@quantakrypto/core 0.5.0 → 0.6.0

package/dist/crypto-agility.d.ts

@@ -0,0 +1,158 @@
+/**
+ * Crypto-agility manifest: an agent-consumable crypto-posture document.
+ *
+ * A small, versioned JSON manifest a project publishes at a well-known URL
+ * (`/.well-known/crypto-agility.json`, see docs/CRYPTO-AGILITY-MANIFEST.md) so any
+ * agent, scanner, or CI bot can read the project's cryptographic posture the way it
+ * reads `security.txt` or `robots.txt`. It is a compact, decision-oriented summary
+ * DERIVED from a qScan result: the readiness score, the count of quantum-vulnerable
+ * findings by severity, the CBOM's algorithm families, an optional attestation URL,
+ * and the migration-policy deadlines.
+ *
+ * This module owns two pure operations and their shared schema:
+ *   - {@link buildCryptoAgilityManifest}: derive a manifest from a {@link ScanResult}.
+ *   - {@link validateCryptoAgilityManifest}: check an untrusted value against the
+ *     schema, returning a list of problems (used by the local validator; a network
+ *     fetch-and-validate lives on the website, never in this offline-boundary tool).
+ *
+ * Zero dependencies; hand-rolled JSON shape and validation so the package stays
+ * runtime-dependency-free.
+ */
+import type { CryptoPolicy } from "./policy.js";
+import type { ScanResult, Severity } from "./types.js";
+/**
+ * Schema version of the manifest this module emits and validates. Bumped only on a
+ * breaking change to the manifest shape; consumers key their parsing off it.
+ */
+export declare const CRYPTO_AGILITY_MANIFEST_VERSION = 1;
+/** The conventional path a manifest is served from, relative to the site origin. */
+export declare const CRYPTO_AGILITY_WELL_KNOWN_PATH = "/.well-known/crypto-agility.json";
+/** A single algorithm family in use, mirroring the CBOM's grouping. */
+export interface CryptoAgilityFamily {
+    /** The algorithm family (e.g. `RSA`, `ECDH`, `ECDSA`), or `unknown`. */
+    family: string;
+    /** How many findings referenced this family. */
+    count: number;
+    /** Always true today: every detected family is classical (Shor-broken). */
+    quantumVulnerable: boolean;
+}
+/** The project's cryptographic posture, distilled from the scan inventory. */
+export interface CryptoAgilityPosture {
+    /** qScan readiness score, 0–100 (100 = no classical asymmetric crypto found). */
+    readinessScore: number;
+    /**
+     * Whether the project negotiates hybrid post-quantum key exchange. qScan is a
+     * static scanner and cannot observe a negotiated TLS group, so this is `null`
+     * ("not determined by this generator") unless the operator asserts it
+     * (`--hybrid-kex` / `--no-hybrid-kex`). A live probe (qProbe) or the website can
+     * fill it authoritatively.
+     */
+    hybridKexInUse: boolean | null;
+    /** Count of quantum-vulnerable findings, total and broken down by severity. */
+    quantumVulnerable: {
+        total: number;
+        bySeverity: Record<Severity, number>;
+    };
+    /** How many findings are exposed to harvest-now-decrypt-later. */
+    hndlExposedCount: number;
+}
+/** A compact summary of the full CBOM, linking to it by serial number. */
+export interface CryptoAgilityCbomSummary {
+    /** The CycloneDX `serialNumber` of the full CBOM this summary was derived from. */
+    serialNumber: string;
+    /** Number of distinct cryptographic-asset components in the full CBOM. */
+    assetCount: number;
+    /** Algorithm families in use, most-referenced first. */
+    algorithmFamilies: CryptoAgilityFamily[];
+}
+/** The migration policy the project declares it is measured against. */
+export interface CryptoAgilityPolicy {
+    /** Human label for the policy source (a standard name, or `operator-declared`). */
+    source: string;
+    /** Year after which classical public-key crypto is deprecated. */
+    deprecateClassicalAfter: number;
+    /** Year after which classical public-key crypto is disallowed. */
+    disallowClassicalAfter: number;
+    /** Operator-declared migration deadline (ISO date / year), or `null`. */
+    transitionDeadline: string | null;
+    /** Citation for the deadlines (spec / publication). */
+    citation: string;
+}
+/** The full crypto-agility manifest. */
+export interface CryptoAgilityManifest {
+    /** Manifest schema version ({@link CRYPTO_AGILITY_MANIFEST_VERSION}). */
+    version: number;
+    /** Discriminator so a consumer can tell this document apart from other JSON. */
+    manifestType: "crypto-agility";
+    /** ISO 8601 timestamp the manifest was generated (caller-supplied). */
+    generatedAt: string;
+    /** What produced the manifest. */
+    generator: {
+        name: string;
+        version: string;
+    };
+    /** What the manifest describes. */
+    subject: {
+        root: string;
+        repository: string | null;
+        commit: string | null;
+    };
+    /** The distilled cryptographic posture. */
+    posture: CryptoAgilityPosture;
+    /** A compact summary of the CBOM. */
+    cbomSummary: CryptoAgilityCbomSummary;
+    /** Optional link to a quantakrypto (or other) posture credential. */
+    attestation?: {
+        url: string;
+    };
+    /** The declared migration policy / deadlines. */
+    policy: CryptoAgilityPolicy;
+}
+/** Inputs the CLI/runtime supplies that are not derivable from the scan. */
+export interface CryptoAgilityManifestOptions {
+    /**
+     * ISO 8601 generation timestamp. The caller supplies it (`Date.now()` is fine in
+     * the CLI runtime) so the builder itself stays pure and deterministic.
+     */
+    generatedAt: string;
+    /** Optional URL to a posture credential (recorded verbatim, never fetched here). */
+    attestationUrl?: string;
+    /**
+     * Operator assertion of hybrid-KEX use. `undefined` leaves the manifest's
+     * `hybridKexInUse` as `null` (not determined).
