@quantakrypto/qscan 0.1.0

package/dist/baseline.js

@@ -0,0 +1,105 @@
+/**
+ * Baseline support for qScan — a thin adapter over the **canonical** baseline
+ * implementation in `@quantakrypto/core` (P1-1).
+ *
+ * Historically qScan carried its own baseline scheme (12-char hash of
+ * `ruleId|file|snippet|line`) that was incompatible with the GitHub Action's.
+ * Both have been unified onto core's single source of truth, so this module no
+ * longer defines its own format or hashing — it re-exports core's primitives
+ * and adds only the small filename-resolution / API-shape conveniences the CLI
+ * and `@quantakrypto/action` rely on.
+ *
+ * The on-disk format is core's {@link Baseline}: `{ version, fingerprints }`,
+ * where each fingerprint is a full, line-INSENSITIVE SHA-256 (so unrelated edits
+ * that shift line numbers no longer invalidate a baseline).
+ */
+import { applyBaseline as coreApplyBaseline, baselineFromFindings, BASELINE_VERSION, fingerprintFinding, loadBaseline, saveBaseline, } from "@quantakrypto/core";
+// Re-export core's canonical primitives so downstream tools (and tests) can use
+// them through `@quantakrypto/qscan` without reaching into `@quantakrypto/core` internals.
+export { baselineFromFindings, BASELINE_VERSION, fingerprintFinding, loadBaseline, saveBaseline };
+/**
+ * Compute a stable fingerprint for a finding. Alias for core's
+ * {@link fingerprintFinding}; kept under the historical name `fingerprint` for
+ * source compatibility with existing call sites and tests.
+ */
+export const fingerprint = fingerprintFinding;
+/**
+ * Partition findings into those kept and those suppressed by a baseline.
+ *
+ * Wraps core's {@link coreApplyBaseline} (which takes a {@link Baseline} and
+ * returns `{ newFindings, suppressed }`) but preserves qScan's historical
+ * `{ kept, suppressed }` shape and its lenient `ReadonlySet<string>` overload so
+ * existing callers keep working.
+ *
+ * @param findings All findings produced by a scan.
+ * @param baseline Either a {@link Baseline} object or a set of accepted
+ *   fingerprints.
+ */
+export function applyBaseline(findings, baseline) {
+    const resolved = baseline instanceof Set
+        ? { version: BASELINE_VERSION, fingerprints: [...baseline] }
+        : baseline;
+    const { newFindings, suppressed } = coreApplyBaseline(findings, resolved);
+    return { kept: newFindings, suppressed };
+}
+/**
+ * Build a {@link Baseline} from a set of findings (deduped + sorted). Alias for
+ * core's {@link baselineFromFindings} under qScan's historical name.
+ */
+export function buildBaseline(findings) {
+    return baselineFromFindings(findings);
+}
+/**
+ * Read a baseline file from disk and return its accepted fingerprints as a set.
+ *
+ * Unlike core's tolerant {@link loadBaseline} (which returns an empty baseline
+ * for a missing/unparseable file), this preserves qScan's historical *strict*
+ * contract: a missing or malformed file is an error, surfaced to the CLI as an
+ * I/O failure (exit 2).
+ *
+ * @throws {Error} If the file cannot be read or is not valid baseline JSON.
