [\"ECIES\", \"ECDH\", \"ECDSA\"],\n severity: \"high\",\n },\n {\n name: \"secp256k1\",\n ecosystem: \"npm\",\n reason: \"secp256k1 ECDSA/ECDH bindings (blockchain keys).\",\n algorithms: [\"ECDSA\", \"ECDH\"],\n severity: \"high\",\n },\n {\n name: \"tweetnacl\",\n ecosystem: \"npm\",\n reason: \"X25519 key exchange and Ed25519 signatures (modern but classical).\",\n algorithms: [\"X25519\", \"EdDSA\"],\n severity: \"low\",\n },\n {\n name: \"ed25519\",\n ecosystem: \"npm\",\n reason: \"Ed25519 signatures (classical).\",\n algorithms: [\"EdDSA\"],\n severity: \"low\",\n },\n {\n name: \"@noble/curves\",\n ecosystem: \"npm\",\n reason: \"Audited classical curves: ECDSA, ECDH, Ed25519, X25519, secp256k1.\",\n algorithms: [\"ECDSA\", \"ECDH\", \"EdDSA\", \"X25519\"],\n severity: \"medium\",\n },\n {\n name: \"@noble/secp256k1\",\n ecosystem: \"npm\",\n reason: \"secp256k1 ECDSA/ECDH (classical).\",\n algorithms: [\"ECDSA\", \"ECDH\"],\n severity: \"medium\",\n },\n {\n name: \"@noble/ed25519\",\n ecosystem: \"npm\",\n reason: \"Ed25519 signatures and X25519 key exchange (classical).\",\n algorithms: [\"EdDSA\", \"X25519\"],\n severity: \"low\",\n },\n {\n name: \"paseto\",\n ecosystem: \"npm\",\n reason: \"PASETO public tokens signed with classical Ed25519 (v2/v4) or RSA.\",\n algorithms: [\"EdDSA\", \"RSA\"],\n severity: \"medium\",\n hndl: false,\n },\n {\n name: \"bcrypto\",\n ecosystem: \"npm\",\n reason: \"Broad classical crypto suite: RSA, ECDSA, ECDH, Ed25519, DSA.\",\n algorithms: [\"RSA\", \"ECDSA\", \"ECDH\", \"EdDSA\", \"DSA\"],\n severity: \"high\",\n },\n {\n name: \"ecpair\",\n ecosystem: \"npm\",\n reason: \"secp256k1 ECDSA key pairs for Bitcoin.\",\n algorithms: [\"ECDSA\"],\n severity: \"medium\",\n },\n {\n name: \"keypair\",\n ecosystem: \"npm\",\n reason: \"Pure-JS RSA key pair generation.\",\n algorithms: [\"RSA\"],\n severity: \"high\",\n },\n {\n name: \"ethers\",\n ecosystem: \"npm\",\n reason: \"Ethereum library built on secp256k1 ECDSA signing and key derivation.\",\n algorithms: [\"ECDSA\"],\n severity: \"high\",\n },\n {\n name: \"web3\",\n ecosystem: \"npm\",\n reason: \"Ethereum library using secp256k1 ECDSA for accounts and signing.\",\n algorithms: [\"ECDSA\"],\n severity: \"high\",\n },\n {\n name: \"bitcoinjs-lib\",\n ecosystem: \"npm\",\n reason: \"Bitcoin library built on secp256k1 ECDSA/Schnorr keys and signatures.\",\n algorithms: [\"ECDSA\"],\n severity: \"high\",\n },\n {\n name: \"ethereumjs-util\",\n ecosystem: \"npm\",\n reason: \"secp256k1 ECDSA utilities for Ethereum keys and signatures.\",\n algorithms: [\"ECDSA\"],\n severity: \"medium\",\n },\n {\n name: \"openpgp\",\n ecosystem: \"npm\",\n reason: \"OpenPGP.js: RSA, ECDSA, ECDH, and EdDSA public-key crypto.\",\n algorithms: [\"RSA\", \"ECDSA\", \"ECDH\", \"EdDSA\"],\n severity: \"high\",\n },\n {\n name: \"node-jose\",\n ecosystem: \"npm\",\n reason: \"JOSE (JWS/JWE/JWK) with classical RSA and EC algorithms.\",\n algorithms: [\"RSA\", \"ECDSA\", \"ECDH\"],\n severity: \"high\",\n },\n {\n name: \"jwa\",\n ecosystem: \"npm\",\n reason: \"JSON Web Algorithms: RSA (RS/PS) and EC (ES) signatures.\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"medium\",\n hndl: false,\n },\n {\n name: \"jwk-to-pem\",\n ecosystem: \"npm\",\n reason: \"Converts RSA/EC JWKs to PEM — classical public keys.\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"medium\",\n },\n {\n name: \"fast-jwt\",\n ecosystem: \"npm\",\n reason: \"JWT signing/verification with classical RS/PS/ES algorithms.\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"medium\",\n hndl: false,\n },\n {\n name: \"ssh2\",\n ecosystem: \"npm\",\n reason: \"SSH client/server using classical RSA/ECDSA/Ed25519 host and user keys.\",\n algorithms: [\"RSA\", \"ECDSA\", \"EdDSA\"],\n severity: \"high\",\n },\n {\n name: \"@peculiar/x509\",\n ecosystem: \"npm\",\n reason: \"X.509 certificate library over classical RSA/EC keys.\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"medium\",\n },\n {\n name: \"pkijs\",\n ecosystem: \"npm\",\n reason: \"PKI (X.509/CMS) built on classical RSA and EC public-key crypto.\",\n algorithms: [\"RSA\", \"ECDSA\", \"ECDH\"],\n severity: \"medium\",\n },\n {\n name: \"http-signature\",\n ecosystem: \"npm\",\n reason: \"HTTP request signing with classical RSA/ECDSA keys.\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"medium\",\n hndl: false,\n },\n {\n name: \"libsodium-wrappers\",\n ecosystem: \"npm\",\n reason: \"libsodium: Ed25519 signatures and X25519 key exchange (classical).\",\n algorithms: [\"EdDSA\", \"X25519\"],\n severity: \"medium\",\n },\n {\n name: \"ecdsa-sig-formatter\",\n ecosystem: \"npm\",\n reason: \"Formats ECDSA signatures — a marker of classical EC signing.\",\n algorithms: [\"ECDSA\"],\n severity: \"low\",\n },\n\n // --- PyPI (Python) ---\n {\n name: \"pycryptodome\",\n ecosystem: \"pypi\",\n reason: \"RSA / ECC / DSA public-key crypto for Python.\",\n algorithms: [\"RSA\", \"ECDSA\", \"DSA\"],\n severity: \"high\",\n },\n {\n name: \"pycrypto\",\n ecosystem: \"pypi\",\n reason: \"Abandoned/unmaintained crypto library — classical RSA/DSA/ElGamal.\",\n algorithms: [\"RSA\", \"DSA\"],\n severity: \"high\",\n },\n {\n name: \"jwcrypto\",\n ecosystem: \"pypi\",\n reason: \"JWK / JWS / JWE with classical RS*/ES* and ECDH-ES key agreement.\",\n algorithms: [\"RSA\", \"ECDSA\", \"ECDH\"],\n severity: \"medium\",\n },\n {\n name: \"authlib\",\n ecosystem: \"pypi\",\n reason: \"OAuth / OIDC / JOSE stack using classical RS*/ES* JWT signing.\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"medium\",\n hndl: false,\n },\n {\n name: \"pycryptodomex\",\n ecosystem: \"pypi\",\n reason: \"RSA / ECC / DSA public-key crypto (the `Cryptodome` namespace).\",\n algorithms: [\"RSA\", \"ECDSA\", \"DSA\"],\n severity: \"high\",\n },\n {\n name: \"rsa\",\n ecosystem: \"pypi\",\n reason: \"Pure-Python RSA encryption and signing.\",\n algorithms: [\"RSA\"],\n severity: \"high\",\n },\n {\n name: \"ecdsa\",\n ecosystem: \"pypi\",\n reason: \"Pure-Python ECDSA/ECDH over NIST + secp256k1 curves.\",\n algorithms: [\"ECDSA\", \"ECDH\"],\n severity: \"high\",\n },\n {\n name: \"cryptography\",\n ecosystem: \"pypi\",\n reason: \"General crypto library exposing classical RSA/EC/DH/DSA (also symmetric/PQC).\",\n algorithms: [\"RSA\", \"ECDH\", \"ECDSA\", \"DSA\"],\n severity: \"medium\",\n },\n {\n name: \"pyjwt\",\n ecosystem: \"pypi\",\n reason: \"JWT signing with classical RS*/ES* algorithms.\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"medium\",\n hndl: false,\n },\n {\n name: \"python-jose\",\n ecosystem: \"pypi\",\n reason: \"JOSE/JWT with classical RSA/ECDSA algorithms.\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"medium\",\n },\n {\n name: \"paramiko\",\n ecosystem: \"pypi\",\n reason: \"SSH client/server with classical RSA/ECDSA/Ed25519/DSA host + user keys.\",\n algorithms: [\"RSA\", \"ECDSA\", \"EdDSA\", \"DSA\"],\n severity: \"medium\",\n },\n {\n name: \"pyopenssl\",\n ecosystem: \"pypi\",\n reason: \"OpenSSL bindings for classical RSA/EC X.509 + TLS.\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"medium\",\n },\n {\n name: \"pynacl\",\n ecosystem: \"pypi\",\n reason:\n \"libsodium bindings — X25519 key agreement and Ed25519 signatures (modern but classical).\",\n algorithms: [\"X25519\", \"EdDSA\"],\n severity: \"low\",\n },\n\n // --- crates.io (Rust) ---\n {\n name: \"rsa\",\n ecosystem: \"cargo\",\n reason: \"Pure-Rust RSA encryption and signing.\",\n algorithms: [\"RSA\"],\n severity: \"high\",\n },\n {\n name: \"ring\",\n ecosystem: \"cargo\",\n reason: \"RSA / ECDSA / Ed25519 / ECDH primitives.\",\n algorithms: [\"RSA\", \"ECDSA\", \"EdDSA\", \"ECDH\"],\n severity: \"medium\",\n },\n {\n name: \"openssl\",\n ecosystem: \"cargo\",\n reason: \"OpenSSL bindings for classical RSA/EC crypto.\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"medium\",\n },\n {\n name: \"p256\",\n ecosystem: \"cargo\",\n reason: \"NIST P-256 ECDSA signatures and ECDH key agreement.\",\n algorithms: [\"ECDSA\", \"ECDH\"],\n severity: \"high\",\n },\n {\n name: \"p384\",\n ecosystem: \"cargo\",\n reason: \"NIST P-384 ECDSA signatures and ECDH key agreement.\",\n algorithms: [\"ECDSA\", \"ECDH\"],\n severity: \"high\",\n },\n {\n name: \"k256\",\n ecosystem: \"cargo\",\n reason: \"secp256k1 ECDSA signatures and ECDH key agreement.\",\n algorithms: [\"ECDSA\", \"ECDH\"],\n severity: \"high\",\n },\n {\n name: \"secp256k1\",\n ecosystem: \"cargo\",\n reason: \"libsecp256k1 bindings (blockchain) — classical ECDSA + ECDH.\",\n algorithms: [\"ECDSA\", \"ECDH\"],\n severity: \"high\",\n },\n {\n name: \"ed25519-dalek\",\n ecosystem: \"cargo\",\n reason: \"Ed25519 signatures (modern but classical).\",\n algorithms: [\"EdDSA\"],\n severity: \"low\",\n },\n {\n name: \"x25519-dalek\",\n ecosystem: \"cargo\",\n reason: \"X25519 key agreement (modern but classical).\",\n algorithms: [\"X25519\"],\n severity: \"low\",\n },\n\n // --- Go modules ---\n {\n name: \"golang.org/x/crypto\",\n ecosystem: \"go\",\n reason: \"SSH, OpenPGP, and classical curve helpers on top of the Go stdlib.\",\n algorithms: [\"RSA\", \"ECDSA\", \"EdDSA\", \"ECDH\"],\n severity: \"medium\",\n },\n {\n name: \"github.com/golang-jwt/jwt/v5\",\n ecosystem: \"go\",\n reason: \"golang-jwt — classical RS*/PS*/ES* JWT algorithms.\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"medium\",\n hndl: false,\n },\n {\n name: \"github.com/golang-jwt/jwt/v4\",\n ecosystem: \"go\",\n reason: \"golang-jwt (v4) — classical RS*/PS*/ES* JWT algorithms.\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"medium\",\n hndl: false,\n },\n {\n name: \"github.com/go-jose/go-jose/v4\",\n ecosystem: \"go\",\n reason: \"go-jose — classical JOSE (RSA/ECDSA signatures, ECDH-ES key agreement).\",\n algorithms: [\"RSA\", \"ECDSA\", \"ECDH\"],\n severity: \"medium\",\n },\n {\n name: \"github.com/cloudflare/circl\",\n ecosystem: \"go\",\n reason:\n \"Cloudflare CIRCL — classical ECDH/EdDSA curves (X25519, X448, Ed25519, P-256); also ships PQC (ML-KEM/ML-DSA + hybrids), so migrate the classical *usage*, not the package.\",\n algorithms: [\"ECDH\", \"EdDSA\"],\n severity: \"medium\",\n },\n {\n name: \"github.com/decred/dcrd/dcrec/secp256k1/v4\",\n ecosystem: \"go\",\n reason: \"decred secp256k1 — classical ECDSA/ECDH on the secp256k1 curve (blockchain keys).\",\n algorithms: [\"ECDSA\", \"ECDH\"],\n severity: \"medium\",\n },\n\n // --- Maven (Java) ---\n {\n name: \"bcprov-jdk18on\",\n ecosystem: \"maven\",\n reason: \"BouncyCastle provider — full classical RSA/ECDSA/ECDH/DSA suite.\",\n algorithms: [\"RSA\", \"ECDSA\", \"ECDH\", \"DSA\"],\n severity: \"high\",\n },\n {\n name: \"bcprov-jdk15on\",\n ecosystem: \"maven\",\n reason: \"BouncyCastle provider (JDK 1.5+) — classical RSA/ECDSA/ECDH/DSA.\",\n algorithms: [\"RSA\", \"ECDSA\", \"ECDH\", \"DSA\"],\n severity: \"high\",\n },\n {\n name: \"bcpkix-jdk18on\",\n ecosystem: \"maven\",\n reason: \"BouncyCastle PKIX — classical X.509 / CMS with RSA/ECDSA.\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"medium\",\n },\n {\n name: \"java-jwt\",\n ecosystem: \"maven\",\n reason: \"Auth0 JWT with classical RS*/ES* algorithms.\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"medium\",\n hndl: false,\n },\n {\n name: \"nimbus-jose-jwt\",\n ecosystem: \"maven\",\n reason: \"Nimbus JOSE+JWT — classical RS*/PS*/ES* JWS and RSA/ECDH-ES JWE.\",\n algorithms: [\"RSA\", \"ECDSA\", \"ECDH\"],\n severity: \"medium\",\n },\n {\n name: \"jjwt-api\",\n ecosystem: \"maven\",\n reason: \"JJWT (io.jsonwebtoken) — classical RS*/ES* JWT signing.\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"medium\",\n hndl: false,\n },\n\n // --- RubyGems ---\n {\n name: \"jwt\",\n ecosystem: \"rubygems\",\n reason: \"Ruby JWT with classical RS*/ES* algorithms.\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"medium\",\n hndl: false,\n },\n {\n name: \"net-ssh\",\n ecosystem: \"rubygems\",\n reason:\n \"Ruby SSH client — classical host/user keys (RSA/ECDSA/Ed25519) and ECDH/DH key exchange.\",\n algorithms: [\"RSA\", \"ECDSA\", \"ECDH\"],\n severity: \"medium\",\n },\n {\n name: \"rbnacl\",\n ecosystem: \"rubygems\",\n reason: \"libsodium bindings — X25519 key agreement and Ed25519 signatures.