@quantakrypto/qscan 0.4.4 → 0.6.0

package/README.md

@@ -14,7 +14,8 @@ step.
 - **CI-friendly.** Severity thresholds drive the exit code; baselines suppress
   known findings so the build only fails on *new* problems.
 - **Multiple formats.** `human` (default), `json`, SARIF 2.1.0 for code-scanning
-  dashboards, and a CycloneDX 1.6 **CBOM** for compliance tooling.
+  dashboards, a CycloneDX 1.6 **CBOM** for compliance tooling, an ISO 27001
+  A.8.24 **evidence** report, and an **OpenVEX** 0.2.0 document for VEX pipelines.
 - **Fast on big repos.** Optional worker-thread parallelism (`--parallel`) and
   git-aware incremental scanning (`--changed`).
 
@@ -23,10 +24,15 @@ step.
 Inline crypto detection currently covers **JavaScript/TypeScript**, **Python**,
 **Go**, **Java/Kotlin/Scala** (JCA + BouncyCastle), **C#/.NET**, **Rust**, **Ruby**,
 **PHP** (openssl / phpseclib3 / libsodium), **Elixir** (`:crypto` / X509 / JOSE),
-and **C/C++** (OpenSSL, Mbed TLS, wolfSSL) source. PEM key material, SSH keys, TLS/certificate
-config, and dependency manifests for **six ecosystems** — npm (plus
-`yarn.lock` / `pnpm-lock.yaml`), PyPI, Cargo, Go modules, Maven, and RubyGems —
-are detected in **any** file regardless of language.
+**C/C++** (OpenSSL, Mbed TLS, wolfSSL), **Swift** (CryptoKit / Security),
+**Objective-C** (Security `SecKey*`), and **Dart/Flutter** (pointycastle /
+`cryptography`), and **smart contracts** (Solidity/Move/Cairo on-chain
+signature verification) source — **14 languages**. PEM key material, SSH keys (including
+SSH-CA certificates), TLS/certificate config, reverse-proxy/gRPC TLS, WebAuthn/FIDO2,
+code-signing, weak signature hashes (SHA-1/MD5), DKIM, SPIFFE/SPIRE, and dependency
+manifests for **seven ecosystems** — npm (plus `yarn.lock` / `pnpm-lock.yaml`),
+PyPI, Cargo, Go modules, Maven, RubyGems, and NuGet — are detected in **any**
+file regardless of language.
 
 qScan is **honest about coverage**: if a scan walks files but finds none in a
 supported source language, it says so and will **not** present a bare `100/100`
@@ -56,7 +62,7 @@ qscan [path] [options]
 
 | Flag | Description | Default |
 | --- | --- | --- |
-| `--format <human\|json\|sarif\|cbom>` | Output format. | `human` |
+| `--format <human\|json\|sarif\|cbom\|evidence\|vex>` | Output format. | `human` |
 | `--cbom` | Alias for `--format cbom` (CycloneDX 1.6 CBOM). | — |
 | `-o, --output <file>` | Write the report to a file instead of stdout. | stdout |
 | `--severity-threshold <level>` | Exit 1 if any finding is at/above this level. One of `critical`, `high`, `medium`, `low`, `info`. | `high` |
@@ -108,7 +114,7 @@ with `--config <path>`, or disable discovery with `--no-config-file`. See
 
 ```
 qScan — quantum-vulnerable cryptography report
-root: ./examples/vulnerable-app  •  files scanned: 2  •  qscan v0.4.2
+root: ./examples/vulnerable-app  •  files scanned: 2  •  qscan v0.5.0
 
 3 findings  (2 high, 1 medium)
 2 exposed to harvest-now-decrypt-later (HNDL).
@@ -194,8 +200,11 @@ qscan . --concurrency 4          # pin the worker count (implies --parallel)
 ## CBOM (CycloneDX)
 
 Emit a CycloneDX 1.6 **cryptographic bill of materials** — one
-`cryptographic-asset` component per distinct (algorithm, primitive) pair, with
-file:line occurrence evidence — for compliance and supply-chain tooling:
+`cryptographic-asset` component per distinct (assetType, algorithm, discriminator),
+with file:line occurrence evidence — for compliance and supply-chain tooling.
+Findings are classified into their proper CycloneDX `assetType`: `algorithm`
+(crypto usage), `certificate` (X.509), `related-crypto-material` (private/public
+key material), and `protocol` (TLS):
 
 ```bash
 qscan . --cbom -o qscan-cbom.json
@@ -206,6 +215,25 @@ qscan . --format cbom -o qscan-cbom.json
 The output is deterministic (sorted components and occurrences, stable serial
 number), so re-running on an unchanged tree produces byte-identical CBOMs.
 
+## VEX (OpenVEX)
+
+Emit an **OpenVEX 0.2.0** document so the quantum-readiness posture flows into the
+same supply-chain pipeline that already ingests CVE-based VEX:
+
+```bash
+qscan . --format vex -o qscan.openvex.json
+```
+
+One statement per rule (a synthetic `QK-<ruleId>` vulnerability), listing every
+affected `file:line` product with `status: "affected"` and the rule's remediation
+as the `action_statement`. PQC findings have no CVE, so qScan mints a stable
+per-rule identifier rather than claiming one. qScan never reports `not_affected`
+— only an operator can attest a mitigation — so downgrading a statement is left to
+you to post-process. When `--triage` is also set, each verdict (exposure score /
+priority / rationale) is carried in the statement's `status_notes`. Output is
+deterministic (statements sorted by vulnerability, products deduped and sorted;
+the `@id` derives from the finding set).
+
 ## Triage (opt-in, BYOK)
 
 `--triage` adds an optional LLM pass that **re-ranks and explains** findings by

package/dist/args.d.ts

@@ -9,6 +9,7 @@
  */
 import { meetsThreshold, SEVERITY_ORDER, severityRank } from "@quantakrypto/core";
 import type { ContextLevel, ReportFormat, SecurityTier, Severity } from "@quantakrypto/core";
+import type { ColorChoice } from "./color.js";
 /** Valid `--llm-provider` values. */
 declare const LLM_PROVIDERS: readonly ["anthropic", "openai-compatible"];
 export type LlmProvider = (typeof LLM_PROVIDERS)[number];
@@ -16,9 +17,11 @@ export { meetsThreshold, SEVERITY_ORDER, severityRank };
 /**
  * Output formats qScan accepts on the command line. Extends core's
  * {@link ReportFormat} with `"cbom"` (a CycloneDX cryptographic bill of
- * materials), which qScan renders locally via core's `toCbom`.
+ * materials), `"evidence"` (ISO A.8.24 readiness report), and `"vex"` (an
+ * OpenVEX 0.2.0 document) — all rendered locally via core (`toCbom`,
+ * `buildReadinessReport`, `toOpenVex`).
  */
-export type QscanFormat = ReportFormat | "cbom" | "evidence";
+export type QscanFormat = ReportFormat | "cbom" | "evidence" | "vex";
 /** Fully-resolved options the CLI/programmatic runner operates on. */
 export interface QscanOptions {
     /** Directory or file to scan. */
@@ -27,6 +30,8 @@ export interface QscanOptions {
     format: QscanFormat;
     /** Write the report to this file instead of stdout, when set. */
     output?: string;
+    /** External CBOM files to merge into the `--cbom` output (CycloneDX bom-link). */
+    mergeCboms?: string[];
     /** Findings at or above this severity cause a non-zero exit. */
     severityThreshold: Severity;
     /** Scan source files for inline crypto usage. */
@@ -68,6 +73,12 @@ export interface QscanOptions {
     writeBaseline?: string;
     /** Suppress the human summary banner (still writes reports/output files). */
     quiet: boolean;
+    /**
+     * ANSI color policy for the human report (`--color` / `--no-color`). `"auto"`
+     * (default) colors only a live terminal and honors `NO_COLOR` / `FORCE_COLOR`;
+     * see {@link resolveColor}. Color is decoration only — never the sole signal.
+     */
+    colorChoice: ColorChoice;
     /** How many findings the human report lists (`--top N`). Default: 5. */
     topN?: number;
     /** Rule ids to suppress (from `quantakrypto.config.json` `disabledRules`). */
@@ -82,8 +93,23 @@ export interface QscanOptions {
     maxFindings?: number;
     /** CNSA security tier for the migration-targets footer (`--tier`). Default: none. */
     tier?: SecurityTier;
+    /**
+     * Standards regime the migration guidance is tailored to (`--profile`): one of the
+     * built-in ids (nist / cnsa-2.0 / bsi-tr-02102 / anssi / uk-ncsc). Default: none
+     * (`--tier` maps to a profile for back-compat). Governs parameter sets, deadlines,
+     * and the hybrid stance surfaced in remediation.
+     */
+    profile?: string;
     /** Org cryptography policy file (`--policy`) for the evidence report's §4 verdicts. */
     policy?: string;
+    /**
+     * External signer command for the evidence attestation (`--sign`). The report's
+     * contentHash is piped to it on stdin; its stdout is recorded as the detached
+     * signature. Only valid with `--format evidence`.
+     */
+    sign?: string;
+    /** External RFC-3161 timestamper command for the evidence attestation (`--timestamp`). */
+    timestamp?: string;
     /** How much source context leaves the machine (`--context`). Default: snippet. */
     contextLevel?: ContextLevel;
     /** Print the exact triage payload and exit without calling the provider (`--dry-run`). */
@@ -109,6 +135,26 @@ export interface QscanOptions {
      * from `--no-config` (which skips config-file *detectors*).
      */
     noConfigFile: boolean;
+    /**
+     * Compute + emit HNDL (harvest-now-decrypt-later) exposure (`--hndl`). Reads
+     * `hndl.yml` at the scan root, scores each finding + a repo summary, and adds
+     * the exposure fields to the JSON / SARIF report. Additive: never changes the
+     * exit code. See docs/HNDL.md.
+     */
+    hndl: boolean;
+    /**
+     * URL to a posture credential recorded in a crypto-agility manifest
+     * (`--attestation`). Only consumed by `crypto-agility emit`; recorded verbatim,
+     * never fetched (offline boundary). See docs/CRYPTO-AGILITY-MANIFEST.md.
+     */
+    attestation?: string;
+    /**
+     * Operator assertion of hybrid post-quantum key exchange for a crypto-agility
+     * manifest (`--hybrid-kex` → true, `--no-hybrid-kex` → false). Left undefined,
+     * the manifest reports `hybridKexInUse: null` (a static scan cannot observe a
+     * negotiated TLS group). Only consumed by `crypto-agility emit`.
+     */
+    hybridKexInUse?: boolean;
 }
 /**
  * Option keys that a `quantakrypto.config.json` may also set. When such a key was set
@@ -124,8 +170,28 @@ export interface ParsedRun {
     /** The set of {@link ConfigurableKey}s the user set via a flag. */
     explicit: Set<ConfigurableKey>;
 }
+/** The `qscan hndl init` subcommand: scaffold an `hndl.yml`. */
+export interface ParsedHndlInit {
+    kind: "hndl-init";
+    options: QscanOptions;
+}
+/**
+ * Emit a crypto-agility manifest: either `qscan crypto-agility emit [path]` or the
+ * `--crypto-agility` flag on a normal scan. Additive: it always exits 0, never
+ * consulting the severity threshold.
+ */
+export interface ParsedCryptoAgilityEmit {
+    kind: "crypto-agility-emit";
+    options: QscanOptions;
+}
+/** Validate a local manifest file: `qscan crypto-agility validate <file>`. */
+export interface ParsedCryptoAgilityValidate {
+    kind: "crypto-agility-validate";
+    /** Path to the manifest JSON file to check. */
+    file: string;
+}
 /** Result of {@link parseArgs}: either resolved options or a meta action. */
-export type ParsedArgs = ParsedRun | {
+export type ParsedArgs = ParsedRun | ParsedHndlInit | ParsedCryptoAgilityEmit | ParsedCryptoAgilityValidate | {
     kind: "help";
 } | {
     kind: "version";
@@ -146,12 +212,6 @@ export declare const DEFAULT_CACHE_FILE = ".quantakrypto-cache.json";
 export declare function parseArgs(argv: readonly string[]): ParsedArgs;
 /** Validate/normalize a `--format` value. */
 export declare function asFormat(value: string): QscanFormat;
-/** Validate/normalize a `--context` level. */
-export declare function asContextLevel(value: string): ContextLevel;
-/** Validate/normalize a `--tier` value. */
-export declare function asTier(value: string): SecurityTier;
-/** Validate/normalize a `--llm-provider` value. */
-export declare function asProvider(value: string): LlmProvider;
 /** Validate/normalize a non-negative integer flag value. */
 export declare function asInt(value: string, flag: string): number;
 /** Validate/normalize a severity value. */

