@quantakrypto/qscan 0.1.0

package/dist/index.js

@@ -0,0 +1,133 @@
+/**
+ * @quantakrypto/qscan — programmatic API.
+ *
+ * `runQscan` is the single entry point shared by the CLI (`src/cli.ts`) and by
+ * `@quantakrypto/action`. It runs a scan via `@quantakrypto/core`, applies an optional
+ * baseline, decides an exit code from the severity threshold, and (optionally)
+ * renders a report. The CLI is a thin shell around it.
+ *
+ * The module also re-exports the argument-parsing and baseline helpers so
+ * downstream tools can reuse them without reaching into internal paths.
+ */
+import { changedFiles, scan, scanParallel } from "@quantakrypto/core";
+import { applyBaseline, loadBaseline, saveBaseline } from "./baseline.js";
+import { defaultOptions, meetsThreshold } from "./args.js";
+import { renderCbom, renderHuman, renderJson, renderSarif } from "./report.js";
+export { ArgError, asFormat, asInt, asSeverity, defaultOptions, meetsThreshold, parseArgs, severityRank, SEVERITY_ORDER, } from "./args.js";
+export { applyBaseline, baselineFromFindings, BASELINE_VERSION, buildBaseline, fingerprint, fingerprintFinding, loadBaseline, readBaseline, saveBaseline, writeBaseline, } from "./baseline.js";
+export { renderCbom, renderHuman, renderJson, renderSarif } from "./report.js";
+export { HELP_TEXT, versionLine } from "./help.js";
+export { applyConfig, resolveConfig } from "./config.js";
+/** Process-style exit codes qScan uses. */
+export const EXIT = {
+    /** No findings at/above threshold, or a baseline was written. */
+    OK: 0,
+    /** One or more findings at/above the severity threshold. */
+    FINDINGS: 1,
+    /** Usage error or I/O failure. */
+    ERROR: 2,
+};
+/**
+ * Translate resolved {@link QscanOptions} into core {@link ParallelScanOptions}.
+ * `files` (the incremental file list) is layered on by {@link runQscan}.
+ */
+function toScanOptions(options) {
+    const scanOptions = {
+        root: options.path,
+        source: options.source,
+        dependencies: options.dependencies,
+        config: options.config,
+        noDefaultIgnores: options.noDefaultIgnores,
+        scanMinified: options.scanMinified,
+    };
+    if (options.ignore.length > 0)
+        scanOptions.exclude = options.ignore;
+    if (options.include.length > 0)
+        scanOptions.include = options.include;
+    if (options.maxFileSize !== undefined)
+        scanOptions.maxFileSize = options.maxFileSize;
+    if (options.concurrency !== undefined)
+        scanOptions.concurrency = options.concurrency;
+    return scanOptions;
+}
+/**
+ * Run a complete qScan pass: scan → baseline → threshold → render.
+ *
+ * This never touches `process` or stdout; the CLI is responsible for printing
+ * `report`/writing `output` and calling `process.exit(exitCode)`. That keeps
+ * the function pure enough to unit-test and to embed in the GitHub Action.
+ *
+ * Behavior:
+ *  - The walk is configured by `include` / `ignore` / `maxFileSize` /
+ *    `noDefaultIgnores` / `scanMinified`.
+ *  - With `changed` set, only the files git reports as changed (relative to
+ *    `since`, if given) are scanned via `ScanOptions.files`. A non-git tree
+ *    yields an empty list, so nothing is scanned.
+ *  - With `parallel` (or `concurrency`) set, the scan is routed through core's
+ *    `scanParallel`, which itself falls back to the serial path for small
+ *    inputs.
+ *  - When `opts.writeBaseline` is set, the scan runs, a baseline is built from
+ *    *all* findings, written to disk, and `exitCode` is {@link EXIT.OK}. No
+ *    report is rendered.
+ *  - When `opts.baseline` is set, its fingerprints are loaded and matching
+ *    findings are moved to `suppressed` (and removed from `result.findings`).
+ *  - `exitCode` is {@link EXIT.FINDINGS} when any *kept* finding meets the
+ *    severity threshold, else {@link EXIT.OK}.