\",\n algorithms: [\"X25519\", \"EdDSA\"],\n severity: \"low\",\n },\n {\n name: \"ed25519\",\n ecosystem: \"rubygems\",\n reason: \"Ed25519 signatures (modern but classical).\",\n algorithms: [\"EdDSA\"],\n severity: \"low\",\n },\n\n // --- NuGet (.NET) ---\n {\n name: \"BouncyCastle.Cryptography\",\n ecosystem: \"nuget\",\n reason: \"BouncyCastle for .NET — full classical RSA/ECDSA/ECDH/DSA suite.\",\n algorithms: [\"RSA\", \"ECDSA\", \"ECDH\", \"DSA\"],\n severity: \"high\",\n },\n {\n name: \"Portable.BouncyCastle\",\n ecosystem: \"nuget\",\n reason: \"Portable BouncyCastle for .NET — classical RSA/ECDSA/ECDH/DSA.\",\n algorithms: [\"RSA\", \"ECDSA\", \"ECDH\", \"DSA\"],\n severity: \"high\",\n },\n {\n name: \"System.IdentityModel.Tokens.Jwt\",\n ecosystem: \"nuget\",\n reason: \"Microsoft JWT handler — classical RS*/ES* (RSA/ECDSA) signatures.\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"medium\",\n hndl: false,\n },\n {\n name: \"Microsoft.IdentityModel.Tokens\",\n ecosystem: \"nuget\",\n reason: \"Microsoft IdentityModel token crypto — classical RSA/ECDSA keys.\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"medium\",\n hndl: false,\n },\n];\n\n/**\n * Normalise a package name for matching within its ecosystem. PyPI is\n * case-insensitive and folds runs of `-_.` to a single `-` (PEP 503); cargo /\n * maven / rubygems / nuget are effectively lower-case (NuGet ids are matched\n * case-insensitively); npm and go module paths are matched verbatim (npm scopes\n * and go paths are case-sensitive).\n */\nfunction normalizeName(ecosystem: DependencyEcosystem, name: string): string {\n const n = name.trim();\n if (ecosystem === \"pypi\") return n.toLowerCase().replace(/[-_.]+/g, \"-\");\n if (ecosystem === \"npm\" || ecosystem === \"go\") return n;\n return n.toLowerCase();\n}\n\n/** ecosystem → (normalised name → entry). Scoped so `rsa` (pypi) ≠ `rsa` (cargo). */\nconst BY_ECOSYSTEM: Map<DependencyEcosystem, Map<string, VulnerableDependency>> = (() => {\n const m = new Map<DependencyEcosystem, Map<string, VulnerableDependency>>();\n for (const d of vulnerableDependencies) {\n let em = m.get(d.ecosystem);\n if (!em) {\n em = new Map();\n m.set(d.ecosystem, em);\n }\n em.set(normalizeName(d.ecosystem, d.name), d);\n }\n return m;\n})();\n\n/**\n * Precompiled `\"name\":` lookup regex per known npm package (P1-9): the set is\n * static, so build the (name → RegExp) map once rather than per manifest. Only\n * npm uses the JSON-key form; other ecosystems locate names generically.\n */\nconst KEY_REGEX_BY_NAME = new Map<string, RegExp>(\n vulnerableDependencies\n .filter((d) => d.ecosystem === \"npm\")\n .map((d): [string, RegExp] => {\n const escaped = d.name.replace(/[.*+?^${}()|[\\]\\\\/]/g, \"\\\\$&\");\n return [d.name, new RegExp(`\"${escaped}\"\\\\s*:`)];\n }),\n);\n\n/**\n * Build a remediation string covering ALL families a package exposes (C5),\n * rather than only `algorithms[0]`. De-duplicates by PQC *target* — the KEM\n * target and the signature target are each named at most once — so a library\n * exposing both a confidentiality family and a signature family reads\n * \"ML-KEM-768 … for key exchange/encryption; ML-DSA-65 (FIPS 204) for\n * signatures\" instead of repeating ML-DSA (the old per-string Set couldn't\n * collapse \"ML-DSA-65 for signatures\" against a standalone \"ML-DSA-65 (FIPS 204)\").\n */\nfunction multiFamilyRemediation(algorithms: readonly AlgorithmFamily[]): string {\n let needsKem = false;\n let needsSig = false;\n let needsReview = false;\n for (const a of algorithms) {\n if (isConfidentialityFamily(a)) needsKem = true;\n if (isSignatureFamily(a)) needsSig = true;\n if (a === \"unknown\") needsReview = true;\n }\n const parts: string[] = [];\n if (needsKem)\n parts.push(\"ML-KEM-768 (FIPS 203, hybrid X25519MLKEM768) for key exchange/encryption\");\n if (needsSig) parts.push(\"ML-DSA-65 (FIPS 204) for signatures\");\n // Only fall back to the generic \"review\" line when nothing concrete applied.\n if (needsReview && parts.length === 0) parts.push(remediationText(\"unknown\"));\n return parts.join(\"; \");\n}\n\n/**\n * The dependency ecosystem a manifest filename belongs to, or null when the file\n * is not a manifest we parse. Drives both {@link isManifestFile} and the scanner\n * dispatch — one place to add a manifest format.\n */\nexport function manifestEcosystem(file: string): DependencyEcosystem | null {\n const base = (file.split(\"/\").pop() ?? file).toLowerCase();\n if (\n base === \"package.json\" ||\n base === \"package-lock.json\" ||\n base === \"npm-shrinkwrap.json\" ||\n base === \"yarn.lock\" ||\n base === \"pnpm-lock.yaml\"\n ) {\n return \"npm\";\n }\n if (base === \"requirements.txt\" || /^requirements[\\w.-]*\\.txt$/.test(base)) return \"pypi\";\n if (base === \"pyproject.toml\" || base === \"pipfile\") return \"pypi\";\n if (base === \"cargo.toml\") return \"cargo\";\n if (base === \"go.mod\") return \"go\";\n if (base === \"pom.xml\" || base === \"build.gradle\" || base === \"build.gradle.kts\") return \"maven\";\n if (base === \"gemfile\" || base.endsWith(\".gemspec\")) return \"rubygems\";\n if (base === \"packages.config\" || base === \"directory.packages.props\" || base.endsWith(\".csproj\"))\n return \"nuget\";\n return null;\n}\n\n/** True if a file path looks like a manifest we can parse for dependencies. */\nexport function isManifestFile(file: string): boolean {\n return manifestEcosystem(file) !== null;\n}\n\n/**\n * Extract candidate package names from a non-npm manifest. Extraction is\n * deliberately GENEROUS — every finding still has to match a curated DB entry,\n * so over-extracting harmless tokens (e.g. a TOML `version = …` key) costs\n * nothing while keeping the parsers tiny and format-tolerant.\n */\nfunction candidateNames(ecosystem: DependencyEcosystem, content: string): string[] {\n const names: string[] = [];\n const lines = content.split(\"\\n\");\n switch (ecosystem) {\n case \"pypi\": {\n // requirements.txt / Pipfile / pyproject.toml: leading token per line, plus\n // quoted deps in arrays/tables. Skip comments and `-r/-e/--flag` lines.\n for (const raw of lines) {\n const line = raw.trim();\n if (!line || line.startsWith(\"#\") || line.startsWith(\"-\")) continue;\n const lead = /^[\"']?([A-Za-z][A-Za-z0-9._-]+)/.exec(line);\n if (lead) names.push(lead[1]);\n for (const m of line.matchAll(/[\"']([A-Za-z][A-Za-z0-9._-]+)/g)) names.push(m[1]);\n }\n break;\n }\n case \"cargo\": {\n // Cargo.toml: dependency-table keys `name = …` and `[…dependencies.name]`.\n for (const raw of lines) {\n const line = raw.trim();\n if (!line || line.startsWith(\"#\")) continue;\n const key = /^([A-Za-z0-9][A-Za-z0-9_-]+)\\s*=/.exec(line);\n if (key) names.push(key[1]);\n const table = /^\\[[\\w.-]*dependencies\\.([A-Za-z0-9][A-Za-z0-9_-]+)\\]/.exec(line);\n if (table) names.push(table[1]);\n }\n break;\n }\n case \"go\": {\n // go.mod: `require path v1.2.3` (single or in a require( … ) block).\n for (const m of content.matchAll(/(?:^|\\s)([a-z0-9][\\w.\\-/]+)\\s+v\\d/gm)) names.push(m[1]);\n break;\n }\n case \"maven\": {\n // pom.xml <artifactId> tags + gradle `group:artifact:version` strings.\n for (const m of content.matchAll(/<artifactId>\\s*([\\w.-]+)\\s*<\\/artifactId>/g)) {\n names.push(m[1]);\n }\n for (const m of content.matchAll(/[\"']([\\w.-]+):([\\w.-]+):[\\w.$-]+[\"']/g)) names.push(m[2]);\n break;\n }\n case \"rubygems\": {\n // Gemfile `gem 'name'` + gemspec `add_*dependency 'name'`.\n for (const m of content.matchAll(/\\bgem\\s+[\"']([\\w.-]+)[\"']/g)) names.push(m[1]);\n for (const m of content.matchAll(\n /add(?:_runtime|_development)?_dependency\\s+[\"']([\\w.-]+)[\"']/g,\n )) {\n names.push(m[1]);\n }\n break;\n }\n case \"nuget\": {\n // NuGet manifests are XML. `.csproj` / `Directory.Packages.props` declare\n // `<PackageReference Include=\"Name\" … />`; `packages.config` uses\n // `<package id=\"Name\" … />`. Pull the Include= / id= attribute value from\n // each. The `[^>]` guard keeps every match inside a single tag, so the\n // scan is linear (no nested quantifiers → no catastrophic backtracking).\n for (const m of content.matchAll(/<PackageReference\\b[^>]*\\bInclude\\s*=\\s*\"([^\"]+)\"/gi)) {\n names.push(m[1]);\n }\n for (const m of content.matchAll(/<package\\b[^>]*\\bid\\s*=\\s*\"([^\"]+)\"/gi)) {\n names.push(m[1]);\n }\n break;\n }\n case \"npm\":\n break; // npm uses the JSON path, not this extractor.\n }\n return names;\n}\n\n/** First offset of a package `name` as a whole token in the manifest text (or 0). */\nfunction offsetOfName(content: string, name: string): number {\n const escaped = name.replace(/[.*+?^${}()|[\\]\\\\/]/g, \"\\\\$&\");\n const m = new RegExp(`(?<![\\\\w./-])${escaped}(?![\\\\w-])`).exec(content);\n return m ? m.index : 0;\n}\n\n/**\n * Build a finding for a vulnerable dependency located in a manifest. The\n * location points at the line where the package name appears in the file (best\n * effort), falling back to line 1.\n */\nfunction dependencyFinding(\n dep: VulnerableDependency,\n file: string,\n content: string,\n index: number,\n): Finding {\n // Use the first listed algorithm for the headline family, but derive the\n // remediation from ALL families the package exposes (C5).\n const algorithm = dep.algorithms[0] ?? \"unknown\";\n return makeFinding({\n ruleId: \"dep-vulnerable\",\n title: `Quantum-vulnerable dependency: ${dep.name}`,\n category: \"dependency\",\n severity: dep.severity,\n confidence: \"high\",\n algorithm,\n // Confidentiality libs are HNDL-exposed; signature-only ones are not. An\n // explicit `dep.hndl` wins (some packages list RSA/EC as a family but only\n // ever sign — e.g. JWS/JWT libs — and signatures are not HNDL-exposed).\n hndl: dep.hndl ?? dep.algorithms.some(isConfidentialityFamily),\n cwe: CWE_BROKEN_CRYPTO,\n message: `${dep.name} — ${dep.reason}`,\n remediation: multiFamilyRemediation(dep.algorithms),\n file,\n content,\n index,\n });\n}\n\n/** Locate the offset of a JSON key `\"name\"` in the manifest text (or 0). */\nfunction offsetOfKey(content: string, name: string): number {\n // Use the precompiled per-name regex (non-global; .exec from position 0).\n const re = KEY_REGEX_BY_NAME.get(name);\n if (!re) return 0;\n const m = re.exec(content);\n return m ? m.index : 0;\n}\n\n/** Sort findings by title for deterministic output. */\nfunction sortByTitle(findings: Finding[]): Finding[] {\n findings.sort((a, b) => (a.title < b.title ? -1 : a.title > b.title ? 1 : 0));\n return findings;\n}\n\n/**\n * Scan a single manifest file for vulnerable dependencies, dispatching by the\n * file's ecosystem ({@link manifestEcosystem}). npm manifests are parsed as\n * JSON; every other ecosystem uses the generous {@link candidateNames} extractor\n * filtered against the ecosystem-scoped database. Returns one finding per\n * distinct vulnerable package.\n */\nexport function scanManifest(file: string, content: string): Finding[] {\n const ecosystem = manifestEcosystem(file);\n if (!ecosystem) return [];\n const db = BY_ECOSYSTEM.get(ecosystem);\n if (!db) return [];\n\n if (ecosystem === \"npm\") {\n const base = (file.split(\"/\").pop() ?? file).toLowerCase();\n // yarn.lock / pnpm-lock.yaml are not JSON — extract names from their text.\n if (base === \"yarn.lock\" || base === \"pnpm-lock.yaml\") {\n return scanNpmLockfile(content, file, db);\n }\n return scanNpmManifest(content, file, db);\n }\n\n const found = new Map<string, VulnerableDependency>(); // dedupe by entry\n for (const raw of candidateNames(ecosystem, content)) {\n const dep = db.get(normalizeName(ecosystem, raw));\n if (dep) found.set(dep.name, dep);\n }\n const findings: Finding[] = [];\n for (const dep of found.values()) {\n findings.push(dependencyFinding(dep, file, content, offsetOfName(content, dep.name)));\n }\n return sortByTitle(findings);\n}\n\n/**\n * npm manifest scan.\n * - `package.json`: dependencies / devDependencies / peerDependencies / optionalDependencies.\n * - `package-lock.json` (v2/v3): the `packages` map keys (node_modules/<name>).\n */\nfunction scanNpmManifest(\n content: string,\n file: string,\n db: Map<string, VulnerableDependency>,\n): Finding[] {\n let json: unknown;\n try {\n json = JSON.parse(content);\n } catch {\n return []; // not valid JSON — skip quietly.