candor-ts 0.5.14 → 0.5.15

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/package.json +1 -1
  2. package/scan-core.mjs +4 -1
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "candor-ts",
3
- "version": "0.5.14",
3
+ "version": "0.5.15",
4
4
  "description": "candor for TypeScript — per-function side effects, transitively, with a policy gate (candor-spec 0.5)",
5
5
  "type": "module",
6
6
  "dependencies": {
package/scan-core.mjs CHANGED
@@ -74,7 +74,10 @@ export const KAPPA_RULES = [
74
74
  // entropy: node:crypto's random surface + the password-hashing libs (salted -> Rand). Found by
75
75
  // the CTA dogfood on a Nest app: argon2.hash came out SILENTLY PURE (the curated-kappa caveat
76
76
  // landing on exactly the call a security review cares about).
77
- [/^(node:)?crypto$/, /^(random|getRandomValues)/, "Rand"],
77
+ // `generateKey*`/`generateKeyPair*`/`generatePrime*` draw from the CSPRNG just like `random*` — they
78
+ // were silently pure inside the covered `crypto` module (the κ-coverage floor can't tell an unmodeled
79
+ // entropy draw from a pure unmodeled member; the fix is to MODEL the member, not drop coverage).
80
+ [/^(node:)?crypto$/, /^(random|getRandomValues|generateKey|generatePrime)/, "Rand"],
78
81
  // node:os identity reads — userInfo (the OS user record) and hostname (the machine name) are
79
82
  // environment/host reads (Env), like System.getenv's host-identity cousins. The rest of node:os
80
83
  // (platform/arch/cpus/totalmem/…) is inert host introspection, left pure.