@quantakrypto/core 0.5.0 → 0.6.0

package/dist/walk.js.map

@@ -1 +1 @@
-{"version":3,"file":"walk.js","sourceRoot":"","sources":["../src/walk.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,8EAA8E;AAC9E,MAAM,eAAe,GAAsB;IACzC,cAAc;IACd,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,KAAK;IACL,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,QAAQ;CACT,CAAC;AAEF,gDAAgD;AAChD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAErD;;;GAGG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAS;IACxC,SAAS;IACT,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,MAAM;IACN,MAAM;IACN,MAAM;IACN,wBAAwB;IACxB,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,MAAM;IACN,MAAM;IACN,QAAQ;IACR,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,uBAAuB;IACvB,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,KAAK;IACL,QAAQ;IACR,MAAM;IACN,IAAI;IACJ,IAAI;IACJ,QAAQ;IACR,OAAO;IACP,kBAAkB;IAClB,KAAK;IACL,SAAS;IACT,UAAU;IACV,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,OAAO;IACP,MAAM;IACN,SAAS;IACT,OAAO;CACR,CAAC,CAAC;AAiBH,0DAA0D;AAC1D,MAAM,UAAU,OAAO,CAAC,CAAS;IAC/B,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACrC,CAAC;AAED,mFAAmF;AACnF,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACxB,CAAC,EAAE,CAAC,CAAC,yBAAyB;gBAC9B,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBACxB,CAAC,EAAE,CAAC,CAAC,2BAA2B;oBAChC,EAAE,IAAI,UAAU,CAAC,CAAC,6BAA6B;gBACjD,CAAC;qBAAM,CAAC;oBACN,EAAE,IAAI,IAAI,CAAC,CAAC,yBAAyB;gBACvC,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,EAAE,IAAI,OAAO,CAAC,CAAC,uBAAuB;YACxC,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,EAAE,IAAI,MAAM,CAAC;QACf,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,wDAAwD;YACxD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACrC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;gBACf,EAAE,IAAI,KAAK,CAAC;YACd,CAAC;iBAAM,CAAC;gBACN,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;gBAC7B,CAAC,GAAG,GAAG,CAAC;YACV,CAAC;QACH,CAAC;aAAM,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,EAAE,IAAI,IAAI,GAAG,CAAC,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,EAAE,IAAI,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;AAC7C,SAAS,UAAU,CAAC,OAAe;IACjC,IAAI,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QAC3B,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,QAA2B;IACjE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YACnB,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzC,SAAS;QACX,CAAC;QACD,wEAAwE;QACxE,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACjC,uEAAuE;QACvE,IAAI,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yEAAyE;AACzE,SAAS,UAAU,CAAC,GAAW,EAAE,OAA0B;IACzD,OAAO,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,GAAW,EAAE,OAA0B;IACzD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,mDAAmD;IACnD,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAS;IAC1C,MAAM;IACN,WAAW;IACX,QAAQ;IACR,MAAM;IACN,MAAM;IACN,MAAM;IACN,gFAAgF;IAChF,MAAM;IACN,MAAM;IACN,MAAM;CACP,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,mBAAmB;QAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IAC5E,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,iBAAiB,GACrB,gHAAgH,CAAC;AAEnH,wEAAwE;AACxE,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC5E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC;YACzC,IAAI,GAAG,GAAG,OAAO;gBAAE,OAAO,GAAG,GAAG,CAAC;YACjC,GAAG,GAAG,CAAC,CAAC;YACR,KAAK,EAAE,CAAC;QACV,CAAC;aAAM,CAAC;YACN,GAAG,EAAE,CAAC;QACR,CAAC;IACH,CAAC;IACD,IAAI,GAAG,GAAG,OAAO;QAAE,OAAO,GAAG,GAAG,CAAC;IACjC,IAAI,OAAO,GAAG,MAAM;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC;IACtC,OAAO,OAAO,GAAG,KAAK,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,SAAS,CAAC,IAAY,EAAE,UAAuB,EAAE;IACtE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,qBAAqB,CAAC;IACjE,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;IAEhE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IAElC,8EAA8E;IAC9E,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,IACE,CAAC,YAAY,CAAC,IAAI,CAAC;YACnB,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC;YACzB,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,EACjD,CAAC;YACD,MAAM,IAAI,CAAC;QACb,CAAC;QACD,OAAO;IACT,CAAC;IAED,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;AACvE,CAAC;AASD;;;;GAIG;AACH,SAAS,eAAe,CAAC,GAAW,EAAE,IAAY,EAAE,WAAmB;IACrE,+EAA+E;IAC/E,iFAAiF;IACjF,IAAI,cAAc,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,OAAO,IAAI,IAAI,WAAW,CAAC;AAC7B,CAAC;AAED,mFAAmF;AACnF,KAAK,SAAS,CAAC,CAAC,OAAO,CAAC,MAAc,EAAE,MAAc,EAAE,GAAgB;IACtE,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,OAAO;IACT,CAAC;IAED,yDAAyD;IACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEzE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAE1C,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;YAC3B,8DAA8D;YAC9D,SAAS;QACX,CAAC;QAED,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC/C,IAAI,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC;gBAAE,SAAS;YAC3C,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YAC9B,SAAS;QACX,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,SAAS;QAC9B,IAAI,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAC3C,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAC5C,4EAA4E;QAC5E,8EAA8E;QAC9E,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,GAAG,CAAC;YAAE,SAAS;QAC7C,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC;YAAE,SAAS;QAEhD,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,WAAW,CAAC;gBAAE,SAAS;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC","sourcesContent":["/**\n * Filesystem walker. A zero-dependency recursive async generator that yields\n * scannable text files as relative POSIX paths. It honours a default ignore\n * list, user-supplied exclude patterns, a max file size, and a binary-extension\n * filter. The root may be a directory or a single file.\n */\nimport { readdir, stat } from \"node:fs/promises\";\nimport type { Dirent } from \"node:fs\";\nimport * as path from \"node:path\";\n\nimport { isManifestFile } from \"./dependencies.js\";\n\n/** Directories ignored by default (can be disabled with noDefaultIgnores). */\nconst DEFAULT_IGNORES: readonly string[] = [\n  \"node_modules\",\n  \".git\",\n  \"dist\",\n  \"build\",\n  \".next\",\n  \"out\",\n  \"coverage\",\n  \"vendor\",\n  \".turbo\",\n  \".cache\",\n];\n\n/** Default maximum file size to read: 2 MiB. */\nexport const DEFAULT_MAX_FILE_SIZE = 2 * 1024 * 1024;\n\n/**\n * File extensions we treat as binary / non-text and therefore skip. Keeping this\n * as an extension allow-list-by-exclusion is cheap and avoids reading bytes.