cryptoserve 0.1.1 → 0.1.3

package/lib/pqc-engine.mjs

@@ -487,7 +487,15 @@ function calculateQuantumScore(libraries, classifications) {
 
   if (total === 0) return 100.0;
 
-  let score = (safe / total) * 100;
+  // Two scoring approaches:
+  // - Ratio: safe / total (good for large samples)
+  // - Penalty: 100 - 30 per vulnerable (good for small samples)
+  // Small samples (≤3 algorithms) produce extreme ratios (1/1 = 0% or 100%),
+  // so use whichever approach gives the more representative score.
+  const ratioScore = (safe / total) * 100;
+  const penaltyScore = Math.max(0, 100 - vulnerable * 30);
+  let score = total <= 3 ? Math.max(ratioScore, penaltyScore) : ratioScore;
+
   if (classifications.some(c => c.category === 'pqc')) {
     score = Math.min(100, score + 20);
   }

package/lib/scanner.mjs

@@ -51,9 +51,15 @@ const IMPORT_PATTERNS = [
   { pattern: /createDecipheriv\s*\(/g, lib: 'node:crypto', detail: 'cipher' },
   { pattern: /createSign\s*\(/g, lib: 'node:crypto', detail: 'signature' },
   { pattern: /createVerify\s*\(/g, lib: 'node:crypto', detail: 'signature' },
+  { pattern: /createHash\s*\(/g, lib: 'node:crypto', detail: 'hash' },
+  { pattern: /createHmac\s*\(/g, lib: 'node:crypto', detail: 'hmac' },
   { pattern: /generateKeyPair(?:Sync)?\s*\(/g, lib: 'node:crypto', detail: 'keygen' },
+  { pattern: /createDiffieHellman(?:Group)?\s*\(/g, lib: 'node:crypto', detail: 'keyagreement' },
+  { pattern: /createECDH\s*\(/g, lib: 'node:crypto', detail: 'keyagreement' },
   { pattern: /scrypt(?:Sync)?\s*\(/g, lib: 'node:crypto', detail: 'kdf' },
   { pattern: /pbkdf2(?:Sync)?\s*\(/g, lib: 'node:crypto', detail: 'kdf' },
+  { pattern: /randomBytes\s*\(/g, lib: 'node:crypto', detail: 'random' },
+  { pattern: /randomUUID\s*\(/g, lib: 'node:crypto', detail: 'random' },
   { pattern: /createCipher\s*\(/g, lib: 'node:crypto', detail: 'DEPRECATED-no-iv' },
   { pattern: /CryptoJS\./g, lib: 'crypto-js' },
   { pattern: /forge\.\w+/g, lib: 'node-forge' },
@@ -69,6 +75,10 @@ const ALGO_LITERALS = [
   { pattern: /['"`]sha(?:256|384|512|1)['"`]/gi, algo: 'SHA-256' },
   { pattern: /['"`](?:HS|RS|ES|PS)(?:256|384|512)['"`]/gi, algo: 'RS256' },
   { pattern: /['"`]ed25519['"`]/gi, algo: 'Ed25519' },
+  { pattern: /['"`]x25519['"`]/gi, algo: 'X25519' },
+  { pattern: /['"`](?:ecdsa|ecdh|ec|secp256k1|secp384r1|prime256v1)['"`]/gi, algo: 'ECDSA' },
+  { pattern: /['"`](?:rsa|rsa-pss)['"`]/gi, algo: 'RSA' },
+  { pattern: /['"`](?:dsa)['"`]/gi, algo: 'DSA' },
   { pattern: /minVersion:\s*['"`]TLSv1\.[0-3]['"`]/g, algo: 'TLS' },
   { pattern: /['"`](?:md5|MD5)['"`]/g, algo: 'MD5' },
   { pattern: /['"`](?:des|DES|3des|3DES|des-ede3)['"`]/gi, algo: 'DES' },
@@ -169,9 +179,26 @@ export function scanProject(projectDir) {
     filesScanned: 0,
   };
 
-  // 1. Scan package.json for crypto dependencies
-  const pkgPath = join(projectDir, 'package.json');
-  if (existsSync(pkgPath)) {
+  // 1. Scan package.json for crypto dependencies (root + monorepo workspaces)
+  const pkgPaths = [join(projectDir, 'package.json')];
+  // Check common monorepo locations for nested package.json files
+  const monorepoGlobs = ['apps', 'packages', 'libs', 'modules', 'services'];
+  for (const sub of monorepoGlobs) {
+    const subDir = join(projectDir, sub);
+    try {
+      const entries = readdirSync(subDir, { withFileTypes: true });
+      for (const entry of entries) {
+        if (entry.isDirectory()) {
+          const nested = join(subDir, entry.name, 'package.json');
+          if (existsSync(nested)) pkgPaths.push(nested);
+        }
+      }
+    } catch { /* dir doesn't exist */ }
+  }
+
+  const seenPkgs = new Set();
+  for (const pkgPath of pkgPaths) {
+    if (!existsSync(pkgPath)) continue;
     try {
       const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));
       const allDeps = {
@@ -180,7 +207,8 @@ export function scanProject(projectDir) {
       };
 
       for (const [name, version] of Object.entries(allDeps)) {
-        if (name in CRYPTO_PACKAGES) {
+        if (name in CRYPTO_PACKAGES && !seenPkgs.has(name)) {
+          seenPkgs.add(name);
           const info = CRYPTO_PACKAGES[name];
           results.libraries.push({
             name,
@@ -188,7 +216,7 @@ export function scanProject(projectDir) {
             algorithms: info.algorithms,
             quantumRisk: info.quantumRisk,
             category: info.category,
-            source: 'package.json',
+            source: pkgPath.replace(projectDir + '/', ''),
           });
         }
       }
@@ -281,11 +309,17 @@ export function scanProject(projectDir) {
     if (seenImports.has('node:crypto:') || seenImports.has('node:crypto:cipher')) {
       if (!nodeCryptoAlgos.includes('AES')) nodeCryptoAlgos.push('AES');
     }
+    if (seenImports.has('node:crypto:') || seenImports.has('node:crypto:hash') || seenImports.has('node:crypto:hmac')) {
+      if (!nodeCryptoAlgos.includes('SHA-256')) nodeCryptoAlgos.push('SHA-256');
+    }
     if (seenImports.has('node:crypto:signature')) {
       if (!nodeCryptoAlgos.includes('RSA')) nodeCryptoAlgos.push('RSA');
     }
+    if (seenImports.has('node:crypto:keygen') || seenImports.has('node:crypto:keyagreement')) {
+      if (!nodeCryptoAlgos.includes('ECDSA')) nodeCryptoAlgos.push('ECDSA');
+    }
     if (seenImports.has('node:crypto:kdf')) {
-      nodeCryptoAlgos.push('scrypt');
+      if (!nodeCryptoAlgos.includes('scrypt')) nodeCryptoAlgos.push('scrypt');
     }
 
     if (nodeCryptoAlgos.length > 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cryptoserve",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "CryptoServe CLI - Cryptographic scanning, PQC analysis, encryption, and local key management",
   "type": "module",
   "bin": {