\n }\n if (json === null || typeof json !== \"object\") return [];\n\n const found = new Set<string>();\n const obj = json as Record<string, unknown>;\n\n const collectFromRecord = (rec: unknown): void => {\n if (rec === null || typeof rec !== \"object\") return;\n for (const key of Object.keys(rec as Record<string, unknown>)) {\n if (db.has(key)) found.add(key);\n }\n };\n\n collectFromRecord(obj.dependencies);\n collectFromRecord(obj.devDependencies);\n collectFromRecord(obj.peerDependencies);\n collectFromRecord(obj.optionalDependencies);\n\n const packages = obj.packages;\n if (packages !== null && typeof packages === \"object\") {\n for (const key of Object.keys(packages as Record<string, unknown>)) {\n if (!key) continue; // root package entry\n const marker = \"node_modules/\";\n const idx = key.lastIndexOf(marker);\n const name = idx >= 0 ? key.slice(idx + marker.length) : key;\n if (db.has(name)) found.add(name);\n }\n }\n\n const findings: Finding[] = [];\n for (const name of found) {\n const dep = db.get(name);\n if (!dep) continue;\n findings.push(dependencyFinding(dep, file, content, offsetOfKey(content, name)));\n }\n return sortByTitle(findings);\n}\n\n/**\n * Extract candidate package names from a yarn.lock / pnpm-lock.yaml text body.\n * Generous — every `name@…` (and pnpm's `/name/version`) token is captured; the\n * caller filters against the vulnerable-dependency DB, so over-capture is safe.\n * Handles yarn v1 (`elliptic@^6.5.4:`), yarn berry (`\"elliptic@npm:^6.5.4\":`),\n * and pnpm (`/elliptic@6.5.4:`, scoped `/@noble/curves@1.2.0:`).\n */\nfunction npmLockfileCandidates(content: string): string[] {\n const names = new Set<string>();\n const at = /(?:^|[\\s,\"'/])((?:@[a-z0-9._-]+\\/)?[a-z0-9][a-z0-9._-]*)@/gm;\n let m: RegExpExecArray | null;\n while ((m = at.exec(content)) !== null) names.add(m[1].toLowerCase());\n // pnpm's older `/name/version` form (name followed by a version digit).\n const slash = /(?:^|\\s)\\/((?:@[a-z0-9._-]+\\/)?[a-z0-9][a-z0-9._-]*)\\/\\d/gm;\n while ((m = slash.exec(content)) !== null) names.add(m[1].toLowerCase());\n return [...names];\n}\n\n/**\n * npm lockfile scan (yarn.lock / pnpm-lock.yaml): match every package token in\n * the lockfile text against the vulnerable-dependency DB. Catches transitive\n * dependencies that never appear in package.json.\n */\nfunction scanNpmLockfile(\n content: string,\n file: string,\n db: Map<string, VulnerableDependency>,\n): Finding[] {\n const found = new Map<string, VulnerableDependency>();\n for (const name of npmLockfileCandidates(content)) {\n const dep = db.get(name);\n if (dep) found.set(dep.name, dep);\n }\n const findings: Finding[] = [];\n for (const dep of found.values()) {\n findings.push(dependencyFinding(dep, file, content, offsetOfName(content, dep.name)));\n }\n return sortByTitle(findings);\n}\n"]}
1
+ {"version":3,"file":"dependencies.js","sourceRoot":"","sources":["../src/dependencies.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAE7C;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAa;IAC3C,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,+BAA+B;IACtC,QAAQ,EAAE,YAAY;IACtB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,8EAA8E;QAC9E,yEAAyE;IAC3E,WAAW,EACT,8EAA8E;QAC9E,2EAA2E;IAC7E,WAAW,EACT,gFAAgF;QAChF,0DAA0D;CAC7D,CAAC;AAEF,iDAAiD;AACjD,MAAM,CAAC,MAAM,sBAAsB,GAA2B;IAC5D;QACE,IAAI,EAAE,YAAY;QAClB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,yDAAyD;QACjE,UAAU,EAAE,CAAC,KAAK,CAAC;QACnB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,uDAAuD;QAC/D,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;QACtC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,mDAAmD;QAC3D,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC;QACnC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,uCAAuC;QAC/C,UAAU,EAAE,CAAC,KAAK,CAAC;QACnB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,qDAAqD;QAC7D,UAAU,EAAE,CAAC,KAAK,CAAC;QACnB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,OAAO;QACb,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,6DAA6D;QACrE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC;QAC5C,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,8DAA8D;QACtE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,8DAA8D;QACtE,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;QAC7C,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,KAAK;QACX,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,uDAAuD;QAC/D,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,qDAAqD;QAC7D,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;QACtC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,kDAAkD;QAC1D,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,oEAAoE;QAC5E,UAAU,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC/B,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,iCAAiC;QACzC,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,oEAAoE;QAC5E,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;QAChD,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,mCAAmC;QAC3C,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,yDAAyD;QACjE,UAAU,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC;QAC/B,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,oEAAoE;QAC5E,UAAU,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,+DAA+D;QACvE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;QACpD,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,wCAAwC;QAChD,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,kCAAkC;QAC1C,UAAU,EAAE,CAAC,KAAK,CAAC;QACnB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,uEAAuE;QAC/E,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,kEAAkE;QAC1E,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,uEAAuE;QAC/E,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,6DAA6D;QACrE,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,4DAA4D;QACpE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;QAC7C,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,0DAA0D;QAClE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;QACpC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,KAAK;QACX,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,0DAA0D;QAClE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,YAAY;QAClB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,sDAAsD;QAC9D,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,8DAA8D;QACtE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,yEAAyE;QACjF,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC;QACrC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,uDAAuD;QAC/D,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,OAAO;QACb,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,kEAAkE;QAC1E,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;QACpC,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,qDAAqD;QAC7D,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,oEAAoE;QAC5E,UAAU,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC;QAC/B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,8DAA8D;QACtE,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,KAAK;KAChB;IAED,wBAAwB;IACxB;QACE,IAAI,EAAE,cAAc;QACpB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,+CAA+C;QACvD,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC;QACnC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,oEAAoE;QAC5E,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;QAC1B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,mEAAmE;QAC3E,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;QACpC,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,gEAAgE;QACxE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,eAAe;QACrB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,iEAAiE;QACzE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC;QACnC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,KAAK;QACX,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,yCAAyC;QACjD,UAAU,EAAE,CAAC,KAAK,CAAC;QACnB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,OAAO;QACb,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,sDAAsD;QAC9D,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,+EAA+E;QACvF,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;QAC3C,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,OAAO;QACb,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,gDAAgD;QACxD,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,aAAa;QACnB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,+CAA+C;QACvD,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,0EAA0E;QAClF,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC;QAC5C,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,oDAAoD;QAC5D,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,MAAM;QACjB,MAAM,EACJ,0FAA0F;QAC5F,UAAU,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC/B,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,MAAM;QACjB,MAAM,EACJ,4FAA4F;QAC9F,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;QAC9C,QAAQ,EAAE,MAAM;KACjB;IAED,2BAA2B;IAC3B;QACE,IAAI,EAAE,KAAK;QACX,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,uCAAuC;QAC/C,UAAU,EAAE,CAAC,KAAK,CAAC;QACnB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,0CAA0C;QAClD,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC;QAC7C,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,+CAA+C;QACvD,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,qDAAqD;QAC7D,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,qDAAqD;QAC7D,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,oDAAoD;QAC5D,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,8DAA8D;QACtE,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,4CAA4C;QACpD,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,8CAA8C;QACtD,UAAU,EAAE,CAAC,QAAQ,CAAC;QACtB,QAAQ,EAAE,KAAK;KAChB;IAED,qBAAqB;IACrB;QACE,IAAI,EAAE,qBAAqB;QAC3B,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,oEAAoE;QAC5E,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC;QAC7C,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,oDAAoD;QAC5D,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,yDAAyD;QACjE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,+BAA+B;QACrC,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,yEAAyE;QACjF,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;QACpC,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,SAAS,EAAE,IAAI;QACf,MAAM,EACJ,6KAA6K;QAC/K,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;QAC7B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,2CAA2C;QACjD,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,mFAAmF;QAC3F,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,mCAAmC;QACzC,SAAS,EAAE,IAAI;QACf,MAAM,EACJ,wFAAwF;QAC1F,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;QAC9C,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,gFAAgF;QACxF,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;QAC9C,QAAQ,EAAE,MAAM;KACjB;IAED,uBAAuB;IACvB;QACE,IAAI,EAAE,gBAAgB;QACtB,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,kEAAkE;QAC1E,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC;QAC3C,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,kEAAkE;QAC1E,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC;QAC3C,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,2DAA2D;QACnE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,8CAA8C;QACtD,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,kEAAkE;QAC1E,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;QACpC,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,yDAAyD;QACjE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,OAAO;QAClB,MAAM,EACJ,4GAA4G;QAC9G,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;QAC9C,QAAQ,EAAE,MAAM;KACjB;IAED,mBAAmB;IACnB;QACE,IAAI,EAAE,KAAK;QACX,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,6CAA6C;QACrD,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,UAAU;QACrB,MAAM,EACJ,0FAA0F;QAC5F,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;QACpC,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,mEAAmE;QAC3E,UAAU,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC/B,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,4CAA4C;QACpD,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,KAAK;KAChB;IAED,uBAAuB;IACvB;QACE,IAAI,EAAE,2BAA2B;QACjC,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,kEAAkE;QAC1E,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC;QAC3C,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,gEAAgE;QACxE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC;QAC3C,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,mEAAmE;QAC3E,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,kEAAkE;QAC1E,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IAED,yBAAyB;IACzB;QACE,IAAI,EAAE,qBAAqB;QAC3B,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,0EAA0E;QAClF,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC;QACzC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,2EAA2E;QACnF,UAAU,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC/B,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,iEAAiE;QACzE,UAAU,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC/B,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,oEAAoE;QAC5E,UAAU,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,iEAAiE;QACzE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,cAAc;QACpB,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,wDAAwD;QAChE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,qFAAqF;QAC7F,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;QACpC,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,aAAa;QACnB,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,kEAAkE;QAC1E,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,sEAAsE;QAC9E,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,MAAM;KACjB;CACF,CAAC;AAEF;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,SAA8B,EAAE,IAAY;IACjE,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,IAAI,SAAS,KAAK,MAAM;QAAE,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACzE,IAAI,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC;IACxD,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;AACzB,CAAC;AAED,qFAAqF;AACrF,MAAM,YAAY,GAAgE,CAAC,GAAG,EAAE;IACtF,MAAM,CAAC,GAAG,IAAI,GAAG,EAA0D,CAAC;IAC5E,KAAK,MAAM,CAAC,IAAI,sBAAsB,EAAE,CAAC;QACvC,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5B,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,EAAE,GAAG,IAAI,GAAG,EAAE,CAAC;YACf,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACzB,CAAC;QACD,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC,CAAC,EAAE,CAAC;AAEL;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAC/B,sBAAsB;KACnB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC;KACpC,GAAG,CAAC,CAAC,CAAC,EAAoB,EAAE;IAC3B,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;IAC/D,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,OAAO,QAAQ,CAAC,CAAC,CAAC;AACnD,CAAC,CAAC,CACL,CAAC;AAEF;;;;;;;;GAQG;AACH,SAAS,sBAAsB,CAAC,UAAsC;IACpE,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,uBAAuB,CAAC,CAAC,CAAC;YAAE,QAAQ,GAAG,IAAI,CAAC;QAChD,IAAI,iBAAiB,CAAC,CAAC,CAAC;YAAE,QAAQ,GAAG,IAAI,CAAC;QAC1C,IAAI,CAAC,KAAK,SAAS;YAAE,WAAW,GAAG,IAAI,CAAC;IAC1C,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,QAAQ;QACV,KAAK,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;IACzF,IAAI,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IAChE,6EAA6E;IAC7E,IAAI,WAAW,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9E,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3D,IACE,IAAI,KAAK,cAAc;QACvB,IAAI,KAAK,mBAAmB;QAC5B,IAAI,KAAK,qBAAqB;QAC9B,IAAI,KAAK,WAAW;QACpB,IAAI,KAAK,gBAAgB,EACzB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,KAAK,kBAAkB,IAAI,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IAC1F,IAAI,IAAI,KAAK,gBAAgB,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACnE,IAAI,IAAI,KAAK,YAAY;QAAE,OAAO,OAAO,CAAC;IAC1C,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,kBAAkB;QAAE,OAAO,OAAO,CAAC;IACjG,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IACvE,IAAI,IAAI,KAAK,iBAAiB,IAAI,IAAI,KAAK,0BAA0B,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC/F,OAAO,OAAO,CAAC;IACjB,IAAI,IAAI,KAAK,eAAe,IAAI,IAAI,KAAK,eAAe;QAAE,OAAO,UAAU,CAAC;IAC5E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,iBAAiB,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,SAA8B,EAAE,OAAe;IACrE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,4EAA4E;YAC5E,wEAAwE;YACxE,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;gBACxB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBACpE,MAAM,IAAI,GAAG,iCAAiC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC1D,IAAI,IAAI;oBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC9B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,gCAAgC,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpF,CAAC;YACD,MAAM;QACR,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,2EAA2E;YAC3E,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;gBACxB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAC5C,MAAM,GAAG,GAAG,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC1D,IAAI,GAAG;oBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5B,MAAM,KAAK,GAAG,uDAAuD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjF,IAAI,KAAK;oBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAClC,CAAC;YACD,MAAM;QACR,CAAC;QACD,KAAK,IAAI,CAAC,CAAC,CAAC;YACV,qEAAqE;YACrE,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,qCAAqC,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1F,MAAM;QACR,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,uEAAuE;YACvE,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,4CAA4C,CAAC,EAAE,CAAC;gBAC/E,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,uCAAuC,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5F,MAAM;QACR,CAAC;QACD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,2DAA2D;YAC3D,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACjF,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAC9B,+DAA+D,CAChE,EAAE,CAAC;gBACF,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC;YACD,MAAM;QACR,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,0EAA0E;YAC1E,kEAAkE;YAClE,0EAA0E;YAC1E,uEAAuE;YACvE,yEAAyE;YACzE,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,qDAAqD,CAAC,EAAE,CAAC;gBACxF,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,uCAAuC,CAAC,EAAE,CAAC;gBAC1E,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC;YACD,MAAM;QACR,CAAC;QACD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,4EAA4E;YAC5E,yEAAyE;YACzE,0EAA0E;YAC1E,yEAAyE;YACzE,2EAA2E;YAC3E,iCAAiC;YACjC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAC9B,kFAAkF,CACnF,EAAE,CAAC;gBACF,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC;YACD,MAAM;QACR,CAAC;QACD,KAAK,KAAK;YACR,MAAM,CAAC,8CAA8C;IACzD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qFAAqF;AACrF,SAAS,YAAY,CAAC,OAAe,EAAE,IAAY;IACjD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,gBAAgB,OAAO,YAAY,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CACxB,GAAyB,EACzB,IAAY,EACZ,OAAe,EACf,KAAa;IAEb,yEAAyE;IACzE,0DAA0D;IAC1D,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;IACjD,OAAO,WAAW,CAAC;QACjB,MAAM,EAAE,gBAAgB;QACxB,KAAK,EAAE,kCAAkC,GAAG,CAAC,IAAI,EAAE;QACnD,QAAQ,EAAE,YAAY;QACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,UAAU,EAAE,MAAM;QAClB,SAAS;QACT,yEAAyE;QACzE,2EAA2E;QAC3E,wEAAwE;QACxE,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,uBAAuB,CAAC;QAC9D,GAAG,EAAE,iBAAiB;QACtB,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,MAAM,EAAE;QACtC,WAAW,EAAE,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC;QACnD,IAAI;QACJ,OAAO;QACP,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED,4EAA4E;AAC5E,SAAS,WAAW,CAAC,OAAe,EAAE,IAAY;IAChD,0EAA0E;IAC1E,MAAM,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,CAAC;IAClB,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3B,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACzB,CAAC;AAED,uDAAuD;AACvD,SAAS,WAAW,CAAC,QAAmB;IACtC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,OAAe;IACxD,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,CAAC;IAC1B,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,CAAC;IAEnB,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3D,2EAA2E;QAC3E,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACtD,OAAO,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,EAAgC,CAAC,CAAC,kBAAkB;IACzE,KAAK,MAAM,GAAG,IAAI,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;QAClD,IAAI,GAAG;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,OAAO,IAAI,IAAI,IAAI,CAAC;AACtB,CAAC;AAED,kFAAkF;AAClF,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAE9B;;;;;;;;GAQG;AACH,SAAS,eAAe,CACtB,OAAe,EACf,IAAY,EACZ,EAAqC;IAErC,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,iCAAiC;IAC9C,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAEzD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,GAAG,GAAG,IAA+B,CAAC;IAE5C,MAAM,GAAG,GAAG,CAAC,IAAY,EAAQ,EAAE;QACjC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC;IAEF;;;;;;OAMG;IACH,MAAM,WAAW,GAAG,CAAC,IAAa,EAAE,KAAa,EAAQ,EAAE;QACzD,IAAI,KAAK,GAAG,kBAAkB,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO;QACpF,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,IAAI,CAAC,CAAC;YACV,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,0EAA0E;gBAC1E,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;gBACrC,IAAI,OAAO;oBAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5B,CAAC;iBAAM,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrD,MAAM,GAAG,GAAG,IAA+B,CAAC;gBAC5C,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;oBACpC,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBAC5C,IAAI,OAAO;wBAAE,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC5B,CAAC;gBACD,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,gCAAgC;YAC5E,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IACjC,WAAW,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;IACpC,WAAW,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;IACrC,WAAW,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC;IAEzC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC9B,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACtD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAmC,CAAC,EAAE,CAAC;YAC/E,IAAI,CAAC,GAAG;gBAAE,SAAS,CAAC,qBAAqB;YACzC,MAAM,MAAM,GAAG,eAAe,CAAC;YAC/B,MAAM,GAAG,GAAG,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YACpC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACrD,2EAA2E;YAC3E,mEAAmE;YACnE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAChD,MAAM,QAAQ,GAAI,KAAiC,CAAC,IAAI,CAAC;gBACzD,IAAI,OAAO,QAAQ,KAAK,QAAQ;oBAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,qBAAqB,CAAC,OAAe;IAC5C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,EAAE,GAAG,6DAA6D,CAAC;IACzE,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI;QAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACtE,wEAAwE;IACxE,MAAM,KAAK,GAAG,4DAA4D,CAAC;IAC3E,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI;QAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACzE,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CACtB,OAAe,EACf,IAAY,EACZ,EAAqC;IAErC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAgC,CAAC;IACtD,KAAK,MAAM,IAAI,IAAI,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,GAAG;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;AAC/B,CAAC","sourcesContent":["/**\n * Curated database of packages that primarily expose classical asymmetric\n * cryptography (and are therefore quantum-vulnerable), across multiple\n * ecosystems (npm, PyPI, crates.io, Go modules, Maven, RubyGems, NuGet), plus a\n * manifest scanner that flags any of them found in the corresponding manifest\n * (package.json, requirements.txt, Cargo.toml, go.mod, pom.xml, Gemfile,\n * packages.config / *.csproj, …).\n *\n * The list is intentionally focused on libraries whose *purpose* is classical\n * public-key crypto. General-purpose packages that merely call the language's\n * stdlib crypto are out of scope here (those are caught by the source detectors).\n * Extraction is generous but every finding must match a curated entry, so a new\n * manifest format is cheap to add (see `manifestEcosystem` + `candidateNames`).\n */\nimport type {\n AlgorithmFamily,\n DependencyEcosystem,\n Finding,\n RuleMeta,\n VulnerableDependency,\n} from \"./types.js\";\nimport { makeFinding } from \"./detect-utils.js\";\nimport { isConfidentialityFamily, isSignatureFamily, remediationText } from \"./remediation.js\";\nimport { CWE_BROKEN_CRYPTO } from \"./cwe.js\";\n\n/**\n * Catalog entry for the `dep-vulnerable` rule. Dependency findings are produced\n * by the manifest scanner rather than a registered {@link Detector}, so this\n * rule is absent from `defaultRegistry.ruleCatalog()`. Reporters (SARIF) merge\n * it in so the rule advertises a GENERIC description — the per-package specifics\n * (title/severity/HNDL/remediation) live on each individual finding/result, not\n * on the shared rule. Without this, SARIF would leak the first dependency's\n * package-specific text into the rule-level `shortDescription` for every dep.