+ *
+ * @throws {Error} Propagates scan / baseline I/O errors; the CLI maps these to
+ *   {@link EXIT.ERROR}.
+ */
+export async function runQscan(opts, hooks = {}) {
+    const options = { ...defaultOptions(), ...opts };
+    // Route to the parallel pool when requested; both share the ScanOptions shape.
+    const scanFn = hooks.scanFn ?? (options.parallel ? scanParallel : scan);
+    const resolveChanged = hooks.changedFilesFn ?? changedFiles;
+    const scanOptions = toScanOptions(options);
+    // Incremental mode: restrict the scan to git-changed files.
+    if (options.changed) {
+        scanOptions.files = await resolveChanged(options.path, options.since);
+    }
+    const result = await scanFn(scanOptions);
+    // --write-baseline: snapshot every finding, persist, and exit cleanly.
+    if (options.writeBaseline) {
+        const baseline = await saveBaseline(options.writeBaseline, result.findings);
+        return {
+            result,
+            suppressed: [],
+            baselineWritten: baseline,
+            exitCode: EXIT.OK,
+        };
+    }
+    // --baseline: suppress previously-accepted findings.
+    let suppressed = [];
+    if (options.baseline) {
+        const baseline = await loadBaseline(options.baseline);
+        const split = applyBaseline(result.findings, baseline);
+        result.findings = split.kept;
+        suppressed = split.suppressed;
+    }
+    const exitCode = result.findings.some((f) => meetsThreshold(f.severity, options.severityThreshold))
+        ? EXIT.FINDINGS
+        : EXIT.OK;
+    return {
+        result,
+        suppressed,
+        report: renderReport(result, options.format, hooks.color ?? false),
+        exitCode,
+    };
+}
+/** Render a scan result in the requested format. */
+export function renderReport(result, format, color = false) {
+    switch (format) {
+        case "json":
+            return renderJson(result);
+        case "sarif":
+            return renderSarif(result);
+        case "cbom":
+            return renderCbom(result);
+        case "human":
+        default:
+            return renderHuman(result, { color });
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGtE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAI/E,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,KAAK,EACL,UAAU,EACV,cAAc,EACd,cAAc,EACd,SAAS,EACT,YAAY,EACZ,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAIzD,2CAA2C;AAC3C,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,iEAAiE;IACjE,EAAE,EAAE,CAAC;IACL,4DAA4D;IAC5D,QAAQ,EAAE,CAAC;IACX,kCAAkC;IAClC,KAAK,EAAE,CAAC;CACA,CAAC;AAuCX;;;GAGG;AACH,SAAS,aAAa,CAAC,OAAqB;IAC1C,MAAM,WAAW,GAAwB;QACvC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,WAAW,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IACpE,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,WAAW,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACtE,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;QAAE,WAAW,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IACrF,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;QAAE,WAAW,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IACrF,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAA8C,EAC9C,QAAuB,EAAE;IAEzB,MAAM,OAAO,GAAiB,EAAE,GAAG,cAAc,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC;IAC/D,+EAA+E;IAC/E,MAAM,MAAM,GAAW,KAAK,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAChF,MAAM,cAAc,GAAmB,KAAK,CAAC,cAAc,IAAI,YAAY,CAAC;IAE5E,MAAM,WAAW,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IAE3C,4DAA4D;IAC5D,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,WAAW,CAAC,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAEzC,uEAAuE;IACvE,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5E,OAAO;YACL,MAAM;YACN,UAAU,EAAE,EAAE;YACd,eAAe,EAAE,QAAQ;YACzB,QAAQ,EAAE,IAAI,CAAC,EAAE;SAClB,CAAC;IACJ,CAAC;IAED,qDAAqD;IACrD,IAAI,UAAU,GAAc,EAAE,CAAC;IAC/B,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACtD,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACvD,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC;QAC7B,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IAChC,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAC1C,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,iBAAiB,CAAC,CACtD;QACC,CAAC,CAAC,IAAI,CAAC,QAAQ;QACf,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;IAEZ,OAAO;QACL,MAAM;QACN,UAAU;QACV,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC;QAClE,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,YAAY,CAC1B,MAAkB,EAClB,MAA8B,EAC9B,KAAK,GAAG,KAAK;IAEb,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM;YACT,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,KAAK,OAAO;YACV,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;QAC7B,KAAK,MAAM;YACT,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,KAAK,OAAO,CAAC;QACb;YACE,OAAO,WAAW,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC"}

package/dist/report.d.ts

@@ -0,0 +1,46 @@
+/**
+ * qScan report rendering.
