@quantakrypto/core 0.5.0 → 0.7.0

package/dist/dependencies.js

@@ -373,6 +373,13 @@ export const vulnerableDependencies = [
         algorithms: ["X25519", "EdDSA"],
         severity: "low",
     },
+    {
+        name: "tink",
+        ecosystem: "pypi",
+        reason: "Google Tink (Python) — classical RSA/ECDSA/Ed25519 signatures and ECIES hybrid encryption.",
+        algorithms: ["RSA", "ECDSA", "EdDSA", "ECIES"],
+        severity: "high",
+    },
     // --- crates.io (Rust) ---
     {
         name: "rsa",
@@ -482,6 +489,20 @@ export const vulnerableDependencies = [
         algorithms: ["ECDSA", "ECDH"],
         severity: "medium",
     },
+    {
+        name: "github.com/tink-crypto/tink-go/v2",
+        ecosystem: "go",
+        reason: "Google Tink (Go) — classical RSA/ECDSA/Ed25519 signatures and ECIES hybrid encryption.",
+        algorithms: ["RSA", "ECDSA", "EdDSA", "ECIES"],
+        severity: "high",
+    },
+    {
+        name: "github.com/google/tink/go",
+        ecosystem: "go",
+        reason: "Google Tink (legacy Go module) — classical RSA/ECDSA/Ed25519 and ECIES hybrid.",
+        algorithms: ["RSA", "ECDSA", "EdDSA", "ECIES"],
+        severity: "high",
+    },
     // --- Maven (Java) ---
     {
         name: "bcprov-jdk18on",
@@ -527,6 +548,13 @@ export const vulnerableDependencies = [
         severity: "medium",
         hndl: false,
     },
+    {
+        name: "tink",
+        ecosystem: "maven",
+        reason: "Google Tink (com.google.crypto.tink) — classical RSA/ECDSA/Ed25519 signatures and ECIES hybrid encryption.",
+        algorithms: ["RSA", "ECDSA", "EdDSA", "ECIES"],
+        severity: "high",
+    },
     // --- RubyGems ---
     {
         name: "jwt",
@@ -588,13 +616,81 @@ export const vulnerableDependencies = [
         severity: "medium",
         hndl: false,
     },
+    // --- Composer (PHP) ---
+    {
+        name: "phpseclib/phpseclib",
+        ecosystem: "composer",
+        reason: "Pure-PHP RSA / DSA / ECDSA / Diffie-Hellman public-key crypto and X.509.",
+        algorithms: ["RSA", "DSA", "ECDSA", "DH"],
+        severity: "high",
+    },
+    {
+        name: "paragonie/sodium_compat",
+        ecosystem: "composer",
+        reason: "Pure-PHP libsodium polyfill: X25519 key agreement and Ed25519 signatures.",
+        algorithms: ["X25519", "EdDSA"],
+        severity: "low",
+    },
+    {
+        name: "paragonie/halite",
+        ecosystem: "composer",
+        reason: "libsodium wrapper: X25519 key agreement and Ed25519 signatures.",
+        algorithms: ["X25519", "EdDSA"],
+        severity: "low",
+    },
+    {
+        name: "paragonie/paseto",
+        ecosystem: "composer",
+        reason: "PASETO public tokens signed with classical Ed25519 (v2/v4) or RSA.",
+        algorithms: ["EdDSA", "RSA"],
+        severity: "medium",
+        hndl: false,
+    },
+    {
+        name: "firebase/php-jwt",
+        ecosystem: "composer",
+        reason: "PHP JWT signing/verification with classical RS*/ES* algorithms.",
+        algorithms: ["RSA", "ECDSA"],
+        severity: "medium",
+        hndl: false,
+    },
+    {
+        name: "lcobucci/jwt",
+        ecosystem: "composer",
+        reason: "PHP JWT with classical RSA/ECDSA signature algorithms.",
+        algorithms: ["RSA", "ECDSA"],
+        severity: "medium",
+        hndl: false,
+    },
+    {
+        name: "web-token/jwt-framework",
+        ecosystem: "composer",
+        reason: "JOSE (JWS/JWE) framework: classical RSA/ECDSA signatures and ECDH-ES key agreement.",
+        algorithms: ["RSA", "ECDSA", "ECDH"],
+        severity: "medium",
+    },
+    {
+        name: "mdanter/ecc",
+        ecosystem: "composer",
+        reason: "Pure-PHP elliptic-curve ECDSA signatures and ECDH key agreement.",
+        algorithms: ["ECDSA", "ECDH"],
+        severity: "high",
+    },
+    {
+        name: "simplito/elliptic-php",
+        ecosystem: "composer",
+        reason: "secp256k1 / NIST-curve ECDSA and ECDH in pure PHP (blockchain keys).",
+        algorithms: ["ECDSA", "ECDH"],
+        severity: "high",
+    },
 ];
 /**
  * Normalise a package name for matching within its ecosystem. PyPI is
  * case-insensitive and folds runs of `-_.` to a single `-` (PEP 503); cargo /
- * maven / rubygems / nuget are effectively lower-case (NuGet ids are matched
- * case-insensitively); npm and go module paths are matched verbatim (npm scopes
- * and go paths are case-sensitive).
+ * maven / rubygems / nuget / composer are effectively lower-case (NuGet ids are
+ * matched case-insensitively; Composer `vendor/package` names are lower-cased by
+ * Packagist); npm and go module paths are matched verbatim (npm scopes and go
+ * paths are case-sensitive).
  */
 function normalizeName(ecosystem, name) {
     const n = name.trim();
@@ -687,6 +783,8 @@ export function manifestEcosystem(file) {
         return "rubygems";
     if (base === "packages.config" || base === "directory.packages.props" || base.endsWith(".csproj"))
         return "nuget";
+    if (base === "composer.json" || base === "composer.lock")
+        return "composer";
     return null;
 }
 /** True if a file path looks like a manifest we can parse for dependencies. */
@@ -771,6 +869,18 @@ function candidateNames(ecosystem, content) {
             }
             break;
         }
+        case "composer": {
+            // composer.json `require`/`require-dev` maps are keyed by "vendor/package";
+            // composer.lock lists `{"name": "vendor/package", …}`. Both are JSON, so
+            // grab every quoted `vendor/package` token (a lower-case vendor + package
+            // separated by a single `/`). PHP platform requirements ("php", "ext-*")
+            // carry no slash and so are naturally excluded; the curated DB filters the
+            // rest, so over-capture is safe.
+            for (const m of content.matchAll(/["']([a-z0-9](?:[a-z0-9._-]*[a-z0-9])?\/[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?)["']/gi)) {
+                names.push(m[1]);
+            }
+            break;
+        }
         case "npm":
             break; // npm uses the JSON path, not this extractor.
     }
@@ -858,10 +968,32 @@ export function scanManifest(file, content) {
     }
     return sortByTitle(findings);
 }
+/**
+ * Resolve an npm `npm:` alias spec to the real package it installs, or null when
+ * the spec is not an alias. An aliased dependency records the alias as the map
+ * KEY and `npm:<real-name>@<range>` as the VALUE (in package.json and in a
+ * lockfile entry's `version`), so the vulnerable package hides behind a benign
+ * alias name. Keeps a leading scope `@` (only a version `@` past index 0 is a
+ * separator): `npm:node-forge@^1` → `node-forge`, `npm:@scope/pkg@1` → `@scope/pkg`.
+ */
+function npmAliasTarget(spec) {
+    if (!spec.startsWith("npm:"))
+        return null;
+    const rest = spec.slice(4);
+    const at = rest.lastIndexOf("@");
+    const name = at > 0 ? rest.slice(0, at) : rest;
+    return name || null;
+}
+/** Guard against a pathological / hostile lockfile nesting the walk unbounded. */
+const NPM_TREE_MAX_DEPTH = 64;
 /**
  * npm manifest scan.
- * - `package.json`: dependencies / devDependencies / peerDependencies / optionalDependencies.
- * - `package-lock.json` (v2/v3): the `packages` map keys (node_modules/<name>).
+ * - `package.json`: dependencies / devDependencies / peerDependencies / optionalDependencies,
+ *   including `npm:`-aliased entries (the alias key hides the real package name).
+ * - `package-lock.json` v1: the NESTED `dependencies` tree, where each entry may carry
+ *   its own `dependencies` (transitive deps) and an `npm:` alias in `version`.
+ * - `package-lock.json` v2/v3: the flat `packages` map keys (node_modules/<name>),
+ *   plus each entry's own `name` field (set for aliased installs).
  */
 function scanNpmManifest(content, file, db) {
     let json;
@@ -875,28 +1007,58 @@ function scanNpmManifest(content, file, db) {
         return [];
     const found = new Set();
     const obj = json;
-    const collectFromRecord = (rec) => {
-        if (rec === null || typeof rec !== "object")
+    const add = (name) => {
+        if (db.has(name))
+            found.add(name);
+    };
+    /**
+     * Walk a dependency map that may be either a flat package.json map
+     * (name → version-range string) or a legacy package-lock v1 tree (name →
+     * `{ version, requires, dependencies }`, arbitrarily nested). Matches keys,
+     * resolves `npm:` aliases from string values and entry `version` fields, and
+     * recurses into a nested `dependencies` sub-tree.
+     */
+    const walkDepTree = (deps, depth) => {
+        if (depth > NPM_TREE_MAX_DEPTH || deps === null || typeof deps !== "object")
             return;
-        for (const key of Object.keys(rec)) {
-            if (db.has(key))
-                found.add(key);
+        for (const [name, node] of Object.entries(deps)) {
+            add(name);
+            if (typeof node === "string") {
+                // package.json form: the value is a range, possibly `npm:<real>@<range>`.
+                const aliased = npmAliasTarget(node);
+                if (aliased)
+                    add(aliased);
+            }
+            else if (node !== null && typeof node === "object") {
+                const rec = node;
+                if (typeof rec.version === "string") {
+                    const aliased = npmAliasTarget(rec.version);
+                    if (aliased)
+                        add(aliased);
+                }
+                walkDepTree(rec.dependencies, depth + 1); // v1 nests transitive deps here
+            }
         }
     };
-    collectFromRecord(obj.dependencies);
-    collectFromRecord(obj.devDependencies);
-    collectFromRecord(obj.peerDependencies);
-    collectFromRecord(obj.optionalDependencies);
+    walkDepTree(obj.dependencies, 0);
+    walkDepTree(obj.devDependencies, 0);
+    walkDepTree(obj.peerDependencies, 0);
+    walkDepTree(obj.optionalDependencies, 0);
     const packages = obj.packages;
     if (packages !== null && typeof packages === "object") {
-        for (const key of Object.keys(packages)) {
+        for (const [key, entry] of Object.entries(packages)) {
             if (!key)
                 continue; // root package entry
             const marker = "node_modules/";
             const idx = key.lastIndexOf(marker);
-            const name = idx >= 0 ? key.slice(idx + marker.length) : key;
-            if (db.has(name))
-                found.add(name);
+            add(idx >= 0 ? key.slice(idx + marker.length) : key);
+            // Aliased install: the entry's own `name` field is the real package, which
+            // differs from the alias embedded in the node_modules/<alias> key.
