verification-layer 0.25.3 → 0.27.0

package/dist/rules/catalog.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Built-in rule catalog — the single source of truth for every detection rule
+ * shipped in vlayer. It is DERIVED from the scanners (and the AI rules), never a
+ * hand-maintained parallel list: each entry traces back to a real rule
+ * definition in `src/scanners/*` or `src/ai/rules`.
+ *
+ * Three forms of built-in rules are folded in here:
+ *   1. Exported pattern arrays (e.g. PHI_PATTERNS, ALL_*_PATTERNS).
+ *   2. Inline rule arrays that live in a scanner's index.ts (ACCESS_CONTROL_ISSUES,
+ *      RETENTION_ISSUES, SECURITY_PATTERNS, WEAK_CRYPTO_PATTERNS,
+ *      MISSING_ENCRYPTION_PATTERNS).
+ *   3. Scanners that build findings inline with dynamic per-finding ids. The
+ *      audit scanner exposes an explicit metadata array of its STABLE rule
+ *      families (AUDIT_RULES) — fixed ids only. (Encryption now carries a stable
+ *      `id` on every pattern, so each distinct check is listed individually.)
+ *
+ * The category of a rule is ALWAYS the owning scanner's canonical `.category`
+ * (the AI rules are normalized from their short tokens). A module-load
+ * validation gate asserts every category is one of the five canonical tokens
+ * from `schema.ts`, permanently preventing category drift.
+ */
+import { type Category } from './schema.js';
+export { type Category };
+export type CatalogSeverity = 'critical' | 'high' | 'medium' | 'low' | 'info';
+export interface CatalogRule {
+    id: string;
+    category: Category;
+    severity: CatalogSeverity;
+    title: string;
+    description: string;
+    recommendation?: string;
+    hipaaReference?: string;
+    source: 'pattern' | 'ai';
+    scanner: string;
+}
+/** The complete built-in rule catalog. Built and validated once at module load. */
+export declare const RULE_CATALOG: CatalogRule[];
+/** Return every catalog rule. */
+export declare function getAllRules(): CatalogRule[];
+/** Return the catalog rules belonging to a single canonical category. */
+export declare function getRulesByCategory(category: Category): CatalogRule[];
+/** Return a per-category rule count keyed by all five canonical categories. */
+export declare function getCategoryCounts(): Record<Category, number>;
+//# sourceMappingURL=catalog.d.ts.map

package/dist/rules/catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/rules/catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AA0B1D,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;AAEzB,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAE9E,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,EAAE,eAAe,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;CACjB;AAwKD,mFAAmF;AACnF,eAAO,MAAM,YAAY,EAAE,WAAW,EAAmB,CAAC;AAE1D,iCAAiC;AACjC,wBAAgB,WAAW,IAAI,WAAW,EAAE,CAE3C;AAED,yEAAyE;AACzE,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,GAAG,WAAW,EAAE,CAEpE;AAED,+EAA+E;AAC/E,wBAAgB,iBAAiB,IAAI,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAQ5D"}