\n */\nexport const DEP_VULNERABLE_RULE: RuleMeta = {\n id: \"dep-vulnerable\",\n title: \"Quantum-vulnerable dependency\",\n category: \"dependency\",\n // Representative default; each SARIF result carries its own per-package level.\n severity: \"high\",\n confidence: \"high\",\n hndl: false,\n cwe: CWE_BROKEN_CRYPTO,\n message:\n \"A dependency implements classical public-key cryptography that is broken by \" +\n \"quantum computers. Replace or upgrade it to a post-quantum alternative.\",\n remediation:\n \"Move to a post-quantum alternative — ML-KEM-768 (FIPS 203) for key exchange/\" +\n \"encryption and ML-DSA-65 (FIPS 204) for signatures, ideally via a hybrid.\",\n description:\n \"Flags packages in a dependency manifest known to implement quantum-vulnerable \" +\n \"public-key cryptography (RSA, ECDH/ECDSA, DH, EdDSA, …).\",\n};\n\n/** Known quantum-vulnerable npm dependencies. */\nexport const vulnerableDependencies: VulnerableDependency[] = [\n {\n name: \"node-forge\",\n ecosystem: \"npm\",\n reason: \"Pure-JS implementation of RSA, RSA-OAEP, and X.509 PKI.\",\n algorithms: [\"RSA\"],\n severity: \"high\",\n },\n {\n name: \"elliptic\",\n ecosystem: \"npm\",\n reason: \"Elliptic-curve ECDSA/ECDH (secp256k1, p256, ed25519).\",\n algorithms: [\"ECDSA\", \"ECDH\", \"EdDSA\"],\n severity: \"high\",\n },\n {\n name: \"jsrsasign\",\n ecosystem: \"npm\",\n reason: \"RSA/ECDSA/DSA signing, JWT, and X.509 in pure JS.\",\n algorithms: [\"RSA\", \"ECDSA\", \"DSA\"],\n severity: \"high\",\n },\n {\n name: \"node-rsa\",\n ecosystem: \"npm\",\n reason: \"Classical RSA encryption and signing.\",\n algorithms: [\"RSA\"],\n severity: \"high\",\n },\n {\n name: \"ursa\",\n ecosystem: \"npm\",\n reason: \"OpenSSL-backed RSA encryption and signing bindings.\",\n algorithms: [\"RSA\"],\n severity: \"high\",\n },\n {\n name: \"sshpk\",\n ecosystem: \"npm\",\n reason: \"Parses/handles SSH and PEM keys (RSA, ECDSA, Ed25519, DSA).\",\n algorithms: [\"RSA\", \"ECDSA\", \"EdDSA\", \"DSA\"],\n severity: \"medium\",\n },\n {\n name: \"jsonwebtoken\",\n ecosystem: \"npm\",\n reason: \"JWTs commonly signed with RS256/ES256 (classical RSA/ECDSA).\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"high\",\n hndl: false,\n },\n {\n name: \"jose\",\n ecosystem: \"npm\",\n reason: \"JWS/JWE with classical RSA-OAEP, RSA-PSS, ECDH-ES and ECDSA.\",\n algorithms: [\"RSA\", \"ECDH\", \"ECDSA\", \"EdDSA\"],\n severity: \"high\",\n },\n {\n name: \"jws\",\n ecosystem: \"npm\",\n reason: \"JSON Web Signatures using classical RS/ES algorithms.\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"high\",\n hndl: false,\n },\n {\n name: \"eccrypto\",\n ecosystem: \"npm\",\n reason: \"ECIES (ECDH-based) encryption and ECDSA signatures.\",\n algorithms: [\"ECIES\", \"ECDH\", \"ECDSA\"],\n severity: \"high\",\n },\n {\n name: \"secp256k1\",\n ecosystem: \"npm\",\n reason: \"secp256k1 ECDSA/ECDH bindings (blockchain keys).\",\n algorithms: [\"ECDSA\", \"ECDH\"],\n severity: \"high\",\n },\n {\n name: \"tweetnacl\",\n ecosystem: \"npm\",\n reason: \"X25519 key exchange and Ed25519 signatures (modern but classical).\",\n algorithms: [\"X25519\", \"EdDSA\"],\n severity: \"low\",\n },\n {\n name: \"ed25519\",\n ecosystem: \"npm\",\n reason: \"Ed25519 signatures (classical).\",\n algorithms: [\"EdDSA\"],\n severity: \"low\",\n },\n {\n name: \"@noble/curves\",\n ecosystem: \"npm\",\n reason: \"Audited classical curves: ECDSA, ECDH, Ed25519, X25519, secp256k1.\",\n algorithms: [\"ECDSA\", \"ECDH\", \"EdDSA\", \"X25519\"],\n severity: \"medium\",\n },\n {\n name: \"@noble/secp256k1\",\n ecosystem: \"npm\",\n reason: \"secp256k1 ECDSA/ECDH (classical).\",\n algorithms: [\"ECDSA\", \"ECDH\"],\n severity: \"medium\",\n },\n {\n name: \"@noble/ed25519\",\n ecosystem: \"npm\",\n reason: \"Ed25519 signatures and X25519 key exchange (classical).\",\n algorithms: [\"EdDSA\", \"X25519\"],\n severity: \"low\",\n },\n {\n name: \"paseto\",\n ecosystem: \"npm\",\n reason: \"PASETO public tokens signed with classical Ed25519 (v2/v4) or RSA.\",\n algorithms: [\"EdDSA\", \"RSA\"],\n severity: \"medium\",\n hndl: false,\n },\n {\n name: \"bcrypto\",\n ecosystem: \"npm\",\n reason: \"Broad classical crypto suite: RSA, ECDSA, ECDH, Ed25519, DSA.\",\n algorithms: [\"RSA\", \"ECDSA\", \"ECDH\", \"EdDSA\", \"DSA\"],\n severity: \"high\",\n },\n {\n name: \"ecpair\",\n ecosystem: \"npm\",\n reason: \"secp256k1 ECDSA key pairs for Bitcoin.\",\n algorithms: [\"ECDSA\"],\n severity: \"medium\",\n },\n {\n name: \"keypair\",\n ecosystem: \"npm\",\n reason: \"Pure-JS RSA key pair generation.\",\n algorithms: [\"RSA\"],\n severity: \"high\",\n },\n {\n name: \"ethers\",\n ecosystem: \"npm\",\n reason: \"Ethereum library built on secp256k1 ECDSA signing and key derivation.\",\n algorithms: [\"ECDSA\"],\n severity: \"high\",\n },\n {\n name: \"web3\",\n ecosystem: \"npm\",\n reason: \"Ethereum library using secp256k1 ECDSA for accounts and signing.\",\n algorithms: [\"ECDSA\"],\n severity: \"high\",\n },\n {\n name: \"bitcoinjs-lib\",\n ecosystem: \"npm\",\n reason: \"Bitcoin library built on secp256k1 ECDSA/Schnorr keys and signatures.\",\n algorithms: [\"ECDSA\"],\n severity: \"high\",\n },\n {\n name: \"ethereumjs-util\",\n ecosystem: \"npm\",\n reason: \"secp256k1 ECDSA utilities for Ethereum keys and signatures.\",\n algorithms: [\"ECDSA\"],\n severity: \"medium\",\n },\n {\n name: \"openpgp\",\n ecosystem: \"npm\",\n reason: \"OpenPGP.js: RSA, ECDSA, ECDH, and EdDSA public-key crypto.\",\n algorithms: [\"RSA\", \"ECDSA\", \"ECDH\", \"EdDSA\"],\n severity: \"high\",\n },\n {\n name: \"node-jose\",\n ecosystem: \"npm\",\n reason: \"JOSE (JWS/JWE/JWK) with classical RSA and EC algorithms.\",\n algorithms: [\"RSA\", \"ECDSA\", \"ECDH\"],\n severity: \"high\",\n },\n {\n name: \"jwa\",\n ecosystem: \"npm\",\n reason: \"JSON Web Algorithms: RSA (RS/PS) and EC (ES) signatures.\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"medium\",\n hndl: false,\n },\n {\n name: \"jwk-to-pem\",\n ecosystem: \"npm\",\n reason: \"Converts RSA/EC JWKs to PEM — classical public keys.\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"medium\",\n },\n {\n name: \"fast-jwt\",\n ecosystem: \"npm\",\n reason: \"JWT signing/verification with classical RS/PS/ES algorithms.\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"medium\",\n hndl: false,\n },\n {\n name: \"ssh2\",\n ecosystem: \"npm\",\n reason: \"SSH client/server using classical RSA/ECDSA/Ed25519 host and user keys.\",\n algorithms: [\"RSA\", \"ECDSA\", \"EdDSA\"],\n severity: \"high\",\n },\n {\n name: \"@peculiar/x509\",\n ecosystem: \"npm\",\n reason: \"X.509 certificate library over classical RSA/EC keys.\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"medium\",\n },\n {\n name: \"pkijs\",\n ecosystem: \"npm\",\n reason: \"PKI (X.509/CMS) built on classical RSA and EC public-key crypto.\",\n algorithms: [\"RSA\", \"ECDSA\", \"ECDH\"],\n severity: \"medium\",\n },\n {\n name: \"http-signature\",\n ecosystem: \"npm\",\n reason: \"HTTP request signing with classical RSA/ECDSA keys.\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"medium\",\n hndl: false,\n },\n {\n name: \"libsodium-wrappers\",\n ecosystem: \"npm\",\n reason: \"libsodium: Ed25519 signatures and X25519 key exchange (classical).\",\n algorithms: [\"EdDSA\", \"X25519\"],\n severity: \"medium\",\n },\n {\n name: \"ecdsa-sig-formatter\",\n ecosystem: \"npm\",\n reason: \"Formats ECDSA signatures — a marker of classical EC signing.\",\n algorithms: [\"ECDSA\"],\n severity: \"low\",\n },\n\n // --- PyPI (Python) ---\n {\n name: \"pycryptodome\",\n ecosystem: \"pypi\",\n reason: \"RSA / ECC / DSA public-key crypto for Python.\",\n algorithms: [\"RSA\", \"ECDSA\", \"DSA\"],\n severity: \"high\",\n },\n {\n name: \"pycrypto\",\n ecosystem: \"pypi\",\n reason: \"Abandoned/unmaintained crypto library — classical RSA/DSA/ElGamal.\",\n algorithms: [\"RSA\", \"DSA\"],\n severity: \"high\",\n },\n {\n name: \"jwcrypto\",\n ecosystem: \"pypi\",\n reason: \"JWK / JWS / JWE with classical RS*/ES* and ECDH-ES key agreement.\",\n algorithms: [\"RSA\", \"ECDSA\", \"ECDH\"],\n severity: \"medium\",\n },\n {\n name: \"authlib\",\n ecosystem: \"pypi\",\n reason: \"OAuth / OIDC / JOSE stack using classical RS*/ES* JWT signing.\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"medium\",\n hndl: false,\n },\n {\n name: \"pycryptodomex\",\n ecosystem: \"pypi\",\n reason: \"RSA / ECC / DSA public-key crypto (the `Cryptodome` namespace).\",\n algorithms: [\"RSA\", \"ECDSA\", \"DSA\"],\n severity: \"high\",\n },\n {\n name: \"rsa\",\n ecosystem: \"pypi\",\n reason: \"Pure-Python RSA encryption and signing.\",\n algorithms: [\"RSA\"],\n severity: \"high\",\n },\n {\n name: \"ecdsa\",\n ecosystem: \"pypi\",\n reason: \"Pure-Python ECDSA/ECDH over NIST + secp256k1 curves.\",\n algorithms: [\"ECDSA\", \"ECDH\"],\n severity: \"high\",\n },\n {\n name: \"cryptography\",\n ecosystem: \"pypi\",\n reason: \"General crypto library exposing classical RSA/EC/DH/DSA (also symmetric/PQC).\",\n algorithms: [\"RSA\", \"ECDH\", \"ECDSA\", \"DSA\"],\n severity: \"medium\",\n },\n {\n name: \"pyjwt\",\n ecosystem: \"pypi\",\n reason: \"JWT signing with classical RS*/ES* algorithms.\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"medium\",\n hndl: false,\n },\n {\n name: \"python-jose\",\n ecosystem: \"pypi\",\n reason: \"JOSE/JWT with classical RSA/ECDSA algorithms.\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"medium\",\n },\n {\n name: \"paramiko\",\n ecosystem: \"pypi\",\n reason: \"SSH client/server with classical RSA/ECDSA/Ed25519/DSA host + user keys.\",\n algorithms: [\"RSA\", \"ECDSA\", \"EdDSA\", \"DSA\"],\n severity: \"medium\",\n },\n {\n name: \"pyopenssl\",\n ecosystem: \"pypi\",\n reason: \"OpenSSL bindings for classical RSA/EC X.509 + TLS.\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"medium\",\n },\n {\n name: \"pynacl\",\n ecosystem: \"pypi\",\n reason:\n \"libsodium bindings — X25519 key agreement and Ed25519 signatures (modern but classical).\",\n algorithms: [\"X25519\", \"EdDSA\"],\n severity: \"low\",\n },\n {\n name: \"tink\",\n ecosystem: \"pypi\",\n reason:\n \"Google Tink (Python) — classical RSA/ECDSA/Ed25519 signatures and ECIES hybrid encryption.\",\n algorithms: [\"RSA\", \"ECDSA\", \"EdDSA\", \"ECIES\"],\n severity: \"high\",\n },\n\n // --- crates.io (Rust) ---\n {\n name: \"rsa\",\n ecosystem: \"cargo\",\n reason: \"Pure-Rust RSA encryption and signing.\",\n algorithms: [\"RSA\"],\n severity: \"high\",\n },\n {\n name: \"ring\",\n ecosystem: \"cargo\",\n reason: \"RSA / ECDSA / Ed25519 / ECDH primitives.\",\n algorithms: [\"RSA\", \"ECDSA\", \"EdDSA\", \"ECDH\"],\n severity: \"medium\",\n },\n {\n name: \"openssl\",\n ecosystem: \"cargo\",\n reason: \"OpenSSL bindings for classical RSA/EC crypto.\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"medium\",\n },\n {\n name: \"p256\",\n ecosystem: \"cargo\",\n reason: \"NIST P-256 ECDSA signatures and ECDH key agreement.\",\n algorithms: [\"ECDSA\", \"ECDH\"],\n severity: \"high\",\n },\n {\n name: \"p384\",\n ecosystem: \"cargo\",\n reason: \"NIST P-384 ECDSA signatures and ECDH key agreement.\",\n algorithms: [\"ECDSA\", \"ECDH\"],\n severity: \"high\",\n },\n {\n name: \"k256\",\n ecosystem: \"cargo\",\n reason: \"secp256k1 ECDSA signatures and ECDH key agreement.\",\n algorithms: [\"ECDSA\", \"ECDH\"],\n severity: \"high\",\n },\n {\n name: \"secp256k1\",\n ecosystem: \"cargo\",\n reason: \"libsecp256k1 bindings (blockchain) — classical ECDSA + ECDH.\",\n algorithms: [\"ECDSA\", \"ECDH\"],\n severity: \"high\",\n },\n {\n name: \"ed25519-dalek\",\n ecosystem: \"cargo\",\n reason: \"Ed25519 signatures (modern but classical).\",\n algorithms: [\"EdDSA\"],\n severity: \"low\",\n },\n {\n name: \"x25519-dalek\",\n ecosystem: \"cargo\",\n reason: \"X25519 key agreement (modern but classical).