+            if (entry !== null && typeof entry === "object") {
+                const realName = entry.name;
+                if (typeof realName === "string")
+                    add(realName);
+            }
         }
     }
     const findings = [];

package/dist/dependencies.js.map

@@ -1 +1 @@
-{"version":3,"file":"dependencies.js","sourceRoot":"","sources":["../src/dependencies.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAE7C;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAa;IAC3C,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,+BAA+B;IACtC,QAAQ,EAAE,YAAY;IACtB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,8EAA8E;QAC9E,yEAAyE;IAC3E,WAAW,EACT,8EAA8E;QAC9E,2EAA2E;IAC7E,WAAW,EACT,gFAAgF;QAChF,0DAA0D;CAC7D,CAAC;AAEF,iDAAiD;AACjD,MAAM,CAAC,MAAM,sBAAsB,GAA2B;IAC5D;QACE,IAAI,EAAE,YAAY;QAClB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,yDAAyD;QACjE,UAAU,EAAE,CAAC,KAAK,CAAC;QACnB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,uDAAuD;QAC/D,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;QACtC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,mDAAmD;QAC3D,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC;QACnC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,uCAAuC;QAC/C,UAAU,EAAE,CAAC,KAAK,CAAC;QACnB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,qDAAqD;QAC7D,UAAU,EAAE,CAAC,KAAK,CAAC;QACnB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,OAAO;QACb,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,6DAA6D;QACrE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC;QAC5C,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,8DAA8D;QACtE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,8DAA8D;QACtE,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;QAC7C,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,KAAK;QACX,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,uDAAuD;QAC/D,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,qDAAqD;QAC7D,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;QACtC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,kDAAkD;QAC1D,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,oEAAoE;QAC5E,UAAU,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC/B,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,iCAAiC;QACzC,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,oEAAoE;QAC5E,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;QAChD,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,mCAAmC;QAC3C,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,yDAAyD;QACjE,UAAU,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC;QAC/B,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,oEAAoE;QAC5E,UAAU,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,+DAA+D;QACvE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;QACpD,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,wCAAwC;QAChD,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,kCAAkC;QAC1C,UAAU,EAAE,CAAC,KAAK,CAAC;QACnB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,uEAAuE;QAC/E,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,kEAAkE;QAC1E,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,uEAAuE;QAC/E,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,6DAA6D;QACrE,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,4DAA4D;QACpE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;QAC7C,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,0DAA0D;QAClE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;QACpC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,KAAK;QACX,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,0DAA0D;QAClE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,YAAY;QAClB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,sDAAsD;QAC9D,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,8DAA8D;QACtE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,yEAAyE;QACjF,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC;QACrC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,uDAAuD;QAC/D,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,OAAO;QACb,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,kEAAkE;QAC1E,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;QACpC,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,qDAAqD;QAC7D,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,oEAAoE;QAC5E,UAAU,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC;QAC/B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,8DAA8D;QACtE,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,KAAK;KAChB;IAED,wBAAwB;IACxB;QACE,IAAI,EAAE,cAAc;QACpB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,+CAA+C;QACvD,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC;QACnC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,oEAAoE;QAC5E,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;QAC1B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,mEAAmE;QAC3E,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;QACpC,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,gEAAgE;QACxE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,eAAe;QACrB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,iEAAiE;QACzE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC;QACnC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,KAAK;QACX,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,yCAAyC;QACjD,UAAU,EAAE,CAAC,KAAK,CAAC;QACnB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,OAAO;QACb,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,sDAAsD;QAC9D,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,+EAA+E;QACvF,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;QAC3C,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,OAAO;QACb,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,gDAAgD;QACxD,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,aAAa;QACnB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,+CAA+C;QACvD,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,0EAA0E;QAClF,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC;QAC5C,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,oDAAoD;QAC5D,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,MAAM;QACjB,MAAM,EACJ,0FAA0F;QAC5F,UAAU,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC/B,QAAQ,EAAE,KAAK;KAChB;IAED,2BAA2B;IAC3B;QACE,IAAI,EAAE,KAAK;QACX,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,uCAAuC;QAC/C,UAAU,EAAE,CAAC,KAAK,CAAC;QACnB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,0CAA0C;QAClD,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC;QAC7C,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,+CAA+C;QACvD,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,qDAAqD;QAC7D,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,qDAAqD;QAC7D,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,oDAAoD;QAC5D,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,8DAA8D;QACtE,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,4CAA4C;QACpD,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,8CAA8C;QACtD,UAAU,EAAE,CAAC,QAAQ,CAAC;QACtB,QAAQ,EAAE,KAAK;KAChB;IAED,qBAAqB;IACrB;QACE,IAAI,EAAE,qBAAqB;QAC3B,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,oEAAoE;QAC5E,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC;QAC7C,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,oDAAoD;QAC5D,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,yDAAyD;QACjE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,+BAA+B;QACrC,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,yEAAyE;QACjF,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;QACpC,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,SAAS,EAAE,IAAI;QACf,MAAM,EACJ,6KAA6K;QAC/K,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;QAC7B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,2CAA2C;QACjD,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,mFAAmF;QAC3F,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,QAAQ;KACnB;IAED,uBAAuB;IACvB;QACE,IAAI,EAAE,gBAAgB;QACtB,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,kEAAkE;QAC1E,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC;QAC3C,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,kEAAkE;QAC1E,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC;QAC3C,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,2DAA2D;QACnE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,8CAA8C;QACtD,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,kEAAkE;QAC1E,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;QACpC,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,yDAAyD;QACjE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IAED,mBAAmB;IACnB;QACE,IAAI,EAAE,KAAK;QACX,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,6CAA6C;QACrD,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,UAAU;QACrB,MAAM,EACJ,0FAA0F;QAC5F,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;QACpC,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,mEAAmE;QAC3E,UAAU,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC/B,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,4CAA4C;QACpD,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,KAAK;KAChB;IAED,uBAAuB;IACvB;QACE,IAAI,EAAE,2BAA2B;QACjC,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,kEAAkE;QAC1E,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC;QAC3C,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,gEAAgE;QACxE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC;QAC3C,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,mEAAmE;QAC3E,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,kEAAkE;QAC1E,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;CACF,CAAC;AAEF;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,SAA8B,EAAE,IAAY;IACjE,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,IAAI,SAAS,KAAK,MAAM;QAAE,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACzE,IAAI,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC;IACxD,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;AACzB,CAAC;AAED,qFAAqF;AACrF,MAAM,YAAY,GAAgE,CAAC,GAAG,EAAE;IACtF,MAAM,CAAC,GAAG,IAAI,GAAG,EAA0D,CAAC;IAC5E,KAAK,MAAM,CAAC,IAAI,sBAAsB,EAAE,CAAC;QACvC,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5B,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,EAAE,GAAG,IAAI,GAAG,EAAE,CAAC;YACf,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACzB,CAAC;QACD,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC,CAAC,EAAE,CAAC;AAEL;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAC/B,sBAAsB;KACnB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC;KACpC,GAAG,CAAC,CAAC,CAAC,EAAoB,EAAE;IAC3B,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;IAC/D,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,OAAO,QAAQ,CAAC,CAAC,CAAC;AACnD,CAAC,CAAC,CACL,CAAC;AAEF;;;;;;;;GAQG;AACH,SAAS,sBAAsB,CAAC,UAAsC;IACpE,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,uBAAuB,CAAC,CAAC,CAAC;YAAE,QAAQ,GAAG,IAAI,CAAC;QAChD,IAAI,iBAAiB,CAAC,CAAC,CAAC;YAAE,QAAQ,GAAG,IAAI,CAAC;QAC1C,IAAI,CAAC,KAAK,SAAS;YAAE,WAAW,GAAG,IAAI,CAAC;IAC1C,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,QAAQ;QACV,KAAK,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;IACzF,IAAI,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IAChE,6EAA6E;IAC7E,IAAI,WAAW,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9E,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3D,IACE,IAAI,KAAK,cAAc;QACvB,IAAI,KAAK,mBAAmB;QAC5B,IAAI,KAAK,qBAAqB;QAC9B,IAAI,KAAK,WAAW;QACpB,IAAI,KAAK,gBAAgB,EACzB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,KAAK,kBAAkB,IAAI,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IAC1F,IAAI,IAAI,KAAK,gBAAgB,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACnE,IAAI,IAAI,KAAK,YAAY;QAAE,OAAO,OAAO,CAAC;IAC1C,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,kBAAkB;QAAE,OAAO,OAAO,CAAC;IACjG,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IACvE,IAAI,IAAI,KAAK,iBAAiB,IAAI,IAAI,KAAK,0BAA0B,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC/F,OAAO,OAAO,CAAC;IACjB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,iBAAiB,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,SAA8B,EAAE,OAAe;IACrE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,4EAA4E;YAC5E,wEAAwE;YACxE,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;gBACxB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBACpE,MAAM,IAAI,GAAG,iCAAiC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC1D,IAAI,IAAI;oBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC9B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,gCAAgC,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpF,CAAC;YACD,MAAM;QACR,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,2EAA2E;YAC3E,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;gBACxB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAC5C,MAAM,GAAG,GAAG,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC1D,IAAI,GAAG;oBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5B,MAAM,KAAK,GAAG,uDAAuD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjF,IAAI,KAAK;oBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAClC,CAAC;YACD,MAAM;QACR,CAAC;QACD,KAAK,IAAI,CAAC,CAAC,CAAC;YACV,qEAAqE;YACrE,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,qCAAqC,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1F,MAAM;QACR,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,uEAAuE;YACvE,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,4CAA4C,CAAC,EAAE,CAAC;gBAC/E,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,uCAAuC,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5F,MAAM;QACR,CAAC;QACD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,2DAA2D;YAC3D,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACjF,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAC9B,+DAA+D,CAChE,EAAE,CAAC;gBACF,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC;YACD,MAAM;QACR,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,0EAA0E;YAC1E,kEAAkE;YAClE,0EAA0E;YAC1E,uEAAuE;YACvE,yEAAyE;YACzE,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,qDAAqD,CAAC,EAAE,CAAC;gBACxF,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,uCAAuC,CAAC,EAAE,CAAC;gBAC1E,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC;YACD,MAAM;QACR,CAAC;QACD,KAAK,KAAK;YACR,MAAM,CAAC,8CAA8C;IACzD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qFAAqF;AACrF,SAAS,YAAY,CAAC,OAAe,EAAE,IAAY;IACjD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,gBAAgB,OAAO,YAAY,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CACxB,GAAyB,EACzB,IAAY,EACZ,OAAe,EACf,KAAa;IAEb,yEAAyE;IACzE,0DAA0D;IAC1D,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;IACjD,OAAO,WAAW,CAAC;QACjB,MAAM,EAAE,gBAAgB;QACxB,KAAK,EAAE,kCAAkC,GAAG,CAAC,IAAI,EAAE;QACnD,QAAQ,EAAE,YAAY;QACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,UAAU,EAAE,MAAM;QAClB,SAAS;QACT,yEAAyE;QACzE,2EAA2E;QAC3E,wEAAwE;QACxE,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,uBAAuB,CAAC;QAC9D,GAAG,EAAE,iBAAiB;QACtB,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,MAAM,EAAE;QACtC,WAAW,EAAE,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC;QACnD,IAAI;QACJ,OAAO;QACP,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED,4EAA4E;AAC5E,SAAS,WAAW,CAAC,OAAe,EAAE,IAAY;IAChD,0EAA0E;IAC1E,MAAM,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,CAAC;IAClB,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3B,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACzB,CAAC;AAED,uDAAuD;AACvD,SAAS,WAAW,CAAC,QAAmB;IACtC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,OAAe;IACxD,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,CAAC;IAC1B,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,CAAC;IAEnB,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3D,2EAA2E;QAC3E,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACtD,OAAO,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,EAAgC,CAAC,CAAC,kBAAkB;IACzE,KAAK,MAAM,GAAG,IAAI,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;QAClD,IAAI,GAAG;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CACtB,OAAe,EACf,IAAY,EACZ,EAAqC;IAErC,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,iCAAiC;IAC9C,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAEzD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,GAAG,GAAG,IAA+B,CAAC;IAE5C,MAAM,iBAAiB,GAAG,CAAC,GAAY,EAAQ,EAAE;QAC/C,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO;QACpD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAA8B,CAAC,EAAE,CAAC;YAC9D,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;IACH,CAAC,CAAC;IAEF,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACpC,iBAAiB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACvC,iBAAiB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACxC,iBAAiB,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAE5C,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC9B,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACtD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAmC,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC,GAAG;gBAAE,SAAS,CAAC,qBAAqB;YACzC,MAAM,MAAM,GAAG,eAAe,CAAC;YAC/B,MAAM,GAAG,GAAG,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YAC7D,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,qBAAqB,CAAC,OAAe;IAC5C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,EAAE,GAAG,6DAA6D,CAAC;IACzE,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI;QAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACtE,wEAAwE;IACxE,MAAM,KAAK,GAAG,4DAA4D,CAAC;IAC3E,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI;QAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACzE,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CACtB,OAAe,EACf,IAAY,EACZ,EAAqC;IAErC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAgC,CAAC;IACtD,KAAK,MAAM,IAAI,IAAI,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,GAAG;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;AAC/B,CAAC","sourcesContent":["/**\n * Curated database of packages that primarily expose classical asymmetric\n * cryptography (and are therefore quantum-vulnerable), across multiple\n * ecosystems (npm, PyPI, crates.io, Go modules, Maven, RubyGems, NuGet), plus a\n * manifest scanner that flags any of them found in the corresponding manifest\n * (package.json, requirements.txt, Cargo.toml, go.mod, pom.xml, Gemfile,\n * packages.config / *.csproj, …).