@quantakrypto/core 0.5.0 → 0.7.0

package/dist/hndl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hndl.js","sourceRoot":"","sources":["../src/hndl.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAE/D,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAY,CAAC;AAE/C,gEAAgE;AAChE,MAAM,CAAC,MAAM,aAAa,GAAG,UAAU,CAAC;AAMxC,MAAM,eAAe,GAAkC;IACrD,QAAQ;IACR,UAAU;IACV,cAAc;IACd,WAAW;CACZ,CAAC;AASF,MAAM,WAAW,GAAyB,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;AAE7E,2EAA2E;AAC3E,MAAM,CAAC,MAAM,sBAAsB,GAA6B;IAC9D,QAAQ,EAAE,GAAG;IACb,IAAI,EAAE,GAAG;IACT,MAAM,EAAE,GAAG;IACX,GAAG,EAAE,IAAI;IACT,IAAI,EAAE,GAAG;CACV,CAAC;AAEF,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAA+B;IAC3D,IAAI,EAAE,GAAG;IACT,MAAM,EAAE,IAAI;IACZ,GAAG,EAAE,GAAG;CACT,CAAC;AAEF,sDAAsD;AACtD,MAAM,CAAC,MAAM,0BAA0B,GAAuC;IAC5E,MAAM,EAAE,GAAG;IACX,QAAQ,EAAE,GAAG;IACb,YAAY,EAAE,GAAG;IACjB,SAAS,EAAE,GAAG;CACf,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAEtC;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,CAAC;AAE/C;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC;AAEjD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,8BAA8B,GAAuB,UAAU,CAAC;AA4C7E,4EAA4E;AAC5E,MAAM,OAAO,SAAU,SAAQ,KAAK;IAChB,IAAI,GAAG,WAAW,CAAC;IACrC,4DAA4D;IACnD,IAAI,CAAqB;IAClC,YAAY,OAAe,EAAE,QAAiB;QAC5C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC;IACvB,CAAC;CACF;AA+FD,4DAA4D;AAC5D,MAAM,aAAa,GAAG,CAAC,CAAC;AAExB,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,CAAU;IAC3C,MAAM,QAAQ,GAAI,CAA+B,CAAC,WAAW,CAAC;IAC9D,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IACzE,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,qEAAqE;AACrE,IAAI,UAA8C,CAAC;AAEnD,SAAS,cAAc;IACrB,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,eAAe,CAAC,GAAG,EAAE,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAc,CAAC;QAC9C,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAChE,CAAC;IACD,UAAU,GAAG,KAAK,CAAC;IACnB,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,CAAU;IACrC,IAAI,CAAC,CAAC,QAAQ,KAAK,YAAY;QAAE,OAAO,YAAY,CAAC;IACrD,OAAO,cAAc,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC;AACpD,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,QAAgB;IACtD,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;AAE5C,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,IAAI,EAAE,GAAG,GAAG,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QAC7B,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACxB,uEAAuE;gBACvE,+DAA+D;gBAC/D,CAAC,EAAE,CAAC;gBACJ,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG;oBAAE,CAAC,EAAE,CAAC;gBAC7B,EAAE,IAAI,IAAI,CAAC;YACb,CAAC;iBAAM,CAAC;gBACN,EAAE,IAAI,OAAO,CAAC;YAChB,CAAC;QACH,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,EAAE,IAAI,MAAM,CAAC;QACf,CAAC;aAAM,IAAI,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACxC,EAAE,IAAI,KAAK,EAAE,EAAE,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,EAAE,IAAI,EAAE,CAAC;QACX,CAAC;IACH,CAAC;IACD,EAAE,IAAI,GAAG,CAAC;IACV,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC;IAChC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC9B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,SAAS,OAAO,CAAC,CAAS;IACxB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,mBAAmB,CAAC,CAAU;IAC5C,MAAM,IAAI,GAAG,sBAAsB,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAClF,OAAO,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,mBAA2B,EAAE,OAAoB;IAC3E,MAAM,IAAI,GAAG,mBAAmB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IACjE,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IACxB,MAAM,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,kBAAkB,CAAC;IACjD,OAAO,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;AAChC,CAAC;AAUD,SAAS,YAAY,CAAC,CAAU,EAAE,KAAiB,EAAE,OAAoB;IACvE,MAAM,WAAW,GAAG,0BAA0B,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACrE,MAAM,mBAAmB,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACvF,MAAM,KAAK,GAAG,WAAW,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IACxD,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,aAAa,GAAG,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC;IAC3F,MAAM,gBAAgB,GACpB,mBAAmB,GAAG,OAAO,CAAC,qBAAqB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IACnF,MAAM,SAAS,GAAsB;QACnC,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC;QAC1C,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC;QAChC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;QACpB,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,mBAAmB;QACnB,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;QACpD,gBAAgB;QAChB,WAAW,EAAE,gBAAgB,GAAG,CAAC;QACjC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;QACtB,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;IACF,OAAO;QACL,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAAC;QAClC,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI;QACrB,SAAS,EAAE,IAAI;QACf,aAAa;QACb,SAAS;KACV,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,CAAS;IACvB,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;AACrC,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,uEAAuE;AACvE,SAAS,cAAc,CAAC,CAAU,EAAE,GAAY,EAAE,KAAgB;IAChE,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,SAAS;QAC5D,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,WAAW,CAAC,QAA4B,EAAE,GAAY;IACpE,MAAM,SAAS,GAAsB,EAAE,CAAC;IACxC,MAAM,aAAa,GAAG,IAAI,GAAG,EAA2B,CAAC;IACzD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE3C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,aAAa,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,UAAU,GAAG,cAAc,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAEjD,IAAI,IAAqB,CAAC;QAC1B,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,IAAI,GAAG,YAAY,CACjB,CAAC,EACD;gBACE,aAAa;gBACb,cAAc,EAAE,GAAG,CAAC,QAAQ,CAAC,cAAc;gBAC3C,qEAAqE;gBACrE,sEAAsE;gBACtE,sEAAsE;gBACtE,uEAAuE;gBACvE,oEAAoE;gBACpE,uEAAuE;gBACvE,wEAAwE;gBACxE,sEAAsE;gBACtE,uEAAuE;gBACvE,gEAAgE;gBAChE,cAAc,EAAE,CAAC;gBACjB,oBAAoB,EAAE,GAAG,CAAC,OAAO,CAAC,kBAAkB;gBACpD,KAAK,EAAE,KAAK;aACb,EACD,GAAG,CAAC,OAAO,CACZ,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,IAAI,SAAoC,CAAC;YACzC,IAAI,GAAG,SAAuC,CAAC;YAC/C,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;gBAC/B,MAAM,MAAM,GAAG,YAAY,CACzB,CAAC,EACD;oBACE,aAAa;oBACb,cAAc,EAAE,KAAK,CAAC,cAAc;oBACpC,cAAc,EAAE,KAAK,CAAC,cAAc;oBACpC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;oBAChD,KAAK,EAAE,IAAI;iBACZ,EACD,GAAG,CAAC,OAAO,CACZ,CAAC;gBACF,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;oBAC5D,IAAI,GAAG,MAAM,CAAC;oBACd,SAAS,GAAG,KAAK,CAAC;gBACpB,CAAC;YACH,CAAC;YACD,IAAI,CAAC,SAAS,GAAG,SAAU,CAAC,GAAG,CAAC;YAChC,aAAa,CAAC,GAAG,CAAC,SAAU,CAAC,GAAG,EAAE,CAAC,aAAa,CAAC,GAAG,CAAC,SAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAChF,QAAQ,CAAC,GAAG,CAAC,SAAU,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QAChG,CAAC;QAED,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,MAAM,GAAoB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrD,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,cAAc,EAAE,CAAC,CAAC,cAAc;QAChC,cAAc,EAAE,CAAC,CAAC,cAAc;QAChC,oBAAoB,EAAE,CAAC,CAAC,oBAAoB;QAC5C,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QACvC,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QACrC,cAAc,EACZ,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,oBAAoB,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,kBAAkB;KACtF,CAAC,CAAC,CAAC;IAEJ,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/D,MAAM,YAAY,GAChB,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxF,MAAM,YAAY,GAAG,CAAC,GAAG,SAAS,CAAC;SAChC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;SAC/F,KAAK,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IAE3B,MAAM,OAAO,GAAgB;QAC3B,cAAc,EAAE,SAAS,CAAC,MAAM;QAChC,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM;QACjC,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,MAAM;QAC/D,sBAAsB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,MAAM;QACrE,aAAa,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,MAAM;QACtE,WAAW;QACX,YAAY;QACZ,YAAY;KACb,CAAC;IAEF,OAAO;QACL,YAAY,EAAE,kBAAkB;QAChC,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,SAAS;QACT,aAAa;QACb,MAAM;QACN,OAAO;KACR,CAAC;AACJ,CAAC;AAaD,gFAAgF;AAChF,SAAS,kBAAkB,CAAC,IAAY;IACtC,IAAI,KAAyB,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,EAAE,KAAK,KAAK;gBAAE,KAAK,GAAG,SAAS,CAAC;YACpC,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC7B,KAAK,GAAG,EAAE,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAW,CAAC,CAAC,EAAE,CAAC;YAChE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,SAAS,YAAY,CAAC,IAAY,EAAE,IAAa;IAC/C,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAW,CAAC;QAC9B,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,SAAS,CAAC,8CAA8C,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9D,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,SAAS;QACrC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC;QAC7D,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,+EAA+E;AAC/E,SAAS,SAAS,CAAC,OAAe;IAChC,OAAO,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,QAAQ,CAAC,OAAe,EAAE,IAAY,EAAE,CAAS;IACxD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,GAAG,GAAG,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,+BAA+B,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5E,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AACrF,CAAC;AAED,6EAA6E;AAC7E,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9D,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,KAAa,EAAE,IAAY,EAAE,CAAS;IAC7D,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,kFAAkF;AAClF,SAAS,aAAa,CAAC,IAAY,EAAE,IAAY,EAAE,CAAS;IAC1D,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,KAAyB,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QAC7B,IAAI,KAAK,EAAE,CAAC;YACV,GAAG,IAAI,EAAE,CAAC;YACV,IAAI,EAAE,KAAK,KAAK;gBAAE,KAAK,GAAG,SAAS,CAAC;YACpC,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC7B,KAAK,GAAG,EAAE,CAAC;YACX,GAAG,IAAI,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YACrB,GAAG,GAAG,EAAE,CAAC;YACT,SAAS;QACX,CAAC;QACD,GAAG,IAAI,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,KAAK;QAAE,MAAM,IAAI,SAAS,CAAC,4CAA4C,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACvF,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACxB,sEAAsE;IACtE,IAAI,IAAI,KAAK,EAAE,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAW,CAAC,CAAC,CAAC;AAC1E,CAAC;AAID,2EAA2E;AAC3E,SAAS,SAAS,CAAC,IAAY,EAAE,IAAY;IAC3C,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAElC,SAAS,SAAS,CAAC,CAAS,EAAE,MAAc;QAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAa,CAAC;QACnC,IAAI,KAAK,CAAC,OAAO,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5D,OAAO,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC;IAED,SAAS,QAAQ,CAAC,KAAa,EAAE,MAAc;QAC7C,MAAM,GAAG,GAAgB,EAAE,CAAC;QAC5B,IAAI,CAAC,GAAG,KAAK,CAAC;QACd,OACE,CAAC,GAAG,KAAK,CAAC,MAAM;YACf,KAAK,CAAC,CAAC,CAAc,CAAC,MAAM,KAAK,MAAM;YACxC,CAAE,KAAK,CAAC,CAAC,CAAc,CAAC,OAAO,KAAK,GAAG,IAAK,KAAK,CAAC,CAAC,CAAc,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAC3F,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAa,CAAC;YAClC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACtE,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,CAAC;YAC9B,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;gBAChB,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,IAAK,KAAK,CAAC,CAAC,GAAG,CAAC,CAAc,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;oBACvE,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC,GAAG,CAAC,EAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAc,CAAC,MAAM,CAAC,CAAC;oBACxE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBACd,CAAC,GAAG,IAAI,CAAC;gBACX,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBACf,CAAC,EAAE,CAAC;gBACN,CAAC;YACH,CAAC;iBAAM,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3B,yEAAyE;gBACzE,sEAAsE;gBACtE,KAAK,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC5D,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;gBAC5C,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACd,CAAC,GAAG,IAAI,CAAC;YACX,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC9C,CAAC,EAAE,CAAC;YACN,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