+ *
+ * Produces the three output formats the CLI supports:
+ *  - `human`  — a tasteful plain-text banner (counts, top findings, readiness
+ *               score, and a one-line next step). Optional raw ANSI color.
+ *  - `json`   — the structured scan result via core's `toJson`.
+ *  - `sarif`  — SARIF 2.1.0 via core's `toSarif`.
+ *
+ * Only `human` lives here; `json`/`sarif` delegate to `@quantakrypto/core` so the
+ * serialized shape stays consistent across every tool in the monorepo.
+ */
+import type { ScanResult } from "@quantakrypto/core";
+/**
+ * Render the JSON report (pretty-printed, no trailing newline).
+ *
+ * Delegates to core's `toJson` for a monorepo-consistent shape. If the running
+ * core build has not implemented the serializer yet, falls back to emitting the
+ * `ScanResult` directly (which is already JSON-friendly) so reports never break.
+ */
+export declare function renderJson(result: ScanResult): string;
+/**
+ * Render the SARIF 2.1.0 report (pretty-printed, no trailing newline).
+ *
+ * Delegates to core's `toSarif`, with a minimal SARIF 2.1.0 fallback so the
+ * format always produces valid, ingestible output.
+ */
+export declare function renderSarif(result: ScanResult): string;
+/**
+ * Render a CycloneDX 1.6 CBOM (cryptographic bill of materials) for the scan,
+ * pretty-printed with no trailing newline. Delegates to core's `toCbom` so the
+ * serialized shape stays consistent across every tool in the monorepo.
+ */
+export declare function renderCbom(result: ScanResult): string;
+/**
+ * Render the human-readable banner.
+ *
+ * @param result The scan result.
+ * @param opts.color Emit raw ANSI escapes (default: false / plain text).
+ * @param opts.topN How many findings to list (default: 5).
+ */
+export declare function renderHuman(result: ScanResult, opts?: {
+    color?: boolean;
+    topN?: number;
+}): string;
+//# sourceMappingURL=report.d.ts.map

package/dist/report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,KAAK,EAAW,UAAU,EAAY,MAAM,oBAAoB,CAAC;AAyBxE;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAMrD;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAMtD;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAErD;AAmED;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,UAAU,EAClB,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GAC5C,MAAM,CAyDR"}

package/dist/report.js

@@ -0,0 +1,204 @@
+/**
+ * qScan report rendering.
+ *
+ * Produces the three output formats the CLI supports:
+ *  - `human`  — a tasteful plain-text banner (counts, top findings, readiness
+ *               score, and a one-line next step). Optional raw ANSI color.
+ *  - `json`   — the structured scan result via core's `toJson`.
+ *  - `sarif`  — SARIF 2.1.0 via core's `toSarif`.
+ *
+ * Only `human` lives here; `json`/`sarif` delegate to `@quantakrypto/core` so the
+ * serialized shape stays consistent across every tool in the monorepo.
+ */
+import { toCbom, toJson, toSarif } from "@quantakrypto/core";
+import { SEVERITY_ORDER, severityRank } from "./args.js";
+const PLAIN = { reset: "", bold: "", dim: "", red: "", yellow: "", green: "", cyan: "" };
+const COLOR = {
+    reset: "\x1b[0m",
+    bold: "\x1b[1m",
+    dim: "\x1b[2m",
+    red: "\x1b[31m",
+    yellow: "\x1b[33m",
+    green: "\x1b[32m",
+    cyan: "\x1b[36m",
+};
+/**
+ * Render the JSON report (pretty-printed, no trailing newline).
+ *
+ * Delegates to core's `toJson` for a monorepo-consistent shape. If the running
+ * core build has not implemented the serializer yet, falls back to emitting the
+ * `ScanResult` directly (which is already JSON-friendly) so reports never break.
