@quantakrypto/qscan - npm Package Compare versions

Comparing version 0.4.3 to 0.4.4

dist/args.d.ts

@@ -85,2 +85,4 @@ /**
     tier?: SecurityTier;
+    /** Org cryptography policy file (`--policy`) for the evidence report's §4 verdicts. */
+    policy?: string;
     /** How much source context leaves the machine (`--context`). Default: snippet. */
@@ -87,0 +89,0 @@ contextLevel?: ContextLevel;

dist/args.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"args.d.ts","sourceRoot":"","sources":["../src/args.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClF,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAM7F,qCAAqC;AACrC,QAAA,MAAM,aAAa,6CAA8C,CAAC;AAClE,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAMzD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC;AAExD;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,MAAM,GAAG,UAAU,CAAC;AAI7D,sEAAsE;AACtE,MAAM,WAAW,YAAY;IAC3B,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,qBAAqB;IACrB,MAAM,EAAE,WAAW,CAAC;IACpB,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gEAAgE;IAChE,iBAAiB,EAAE,QAAQ,CAAC;IAC5B,iDAAiD;IACjD,MAAM,EAAE,OAAO,CAAC;IAChB,0DAA0D;IAC1D,YAAY,EAAE,OAAO,CAAC;IACtB,4CAA4C;IAC5C,MAAM,EAAE,OAAO,CAAC;IAChB,sDAAsD;IACtD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB;;;OAGG;IACH,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iEAAiE;IACjE,gBAAgB,EAAE,OAAO,CAAC;IAC1B,sEAAsE;IACtE,YAAY,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,QAAQ,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,6EAA6E;IAC7E,KAAK,EAAE,OAAO,CAAC;IACf,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,MAAM,EAAE,OAAO,CAAC;IAChB,0FAA0F;IAC1F,WAAW,CAAC,EAAE,QAAQ,CAAC;IACvB,kFAAkF;IAClF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qFAAqF;IACrF,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,kFAAkF;IAClF,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,0FAA0F;IAC1F,MAAM,EAAE,OAAO,CAAC;IAChB,4DAA4D;IAC5D,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,qCAAqC;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GACvB,mBAAmB,GACnB,QAAQ,GACR,cAAc,GACd,QAAQ,GACR,SAAS,GACT,QAAQ,GACR,aAAa,GACb,kBAAkB,GAClB,cAAc,GACd,UAAU,CAAC;AAEf,uFAAuF;AACvF,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,KAAK,CAAC;IACZ,OAAO,EAAE,YAAY,CAAC;IACtB,mEAAmE;IACnE,QAAQ,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC;CAChC;AAED,6EAA6E;AAC7E,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC;AAE5E,mEAAmE;AACnE,qBAAa,QAAS,SAAQ,KAAK;IACjC,SAAkB,IAAI,cAAc;CACrC;AAED,qDAAqD;AACrD,wBAAgB,cAAc,IAAI,YAAY,CAoB7C;AAED;;;;GAIG;AACH,sEAAsE;AACtE,eAAO,MAAM,kBAAkB,6BAA6B,CAAC;AAE7D,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,CAqN7D;AAED,6CAA6C;AAC7C,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAGnD;AAED,8CAA8C;AAC9C,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,CAK1D;AAED,2CAA2C;AAC3C,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,CAGlD;AAED,mDAAmD;AACnD,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAKrD;AAED,4DAA4D;AAC5D,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAKzD;AAED,2CAA2C;AAC3C,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAGlD"}
+{"version":3,"file":"args.d.ts","sourceRoot":"","sources":["../src/args.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClF,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAM7F,qCAAqC;AACrC,QAAA,MAAM,aAAa,6CAA8C,CAAC;AAClE,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAMzD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC;AAExD;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,MAAM,GAAG,UAAU,CAAC;AAI7D,sEAAsE;AACtE,MAAM,WAAW,YAAY;IAC3B,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,qBAAqB;IACrB,MAAM,EAAE,WAAW,CAAC;IACpB,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gEAAgE;IAChE,iBAAiB,EAAE,QAAQ,CAAC;IAC5B,iDAAiD;IACjD,MAAM,EAAE,OAAO,CAAC;IAChB,0DAA0D;IAC1D,YAAY,EAAE,OAAO,CAAC;IACtB,4CAA4C;IAC5C,MAAM,EAAE,OAAO,CAAC;IAChB,sDAAsD;IACtD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB;;;OAGG;IACH,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,2DAA2D;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iEAAiE;IACjE,gBAAgB,EAAE,OAAO,CAAC;IAC1B,sEAAsE;IACtE,YAAY,EAAE,OAAO,CAAC;IACtB;;;OAGG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,QAAQ,EAAE,OAAO,CAAC;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,6EAA6E;IAC7E,KAAK,EAAE,OAAO,CAAC;IACf,wEAAwE;IACxE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,MAAM,EAAE,OAAO,CAAC;IAChB,0FAA0F;IAC1F,WAAW,CAAC,EAAE,QAAQ,CAAC;IACvB,kFAAkF;IAClF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qFAAqF;IACrF,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,uFAAuF;IACvF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kFAAkF;IAClF,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,0FAA0F;IAC1F,MAAM,EAAE,OAAO,CAAC;IAChB,4DAA4D;IAC5D,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,qCAAqC;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GACvB,mBAAmB,GACnB,QAAQ,GACR,cAAc,GACd,QAAQ,GACR,SAAS,GACT,QAAQ,GACR,aAAa,GACb,kBAAkB,GAClB,cAAc,GACd,UAAU,CAAC;AAEf,uFAAuF;AACvF,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,KAAK,CAAC;IACZ,OAAO,EAAE,YAAY,CAAC;IACtB,mEAAmE;IACnE,QAAQ,EAAE,GAAG,CAAC,eAAe,CAAC,CAAC;CAChC;AAED,6EAA6E;AAC7E,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC;AAE5E,mEAAmE;AACnE,qBAAa,QAAS,SAAQ,KAAK;IACjC,SAAkB,IAAI,cAAc;CACrC;AAED,qDAAqD;AACrD,wBAAgB,cAAc,IAAI,YAAY,CAoB7C;AAED;;;;GAIG;AACH,sEAAsE;AACtE,eAAO,MAAM,kBAAkB,6BAA6B,CAAC;AAE7D,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,CAwN7D;AAED,6CAA6C;AAC7C,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAGnD;AAED,8CAA8C;AAC9C,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,CAK1D;AAED,2CAA2C;AAC3C,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,CAGlD;AAED,mDAAmD;AACnD,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAKrD;AAED,4DAA4D;AAC5D,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAKzD;AAED,2CAA2C;AAC3C,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,CAGlD"}

dist/args.js

@@ -232,2 +232,5 @@ /**
                 break;
+            case "--policy":
+                options.policy = takeValue();
+                break;
             case "--write-baseline":
@@ -234,0 +237,0 @@ options.writeBaseline = takeValue();