\n */\nconst BINARY_EXTENSIONS = new Set<string>([\n  // images\n  \".png\",\n  \".jpg\",\n  \".jpeg\",\n  \".gif\",\n  \".webp\",\n  \".bmp\",\n  \".ico\",\n  \".tiff\",\n  \".avif\",\n  // fonts\n  \".woff\",\n  \".woff2\",\n  \".ttf\",\n  \".otf\",\n  \".eot\",\n  // archives / compressed\n  \".zip\",\n  \".gz\",\n  \".tgz\",\n  \".bz2\",\n  \".xz\",\n  \".7z\",\n  \".rar\",\n  \".tar\",\n  // media\n  \".mp3\",\n  \".mp4\",\n  \".mov\",\n  \".avi\",\n  \".mkv\",\n  \".wav\",\n  \".flac\",\n  \".ogg\",\n  \".webm\",\n  // documents / binaries\n  \".pdf\",\n  \".doc\",\n  \".docx\",\n  \".xls\",\n  \".xlsx\",\n  \".ppt\",\n  \".pptx\",\n  \".exe\",\n  \".dll\",\n  \".so\",\n  \".dylib\",\n  \".bin\",\n  \".o\",\n  \".a\",\n  \".class\",\n  \".wasm\",\n  // data blobs / db\n  \".db\",\n  \".sqlite\",\n  \".sqlite3\",\n  \".dat\",\n  \".pack\",\n  \".idx\",\n  // misc\n  \".lock\",\n  \".map\",\n  \".min.js\",\n  \".node\",\n]);\n\n/** Options accepted by {@link walkFiles}. */\ninterface WalkOptions {\n  /**\n   * Restrict to paths matching one of these include patterns (substring or\n   * relative-path-prefix match). When omitted/empty, all files pass.\n   */\n  include?: string[];\n  /** Extra exclude patterns (substring or relative-path-prefix match). */\n  exclude?: string[];\n  /** Disable the built-in directory ignore list. */\n  noDefaultIgnores?: boolean;\n  /** Max file size in bytes; larger files are skipped. */\n  maxFileSize?: number;\n}\n\n/** Normalise a path to forward-slash POSIX separators. */\nexport function toPosix(p: string): string {\n  return p.split(path.sep).join(\"/\");\n}\n\n/** A pattern is treated as a glob when it contains one of these metacharacters. */\nfunction hasGlobMeta(pattern: string): boolean {\n  return /[*?[]/.test(pattern);\n}\n\n/**\n * Translate a glob into an anchored RegExp: `*` matches within a path segment\n * (not `/`), `**` matches across segments, a leading `**` before a slash is an\n * optional path prefix, `?` matches a single non-`/` char, `[...]` is a\n * character class. Other regex\n * metacharacters are escaped.\n */\nfunction globToRegExp(glob: string): RegExp {\n  let re = \"\";\n  for (let i = 0; i < glob.length; i++) {\n    const c = glob[i];\n    if (c === \"*\") {\n      if (glob[i + 1] === \"*\") {\n        i++; // consume the second '*'\n        if (glob[i + 1] === \"/\") {\n          i++; // consume the trailing '/'\n          re += \"(?:.*/)?\"; // zero or more path segments\n        } else {\n          re += \".*\"; // '**' spanning segments\n        }\n      } else {\n        re += \"[^/]*\"; // '*' within a segment\n      }\n    } else if (c === \"?\") {\n      re += \"[^/]\";\n    } else if (c === \"[\") {\n      // Pass a character class through; find its closing ']'.\n      const end = glob.indexOf(\"]\", i + 1);\n      if (end === -1) {\n        re += \"\\\\[\";\n      } else {\n        re += glob.slice(i, end + 1);\n        i = end;\n      }\n    } else if (\"\\\\^$.|+(){}\".includes(c)) {\n      re += \"\\\\\" + c;\n    } else {\n      re += c;\n    }\n  }\n  return new RegExp(`^${re}$`);\n}\n\n/** Memoized glob→RegExp so a pattern is compiled once, not once per file. */\nconst GLOB_CACHE = new Map<string, RegExp>();\nfunction globRegExp(pattern: string): RegExp {\n  let re = GLOB_CACHE.get(pattern);\n  if (!re) {\n    re = globToRegExp(pattern);\n    GLOB_CACHE.set(pattern, re);\n  }\n  return re;\n}\n\n/**\n * True if `rel` (a POSIX relative path) matches any pattern. A pattern with a\n * glob metacharacter (`*`, `?`, `[`) is matched as an anchored glob; a plain\n * pattern keeps the historical substring / path-prefix semantics (so `\"src\"`\n * still matches `src/a.ts` and `\"secrets\"` matches anywhere).\n */\nexport function matchesAny(rel: string, patterns: readonly string[]): boolean {\n  for (const pattern of patterns) {\n    if (!pattern) continue;\n    const p = toPosix(pattern).replace(/\\/+$/, \"\");\n    if (hasGlobMeta(p)) {\n      if (globRegExp(p).test(rel)) return true;\n      continue;\n    }\n    // Plain pattern: substring match (handles \"src/legacy\" or \"secrets\")...\n    if (rel.includes(p)) return true;\n    // ...and explicit path-prefix match (\"foo\" should match \"foo/bar.ts\").\n    if (rel === p || rel.startsWith(`${p}/`)) return true;\n  }\n  return false;\n}\n\n/** True if `rel` (a POSIX relative path) matches any exclude pattern. */\nfunction isExcluded(rel: string, exclude: readonly string[]): boolean {\n  return matchesAny(rel, exclude);\n}\n\n/**\n * True if `rel` passes the include filter. An empty include list means \"include\n * everything\"; otherwise the file must match at least one include pattern.\n */\nfunction isIncluded(rel: string, include: readonly string[]): boolean {\n  if (include.length === 0) return true;\n  return matchesAny(rel, include);\n}\n\n/** True if the file's extension marks it as binary / non-text. */\nexport function isBinaryPath(rel: string): boolean {\n  const lower = rel.toLowerCase();\n  // Handle compound extensions like \".min.js\" first.\n  if (lower.endsWith(\".min.js\")) return true;\n  const ext = path.posix.extname(lower);\n  return BINARY_EXTENSIONS.has(ext);\n}\n\n/**\n * Binary cryptographic key containers we DO want to scan — Java/PKCS#12 keystores\n * and binary OpenPGP keyrings/messages. Unlike the images/archives above these are\n * read byte-preserving (latin1) and exempted from the minified skip, so the\n * keystore + openpgp detectors can identify them by magic number / packet tag.\n * Kept separate from {@link BINARY_EXTENSIONS} so those detectors can opt in.\n */\nconst KEYSTORE_EXTENSIONS = new Set<string>([\n  \".jks\",\n  \".keystore\",\n  \".jceks\",\n  \".bks\",\n  \".p12\",\n  \".pfx\",\n  // Binary OpenPGP keyrings / messages (armored .asc is text; handled elsewhere).\n  \".gpg\",\n  \".pgp\",\n  \".kbx\",\n]);\n\n/**\n * True if the path is a binary cryptographic key container we scan byte-preserving.\n * Uses a suffix match (not `extname`) so it agrees with the detectors' `hasExtension`\n * even for a bare dotfile literally named e.g. `.gpg` (where `extname` returns \"\").\n */\nexport function isKeystorePath(rel: string): boolean {\n  const lower = rel.toLowerCase();\n  for (const ext of KEYSTORE_EXTENSIONS) if (lower.endsWith(ext)) return true;\n  return false;\n}\n\n/**\n * Compound / pattern extensions that mark generated or bundled output we skip\n * by default (beyond `.min.js` / `.map`, which {@link isBinaryPath} handles).\n */\nconst GENERATED_PATH_RE =\n  /(?:\\.min\\.[mc]?js|[.-]min\\.[mc]?js|\\.bundle\\.[mc]?js|\\.chunk\\.[mc]?js|\\.generated\\.[jt]sx?