+ */
+export async function readBaseline(path) {
+    const { readFile } = await import("node:fs/promises");
+    let raw;
+    try {
+        raw = await readFile(path, "utf8");
+    }
+    catch (cause) {
+        throw new Error(`could not read baseline file "${path}": ${errMessage(cause)}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (cause) {
+        throw new Error(`baseline file "${path}" is not valid JSON: ${errMessage(cause)}`);
+    }
+    if (!isBaselineFile(parsed)) {
+        throw new Error(`baseline file "${path}" is missing a string "fingerprints" array`);
+    }
+    return new Set(parsed.fingerprints);
+}
+/** Serialize and write a baseline to disk (pretty-printed, trailing newline). */
+export async function writeBaseline(path, baseline) {
+    const { writeFile } = await import("node:fs/promises");
+    const json = `${JSON.stringify(baseline, null, 2)}\n`;
+    try {
+        await writeFile(path, json, "utf8");
+    }
+    catch (cause) {
+        throw new Error(`could not write baseline file "${path}": ${errMessage(cause)}`);
+    }
+}
+/** Narrowing type guard for parsed baseline JSON. */
+function isBaselineFile(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    const obj = value;
+    return Array.isArray(obj.fingerprints) && obj.fingerprints.every((f) => typeof f === "string");
+}
+/** Extract a human message from an unknown thrown value. */
+function errMessage(cause) {
+    return cause instanceof Error ? cause.message : String(cause);
+}
+//# sourceMappingURL=baseline.js.map

package/dist/baseline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"baseline.js","sourceRoot":"","sources":["../src/baseline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EACL,aAAa,IAAI,iBAAiB,EAClC,oBAAoB,EACpB,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,YAAY,GACb,MAAM,oBAAoB,CAAC;AAG5B,gFAAgF;AAChF,2FAA2F;AAC3F,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;AAGlG;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAC;AAE9C;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAC3B,QAA4B,EAC5B,QAAwC;IAExC,MAAM,QAAQ,GACZ,QAAQ,YAAY,GAAG;QACrB,CAAC,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE;QAC5D,CAAC,CAAE,QAAqB,CAAC;IAC7B,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC1E,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,QAA4B;IACxD,OAAO,oBAAoB,CAAC,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACtD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,MAAM,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,wBAAwB,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,4CAA4C,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;AACtC,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,QAAkB;IAClE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,MAAM,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED,qDAAqD;AACrD,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AACjG,CAAC;AAED,4DAA4D;AAC5D,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+/**
+ * qScan command-line entry point.
+ *
+ * Thin shell over the programmatic API in `./index.ts`:
+ *   parse argv → runQscan → print/write report → process.exit(code).
+ *
+ * All policy (scanning, baseline, thresholds, rendering) lives in `index.ts`;
+ * this file only deals with argv, stdout/stderr, files, and exit codes.
+ */
+/** Run the CLI and return the desired process exit code (never throws). */
+export declare function main(argv: readonly string[]): Promise<number>;
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;GAQG;AAeH,2EAA2E;AAC3E,wBAAsB,IAAI,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA+FnE"}

package/dist/cli.js

@@ -0,0 +1,121 @@
+#!/usr/bin/env node
+/**
+ * qScan command-line entry point.
+ *
+ * Thin shell over the programmatic API in `./index.ts`:
+ *   parse argv → runQscan → print/write report → process.exit(code).
+ *
+ * All policy (scanning, baseline, thresholds, rendering) lives in `index.ts`;
+ * this file only deals with argv, stdout/stderr, files, and exit codes.
+ */
+import { writeFile } from "node:fs/promises";
+import process from "node:process";
+import { pathToFileURL } from "node:url";
+import { ConfigError } from "@quantakrypto/core";
+import { ArgError, parseArgs } from "./args.js";
+import { resolveConfig } from "./config.js";
+import { HELP_TEXT, versionLine } from "./help.js";
+import { EXIT, runQscan } from "./index.js";
+/** Run the CLI and return the desired process exit code (never throws). */
+export async function main(argv) {
+    let parsed;
+    try {
+        parsed = parseArgs(argv);
+    }
+    catch (err) {
+        if (err instanceof ArgError) {
+            process.stderr.write(`qscan: ${err.message}\n`);
+            process.stderr.write(`Run "qscan --help" for usage.\n`);
+            return EXIT.ERROR;
+        }
+        throw err;
+    }
+    if (parsed.kind === "help") {
+        process.stdout.write(HELP_TEXT);
+        return EXIT.OK;
+    }
+    if (parsed.kind === "version") {
+        process.stdout.write(`${versionLine()}\n`);
+        return EXIT.OK;
+    }
+    // Resolve `quantakrypto.config.json` (flags > config > defaults) before scanning.
+    let options;
+    try {
+        const resolved = await resolveConfig(parsed.options, parsed.explicit);
+        options = resolved.options;
+        if (!options.quiet) {
+            for (const w of resolved.warnings) {
+                process.stderr.write(`qscan: config warning: ${w}\n`);
+            }
+            if (resolved.configPath) {
+                process.stderr.write(`qscan: using config ${resolved.configPath}\n`);
+            }
+        }
+    }
+    catch (err) {
+        if (err instanceof ConfigError) {
+            process.stderr.write(`qscan: ${err.message}\n`);
+            return EXIT.ERROR;
+        }
+        const message = err instanceof Error ? err.message : String(err);
+        process.stderr.write(`qscan: ${message}\n`);
+        return EXIT.ERROR;
+    }
+    // Color only when writing the human report to an interactive stdout.