dist/args.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"args.js","sourceRoot":"","sources":["../src/args.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGlF,qFAAqF;AACrF,MAAM,cAAc,GAA4B,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;AAC5F,iFAAiF;AACjF,MAAM,cAAc,GAA4B,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;AAC7E,qCAAqC;AACrC,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,mBAAmB,CAAU,CAAC;AAGlE,4EAA4E;AAC5E,2EAA2E;AAC3E,iFAAiF;AACjF,wDAAwD;AACxD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC;AASxD,MAAM,OAAO,GAA2B,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;AAyHvF,mEAAmE;AACnE,MAAM,OAAO,QAAS,SAAQ,KAAK;IACf,IAAI,GAAG,UAAU,CAAC;CACrC;AAED,qDAAqD;AACrD,MAAM,UAAU,cAAc;IAC5B,OAAO;QACL,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,OAAO;QACf,iBAAiB,EAAE,MAAM;QACzB,MAAM,EAAE,IAAI;QACZ,YAAY,EAAE,IAAI;QAClB,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,EAAE;QACX,gBAAgB,EAAE,KAAK;QACvB,YAAY,EAAE,KAAK;QACnB,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,KAAK;QACf,KAAK,EAAE,KAAK;QACZ,UAAU,EAAE,KAAK;QACjB,YAAY,EAAE,KAAK;QACnB,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,KAAK;KACd,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,sEAAsE;AACtE,MAAM,CAAC,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AAE7D,MAAM,UAAU,SAAS,CAAC,IAAuB;IAC/C,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC5C,IAAI,UAA8B,CAAC;IAEnC,yEAAyE;IACzE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QAE9B,mDAAmD;QACnD,IAAI,WAA+B,CAAC;QACpC,IAAI,IAAI,GAAG,GAAG,CAAC;QACf,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACxB,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAClC,CAAC;QAED,mFAAmF;QACnF,MAAM,SAAS,GAAG,GAAW,EAAE;YAC7B,IAAI,WAAW,KAAK,SAAS;gBAAE,OAAO,WAAW,CAAC;YAClD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACjE,MAAM,IAAI,QAAQ,CAAC,WAAW,IAAI,oBAAoB,CAAC,CAAC;YAC1D,CAAC;YACD,CAAC,EAAE,CAAC;YACJ,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QAEF;;;;WAIG;QACH,MAAM,iBAAiB,GAAG,GAAS,EAAE;YACnC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,IAAI,QAAQ,CAAC,WAAW,IAAI,wCAAwC,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC,CAAC;QAEF,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,IAAI,CAAC;YACV,KAAK,QAAQ;gBACX,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC1B,KAAK,IAAI,CAAC;YACV,KAAK,WAAW;gBACd,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAE7B,KAAK,UAAU;gBACb,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;gBACvC,MAAM;YACR,KAAK,QAAQ;gBACX,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;gBACxB,MAAM;YACR,KAAK,IAAI,CAAC;YACV,KAAK,UAAU;gBACb,OAAO,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;gBAC7B,MAAM;YACR,KAAK,sBAAsB;gBACzB,OAAO,CAAC,iBAAiB,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;gBACpD,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;gBAClC,MAAM;YAER,KAAK,aAAa;gBAChB,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC;gBACvB,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACvB,MAAM;YACR,KAAK,WAAW;gBACd,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,YAAY,GAAG,KAAK,CAAC;gBAC7B,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;gBAC7B,MAAM;YACR,KAAK,aAAa;gBAChB,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC;gBACvB,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACvB,MAAM;YAER,KAAK,UAAU;gBACb,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;gBACjC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACvB,MAAM;YACR,KAAK,WAAW;gBACd,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;gBAClC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACxB,MAAM;YACR,KAAK,iBAAiB;gBACpB,OAAO,CAAC,WAAW,GAAG,KAAK,CAAC,SAAS,EAAE,EAAE,iBAAiB,CAAC,CAAC;gBAC5D,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;gBAC5B,MAAM;YACR,KAAK,OAAO;gBACV,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,SAAS,EAAE,EAAE,OAAO,CAAC,CAAC;gBAC3C,MAAM;YACR,KAAK,UAAU;gBACb,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;gBACtB,MAAM;YACR,KAAK,gBAAgB;gBACnB,OAAO,CAAC,WAAW,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;gBAC9C,MAAM;YACR,KAAK,gBAAgB;gBACnB,OAAO,CAAC,WAAW,GAAG,KAAK,CAAC,SAAS,EAAE,EAAE,gBAAgB,CAAC,CAAC;gBAC3D,MAAM;YACR,KAAK,QAAQ;gBACX,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;gBACnC,MAAM;YACR,KAAK,WAAW;gBACd,OAAO,CAAC,YAAY,GAAG,cAAc,CAAC,SAAS,EAAE,CAAC,CAAC;gBACnD,MAAM;YACR,KAAK,WAAW;gBACd,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;gBACtB,MAAM;YACR,KAAK,gBAAgB;gBACnB,OAAO,CAAC,WAAW,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;gBAC9C,MAAM;YACR,KAAK,aAAa;gBAChB,OAAO,CAAC,QAAQ,GAAG,SAAS,EAAE,CAAC;gBAC/B,MAAM;YACR,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,oEAAoE;gBACpE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;oBAC9B,OAAO,CAAC,SAAS,GAAG,WAAW,CAAC;gBAClC,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;oBACzB,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;wBAClE,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;wBACzB,CAAC,EAAE,CAAC;oBACN,CAAC;yBAAM,CAAC;wBACN,OAAO,CAAC,SAAS,GAAG,kBAAkB,CAAC;oBACzC,CAAC;gBACH,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,sBAAsB;gBACzB,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;gBAChC,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;gBACjC,MAAM;YACR,KAAK,iBAAiB;gBACpB,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;gBAC5B,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;gBAC7B,MAAM;YAER,+EAA+E;YAC/E,iDAAiD;YACjD,KAAK,UAAU;gBACb,OAAO,CAAC,UAAU,GAAG,SAAS,EAAE,CAAC;gBACjC,MAAM;YACR,KAAK,kBAAkB;gBACrB,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;gBAC5B,MAAM;YAER,KAAK,WAAW;gBACd,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;gBACvB,MAAM;YACR,KAAK,SAAS;gBACZ,OAAO,CAAC,KAAK,GAAG,SAAS,EAAE,CAAC;gBAC5B,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,mCAAmC;gBAC3D,MAAM;YAER,KAAK,YAAY;gBACf,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;gBACxB,MAAM;YACR,KAAK,eAAe,CAAC,CAAC,CAAC;gBACrB,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,EAAE,EAAE,eAAe,CAAC,CAAC;gBAC9C,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC;gBACxB,uEAAuE;gBACvE,wEAAwE;gBACxE,yEAAyE;gBACzE,oBAAoB;gBACpB,OAAO,CAAC,QAAQ,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC1B,MAAM;YACR,CAAC;YAED,KAAK,YAAY;gBACf,OAAO,CAAC,QAAQ,GAAG,SAAS,EAAE,CAAC;gBAC/B,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACzB,MAAM;YACR,KAAK,kBAAkB;gBACrB,OAAO,CAAC,aAAa,GAAG,SAAS,EAAE,CAAC;gBACpC,MAAM;YACR,KAAK,SAAS;gBACZ,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;gBACrB,MAAM;YACR,KAAK,eAAe;gBAClB,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;gBAC1B,MAAM;YAER;gBACE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;oBACzC,MAAM,IAAI,QAAQ,CAAC,mBAAmB,IAAI,GAAG,CAAC,CAAC;gBACjD,CAAC;gBACD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC7B,MAAM,IAAI,QAAQ,CAChB,8BAA8B,GAAG,2BAA2B,UAAU,IAAI,CAC3E,CAAC;gBACJ,CAAC;gBACD,UAAU,GAAG,GAAG,CAAC;gBACjB,MAAM;QACV,CAAC;IACH,CAAC;IAED,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,GAAG,UAAU,CAAC;IACxD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC5C,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,IAAK,OAA6B,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAoB,CAAC;IAChF,MAAM,IAAI,QAAQ,CAAC,qBAAqB,KAAK,uBAAuB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7F,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,IAAK,cAAoC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAqB,CAAC;IACxF,MAAM,IAAI,QAAQ,CAChB,sBAAsB,KAAK,uBAAuB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC/E,CAAC;AACJ,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,IAAK,cAAoC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAqB,CAAC;IACxF,MAAM,IAAI,QAAQ,CAAC,mBAAmB,KAAK,uBAAuB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClG,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,IAAK,aAAmC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAoB,CAAC;IACtF,MAAM,IAAI,QAAQ,CAChB,2BAA2B,KAAK,uBAAuB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACnF,CAAC;AACJ,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,KAAK,CAAC,KAAa,EAAE,IAAY;IAC/C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,QAAQ,CAAC,WAAW,IAAI,KAAK,KAAK,qCAAqC,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,IAAK,cAAoC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAiB,CAAC;IACpF,MAAM,IAAI,QAAQ,CAAC,qBAAqB,KAAK,uBAAuB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpG,CAAC","sourcesContent":["/**\n * Zero-dependency command-line argument parsing for qScan.\n *\n * Hand-rolled rather than pulled from a library to keep the package free of\n * runtime dependencies. The grammar is deliberately small: long flags\n * (`--flag`, `--flag value`, `--flag=value`), a couple of short aliases\n * (`-o`, `-v`, `-h`), repeatable `--ignore`, and a single optional positional\n * path. Unknown flags are a usage error.\n */\n\nimport { meetsThreshold, SEVERITY_ORDER, severityRank } from \"@quantakrypto/core\";\nimport type { ContextLevel, ReportFormat, SecurityTier, Severity } from \"@quantakrypto/core\";\n\n/** Valid context levels for `--context` (how much source triage/remediate sends). */\nconst CONTEXT_LEVELS: readonly ContextLevel[] = [\"metadata\", \"snippet\", \"function\", \"file\"];\n/** Valid CNSA security tiers for `--tier` (report migration-target guidance). */\nconst SECURITY_TIERS: readonly SecurityTier[] = [\"category-3\", \"category-5\"];\n/** Valid `--llm-provider` values. */\nconst LLM_PROVIDERS = [\"anthropic\", \"openai-compatible\"] as const;\nexport type LlmProvider = (typeof LLM_PROVIDERS)[number];\n\n// Severity ordering, ranking, and threshold logic are the monorepo's single\n// source of truth in `@quantakrypto/core`. Re-export them here so existing\n// `@quantakrypto/qscan` callers (and tests) keep importing them from `./args.js`\n// without qScan maintaining a second, drift-prone copy.\nexport { meetsThreshold, SEVERITY_ORDER, severityRank };\n\n/**\n * Output formats qScan accepts on the command line. Extends core's\n * {@link ReportFormat} with `\"cbom\"` (a CycloneDX cryptographic bill of\n * materials), which qScan renders locally via core's `toCbom`.\n */\nexport type QscanFormat = ReportFormat | \"cbom\" | \"evidence\";\n\nconst FORMATS: readonly QscanFormat[] = [\"human\", \"json\", \"sarif\", \"cbom\", \"evidence\"];\n\n/** Fully-resolved options the CLI/programmatic runner operates on. */\nexport interface QscanOptions {\n  /** Directory or file to scan. */\n  path: string;\n  /** Report format. */\n  format: QscanFormat;\n  /** Write the report to this file instead of stdout, when set. */\n  output?: string;\n  /** Findings at or above this severity cause a non-zero exit. */\n  severityThreshold: Severity;\n  /** Scan source files for inline crypto usage. */\n  source: boolean;\n  /** Scan dependency manifests for vulnerable libraries. */\n  dependencies: boolean;\n  /** Scan config files (TLS/certificates). */\n  config: boolean;\n  /** Extra exclude patterns (repeatable `--ignore`). */\n  ignore: string[];\n  /**\n   * Restrict the walk to paths matching one of these include patterns\n   * (repeatable `--include`). When empty, every non-excluded file is scanned.\n   */\n  include: string[];\n  /** Max file size to read, in bytes (`--max-file-size`). */\n  maxFileSize?: number;\n  /** Disable the built-in ignore list (`--no-default-ignores`). */\n  noDefaultIgnores: boolean;\n  /** Scan minified/generated/bundled files instead of skipping them. */\n  scanMinified: boolean;\n  /**\n   * Incremental mode: scan only the files git reports as changed\n   * (`--changed`), optionally relative to {@link since}.\n   */\n  changed: boolean;\n  /** Git ref/range the `--changed` diff is taken against (`--since`). */\n  since?: string;\n  /** Route the scan through core's worker-thread pool (`--parallel`). */\n  parallel: boolean;\n  /**\n   * Worker count for parallel scanning (`--concurrency`). Implies parallel.\n   * A value of 0 or 1 forces the in-process serial path.\n   */\n  concurrency?: number;\n  /** Suppress findings whose fingerprint is in this baseline file. */\n  baseline?: string;\n  /** Write current findings as a baseline to this file, then exit 0. */\n  writeBaseline?: string;\n  /** Suppress the human summary banner (still writes reports/output files). */\n  quiet: boolean;\n  /** How many findings the human report lists (`--top N`). Default: 5. */\n  topN?: number;\n  /** Rule ids to suppress (from `quantakrypto.config.json` `disabledRules`). */\n  disabledRules?: string[];\n  /** Content-hash scan cache path (`--cache [path]`); reuse unchanged files. */\n  cacheFile?: string;\n  /** Run the BYOK LLM triage pass (`--triage`): annotate + re-sort, never suppress. */\n  triage: boolean;\n  /** Only triage findings at/above this seriousness (`--triage-floor`). Default: medium. */\n  triageFloor?: Severity;\n  /** Cap findings sent to the LLM during triage (`--max-findings`; spend guard). */\n  maxFindings?: number;\n  /** CNSA security tier for the migration-targets footer (`--tier`). Default: none. */\n  tier?: SecurityTier;\n  /** How much source context leaves the machine (`--context`). Default: snippet. */\n  contextLevel?: ContextLevel;\n  /** Print the exact triage payload and exit without calling the provider (`--dry-run`). */\n  dryRun: boolean;\n  /** BYOK provider (`--llm-provider`). Default: anthropic. */\n  llmProvider?: LlmProvider;\n  /** BYOK model id (`--llm-model`). */\n  llmModel?: string;\n  /**\n   * Omit code snippets from the JSON/SARIF report (`--no-snippets`). Passed to\n   * core's reporters as `{ redactSnippets: true }`. Snippets of `sensitive`\n   * findings are always omitted regardless of this flag.\n   */\n  noSnippets: boolean;\n  /**\n   * Explicit path to a `quantakrypto.config.json` (`--config <path>`). Overrides\n   * auto-discovery at the scan root. Distinct from `--no-config`, which toggles\n   * config/TLS *detector* scanning — this names the config FILE.\n   */\n  configFile?: string;\n  /**\n   * Disable `quantakrypto.config.json` auto-discovery (`--no-config-file`). Distinct\n   * from `--no-config` (which skips config-file *detectors*).\n   */\n  noConfigFile: boolean;\n}\n\n/**\n * Option keys that a `quantakrypto.config.json` may also set. When such a key was set\n * by a CLI flag, the flag wins (precedence: flags > config > defaults); when it\n * was left at its default, config may fill it. {@link parseArgs} records which\n * of these keys came from an explicit flag in {@link ParsedRun.explicit}.\n */\nexport type ConfigurableKey =\n  | \"severityThreshold\"\n  | \"source\"\n  | \"dependencies\"\n  | \"config\"\n  | \"include\"\n  | \"ignore\"\n  | \"maxFileSize\"\n  | \"noDefaultIgnores\"\n  | \"scanMinified\"\n  | \"baseline\";\n\n/** A successful parse: resolved options plus which configurable keys were explicit. */\nexport interface ParsedRun {\n  kind: \"run\";\n  options: QscanOptions;\n  /** The set of {@link ConfigurableKey}s the user set via a flag. */\n  explicit: Set<ConfigurableKey>;\n}\n\n/** Result of {@link parseArgs}: either resolved options or a meta action. */\nexport type ParsedArgs = ParsedRun | { kind: \"help\" } | { kind: \"version\" };\n\n/** Thrown on malformed input; the CLI maps this to exit code 2. */\nexport class ArgError extends Error {\n  override readonly name = \"ArgError\";\n}\n\n/** Default options, before any flags are applied. */\nexport function defaultOptions(): QscanOptions {\n  return {\n    path: \".\",\n    format: \"human\",\n    severityThreshold: \"high\",\n    source: true,\n    dependencies: true,\n    config: true,\n    ignore: [],\n    include: [],\n    noDefaultIgnores: false,\n    scanMinified: false,\n    changed: false,\n    parallel: false,\n    quiet: false,\n    noSnippets: false,\n    noConfigFile: false,\n    triage: false,\n    dryRun: false,\n  };\n}\n\n/**\n * Parse a raw argv slice (i.e. without `node` and the script path).\n *\n * @throws {ArgError} On unknown flags, missing values, or invalid enum values.\n */\n/** Default scan-cache file when `--cache` is given without a path. */\nexport const DEFAULT_CACHE_FILE = \".quantakrypto-cache.json\";\n\nexport function parseArgs(argv: readonly string[]): ParsedArgs {\n  const options = defaultOptions();\n  const explicit = new Set<ConfigurableKey>();\n  let positional: string | undefined;\n\n  // Manual index walk so flags can consume the following token as a value.\n  for (let i = 0; i < argv.length; i++) {\n    const arg = argv[i] as string;\n\n    // `--flag=value` → split into flag + inline value.\n    let inlineValue: string | undefined;\n    let flag = arg;\n    if (arg.startsWith(\"--\") && arg.includes(\"=\")) {\n      const eq = arg.indexOf(\"=\");\n      flag = arg.slice(0, eq);\n      inlineValue = arg.slice(eq + 1);\n    }\n\n    /** Consume a value for `flag`: prefer the inline `=value`, else the next token. */\n    const takeValue = (): string => {\n      if (inlineValue !== undefined) return inlineValue;\n      const next = argv[i + 1];\n      if (next === undefined || (next.startsWith(\"-\") && next !== \"-\")) {\n        throw new ArgError(`option \"${flag}\" requires a value`);\n      }\n      i++;\n      return next;\n    };\n\n    /**\n     * Reject an inline `=value` on a boolean flag. Without this, `--quiet=false`\n     * would silently ignore the value and turn the flag ON — the opposite of the\n     * caller's intent. Boolean flags take no value, so any `=value` is an error.\n     */\n    const rejectInlineValue = (): void => {\n      if (inlineValue !== undefined) {\n        throw new ArgError(`option \"${flag}\" is a boolean flag and takes no value`);\n      }\n    };\n\n    switch (flag) {\n      case \"-h\":\n      case \"--help\":\n        return { kind: \"help\" };\n      case \"-v\":\n      case \"--version\":\n        return { kind: \"version\" };\n\n      case \"--format\":\n        options.format = asFormat(takeValue());\n        break;\n      case \"--cbom\":\n        rejectInlineValue();\n        options.format = \"cbom\";\n        break;\n      case \"-o\":\n      case \"--output\":\n        options.output = takeValue();\n        break;\n      case \"--severity-threshold\":\n        options.severityThreshold = asSeverity(takeValue());\n        explicit.add(\"severityThreshold\");\n        break;\n\n      case \"--no-source\":\n        rejectInlineValue();\n        options.source = false;\n        explicit.add(\"source\");\n        break;\n      case \"--no-deps\":\n        rejectInlineValue();\n        options.dependencies = false;\n        explicit.add(\"dependencies\");\n        break;\n      case \"--no-config\":\n        rejectInlineValue();\n        options.config = false;\n        explicit.add(\"config\");\n        break;\n\n      case \"--ignore\":\n        options.ignore.push(takeValue());\n        explicit.add(\"ignore\");\n        break;\n      case \"--include\":\n        options.include.push(takeValue());\n        explicit.add(\"include\");\n        break;\n      case \"--max-file-size\":\n        options.maxFileSize = asInt(takeValue(), \"--max-file-size\");\n        explicit.add(\"maxFileSize\");\n        break;\n      case \"--top\":\n        options.topN = asInt(takeValue(), \"--top\");\n        break;\n      case \"--triage\":\n        rejectInlineValue();\n        options.triage = true;\n        break;\n      case \"--triage-floor\":\n        options.triageFloor = asSeverity(takeValue());\n        break;\n      case \"--max-findings\":\n        options.maxFindings = asInt(takeValue(), \"--max-findings\");\n        break;\n      case \"--tier\":\n        options.tier = asTier(takeValue());\n        break;\n      case \"--context\":\n        options.contextLevel = asContextLevel(takeValue());\n        break;\n      case \"--dry-run\":\n        rejectInlineValue();\n        options.dryRun = true;\n        break;\n      case \"--llm-provider\":\n        options.llmProvider = asProvider(takeValue());\n        break;\n      case \"--llm-model\":\n        options.llmModel = takeValue();\n        break;\n      case \"--cache\": {\n        // `--cache` alone uses the default file; `--cache <path>` names it.\n        if (inlineValue !== undefined) {\n          options.cacheFile = inlineValue;\n        } else {\n          const next = argv[i + 1];\n          if (next !== undefined && !(next.startsWith(\"-\") && next !== \"-\")) {\n            options.cacheFile = next;\n            i++;\n          } else {\n            options.cacheFile = DEFAULT_CACHE_FILE;\n          }\n        }\n        break;\n      }\n      case \"--no-default-ignores\":\n        rejectInlineValue();\n        options.noDefaultIgnores = true;\n        explicit.add(\"noDefaultIgnores\");\n        break;\n      case \"--scan-minified\":\n        rejectInlineValue();\n        options.scanMinified = true;\n        explicit.add(\"scanMinified\");\n        break;\n\n      // `quantakrypto.config.json` FILE controls (distinct from `--no-config`, which\n      // toggles config/TLS *detector* scanning above).\n      case \"--config\":\n        options.configFile = takeValue();\n        break;\n      case \"--no-config-file\":\n        rejectInlineValue();\n        options.noConfigFile = true;\n        break;\n\n      case \"--changed\":\n        rejectInlineValue();\n        options.changed = true;\n        break;\n      case \"--since\":\n        options.since = takeValue();\n        options.changed = true; // --since implies incremental mode\n        break;\n\n      case \"--parallel\":\n        rejectInlineValue();\n        options.parallel = true;\n        break;\n      case \"--concurrency\": {\n        const n = asInt(takeValue(), \"--concurrency\");\n        options.concurrency = n;\n        // `--concurrency 0` documents \"serial\": core treats <1 as \"auto\" (full\n        // parallelism), so without this special-case 0 would do the OPPOSITE of\n        // what's documented. 0 forces the in-process serial path; any value >= 1\n        // implies parallel.\n        options.parallel = n >= 1;\n        break;\n      }\n\n      case \"--baseline\":\n        options.baseline = takeValue();\n        explicit.add(\"baseline\");\n        break;\n      case \"--write-baseline\":\n        options.writeBaseline = takeValue();\n        break;\n      case \"--quiet\":\n        rejectInlineValue();\n        options.quiet = true;\n        break;\n      case \"--no-snippets\":\n        rejectInlineValue();\n        options.noSnippets = true;\n        break;\n\n      default:\n        if (flag.startsWith(\"-\") && flag !== \"-\") {\n          throw new ArgError(`unknown option \"${flag}\"`);\n        }\n        if (positional !== undefined) {\n          throw new ArgError(\n            `unexpected extra argument \"${arg}\" (path already set to \"${positional}\")`,\n          );\n        }\n        positional = arg;\n        break;\n    }\n  }\n\n  if (positional !== undefined) options.path = positional;\n  return { kind: \"run\", options, explicit };\n}\n\n/** Validate/normalize a `--format` value. */\nexport function asFormat(value: string): QscanFormat {\n  if ((FORMATS as readonly string[]).includes(value)) return value as QscanFormat;\n  throw new ArgError(`invalid --format \"${value}\" (expected one of: ${FORMATS.join(\", \")})`);\n}\n\n/** Validate/normalize a `--context` level. */\nexport function asContextLevel(value: string): ContextLevel {\n  if ((CONTEXT_LEVELS as readonly string[]).includes(value)) return value as ContextLevel;\n  throw new ArgError(\n    `invalid --context \"${value}\" (expected one of: ${CONTEXT_LEVELS.join(\", \")})`,\n  );\n}\n\n/** Validate/normalize a `--tier` value. */\nexport function asTier(value: string): SecurityTier {\n  if ((SECURITY_TIERS as readonly string[]).includes(value)) return value as SecurityTier;\n  throw new ArgError(`invalid --tier \"${value}\" (expected one of: ${SECURITY_TIERS.join(\", \")})`);\n}\n\n/** Validate/normalize a `--llm-provider` value. */\nexport function asProvider(value: string): LlmProvider {\n  if ((LLM_PROVIDERS as readonly string[]).includes(value)) return value as LlmProvider;\n  throw new ArgError(\n    `invalid --llm-provider \"${value}\" (expected one of: ${LLM_PROVIDERS.join(\", \")})`,\n  );\n}\n\n/** Validate/normalize a non-negative integer flag value. */\nexport function asInt(value: string, flag: string): number {\n  if (!/^\\d+$/.test(value)) {\n    throw new ArgError(`invalid ${flag} \"${value}\" (expected a non-negative integer)`);\n  }\n  return Number.parseInt(value, 10);\n}\n\n/** Validate/normalize a severity value. */\nexport function asSeverity(value: string): Severity {\n  if ((SEVERITY_ORDER as readonly string[]).includes(value)) return value as Severity;\n  throw new ArgError(`invalid severity \"${value}\" (expected one of: ${SEVERITY_ORDER.join(\", \")})`);\n}\n"]}