|_pb\\.js|\\.pb\\.go)$/i;\n\n/** True if the path looks like generated / bundled output (by name). */\nexport function isGeneratedPath(rel: string): boolean {\n  return GENERATED_PATH_RE.test(rel.toLowerCase());\n}\n\n/**\n * Heuristic content check for machine-minified / generated files with no\n * telltale extension: a very long average line length, or any single line over\n * ~50 KB, in the first ~64 KB sampled. Used at read time, not in the walker.\n */\nexport function looksMinified(content: string): boolean {\n  const sample = content.length > 65_536 ? content.slice(0, 65_536) : content;\n  if (sample.length === 0) return false;\n  let maxLine = 0;\n  let cur = 0;\n  let lines = 1;\n  for (let i = 0; i < sample.length; i++) {\n    if (sample.charCodeAt(i) === 10 /* \\n */) {\n      if (cur > maxLine) maxLine = cur;\n      cur = 0;\n      lines++;\n    } else {\n      cur++;\n    }\n  }\n  if (cur > maxLine) maxLine = cur;\n  if (maxLine > 50_000) return true;\n  const avgLine = sample.length / lines;\n  return avgLine > 1_000;\n}\n\n/**\n * Recursively yield scannable file paths (relative to `root`, POSIX) under a\n * directory. If `root` points at a single file, yields just that file's\n * basename (subject to the size / binary filters).\n */\nexport async function* walkFiles(root: string, options: WalkOptions = {}): AsyncGenerator<string> {\n  const include = options.include ?? [];\n  const exclude = options.exclude ?? [];\n  const maxFileSize = options.maxFileSize ?? DEFAULT_MAX_FILE_SIZE;\n  const ignores = options.noDefaultIgnores ? [] : DEFAULT_IGNORES;\n\n  const rootStat = await stat(root);\n\n  // Single-file mode: yield the file itself (by basename) if it passes filters.\n  if (rootStat.isFile()) {\n    const name = toPosix(path.basename(root));\n    if (\n      !isBinaryPath(name) &&\n      isIncluded(name, include) &&\n      passesSizeLimit(name, rootStat.size, maxFileSize)\n    ) {\n      yield name;\n    }\n    return;\n  }\n\n  yield* walkDir(root, \"\", { include, exclude, maxFileSize, ignores });\n}\n\ninterface WalkContext {\n  include: readonly string[];\n  exclude: readonly string[];\n  maxFileSize: number;\n  ignores: readonly string[];\n}\n\n/**\n * True if a file passes the size limit. Dependency manifests (package.json /\n * package-lock.json) are exempt from the cap so large lockfiles still get\n * scanned for vulnerable dependencies instead of being silently dropped.\n */\nfunction passesSizeLimit(rel: string, size: number, maxFileSize: number): boolean {\n  // Dependency manifests are always read (they can exceed the size cap but carry\n  // the whole dependency tree). Uses the single {@link isManifestFile} definition.\n  if (isManifestFile(rel)) return true;\n  return size <= maxFileSize;\n}\n\n/** Internal recursive directory walker. `relDir` is POSIX-relative to the root. */\nasync function* walkDir(absDir: string, relDir: string, ctx: WalkContext): AsyncGenerator<string> {\n  let entries: Dirent[];\n  try {\n    entries = await readdir(absDir, { withFileTypes: true });\n  } catch {\n    // Unreadable directory (permissions, transient races) — skip silently.\n    return;\n  }\n\n  // Stable, deterministic ordering for reproducible scans.\n  entries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));\n\n  for (const entry of entries) {\n    const rel = relDir ? `${relDir}/${entry.name}` : entry.name;\n    const abs = path.join(absDir, entry.name);\n\n    if (entry.isSymbolicLink()) {\n      // Don't follow symlinks: avoids cycles and escaping the root.\n      continue;\n    }\n\n    if (entry.isDirectory()) {\n      if (ctx.ignores.includes(entry.name)) continue;\n      if (isExcluded(rel, ctx.exclude)) continue;\n      yield* walkDir(abs, rel, ctx);\n      continue;\n    }\n\n    if (!entry.isFile()) continue;\n    if (isExcluded(rel, ctx.exclude)) continue;\n    if (!isIncluded(rel, ctx.include)) continue;\n    // Dependency manifests (incl. yarn.lock / pnpm-lock.yaml) are always read —\n    // they carry the dependency tree and must not be dropped as binary/generated.\n    const manifest = isManifestFile(rel);\n    if (!manifest && isBinaryPath(rel)) continue;\n    if (!manifest && isGeneratedPath(rel)) continue;\n\n    try {\n      const s = await stat(abs);\n      if (!passesSizeLimit(rel, s.size, ctx.maxFileSize)) continue;\n    } catch {\n      continue;\n    }\n\n    yield rel;\n  }\n}\n"]}
+{"version":3,"file":"walk.js","sourceRoot":"","sources":["../src/walk.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,8EAA8E;AAC9E,MAAM,eAAe,GAAsB;IACzC,cAAc;IACd,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,KAAK;IACL,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,QAAQ;CACT,CAAC;AAEF,gDAAgD;AAChD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAErD;;;GAGG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAS;IACxC,SAAS;IACT,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,MAAM;IACN,MAAM;IACN,MAAM;IACN,wBAAwB;IACxB,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,MAAM;IACN,MAAM;IACN,QAAQ;IACR,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,uBAAuB;IACvB,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,KAAK;IACL,QAAQ;IACR,MAAM;IACN,IAAI;IACJ,IAAI;IACJ,QAAQ;IACR,OAAO;IACP,kBAAkB;IAClB,KAAK;IACL,SAAS;IACT,UAAU;IACV,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,OAAO;IACP,MAAM;IACN,SAAS;IACT,OAAO;CACR,CAAC,CAAC;AAiBH,0DAA0D;AAC1D,MAAM,UAAU,OAAO,CAAC,CAAS;IAC/B,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACrC,CAAC;AAED,mFAAmF;AACnF,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,EAAE,GAAG,EAAE,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACxB,CAAC,EAAE,CAAC,CAAC,yBAAyB;gBAC9B,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBACxB,CAAC,EAAE,CAAC,CAAC,2BAA2B;oBAChC,EAAE,IAAI,UAAU,CAAC,CAAC,6BAA6B;gBACjD,CAAC;qBAAM,CAAC;oBACN,EAAE,IAAI,IAAI,CAAC,CAAC,yBAAyB;gBACvC,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,EAAE,IAAI,OAAO,CAAC,CAAC,uBAAuB;YACxC,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,EAAE,IAAI,MAAM,CAAC;QACf,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,wDAAwD;YACxD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACrC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;gBACf,EAAE,IAAI,KAAK,CAAC;YACd,CAAC;iBAAM,CAAC;gBACN,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC;gBAC7B,CAAC,GAAG,GAAG,CAAC;YACV,CAAC;QACH,CAAC;aAAM,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,EAAE,IAAI,IAAI,GAAG,CAAC,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,EAAE,IAAI,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;AAC7C,SAAS,UAAU,CAAC,OAAe;IACjC,IAAI,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QAC3B,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,QAA2B;IACjE,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YACnB,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzC,SAAS;QACX,CAAC;QACD,wEAAwE;QACxE,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACjC,uEAAuE;QACvE,IAAI,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yEAAyE;AACzE,SAAS,UAAU,CAAC,GAAW,EAAE,OAA0B;IACzD,OAAO,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,GAAW,EAAE,OAA0B;IACzD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;AAClC,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,mDAAmD;IACnD,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAS;IAC1C,MAAM;IACN,WAAW;IACX,QAAQ;IACR,MAAM;IACN,MAAM;IACN,MAAM;IACN,gFAAgF;IAChF,MAAM;IACN,MAAM;IACN,MAAM;CACP,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,mBAAmB;QAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IAC5E,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,iBAAiB,GACrB,gHAAgH,CAAC;AAEnH,wEAAwE;AACxE,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC5E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC;YACzC,IAAI,GAAG,GAAG,OAAO;gBAAE,OAAO,GAAG,GAAG,CAAC;YACjC,GAAG,GAAG,CAAC,CAAC;YACR,KAAK,EAAE,CAAC;QACV,CAAC;aAAM,CAAC;YACN,GAAG,EAAE,CAAC;QACR,CAAC;IACH,CAAC;IACD,IAAI,GAAG,GAAG,OAAO;QAAE,OAAO,GAAG,GAAG,CAAC;IACjC,IAAI,OAAO,GAAG,MAAM;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC;IACtC,OAAO,OAAO,GAAG,KAAK,CAAC;AACzB,CAAC;AAUD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,SAAS,CAAC,IAAY,EAAE,UAAuB,EAAE;IACtE,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC;QAAE,MAAM,CAAC,CAAC,GAAG,CAAC;AACnE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,cAAc,CACnC,IAAY,EACZ,UAAuB,EAAE;IAEzB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,qBAAqB,CAAC;IACjE,MAAM,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;IAEhE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IAElC,8EAA8E;IAC9E,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,IACE,CAAC,YAAY,CAAC,IAAI,CAAC;YACnB,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC;YACzB,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,EACjD,CAAC;YACD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC3C,CAAC;QACD,OAAO;IACT,CAAC;IAED,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;AACvE,CAAC;AASD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,IAAY,EAAE,WAAmB;IAC5E,qDAAqD;IACrD,IAAI,cAAc,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,IAAI,kBAAkB,CAAC;IAC3D,OAAO,IAAI,IAAI,WAAW,CAAC;AAC7B,CAAC;AAED,mFAAmF;AACnF,KAAK,SAAS,CAAC,CAAC,OAAO,CACrB,MAAc,EACd,MAAc,EACd,GAAgB;IAEhB,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,OAAO;IACT,CAAC;IAED,yDAAyD;IACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEzE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAE1C,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;YAC3B,8DAA8D;YAC9D,SAAS;QACX,CAAC;QAED,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC/C,IAAI,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC;gBAAE,SAAS;YAC3C,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YAC9B,SAAS;QACX,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,SAAS;QAC9B,IAAI,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAC3C,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAC5C,4EAA4E;QAC5E,8EAA8E;QAC9E,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,GAAG,CAAC;YAAE,SAAS;QAC7C,IAAI,CAAC,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC;YAAE,SAAS;QAEhD,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,WAAW,CAAC;gBAAE,SAAS;YAC7D,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;AACH,CAAC","sourcesContent":["/**\n * Filesystem walker. A zero-dependency recursive async generator that yields\n * scannable text files as relative POSIX paths. It honours a default ignore\n * list, user-supplied exclude patterns, a max file size, and a binary-extension\n * filter. The root may be a directory or a single file.\n */\nimport { readdir, stat } from \"node:fs/promises\";\nimport type { Dirent } from \"node:fs\";\nimport * as path from \"node:path\";\n\nimport { isManifestFile } from \"./dependencies.js\";\n\n/** Directories ignored by default (can be disabled with noDefaultIgnores). */\nconst DEFAULT_IGNORES: readonly string[] = [\n  \"node_modules\",\n  \".git\",\n  \"dist\",\n  \"build\",\n  \".next\",\n  \"out\",\n  \"coverage\",\n  \"vendor\",\n  \".turbo\",\n  \".cache\",\n];\n\n/** Default maximum file size to read: 2 MiB. */\nexport const DEFAULT_MAX_FILE_SIZE = 2 * 1024 * 1024;\n\n/**\n * File extensions we treat as binary / non-text and therefore skip. Keeping this\n * as an extension allow-list-by-exclusion is cheap and avoids reading bytes.\n */\nconst BINARY_EXTENSIONS = new Set<string>([\n  // images\n  \".png\",\n  \".jpg\",\n  \".jpeg\",\n  \".gif\",\n  \".webp\",\n  \".bmp\",\n  \".ico\",\n  \".tiff\",\n  \".avif\",\n  // fonts\n  \".woff\",\n  \".woff2\",\n  \".ttf\",\n  \".otf\",\n  \".eot\",\n  // archives / compressed\n  \".zip\",\n  \".gz\",\n  \".tgz\",\n  \".bz2\",\n  \".xz\",\n  \".7z\",\n  \".rar\",\n  \".tar\",\n  // media\n  \".mp3\",\n  \".mp4\",\n  \".mov\",\n  \".avi\",\n  \".mkv\",\n  \".wav\",\n  \".flac\",\n  \".ogg\",\n  \".webm\",\n  // documents / binaries\n  \".pdf\",\n  \".doc\",\n  \".docx\",\n  \".xls\",\n  \".xlsx\",\n  \".ppt\",\n  \".pptx\",\n  \".exe\",\n  \".dll\",\n  \".so\",\n  \".dylib\",\n  \".bin\",\n  \".o\",\n  \".a\",\n  \".class\",\n  \".wasm\",\n  // data blobs / db\n  \".db\",\n  \".sqlite\",\n  \".sqlite3\",\n  \".dat\",\n  \".pack\",\n  \".idx\",\n  // misc\n  \".lock\",\n  \".map\",\n  \".min.js\",\n  \".node\",\n]);\n\n/** Options accepted by {@link walkFiles}. */\ninterface WalkOptions {\n  /**\n   * Restrict to paths matching one of these include patterns (substring or\n   * relative-path-prefix match). When omitted/empty, all files pass.\n   */\n  include?: string[];\n  /** Extra exclude patterns (substring or relative-path-prefix match). */\n  exclude?: string[];\n  /** Disable the built-in directory ignore list. */\n  noDefaultIgnores?: boolean;\n  /** Max file size in bytes; larger files are skipped. */\n  maxFileSize?: number;\n}\n\n/** Normalise a path to forward-slash POSIX separators. */\nexport function toPosix(p: string): string {\n  return p.split(path.sep).join(\"/\");\n}\n\n/** A pattern is treated as a glob when it contains one of these metacharacters. */\nfunction hasGlobMeta(pattern: string): boolean {\n  return /[*?[]/.test(pattern);\n}\n\n/**\n * Translate a glob into an anchored RegExp: `*` matches within a path segment\n * (not `/`), `**` matches across segments, a leading `**` before a slash is an\n * optional path prefix, `?` matches a single non-`/` char, `[...]` is a\n * character class. Other regex\n * metacharacters are escaped.\n */\nfunction globToRegExp(glob: string): RegExp {\n  let re = \"\";\n  for (let i = 0; i < glob.length; i++) {\n    const c = glob[i];\n    if (c === \"*\") {\n      if (glob[i + 1] === \"*\") {\n        i++; // consume the second '*'\n        if (glob[i + 1] === \"/\") {\n          i++; // consume the trailing '/'\n          re += \"(?:.