\n *\n * The list is intentionally focused on libraries whose *purpose* is classical\n * public-key crypto. General-purpose packages that merely call the language's\n * stdlib crypto are out of scope here (those are caught by the source detectors).\n * Extraction is generous but every finding must match a curated entry, so a new\n * manifest format is cheap to add (see `manifestEcosystem` + `candidateNames`).\n */\nimport type {\n  AlgorithmFamily,\n  DependencyEcosystem,\n  Finding,\n  RuleMeta,\n  VulnerableDependency,\n} from \"./types.js\";\nimport { makeFinding } from \"./detect-utils.js\";\nimport { isConfidentialityFamily, isSignatureFamily, remediationText } from \"./remediation.js\";\nimport { CWE_BROKEN_CRYPTO } from \"./cwe.js\";\n\n/**\n * Catalog entry for the `dep-vulnerable` rule. Dependency findings are produced\n * by the manifest scanner rather than a registered {@link Detector}, so this\n * rule is absent from `defaultRegistry.ruleCatalog()`. Reporters (SARIF) merge\n * it in so the rule advertises a GENERIC description — the per-package specifics\n * (title/severity/HNDL/remediation) live on each individual finding/result, not\n * on the shared rule. Without this, SARIF would leak the first dependency's\n * package-specific text into the rule-level `shortDescription` for every dep.\n */\nexport const DEP_VULNERABLE_RULE: RuleMeta = {\n  id: \"dep-vulnerable\",\n  title: \"Quantum-vulnerable dependency\",\n  category: \"dependency\",\n  // Representative default; each SARIF result carries its own per-package level.\n  severity: \"high\",\n  confidence: \"high\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"A dependency implements classical public-key cryptography that is broken by \" +\n    \"quantum computers. Replace or upgrade it to a post-quantum alternative.\",\n  remediation:\n    \"Move to a post-quantum alternative — ML-KEM-768 (FIPS 203) for key exchange/\" +\n    \"encryption and ML-DSA-65 (FIPS 204) for signatures, ideally via a hybrid.\",\n  description:\n    \"Flags packages in a dependency manifest known to implement quantum-vulnerable \" +\n    \"public-key cryptography (RSA, ECDH/ECDSA, DH, EdDSA, …).\",\n};\n\n/** Known quantum-vulnerable npm dependencies. */\nexport const vulnerableDependencies: VulnerableDependency[] = [\n  {\n    name: \"node-forge\",\n    ecosystem: \"npm\",\n    reason: \"Pure-JS implementation of RSA, RSA-OAEP, and X.509 PKI.\",\n    algorithms: [\"RSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"elliptic\",\n    ecosystem: \"npm\",\n    reason: \"Elliptic-curve ECDSA/ECDH (secp256k1, p256, ed25519).\",\n    algorithms: [\"ECDSA\", \"ECDH\", \"EdDSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"jsrsasign\",\n    ecosystem: \"npm\",\n    reason: \"RSA/ECDSA/DSA signing, JWT, and X.509 in pure JS.\",\n    algorithms: [\"RSA\", \"ECDSA\", \"DSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"node-rsa\",\n    ecosystem: \"npm\",\n    reason: \"Classical RSA encryption and signing.\",\n    algorithms: [\"RSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"ursa\",\n    ecosystem: \"npm\",\n    reason: \"OpenSSL-backed RSA encryption and signing bindings.\",\n    algorithms: [\"RSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"sshpk\",\n    ecosystem: \"npm\",\n    reason: \"Parses/handles SSH and PEM keys (RSA, ECDSA, Ed25519, DSA).\",\n    algorithms: [\"RSA\", \"ECDSA\", \"EdDSA\", \"DSA\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"jsonwebtoken\",\n    ecosystem: \"npm\",\n    reason: \"JWTs commonly signed with RS256/ES256 (classical RSA/ECDSA).\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"high\",\n    hndl: false,\n  },\n  {\n    name: \"jose\",\n    ecosystem: \"npm\",\n    reason: \"JWS/JWE with classical RSA-OAEP, RSA-PSS, ECDH-ES and ECDSA.\",\n    algorithms: [\"RSA\", \"ECDH\", \"ECDSA\", \"EdDSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"jws\",\n    ecosystem: \"npm\",\n    reason: \"JSON Web Signatures using classical RS/ES algorithms.\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"high\",\n    hndl: false,\n  },\n  {\n    name: \"eccrypto\",\n    ecosystem: \"npm\",\n    reason: \"ECIES (ECDH-based) encryption and ECDSA signatures.\",\n    algorithms: [\"ECIES\", \"ECDH\", \"ECDSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"secp256k1\",\n    ecosystem: \"npm\",\n    reason: \"secp256k1 ECDSA/ECDH bindings (blockchain keys).\",\n    algorithms: [\"ECDSA\", \"ECDH\"],\n    severity: \"high\",\n  },\n  {\n    name: \"tweetnacl\",\n    ecosystem: \"npm\",\n    reason: \"X25519 key exchange and Ed25519 signatures (modern but classical).\",\n    algorithms: [\"X25519\", \"EdDSA\"],\n    severity: \"low\",\n  },\n  {\n    name: \"ed25519\",\n    ecosystem: \"npm\",\n    reason: \"Ed25519 signatures (classical).\",\n    algorithms: [\"EdDSA\"],\n    severity: \"low\",\n  },\n  {\n    name: \"@noble/curves\",\n    ecosystem: \"npm\",\n    reason: \"Audited classical curves: ECDSA, ECDH, Ed25519, X25519, secp256k1.\",\n    algorithms: [\"ECDSA\", \"ECDH\", \"EdDSA\", \"X25519\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"@noble/secp256k1\",\n    ecosystem: \"npm\",\n    reason: \"secp256k1 ECDSA/ECDH (classical).\",\n    algorithms: [\"ECDSA\", \"ECDH\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"@noble/ed25519\",\n    ecosystem: \"npm\",\n    reason: \"Ed25519 signatures and X25519 key exchange (classical).\",\n    algorithms: [\"EdDSA\", \"X25519\"],\n    severity: \"low\",\n  },\n  {\n    name: \"paseto\",\n    ecosystem: \"npm\",\n    reason: \"PASETO public tokens signed with classical Ed25519 (v2/v4) or RSA.\",\n    algorithms: [\"EdDSA\", \"RSA\"],\n    severity: \"medium\",\n    hndl: false,\n  },\n  {\n    name: \"bcrypto\",\n    ecosystem: \"npm\",\n    reason: \"Broad classical crypto suite: RSA, ECDSA, ECDH, Ed25519, DSA.\",\n    algorithms: [\"RSA\", \"ECDSA\", \"ECDH\", \"EdDSA\", \"DSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"ecpair\",\n    ecosystem: \"npm\",\n    reason: \"secp256k1 ECDSA key pairs for Bitcoin.\",\n    algorithms: [\"ECDSA\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"keypair\",\n    ecosystem: \"npm\",\n    reason: \"Pure-JS RSA key pair generation.\",\n    algorithms: [\"RSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"ethers\",\n    ecosystem: \"npm\",\n    reason: \"Ethereum library built on secp256k1 ECDSA signing and key derivation.\",\n    algorithms: [\"ECDSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"web3\",\n    ecosystem: \"npm\",\n    reason: \"Ethereum library using secp256k1 ECDSA for accounts and signing.\",\n    algorithms: [\"ECDSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"bitcoinjs-lib\",\n    ecosystem: \"npm\",\n    reason: \"Bitcoin library built on secp256k1 ECDSA/Schnorr keys and signatures.\",\n    algorithms: [\"ECDSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"ethereumjs-util\",\n    ecosystem: \"npm\",\n    reason: \"secp256k1 ECDSA utilities for Ethereum keys and signatures.\",\n    algorithms: [\"ECDSA\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"openpgp\",\n    ecosystem: \"npm\",\n    reason: \"OpenPGP.js: RSA, ECDSA, ECDH, and EdDSA public-key crypto.\",\n    algorithms: [\"RSA\", \"ECDSA\", \"ECDH\", \"EdDSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"node-jose\",\n    ecosystem: \"npm\",\n    reason: \"JOSE (JWS/JWE/JWK) with classical RSA and EC algorithms.\",\n    algorithms: [\"RSA\", \"ECDSA\", \"ECDH\"],\n    severity: \"high\",\n  },\n  {\n    name: \"jwa\",\n    ecosystem: \"npm\",\n    reason: \"JSON Web Algorithms: RSA (RS/PS) and EC (ES) signatures.\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"medium\",\n    hndl: false,\n  },\n  {\n    name: \"jwk-to-pem\",\n    ecosystem: \"npm\",\n    reason: \"Converts RSA/EC JWKs to PEM — classical public keys.\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"fast-jwt\",\n    ecosystem: \"npm\",\n    reason: \"JWT signing/verification with classical RS/PS/ES algorithms.\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"medium\",\n    hndl: false,\n  },\n  {\n    name: \"ssh2\",\n    ecosystem: \"npm\",\n    reason: \"SSH client/server using classical RSA/ECDSA/Ed25519 host and user keys.\",\n    algorithms: [\"RSA\", \"ECDSA\", \"EdDSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"@peculiar/x509\",\n    ecosystem: \"npm\",\n    reason: \"X.509 certificate library over classical RSA/EC keys.\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"pkijs\",\n    ecosystem: \"npm\",\n    reason: \"PKI (X.509/CMS) built on classical RSA and EC public-key crypto.\",\n    algorithms: [\"RSA\", \"ECDSA\", \"ECDH\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"http-signature\",\n    ecosystem: \"npm\",\n    reason: \"HTTP request signing with classical RSA/ECDSA keys.\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"medium\",\n    hndl: false,\n  },\n  {\n    name: \"libsodium-wrappers\",\n    ecosystem: \"npm\",\n    reason: \"libsodium: Ed25519 signatures and X25519 key exchange (classical).\",\n    algorithms: [\"EdDSA\", \"X25519\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"ecdsa-sig-formatter\",\n    ecosystem: \"npm\",\n    reason: \"Formats ECDSA signatures — a marker of classical EC signing.\",\n    algorithms: [\"ECDSA\"],\n    severity: \"low\",\n  },\n\n  // --- PyPI (Python) ---\n  {\n    name: \"pycryptodome\",\n    ecosystem: \"pypi\",\n    reason: \"RSA / ECC / DSA public-key crypto for Python.\",\n    algorithms: [\"RSA\", \"ECDSA\", \"DSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"pycrypto\",\n    ecosystem: \"pypi\",\n    reason: \"Abandoned/unmaintained crypto library — classical RSA/DSA/ElGamal.\",\n    algorithms: [\"RSA\", \"DSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"jwcrypto\",\n    ecosystem: \"pypi\",\n    reason: \"JWK / JWS / JWE with classical RS*/ES* and ECDH-ES key agreement.\",\n    algorithms: [\"RSA\", \"ECDSA\", \"ECDH\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"authlib\",\n    ecosystem: \"pypi\",\n    reason: \"OAuth / OIDC / JOSE stack using classical RS*/ES* JWT signing.\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"medium\",\n    hndl: false,\n  },\n  {\n    name: \"pycryptodomex\",\n    ecosystem: \"pypi\",\n    reason: \"RSA / ECC / DSA public-key crypto (the `Cryptodome` namespace).\",\n    algorithms: [\"RSA\", \"ECDSA\", \"DSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"rsa\",\n    ecosystem: \"pypi\",\n    reason: \"Pure-Python RSA encryption and signing.\",\n    algorithms: [\"RSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"ecdsa\",\n    ecosystem: \"pypi\",\n    reason: \"Pure-Python ECDSA/ECDH over NIST + secp256k1 curves.\",\n    algorithms: [\"ECDSA\", \"ECDH\"],\n    severity: \"high\",\n  },\n  {\n    name: \"cryptography\",\n    ecosystem: \"pypi\",\n    reason: \"General crypto library exposing classical RSA/EC/DH/DSA (also symmetric/PQC).\",\n    algorithms: [\"RSA\", \"ECDH\", \"ECDSA\", \"DSA\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"pyjwt\",\n    ecosystem: \"pypi\",\n    reason: \"JWT signing with classical RS*/ES* algorithms.\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"medium\",\n    hndl: false,\n  },\n  {\n    name: \"python-jose\",\n    ecosystem: \"pypi\",\n    reason: \"JOSE/JWT with classical RSA/ECDSA algorithms.\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"paramiko\",\n    ecosystem: \"pypi\",\n    reason: \"SSH client/server with classical RSA/ECDSA/Ed25519/DSA host + user keys.\",\n    algorithms: [\"RSA\", \"ECDSA\", \"EdDSA\", \"DSA\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"pyopenssl\",\n    ecosystem: \"pypi\",\n    reason: \"OpenSSL bindings for classical RSA/EC X.509 + TLS.\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"pynacl\",\n    ecosystem: \"pypi\",\n    reason:\n      \"libsodium bindings — X25519 key agreement and Ed25519 signatures (modern but classical).\",\n    algorithms: [\"X25519\", \"EdDSA\"],\n    severity: \"low\",\n  },\n\n  // --- crates.io (Rust) ---\n  {\n    name: \"rsa\",\n    ecosystem: \"cargo\",\n    reason: \"Pure-Rust RSA encryption and signing.\",\n    algorithms: [\"RSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"ring\",\n    ecosystem: \"cargo\",\n    reason: \"RSA / ECDSA / Ed25519 / ECDH primitives.\",\n    algorithms: [\"RSA\", \"ECDSA\", \"EdDSA\", \"ECDH\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"openssl\",\n    ecosystem: \"cargo\",\n    reason: \"OpenSSL bindings for classical RSA/EC crypto.\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"p256\",\n    ecosystem: \"cargo\",\n    reason: \"NIST P-256 ECDSA signatures and ECDH key agreement.\",\n    algorithms: [\"ECDSA\", \"ECDH\"],\n    severity: \"high\",\n  },\n  {\n    name: \"p384\",\n    ecosystem: \"cargo\",\n    reason: \"NIST P-384 ECDSA signatures and ECDH key agreement.\",\n    algorithms: [\"ECDSA\", \"ECDH\"],\n    severity: \"high\",\n  },\n  {\n    name: \"k256\",\n    ecosystem: \"cargo\",\n    reason: \"secp256k1 ECDSA signatures and ECDH key agreement.\",\n    algorithms: [\"ECDSA\", \"ECDH\"],\n    severity: \"high\",\n  },\n  {\n    name: \"secp256k1\",\n    ecosystem: \"cargo\",\n    reason: \"libsecp256k1 bindings (blockchain) — classical ECDSA + ECDH.\",\n    algorithms: [\"ECDSA\", \"ECDH\"],\n    severity: \"high\",\n  },\n  {\n    name: \"ed25519-dalek\",\n    ecosystem: \"cargo\",\n    reason: \"Ed25519 signatures (modern but classical).\",\n    algorithms: [\"EdDSA\"],\n    severity: \"low\",\n  },\n  {\n    name: \"x25519-dalek\",\n    ecosystem: \"cargo\",\n    reason: \"X25519 key agreement (modern but classical).\",\n    algorithms: [\"X25519\"],\n    severity: \"low\",\n  },\n\n  // --- Go modules ---\n  {\n    name: \"golang.org/x/crypto\",\n    ecosystem: \"go\",\n    reason: \"SSH, OpenPGP, and classical curve helpers on top of the Go stdlib.\",\n    algorithms: [\"RSA\", \"ECDSA\", \"EdDSA\", \"ECDH\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"github.com/golang-jwt/jwt/v5\",\n    ecosystem: \"go\",\n    reason: \"golang-jwt — classical RS*/PS*/ES* JWT algorithms.