+    const color = options.format === "human" &&
+        !options.output &&
+        Boolean(process.stdout.isTTY) &&
+        process.env.NO_COLOR === undefined;
+    let run;
+    try {
+        run = await runQscan(options, { color });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        process.stderr.write(`qscan: ${message}\n`);
+        return EXIT.ERROR;
+    }
+    // --write-baseline: report what was written and stop.
+    if (run.baselineWritten) {
+        if (!options.quiet) {
+            const n = run.baselineWritten.fingerprints.length;
+            process.stderr.write(`qscan: wrote baseline with ${n} fingerprint${n === 1 ? "" : "s"} to ${options.writeBaseline}\n`);
+        }
+        return run.exitCode;
+    }
+    const report = run.report ?? "";
+    try {
+        if (options.output) {
+            await writeFile(options.output, report.endsWith("\n") ? report : `${report}\n`, "utf8");
+            if (!options.quiet) {
+                process.stderr.write(`qscan: wrote ${options.format} report to ${options.output}\n`);
+            }
+        }
+        else if (!options.quiet || options.format !== "human") {
+            // In quiet mode we still emit machine formats to stdout (the point of a
+            // pipe), but suppress the human banner.
+            process.stdout.write(report.endsWith("\n") ? report : `${report}\n`);
+        }
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        process.stderr.write(`qscan: ${message}\n`);
+        return EXIT.ERROR;
+    }
+    if (!options.quiet && run.suppressed.length > 0) {
+        process.stderr.write(`qscan: suppressed ${run.suppressed.length} finding(s) via baseline\n`);
+    }
+    return run.exitCode;
+}
+// Only auto-run when invoked as a script (not when imported by a test).
+const invokedDirectly = process.argv[1] !== undefined && import.meta.url === pathToFileURL(process.argv[1]).href;
+if (invokedDirectly) {
+    main(process.argv.slice(2))
+        .then((code) => process.exit(code))
+        .catch((err) => {
+        const message = err instanceof Error ? (err.stack ?? err.message) : String(err);
+        process.stderr.write(`qscan: fatal: ${message}\n`);
+        process.exit(EXIT.ERROR);
+    });
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;GAQG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,OAAO,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEhD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAG5C,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAuB;IAChD,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;YAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;YAChD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,WAAW,EAAE,IAAI,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC;IAED,kFAAkF;IAClF,IAAI,OAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtE,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;QAC3B,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC;YACxD,CAAC;YACD,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;gBACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,WAAW,EAAE,CAAC;YAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;YAChD,OAAO,IAAI,CAAC,KAAK,CAAC;QACpB,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,OAAO,IAAI,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,qEAAqE;IACrE,MAAM,KAAK,GACT,OAAO,CAAC,MAAM,KAAK,OAAO;QAC1B,CAAC,OAAO,CAAC,MAAM;QACf,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC;IAErC,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,OAAO,IAAI,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,sDAAsD;IACtD,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC;QACxB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,CAAC,GAAG,GAAG,CAAC,eAAe,CAAC,YAAY,CAAC,MAAM,CAAC;YAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,8BAA8B,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,OAAO,CAAC,aAAa,IAAI,CACjG,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,CAAC,QAAQ,CAAC;IACtB,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,EAAE,MAAM,CAAC,CAAC;YACxF,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,OAAO,CAAC,MAAM,cAAc,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACxD,wEAAwE;YACxE,wCAAwC;YACxC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,OAAO,IAAI,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,GAAG,CAAC,UAAU,CAAC,MAAM,4BAA4B,CAAC,CAAC;IAC/F,CAAC;IAED,OAAO,GAAG,CAAC,QAAQ,CAAC;AACtB,CAAC;AAED,wEAAwE;AACxE,MAAM,eAAe,GACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAE3F,IAAI,eAAe,EAAE,CAAC;IACpB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SACxB,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SAClC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,OAAO,IAAI,CAAC,CAAC;QACnD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,42 @@
+/**
+ * qScan-side resolution of `quantakrypto.config.json` (ROADMAP P2-9, docs/CONFIG.md).