package/dist/args.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"args.d.ts","sourceRoot":"","sources":["../src/args.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClF,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAM7F,qCAAqC;AACrC,QAAA,MAAM,aAAa,6CAA8C,CAAC;AAClE,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAMzD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC;AAExD;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,MAAM,GAAG,UAAU,CAAC;AAI7D,sEAAsE;AACtE,MAAM,WAAW,YAAY;IAC3B,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,qBAAqB;IACrB,MAAM,EAAE,WAAW,CAAC;IACpB,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gEAAgE;IAChE,iBAAiB,EAAE,QAAQ,CAAC;IAC5B,iDAAiD;IACjD,MAAM,EAAE,OAAO,CAAC;IAChB,0DAA0D;IAC1D,YAAY,EAAE,OAAO,CAAC;IACtB,4CAA4C;IAC5C,MAAM,EAAE,OAAO,CAAC;IAChB,sDAAsD;IACtD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB;;;OAGG;IACH,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iEAAiE;IACjE,gBAAgB,EAAE,OAAO,CAAC;IAC1B,sEAAsE;IACtE,YAAY,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,QAAQ,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,6EAA6E;IAC7E,KAAK,EAAE,OAAO,CAAC;IACf,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,MAAM,EAAE,OAAO,CAAC;IAChB,0FAA0F;IAC1F,WAAW,CAAC,EAAE,QAAQ,CAAC;IACvB,kFAAkF;IAClF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qFAAqF;IACrF,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,uFAAuF;IACvF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kFAAkF;IAClF,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,0FAA0F;IAC1F,MAAM,EAAE,OAAO,CAAC;IAChB,4DAA4D;IAC5D,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,qCAAqC;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GACvB,mBAAmB,GACnB,QAAQ,GACR,cAAc,GACd,QAAQ,GACR,SAAS,GACT,QAAQ,GACR,aAAa,GACb,kBAAkB,GAClB,cAAc,GACd,UAAU,CAAC;AAEf,uFAAuF;AACvF,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,KAAK,CAAC;IACZ,OAAO,EAAE,YAAY,CAAC;IACtB,mEAAmE;IACnE,QAAQ,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC;CAChC;AAED,6EAA6E;AAC7E,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC;AAE5E,mEAAmE;AACnE,qBAAa,QAAS,SAAQ,KAAK;IACjC,SAAkB,IAAI,cAAc;CACrC;AAED,qDAAqD;AACrD,wBAAgB,cAAc,IAAI,YAAY,CAoB7C;AAED;;;;GAIG;AACH,sEAAsE;AACtE,eAAO,MAAM,kBAAkB,6BAA6B,CAAC;AAE7D,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,CAwN7D;AAED,6CAA6C;AAC7C,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAGnD;AAED,8CAA8C;AAC9C,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,CAK1D;AAED,2CAA2C;AAC3C,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,CAGlD;AAED,mDAAmD;AACnD,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAKrD;AAED,4DAA4D;AAC5D,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAKzD;AAED,2CAA2C;AAC3C,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAGlD"}
+{"version":3,"file":"args.d.ts","sourceRoot":"","sources":["../src/args.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,cAAc,EACd,cAAc,EACd,YAAY,EAEb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC7F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAM9C,qCAAqC;AACrC,QAAA,MAAM,aAAa,6CAA8C,CAAC;AAClE,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAMzD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC;AAExD;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,MAAM,GAAG,UAAU,GAAG,KAAK,CAAC;AAIrE,sEAAsE;AACtE,MAAM,WAAW,YAAY;IAC3B,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,qBAAqB;IACrB,MAAM,EAAE,WAAW,CAAC;IACpB,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,gEAAgE;IAChE,iBAAiB,EAAE,QAAQ,CAAC;IAC5B,iDAAiD;IACjD,MAAM,EAAE,OAAO,CAAC;IAChB,0DAA0D;IAC1D,YAAY,EAAE,OAAO,CAAC;IACtB,4CAA4C;IAC5C,MAAM,EAAE,OAAO,CAAC;IAChB,sDAAsD;IACtD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB;;;OAGG;IACH,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iEAAiE;IACjE,gBAAgB,EAAE,OAAO,CAAC;IAC1B,sEAAsE;IACtE,YAAY,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,QAAQ,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,6EAA6E;IAC7E,KAAK,EAAE,OAAO,CAAC;IACf;;;;OAIG;IACH,WAAW,EAAE,WAAW,CAAC;IACzB,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,MAAM,EAAE,OAAO,CAAC;IAChB,0FAA0F;IAC1F,WAAW,CAAC,EAAE,QAAQ,CAAC;IACvB,kFAAkF;IAClF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qFAAqF;IACrF,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uFAAuF;IACvF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0FAA0F;IAC1F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,0FAA0F;IAC1F,MAAM,EAAE,OAAO,CAAC;IAChB,4DAA4D;IAC5D,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,qCAAqC;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,YAAY,EAAE,OAAO,CAAC;IACtB;;;;;OAKG;IACH,IAAI,EAAE,OAAO,CAAC;IACd;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GACvB,mBAAmB,GACnB,QAAQ,GACR,cAAc,GACd,QAAQ,GACR,SAAS,GACT,QAAQ,GACR,aAAa,GACb,kBAAkB,GAClB,cAAc,GACd,UAAU,CAAC;AAEf,uFAAuF;AACvF,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,KAAK,CAAC;IACZ,OAAO,EAAE,YAAY,CAAC;IACtB,mEAAmE;IACnE,QAAQ,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC;CAChC;AAED,gEAAgE;AAChE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,YAAY,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,qBAAqB,CAAC;IAC5B,OAAO,EAAE,YAAY,CAAC;CACvB;AAED,8EAA8E;AAC9E,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,yBAAyB,CAAC;IAChC,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;CACd;AAED,6EAA6E;AAC7E,MAAM,MAAM,UAAU,GAClB,SAAS,GACT,cAAc,GACd,uBAAuB,GACvB,2BAA2B,GAC3B;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC;AAExB,mEAAmE;AACnE,qBAAa,QAAS,SAAQ,KAAK;IACjC,SAAkB,IAAI,cAAc;CACrC;AAED,qDAAqD;AACrD,wBAAgB,cAAc,IAAI,YAAY,CAsB7C;AAED;;;;GAIG;AACH,sEAAsE;AACtE,eAAO,MAAM,kBAAkB,6BAA6B,CAAC;AAE7D,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,CAsD7D;AA6QD,6CAA6C;AAC7C,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAGnD;AA+BD,4DAA4D;AAC5D,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAKzD;AAED,2CAA2C;AAC3C,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAGlD"}