,SAAS,QAAQ,CAAC,KAAa,EAAE,MAAc;QAC7C,MAAM,GAAG,GAA+B,EAAE,CAAC;QAC3C,IAAI,CAAC,GAAG,KAAK,CAAC;QACd,OACE,CAAC,GAAG,KAAK,CAAC,MAAM;YACf,KAAK,CAAC,CAAC,CAAc,CAAC,MAAM,KAAK,MAAM;YACxC,CAAE,KAAK,CAAC,CAAC,CAAc,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;YAC/C,KAAK,CAAC,CAAC,CAAc,CAAC,OAAO,KAAK,GAAG,EACtC,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAa,CAAC;YAClC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5D,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBACjB,GAAG,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;gBAChD,CAAC,EAAE,CAAC;YACN,CAAC;iBAAM,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,IAAK,KAAK,CAAC,CAAC,GAAG,CAAC,CAAc,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;gBAC9E,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,SAAS,CAAC,CAAC,GAAG,CAAC,EAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAc,CAAC,MAAM,CAAC,CAAC;gBACxE,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;gBACf,CAAC,GAAG,IAAI,CAAC;YACX,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;gBAChB,CAAC,EAAE,CAAC;YACN,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,CAAC,EAAG,KAAK,CAAC,CAAC,CAAc,CAAC,MAAM,CAAC,CAAC;IAC5D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,SAAS,QAAQ,CAAC,CAAY;IAC5B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,QAAQ,CAAC,CAAY,EAAE,IAAY,EAAE,IAAY;IACxD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,6BAA6B,EAAE,IAAI,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,cAAc,CAAC,CAAY,EAAE,IAAY,EAAE,IAAY;IAC9D,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,gCAAgC,EAAE,IAAI,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAY,EAAE,IAAY,EAAE,IAAY;IAChE,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAE,eAAqC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,oBAAoB,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,CAAuB,CAAC;AACjC,CAAC;AAED,SAAS,YAAY,CAAC,CAAY,EAAE,IAAY,EAAE,IAAY;IAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,sCAAsC,EAAE,IAAI,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,CAAa,CAAC;AACvB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,IAAI,GAAG,aAAa;IAC7D,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,SAAS,CAAC,6CAA6C,EAAE,IAAI,CAAC,CAAC;IAC3E,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,SAAS,CAAC,8BAA8B,EAAE,IAAI,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,GAAG,CAAC,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAgB;QAC3B,kBAAkB,EAAE,4BAA4B;QAChD,qBAAqB,EAAE,+BAA+B;KACvD,CAAC;IACF,IAAI,SAAS,IAAI,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1B,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,6BAA6B,EAAE,IAAI,CAAC,CAAC;QAC3E,IAAI,sBAAsB,IAAI,CAAC,EAAE,CAAC;YAChC,OAAO,CAAC,kBAAkB,GAAG,cAAc,CACzC,CAAC,CAAC,sBAAsB,CAAC,EACzB,gCAAgC,EAChC,IAAI,CACL,CAAC;QACJ,CAAC;QACD,IAAI,yBAAyB,IAAI,CAAC,EAAE,CAAC;YACnC,OAAO,CAAC,qBAAqB,GAAG,cAAc,CAC5C,CAAC,CAAC,yBAAyB,CAAC,EAC5B,mCAAmC,EACnC,IAAI,CACL,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAiB,EAAE,cAAc,EAAE,8BAA8B,EAAE,CAAC;IAClF,IAAI,UAAU,IAAI,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC;QACpD,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,8BAA8B,EAAE,IAAI,CAAC,CAAC;QAC5E,IAAI,gBAAgB,IAAI,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,cAAc,GAAG,gBAAgB,CACxC,CAAC,CAAC,gBAAgB,CAAC,EACnB,2BAA2B,EAC3B,IAAI,CACL,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,SAAS,CAAC,yBAAyB,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,MAAM,GAAoB,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC;QAChD,MAAM,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,UAAU,GAAG,qBAAqB,EAAE,IAAI,CAAC,CAAC;QAChF,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,UAAU,GAAG,OAAO,EAAE,IAAI,CAAC,CAAC;QAC3D,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,wBAAwB,GAAG,GAAG,EAAE,IAAI,CAAC,CAAC;QACjF,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClB,MAAM,KAAK,GAAkB;YAC3B,GAAG;YACH,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,QAAQ,EAAE,IAAI,CAAC;YACtD,cAAc,EAAE,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE,UAAU,GAAG,kBAAkB,EAAE,IAAI,CAAC;YAC5F,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAC,EAAE,UAAU,GAAG,mBAAmB,EAAE,IAAI,CAAC;YAC5F,oBAAoB,EAAE,cAAc,CAClC,CAAC,CAAC,wBAAwB,CAAC,EAC3B,UAAU,GAAG,0BAA0B,EACvC,IAAI,CACL;YACD,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,UAAU,GAAG,SAAS,EAAE,IAAI,CAAC;SAC9D,CAAC;QACF,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,SAAS,CAAC,UAAU,GAAG,qCAAqC,EAAE,IAAI,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,QAAQ,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1C,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,UAAU,GAAG,UAAU,EAAE,IAAI,CAAC,CAAC;YACxE,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;gBACvB,IAAI,CAAE,WAAiC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;oBACpD,MAAM,IAAI,SAAS,CACjB,UAAU,GAAG,cAAc,CAAC,qBAAqB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACzE,IAAI,CACL,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,KAAK,CAAC,MAAM,GAAG,MAAqB,CAAC;QACvC,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,IAAI,GACR,IAAI,KAAK,aAAa,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QACvE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;QACpB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACxC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,SAAS,CACjB,uBAAuB,IAAI,0CAA0C,EACrE,IAAI,CACL,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACvD,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,6EAA6E;AAC7E,SAAS,MAAM,CAAC,IAAY;IAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,gDAAgD;AAChD,SAAS,OAAO,CAAC,GAAW;IAC1B,MAAM,IAAI,GAAG,GAAG;SACb,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3B,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;AACzC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAA4B;IAC3D,6DAA6D;IAC7D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,IAAI;YAAE,SAAS;QACtD,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;YAC1B,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACxB,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IAED,MAAM,KAAK,GAAa;QACtB,uEAAuE;QACvE,GAAG;QACH,kFAAkF;QAClF,iFAAiF;QACjF,8EAA8E;QAC9E,GAAG;QACH,iFAAiF;QACjF,+EAA+E;QAC/E,YAAY;QACZ,EAAE;QACF,UAAU;QACV,2BAA2B,4BAA4B,uCAAuC;QAC9F,8BAA8B,+BAA+B,6CAA6C;QAC1G,EAAE;QACF,WAAW;QACX,qBAAqB,8BAA8B,oDAAoD;QACvG,EAAE;QACF,SAAS;KACV,CAAC;IAEF,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CACR,gFAAgF,EAChF,qDAAqD,EACrD,uBAAuB,EACvB,wBAAwB,EACxB,+BAA+B,EAC/B,wBAAwB,EACxB,gCAAgC,EAChC,YAAY,EACZ,kBAAkB,CACnB,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,CAAC,GAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAiB,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1D,MAAM,IAAI,GAAG,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC;YAC7C,KAAK,CAAC,IAAI,CACR,2CAA2C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC7D,YAAY,OAAO,CAAC,GAAG,CAAC,EAAE,EAC1B,aAAa,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,EAAE,EACpD,yFAAyF,EACzF,sEAAsE,EACtE,+EAA+E,EAC/E,YAAY,EACZ,YAAY,IAAI,GAAG,CACpB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC","sourcesContent":["/**\n * HNDL (\"harvest now, decrypt later\") data-risk quantifier - roadmap initiative 2.\n *\n * A crypto finding on its own answers \"what is broken\"; it does not answer \"how\n * much does it matter\". This module joins the crypto finding to the DATA it\n * protects and makes Mosca's inequality concrete, so a migration backlog can be\n * ranked by real exposure instead of by finding counts.\n *\n * Exposure per finding = crypto-vulnerability (V) x data-sensitivity (S) x\n * Mosca-factor (M), each normalised to 0..1, reported as an integer 0..100:\n *\n *   - V: how breakable + how confidently detected the crypto is, discounted hard\n *        when the finding is not HNDL-exposed (a signature cannot be broken\n *        retroactively to reveal harvested ciphertext).\n *   - S: the declared sensitivity class of the data the finding sits next to.\n *   - M: the fraction of the data's protection horizon (retention / secrecy\n *        lifetime + migration time) that extends BEYOND the quantum-threat\n *        horizon. Mosca: concern exists when X + Y > Z.\n *\n * The data map is a declared `hndl.yml` (assets, classification, retention +\n * secrecy lifetime, path/scope bindings). Parsing is hand-rolled and\n * zero-dependency, consistent with the rest of core (ADR-0001): no YAML library\n * is pulled in. The full model is documented in docs/HNDL.md so the score is\n * contestable rather than magic.\n */\nimport { readFile } from \"node:fs/promises\";\nimport * as path from \"node:path\";\n\nimport type { Confidence, Finding, Severity } from \"./types.js\";\nimport { fingerprintFinding } from \"./baseline.js\";\nimport { defaultRegistry, detectorScope } from \"./registry.js\";\n\n/* -------------------------------------------------------------------------- */\n/* Model constants (exported so the score is contestable, not magic)          */\n/* -------------------------------------------------------------------------- */\n\n/** Version of the exposure model. Bump on any weight / formula change. */\nexport const HNDL_MODEL_VERSION = \"1\" as const;\n\n/** Canonical `hndl.yml` file name discovered at a scan root. */\nexport const HNDL_FILENAME = \"hndl.yml\";\n\n/** Data sensitivity classes, least → most sensitive. Vocabulary aligned with the\n * readiness DPE (data-protection) practice. */\nexport type DataClassification = \"public\" | \"internal\" | \"confidential\" | \"regulated\";\n\nconst CLASSIFICATIONS: readonly DataClassification[] = [\n  \"public\",\n  \"internal\",\n  \"confidential\",\n  \"regulated\",\n];\n\n/**\n * Logical scope a finding belongs to, used for optional scope-bound assets. The\n * two detector scopes (\"source\" / \"config\") plus \"dependency\" (manifest\n * findings, which are not produced by a Detector).\n */\nexport type HndlScope = \"source\" | \"config\" | \"dependency\";\n\nconst HNDL_SCOPES: readonly HndlScope[] = [\"source\", \"config\", \"dependency\"];\n\n/** Crypto-vulnerability weight (V) contributed by a finding's severity. */\nexport const SEVERITY_VULNERABILITY: Record<Severity, number> = {\n  critical: 1.0,\n  high: 0.8,\n  medium: 0.5,\n  low: 0.25,\n  info: 0.1,\n};\n\n/** Crypto-vulnerability weight (V) scaled by detector confidence. */\nexport const CONFIDENCE_WEIGHT: Record<Confidence, number> = {\n  high: 1.0,\n  medium: 0.85,\n  low: 0.6,\n};\n\n/** Data-sensitivity weight (S) per classification. */\nexport const CLASSIFICATION_SENSITIVITY: Record<DataClassification, number> = {\n  public: 0.1,\n  internal: 0.4,\n  confidential: 0.7,\n  regulated: 1.0,\n};\n\n/**\n * Discount applied to V when a finding is NOT harvest-now-decrypt-later exposed\n * (e.g. a pure signature). A forged signature is a future-integrity problem, not\n * a retroactive-confidentiality one, so it barely moves the HNDL needle.\n */\nexport const NON_HNDL_DISCOUNT = 0.15;\n\n/**\n * Default years until a cryptographically-relevant quantum computer is assumed\n * to exist (Z in Mosca's inequality). 15 years is a defensible mid-point of the\n * commonly-cited Mosca / NIST window; override per-org in `hndl.yml`.\n */\nexport const DEFAULT_QUANTUM_THREAT_YEARS = 15;\n\n/**\n * Default years to complete the org's PQC migration (Y in Mosca's inequality).\n * Override per-org in `hndl.yml`.