package/dist/rules/catalog.js

@@ -0,0 +1,196 @@
+/**
+ * Built-in rule catalog — the single source of truth for every detection rule
+ * shipped in vlayer. It is DERIVED from the scanners (and the AI rules), never a
+ * hand-maintained parallel list: each entry traces back to a real rule
+ * definition in `src/scanners/*` or `src/ai/rules`.
+ *
+ * Three forms of built-in rules are folded in here:
+ *   1. Exported pattern arrays (e.g. PHI_PATTERNS, ALL_*_PATTERNS).
+ *   2. Inline rule arrays that live in a scanner's index.ts (ACCESS_CONTROL_ISSUES,
+ *      RETENTION_ISSUES, SECURITY_PATTERNS, WEAK_CRYPTO_PATTERNS,
+ *      MISSING_ENCRYPTION_PATTERNS).
+ *   3. Scanners that build findings inline with dynamic per-finding ids. The
+ *      audit scanner exposes an explicit metadata array of its STABLE rule
+ *      families (AUDIT_RULES) — fixed ids only. (Encryption now carries a stable
+ *      `id` on every pattern, so each distinct check is listed individually.)
+ *
+ * The category of a rule is ALWAYS the owning scanner's canonical `.category`
+ * (the AI rules are normalized from their short tokens). A module-load
+ * validation gate asserts every category is one of the five canonical tokens
+ * from `schema.ts`, permanently preventing category drift.
+ */
+import { CategoryEnum } from './schema.js';
+import { AI_RULES } from '../ai/rules/index.js';
+// Form 1 — exported pattern arrays
+import { PHI_PATTERNS } from '../scanners/phi/patterns.js';
+import { ALL_SKILL_PATTERNS } from '../scanners/skills/patterns.js';
+import { ALL_HIPAA_2026_PATTERNS } from '../scanners/hipaa2026/patterns.js';
+import { ALL_API_SECURITY_PATTERNS } from '../scanners/api-security/patterns.js';
+import { ALL_CONFIGURATION_PATTERNS } from '../scanners/configuration/patterns.js';
+import { ALL_MFA_PATTERNS } from '../scanners/authentication/patterns.js';
+import { ALL_ERROR_PATTERNS } from '../scanners/errors/patterns.js';
+import { ALL_OPERATIONAL_PATTERNS } from '../scanners/operational/patterns.js';
+import { ALL_CREDENTIAL_PATTERNS } from '../scanners/credentials/patterns.js';
+import { ALL_RBAC_PATTERNS } from '../scanners/rbac/patterns.js';
+import { ALL_SANITIZATION_PATTERNS } from '../scanners/sanitization/patterns.js';
+import { ALL_REVOCATION_PATTERNS } from '../scanners/revocation/patterns.js';
+// Form 2 — inline rule arrays exported from a scanner's index.ts
+import { ACCESS_CONTROL_ISSUES } from '../scanners/access/index.js';
+import { RETENTION_ISSUES } from '../scanners/retention/index.js';
+import { SECURITY_PATTERNS } from '../scanners/security/index.js';
+import { WEAK_CRYPTO_PATTERNS, MISSING_ENCRYPTION_PATTERNS } from '../scanners/encryption/index.js';
+// Form 3 — stable families for scanners that emit dynamic per-finding ids
+import { AUDIT_RULES } from '../scanners/audit/index.js';
+const SEVERITIES = ['critical', 'high', 'medium', 'low', 'info'];
+function normalizeSeverity(severity) {
+    const value = severity.toLowerCase();
+    return SEVERITIES.includes(value)
+        ? value
+        : 'info';
+}
+function fromScanner(scanner, category, rules) {
+    return rules.map((rule) => ({
+        id: rule.id,
+        category,
+        severity: normalizeSeverity(rule.severity),
+        title: rule.title ?? rule.name ?? rule.id,
+        description: rule.description,
+        recommendation: rule.recommendation,
+        hipaaReference: rule.hipaaReference,
+        source: 'pattern',
+        scanner,
+    }));
+}
+/** AI rules carry SHORT category tokens that must be normalized to the enum. */
+const AI_CATEGORY_MAP = {
+    phi: 'phi-exposure',
+    encryption: 'encryption',
+    audit: 'audit-logging',
+    access: 'access-control',
+    retention: 'data-retention',
+};
+function fromAiRules() {
+    return AI_RULES.map((rule) => {
+        const category = AI_CATEGORY_MAP[rule.category];
+        if (!category) {
+            throw new Error(`[rule-catalog] Unknown AI rule category "${rule.category}" for ${rule.id}`);
+        }
+        return {
+            id: rule.id,
+            category,
+            // AI rules have no fixed severity (severity is decided by the LLM at runtime).
+            severity: 'info',
+            title: rule.name,
+            description: rule.name,
+            source: 'ai',
+            scanner: 'ai',
+        };
+    });
+}
+/**
+ * The encryption scanner builds findings inline (with `<id>-<line>` finding ids),
+ * so its checks are mapped to catalog entries directly from the two pattern
+ * arrays. Each pattern carries a stable `id` and an `issue` (its short title);
+ * we attach an accurate HIPAA-relevant description, fix recommendation, and the
+ * same HIPAA reference the scanner emits. Detection logic is unchanged — these
+ * are the same checks, now enumerated individually.
+ */
+const WEAK_CRYPTO_HIPAA_REF = '§164.312(a)(2)(iv), §164.312(e)(2)(ii)';
+const MISSING_ENCRYPTION_HIPAA_REF = '§164.312(e)(1)';
+function encryptionRules() {
+    const weak = WEAK_CRYPTO_PATTERNS.map((pattern) => ({
+        id: pattern.id,
+        category: 'encryption',
+        severity: normalizeSeverity(pattern.severity),
+        title: pattern.issue,
+        description: `${pattern.issue} is not suitable for protecting PHI.`,
+        recommendation: 'Use AES-256-GCM for encryption and SHA-256 or stronger for hashing.',
+        hipaaReference: WEAK_CRYPTO_HIPAA_REF,
+        source: 'pattern',
+        scanner: 'encryption',
+    }));
+    const missing = MISSING_ENCRYPTION_PATTERNS.map((pattern) => ({
+        id: pattern.id,
+        category: 'encryption',
+        severity: normalizeSeverity(pattern.severity),
+        title: pattern.issue,
+        description: `${pattern.issue} may expose PHI in transit or at rest.`,
+        recommendation: 'Enforce TLS 1.2+ for PHI in transit and encrypt PHI (including backups) at rest.',
+        hipaaReference: MISSING_ENCRYPTION_HIPAA_REF,
+        source: 'pattern',
+        scanner: 'encryption',
+    }));
+    return [...weak, ...missing];
+}
+function buildCatalog() {
+    const rules = [
+        // Form 1 — exported pattern arrays (category = owning scanner's .category)
+        ...fromScanner('phi', 'phi-exposure', PHI_PATTERNS),
+        ...fromScanner('skills', 'access-control', ALL_SKILL_PATTERNS),
+        ...fromScanner('hipaa2026', 'access-control', ALL_HIPAA_2026_PATTERNS),
+        ...fromScanner('api-security', 'access-control', ALL_API_SECURITY_PATTERNS),
+        ...fromScanner('configuration', 'audit-logging', ALL_CONFIGURATION_PATTERNS),
+        ...fromScanner('authentication', 'access-control', ALL_MFA_PATTERNS),
+        ...fromScanner('errors', 'audit-logging', ALL_ERROR_PATTERNS),
+        ...fromScanner('operational', 'data-retention', ALL_OPERATIONAL_PATTERNS),
+        ...fromScanner('credentials', 'encryption', ALL_CREDENTIAL_PATTERNS),
+        ...fromScanner('rbac', 'access-control', ALL_RBAC_PATTERNS),
+        ...fromScanner('sanitization', 'access-control', ALL_SANITIZATION_PATTERNS),
+        ...fromScanner('revocation', 'access-control', ALL_REVOCATION_PATTERNS),
+        // Form 2 — inline arrays exported from index.ts
+        ...fromScanner('access', 'access-control', ACCESS_CONTROL_ISSUES),
+        ...fromScanner('retention', 'data-retention', RETENTION_ISSUES),
+        ...fromScanner('security', 'access-control', SECURITY_PATTERNS),
+        // Form 3 — dynamic-id scanners
+        ...fromScanner('audit', 'audit-logging', AUDIT_RULES),
+        // Encryption: one catalog entry per distinct check (stable ids on patterns).
+        ...encryptionRules(),
+        // AI rules (normalized categories)
+        ...fromAiRules(),
+    ];
+    // Dedupe by id; THROW on duplicate id so a collision can never silently shadow
+    // a real rule (and so the catalog count stays honest).
+    const byId = new Map();
+    const duplicates = [];
+    for (const rule of rules) {
+        if (byId.has(rule.id)) {
+            duplicates.push(rule.id);
+        }
+        else {
+            byId.set(rule.id, rule);
+        }
+    }
+    if (duplicates.length > 0) {
+        const unique = [...new Set(duplicates)].sort();
+        throw new Error(`[rule-catalog] Duplicate rule id(s): ${unique.join(', ')}`);
+    }
+    const catalog = [...byId.values()];
+    // VALIDATION GATE: every category must be one of the five canonical tokens.
+    // This runs at module load and permanently prevents category drift.
+    const valid = new Set(CategoryEnum.options);
+    const offenders = catalog.filter((rule) => !valid.has(rule.category));
+    if (offenders.length > 0) {
+        const detail = offenders.map((o) => `${o.id} -> ${o.category}`).join(', ');
+        throw new Error(`[rule-catalog] Non-canonical categories: ${detail}. Allowed: ${CategoryEnum.options.join(', ')}`);
+    }
+    return catalog;
+}
+/** The complete built-in rule catalog. Built and validated once at module load. */
+export const RULE_CATALOG = buildCatalog();
+/** Return every catalog rule. */
+export function getAllRules() {
+    return RULE_CATALOG;
+}
+/** Return the catalog rules belonging to a single canonical category. */
+export function getRulesByCategory(category) {
+    return RULE_CATALOG.filter((rule) => rule.category === category);
+}
+/** Return a per-category rule count keyed by all five canonical categories. */
+export function getCategoryCounts() {
+    const counts = Object.fromEntries(CategoryEnum.options.map((category) => [category, 0]));
+    for (const rule of RULE_CATALOG) {
+        counts[rule.category] += 1;
+    }
+    return counts;
+}
+//# sourceMappingURL=catalog.js.map