\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"medium\",\n    hndl: false,\n  },\n  {\n    name: \"github.com/golang-jwt/jwt/v4\",\n    ecosystem: \"go\",\n    reason: \"golang-jwt (v4) — classical RS*/PS*/ES* JWT algorithms.\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"medium\",\n    hndl: false,\n  },\n  {\n    name: \"github.com/go-jose/go-jose/v4\",\n    ecosystem: \"go\",\n    reason: \"go-jose — classical JOSE (RSA/ECDSA signatures, ECDH-ES key agreement).\",\n    algorithms: [\"RSA\", \"ECDSA\", \"ECDH\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"github.com/cloudflare/circl\",\n    ecosystem: \"go\",\n    reason:\n      \"Cloudflare CIRCL — classical ECDH/EdDSA curves (X25519, X448, Ed25519, P-256); also ships PQC (ML-KEM/ML-DSA + hybrids), so migrate the classical *usage*, not the package.\",\n    algorithms: [\"ECDH\", \"EdDSA\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"github.com/decred/dcrd/dcrec/secp256k1/v4\",\n    ecosystem: \"go\",\n    reason: \"decred secp256k1 — classical ECDSA/ECDH on the secp256k1 curve (blockchain keys).\",\n    algorithms: [\"ECDSA\", \"ECDH\"],\n    severity: \"medium\",\n  },\n\n  // --- Maven (Java) ---\n  {\n    name: \"bcprov-jdk18on\",\n    ecosystem: \"maven\",\n    reason: \"BouncyCastle provider — full classical RSA/ECDSA/ECDH/DSA suite.\",\n    algorithms: [\"RSA\", \"ECDSA\", \"ECDH\", \"DSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"bcprov-jdk15on\",\n    ecosystem: \"maven\",\n    reason: \"BouncyCastle provider (JDK 1.5+) — classical RSA/ECDSA/ECDH/DSA.\",\n    algorithms: [\"RSA\", \"ECDSA\", \"ECDH\", \"DSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"bcpkix-jdk18on\",\n    ecosystem: \"maven\",\n    reason: \"BouncyCastle PKIX — classical X.509 / CMS with RSA/ECDSA.\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"java-jwt\",\n    ecosystem: \"maven\",\n    reason: \"Auth0 JWT with classical RS*/ES* algorithms.\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"medium\",\n    hndl: false,\n  },\n  {\n    name: \"nimbus-jose-jwt\",\n    ecosystem: \"maven\",\n    reason: \"Nimbus JOSE+JWT — classical RS*/PS*/ES* JWS and RSA/ECDH-ES JWE.\",\n    algorithms: [\"RSA\", \"ECDSA\", \"ECDH\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"jjwt-api\",\n    ecosystem: \"maven\",\n    reason: \"JJWT (io.jsonwebtoken) — classical RS*/ES* JWT signing.\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"medium\",\n    hndl: false,\n  },\n\n  // --- RubyGems ---\n  {\n    name: \"jwt\",\n    ecosystem: \"rubygems\",\n    reason: \"Ruby JWT with classical RS*/ES* algorithms.\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"medium\",\n    hndl: false,\n  },\n  {\n    name: \"net-ssh\",\n    ecosystem: \"rubygems\",\n    reason:\n      \"Ruby SSH client — classical host/user keys (RSA/ECDSA/Ed25519) and ECDH/DH key exchange.\",\n    algorithms: [\"RSA\", \"ECDSA\", \"ECDH\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"rbnacl\",\n    ecosystem: \"rubygems\",\n    reason: \"libsodium bindings — X25519 key agreement and Ed25519 signatures.\",\n    algorithms: [\"X25519\", \"EdDSA\"],\n    severity: \"low\",\n  },\n  {\n    name: \"ed25519\",\n    ecosystem: \"rubygems\",\n    reason: \"Ed25519 signatures (modern but classical).\",\n    algorithms: [\"EdDSA\"],\n    severity: \"low\",\n  },\n\n  // --- NuGet (.NET) ---\n  {\n    name: \"BouncyCastle.Cryptography\",\n    ecosystem: \"nuget\",\n    reason: \"BouncyCastle for .NET — full classical RSA/ECDSA/ECDH/DSA suite.\",\n    algorithms: [\"RSA\", \"ECDSA\", \"ECDH\", \"DSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"Portable.BouncyCastle\",\n    ecosystem: \"nuget\",\n    reason: \"Portable BouncyCastle for .NET — classical RSA/ECDSA/ECDH/DSA.\",\n    algorithms: [\"RSA\", \"ECDSA\", \"ECDH\", \"DSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"System.IdentityModel.Tokens.Jwt\",\n    ecosystem: \"nuget\",\n    reason: \"Microsoft JWT handler — classical RS*/ES* (RSA/ECDSA) signatures.\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"medium\",\n    hndl: false,\n  },\n  {\n    name: \"Microsoft.IdentityModel.Tokens\",\n    ecosystem: \"nuget\",\n    reason: \"Microsoft IdentityModel token crypto — classical RSA/ECDSA keys.\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"medium\",\n    hndl: false,\n  },\n];\n\n/**\n * Normalise a package name for matching within its ecosystem. PyPI is\n * case-insensitive and folds runs of `-_.` to a single `-` (PEP 503); cargo /\n * maven / rubygems / nuget are effectively lower-case (NuGet ids are matched\n * case-insensitively); npm and go module paths are matched verbatim (npm scopes\n * and go paths are case-sensitive).\n */\nfunction normalizeName(ecosystem: DependencyEcosystem, name: string): string {\n  const n = name.trim();\n  if (ecosystem === \"pypi\") return n.toLowerCase().replace(/[-_.]+/g, \"-\");\n  if (ecosystem === \"npm\" || ecosystem === \"go\") return n;\n  return n.toLowerCase();\n}\n\n/** ecosystem → (normalised name → entry). Scoped so `rsa` (pypi) ≠ `rsa` (cargo). */\nconst BY_ECOSYSTEM: Map<DependencyEcosystem, Map<string, VulnerableDependency>> = (() => {\n  const m = new Map<DependencyEcosystem, Map<string, VulnerableDependency>>();\n  for (const d of vulnerableDependencies) {\n    let em = m.get(d.ecosystem);\n    if (!em) {\n      em = new Map();\n      m.set(d.ecosystem, em);\n    }\n    em.set(normalizeName(d.ecosystem, d.name), d);\n  }\n  return m;\n})();\n\n/**\n * Precompiled `\"name\":` lookup regex per known npm package (P1-9): the set is\n * static, so build the (name → RegExp) map once rather than per manifest. Only\n * npm uses the JSON-key form; other ecosystems locate names generically.\n */\nconst KEY_REGEX_BY_NAME = new Map<string, RegExp>(\n  vulnerableDependencies\n    .filter((d) => d.ecosystem === \"npm\")\n    .map((d): [string, RegExp] => {\n      const escaped = d.name.replace(/[.*+?^${}()|[\\]\\\\/]/g, \"\\\\$&\");\n      return [d.name, new RegExp(`\"${escaped}\"\\\\s*:`)];\n    }),\n);\n\n/**\n * Build a remediation string covering ALL families a package exposes (C5),\n * rather than only `algorithms[0]`. De-duplicates by PQC *target* — the KEM\n * target and the signature target are each named at most once — so a library\n * exposing both a confidentiality family and a signature family reads\n * \"ML-KEM-768 … for key exchange/encryption; ML-DSA-65 (FIPS 204) for\n * signatures\" instead of repeating ML-DSA (the old per-string Set couldn't\n * collapse \"ML-DSA-65 for signatures\" against a standalone \"ML-DSA-65 (FIPS 204)\").\n */\nfunction multiFamilyRemediation(algorithms: readonly AlgorithmFamily[]): string {\n  let needsKem = false;\n  let needsSig = false;\n  let needsReview = false;\n  for (const a of algorithms) {\n    if (isConfidentialityFamily(a)) needsKem = true;\n    if (isSignatureFamily(a)) needsSig = true;\n    if (a === \"unknown\") needsReview = true;\n  }\n  const parts: string[] = [];\n  if (needsKem)\n    parts.push(\"ML-KEM-768 (FIPS 203, hybrid X25519MLKEM768) for key exchange/encryption\");\n  if (needsSig) parts.push(\"ML-DSA-65 (FIPS 204) for signatures\");\n  // Only fall back to the generic \"review\" line when nothing concrete applied.\n  if (needsReview && parts.length === 0) parts.push(remediationText(\"unknown\"));\n  return parts.join(\"; \");\n}\n\n/**\n * The dependency ecosystem a manifest filename belongs to, or null when the file\n * is not a manifest we parse. Drives both {@link isManifestFile} and the scanner\n * dispatch — one place to add a manifest format.\n */\nexport function manifestEcosystem(file: string): DependencyEcosystem | null {\n  const base = (file.split(\"/\").pop() ?? file).toLowerCase();\n  if (\n    base === \"package.json\" ||\n    base === \"package-lock.json\" ||\n    base === \"npm-shrinkwrap.json\" ||\n    base === \"yarn.lock\" ||\n    base === \"pnpm-lock.yaml\"\n  ) {\n    return \"npm\";\n  }\n  if (base === \"requirements.txt\" || /^requirements[\\w.-]*\\.txt$/.test(base)) return \"pypi\";\n  if (base === \"pyproject.toml\" || base === \"pipfile\") return \"pypi\";\n  if (base === \"cargo.toml\") return \"cargo\";\n  if (base === \"go.mod\") return \"go\";\n  if (base === \"pom.xml\" || base === \"build.gradle\" || base === \"build.gradle.kts\") return \"maven\";\n  if (base === \"gemfile\" || base.endsWith(\".gemspec\")) return \"rubygems\";\n  if (base === \"packages.config\" || base === \"directory.packages.props\" || base.endsWith(\".csproj\"))\n    return \"nuget\";\n  return null;\n}\n\n/** True if a file path looks like a manifest we can parse for dependencies. */\nexport function isManifestFile(file: string): boolean {\n  return manifestEcosystem(file) !== null;\n}\n\n/**\n * Extract candidate package names from a non-npm manifest. Extraction is\n * deliberately GENEROUS — every finding still has to match a curated DB entry,\n * so over-extracting harmless tokens (e.g. a TOML `version = …` key) costs\n * nothing while keeping the parsers tiny and format-tolerant.\n */\nfunction candidateNames(ecosystem: DependencyEcosystem, content: string): string[] {\n  const names: string[] = [];\n  const lines = content.split(\"\\n\");\n  switch (ecosystem) {\n    case \"pypi\": {\n      // requirements.txt / Pipfile / pyproject.toml: leading token per line, plus\n      // quoted deps in arrays/tables. Skip comments and `-r/-e/--flag` lines.\n      for (const raw of lines) {\n        const line = raw.trim();\n        if (!line || line.startsWith(\"#\") || line.startsWith(\"-\")) continue;\n        const lead = /^[\"']?([A-Za-z][A-Za-z0-9._-]+)/.exec(line);\n        if (lead) names.push(lead[1]);\n        for (const m of line.matchAll(/[\"']([A-Za-z][A-Za-z0-9._-]+)/g)) names.push(m[1]);\n      }\n      break;\n    }\n    case \"cargo\": {\n      // Cargo.toml: dependency-table keys `name = …` and `[…dependencies.name]`.\n      for (const raw of lines) {\n        const line = raw.trim();\n        if (!line || line.startsWith(\"#\")) continue;\n        const key = /^([A-Za-z0-9][A-Za-z0-9_-]+)\\s*=/.exec(line);\n        if (key) names.push(key[1]);\n        const table = /^\\[[\\w.-]*dependencies\\.([A-Za-z0-9][A-Za-z0-9_-]+)\\]/.exec(line);\n        if (table) names.push(table[1]);\n      }\n      break;\n    }\n    case \"go\": {\n      // go.mod: `require path v1.2.3` (single or in a require( … ) block).\n      for (const m of content.matchAll(/(?:^|\\s)([a-z0-9][\\w.\\-/]+)\\s+v\\d/gm)) names.push(m[1]);\n      break;\n    }\n    case \"maven\": {\n      // pom.xml <artifactId> tags + gradle `group:artifact:version` strings.\n      for (const m of content.matchAll(/<artifactId>\\s*([\\w.-]+)\\s*<\\/artifactId>/g)) {\n        names.push(m[1]);\n      }\n      for (const m of content.matchAll(/[\"']([\\w.-]+):([\\w.-]+):[\\w.$-]+[\"']/g)) names.push(m[2]);\n      break;\n    }\n    case \"rubygems\": {\n      // Gemfile `gem 'name'` + gemspec `add_*dependency 'name'`.\n      for (const m of content.matchAll(/\\bgem\\s+[\"']([\\w.-]+)[\"']/g)) names.push(m[1]);\n      for (const m of content.matchAll(\n        /add(?:_runtime|_development)?_dependency\\s+[\"']([\\w.-]+)[\"']/g,\n      )) {\n        names.push(m[1]);\n      }\n      break;\n    }\n    case \"nuget\": {\n      // NuGet manifests are XML. `.csproj` / `Directory.Packages.props` declare\n      // `<PackageReference Include=\"Name\" … />`; `packages.config` uses\n      // `<package id=\"Name\" … />`. Pull the Include= / id= attribute value from\n      // each. The `[^>]` guard keeps every match inside a single tag, so the\n      // scan is linear (no nested quantifiers → no catastrophic backtracking).\n      for (const m of content.matchAll(/<PackageReference\\b[^>]*\\bInclude\\s*=\\s*\"([^\"]+)\"/gi)) {\n        names.push(m[1]);\n      }\n      for (const m of content.matchAll(/<package\\b[^>]*\\bid\\s*=\\s*\"([^\"]+)\"/gi)) {\n        names.push(m[1]);\n      }\n      break;\n    }\n    case \"npm\":\n      break; // npm uses the JSON path, not this extractor.\n  }\n  return names;\n}\n\n/** First offset of a package `name` as a whole token in the manifest text (or 0). */\nfunction offsetOfName(content: string, name: string): number {\n  const escaped = name.replace(/[.*+?^${}()|[\\]\\\\/]/g, \"\\\\$&\");\n  const m = new RegExp(`(?<![\\\\w./-])${escaped}(?![\\\\w-])`).exec(content);\n  return m ? m.index : 0;\n}\n\n/**\n * Build a finding for a vulnerable dependency located in a manifest. The\n * location points at the line where the package name appears in the file (best\n * effort), falling back to line 1.\n */\nfunction dependencyFinding(\n  dep: VulnerableDependency,\n  file: string,\n  content: string,\n  index: number,\n): Finding {\n  // Use the first listed algorithm for the headline family, but derive the\n  // remediation from ALL families the package exposes (C5).\n  const algorithm = dep.algorithms[0] ?? \"unknown\";\n  return makeFinding({\n    ruleId: \"dep-vulnerable\",\n    title: `Quantum-vulnerable dependency: ${dep.name}`,\n    category: \"dependency\",\n    severity: dep.severity,\n    confidence: \"high\",\n    algorithm,\n    // Confidentiality libs are HNDL-exposed; signature-only ones are not. An\n    // explicit `dep.hndl` wins (some packages list RSA/EC as a family but only\n    // ever sign — e.g. JWS/JWT libs — and signatures are not HNDL-exposed).\n    hndl: dep.hndl ?? dep.algorithms.some(isConfidentialityFamily),\n    cwe: CWE_BROKEN_CRYPTO,\n    message: `${dep.name} — ${dep.reason}`,\n    remediation: multiFamilyRemediation(dep.algorithms),\n    file,\n    content,\n    index,\n  });\n}\n\n/** Locate the offset of a JSON key `\"name\"` in the manifest text (or 0). */\nfunction offsetOfKey(content: string, name: string): number {\n  // Use the precompiled per-name regex (non-global; .exec from position 0).\n  const re = KEY_REGEX_BY_NAME.get(name);\n  if (!re) return 0;\n  const m = re.exec(content);\n  return m ? m.index : 0;\n}\n\n/** Sort findings by title for deterministic output. */\nfunction sortByTitle(findings: Finding[]): Finding[] {\n  findings.sort((a, b) => (a.title < b.title ? -1 : a.title > b.title ? 1 : 0));\n  return findings;\n}\n\n/**\n * Scan a single manifest file for vulnerable dependencies, dispatching by the\n * file's ecosystem ({@link manifestEcosystem}). npm manifests are parsed as\n * JSON; every other ecosystem uses the generous {@link candidateNames} extractor\n * filtered against the ecosystem-scoped database. Returns one finding per\n * distinct vulnerable package.\n */\nexport function scanManifest(file: string, content: string): Finding[] {\n  const ecosystem = manifestEcosystem(file);\n  if (!ecosystem) return [];\n  const db = BY_ECOSYSTEM.get(ecosystem);\n  if (!db) return [];\n\n  if (ecosystem === \"npm\") {\n    const base = (file.split(\"/\").pop() ?? file).toLowerCase();\n    // yarn.lock / pnpm-lock.yaml are not JSON — extract names from their text.\n    if (base === \"yarn.lock\" || base === \"pnpm-lock.yaml\") {\n      return scanNpmLockfile(content, file, db);\n    }\n    return scanNpmManifest(content, file, db);\n  }\n\n  const found = new Map<string, VulnerableDependency>(); // dedupe by entry\n  for (const raw of candidateNames(ecosystem, content)) {\n    const dep = db.get(normalizeName(ecosystem, raw));\n    if (dep) found.set(dep.name, dep);\n  }\n  const findings: Finding[] = [];\n  for (const dep of found.values()) {\n    findings.push(dependencyFinding(dep, file, content, offsetOfName(content, dep.name)));\n  }\n  return sortByTitle(findings);\n}\n\n/**\n * npm manifest scan.\n * - `package.json`: dependencies / devDependencies / peerDependencies / optionalDependencies.\n * - `package-lock.json` (v2/v3): the `packages` map keys (node_modules/<name>).\n */\nfunction scanNpmManifest(\n  content: string,\n  file: string,\n  db: Map<string, VulnerableDependency>,\n): Finding[] {\n  let json: unknown;\n  try {\n    json = JSON.parse(content);\n  } catch {\n    return []; // not valid JSON — skip quietly.\n  }\n  if (json === null || typeof json !