+     */
+    hybridKexInUse?: boolean;
+    /** Optional org crypto policy; its `transitionDeadline` overlays the defaults. */
+    policy?: CryptoPolicy;
+    /** Repository URL (e.g. `GITHUB_REPOSITORY`); omitted → null. */
+    repository?: string;
+    /** Commit SHA (e.g. `GITHUB_SHA`); omitted → null. */
+    commit?: string;
+}
+/**
+ * Build a crypto-agility manifest from a scan result. Pure: every runtime input
+ * (timestamp, attestation, hybrid-KEX assertion, policy) arrives via `opts`.
+ *
+ * The posture and CBOM summary are derived straight from the scan's inventory and
+ * its CycloneDX CBOM, so the manifest can never disagree with the full `--cbom` /
+ * `--format json` outputs of the same scan.
+ */
+export declare function buildCryptoAgilityManifest(result: ScanResult, opts: CryptoAgilityManifestOptions): CryptoAgilityManifest;
+/** Outcome of {@link validateCryptoAgilityManifest}. */
+export interface ManifestValidation {
+    /** True when the value satisfies the manifest schema. */
+    valid: boolean;
+    /** One human-readable message per problem found (empty when `valid`). */
+    errors: string[];
+}
+/**
+ * Validate an untrusted value against the crypto-agility manifest schema.
+ *
+ * Checks structure, required fields, types, and the schema version. Purely local:
+ * it parses an already-in-memory value and NEVER performs I/O or network fetches;
+ * a fetch-and-validate of a remote manifest is a website-side concern, deliberately
+ * kept out of this offline-boundary tool. Returns every problem it finds rather than
+ * throwing on the first, so a caller can report them all at once.
+ */
+export declare function validateCryptoAgilityManifest(value: unknown): ManifestValidation;
+//# sourceMappingURL=crypto-agility.d.ts.map

package/dist/crypto-agility.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-agility.d.ts","sourceRoot":"","sources":["../src/crypto-agility.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAKH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAGvD;;;GAGG;AACH,eAAO,MAAM,+BAA+B,IAAI,CAAC;AAEjD,oFAAoF;AACpF,eAAO,MAAM,8BAA8B,qCAAqC,CAAC;AAEjF,uEAAuE;AACvE,MAAM,WAAW,mBAAmB;IAClC,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,2EAA2E;IAC3E,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAED,8EAA8E;AAC9E,MAAM,WAAW,oBAAoB;IACnC,iFAAiF;IACjF,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,cAAc,EAAE,OAAO,GAAG,IAAI,CAAC;IAC/B,+EAA+E;IAC/E,iBAAiB,EAAE;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;KACtC,CAAC;IACF,kEAAkE;IAClE,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,0EAA0E;AAC1E,MAAM,WAAW,wBAAwB;IACvC,mFAAmF;IACnF,YAAY,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,UAAU,EAAE,MAAM,CAAC;IACnB,wDAAwD;IACxD,iBAAiB,EAAE,mBAAmB,EAAE,CAAC;CAC1C;AAED,wEAAwE;AACxE,MAAM,WAAW,mBAAmB;IAClC,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,uBAAuB,EAAE,MAAM,CAAC;IAChC,kEAAkE;IAClE,sBAAsB,EAAE,MAAM,CAAC;IAC/B,yEAAyE;IACzE,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wCAAwC;AACxC,MAAM,WAAW,qBAAqB;IACpC,yEAAyE;IACzE,OAAO,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,YAAY,EAAE,gBAAgB,CAAC;IAC/B,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,kCAAkC;IAClC,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,mCAAmC;IACnC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC5E,2CAA2C;IAC3C,OAAO,EAAE,oBAAoB,CAAC;IAC9B,qCAAqC;IACrC,WAAW,EAAE,wBAAwB,CAAC;IACtC,qEAAqE;IACrE,WAAW,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9B,iDAAiD;IACjD,MAAM,EAAE,mBAAmB,CAAC;CAC7B;AAED,4EAA4E;AAC5E,MAAM,WAAW,4BAA4B;IAC3C;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,oFAAoF;IACpF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kFAAkF;IAClF,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,4BAA4B,GACjC,qBAAqB,CAyDvB;AAED,wDAAwD;AACxD,MAAM,WAAW,kBAAkB;IACjC,yDAAyD;IACzD,KAAK,EAAE,OAAO,CAAC;IACf,yEAAyE;IACzE,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAOD;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,CA+EhF"}

package/dist/crypto-agility.js

@@ -0,0 +1,285 @@
+/**
+ * Crypto-agility manifest: an agent-consumable crypto-posture document.
+ *
+ * A small, versioned JSON manifest a project publishes at a well-known URL
+ * (`/.well-known/crypto-agility.json`, see docs/CRYPTO-AGILITY-MANIFEST.md) so any
+ * agent, scanner, or CI bot can read the project's cryptographic posture the way it
+ * reads `security.txt` or `robots.txt`. It is a compact, decision-oriented summary
+ * DERIVED from a qScan result: the readiness score, the count of quantum-vulnerable
+ * findings by severity, the CBOM's algorithm families, an optional attestation URL,
+ * and the migration-policy deadlines.
+ *
+ * This module owns two pure operations and their shared schema:
+ *   - {@link buildCryptoAgilityManifest}: derive a manifest from a {@link ScanResult}.
+ *   - {@link validateCryptoAgilityManifest}: check an untrusted value against the
+ *     schema, returning a list of problems (used by the local validator; a network
+ *     fetch-and-validate lives on the website, never in this offline-boundary tool).
+ *
+ * Zero dependencies; hand-rolled JSON shape and validation so the package stays
+ * runtime-dependency-free.
+ */
+import { toCbom } from "./cbom.js";
+import { PQC_STANDARDS } from "./standards.js";
+import { SEVERITY_ORDER } from "./severity.js";
+import { VERSION } from "./version.js";
+/**
+ * Schema version of the manifest this module emits and validates. Bumped only on a
+ * breaking change to the manifest shape; consumers key their parsing off it.
+ */
+export const CRYPTO_AGILITY_MANIFEST_VERSION = 1;
+/** The conventional path a manifest is served from, relative to the site origin. */
+export const CRYPTO_AGILITY_WELL_KNOWN_PATH = "/.well-known/crypto-agility.json";
+/**
+ * Build a crypto-agility manifest from a scan result. Pure: every runtime input
+ * (timestamp, attestation, hybrid-KEX assertion, policy) arrives via `opts`.