*/)?\"; // zero or more path segments\n        } else {\n          re += \".*\"; // '**' spanning segments\n        }\n      } else {\n        re += \"[^/]*\"; // '*' within a segment\n      }\n    } else if (c === \"?\") {\n      re += \"[^/]\";\n    } else if (c === \"[\") {\n      // Pass a character class through; find its closing ']'.\n      const end = glob.indexOf(\"]\", i + 1);\n      if (end === -1) {\n        re += \"\\\\[\";\n      } else {\n        re += glob.slice(i, end + 1);\n        i = end;\n      }\n    } else if (\"\\\\^$.|+(){}\".includes(c)) {\n      re += \"\\\\\" + c;\n    } else {\n      re += c;\n    }\n  }\n  return new RegExp(`^${re}$`);\n}\n\n/** Memoized glob→RegExp so a pattern is compiled once, not once per file. */\nconst GLOB_CACHE = new Map<string, RegExp>();\nfunction globRegExp(pattern: string): RegExp {\n  let re = GLOB_CACHE.get(pattern);\n  if (!re) {\n    re = globToRegExp(pattern);\n    GLOB_CACHE.set(pattern, re);\n  }\n  return re;\n}\n\n/**\n * True if `rel` (a POSIX relative path) matches any pattern. A pattern with a\n * glob metacharacter (`*`, `?`, `[`) is matched as an anchored glob; a plain\n * pattern keeps the historical substring / path-prefix semantics (so `\"src\"`\n * still matches `src/a.ts` and `\"secrets\"` matches anywhere).\n */\nexport function matchesAny(rel: string, patterns: readonly string[]): boolean {\n  for (const pattern of patterns) {\n    if (!pattern) continue;\n    const p = toPosix(pattern).replace(/\\/+$/, \"\");\n    if (hasGlobMeta(p)) {\n      if (globRegExp(p).test(rel)) return true;\n      continue;\n    }\n    // Plain pattern: substring match (handles \"src/legacy\" or \"secrets\")...\n    if (rel.includes(p)) return true;\n    // ...and explicit path-prefix match (\"foo\" should match \"foo/bar.ts\").\n    if (rel === p || rel.startsWith(`${p}/`)) return true;\n  }\n  return false;\n}\n\n/** True if `rel` (a POSIX relative path) matches any exclude pattern. */\nfunction isExcluded(rel: string, exclude: readonly string[]): boolean {\n  return matchesAny(rel, exclude);\n}\n\n/**\n * True if `rel` passes the include filter. An empty include list means \"include\n * everything\"; otherwise the file must match at least one include pattern.\n */\nfunction isIncluded(rel: string, include: readonly string[]): boolean {\n  if (include.length === 0) return true;\n  return matchesAny(rel, include);\n}\n\n/** True if the file's extension marks it as binary / non-text. */\nexport function isBinaryPath(rel: string): boolean {\n  const lower = rel.toLowerCase();\n  // Handle compound extensions like \".min.js\" first.\n  if (lower.endsWith(\".min.js\")) return true;\n  const ext = path.posix.extname(lower);\n  return BINARY_EXTENSIONS.has(ext);\n}\n\n/**\n * Binary cryptographic key containers we DO want to scan — Java/PKCS#12 keystores\n * and binary OpenPGP keyrings/messages. Unlike the images/archives above these are\n * read byte-preserving (latin1) and exempted from the minified skip, so the\n * keystore + openpgp detectors can identify them by magic number / packet tag.\n * Kept separate from {@link BINARY_EXTENSIONS} so those detectors can opt in.\n */\nconst KEYSTORE_EXTENSIONS = new Set<string>([\n  \".jks\",\n  \".keystore\",\n  \".jceks\",\n  \".bks\",\n  \".p12\",\n  \".pfx\",\n  // Binary OpenPGP keyrings / messages (armored .asc is text; handled elsewhere).\n  \".gpg\",\n  \".pgp\",\n  \".kbx\",\n]);\n\n/**\n * True if the path is a binary cryptographic key container we scan byte-preserving.\n * Uses a suffix match (not `extname`) so it agrees with the detectors' `hasExtension`\n * even for a bare dotfile literally named e.g. `.gpg` (where `extname` returns \"\").\n */\nexport function isKeystorePath(rel: string): boolean {\n  const lower = rel.toLowerCase();\n  for (const ext of KEYSTORE_EXTENSIONS) if (lower.endsWith(ext)) return true;\n  return false;\n}\n\n/**\n * Compound / pattern extensions that mark generated or bundled output we skip\n * by default (beyond `.min.js` / `.map`, which {@link isBinaryPath} handles).\n */\nconst GENERATED_PATH_RE =\n  /(?:\\.min\\.[mc]?js|[.-]min\\.[mc]?js|\\.bundle\\.[mc]?js|\\.chunk\\.[mc]?js|\\.generated\\.[jt]sx?|_pb\\.js|\\.pb\\.go)$/i;\n\n/** True if the path looks like generated / bundled output (by name). */\nexport function isGeneratedPath(rel: string): boolean {\n  return GENERATED_PATH_RE.test(rel.toLowerCase());\n}\n\n/**\n * Heuristic content check for machine-minified / generated files with no\n * telltale extension: a very long average line length, or any single line over\n * ~50 KB, in the first ~64 KB sampled. Used at read time, not in the walker.\n */\nexport function looksMinified(content: string): boolean {\n  const sample = content.length > 65_536 ? content.slice(0, 65_536) : content;\n  if (sample.length === 0) return false;\n  let maxLine = 0;\n  let cur = 0;\n  let lines = 1;\n  for (let i = 0; i < sample.length; i++) {\n    if (sample.charCodeAt(i) === 10 /* \\n */) {\n      if (cur > maxLine) maxLine = cur;\n      cur = 0;\n      lines++;\n    } else {\n      cur++;\n    }\n  }\n  if (cur > maxLine) maxLine = cur;\n  if (maxLine > 50_000) return true;\n  const avgLine = sample.length / lines;\n  return avgLine > 1_000;\n}\n\n/** A scannable file plus the byte size the walker already stat'd for it. */\nexport interface WalkedFile {\n  /** Relative POSIX path from the walk root. */\n  rel: string;\n  /** File size in bytes (from the walker's own stat; never re-stat downstream). */\n  size: number;\n}\n\n/**\n * Recursively yield scannable file paths (relative to `root`, POSIX) under a\n * directory. If `root` points at a single file, yields just that file's\n * basename (subject to the size / binary filters). Thin wrapper over\n * {@link walkFilesSized} that drops the size (the historical string-yielding API).\n */\nexport async function* walkFiles(root: string, options: WalkOptions = {}): AsyncGenerator<string> {\n  for await (const f of walkFilesSized(root, options)) yield f.rel;\n}\n\n/**\n * Like {@link walkFiles} but yields each file WITH the byte size the walker\n * already obtained while applying the size limit. Callers that need sizes (the\n * parallel scanner's byte-balanced chunking) consume this directly so they do\n * not stat every file a second time (P2 double-stat elimination).