\n */\nexport const DEFAULT_MIGRATION_HORIZON_YEARS = 5;\n\n/** Classification assumed for findings that bind to no declared asset. */\nexport const DEFAULT_UNBOUND_CLASSIFICATION: DataClassification = \"internal\";\n\n/* -------------------------------------------------------------------------- */\n/* Declared data map (hndl.yml)                                               */\n/* -------------------------------------------------------------------------- */\n\n/** A single declared data asset from `hndl.yml`. */\nexport interface HndlDataAsset {\n  /** Stable id (referenced by finding exposures + the website's `data_asset.key`). */\n  key: string;\n  /** Human name. */\n  name: string;\n  classification: DataClassification;\n  /** How long the data is retained, in years. */\n  retentionYears: number;\n  /** How long the data must remain confidential once captured, in years. */\n  secrecyLifetimeYears: number;\n  /** Path globs (POSIX, relative to scan root) whose findings bind to this asset. */\n  paths: string[];\n  /** Optional detector-scope filter: only findings of these scopes bind here. */\n  scopes?: HndlScope[];\n}\n\n/** The Mosca horizons that gate the exposure model. */\nexport interface HndlHorizon {\n  /** Z: years until a cryptographically-relevant quantum computer is assumed. */\n  quantumThreatYears: number;\n  /** Y: years to complete the org's PQC migration. */\n  migrationHorizonYears: number;\n}\n\n/** Defaults applied to findings that bind to no declared asset. */\nexport interface HndlDefaults {\n  classification: DataClassification;\n}\n\n/** A fully-parsed, validated `hndl.yml`. */\nexport interface HndlMap {\n  version: number;\n  horizon: HndlHorizon;\n  defaults: HndlDefaults;\n  assets: HndlDataAsset[];\n}\n\n/** Thrown when `hndl.yml` is malformed (structure or a bad known value). */\nexport class HndlError extends Error {\n  override readonly name = \"HndlError\";\n  /** The `hndl.yml` path the error relates to, when known. */\n  readonly path: string | undefined;\n  constructor(message: string, hndlPath?: string) {\n    super(message);\n    this.path = hndlPath;\n  }\n}\n\n/* -------------------------------------------------------------------------- */\n/* Exposure results                                                           */\n/* -------------------------------------------------------------------------- */\n\n/** Full, auditable breakdown of one finding's exposure score. */\nexport interface ExposureRationale {\n  /** V - crypto-vulnerability factor (0..1). */\n  vulnerability: number;\n  /** S - data-sensitivity factor (0..1). */\n  sensitivity: number;\n  /** M - Mosca factor (0..1): fraction of the protection horizon past the threat. */\n  mosca: number;\n  classification: DataClassification;\n  retentionYears: number;\n  secrecyLifetimeYears: number;\n  /** X = max(retention, secrecy lifetime): the data's protection requirement. */\n  secrecyHorizonYears: number;\n  /** Z - quantum-threat horizon (years). */\n  quantumThreatYears: number;\n  /** Y - migration horizon (years). */\n  migrationHorizonYears: number;\n  /** (X + Y) - Z; positive means Mosca's inequality is breached. */\n  moscaMarginYears: number;\n  /** True when (X + Y) > Z (data captured today is exposed while still secret). */\n  moscaBreach: boolean;\n  /** Whether the finding is HNDL-exposed (drives {@link NON_HNDL_DISCOUNT}). */\n  hndl: boolean;\n  severity: Severity;\n  confidence: Confidence;\n  scope: HndlScope;\n  /** True when the finding matched a declared asset (false = defaults applied). */\n  bound: boolean;\n}\n\n/** A finding's computed exposure, keyed by fingerprint for website ingest. */\nexport interface FindingExposure {\n  /** Finding identity: `finding.fingerprint` when present, else the canonical\n   * `fingerprintFinding()` hash. This is the join key the website stores. */\n  fingerprint: string;\n  ruleId: string;\n  file: string;\n  /** The bound data asset's stable key, or null when unbound. */\n  dataAsset: string | null;\n  /** 0..100 exposure score. */\n  exposureScore: number;\n  rationale: ExposureRationale;\n}\n\n/** Per-asset rollup for the repo summary. */\nexport interface AssetExposure {\n  key: string;\n  name: string;\n  classification: DataClassification;\n  retentionYears: number;\n  secrecyLifetimeYears: number;\n  /** Number of findings bound to this asset. */\n  findings: number;\n  /** Highest exposure among this asset's findings. */\n  maxExposure: number;\n  /** True when the data's secrecy horizon outlives the quantum threat (X > Z). */\n  outlivesThreat: boolean;\n}\n\n/** Repo-level HNDL summary. */\nexport interface HndlSummary {\n  findingsScored: number;\n  assetsDeclared: number;\n  /** Declared assets that bound at least one finding. */\n  assetsWithFindings: number;\n  /** Declared assets whose secrecy horizon outlives the quantum threat (X > Z). */\n  assetsOutlivingHorizon: number;\n  /** Findings whose Mosca inequality is breached ((X + Y) > Z). */\n  moscaBreaches: number;\n  maxExposure: number;\n  /** Rounded mean exposure across scored findings. */\n  meanExposure: number;\n  /** The worst findings, most-exposed first (capped). */\n  topExposures: FindingExposure[];\n}\n\n/** The complete HNDL analysis of a scan. */\nexport interface HndlReport {\n  modelVersion: string;\n  horizon: HndlHorizon;\n  /** Per-finding exposures, in input order. */\n  exposures: FindingExposure[];\n  /** Fingerprint → exposure, for reporters to annotate each finding. */\n  byFingerprint: Map<string, FindingExposure>;\n  /** Per-asset rollups. */\n  assets: AssetExposure[];\n  summary: HndlSummary;\n}\n\n/** How many findings the summary's `topExposures` lists. */\nconst TOP_EXPOSURES = 5;\n\n/* -------------------------------------------------------------------------- */\n/* Fingerprint + scope resolution                                             */\n/* -------------------------------------------------------------------------- */\n\n/**\n * Identity key for a finding's exposure. Prefers a `finding.fingerprint` field\n * when a build supplies one (another workstream is adding it to core's Finding\n * type + reporters); falls back to the canonical `fingerprintFinding()` hash\n * (`sha256(ruleId|file|normalizedSnippet)`) otherwise. INTEGRATION POINT: once\n * `Finding.fingerprint` lands, this transparently switches to it - no caller\n * change needed.\n */\nexport function findingFingerprint(f: Finding): string {\n  const declared = (f as { fingerprint?: unknown }).fingerprint;\n  if (typeof declared === \"string\" && declared.length > 0) return declared;\n  return fingerprintFinding(f);\n}\n\n/** ruleId → detector scope, built once from the default registry. */\nlet scopeIndex: Map<string, HndlScope> | undefined;\n\nfunction ruleScopeIndex(): Map<string, HndlScope> {\n  if (scopeIndex) return scopeIndex;\n  const index = new Map<string, HndlScope>();\n  for (const det of defaultRegistry.all()) {\n    const scope = detectorScope(det) as HndlScope;\n    for (const rule of det.rules ?? []) index.set(rule.id, scope);\n  }\n  scopeIndex = index;\n  return index;\n}\n\n/**\n * The scope a finding belongs to. Dependency findings (from the manifest\n * scanner, category \"dependency\") are \"dependency\"; everything else is looked up\n * by ruleId in the detector registry, defaulting to \"source\".\n */\nexport function findingScope(f: Finding): HndlScope {\n  if (f.category === \"dependency\") return \"dependency\";\n  return ruleScopeIndex().get(f.ruleId) ?? \"source\";\n}\n\n/* -------------------------------------------------------------------------- */\n/* Glob matching (hand-rolled, zero-dependency)                               */\n/* -------------------------------------------------------------------------- */\n\n/**\n * Match a POSIX path against a glob supporting `**` (any path segments incl.\n * `/`), `*` (any run of non-`/` chars), and `?` (a single non-`/` char). A\n * trailing `/**` also matches the directory itself. Everything else is literal.\n */\nexport function globMatch(glob: string, filePath: string): boolean {\n  return globToRegExp(glob).test(filePath);\n}\n\nconst globCache = new Map<string, RegExp>();\n\nfunction globToRegExp(glob: string): RegExp {\n  const cached = globCache.get(glob);\n  if (cached) return cached;\n  let re = \"^\";\n  for (let i = 0; i < glob.length; i++) {\n    const ch = glob[i] as string;\n    if (ch === \"*\") {\n      if (glob[i + 1] === \"*\") {\n        // `**` - any number of characters including path separators. Consume a\n        // following `/` so `a/**/b` matches `a/b` (zero segments) too.\n        i++;\n        if (glob[i + 1] === \"/\") i++;\n        re += \".*\";\n      } else {\n        re += \"[^/]*\";\n      }\n    } else if (ch === \"?\") {\n      re += \"[^/]\";\n    } else if (\"\\\\^$.|+()[]{}\".includes(ch)) {\n      re += `\\\\${ch}`;\n    } else {\n      re += ch;\n    }\n  }\n  re += \"$\";\n  const compiled = new RegExp(re);\n  globCache.set(glob, compiled);\n  return compiled;\n}\n\n/* -------------------------------------------------------------------------- */\n/* Exposure math                                                              */\n/* -------------------------------------------------------------------------- */\n\nfunction clamp01(x: number): number {\n  return x < 0 ? 0 : x > 1 ? 1 : x;\n}\n\n/** V - crypto-vulnerability factor for a finding (0..1). */\nexport function vulnerabilityFactor(f: Finding): number {\n  const base = SEVERITY_VULNERABILITY[f.severity] * CONFIDENCE_WEIGHT[f.confidence];\n  return clamp01(base * (f.hndl ? 1 : NON_HNDL_DISCOUNT));\n}\n\n/**\n * M - the Mosca factor (0..1). `X` is the data's protection horizon\n * (max of retention + secrecy lifetime), `Y` the migration horizon, `Z` the\n * quantum-threat horizon. M is the fraction of `X + Y` that falls after `Z`:\n * 0 when the threat is beyond the whole horizon, 1 when the threat is already\n * here. Mosca's inequality (X + Y > Z) is exactly `M > 0`.\n */\nexport function moscaFactor(secrecyHorizonYears: number, horizon: HndlHorizon): number {\n  const span = secrecyHorizonYears + horizon.migrationHorizonYears;\n  if (span <= 0) return 0;\n  const margin = span - horizon.quantumThreatYears;\n  return clamp01(margin / span);\n}\n\ninterface ScoreInput {\n  vulnerability: number;\n  classification: DataClassification;\n  retentionYears: number;\n  secrecyLifetimeYears: number;\n  bound: boolean;\n}\n\nfunction scoreFinding(f: Finding, input: ScoreInput, horizon: HndlHorizon): FindingExposure {\n  const sensitivity = CLASSIFICATION_SENSITIVITY[input.classification];\n  const secrecyHorizonYears = Math.max(input.retentionYears, input.secrecyLifetimeYears);\n  const mosca = moscaFactor(secrecyHorizonYears, horizon);\n  const exposureScore = Math.round(100 * clamp01(input.vulnerability * sensitivity * mosca));\n  const moscaMarginYears =\n    secrecyHorizonYears + horizon.migrationHorizonYears - horizon.quantumThreatYears;\n  const rationale: ExposureRationale = {\n    vulnerability: round3(input.vulnerability),\n    sensitivity: round3(sensitivity),\n    mosca: round3(mosca),\n    classification: input.classification,\n    retentionYears: input.retentionYears,\n    secrecyLifetimeYears: input.secrecyLifetimeYears,\n    secrecyHorizonYears,\n    quantumThreatYears: horizon.quantumThreatYears,\n    migrationHorizonYears: horizon.migrationHorizonYears,\n    moscaMarginYears,\n    moscaBreach: moscaMarginYears > 0,\n    hndl: f.hndl,\n    severity: f.severity,\n    confidence: f.confidence,\n    scope: findingScope(f),\n    bound: input.bound,\n  };\n  return {\n    fingerprint: findingFingerprint(f),\n    ruleId: f.ruleId,\n    file: f.location.file,\n    dataAsset: null,\n    exposureScore,\n    rationale,\n  };\n}\n\nfunction round3(x: number): number {\n  return Math.round(x * 1000) / 1000;\n}\n\n/* -------------------------------------------------------------------------- */\n/* Binding + top-level compute                                                */\n/* -------------------------------------------------------------------------- */\n\n/** Assets whose path globs + optional scope filter match a finding. */\nfunction matchingAssets(f: Finding, map: HndlMap, scope: HndlScope): HndlDataAsset[] {\n  const out: HndlDataAsset[] = [];\n  for (const asset of map.assets) {\n    if (asset.scopes && !asset.scopes.includes(scope)) continue;\n    if (asset.paths.some((g) => globMatch(g, f.location.file))) out.push(asset);\n  }\n  return out;\n}\n\n/**\n * Compute HNDL exposure for a set of findings against a declared data map.