package/dist/rules/catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../../src/rules/catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,YAAY,EAAiB,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD,mCAAmC;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAC/E,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAE7E,iEAAiE;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAEpG,0EAA0E;AAC1E,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAiCzD,MAAM,UAAU,GAA+B,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AAE7F,SAAS,iBAAiB,CAAC,QAAgB;IACzC,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,OAAQ,UAAgC,CAAC,QAAQ,CAAC,KAAK,CAAC;QACtD,CAAC,CAAE,KAAyB;QAC5B,CAAC,CAAC,MAAM,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAClB,OAAe,EACf,QAAkB,EAClB,KAAgC;IAEhC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1B,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,QAAQ;QACR,QAAQ,EAAE,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC1C,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE;QACzC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,MAAM,EAAE,SAAkB;QAC1B,OAAO;KACR,CAAC,CAAC,CAAC;AACN,CAAC;AAED,gFAAgF;AAChF,MAAM,eAAe,GAA6B;IAChD,GAAG,EAAE,cAAc;IACnB,UAAU,EAAE,YAAY;IACxB,KAAK,EAAE,eAAe;IACtB,MAAM,EAAE,gBAAgB;IACxB,SAAS,EAAE,gBAAgB;CAC5B,CAAC;AAEF,SAAS,WAAW;IAClB,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QAC3B,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,4CAA4C,IAAI,CAAC,QAAQ,SAAS,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,QAAQ;YACR,+EAA+E;YAC/E,QAAQ,EAAE,MAAe;YACzB,KAAK,EAAE,IAAI,CAAC,IAAI;YAChB,WAAW,EAAE,IAAI,CAAC,IAAI;YACtB,MAAM,EAAE,IAAa;YACrB,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,qBAAqB,GAAG,wCAAwC,CAAC;AACvE,MAAM,4BAA4B,GAAG,gBAAgB,CAAC;AAEtD,SAAS,eAAe;IACtB,MAAM,IAAI,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAe,EAAE,CAAC,CAAC;QAC/D,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,QAAQ,EAAE,YAAY;QACtB,QAAQ,EAAE,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC7C,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,WAAW,EAAE,GAAG,OAAO,CAAC,KAAK,sCAAsC;QACnE,cAAc,EAAE,qEAAqE;QACrF,cAAc,EAAE,qBAAqB;QACrC,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,YAAY;KACtB,CAAC,CAAC,CAAC;IACJ,MAAM,OAAO,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAC,OAAO,EAAe,EAAE,CAAC,CAAC;QACzE,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,QAAQ,EAAE,YAAY;QACtB,QAAQ,EAAE,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC7C,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,WAAW,EAAE,GAAG,OAAO,CAAC,KAAK,wCAAwC;QACrE,cAAc,EAAE,kFAAkF;QAClG,cAAc,EAAE,4BAA4B;QAC5C,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,YAAY;KACtB,CAAC,CAAC,CAAC;IACJ,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,KAAK,GAAkB;QAC3B,2EAA2E;QAC3E,GAAG,WAAW,CAAC,KAAK,EAAE,cAAc,EAAE,YAAY,CAAC;QACnD,GAAG,WAAW,CAAC,QAAQ,EAAE,gBAAgB,EAAE,kBAAkB,CAAC;QAC9D,GAAG,WAAW,CAAC,WAAW,EAAE,gBAAgB,EAAE,uBAAuB,CAAC;QACtE,GAAG,WAAW,CAAC,cAAc,EAAE,gBAAgB,EAAE,yBAAyB,CAAC;QAC3E,GAAG,WAAW,CAAC,eAAe,EAAE,eAAe,EAAE,0BAA0B,CAAC;QAC5E,GAAG,WAAW,CAAC,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,CAAC;QACpE,GAAG,WAAW,CAAC,QAAQ,EAAE,eAAe,EAAE,kBAAkB,CAAC;QAC7D,GAAG,WAAW,CAAC,aAAa,EAAE,gBAAgB,EAAE,wBAAwB,CAAC;QACzE,GAAG,WAAW,CAAC,aAAa,EAAE,YAAY,EAAE,uBAAuB,CAAC;QACpE,GAAG,WAAW,CAAC,MAAM,EAAE,gBAAgB,EAAE,iBAAiB,CAAC;QAC3D,GAAG,WAAW,CAAC,cAAc,EAAE,gBAAgB,EAAE,yBAAyB,CAAC;QAC3E,GAAG,WAAW,CAAC,YAAY,EAAE,gBAAgB,EAAE,uBAAuB,CAAC;QACvE,gDAAgD;QAChD,GAAG,WAAW,CAAC,QAAQ,EAAE,gBAAgB,EAAE,qBAAqB,CAAC;QACjE,GAAG,WAAW,CAAC,WAAW,EAAE,gBAAgB,EAAE,gBAAgB,CAAC;QAC/D,GAAG,WAAW,CAAC,UAAU,EAAE,gBAAgB,EAAE,iBAAiB,CAAC;QAC/D,+BAA+B;QAC/B,GAAG,WAAW,CAAC,OAAO,EAAE,eAAe,EAAE,WAAW,CAAC;QACrD,6EAA6E;QAC7E,GAAG,eAAe,EAAE;QACpB,mCAAmC;QACnC,GAAG,WAAW,EAAE;KACjB,CAAC;IAEF,+EAA+E;IAC/E,uDAAuD;IACvD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC5C,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACtB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,wCAAwC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAEnC,4EAA4E;IAC5E,oEAAoE;IACpE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,YAAY,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3E,MAAM,IAAI,KAAK,CACb,4CAA4C,MAAM,cAAc,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAClG,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,MAAM,YAAY,GAAkB,YAAY,EAAE,CAAC;AAE1D,iCAAiC;AACjC,MAAM,UAAU,WAAW;IACzB,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,kBAAkB,CAAC,QAAkB;IACnD,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;AACnE,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,iBAAiB;IAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAC/B,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAC1B,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/rules/catalog.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=catalog.test.d.ts.map