+ */
+export function renderJson(result) {
+    return JSON.stringify(serialize(() => toJson(result), result), null, 2);
+}
+/**
+ * Render the SARIF 2.1.0 report (pretty-printed, no trailing newline).
+ *
+ * Delegates to core's `toSarif`, with a minimal SARIF 2.1.0 fallback so the
+ * format always produces valid, ingestible output.
+ */
+export function renderSarif(result) {
+    return JSON.stringify(serialize(() => toSarif(result), fallbackSarif(result)), null, 2);
+}
+/**
+ * Render a CycloneDX 1.6 CBOM (cryptographic bill of materials) for the scan,
+ * pretty-printed with no trailing newline. Delegates to core's `toCbom` so the
+ * serialized shape stays consistent across every tool in the monorepo.
+ */
+export function renderCbom(result) {
+    return JSON.stringify(toCbom(result), null, 2);
+}
+/**
+ * Call a core serializer, falling back when it is an unimplemented stub.
+ * Only the documented "not implemented" stub error is swallowed; real errors
+ * (e.g. a bug in a future core) propagate. The two branches may have different
+ * shapes — both are ultimately handed to `JSON.stringify`.
+ */
+function serialize(fn, fallback) {
+    try {
+        return fn();
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (message.includes("not implemented"))
+            return fallback;
+        throw err;
+    }
+}
+/** A minimal, valid SARIF 2.1.0 log used when core's `toSarif` is unavailable. */
+function fallbackSarif(result) {
+    return {
+        $schema: "https://json.schemastore.org/sarif-2.1.0.json",
+        version: "2.1.0",
+        runs: [
+            {
+                tool: {
+                    driver: {
+                        name: "qscan",
+                        informationUri: "https://github.com/qproof/qproof-tools",
+                        version: result.toolVersion,
+                        rules: [],
+                    },
+                },
+                results: result.findings.map((f) => ({
+                    ruleId: f.ruleId,
+                    level: sarifLevel(f.severity),
+                    message: { text: f.message },
+                    locations: [
+                        {
+                            physicalLocation: {
+                                artifactLocation: { uri: f.location.file },
+                                region: {
+                                    startLine: f.location.line,
+                                    ...(f.location.column ? { startColumn: f.location.column } : {}),
+                                },
+                            },
+                        },
+                    ],
+                })),
+            },
+        ],
+    };
+}
+/** Map a qScan severity to a SARIF level. */
+function sarifLevel(severity) {
+    switch (severity) {
+        case "critical":
+        case "high":
+            return "error";
+        case "medium":
+            return "warning";
+        default:
+            return "note";
+    }
+}
+/**
+ * Render the human-readable banner.
+ *
+ * @param result The scan result.
+ * @param opts.color Emit raw ANSI escapes (default: false / plain text).
+ * @param opts.topN How many findings to list (default: 5).
+ */
+export function renderHuman(result, opts = {}) {
+    const c = opts.color ? COLOR : PLAIN;
+    const topN = opts.topN ?? 5;
+    const { findings, inventory, filesScanned } = result;
+    const lines = [];
+    lines.push(`${c.bold}qScan — quantum-vulnerable cryptography report${c.reset}`);
+    lines.push(`${c.dim}root: ${result.root}  •  files scanned: ${filesScanned}  •  qscan v${result.toolVersion}${c.reset}`);
+    lines.push("");
+    if (findings.length === 0) {
+        lines.push(`${c.green}No quantum-vulnerable cryptography detected.${c.reset}`);
+        lines.push(`${c.bold}Readiness score: ${readiness(inventory.readinessScore, c)}/100${c.reset}`);
+        lines.push("");
+        lines.push(`${c.dim}Next step:${c.reset} keep scanning in CI to catch regressions.`);
+        return lines.join("\n");
+    }
+    // Severity counts, most-severe first.