\n */\nexport async function* walkFilesSized(\n  root: string,\n  options: WalkOptions = {},\n): AsyncGenerator<WalkedFile> {\n  const include = options.include ?? [];\n  const exclude = options.exclude ?? [];\n  const maxFileSize = options.maxFileSize ?? DEFAULT_MAX_FILE_SIZE;\n  const ignores = options.noDefaultIgnores ? [] : DEFAULT_IGNORES;\n\n  const rootStat = await stat(root);\n\n  // Single-file mode: yield the file itself (by basename) if it passes filters.\n  if (rootStat.isFile()) {\n    const name = toPosix(path.basename(root));\n    if (\n      !isBinaryPath(name) &&\n      isIncluded(name, include) &&\n      passesSizeLimit(name, rootStat.size, maxFileSize)\n    ) {\n      yield { rel: name, size: rootStat.size };\n    }\n    return;\n  }\n\n  yield* walkDir(root, \"\", { include, exclude, maxFileSize, ignores });\n}\n\ninterface WalkContext {\n  include: readonly string[];\n  exclude: readonly string[];\n  maxFileSize: number;\n  ignores: readonly string[];\n}\n\n/**\n * Manifests bypass the normal file-size cap (they carry the whole dependency\n * tree and must not be dropped), but still get a generous hard ceiling so a\n * pathological or hostile lockfile can't be read unbounded and OOM the scan.\n * 16 MiB comfortably covers real monorepo lockfiles (npm's own is well under 5).\n */\nexport const MANIFEST_MAX_BYTES = 16 * 1024 * 1024;\n\n/**\n * True if a file passes the size limit. Dependency manifests (package.json /\n * package-lock.json / yarn.lock / …) get the larger {@link MANIFEST_MAX_BYTES}\n * ceiling instead of the ordinary cap, so large lockfiles still get scanned for\n * vulnerable dependencies without letting an enormous one exhaust memory.\n * Exported for unit testing.\n */\nexport function passesSizeLimit(rel: string, size: number, maxFileSize: number): boolean {\n  // Uses the single {@link isManifestFile} definition.\n  if (isManifestFile(rel)) return size <= MANIFEST_MAX_BYTES;\n  return size <= maxFileSize;\n}\n\n/** Internal recursive directory walker. `relDir` is POSIX-relative to the root. */\nasync function* walkDir(\n  absDir: string,\n  relDir: string,\n  ctx: WalkContext,\n): AsyncGenerator<WalkedFile> {\n  let entries: Dirent[];\n  try {\n    entries = await readdir(absDir, { withFileTypes: true });\n  } catch {\n    // Unreadable directory (permissions, transient races) — skip silently.\n    return;\n  }\n\n  // Stable, deterministic ordering for reproducible scans.\n  entries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));\n\n  for (const entry of entries) {\n    const rel = relDir ? `${relDir}/${entry.name}` : entry.name;\n    const abs = path.join(absDir, entry.name);\n\n    if (entry.isSymbolicLink()) {\n      // Don't follow symlinks: avoids cycles and escaping the root.\n      continue;\n    }\n\n    if (entry.isDirectory()) {\n      if (ctx.ignores.includes(entry.name)) continue;\n      if (isExcluded(rel, ctx.exclude)) continue;\n      yield* walkDir(abs, rel, ctx);\n      continue;\n    }\n\n    if (!entry.isFile()) continue;\n    if (isExcluded(rel, ctx.exclude)) continue;\n    if (!isIncluded(rel, ctx.include)) continue;\n    // Dependency manifests (incl. yarn.lock / pnpm-lock.yaml) are always read —\n    // they carry the dependency tree and must not be dropped as binary/generated.\n    const manifest = isManifestFile(rel);\n    if (!manifest && isBinaryPath(rel)) continue;\n    if (!manifest && isGeneratedPath(rel)) continue;\n\n    let size: number;\n    try {\n      const s = await stat(abs);\n      if (!passesSizeLimit(rel, s.size, ctx.maxFileSize)) continue;\n      size = s.size;\n    } catch {\n      continue;\n    }\n\n    yield { rel, size };\n  }\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quantakrypto/core",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Shared post-quantum readiness library: crypto detectors, vulnerable-dependency database, inventory + SARIF reporting. Zero runtime dependencies.",
   "license": "Apache-2.0",
   "author": "Dandelion Labs <hello@dandelionlabs.io> (https://dandelionlabs.io)",

package/src/crypto-agility.ts

@@ -0,0 +1,407 @@
+/**
+ * Crypto-agility manifest: an agent-consumable crypto-posture document.
+ *
+ * A small, versioned JSON manifest a project publishes at a well-known URL
+ * (`/.well-known/crypto-agility.json`, see docs/CRYPTO-AGILITY-MANIFEST.md) so any
+ * agent, scanner, or CI bot can read the project's cryptographic posture the way it
+ * reads `security.txt` or `robots.txt`. It is a compact, decision-oriented summary
+ * DERIVED from a qScan result: the readiness score, the count of quantum-vulnerable
+ * findings by severity, the CBOM's algorithm families, an optional attestation URL,
+ * and the migration-policy deadlines.
+ *
+ * This module owns two pure operations and their shared schema:
+ *   - {@link buildCryptoAgilityManifest}: derive a manifest from a {@link ScanResult}.
+ *   - {@link validateCryptoAgilityManifest}: check an untrusted value against the
+ *     schema, returning a list of problems (used by the local validator; a network
+ *     fetch-and-validate lives on the website, never in this offline-boundary tool).
+ *
+ * Zero dependencies; hand-rolled JSON shape and validation so the package stays
+ * runtime-dependency-free.
+ */
+
+import { toCbom } from "./cbom.js";
+import { PQC_STANDARDS } from "./standards.js";
+import { SEVERITY_ORDER } from "./severity.js";
+import type { CryptoPolicy } from "./policy.js";
+import type { ScanResult, Severity } from "./types.js";
+import { VERSION } from "./version.js";
+
+/**
+ * Schema version of the manifest this module emits and validates. Bumped only on a
+ * breaking change to the manifest shape; consumers key their parsing off it.
+ */
+export const CRYPTO_AGILITY_MANIFEST_VERSION = 1;
+
+/** The conventional path a manifest is served from, relative to the site origin. */
+export const CRYPTO_AGILITY_WELL_KNOWN_PATH = "/.well-known/crypto-agility.json";
+
+/** A single algorithm family in use, mirroring the CBOM's grouping. */
+export interface CryptoAgilityFamily {
+  /** The algorithm family (e.g. `RSA`, `ECDH`, `ECDSA`), or `unknown`. */
+  family: string;
+  /** How many findings referenced this family. */
+  count: number;
+  /** Always true today: every detected family is classical (Shor-broken). */
+  quantumVulnerable: boolean;
+}
+
+/** The project's cryptographic posture, distilled from the scan inventory. */
+export interface CryptoAgilityPosture {
+  /** qScan readiness score, 0–100 (100 = no classical asymmetric crypto found). */
+  readinessScore: number;
+  /**
+   * Whether the project negotiates hybrid post-quantum key exchange. qScan is a
+   * static scanner and cannot observe a negotiated TLS group, so this is `null`
+   * ("not determined by this generator") unless the operator asserts it
+   * (`--hybrid-kex` / `--no-hybrid-kex`). A live probe (qProbe) or the website can
+   * fill it authoritatively.