package/dist/rules/catalog.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.test.d.ts","sourceRoot":"","sources":["../../src/rules/catalog.test.ts"],"names":[],"mappings":""}

package/dist/rules/catalog.test.js

@@ -0,0 +1,80 @@
+import { describe, it, expect } from 'vitest';
+import { RULE_CATALOG, getAllRules, getRulesByCategory, getCategoryCounts, } from './catalog.js';
+import { CategoryEnum } from './schema.js';
+describe('built-in rule catalog', () => {
+    it('is non-empty', () => {
+        expect(RULE_CATALOG.length).toBeGreaterThan(0);
+        expect(getAllRules()).toBe(RULE_CATALOG);
+    });
+    it('only contains the five canonical categories', () => {
+        const allowed = new Set(CategoryEnum.options);
+        for (const rule of RULE_CATALOG) {
+            expect(allowed.has(rule.category)).toBe(true);
+        }
+    });
+    it('has no duplicate ids', () => {
+        const ids = RULE_CATALOG.map((r) => r.id);
+        expect(new Set(ids).size).toBe(ids.length);
+    });
+    it('getCategoryCounts returns all five keys, each populated', () => {
+        const counts = getCategoryCounts();
+        expect(Object.keys(counts).sort()).toEqual([...CategoryEnum.options].sort());
+        expect(counts['data-retention']).toBeGreaterThan(0);
+        expect(counts['access-control']).toBeGreaterThan(0);
+        for (const category of CategoryEnum.options) {
+            expect(counts[category]).toBeGreaterThan(0);
+        }
+    });
+    it('getRulesByCategory matches counts and includes the known data-retention rules', () => {
+        const counts = getCategoryCounts();
+        for (const category of CategoryEnum.options) {
+            expect(getRulesByCategory(category).length).toBe(counts[category]);
+        }
+        const retentionIds = getRulesByCategory('data-retention').map((r) => r.id);
+        for (const id of [
+            'short-retention',
+            'unlogged-delete',
+            'bulk-delete',
+            'backup-disabled',
+            'phi-cache',
+            'HIPAA-RETENTION-001',
+        ]) {
+            expect(retentionIds).toContain(id);
+        }
+    });
+    it('lists every distinct encryption check with stable ids (no collapsed families)', () => {
+        const encryption = getRulesByCategory('encryption');
+        const ids = encryption.map((r) => r.id);
+        // 16 encryption-scanner patterns + 3 credentials + 1 AI (HIPAA-SEC-001)
+        expect(encryption.length).toBe(20);
+        // The collapsed families must be gone.
+        expect(ids).not.toContain('enc-weak');
+        expect(ids).not.toContain('enc-missing');
+        // Every distinct check is now individually enumerated.
+        const expectedEncryptionScannerIds = [
+            'enc-md5', 'enc-sha1', 'enc-des', 'enc-rc4', 'enc-deprecated-cipher', 'enc-ecb-mode',
+            'enc-http-url', 'enc-ssl-disabled', 'enc-ssl-verify-disabled',
+            'enc-tls-cert-validation-disabled', 'enc-backup-encryption-disabled',
+            'enc-db-backup-no-ssl', 'enc-backup-file-unencrypted', 'enc-phi-backup-unencrypted',
+            'enc-s3-backup-no-sse', 'enc-backup-storage-unencrypted',
+        ];
+        for (const id of expectedEncryptionScannerIds) {
+            expect(ids).toContain(id);
+        }
+        // Severities are preserved from the patterns (not flattened to one value).
+        const desRule = encryption.find((r) => r.id === 'enc-des');
+        expect(desRule?.severity).toBe('critical');
+        const sha1Rule = encryption.find((r) => r.id === 'enc-sha1');
+        expect(sha1Rule?.severity).toBe('medium');
+    });
+    it('normalizes severity to lowercase and marks AI rules as info', () => {
+        const severities = new Set(['critical', 'high', 'medium', 'low', 'info']);
+        for (const rule of RULE_CATALOG) {
+            expect(severities.has(rule.severity)).toBe(true);
+            if (rule.source === 'ai') {
+                expect(rule.severity).toBe('info');
+            }
+        }
+    });
+});
+//# sourceMappingURL=catalog.test.js.map

package/dist/rules/catalog.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.test.js","sourceRoot":"","sources":["../../src/rules/catalog.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,cAAc,EAAE,GAAG,EAAE;QACtB,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC/C,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,YAAY,CAAC,OAAO,CAAC,CAAC;QACtD,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;YAChC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC9B,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1C,MAAM,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7E,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACpD,KAAK,MAAM,QAAQ,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;YAC5C,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,GAAG,EAAE;QACvF,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;QACnC,KAAK,MAAM,QAAQ,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;YAC5C,MAAM,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,YAAY,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3E,KAAK,MAAM,EAAE,IAAI;YACf,iBAAiB;YACjB,iBAAiB;YACjB,aAAa;YACb,iBAAiB;YACjB,WAAW;YACX,qBAAqB;SACtB,EAAE,CAAC;YACF,MAAM,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACrC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,GAAG,EAAE;QACvF,MAAM,UAAU,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAExC,wEAAwE;QACxE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEnC,uCAAuC;QACvC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACtC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAEzC,uDAAuD;QACvD,MAAM,4BAA4B,GAAG;YACnC,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,uBAAuB,EAAE,cAAc;YACpF,cAAc,EAAE,kBAAkB,EAAE,yBAAyB;YAC7D,kCAAkC,EAAE,gCAAgC;YACpE,sBAAsB,EAAE,6BAA6B,EAAE,4BAA4B;YACnF,sBAAsB,EAAE,gCAAgC;SACzD,CAAC;QACF,KAAK,MAAM,EAAE,IAAI,4BAA4B,EAAE,CAAC;YAC9C,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC5B,CAAC;QAED,2EAA2E;QAC3E,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC;QAC3D,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;QAC7D,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1E,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;YAChC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjD,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/rules/schema.d.ts