== \"object\") return [];\n\n  const found = new Set<string>();\n  const obj = json as Record<string, unknown>;\n\n  const collectFromRecord = (rec: unknown): void => {\n    if (rec === null || typeof rec !== \"object\") return;\n    for (const key of Object.keys(rec as Record<string, unknown>)) {\n      if (db.has(key)) found.add(key);\n    }\n  };\n\n  collectFromRecord(obj.dependencies);\n  collectFromRecord(obj.devDependencies);\n  collectFromRecord(obj.peerDependencies);\n  collectFromRecord(obj.optionalDependencies);\n\n  const packages = obj.packages;\n  if (packages !== null && typeof packages === \"object\") {\n    for (const key of Object.keys(packages as Record<string, unknown>)) {\n      if (!key) continue; // root package entry\n      const marker = \"node_modules/\";\n      const idx = key.lastIndexOf(marker);\n      const name = idx >= 0 ? key.slice(idx + marker.length) : key;\n      if (db.has(name)) found.add(name);\n    }\n  }\n\n  const findings: Finding[] = [];\n  for (const name of found) {\n    const dep = db.get(name);\n    if (!dep) continue;\n    findings.push(dependencyFinding(dep, file, content, offsetOfKey(content, name)));\n  }\n  return sortByTitle(findings);\n}\n\n/**\n * Extract candidate package names from a yarn.lock / pnpm-lock.yaml text body.\n * Generous — every `name@…` (and pnpm's `/name/version`) token is captured; the\n * caller filters against the vulnerable-dependency DB, so over-capture is safe.\n * Handles yarn v1 (`elliptic@^6.5.4:`), yarn berry (`\"elliptic@npm:^6.5.4\":`),\n * and pnpm (`/elliptic@6.5.4:`, scoped `/@noble/curves@1.2.0:`).\n */\nfunction npmLockfileCandidates(content: string): string[] {\n  const names = new Set<string>();\n  const at = /(?:^|[\\s,\"'/])((?:@[a-z0-9._-]+\\/)?[a-z0-9][a-z0-9._-]*)@/gm;\n  let m: RegExpExecArray | null;\n  while ((m = at.exec(content)) !== null) names.add(m[1].toLowerCase());\n  // pnpm's older `/name/version` form (name followed by a version digit).\n  const slash = /(?:^|\\s)\\/((?:@[a-z0-9._-]+\\/)?[a-z0-9][a-z0-9._-]*)\\/\\d/gm;\n  while ((m = slash.exec(content)) !== null) names.add(m[1].toLowerCase());\n  return [...names];\n}\n\n/**\n * npm lockfile scan (yarn.lock / pnpm-lock.yaml): match every package token in\n * the lockfile text against the vulnerable-dependency DB. Catches transitive\n * dependencies that never appear in package.json.\n */\nfunction scanNpmLockfile(\n  content: string,\n  file: string,\n  db: Map<string, VulnerableDependency>,\n): Finding[] {\n  const found = new Map<string, VulnerableDependency>();\n  for (const name of npmLockfileCandidates(content)) {\n    const dep = db.get(name);\n    if (dep) found.set(dep.name, dep);\n  }\n  const findings: Finding[] = [];\n  for (const dep of found.values()) {\n    findings.push(dependencyFinding(dep, file, content, offsetOfName(content, dep.name)));\n  }\n  return sortByTitle(findings);\n}\n"]}
+{"version":3,"file":"dependencies.js","sourceRoot":"","sources":["../src/dependencies.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAE7C;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAa;IAC3C,EAAE,EAAE,gBAAgB;IACpB,KAAK,EAAE,+BAA+B;IACtC,QAAQ,EAAE,YAAY;IACtB,+EAA+E;IAC/E,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,IAAI,EAAE,KAAK;IACX,GAAG,EAAE,iBAAiB;IACtB,OAAO,EACL,8EAA8E;QAC9E,yEAAyE;IAC3E,WAAW,EACT,8EAA8E;QAC9E,2EAA2E;IAC7E,WAAW,EACT,gFAAgF;QAChF,0DAA0D;CAC7D,CAAC;AAEF,iDAAiD;AACjD,MAAM,CAAC,MAAM,sBAAsB,GAA2B;IAC5D;QACE,IAAI,EAAE,YAAY;QAClB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,yDAAyD;QACjE,UAAU,EAAE,CAAC,KAAK,CAAC;QACnB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,uDAAuD;QAC/D,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;QACtC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,mDAAmD;QAC3D,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC;QACnC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,uCAAuC;QAC/C,UAAU,EAAE,CAAC,KAAK,CAAC;QACnB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,qDAAqD;QAC7D,UAAU,EAAE,CAAC,KAAK,CAAC;QACnB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,OAAO;QACb,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,6DAA6D;QACrE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC;QAC5C,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,8DAA8D;QACtE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,8DAA8D;QACtE,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;QAC7C,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,KAAK;QACX,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,uDAAuD;QAC/D,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,qDAAqD;QAC7D,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;QACtC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,kDAAkD;QAC1D,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,oEAAoE;QAC5E,UAAU,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC/B,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,iCAAiC;QACzC,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,oEAAoE;QAC5E,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;QAChD,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,mCAAmC;QAC3C,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,yDAAyD;QACjE,UAAU,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC;QAC/B,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,oEAAoE;QAC5E,UAAU,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,+DAA+D;QACvE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;QACpD,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,wCAAwC;QAChD,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,kCAAkC;QAC1C,UAAU,EAAE,CAAC,KAAK,CAAC;QACnB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,uEAAuE;QAC/E,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,kEAAkE;QAC1E,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,uEAAuE;QAC/E,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,6DAA6D;QACrE,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,4DAA4D;QACpE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;QAC7C,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,0DAA0D;QAClE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;QACpC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,KAAK;QACX,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,0DAA0D;QAClE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,YAAY;QAClB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,sDAAsD;QAC9D,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,8DAA8D;QACtE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,yEAAyE;QACjF,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC;QACrC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,uDAAuD;QAC/D,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,OAAO;QACb,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,kEAAkE;QAC1E,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;QACpC,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,qDAAqD;QAC7D,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,oEAAoE;QAC5E,UAAU,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC;QAC/B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,SAAS,EAAE,KAAK;QAChB,MAAM,EAAE,8DAA8D;QACtE,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,KAAK;KAChB;IAED,wBAAwB;IACxB;QACE,IAAI,EAAE,cAAc;QACpB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,+CAA+C;QACvD,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC;QACnC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,oEAAoE;QAC5E,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC;QAC1B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,mEAAmE;QAC3E,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;QACpC,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,gEAAgE;QACxE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,eAAe;QACrB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,iEAAiE;QACzE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC;QACnC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,KAAK;QACX,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,yCAAyC;QACjD,UAAU,EAAE,CAAC,KAAK,CAAC;QACnB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,OAAO;QACb,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,sDAAsD;QAC9D,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,+EAA+E;QACvF,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;QAC3C,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,OAAO;QACb,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,gDAAgD;QACxD,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,aAAa;QACnB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,+CAA+C;QACvD,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,0EAA0E;QAClF,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC;QAC5C,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,MAAM;QACjB,MAAM,EAAE,oDAAoD;QAC5D,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,MAAM;QACjB,MAAM,EACJ,0FAA0F;QAC5F,UAAU,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC/B,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,MAAM;QACjB,MAAM,EACJ,4FAA4F;QAC9F,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;QAC9C,QAAQ,EAAE,MAAM;KACjB;IAED,2BAA2B;IAC3B;QACE,IAAI,EAAE,KAAK;QACX,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,uCAAuC;QAC/C,UAAU,EAAE,CAAC,KAAK,CAAC;QACnB,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,0CAA0C;QAClD,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC;QAC7C,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,+CAA+C;QACvD,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,qDAAqD;QAC7D,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,qDAAqD;QAC7D,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,oDAAoD;QAC5D,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,8DAA8D;QACtE,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,eAAe;QACrB,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,4CAA4C;QACpD,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,8CAA8C;QACtD,UAAU,EAAE,CAAC,QAAQ,CAAC;QACtB,QAAQ,EAAE,KAAK;KAChB;IAED,qBAAqB;IACrB;QACE,IAAI,EAAE,qBAAqB;QAC3B,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,oEAAoE;QAC5E,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC;QAC7C,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,oDAAoD;QAC5D,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,yDAAyD;QACjE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,+BAA+B;QACrC,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,yEAAyE;QACjF,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;QACpC,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,SAAS,EAAE,IAAI;QACf,MAAM,EACJ,6KAA6K;QAC/K,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;QAC7B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,2CAA2C;QACjD,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,mFAAmF;QAC3F,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,mCAAmC;QACzC,SAAS,EAAE,IAAI;QACf,MAAM,EACJ,wFAAwF;QAC1F,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;QAC9C,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,SAAS,EAAE,IAAI;QACf,MAAM,EAAE,gFAAgF;QACxF,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;QAC9C,QAAQ,EAAE,MAAM;KACjB;IAED,uBAAuB;IACvB;QACE,IAAI,EAAE,gBAAgB;QACtB,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,kEAAkE;QAC1E,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC;QAC3C,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,kEAAkE;QAC1E,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC;QAC3C,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,2DAA2D;QACnE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,8CAA8C;QACtD,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,iBAAiB;QACvB,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,kEAAkE;QAC1E,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;QACpC,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,UAAU;QAChB,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,yDAAyD;QACjE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,OAAO;QAClB,MAAM,EACJ,4GAA4G;QAC9G,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC;QAC9C,QAAQ,EAAE,MAAM;KACjB;IAED,mBAAmB;IACnB;QACE,IAAI,EAAE,KAAK;QACX,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,6CAA6C;QACrD,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,UAAU;QACrB,MAAM,EACJ,0FAA0F;QAC5F,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;QACpC,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,mEAAmE;QAC3E,UAAU,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC/B,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,IAAI,EAAE,SAAS;QACf,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,4CAA4C;QACpD,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,QAAQ,EAAE,KAAK;KAChB;IAED,uBAAuB;IACvB;QACE,IAAI,EAAE,2BAA2B;QACjC,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,kEAAkE;QAC1E,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC;QAC3C,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,gEAAgE;QACxE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC;QAC3C,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,mEAAmE;QAC3E,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,SAAS,EAAE,OAAO;QAClB,MAAM,EAAE,kEAAkE;QAC1E,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IAED,yBAAyB;IACzB;QACE,IAAI,EAAE,qBAAqB;QAC3B,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,0EAA0E;QAClF,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC;QACzC,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,2EAA2E;QACnF,UAAU,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC/B,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,iEAAiE;QACzE,UAAU,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC/B,QAAQ,EAAE,KAAK;KAChB;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,oEAAoE;QAC5E,UAAU,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,kBAAkB;QACxB,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,iEAAiE;QACzE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,cAAc;QACpB,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,wDAAwD;QAChE,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;QAC5B,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;KACZ;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,qFAAqF;QAC7F,UAAU,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;QACpC,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,IAAI,EAAE,aAAa;QACnB,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,kEAAkE;QAC1E,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,MAAM;KACjB;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,sEAAsE;QAC9E,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QAC7B,QAAQ,EAAE,MAAM;KACjB;CACF,CAAC;AAEF;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,SAA8B,EAAE,IAAY;IACjE,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,IAAI,SAAS,KAAK,MAAM;QAAE,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACzE,IAAI,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC;IACxD,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;AACzB,CAAC;AAED,qFAAqF;AACrF,MAAM,YAAY,GAAgE,CAAC,GAAG,EAAE;IACtF,MAAM,CAAC,GAAG,IAAI,GAAG,EAA0D,CAAC;IAC5E,KAAK,MAAM,CAAC,IAAI,sBAAsB,EAAE,CAAC;QACvC,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC5B,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,EAAE,GAAG,IAAI,GAAG,EAAE,CAAC;YACf,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACzB,CAAC;QACD,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC,CAAC,EAAE,CAAC;AAEL;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAC/B,sBAAsB;KACnB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC;KACpC,GAAG,CAAC,CAAC,CAAC,EAAoB,EAAE;IAC3B,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;IAC/D,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,OAAO,QAAQ,CAAC,CAAC,CAAC;AACnD,CAAC,CAAC,CACL,CAAC;AAEF;;;;;;;;GAQG;AACH,SAAS,sBAAsB,CAAC,UAAsC;IACpE,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,uBAAuB,CAAC,CAAC,CAAC;YAAE,QAAQ,GAAG,IAAI,CAAC;QAChD,IAAI,iBAAiB,CAAC,CAAC,CAAC;YAAE,QAAQ,GAAG,IAAI,CAAC;QAC1C,IAAI,CAAC,KAAK,SAAS;YAAE,WAAW,GAAG,IAAI,CAAC;IAC1C,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,QAAQ;QACV,KAAK,CAAC,IAAI,CAAC,0EAA0E,CAAC,CAAC;IACzF,IAAI,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IAChE,6EAA6E;IAC7E,IAAI,WAAW,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;IAC9E,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3D,IACE,IAAI,KAAK,cAAc;QACvB,IAAI,KAAK,mBAAmB;