\",\n algorithms: [\"X25519\"],\n severity: \"low\",\n },\n\n // --- Go modules ---\n {\n name: \"golang.org/x/crypto\",\n ecosystem: \"go\",\n reason: \"SSH, OpenPGP, and classical curve helpers on top of the Go stdlib.\",\n algorithms: [\"RSA\", \"ECDSA\", \"EdDSA\", \"ECDH\"],\n severity: \"medium\",\n },\n {\n name: \"github.com/golang-jwt/jwt/v5\",\n ecosystem: \"go\",\n reason: \"golang-jwt — classical RS*/PS*/ES* JWT algorithms.\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"medium\",\n hndl: false,\n },\n {\n name: \"github.com/golang-jwt/jwt/v4\",\n ecosystem: \"go\",\n reason: \"golang-jwt (v4) — classical RS*/PS*/ES* JWT algorithms.\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"medium\",\n hndl: false,\n },\n {\n name: \"github.com/go-jose/go-jose/v4\",\n ecosystem: \"go\",\n reason: \"go-jose — classical JOSE (RSA/ECDSA signatures, ECDH-ES key agreement).\",\n algorithms: [\"RSA\", \"ECDSA\", \"ECDH\"],\n severity: \"medium\",\n },\n {\n name: \"github.com/cloudflare/circl\",\n ecosystem: \"go\",\n reason:\n \"Cloudflare CIRCL — classical ECDH/EdDSA curves (X25519, X448, Ed25519, P-256); also ships PQC (ML-KEM/ML-DSA + hybrids), so migrate the classical *usage*, not the package.\",\n algorithms: [\"ECDH\", \"EdDSA\"],\n severity: \"medium\",\n },\n {\n name: \"github.com/decred/dcrd/dcrec/secp256k1/v4\",\n ecosystem: \"go\",\n reason: \"decred secp256k1 — classical ECDSA/ECDH on the secp256k1 curve (blockchain keys).\",\n algorithms: [\"ECDSA\", \"ECDH\"],\n severity: \"medium\",\n },\n {\n name: \"github.com/tink-crypto/tink-go/v2\",\n ecosystem: \"go\",\n reason:\n \"Google Tink (Go) — classical RSA/ECDSA/Ed25519 signatures and ECIES hybrid encryption.\",\n algorithms: [\"RSA\", \"ECDSA\", \"EdDSA\", \"ECIES\"],\n severity: \"high\",\n },\n {\n name: \"github.com/google/tink/go\",\n ecosystem: \"go\",\n reason: \"Google Tink (legacy Go module) — classical RSA/ECDSA/Ed25519 and ECIES hybrid.\",\n algorithms: [\"RSA\", \"ECDSA\", \"EdDSA\", \"ECIES\"],\n severity: \"high\",\n },\n\n // --- Maven (Java) ---\n {\n name: \"bcprov-jdk18on\",\n ecosystem: \"maven\",\n reason: \"BouncyCastle provider — full classical RSA/ECDSA/ECDH/DSA suite.\",\n algorithms: [\"RSA\", \"ECDSA\", \"ECDH\", \"DSA\"],\n severity: \"high\",\n },\n {\n name: \"bcprov-jdk15on\",\n ecosystem: \"maven\",\n reason: \"BouncyCastle provider (JDK 1.5+) — classical RSA/ECDSA/ECDH/DSA.\",\n algorithms: [\"RSA\", \"ECDSA\", \"ECDH\", \"DSA\"],\n severity: \"high\",\n },\n {\n name: \"bcpkix-jdk18on\",\n ecosystem: \"maven\",\n reason: \"BouncyCastle PKIX — classical X.509 / CMS with RSA/ECDSA.\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"medium\",\n },\n {\n name: \"java-jwt\",\n ecosystem: \"maven\",\n reason: \"Auth0 JWT with classical RS*/ES* algorithms.\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"medium\",\n hndl: false,\n },\n {\n name: \"nimbus-jose-jwt\",\n ecosystem: \"maven\",\n reason: \"Nimbus JOSE+JWT — classical RS*/PS*/ES* JWS and RSA/ECDH-ES JWE.\",\n algorithms: [\"RSA\", \"ECDSA\", \"ECDH\"],\n severity: \"medium\",\n },\n {\n name: \"jjwt-api\",\n ecosystem: \"maven\",\n reason: \"JJWT (io.jsonwebtoken) — classical RS*/ES* JWT signing.\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"medium\",\n hndl: false,\n },\n {\n name: \"tink\",\n ecosystem: \"maven\",\n reason:\n \"Google Tink (com.google.crypto.tink) — classical RSA/ECDSA/Ed25519 signatures and ECIES hybrid encryption.\",\n algorithms: [\"RSA\", \"ECDSA\", \"EdDSA\", \"ECIES\"],\n severity: \"high\",\n },\n\n // --- RubyGems ---\n {\n name: \"jwt\",\n ecosystem: \"rubygems\",\n reason: \"Ruby JWT with classical RS*/ES* algorithms.\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"medium\",\n hndl: false,\n },\n {\n name: \"net-ssh\",\n ecosystem: \"rubygems\",\n reason:\n \"Ruby SSH client — classical host/user keys (RSA/ECDSA/Ed25519) and ECDH/DH key exchange.\",\n algorithms: [\"RSA\", \"ECDSA\", \"ECDH\"],\n severity: \"medium\",\n },\n {\n name: \"rbnacl\",\n ecosystem: \"rubygems\",\n reason: \"libsodium bindings — X25519 key agreement and Ed25519 signatures.\",\n algorithms: [\"X25519\", \"EdDSA\"],\n severity: \"low\",\n },\n {\n name: \"ed25519\",\n ecosystem: \"rubygems\",\n reason: \"Ed25519 signatures (modern but classical).\",\n algorithms: [\"EdDSA\"],\n severity: \"low\",\n },\n\n // --- NuGet (.NET) ---\n {\n name: \"BouncyCastle.Cryptography\",\n ecosystem: \"nuget\",\n reason: \"BouncyCastle for .NET — full classical RSA/ECDSA/ECDH/DSA suite.\",\n algorithms: [\"RSA\", \"ECDSA\", \"ECDH\", \"DSA\"],\n severity: \"high\",\n },\n {\n name: \"Portable.BouncyCastle\",\n ecosystem: \"nuget\",\n reason: \"Portable BouncyCastle for .NET — classical RSA/ECDSA/ECDH/DSA.\",\n algorithms: [\"RSA\", \"ECDSA\", \"ECDH\", \"DSA\"],\n severity: \"high\",\n },\n {\n name: \"System.IdentityModel.Tokens.Jwt\",\n ecosystem: \"nuget\",\n reason: \"Microsoft JWT handler — classical RS*/ES* (RSA/ECDSA) signatures.\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"medium\",\n hndl: false,\n },\n {\n name: \"Microsoft.IdentityModel.Tokens\",\n ecosystem: \"nuget\",\n reason: \"Microsoft IdentityModel token crypto — classical RSA/ECDSA keys.\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"medium\",\n hndl: false,\n },\n\n // --- Composer (PHP) ---\n {\n name: \"phpseclib/phpseclib\",\n ecosystem: \"composer\",\n reason: \"Pure-PHP RSA / DSA / ECDSA / Diffie-Hellman public-key crypto and X.509.\",\n algorithms: [\"RSA\", \"DSA\", \"ECDSA\", \"DH\"],\n severity: \"high\",\n },\n {\n name: \"paragonie/sodium_compat\",\n ecosystem: \"composer\",\n reason: \"Pure-PHP libsodium polyfill: X25519 key agreement and Ed25519 signatures.\",\n algorithms: [\"X25519\", \"EdDSA\"],\n severity: \"low\",\n },\n {\n name: \"paragonie/halite\",\n ecosystem: \"composer\",\n reason: \"libsodium wrapper: X25519 key agreement and Ed25519 signatures.\",\n algorithms: [\"X25519\", \"EdDSA\"],\n severity: \"low\",\n },\n {\n name: \"paragonie/paseto\",\n ecosystem: \"composer\",\n reason: \"PASETO public tokens signed with classical Ed25519 (v2/v4) or RSA.\",\n algorithms: [\"EdDSA\", \"RSA\"],\n severity: \"medium\",\n hndl: false,\n },\n {\n name: \"firebase/php-jwt\",\n ecosystem: \"composer\",\n reason: \"PHP JWT signing/verification with classical RS*/ES* algorithms.\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"medium\",\n hndl: false,\n },\n {\n name: \"lcobucci/jwt\",\n ecosystem: \"composer\",\n reason: \"PHP JWT with classical RSA/ECDSA signature algorithms.\",\n algorithms: [\"RSA\", \"ECDSA\"],\n severity: \"medium\",\n hndl: false,\n },\n {\n name: \"web-token/jwt-framework\",\n ecosystem: \"composer\",\n reason: \"JOSE (JWS/JWE) framework: classical RSA/ECDSA signatures and ECDH-ES key agreement.\",\n algorithms: [\"RSA\", \"ECDSA\", \"ECDH\"],\n severity: \"medium\",\n },\n {\n name: \"mdanter/ecc\",\n ecosystem: \"composer\",\n reason: \"Pure-PHP elliptic-curve ECDSA signatures and ECDH key agreement.\",\n algorithms: [\"ECDSA\", \"ECDH\"],\n severity: \"high\",\n },\n {\n name: \"simplito/elliptic-php\",\n ecosystem: \"composer\",\n reason: \"secp256k1 / NIST-curve ECDSA and ECDH in pure PHP (blockchain keys).\",\n algorithms: [\"ECDSA\", \"ECDH\"],\n severity: \"high\",\n },\n];\n\n/**\n * Normalise a package name for matching within its ecosystem. PyPI is\n * case-insensitive and folds runs of `-_.` to a single `-` (PEP 503); cargo /\n * maven / rubygems / nuget / composer are effectively lower-case (NuGet ids are\n * matched case-insensitively; Composer `vendor/package` names are lower-cased by\n * Packagist); npm and go module paths are matched verbatim (npm scopes and go\n * paths are case-sensitive).\n */\nfunction normalizeName(ecosystem: DependencyEcosystem, name: string): string {\n const n = name.trim();\n if (ecosystem === \"pypi\") return n.toLowerCase().replace(/[-_.]+/g, \"-\");\n if (ecosystem === \"npm\" || ecosystem === \"go\") return n;\n return n.toLowerCase();\n}\n\n/** ecosystem → (normalised name → entry). Scoped so `rsa` (pypi) ≠ `rsa` (cargo). */\nconst BY_ECOSYSTEM: Map<DependencyEcosystem, Map<string, VulnerableDependency>> = (() => {\n const m = new Map<DependencyEcosystem, Map<string, VulnerableDependency>>();\n for (const d of vulnerableDependencies) {\n let em = m.get(d.ecosystem);\n if (!em) {\n em = new Map();\n m.set(d.ecosystem, em);\n }\n em.set(normalizeName(d.ecosystem, d.name), d);\n }\n return m;\n})();\n\n/**\n * Precompiled `\"name\":` lookup regex per known npm package (P1-9): the set is\n * static, so build the (name → RegExp) map once rather than per manifest. Only\n * npm uses the JSON-key form; other ecosystems locate names generically.\n */\nconst KEY_REGEX_BY_NAME = new Map<string, RegExp>(\n vulnerableDependencies\n .filter((d) => d.ecosystem === \"npm\")\n .map((d): [string, RegExp] => {\n const escaped = d.name.replace(/[.*+?^${}()|[\\]\\\\/]/g, \"\\\\$&\");\n return [d.name, new RegExp(`\"${escaped}\"\\\\s*:`)];\n }),\n);\n\n/**\n * Build a remediation string covering ALL families a package exposes (C5),\n * rather than only `algorithms[0]`. De-duplicates by PQC *target* — the KEM\n * target and the signature target are each named at most once — so a library\n * exposing both a confidentiality family and a signature family reads\n * \"ML-KEM-768 … for key exchange/encryption; ML-DSA-65 (FIPS 204) for\n * signatures\" instead of repeating ML-DSA (the old per-string Set couldn't\n * collapse \"ML-DSA-65 for signatures\" against a standalone \"ML-DSA-65 (FIPS 204)\").\n */\nfunction multiFamilyRemediation(algorithms: readonly AlgorithmFamily[]): string {\n let needsKem = false;\n let needsSig = false;\n let needsReview = false;\n for (const a of algorithms) {\n if (isConfidentialityFamily(a)) needsKem = true;\n if (isSignatureFamily(a)) needsSig = true;\n if (a === \"unknown\") needsReview = true;\n }\n const parts: string[] = [];\n if (needsKem)\n parts.push(\"ML-KEM-768 (FIPS 203, hybrid X25519MLKEM768) for key exchange/encryption\");\n if (needsSig) parts.push(\"ML-DSA-65 (FIPS 204) for signatures\");\n // Only fall back to the generic \"review\" line when nothing concrete applied.\n if (needsReview && parts.length === 0) parts.push(remediationText(\"unknown\"));\n return parts.join(\"; \");\n}\n\n/**\n * The dependency ecosystem a manifest filename belongs to, or null when the file\n * is not a manifest we parse. Drives both {@link isManifestFile} and the scanner\n * dispatch — one place to add a manifest format.\n */\nexport function manifestEcosystem(file: string): DependencyEcosystem | null {\n const base = (file.split(\"/\").pop() ?? file).toLowerCase();\n if (\n base === \"package.json\" ||\n base === \"package-lock.json\" ||\n base === \"npm-shrinkwrap.json\" ||\n base === \"yarn.lock\" ||\n base === \"pnpm-lock.yaml\"\n ) {\n return \"npm\";\n }\n if (base === \"requirements.txt\" || /^requirements[\\w.-]*\\.txt$/.test(base)) return \"pypi\";\n if (base === \"pyproject.toml\" || base === \"pipfile\") return \"pypi\";\n if (base === \"cargo.toml\") return \"cargo\";\n if (base === \"go.mod\") return \"go\";\n if (base === \"pom.xml\" || base === \"build.gradle\" || base === \"build.gradle.kts\") return \"maven\";\n if (base === \"gemfile\" || base.endsWith(\".gemspec\")) return \"rubygems\";\n if (base === \"packages.config\" || base === \"directory.packages.props\" || base.endsWith(\".csproj\"))\n return \"nuget\";\n if (base === \"composer.json\" || base === \"composer.lock\") return \"composer\";\n return null;\n}\n\n/** True if a file path looks like a manifest we can parse for dependencies. */\nexport function isManifestFile(file: string): boolean {\n return manifestEcosystem(file) !== null;\n}\n\n/**\n * Extract candidate package names from a non-npm manifest. Extraction is\n * deliberately GENEROUS — every finding still has to match a curated DB entry,\n * so over-extracting harmless tokens (e.g. a TOML `version = …` key) costs\n * nothing while keeping the parsers tiny and format-tolerant.\n */\nfunction candidateNames(ecosystem: DependencyEcosystem, content: string): string[] {\n const names: string[] = [];\n const lines = content.split(\"\\n\");\n switch (ecosystem) {\n case \"pypi\": {\n // requirements.txt / Pipfile / pyproject.toml: leading token per line, plus\n // quoted deps in arrays/tables. Skip comments and `-r/-e/--flag` lines.