+ *
+ * core's {@link loadConfig} does the reading + type-validation; this module
+ * applies the file's values onto parsed CLI options with the documented
+ * precedence:
+ *
+ *     CLI flags  >  quantakrypto.config.json  >  built-in defaults
+ *
+ * Resolution is **per-key**: a key set by a flag (tracked in the `explicit` set
+ * from `parseArgs`) is left alone; otherwise the config value fills it. The
+ * list-valued keys (`include` / `ignore`→`exclude`) *append* — the config
+ * provides a base set and any CLI flags add to it (docs/CONFIG.md §4.2).
+ */
+import type { QuantakryptoFileConfig } from "@quantakrypto/core";
+import type { ConfigurableKey, QscanOptions } from "./args.js";
+/** What {@link resolveConfig} returns: the merged options + provenance. */
+export interface ResolvedConfig {
+    /** Options with config applied under the flags > config > defaults rule. */
+    options: QscanOptions;
+    /** Absolute path of the config file that was applied, when one was. */
+    configPath?: string;
+    /** Non-fatal warnings from parsing (unknown keys, future version, …). */
+    warnings: string[];
+}
+/**
+ * Load and merge `quantakrypto.config.json` into the parsed CLI options.
+ *
+ * @param options Fully-resolved options from {@link parseArgs} (defaults filled).
+ * @param explicit The set of configurable keys the user set via a flag.
+ * @returns The merged options plus the applied config path + any warnings.
+ * @throws {ConfigError} (from core) on a malformed config or a missing
+ *   explicitly-named `--config` file. The CLI maps this to exit 2.
+ */
+export declare function resolveConfig(options: QscanOptions, explicit: ReadonlySet<ConfigurableKey>): Promise<ResolvedConfig>;
+/**
+ * Apply a parsed config onto options under the precedence rule. Pure; returns a
+ * new options object. Scalars: config fills only keys NOT set by a flag. Lists:
+ * config provides the base and the CLI flag values are appended.
+ */
+export declare function applyConfig(options: QscanOptions, config: QuantakryptoFileConfig, explicit: ReadonlySet<ConfigurableKey>): QscanOptions;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAEjE,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAE/D,2EAA2E;AAC3E,MAAM,WAAW,cAAc;IAC7B,4EAA4E;IAC5E,OAAO,EAAE,YAAY,CAAC;IACtB,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,YAAY,EACrB,QAAQ,EAAE,WAAW,CAAC,eAAe,CAAC,GACrC,OAAO,CAAC,cAAc,CAAC,CAkBzB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,sBAAsB,EAC9B,QAAQ,EAAE,WAAW,CAAC,eAAe,CAAC,GACrC,YAAY,CAoCd"}

package/dist/config.js

@@ -0,0 +1,78 @@
+/**
+ * qScan-side resolution of `quantakrypto.config.json` (ROADMAP P2-9, docs/CONFIG.md).
+ *
+ * core's {@link loadConfig} does the reading + type-validation; this module
+ * applies the file's values onto parsed CLI options with the documented
+ * precedence:
+ *
+ *     CLI flags  >  quantakrypto.config.json  >  built-in defaults
+ *
+ * Resolution is **per-key**: a key set by a flag (tracked in the `explicit` set
+ * from `parseArgs`) is left alone; otherwise the config value fills it. The
+ * list-valued keys (`include` / `ignore`→`exclude`) *append* — the config
+ * provides a base set and any CLI flags add to it (docs/CONFIG.md §4.2).
+ */
+import { loadConfig } from "@quantakrypto/core";
+/**
+ * Load and merge `quantakrypto.config.json` into the parsed CLI options.
+ *
+ * @param options Fully-resolved options from {@link parseArgs} (defaults filled).
+ * @param explicit The set of configurable keys the user set via a flag.
+ * @returns The merged options plus the applied config path + any warnings.
+ * @throws {ConfigError} (from core) on a malformed config or a missing
+ *   explicitly-named `--config` file. The CLI maps this to exit 2.