package/dist/args.js

@@ -7,7 +7,7 @@
  * (`-o`, `-v`, `-h`), repeatable `--ignore`, and a single optional positional
  * path. Unknown flags are a usage error.
  */
-import { meetsThreshold, SEVERITY_ORDER, severityRank } from "@quantakrypto/core";
+import { meetsThreshold, SEVERITY_ORDER, severityRank, standardsProfileIds, } from "@quantakrypto/core";
 /** Valid context levels for `--context` (how much source triage/remediate sends). */
 const CONTEXT_LEVELS = ["metadata", "snippet", "function", "file"];
 /** Valid CNSA security tiers for `--tier` (report migration-target guidance). */
@@ -19,7 +19,7 @@ const LLM_PROVIDERS = ["anthropic", "openai-compatible"];
 // `@quantakrypto/qscan` callers (and tests) keep importing them from `./args.js`
 // without qScan maintaining a second, drift-prone copy.
 export { meetsThreshold, SEVERITY_ORDER, severityRank };
-const FORMATS = ["human", "json", "sarif", "cbom", "evidence"];
+const FORMATS = ["human", "json", "sarif", "cbom", "evidence", "vex"];
 /** Thrown on malformed input; the CLI maps this to exit code 2. */
 export class ArgError extends Error {
     name = "ArgError";
@@ -40,10 +40,12 @@ export function defaultOptions() {
         changed: false,
         parallel: false,
         quiet: false,
+        colorChoice: "auto",
         noSnippets: false,
         noConfigFile: false,
         triage: false,
         dryRun: false,
+        hndl: false,
     };
 }
 /**
@@ -54,9 +56,72 @@ export function defaultOptions() {
 /** Default scan-cache file when `--cache` is given without a path. */
 export const DEFAULT_CACHE_FILE = ".quantakrypto-cache.json";
 export function parseArgs(argv) {
+    // Subcommand dispatch: `qscan hndl <sub> …`. Only `init` exists today. `--help`
+    // / `--version` anywhere still short-circuit to the meta actions (handled by
+    // the shared loop below), so `qscan hndl init --help` shows help.
+    if (argv[0] === "hndl") {
+        const sub = argv[1];
+        if (sub === undefined || sub.startsWith("-")) {
+            if (sub === "--help" || sub === "-h")
+                return { kind: "help" };
+            if (sub === "--version" || sub === "-v")
+                return { kind: "version" };
+            throw new ArgError(`"hndl" requires a subcommand (expected: init)`);
+        }
+        if (sub !== "init") {
+            throw new ArgError(`unknown hndl subcommand "${sub}" (expected: init)`);
+        }
+        const parsed = parseRunArgs(argv.slice(2));
+        if (parsed.kind !== "run")
+            return parsed; // --help / --version passthrough
+        return { kind: "hndl-init", options: parsed.options };
+    }
+    // Subcommand dispatch: `qscan crypto-agility <sub> …`.
+    //   emit [path]       derive + write a manifest (always exits 0)
+    //   validate <file>   check a local manifest against the schema
+    if (argv[0] === "crypto-agility") {
+        const sub = argv[1];
+        if (sub === undefined || sub.startsWith("-")) {
+            if (sub === "--help" || sub === "-h")
+                return { kind: "help" };
+            if (sub === "--version" || sub === "-v")
+                return { kind: "version" };
+            throw new ArgError(`"crypto-agility" requires a subcommand (expected: emit, validate)`);
+        }
+        if (sub === "emit") {
+            const parsed = parseRunArgs(argv.slice(2));
+            // `--help`/`--version` short-circuit; a redundant `--crypto-agility` flag on
+            // the emit subcommand already yields the emit kind (returned as-is).
+            if (parsed.kind !== "run")
+                return parsed;
+            return { kind: "crypto-agility-emit", options: parsed.options };
+        }
+        if (sub === "validate") {
+            const rest = argv.slice(2);
+            if (rest.includes("--help") || rest.includes("-h"))
+                return { kind: "help" };
+            if (rest.includes("--version") || rest.includes("-v"))
+                return { kind: "version" };
+            const positionals = rest.filter((a) => !(a.startsWith("-") && a !== "-"));
+            if (positionals.length === 0) {
+                throw new ArgError(`"crypto-agility validate" requires a manifest file path`);
+            }
+            if (positionals.length > 1) {
+                throw new ArgError(`"crypto-agility validate" takes exactly one file (got ${positionals.length})`);
+            }
+            return { kind: "crypto-agility-validate", file: positionals[0] };
+        }
+        throw new ArgError(`unknown crypto-agility subcommand "${sub}" (expected: emit, validate)`);
+    }
+    return parseRunArgs(argv);
+}
+/** Parse the run-mode grammar (flags + a single optional positional path). */
+function parseRunArgs(argv) {
     const options = defaultOptions();
     const explicit = new Set();
     let positional;
+    // Set by `--crypto-agility`: the whole run becomes a manifest emit (exit 0).
+    let emitManifest = false;
     // Manual index walk so flags can consume the following token as a value.
     for (let i = 0; i < argv.length; i++) {
         const arg = argv[i];
@@ -103,6 +168,11 @@ export function parseArgs(argv) {
                 rejectInlineValue();
                 options.format = "cbom";
                 break;
+            case "--merge":
+                // Merge an external CBOM (e.g. a qprobe endpoint CBOM) into the --cbom
+                // output via CycloneDX bom-link. Repeatable.
+                (options.mergeCboms ??= []).push(takeValue());
+                break;
             case "-o":
             case "--output":
                 options.output = takeValue();
@@ -154,6 +224,9 @@ export function parseArgs(argv) {
             case "--tier":
                 options.tier = asTier(takeValue());
                 break;
+            case "--profile":
+                options.profile = asProfile(takeValue());
+                break;
             case "--context":
                 options.contextLevel = asContextLevel(takeValue());
                 break;
@@ -232,6 +305,12 @@ export function parseArgs(argv) {
             case "--policy":
                 options.policy = takeValue();
                 break;
+            case "--sign":
+                options.sign = takeValue();
+                break;
+            case "--timestamp":
+                options.timestamp = takeValue();
+                break;
             case "--write-baseline":
                 options.writeBaseline = takeValue();
                 break;
@@ -239,10 +318,38 @@ export function parseArgs(argv) {
                 rejectInlineValue();
                 options.quiet = true;
                 break;
+            case "--color":
+                rejectInlineValue();
+                options.colorChoice = "always";
+                break;
+            case "--no-color":
+                rejectInlineValue();
+                options.colorChoice = "never";
+                break;
             case "--no-snippets":
                 rejectInlineValue();
                 options.noSnippets = true;
                 break;
+            case "--hndl":
+                rejectInlineValue();
+                options.hndl = true;
+                break;
+            // Crypto-agility manifest controls (see `crypto-agility emit`).
+            case "--crypto-agility":
+                rejectInlineValue();
+                emitManifest = true;
+                break;
+            case "--attestation":
+                options.attestation = takeValue();
+                break;
+            case "--hybrid-kex":
+                rejectInlineValue();
+                options.hybridKexInUse = true;
+                break;
+            case "--no-hybrid-kex":
+                rejectInlineValue();
+                options.hybridKexInUse = false;
+                break;
             default:
                 if (flag.startsWith("-") && flag !== "-") {
                     throw new ArgError(`unknown option "${flag}"`);
@@ -256,6 +363,10 @@ export function parseArgs(argv) {
     }
     if (positional !== undefined)
         options.path = positional;
+    // `--crypto-agility` turns the whole run into a manifest emit, taking it off the
+    // findings-threshold exit path entirely (the emit always exits 0).
+    if (emitManifest)
+        return { kind: "crypto-agility-emit", options };
     return { kind: "run", options, explicit };
 }
 /** Validate/normalize a `--format` value. */
@@ -265,19 +376,26 @@ export function asFormat(value) {
     throw new ArgError(`invalid --format "${value}" (expected one of: ${FORMATS.join(", ")})`);
 }
 /** Validate/normalize a `--context` level. */
-export function asContextLevel(value) {
+function asContextLevel(value) {
     if (CONTEXT_LEVELS.includes(value))
         return value;
     throw new ArgError(`invalid --context "${value}" (expected one of: ${CONTEXT_LEVELS.join(", ")})`);
 }
 /** Validate/normalize a `--tier` value. */
-export function asTier(value) {
+function asTier(value) {
     if (SECURITY_TIERS.includes(value))
         return value;
     throw new ArgError(`invalid --tier "${value}" (expected one of: ${SECURITY_TIERS.join(", ")})`);
 }
+/** Validate a `--profile` value against the built-in standards regimes. */
+function asProfile(value) {
+    const ids = standardsProfileIds();
+    if (ids.includes(value))
+        return value;
+    throw new ArgError(`invalid --profile "${value}" (expected one of: ${ids.join(", ")})`);
+}
 /** Validate/normalize a `--llm-provider` value. */
-export function asProvider(value) {
+function asProvider(value) {
     if (LLM_PROVIDERS.includes(value))
         return value;
     throw new ArgError(`invalid --llm-provider "${value}" (expected one of: ${LLM_PROVIDERS.join(", ")})`);