\n for (const raw of lines) {\n const line = raw.trim();\n if (!line || line.startsWith(\"#\") || line.startsWith(\"-\")) continue;\n const lead = /^[\"']?([A-Za-z][A-Za-z0-9._-]+)/.exec(line);\n if (lead) names.push(lead[1]);\n for (const m of line.matchAll(/[\"']([A-Za-z][A-Za-z0-9._-]+)/g)) names.push(m[1]);\n }\n break;\n }\n case \"cargo\": {\n // Cargo.toml: dependency-table keys `name = …` and `[…dependencies.name]`.\n for (const raw of lines) {\n const line = raw.trim();\n if (!line || line.startsWith(\"#\")) continue;\n const key = /^([A-Za-z0-9][A-Za-z0-9_-]+)\\s*=/.exec(line);\n if (key) names.push(key[1]);\n const table = /^\\[[\\w.-]*dependencies\\.([A-Za-z0-9][A-Za-z0-9_-]+)\\]/.exec(line);\n if (table) names.push(table[1]);\n }\n break;\n }\n case \"go\": {\n // go.mod: `require path v1.2.3` (single or in a require( … ) block).\n for (const m of content.matchAll(/(?:^|\\s)([a-z0-9][\\w.\\-/]+)\\s+v\\d/gm)) names.push(m[1]);\n break;\n }\n case \"maven\": {\n // pom.xml <artifactId> tags + gradle `group:artifact:version` strings.\n for (const m of content.matchAll(/<artifactId>\\s*([\\w.-]+)\\s*<\\/artifactId>/g)) {\n names.push(m[1]);\n }\n for (const m of content.matchAll(/[\"']([\\w.-]+):([\\w.-]+):[\\w.$-]+[\"']/g)) names.push(m[2]);\n break;\n }\n case \"rubygems\": {\n // Gemfile `gem 'name'` + gemspec `add_*dependency 'name'`.\n for (const m of content.matchAll(/\\bgem\\s+[\"']([\\w.-]+)[\"']/g)) names.push(m[1]);\n for (const m of content.matchAll(\n /add(?:_runtime|_development)?_dependency\\s+[\"']([\\w.-]+)[\"']/g,\n )) {\n names.push(m[1]);\n }\n break;\n }\n case \"nuget\": {\n // NuGet manifests are XML. `.csproj` / `Directory.Packages.props` declare\n // `<PackageReference Include=\"Name\" … />`; `packages.config` uses\n // `<package id=\"Name\" … />`. Pull the Include= / id= attribute value from\n // each. The `[^>]` guard keeps every match inside a single tag, so the\n // scan is linear (no nested quantifiers → no catastrophic backtracking).\n for (const m of content.matchAll(/<PackageReference\\b[^>]*\\bInclude\\s*=\\s*\"([^\"]+)\"/gi)) {\n names.push(m[1]);\n }\n for (const m of content.matchAll(/<package\\b[^>]*\\bid\\s*=\\s*\"([^\"]+)\"/gi)) {\n names.push(m[1]);\n }\n break;\n }\n case \"composer\": {\n // composer.json `require`/`require-dev` maps are keyed by \"vendor/package\";\n // composer.lock lists `{\"name\": \"vendor/package\", …}`. Both are JSON, so\n // grab every quoted `vendor/package` token (a lower-case vendor + package\n // separated by a single `/`). PHP platform requirements (\"php\", \"ext-*\")\n // carry no slash and so are naturally excluded; the curated DB filters the\n // rest, so over-capture is safe.\n for (const m of content.matchAll(\n /[\"']([a-z0-9](?:[a-z0-9._-]*[a-z0-9])?\\/[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?)[\"']/gi,\n )) {\n names.push(m[1]);\n }\n break;\n }\n case \"npm\":\n break; // npm uses the JSON path, not this extractor.\n }\n return names;\n}\n\n/** First offset of a package `name` as a whole token in the manifest text (or 0). */\nfunction offsetOfName(content: string, name: string): number {\n const escaped = name.replace(/[.*+?^${}()|[\\]\\\\/]/g, \"\\\\$&\");\n const m = new RegExp(`(?<![\\\\w./-])${escaped}(?![\\\\w-])`).exec(content);\n return m ? m.index : 0;\n}\n\n/**\n * Build a finding for a vulnerable dependency located in a manifest. The\n * location points at the line where the package name appears in the file (best\n * effort), falling back to line 1.\n */\nfunction dependencyFinding(\n dep: VulnerableDependency,\n file: string,\n content: string,\n index: number,\n): Finding {\n // Use the first listed algorithm for the headline family, but derive the\n // remediation from ALL families the package exposes (C5).\n const algorithm = dep.algorithms[0] ?? \"unknown\";\n return makeFinding({\n ruleId: \"dep-vulnerable\",\n title: `Quantum-vulnerable dependency: ${dep.name}`,\n category: \"dependency\",\n severity: dep.severity,\n confidence: \"high\",\n algorithm,\n // Confidentiality libs are HNDL-exposed; signature-only ones are not. An\n // explicit `dep.hndl` wins (some packages list RSA/EC as a family but only\n // ever sign — e.g. JWS/JWT libs — and signatures are not HNDL-exposed).\n hndl: dep.hndl ?? dep.algorithms.some(isConfidentialityFamily),\n cwe: CWE_BROKEN_CRYPTO,\n message: `${dep.name} — ${dep.reason}`,\n remediation: multiFamilyRemediation(dep.algorithms),\n file,\n content,\n index,\n });\n}\n\n/** Locate the offset of a JSON key `\"name\"` in the manifest text (or 0). */\nfunction offsetOfKey(content: string, name: string): number {\n // Use the precompiled per-name regex (non-global; .exec from position 0).\n const re = KEY_REGEX_BY_NAME.get(name);\n if (!re) return 0;\n const m = re.exec(content);\n return m ? m.index : 0;\n}\n\n/** Sort findings by title for deterministic output. */\nfunction sortByTitle(findings: Finding[]): Finding[] {\n findings.sort((a, b) => (a.title < b.title ? -1 : a.title > b.title ? 1 : 0));\n return findings;\n}\n\n/**\n * Scan a single manifest file for vulnerable dependencies, dispatching by the\n * file's ecosystem ({@link manifestEcosystem}). npm manifests are parsed as\n * JSON; every other ecosystem uses the generous {@link candidateNames} extractor\n * filtered against the ecosystem-scoped database. Returns one finding per\n * distinct vulnerable package.\n */\nexport function scanManifest(file: string, content: string): Finding[] {\n const ecosystem = manifestEcosystem(file);\n if (!ecosystem) return [];\n const db = BY_ECOSYSTEM.get(ecosystem);\n if (!db) return [];\n\n if (ecosystem === \"npm\") {\n const base = (file.split(\"/\").pop() ?? file).toLowerCase();\n // yarn.lock / pnpm-lock.yaml are not JSON — extract names from their text.\n if (base === \"yarn.lock\" || base === \"pnpm-lock.yaml\") {\n return scanNpmLockfile(content, file, db);\n }\n return scanNpmManifest(content, file, db);\n }\n\n const found = new Map<string, VulnerableDependency>(); // dedupe by entry\n for (const raw of candidateNames(ecosystem, content)) {\n const dep = db.get(normalizeName(ecosystem, raw));\n if (dep) found.set(dep.name, dep);\n }\n const findings: Finding[] = [];\n for (const dep of found.values()) {\n findings.push(dependencyFinding(dep, file, content, offsetOfName(content, dep.name)));\n }\n return sortByTitle(findings);\n}\n\n/**\n * Resolve an npm `npm:` alias spec to the real package it installs, or null when\n * the spec is not an alias. An aliased dependency records the alias as the map\n * KEY and `npm:<real-name>@<range>` as the VALUE (in package.json and in a\n * lockfile entry's `version`), so the vulnerable package hides behind a benign\n * alias name. Keeps a leading scope `@` (only a version `@` past index 0 is a\n * separator): `npm:node-forge@^1` → `node-forge`, `npm:@scope/pkg@1` → `@scope/pkg`.\n */\nfunction npmAliasTarget(spec: string): string | null {\n if (!spec.startsWith(\"npm:\")) return null;\n const rest = spec.slice(4);\n const at = rest.lastIndexOf(\"@\");\n const name = at > 0 ? rest.slice(0, at) : rest;\n return name || null;\n}\n\n/** Guard against a pathological / hostile lockfile nesting the walk unbounded. */\nconst NPM_TREE_MAX_DEPTH = 64;\n\n/**\n * npm manifest scan.\n * - `package.json`: dependencies / devDependencies / peerDependencies / optionalDependencies,\n * including `npm:`-aliased entries (the alias key hides the real package name).\n * - `package-lock.json` v1: the NESTED `dependencies` tree, where each entry may carry\n * its own `dependencies` (transitive deps) and an `npm:` alias in `version`.\n * - `package-lock.json` v2/v3: the flat `packages` map keys (node_modules/<name>),\n * plus each entry's own `name` field (set for aliased installs).\n */\nfunction scanNpmManifest(\n content: string,\n file: string,\n db: Map<string, VulnerableDependency>,\n): Finding[] {\n let json: unknown;\n try {\n json = JSON.parse(content);\n } catch {\n return []; // not valid JSON — skip quietly.\n }\n if (json === null || typeof json !== \"object\") return [];\n\n const found = new Set<string>();\n const obj = json as Record<string, unknown>;\n\n const add = (name: string): void => {\n if (db.has(name)) found.add(name);\n };\n\n /**\n * Walk a dependency map that may be either a flat package.json map\n * (name → version-range string) or a legacy package-lock v1 tree (name →\n * `{ version, requires, dependencies }`, arbitrarily nested). Matches keys,\n * resolves `npm:` aliases from string values and entry `version` fields, and\n * recurses into a nested `dependencies` sub-tree.\n */\n const walkDepTree = (deps: unknown, depth: number): void => {\n if (depth > NPM_TREE_MAX_DEPTH || deps === null || typeof deps !== \"object\") return;\n for (const [name, node] of Object.entries(deps as Record<string, unknown>)) {\n add(name);\n if (typeof node === \"string\") {\n // package.json form: the value is a range, possibly `npm:<real>@<range>`.\n const aliased = npmAliasTarget(node);\n if (aliased) add(aliased);\n } else if (node !== null && typeof node === \"object\") {\n const rec = node as Record<string, unknown>;\n if (typeof rec.version === \"string\") {\n const aliased = npmAliasTarget(rec.version);\n if (aliased) add(aliased);\n }\n walkDepTree(rec.dependencies, depth + 1); // v1 nests transitive deps here\n }\n }\n };\n\n walkDepTree(obj.dependencies, 0);\n walkDepTree(obj.devDependencies, 0);\n walkDepTree(obj.peerDependencies, 0);\n walkDepTree(obj.optionalDependencies, 0);\n\n const packages = obj.packages;\n if (packages !== null && typeof packages === \"object\") {\n for (const [key, entry] of Object.entries(packages as Record<string, unknown>)) {\n if (!key) continue; // root package entry\n const marker = \"node_modules/\";\n const idx = key.lastIndexOf(marker);\n add(idx >= 0 ? key.slice(idx + marker.length) : key);\n // Aliased install: the entry's own `name` field is the real package, which\n // differs from the alias embedded in the node_modules/<alias> key.\n if (entry !== null && typeof entry === \"object\") {\n const realName = (entry as Record<string, unknown>).name;\n if (typeof realName === \"string\") add(realName);\n }\n }\n }\n\n const findings: Finding[] = [];\n for (const name of found) {\n const dep = db.get(name);\n if (!dep) continue;\n findings.push(dependencyFinding(dep, file, content, offsetOfKey(content, name)));\n }\n return sortByTitle(findings);\n}\n\n/**\n * Extract candidate package names from a yarn.lock / pnpm-lock.yaml text body.\n * Generous — every `name@…` (and pnpm's `/name/version`) token is captured; the\n * caller filters against the vulnerable-dependency DB, so over-capture is safe.\n * Handles yarn v1 (`elliptic@^6.5.4:`), yarn berry (`\"elliptic@npm:^6.5.4\":`),\n * and pnpm (`/elliptic@6.5.4:`, scoped `/@noble/curves@1.2.0:`).\n */\nfunction npmLockfileCandidates(content: string): string[] {\n const names = new Set<string>();\n const at = /(?:^|[\\s,\"'/])((?:@[a-z0-9._-]+\\/)?[a-z0-9][a-z0-9._-]*)@/gm;\n let m: RegExpExecArray | null;\n while ((m = at.exec(content)) !== null) names.add(m[1].toLowerCase());\n // pnpm's older `/name/version` form (name followed by a version digit).\n const slash = /(?:^|\\s)\\/((?:@[a-z0-9._-]+\\/)?[a-z0-9][a-z0-9._-]*)\\/\\d/gm;\n while ((m = slash.exec(content)) !== null) names.add(m[1].toLowerCase());\n return [...names];\n}\n\n/**\n * npm lockfile scan (yarn.lock / pnpm-lock.yaml): match every package token in\n * the lockfile text against the vulnerable-dependency DB. Catches transitive\n * dependencies that never appear in package.json.\n */\nfunction scanNpmLockfile(\n content: string,\n file: string,\n db: Map<string, VulnerableDependency>,\n): Finding[] {\n const found = new Map<string, VulnerableDependency>();\n for (const name of npmLockfileCandidates(content)) {\n const dep = db.get(name);\n if (dep) found.set(dep.name, dep);\n }\n const findings: Finding[] = [];\n for (const dep of found.values()) {\n findings.push(dependencyFinding(dep, file, content, offsetOfName(content, dep.name)));\n }\n return sortByTitle(findings);\n}\n"]}
@@ -4,21 +4,8 @@
4
4
  * small factory for building Finding objects with consistent remediation text.