+    const counts = SEVERITY_ORDER.map((sev) => {
+        const n = inventory.bySeverity[sev] ?? 0;
+        return n > 0 ? `${severityColor(sev, c)}${n} ${sev}${c.reset}` : null;
+    }).filter((s) => s !== null);
+    lines.push(`${c.bold}${findings.length} finding${findings.length === 1 ? "" : "s"}${c.reset}  (${counts.join(", ")})`);
+    if (inventory.hndlCount > 0) {
+        lines.push(`${c.yellow}${inventory.hndlCount}${c.reset} exposed to harvest-now-decrypt-later (HNDL).`);
+    }
+    lines.push(`${c.bold}Readiness score: ${readiness(inventory.readinessScore, c)}/100${c.reset}`);
+    lines.push("");
+    // Top findings, sorted by severity then file/line for determinism.
+    const top = [...findings].sort(compareFindings).slice(0, topN);
+    lines.push(`${c.bold}Top findings${c.reset}`);
+    for (const f of top) {
+        const loc = `${f.location.file}:${f.location.line}`;
+        lines.push(`  ${severityColor(f.severity, c)}${f.severity.padEnd(8)}${c.reset} ${c.cyan}${f.ruleId}${c.reset}  ${loc}`);
+        lines.push(`           ${f.message}`);
+        if (f.remediation) {
+            lines.push(`           ${c.dim}→ ${f.remediation}${c.reset}`);
+        }
+    }
+    if (findings.length > top.length) {
+        lines.push(`  ${c.dim}…and ${findings.length - top.length} more${c.reset}`);
+    }
+    lines.push("");
+    lines.push(`${c.dim}Next step:${c.reset} ${nextStep(findings)}`);
+    return lines.join("\n");
+}
+/** Suggest a single concrete next action based on the worst finding. */
+function nextStep(findings) {
+    const worst = [...findings].sort(compareFindings)[0];
+    if (!worst)
+        return "review the findings above.";
+    if (worst.remediation) {
+        return `migrate ${worst.location.file} — ${worst.remediation}`;
+    }
+    return `triage ${worst.ruleId} in ${worst.location.file}:${worst.location.line}.`;
+}
+/** Deterministic ordering: most severe first, then file, then line. */
+function compareFindings(a, b) {
+    const bySev = severityRank(a.severity) - severityRank(b.severity);
+    if (bySev !== 0)
+        return bySev;
+    const byFile = a.location.file.localeCompare(b.location.file);
+    if (byFile !== 0)
+        return byFile;
+    return a.location.line - b.location.line;
+}
+/** Color the readiness score green/yellow/red by band. */
+function readiness(score, c) {
+    const color = score >= 80 ? c.green : score >= 50 ? c.yellow : c.red;
+    return `${color}${score}${c.reset}`;
+}
+/** Map a severity to its palette color. */
+function severityColor(severity, c) {
+    switch (severity) {
+        case "critical":
+        case "high":
+            return c.red;
+        case "medium":
+            return c.yellow;
+        default:
+            return c.dim;
+    }
+}
+//# sourceMappingURL=report.js.map

package/dist/report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7D,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAazD,MAAM,KAAK,GAAY,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AAClG,MAAM,KAAK,GAAY;IACrB,KAAK,EAAE,SAAS;IAChB,IAAI,EAAE,SAAS;IACf,GAAG,EAAE,SAAS;IACd,GAAG,EAAE,UAAU;IACf,MAAM,EAAE,UAAU;IAClB,KAAK,EAAE,UAAU;IACjB,IAAI,EAAE,UAAU;CACjB,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,MAAkB;IAC3C,OAAO,IAAI,CAAC,SAAS,CACnB,SAAS,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,EACvC,IAAI,EACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,MAAkB;IAC5C,OAAO,IAAI,CAAC,SAAS,CACnB,SAAS,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,EACvD,IAAI,EACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,MAAkB;IAC3C,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,SAAS,SAAS,CAAO,EAAW,EAAE,QAAW;IAC/C,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YAAE,OAAO,QAAQ,CAAC;QACzD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,SAAS,aAAa,CAAC,MAAkB;IACvC,OAAO;QACL,OAAO,EAAE,+CAA+C;QACxD,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE;oBACJ,MAAM,EAAE;wBACN,IAAI,EAAE,OAAO;wBACb,cAAc,EAAE,wCAAwC;wBACxD,OAAO,EAAE,MAAM,CAAC,WAAW;wBAC3B,KAAK,EAAE,EAAE;qBACV;iBACF;gBACD,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACnC,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;oBAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;oBAC5B,SAAS,EAAE;wBACT;4BACE,gBAAgB,EAAE;gCAChB,gBAAgB