+{"version":3,"file":"args.js","sourceRoot":"","sources":["../src/args.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGlF,qFAAqF;AACrF,MAAM,cAAc,GAA4B,CAAC,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;AAC5F,iFAAiF;AACjF,MAAM,cAAc,GAA4B,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;AAC7E,qCAAqC;AACrC,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,mBAAmB,CAAU,CAAC;AAGlE,4EAA4E;AAC5E,2EAA2E;AAC3E,iFAAiF;AACjF,wDAAwD;AACxD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC;AASxD,MAAM,OAAO,GAA2B,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;AA2HvF,mEAAmE;AACnE,MAAM,OAAO,QAAS,SAAQ,KAAK;IACf,IAAI,GAAG,UAAU,CAAC;CACrC;AAED,qDAAqD;AACrD,MAAM,UAAU,cAAc;IAC5B,OAAO;QACL,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,OAAO;QACf,iBAAiB,EAAE,MAAM;QACzB,MAAM,EAAE,IAAI;QACZ,YAAY,EAAE,IAAI;QAClB,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,EAAE;QACV,OAAO,EAAE,EAAE;QACX,gBAAgB,EAAE,KAAK;QACvB,YAAY,EAAE,KAAK;QACnB,OAAO,EAAE,KAAK;QACd,QAAQ,EAAE,KAAK;QACf,KAAK,EAAE,KAAK;QACZ,UAAU,EAAE,KAAK;QACjB,YAAY,EAAE,KAAK;QACnB,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,KAAK;KACd,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,sEAAsE;AACtE,MAAM,CAAC,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AAE7D,MAAM,UAAU,SAAS,CAAC,IAAuB;IAC/C,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC5C,IAAI,UAA8B,CAAC;IAEnC,yEAAyE;IACzE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QAE9B,mDAAmD;QACnD,IAAI,WAA+B,CAAC;QACpC,IAAI,IAAI,GAAG,GAAG,CAAC;QACf,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACxB,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAClC,CAAC;QAED,mFAAmF;QACnF,MAAM,SAAS,GAAG,GAAW,EAAE;YAC7B,IAAI,WAAW,KAAK,SAAS;gBAAE,OAAO,WAAW,CAAC;YAClD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACjE,MAAM,IAAI,QAAQ,CAAC,WAAW,IAAI,oBAAoB,CAAC,CAAC;YAC1D,CAAC;YACD,CAAC,EAAE,CAAC;YACJ,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QAEF;;;;WAIG;QACH,MAAM,iBAAiB,GAAG,GAAS,EAAE;YACnC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,IAAI,QAAQ,CAAC,WAAW,IAAI,wCAAwC,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC,CAAC;QAEF,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,IAAI,CAAC;YACV,KAAK,QAAQ;gBACX,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC1B,KAAK,IAAI,CAAC;YACV,KAAK,WAAW;gBACd,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAE7B,KAAK,UAAU;gBACb,OAAO,CAAC,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;gBACvC,MAAM;YACR,KAAK,QAAQ;gBACX,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;gBACxB,MAAM;YACR,KAAK,IAAI,CAAC;YACV,KAAK,UAAU;gBACb,OAAO,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;gBAC7B,MAAM;YACR,KAAK,sBAAsB;gBACzB,OAAO,CAAC,iBAAiB,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;gBACpD,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;gBAClC,MAAM;YAER,KAAK,aAAa;gBAChB,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC;gBACvB,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACvB,MAAM;YACR,KAAK,WAAW;gBACd,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,YAAY,GAAG,KAAK,CAAC;gBAC7B,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;gBAC7B,MAAM;YACR,KAAK,aAAa;gBAChB,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC;gBACvB,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACvB,MAAM;YAER,KAAK,UAAU;gBACb,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;gBACjC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACvB,MAAM;YACR,KAAK,WAAW;gBACd,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;gBAClC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBACxB,MAAM;YACR,KAAK,iBAAiB;gBACpB,OAAO,CAAC,WAAW,GAAG,KAAK,CAAC,SAAS,EAAE,EAAE,iBAAiB,CAAC,CAAC;gBAC5D,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;gBAC5B,MAAM;YACR,KAAK,OAAO;gBACV,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,SAAS,EAAE,EAAE,OAAO,CAAC,CAAC;gBAC3C,MAAM;YACR,KAAK,UAAU;gBACb,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;gBACtB,MAAM;YACR,KAAK,gBAAgB;gBACnB,OAAO,CAAC,WAAW,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;gBAC9C,MAAM;YACR,KAAK,gBAAgB;gBACnB,OAAO,CAAC,WAAW,GAAG,KAAK,CAAC,SAAS,EAAE,EAAE,gBAAgB,CAAC,CAAC;gBAC3D,MAAM;YACR,KAAK,QAAQ;gBACX,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;gBACnC,MAAM;YACR,KAAK,WAAW;gBACd,OAAO,CAAC,YAAY,GAAG,cAAc,CAAC,SAAS,EAAE,CAAC,CAAC;gBACnD,MAAM;YACR,KAAK,WAAW;gBACd,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;gBACtB,MAAM;YACR,KAAK,gBAAgB;gBACnB,OAAO,CAAC,WAAW,GAAG,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC;gBAC9C,MAAM;YACR,KAAK,aAAa;gBAChB,OAAO,CAAC,QAAQ,GAAG,SAAS,EAAE,CAAC;gBAC/B,MAAM;YACR,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,oEAAoE;gBACpE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;oBAC9B,OAAO,CAAC,SAAS,GAAG,WAAW,CAAC;gBAClC,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;oBACzB,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;wBAClE,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;wBACzB,CAAC,EAAE,CAAC;oBACN,CAAC;yBAAM,CAAC;wBACN,OAAO,CAAC,SAAS,GAAG,kBAAkB,CAAC;oBACzC,CAAC;gBACH,CAAC;gBACD,MAAM;YACR,CAAC;YACD,KAAK,sBAAsB;gBACzB,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;gBAChC,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;gBACjC,MAAM;YACR,KAAK,iBAAiB;gBACpB,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;gBAC5B,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;gBAC7B,MAAM;YAER,+EAA+E;YAC/E,iDAAiD;YACjD,KAAK,UAAU;gBACb,OAAO,CAAC,UAAU,GAAG,SAAS,EAAE,CAAC;gBACjC,MAAM;YACR,KAAK,kBAAkB;gBACrB,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;gBAC5B,MAAM;YAER,KAAK,WAAW;gBACd,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;gBACvB,MAAM;YACR,KAAK,SAAS;gBACZ,OAAO,CAAC,KAAK,GAAG,SAAS,EAAE,CAAC;gBAC5B,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,mCAAmC;gBAC3D,MAAM;YAER,KAAK,YAAY;gBACf,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;gBACxB,MAAM;YACR,KAAK,eAAe,CAAC,CAAC,CAAC;gBACrB,MAAM,CAAC,GAAG,KAAK,CAAC,SAAS,EAAE,EAAE,eAAe,CAAC,CAAC;gBAC9C,OAAO,CAAC,WAAW,GAAG,CAAC,CAAC;gBACxB,uEAAuE;gBACvE,wEAAwE;gBACxE,yEAAyE;gBACzE,oBAAoB;gBACpB,OAAO,CAAC,QAAQ,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC1B,MAAM;YACR,CAAC;YAED,KAAK,YAAY;gBACf,OAAO,CAAC,QAAQ,GAAG,SAAS,EAAE,CAAC;gBAC/B,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBACzB,MAAM;YACR,KAAK,UAAU;gBACb,OAAO,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;gBAC7B,MAAM;YACR,KAAK,kBAAkB;gBACrB,OAAO,CAAC,aAAa,GAAG,SAAS,EAAE,CAAC;gBACpC,MAAM;YACR,KAAK,SAAS;gBACZ,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC;gBACrB,MAAM;YACR,KAAK,eAAe;gBAClB,iBAAiB,EAAE,CAAC;gBACpB,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;gBAC1B,MAAM;YAER;gBACE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;oBACzC,MAAM,IAAI,QAAQ,CAAC,mBAAmB,IAAI,GAAG,CAAC,CAAC;gBACjD,CAAC;gBACD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;oBAC7B,MAAM,IAAI,QAAQ,CAChB,8BAA8B,GAAG,2BAA2B,UAAU,IAAI,CAC3E,CAAC;gBACJ,CAAC;gBACD,UAAU,GAAG,GAAG,CAAC;gBACjB,MAAM;QACV,CAAC;IACH,CAAC;IAED,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,GAAG,UAAU,CAAC;IACxD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC5C,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,IAAK,OAA6B,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAoB,CAAC;IAChF,MAAM,IAAI,QAAQ,CAAC,qBAAqB,KAAK,uBAAuB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7F,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,IAAK,cAAoC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAqB,CAAC;IACxF,MAAM,IAAI,QAAQ,CAChB,sBAAsB,KAAK,uBAAuB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC/E,CAAC;AACJ,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,IAAK,cAAoC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAqB,CAAC;IACxF,MAAM,IAAI,QAAQ,CAAC,mBAAmB,KAAK,uBAAuB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClG,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,IAAK,aAAmC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAoB,CAAC;IACtF,MAAM,IAAI,QAAQ,CAChB,2BAA2B,KAAK,uBAAuB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACnF,CAAC;AACJ,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,KAAK,CAAC,KAAa,EAAE,IAAY;IAC/C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,QAAQ,CAAC,WAAW,IAAI,KAAK,KAAK,qCAAqC,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,IAAK,cAAoC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAiB,CAAC;IACpF,MAAM,IAAI,QAAQ,CAAC,qBAAqB,KAAK,uBAAuB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpG,CAAC","sourcesContent":["/**\n * Zero-dependency command-line argument parsing for qScan.\n *\n * Hand-rolled rather than pulled from a library to keep the package free of\n * runtime dependencies. The grammar is deliberately small: long flags\n * (`--flag`, `--flag value`, `--flag=value`), a couple of short aliases\n * (`-o`, `-v`, `-h`), repeatable `--ignore`, and a single optional positional\n * path. Unknown flags are a usage error.\n */\n\nimport { meetsThreshold, SEVERITY_ORDER, severityRank } from \"@quantakrypto/core\";\nimport type { ContextLevel, ReportFormat, SecurityTier, Severity } from \"@quantakrypto/core\";\n\n/** Valid context levels for `--context` (how much source triage/remediate sends). */\nconst CONTEXT_LEVELS: readonly ContextLevel[] = [\"metadata\", \"snippet\", \"function\", \"file\"];\n/** Valid CNSA security tiers for `--tier` (report migration-target guidance). */\nconst SECURITY_TIERS: readonly SecurityTier[] = [\"category-3\", \"category-5\"];\n/** Valid `--llm-provider` values. */\nconst LLM_PROVIDERS = [\"anthropic\", \"openai-compatible\"] as const;\nexport type LlmProvider = (typeof LLM_PROVIDERS)[number];\n\n// Severity ordering, ranking, and threshold logic are the monorepo's single\n// source of truth in `@quantakrypto/core`. Re-export them here so existing\n// `@quantakrypto/qscan` callers (and tests) keep importing them from `./args.js`\n// without qScan maintaining a second, drift-prone copy.\nexport { meetsThreshold, SEVERITY_ORDER, severityRank };\n\n/**\n * Output formats qScan accepts on the command line. Extends core's\n * {@link ReportFormat} with `\"cbom\"` (a CycloneDX cryptographic bill of\n * materials), which qScan renders locally via core's `toCbom`.\n */\nexport type QscanFormat = ReportFormat | \"cbom\" | \"evidence\";\n\nconst FORMATS: readonly QscanFormat[] = [\"human\", \"json\", \"sarif\", \"cbom\", \"evidence\"];\n\n/** Fully-resolved options the CLI/programmatic runner operates on. */\nexport interface QscanOptions {\n  /** Directory or file to scan. */\n  path: string;\n  /** Report format. */\n  format: QscanFormat;\n  /** Write the report to this file instead of stdout, when set. */\n  output?: string;\n  /** Findings at or above this severity cause a non-zero exit. */\n  severityThreshold: Severity;\n  /** Scan source files for inline crypto usage. */\n  source: boolean;\n  /** Scan dependency manifests for vulnerable libraries. */\n  dependencies: boolean;\n  /** Scan config files (TLS/certificates). */\n  config: boolean;\n  /** Extra exclude patterns (repeatable `--ignore`). */\n  ignore: string[];\n  /**\n   * Restrict the walk to paths matching one of these include patterns\n   * (repeatable `--include`). When empty, every non-excluded file is scanned.\n   */\n  include: string[];\n  /** Max file size to read, in bytes (`--max-file-size`). */\n  maxFileSize?: number;\n  /** Disable the built-in ignore list (`--no-default-ignores`). */\n  noDefaultIgnores: boolean;\n  /** Scan minified/generated/bundled files instead of skipping them. */\n  scanMinified: boolean;\n  /**\n   * Incremental mode: scan only the files git reports as changed\n   * (`--changed`), optionally relative to {@link since}.\n   */\n  changed: boolean;\n  /** Git ref/range the `--changed` diff is taken against (`--since`). */\n  since?: string;\n  /** Route the scan through core's worker-thread pool (`--parallel`). */\n  parallel: boolean;\n  /**\n   * Worker count for parallel scanning (`--concurrency`). Implies parallel.\n   * A value of 0 or 1 forces the in-process serial path.\n   */\n  concurrency?: number;\n  /** Suppress findings whose fingerprint is in this baseline file. */\n  baseline?: string;\n  /** Write current findings as a baseline to this file, then exit 0. */\n  writeBaseline?: string;\n  /** Suppress the human summary banner (still writes reports/output files). */\n  quiet: boolean;\n  /** How many findings the human report lists (`--top N`). Default: 5. */\n  topN?: number;\n  /** Rule ids to suppress (from `quantakrypto.config.json` `disabledRules`). */\n  disabledRules?: string[];\n  /** Content-hash scan cache path (`--cache [path]`); reuse unchanged files. */\n  cacheFile?: string;\n  /** Run the BYOK LLM triage pass (`--triage`): annotate + re-sort, never suppress. */\n  triage: boolean;\n  /** Only triage findings at/above this seriousness (`--triage-floor`). Default: medium. */\n  triageFloor?: Severity;\n  /** Cap findings sent to the LLM during triage (`--max-findings`; spend guard). */\n  maxFindings?: number;\n  /** CNSA security tier for the migration-targets footer (`--tier`). Default: none. */\n  tier?: SecurityTier;\n  /** Org cryptography policy file (`--policy`) for the evidence report's §4 verdicts. */\n  policy?: string;\n  /** How much source context leaves the machine (`--context`). Default: snippet. */\n  contextLevel?: ContextLevel;\n  /** Print the exact triage payload and exit without calling the provider (`--dry-run`). */\n  dryRun: boolean;\n  /** BYOK provider (`--llm-provider`). Default: anthropic. */\n  llmProvider?: LlmProvider;\n  /** BYOK model id (`--llm-model`). */\n  llmModel?: string;\n  /**\n   * Omit code snippets from the JSON/SARIF report (`--no-snippets`). Passed to\n   * core's reporters as `{ redactSnippets: true }`. Snippets of `sensitive`\n   * findings are always omitted regardless of this flag.\n   */\n  noSnippets: boolean;\n  /**\n   * Explicit path to a `quantakrypto.config.json` (`--config <path>`). Overrides\n   * auto-discovery at the scan root. Distinct from `--no-config`, which toggles\n   * config/TLS *detector* scanning — this names the config FILE.\n   */\n  configFile?: string;\n  /**\n   * Disable `quantakrypto.config.json` auto-discovery (`--no-config-file`). Distinct\n   * from `--no-config` (which skips config-file *detectors*).\n   */\n  noConfigFile: boolean;\n}\n\n/**\n * Option keys that a `quantakrypto.config.json` may also set. When such a key was set\n * by a CLI flag, the flag wins (precedence: flags > config > defaults); when it\n * was left at its default, config may fill it. {@link parseArgs} records which\n * of these keys came from an explicit flag in {@link ParsedRun.explicit}.\n */\nexport type ConfigurableKey =\n  | \"severityThreshold\"\n  | \"source\"\n  | \"dependencies\"\n  | \"config\"\n  | \"include\"\n  | \"ignore\"\n  | \"maxFileSize\"\n  | \"noDefaultIgnores\"\n  | \"scanMinified\"\n  | \"baseline\";\n\n/** A successful parse: resolved options plus which configurable keys were explicit. */\nexport interface ParsedRun {\n  kind: \"run\";\n  options: QscanOptions;\n  /** The set of {@link ConfigurableKey}s the user set via a flag. */\n  explicit: Set<ConfigurableKey>;\n}\n\n/** Result of {@link parseArgs}: either resolved options or a meta action. */\nexport type ParsedArgs = ParsedRun | { kind: \"help\" } | { kind: \"version\" };\n\n/** Thrown on malformed input; the CLI maps this to exit code 2. */\nexport class ArgError extends Error {\n  override readonly name = \"ArgError\";\n}\n\n/** Default options, before any flags are applied. */\nexport function defaultOptions(): QscanOptions {\n  return {\n    path: \".\",\n    format: \"human\",\n    severityThreshold: \"high\",\n    source: true,\n    dependencies: true,\n    config: true,\n    ignore: [],\n    include: [],\n    noDefaultIgnores: false,\n    scanMinified: false,\n    changed: false,\n    parallel: false,\n    quiet: false,\n    noSnippets: false,\n    noConfigFile: false,\n    triage: false,\n    dryRun: false,\n  };\n}\n\n/**\n * Parse a raw argv slice (i.e. without `node` and the script path).\n *\n * @throws {ArgError} On unknown flags, missing values, or invalid enum values.\n */\n/** Default scan-cache file when `--cache` is given without a path. */\nexport const DEFAULT_CACHE_FILE = \".quantakrypto-cache.json\";\n\nexport function parseArgs(argv: readonly string[]): ParsedArgs {\n  const options = defaultOptions();\n  const explicit = new Set<ConfigurableKey>();\n  let positional: string | undefined;\n\n  // Manual index walk so flags can consume the following token as a value.\n  for (let i = 0; i < argv.length; i++) {\n    const arg = argv[i] as string;\n\n    // `--flag=value` → split into flag + inline value.\n    let inlineValue: string | undefined;\n    let flag = arg;\n    if (arg.startsWith(\"--\") && arg.includes(\"=\")) {\n      const eq = arg.indexOf(\"=\");\n      flag = arg.slice(0, eq);\n      inlineValue = arg.slice(eq + 1);\n    }\n\n    /** Consume a value for `flag`: prefer the inline `=value`, else the next token. */\n    const takeValue = (): string => {\n      if (inlineValue !== undefined) return inlineValue;\n      const next = argv[i + 1];\n      if (next === undefined || (next.startsWith(\"-\") && next !== \"-\")) {\n        throw new ArgError(`option \"${flag}\" requires a value`);\n      }\n      i++;\n      return next;\n    };\n\n    /**\n     * Reject an inline `=value` on a boolean flag. Without this, `--quiet=false`\n     * would silently ignore the value and turn the flag ON — the opposite of the\n     * caller's intent. Boolean flags take no value, so any `=value` is an error.\n     */\n    const rejectInlineValue = (): void => {\n      if (inlineValue !== undefined) {\n        throw new ArgError(`option \"${flag}\" is a boolean flag and takes no value`);\n      }\n    };\n\n    switch (flag) {\n      case \"-h\":\n      case \"--help\":\n        return { kind: \"help\" };\n      case \"-v\":\n      case \"--version\":\n        return { kind: \"version\" };\n\n      case \"--format\":\n        options.format = asFormat(takeValue());\n        break;\n      case \"--cbom\":\n        rejectInlineValue();\n        options.format = \"cbom\";\n        break;\n      case \"-o\":\n      case \"--output\":\n        options.output = takeValue();\n        break;\n      case \"--severity-threshold\":\n        options.severityThreshold = asSeverity(takeValue());\n        explicit.add(\"severityThreshold\");\n        break;\n\n      case \"--no-source\":\n        rejectInlineValue();\n        options.source = false;\n        explicit.add(\"source\");\n        break;\n      case \"--no-deps\":\n        rejectInlineValue();\n        options.dependencies = false;\n        explicit.add(\"dependencies\");\n        break;\n      case \"--no-config\":\n        rejectInlineValue();\n        options.config = false;\n        explicit.add(\"config\");\n        break;\n\n      case \"--ignore\":\n        options.ignore.push(takeValue());\n        explicit.add(\"ignore\");\n        break;\n      case \"--include\":\n        options.include.push(takeValue());\n        explicit.add(\"include\");\n        break;\n      case \"--max-file-size\":\n        options.maxFileSize = asInt(takeValue(), \"--max-file-size\");\n        explicit.add(\"maxFileSize\");\n        break;\n      case \"--top\":\n        options.topN = asInt(takeValue(), \"--top\");\n        break;\n      case \"--triage\":\n        rejectInlineValue();\n        options.triage = true;\n        break;\n      case \"--triage-floor\":\n        options.triageFloor = asSeverity(takeValue());\n        break;\n      case \"--max-findings\":\n        options.maxFindings = asInt(takeValue(), \"--max-findings\");\n        break;\n      case \"--tier\":\n        options.tier = asTier(takeValue());\n        break;\n      case \"--context\":\n        options.contextLevel = asContextLevel(takeValue());\n        break;\n      case \"--dry-run\":\n        rejectInlineValue();\n        options.dryRun = true;\n        break;\n      case \"--llm-provider\":\n        options.llmProvider = asProvider(takeValue());\n        break;\n      case \"--llm-model\":\n        options.llmModel = takeValue();\n        break;\n      case \"--cache\": {\n        // `--cache` alone uses the default file; `--cache <path>` names it.\n        if (inlineValue !== undefined) {\n          options.cacheFile = inlineValue;\n        } else {\n          const next = argv[i + 1];\n          if (next !== undefined && !(next.startsWith(\"-\") && next !== \"-\")) {\n            options.cacheFile = next;\n            i++;\n          } else {\n            options.cacheFile = DEFAULT_CACHE_FILE;\n          }\n        }\n        break;\n      }\n      case \"--no-default-ignores\":\n        rejectInlineValue();\n        options.noDefaultIgnores = true;\n        explicit.add(\"noDefaultIgnores\");\n        break;\n      case \"--scan-minified\":\n        rejectInlineValue();\n        options.scanMinified = true;\n        explicit.add(\"scanMinified\");\n        break;\n\n      // `quantakrypto.config.json` FILE controls (distinct from `--no-config`, which\n      // toggles config/TLS *detector* scanning above).\n      case \"--config\":\n        options.configFile = takeValue();\n        break;\n      case \"--no-config-file\":\n        rejectInlineValue();\n        options.noConfigFile = true;\n        break;\n\n      case \"--changed\":\n        rejectInlineValue();\n        options.changed = true;\n        break;\n      case \"--since\":\n        options.since = takeValue();\n        options.changed = true; // --since implies incremental mode\n        break;\n\n      case \"--parallel\":\n        rejectInlineValue();\n        options.parallel = true;\n        break;\n      case \"--concurrency\": {\n        const n = asInt(takeValue(), \"--concurrency\");\n        options.concurrency = n;\n        // `--concurrency 0` documents \"serial\": core treats <1 as \"auto\" (full\n        // parallelism), so without this special-case 0 would do the OPPOSITE of\n        // what's documented. 0 forces the in-process serial path; any value >= 1\n        // implies parallel.\n        options.parallel = n >= 1;\n        break;\n      }\n\n      case \"--baseline\":\n        options.baseline = takeValue();\n        explicit.add(\"baseline\");\n        break;\n      case \"--policy\":\n        options.policy = takeValue();\n        break;\n      case \"--write-baseline\":\n        options.writeBaseline = takeValue();\n        break;\n      case \"--quiet\":\n        rejectInlineValue();\n        options.quiet = true;\n        break;\n      case \"--no-snippets\":\n        rejectInlineValue();\n        options.noSnippets = true;\n        break;\n\n      default:\n        if (flag.startsWith(\"-\") && flag !== \"-\") {\n          throw new ArgError(`unknown option \"${flag}\"`);\n        }\n        if (positional !== undefined) {\n          throw new ArgError(\n            `unexpected extra argument \"${arg}\" (path already set to \"${positional}\")`,\n          );\n        }\n        positional = arg;\n        break;\n    }\n  }\n\n  if (positional !== undefined) options.path = positional;\n  return { kind: \"run\", options, explicit };\n}\n\n/** Validate/normalize a `--format` value. */\nexport function asFormat(value: string): QscanFormat {\n  if ((FORMATS as readonly string[]).includes(value)) return value as QscanFormat;\n  throw new ArgError(`invalid --format \"${value}\" (expected one of: ${FORMATS.join(\", \")})`);\n}\n\n/** Validate/normalize a `--context` level. */\nexport function asContextLevel(value: string): ContextLevel {\n  if ((CONTEXT_LEVELS as readonly string[]).includes(value)) return value as ContextLevel;\n  throw new ArgError(\n    `invalid --context \"${value}\" (expected one of: ${CONTEXT_LEVELS.join(\", \")})`,\n  );\n}\n\n/** Validate/normalize a `--tier` value. */\nexport function asTier(value: string): SecurityTier {\n  if ((SECURITY_TIERS as readonly string[]).includes(value)) return value as SecurityTier;\n  throw new ArgError(`invalid --tier \"${value}\" (expected one of: ${SECURITY_TIERS.join(\", \")})`);\n}\n\n/** Validate/normalize a `--llm-provider` value. */\nexport function asProvider(value: string): LlmProvider {\n  if ((LLM_PROVIDERS as readonly string[]).includes(value)) return value as LlmProvider;\n  throw new ArgError(\n    `invalid --llm-provider \"${value}\" (expected one of: ${LLM_PROVIDERS.join(\", \")})`,\n  );\n}\n\n/** Validate/normalize a non-negative integer flag value. */\nexport function asInt(value: string, flag: string): number {\n  if (!/^\\d+$/.test(value)) {\n    throw new ArgError(`invalid ${flag} \"${value}\" (expected a non-negative integer)`);\n  }\n  return Number.parseInt(value, 10);\n}\n\n/** Validate/normalize a severity value. */\nexport function asSeverity(value: string): Severity {\n  if ((SEVERITY_ORDER as readonly string[]).includes(value)) return value as Severity;\n  throw new ArgError(`invalid severity \"${value}\" (expected one of: ${SEVERITY_ORDER.join(\", \")})`);\n}\n"]}