package/dist/args.js.map

@@ -1 +1 @@
-{"version":3,"file":"args.js","sourceRoot":"","sources":["../src/args.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGlF,qFAAqF;AACrF,MAAM,cAAc,GAA4B,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;AAC5F,iFAAiF;AACjF,MAAM,cAAc,GAA4B,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;AAC7E,qCAAqC;AACrC,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,mBAAmB,CAAU,CAAC;AAGlE,4EAA4E;AAC5E,2EAA2E;AAC3E,iFAAiF;AACjF,wDAAwD;AACxD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC;AASxD,MAAM,OAAO,GAA2B,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;AA2HvF,mEAAmE;AACnE,MAAM,OAAO,QAAS,SAAQ,KAAK;IACf,IAAI,GAAG,UAAU,CAAC;CACrC;AAED,qDAAqD;AACrD,MAAM,UAAU,cAAc;IAC5B,OAAO;QACL,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,OAAO;QACf,iBAAiB,EAAE,MAAM;QACzB,MAAM,EAAE,IAAI;QACZ,YAAY,EAAE,IAAI;QAClB,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,EAAE;QACX,gBAAgB,EAAE,KAAK;QACvB,YAAY,EAAE,KAAK;QACnB,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,KAAK;QACf,KAAK,EAAE,KAAK;QACZ,UAAU,EAAE,KAAK;QACjB,YAAY,EAAE,KAAK;QACnB,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,KAAK;KACd,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,sEAAsE;AACtE,MAAM,CAAC,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AAE7D,MAAM,UAAU,SAAS,CAAC,IAAuB;IAC/C,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC5C,IAAI,UAA8B,CAAC;IAEnC,yEAAyE;IACzE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QAE9B,mDAAmD;QACnD,IAAI,WAA+B,CAAC;QACpC,IAAI,IAAI,GAAG,GAAG,CAAC;QACf,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACxB,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAClC,CAAC;QAED,mFAAmF;QACnF,MAAM,SAAS,GAAG,GAAW,EAAE;YAC7B,IAAI,WAAW,KAAK,SAAS;gBAAE,OAAO,WAAW,CAAC;YAClD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACjE,MAAM,IAAI,QAAQ,CAAC,WAAW,IAAI,oBAAoB,CAAC,CAAC;YAC1D,CAAC;YACD,CAAC,EAAE,CAAC;YACJ,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QAEF;;;;WAIG;QACH,MAAM,iBAAiB,GAAG,GAAS,EAAE;YACnC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,IAAI,QAAQ,CAAC,WAAW,IAAI,wCAAwC,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC,CAAC;QAEF,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,IAAI,CAAC;YACV,KAAK,QAAQ;gBACX,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC1B,KAAK,IAAI,CAAC;YACV,KAAK,WAAW;gBACd,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAE7B,KAAK,UAAU;gBACb,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;gBACvC,MAAM;YACR,KAAK,QAAQ;gBACX,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;gBACxB,MAAM;YACR,KAAK,IAAI,CAAC;YACV,KAAK,UAAU;gBACb,OAAO,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;gBAC7B,MAAM;YACR,KAAK,sBAAsB;gBACzB,OAAO,CAAC,iBAAiB,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;gBACpD,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;gBAClC,MAAM;YAER,KAAK,aAAa;gBAChB,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC;gBACvB,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACvB,MAAM;YACR,KAAK,WAAW;gBACd,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,YAAY,GAAG,KAAK,CAAC;gBAC7B,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;gBAC7B,MAAM;YACR,KAAK,aAAa;gBAChB,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC;gBACvB,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACvB,MAAM;YAER,KAAK,UAAU;gBACb,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;gBACjC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACvB,MAAM;YACR,KAAK,WAAW;gBACd,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;gBAClC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACxB,MAAM;YACR,KAAK,iBAAiB;gBACpB,OAAO,CAAC,WAAW,GAAG,KAAK,CAAC,SAAS,EAAE,EAAE,iBAAiB,CAAC,CAAC;gBAC5D,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;gBAC5B,MAAM;YACR,KAAK,OAAO;gBACV,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,SAAS,EAAE,EAAE,OAAO,CAAC,CAAC;gBAC3C,MAAM;YACR,KAAK,UAAU;gBACb,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;gBACtB,MAAM;YACR,KAAK,gBAAgB;gBACnB,OAAO,CAAC,WAAW,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;gBAC9C,MAAM;YACR,KAAK,gBAAgB;gBACnB,OAAO,CAAC,WAAW,GAAG,KAAK,CAAC,SAAS,EAAE,EAAE,gBAAgB,CAAC,CAAC;gBAC3D,MAAM;YACR,KAAK,QAAQ;gBACX,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;gBACnC,MAAM;YACR,KAAK,WAAW;gBACd,OAAO,CAAC,YAAY,GAAG,cAAc,CAAC,SAAS,EAAE,CAAC,CAAC;gBACnD,MAAM;YACR,KAAK,WAAW;gBACd,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;gBACtB,MAAM;YACR,KAAK,gBAAgB;gBACnB,OAAO,CAAC,WAAW,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;gBAC9C,MAAM;YACR,KAAK,aAAa;gBAChB,OAAO,CAAC,QAAQ,GAAG,SAAS,EAAE,CAAC;gBAC/B,MAAM;YACR,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,oEAAoE;gBACpE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;oBAC9B,OAAO,CAAC,SAAS,GAAG,WAAW,CAAC;gBAClC,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;oBACzB,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;wBAClE,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;wBACzB,CAAC,EAAE,CAAC;oBACN,CAAC;yBAAM,CAAC;wBACN,OAAO,CAAC,SAAS,GAAG,kBAAkB,CAAC;oBACzC,CAAC;gBACH,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,sBAAsB;gBACzB,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;gBAChC,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;gBACjC,MAAM;YACR,KAAK,iBAAiB;gBACpB,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;gBAC5B,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;gBAC7B,MAAM;YAER,+EAA+E;YAC/E,iDAAiD;YACjD,KAAK,UAAU;gBACb,OAAO,CAAC,UAAU,GAAG,SAAS,EAAE,CAAC;gBACjC,MAAM;YACR,KAAK,kBAAkB;gBACrB,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;gBAC5B,MAAM;YAER,KAAK,WAAW;gBACd,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;gBACvB,MAAM;YACR,KAAK,SAAS;gBACZ,OAAO,CAAC,KAAK,GAAG,SAAS,EAAE,CAAC;gBAC5B,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,mCAAmC;gBAC3D,MAAM;YAER,KAAK,YAAY;gBACf,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;gBACxB,MAAM;YACR,KAAK,eAAe,CAAC,CAAC,CAAC;gBACrB,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,EAAE,EAAE,eAAe,CAAC,CAAC;gBAC9C,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC;gBACxB,uEAAuE;gBACvE,wEAAwE;gBACxE,yEAAyE;gBACzE,oBAAoB;gBACpB,OAAO,CAAC,QAAQ,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC1B,MAAM;YACR,CAAC;YAED,KAAK,YAAY;gBACf,OAAO,CAAC,QAAQ,GAAG,SAAS,EAAE,CAAC;gBAC/B,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACzB,MAAM;YACR,KAAK,UAAU;gBACb,OAAO,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;gBAC7B,MAAM;YACR,KAAK,kBAAkB;gBACrB,OAAO,CAAC,aAAa,GAAG,SAAS,EAAE,CAAC;gBACpC,MAAM;YACR,KAAK,SAAS;gBACZ,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;gBACrB,MAAM;YACR,KAAK,eAAe;gBAClB,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;gBAC1B,MAAM;YAER;gBACE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;oBACzC,MAAM,IAAI,QAAQ,CAAC,mBAAmB,IAAI,GAAG,CAAC,CAAC;gBACjD,CAAC;gBACD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC7B,MAAM,IAAI,QAAQ,CAChB,8BAA8B,GAAG,2BAA2B,UAAU,IAAI,CAC3E,CAAC;gBACJ,CAAC;gBACD,UAAU,GAAG,GAAG,CAAC;gBACjB,MAAM;QACV,CAAC;IACH,CAAC;IAED,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,GAAG,UAAU,CAAC;IACxD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC5C,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,IAAK,OAA6B,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAoB,CAAC;IAChF,MAAM,IAAI,QAAQ,CAAC,qBAAqB,KAAK,uBAAuB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7F,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,IAAK,cAAoC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAqB,CAAC;IACxF,MAAM,IAAI,QAAQ,CAChB,sBAAsB,KAAK,uBAAuB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC/E,CAAC;AACJ,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,IAAK,cAAoC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAqB,CAAC;IACxF,MAAM,IAAI,QAAQ,CAAC,mBAAmB,KAAK,uBAAuB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClG,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,IAAK,aAAmC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAoB,CAAC;IACtF,MAAM,IAAI,QAAQ,CAChB,2BAA2B,KAAK,uBAAuB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACnF,CAAC;AACJ,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,KAAK,CAAC,KAAa,EAAE,IAAY;IAC/C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,QAAQ,CAAC,WAAW,IAAI,KAAK,KAAK,qCAAqC,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,IAAK,cAAoC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAiB,CAAC;IACpF,MAAM,IAAI,QAAQ,CAAC,qBAAqB,KAAK,uBAAuB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpG,CAAC","sourcesContent":["/**\n * Zero-dependency command-line argument parsing for qScan.\n *\n * Hand-rolled rather than pulled from a library to keep the package free of\n * runtime dependencies. The grammar is deliberately small: long flags\n * (`--flag`, `--flag value`, `--flag=value`), a couple of short aliases\n * (`-o`, `-v`, `-h`), repeatable `--ignore`, and a single optional positional\n * path. Unknown flags are a usage error.\n */\n\nimport { meetsThreshold, SEVERITY_ORDER, severityRank } from \"@quantakrypto/core\";\nimport type { ContextLevel, ReportFormat, SecurityTier, Severity } from \"@quantakrypto/core\";\n\n/** Valid context levels for `--context` (how much source triage/remediate sends). */\nconst CONTEXT_LEVELS: readonly ContextLevel[] = [\"metadata\", \"snippet\", \"function\", \"file\"];\n/** Valid CNSA security tiers for `--tier` (report migration-target guidance). */\nconst SECURITY_TIERS: readonly SecurityTier[] = [\"category-3\", \"category-5\"];\n/** Valid `--llm-provider` values. */\nconst LLM_PROVIDERS = [\"anthropic\", \"openai-compatible\"] as const;\nexport type LlmProvider = (typeof LLM_PROVIDERS)[number];\n\n// Severity ordering, ranking, and threshold logic are the monorepo's single\n// source of truth in `@quantakrypto/core`. Re-export them here so existing\n// `@quantakrypto/qscan` callers (and tests) keep importing them from `./args.js`\n// without qScan maintaining a second, drift-prone copy.\nexport { meetsThreshold, SEVERITY_ORDER, severityRank };\n\n/**\n * Output formats qScan accepts on the command line. Extends core's\n * {@link ReportFormat} with `\"cbom\"` (a CycloneDX cryptographic bill of\n * materials), which qScan renders locally via core's `toCbom`.\n */\nexport type QscanFormat = ReportFormat | \"cbom\" | \"evidence\";\n\nconst FORMATS: readonly QscanFormat[] = [\"human\", \"json\", \"sarif\", \"cbom\", \"evidence\"];\n\n/** Fully-resolved options the CLI/programmatic runner operates on. */\nexport interface QscanOptions {\n  /** Directory or file to scan. */\n  path: string;\n  /** Report format. */\n  format: QscanFormat;\n  /** Write the report to this file instead of stdout, when set. */\n  output?: string;\n  /** Findings at or above this severity cause a non-zero exit. */\n  severityThreshold: Severity;\n  /** Scan source files for inline crypto usage. */\n  source: boolean;\n  /** Scan dependency manifests for vulnerable libraries. */\n  dependencies: boolean;\n  /** Scan config files (TLS/certificates). */\n  config: boolean;\n  /** Extra exclude patterns (repeatable `--ignore`). */\n  ignore: string[];\n  /**\n   * Restrict the walk to paths matching one of these include patterns\n   * (repeatable `--include`). When empty, every non-excluded file is scanned.\n   */\n  include: string[];\n  /** Max file size to read, in bytes (`--max-file-size`). */\n  maxFileSize?: number;\n  /** Disable the built-in ignore list (`--no-default-ignores`). */\n  noDefaultIgnores: boolean;\n  /** Scan minified/generated/bundled files instead of skipping them. */\n  scanMinified: boolean;\n  /**\n   * Incremental mode: scan only the files git reports as changed\n   * (`--changed`), optionally relative to {@link since}.\n   */\n  changed: boolean;\n  /** Git ref/range the `--changed` diff is taken against (`--since`). */\n  since?: string;\n  /** Route the scan through core's worker-thread pool (`--parallel`). */\n  parallel: boolean;\n  /**\n   * Worker count for parallel scanning (`--concurrency`). Implies parallel.\n   * A value of 0 or 1 forces the in-process serial path.\n   */\n  concurrency?: number;\n  /** Suppress findings whose fingerprint is in this baseline file. */\n  baseline?: string;\n  /** Write current findings as a baseline to this file, then exit 0. */\n  writeBaseline?: string;\n  /** Suppress the human summary banner (still writes reports/output files). */\n  quiet: boolean;\n  /** How many findings the human report lists (`--top N`). Default: 5. */\n  topN?: number;\n  /** Rule ids to suppress (from `quantakrypto.config.json` `disabledRules`). */\n  disabledRules?: string[];\n  /** Content-hash scan cache path (`--cache [path]`); reuse unchanged files. */\n  cacheFile?: string;\n  /** Run the BYOK LLM triage pass (`--triage`): annotate + re-sort, never suppress. */\n  triage: boolean;\n  /** Only triage findings at/above this seriousness (`--triage-floor`). Default: medium. */\n  triageFloor?: Severity;\n  /** Cap findings sent to the LLM during triage (`--max-findings`; spend guard). */\n  maxFindings?: number;\n  /** CNSA security tier for the migration-targets footer (`--tier`). Default: none. */\n  tier?: SecurityTier;\n  /** Org cryptography policy file (`--policy`) for the evidence report's §4 verdicts. */\n  policy?: string;\n  /** How much source context leaves the machine (`--context`). Default: snippet. */\n  contextLevel?: ContextLevel;\n  /** Print the exact triage payload and exit without calling the provider (`--dry-run`). */\n  dryRun: boolean;\n  /** BYOK provider (`--llm-provider`). Default: anthropic. */\n  llmProvider?: LlmProvider;\n  /** BYOK model id (`--llm-model`). */\n  llmModel?: string;\n  /**\n   * Omit code snippets from the JSON/SARIF report (`--no-snippets`). Passed to\n   * core's reporters as `{ redactSnippets: true }`. Snippets of `sensitive`\n   * findings are always omitted regardless of this flag.\n   */\n  noSnippets: boolean;\n  /**\n   * Explicit path to a `quantakrypto.config.json` (`--config <path>`). Overrides\n   * auto-discovery at the scan root. Distinct from `--no-config`, which toggles\n   * config/TLS *detector* scanning — this names the config FILE.\n   */\n  configFile?: string;\n  /**\n   * Disable `quantakrypto.config.json` auto-discovery (`--no-config-file`). Distinct\n   * from `--no-config` (which skips config-file *detectors*).\n   */\n  noConfigFile: boolean;\n}\n\n/**\n * Option keys that a `quantakrypto.config.json` may also set. When such a key was set\n * by a CLI flag, the flag wins (precedence: flags > config > defaults); when it\n * was left at its default, config may fill it. {@link parseArgs} records which\n * of these keys came from an explicit flag in {@link ParsedRun.explicit}.\n */\nexport type ConfigurableKey =\n  | \"severityThreshold\"\n  | \"source\"\n  | \"dependencies\"\n  | \"config\"\n  | \"include\"\n  | \"ignore\"\n  | \"maxFileSize\"\n  | \"noDefaultIgnores\"\n  | \"scanMinified\"\n  | \"baseline\";\n\n/** A successful parse: resolved options plus which configurable keys were explicit. */\nexport interface ParsedRun {\n  kind: \"run\";\n  options: QscanOptions;\n  /** The set of {@link ConfigurableKey}s the user set via a flag. */\n  explicit: Set<ConfigurableKey>;\n}\n\n/** Result of {@link parseArgs}: either resolved options or a meta action. */\nexport type ParsedArgs = ParsedRun | { kind: \"help\" } | { kind: \"version\" };\n\n/** Thrown on malformed input; the CLI maps this to exit code 2. */\nexport class ArgError extends Error {\n  override readonly name = \"ArgError\";\n}\n\n/** Default options, before any flags are applied. */\nexport function defaultOptions(): QscanOptions {\n  return {\n    path: \".\",\n    format: \"human\",\n    severityThreshold: \"high\",\n    source: true,\n    dependencies: true,\n    config: true,\n    ignore: [],\n    include: [],\n    noDefaultIgnores: false,\n    scanMinified: false,\n    changed: false,\n    parallel: false,\n    quiet: false,\n    noSnippets: false,\n    noConfigFile: false,\n    triage: false,\n    dryRun: false,\n  };\n}\n\n/**\n * Parse a raw argv slice (i.e. without `node` and the script path).\n *\n * @throws {ArgError} On unknown flags, missing values, or invalid enum values.\n */\n/** Default scan-cache file when `--cache` is given without a path. */\nexport const DEFAULT_CACHE_FILE = \".quantakrypto-cache.json\";\n\nexport function parseArgs(argv: readonly string[]): ParsedArgs {\n  const options = defaultOptions();\n  const explicit = new Set<ConfigurableKey>();\n  let positional: string | undefined;\n\n  // Manual index walk so flags can consume the following token as a value.\n  for (let i = 0; i < argv.length; i++) {\n    const arg = argv[i] as string;\n\n    // `--flag=value` → split into flag + inline value.\n    let inlineValue: string | undefined;\n    let flag = arg;\n    if (arg.startsWith(\"--\") && arg.includes(\"=\")) {\n      const eq = arg.indexOf(\"=\");\n      flag = arg.slice(0, eq);\n      inlineValue = arg.slice(eq + 1);\n    }\n\n    /** Consume a value for `flag`: prefer the inline `=value`, else the next token. */\n    const takeValue = (): string => {\n      if (inlineValue !== undefined) return inlineValue;\n      const next = argv[i + 1];\n      if (next === undefined || (next.startsWith(\"-\") && next !== \"-\")) {\n        throw new ArgError(`option \"${flag}\" requires a value`);\n      }\n      i++;\n      return next;\n    };\n\n    /**\n     * Reject an inline `=value` on a boolean flag. Without this, `--quiet=false`\n     * would silently ignore the value and turn the flag ON — the opposite of the\n     * caller's intent. Boolean flags take no value, so any `=value` is an error.\n     */\n    const rejectInlineValue = (): void => {\n      if (inlineValue !== undefined) {\n        throw new ArgError(`option \"${flag}\" is a boolean flag and takes no value`);\n      }\n    };\n\n    switch (flag) {\n      case \"-h\":\n      case \"--help\":\n        return { kind: \"help\" };\n      case \"-v\":\n      case \"--version\":\n        return { kind: \"version\" };\n\n      case \"--format\":\n        options.format = asFormat(takeValue());\n        break;\n      case \"--cbom\":\n        rejectInlineValue();\n        options.format = \"cbom\";\n        break;\n      case \"-o\":\n      case \"--output\":\n        options.output = takeValue();\n        break;\n      case \"--severity-threshold\":\n        options.severityThreshold = asSeverity(takeValue());\n        explicit.add(\"severityThreshold\");\n        break;\n\n      case \"--no-source\":\n        rejectInlineValue();\n        options.source = false;\n        explicit.add(\"source\");\n        break;\n      case \"--no-deps\":\n        rejectInlineValue();\n        options.dependencies = false;\n        explicit.add(\"dependencies\");\n        break;\n      case \"--no-config\":\n        rejectInlineValue();\n        options.config = false;\n        explicit.add(\"config\");\n        break;\n\n      case \"--ignore\":\n        options.ignore.push(takeValue());\n        explicit.add(\"ignore\");\n        break;\n      case \"--include\":\n        options.include.push(takeValue());\n        explicit.add(\"include\");\n        break;\n      case \"--max-file-size\":\n        options.maxFileSize = asInt(takeValue(), \"--max-file-size\");\n        explicit.add(\"maxFileSize\");\n        break;\n      case \"--top\":\n        options.topN = asInt(takeValue(), \"--top\");\n        break;\n      case \"--triage\":\n        rejectInlineValue();\n        options.triage = true;\n        break;\n      case \"--triage-floor\":\n        options.triageFloor = asSeverity(takeValue());\n        break;\n      case \"--max-findings\":\n        options.maxFindings = asInt(takeValue(), \"--max-findings\");\n        break;\n      case \"--tier\":\n        options.tier = asTier(takeValue());\n        break;\n      case \"--context\":\n        options.contextLevel = asContextLevel(takeValue());\n        break;\n      case \"--dry-run\":\n        rejectInlineValue();\n        options.dryRun = true;\n        break;\n      case \"--llm-provider\":\n        options.llmProvider = asProvider(takeValue());\n        break;\n      case \"--llm-model\":\n        options.llmModel = takeValue();\n        break;\n      case \"--cache\": {\n        // `--cache` alone uses the default file; `--cache <path>` names it.\n        if (inlineValue !== undefined) {\n          options.cacheFile = inlineValue;\n        } else {\n          const next = argv[i + 1];\n          if (next !== undefined && !(next.startsWith(\"-\") && next !== \"-\")) {\n            options.cacheFile = next;\n            i++;\n          } else {\n            options.cacheFile = DEFAULT_CACHE_FILE;\n          }\n        }\n        break;\n      }\n      case \"--no-default-ignores\":\n        rejectInlineValue();\n        options.noDefaultIgnores = true;\n        explicit.add(\"noDefaultIgnores\");\n        break;\n      case \"--scan-minified\":\n        rejectInlineValue();\n        options.scanMinified = true;\n        explicit.add(\"scanMinified\");\n        break;\n\n      // `quantakrypto.config.json` FILE controls (distinct from `--no-config`, which\n      // toggles config/TLS *detector* scanning above).\n      case \"--config\":\n        options.configFile = takeValue();\n        break;\n      case \"--no-config-file\":\n        rejectInlineValue();\n        options.noConfigFile = true;\n        break;\n\n      case \"--changed\":\n        rejectInlineValue();\n        options.changed = true;\n        break;\n      case \"--since\":\n        options.since = takeValue();\n        options.changed = true; // --since implies incremental mode\n        break;\n\n      case \"--parallel\":\n        rejectInlineValue();\n        options.parallel = true;\n        break;\n      case \"--concurrency\": {\n        const n = asInt(takeValue(), \"--concurrency\");\n        options.concurrency = n;\n        // `--concurrency 0` documents \"serial\": core treats <1 as \"auto\" (full\n        // parallelism), so without this special-case 0 would do the OPPOSITE of\n        // what's documented. 0 forces the in-process serial path; any value >= 1\n        // implies parallel.\n        options.parallel = n >= 1;\n        break;\n      }\n\n      case \"--baseline\":\n        options.baseline = takeValue();\n        explicit.add(\"baseline\");\n        break;\n      case \"--policy\":\n        options.policy = takeValue();\n        break;\n      case \"--write-baseline\":\n        options.writeBaseline = takeValue();\n        break;\n      case \"--quiet\":\n        rejectInlineValue();\n        options.quiet = true;\n        break;\n      case \"--no-snippets\":\n        rejectInlineValue();\n        options.noSnippets = true;\n        break;\n\n      default:\n        if (flag.startsWith(\"-\") && flag !== \"-\") {\n          throw new ArgError(`unknown option \"${flag}\"`);\n        }\n        if (positional !== undefined) {\n          throw new ArgError(\n            `unexpected extra argument \"${arg}\" (path already set to \"${positional}\")`,\n          );\n        }\n        positional = arg;\n        break;\n    }\n  }\n\n  if (positional !== undefined) options.path = positional;\n  return { kind: \"run\", options, explicit };\n}\n\n/** Validate/normalize a `--format` value. */\nexport function asFormat(value: string): QscanFormat {\n  if ((FORMATS as readonly string[]).includes(value)) return value as QscanFormat;\n  throw new ArgError(`invalid --format \"${value}\" (expected one of: ${FORMATS.join(\", \")})`);\n}\n\n/** Validate/normalize a `--context` level. */\nexport function asContextLevel(value: string): ContextLevel {\n  if ((CONTEXT_LEVELS as readonly string[]).includes(value)) return value as ContextLevel;\n  throw new ArgError(\n    `invalid --context \"${value}\" (expected one of: ${CONTEXT_LEVELS.join(\", \")})`,\n  );\n}\n\n/** Validate/normalize a `--tier` value. */\nexport function asTier(value: string): SecurityTier {\n  if ((SECURITY_TIERS as readonly string[]).includes(value)) return value as SecurityTier;\n  throw new ArgError(`invalid --tier \"${value}\" (expected one of: ${SECURITY_TIERS.join(\", \")})`);\n}\n\n/** Validate/normalize a `--llm-provider` value. */\nexport function asProvider(value: string): LlmProvider {\n  if ((LLM_PROVIDERS as readonly string[]).includes(value)) return value as LlmProvider;\n  throw new ArgError(\n    `invalid --llm-provider \"${value}\" (expected one of: ${LLM_PROVIDERS.join(\", \")})`,\n  );\n}\n\n/** Validate/normalize a non-negative integer flag value. */\nexport function asInt(value: string, flag: string): number {\n  if (!/^\\d+$/.test(value)) {\n    throw new ArgError(`invalid ${flag} \"${value}\" (expected a non-negative integer)`);\n  }\n  return Number.parseInt(value, 10);\n}\n\n/** Validate/normalize a severity value. */\nexport function asSeverity(value: string): Severity {\n  if ((SEVERITY_ORDER as readonly string[]).includes(value)) return value as Severity;\n  throw new ArgError(`invalid severity \"${value}\" (expected one of: ${SEVERITY_ORDER.join(\", \")})`);\n}\n"]}