+ */
+export async function resolveConfig(options, explicit) {
+    // `--no-config-file` disables discovery entirely; nothing to merge.
+    if (options.noConfigFile && options.configFile === undefined) {
+        return { options, warnings: [] };
+    }
+    // `--config <path>` names the file explicitly (a missing file is then fatal);
+    // otherwise auto-discover at the scan root.
+    const target = options.configFile ?? options.path;
+    const loaded = await loadConfig(target, { explicit: options.configFile !== undefined });
+    if (loaded.path === undefined) {
+        // No file found (auto-discovery, tolerant): options unchanged.
+        return { options, warnings: loaded.warnings };
+    }
+    const merged = applyConfig(options, loaded.config, explicit);
+    return { options: merged, configPath: loaded.path, warnings: loaded.warnings };
+}
+/**
+ * Apply a parsed config onto options under the precedence rule. Pure; returns a
+ * new options object. Scalars: config fills only keys NOT set by a flag. Lists:
+ * config provides the base and the CLI flag values are appended.
+ */
+export function applyConfig(options, config, explicit) {
+    const out = {
+        ...options,
+        ignore: [...options.ignore],
+        include: [...options.include],
+    };
+    /** Set a scalar key from config only when the user didn't set it via a flag. */
+    const fillScalar = (key, value) => {
+        if (value === undefined)
+            return;
+        if (explicit.has(key))
+            return; // flag wins.
+        out[key] = value;
+    };
+    fillScalar("severityThreshold", config.severityThreshold);
+    fillScalar("source", config.source);
+    fillScalar("dependencies", config.dependencies);
+    fillScalar("config", config.config);
+    fillScalar("noDefaultIgnores", config.noDefaultIgnores);
+    fillScalar("scanMinified", config.scanMinified);
+    fillScalar("maxFileSize", config.maxFileSize);
+    fillScalar("baseline", config.baseline);
+    // List-valued keys: config is the base, CLI flags append (config first so the
+    // committed policy reads as the baseline, ad-hoc CLI excludes/includes after).
+    if (config.exclude && config.exclude.length > 0) {
+        out.ignore = [...config.exclude, ...options.ignore];
+    }
+    if (config.include && config.include.length > 0) {
+        out.include = [...config.include, ...options.include];
+    }
+    return out;
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAehD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAqB,EACrB,QAAsC;IAEtC,oEAAoE;IACpE,IAAI,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7D,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACnC,CAAC;IAED,8EAA8E;IAC9E,4CAA4C;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC,CAAC;IAExF,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,+DAA+D;QAC/D,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IAChD,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;AACjF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,OAAqB,EACrB,MAA8B,EAC9B,QAAsC;IAEtC,MAAM,GAAG,GAAiB;QACxB,GAAG,OAAO;QACV,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;QAC3B,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;KAC9B,CAAC;IAEF,gFAAgF;IAChF,MAAM,UAAU,GAAG,CACjB,GAAM,EACN,KAAkC,EAC5B,EAAE;QACR,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO;QAChC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,aAAa;QAC5C,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC,CAAC;IAEF,UAAU,CAAC,mBAAmB,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC1D,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACpC,UAAU,CAAC,cAAc,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAChD,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACpC,UAAU,CAAC,kBAAkB,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACxD,UAAU,CAAC,cAAc,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAChD,UAAU,CAAC,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IAC9C,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAExC,8EAA8E;IAC9E,+EAA+E;IAC/E,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/help.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Static help / usage text for the qScan CLI.
+ *
+ * Kept in its own module so it can be unit-tested and reused without pulling in
+ * filesystem or process side effects.