dist/help.d.ts

@@ -8,5 +8,5 @@ /**
 /** The full `--help` screen. */
-export declare const HELP_TEXT = "qscan \u2014 find quantum-vulnerable cryptography in any codebase\n\nUSAGE\n  qscan [path] [options]\n\nARGUMENTS\n  path                          Directory or file to scan (default: \".\")\n\nOPTIONS\n  --format <human|json|sarif|cbom|evidence>\n                                Output format (default: human)\n  --cbom                        Alias for --format cbom (CycloneDX CBOM)\n  --format evidence             ISO 27001 A.8.24 readiness report \u2014 findings +\n                                inventory + CBOM + a deterministic content hash\n                                (sign/timestamp it with an external signer)\n  -o, --output <file>           Write the report to a file instead of stdout\n  --severity-threshold <level>  Fail (exit 1) on findings at/above this level;\n                                one of critical|high|medium|low|info\n                                (default: high)\n  --no-source                   Skip scanning source files for inline crypto\n  --no-deps                     Skip scanning dependency manifests\n  --no-config                   Skip scanning config files (TLS/certificates)\n  --config <path>               Use this quantakrypto.config.json instead of\n                                auto-discovering one at the scan root\n  --no-config-file              Disable quantakrypto.config.json auto-discovery\n  --ignore <pattern>            Exclude paths matching <pattern> (repeatable)\n  --include <pattern>           Restrict the scan to matching paths (repeatable)\n  --max-file-size <bytes>       Skip files larger than <bytes> (default: 2 MiB)\n  --no-default-ignores          Don't skip node_modules/.git/dist by default\n  --scan-minified               Scan minified/generated/bundled files too\n  --changed                     Scan only files changed in the git work tree\n  --since <git-ref>             With --changed, diff against <git-ref>\n  --parallel                    Scan using a worker-thread pool when worthwhile\n  --concurrency <n>             Worker count for --parallel (implies --parallel);\n                                0 forces the in-process serial path\n  --top <n>                     List <n> findings in the human report (default: 5)\n  --tier <category-3|category-5> Add CNSA migration targets to the report footer\n                                (category-5 = CNSA 2.0: ML-KEM-1024 / ML-DSA-87)\n  --cache [file]                Reuse findings for unchanged files across runs\n                                (default file: .quantakrypto-cache.json)\n  --triage                      BYOK LLM pass that re-ranks findings by real\n                                exposure and explains them (never suppresses,\n                                never changes the exit code). Needs an API key in\n                                QK_LLM_API_KEY / ANTHROPIC_API_KEY / OPENAI_API_KEY\n  --triage-floor <level>        Only triage findings at/above this level (default: medium)\n  --max-findings <n>            Cap findings sent to the LLM during triage (default: 100; spend guard)\n  --context <level>             Source shared with the LLM: metadata|snippet|\n                                function|file (default: snippet; secrets always redacted)\n  --dry-run                     With --triage, print the exact payload that would\n                                be sent and exit without calling the provider\n  --llm-provider <name>         anthropic | openai-compatible (default: anthropic)\n  --llm-model <id>              Model id for the BYOK provider\n  --baseline <file>             Suppress findings listed in a baseline file\n  --write-baseline <file>       Write current findings as a baseline, then exit 0\n  --quiet                       Suppress the human summary banner\n  --no-snippets                 Omit code snippets from the json/sarif report\n  -v, --version                 Print version and exit\n  -h, --help                    Print this help and exit\n\nEXIT CODES\n  0   No findings at/above the threshold (or a baseline was written)\n  1   One or more findings at/above the severity threshold\n  2   Usage error or I/O failure\n\nEXAMPLES\n  qscan .                       Scan the current directory\n  qscan src --format sarif -o qscan.sarif\n  qscan . --severity-threshold critical\n  qscan . --write-baseline qscan-baseline.json\n  qscan . --baseline qscan-baseline.json\n  qscan . --include src --include lib\n  qscan . --config ./ci/quantakrypto.config.json\n  qscan . --changed --since origin/main\n  qscan . --parallel --concurrency 4\n  qscan . --cbom -o qscan-cbom.json\n";
+export declare const HELP_TEXT = "qscan \u2014 find quantum-vulnerable cryptography in any codebase\n\nUSAGE\n  qscan [path] [options]\n\nARGUMENTS\n  path                          Directory or file to scan (default: \".\")\n\nOPTIONS\n  --format <human|json|sarif|cbom|evidence>\n                                Output format (default: human)\n  --cbom                        Alias for --format cbom (CycloneDX CBOM)\n  --format evidence             ISO 27001 A.8.24 readiness report \u2014 findings +\n                                inventory + CBOM + a deterministic content hash\n                                (sign/timestamp it with an external signer)\n  --policy <file>               Crypto-policy JSON; adds conformant/violation/\n                                transition verdicts to the evidence report\n  -o, --output <file>           Write the report to a file instead of stdout\n  --severity-threshold <level>  Fail (exit 1) on findings at/above this level;\n                                one of critical|high|medium|low|info\n                                (default: high)\n  --no-source                   Skip scanning source files for inline crypto\n  --no-deps                     Skip scanning dependency manifests\n  --no-config                   Skip scanning config files (TLS/certificates)\n  --config <path>               Use this quantakrypto.config.json instead of\n                                auto-discovering one at the scan root\n  --no-config-file              Disable quantakrypto.config.json auto-discovery\n  --ignore <pattern>            Exclude paths matching <pattern> (repeatable)\n  --include <pattern>           Restrict the scan to matching paths (repeatable)\n  --max-file-size <bytes>       Skip files larger than <bytes> (default: 2 MiB)\n  --no-default-ignores          Don't skip node_modules/.git/dist by default\n  --scan-minified               Scan minified/generated/bundled files too\n  --changed                     Scan only files changed in the git work tree\n  --since <git-ref>             With --changed, diff against <git-ref>\n  --parallel                    Scan using a worker-thread pool when worthwhile\n  --concurrency <n>             Worker count for --parallel (implies --parallel);\n                                0 forces the in-process serial path\n  --top <n>                     List <n> findings in the human report (default: 5)\n  --tier <category-3|category-5> Add CNSA migration targets to the report footer\n                                (category-5 = CNSA 2.0: ML-KEM-1024 / ML-DSA-87)\n  --cache [file]                Reuse findings for unchanged files across runs\n                                (default file: .quantakrypto-cache.json)\n  --triage                      BYOK LLM pass that re-ranks findings by real\n                                exposure and explains them (never suppresses,\n                                never changes the exit code). Needs an API key in\n                                QK_LLM_API_KEY / ANTHROPIC_API_KEY / OPENAI_API_KEY\n  --triage-floor <level>        Only triage findings at/above this level (default: medium)\n  --max-findings <n>            Cap findings sent to the LLM during triage (default: 100; spend guard)\n  --context <level>             Source shared with the LLM: metadata|snippet|\n                                function|file (default: snippet; secrets always redacted)\n  --dry-run                     With --triage, print the exact payload that would\n                                be sent and exit without calling the provider\n  --llm-provider <name>         anthropic | openai-compatible (default: anthropic)\n  --llm-model <id>              Model id for the BYOK provider\n  --baseline <file>             Suppress findings listed in a baseline file\n  --write-baseline <file>       Write current findings as a baseline, then exit 0\n  --quiet                       Suppress the human summary banner\n  --no-snippets                 Omit code snippets from the json/sarif report\n  -v, --version                 Print version and exit\n  -h, --help                    Print this help and exit\n\nEXIT CODES\n  0   No findings at/above the threshold (or a baseline was written)\n  1   One or more findings at/above the severity threshold\n  2   Usage error or I/O failure\n\nEXAMPLES\n  qscan .                       Scan the current directory\n  qscan src --format sarif -o qscan.sarif\n  qscan . --severity-threshold critical\n  qscan . --write-baseline qscan-baseline.json\n  qscan . --baseline qscan-baseline.json\n  qscan . --include src --include lib\n  qscan . --config ./ci/quantakrypto.config.json\n  qscan . --changed --since origin/main\n  qscan . --parallel --concurrency 4\n  qscan . --cbom -o qscan-cbom.json\n";
 /** The `--version` line. */
 export declare function versionLine(): string;
 //# sourceMappingURL=help.d.ts.map