@@ -11,6 +11,19 @@ export declare const CustomRuleFixSchema: z.ZodObject<{
         after: z.ZodString;
     }, z.core.$strip>>;
 }, z.core.$strip>;
+/**
+ * Canonical HIPAA compliance categories. This is the single source of truth for
+ * the five category tokens used throughout vlayer (scanners, custom rules, and
+ * the built-in rule catalog). Never add a sixth without updating the scanners.
+ */
+export declare const CategoryEnum: z.ZodEnum<{
+    "phi-exposure": "phi-exposure";
+    encryption: "encryption";
+    "audit-logging": "audit-logging";
+    "access-control": "access-control";
+    "data-retention": "data-retention";
+}>;
+export type Category = z.infer<typeof CategoryEnum>;
 export declare const CustomRuleSchema: z.ZodObject<{
     id: z.ZodString;
     name: z.ZodString;

package/dist/rules/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/rules/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,mBAAmB;;;;;;;;;;;iBAO9B,CAAC;AAEH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkB3B,CAAC;AAEH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAG1B,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AACpE,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AACxD,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/rules/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,mBAAmB;;;;;;;;;;;iBAO9B,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,YAAY;;;;;;EAMvB,CAAC;AAEH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAEpD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkB3B,CAAC;AAEH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAG1B,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AACpE,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AACxD,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/dist/rules/schema.js

@@ -7,11 +7,23 @@ export const CustomRuleFixSchema = z.object({
         after: z.string(),
     }).optional(),
 });
+/**
+ * Canonical HIPAA compliance categories. This is the single source of truth for
+ * the five category tokens used throughout vlayer (scanners, custom rules, and
+ * the built-in rule catalog). Never add a sixth without updating the scanners.
+ */
+export const CategoryEnum = z.enum([
+    'phi-exposure',
+    'encryption',
+    'audit-logging',
+    'access-control',
+    'data-retention',
+]);
 export const CustomRuleSchema = z.object({
     id: z.string().regex(/^[a-z0-9-]+$/, 'Rule ID must be lowercase alphanumeric with hyphens'),
     name: z.string().min(1, 'Rule name is required'),
     description: z.string().min(1, 'Rule description is required'),
-    category: z.enum(['phi-exposure', 'encryption', 'audit-logging', 'access-control', 'data-retention']),
+    category: CategoryEnum,
     severity: z.enum(['critical', 'high', 'medium', 'low', 'info']),
     pattern: z.string().min(1, 'Pattern is required'),
     flags: z.string().optional().default('gi'),

package/dist/rules/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/rules/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;KAClB,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,qDAAqD,CAAC;IAC3F,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,uBAAuB,CAAC;IAChD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,8BAA8B,CAAC;IAC9D,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;IACrG,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,qBAAqB,CAAC;IACjD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,4BAA4B,CAAC;IAC/D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,GAAG,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IACnC,4BAA4B;IAC5B,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/E,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAChE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;CACjC,CAAC,CAAC"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/rules/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;KAClB,CAAC,CAAC,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC;IACjC,cAAc;IACd,YAAY;IACZ,eAAe;IACf,gBAAgB;IAChB,gBAAgB;CACjB,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,qDAAqD,CAAC;IAC3F,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,uBAAuB,CAAC;IAChD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,8BAA8B,CAAC;IAC9D,QAAQ,EAAE,YAAY;IACtB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,qBAAqB,CAAC;IACjD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,4BAA4B,CAAC;IAC/D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,GAAG,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IACnC,4BAA4B;IAC5B,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/E,yBAAyB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAChE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;CACjC,CAAC,CAAC"}

package/dist/scanners/access/index.d.ts

@@ -1,3 +1,25 @@
 import type { Scanner } from '../../types.js';
+export declare const ACCESS_CONTROL_ISSUES: ({
+    regex: RegExp;
+    id: string;
+    severity: "medium";
+    title: string;
+    description: string;
+    recommendation: string;
+} | {
+    regex: RegExp;
+    id: string;
+    severity: "high";
+    title: string;
+    description: string;
+    recommendation: string;
+} | {
+    regex: RegExp;
+    id: string;
+    severity: "critical";
+    title: string;
+    description: string;
+    recommendation: string;
+})[];
 export declare const accessScanner: Scanner;
 //# sourceMappingURL=index.d.ts.map

package/dist/scanners/access/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/scanners/access/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAwB,MAAM,gBAAgB,CAAC;AA+DpE,eAAO,MAAM,aAAa,EAAE,OA2C3B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/scanners/access/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAwB,MAAM,gBAAgB,CAAC;AAIpE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;IAyDjC,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,OA2C3B,CAAC"}

package/dist/scanners/access/index.js

@@ -1,7 +1,7 @@
 import { readFile } from 'fs/promises';
 import { DEFAULT_CONFIG } from '../../config.js';
 import { getContextLines } from '../../utils/context.js';
-const ACCESS_CONTROL_ISSUES = [
+export const ACCESS_CONTROL_ISSUES = [
     {
         regex: /\*\s*FROM\s+(patient|user|health|medical)/i,
         id: 'select-star',