+ */
+/** The full `--help` screen. */
+export declare const HELP_TEXT = "qscan \u2014 find quantum-vulnerable cryptography in any codebase\n\nUSAGE\n  qscan [path] [options]\n\nARGUMENTS\n  path                          Directory or file to scan (default: \".\")\n\nOPTIONS\n  --format <human|json|sarif|cbom>\n                                Output format (default: human)\n  --cbom                        Alias for --format cbom (CycloneDX CBOM)\n  -o, --output <file>           Write the report to a file instead of stdout\n  --severity-threshold <level>  Fail (exit 1) on findings at/above this level;\n                                one of critical|high|medium|low|info\n                                (default: high)\n  --no-source                   Skip scanning source files for inline crypto\n  --no-deps                     Skip scanning dependency manifests\n  --no-config                   Skip scanning config files (TLS/certificates)\n  --config <path>               Use this quantakrypto.config.json instead of\n                                auto-discovering one at the scan root\n  --no-config-file              Disable quantakrypto.config.json auto-discovery\n  --ignore <pattern>            Exclude paths matching <pattern> (repeatable)\n  --include <pattern>           Restrict the scan to matching paths (repeatable)\n  --max-file-size <bytes>       Skip files larger than <bytes> (default: 2 MiB)\n  --no-default-ignores          Don't skip node_modules/.git/dist by default\n  --scan-minified               Scan minified/generated/bundled files too\n  --changed                     Scan only files changed in the git work tree\n  --since <git-ref>             With --changed, diff against <git-ref>\n  --parallel                    Scan using a worker-thread pool when worthwhile\n  --concurrency <n>             Worker count for --parallel (implies --parallel)\n  --baseline <file>             Suppress findings listed in a baseline file\n  --write-baseline <file>       Write current findings as a baseline, then exit 0\n  --quiet                       Suppress the human summary banner\n  -v, --version                 Print version and exit\n  -h, --help                    Print this help and exit\n\nEXIT CODES\n  0   No findings at/above the threshold (or a baseline was written)\n  1   One or more findings at/above the severity threshold\n  2   Usage error or I/O failure\n\nEXAMPLES\n  qscan .                       Scan the current directory\n  qscan src --format sarif -o qscan.sarif\n  qscan . --severity-threshold critical\n  qscan . --write-baseline qscan-baseline.json\n  qscan . --baseline qscan-baseline.json\n  qscan . --include src --include lib\n  qscan . --config ./ci/quantakrypto.config.json\n  qscan . --changed --since origin/main\n  qscan . --parallel --concurrency 4\n  qscan . --cbom -o qscan-cbom.json\n";
+/** The `--version` line. */
+export declare function versionLine(): string;
+//# sourceMappingURL=help.d.ts.map

package/dist/help.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"help.d.ts","sourceRoot":"","sources":["../src/help.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,gCAAgC;AAChC,eAAO,MAAM,SAAS,uuFAqDrB,CAAC;AAEF,4BAA4B;AAC5B,wBAAgB,WAAW,IAAI,MAAM,CAEpC"}

package/dist/help.js

@@ -0,0 +1,67 @@
+/**
+ * Static help / usage text for the qScan CLI.
+ *
+ * Kept in its own module so it can be unit-tested and reused without pulling in
+ * filesystem or process side effects.
+ */
+import { VERSION } from "@quantakrypto/core";
+/** The full `--help` screen. */
+export const HELP_TEXT = `qscan — find quantum-vulnerable cryptography in any codebase
+
+USAGE
+  qscan [path] [options]
+
+ARGUMENTS
+  path                          Directory or file to scan (default: ".")
+
+OPTIONS
+  --format <human|json|sarif|cbom>
+                                Output format (default: human)
+  --cbom                        Alias for --format cbom (CycloneDX CBOM)
+  -o, --output <file>           Write the report to a file instead of stdout
+  --severity-threshold <level>  Fail (exit 1) on findings at/above this level;
+                                one of critical|high|medium|low|info
+                                (default: high)
+  --no-source                   Skip scanning source files for inline crypto
+  --no-deps                     Skip scanning dependency manifests
+  --no-config                   Skip scanning config files (TLS/certificates)
+  --config <path>               Use this quantakrypto.config.json instead of
+                                auto-discovering one at the scan root
+  --no-config-file              Disable quantakrypto.config.json auto-discovery