\n *\n * A finding binds to every declared asset whose path glob (and optional scope\n * filter) matches its file; when several match, the WORST-CASE (highest)\n * exposure is chosen and its asset recorded, since risk ranking should not be\n * diluted by an incidental low-sensitivity overlap. A finding that binds to no\n * asset is still scored, using the map's `defaults.classification` and the\n * global horizons, and flagged `bound: false` so it is visibly a fallback. Its\n * secrecy lifetime is assumed to be the quantum-threat horizon Z (the\n * minimum-concern horizon; see {@link scoreFinding} call below and docs/HNDL.md\n * §4), so the fallback classification produces a real, rankable exposure rather\n * than a dead 0.\n *\n * Purely additive: it never mutates findings and never affects a scan's exit\n * code.\n */\nexport function computeHndl(findings: readonly Finding[], map: HndlMap): HndlReport {\n  const exposures: FindingExposure[] = [];\n  const byFingerprint = new Map<string, FindingExposure>();\n  const assetFindings = new Map<string, number>();\n  const assetMax = new Map<string, number>();\n\n  for (const f of findings) {\n    const vulnerability = vulnerabilityFactor(f);\n    const scope = findingScope(f);\n    const candidates = matchingAssets(f, map, scope);\n\n    let best: FindingExposure;\n    if (candidates.length === 0) {\n      best = scoreFinding(\n        f,\n        {\n          vulnerability,\n          classification: map.defaults.classification,\n          // Unbound: the data's lifetime is unknown, so we cannot read X off a\n          // declared asset. Assuming X = 0 would drive M (hence the score) to a\n          // dead 0 for EVERY unbound finding under any sane horizon, making the\n          // documented `defaults.classification` fallback unrankable. Instead we\n          // assume the MINIMUM-CONCERN horizon: data captured today must stay\n          // confidential at least until the quantum threat arrives (X = Z). That\n          // yields M = Y / (Y + Z) - a small but non-zero, rankable exposure that\n          // never exceeds a declared long-lived asset's and self-adjusts to any\n          // per-org horizon override. Retention stays 0 (genuinely unknown); the\n          // secrecy lifetime carries the assumption. See docs/HNDL.md §4.\n          retentionYears: 0,\n          secrecyLifetimeYears: map.horizon.quantumThreatYears,\n          bound: false,\n        },\n        map.horizon,\n      );\n    } else {\n      let bestAsset: HndlDataAsset | undefined;\n      best = undefined as unknown as FindingExposure;\n      for (const asset of candidates) {\n        const scored = scoreFinding(\n          f,\n          {\n            vulnerability,\n            classification: asset.classification,\n            retentionYears: asset.retentionYears,\n            secrecyLifetimeYears: asset.secrecyLifetimeYears,\n            bound: true,\n          },\n          map.horizon,\n        );\n        if (!bestAsset || scored.exposureScore > best.exposureScore) {\n          best = scored;\n          bestAsset = asset;\n        }\n      }\n      best.dataAsset = bestAsset!.key;\n      assetFindings.set(bestAsset!.key, (assetFindings.get(bestAsset!.key) ?? 0) + 1);\n      assetMax.set(bestAsset!.key, Math.max(assetMax.get(bestAsset!.key) ?? 0, best.exposureScore));\n    }\n\n    exposures.push(best);\n    byFingerprint.set(best.fingerprint, best);\n  }\n\n  const assets: AssetExposure[] = map.assets.map((a) => ({\n    key: a.key,\n    name: a.name,\n    classification: a.classification,\n    retentionYears: a.retentionYears,\n    secrecyLifetimeYears: a.secrecyLifetimeYears,\n    findings: assetFindings.get(a.key) ?? 0,\n    maxExposure: assetMax.get(a.key) ?? 0,\n    outlivesThreat:\n      Math.max(a.retentionYears, a.secrecyLifetimeYears) > map.horizon.quantumThreatYears,\n  }));\n\n  const scores = exposures.map((e) => e.exposureScore);\n  const maxExposure = scores.reduce((m, s) => Math.max(m, s), 0);\n  const meanExposure =\n    scores.length > 0 ? Math.round(scores.reduce((a, b) => a + b, 0) / scores.length) : 0;\n  const topExposures = [...exposures]\n    .sort((a, b) => b.exposureScore - a.exposureScore || a.fingerprint.localeCompare(b.fingerprint))\n    .slice(0, TOP_EXPOSURES);\n\n  const summary: HndlSummary = {\n    findingsScored: exposures.length,\n    assetsDeclared: map.assets.length,\n    assetsWithFindings: assets.filter((a) => a.findings > 0).length,\n    assetsOutlivingHorizon: assets.filter((a) => a.outlivesThreat).length,\n    moscaBreaches: exposures.filter((e) => e.rationale.moscaBreach).length,\n    maxExposure,\n    meanExposure,\n    topExposures,\n  };\n\n  return {\n    modelVersion: HNDL_MODEL_VERSION,\n    horizon: map.horizon,\n    exposures,\n    byFingerprint,\n    assets,\n    summary,\n  };\n}\n\n/* -------------------------------------------------------------------------- */\n/* hndl.yml parsing (hand-rolled YAML subset)                                 */\n/* -------------------------------------------------------------------------- */\n\ninterface YamlLine {\n  indent: number;\n  content: string;\n  /** 1-based source line number, for error messages. */\n  n: number;\n}\n\n/** Strip an inline `# comment` that begins after whitespace, outside quotes. */\nfunction stripInlineComment(text: string): string {\n  let quote: string | undefined;\n  for (let i = 0; i < text.length; i++) {\n    const ch = text[i];\n    if (quote) {\n      if (ch === quote) quote = undefined;\n      continue;\n    }\n    if (ch === '\"' || ch === \"'\") {\n      quote = ch;\n      continue;\n    }\n    if (ch === \"#\" && (i === 0 || /\\s/.test(text[i - 1] as string))) {\n      return text.slice(0, i);\n    }\n  }\n  return text;\n}\n\n/** Tokenise text into non-blank, non-comment lines with their indent depth. */\nfunction tokenizeYaml(text: string, file?: string): YamlLine[] {\n  const lines: YamlLine[] = [];\n  const raw = text.split(/\\r?\\n/);\n  for (let i = 0; i < raw.length; i++) {\n    const line = raw[i] as string;\n    if (line.includes(\"\\t\")) {\n      throw new HndlError(`tabs are not allowed for indentation (line ${i + 1})`, file);\n    }\n    const stripped = stripInlineComment(line).replace(/\\s+$/, \"\");\n    if (stripped.trim() === \"\") continue;\n    const indent = stripped.length - stripped.trimStart().length;\n    lines.push({ indent, content: stripped.trimStart(), n: i + 1 });\n  }\n  return lines;\n}\n\n/** True when `content` opens a `key:` mapping entry (colon outside quotes). */\nfunction isKeyLine(content: string): boolean {\n  return /^[A-Za-z0-9_.-]+\\s*:(\\s|$)/.test(content);\n}\n\nfunction splitKey(content: string, file: string, n: number): { key: string; value: string } {\n  const idx = content.indexOf(\":\");\n  if (idx < 0) throw new HndlError(`expected \"key: value\" (line ${n})`, file);\n  return { key: content.slice(0, idx).trim(), value: content.slice(idx + 1).trim() };\n}\n\n/** Coerce a scalar token: quoted string, boolean, number, or bare string. */\nfunction parseScalar(token: string): string | number | boolean {\n  if (token.length >= 2) {\n    const q = token[0];\n    if ((q === '\"' || q === \"'\") && token[token.length - 1] === q) {\n      return token.slice(1, -1);\n    }\n  }\n  if (token === \"true\") return true;\n  if (token === \"false\") return false;\n  if (/^-?\\d+(\\.\\d+)?$/.test(token)) return Number(token);\n  return token;\n}\n\n/**\n * Parse a mapping/sequence VALUE token: either an inline-flow list\n * (`[a, \"b\", c]`, `[]`) or a plain scalar. Only flat flow lists of scalars are\n * supported - enough for `paths: [...]` / `scopes: [...]` without a full YAML\n * flow grammar.\n */\nfunction parseValueToken(token: string, file: string, n: number): YamlValue {\n  if (token.startsWith(\"[\")) {\n    if (!token.endsWith(\"]\")) {\n      throw new HndlError(`unterminated inline list (line ${n})`, file);\n    }\n    return parseFlowList(token.slice(1, -1), file, n);\n  }\n  return parseScalar(token);\n}\n\n/** Split a flow-list body on top-level commas (quote-aware) → scalar elements. */\nfunction parseFlowList(body: string, file: string, n: number): YamlValue[] {\n  const out: YamlValue[] = [];\n  let cur = \"\";\n  let quote: string | undefined;\n  for (let i = 0; i < body.length; i++) {\n    const ch = body[i] as string;\n    if (quote) {\n      cur += ch;\n      if (ch === quote) quote = undefined;\n      continue;\n    }\n    if (ch === '\"' || ch === \"'\") {\n      quote = ch;\n      cur += ch;\n      continue;\n    }\n    if (ch === \",\") {\n      out.push(cur.trim());\n      cur = \"\";\n      continue;\n    }\n    cur += ch;\n  }\n  if (quote) throw new HndlError(`unterminated string in inline list (line ${n})`, file);\n  const last = cur.trim();\n  // A trailing empty segment only when the list itself is empty (`[]`).\n  if (last !== \"\" || out.length > 0) out.push(last);\n  return out.filter((t) => t !== \"\").map((t) => parseScalar(t as string));\n}\n\ntype YamlValue = string | number | boolean | null | YamlValue[] | { [k: string]: YamlValue };\n\n/** Recursive-descent parse of the tokenised lines into a generic value. */\nfunction parseYaml(text: string, file: string): YamlValue {\n  const lines = tokenizeYaml(text, file);\n  if (lines.length === 0) return {};\n\n  function parseNode(i: number, indent: number): [YamlValue, number] {\n    const first = lines[i] as YamlLine;\n    if (first.content === \"-\" || first.content.startsWith(\"- \")) {\n      return parseSeq(i, indent);\n    }\n    return parseMap(i, indent);\n  }\n\n  function parseSeq(start: number, indent: number): [YamlValue[], number] {\n    const arr: YamlValue[] = [];\n    let i = start;\n    while (\n      i < lines.length &&\n      (lines[i] as YamlLine).indent === indent &&\n      ((lines[i] as YamlLine).content === \"-\" || (lines[i] as YamlLine).content.startsWith(\"- \"))\n    ) {\n      const line = lines[i] as YamlLine;\n      const rest = line.content === \"-\" ? \"\" : line.content.slice(2).trim();\n      const itemIndent = indent + 2;\n      if (rest === \"\") {\n        if (i + 1 < lines.length && (lines[i + 1] as YamlLine).indent > indent) {\n          const [val, next] = parseNode(i + 1, (lines[i + 1] as YamlLine).indent);\n          arr.push(val);\n          i = next;\n        } else {\n          arr.push(null);\n          i++;\n        }\n      } else if (isKeyLine(rest)) {\n        // Map item introduced by the dash: rewrite this line as its first key at\n        // the deeper indent, then let parseMap consume it + aligned siblings.\n        lines[i] = { indent: itemIndent, content: rest, n: line.n };\n        const [val, next] = parseMap(i, itemIndent);\n        arr.push(val);\n        i = next;\n      } else {\n        arr.push(parseValueToken(rest, file, line.n));\n        i++;\n      }\n    }\n    return [arr, i];\n  }\n\n  function parseMap(start: number, indent: number): [{ [k: string]: YamlValue }, number] {\n    const obj: { [k: string]: YamlValue } = {};\n    let i = start;\n    while (\n      i < lines.length &&\n      (lines[i] as YamlLine).indent === indent &&\n      !(lines[i] as YamlLine).content.startsWith(\"- \") &&\n      (lines[i] as YamlLine).content !== \"-\"\n    ) {\n      const line = lines[i] as YamlLine;\n      const { key, value } = splitKey(line.content, file, line.n);\n      if (value !== \"\") {\n        obj[key] = parseValueToken(value, file, line.n);\n        i++;\n      } else if (i + 1 < lines.length && (lines[i + 1] as YamlLine).indent > indent) {\n        const [val, next] = parseNode(i + 1, (lines[i + 1] as YamlLine).indent);\n        obj[key] = val;\n        i = next;\n      } else {\n        obj[key] = null;\n        i++;\n      }\n    }\n    return [obj, i];\n  }\n\n  const [value] = parseNode(0, (lines[0] as YamlLine).indent);\n  return value;\n}\n\n/* -------------------------------------------------------------------------- */\n/* hndl.yml validation → HndlMap                                              */\n/* -------------------------------------------------------------------------- */\n\nfunction isObject(v: YamlValue): v is { [k: string]: YamlValue } {\n  return typeof v === \"object\" && v !