+ *
+ * The posture and CBOM summary are derived straight from the scan's inventory and
+ * its CycloneDX CBOM, so the manifest can never disagree with the full `--cbom` /
+ * `--format json` outputs of the same scan.
+ */
+export function buildCryptoAgilityManifest(result, opts) {
+    const cbom = toCbom(result);
+    const inv = result.inventory;
+    const algorithmFamilies = Object.entries(inv.byAlgorithm)
+        .filter(([, count]) => (count ?? 0) > 0)
+        .map(([family, count]) => ({
+        family,
+        count: count,
+        // Every family the detectors surface is classical, hence quantum-vulnerable
+        // by construction (mirrors cbom.ts `isQuantumVulnerable`).
+        quantumVulnerable: true,
+    }))
+        .sort((a, b) => b.count - a.count || a.family.localeCompare(b.family));
+    const bySeverity = { ...inv.bySeverity };
+    // Default policy: the NIST IR 8547 transition timeline. An operator crypto policy
+    // (`--policy`) does not override the standards deadlines but layers its own
+    // `transitionDeadline` on top and re-labels the source as operator-declared.
+    const timeline = PQC_STANDARDS.transitionTimeline;
+    const policy = {
+        source: opts.policy ? "operator-declared" : timeline.source,
+        deprecateClassicalAfter: timeline.deprecateAfter,
+        disallowClassicalAfter: timeline.disallowAfter,
+        transitionDeadline: opts.policy?.transitionDeadline ?? null,
+        citation: timeline.source,
+    };
+    const manifest = {
+        version: CRYPTO_AGILITY_MANIFEST_VERSION,
+        manifestType: "crypto-agility",
+        generatedAt: opts.generatedAt,
+        generator: { name: "qScan", version: result.toolVersion || VERSION },
+        subject: {
+            root: result.root,
+            repository: opts.repository ?? null,
+            commit: opts.commit ?? null,
+        },
+        posture: {
+            readinessScore: inv.readinessScore,
+            hybridKexInUse: opts.hybridKexInUse ?? null,
+            quantumVulnerable: {
+                total: result.findings.length,
+                bySeverity,
+            },
+            hndlExposedCount: inv.hndlCount,
+        },
+        cbomSummary: {
+            serialNumber: cbom.serialNumber,
+            assetCount: cbom.components.length,
+            algorithmFamilies,
+        },
+        ...(opts.attestationUrl ? { attestation: { url: opts.attestationUrl } } : {}),
+        policy,
+    };
+    return manifest;
+}
+/** True for a plain (non-array, non-null) object. */
+function isObject(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+/**
+ * Validate an untrusted value against the crypto-agility manifest schema.
+ *
+ * Checks structure, required fields, types, and the schema version. Purely local:
+ * it parses an already-in-memory value and NEVER performs I/O or network fetches;
+ * a fetch-and-validate of a remote manifest is a website-side concern, deliberately
+ * kept out of this offline-boundary tool. Returns every problem it finds rather than
+ * throwing on the first, so a caller can report them all at once.
+ */
+export function validateCryptoAgilityManifest(value) {
+    const errors = [];
+    const err = (m) => void errors.push(m);
+    if (!isObject(value)) {
+        return { valid: false, errors: ["manifest must be a JSON object"] };
+    }
+    // version
+    if (value.version === undefined) {
+        err("missing required field: version");
+    }
+    else if (typeof value.version !== "number" || !Number.isInteger(value.version)) {
+        err("version must be an integer");
+    }
+    else if (value.version !== CRYPTO_AGILITY_MANIFEST_VERSION) {
+        err(`unsupported version ${value.version} (this validator understands version ${CRYPTO_AGILITY_MANIFEST_VERSION})`);
+    }
+    // manifestType
+    if (value.manifestType === undefined) {
+        err("missing required field: manifestType");
+    }
+    else if (value.manifestType !== "crypto-agility") {
+        err('manifestType must be the string "crypto-agility"');
+    }
+    // generatedAt
+    if (value.generatedAt === undefined) {
+        err("missing required field: generatedAt");
+    }
+    else if (typeof value.generatedAt !== "string" || value.generatedAt.length === 0) {
+        err("generatedAt must be a non-empty ISO 8601 string");
+    }
+    else if (Number.isNaN(Date.parse(value.generatedAt))) {
+        err("generatedAt must be a parseable ISO 8601 timestamp");
+    }
+    // generator
+    if (value.generator === undefined) {
+        err("missing required field: generator");
+    }
+    else if (!isObject(value.generator)) {
+        err("generator must be an object");
+    }
+    else {
+        if (typeof value.generator.name !== "string")
+            err("generator.name must be a string");
+        if (typeof value.generator.version !== "string")
+            err("generator.version must be a string");
+    }
+    // subject
+    if (value.subject === undefined) {
+        err("missing required field: subject");
+    }
+    else if (!isObject(value.subject)) {
+        err("subject must be an object");
+    }
+    else {
+        if (typeof value.subject.root !== "string")
+            err("subject.root must be a string");
+        if (value.subject.repository !== null && typeof value.subject.repository !== "string") {
+            err("subject.repository must be a string or null");
+        }
+        if (value.subject.commit !== null && typeof value.subject.commit !== "string") {
+            err("subject.commit must be a string or null");
+        }
+    }
+    // posture
+    validatePosture(value.posture, err);
+    // cbomSummary
+    validateCbomSummary(value.cbomSummary, err);
+    // attestation (optional)
+    if (value.attestation !== undefined) {
+        if (!isObject(value.attestation)) {