+{"version":3,"file":"args.js","sourceRoot":"","sources":["../src/args.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,cAAc,EACd,cAAc,EACd,YAAY,EACZ,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAI5B,qFAAqF;AACrF,MAAM,cAAc,GAA4B,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;AAC5F,iFAAiF;AACjF,MAAM,cAAc,GAA4B,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;AAC7E,qCAAqC;AACrC,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,mBAAmB,CAAU,CAAC;AAGlE,4EAA4E;AAC5E,2EAA2E;AAC3E,iFAAiF;AACjF,wDAAwD;AACxD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC;AAWxD,MAAM,OAAO,GAA2B,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;AAmM9F,mEAAmE;AACnE,MAAM,OAAO,QAAS,SAAQ,KAAK;IACf,IAAI,GAAG,UAAU,CAAC;CACrC;AAED,qDAAqD;AACrD,MAAM,UAAU,cAAc;IAC5B,OAAO;QACL,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,OAAO;QACf,iBAAiB,EAAE,MAAM;QACzB,MAAM,EAAE,IAAI;QACZ,YAAY,EAAE,IAAI;QAClB,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,EAAE;QACX,gBAAgB,EAAE,KAAK;QACvB,YAAY,EAAE,KAAK;QACnB,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,KAAK;QACf,KAAK,EAAE,KAAK;QACZ,WAAW,EAAE,MAAM;QACnB,UAAU,EAAE,KAAK;QACjB,YAAY,EAAE,KAAK;QACnB,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,KAAK;KACZ,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,sEAAsE;AACtE,MAAM,CAAC,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AAE7D,MAAM,UAAU,SAAS,CAAC,IAAuB;IAC/C,gFAAgF;IAChF,6EAA6E;IAC7E,kEAAkE;IAClE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7C,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;gBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9D,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,IAAI;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YACpE,MAAM,IAAI,QAAQ,CAAC,+CAA+C,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACnB,MAAM,IAAI,QAAQ,CAAC,4BAA4B,GAAG,oBAAoB,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3C,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;YAAE,OAAO,MAAM,CAAC,CAAC,iCAAiC;QAC3E,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IACxD,CAAC;IAED,uDAAuD;IACvD,iEAAiE;IACjE,gEAAgE;IAChE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,gBAAgB,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7C,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;gBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9D,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,IAAI;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YACpE,MAAM,IAAI,QAAQ,CAAC,mEAAmE,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,6EAA6E;YAC7E,qEAAqE;YACrE,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;gBAAE,OAAO,MAAM,CAAC;YACzC,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QAClE,CAAC;QACD,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC3B,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC5E,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAClF,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC1E,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,QAAQ,CAAC,yDAAyD,CAAC,CAAC;YAChF,CAAC;YACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,QAAQ,CAChB,yDAAyD,WAAW,CAAC,MAAM,GAAG,CAC/E,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAW,EAAE,CAAC;QAC7E,CAAC;QACD,MAAM,IAAI,QAAQ,CAAC,sCAAsC,GAAG,8BAA8B,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,8EAA8E;AAC9E,SAAS,YAAY,CAAC,IAAuB;IAC3C,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC5C,IAAI,UAA8B,CAAC;IACnC,6EAA6E;IAC7E,IAAI,YAAY,GAAG,KAAK,CAAC;IAEzB,yEAAyE;IACzE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QAE9B,mDAAmD;QACnD,IAAI,WAA+B,CAAC;QACpC,IAAI,IAAI,GAAG,GAAG,CAAC;QACf,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACxB,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAClC,CAAC;QAED,mFAAmF;QACnF,MAAM,SAAS,GAAG,GAAW,EAAE;YAC7B,IAAI,WAAW,KAAK,SAAS;gBAAE,OAAO,WAAW,CAAC;YAClD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACjE,MAAM,IAAI,QAAQ,CAAC,WAAW,IAAI,oBAAoB,CAAC,CAAC;YAC1D,CAAC;YACD,CAAC,EAAE,CAAC;YACJ,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QAEF;;;;WAIG;QACH,MAAM,iBAAiB,GAAG,GAAS,EAAE;YACnC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,IAAI,QAAQ,CAAC,WAAW,IAAI,wCAAwC,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC,CAAC;QAEF,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,IAAI,CAAC;YACV,KAAK,QAAQ;gBACX,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC1B,KAAK,IAAI,CAAC;YACV,KAAK,WAAW;gBACd,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAE7B,KAAK,UAAU;gBACb,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;gBACvC,MAAM;YACR,KAAK,QAAQ;gBACX,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;gBACxB,MAAM;YACR,KAAK,SAAS;gBACZ,uEAAuE;gBACvE,6CAA6C;gBAC7C,CAAC,OAAO,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;gBAC9C,MAAM;YACR,KAAK,IAAI,CAAC;YACV,KAAK,UAAU;gBACb,OAAO,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;gBAC7B,MAAM;YACR,KAAK,sBAAsB;gBACzB,OAAO,CAAC,iBAAiB,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;gBACpD,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;gBAClC,MAAM;YAER,KAAK,aAAa;gBAChB,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC;gBACvB,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACvB,MAAM;YACR,KAAK,WAAW;gBACd,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,YAAY,GAAG,KAAK,CAAC;gBAC7B,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;gBAC7B,MAAM;YACR,KAAK,aAAa;gBAChB,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC;gBACvB,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACvB,MAAM;YAER,KAAK,UAAU;gBACb,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;gBACjC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACvB,MAAM;YACR,KAAK,WAAW;gBACd,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;gBAClC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACxB,MAAM;YACR,KAAK,iBAAiB;gBACpB,OAAO,CAAC,WAAW,GAAG,KAAK,CAAC,SAAS,EAAE,EAAE,iBAAiB,CAAC,CAAC;gBAC5D,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;gBAC5B,MAAM;YACR,KAAK,OAAO;gBACV,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,SAAS,EAAE,EAAE,OAAO,CAAC,CAAC;gBAC3C,MAAM;YACR,KAAK,UAAU;gBACb,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;gBACtB,MAAM;YACR,KAAK,gBAAgB;gBACnB,OAAO,CAAC,WAAW,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;gBAC9C,MAAM;YACR,KAAK,gBAAgB;gBACnB,OAAO,CAAC,WAAW,GAAG,KAAK,CAAC,SAAS,EAAE,EAAE,gBAAgB,CAAC,CAAC;gBAC3D,MAAM;YACR,KAAK,QAAQ;gBACX,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;gBACnC,MAAM;YACR,KAAK,WAAW;gBACd,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC;gBACzC,MAAM;YACR,KAAK,WAAW;gBACd,OAAO,CAAC,YAAY,GAAG,cAAc,CAAC,SAAS,EAAE,CAAC,CAAC;gBACnD,MAAM;YACR,KAAK,WAAW;gBACd,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;gBACtB,MAAM;YACR,KAAK,gBAAgB;gBACnB,OAAO,CAAC,WAAW,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;gBAC9C,MAAM;YACR,KAAK,aAAa;gBAChB,OAAO,CAAC,QAAQ,GAAG,SAAS,EAAE,CAAC;gBAC/B,MAAM;YACR,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,oEAAoE;gBACpE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;oBAC9B,OAAO,CAAC,SAAS,GAAG,WAAW,CAAC;gBAClC,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;oBACzB,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;wBAClE,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;wBACzB,CAAC,EAAE,CAAC;oBACN,CAAC;yBAAM,CAAC;wBACN,OAAO,CAAC,SAAS,GAAG,kBAAkB,CAAC;oBACzC,CAAC;gBACH,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,sBAAsB;gBACzB,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;gBAChC,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;gBACjC,MAAM;YACR,KAAK,iBAAiB;gBACpB,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;gBAC5B,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;gBAC7B,MAAM;YAER,+EAA+E;YAC/E,iDAAiD;YACjD,KAAK,UAAU;gBACb,OAAO,CAAC,UAAU,GAAG,SAAS,EAAE,CAAC;gBACjC,MAAM;YACR,KAAK,kBAAkB;gBACrB,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;gBAC5B,MAAM;YAER,KAAK,WAAW;gBACd,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;gBACvB,MAAM;YACR,KAAK,SAAS;gBACZ,OAAO,CAAC,KAAK,GAAG,SAAS,EAAE,CAAC;gBAC5B,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,mCAAmC;gBAC3D,MAAM;YAER,KAAK,YAAY;gBACf,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;gBACxB,MAAM;YACR,KAAK,eAAe,CAAC,CAAC,CAAC;gBACrB,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,EAAE,EAAE,eAAe,CAAC,CAAC;gBAC9C,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC;gBACxB,uEAAuE;gBACvE,wEAAwE;gBACxE,yEAAyE;gBACzE,oBAAoB;gBACpB,OAAO,CAAC,QAAQ,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC1B,MAAM;YACR,CAAC;YAED,KAAK,YAAY;gBACf,OAAO,CAAC,QAAQ,GAAG,SAAS,EAAE,CAAC;gBAC/B,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACzB,MAAM;YACR,KAAK,UAAU;gBACb,OAAO,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;gBAC7B,MAAM;YACR,KAAK,QAAQ;gBACX,OAAO,CAAC,IAAI,GAAG,SAAS,EAAE,CAAC;gBAC3B,MAAM;YACR,KAAK,aAAa;gBAChB,OAAO,CAAC,SAAS,GAAG,SAAS,EAAE,CAAC;gBAChC,MAAM;YACR,KAAK,kBAAkB;gBACrB,OAAO,CAAC,aAAa,GAAG,SAAS,EAAE,CAAC;gBACpC,MAAM;YACR,KAAK,SAAS;gBACZ,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;gBACrB,MAAM;YACR,KAAK,SAAS;gBACZ,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,WAAW,GAAG,QAAQ,CAAC;gBAC/B,MAAM;YACR,KAAK,YAAY;gBACf,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,WAAW,GAAG,OAAO,CAAC;gBAC9B,MAAM;YACR,KAAK,eAAe;gBAClB,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;gBAC1B,MAAM;YACR,KAAK,QAAQ;gBACX,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;gBACpB,MAAM;YAER,gEAAgE;YAChE,KAAK,kBAAkB;gBACrB,iBAAiB,EAAE,CAAC;gBACpB,YAAY,GAAG,IAAI,CAAC;gBACpB,MAAM;YACR,KAAK,eAAe;gBAClB,OAAO,CAAC,WAAW,GAAG,SAAS,EAAE,CAAC;gBAClC,MAAM;YACR,KAAK,cAAc;gBACjB,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC9B,MAAM;YACR,KAAK,iBAAiB;gBACpB,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,cAAc,GAAG,KAAK,CAAC;gBAC/B,MAAM;YAER;gBACE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;oBACzC,MAAM,IAAI,QAAQ,CAAC,mBAAmB,IAAI,GAAG,CAAC,CAAC;gBACjD,CAAC;gBACD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC7B,MAAM,IAAI,QAAQ,CAChB,8BAA8B,GAAG,2BAA2B,UAAU,IAAI,CAC3E,CAAC;gBACJ,CAAC;gBACD,UAAU,GAAG,GAAG,CAAC;gBACjB,MAAM;QACV,CAAC;IACH,CAAC;IAED,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,GAAG,UAAU,CAAC;IACxD,iFAAiF;IACjF,mEAAmE;IACnE,IAAI,YAAY;QAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,CAAC;IAClE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC5C,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,IAAK,OAA6B,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAoB,CAAC;IAChF,MAAM,IAAI,QAAQ,CAAC,qBAAqB,KAAK,uBAAuB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7F,CAAC;AAED,8CAA8C;AAC9C,SAAS,cAAc,CAAC,KAAa;IACnC,IAAK,cAAoC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAqB,CAAC;IACxF,MAAM,IAAI,QAAQ,CAChB,sBAAsB,KAAK,uBAAuB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC/E,CAAC;AACJ,CAAC;AAED,2CAA2C;AAC3C,SAAS,MAAM,CAAC,KAAa;IAC3B,IAAK,cAAoC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAqB,CAAC;IACxF,MAAM,IAAI,QAAQ,CAAC,mBAAmB,KAAK,uBAAuB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClG,CAAC;AAED,2EAA2E;AAC3E,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,GAAG,GAAG,mBAAmB,EAAE,CAAC;IAClC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,MAAM,IAAI,QAAQ,CAAC,sBAAsB,KAAK,uBAAuB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1F,CAAC;AAED,mDAAmD;AACnD,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAK,aAAmC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAoB,CAAC;IACtF,MAAM,IAAI,QAAQ,CAChB,2BAA2B,KAAK,uBAAuB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACnF,CAAC;AACJ,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,KAAK,CAAC,KAAa,EAAE,IAAY;IAC/C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,QAAQ,CAAC,WAAW,IAAI,KAAK,KAAK,qCAAqC,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,IAAK,cAAoC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAiB,CAAC;IACpF,MAAM,IAAI,QAAQ,CAAC,qBAAqB,KAAK,uBAAuB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpG,CAAC","sourcesContent":["/**\n * Zero-dependency command-line argument parsing for qScan.