QAC5B,IAAI,KAAK,qBAAqB;QAC9B,IAAI,KAAK,WAAW;QACpB,IAAI,KAAK,gBAAgB,EACzB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,IAAI,KAAK,kBAAkB,IAAI,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IAC1F,IAAI,IAAI,KAAK,gBAAgB,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACnE,IAAI,IAAI,KAAK,YAAY;QAAE,OAAO,OAAO,CAAC;IAC1C,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,kBAAkB;QAAE,OAAO,OAAO,CAAC;IACjG,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,UAAU,CAAC;IACvE,IAAI,IAAI,KAAK,iBAAiB,IAAI,IAAI,KAAK,0BAA0B,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC/F,OAAO,OAAO,CAAC;IACjB,IAAI,IAAI,KAAK,eAAe,IAAI,IAAI,KAAK,eAAe;QAAE,OAAO,UAAU,CAAC;IAC5E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,iBAAiB,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,SAA8B,EAAE,OAAe;IACrE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,4EAA4E;YAC5E,wEAAwE;YACxE,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;gBACxB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBACpE,MAAM,IAAI,GAAG,iCAAiC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC1D,IAAI,IAAI;oBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC9B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,gCAAgC,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpF,CAAC;YACD,MAAM;QACR,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,2EAA2E;YAC3E,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;gBACxB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAC5C,MAAM,GAAG,GAAG,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC1D,IAAI,GAAG;oBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5B,MAAM,KAAK,GAAG,uDAAuD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjF,IAAI,KAAK;oBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAClC,CAAC;YACD,MAAM;QACR,CAAC;QACD,KAAK,IAAI,CAAC,CAAC,CAAC;YACV,qEAAqE;YACrE,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,qCAAqC,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1F,MAAM;QACR,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,uEAAuE;YACvE,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,4CAA4C,CAAC,EAAE,CAAC;gBAC/E,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,uCAAuC,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5F,MAAM;QACR,CAAC;QACD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,2DAA2D;YAC3D,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACjF,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAC9B,+DAA+D,CAChE,EAAE,CAAC;gBACF,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC;YACD,MAAM;QACR,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,0EAA0E;YAC1E,kEAAkE;YAClE,0EAA0E;YAC1E,uEAAuE;YACvE,yEAAyE;YACzE,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,qDAAqD,CAAC,EAAE,CAAC;gBACxF,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,uCAAuC,CAAC,EAAE,CAAC;gBAC1E,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC;YACD,MAAM;QACR,CAAC;QACD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,4EAA4E;YAC5E,yEAAyE;YACzE,0EAA0E;YAC1E,yEAAyE;YACzE,2EAA2E;YAC3E,iCAAiC;YACjC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAC9B,kFAAkF,CACnF,EAAE,CAAC;gBACF,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC;YACD,MAAM;QACR,CAAC;QACD,KAAK,KAAK;YACR,MAAM,CAAC,8CAA8C;IACzD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qFAAqF;AACrF,SAAS,YAAY,CAAC,OAAe,EAAE,IAAY;IACjD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,gBAAgB,OAAO,YAAY,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CACxB,GAAyB,EACzB,IAAY,EACZ,OAAe,EACf,KAAa;IAEb,yEAAyE;IACzE,0DAA0D;IAC1D,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;IACjD,OAAO,WAAW,CAAC;QACjB,MAAM,EAAE,gBAAgB;QACxB,KAAK,EAAE,kCAAkC,GAAG,CAAC,IAAI,EAAE;QACnD,QAAQ,EAAE,YAAY;QACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,UAAU,EAAE,MAAM;QAClB,SAAS;QACT,yEAAyE;QACzE,2EAA2E;QAC3E,wEAAwE;QACxE,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,uBAAuB,CAAC;QAC9D,GAAG,EAAE,iBAAiB;QACtB,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,MAAM,EAAE;QACtC,WAAW,EAAE,sBAAsB,CAAC,GAAG,CAAC,UAAU,CAAC;QACnD,IAAI;QACJ,OAAO;QACP,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AAED,4EAA4E;AAC5E,SAAS,WAAW,CAAC,OAAe,EAAE,IAAY;IAChD,0EAA0E;IAC1E,MAAM,EAAE,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,CAAC;IAClB,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3B,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACzB,CAAC;AAED,uDAAuD;AACvD,SAAS,WAAW,CAAC,QAAmB;IACtC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,OAAe;IACxD,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,CAAC;IAC1B,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,CAAC;IAEnB,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3D,2EAA2E;QAC3E,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;YACtD,OAAO,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,GAAG,EAAgC,CAAC,CAAC,kBAAkB;IACzE,KAAK,MAAM,GAAG,IAAI,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;QAClD,IAAI,GAAG;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,OAAO,IAAI,IAAI,IAAI,CAAC;AACtB,CAAC;AAED,kFAAkF;AAClF,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAE9B;;;;;;;;GAQG;AACH,SAAS,eAAe,CACtB,OAAe,EACf,IAAY,EACZ,EAAqC;IAErC,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,iCAAiC;IAC9C,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAEzD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,GAAG,GAAG,IAA+B,CAAC;IAE5C,MAAM,GAAG,GAAG,CAAC,IAAY,EAAQ,EAAE;QACjC,IAAI,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC;IAEF;;;;;;OAMG;IACH,MAAM,WAAW,GAAG,CAAC,IAAa,EAAE,KAAa,EAAQ,EAAE;QACzD,IAAI,KAAK,GAAG,kBAAkB,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO;QACpF,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC,EAAE,CAAC;YAC3E,GAAG,CAAC,IAAI,CAAC,CAAC;YACV,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,0EAA0E;gBAC1E,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;gBACrC,IAAI,OAAO;oBAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5B,CAAC;iBAAM,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrD,MAAM,GAAG,GAAG,IAA+B,CAAC;gBAC5C,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;oBACpC,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;oBAC5C,IAAI,OAAO;wBAAE,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC5B,CAAC;gBACD,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,gCAAgC;YAC5E,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IACjC,WAAW,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;IACpC,WAAW,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC;IACrC,WAAW,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC;IAEzC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;IAC9B,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACtD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAmC,CAAC,EAAE,CAAC;YAC/E,IAAI,CAAC,GAAG;gBAAE,SAAS,CAAC,qBAAqB;YACzC,MAAM,MAAM,GAAG,eAAe,CAAC;YAC/B,MAAM,GAAG,GAAG,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YACpC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACrD,2EAA2E;YAC3E,mEAAmE;YACnE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAChD,MAAM,QAAQ,GAAI,KAAiC,CAAC,IAAI,CAAC;gBACzD,IAAI,OAAO,QAAQ,KAAK,QAAQ;oBAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,qBAAqB,CAAC,OAAe;IAC5C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,EAAE,GAAG,6DAA6D,CAAC;IACzE,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI;QAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACtE,wEAAwE;IACxE,MAAM,KAAK,GAAG,4DAA4D,CAAC;IAC3E,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI;QAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACzE,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CACtB,OAAe,EACf,IAAY,EACZ,EAAqC;IAErC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAgC,CAAC;IACtD,KAAK,MAAM,IAAI,IAAI,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,GAAG;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;AAC/B,CAAC","sourcesContent":["/**\n * Curated database of packages that primarily expose classical asymmetric\n * cryptography (and are therefore quantum-vulnerable), across multiple\n * ecosystems (npm, PyPI, crates.io, Go modules, Maven, RubyGems, NuGet), plus a\n * manifest scanner that flags any of them found in the corresponding manifest\n * (package.json, requirements.txt, Cargo.toml, go.mod, pom.xml, Gemfile,\n * packages.config / *.csproj, …).\n *\n * The list is intentionally focused on libraries whose *purpose* is classical\n * public-key crypto. General-purpose packages that merely call the language's\n * stdlib crypto are out of scope here (those are caught by the source detectors).\n * Extraction is generous but every finding must match a curated entry, so a new\n * manifest format is cheap to add (see `manifestEcosystem` + `candidateNames`).\n */\nimport type {\n  AlgorithmFamily,\n  DependencyEcosystem,\n  Finding,\n  RuleMeta,\n  VulnerableDependency,\n} from \"./types.js\";\nimport { makeFinding } from \"./detect-utils.js\";\nimport { isConfidentialityFamily, isSignatureFamily, remediationText } from \"./remediation.js\";\nimport { CWE_BROKEN_CRYPTO } from \"./cwe.js\";\n\n/**\n * Catalog entry for the `dep-vulnerable` rule. Dependency findings are produced\n * by the manifest scanner rather than a registered {@link Detector}, so this\n * rule is absent from `defaultRegistry.ruleCatalog()`. Reporters (SARIF) merge\n * it in so the rule advertises a GENERIC description — the per-package specifics\n * (title/severity/HNDL/remediation) live on each individual finding/result, not\n * on the shared rule. Without this, SARIF would leak the first dependency's\n * package-specific text into the rule-level `shortDescription` for every dep.\n */\nexport const DEP_VULNERABLE_RULE: RuleMeta = {\n  id: \"dep-vulnerable\",\n  title: \"Quantum-vulnerable dependency\",\n  category: \"dependency\",\n  // Representative default; each SARIF result carries its own per-package level.\n  severity: \"high\",\n  confidence: \"high\",\n  hndl: false,\n  cwe: CWE_BROKEN_CRYPTO,\n  message:\n    \"A dependency implements classical public-key cryptography that is broken by \" +\n    \"quantum computers. Replace or upgrade it to a post-quantum alternative.\",\n  remediation:\n    \"Move to a post-quantum alternative — ML-KEM-768 (FIPS 203) for key exchange/\" +\n    \"encryption and ML-DSA-65 (FIPS 204) for signatures, ideally via a hybrid.\",\n  description:\n    \"Flags packages in a dependency manifest known to implement quantum-vulnerable \" +\n    \"public-key cryptography (RSA, ECDH/ECDSA, DH, EdDSA, …).\",\n};\n\n/** Known quantum-vulnerable npm dependencies. */\nexport const vulnerableDependencies: VulnerableDependency[] = [\n  {\n    name: \"node-forge\",\n    ecosystem: \"npm\",\n    reason: \"Pure-JS implementation of RSA, RSA-OAEP, and X.509 PKI.\",\n    algorithms: [\"RSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"elliptic\",\n    ecosystem: \"npm\",\n    reason: \"Elliptic-curve ECDSA/ECDH (secp256k1, p256, ed25519).\",\n    algorithms: [\"ECDSA\", \"ECDH\", \"EdDSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"jsrsasign\",\n    ecosystem: \"npm\",\n    reason: \"RSA/ECDSA/DSA signing, JWT, and X.509 in pure JS.\",\n    algorithms: [\"RSA\", \"ECDSA\", \"DSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"node-rsa\",\n    ecosystem: \"npm\",\n    reason: \"Classical RSA encryption and signing.\",\n    algorithms: [\"RSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"ursa\",\n    ecosystem: \"npm\",\n    reason: \"OpenSSL-backed RSA encryption and signing bindings.\",\n    algorithms: [\"RSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"sshpk\",\n    ecosystem: \"npm\",\n    reason: \"Parses/handles SSH and PEM keys (RSA, ECDSA, Ed25519, DSA).\",\n    algorithms: [\"RSA\", \"ECDSA\", \"EdDSA\", \"DSA\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"jsonwebtoken\",\n    ecosystem: \"npm\",\n    reason: \"JWTs commonly signed with RS256/ES256 (classical RSA/ECDSA).\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"high\",\n    hndl: false,\n  },\n  {\n    name: \"jose\",\n    ecosystem: \"npm\",\n    reason: \"JWS/JWE with classical RSA-OAEP, RSA-PSS, ECDH-ES and ECDSA.\",\n    algorithms: [\"RSA\", \"ECDH\", \"ECDSA\", \"EdDSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"jws\",\n    ecosystem: \"npm\",\n    reason: \"JSON Web Signatures using classical RS/ES algorithms.\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"high\",\n    hndl: false,\n  },\n  {\n    name: \"eccrypto\",\n    ecosystem: \"npm\",\n    reason: \"ECIES (ECDH-based) encryption and ECDSA signatures.\",\n    algorithms: [\"ECIES\", \"ECDH\", \"ECDSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"secp256k1\",\n    ecosystem: \"npm\",\n    reason: \"secp256k1 ECDSA/ECDH bindings (blockchain keys).\",\n    algorithms: [\"ECDSA\", \"ECDH\"],\n    severity: \"high\",\n  },\n  {\n    name: \"tweetnacl\",\n    ecosystem: \"npm\",\n    reason: \"X25519 key exchange and Ed25519 signatures (modern but classical).\",\n    algorithms: [\"X25519\", \"EdDSA\"],\n    severity: \"low\",\n  },\n  {\n    name: \"ed25519\",\n    ecosystem: \"npm\",\n    reason: \"Ed25519 signatures (classical).\",\n    algorithms: [\"EdDSA\"],\n    severity: \"low\",\n  },\n  {\n    name: \"@noble/curves\",\n    ecosystem: \"npm\",\n    reason: \"Audited classical curves: ECDSA, ECDH, Ed25519, X25519, secp256k1.\",\n    algorithms: [\"ECDSA\", \"ECDH\", \"EdDSA\", \"X25519\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"@noble/secp256k1\",\n    ecosystem: \"npm\",\n    reason: \"secp256k1 ECDSA/ECDH (classical).\",\n    algorithms: [\"ECDSA\", \"ECDH\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"@noble/ed25519\",\n    ecosystem: \"npm\",\n    reason: \"Ed25519 signatures and X25519 key exchange (classical).\",\n    algorithms: [\"EdDSA\", \"X25519\"],\n    severity: \"low\",\n  },\n  {\n    name: \"paseto\",\n    ecosystem: \"npm\",\n    reason: \"PASETO public tokens signed with classical Ed25519 (v2/v4) or RSA.\",\n    algorithms: [\"EdDSA\", \"RSA\"],\n    severity: \"medium\",\n    hndl: false,\n  },\n  {\n    name: \"bcrypto\",\n    ecosystem: \"npm\",\n    reason: \"Broad classical crypto suite: RSA, ECDSA, ECDH, Ed25519, DSA.\",\n    algorithms: [\"RSA\", \"ECDSA\", \"ECDH\", \"EdDSA\", \"DSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"ecpair\",\n    ecosystem: \"npm\",\n    reason: \"secp256k1 ECDSA key pairs for Bitcoin.\",\n    algorithms: [\"ECDSA\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"keypair\",\n    ecosystem: \"npm\",\n    reason: \"Pure-JS RSA key pair generation.\",\n    algorithms: [\"RSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"ethers\",\n    ecosystem: \"npm\",\n    reason: \"Ethereum library built on secp256k1 ECDSA signing and key derivation.\",\n    algorithms: [\"ECDSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"web3\",\n    ecosystem: \"npm\",\n    reason: \"Ethereum library using secp256k1 ECDSA for accounts and signing.\",\n    algorithms: [\"ECDSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"bitcoinjs-lib\",\n    ecosystem: \"npm\",\n    reason: \"Bitcoin library built on secp256k1 ECDSA/Schnorr keys and signatures.\",\n    algorithms: [\"ECDSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"ethereumjs-util\",\n    ecosystem: \"npm\",\n    reason: \"secp256k1 ECDSA utilities for Ethereum keys and signatures.\",\n    algorithms: [\"ECDSA\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"openpgp\",\n    ecosystem: \"npm\",\n    reason: \"OpenPGP.js: RSA, ECDSA, ECDH, and EdDSA public-key crypto.\",\n    algorithms: [\"RSA\", \"ECDSA\", \"ECDH\", \"EdDSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"node-jose\",\n    ecosystem: \"npm\",\n    reason: \"JOSE (JWS/JWE/JWK) with classical RSA and EC algorithms.\",\n    algorithms: [\"RSA\", \"ECDSA\", \"ECDH\"],\n    severity: \"high\",\n  },\n  {\n    name: \"jwa\",\n    ecosystem: \"npm\",\n    reason: \"JSON Web Algorithms: RSA (RS/PS) and EC (ES) signatures.\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"medium\",\n    hndl: false,\n  },\n  {\n    name: \"jwk-to-pem\",\n    ecosystem: \"npm\",\n    reason: \"Converts RSA/EC JWKs to PEM — classical public keys.