+            err("attestation must be an object when present");
+        }
+        else if (typeof value.attestation.url !== "string" || value.attestation.url.length === 0) {
+            err("attestation.url must be a non-empty string");
+        }
+    }
+    // policy
+    validatePolicy(value.policy, err);
+    return { valid: errors.length === 0, errors };
+}
+/** Validate the `posture` block. */
+function validatePosture(posture, err) {
+    if (posture === undefined) {
+        err("missing required field: posture");
+        return;
+    }
+    if (!isObject(posture)) {
+        err("posture must be an object");
+        return;
+    }
+    if (typeof posture.readinessScore !== "number" ||
+        posture.readinessScore < 0 ||
+        posture.readinessScore > 100) {
+        err("posture.readinessScore must be a number between 0 and 100");
+    }
+    if (posture.hybridKexInUse !== null && typeof posture.hybridKexInUse !== "boolean") {
+        err("posture.hybridKexInUse must be a boolean or null");
+    }
+    if (typeof posture.hndlExposedCount !== "number" || posture.hndlExposedCount < 0) {
+        err("posture.hndlExposedCount must be a non-negative number");
+    }
+    const qv = posture.quantumVulnerable;
+    if (!isObject(qv)) {
+        err("posture.quantumVulnerable must be an object");
+        return;
+    }
+    if (typeof qv.total !== "number" || qv.total < 0) {
+        err("posture.quantumVulnerable.total must be a non-negative number");
+    }
+    if (!isObject(qv.bySeverity)) {
+        err("posture.quantumVulnerable.bySeverity must be an object");
+    }
+    else {
+        for (const sev of SEVERITY_ORDER) {
+            if (typeof qv.bySeverity[sev] !== "number") {
+                err(`posture.quantumVulnerable.bySeverity.${sev} must be a number`);
+            }
+        }
+    }
+}
+/** Validate the `cbomSummary` block. */
+function validateCbomSummary(summary, err) {
+    if (summary === undefined) {
+        err("missing required field: cbomSummary");
+        return;
+    }
+    if (!isObject(summary)) {
+        err("cbomSummary must be an object");
+        return;
+    }
+    if (typeof summary.serialNumber !== "string")
+        err("cbomSummary.serialNumber must be a string");
+    if (typeof summary.assetCount !== "number" || summary.assetCount < 0) {
+        err("cbomSummary.assetCount must be a non-negative number");
+    }
+    if (!Array.isArray(summary.algorithmFamilies)) {
+        err("cbomSummary.algorithmFamilies must be an array");
+        return;
+    }
+    summary.algorithmFamilies.forEach((fam, i) => {
+        if (!isObject(fam)) {
+            err(`cbomSummary.algorithmFamilies[${i}] must be an object`);
+            return;
+        }
+        if (typeof fam.family !== "string")
+            err(`cbomSummary.algorithmFamilies[${i}].family must be a string`);
+        if (typeof fam.count !== "number" || fam.count < 0) {
+            err(`cbomSummary.algorithmFamilies[${i}].count must be a non-negative number`);
+        }
+        if (typeof fam.quantumVulnerable !== "boolean") {
+            err(`cbomSummary.algorithmFamilies[${i}].quantumVulnerable must be a boolean`);
+        }
+    });
+}
+/** Validate the `policy` block. */
+function validatePolicy(policy, err) {
+    if (policy === undefined) {
+        err("missing required field: policy");
+        return;
+    }
+    if (!isObject(policy)) {
+        err("policy must be an object");
+        return;
+    }
+    if (typeof policy.source !== "string")
+        err("policy.source must be a string");
+    if (typeof policy.deprecateClassicalAfter !== "number") {
+        err("policy.deprecateClassicalAfter must be a number (year)");
+    }
+    if (typeof policy.disallowClassicalAfter !== "number") {
+        err("policy.disallowClassicalAfter must be a number (year)");
+    }
+    if (policy.transitionDeadline !== null && typeof policy.transitionDeadline !== "string") {
+        err("policy.transitionDeadline must be a string or null");
+    }
+    if (typeof policy.citation !== "string")
+        err("policy.citation must be a string");
+}
+//# sourceMappingURL=crypto-agility.js.map

package/dist/crypto-agility.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-agility.js","sourceRoot":"","sources":["../src/crypto-agility.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAG/C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC;AAEjD,oFAAoF;AACpF,MAAM,CAAC,MAAM,8BAA8B,GAAG,kCAAkC,CAAC;AAqGjF;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAkB,EAClB,IAAkC;IAElC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC;IAE7B,MAAM,iBAAiB,GAA0B,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;SAC7E,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;SACvC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QACzB,MAAM;QACN,KAAK,EAAE,KAAe;QACtB,4EAA4E;QAC5E,2DAA2D;QAC3D,iBAAiB,EAAE,IAAI;KACxB,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAEzE,MAAM,UAAU,GAAG,EAAE,GAAG,GAAG,CAAC,UAAU,EAAE,CAAC;IAEzC,kFAAkF;IAClF,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,aAAa,CAAC,kBAAkB,CAAC;IAClD,MAAM,MAAM,GAAwB;QAClC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM;QAC3D,uBAAuB,EAAE,QAAQ,CAAC,cAAc;QAChD,sBAAsB,EAAE,QAAQ,CAAC,aAAa;QAC9C,kBAAkB,EAAE,IAAI,CAAC,MAAM,EAAE,kBAAkB,IAAI,IAAI;QAC3D,QAAQ,EAAE,QAAQ,CAAC,MAAM;KAC1B,CAAC;IAEF,MAAM,QAAQ,GAA0B;QACtC,OAAO,EAAE,+BAA+B;QACxC,YAAY,EAAE,gBAAgB;QAC9B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,WAAW,IAAI,OAAO,EAAE;QACpE,OAAO,EAAE;YACP,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;SAC5B;QACD,OAAO,EAAE;YACP,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,IAAI;YAC3C,iBAAiB,EAAE;gBACjB,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;gBAC7B,UAAU;aACX;YACD,gBAAgB,EAAE,GAAG,CAAC,SAAS;SAChC;QACD,WAAW,EAAE;YACX,