+  --ignore <pattern>            Exclude paths matching <pattern> (repeatable)
+  --include <pattern>           Restrict the scan to matching paths (repeatable)
+  --max-file-size <bytes>       Skip files larger than <bytes> (default: 2 MiB)
+  --no-default-ignores          Don't skip node_modules/.git/dist by default
+  --scan-minified               Scan minified/generated/bundled files too
+  --changed                     Scan only files changed in the git work tree
+  --since <git-ref>             With --changed, diff against <git-ref>
+  --parallel                    Scan using a worker-thread pool when worthwhile
+  --concurrency <n>             Worker count for --parallel (implies --parallel)
+  --baseline <file>             Suppress findings listed in a baseline file
+  --write-baseline <file>       Write current findings as a baseline, then exit 0
+  --quiet                       Suppress the human summary banner
+  -v, --version                 Print version and exit
+  -h, --help                    Print this help and exit
+
+EXIT CODES
+  0   No findings at/above the threshold (or a baseline was written)
+  1   One or more findings at/above the severity threshold
+  2   Usage error or I/O failure
+
+EXAMPLES
+  qscan .                       Scan the current directory
+  qscan src --format sarif -o qscan.sarif
+  qscan . --severity-threshold critical
+  qscan . --write-baseline qscan-baseline.json
+  qscan . --baseline qscan-baseline.json
+  qscan . --include src --include lib
+  qscan . --config ./ci/quantakrypto.config.json
+  qscan . --changed --since origin/main
+  qscan . --parallel --concurrency 4
+  qscan . --cbom -o qscan-cbom.json
+`;
+/** The `--version` line. */
+export function versionLine() {
+    return `qscan ${VERSION}`;
+}
+//# sourceMappingURL=help.js.map

package/dist/help.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"help.js","sourceRoot":"","sources":["../src/help.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C,gCAAgC;AAChC,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqDxB,CAAC;AAEF,4BAA4B;AAC5B,MAAM,UAAU,WAAW;IACzB,OAAO,SAAS,OAAO,EAAE,CAAC;AAC5B,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,99 @@
+/**
+ * @quantakrypto/qscan — programmatic API.
+ *
+ * `runQscan` is the single entry point shared by the CLI (`src/cli.ts`) and by
+ * `@quantakrypto/action`. It runs a scan via `@quantakrypto/core`, applies an optional
+ * baseline, decides an exit code from the severity threshold, and (optionally)
+ * renders a report. The CLI is a thin shell around it.
+ *
+ * The module also re-exports the argument-parsing and baseline helpers so
+ * downstream tools can reuse them without reaching into internal paths.
+ */
+import type { Baseline, Finding, ParallelScanOptions, ScanResult } from "@quantakrypto/core";
+import type { QscanOptions } from "./args.js";
+export type { QscanOptions, ParsedArgs, ParsedRun, QscanFormat } from "./args.js";
+export type { Baseline } from "./baseline.js";
+export { ArgError, asFormat, asInt, asSeverity, defaultOptions, meetsThreshold, parseArgs, severityRank, SEVERITY_ORDER, } from "./args.js";
+export { applyBaseline, baselineFromFindings, BASELINE_VERSION, buildBaseline, fingerprint, fingerprintFinding, loadBaseline, readBaseline, saveBaseline, writeBaseline, } from "./baseline.js";
+export { renderCbom, renderHuman, renderJson, renderSarif } from "./report.js";
+export { HELP_TEXT, versionLine } from "./help.js";
+export { applyConfig, resolveConfig } from "./config.js";
+export type { ResolvedConfig } from "./config.js";
+export type { ConfigurableKey } from "./args.js";
+/** Process-style exit codes qScan uses. */
+export declare const EXIT: {
+    /** No findings at/above threshold, or a baseline was written. */
+    readonly OK: 0;
+    /** One or more findings at/above the severity threshold. */
+    readonly FINDINGS: 1;
+    /** Usage error or I/O failure. */
+    readonly ERROR: 2;
+};
+/** Outcome of {@link runQscan}. */
+export interface QscanRun {
+    /** The scan result, with the baseline already applied to `findings`. */
+    result: ScanResult;
+    /** Findings suppressed because their fingerprint was in the baseline. */
+    suppressed: Finding[];
+    /** Rendered report in the requested format (`undefined` for a baseline write). */
+    report?: string;
+    /** The baseline that was written, when `writeBaseline` was requested. */
+    baselineWritten?: Baseline;
+    /** Suggested process exit code. */
+    exitCode: number;
+}
+/**
+ * The scan implementation `runQscan` calls. Matches `@quantakrypto/core`'s `scan` /
+ * `scanParallel` (parallel options are a superset of `ScanOptions`).
+ * Injectable so the GitHub Action and tests can supply a custom scanner.