\n *\n * Hand-rolled rather than pulled from a library to keep the package free of\n * runtime dependencies. The grammar is deliberately small: long flags\n * (`--flag`, `--flag value`, `--flag=value`), a couple of short aliases\n * (`-o`, `-v`, `-h`), repeatable `--ignore`, and a single optional positional\n * path. Unknown flags are a usage error.\n */\n\nimport {\n  meetsThreshold,\n  SEVERITY_ORDER,\n  severityRank,\n  standardsProfileIds,\n} from \"@quantakrypto/core\";\nimport type { ContextLevel, ReportFormat, SecurityTier, Severity } from \"@quantakrypto/core\";\nimport type { ColorChoice } from \"./color.js\";\n\n/** Valid context levels for `--context` (how much source triage/remediate sends). */\nconst CONTEXT_LEVELS: readonly ContextLevel[] = [\"metadata\", \"snippet\", \"function\", \"file\"];\n/** Valid CNSA security tiers for `--tier` (report migration-target guidance). */\nconst SECURITY_TIERS: readonly SecurityTier[] = [\"category-3\", \"category-5\"];\n/** Valid `--llm-provider` values. */\nconst LLM_PROVIDERS = [\"anthropic\", \"openai-compatible\"] as const;\nexport type LlmProvider = (typeof LLM_PROVIDERS)[number];\n\n// Severity ordering, ranking, and threshold logic are the monorepo's single\n// source of truth in `@quantakrypto/core`. Re-export them here so existing\n// `@quantakrypto/qscan` callers (and tests) keep importing them from `./args.js`\n// without qScan maintaining a second, drift-prone copy.\nexport { meetsThreshold, SEVERITY_ORDER, severityRank };\n\n/**\n * Output formats qScan accepts on the command line. Extends core's\n * {@link ReportFormat} with `\"cbom\"` (a CycloneDX cryptographic bill of\n * materials), `\"evidence\"` (ISO A.8.24 readiness report), and `\"vex\"` (an\n * OpenVEX 0.2.0 document) — all rendered locally via core (`toCbom`,\n * `buildReadinessReport`, `toOpenVex`).\n */\nexport type QscanFormat = ReportFormat | \"cbom\" | \"evidence\" | \"vex\";\n\nconst FORMATS: readonly QscanFormat[] = [\"human\", \"json\", \"sarif\", \"cbom\", \"evidence\", \"vex\"];\n\n/** Fully-resolved options the CLI/programmatic runner operates on. */\nexport interface QscanOptions {\n  /** Directory or file to scan. */\n  path: string;\n  /** Report format. */\n  format: QscanFormat;\n  /** Write the report to this file instead of stdout, when set. */\n  output?: string;\n  /** External CBOM files to merge into the `--cbom` output (CycloneDX bom-link). */\n  mergeCboms?: string[];\n  /** Findings at or above this severity cause a non-zero exit. */\n  severityThreshold: Severity;\n  /** Scan source files for inline crypto usage. */\n  source: boolean;\n  /** Scan dependency manifests for vulnerable libraries. */\n  dependencies: boolean;\n  /** Scan config files (TLS/certificates). */\n  config: boolean;\n  /** Extra exclude patterns (repeatable `--ignore`). */\n  ignore: string[];\n  /**\n   * Restrict the walk to paths matching one of these include patterns\n   * (repeatable `--include`). When empty, every non-excluded file is scanned.\n   */\n  include: string[];\n  /** Max file size to read, in bytes (`--max-file-size`). */\n  maxFileSize?: number;\n  /** Disable the built-in ignore list (`--no-default-ignores`). */\n  noDefaultIgnores: boolean;\n  /** Scan minified/generated/bundled files instead of skipping them. */\n  scanMinified: boolean;\n  /**\n   * Incremental mode: scan only the files git reports as changed\n   * (`--changed`), optionally relative to {@link since}.\n   */\n  changed: boolean;\n  /** Git ref/range the `--changed` diff is taken against (`--since`). */\n  since?: string;\n  /** Route the scan through core's worker-thread pool (`--parallel`). */\n  parallel: boolean;\n  /**\n   * Worker count for parallel scanning (`--concurrency`). Implies parallel.\n   * A value of 0 or 1 forces the in-process serial path.\n   */\n  concurrency?: number;\n  /** Suppress findings whose fingerprint is in this baseline file. */\n  baseline?: string;\n  /** Write current findings as a baseline to this file, then exit 0. */\n  writeBaseline?: string;\n  /** Suppress the human summary banner (still writes reports/output files). */\n  quiet: boolean;\n  /**\n   * ANSI color policy for the human report (`--color` / `--no-color`). `\"auto\"`\n   * (default) colors only a live terminal and honors `NO_COLOR` / `FORCE_COLOR`;\n   * see {@link resolveColor}. Color is decoration only — never the sole signal.\n   */\n  colorChoice: ColorChoice;\n  /** How many findings the human report lists (`--top N`). Default: 5. */\n  topN?: number;\n  /** Rule ids to suppress (from `quantakrypto.config.json` `disabledRules`). */\n  disabledRules?: string[];\n  /** Content-hash scan cache path (`--cache [path]`); reuse unchanged files. */\n  cacheFile?: string;\n  /** Run the BYOK LLM triage pass (`--triage`): annotate + re-sort, never suppress. */\n  triage: boolean;\n  /** Only triage findings at/above this seriousness (`--triage-floor`). Default: medium. */\n  triageFloor?: Severity;\n  /** Cap findings sent to the LLM during triage (`--max-findings`; spend guard). */\n  maxFindings?: number;\n  /** CNSA security tier for the migration-targets footer (`--tier`). Default: none. */\n  tier?: SecurityTier;\n  /**\n   * Standards regime the migration guidance is tailored to (`--profile`): one of the\n   * built-in ids (nist / cnsa-2.0 / bsi-tr-02102 / anssi / uk-ncsc). Default: none\n   * (`--tier` maps to a profile for back-compat). Governs parameter sets, deadlines,\n   * and the hybrid stance surfaced in remediation.\n   */\n  profile?: string;\n  /** Org cryptography policy file (`--policy`) for the evidence report's §4 verdicts. */\n  policy?: string;\n  /**\n   * External signer command for the evidence attestation (`--sign`). The report's\n   * contentHash is piped to it on stdin; its stdout is recorded as the detached\n   * signature. Only valid with `--format evidence`.\n   */\n  sign?: string;\n  /** External RFC-3161 timestamper command for the evidence attestation (`--timestamp`). */\n  timestamp?: string;\n  /** How much source context leaves the machine (`--context`). Default: snippet. */\n  contextLevel?: ContextLevel;\n  /** Print the exact triage payload and exit without calling the provider (`--dry-run`). */\n  dryRun: boolean;\n  /** BYOK provider (`--llm-provider`). Default: anthropic. */\n  llmProvider?: LlmProvider;\n  /** BYOK model id (`--llm-model`). */\n  llmModel?: string;\n  /**\n   * Omit code snippets from the JSON/SARIF report (`--no-snippets`). Passed to\n   * core's reporters as `{ redactSnippets: true }`. Snippets of `sensitive`\n   * findings are always omitted regardless of this flag.\n   */\n  noSnippets: boolean;\n  /**\n   * Explicit path to a `quantakrypto.config.json` (`--config <path>`). Overrides\n   * auto-discovery at the scan root. Distinct from `--no-config`, which toggles\n   * config/TLS *detector* scanning — this names the config FILE.\n   */\n  configFile?: string;\n  /**\n   * Disable `quantakrypto.config.json` auto-discovery (`--no-config-file`). Distinct\n   * from `--no-config` (which skips config-file *detectors*).\n   */\n  noConfigFile: boolean;\n  /**\n   * Compute + emit HNDL (harvest-now-decrypt-later) exposure (`--hndl`). Reads\n   * `hndl.yml` at the scan root, scores each finding + a repo summary, and adds\n   * the exposure fields to the JSON / SARIF report. Additive: never changes the\n   * exit code. See docs/HNDL.md.\n   */\n  hndl: boolean;\n  /**\n   * URL to a posture credential recorded in a crypto-agility manifest\n   * (`--attestation`). Only consumed by `crypto-agility emit`; recorded verbatim,\n   * never fetched (offline boundary). See docs/CRYPTO-AGILITY-MANIFEST.md.\n   */\n  attestation?: string;\n  /**\n   * Operator assertion of hybrid post-quantum key exchange for a crypto-agility\n   * manifest (`--hybrid-kex` → true, `--no-hybrid-kex` → false). Left undefined,\n   * the manifest reports `hybridKexInUse: null` (a static scan cannot observe a\n   * negotiated TLS group). Only consumed by `crypto-agility emit`.\n   */\n  hybridKexInUse?: boolean;\n}\n\n/**\n * Option keys that a `quantakrypto.config.json` may also set. When such a key was set\n * by a CLI flag, the flag wins (precedence: flags > config > defaults); when it\n * was left at its default, config may fill it. {@link parseArgs} records which\n * of these keys came from an explicit flag in {@link ParsedRun.explicit}.\n */\nexport type ConfigurableKey =\n  | \"severityThreshold\"\n  | \"source\"\n  | \"dependencies\"\n  | \"config\"\n  | \"include\"\n  | \"ignore\"\n  | \"maxFileSize\"\n  | \"noDefaultIgnores\"\n  | \"scanMinified\"\n  | \"baseline\";\n\n/** A successful parse: resolved options plus which configurable keys were explicit. */\nexport interface ParsedRun {\n  kind: \"run\";\n  options: QscanOptions;\n  /** The set of {@link ConfigurableKey}s the user set via a flag. */\n  explicit: Set<ConfigurableKey>;\n}\n\n/** The `qscan hndl init` subcommand: scaffold an `hndl.yml`. */\nexport interface ParsedHndlInit {\n  kind: \"hndl-init\";\n  options: QscanOptions;\n}\n\n/**\n * Emit a crypto-agility manifest: either `qscan crypto-agility emit [path]` or the\n * `--crypto-agility` flag on a normal scan. Additive: it always exits 0, never\n * consulting the severity threshold.\n */\nexport interface ParsedCryptoAgilityEmit {\n  kind: \"crypto-agility-emit\";\n  options: QscanOptions;\n}\n\n/** Validate a local manifest file: `qscan crypto-agility validate <file>`. */\nexport interface ParsedCryptoAgilityValidate {\n  kind: \"crypto-agility-validate\";\n  /** Path to the manifest JSON file to check. */\n  file: string;\n}\n\n/** Result of {@link parseArgs}: either resolved options or a meta action. */\nexport type ParsedArgs =\n  | ParsedRun\n  | ParsedHndlInit\n  | ParsedCryptoAgilityEmit\n  | ParsedCryptoAgilityValidate\n  | { kind: \"help\" }\n  | { kind: \"version\" };\n\n/** Thrown on malformed input; the CLI maps this to exit code 2. */\nexport class ArgError extends Error {\n  override readonly name = \"ArgError\";\n}\n\n/** Default options, before any flags are applied. */\nexport function defaultOptions(): QscanOptions {\n  return {\n    path: \".\",\n    format: \"human\",\n    severityThreshold: \"high\",\n    source: true,\n    dependencies: true,\n    config: true,\n    ignore: [],\n    include: [],\n    noDefaultIgnores: false,\n    scanMinified: false,\n    changed: false,\n    parallel: false,\n    quiet: false,\n    colorChoice: \"auto\",\n    noSnippets: false,\n    noConfigFile: false,\n    triage: false,\n    dryRun: false,\n    hndl: false,\n  };\n}\n\n/**\n * Parse a raw argv slice (i.e. without `node` and the script path).\n *\n * @throws {ArgError} On unknown flags, missing values, or invalid enum values.\n */\n/** Default scan-cache file when `--cache` is given without a path. */\nexport const DEFAULT_CACHE_FILE = \".quantakrypto-cache.json\";\n\nexport function parseArgs(argv: readonly string[]): ParsedArgs {\n  // Subcommand dispatch: `qscan hndl <sub> …`. Only `init` exists today. `--help`\n  // / `--version` anywhere still short-circuit to the meta actions (handled by\n  // the shared loop below), so `qscan hndl init --help` shows help.\n  if (argv[0] === \"hndl\") {\n    const sub = argv[1];\n    if (sub === undefined || sub.startsWith(\"-\")) {\n      if (sub === \"--help\" || sub === \"-h\") return { kind: \"help\" };\n      if (sub === \"--version\" || sub === \"-v\") return { kind: \"version\" };\n      throw new ArgError(`\"hndl\" requires a subcommand (expected: init)`);\n    }\n    if (sub !== \"init\") {\n      throw new ArgError(`unknown hndl subcommand \"${sub}\" (expected: init)`);\n    }\n    const parsed = parseRunArgs(argv.slice(2));\n    if (parsed.kind !== \"run\") return parsed; // --help / --version passthrough\n    return { kind: \"hndl-init\", options: parsed.options };\n  }\n\n  // Subcommand dispatch: `qscan crypto-agility <sub> …`.\n  //   emit [path]       derive + write a manifest (always exits 0)\n  //   validate <file>   check a local manifest against the schema\n  if (argv[0] === \"crypto-agility\") {\n    const sub = argv[1];\n    if (sub === undefined || sub.startsWith(\"-\")) {\n      if (sub === \"--help\" || sub === \"-h\") return { kind: \"help\" };\n      if (sub === \"--version\" || sub === \"-v\") return { kind: \"version\" };\n      throw new ArgError(`\"crypto-agility\" requires a subcommand (expected: emit, validate)`);\n    }\n    if (sub === \"emit\") {\n      const parsed = parseRunArgs(argv.slice(2));\n      // `--help`/`--version` short-circuit; a redundant `--crypto-agility` flag on\n      // the emit subcommand already yields the emit kind (returned as-is).