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM;YAClC,iBAAiB;SAClB;QACD,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,MAAM;KACP,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAUD,qDAAqD;AACrD,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,6BAA6B,CAAC,KAAc;IAC1D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,CAAC,CAAS,EAAQ,EAAE,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAErD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,gCAAgC,CAAC,EAAE,CAAC;IACtE,CAAC;IAED,UAAU;IACV,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChC,GAAG,CAAC,iCAAiC,CAAC,CAAC;IACzC,CAAC;SAAM,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACjF,GAAG,CAAC,4BAA4B,CAAC,CAAC;IACpC,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,KAAK,+BAA+B,EAAE,CAAC;QAC7D,GAAG,CACD,uBAAuB,KAAK,CAAC,OAAO,wCAAwC,+BAA+B,GAAG,CAC/G,CAAC;IACJ,CAAC;IAED,eAAe;IACf,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACrC,GAAG,CAAC,sCAAsC,CAAC,CAAC;IAC9C,CAAC;SAAM,IAAI,KAAK,CAAC,YAAY,KAAK,gBAAgB,EAAE,CAAC;QACnD,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAC1D,CAAC;IAED,cAAc;IACd,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACpC,GAAG,CAAC,qCAAqC,CAAC,CAAC;IAC7C,CAAC;SAAM,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnF,GAAG,CAAC,iDAAiD,CAAC,CAAC;IACzD,CAAC;SAAM,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAC5D,CAAC;IAED,YAAY;IACZ,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAClC,GAAG,CAAC,mCAAmC,CAAC,CAAC;IAC3C,CAAC;SAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,GAAG,CAAC,6BAA6B,CAAC,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,IAAI,OAAO,KAAK,CAAC,SAAS,CAAC,IAAI,KAAK,QAAQ;YAAE,GAAG,CAAC,iCAAiC,CAAC,CAAC;QACrF,IAAI,OAAO,KAAK,CAAC,SAAS,CAAC,OAAO,KAAK,QAAQ;YAAE,GAAG,CAAC,oCAAoC,CAAC,CAAC;IAC7F,CAAC;IAED,UAAU;IACV,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChC,GAAG,CAAC,iCAAiC,CAAC,CAAC;IACzC,CAAC;SAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IACnC,CAAC;SAAM,CAAC;QACN,IAAI,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ;YAAE,GAAG,CAAC,+BAA+B,CAAC,CAAC;QACjF,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,KAAK,IAAI,IAAI,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACtF,GAAG,CAAC,6CAA6C,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,IAAI,IAAI,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC9E,GAAG,CAAC,yCAAyC,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAED,UAAU;IACV,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAEpC,cAAc;IACd,mBAAmB,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IAE5C,yBAAyB;IACzB,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;YACjC,GAAG,CAAC,4CAA4C,CAAC,CAAC;QACpD,CAAC;aAAM,IAAI,OAAO,KAAK,CAAC,WAAW,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3F,GAAG,CAAC,4CAA4C,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,SAAS;IACT,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAElC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,oCAAoC;AACpC,SAAS,eAAe,CAAC,OAAgB,EAAE,GAAwB;IACjE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,GAAG,CAAC,iCAAiC,CAAC,CAAC;QACvC,OAAO;IACT,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,2BAA2B,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IACD,IACE,OAAO,OAAO,CAAC,cAAc,KAAK,QAAQ;QAC1C,OAAO,CAAC,cAAc,GAAG,CAAC;QAC1B,OAAO,CAAC,cAAc,GAAG,GAAG,EAC5B,CAAC;QACD,GAAG,CAAC,2DAA2D,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,KAAK,IAAI,IAAI,OAAO,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACnF,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,gBAAgB,KAAK,QAAQ,IAAI,OAAO,CAAC,gBAAgB,GAAG,CAAC,EAAE,CAAC;QACjF,GAAG,CAAC,wDAAwD,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,EAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC;IACrC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QAClB,GAAG,CAAC,6CAA6C,CAAC,CAAC;QACnD,OAAO;IACT,CAAC;IACD,IAAI,OAAO,EAAE,CAAC,KAAK,KAAK,QAAQ,IAAI,EAAE,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,+DAA+D,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,wDAAwD,CAAC,CAAC;IAChE,CAAC;SAAM,CAAC;QACN,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;YACjC,IAAI,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC3C,GAAG,CAAC,wCAAwC,GAAG,mBAAmB,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,wCAAwC;AACxC,SAAS,mBAAmB,CAAC,OAAgB,EAAE,GAAwB;IACrE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,GAAG,CAAC,qCAAqC,CAAC,CAAC;QAC3C,OAAO;IACT,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,+BAA+B,CAAC,CAAC;QACrC,OAAO;IACT,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ;QAAE,GAAG,CAAC,2CAA2C,CAAC,CAAC;IAC/F,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,sDAAsD,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,gDAAgD,CAAC,CAAC;QACtD,OAAO;IACT,CAAC;IACD,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QAC3C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,GAAG,CAAC,iCAAiC,CAAC,qBAAqB,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;YAChC,GAAG,CAAC,iCAAiC,CAAC,2BAA2B,CAAC,CAAC;QACrE,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,iCAAiC,CAAC,uCAAuC,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YAC/C,GAAG,CAAC,iCAAiC,CAAC,uCAAuC,CAAC,CAAC;QACjF,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,mCAAmC;AACnC,SAAS,cAAc,CAAC,MAAe,EAAE,GAAwB;IAC/D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,GAAG,CAAC,gCAAgC,CAAC,CAAC;QACtC,OAAO;IACT,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,GAAG,CAAC,0BAA0B,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;QAAE,GAAG,CAAC,gCAAgC,CAAC,CAAC;IAC7E,IAAI,OAAO,MAAM,CAAC,uBAAuB,KAAK,QAAQ,EAAE,CAAC;QACvD,GAAG,CAAC,wDAAwD,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,sBAAsB,KAAK,QAAQ,EAAE,CAAC;QACtD,GAAG,CAAC,uDAAuD,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,MAAM,CAAC,kBAAkB,KAAK,IAAI,IAAI,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,EAAE,CAAC;QACxF,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,GAAG,CAAC,kCAAkC,CAAC,CAAC;AACnF,CAAC","sourcesContent":["/**\n * Crypto-agility manifest: an agent-consumable crypto-posture document.