\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"fast-jwt\",\n    ecosystem: \"npm\",\n    reason: \"JWT signing/verification with classical RS/PS/ES algorithms.\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"medium\",\n    hndl: false,\n  },\n  {\n    name: \"ssh2\",\n    ecosystem: \"npm\",\n    reason: \"SSH client/server using classical RSA/ECDSA/Ed25519 host and user keys.\",\n    algorithms: [\"RSA\", \"ECDSA\", \"EdDSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"@peculiar/x509\",\n    ecosystem: \"npm\",\n    reason: \"X.509 certificate library over classical RSA/EC keys.\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"pkijs\",\n    ecosystem: \"npm\",\n    reason: \"PKI (X.509/CMS) built on classical RSA and EC public-key crypto.\",\n    algorithms: [\"RSA\", \"ECDSA\", \"ECDH\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"http-signature\",\n    ecosystem: \"npm\",\n    reason: \"HTTP request signing with classical RSA/ECDSA keys.\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"medium\",\n    hndl: false,\n  },\n  {\n    name: \"libsodium-wrappers\",\n    ecosystem: \"npm\",\n    reason: \"libsodium: Ed25519 signatures and X25519 key exchange (classical).\",\n    algorithms: [\"EdDSA\", \"X25519\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"ecdsa-sig-formatter\",\n    ecosystem: \"npm\",\n    reason: \"Formats ECDSA signatures — a marker of classical EC signing.\",\n    algorithms: [\"ECDSA\"],\n    severity: \"low\",\n  },\n\n  // --- PyPI (Python) ---\n  {\n    name: \"pycryptodome\",\n    ecosystem: \"pypi\",\n    reason: \"RSA / ECC / DSA public-key crypto for Python.\",\n    algorithms: [\"RSA\", \"ECDSA\", \"DSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"pycrypto\",\n    ecosystem: \"pypi\",\n    reason: \"Abandoned/unmaintained crypto library — classical RSA/DSA/ElGamal.\",\n    algorithms: [\"RSA\", \"DSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"jwcrypto\",\n    ecosystem: \"pypi\",\n    reason: \"JWK / JWS / JWE with classical RS*/ES* and ECDH-ES key agreement.\",\n    algorithms: [\"RSA\", \"ECDSA\", \"ECDH\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"authlib\",\n    ecosystem: \"pypi\",\n    reason: \"OAuth / OIDC / JOSE stack using classical RS*/ES* JWT signing.\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"medium\",\n    hndl: false,\n  },\n  {\n    name: \"pycryptodomex\",\n    ecosystem: \"pypi\",\n    reason: \"RSA / ECC / DSA public-key crypto (the `Cryptodome` namespace).\",\n    algorithms: [\"RSA\", \"ECDSA\", \"DSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"rsa\",\n    ecosystem: \"pypi\",\n    reason: \"Pure-Python RSA encryption and signing.\",\n    algorithms: [\"RSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"ecdsa\",\n    ecosystem: \"pypi\",\n    reason: \"Pure-Python ECDSA/ECDH over NIST + secp256k1 curves.\",\n    algorithms: [\"ECDSA\", \"ECDH\"],\n    severity: \"high\",\n  },\n  {\n    name: \"cryptography\",\n    ecosystem: \"pypi\",\n    reason: \"General crypto library exposing classical RSA/EC/DH/DSA (also symmetric/PQC).\",\n    algorithms: [\"RSA\", \"ECDH\", \"ECDSA\", \"DSA\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"pyjwt\",\n    ecosystem: \"pypi\",\n    reason: \"JWT signing with classical RS*/ES* algorithms.\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"medium\",\n    hndl: false,\n  },\n  {\n    name: \"python-jose\",\n    ecosystem: \"pypi\",\n    reason: \"JOSE/JWT with classical RSA/ECDSA algorithms.\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"paramiko\",\n    ecosystem: \"pypi\",\n    reason: \"SSH client/server with classical RSA/ECDSA/Ed25519/DSA host + user keys.\",\n    algorithms: [\"RSA\", \"ECDSA\", \"EdDSA\", \"DSA\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"pyopenssl\",\n    ecosystem: \"pypi\",\n    reason: \"OpenSSL bindings for classical RSA/EC X.509 + TLS.\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"pynacl\",\n    ecosystem: \"pypi\",\n    reason:\n      \"libsodium bindings — X25519 key agreement and Ed25519 signatures (modern but classical).\",\n    algorithms: [\"X25519\", \"EdDSA\"],\n    severity: \"low\",\n  },\n  {\n    name: \"tink\",\n    ecosystem: \"pypi\",\n    reason:\n      \"Google Tink (Python) — classical RSA/ECDSA/Ed25519 signatures and ECIES hybrid encryption.\",\n    algorithms: [\"RSA\", \"ECDSA\", \"EdDSA\", \"ECIES\"],\n    severity: \"high\",\n  },\n\n  // --- crates.io (Rust) ---\n  {\n    name: \"rsa\",\n    ecosystem: \"cargo\",\n    reason: \"Pure-Rust RSA encryption and signing.\",\n    algorithms: [\"RSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"ring\",\n    ecosystem: \"cargo\",\n    reason: \"RSA / ECDSA / Ed25519 / ECDH primitives.\",\n    algorithms: [\"RSA\", \"ECDSA\", \"EdDSA\", \"ECDH\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"openssl\",\n    ecosystem: \"cargo\",\n    reason: \"OpenSSL bindings for classical RSA/EC crypto.\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"p256\",\n    ecosystem: \"cargo\",\n    reason: \"NIST P-256 ECDSA signatures and ECDH key agreement.\",\n    algorithms: [\"ECDSA\", \"ECDH\"],\n    severity: \"high\",\n  },\n  {\n    name: \"p384\",\n    ecosystem: \"cargo\",\n    reason: \"NIST P-384 ECDSA signatures and ECDH key agreement.\",\n    algorithms: [\"ECDSA\", \"ECDH\"],\n    severity: \"high\",\n  },\n  {\n    name: \"k256\",\n    ecosystem: \"cargo\",\n    reason: \"secp256k1 ECDSA signatures and ECDH key agreement.\",\n    algorithms: [\"ECDSA\", \"ECDH\"],\n    severity: \"high\",\n  },\n  {\n    name: \"secp256k1\",\n    ecosystem: \"cargo\",\n    reason: \"libsecp256k1 bindings (blockchain) — classical ECDSA + ECDH.\",\n    algorithms: [\"ECDSA\", \"ECDH\"],\n    severity: \"high\",\n  },\n  {\n    name: \"ed25519-dalek\",\n    ecosystem: \"cargo\",\n    reason: \"Ed25519 signatures (modern but classical).\",\n    algorithms: [\"EdDSA\"],\n    severity: \"low\",\n  },\n  {\n    name: \"x25519-dalek\",\n    ecosystem: \"cargo\",\n    reason: \"X25519 key agreement (modern but classical).\",\n    algorithms: [\"X25519\"],\n    severity: \"low\",\n  },\n\n  // --- Go modules ---\n  {\n    name: \"golang.org/x/crypto\",\n    ecosystem: \"go\",\n    reason: \"SSH, OpenPGP, and classical curve helpers on top of the Go stdlib.\",\n    algorithms: [\"RSA\", \"ECDSA\", \"EdDSA\", \"ECDH\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"github.com/golang-jwt/jwt/v5\",\n    ecosystem: \"go\",\n    reason: \"golang-jwt — classical RS*/PS*/ES* JWT algorithms.\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"medium\",\n    hndl: false,\n  },\n  {\n    name: \"github.com/golang-jwt/jwt/v4\",\n    ecosystem: \"go\",\n    reason: \"golang-jwt (v4) — classical RS*/PS*/ES* JWT algorithms.\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"medium\",\n    hndl: false,\n  },\n  {\n    name: \"github.com/go-jose/go-jose/v4\",\n    ecosystem: \"go\",\n    reason: \"go-jose — classical JOSE (RSA/ECDSA signatures, ECDH-ES key agreement).\",\n    algorithms: [\"RSA\", \"ECDSA\", \"ECDH\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"github.com/cloudflare/circl\",\n    ecosystem: \"go\",\n    reason:\n      \"Cloudflare CIRCL — classical ECDH/EdDSA curves (X25519, X448, Ed25519, P-256); also ships PQC (ML-KEM/ML-DSA + hybrids), so migrate the classical *usage*, not the package.\",\n    algorithms: [\"ECDH\", \"EdDSA\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"github.com/decred/dcrd/dcrec/secp256k1/v4\",\n    ecosystem: \"go\",\n    reason: \"decred secp256k1 — classical ECDSA/ECDH on the secp256k1 curve (blockchain keys).\",\n    algorithms: [\"ECDSA\", \"ECDH\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"github.com/tink-crypto/tink-go/v2\",\n    ecosystem: \"go\",\n    reason:\n      \"Google Tink (Go) — classical RSA/ECDSA/Ed25519 signatures and ECIES hybrid encryption.\",\n    algorithms: [\"RSA\", \"ECDSA\", \"EdDSA\", \"ECIES\"],\n    severity: \"high\",\n  },\n  {\n    name: \"github.com/google/tink/go\",\n    ecosystem: \"go\",\n    reason: \"Google Tink (legacy Go module) — classical RSA/ECDSA/Ed25519 and ECIES hybrid.\",\n    algorithms: [\"RSA\", \"ECDSA\", \"EdDSA\", \"ECIES\"],\n    severity: \"high\",\n  },\n\n  // --- Maven (Java) ---\n  {\n    name: \"bcprov-jdk18on\",\n    ecosystem: \"maven\",\n    reason: \"BouncyCastle provider — full classical RSA/ECDSA/ECDH/DSA suite.\",\n    algorithms: [\"RSA\", \"ECDSA\", \"ECDH\", \"DSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"bcprov-jdk15on\",\n    ecosystem: \"maven\",\n    reason: \"BouncyCastle provider (JDK 1.5+) — classical RSA/ECDSA/ECDH/DSA.\",\n    algorithms: [\"RSA\", \"ECDSA\", \"ECDH\", \"DSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"bcpkix-jdk18on\",\n    ecosystem: \"maven\",\n    reason: \"BouncyCastle PKIX — classical X.509 / CMS with RSA/ECDSA.\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"java-jwt\",\n    ecosystem: \"maven\",\n    reason: \"Auth0 JWT with classical RS*/ES* algorithms.\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"medium\",\n    hndl: false,\n  },\n  {\n    name: \"nimbus-jose-jwt\",\n    ecosystem: \"maven\",\n    reason: \"Nimbus JOSE+JWT — classical RS*/PS*/ES* JWS and RSA/ECDH-ES JWE.\",\n    algorithms: [\"RSA\", \"ECDSA\", \"ECDH\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"jjwt-api\",\n    ecosystem: \"maven\",\n    reason: \"JJWT (io.jsonwebtoken) — classical RS*/ES* JWT signing.\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"medium\",\n    hndl: false,\n  },\n  {\n    name: \"tink\",\n    ecosystem: \"maven\",\n    reason:\n      \"Google Tink (com.google.crypto.tink) — classical RSA/ECDSA/Ed25519 signatures and ECIES hybrid encryption.\",\n    algorithms: [\"RSA\", \"ECDSA\", \"EdDSA\", \"ECIES\"],\n    severity: \"high\",\n  },\n\n  // --- RubyGems ---\n  {\n    name: \"jwt\",\n    ecosystem: \"rubygems\",\n    reason: \"Ruby JWT with classical RS*/ES* algorithms.\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"medium\",\n    hndl: false,\n  },\n  {\n    name: \"net-ssh\",\n    ecosystem: \"rubygems\",\n    reason:\n      \"Ruby SSH client — classical host/user keys (RSA/ECDSA/Ed25519) and ECDH/DH key exchange.\",\n    algorithms: [\"RSA\", \"ECDSA\", \"ECDH\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"rbnacl\",\n    ecosystem: \"rubygems\",\n    reason: \"libsodium bindings — X25519 key agreement and Ed25519 signatures.\",\n    algorithms: [\"X25519\", \"EdDSA\"],\n    severity: \"low\",\n  },\n  {\n    name: \"ed25519\",\n    ecosystem: \"rubygems\",\n    reason: \"Ed25519 signatures (modern but classical).\",\n    algorithms: [\"EdDSA\"],\n    severity: \"low\",\n  },\n\n  // --- NuGet (.NET) ---\n  {\n    name: \"BouncyCastle.Cryptography\",\n    ecosystem: \"nuget\",\n    reason: \"BouncyCastle for .NET — full classical RSA/ECDSA/ECDH/DSA suite.\",\n    algorithms: [\"RSA\", \"ECDSA\", \"ECDH\", \"DSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"Portable.BouncyCastle\",\n    ecosystem: \"nuget\",\n    reason: \"Portable BouncyCastle for .NET — classical RSA/ECDSA/ECDH/DSA.\",\n    algorithms: [\"RSA\", \"ECDSA\", \"ECDH\", \"DSA\"],\n    severity: \"high\",\n  },\n  {\n    name: \"System.IdentityModel.Tokens.Jwt\",\n    ecosystem: \"nuget\",\n    reason: \"Microsoft JWT handler — classical RS*/ES* (RSA/ECDSA) signatures.\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"medium\",\n    hndl: false,\n  },\n  {\n    name: \"Microsoft.IdentityModel.Tokens\",\n    ecosystem: \"nuget\",\n    reason: \"Microsoft IdentityModel token crypto — classical RSA/ECDSA keys.\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"medium\",\n    hndl: false,\n  },\n\n  // --- Composer (PHP) ---\n  {\n    name: \"phpseclib/phpseclib\",\n    ecosystem: \"composer\",\n    reason: \"Pure-PHP RSA / DSA / ECDSA / Diffie-Hellman public-key crypto and X.509.\",\n    algorithms: [\"RSA\", \"DSA\", \"ECDSA\", \"DH\"],\n    severity: \"high\",\n  },\n  {\n    name: \"paragonie/sodium_compat\",\n    ecosystem: \"composer\",\n    reason: \"Pure-PHP libsodium polyfill: X25519 key agreement and Ed25519 signatures.\",\n    algorithms: [\"X25519\", \"EdDSA\"],\n    severity: \"low\",\n  },\n  {\n    name: \"paragonie/halite\",\n    ecosystem: \"composer\",\n    reason: \"libsodium wrapper: X25519 key agreement and Ed25519 signatures.\",\n    algorithms: [\"X25519\", \"EdDSA\"],\n    severity: \"low\",\n  },\n  {\n    name: \"paragonie/paseto\",\n    ecosystem: \"composer\",\n    reason: \"PASETO public tokens signed with classical Ed25519 (v2/v4) or RSA.\",\n    algorithms: [\"EdDSA\", \"RSA\"],\n    severity: \"medium\",\n    hndl: false,\n  },\n  {\n    name: \"firebase/php-jwt\",\n    ecosystem: \"composer\",\n    reason: \"PHP JWT signing/verification with classical RS*/ES* algorithms.\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"medium\",\n    hndl: false,\n  },\n  {\n    name: \"lcobucci/jwt\",\n    ecosystem: \"composer\",\n    reason: \"PHP JWT with classical RSA/ECDSA signature algorithms.\",\n    algorithms: [\"RSA\", \"ECDSA\"],\n    severity: \"medium\",\n    hndl: false,\n  },\n  {\n    name: \"web-token/jwt-framework\",\n    ecosystem: \"composer\",\n    reason: \"JOSE (JWS/JWE) framework: classical RSA/ECDSA signatures and ECDH-ES key agreement.\",\n    algorithms: [\"RSA\", \"ECDSA\", \"ECDH\"],\n    severity: \"medium\",\n  },\n  {\n    name: \"mdanter/ecc\",\n    ecosystem: \"composer\",\n    reason: \"Pure-PHP elliptic-curve ECDSA signatures and ECDH key agreement.\",\n    algorithms: [\"ECDSA\", \"ECDH\"],\n    severity: \"high\",\n  },\n  {\n    name: \"simplito/elliptic-php\",\n    ecosystem: \"composer\",\n    reason: \"secp256k1 / NIST-curve ECDSA and ECDH in pure PHP (blockchain keys).\",\n    algorithms: [\"ECDSA\", \"ECDH\"],\n    severity: \"high\",\n  },\n];\n\n/**\n * Normalise a package name for matching within its ecosystem. PyPI is\n * case-insensitive and folds runs of `-_.` to a single `-` (PEP 503); cargo /\n * maven / rubygems / nuget / composer are effectively lower-case (NuGet ids are\n * matched case-insensitively; Composer `vendor/package` names are lower-cased by\n * Packagist); npm and go module paths are matched verbatim (npm scopes and go\n * paths are case-sensitive).\n */\nfunction normalizeName(ecosystem: DependencyEcosystem, name: string): string {\n  const n = name.trim();\n  if (ecosystem === \"pypi\") return n.toLowerCase().replace(/[-_.]+/g, \"-\");\n  if (ecosystem === \"npm\" || ecosystem === \"go\") return n;\n  return n.toLowerCase();\n}\n\n/** ecosystem → (normalised name → entry). Scoped so `rsa` (pypi) ≠ `rsa` (cargo). */\nconst BY_ECOSYSTEM: Map<DependencyEcosystem, Map<string, VulnerableDependency>> = (() => {\n  const m = new Map<DependencyEcosystem, Map<string, VulnerableDependency>>();\n  for (const d of vulnerableDependencies) {\n    let em = m.get(d.ecosystem);\n    if (!em) {\n      em = new Map();\n      m.set(d.ecosystem, em);\n    }\n    em.set(normalizeName(d.ecosystem, d.name), d);\n  }\n  return m;\n})();\n\n/**\n * Precompiled `\"name\":` lookup regex per known npm package (P1-9): the set is\n * static, so build the (name → RegExp) map once rather than per manifest. Only\n * npm uses the JSON-key form; other ecosystems locate names generically.\n */\nconst KEY_REGEX_BY_NAME = new Map<string, RegExp>(\n  vulnerableDependencies\n    .filter((d) => d.ecosystem === \"npm\")\n    .map((d): [string, RegExp] => {\n      const escaped = d.name.replace(/[.*+?^${}()|[\\]\\\\/]/g, \"\\\\$&\");\n      return [d.name, new RegExp(`\"${escaped}\"\\\\s*:`)];\n    }),\n);\n\n/**\n * Build a remediation string covering ALL families a package exposes (C5),\n * rather than only `algorithms[0]`. De-duplicates by PQC *target* — the KEM\n * target and the signature target are each named at most once — so a library\n * exposing both a confidentiality family and a signature family reads\n * \"ML-KEM-768 … for key exchange/encryption; ML-DSA-65 (FIPS 204) for\n * signatures\" instead of repeating ML-DSA (the old per-string Set couldn't\n * collapse \"ML-DSA-65 for signatures\" against a standalone \"ML-DSA-65 (FIPS 204)\").