\n      if (parsed.kind !== \"run\") return parsed;\n      return { kind: \"crypto-agility-emit\", options: parsed.options };\n    }\n    if (sub === \"validate\") {\n      const rest = argv.slice(2);\n      if (rest.includes(\"--help\") || rest.includes(\"-h\")) return { kind: \"help\" };\n      if (rest.includes(\"--version\") || rest.includes(\"-v\")) return { kind: \"version\" };\n      const positionals = rest.filter((a) => !(a.startsWith(\"-\") && a !== \"-\"));\n      if (positionals.length === 0) {\n        throw new ArgError(`\"crypto-agility validate\" requires a manifest file path`);\n      }\n      if (positionals.length > 1) {\n        throw new ArgError(\n          `\"crypto-agility validate\" takes exactly one file (got ${positionals.length})`,\n        );\n      }\n      return { kind: \"crypto-agility-validate\", file: positionals[0] as string };\n    }\n    throw new ArgError(`unknown crypto-agility subcommand \"${sub}\" (expected: emit, validate)`);\n  }\n  return parseRunArgs(argv);\n}\n\n/** Parse the run-mode grammar (flags + a single optional positional path). */\nfunction parseRunArgs(argv: readonly string[]): ParsedArgs {\n  const options = defaultOptions();\n  const explicit = new Set<ConfigurableKey>();\n  let positional: string | undefined;\n  // Set by `--crypto-agility`: the whole run becomes a manifest emit (exit 0).\n  let emitManifest = false;\n\n  // Manual index walk so flags can consume the following token as a value.\n  for (let i = 0; i < argv.length; i++) {\n    const arg = argv[i] as string;\n\n    // `--flag=value` → split into flag + inline value.\n    let inlineValue: string | undefined;\n    let flag = arg;\n    if (arg.startsWith(\"--\") && arg.includes(\"=\")) {\n      const eq = arg.indexOf(\"=\");\n      flag = arg.slice(0, eq);\n      inlineValue = arg.slice(eq + 1);\n    }\n\n    /** Consume a value for `flag`: prefer the inline `=value`, else the next token. */\n    const takeValue = (): string => {\n      if (inlineValue !== undefined) return inlineValue;\n      const next = argv[i + 1];\n      if (next === undefined || (next.startsWith(\"-\") && next !== \"-\")) {\n        throw new ArgError(`option \"${flag}\" requires a value`);\n      }\n      i++;\n      return next;\n    };\n\n    /**\n     * Reject an inline `=value` on a boolean flag. Without this, `--quiet=false`\n     * would silently ignore the value and turn the flag ON — the opposite of the\n     * caller's intent. Boolean flags take no value, so any `=value` is an error.\n     */\n    const rejectInlineValue = (): void => {\n      if (inlineValue !== undefined) {\n        throw new ArgError(`option \"${flag}\" is a boolean flag and takes no value`);\n      }\n    };\n\n    switch (flag) {\n      case \"-h\":\n      case \"--help\":\n        return { kind: \"help\" };\n      case \"-v\":\n      case \"--version\":\n        return { kind: \"version\" };\n\n      case \"--format\":\n        options.format = asFormat(takeValue());\n        break;\n      case \"--cbom\":\n        rejectInlineValue();\n        options.format = \"cbom\";\n        break;\n      case \"--merge\":\n        // Merge an external CBOM (e.g. a qprobe endpoint CBOM) into the --cbom\n        // output via CycloneDX bom-link. Repeatable.\n        (options.mergeCboms ??= []).push(takeValue());\n        break;\n      case \"-o\":\n      case \"--output\":\n        options.output = takeValue();\n        break;\n      case \"--severity-threshold\":\n        options.severityThreshold = asSeverity(takeValue());\n        explicit.add(\"severityThreshold\");\n        break;\n\n      case \"--no-source\":\n        rejectInlineValue();\n        options.source = false;\n        explicit.add(\"source\");\n        break;\n      case \"--no-deps\":\n        rejectInlineValue();\n        options.dependencies = false;\n        explicit.add(\"dependencies\");\n        break;\n      case \"--no-config\":\n        rejectInlineValue();\n        options.config = false;\n        explicit.add(\"config\");\n        break;\n\n      case \"--ignore\":\n        options.ignore.push(takeValue());\n        explicit.add(\"ignore\");\n        break;\n      case \"--include\":\n        options.include.push(takeValue());\n        explicit.add(\"include\");\n        break;\n      case \"--max-file-size\":\n        options.maxFileSize = asInt(takeValue(), \"--max-file-size\");\n        explicit.add(\"maxFileSize\");\n        break;\n      case \"--top\":\n        options.topN = asInt(takeValue(), \"--top\");\n        break;\n      case \"--triage\":\n        rejectInlineValue();\n        options.triage = true;\n        break;\n      case \"--triage-floor\":\n        options.triageFloor = asSeverity(takeValue());\n        break;\n      case \"--max-findings\":\n        options.maxFindings = asInt(takeValue(), \"--max-findings\");\n        break;\n      case \"--tier\":\n        options.tier = asTier(takeValue());\n        break;\n      case \"--profile\":\n        options.profile = asProfile(takeValue());\n        break;\n      case \"--context\":\n        options.contextLevel = asContextLevel(takeValue());\n        break;\n      case \"--dry-run\":\n        rejectInlineValue();\n        options.dryRun = true;\n        break;\n      case \"--llm-provider\":\n        options.llmProvider = asProvider(takeValue());\n        break;\n      case \"--llm-model\":\n        options.llmModel = takeValue();\n        break;\n      case \"--cache\": {\n        // `--cache` alone uses the default file; `--cache <path>` names it.\n        if (inlineValue !== undefined) {\n          options.cacheFile = inlineValue;\n        } else {\n          const next = argv[i + 1];\n          if (next !== undefined && !(next.startsWith(\"-\") && next !== \"-\")) {\n            options.cacheFile = next;\n            i++;\n          } else {\n            options.cacheFile = DEFAULT_CACHE_FILE;\n          }\n        }\n        break;\n      }\n      case \"--no-default-ignores\":\n        rejectInlineValue();\n        options.noDefaultIgnores = true;\n        explicit.add(\"noDefaultIgnores\");\n        break;\n      case \"--scan-minified\":\n        rejectInlineValue();\n        options.scanMinified = true;\n        explicit.add(\"scanMinified\");\n        break;\n\n      // `quantakrypto.config.json` FILE controls (distinct from `--no-config`, which\n      // toggles config/TLS *detector* scanning above).\n      case \"--config\":\n        options.configFile = takeValue();\n        break;\n      case \"--no-config-file\":\n        rejectInlineValue();\n        options.noConfigFile = true;\n        break;\n\n      case \"--changed\":\n        rejectInlineValue();\n        options.changed = true;\n        break;\n      case \"--since\":\n        options.since = takeValue();\n        options.changed = true; // --since implies incremental mode\n        break;\n\n      case \"--parallel\":\n        rejectInlineValue();\n        options.parallel = true;\n        break;\n      case \"--concurrency\": {\n        const n = asInt(takeValue(), \"--concurrency\");\n        options.concurrency = n;\n        // `--concurrency 0` documents \"serial\": core treats <1 as \"auto\" (full\n        // parallelism), so without this special-case 0 would do the OPPOSITE of\n        // what's documented. 0 forces the in-process serial path; any value >= 1\n        // implies parallel.\n        options.parallel = n >= 1;\n        break;\n      }\n\n      case \"--baseline\":\n        options.baseline = takeValue();\n        explicit.add(\"baseline\");\n        break;\n      case \"--policy\":\n        options.policy = takeValue();\n        break;\n      case \"--sign\":\n        options.sign = takeValue();\n        break;\n      case \"--timestamp\":\n        options.timestamp = takeValue();\n        break;\n      case \"--write-baseline\":\n        options.writeBaseline = takeValue();\n        break;\n      case \"--quiet\":\n        rejectInlineValue();\n        options.quiet = true;\n        break;\n      case \"--color\":\n        rejectInlineValue();\n        options.colorChoice = \"always\";\n        break;\n      case \"--no-color\":\n        rejectInlineValue();\n        options.colorChoice = \"never\";\n        break;\n      case \"--no-snippets\":\n        rejectInlineValue();\n        options.noSnippets = true;\n        break;\n      case \"--hndl\":\n        rejectInlineValue();\n        options.hndl = true;\n        break;\n\n      // Crypto-agility manifest controls (see `crypto-agility emit`).\n      case \"--crypto-agility\":\n        rejectInlineValue();\n        emitManifest = true;\n        break;\n      case \"--attestation\":\n        options.attestation = takeValue();\n        break;\n      case \"--hybrid-kex\":\n        rejectInlineValue();\n        options.hybridKexInUse = true;\n        break;\n      case \"--no-hybrid-kex\":\n        rejectInlineValue();\n        options.hybridKexInUse = false;\n        break;\n\n      default:\n        if (flag.startsWith(\"-\") && flag !== \"-\") {\n          throw new ArgError(`unknown option \"${flag}\"`);\n        }\n        if (positional !== undefined) {\n          throw new ArgError(\n            `unexpected extra argument \"${arg}\" (path already set to \"${positional}\")`,\n          );\n        }\n        positional = arg;\n        break;\n    }\n  }\n\n  if (positional !== undefined) options.path = positional;\n  // `--crypto-agility` turns the whole run into a manifest emit, taking it off the\n  // findings-threshold exit path entirely (the emit always exits 0).\n  if (emitManifest) return { kind: \"crypto-agility-emit\", options };\n  return { kind: \"run\", options, explicit };\n}\n\n/** Validate/normalize a `--format` value. */\nexport function asFormat(value: string): QscanFormat {\n  if ((FORMATS as readonly string[]).includes(value)) return value as QscanFormat;\n  throw new ArgError(`invalid --format \"${value}\" (expected one of: ${FORMATS.join(\", \")})`);\n}\n\n/** Validate/normalize a `--context` level. */\nfunction asContextLevel(value: string): ContextLevel {\n  if ((CONTEXT_LEVELS as readonly string[]).includes(value)) return value as ContextLevel;\n  throw new ArgError(\n    `invalid --context \"${value}\" (expected one of: ${CONTEXT_LEVELS.join(\", \")})`,\n  );\n}\n\n/** Validate/normalize a `--tier` value. */\nfunction asTier(value: string): SecurityTier {\n  if ((SECURITY_TIERS as readonly string[]).includes(value)) return value as SecurityTier;\n  throw new ArgError(`invalid --tier \"${value}\" (expected one of: ${SECURITY_TIERS.join(\", \")})`);\n}\n\n/** Validate a `--profile` value against the built-in standards regimes. */\nfunction asProfile(value: string): string {\n  const ids = standardsProfileIds();\n  if (ids.includes(value)) return value;\n  throw new ArgError(`invalid --profile \"${value}\" (expected one of: ${ids.join(\", \")})`);\n}\n\n/** Validate/normalize a `--llm-provider` value. */\nfunction asProvider(value: string): LlmProvider {\n  if ((LLM_PROVIDERS as readonly string[]).includes(value)) return value as LlmProvider;\n  throw new ArgError(\n    `invalid --llm-provider \"${value}\" (expected one of: ${LLM_PROVIDERS.join(\", \")})`,\n  );\n}\n\n/** Validate/normalize a non-negative integer flag value. */\nexport function asInt(value: string, flag: string): number {\n  if (!/^\\d+$/.test(value)) {\n    throw new ArgError(`invalid ${flag} \"${value}\" (expected a non-negative integer)`);\n  }\n  return Number.parseInt(value, 10);\n}\n\n/** Validate/normalize a severity value. */\nexport function asSeverity(value: string): Severity {\n  if ((SEVERITY_ORDER as readonly string[]).includes(value)) return value as Severity;\n  throw new ArgError(`invalid severity \"${value}\" (expected one of: ${SEVERITY_ORDER.join(\", \")})`);\n}\n"]}

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;GAQG;AAgBH,2EAA2E;AAC3E,wBAAsB,IAAI,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAsGnE"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;GAQG;AAuBH,2EAA2E;AAC3E,wBAAsB,IAAI,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAmMnE"}