package/dist/scanners/access/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/scanners/access/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,MAAM,qBAAqB,GAAG;IAC5B;QACE,KAAK,EAAE,4CAA4C;QACnD,EAAE,EAAE,aAAa;QACjB,QAAQ,EAAE,QAAiB;QAC3B,KAAK,EAAE,6BAA6B;QACpC,WAAW,EAAE,sDAAsD;QACnE,cAAc,EAAE,4EAA4E;KAC7F;IACD;QACE,KAAK,EAAE,iDAAiD;QACxD,EAAE,EAAE,iBAAiB;QACrB,QAAQ,EAAE,MAAe;QACzB,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EAAE,oDAAoD;QACjE,cAAc,EAAE,kEAAkE;KACnF;IACD;QACE,KAAK,EAAE,uCAAuC;QAC9C,EAAE,EAAE,aAAa;QACjB,QAAQ,EAAE,UAAmB;QAC7B,KAAK,EAAE,iCAAiC;QACxC,WAAW,EAAE,uDAAuD;QACpE,cAAc,EAAE,iEAAiE;KAClF;IACD;QACE,KAAK,EAAE,4CAA4C;QACnD,EAAE,EAAE,YAAY;QAChB,QAAQ,EAAE,QAAiB;QAC3B,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EAAE,0CAA0C;QACvD,cAAc,EAAE,4DAA4D;KAC7E;IACD;QACE,KAAK,EAAE,mDAAmD;QAC1D,EAAE,EAAE,iBAAiB;QACrB,QAAQ,EAAE,UAAmB;QAC7B,KAAK,EAAE,uCAAuC;QAC9C,WAAW,EAAE,+CAA+C;QAC5D,cAAc,EAAE,sDAAsD;KACvE;IACD;QACE,KAAK,EAAE,oBAAoB;QAC3B,EAAE,EAAE,eAAe;QACnB,QAAQ,EAAE,MAAe;QACzB,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EAAE,uCAAuC;QACpD,cAAc,EAAE,uEAAuE;KACxF;IACD;QACE,KAAK,EAAE,8CAA8C;QACrD,EAAE,EAAE,mBAAmB;QACvB,QAAQ,EAAE,MAAe;QACzB,KAAK,EAAE,4BAA4B;QACnC,WAAW,EAAE,wCAAwC;QACrD,cAAc,EAAE,oFAAoF;KACrG;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAY;IACpC,IAAI,EAAE,wBAAwB;IAC9B,QAAQ,EAAE,gBAAgB;IAE1B,KAAK,CAAC,IAAI,CAAC,KAAe,EAAE,OAAoB;QAC9C,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,cAAc,CAAC;QAChD,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC;QAC7C,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACpG,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAEjF,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAClD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAElC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;oBACxD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;oBAE5B,KAAK,MAAM,KAAK,IAAI,qBAAqB,EAAE,CAAC;wBAC1C,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;4BAC3B,QAAQ,CAAC,IAAI,CAAC;gCACZ,EAAE,EAAE,UAAU,KAAK,CAAC,EAAE,IAAI,OAAO,EAAE;gCACnC,QAAQ,EAAE,gBAAgB;gCAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gCACxB,KAAK,EAAE,KAAK,CAAC,KAAK;gCAClB,WAAW,EAAE,KAAK,CAAC,WAAW;gCAC9B,IAAI,EAAE,QAAQ;gCACd,IAAI,EAAE,OAAO,GAAG,CAAC;gCACjB,cAAc,EAAE,KAAK,CAAC,cAAc;gCACpC,cAAc,EAAE,6BAA6B;gCAC7C,OAAO,EAAE,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC;6BACtD,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,gCAAgC;YAClC,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/scanners/access/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC;QACE,KAAK,EAAE,4CAA4C;QACnD,EAAE,EAAE,aAAa;QACjB,QAAQ,EAAE,QAAiB;QAC3B,KAAK,EAAE,6BAA6B;QACpC,WAAW,EAAE,sDAAsD;QACnE,cAAc,EAAE,4EAA4E;KAC7F;IACD;QACE,KAAK,EAAE,iDAAiD;QACxD,EAAE,EAAE,iBAAiB;QACrB,QAAQ,EAAE,MAAe;QACzB,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EAAE,oDAAoD;QACjE,cAAc,EAAE,kEAAkE;KACnF;IACD;QACE,KAAK,EAAE,uCAAuC;QAC9C,EAAE,EAAE,aAAa;QACjB,QAAQ,EAAE,UAAmB;QAC7B,KAAK,EAAE,iCAAiC;QACxC,WAAW,EAAE,uDAAuD;QACpE,cAAc,EAAE,iEAAiE;KAClF;IACD;QACE,KAAK,EAAE,4CAA4C;QACnD,EAAE,EAAE,YAAY;QAChB,QAAQ,EAAE,QAAiB;QAC3B,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EAAE,0CAA0C;QACvD,cAAc,EAAE,4DAA4D;KAC7E;IACD;QACE,KAAK,EAAE,mDAAmD;QAC1D,EAAE,EAAE,iBAAiB;QACrB,QAAQ,EAAE,UAAmB;QAC7B,KAAK,EAAE,uCAAuC;QAC9C,WAAW,EAAE,+CAA+C;QAC5D,cAAc,EAAE,sDAAsD;KACvE;IACD;QACE,KAAK,EAAE,oBAAoB;QAC3B,EAAE,EAAE,eAAe;QACnB,QAAQ,EAAE,MAAe;QACzB,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EAAE,uCAAuC;QACpD,cAAc,EAAE,uEAAuE;KACxF;IACD;QACE,KAAK,EAAE,8CAA8C;QACrD,EAAE,EAAE,mBAAmB;QACvB,QAAQ,EAAE,MAAe;QACzB,KAAK,EAAE,4BAA4B;QACnC,WAAW,EAAE,wCAAwC;QACrD,cAAc,EAAE,oFAAoF;KACrG;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAY;IACpC,IAAI,EAAE,wBAAwB;IAC9B,QAAQ,EAAE,gBAAgB;IAE1B,KAAK,CAAC,IAAI,CAAC,KAAe,EAAE,OAAoB;QAC9C,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,cAAc,CAAC;QAChD,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC;QAC7C,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACpG,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAEjF,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAClD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAElC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;oBACxD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;oBAE5B,KAAK,MAAM,KAAK,IAAI,qBAAqB,EAAE,CAAC;wBAC1C,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;4BAC3B,QAAQ,CAAC,IAAI,CAAC;gCACZ,EAAE,EAAE,UAAU,KAAK,CAAC,EAAE,IAAI,OAAO,EAAE;gCACnC,QAAQ,EAAE,gBAAgB;gCAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gCACxB,KAAK,EAAE,KAAK,CAAC,KAAK;gCAClB,WAAW,EAAE,KAAK,CAAC,WAAW;gCAC9B,IAAI,EAAE,QAAQ;gCACd,IAAI,EAAE,OAAO,GAAG,CAAC;gCACjB,cAAc,EAAE,KAAK,CAAC,cAAc;gCACpC,cAAc,EAAE,6BAA6B;gCAC7C,OAAO,EAAE,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC;6BACtD,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,gCAAgC;YAClC,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC"}