dist/help.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"help.d.ts","sourceRoot":"","sources":["../src/help.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,gCAAgC;AAChC,eAAO,MAAM,SAAS,m/IA2ErB,CAAC;AAEF,4BAA4B;AAC5B,wBAAgB,WAAW,IAAI,MAAM,CAEpC"}
+{"version":3,"file":"help.d.ts","sourceRoot":"","sources":["../src/help.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,gCAAgC;AAChC,eAAO,MAAM,SAAS,+oJA6ErB,CAAC;AAEF,4BAA4B;AAC5B,wBAAgB,WAAW,IAAI,MAAM,CAEpC"}

dist/help.js

@@ -24,2 +24,4 @@ /**
                                 (sign/timestamp it with an external signer)
+  --policy <file>               Crypto-policy JSON; adds conformant/violation/
+                                transition verdicts to the evidence report
   -o, --output <file>           Write the report to a file instead of stdout
@@ -26,0 +28,0 @@ --severity-threshold <level>  Fail (exit 1) on findings at/above this level;

dist/help.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"help.js","sourceRoot":"","sources":["../src/help.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C,gCAAgC;AAChC,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2ExB,CAAC;AAEF,4BAA4B;AAC5B,MAAM,UAAU,WAAW;IACzB,OAAO,SAAS,OAAO,EAAE,CAAC;AAC5B,CAAC","sourcesContent":["/**\n * Static help / usage text for the qScan CLI.\n *\n * Kept in its own module so it can be unit-tested and reused without pulling in\n * filesystem or process side effects.\n */\n\nimport { VERSION } from \"@quantakrypto/core\";\n\n/** The full `--help` screen. */\nexport const HELP_TEXT = `qscan — find quantum-vulnerable cryptography in any codebase\n\nUSAGE\n  qscan [path] [options]\n\nARGUMENTS\n  path                          Directory or file to scan (default: \".\")\n\nOPTIONS\n  --format <human|json|sarif|cbom|evidence>\n                                Output format (default: human)\n  --cbom                        Alias for --format cbom (CycloneDX CBOM)\n  --format evidence             ISO 27001 A.8.24 readiness report — findings +\n                                inventory + CBOM + a deterministic content hash\n                                (sign/timestamp it with an external signer)\n  -o, --output <file>           Write the report to a file instead of stdout\n  --severity-threshold <level>  Fail (exit 1) on findings at/above this level;\n                                one of critical|high|medium|low|info\n                                (default: high)\n  --no-source                   Skip scanning source files for inline crypto\n  --no-deps                     Skip scanning dependency manifests\n  --no-config                   Skip scanning config files (TLS/certificates)\n  --config <path>               Use this quantakrypto.config.json instead of\n                                auto-discovering one at the scan root\n  --no-config-file              Disable quantakrypto.config.json auto-discovery\n  --ignore <pattern>            Exclude paths matching <pattern> (repeatable)\n  --include <pattern>           Restrict the scan to matching paths (repeatable)\n  --max-file-size <bytes>       Skip files larger than <bytes> (default: 2 MiB)\n  --no-default-ignores          Don't skip node_modules/.git/dist by default\n  --scan-minified               Scan minified/generated/bundled files too\n  --changed                     Scan only files changed in the git work tree\n  --since <git-ref>             With --changed, diff against <git-ref>\n  --parallel                    Scan using a worker-thread pool when worthwhile\n  --concurrency <n>             Worker count for --parallel (implies --parallel);\n                                0 forces the in-process serial path\n  --top <n>                     List <n> findings in the human report (default: 5)\n  --tier <category-3|category-5> Add CNSA migration targets to the report footer\n                                (category-5 = CNSA 2.0: ML-KEM-1024 / ML-DSA-87)\n  --cache [file]                Reuse findings for unchanged files across runs\n                                (default file: .quantakrypto-cache.json)\n  --triage                      BYOK LLM pass that re-ranks findings by real\n                                exposure and explains them (never suppresses,\n                                never changes the exit code). Needs an API key in\n                                QK_LLM_API_KEY / ANTHROPIC_API_KEY / OPENAI_API_KEY\n  --triage-floor <level>        Only triage findings at/above this level (default: medium)\n  --max-findings <n>            Cap findings sent to the LLM during triage (default: 100; spend guard)\n  --context <level>             Source shared with the LLM: metadata|snippet|\n                                function|file (default: snippet; secrets always redacted)\n  --dry-run                     With --triage, print the exact payload that would\n                                be sent and exit without calling the provider\n  --llm-provider <name>         anthropic | openai-compatible (default: anthropic)\n  --llm-model <id>              Model id for the BYOK provider\n  --baseline <file>             Suppress findings listed in a baseline file\n  --write-baseline <file>       Write current findings as a baseline, then exit 0\n  --quiet                       Suppress the human summary banner\n  --no-snippets                 Omit code snippets from the json/sarif report\n  -v, --version                 Print version and exit\n  -h, --help                    Print this help and exit\n\nEXIT CODES\n  0   No findings at/above the threshold (or a baseline was written)\n  1   One or more findings at/above the severity threshold\n  2   Usage error or I/O failure\n\nEXAMPLES\n  qscan .                       Scan the current directory\n  qscan src --format sarif -o qscan.sarif\n  qscan . --severity-threshold critical\n  qscan . --write-baseline qscan-baseline.json\n  qscan . --baseline qscan-baseline.json\n  qscan . --include src --include lib\n  qscan . --config ./ci/quantakrypto.config.json\n  qscan . --changed --since origin/main\n  qscan . --parallel --concurrency 4\n  qscan . --cbom -o qscan-cbom.json\n`;\n\n/** The `--version` line. */\nexport function versionLine(): string {\n  return `qscan ${VERSION}`;\n}\n"]}
+{"version":3,"file":"help.js","sourceRoot":"","sources":["../src/help.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C,gCAAgC;AAChC,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6ExB,CAAC;AAEF,4BAA4B;AAC5B,MAAM,UAAU,WAAW;IACzB,OAAO,SAAS,OAAO,EAAE,CAAC;AAC5B,CAAC","sourcesContent":["/**\n * Static help / usage text for the qScan CLI.\n *\n * Kept in its own module so it can be unit-tested and reused without pulling in\n * filesystem or process side effects.\n */\n\nimport { VERSION } from \"@quantakrypto/core\";\n\n/** The full `--help` screen. */\nexport const HELP_TEXT = `qscan — find quantum-vulnerable cryptography in any codebase\n\nUSAGE\n  qscan [path] [options]\n\nARGUMENTS\n  path                          Directory or file to scan (default: \".\")\n\nOPTIONS\n  --format <human|json|sarif|cbom|evidence>\n                                Output format (default: human)\n  --cbom                        Alias for --format cbom (CycloneDX CBOM)\n  --format evidence             ISO 27001 A.8.24 readiness report — findings +\n                                inventory + CBOM + a deterministic content hash\n                                (sign/timestamp it with an external signer)\n  --policy <file>               Crypto-policy JSON; adds conformant/violation/\n                                transition verdicts to the evidence report\n  -o, --output <file>           Write the report to a file instead of stdout\n  --severity-threshold <level>  Fail (exit 1) on findings at/above this level;\n                                one of critical|high|medium|low|info\n                                (default: high)\n  --no-source                   Skip scanning source files for inline crypto\n  --no-deps                     Skip scanning dependency manifests\n  --no-config                   Skip scanning config files (TLS/certificates)\n  --config <path>               Use this quantakrypto.config.json instead of\n                                auto-discovering one at the scan root\n  --no-config-file              Disable quantakrypto.config.json auto-discovery\n  --ignore <pattern>            Exclude paths matching <pattern> (repeatable)\n  --include <pattern>           Restrict the scan to matching paths (repeatable)\n  --max-file-size <bytes>       Skip files larger than <bytes> (default: 2 MiB)\n  --no-default-ignores          Don't skip node_modules/.git/dist by default\n  --scan-minified               Scan minified/generated/bundled files too\n  --changed                     Scan only files changed in the git work tree\n  --since <git-ref>             With --changed, diff against <git-ref>\n  --parallel                    Scan using a worker-thread pool when worthwhile\n  --concurrency <n>             Worker count for --parallel (implies --parallel);\n                                0 forces the in-process serial path\n  --top <n>                     List <n> findings in the human report (default: 5)\n  --tier <category-3|category-5> Add CNSA migration targets to the report footer\n                                (category-5 = CNSA 2.0: ML-KEM-1024 / ML-DSA-87)\n  --cache [file]                Reuse findings for unchanged files across runs\n                                (default file: .quantakrypto-cache.json)\n  --triage                      BYOK LLM pass that re-ranks findings by real\n                                exposure and explains them (never suppresses,\n                                never changes the exit code). Needs an API key in\n                                QK_LLM_API_KEY / ANTHROPIC_API_KEY / OPENAI_API_KEY\n  --triage-floor <level>        Only triage findings at/above this level (default: medium)\n  --max-findings <n>            Cap findings sent to the LLM during triage (default: 100; spend guard)\n  --context <level>             Source shared with the LLM: metadata|snippet|\n                                function|file (default: snippet; secrets always redacted)\n  --dry-run                     With --triage, print the exact payload that would\n                                be sent and exit without calling the provider\n  --llm-provider <name>         anthropic | openai-compatible (default: anthropic)\n  --llm-model <id>              Model id for the BYOK provider\n  --baseline <file>             Suppress findings listed in a baseline file\n  --write-baseline <file>       Write current findings as a baseline, then exit 0\n  --quiet                       Suppress the human summary banner\n  --no-snippets                 Omit code snippets from the json/sarif report\n  -v, --version                 Print version and exit\n  -h, --help                    Print this help and exit\n\nEXIT CODES\n  0   No findings at/above the threshold (or a baseline was written)\n  1   One or more findings at/above the severity threshold\n  2   Usage error or I/O failure\n\nEXAMPLES\n  qscan .                       Scan the current directory\n  qscan src --format sarif -o qscan.sarif\n  qscan . --severity-threshold critical\n  qscan . --write-baseline qscan-baseline.json\n  qscan . --baseline qscan-baseline.json\n  qscan . --include src --include lib\n  qscan . --config ./ci/quantakrypto.config.json\n  qscan . --changed --since origin/main\n  qscan . --parallel --concurrency 4\n  qscan . --cbom -o qscan-cbom.json\n`;\n\n/** The `--version` line. */\nexport function versionLine(): string {\n  return `qscan ${VERSION}`;\n}\n"]}

dist/index.d.ts

@@ -12,3 +12,3 @@ /**
  */
-import type { Baseline, Finding, ParallelScanOptions, ScanResult, SecurityTier } from "@quantakrypto/core";
+import type { Baseline, CryptoPolicy, Finding, ParallelScanOptions, ScanResult, SecurityTier } from "@quantakrypto/core";
 import type { QscanOptions } from "./args.js";
@@ -67,2 +67,7 @@ export type { QscanOptions, ParsedArgs, ParsedRun, QscanFormat } from "./args.js";
     changedFilesFn?: ChangedFilesFn;
+    /** Inject the triage function (offline testing of the `--triage` path, so the
+     * exit-code invariant can be exercised without a network client or API key).
+     * `import type` keeps this a compile-time-only reference — the networked agent
+     * package is still only loaded via the dynamic import inside `runTriage`. */
+    triageFn?: import("./triage-run.js").TriageFn;
 }
@@ -109,2 +114,4 @@ /**
     tier?: SecurityTier;
+    /** Org cryptography policy for the evidence report's §4 verdicts (`--policy`). */
+    policy?: CryptoPolicy;
 }
@@ -111,0 +118,0 @@ /** Render a scan result in the requested format. */