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE;gCAC1C,MAAM,EAAE;oCACN,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI;oCAC1B,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iCACjE;6BACF;yBACF;qBACF;iBACF,CAAC,CAAC;aACJ;SACF;KACF,CAAC;AACJ,CAAC;AAED,6CAA6C;AAC7C,SAAS,UAAU,CAAC,QAAkB;IACpC,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,OAAO,CAAC;QACjB,KAAK,QAAQ;YACX,OAAO,SAAS,CAAC;QACnB;YACE,OAAO,MAAM,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CACzB,MAAkB,EAClB,OAA2C,EAAE;IAE7C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;IAC5B,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;IACrD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,iDAAiD,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAChF,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,CAAC,GAAG,SAAS,MAAM,CAAC,IAAI,uBAAuB,YAAY,eAAe,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC,KAAK,EAAE,CAC7G,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,+CAA+C,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/E,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,oBAAoB,SAAS,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAChG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,KAAK,4CAA4C,CAAC,CAAC;QACrF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,sCAAsC;IACtC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACxC,MAAM,CAAC,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAE1C,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,CAAC,IAAI,GAAG,QAAQ,CAAC,MAAM,WAAW,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC3G,CAAC;IACF,IAAI,SAAS,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,CAAC,MAAM,GAAG,SAAS,CAAC,SAAS,GAAG,CAAC,CAAC,KAAK,+CAA+C,CAC3F,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,oBAAoB,SAAS,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAChG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,mEAAmE;IACnE,MAAM,GAAG,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC/D,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpD,KAAK,CAAC,IAAI,CACR,KAAK,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,KAAK,GAAG,EAAE,CAC5G,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,QAAQ,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAEjE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,wEAAwE;AACxE,SAAS,QAAQ,CAAC,QAAmB;IACnC,MAAM,KAAK,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK;QAAE,OAAO,4BAA4B,CAAC;IAChD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,OAAO,WAAW,KAAK,CAAC,QAAQ,CAAC,IAAI,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC;IACjE,CAAC;IACD,OAAO,UAAU,KAAK,CAAC,MAAM,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC;AACpF,CAAC;AAED,uEAAuE;AACvE,SAAS,eAAe,CAAC,CAAU,EAAE,CAAU;IAC7C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAClE,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9D,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAChC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;AAC3C,CAAC;AAED,0DAA0D;AAC1D,SAAS,SAAS,CAAC,KAAa,EAAE,CAAU;IAC1C,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACrE,OAAO,GAAG,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC;AACtC,CAAC;AAED,2CAA2C;AAC3C,SAAS,aAAa,CAAC,QAAkB,EAAE,CAAU;IACnD,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,CAAC,CAAC,GAAG,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,CAAC,CAAC,MAAM,CAAC;QAClB;YACE,OAAO,CAAC,CAAC,GAAG,CAAC;IACjB,CAAC;AACH,CAAC"}

package/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "@quantakrypto/qscan",
+  "version": "0.1.0",
+  "description": "qScan — find quantum-vulnerable cryptography in any codebase (CLI). Zero runtime dependencies.",
+  "license": "Apache-2.0",
+  "author": "Dandelion Labs <hello@dandelionlabs.io> (https://dandelionlabs.io)",
+  "homepage": "https://github.com/dandelionlabs-io/qproof-tools/tree/main/packages/qscan#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/dandelionlabs-io/qproof-tools.git",
+    "directory": "packages/qscan"
+  },
+  "bugs": {
+    "url": "https://github.com/dandelionlabs-io/qproof-tools/issues"
+  },
+  "type": "module",
+  "bin": {
+    "qscan": "./dist/cli.js"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@quantakrypto/core": "0.1.0"
+  },
+  "scripts": {
+    "build": "tsc -b",
+    "test": "node --import tsx --test test/*.test.ts"
+  }
+}