package/dist/scanners/audit/index.d.ts

@@ -1,3 +1,24 @@
 import type { Scanner } from '../../types.js';
+/**
+ * Stable rule families emitted by this scanner for the built-in rule catalog.
+ * Findings carry dynamic ids (`audit-no-framework`, `audit-unlogged-<action>-<line>`);
+ * these are the FIXED families only — never the per-finding suffix. The ids here
+ * match the stable id prefixes emitted in scan() below.
+ */
+export declare const AUDIT_RULES: ({
+    id: string;
+    severity: "high";
+    title: string;
+    description: string;
+    recommendation: string;
+    hipaaReference: string;
+} | {
+    id: string;
+    severity: "medium";
+    title: string;
+    description: string;
+    recommendation: string;
+    hipaaReference: string;
+})[];
 export declare const auditScanner: Scanner;
 //# sourceMappingURL=index.d.ts.map

package/dist/scanners/audit/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/scanners/audit/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAwB,MAAM,gBAAgB,CAAC;AAiBpE,eAAO,MAAM,YAAY,EAAE,OAuF1B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/scanners/audit/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAwB,MAAM,gBAAgB,CAAC;AAiBpE;;;;;GAKG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;IAiBvB,CAAC;AAEF,eAAO,MAAM,YAAY,EAAE,OAuF1B,CAAC"}

package/dist/scanners/audit/index.js

@@ -12,6 +12,30 @@ const AUDIT_REQUIRED_ACTIONS = [
     { pattern: /\.(read|get|find|fetch|select)\s*\(/i, action: 'read' },
     { pattern: /\.(login|authenticate|authorize)\s*\(/i, action: 'auth' },
 ];
+/**
+ * Stable rule families emitted by this scanner for the built-in rule catalog.
+ * Findings carry dynamic ids (`audit-no-framework`, `audit-unlogged-<action>-<line>`);
+ * these are the FIXED families only — never the per-finding suffix. The ids here
+ * match the stable id prefixes emitted in scan() below.
+ */
+export const AUDIT_RULES = [
+    {
+        id: 'audit-no-framework',
+        severity: 'high',
+        title: 'No audit logging framework detected',
+        description: 'No recognized logging framework found in dependencies.',
+        recommendation: 'Implement structured audit logging using winston, pino, or similar.',
+        hipaaReference: '§164.312(b)',
+    },
+    {
+        id: 'audit-unlogged-action',
+        severity: 'medium',
+        title: 'PHI operation may lack audit logging',
+        description: 'A create, update, delete, read, or auth operation on PHI-related data was found without apparent audit logging in the same file.',
+        recommendation: 'Log all PHI operations with timestamp, user ID, and action details.',
+        hipaaReference: '§164.312(b)',
+    },
+];
 export const auditScanner = {
     name: 'Audit Logging Scanner',
     category: 'audit-logging',