+   */
+  hybridKexInUse: boolean | null;
+  /** Count of quantum-vulnerable findings, total and broken down by severity. */
+  quantumVulnerable: {
+    total: number;
+    bySeverity: Record<Severity, number>;
+  };
+  /** How many findings are exposed to harvest-now-decrypt-later. */
+  hndlExposedCount: number;
+}
+
+/** A compact summary of the full CBOM, linking to it by serial number. */
+export interface CryptoAgilityCbomSummary {
+  /** The CycloneDX `serialNumber` of the full CBOM this summary was derived from. */
+  serialNumber: string;
+  /** Number of distinct cryptographic-asset components in the full CBOM. */
+  assetCount: number;
+  /** Algorithm families in use, most-referenced first. */
+  algorithmFamilies: CryptoAgilityFamily[];
+}
+
+/** The migration policy the project declares it is measured against. */
+export interface CryptoAgilityPolicy {
+  /** Human label for the policy source (a standard name, or `operator-declared`). */
+  source: string;
+  /** Year after which classical public-key crypto is deprecated. */
+  deprecateClassicalAfter: number;
+  /** Year after which classical public-key crypto is disallowed. */
+  disallowClassicalAfter: number;
+  /** Operator-declared migration deadline (ISO date / year), or `null`. */
+  transitionDeadline: string | null;
+  /** Citation for the deadlines (spec / publication). */
+  citation: string;
+}
+
+/** The full crypto-agility manifest. */
+export interface CryptoAgilityManifest {
+  /** Manifest schema version ({@link CRYPTO_AGILITY_MANIFEST_VERSION}). */
+  version: number;
+  /** Discriminator so a consumer can tell this document apart from other JSON. */
+  manifestType: "crypto-agility";
+  /** ISO 8601 timestamp the manifest was generated (caller-supplied). */
+  generatedAt: string;
+  /** What produced the manifest. */
+  generator: { name: string; version: string };
+  /** What the manifest describes. */
+  subject: { root: string; repository: string | null; commit: string | null };
+  /** The distilled cryptographic posture. */
+  posture: CryptoAgilityPosture;
+  /** A compact summary of the CBOM. */
+  cbomSummary: CryptoAgilityCbomSummary;
+  /** Optional link to a quantakrypto (or other) posture credential. */
+  attestation?: { url: string };
+  /** The declared migration policy / deadlines. */
+  policy: CryptoAgilityPolicy;
+}
+
+/** Inputs the CLI/runtime supplies that are not derivable from the scan. */
+export interface CryptoAgilityManifestOptions {
+  /**
+   * ISO 8601 generation timestamp. The caller supplies it (`Date.now()` is fine in
+   * the CLI runtime) so the builder itself stays pure and deterministic.
+   */
+  generatedAt: string;
+  /** Optional URL to a posture credential (recorded verbatim, never fetched here). */
+  attestationUrl?: string;
+  /**
+   * Operator assertion of hybrid-KEX use. `undefined` leaves the manifest's
+   * `hybridKexInUse` as `null` (not determined).
+   */
+  hybridKexInUse?: boolean;
+  /** Optional org crypto policy; its `transitionDeadline` overlays the defaults. */
+  policy?: CryptoPolicy;
+  /** Repository URL (e.g. `GITHUB_REPOSITORY`); omitted → null. */
+  repository?: string;
+  /** Commit SHA (e.g. `GITHUB_SHA`); omitted → null. */
+  commit?: string;
+}
+
+/**
+ * Build a crypto-agility manifest from a scan result. Pure: every runtime input
+ * (timestamp, attestation, hybrid-KEX assertion, policy) arrives via `opts`.
+ *
+ * The posture and CBOM summary are derived straight from the scan's inventory and
+ * its CycloneDX CBOM, so the manifest can never disagree with the full `--cbom` /
+ * `--format json` outputs of the same scan.
+ */
+export function buildCryptoAgilityManifest(
+  result: ScanResult,
+  opts: CryptoAgilityManifestOptions,
+): CryptoAgilityManifest {
+  const cbom = toCbom(result);
+  const inv = result.inventory;
+
+  const algorithmFamilies: CryptoAgilityFamily[] = Object.entries(inv.byAlgorithm)
+    .filter(([, count]) => (count ?? 0) > 0)
+    .map(([family, count]) => ({
+      family,
+      count: count as number,
+      // Every family the detectors surface is classical, hence quantum-vulnerable
+      // by construction (mirrors cbom.ts `isQuantumVulnerable`).
+      quantumVulnerable: true,
+    }))
+    .sort((a, b) => b.count - a.count || a.family.localeCompare(b.family));
+
+  const bySeverity = { ...inv.bySeverity };
+
+  // Default policy: the NIST IR 8547 transition timeline. An operator crypto policy
+  // (`--policy`) does not override the standards deadlines but layers its own
+  // `transitionDeadline` on top and re-labels the source as operator-declared.
+  const timeline = PQC_STANDARDS.transitionTimeline;
+  const policy: CryptoAgilityPolicy = {
+    source: opts.policy ? "operator-declared" : timeline.source,
+    deprecateClassicalAfter: timeline.deprecateAfter,
+    disallowClassicalAfter: timeline.disallowAfter,
+    transitionDeadline: opts.policy?.transitionDeadline ?? null,
+    citation: timeline.source,
+  };
+
+  const manifest: CryptoAgilityManifest = {
+    version: CRYPTO_AGILITY_MANIFEST_VERSION,
+    manifestType: "crypto-agility",
+    generatedAt: opts.generatedAt,
+    generator: { name: "qScan", version: result.toolVersion || VERSION },
+    subject: {
+      root: result.root,
+      repository: opts.repository ?? null,
+      commit: opts.commit ?? null,
+    },
+    posture: {
+      readinessScore: inv.readinessScore,
+      hybridKexInUse: opts.hybridKexInUse ?? null,
+      quantumVulnerable: {
+        total: result.findings.length,
+        bySeverity,
+      },
+      hndlExposedCount: inv.hndlCount,
+    },
+    cbomSummary: {
+      serialNumber: cbom.serialNumber,
+      assetCount: cbom.components.length,
+      algorithmFamilies,
+    },
+    ...(opts.attestationUrl ? { attestation: { url: opts.attestationUrl } } : {}),
+    policy,
+  };
+  return manifest;
+}
+
+/** Outcome of {@link validateCryptoAgilityManifest}. */
+export interface ManifestValidation {
+  /** True when the value satisfies the manifest schema. */
+  valid: boolean;
+  /** One human-readable message per problem found (empty when `valid`). */
+  errors: string[];
+}
+
+/** True for a plain (non-array, non-null) object. */
+function isObject(v: unknown): v is Record<string, unknown> {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+
+/**
+ * Validate an untrusted value against the crypto-agility manifest schema.