dist/index.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,OAAO,KAAK,EACV,QAAQ,EACR,OAAO,EACP,mBAAmB,EACnB,UAAU,EACV,YAAY,EACb,MAAM,oBAAoB,CAAC;AAI5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAG9C,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAClF,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,KAAK,EACL,UAAU,EACV,cAAc,EACd,cAAc,EACd,SAAS,EACT,YAAY,EACZ,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,WAAW,EACX,cAAc,EACd,cAAc,GACf,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,aAAa,EACb,gBAAgB,EAChB,YAAY,EACZ,cAAc,GACf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACzD,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,YAAY,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEjD,2CAA2C;AAC3C,eAAO,MAAM,IAAI;IACf,iEAAiE;;IAEjE,4DAA4D;;IAE5D,kCAAkC;;CAE1B,CAAC;AAEX,mCAAmC;AACnC,MAAM,WAAW,QAAQ;IACvB,wEAAwE;IACxE,MAAM,EAAE,UAAU,CAAC;IACnB,yEAAyE;IACzE,UAAU,EAAE,OAAO,EAAE,CAAC;IACtB,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,eAAe,CAAC,EAAE,QAAQ,CAAC;IAC3B,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,MAAM,MAAM,GAAG,CAAC,OAAO,EAAE,mBAAmB,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;AAE3E;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AAEjF,iEAAiE;AACjE,MAAM,WAAW,aAAa;IAC5B,+DAA+D;IAC/D,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AA0BD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EAC9C,KAAK,GAAE,aAAkB,GACxB,OAAO,CAAC,QAAQ,CAAC,CAkFnB;AAED,mDAAmD;AACnD,MAAM,WAAW,mBAAmB;IAClC,+DAA+D;IAC/D,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,uEAAuE;IACvE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,IAAI,CAAC,EAAE,YAAY,CAAC;CACrB;AAED,oDAAoD;AACpD,wBAAgB,YAAY,CAC1B,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,EAC9B,IAAI,GAAE,mBAAmB,GAAG,OAAY,GACvC,MAAM,CA6BR;AAED,+DAA+D;AAC/D,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAYH,OAAO,KAAK,EACV,QAAQ,EACR,YAAY,EACZ,OAAO,EACP,mBAAmB,EACnB,UAAU,EACV,YAAY,EACb,MAAM,oBAAoB,CAAC;AAI5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAG9C,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAClF,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,KAAK,EACL,UAAU,EACV,cAAc,EACd,cAAc,EACd,SAAS,EACT,YAAY,EACZ,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,WAAW,EACX,cAAc,EACd,cAAc,GACf,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,aAAa,EACb,gBAAgB,EAChB,YAAY,EACZ,cAAc,GACf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACzD,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,YAAY,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEjD,2CAA2C;AAC3C,eAAO,MAAM,IAAI;IACf,iEAAiE;;IAEjE,4DAA4D;;IAE5D,kCAAkC;;CAE1B,CAAC;AAEX,mCAAmC;AACnC,MAAM,WAAW,QAAQ;IACvB,wEAAwE;IACxE,MAAM,EAAE,UAAU,CAAC;IACnB,yEAAyE;IACzE,UAAU,EAAE,OAAO,EAAE,CAAC;IACtB,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,eAAe,CAAC,EAAE,QAAQ,CAAC;IAC3B,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,MAAM,MAAM,MAAM,GAAG,CAAC,OAAO,EAAE,mBAAmB,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;AAE3E;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AAEjF,iEAAiE;AACjE,MAAM,WAAW,aAAa;IAC5B,+DAA+D;IAC/D,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;iFAG6E;IAC7E,QAAQ,CAAC,EAAE,OAAO,iBAAiB,EAAE,QAAQ,CAAC;CAC/C;AA0BD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EAC9C,KAAK,GAAE,aAAkB,GACxB,OAAO,CAAC,QAAQ,CAAC,CA4FnB;AAED,mDAAmD;AACnD,MAAM,WAAW,mBAAmB;IAClC,+DAA+D;IAC/D,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,uEAAuE;IACvE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,kFAAkF;IAClF,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,oDAAoD;AACpD,wBAAgB,YAAY,CAC1B,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,YAAY,CAAC,QAAQ,CAAC,EAC9B,IAAI,GAAE,mBAAmB,GAAG,OAAY,GACvC,MAAM,CAgCR;AAED,+DAA+D;AAC/D,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC"}

dist/index.js

@@ -12,4 +12,5 @@ /**
  */
+import { readFile } from "node:fs/promises";
 import process from "node:process";
-import { buildReadinessReport, changedFiles, scan, scanParallel } from "@quantakrypto/core";
+import { buildReadinessReport, changedFiles, parseCryptoPolicy, scan, scanParallel, } from "@quantakrypto/core";
 import { applyBaseline, readBaseline, saveBaseline } from "./baseline.js";
@@ -123,2 +124,9 @@ import { defaultOptions, meetsThreshold } from "./args.js";
     }
+    // --policy: the org cryptography policy for the evidence report's §4 verdicts.
+    // Parsed strictly — a malformed policy fails loudly rather than silently
+    // dropping the verdicts from the attested evidence.
+    let policy;
+    if (options.policy) {
+        policy = parseCryptoPolicy(JSON.parse(await readFile(options.policy, "utf8")));
+    }
     // Exit code is computed from RAW severities, BEFORE triage runs, so the
@@ -145,2 +153,3 @@ // (optional) LLM triage pass can never make a failing scan pass CI.
             root: options.path,
+            triageFn: hooks.triageFn,
         });
@@ -159,2 +168,3 @@ if (triaged.preflight !== undefined) {
             tier: options.tier,
+            ...(policy ? { policy } : {}),
         }),
@@ -167,3 +177,3 @@ exitCode,
     // Back-compat: `renderReport(result, format, true)` used to mean "color on".
-    const { color = false, redactSnippets = false, topN = undefined, tier = undefined, } = typeof opts === "boolean" ? { color: opts } : opts;
+    const { color = false, redactSnippets = false, topN = undefined, tier = undefined, policy = undefined, } = typeof opts === "boolean" ? { color: opts, policy: undefined } : opts;
     switch (format) {
@@ -178,5 +188,7 @@ case "json":
             // ISO A.8.24 readiness report; repo/commit come from CI env when present.
+            // A `--policy` file adds the §4 conformant/violation/transition verdicts.
             return JSON.stringify(buildReadinessReport(result, {
                 repository: process.env.GITHUB_REPOSITORY,
                 commit: process.env.GITHUB_SHA,
+                ...(policy ? { policy } : {}),
             }), null, 2);
@@ -183,0 +195,0 @@ case "human":