\n *\n * A small, versioned JSON manifest a project publishes at a well-known URL\n * (`/.well-known/crypto-agility.json`, see docs/CRYPTO-AGILITY-MANIFEST.md) so any\n * agent, scanner, or CI bot can read the project's cryptographic posture the way it\n * reads `security.txt` or `robots.txt`. It is a compact, decision-oriented summary\n * DERIVED from a qScan result: the readiness score, the count of quantum-vulnerable\n * findings by severity, the CBOM's algorithm families, an optional attestation URL,\n * and the migration-policy deadlines.\n *\n * This module owns two pure operations and their shared schema:\n *   - {@link buildCryptoAgilityManifest}: derive a manifest from a {@link ScanResult}.\n *   - {@link validateCryptoAgilityManifest}: check an untrusted value against the\n *     schema, returning a list of problems (used by the local validator; a network\n *     fetch-and-validate lives on the website, never in this offline-boundary tool).\n *\n * Zero dependencies; hand-rolled JSON shape and validation so the package stays\n * runtime-dependency-free.\n */\n\nimport { toCbom } from \"./cbom.js\";\nimport { PQC_STANDARDS } from \"./standards.js\";\nimport { SEVERITY_ORDER } from \"./severity.js\";\nimport type { CryptoPolicy } from \"./policy.js\";\nimport type { ScanResult, Severity } from \"./types.js\";\nimport { VERSION } from \"./version.js\";\n\n/**\n * Schema version of the manifest this module emits and validates. Bumped only on a\n * breaking change to the manifest shape; consumers key their parsing off it.\n */\nexport const CRYPTO_AGILITY_MANIFEST_VERSION = 1;\n\n/** The conventional path a manifest is served from, relative to the site origin. */\nexport const CRYPTO_AGILITY_WELL_KNOWN_PATH = \"/.well-known/crypto-agility.json\";\n\n/** A single algorithm family in use, mirroring the CBOM's grouping. */\nexport interface CryptoAgilityFamily {\n  /** The algorithm family (e.g. `RSA`, `ECDH`, `ECDSA`), or `unknown`. */\n  family: string;\n  /** How many findings referenced this family. */\n  count: number;\n  /** Always true today: every detected family is classical (Shor-broken). */\n  quantumVulnerable: boolean;\n}\n\n/** The project's cryptographic posture, distilled from the scan inventory. */\nexport interface CryptoAgilityPosture {\n  /** qScan readiness score, 0–100 (100 = no classical asymmetric crypto found). */\n  readinessScore: number;\n  /**\n   * Whether the project negotiates hybrid post-quantum key exchange. qScan is a\n   * static scanner and cannot observe a negotiated TLS group, so this is `null`\n   * (\"not determined by this generator\") unless the operator asserts it\n   * (`--hybrid-kex` / `--no-hybrid-kex`). A live probe (qProbe) or the website can\n   * fill it authoritatively.\n   */\n  hybridKexInUse: boolean | null;\n  /** Count of quantum-vulnerable findings, total and broken down by severity. */\n  quantumVulnerable: {\n    total: number;\n    bySeverity: Record<Severity, number>;\n  };\n  /** How many findings are exposed to harvest-now-decrypt-later. */\n  hndlExposedCount: number;\n}\n\n/** A compact summary of the full CBOM, linking to it by serial number. */\nexport interface CryptoAgilityCbomSummary {\n  /** The CycloneDX `serialNumber` of the full CBOM this summary was derived from. */\n  serialNumber: string;\n  /** Number of distinct cryptographic-asset components in the full CBOM. */\n  assetCount: number;\n  /** Algorithm families in use, most-referenced first. */\n  algorithmFamilies: CryptoAgilityFamily[];\n}\n\n/** The migration policy the project declares it is measured against. */\nexport interface CryptoAgilityPolicy {\n  /** Human label for the policy source (a standard name, or `operator-declared`). */\n  source: string;\n  /** Year after which classical public-key crypto is deprecated. */\n  deprecateClassicalAfter: number;\n  /** Year after which classical public-key crypto is disallowed. */\n  disallowClassicalAfter: number;\n  /** Operator-declared migration deadline (ISO date / year), or `null`. */\n  transitionDeadline: string | null;\n  /** Citation for the deadlines (spec / publication). */\n  citation: string;\n}\n\n/** The full crypto-agility manifest. */\nexport interface CryptoAgilityManifest {\n  /** Manifest schema version ({@link CRYPTO_AGILITY_MANIFEST_VERSION}). */\n  version: number;\n  /** Discriminator so a consumer can tell this document apart from other JSON. */\n  manifestType: \"crypto-agility\";\n  /** ISO 8601 timestamp the manifest was generated (caller-supplied). */\n  generatedAt: string;\n  /** What produced the manifest. */\n  generator: { name: string; version: string };\n  /** What the manifest describes. */\n  subject: { root: string; repository: string | null; commit: string | null };\n  /** The distilled cryptographic posture. */\n  posture: CryptoAgilityPosture;\n  /** A compact summary of the CBOM. */\n  cbomSummary: CryptoAgilityCbomSummary;\n  /** Optional link to a quantakrypto (or other) posture credential. */\n  attestation?: { url: string };\n  /** The declared migration policy / deadlines. */\n  policy: CryptoAgilityPolicy;\n}\n\n/** Inputs the CLI/runtime supplies that are not derivable from the scan. */\nexport interface CryptoAgilityManifestOptions {\n  /**\n   * ISO 8601 generation timestamp. The caller supplies it (`Date.now()` is fine in\n   * the CLI runtime) so the builder itself stays pure and deterministic.\n   */\n  generatedAt: string;\n  /** Optional URL to a posture credential (recorded verbatim, never fetched here). */\n  attestationUrl?: string;\n  /**\n   * Operator assertion of hybrid-KEX use. `undefined` leaves the manifest's\n   * `hybridKexInUse` as `null` (not determined).