package/dist/scanners/audit/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/scanners/audit/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,MAAM,kBAAkB,GAAG;IACzB,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ;IAC/C,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ;CAC3C,CAAC;AAEF,MAAM,sBAAsB,GAAG;IAC7B,EAAE,OAAO,EAAE,kCAAkC,EAAE,MAAM,EAAE,QAAQ,EAAE;IACjE,EAAE,OAAO,EAAE,mCAAmC,EAAE,MAAM,EAAE,QAAQ,EAAE;IAClE,EAAE,OAAO,EAAE,iCAAiC,EAAE,MAAM,EAAE,QAAQ,EAAE;IAChE,EAAE,OAAO,EAAE,sCAAsC,EAAE,MAAM,EAAE,MAAM,EAAE;IACnE,EAAE,OAAO,EAAE,wCAAwC,EAAE,MAAM,EAAE,MAAM,EAAE;CACtE,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAY;IACnC,IAAI,EAAE,uBAAuB;IAC7B,QAAQ,EAAE,eAAe;IAEzB,KAAK,CAAC,IAAI,CAAC,KAAe,EAAE,OAAoB;QAC9C,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,cAAc,CAAC;QAChD,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC;QAE7C,uCAAuC;QACvC,MAAM,gBAAgB,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QACvE,IAAI,mBAAmB,GAAG,KAAK,CAAC;QAEhC,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACjD,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;oBACxD,mBAAmB,GAAG,IAAI,CAAC;oBAC3B,MAAM;gBACR,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO;YACT,CAAC;QACH,CAAC;QAED,IAAI,CAAC,mBAAmB,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxD,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,oBAAoB;gBACxB,QAAQ,EAAE,eAAe;gBACzB,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,qCAAqC;gBAC5C,WAAW,EAAE,wDAAwD;gBACrE,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;gBACzB,cAAc,EAAE,qEAAqE;gBACrF,cAAc,EAAE,aAAa;aAC9B,CAAC,CAAC;QACL,CAAC;QAED,2CAA2C;QAC3C,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC7E,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAEjF,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,kBAAkB;YAClB,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3D,SAAS;YACX,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAClD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAElC,6EAA6E;gBAC7E,MAAM,cAAc,GAAG,6CAA6C,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACnF,MAAM,UAAU,GAAG,qCAAqC,CAAC,IAAI,CAAC,OAAO,CAAC;oBACpD,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAE5C,IAAI,cAAc,EAAE,CAAC;oBACnB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;wBACxD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;wBAE5B,KAAK,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,sBAAsB,EAAE,CAAC;4BACzD,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;gCACtC,QAAQ,CAAC,IAAI,CAAC;oCACZ,EAAE,EAAE,kBAAkB,MAAM,IAAI,OAAO,EAAE;oCACzC,QAAQ,EAAE,eAAe;oCACzB,QAAQ,EAAE,QAAQ;oCAClB,KAAK,EAAE,OAAO,MAAM,mCAAmC;oCACvD,WAAW,EAAE,KAAK,MAAM,uFAAuF;oCAC/G,IAAI,EAAE,QAAQ;oCACd,IAAI,EAAE,OAAO,GAAG,CAAC;oCACjB,cAAc,EAAE,WAAW,MAAM,iEAAiE;oCAClG,cAAc,EAAE,aAAa;oCAC7B,OAAO,EAAE,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC;iCACtD,CAAC,CAAC;gCACH,MAAM,CAAC,wCAAwC;4BACjD,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,gCAAgC;YAClC,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/scanners/audit/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,MAAM,kBAAkB,GAAG;IACzB,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ;IAC/C,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ;CAC3C,CAAC;AAEF,MAAM,sBAAsB,GAAG;IAC7B,EAAE,OAAO,EAAE,kCAAkC,EAAE,MAAM,EAAE,QAAQ,EAAE;IACjE,EAAE,OAAO,EAAE,mCAAmC,EAAE,MAAM,EAAE,QAAQ,EAAE;IAClE,EAAE,OAAO,EAAE,iCAAiC,EAAE,MAAM,EAAE,QAAQ,EAAE;IAChE,EAAE,OAAO,EAAE,sCAAsC,EAAE,MAAM,EAAE,MAAM,EAAE;IACnE,EAAE,OAAO,EAAE,wCAAwC,EAAE,MAAM,EAAE,MAAM,EAAE;CACtE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB;QACE,EAAE,EAAE,oBAAoB;QACxB,QAAQ,EAAE,MAAe;QACzB,KAAK,EAAE,qCAAqC;QAC5C,WAAW,EAAE,wDAAwD;QACrE,cAAc,EAAE,qEAAqE;QACrF,cAAc,EAAE,aAAa;KAC9B;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,QAAQ,EAAE,QAAiB;QAC3B,KAAK,EAAE,sCAAsC;QAC7C,WAAW,EAAE,kIAAkI;QAC/I,cAAc,EAAE,qEAAqE;QACrF,cAAc,EAAE,aAAa;KAC9B;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAY;IACnC,IAAI,EAAE,uBAAuB;IAC7B,QAAQ,EAAE,eAAe;IAEzB,KAAK,CAAC,IAAI,CAAC,KAAe,EAAE,OAAoB;QAC9C,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,cAAc,CAAC;QAChD,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,IAAI,CAAC,CAAC;QAE7C,uCAAuC;QACvC,MAAM,gBAAgB,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QACvE,IAAI,mBAAmB,GAAG,KAAK,CAAC;QAEhC,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACjD,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;oBACxD,mBAAmB,GAAG,IAAI,CAAC;oBAC3B,MAAM;gBACR,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO;YACT,CAAC;QACH,CAAC;QAED,IAAI,CAAC,mBAAmB,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxD,QAAQ,CAAC,IAAI,CAAC;gBACZ,EAAE,EAAE,oBAAoB;gBACxB,QAAQ,EAAE,eAAe;gBACzB,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,qCAAqC;gBAC5C,WAAW,EAAE,wDAAwD;gBACrE,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;gBACzB,cAAc,EAAE,qEAAqE;gBACrF,cAAc,EAAE,aAAa;aAC9B,CAAC,CAAC;QACL,CAAC;QAED,2CAA2C;QAC3C,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC7E,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAEjF,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,kBAAkB;YAClB,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3D,SAAS;YACX,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAClD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAElC,6EAA6E;gBAC7E,MAAM,cAAc,GAAG,6CAA6C,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACnF,MAAM,UAAU,GAAG,qCAAqC,CAAC,IAAI,CAAC,OAAO,CAAC;oBACpD,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAE5C,IAAI,cAAc,EAAE,CAAC;oBACnB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;wBACxD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;wBAE5B,KAAK,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,sBAAsB,EAAE,CAAC;4BACzD,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;gCACtC,QAAQ,CAAC,IAAI,CAAC;oCACZ,EAAE,EAAE,kBAAkB,MAAM,IAAI,OAAO,EAAE;oCACzC,QAAQ,EAAE,eAAe;oCACzB,QAAQ,EAAE,QAAQ;oCAClB,KAAK,EAAE,OAAO,MAAM,mCAAmC;oCACvD,WAAW,EAAE,KAAK,MAAM,uFAAuF;oCAC/G,IAAI,EAAE,QAAQ;oCACd,IAAI,EAAE,OAAO,GAAG,CAAC;oCACjB,cAAc,EAAE,WAAW,MAAM,iEAAiE;oCAClG,cAAc,EAAE,aAAa;oCAC7B,OAAO,EAAE,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,CAAC;iCACtD,CAAC,CAAC;gCACH,MAAM,CAAC,wCAAwC;4BACjD,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,gCAAgC;YAClC,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC"}

package/dist/scanners/encryption/index.d.ts

@@ -1,3 +1,27 @@
-import type { Scanner } from '../../types.js';
+import type { Scanner, FixType } from '../../types.js';
+export declare const WEAK_CRYPTO_PATTERNS: ({
+    id: string;
+    regex: RegExp;
+    issue: string;
+    severity: "high";
+} | {
+    id: string;
+    regex: RegExp;
+    issue: string;
+    severity: "medium";
+} | {
+    id: string;
+    regex: RegExp;
+    issue: string;
+    severity: "critical";
+})[];
+export declare const MISSING_ENCRYPTION_PATTERNS: Array<{
+    id: string;
+    regex: RegExp;
+    issue: string;
+    severity: 'critical' | 'high' | 'medium' | 'low' | 'info';
+    checkSafe?: boolean;
+    fixType?: FixType;
+}>;
 export declare const encryptionScanner: Scanner;
 //# sourceMappingURL=index.d.ts.map

package/dist/scanners/encryption/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/scanners/encryption/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAiC,MAAM,gBAAgB,CAAC;AA8C7E,eAAO,MAAM,iBAAiB,EAAE,OA2E/B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/scanners/encryption/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAwB,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAI7E,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;IAOhC,CAAC;AAEF,eAAO,MAAM,2BAA2B,EAAE,KAAK,CAAC;IAC9C,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAC1D,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAYA,CAAC;AAeF,eAAO,MAAM,iBAAiB,EAAE,OA2E/B,CAAC"}