\n */\nfunction multiFamilyRemediation(algorithms: readonly AlgorithmFamily[]): string {\n  let needsKem = false;\n  let needsSig = false;\n  let needsReview = false;\n  for (const a of algorithms) {\n    if (isConfidentialityFamily(a)) needsKem = true;\n    if (isSignatureFamily(a)) needsSig = true;\n    if (a === \"unknown\") needsReview = true;\n  }\n  const parts: string[] = [];\n  if (needsKem)\n    parts.push(\"ML-KEM-768 (FIPS 203, hybrid X25519MLKEM768) for key exchange/encryption\");\n  if (needsSig) parts.push(\"ML-DSA-65 (FIPS 204) for signatures\");\n  // Only fall back to the generic \"review\" line when nothing concrete applied.\n  if (needsReview && parts.length === 0) parts.push(remediationText(\"unknown\"));\n  return parts.join(\"; \");\n}\n\n/**\n * The dependency ecosystem a manifest filename belongs to, or null when the file\n * is not a manifest we parse. Drives both {@link isManifestFile} and the scanner\n * dispatch — one place to add a manifest format.\n */\nexport function manifestEcosystem(file: string): DependencyEcosystem | null {\n  const base = (file.split(\"/\").pop() ?? file).toLowerCase();\n  if (\n    base === \"package.json\" ||\n    base === \"package-lock.json\" ||\n    base === \"npm-shrinkwrap.json\" ||\n    base === \"yarn.lock\" ||\n    base === \"pnpm-lock.yaml\"\n  ) {\n    return \"npm\";\n  }\n  if (base === \"requirements.txt\" || /^requirements[\\w.-]*\\.txt$/.test(base)) return \"pypi\";\n  if (base === \"pyproject.toml\" || base === \"pipfile\") return \"pypi\";\n  if (base === \"cargo.toml\") return \"cargo\";\n  if (base === \"go.mod\") return \"go\";\n  if (base === \"pom.xml\" || base === \"build.gradle\" || base === \"build.gradle.kts\") return \"maven\";\n  if (base === \"gemfile\" || base.endsWith(\".gemspec\")) return \"rubygems\";\n  if (base === \"packages.config\" || base === \"directory.packages.props\" || base.endsWith(\".csproj\"))\n    return \"nuget\";\n  if (base === \"composer.json\" || base === \"composer.lock\") return \"composer\";\n  return null;\n}\n\n/** True if a file path looks like a manifest we can parse for dependencies. */\nexport function isManifestFile(file: string): boolean {\n  return manifestEcosystem(file) !== null;\n}\n\n/**\n * Extract candidate package names from a non-npm manifest. Extraction is\n * deliberately GENEROUS — every finding still has to match a curated DB entry,\n * so over-extracting harmless tokens (e.g. a TOML `version = …` key) costs\n * nothing while keeping the parsers tiny and format-tolerant.\n */\nfunction candidateNames(ecosystem: DependencyEcosystem, content: string): string[] {\n  const names: string[] = [];\n  const lines = content.split(\"\\n\");\n  switch (ecosystem) {\n    case \"pypi\": {\n      // requirements.txt / Pipfile / pyproject.toml: leading token per line, plus\n      // quoted deps in arrays/tables. Skip comments and `-r/-e/--flag` lines.\n      for (const raw of lines) {\n        const line = raw.trim();\n        if (!line || line.startsWith(\"#\") || line.startsWith(\"-\")) continue;\n        const lead = /^[\"']?([A-Za-z][A-Za-z0-9._-]+)/.exec(line);\n        if (lead) names.push(lead[1]);\n        for (const m of line.matchAll(/[\"']([A-Za-z][A-Za-z0-9._-]+)/g)) names.push(m[1]);\n      }\n      break;\n    }\n    case \"cargo\": {\n      // Cargo.toml: dependency-table keys `name = …` and `[…dependencies.name]`.\n      for (const raw of lines) {\n        const line = raw.trim();\n        if (!line || line.startsWith(\"#\")) continue;\n        const key = /^([A-Za-z0-9][A-Za-z0-9_-]+)\\s*=/.exec(line);\n        if (key) names.push(key[1]);\n        const table = /^\\[[\\w.-]*dependencies\\.([A-Za-z0-9][A-Za-z0-9_-]+)\\]/.exec(line);\n        if (table) names.push(table[1]);\n      }\n      break;\n    }\n    case \"go\": {\n      // go.mod: `require path v1.2.3` (single or in a require( … ) block).\n      for (const m of content.matchAll(/(?:^|\\s)([a-z0-9][\\w.\\-/]+)\\s+v\\d/gm)) names.push(m[1]);\n      break;\n    }\n    case \"maven\": {\n      // pom.xml <artifactId> tags + gradle `group:artifact:version` strings.\n      for (const m of content.matchAll(/<artifactId>\\s*([\\w.-]+)\\s*<\\/artifactId>/g)) {\n        names.push(m[1]);\n      }\n      for (const m of content.matchAll(/[\"']([\\w.-]+):([\\w.-]+):[\\w.$-]+[\"']/g)) names.push(m[2]);\n      break;\n    }\n    case \"rubygems\": {\n      // Gemfile `gem 'name'` + gemspec `add_*dependency 'name'`.\n      for (const m of content.matchAll(/\\bgem\\s+[\"']([\\w.-]+)[\"']/g)) names.push(m[1]);\n      for (const m of content.matchAll(\n        /add(?:_runtime|_development)?_dependency\\s+[\"']([\\w.-]+)[\"']/g,\n      )) {\n        names.push(m[1]);\n      }\n      break;\n    }\n    case \"nuget\": {\n      // NuGet manifests are XML. `.csproj` / `Directory.Packages.props` declare\n      // `<PackageReference Include=\"Name\" … />`; `packages.config` uses\n      // `<package id=\"Name\" … />`. Pull the Include= / id= attribute value from\n      // each. The `[^>]` guard keeps every match inside a single tag, so the\n      // scan is linear (no nested quantifiers → no catastrophic backtracking).\n      for (const m of content.matchAll(/<PackageReference\\b[^>]*\\bInclude\\s*=\\s*\"([^\"]+)\"/gi)) {\n        names.push(m[1]);\n      }\n      for (const m of content.matchAll(/<package\\b[^>]*\\bid\\s*=\\s*\"([^\"]+)\"/gi)) {\n        names.push(m[1]);\n      }\n      break;\n    }\n    case \"composer\": {\n      // composer.json `require`/`require-dev` maps are keyed by \"vendor/package\";\n      // composer.lock lists `{\"name\": \"vendor/package\", …}`. Both are JSON, so\n      // grab every quoted `vendor/package` token (a lower-case vendor + package\n      // separated by a single `/`). PHP platform requirements (\"php\", \"ext-*\")\n      // carry no slash and so are naturally excluded; the curated DB filters the\n      // rest, so over-capture is safe.\n      for (const m of content.matchAll(\n        /[\"']([a-z0-9](?:[a-z0-9._-]*[a-z0-9])?\\/[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?)[\"']/gi,\n      )) {\n        names.push(m[1]);\n      }\n      break;\n    }\n    case \"npm\":\n      break; // npm uses the JSON path, not this extractor.\n  }\n  return names;\n}\n\n/** First offset of a package `name` as a whole token in the manifest text (or 0). */\nfunction offsetOfName(content: string, name: string): number {\n  const escaped = name.replace(/[.*+?^${}()|[\\]\\\\/]/g, \"\\\\$&\");\n  const m = new RegExp(`(?<![\\\\w./-])${escaped}(?![\\\\w-])`).exec(content);\n  return m ? m.index : 0;\n}\n\n/**\n * Build a finding for a vulnerable dependency located in a manifest. The\n * location points at the line where the package name appears in the file (best\n * effort), falling back to line 1.\n */\nfunction dependencyFinding(\n  dep: VulnerableDependency,\n  file: string,\n  content: string,\n  index: number,\n): Finding {\n  // Use the first listed algorithm for the headline family, but derive the\n  // remediation from ALL families the package exposes (C5).\n  const algorithm = dep.algorithms[0] ?? \"unknown\";\n  return makeFinding({\n    ruleId: \"dep-vulnerable\",\n    title: `Quantum-vulnerable dependency: ${dep.name}`,\n    category: \"dependency\",\n    severity: dep.severity,\n    confidence: \"high\",\n    algorithm,\n    // Confidentiality libs are HNDL-exposed; signature-only ones are not. An\n    // explicit `dep.hndl` wins (some packages list RSA/EC as a family but only\n    // ever sign — e.g. JWS/JWT libs — and signatures are not HNDL-exposed).\n    hndl: dep.hndl ?? dep.algorithms.some(isConfidentialityFamily),\n    cwe: CWE_BROKEN_CRYPTO,\n    message: `${dep.name} — ${dep.reason}`,\n    remediation: multiFamilyRemediation(dep.algorithms),\n    file,\n    content,\n    index,\n  });\n}\n\n/** Locate the offset of a JSON key `\"name\"` in the manifest text (or 0). */\nfunction offsetOfKey(content: string, name: string): number {\n  // Use the precompiled per-name regex (non-global; .exec from position 0).\n  const re = KEY_REGEX_BY_NAME.get(name);\n  if (!re) return 0;\n  const m = re.exec(content);\n  return m ? m.index : 0;\n}\n\n/** Sort findings by title for deterministic output. */\nfunction sortByTitle(findings: Finding[]): Finding[] {\n  findings.sort((a, b) => (a.title < b.title ? -1 : a.title > b.title ? 1 : 0));\n  return findings;\n}\n\n/**\n * Scan a single manifest file for vulnerable dependencies, dispatching by the\n * file's ecosystem ({@link manifestEcosystem}). npm manifests are parsed as\n * JSON; every other ecosystem uses the generous {@link candidateNames} extractor\n * filtered against the ecosystem-scoped database. Returns one finding per\n * distinct vulnerable package.\n */\nexport function scanManifest(file: string, content: string): Finding[] {\n  const ecosystem = manifestEcosystem(file);\n  if (!ecosystem) return [];\n  const db = BY_ECOSYSTEM.get(ecosystem);\n  if (!db) return [];\n\n  if (ecosystem === \"npm\") {\n    const base = (file.split(\"/\").pop() ?? file).toLowerCase();\n    // yarn.lock / pnpm-lock.yaml are not JSON — extract names from their text.\n    if (base === \"yarn.lock\" || base === \"pnpm-lock.yaml\") {\n      return scanNpmLockfile(content, file, db);\n    }\n    return scanNpmManifest(content, file, db);\n  }\n\n  const found = new Map<string, VulnerableDependency>(); // dedupe by entry\n  for (const raw of candidateNames(ecosystem, content)) {\n    const dep = db.get(normalizeName(ecosystem, raw));\n    if (dep) found.set(dep.name, dep);\n  }\n  const findings: Finding[] = [];\n  for (const dep of found.values()) {\n    findings.push(dependencyFinding(dep, file, content, offsetOfName(content, dep.name)));\n  }\n  return sortByTitle(findings);\n}\n\n/**\n * Resolve an npm `npm:` alias spec to the real package it installs, or null when\n * the spec is not an alias. An aliased dependency records the alias as the map\n * KEY and `npm:<real-name>@<range>` as the VALUE (in package.json and in a\n * lockfile entry's `version`), so the vulnerable package hides behind a benign\n * alias name. Keeps a leading scope `@` (only a version `@` past index 0 is a\n * separator): `npm:node-forge@^1` → `node-forge`, `npm:@scope/pkg@1` → `@scope/pkg`.\n */\nfunction npmAliasTarget(spec: string): string | null {\n  if (!spec.startsWith(\"npm:\")) return null;\n  const rest = spec.slice(4);\n  const at = rest.lastIndexOf(\"@\");\n  const name = at > 0 ? rest.slice(0, at) : rest;\n  return name || null;\n}\n\n/** Guard against a pathological / hostile lockfile nesting the walk unbounded. */\nconst NPM_TREE_MAX_DEPTH = 64;\n\n/**\n * npm manifest scan.\n * - `package.json`: dependencies / devDependencies / peerDependencies / optionalDependencies,\n *   including `npm:`-aliased entries (the alias key hides the real package name).\n * - `package-lock.json` v1: the NESTED `dependencies` tree, where each entry may carry\n *   its own `dependencies` (transitive deps) and an `npm:` alias in `version`.\n * - `package-lock.json` v2/v3: the flat `packages` map keys (node_modules/<name>),\n *   plus each entry's own `name` field (set for aliased installs).\n */\nfunction scanNpmManifest(\n  content: string,\n  file: string,\n  db: Map<string, VulnerableDependency>,\n): Finding[] {\n  let json: unknown;\n  try {\n    json = JSON.parse(content);\n  } catch {\n    return []; // not valid JSON — skip quietly.\n  }\n  if (json === null || typeof json !== \"object\") return [];\n\n  const found = new Set<string>();\n  const obj = json as Record<string, unknown>;\n\n  const add = (name: string): void => {\n    if (db.has(name)) found.add(name);\n  };\n\n  /**\n   * Walk a dependency map that may be either a flat package.json map\n   * (name → version-range string) or a legacy package-lock v1 tree (name →\n   * `{ version, requires, dependencies }`, arbitrarily nested). Matches keys,\n   * resolves `npm:` aliases from string values and entry `version` fields, and\n   * recurses into a nested `dependencies` sub-tree.\n   */\n  const walkDepTree = (deps: unknown, depth: number): void => {\n    if (depth > NPM_TREE_MAX_DEPTH || deps === null || typeof deps !== \"object\") return;\n    for (const [name, node] of Object.entries(deps as Record<string, unknown>)) {\n      add(name);\n      if (typeof node === \"string\") {\n        // package.json form: the value is a range, possibly `npm:<real>@<range>`.\n        const aliased = npmAliasTarget(node);\n        if (aliased) add(aliased);\n      } else if (node !== null && typeof node === \"object\") {\n        const rec = node as Record<string, unknown>;\n        if (typeof rec.version === \"string\") {\n          const aliased = npmAliasTarget(rec.version);\n          if (aliased) add(aliased);\n        }\n        walkDepTree(rec.dependencies, depth + 1); // v1 nests transitive deps here\n      }\n    }\n  };\n\n  walkDepTree(obj.dependencies, 0);\n  walkDepTree(obj.devDependencies, 0);\n  walkDepTree(obj.peerDependencies, 0);\n  walkDepTree(obj.optionalDependencies, 0);\n\n  const packages = obj.packages;\n  if (packages !== null && typeof packages === \"object\") {\n    for (const [key, entry] of Object.entries(packages as Record<string, unknown>)) {\n      if (!key) continue; // root package entry\n      const marker = \"node_modules/\";\n      const idx = key.lastIndexOf(marker);\n      add(idx >= 0 ? key.slice(idx + marker.length) : key);\n      // Aliased install: the entry's own `name` field is the real package, which\n      // differs from the alias embedded in the node_modules/<alias> key.\n      if (entry !== null && typeof entry === \"object\") {\n        const realName = (entry as Record<string, unknown>).name;\n        if (typeof realName === \"string\") add(realName);\n      }\n    }\n  }\n\n  const findings: Finding[] = [];\n  for (const name of found) {\n    const dep = db.get(name);\n    if (!dep) continue;\n    findings.push(dependencyFinding(dep, file, content, offsetOfKey(content, name)));\n  }\n  return sortByTitle(findings);\n}\n\n/**\n * Extract candidate package names from a yarn.lock / pnpm-lock.yaml text body.\n * Generous — every `name@…` (and pnpm's `/name/version`) token is captured; the\n * caller filters against the vulnerable-dependency DB, so over-capture is safe.\n * Handles yarn v1 (`elliptic@^6.5.4:`), yarn berry (`\"elliptic@npm:^6.5.4\":`),\n * and pnpm (`/elliptic@6.5.4:`, scoped `/@noble/curves@1.2.0:`).\n */\nfunction npmLockfileCandidates(content: string): string[] {\n  const names = new Set<string>();\n  const at = /(?:^|[\\s,\"'/])((?:@[a-z0-9._-]+\\/)?[a-z0-9][a-z0-9._-]*)@/gm;\n  let m: RegExpExecArray | null;\n  while ((m = at.exec(content)) !== null) names.add(m[1].toLowerCase());\n  // pnpm's older `/name/version` form (name followed by a version digit).\n  const slash = /(?:^|\\s)\\/((?:@[a-z0-9._-]+\\/)?[a-z0-9][a-z0-9._-]*)\\/\\d/gm;\n  while ((m = slash.exec(content)) !== null) names.add(m[1].toLowerCase());\n  return [...names];\n}\n\n/**\n * npm lockfile scan (yarn.lock / pnpm-lock.yaml): match every package token in\n * the lockfile text against the vulnerable-dependency DB. Catches transitive\n * dependencies that never appear in package.json.\n */\nfunction scanNpmLockfile(\n  content: string,\n  file: string,\n  db: Map<string, VulnerableDependency>,\n): Finding[] {\n  const found = new Map<string, VulnerableDependency>();\n  for (const name of npmLockfileCandidates(content)) {\n    const dep = db.get(name);\n    if (dep) found.set(dep.name, dep);\n  }\n  const findings: Finding[] = [];\n  for (const dep of found.values()) {\n    findings.push(dependencyFinding(dep, file, content, offsetOfName(content, dep.name)));\n  }\n  return sortByTitle(findings);\n}\n"]}

package/dist/detectors/source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../src/detectors/source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AA8sC/D,0DAA0D;AAC1D,eAAO,MAAM,eAAe,EAAE,QAAQ,EAQrC,CAAC"}
+{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../../src/detectors/source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAqB,MAAM,aAAa,CAAC;AA4wC/D,0DAA0D;AAC1D,eAAO,MAAM,eAAe,EAAE,QAAQ,EAQrC,CAAC"}