\n   */\n  hybridKexInUse?: boolean;\n  /** Optional org crypto policy; its `transitionDeadline` overlays the defaults. */\n  policy?: CryptoPolicy;\n  /** Repository URL (e.g. `GITHUB_REPOSITORY`); omitted → null. */\n  repository?: string;\n  /** Commit SHA (e.g. `GITHUB_SHA`); omitted → null. */\n  commit?: string;\n}\n\n/**\n * Build a crypto-agility manifest from a scan result. Pure: every runtime input\n * (timestamp, attestation, hybrid-KEX assertion, policy) arrives via `opts`.\n *\n * The posture and CBOM summary are derived straight from the scan's inventory and\n * its CycloneDX CBOM, so the manifest can never disagree with the full `--cbom` /\n * `--format json` outputs of the same scan.\n */\nexport function buildCryptoAgilityManifest(\n  result: ScanResult,\n  opts: CryptoAgilityManifestOptions,\n): CryptoAgilityManifest {\n  const cbom = toCbom(result);\n  const inv = result.inventory;\n\n  const algorithmFamilies: CryptoAgilityFamily[] = Object.entries(inv.byAlgorithm)\n    .filter(([, count]) => (count ?? 0) > 0)\n    .map(([family, count]) => ({\n      family,\n      count: count as number,\n      // Every family the detectors surface is classical, hence quantum-vulnerable\n      // by construction (mirrors cbom.ts `isQuantumVulnerable`).\n      quantumVulnerable: true,\n    }))\n    .sort((a, b) => b.count - a.count || a.family.localeCompare(b.family));\n\n  const bySeverity = { ...inv.bySeverity };\n\n  // Default policy: the NIST IR 8547 transition timeline. An operator crypto policy\n  // (`--policy`) does not override the standards deadlines but layers its own\n  // `transitionDeadline` on top and re-labels the source as operator-declared.\n  const timeline = PQC_STANDARDS.transitionTimeline;\n  const policy: CryptoAgilityPolicy = {\n    source: opts.policy ? \"operator-declared\" : timeline.source,\n    deprecateClassicalAfter: timeline.deprecateAfter,\n    disallowClassicalAfter: timeline.disallowAfter,\n    transitionDeadline: opts.policy?.transitionDeadline ?? null,\n    citation: timeline.source,\n  };\n\n  const manifest: CryptoAgilityManifest = {\n    version: CRYPTO_AGILITY_MANIFEST_VERSION,\n    manifestType: \"crypto-agility\",\n    generatedAt: opts.generatedAt,\n    generator: { name: \"qScan\", version: result.toolVersion || VERSION },\n    subject: {\n      root: result.root,\n      repository: opts.repository ?? null,\n      commit: opts.commit ?? null,\n    },\n    posture: {\n      readinessScore: inv.readinessScore,\n      hybridKexInUse: opts.hybridKexInUse ?? null,\n      quantumVulnerable: {\n        total: result.findings.length,\n        bySeverity,\n      },\n      hndlExposedCount: inv.hndlCount,\n    },\n    cbomSummary: {\n      serialNumber: cbom.serialNumber,\n      assetCount: cbom.components.length,\n      algorithmFamilies,\n    },\n    ...(opts.attestationUrl ? { attestation: { url: opts.attestationUrl } } : {}),\n    policy,\n  };\n  return manifest;\n}\n\n/** Outcome of {@link validateCryptoAgilityManifest}. */\nexport interface ManifestValidation {\n  /** True when the value satisfies the manifest schema. */\n  valid: boolean;\n  /** One human-readable message per problem found (empty when `valid`). */\n  errors: string[];\n}\n\n/** True for a plain (non-array, non-null) object. */\nfunction isObject(v: unknown): v is Record<string, unknown> {\n  return typeof v === \"object\" && v !== null && !Array.isArray(v);\n}\n\n/**\n * Validate an untrusted value against the crypto-agility manifest schema.\n *\n * Checks structure, required fields, types, and the schema version. Purely local:\n * it parses an already-in-memory value and NEVER performs I/O or network fetches;\n * a fetch-and-validate of a remote manifest is a website-side concern, deliberately\n * kept out of this offline-boundary tool. Returns every problem it finds rather than\n * throwing on the first, so a caller can report them all at once.\n */\nexport function validateCryptoAgilityManifest(value: unknown): ManifestValidation {\n  const errors: string[] = [];\n  const err = (m: string): void => void errors.push(m);\n\n  if (!isObject(value)) {\n    return { valid: false, errors: [\"manifest must be a JSON object\"] };\n  }\n\n  // version\n  if (value.version === undefined) {\n    err(\"missing required field: version\");\n  } else if (typeof value.version !== \"number\" || !Number.isInteger(value.version)) {\n    err(\"version must be an integer\");\n  } else if (value.version !== CRYPTO_AGILITY_MANIFEST_VERSION) {\n    err(\n      `unsupported version ${value.version} (this validator understands version ${CRYPTO_AGILITY_MANIFEST_VERSION})`,\n    );\n  }\n\n  // manifestType\n  if (value.manifestType === undefined) {\n    err(\"missing required field: manifestType\");\n  } else if (value.manifestType !== \"crypto-agility\") {\n    err('manifestType must be the string \"crypto-agility\"');\n  }\n\n  // generatedAt\n  if (value.generatedAt === undefined) {\n    err(\"missing required field: generatedAt\");\n  } else if (typeof value.generatedAt !== \"string\" || value.generatedAt.length === 0) {\n    err(\"generatedAt must be a non-empty ISO 8601 string\");\n  } else if (Number.isNaN(Date.parse(value.generatedAt))) {\n    err(\"generatedAt must be a parseable ISO 8601 timestamp\");\n  }\n\n  // generator\n  if (value.generator === undefined) {\n    err(\"missing required field: generator\");\n  } else if (!isObject(value.generator)) {\n    err(\"generator must be an object\");\n  } else {\n    if (typeof value.generator.name !== \"string\") err(\"generator.name must be a string\");\n    if (typeof value.generator.version !== \"string\") err(\"generator.version must be a string\");\n  }\n\n  // subject\n  if (value.subject === undefined) {\n    err(\"missing required field: subject\");\n  } else if (!isObject(value.subject)) {\n    err(\"subject must be an object\");\n  } else {\n    if (typeof value.subject.root !