== null && !Array.isArray(v);\n}\n\nfunction asString(v: YamlValue, what: string, file: string): string {\n  if (typeof v !== \"string\" || v.length === 0) {\n    throw new HndlError(`${what} must be a non-empty string`, file);\n  }\n  return v;\n}\n\nfunction asNonNegNumber(v: YamlValue, what: string, file: string): number {\n  if (typeof v !== \"number\" || !Number.isFinite(v) || v < 0) {\n    throw new HndlError(`${what} must be a non-negative number`, file);\n  }\n  return v;\n}\n\nfunction asClassification(v: YamlValue, what: string, file: string): DataClassification {\n  if (typeof v !== \"string\" || !(CLASSIFICATIONS as readonly string[]).includes(v)) {\n    throw new HndlError(`${what} must be one of: ${CLASSIFICATIONS.join(\", \")}`, file);\n  }\n  return v as DataClassification;\n}\n\nfunction asStringList(v: YamlValue, what: string, file: string): string[] {\n  if (!Array.isArray(v) || v.some((x) => typeof x !== \"string\" || x.length === 0)) {\n    throw new HndlError(`${what} must be a list of non-empty strings`, file);\n  }\n  return v as string[];\n}\n\n/**\n * Validate a parsed `hndl.yml` object into a typed {@link HndlMap}. Applies\n * defaults for `version`, `horizon`, and `defaults`; requires each asset to have\n * a unique `key`, a `name`, a valid `classification`, non-negative retention +\n * secrecy lifetime, and at least one path glob.\n */\nexport function parseHndlMap(text: string, file = HNDL_FILENAME): HndlMap {\n  const root = parseYaml(text, file);\n  if (!isObject(root)) {\n    throw new HndlError(`hndl.yml must be a mapping at the top level`, file);\n  }\n\n  let version = 1;\n  if (\"version\" in root) {\n    const v = root[\"version\"];\n    if (typeof v !== \"number\" || !Number.isInteger(v)) {\n      throw new HndlError(`\"version\" must be an integer`, file);\n    }\n    version = v;\n  }\n\n  const horizon: HndlHorizon = {\n    quantumThreatYears: DEFAULT_QUANTUM_THREAT_YEARS,\n    migrationHorizonYears: DEFAULT_MIGRATION_HORIZON_YEARS,\n  };\n  if (\"horizon\" in root && root[\"horizon\"] !== null) {\n    const h = root[\"horizon\"];\n    if (!isObject(h)) throw new HndlError(`\"horizon\" must be a mapping`, file);\n    if (\"quantum_threat_years\" in h) {\n      horizon.quantumThreatYears = asNonNegNumber(\n        h[\"quantum_threat_years\"],\n        `\"horizon.quantum_threat_years\"`,\n        file,\n      );\n    }\n    if (\"migration_horizon_years\" in h) {\n      horizon.migrationHorizonYears = asNonNegNumber(\n        h[\"migration_horizon_years\"],\n        `\"horizon.migration_horizon_years\"`,\n        file,\n      );\n    }\n  }\n\n  const defaults: HndlDefaults = { classification: DEFAULT_UNBOUND_CLASSIFICATION };\n  if (\"defaults\" in root && root[\"defaults\"] !== null) {\n    const d = root[\"defaults\"];\n    if (!isObject(d)) throw new HndlError(`\"defaults\" must be a mapping`, file);\n    if (\"classification\" in d) {\n      defaults.classification = asClassification(\n        d[\"classification\"],\n        `\"defaults.classification\"`,\n        file,\n      );\n    }\n  }\n\n  const rawAssets = \"assets\" in root ? root[\"assets\"] : [];\n  if (!Array.isArray(rawAssets)) {\n    throw new HndlError(`\"assets\" must be a list`, file);\n  }\n  const assets: HndlDataAsset[] = [];\n  const seenKeys = new Set<string>();\n  for (let idx = 0; idx < rawAssets.length; idx++) {\n    const a = rawAssets[idx];\n    if (!isObject(a)) throw new HndlError(`assets[${idx}] must be a mapping`, file);\n    const key = asString(a[\"key\"], `assets[${idx}].key`, file);\n    if (seenKeys.has(key)) throw new HndlError(`duplicate asset key \"${key}\"`, file);\n    seenKeys.add(key);\n    const asset: HndlDataAsset = {\n      key,\n      name: asString(a[\"name\"], `assets[${idx}].name`, file),\n      classification: asClassification(a[\"classification\"], `assets[${idx}].classification`, file),\n      retentionYears: asNonNegNumber(a[\"retention_years\"], `assets[${idx}].retention_years`, file),\n      secrecyLifetimeYears: asNonNegNumber(\n        a[\"secrecy_lifetime_years\"],\n        `assets[${idx}].secrecy_lifetime_years`,\n        file,\n      ),\n      paths: asStringList(a[\"paths\"], `assets[${idx}].paths`, file),\n    };\n    if (asset.paths.length === 0) {\n      throw new HndlError(`assets[${idx}].paths must list at least one glob`, file);\n    }\n    if (\"scopes\" in a && a[\"scopes\"] !== null) {\n      const scopes = asStringList(a[\"scopes\"], `assets[${idx}].scopes`, file);\n      for (const s of scopes) {\n        if (!(HNDL_SCOPES as readonly string[]).includes(s)) {\n          throw new HndlError(\n            `assets[${idx}].scopes: \"${s}\" must be one of: ${HNDL_SCOPES.join(\", \")}`,\n            file,\n          );\n        }\n      }\n      asset.scopes = scopes as HndlScope[];\n    }\n    assets.push(asset);\n  }\n\n  return { version, horizon, defaults, assets };\n}\n\n/**\n * Load and validate the `hndl.yml` for a scan. By default reads\n * `<root>/hndl.yml`; pass an explicit `*.yml` path to read a named file. A\n * missing file is always an error here (the caller opted into `--hndl`).\n *\n * @throws {HndlError} On a missing file, unreadable file, or malformed content.\n */\nexport async function loadHndlMap(root: string): Promise<{ map: HndlMap; path: string }> {\n  const base = path.basename(root);\n  const file =\n    base === HNDL_FILENAME || base.endsWith(\".yml\") || base.endsWith(\".yaml\")\n      ? path.resolve(root)\n      : path.resolve(root, HNDL_FILENAME);\n  let text: string;\n  try {\n    text = await readFile(file, \"utf8\");\n  } catch {\n    throw new HndlError(\n      `hndl.yml not found: ${file} (run \"qscan hndl init\" to scaffold one)`,\n      file,\n    );\n  }\n  return { map: parseHndlMap(text, file), path: file };\n}\n\n/* -------------------------------------------------------------------------- */\n/* hndl.yml scaffolding (`qscan hndl init`)                                   */\n/* -------------------------------------------------------------------------- */\n\n/** First path segment of a POSIX file path, or \".\" for a root-level file. */\nfunction topDir(file: string): string {\n  const slash = file.indexOf(\"/\");\n  return slash < 0 ? \".\" : file.slice(0, slash);\n}\n\n/** A URL/key-safe slug for a directory name. */\nfunction slugify(dir: string): string {\n  const slug = dir\n    .toLowerCase()\n    .replace(/[^a-z0-9]+/g, \"-\")\n    .replace(/^-+|-+$/g, \"\");\n  return slug.length > 0 ? slug : \"root\";\n}\n\n/**\n * Scaffold an `hndl.yml` document seeded from a scan's findings. Config-scope,\n * HNDL-exposed findings are the crypto-to-data join points (KMS, secrets-at-rest,\n * database TDE, brokers, JOSE/JWE), so each directory that contains one becomes a\n * proposed asset stub the user fills in. The returned string is valid `hndl.yml`\n * (it round-trips through {@link parseHndlMap}); the classification / retention /\n * secrecy values are conservative placeholders the user is expected to correct.\n */\nexport function scaffoldHndlYaml(findings: readonly Finding[]): string {\n  // Group data-adjacent findings by their top-level directory.\n  const byDir = new Map<string, Set<string>>();\n  for (const f of findings) {\n    if (findingScope(f) !== \"config\" || !f.hndl) continue;\n    const dir = topDir(f.location.file);\n    let rules = byDir.get(dir);\n    if (!rules) {\n      rules = new Set<string>();\n      byDir.set(dir, rules);\n    }\n    rules.add(f.ruleId);\n  }\n\n  const lines: string[] = [\n    \"# hndl.yml - HNDL (harvest-now-decrypt-later) data map for this repo.\",\n    \"#\",\n    \"# qScan joins each crypto finding to the data it protects and scores exposure as\",\n    \"#   crypto-vulnerability x data-sensitivity x Mosca-factor (retention + secrecy\",\n    \"#   lifetime vs the quantum-threat horizon). See docs/HNDL.md for the model.\",\n    \"#\",\n    \"# Fill in the assets below: correct the classification, the retention_years and\",\n    \"# secrecy_lifetime_years, and the path globs. Delete stubs that do not apply.\",\n    \"version: 1\",\n    \"\",\n    \"horizon:\",\n    `  quantum_threat_years: ${DEFAULT_QUANTUM_THREAT_YEARS}   # Z: years until a CRQC is assumed`,\n    `  migration_horizon_years: ${DEFAULT_MIGRATION_HORIZON_YEARS}    # Y: years to finish your PQC migration`,\n    \"\",\n    \"defaults:\",\n    `  classification: ${DEFAULT_UNBOUND_CLASSIFICATION}   # applied to findings that match no asset below`,\n    \"\",\n    \"assets:\",\n  ];\n\n  if (byDir.size === 0) {\n    lines.push(\n      \"  # No data-adjacent (config-scope, HNDL) findings were detected to seed from.\",\n      \"  # Declare your data assets manually, for example:\",\n      \"  - key: customer-pii\",\n      \"    name: Customer PII\",\n      \"    classification: regulated\",\n      \"    retention_years: 7\",\n      \"    secrecy_lifetime_years: 25\",\n      \"    paths:\",\n      '      - \"src/**\"',\n    );\n  } else {\n    const dirs = [...byDir.keys()].sort();\n    for (const dir of dirs) {\n      const rules = [...(byDir.get(dir) as Set<string>)].sort();\n      const glob = dir === \".\" ? \"*\" : `${dir}/**`;\n      lines.push(\n        `  # detected data-adjacent crypto here: ${rules.join(\", \")}`,\n        `  - key: ${slugify(dir)}`,\n        `    name: ${dir === \".\" ? \"Repository root\" : dir}`,\n        \"    classification: confidential   # TODO: public | internal | confidential | regulated\",\n        \"    retention_years: 7             # TODO: how long the data is kept\",\n        \"    secrecy_lifetime_years: 10     # TODO: how long it must stay confidential\",\n        \"    paths:\",\n        `      - \"${glob}\"`,\n      );\n    }\n  }\n\n  return `${lines.join(\"\\n\")}\\n`;\n}\n"]}

package/dist/index.d.ts

@@ -36,6 +36,8 @@ export type { Baseline } from "./baseline.js";
 export { changedFiles } from "./changed.js";
 export { loadConfig, ConfigError, CONFIG_FILENAME } from "./config.js";
 export type { QuantakryptoFileConfig, LoadConfigResult } from "./config.js";
+export { HNDL_MODEL_VERSION, HNDL_FILENAME, SEVERITY_VULNERABILITY, CONFIDENCE_WEIGHT, CLASSIFICATION_SENSITIVITY, NON_HNDL_DISCOUNT, DEFAULT_QUANTUM_THREAT_YEARS, DEFAULT_MIGRATION_HORIZON_YEARS, DEFAULT_UNBOUND_CLASSIFICATION, HndlError, computeHndl, vulnerabilityFactor, moscaFactor, globMatch, findingFingerprint, findingScope, parseHndlMap, loadHndlMap, scaffoldHndlYaml, } from "./hndl.js";
+export type { DataClassification, HndlScope, HndlDataAsset, HndlHorizon, HndlDefaults, HndlMap, ExposureRationale, FindingExposure, AssetExposure, HndlSummary, HndlReport, } from "./hndl.js";
 export { walkFiles, isBinaryPath, looksMinified } from "./walk.js";
 export { isAnalyzableSource, ANALYZABLE_SOURCE_EXTENSIONS, ANALYZABLE_LANGUAGES_LABEL, } from "./detect-utils.js";
 export { buildInventory } from "./inventory.js";
@@ -48,10 +50,14 @@ export type { CycloneDxBom, CbomComponent } from "./cbom.js";
 export { mergeCboms } from "./cbom-merge.js";
 export { toOpenVex } from "./vex.js";
 export type { OpenVexDocument, OpenVexStatement, OpenVexOptions } from "./vex.js";
+export { buildCryptoAgilityManifest, validateCryptoAgilityManifest, CRYPTO_AGILITY_MANIFEST_VERSION, CRYPTO_AGILITY_WELL_KNOWN_PATH, } from "./crypto-agility.js";
+export type { CryptoAgilityManifest, CryptoAgilityManifestOptions, CryptoAgilityPosture, CryptoAgilityCbomSummary, CryptoAgilityFamily, CryptoAgilityPolicy, ManifestValidation, } from "./crypto-agility.js";
 export { buildReadinessReport, signReadinessReport, verifyReadinessReport } from "./evidence.js";
 export type { ReadinessReport, EvidenceFinding, ReadinessReportOptions, EvidenceSigner, SignEvidenceOptions, VerifyReadinessResult, } from "./evidence.js";
 export { buildPolicyMapping, parseCryptoPolicy } from "./policy.js";
 export type { CryptoPolicy, PolicyVerdict, PolicyMapping, PolicyFindingVerdict } from "./policy.js";