dist/index.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,OAAO,MAAM,cAAc,CAAC;AAEnC,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAS5F,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAI/E,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,KAAK,EACL,UAAU,EACV,cAAc,EACd,cAAc,EACd,SAAS,EACT,YAAY,EACZ,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,WAAW,EACX,cAAc,EACd,cAAc,GACf,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAIzD,2CAA2C;AAC3C,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,iEAAiE;IACjE,EAAE,EAAE,CAAC;IACL,4DAA4D;IAC5D,QAAQ,EAAE,CAAC;IACX,kCAAkC;IAClC,KAAK,EAAE,CAAC;CACA,CAAC;AAuCX;;;GAGG;AACH,SAAS,aAAa,CAAC,OAAqB;IAC1C,MAAM,WAAW,GAAwB;QACvC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,WAAW,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IACpE,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,WAAW,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACtE,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;QAAE,WAAW,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IACrF,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;QAAE,WAAW,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IACrF,IAAI,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9D,WAAW,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IACpD,CAAC;IACD,IAAI,OAAO,CAAC,SAAS;QAAE,WAAW,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACjE,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAA8C,EAC9C,QAAuB,EAAE;IAEzB,MAAM,OAAO,GAAiB,EAAE,GAAG,cAAc,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC;IAC/D,+EAA+E;IAC/E,MAAM,MAAM,GAAW,KAAK,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAChF,MAAM,cAAc,GAAmB,KAAK,CAAC,cAAc,IAAI,YAAY,CAAC;IAE5E,MAAM,WAAW,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IAE3C,4DAA4D;IAC5D,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,WAAW,CAAC,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAEzC,uEAAuE;IACvE,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5E,OAAO;YACL,MAAM;YACN,UAAU,EAAE,EAAE;YACd,eAAe,EAAE,QAAQ;YACzB,QAAQ,EAAE,IAAI,CAAC,EAAE;SAClB,CAAC;IACJ,CAAC;IAED,qDAAqD;IACrD,EAAE;IACF,0EAA0E;IAC1E,6EAA6E;IAC7E,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,IAAI,UAAU,GAAc,EAAE,CAAC;IAC/B,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC3D,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC;QAC7B,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IAChC,CAAC;IAED,wEAAwE;IACxE,oEAAoE;IACpE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAC1C,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,iBAAiB,CAAC,CACtD;QACC,CAAC,CAAC,IAAI,CAAC,QAAQ;QACf,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;IAEZ,4EAA4E;IAC5E,qEAAqE;IACrE,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE;YACtC,KAAK,EAAE,OAAO,CAAC,YAAY,IAAI,SAAS;YACxC,KAAK,EAAE,OAAO,CAAC,WAAW;YAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,WAAW;YAC7B,KAAK,EAAE,OAAO,CAAC,QAAQ;YACvB,wEAAwE;YACxE,wEAAwE;YACxE,+DAA+D;YAC/D,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,SAAS,iBAAiB,CAAC,CAAC,CAAC,SAAS;YAChF,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM;QACN,UAAU;QACV,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;YAC3C,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,KAAK;YAC3B,cAAc,EAAE,OAAO,CAAC,UAAU;YAClC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,OAAO,CAAC,IAAI;SACnB,CAAC;QACF,QAAQ;KACT,CAAC;AACJ,CAAC;AAcD,oDAAoD;AACpD,MAAM,UAAU,YAAY,CAC1B,MAAkB,EAClB,MAA8B,EAC9B,OAAsC,EAAE;IAExC,6EAA6E;IAC7E,MAAM,EACJ,KAAK,GAAG,KAAK,EACb,cAAc,GAAG,KAAK,EACtB,IAAI,GAAG,SAAS,EAChB,IAAI,GAAG,SAAS,GACjB,GAAG,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM;YACT,OAAO,UAAU,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC;QAChD,KAAK,OAAO;YACV,OAAO,WAAW,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC;QACjD,KAAK,MAAM;YACT,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,KAAK,UAAU;YACb,0EAA0E;YAC1E,OAAO,IAAI,CAAC,SAAS,CACnB,oBAAoB,CAAC,MAAM,EAAE;gBAC3B,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;gBACzC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;aAC/B,CAAC,EACF,IAAI,EACJ,CAAC,CACF,CAAC;QACJ,KAAK,OAAO,CAAC;QACb;YACE,OAAO,WAAW,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;AACH,CAAC","sourcesContent":["/**\n * @quantakrypto/qscan — programmatic API.\n *\n * `runQscan` is the single entry point shared by the CLI (`src/cli.ts`) and by\n * `@quantakrypto/action`. It runs a scan via `@quantakrypto/core`, applies an optional\n * baseline, decides an exit code from the severity threshold, and (optionally)\n * renders a report. The CLI is a thin shell around it.\n *\n * The module also re-exports the argument-parsing and baseline helpers so\n * downstream tools can reuse them without reaching into internal paths.\n */\n\nimport process from \"node:process\";\n\nimport { buildReadinessReport, changedFiles, scan, scanParallel } from \"@quantakrypto/core\";\nimport type {\n  Baseline,\n  Finding,\n  ParallelScanOptions,\n  ScanResult,\n  SecurityTier,\n} from \"@quantakrypto/core\";\n\nimport { applyBaseline, readBaseline, saveBaseline } from \"./baseline.js\";\nimport { defaultOptions, meetsThreshold } from \"./args.js\";\nimport type { QscanOptions } from \"./args.js\";\nimport { renderCbom, renderHuman, renderJson, renderSarif } from \"./report.js\";\n\nexport type { QscanOptions, ParsedArgs, ParsedRun, QscanFormat } from \"./args.js\";\nexport type { Baseline } from \"./baseline.js\";\nexport {\n  ArgError,\n  asFormat,\n  asInt,\n  asSeverity,\n  defaultOptions,\n  meetsThreshold,\n  parseArgs,\n  severityRank,\n  SEVERITY_ORDER,\n} from \"./args.js\";\nexport {\n  applyBaseline,\n  baselineFromFindings,\n  BASELINE_VERSION,\n  buildBaseline,\n  fingerprint,\n  fingerprintFinding,\n  loadBaseline,\n  readBaseline,\n  saveBaseline,\n  writeBaseline,\n} from \"./baseline.js\";\nexport { renderCbom, renderHuman, renderJson, renderSarif } from \"./report.js\";\nexport { HELP_TEXT, versionLine } from \"./help.js\";\nexport {\n  runRemediate,\n  parseRemediateArgs,\n  unifiedDiff,\n  REMEDIATE_HELP,\n  REMEDIATE_EXIT,\n} from \"./remediate-cli.js\";\nexport type {\n  RemediateMode,\n  RemediateOptions,\n  RemediateRun,\n  RemediateHooks,\n} from \"./remediate-cli.js\";\nexport { applyConfig, resolveConfig } from \"./config.js\";\nexport type { ResolvedConfig } from \"./config.js\";\nexport type { ConfigurableKey } from \"./args.js\";\n\n/** Process-style exit codes qScan uses. */\nexport const EXIT = {\n  /** No findings at/above threshold, or a baseline was written. */\n  OK: 0,\n  /** One or more findings at/above the severity threshold. */\n  FINDINGS: 1,\n  /** Usage error or I/O failure. */\n  ERROR: 2,\n} as const;\n\n/** Outcome of {@link runQscan}. */\nexport interface QscanRun {\n  /** The scan result, with the baseline already applied to `findings`. */\n  result: ScanResult;\n  /** Findings suppressed because their fingerprint was in the baseline. */\n  suppressed: Finding[];\n  /** Rendered report in the requested format (`undefined` for a baseline write). */\n  report?: string;\n  /** The baseline that was written, when `writeBaseline` was requested. */\n  baselineWritten?: Baseline;\n  /** Suggested process exit code. */\n  exitCode: number;\n}\n\n/**\n * The scan implementation `runQscan` calls. Matches `@quantakrypto/core`'s `scan` /\n * `scanParallel` (parallel options are a superset of `ScanOptions`).\n * Injectable so the GitHub Action and tests can supply a custom scanner.\n */\nexport type ScanFn = (options: ParallelScanOptions) => Promise<ScanResult>;\n\n/**\n * Resolve the changed-file list for incremental scans. Injectable for testing;\n * defaults to core's git-aware {@link changedFiles}.\n */\nexport type ChangedFilesFn = (root: string, since?: string) => Promise<string[]>;\n\n/** Behavioral hooks for {@link runQscan}, mainly for testing. */\nexport interface RunQscanHooks {\n  /** Emit raw ANSI color in the human report. Default: false. */\n  color?: boolean;\n  /** Override the scanner. Default: `scan` / `scanParallel` from `@quantakrypto/core`. */\n  scanFn?: ScanFn;\n  /** Override changed-file resolution. Default: `changedFiles` from `@quantakrypto/core`. */\n  changedFilesFn?: ChangedFilesFn;\n}\n\n/**\n * Translate resolved {@link QscanOptions} into core {@link ParallelScanOptions}.\n * `files` (the incremental file list) is layered on by {@link runQscan}.\n */\nfunction toScanOptions(options: QscanOptions): ParallelScanOptions {\n  const scanOptions: ParallelScanOptions = {\n    root: options.path,\n    source: options.source,\n    dependencies: options.dependencies,\n    config: options.config,\n    noDefaultIgnores: options.noDefaultIgnores,\n    scanMinified: options.scanMinified,\n  };\n  if (options.ignore.length > 0) scanOptions.exclude = options.ignore;\n  if (options.include.length > 0) scanOptions.include = options.include;\n  if (options.maxFileSize !== undefined) scanOptions.maxFileSize = options.maxFileSize;\n  if (options.concurrency !== undefined) scanOptions.concurrency = options.concurrency;\n  if (options.disabledRules && options.disabledRules.length > 0) {\n    scanOptions.disabledRules = options.disabledRules;\n  }\n  if (options.cacheFile) scanOptions.cacheFile = options.cacheFile;\n  return scanOptions;\n}\n\n/**\n * Run a complete qScan pass: scan → baseline → threshold → render.\n *\n * This never touches `process` or stdout; the CLI is responsible for printing\n * `report`/writing `output` and calling `process.exit(exitCode)`. That keeps\n * the function pure enough to unit-test and to embed in the GitHub Action.\n *\n * Behavior:\n *  - The walk is configured by `include` / `ignore` / `maxFileSize` /\n *    `noDefaultIgnores` / `scanMinified`.\n *  - With `changed` set, only the files git reports as changed (relative to\n *    `since`, if given) are scanned via `ScanOptions.files`. A non-git tree\n *    yields an empty list, so nothing is scanned.\n *  - With `parallel` (or `concurrency`) set, the scan is routed through core's\n *    `scanParallel`, which itself falls back to the serial path for small\n *    inputs.\n *  - When `opts.writeBaseline` is set, the scan runs, a baseline is built from\n *    *all* findings, written to disk, and `exitCode` is {@link EXIT.OK}. No\n *    report is rendered.\n *  - When `opts.baseline` is set, its fingerprints are loaded and matching\n *    findings are moved to `suppressed` (and removed from `result.findings`).\n *  - `exitCode` is {@link EXIT.FINDINGS} when any *kept* finding meets the\n *    severity threshold, else {@link EXIT.OK}.\n *\n * @throws {Error} Propagates scan / baseline I/O errors; the CLI maps these to\n *   {@link EXIT.ERROR}.\n */\nexport async function runQscan(\n  opts: Partial<QscanOptions> & { path: string },\n  hooks: RunQscanHooks = {},\n): Promise<QscanRun> {\n  const options: QscanOptions = { ...defaultOptions(), ...opts };\n  // Route to the parallel pool when requested; both share the ScanOptions shape.\n  const scanFn: ScanFn = hooks.scanFn ?? (options.parallel ? scanParallel : scan);\n  const resolveChanged: ChangedFilesFn = hooks.changedFilesFn ?? changedFiles;\n\n  const scanOptions = toScanOptions(options);\n\n  // Incremental mode: restrict the scan to git-changed files.\n  if (options.changed) {\n    scanOptions.files = await resolveChanged(options.path, options.since);\n  }\n\n  const result = await scanFn(scanOptions);\n\n  // --write-baseline: snapshot every finding, persist, and exit cleanly.\n  if (options.writeBaseline) {\n    const baseline = await saveBaseline(options.writeBaseline, result.findings);\n    return {\n      result,\n      suppressed: [],\n      baselineWritten: baseline,\n      exitCode: EXIT.OK,\n    };\n  }\n\n  // --baseline: suppress previously-accepted findings.\n  //\n  // The explicit `--baseline <path>` is read STRICTLY via `readBaseline`: a\n  // missing or malformed file is an error (surfaced by the CLI as exit 2), not\n  // silently treated as an empty baseline. Using core's tolerant `loadBaseline`\n  // here would let a typo'd path (`--baseline typo.json`) suppress nothing and\n  // still exit 0 — a CI footgun where a broken baseline reads as \"all clear\".\n  let suppressed: Finding[] = [];\n  if (options.baseline) {\n    const fingerprints = await readBaseline(options.baseline);\n    const split = applyBaseline(result.findings, fingerprints);\n    result.findings = split.kept;\n    suppressed = split.suppressed;\n  }\n\n  // Exit code is computed from RAW severities, BEFORE triage runs, so the\n  // (optional) LLM triage pass can never make a failing scan pass CI.\n  const exitCode = result.findings.some((f) =>\n    meetsThreshold(f.severity, options.severityThreshold),\n  )\n    ? EXIT.FINDINGS\n    : EXIT.OK;\n\n  // Optional BYOK triage: annotate + re-sort findings (never suppresses). The\n  // agent (networked) package is loaded only here, via dynamic import.\n  if (options.triage) {\n    const { runTriage } = await import(\"./triage-run.js\");\n    const triaged = await runTriage(result, {\n      level: options.contextLevel ?? \"snippet\",\n      floor: options.triageFloor,\n      maxFindings: options.maxFindings,\n      dryRun: options.dryRun,\n      provider: options.llmProvider,\n      model: options.llmModel,\n      // The triage RESPONSE cache must not share a path with the scan cache —\n      // they are different on-disk formats and would clobber each other every\n      // run, defeating both (audit: arch #1). Derive a sibling path.\n      cacheFile: options.cacheFile ? `${options.cacheFile}.responses.json` : undefined,\n      root: options.path,\n    });\n    if (triaged.preflight !== undefined) {\n      return { result, suppressed, report: triaged.preflight, exitCode: EXIT.OK };\n    }\n  }\n\n  return {\n    result,\n    suppressed,\n    report: renderReport(result, options.format, {\n      color: hooks.color ?? false,\n      redactSnippets: options.noSnippets,\n      topN: options.topN,\n      tier: options.tier,\n    }),\n    exitCode,\n  };\n}\n\n/** Rendering controls for {@link renderReport}. */\nexport interface RenderReportOptions {\n  /** Emit raw ANSI color in the human report. Default: false. */\n  color?: boolean;\n  /** Omit code snippets from the JSON/SARIF report (`--no-snippets`). */\n  redactSnippets?: boolean;\n  /** How many findings the human report lists (`--top N`). */\n  topN?: number;\n  /** CNSA security tier for the migration-targets footer (`--tier`). */\n  tier?: SecurityTier;\n}\n\n/** Render a scan result in the requested format. */\nexport function renderReport(\n  result: ScanResult,\n  format: QscanOptions[\"format\"],\n  opts: RenderReportOptions | boolean = {},\n): string {\n  // Back-compat: `renderReport(result, format, true)` used to mean \"color on\".\n  const {\n    color = false,\n    redactSnippets = false,\n    topN = undefined,\n    tier = undefined,\n  } = typeof opts === \"boolean\" ? { color: opts } : opts;\n  switch (format) {\n    case \"json\":\n      return renderJson(result, { redactSnippets });\n    case \"sarif\":\n      return renderSarif(result, { redactSnippets });\n    case \"cbom\":\n      return renderCbom(result);\n    case \"evidence\":\n      // ISO A.8.24 readiness report; repo/commit come from CI env when present.\n      return JSON.stringify(\n        buildReadinessReport(result, {\n          repository: process.env.GITHUB_REPOSITORY,\n          commit: process.env.GITHUB_SHA,\n        }),\n        null,\n        2,\n      );\n    case \"human\":\n    default:\n      return renderHuman(result, { color, topN, tier });\n  }\n}\n\n/** Re-export the core result types consumers commonly need. */\nexport type { Finding, ScanResult, ScanOptions } from \"@quantakrypto/core\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,OAAO,MAAM,cAAc,CAAC;AAEnC,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,iBAAiB,EACjB,IAAI,EACJ,YAAY,GACb,MAAM,oBAAoB,CAAC;AAU5B,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAI/E,OAAO,EACL,QAAQ,EACR,QAAQ,EACR,KAAK,EACL,UAAU,EACV,cAAc,EACd,cAAc,EACd,SAAS,EACT,YAAY,EACZ,cAAc,GACf,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,YAAY,EACZ,YAAY,EACZ,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EACL,YAAY,EACZ,kBAAkB,EAClB,WAAW,EACX,cAAc,EACd,cAAc,GACf,MAAM,oBAAoB,CAAC;AAO5B,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAIzD,2CAA2C;AAC3C,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB,iEAAiE;IACjE,EAAE,EAAE,CAAC;IACL,4DAA4D;IAC5D,QAAQ,EAAE,CAAC;IACX,kCAAkC;IAClC,KAAK,EAAE,CAAC;CACA,CAAC;AA4CX;;;GAGG;AACH,SAAS,aAAa,CAAC,OAAqB;IAC1C,MAAM,WAAW,GAAwB;QACvC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,WAAW,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IACpE,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,WAAW,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IACtE,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;QAAE,WAAW,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IACrF,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;QAAE,WAAW,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IACrF,IAAI,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9D,WAAW,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IACpD,CAAC;IACD,IAAI,OAAO,CAAC,SAAS;QAAE,WAAW,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACjE,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAA8C,EAC9C,QAAuB,EAAE;IAEzB,MAAM,OAAO,GAAiB,EAAE,GAAG,cAAc,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC;IAC/D,+EAA+E;IAC/E,MAAM,MAAM,GAAW,KAAK,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAChF,MAAM,cAAc,GAAmB,KAAK,CAAC,cAAc,IAAI,YAAY,CAAC;IAE5E,MAAM,WAAW,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IAE3C,4DAA4D;IAC5D,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,WAAW,CAAC,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAEzC,uEAAuE;IACvE,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5E,OAAO;YACL,MAAM;YACN,UAAU,EAAE,EAAE;YACd,eAAe,EAAE,QAAQ;YACzB,QAAQ,EAAE,IAAI,CAAC,EAAE;SAClB,CAAC;IACJ,CAAC;IAED,qDAAqD;IACrD,EAAE;IACF,0EAA0E;IAC1E,6EAA6E;IAC7E,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,IAAI,UAAU,GAAc,EAAE,CAAC;IAC/B,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC3D,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC;QAC7B,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IAChC,CAAC;IAED,+EAA+E;IAC/E,yEAAyE;IACzE,oDAAoD;IACpD,IAAI,MAAgC,CAAC;IACrC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACjF,CAAC;IAED,wEAAwE;IACxE,oEAAoE;IACpE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAC1C,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,iBAAiB,CAAC,CACtD;QACC,CAAC,CAAC,IAAI,CAAC,QAAQ;QACf,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;IAEZ,4EAA4E;IAC5E,qEAAqE;IACrE,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE;YACtC,KAAK,EAAE,OAAO,CAAC,YAAY,IAAI,SAAS;YACxC,KAAK,EAAE,OAAO,CAAC,WAAW;YAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,WAAW;YAC7B,KAAK,EAAE,OAAO,CAAC,QAAQ;YACvB,wEAAwE;YACxE,wEAAwE;YACxE,+DAA+D;YAC/D,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,SAAS,iBAAiB,CAAC,CAAC,CAAC,SAAS;YAChF,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,OAAO;QACL,MAAM;QACN,UAAU;QACV,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;YAC3C,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,KAAK;YAC3B,cAAc,EAAE,OAAO,CAAC,UAAU;YAClC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,CAAC;QACF,QAAQ;KACT,CAAC;AACJ,CAAC;AAgBD,oDAAoD;AACpD,MAAM,UAAU,YAAY,CAC1B,MAAkB,EAClB,MAA8B,EAC9B,OAAsC,EAAE;IAExC,6EAA6E;IAC7E,MAAM,EACJ,KAAK,GAAG,KAAK,EACb,cAAc,GAAG,KAAK,EACtB,IAAI,GAAG,SAAS,EAChB,IAAI,GAAG,SAAS,EAChB,MAAM,GAAG,SAAS,GACnB,GAAG,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1E,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM;YACT,OAAO,UAAU,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC;QAChD,KAAK,OAAO;YACV,OAAO,WAAW,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC;QACjD,KAAK,MAAM;YACT,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC5B,KAAK,UAAU;YACb,0EAA0E;YAC1E,0EAA0E;YAC1E,OAAO,IAAI,CAAC,SAAS,CACnB,oBAAoB,CAAC,MAAM,EAAE;gBAC3B,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;gBACzC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU;gBAC9B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9B,CAAC,EACF,IAAI,EACJ,CAAC,CACF,CAAC;QACJ,KAAK,OAAO,CAAC;QACb;YACE,OAAO,WAAW,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;AACH,CAAC","sourcesContent":["/**\n * @quantakrypto/qscan — programmatic API.\n *\n * `runQscan` is the single entry point shared by the CLI (`src/cli.ts`) and by\n * `@quantakrypto/action`. It runs a scan via `@quantakrypto/core`, applies an optional\n * baseline, decides an exit code from the severity threshold, and (optionally)\n * renders a report. The CLI is a thin shell around it.\n *\n * The module also re-exports the argument-parsing and baseline helpers so\n * downstream tools can reuse them without reaching into internal paths.\n */\n\nimport { readFile } from \"node:fs/promises\";\nimport process from \"node:process\";\n\nimport {\n  buildReadinessReport,\n  changedFiles,\n  parseCryptoPolicy,\n  scan,\n  scanParallel,\n} from \"@quantakrypto/core\";\nimport type {\n  Baseline,\n  CryptoPolicy,\n  Finding,\n  ParallelScanOptions,\n  ScanResult,\n  SecurityTier,\n} from \"@quantakrypto/core\";\n\nimport { applyBaseline, readBaseline, saveBaseline } from \"./baseline.js\";\nimport { defaultOptions, meetsThreshold } from \"./args.js\";\nimport type { QscanOptions } from \"./args.js\";\nimport { renderCbom, renderHuman, renderJson, renderSarif } from \"./report.js\";\n\nexport type { QscanOptions, ParsedArgs, ParsedRun, QscanFormat } from \"./args.js\";\nexport type { Baseline } from \"./baseline.js\";\nexport {\n  ArgError,\n  asFormat,\n  asInt,\n  asSeverity,\n  defaultOptions,\n  meetsThreshold,\n  parseArgs,\n  severityRank,\n  SEVERITY_ORDER,\n} from \"./args.js\";\nexport {\n  applyBaseline,\n  baselineFromFindings,\n  BASELINE_VERSION,\n  buildBaseline,\n  fingerprint,\n  fingerprintFinding,\n  loadBaseline,\n  readBaseline,\n  saveBaseline,\n  writeBaseline,\n} from \"./baseline.js\";\nexport { renderCbom, renderHuman, renderJson, renderSarif } from \"./report.js\";\nexport { HELP_TEXT, versionLine } from \"./help.js\";\nexport {\n  runRemediate,\n  parseRemediateArgs,\n  unifiedDiff,\n  REMEDIATE_HELP,\n  REMEDIATE_EXIT,\n} from \"./remediate-cli.js\";\nexport type {\n  RemediateMode,\n  RemediateOptions,\n  RemediateRun,\n  RemediateHooks,\n} from \"./remediate-cli.js\";\nexport { applyConfig, resolveConfig } from \"./config.js\";\nexport type { ResolvedConfig } from \"./config.js\";\nexport type { ConfigurableKey } from \"./args.js\";\n\n/** Process-style exit codes qScan uses. */\nexport const EXIT = {\n  /** No findings at/above threshold, or a baseline was written. */\n  OK: 0,\n  /** One or more findings at/above the severity threshold. */\n  FINDINGS: 1,\n  /** Usage error or I/O failure. */\n  ERROR: 2,\n} as const;\n\n/** Outcome of {@link runQscan}. */\nexport interface QscanRun {\n  /** The scan result, with the baseline already applied to `findings`. */\n  result: ScanResult;\n  /** Findings suppressed because their fingerprint was in the baseline. */\n  suppressed: Finding[];\n  /** Rendered report in the requested format (`undefined` for a baseline write). */\n  report?: string;\n  /** The baseline that was written, when `writeBaseline` was requested. */\n  baselineWritten?: Baseline;\n  /** Suggested process exit code. */\n  exitCode: number;\n}\n\n/**\n * The scan implementation `runQscan` calls. Matches `@quantakrypto/core`'s `scan` /\n * `scanParallel` (parallel options are a superset of `ScanOptions`).\n * Injectable so the GitHub Action and tests can supply a custom scanner.\n */\nexport type ScanFn = (options: ParallelScanOptions) => Promise<ScanResult>;\n\n/**\n * Resolve the changed-file list for incremental scans. Injectable for testing;\n * defaults to core's git-aware {@link changedFiles}.\n */\nexport type ChangedFilesFn = (root: string, since?: string) => Promise<string[]>;\n\n/** Behavioral hooks for {@link runQscan}, mainly for testing. */\nexport interface RunQscanHooks {\n  /** Emit raw ANSI color in the human report. Default: false. */\n  color?: boolean;\n  /** Override the scanner. Default: `scan` / `scanParallel` from `@quantakrypto/core`. */\n  scanFn?: ScanFn;\n  /** Override changed-file resolution. Default: `changedFiles` from `@quantakrypto/core`. */\n  changedFilesFn?: ChangedFilesFn;\n  /** Inject the triage function (offline testing of the `--triage` path, so the\n   * exit-code invariant can be exercised without a network client or API key).\n   * `import type` keeps this a compile-time-only reference — the networked agent\n   * package is still only loaded via the dynamic import inside `runTriage`. */\n  triageFn?: import(\"./triage-run.js\").TriageFn;\n}\n\n/**\n * Translate resolved {@link QscanOptions} into core {@link ParallelScanOptions}.\n * `files` (the incremental file list) is layered on by {@link runQscan}.\n */\nfunction toScanOptions(options: QscanOptions): ParallelScanOptions {\n  const scanOptions: ParallelScanOptions = {\n    root: options.path,\n    source: options.source,\n    dependencies: options.dependencies,\n    config: options.config,\n    noDefaultIgnores: options.noDefaultIgnores,\n    scanMinified: options.scanMinified,\n  };\n  if (options.ignore.length > 0) scanOptions.exclude = options.ignore;\n  if (options.include.length > 0) scanOptions.include = options.include;\n  if (options.maxFileSize !== undefined) scanOptions.maxFileSize = options.maxFileSize;\n  if (options.concurrency !== undefined) scanOptions.concurrency = options.concurrency;\n  if (options.disabledRules && options.disabledRules.length > 0) {\n    scanOptions.disabledRules = options.disabledRules;\n  }\n  if (options.cacheFile) scanOptions.cacheFile = options.cacheFile;\n  return scanOptions;\n}\n\n/**\n * Run a complete qScan pass: scan → baseline → threshold → render.\n *\n * This never touches `process` or stdout; the CLI is responsible for printing\n * `report`/writing `output` and calling `process.exit(exitCode)`. That keeps\n * the function pure enough to unit-test and to embed in the GitHub Action.\n *\n * Behavior:\n *  - The walk is configured by `include` / `ignore` / `maxFileSize` /\n *    `noDefaultIgnores` / `scanMinified`.\n *  - With `changed` set, only the files git reports as changed (relative to\n *    `since`, if given) are scanned via `ScanOptions.files`. A non-git tree\n *    yields an empty list, so nothing is scanned.\n *  - With `parallel` (or `concurrency`) set, the scan is routed through core's\n *    `scanParallel`, which itself falls back to the serial path for small\n *    inputs.\n *  - When `opts.writeBaseline` is set, the scan runs, a baseline is built from\n *    *all* findings, written to disk, and `exitCode` is {@link EXIT.OK}. No\n *    report is rendered.\n *  - When `opts.baseline` is set, its fingerprints are loaded and matching\n *    findings are moved to `suppressed` (and removed from `result.findings`).\n *  - `exitCode` is {@link EXIT.FINDINGS} when any *kept* finding meets the\n *    severity threshold, else {@link EXIT.OK}.\n *\n * @throws {Error} Propagates scan / baseline I/O errors; the CLI maps these to\n *   {@link EXIT.ERROR}.\n */\nexport async function runQscan(\n  opts: Partial<QscanOptions> & { path: string },\n  hooks: RunQscanHooks = {},\n): Promise<QscanRun> {\n  const options: QscanOptions = { ...defaultOptions(), ...opts };\n  // Route to the parallel pool when requested; both share the ScanOptions shape.\n  const scanFn: ScanFn = hooks.scanFn ?? (options.parallel ? scanParallel : scan);\n  const resolveChanged: ChangedFilesFn = hooks.changedFilesFn ?? changedFiles;\n\n  const scanOptions = toScanOptions(options);\n\n  // Incremental mode: restrict the scan to git-changed files.\n  if (options.changed) {\n    scanOptions.files = await resolveChanged(options.path, options.since);\n  }\n\n  const result = await scanFn(scanOptions);\n\n  // --write-baseline: snapshot every finding, persist, and exit cleanly.\n  if (options.writeBaseline) {\n    const baseline = await saveBaseline(options.writeBaseline, result.findings);\n    return {\n      result,\n      suppressed: [],\n      baselineWritten: baseline,\n      exitCode: EXIT.OK,\n    };\n  }\n\n  // --baseline: suppress previously-accepted findings.\n  //\n  // The explicit `--baseline <path>` is read STRICTLY via `readBaseline`: a\n  // missing or malformed file is an error (surfaced by the CLI as exit 2), not\n  // silently treated as an empty baseline. Using core's tolerant `loadBaseline`\n  // here would let a typo'd path (`--baseline typo.json`) suppress nothing and\n  // still exit 0 — a CI footgun where a broken baseline reads as \"all clear\".\n  let suppressed: Finding[] = [];\n  if (options.baseline) {\n    const fingerprints = await readBaseline(options.baseline);\n    const split = applyBaseline(result.findings, fingerprints);\n    result.findings = split.kept;\n    suppressed = split.suppressed;\n  }\n\n  // --policy: the org cryptography policy for the evidence report's §4 verdicts.\n  // Parsed strictly — a malformed policy fails loudly rather than silently\n  // dropping the verdicts from the attested evidence.\n  let policy: CryptoPolicy | undefined;\n  if (options.policy) {\n    policy = parseCryptoPolicy(JSON.parse(await readFile(options.policy, \"utf8\")));\n  }\n\n  // Exit code is computed from RAW severities, BEFORE triage runs, so the\n  // (optional) LLM triage pass can never make a failing scan pass CI.\n  const exitCode = result.findings.some((f) =>\n    meetsThreshold(f.severity, options.severityThreshold),\n  )\n    ? EXIT.FINDINGS\n    : EXIT.OK;\n\n  // Optional BYOK triage: annotate + re-sort findings (never suppresses). The\n  // agent (networked) package is loaded only here, via dynamic import.\n  if (options.triage) {\n    const { runTriage } = await import(\"./triage-run.js\");\n    const triaged = await runTriage(result, {\n      level: options.contextLevel ?? \"snippet\",\n      floor: options.triageFloor,\n      maxFindings: options.maxFindings,\n      dryRun: options.dryRun,\n      provider: options.llmProvider,\n      model: options.llmModel,\n      // The triage RESPONSE cache must not share a path with the scan cache —\n      // they are different on-disk formats and would clobber each other every\n      // run, defeating both (audit: arch #1). Derive a sibling path.\n      cacheFile: options.cacheFile ? `${options.cacheFile}.responses.json` : undefined,\n      root: options.path,\n      triageFn: hooks.triageFn,\n    });\n    if (triaged.preflight !== undefined) {\n      return { result, suppressed, report: triaged.preflight, exitCode: EXIT.OK };\n    }\n  }\n\n  return {\n    result,\n    suppressed,\n    report: renderReport(result, options.format, {\n      color: hooks.color ?? false,\n      redactSnippets: options.noSnippets,\n      topN: options.topN,\n      tier: options.tier,\n      ...(policy ? { policy } : {}),\n    }),\n    exitCode,\n  };\n}\n\n/** Rendering controls for {@link renderReport}. */\nexport interface RenderReportOptions {\n  /** Emit raw ANSI color in the human report. Default: false. */\n  color?: boolean;\n  /** Omit code snippets from the JSON/SARIF report (`--no-snippets`). */\n  redactSnippets?: boolean;\n  /** How many findings the human report lists (`--top N`). */\n  topN?: number;\n  /** CNSA security tier for the migration-targets footer (`--tier`). */\n  tier?: SecurityTier;\n  /** Org cryptography policy for the evidence report's §4 verdicts (`--policy`). */\n  policy?: CryptoPolicy;\n}\n\n/** Render a scan result in the requested format. */\nexport function renderReport(\n  result: ScanResult,\n  format: QscanOptions[\"format\"],\n  opts: RenderReportOptions | boolean = {},\n): string {\n  // Back-compat: `renderReport(result, format, true)` used to mean \"color on\".\n  const {\n    color = false,\n    redactSnippets = false,\n    topN = undefined,\n    tier = undefined,\n    policy = undefined,\n  } = typeof opts === \"boolean\" ? { color: opts, policy: undefined } : opts;\n  switch (format) {\n    case \"json\":\n      return renderJson(result, { redactSnippets });\n    case \"sarif\":\n      return renderSarif(result, { redactSnippets });\n    case \"cbom\":\n      return renderCbom(result);\n    case \"evidence\":\n      // ISO A.8.24 readiness report; repo/commit come from CI env when present.\n      // A `--policy` file adds the §4 conformant/violation/transition verdicts.\n      return JSON.stringify(\n        buildReadinessReport(result, {\n          repository: process.env.GITHUB_REPOSITORY,\n          commit: process.env.GITHUB_SHA,\n          ...(policy ? { policy } : {}),\n        }),\n        null,\n        2,\n      );\n    case \"human\":\n    default:\n      return renderHuman(result, { color, topN, tier });\n  }\n}\n\n/** Re-export the core result types consumers commonly need. */\nexport type { Finding, ScanResult, ScanOptions } from \"@quantakrypto/core\";\n"]}