== \"string\") err(\"subject.root must be a string\");\n    if (value.subject.repository !== null && typeof value.subject.repository !== \"string\") {\n      err(\"subject.repository must be a string or null\");\n    }\n    if (value.subject.commit !== null && typeof value.subject.commit !== \"string\") {\n      err(\"subject.commit must be a string or null\");\n    }\n  }\n\n  // posture\n  validatePosture(value.posture, err);\n\n  // cbomSummary\n  validateCbomSummary(value.cbomSummary, err);\n\n  // attestation (optional)\n  if (value.attestation !== undefined) {\n    if (!isObject(value.attestation)) {\n      err(\"attestation must be an object when present\");\n    } else if (typeof value.attestation.url !== \"string\" || value.attestation.url.length === 0) {\n      err(\"attestation.url must be a non-empty string\");\n    }\n  }\n\n  // policy\n  validatePolicy(value.policy, err);\n\n  return { valid: errors.length === 0, errors };\n}\n\n/** Validate the `posture` block. */\nfunction validatePosture(posture: unknown, err: (m: string) => void): void {\n  if (posture === undefined) {\n    err(\"missing required field: posture\");\n    return;\n  }\n  if (!isObject(posture)) {\n    err(\"posture must be an object\");\n    return;\n  }\n  if (\n    typeof posture.readinessScore !== \"number\" ||\n    posture.readinessScore < 0 ||\n    posture.readinessScore > 100\n  ) {\n    err(\"posture.readinessScore must be a number between 0 and 100\");\n  }\n  if (posture.hybridKexInUse !== null && typeof posture.hybridKexInUse !== \"boolean\") {\n    err(\"posture.hybridKexInUse must be a boolean or null\");\n  }\n  if (typeof posture.hndlExposedCount !== \"number\" || posture.hndlExposedCount < 0) {\n    err(\"posture.hndlExposedCount must be a non-negative number\");\n  }\n  const qv = posture.quantumVulnerable;\n  if (!isObject(qv)) {\n    err(\"posture.quantumVulnerable must be an object\");\n    return;\n  }\n  if (typeof qv.total !== \"number\" || qv.total < 0) {\n    err(\"posture.quantumVulnerable.total must be a non-negative number\");\n  }\n  if (!isObject(qv.bySeverity)) {\n    err(\"posture.quantumVulnerable.bySeverity must be an object\");\n  } else {\n    for (const sev of SEVERITY_ORDER) {\n      if (typeof qv.bySeverity[sev] !== \"number\") {\n        err(`posture.quantumVulnerable.bySeverity.${sev} must be a number`);\n      }\n    }\n  }\n}\n\n/** Validate the `cbomSummary` block. */\nfunction validateCbomSummary(summary: unknown, err: (m: string) => void): void {\n  if (summary === undefined) {\n    err(\"missing required field: cbomSummary\");\n    return;\n  }\n  if (!isObject(summary)) {\n    err(\"cbomSummary must be an object\");\n    return;\n  }\n  if (typeof summary.serialNumber !== \"string\") err(\"cbomSummary.serialNumber must be a string\");\n  if (typeof summary.assetCount !== \"number\" || summary.assetCount < 0) {\n    err(\"cbomSummary.assetCount must be a non-negative number\");\n  }\n  if (!Array.isArray(summary.algorithmFamilies)) {\n    err(\"cbomSummary.algorithmFamilies must be an array\");\n    return;\n  }\n  summary.algorithmFamilies.forEach((fam, i) => {\n    if (!isObject(fam)) {\n      err(`cbomSummary.algorithmFamilies[${i}] must be an object`);\n      return;\n    }\n    if (typeof fam.family !== \"string\")\n      err(`cbomSummary.algorithmFamilies[${i}].family must be a string`);\n    if (typeof fam.count !== \"number\" || fam.count < 0) {\n      err(`cbomSummary.algorithmFamilies[${i}].count must be a non-negative number`);\n    }\n    if (typeof fam.quantumVulnerable !== \"boolean\") {\n      err(`cbomSummary.algorithmFamilies[${i}].quantumVulnerable must be a boolean`);\n    }\n  });\n}\n\n/** Validate the `policy` block. */\nfunction validatePolicy(policy: unknown, err: (m: string) => void): void {\n  if (policy === undefined) {\n    err(\"missing required field: policy\");\n    return;\n  }\n  if (!isObject(policy)) {\n    err(\"policy must be an object\");\n    return;\n  }\n  if (typeof policy.source !== \"string\") err(\"policy.source must be a string\");\n  if (typeof policy.deprecateClassicalAfter !== \"number\") {\n    err(\"policy.deprecateClassicalAfter must be a number (year)\");\n  }\n  if (typeof policy.disallowClassicalAfter !== \"number\") {\n    err(\"policy.disallowClassicalAfter must be a number (year)\");\n  }\n  if (policy.transitionDeadline !== null && typeof policy.transitionDeadline !== \"string\") {\n    err(\"policy.transitionDeadline must be a string or null\");\n  }\n  if (typeof policy.citation !== \"string\") err(\"policy.citation must be a string\");\n}\n"]}

package/dist/dependencies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dependencies.d.ts","sourceRoot":"","sources":["../src/dependencies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAEV,mBAAmB,EACnB,OAAO,EACP,QAAQ,EACR,oBAAoB,EACrB,MAAM,YAAY,CAAC;AAKpB;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAkBjC,CAAC;AAEF,iDAAiD;AACjD,eAAO,MAAM,sBAAsB,EAAE,oBAAoB,EA0jBxD,CAAC;AAuEF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI,CAoB1E;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAuID;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,EAAE,CAyBrE"}
+{"version":3,"file":"dependencies.d.ts","sourceRoot":"","sources":["../src/dependencies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAEV,mBAAmB,EACnB,OAAO,EACP,QAAQ,EACR,oBAAoB,EACrB,MAAM,YAAY,CAAC;AAKpB;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAkBjC,CAAC;AAEF,iDAAiD;AACjD,eAAO,MAAM,sBAAsB,EAAE,oBAAoB,EA6pBxD,CAAC;AAwEF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI,CAqB1E;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAqJD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,EAAE,CAyBrE"}