+export { MANDATES, mandateIds, getMandate, assertKnownMandates, evaluateMandates, mandateGateFails, } from "./mandates.js";
+export type { Mandate, MandateRule, MandateRuleTier, MandateStatus, MandateFindingVerdict, MandateEvaluation, MandateGateOptions, } from "./mandates.js";
 export { remediationFor, remediationForTier, remediationForProfile, TIER_PARAMS, STATEFUL_HBS_NOTE, PQC_TRANSITION_NOTE, statefulHbsApplies, } from "./remediation.js";
 export type { SecurityTier } from "./remediation.js";
 export { PQC_STANDARDS } from "./standards.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,cAAc,YAAY,CAAC;AAG3B,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAGvC,YAAY,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAG5C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAGzE,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC7D,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAGhD,YAAY,EACV,YAAY,EACZ,eAAe,EACf,aAAa,EACb,KAAK,EACL,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACvF,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACrE,YAAY,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,YAAY,EACV,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,aAAa,GACd,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAI9D,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,YAAY,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAI/C,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGlE,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAG9C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAG5C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,YAAY,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAG5E,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAGnE,OAAO,EACL,kBAAkB,EAClB,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAKhD,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGhG,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGzF,OAAO,EACL,OAAO,EACP,MAAM,EACN,aAAa,EACb,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGjD,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACnC,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE7D,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAElF,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACjG,YAAY,EACV,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,cAAc,EACd,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACpE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAGpG,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EACrB,WAAW,EACX,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAGrD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAG7F,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAG9E,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,cAAc,YAAY,CAAC;AAG3B,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAGvC,YAAY,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAG5C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAGzE,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC7D,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAGhD,YAAY,EACV,YAAY,EACZ,eAAe,EACf,aAAa,EACb,KAAK,EACL,WAAW,GACZ,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACvF,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACrE,YAAY,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,YAAY,EACV,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,aAAa,GACd,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAI9D,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,YAAY,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAI/C,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAGlE,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAG9C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAG5C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,YAAY,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAG5E,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,sBAAsB,EACtB,iBAAiB,EACjB,0BAA0B,EAC1B,iBAAiB,EACjB,4BAA4B,EAC5B,+BAA+B,EAC/B,8BAA8B,EAC9B,SAAS,EACT,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,SAAS,EACT,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,gBAAgB,GACjB,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,kBAAkB,EAClB,SAAS,EACT,aAAa,EACb,WAAW,EACX,YAAY,EACZ,OAAO,EACP,iBAAiB,EACjB,eAAe,EACf,aAAa,EACb,WAAW,EACX,UAAU,GACX,MAAM,WAAW,CAAC;AAGnB,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAGnE,OAAO,EACL,kBAAkB,EAClB,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAKhD,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGhG,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGzF,OAAO,EACL,OAAO,EACP,MAAM,EACN,aAAa,EACb,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGjD,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACnC,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE7D,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAElF,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,EAC7B,+BAA+B,EAC/B,8BAA8B,GAC/B,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,qBAAqB,EACrB,4BAA4B,EAC5B,oBAAoB,EACpB,wBAAwB,EACxB,mBAAmB,EACnB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACjG,YAAY,EACV,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,cAAc,EACd,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACpE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAGpG,OAAO,EACL,QAAQ,EACR,UAAU,EACV,UAAU,EACV,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,OAAO,EACP,WAAW,EACX,eAAe,EACf,aAAa,EACb,qBAAqB,EACrB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EACrB,WAAW,EACX,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAGrD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAG7F,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAG9E,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,UAAU,CAAC"}

package/dist/index.js

@@ -36,6 +36,8 @@ export { fingerprintFinding, baselineFromFindings, applyBaseline, loadBaseline,
 export { changedFiles } from "./changed.js";
 // Optional `quantakrypto.config.json` loader (P2-9; see docs/CONFIG.md).
 export { loadConfig, ConfigError, CONFIG_FILENAME } from "./config.js";
+// HNDL (harvest-now-decrypt-later) data-risk quantifier (see docs/HNDL.md).
+export { HNDL_MODEL_VERSION, HNDL_FILENAME, SEVERITY_VULNERABILITY, CONFIDENCE_WEIGHT, CLASSIFICATION_SENSITIVITY, NON_HNDL_DISCOUNT, DEFAULT_QUANTUM_THREAT_YEARS, DEFAULT_MIGRATION_HORIZON_YEARS, DEFAULT_UNBOUND_CLASSIFICATION, HndlError, computeHndl, vulnerabilityFactor, moscaFactor, globMatch, findingFingerprint, findingScope, parseHndlMap, loadHndlMap, scaffoldHndlYaml, } from "./hndl.js";
 // Filesystem walker (relative POSIX paths, default ignores, size/binary filters).
 export { walkFiles, isBinaryPath, looksMinified } from "./walk.js";
 // Analyzable-language coverage (which source languages the scanner inspects).
@@ -56,10 +58,14 @@ export { toCbom } from "./cbom.js";
 export { mergeCboms } from "./cbom-merge.js";
 // OpenVEX 0.2.0 export — quantum-readiness posture as VEX statements.
 export { toOpenVex } from "./vex.js";
+// Crypto-agility manifest: agent-consumable crypto-posture document.
+export { buildCryptoAgilityManifest, validateCryptoAgilityManifest, CRYPTO_AGILITY_MANIFEST_VERSION, CRYPTO_AGILITY_WELL_KNOWN_PATH, } from "./crypto-agility.js";
 // ISO/IEC 27001 A.8.24 evidence-chain readiness report.
 export { buildReadinessReport, signReadinessReport, verifyReadinessReport } from "./evidence.js";
 // Cryptography policy → per-finding verdicts (A.8.24 evidence §4).
 export { buildPolicyMapping, parseCryptoPolicy } from "./policy.js";
+// Compliance mandates → dated, clause-named verdicts + gate (policy-as-code).
+export { MANDATES, mandateIds, getMandate, assertKnownMandates, evaluateMandates, mandateGateFails, } from "./mandates.js";
 // Remediation lookup (family + tier-aware + profile-aware) and stateful-HBS guidance.
 export { remediationFor, remediationForTier, remediationForProfile, TIER_PARAMS, STATEFUL_HBS_NOTE, PQC_TRANSITION_NOTE, statefulHbsApplies, } from "./remediation.js";
 // Post-quantum standards source of truth + review cadence.

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,cAAc,YAAY,CAAC;AAE3B,qEAAqE;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAKvC,8CAA8C;AAC9C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEzE,2EAA2E;AAC3E,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAW7D,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEvF,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAErE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAQ5D,0CAA0C;AAC1C,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAE9D,6EAA6E;AAC7E,kFAAkF;AAClF,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG7C,kFAAkF;AAClF,YAAY;AACZ,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAElE,qDAAqD;AACrD,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAGvB,oEAAoE;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,yEAAyE;AACzE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAGvE,kFAAkF;AAClF,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAEnE,8EAA8E;AAC9E,OAAO,EACL,kBAAkB,EAClB,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAE3B,+BAA+B;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,sFAAsF;AACtF,6EAA6E;AAC7E,gFAAgF;AAChF,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEhG,+EAA+E;AAC/E,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEzF,aAAa;AACb,OAAO,EACL,OAAO,EACP,MAAM,EACN,aAAa,EACb,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AAGrB,+DAA+D;AAC/D,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAEnC,8EAA8E;AAC9E,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,sEAAsE;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAErC,wDAAwD;AACxD,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAUjG,mEAAmE;AACnE,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGpE,sFAAsF;AACtF,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EACrB,WAAW,EACX,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAG1B,2DAA2D;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAG/C,2EAA2E;AAC3E,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAGjC,4BAA4B;AAC5B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,UAAU,CAAC","sourcesContent":["/**\n * @quantakrypto/core — public API (LOCKED CONTRACT).\n *\n * The exported NAMES and SIGNATURES below are the stable contract that\n * @quantakrypto/qscan, @quantakrypto/mcp and the GitHub Action depend on — do not change\n * them without updating all consumers. The implementations live in focused\n * modules under src/ and are re-exported here; the public surface is identical\n * to the original stub file.\n */\nexport * from \"./types.js\";\n\n// Tool version, surfaced in reports. Keep in sync with package.json.\nexport { VERSION } from \"./version.js\";\n\n// Minimal SARIF 2.1.0 log shape, defined alongside the reporters.\nexport type { SarifLog } from \"./report.js\";\n\n// Core orchestration + built-in detector set.\nexport { scan, detectors, detectFile, compareFindings } from \"./scan.js\";\n\n// Snippet-level fix verification (shared by MCP verify_fix + remediation).\nexport { verifyFix, languageToExtension } from \"./verify.js\";\nexport type { VerifyResult } from \"./verify.js\";\n\n// Agent-plane shared types + the context redactor (offline; reused by MCP).\nexport type {\n  ContextLevel,\n  RedactedContext,\n  TriageVerdict,\n  Patch,\n  FixProposal,\n} from \"./agent-types.js\";\nexport { buildContext, renderPreflight } from \"./redact.js\";\nexport { TRIAGE_RUBRIC, TRIAGE_VERDICT_SCHEMA, buildTriageRequest } from \"./triage.js\";\nexport type { TriageRequest } from \"./triage.js\";\nexport {\n  REMEDIATE_RUBRIC,\n  FIX_REQUEST_SCHEMA,\n  buildRemediateRequest,\n} from \"./remediate-request.js\";\nexport type { RemediateRequest } from \"./remediate-request.js\";\nexport { checkPatchPolicy } from \"./patch-policy.js\";\nexport type { PolicyContext, PolicyDecision } from \"./patch-policy.js\";\nexport { withWorktree } from \"./worktree.js\";\nexport { codemodRegistry, codemodFor } from \"./codemods/registry.js\";\nexport type { Codemod } from \"./codemods/registry.js\";\nexport { configToggleCodemod } from \"./codemods/config-toggle.js\";\nexport { remediateFindings } from \"./remediate-pipeline.js\";\nexport type {\n  RemediateOptions,\n  RemediationResult,\n  VerifiedPatch,\n  RejectedPatch,\n} from \"./remediate-pipeline.js\";\n\n// Scan cancellation / work-budget errors.