5
5
  */
6
6
  import type { AlgorithmFamily, Confidence, Finding, FindingCategory, RuleMeta, Severity } from "./types.js";
7
- /** A 1-based line/column position derived from a character offset. */
8
- export interface LineCol {
9
- line: number;
10
- column: number;
11
- }
12
- /**
13
- * Convert a 0-based character offset within `content` into a 1-based
14
- * line/column. Newlines are LF; CR is treated as an ordinary character, so on
15
- * CRLF files the column includes the trailing CR offset harmlessly.
16
- */
17
- export declare function offsetToLineCol(content: string, offset: number): LineCol;
18
- /** Extract the (trimmed) single source line containing `offset`. */
19
- export declare function lineAt(content: string, offset: number): string;
20
7
  /** Inputs for {@link makeFinding}. */
21
- export interface FindingSpec {
8
+ interface FindingSpec {
22
9
  ruleId: string;
23
10
  title: string;
24
11
  category: FindingCategory;
@@ -47,7 +34,7 @@ export interface FindingSpec {
47
34
  */
48
35
  export declare function makeFinding(spec: FindingSpec): Finding;
49
36
  /** Where a match occurred, plus optional per-finding field overrides. */
50
- export interface RuleMatch {
37
+ interface RuleMatch {
51
38
  file: string;
52
39
  content: string;
53
40
  /** Match start offset within `content`. */
@@ -60,7 +47,7 @@ export interface RuleMatch {
60
47
  * rules (e.g. key generation across algorithm families) override these; fixed
61
48
  * rules pass none and inherit the catalog metadata verbatim.
62
49
  */
63
- export type RuleOverrides = Partial<Pick<RuleMeta, "title" | "category" | "severity" | "confidence" | "algorithm" | "hndl" | "message" | "cwe">> & {
50
+ type RuleOverrides = Partial<Pick<RuleMeta, "title" | "category" | "severity" | "confidence" | "algorithm" | "hndl" | "message" | "cwe">> & {
64
51
  remediation?: string;
65
52
  };
66
53
  /**
@@ -97,6 +84,14 @@ export declare const ELIXIR_EXTENSIONS: readonly string[];
97
84
  export declare const PHP_EXTENSIONS: readonly string[];
98
85
  /** C / C++ source extensions handled by the OpenSSL detector. */
99
86
  export declare const C_EXTENSIONS: readonly string[];
87
+ /** Swift source extensions handled by the CryptoKit / Security-framework detector. */
88
+ export declare const SWIFT_EXTENSIONS: readonly string[];
89
+ /** Objective-C implementation extensions (`.h` is owned by the C pack). */
90
+ export declare const OBJC_EXTENSIONS: readonly string[];
91
+ /** Dart / Flutter source extensions. */
92
+ export declare const DART_EXTENSIONS: readonly string[];
93
+ /** Smart-contract source extensions (Solidity/EVM, Move, Cairo/Starknet). */
94
+ export declare const SMART_CONTRACT_EXTENSIONS: readonly string[];
100
95
  /**
101
96
  * Prose/documentation extensions. The language-agnostic *token* detectors (SSH
102
97
  * public keys, TLS cipher suites, certificate signature algorithms) must not run
@@ -130,14 +125,17 @@ export declare const ANALYZABLE_SOURCE_EXTENSIONS: readonly string[];
130
125
  * crypto, shown in coverage output. Kept next to {@link
131
126
  * ANALYZABLE_SOURCE_EXTENSIONS} so a new language pack updates one place.
132
127
  */
133
- export declare const ANALYZABLE_LANGUAGES_LABEL = "JS/TS, Python, Go, Java/Kotlin/Scala, C#, Rust, Ruby, PHP, Elixir, C/C++";
128
+ export declare const ANALYZABLE_LANGUAGES_LABEL = "JS/TS, Python, Go, Java/Kotlin/Scala, C#, Rust, Ruby, PHP, Elixir, C/C++, Swift, Objective-C, Dart, Solidity/Move/Cairo";
134
129
  /** True when a path is in a source language the scanner can analyze for crypto. */
135
130
  export declare function isAnalyzableSource(filePath: string): boolean;
136
131
  /**
137
- * Given a SORTED ascending array of call offsets, return true when `idx` is at
138
- * or after some call offset `c` with `idx - c < window`. Runs in O(log n) by
139
- * binary-searching the largest call offset `idx` and checking the gap. This
140
- * replaces the previous O(matches × calls) linear scan (`nearCall`).
132
+ * Given a SORTED ascending array of call offsets, return true when `idx` is at or
133
+ * after some call offset `c` with `idx - c < window`. Deliberately ONE-SIDED
134
+ * (forward only): the WebCrypto algorithm name follows the `subtle.*(` call it
135
+ * belongs to, and reaching backward would wrongly attribute an UNRELATED earlier
136
+ * call's argument (e.g. a Node `generateKeyPairSync('rsa-pss', …)` sitting a few
137
+ * lines above a subtle call) to the wrong API. Runs in O(log n) by binary-searching
138
+ * the largest call offset ≤ `idx` and checking the gap.
141
139
  */
142
140
  export declare function nearSortedCall(sortedCalls: readonly number[], idx: number, window: number): boolean;
143
141
  /**
@@ -145,4 +143,40 @@ export declare function nearSortedCall(sortedCalls: readonly number[], idx: numb
145
143
  * lastIndex and guards against zero-width matches (which would loop forever).
146
144
  */
147
145
  export declare function eachMatch(re: RegExp, content: string, onMatch: (match: RegExpExecArray) => void): void;
146
+ /**
147
+ * Return the innermost `{ … }` object that contains `index`, as a substring — so a
148
+ * per-match check (e.g. a JWK's own `use`/`alg`, or whether an `alg` sits inside a
149
+ * JWK) analyses ONLY that object and can't be contaminated by a neighbouring object
150
+ * in a packed array. The scan is STRING-AWARE (braces and quotes inside JSON string
151
+ * values, honouring `\"`, are ignored), so a value like `"a}b{c"` can't mis-scope the
152
+ * object. Bounded by `maxSpan` each way so a pathological input can't blow up; falls
153
+ * back to a bounded ±window when no enclosing object is found in range.
154
+ */
155
+ export declare function enclosingObject(content: string, index: number, maxSpan?: number): string;
156
+ /**
157
+ * Blank out FULL-LINE comments so a commented-out directive isn't reported as an
158
+ * active setting. A line counts as a comment when its first non-whitespace characters
159
+ * match one of `markers` (e.g. `#`, `//`, `;`, `!`). Each such line's characters are
160
+ * replaced with spaces of the SAME length (newlines preserved), so every byte offset
161
+ * is unchanged — the finding line/column/snippet for the non-comment lines that remain
162
+ * stay exactly correct. Inline trailing comments are intentionally left alone (the
163
+ * directive before them is still active, so it should still be flagged).
164
+ *
165
+ * Config detectors run their rules over the masked content; matches can then only land
166
+ * on live config, not on commented examples (mosquitto.conf, CI YAML, ipsec.conf, and
167
+ * HCL all conventionally ship large blocks of commented-out directives).
168
+ */
169
+ export declare function maskCommentLines(content: string, markers: readonly string[]): string;
170
+ /**
171
+ * Blank out C-style block comments (the `slash-star … star-slash` form, multi-line
172
+ * included), replacing every
173
+ * character with a space and preserving newlines so byte offsets — and therefore
174
+ * finding line/column — stay exact. Complements {@link maskCommentLines}, which only
175
+ * masks whole single-line comments: an HCL/Bicep resource wrapped in a block comment
176
+ * has its inner lines mid-block (they don't START with `/*`), so a line-only masker
177
+ * leaves them live. Not string-aware — a literal `/*` inside a config string value is
178
+ * rare and, for these token detectors, a tolerable over-mask.
179
+ */
180
+ export declare function maskBlockComments(content: string): string;
181
+ export {};
148
182
  //# sourceMappingURL=detect-utils.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"detect-utils.d.ts","sourceRoot":"","sources":["../src/detect-utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EACV,eAAe,EACf,UAAU,EACV,OAAO,EACP,eAAe,EACf,QAAQ,EACR,QAAQ,EACT,MAAM,YAAY,CAAC;AAGpB,sEAAsE;AACtE,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAwCD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAIxE;AAED,oEAAoE;AACpE,wBAAgB,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAQ9D;AAED,sCAAsC;AACtC,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,QAAQ,CAAC;IACnB,UAAU,EAAE,UAAU,CAAC;IACvB,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0CAA0C;IAC1C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAmCtD;AAED,yEAAyE;AACzE,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,2CAA2C;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,CACjC,IAAI,CACF,QAAQ,EACR,OAAO,GAAG,UAAU,GAAG,UAAU,GAAG,YAAY,GAAG,WAAW,GAAG,MAAM,GAAG,SAAS,GAAG,KAAK,CAC5F,CACF,GAAG;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7B;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,aAAa,GAAG,OAAO,CAkBjG;AAED,+EAA+E;AAC/E,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAG/E;AAED;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAS7C,CAAC;AAEF,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAA4B,CAAC;AAE5E,uDAAuD;AACvD,eAAO,MAAM,aAAa,EAAE,SAAS,MAAM,EAAY,CAAC;AAExD,mEAAmE;AAInE,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAA8C,CAAC;AAE5F,yDAAyD;AACzD,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAAY,CAAC;AAE5D,2DAA2D;AAC3D,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAAY,CAAC;AAE1D,2DAA2D;AAC3D,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAAY,CAAC;AAE1D,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAAoB,CAAC;AAEpE,yDAAyD;AACzD,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAAkD,CAAC;AAE/F,iEAAiE;AACjE,eAAO,MAAM,YAAY,EAAE,SAAS,MAAM,EAAuD,CAAC;AAElG;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAY3C,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAKhD,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,EAAE,SAAS,MAAM,EAWzD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,6EACqC,CAAC;AAE7E,mFAAmF;AACnF,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GACb,OAAO,CAgBT;AAED;;;GAGG;AACH,wBAAgB,SAAS,CACvB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,GACxC,IAAI,CAQN"}
1
+ {"version":3,"file":"detect-utils.d.ts","sourceRoot":"","sources":["../src/detect-utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EACV,eAAe,EACf,UAAU,EACV,OAAO,EACP,eAAe,EACf,QAAQ,EACR,QAAQ,EACT,MAAM,YAAY,CAAC;AAqEpB,sCAAsC;AACtC,UAAU,WAAW;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,eAAe,CAAC;IAC1B,QAAQ,EAAE,QAAQ,CAAC;IACnB,UAAU,EAAE,UAAU,CAAC;IACvB,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0CAA0C;IAC1C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAmCtD;AAED,yEAAyE;AACzE,UAAU,SAAS;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,2CAA2C;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,KAAK,aAAa,GAAG,OAAO,CAC1B,IAAI,CACF,QAAQ,EACR,OAAO,GAAG,UAAU,GAAG,UAAU,GAAG,YAAY,GAAG,WAAW,GAAG,MAAM,GAAG,SAAS,GAAG,KAAK,CAC5F,CACF,GAAG;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7B;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,aAAa,GAAG,OAAO,CAkBjG;AAED,+EAA+E;AAC/E,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAG/E;AAED;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAS7C,CAAC;AAEF,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAA4B,CAAC;AAE5E,uDAAuD;AACvD,eAAO,MAAM,aAAa,EAAE,SAAS,MAAM,EAAY,CAAC;AAExD,mEAAmE;AAInE,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAA8C,CAAC;AAE5F,yDAAyD;AACzD,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAAY,CAAC;AAE5D,2DAA2D;AAC3D,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAAY,CAAC;AAE1D,2DAA2D;AAC3D,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAAY,CAAC;AAE1D,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAAoB,CAAC;AAEpE,yDAAyD;AACzD,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAAkD,CAAC;AAE/F,iEAAiE;AACjE,eAAO,MAAM,YAAY,EAAE,SAAS,MAAM,EAAuD,CAAC;AAElG,sFAAsF;AACtF,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAAe,CAAC;AAE9D,2EAA2E;AAC3E,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAAkB,CAAC;AAEhE,wCAAwC;AACxC,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAAc,CAAC;AAE5D,6EAA6E;AAC7E,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EAAgC,CAAC;AAExF;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,EAAE,SAAS,MAAM,EAY3C,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAQhD,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,4BAA4B,EAAE,SAAS,MAAM,EAezD,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,4HACoF,CAAC;AAE5H,mFAAmF;AACnF,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GACb,OAAO,CAgBT;AAED;;;GAGG;AACH,wBAAgB,SAAS,CACvB,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,GACxC,IAAI,CAQN;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,SAAO,GAAG,MAAM,CAkCtF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAWpF;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAiBzD"}