+ */
+export type ScanFn = (options: ParallelScanOptions) => Promise<ScanResult>;
+/**
+ * Resolve the changed-file list for incremental scans. Injectable for testing;
+ * defaults to core's git-aware {@link changedFiles}.
+ */
+export type ChangedFilesFn = (root: string, since?: string) => Promise<string[]>;
+/** Behavioral hooks for {@link runQscan}, mainly for testing. */
+export interface RunQscanHooks {
+    /** Emit raw ANSI color in the human report. Default: false. */
+    color?: boolean;
+    /** Override the scanner. Default: `scan` / `scanParallel` from `@quantakrypto/core`. */
+    scanFn?: ScanFn;
+    /** Override changed-file resolution. Default: `changedFiles` from `@quantakrypto/core`. */
+    changedFilesFn?: ChangedFilesFn;
+}
+/**
+ * Run a complete qScan pass: scan → baseline → threshold → render.
+ *
+ * This never touches `process` or stdout; the CLI is responsible for printing
+ * `report`/writing `output` and calling `process.exit(exitCode)`. That keeps
+ * the function pure enough to unit-test and to embed in the GitHub Action.
+ *
+ * Behavior:
+ *  - The walk is configured by `include` / `ignore` / `maxFileSize` /
+ *    `noDefaultIgnores` / `scanMinified`.
+ *  - With `changed` set, only the files git reports as changed (relative to
+ *    `since`, if given) are scanned via `ScanOptions.files`. A non-git tree
+ *    yields an empty list, so nothing is scanned.
+ *  - With `parallel` (or `concurrency`) set, the scan is routed through core's
+ *    `scanParallel`, which itself falls back to the serial path for small
+ *    inputs.
+ *  - When `opts.writeBaseline` is set, the scan runs, a baseline is built from
+ *    *all* findings, written to disk, and `exitCode` is {@link EXIT.OK}. No
+ *    report is rendered.
+ *  - When `opts.baseline` is set, its fingerprints are loaded and matching
+ *    findings are moved to `suppressed` (and removed from `result.findings`).
+ *  - `exitCode` is {@link EXIT.FINDINGS} when any *kept* finding meets the
+ *    severity threshold, else {@link EXIT.OK}.
+ *
+ * @throws {Error} Propagates scan / baseline I/O errors; the CLI maps these to
+ *   {@link EXIT.ERROR}.
+ */
+export declare function runQscan(opts: Partial<QscanOptions> & {
+    path: string;
+}, hooks?: RunQscanHooks): Promise<QscanRun>;
+/** Render a scan result in the requested format. */
+export declare function renderReport(result: ScanResult, format: QscanOptions["format"], color?: boolean): string;
+/** Re-export the core result types consumers commonly need. */
+export type { Finding, ScanResult, ScanOptions } from "@quantakrypto/core";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAI7F,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAG9C,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAClF,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,KAAK,EACL,UAAU,EACV,cAAc,EACd,cAAc,EACd,SAAS,EACT,YAAY,EACZ,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACzD,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,YAAY,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEjD,2CAA2C;AAC3C,eAAO,MAAM,IAAI;IACf,iEAAiE;;IAEjE,4DAA4D;;IAE5D,kCAAkC;;CAE1B,CAAC;AAEX,mCAAmC;AACnC,MAAM,WAAW,QAAQ;IACvB,wEAAwE;IACxE,MAAM,EAAE,UAAU,CAAC;IACnB,yEAAyE;IACzE,UAAU,EAAE,OAAO,EAAE,CAAC;IACtB,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,eAAe,CAAC,EAAE,QAAQ,CAAC;IAC3B,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,MAAM,MAAM,GAAG,CAAC,OAAO,EAAE,mBAAmB,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;AAE3E;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AAEjF,iEAAiE;AACjE,MAAM,WAAW,aAAa;IAC5B,+DAA+D;IAC/D,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAsBD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EAC9C,KAAK,GAAE,aAAkB,GACxB,OAAO,CAAC,QAAQ,CAAC,CA+CnB;AAED,oDAAoD;AACpD,wBAAgB,YAAY,CAC1B,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,EAC9B,KAAK,UAAQ,GACZ,MAAM,CAYR;AAED,+DAA+D;AAC/D,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC"}