\nexport { AbortError, BudgetExceededError } from \"./errors.js\";\n\n// Parallel scanning (worker_threads pool). The chunk/merge helpers and their\n// SizedFile/ChunkResult types are internal plumbing (not part of the public API).\nexport { scanParallel } from \"./parallel.js\";\nexport type { ScanChunk } from \"./parallel.js\";\n\n// Detector registry (plugin point). `detectorScope` and the rule-catalog type are\n// internal.\nexport { DetectorRegistry, defaultRegistry } from \"./registry.js\";\n\n// Canonical baseline (shared by qScan + the Action).\nexport {\n  fingerprintFinding,\n  baselineFromFindings,\n  applyBaseline,\n  loadBaseline,\n  saveBaseline,\n  BASELINE_VERSION,\n} from \"./baseline.js\";\nexport type { Baseline } from \"./baseline.js\";\n\n// Incremental scanning: changed-files helper (git-aware, tolerant).\nexport { changedFiles } from \"./changed.js\";\n\n// Optional `quantakrypto.config.json` loader (P2-9; see docs/CONFIG.md).\nexport { loadConfig, ConfigError, CONFIG_FILENAME } from \"./config.js\";\nexport type { QuantakryptoFileConfig, LoadConfigResult } from \"./config.js\";\n\n// Filesystem walker (relative POSIX paths, default ignores, size/binary filters).\nexport { walkFiles, isBinaryPath, looksMinified } from \"./walk.js\";\n\n// Analyzable-language coverage (which source languages the scanner inspects).\nexport {\n  isAnalyzableSource,\n  ANALYZABLE_SOURCE_EXTENSIONS,\n  ANALYZABLE_LANGUAGES_LABEL,\n} from \"./detect-utils.js\";\n\n// Inventory + readiness score.\nexport { buildInventory } from \"./inventory.js\";\n\n// Vulnerable-dependency database (the manifest scanner is used internally by scan()).\n// `DEP_VULNERABLE_RULE` is the generic catalog entry for dependency findings\n// (which don't come from a Detector, so aren't in the registry's rule catalog).\nexport { vulnerableDependencies, DEP_VULNERABLE_RULE, isManifestFile } from \"./dependencies.js\";\n\n// Severity utilities (ordering, threshold, SARIF level) — shared across tools.\nexport { SEVERITY_ORDER, severityRank, meetsThreshold, sarifLevel } from \"./severity.js\";\n\n// Reporters.\nexport {\n  toSarif,\n  toJson,\n  formatSummary,\n  formatTierGuidance,\n  formatProfileGuidance,\n} from \"./report.js\";\nexport type { ReportOptions } from \"./report.js\";\n\n// CycloneDX 1.6 cryptographic bill of materials (CBOM) export.\nexport { toCbom } from \"./cbom.js\";\nexport type { CycloneDxBom, CbomComponent } from \"./cbom.js\";\n// Merge multiple CBOMs (code + infra + live endpoints) into one combined BOM.\nexport { mergeCboms } from \"./cbom-merge.js\";\n// OpenVEX 0.2.0 export — quantum-readiness posture as VEX statements.\nexport { toOpenVex } from \"./vex.js\";\nexport type { OpenVexDocument, OpenVexStatement, OpenVexOptions } from \"./vex.js\";\n// ISO/IEC 27001 A.8.24 evidence-chain readiness report.\nexport { buildReadinessReport, signReadinessReport, verifyReadinessReport } from \"./evidence.js\";\nexport type {\n  ReadinessReport,\n  EvidenceFinding,\n  ReadinessReportOptions,\n  EvidenceSigner,\n  SignEvidenceOptions,\n  VerifyReadinessResult,\n} from \"./evidence.js\";\n\n// Cryptography policy → per-finding verdicts (A.8.24 evidence §4).\nexport { buildPolicyMapping, parseCryptoPolicy } from \"./policy.js\";\nexport type { CryptoPolicy, PolicyVerdict, PolicyMapping, PolicyFindingVerdict } from \"./policy.js\";\n\n// Remediation lookup (family + tier-aware + profile-aware) and stateful-HBS guidance.\nexport {\n  remediationFor,\n  remediationForTier,\n  remediationForProfile,\n  TIER_PARAMS,\n  STATEFUL_HBS_NOTE,\n  PQC_TRANSITION_NOTE,\n  statefulHbsApplies,\n} from \"./remediation.js\";\nexport type { SecurityTier } from \"./remediation.js\";\n\n// Post-quantum standards source of truth + review cadence.\nexport { PQC_STANDARDS } from \"./standards.js\";\nexport type { PqcStandards, StandardsCitation, StandardsReviewStatus } from \"./standards.js\";\n\n// Selectable standards regime profiles (NIST / CNSA / BSI / ANSSI / NCSC).\nexport {\n  STANDARDS_PROFILES,\n  DEFAULT_PROFILE_ID,\n  standardsProfileIds,\n  getStandardsProfile,\n  defaultStandardsProfile,\n} from \"./standards-profiles.js\";\nexport type { StandardsProfile, HybridStance } from \"./standards-profiles.js\";\n\n// CWE identifier constants.\nexport {\n  CWE_BROKEN_CRYPTO,\n  CWE_WEAK_STRENGTH,\n  CWE_CERT_VALIDATION,\n  CWE_HARDCODED_KEY,\n  CWE_RISKY_PRIMITIVE,\n} from \"./cwe.js\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,cAAc,YAAY,CAAC;AAE3B,qEAAqE;AACrE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAKvC,8CAA8C;AAC9C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEzE,2EAA2E;AAC3E,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAW7D,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEvF,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAErE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAQ5D,0CAA0C;AAC1C,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAE9D,6EAA6E;AAC7E,kFAAkF;AAClF,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG7C,kFAAkF;AAClF,YAAY;AACZ,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAElE,qDAAqD;AACrD,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAGvB,oEAAoE;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,yEAAyE;AACzE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAGvE,4EAA4E;AAC5E,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,sBAAsB,EACtB,iBAAiB,EACjB,0BAA0B,EAC1B,iBAAiB,EACjB,4BAA4B,EAC5B,+BAA+B,EAC/B,8BAA8B,EAC9B,SAAS,EACT,WAAW,EACX,mBAAmB,EACnB,WAAW,EACX,SAAS,EACT,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,gBAAgB,GACjB,MAAM,WAAW,CAAC;AAenB,kFAAkF;AAClF,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAEnE,8EAA8E;AAC9E,OAAO,EACL,kBAAkB,EAClB,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAE3B,+BAA+B;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,sFAAsF;AACtF,6EAA6E;AAC7E,gFAAgF;AAChF,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEhG,+EAA+E;AAC/E,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEzF,aAAa;AACb,OAAO,EACL,OAAO,EACP,MAAM,EACN,aAAa,EACb,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AAGrB,+DAA+D;AAC/D,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAEnC,8EAA8E;AAC9E,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,sEAAsE;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAErC,qEAAqE;AACrE,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,EAC7B,+BAA+B,EAC/B,8BAA8B,GAC/B,MAAM,qBAAqB,CAAC;AAU7B,wDAAwD;AACxD,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAUjG,mEAAmE;AACnE,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGpE,8EAA8E;AAC9E,OAAO,EACL,QAAQ,EACR,UAAU,EACV,UAAU,EACV,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAWvB,sFAAsF;AACtF,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EACrB,WAAW,EACX,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAG1B,2DAA2D;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAG/C,2EAA2E;AAC3E,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAGjC,4BAA4B;AAC5B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,UAAU,CAAC","sourcesContent":["/**\n * @quantakrypto/core — public API (LOCKED CONTRACT).\n *\n * The exported NAMES and SIGNATURES below are the stable contract that\n * @quantakrypto/qscan, @quantakrypto/mcp and the GitHub Action depend on — do not change\n * them without updating all consumers. The implementations live in focused\n * modules under src/ and are re-exported here; the public surface is identical\n * to the original stub file.\n */\nexport * from \"./types.js\";\n\n// Tool version, surfaced in reports. Keep in sync with package.json.\nexport { VERSION } from \"./version.js\";\n\n// Minimal SARIF 2.1.0 log shape, defined alongside the reporters.\nexport type { SarifLog } from \"./report.js\";\n\n// Core orchestration + built-in detector set.\nexport { scan, detectors, detectFile, compareFindings } from \"./scan.js\";\n\n// Snippet-level fix verification (shared by MCP verify_fix + remediation).\nexport { verifyFix, languageToExtension } from \"./verify.js\";\nexport type { VerifyResult } from \"./verify.js\";\n\n// Agent-plane shared types + the context redactor (offline; reused by MCP).\nexport type {\n  ContextLevel,\n  RedactedContext,\n  TriageVerdict,\n  Patch,\n  FixProposal,\n} from \"./agent-types.js\";\nexport { buildContext, renderPreflight } from \"./redact.js\";\nexport { TRIAGE_RUBRIC, TRIAGE_VERDICT_SCHEMA, buildTriageRequest } from \"./triage.js\";\nexport type { TriageRequest } from \"./triage.js\";\nexport {\n  REMEDIATE_RUBRIC,\n  FIX_REQUEST_SCHEMA,\n  buildRemediateRequest,\n} from \"./remediate-request.js\";\nexport type { RemediateRequest } from \"./remediate-request.js\";\nexport { checkPatchPolicy } from \"./patch-policy.js\";\nexport type { PolicyContext, PolicyDecision } from \"./patch-policy.js\";\nexport { withWorktree } from \"./worktree.js\";\nexport { codemodRegistry, codemodFor } from \"./codemods/registry.js\";\nexport type { Codemod } from \"./codemods/registry.js\";\nexport { configToggleCodemod } from \"./codemods/config-toggle.js\";\nexport { remediateFindings } from \"./remediate-pipeline.js\";\nexport type {\n  RemediateOptions,\n  RemediationResult,\n  VerifiedPatch,\n  RejectedPatch,\n} from \"./remediate-pipeline.js\";\n\n// Scan cancellation / work-budget errors.\nexport { AbortError, BudgetExceededError } from \"./errors.js\";\n\n// Parallel scanning (worker_threads pool). The chunk/merge helpers and their\n// SizedFile/ChunkResult types are internal plumbing (not part of the public API).\nexport { scanParallel } from \"./parallel.js\";\nexport type { ScanChunk } from \"./parallel.js\";\n\n// Detector registry (plugin point). `detectorScope` and the rule-catalog type are\n// internal.\nexport { DetectorRegistry, defaultRegistry } from \"./registry.js\";\n\n// Canonical baseline (shared by qScan + the Action).\nexport {\n  fingerprintFinding,\n  baselineFromFindings,\n  applyBaseline,\n  loadBaseline,\n  saveBaseline,\n  BASELINE_VERSION,\n} from \"./baseline.js\";\nexport type { Baseline } from \"./baseline.js\";\n\n// Incremental scanning: changed-files helper (git-aware, tolerant).\nexport { changedFiles } from \"./changed.js\";\n\n// Optional `quantakrypto.config.json` loader (P2-9; see docs/CONFIG.md).\nexport { loadConfig, ConfigError, CONFIG_FILENAME } from \"./config.js\";\nexport type { QuantakryptoFileConfig, LoadConfigResult } from \"./config.js\";\n\n// HNDL (harvest-now-decrypt-later) data-risk quantifier (see docs/HNDL.md).\nexport {\n  HNDL_MODEL_VERSION,\n  HNDL_FILENAME,\n  SEVERITY_VULNERABILITY,\n  CONFIDENCE_WEIGHT,\n  CLASSIFICATION_SENSITIVITY,\n  NON_HNDL_DISCOUNT,\n  DEFAULT_QUANTUM_THREAT_YEARS,\n  DEFAULT_MIGRATION_HORIZON_YEARS,\n  DEFAULT_UNBOUND_CLASSIFICATION,\n  HndlError,\n  computeHndl,\n  vulnerabilityFactor,\n  moscaFactor,\n  globMatch,\n  findingFingerprint,\n  findingScope,\n  parseHndlMap,\n  loadHndlMap,\n  scaffoldHndlYaml,\n} from \"./hndl.js\";\nexport type {\n  DataClassification,\n  HndlScope,\n  HndlDataAsset,\n  HndlHorizon,\n  HndlDefaults,\n  HndlMap,\n  ExposureRationale,\n  FindingExposure,\n  AssetExposure,\n  HndlSummary,\n  HndlReport,\n} from \"./hndl.js\";\n\n// Filesystem walker (relative POSIX paths, default ignores, size/binary filters).\nexport { walkFiles, isBinaryPath, looksMinified } from \"./walk.js\";\n\n// Analyzable-language coverage (which source languages the scanner inspects).\nexport {\n  isAnalyzableSource,\n  ANALYZABLE_SOURCE_EXTENSIONS,\n  ANALYZABLE_LANGUAGES_LABEL,\n} from \"./detect-utils.js\";\n\n// Inventory + readiness score.\nexport { buildInventory } from \"./inventory.js\";\n\n// Vulnerable-dependency database (the manifest scanner is used internally by scan()).\n// `DEP_VULNERABLE_RULE` is the generic catalog entry for dependency findings\n// (which don't come from a Detector, so aren't in the registry's rule catalog).