+ *
+ * Checks structure, required fields, types, and the schema version. Purely local:
+ * it parses an already-in-memory value and NEVER performs I/O or network fetches;
+ * a fetch-and-validate of a remote manifest is a website-side concern, deliberately
+ * kept out of this offline-boundary tool. Returns every problem it finds rather than
+ * throwing on the first, so a caller can report them all at once.
+ */
+export function validateCryptoAgilityManifest(value: unknown): ManifestValidation {
+  const errors: string[] = [];
+  const err = (m: string): void => void errors.push(m);
+
+  if (!isObject(value)) {
+    return { valid: false, errors: ["manifest must be a JSON object"] };
+  }
+
+  // version
+  if (value.version === undefined) {
+    err("missing required field: version");
+  } else if (typeof value.version !== "number" || !Number.isInteger(value.version)) {
+    err("version must be an integer");
+  } else if (value.version !== CRYPTO_AGILITY_MANIFEST_VERSION) {
+    err(
+      `unsupported version ${value.version} (this validator understands version ${CRYPTO_AGILITY_MANIFEST_VERSION})`,
+    );
+  }
+
+  // manifestType
+  if (value.manifestType === undefined) {
+    err("missing required field: manifestType");
+  } else if (value.manifestType !== "crypto-agility") {
+    err('manifestType must be the string "crypto-agility"');
+  }
+
+  // generatedAt
+  if (value.generatedAt === undefined) {
+    err("missing required field: generatedAt");
+  } else if (typeof value.generatedAt !== "string" || value.generatedAt.length === 0) {
+    err("generatedAt must be a non-empty ISO 8601 string");
+  } else if (Number.isNaN(Date.parse(value.generatedAt))) {
+    err("generatedAt must be a parseable ISO 8601 timestamp");
+  }
+
+  // generator
+  if (value.generator === undefined) {
+    err("missing required field: generator");
+  } else if (!isObject(value.generator)) {
+    err("generator must be an object");
+  } else {
+    if (typeof value.generator.name !== "string") err("generator.name must be a string");
+    if (typeof value.generator.version !== "string") err("generator.version must be a string");
+  }
+
+  // subject
+  if (value.subject === undefined) {
+    err("missing required field: subject");
+  } else if (!isObject(value.subject)) {
+    err("subject must be an object");
+  } else {
+    if (typeof value.subject.root !== "string") err("subject.root must be a string");
+    if (value.subject.repository !== null && typeof value.subject.repository !== "string") {
+      err("subject.repository must be a string or null");
+    }
+    if (value.subject.commit !== null && typeof value.subject.commit !== "string") {
+      err("subject.commit must be a string or null");
+    }
+  }
+
+  // posture
+  validatePosture(value.posture, err);
+
+  // cbomSummary
+  validateCbomSummary(value.cbomSummary, err);
+
+  // attestation (optional)
+  if (value.attestation !== undefined) {
+    if (!isObject(value.attestation)) {
+      err("attestation must be an object when present");
+    } else if (typeof value.attestation.url !== "string" || value.attestation.url.length === 0) {
+      err("attestation.url must be a non-empty string");
+    }
+  }
+
+  // policy
+  validatePolicy(value.policy, err);
+
+  return { valid: errors.length === 0, errors };
+}
+
+/** Validate the `posture` block. */
+function validatePosture(posture: unknown, err: (m: string) => void): void {
+  if (posture === undefined) {
+    err("missing required field: posture");
+    return;
+  }
+  if (!isObject(posture)) {
+    err("posture must be an object");
+    return;
+  }
+  if (
+    typeof posture.readinessScore !== "number" ||
+    posture.readinessScore < 0 ||
+    posture.readinessScore > 100
+  ) {
+    err("posture.readinessScore must be a number between 0 and 100");
+  }
+  if (posture.hybridKexInUse !== null && typeof posture.hybridKexInUse !== "boolean") {
+    err("posture.hybridKexInUse must be a boolean or null");
+  }
+  if (typeof posture.hndlExposedCount !== "number" || posture.hndlExposedCount < 0) {
+    err("posture.hndlExposedCount must be a non-negative number");
+  }
+  const qv = posture.quantumVulnerable;
+  if (!isObject(qv)) {
+    err("posture.quantumVulnerable must be an object");
+    return;
+  }
+  if (typeof qv.total !== "number" || qv.total < 0) {
+    err("posture.quantumVulnerable.total must be a non-negative number");
+  }
+  if (!isObject(qv.bySeverity)) {
+    err("posture.quantumVulnerable.bySeverity must be an object");
+  } else {
+    for (const sev of SEVERITY_ORDER) {
+      if (typeof qv.bySeverity[sev] !== "number") {
+        err(`posture.quantumVulnerable.bySeverity.${sev} must be a number`);
+      }
+    }
+  }
+}
+
+/** Validate the `cbomSummary` block. */
+function validateCbomSummary(summary: unknown, err: (m: string) => void): void {
+  if (summary === undefined) {
+    err("missing required field: cbomSummary");
+    return;
+  }
+  if (!isObject(summary)) {
+    err("cbomSummary must be an object");
+    return;
+  }
+  if (typeof summary.serialNumber !== "string") err("cbomSummary.serialNumber must be a string");
+  if (typeof summary.assetCount !== "number" || summary.assetCount < 0) {
+    err("cbomSummary.assetCount must be a non-negative number");
+  }
+  if (!Array.isArray(summary.algorithmFamilies)) {
+    err("cbomSummary.algorithmFamilies must be an array");
+    return;
+  }
+  summary.algorithmFamilies.forEach((fam, i) => {
+    if (!isObject(fam)) {
+      err(`cbomSummary.algorithmFamilies[${i}] must be an object`);
+      return;
+    }
+    if (typeof fam.family !== "string")
+      err(`cbomSummary.algorithmFamilies[${i}].family must be a string`);
+    if (typeof fam.count !== "number" || fam.count < 0) {
+      err(`cbomSummary.algorithmFamilies[${i}].count must be a non-negative number`);
+    }
+    if (typeof fam.quantumVulnerable !== "boolean") {
+      err(`cbomSummary.algorithmFamilies[${i}].quantumVulnerable must be a boolean`);
+    }
+  });
+}
+
+/** Validate the `policy` block. */
+function validatePolicy(policy: unknown, err: (m: string) => void): void {
+  if (policy === undefined) {
+    err("missing required field: policy");
+    return;
+  }
+  if (!isObject(policy)) {
+    err("policy must be an object");
+    return;
+  }
+  if (typeof policy.source !== "string") err("policy.source must be a string");
+  if (typeof policy.deprecateClassicalAfter !== "number") {
+    err("policy.deprecateClassicalAfter must be a number (year)");
+  }
+  if (typeof policy.disallowClassicalAfter !== "number") {
+    err("policy.disallowClassicalAfter must be a number (year)");
+  }
+  if (policy.transitionDeadline !== null && typeof policy.transitionDeadline !== "string") {
+    err("policy.transitionDeadline must be a string or null");
+  }
+  if (typeof policy.citation !== "string") err("policy.citation must be a string");
+}