\nexport { vulnerableDependencies, DEP_VULNERABLE_RULE, isManifestFile } from \"./dependencies.js\";\n\n// Severity utilities (ordering, threshold, SARIF level) — shared across tools.\nexport { SEVERITY_ORDER, severityRank, meetsThreshold, sarifLevel } from \"./severity.js\";\n\n// Reporters.\nexport {\n  toSarif,\n  toJson,\n  formatSummary,\n  formatTierGuidance,\n  formatProfileGuidance,\n} from \"./report.js\";\nexport type { ReportOptions } from \"./report.js\";\n\n// CycloneDX 1.6 cryptographic bill of materials (CBOM) export.\nexport { toCbom } from \"./cbom.js\";\nexport type { CycloneDxBom, CbomComponent } from \"./cbom.js\";\n// Merge multiple CBOMs (code + infra + live endpoints) into one combined BOM.\nexport { mergeCboms } from \"./cbom-merge.js\";\n// OpenVEX 0.2.0 export — quantum-readiness posture as VEX statements.\nexport { toOpenVex } from \"./vex.js\";\nexport type { OpenVexDocument, OpenVexStatement, OpenVexOptions } from \"./vex.js\";\n// Crypto-agility manifest: agent-consumable crypto-posture document.\nexport {\n  buildCryptoAgilityManifest,\n  validateCryptoAgilityManifest,\n  CRYPTO_AGILITY_MANIFEST_VERSION,\n  CRYPTO_AGILITY_WELL_KNOWN_PATH,\n} from \"./crypto-agility.js\";\nexport type {\n  CryptoAgilityManifest,\n  CryptoAgilityManifestOptions,\n  CryptoAgilityPosture,\n  CryptoAgilityCbomSummary,\n  CryptoAgilityFamily,\n  CryptoAgilityPolicy,\n  ManifestValidation,\n} from \"./crypto-agility.js\";\n// ISO/IEC 27001 A.8.24 evidence-chain readiness report.\nexport { buildReadinessReport, signReadinessReport, verifyReadinessReport } from \"./evidence.js\";\nexport type {\n  ReadinessReport,\n  EvidenceFinding,\n  ReadinessReportOptions,\n  EvidenceSigner,\n  SignEvidenceOptions,\n  VerifyReadinessResult,\n} from \"./evidence.js\";\n\n// Cryptography policy → per-finding verdicts (A.8.24 evidence §4).\nexport { buildPolicyMapping, parseCryptoPolicy } from \"./policy.js\";\nexport type { CryptoPolicy, PolicyVerdict, PolicyMapping, PolicyFindingVerdict } from \"./policy.js\";\n\n// Compliance mandates → dated, clause-named verdicts + gate (policy-as-code).\nexport {\n  MANDATES,\n  mandateIds,\n  getMandate,\n  assertKnownMandates,\n  evaluateMandates,\n  mandateGateFails,\n} from \"./mandates.js\";\nexport type {\n  Mandate,\n  MandateRule,\n  MandateRuleTier,\n  MandateStatus,\n  MandateFindingVerdict,\n  MandateEvaluation,\n  MandateGateOptions,\n} from \"./mandates.js\";\n\n// Remediation lookup (family + tier-aware + profile-aware) and stateful-HBS guidance.\nexport {\n  remediationFor,\n  remediationForTier,\n  remediationForProfile,\n  TIER_PARAMS,\n  STATEFUL_HBS_NOTE,\n  PQC_TRANSITION_NOTE,\n  statefulHbsApplies,\n} from \"./remediation.js\";\nexport type { SecurityTier } from \"./remediation.js\";\n\n// Post-quantum standards source of truth + review cadence.\nexport { PQC_STANDARDS } from \"./standards.js\";\nexport type { PqcStandards, StandardsCitation, StandardsReviewStatus } from \"./standards.js\";\n\n// Selectable standards regime profiles (NIST / CNSA / BSI / ANSSI / NCSC).\nexport {\n  STANDARDS_PROFILES,\n  DEFAULT_PROFILE_ID,\n  standardsProfileIds,\n  getStandardsProfile,\n  defaultStandardsProfile,\n} from \"./standards-profiles.js\";\nexport type { StandardsProfile, HybridStance } from \"./standards-profiles.js\";\n\n// CWE identifier constants.\nexport {\n  CWE_BROKEN_CRYPTO,\n  CWE_WEAK_STRENGTH,\n  CWE_CERT_VALIDATION,\n  CWE_HARDCODED_KEY,\n  CWE_RISKY_PRIMITIVE,\n} from \"./cwe.js\";\n"]}

package/dist/mandates.d.ts

@@ -0,0 +1,138 @@
+/**
+ * Policy-as-code compliance mandates → dated, clause-named verdicts for findings.
+ *
+ * `CryptoPolicy` (policy.ts) classifies findings by algorithm family but is
+ * date-blind. A mandate adds the missing dimension: named clauses with an effective
+ * DATE ("CNSA 2.0 disallows classical public-key crypto after 2035"). The evaluator
+ * compares each finding's algorithm against the selected mandates and today's date,
+ * so a finding on a prohibited family reads as `due` (every deadline still ahead),
+ * `deprecated` (the DEPRECATE deadline has passed — a warning), or `violation` (the
+ * DISALLOW deadline has passed — a failure), always naming the governing clause,
+ * deadline, and citation. This is what turns the inventory into an enforceable,
+ * mandate-mapped gate rather than a neutral list.
+ *
+ * Pure and deterministic (the caller supplies `now`), so it is trivially testable.
+ * qScan consumes it today for the `--mandate` gate; because it operates on the
+ * shared `Finding[]`, qProbe or the GitHub Action can reuse it unchanged.
+ *
+ * Catalog scope: the two regimes that carry hard algorithm deadlines — CNSA 2.0 and
+ * NIST IR 8547. DORA / NIS2 / PCI DSS require approved cryptography but set no
+ * independent algorithm date; they inherit these timelines and are cited in docs.
+ */
+import type { AlgorithmFamily, Finding } from "./types.js";
+/** Which enforcement tier a clause encodes: warn (`deprecate`) or fail (`disallow`). */
+export type MandateRuleTier = "deprecate" | "disallow";
+export interface MandateRule {
+    /** The named clause this rule encodes (verbatim in the gate's failure message). */
+    clause: string;
+    /** Enforcement tier: a passed `deprecate` date warns; a passed `disallow` date fails. */
+    tier: MandateRuleTier;
+    /** Algorithm families prohibited from the effective date onward. */
+    prohibits: AlgorithmFamily[];
+    /** ISO date (YYYY-MM-DD) the prohibition takes effect. */
+    effective: string;
+    /** One-line human description of the clause. */
+    note: string;
+}
+export interface Mandate {
+    id: string;
+    name: string;
+    authority: string;
+    citation: string;
+    /** When this catalog entry was last reviewed against the source. */
+    asOf: string;
+    rules: MandateRule[];
+}
+/** The bundled mandate catalog. Keyed by `--mandate <id>`. */
+export declare const MANDATES: Record<string, Mandate>;
+export declare const mandateIds: () => string[];
+export declare const getMandate: (id: string) => Mandate | undefined;
+/**
+ * Validate mandate ids loudly, matching `parseCryptoPolicy`'s fail-loud
+ * convention: a mistyped id must never silently evaluate to an empty gate.
+ * Throws an `Error` naming every unknown id and the known catalog.
+ * `evaluateMandates` itself stays lenient (unknown ids are skipped) so callers
+ * decide where to fail.
+ */
+export declare function assertKnownMandates(ids: readonly string[]): void;
+/**
+ * A finding's status against a mandate, worst last:
+ * - `conformant` — in scope (classical asymmetric) but prohibited by no selected
+ *   clause (e.g. X25519 as the presumed hybrid leg).
+ * - `due` — prohibited, with every deadline still ahead.
+ * - `deprecated` — the DEPRECATE deadline has passed; a warning, not a failure.
+ * - `violation` — the DISALLOW deadline has passed; fails the default gate.
+ */
+export type MandateStatus = "conformant" | "due" | "deprecated" | "violation";
+export interface MandateFindingVerdict {
+    ruleId: string;
+    algorithm: AlgorithmFamily | "unknown";
+    file: string;
+    line: number;
+    /** Mandate id (e.g. "cnsa-2.0"). */
+    mandate: string;
+    /**
+     * The governing clause: the next upcoming clause when `due`, the passed
+     * DEPRECATE clause when `deprecated`, the passed DISALLOW clause on `violation`.
+     */
+    clause: string;
+    /** ISO effective date of the governing clause. */
+    effective: string;
+    status: MandateStatus;
+    /** Whole months from `now` to the governing deadline; negative once it has passed. */
+    monthsUntil: number;
+    /**
+     * ISO effective date of this mandate's DISALLOW clause for the family, or null
+     * when the mandate carries none. The gate's `leadMonths` measures against this.
+     */
+    disallowEffective: string | null;
+    /** Whole months from `now` to `disallowEffective`; null when there is none. */
+    monthsUntilDisallow: number | null;
+    citation: string;
+}
+export interface MandateEvaluation {
+    /** The `now` the evaluation was computed against (ISO). */
+    now: string;
+    /** Mandate ids evaluated. */
+    mandates: string[];
+    /**
+     * Counts of IN-SCOPE findings (classical asymmetric families) by their worst
+     * status across the selected mandates. Out-of-scope findings are excluded so
+     * the conformant count is an honest statement about asymmetric crypto only.
+     */
+    summary: Record<MandateStatus, number>;
+    /**
+     * Findings outside the mandate's scope (hashes, RNG, dependency, TLS-config…),
+     * which a PQC-asymmetric mandate does not adjudicate.
+     */
+    notInScope: number;
+    /** One row per (prohibited finding × applicable mandate). */
+    findings: MandateFindingVerdict[];
+    /** Earliest still-future deadline across non-violation rows, or null. */
+    nextDeadline: string | null;
+    /** True when at least one DISALLOW deadline has passed (a `violation` exists). */
+    hasViolation: boolean;
+}
+/**
+ * Evaluate findings against the selected mandates as of `now`. Unknown mandate
+ * ids are ignored — callers validate up front with {@link assertKnownMandates}.
+ * A finding outside the classical-asymmetric scope is counted in `notInScope`;
+ * an in-scope finding no selected mandate prohibits is `conformant`. Neither
+ * contributes a verdict row.
+ */
+export declare function evaluateMandates(findings: readonly Finding[], mandateIdList: readonly string[], now: Date): MandateEvaluation;
+export interface MandateGateOptions {
+    /** Fail when a DISALLOW deadline is within this many months (early enforcement). */
+    leadMonths?: number;
+    /** Fail on any mandate-prohibited finding regardless of the deadlines. */
+    failNow?: boolean;
+}
+/**
+ * The gate decision under the "deadline-aware" default: fail only once a DISALLOW
+ * deadline has passed (`violation`). A passed DEPRECATE date (`deprecated`) is a
+ * warning and does not fail the build. `leadMonths` fails early when a disallow
+ * deadline is within the window; `failNow` fails on any prohibited finding
+ * immediately.
+ */
+export declare function mandateGateFails(ev: MandateEvaluation, opts?: MandateGateOptions): boolean;
+//# sourceMappingURL=mandates.d.ts.map

package/dist/mandates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mandates.d.ts","sourceRoot":"","sources":["../src/mandates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAgD3D,wFAAwF;AACxF,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,UAAU,CAAC;AAEvD,MAAM,WAAW,WAAW;IAC1B,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;IACf,yFAAyF;IACzF,IAAI,EAAE,eAAe,CAAC;IACtB,oEAAoE;IACpE,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,WAAW,EAAE,CAAC;CACtB;AAED,8DAA8D;AAC9D,eAAO,MAAM,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CA+C5C,CAAC;AAEF,eAAO,MAAM,UAAU,QAAO,MAAM,EAA2B,CAAC;AAChE,eAAO,MAAM,UAAU,GAAI,IAAI,MAAM,KAAG,OAAO,GAAG,SAAyB,CAAC;AAE5E;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAOhE;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG,YAAY,GAAG,KAAK,GAAG,YAAY,GAAG,WAAW,CAAC;AAE9E,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,eAAe,GAAG,SAAS,CAAC;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,aAAa,CAAC;IACtB,sFAAsF;IACtF,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,+EAA+E;IAC/E,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,2DAA2D;IAC3D,GAAG,EAAE,MAAM,CAAC;IACZ,6BAA6B;IAC7B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IACvC;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,6DAA6D;IAC7D,QAAQ,EAAE,qBAAqB,EAAE,CAAC;IAClC,yEAAyE;IACzE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,kFAAkF;IAClF,YAAY,EAAE,OAAO,CAAC;CACvB;AAeD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,SAAS,OAAO,EAAE,EAC5B,aAAa,EAAE,SAAS,MAAM,EAAE,EAChC,GAAG,EAAE,IAAI,GACR,iBAAiB,CA0FnB;AAED,MAAM,WAAW,kBAAkB;IACjC,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,iBAAiB,EAAE,IAAI,GAAE,kBAAuB,GAAG,OAAO,CAS9F"}