dist/report.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAaH,OAAO,KAAK,EAEV,aAAa,EACb,UAAU,EACV,YAAY,EAEb,MAAM,oBAAoB,CAAC;AAwB5B;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,MAAM,CAE3E;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,MAAM,CAS5E;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAErD;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,UAAU,EAClB,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,YAAY,CAAA;CAAO,GACjE,MAAM,CAwGR"}
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAeH,OAAO,KAAK,EAEV,aAAa,EACb,UAAU,EACV,YAAY,EAEb,MAAM,oBAAoB,CAAC;AAwB5B;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,MAAM,CAE3E;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,EAAE,aAAa,GAAG,MAAM,CAS5E;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAErD;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,UAAU,EAClB,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,YAAY,CAAA;CAAO,GACjE,MAAM,CAgIR"}

dist/report.js

@@ -13,3 +13,3 @@ /**
  */
-import { ANALYZABLE_LANGUAGES_LABEL, defaultRegistry, DEP_VULNERABLE_RULE, formatTierGuidance, SEVERITY_ORDER, severityRank, toCbom, toJson, toSarif, } from "@quantakrypto/core";
+import { ANALYZABLE_LANGUAGES_LABEL, defaultRegistry, DEP_VULNERABLE_RULE, formatTierGuidance, PQC_TRANSITION_NOTE, SEVERITY_ORDER, severityRank, STATEFUL_HBS_NOTE, toCbom, toJson, toSarif, } from "@quantakrypto/core";
 const PLAIN = { reset: "", bold: "", dim: "", red: "", yellow: "", green: "", cyan: "" };
@@ -75,2 +75,14 @@ const COLOR = {
     const noAnalyzable = analyzedFiles === 0;
+    // Partial-coverage honesty: when the analyzable subset is only a small slice of
+    // what was scanned, a high score reflects that slice, not the whole tree. We
+    // surface a one-line caveat next to the score so the number isn't over-trusted.
+    // Skips the zero case (handled explicitly below) and normal repos where most
+    // files are analyzable.
+    const lowCoverage = analyzedFiles !== undefined &&
+        analyzedFiles > 0 &&
+        filesScanned > 0 &&
+        analyzedFiles / filesScanned < 0.25;
+    const coverageCaveat = lowCoverage
+        ? `${c.dim}Note: the score covers only ${analyzedFiles} analyzable of ${filesScanned} scanned files (${ANALYZABLE_LANGUAGES_LABEL}); crypto in unsupported languages is not reflected.${c.reset}`
+        : "";
     const lines = [];
@@ -108,2 +120,4 @@ lines.push(`${c.bold}qScan — quantum-vulnerable cryptography report${c.reset}`);
         lines.push(`${c.bold}Readiness score: ${readiness(inventory.readinessScore, c)}/100${c.reset}`);
+        if (coverageCaveat)
+            lines.push(coverageCaveat);
         lines.push("");
@@ -123,2 +137,4 @@ lines.push(`${c.dim}Next step:${c.reset} keep scanning in CI to catch regressions.`);
     lines.push(`${c.bold}Readiness score: ${readiness(inventory.readinessScore, c)}/100${c.reset}`);
+    if (coverageCaveat)
+        lines.push(coverageCaveat);
     lines.push("");
@@ -149,2 +165,10 @@ // Top findings, sorted by severity then file/line for determinism.
     }
+    // Forward-looking standards + the IR 8547 migration deadline (HQC / FN-DSA /
+    // X-Wing) — the long-horizon guidance behind anything flagged above.
+    lines.push("");
+    lines.push(`${c.bold}Standards & timeline${c.reset}`);
+    lines.push(`${c.dim}${PQC_TRANSITION_NOTE}${c.reset}`);
+    if (findings.some((f) => f.category === "signature")) {
+        lines.push(`${c.dim}${STATEFUL_HBS_NOTE}${c.reset}`);
+    }
     return lines.join("\n");
@@ -151,0 +175,0 @@ }

dist/report.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"report.js","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,0BAA0B,EAC1B,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,MAAM,EACN,MAAM,EACN,OAAO,GACR,MAAM,oBAAoB,CAAC;AAoB5B,MAAM,KAAK,GAAY,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AAClG,MAAM,KAAK,GAAY;IACrB,KAAK,EAAE,SAAS;IAChB,IAAI,EAAE,SAAS;IACf,GAAG,EAAE,SAAS;IACd,GAAG,EAAE,UAAU;IACf,MAAM,EAAE,UAAU;IAClB,KAAK,EAAE,UAAU;IACjB,IAAI,EAAE,UAAU;CACjB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,MAAkB,EAAE,IAAoB;IACjE,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,MAAkB,EAAE,IAAoB;IAClE,2EAA2E;IAC3E,8EAA8E;IAC9E,8EAA8E;IAC9E,+EAA+E;IAC/E,+EAA+E;IAC/E,oCAAoC;IACpC,MAAM,OAAO,GAAG,CAAC,GAAG,eAAe,CAAC,WAAW,EAAE,EAAE,mBAAmB,CAAC,CAAC;IACxE,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACxE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,MAAkB;IAC3C,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CACzB,MAAkB,EAClB,OAAgE,EAAE;IAElE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;IAC5B,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;IACrD,yEAAyE;IACzE,qFAAqF;IACrF,+EAA+E;IAC/E,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;IAC3C,MAAM,YAAY,GAAG,aAAa,KAAK,CAAC,CAAC;IACzC,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,iDAAiD,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAChF,MAAM,QAAQ,GACZ,aAAa,KAAK,SAAS;QACzB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,kBAAkB,aAAa,KAAK,0BAA0B,GAAG,CAAC;IACxE,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,CAAC,GAAG,SAAS,MAAM,CAAC,IAAI,uBAAuB,YAAY,GAAG,QAAQ,eAAe,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC,KAAK,EAAE,CACxH,CAAC;IACF,6EAA6E;IAC7E,qDAAqD;IACrD,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC;IAChC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,IAAI,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,UAAU,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,aAAa,CAAC,CAAC;QACrE,IAAI,IAAI,CAAC,eAAe,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,eAAe,qBAAqB,CAAC,CAAC;QACvF,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,aAAa,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,IAAI,YAAY,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrC,qEAAqE;YACrE,+DAA+D;YAC/D,gDAAgD;YAChD,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,CAAC,MAAM,8BAA8B,CAAC,CAAC,KAAK,YAAY,YAAY,QACtE,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAC5B,4CAA4C,0BAA0B,IAAI,CAC3E,CAAC;YACF,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,CAAC,GAAG,8GAA8G,CAAC,CAAC,KAAK,EAAE,CAChI,CAAC;YACF,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,CAAC,IAAI,oBAAoB,SAAS,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC,8BAA8B,CAAC,CAAC,KAAK,EAAE,CAC3G,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,KAAK,mFAAmF,CAChH,CAAC;YACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,+CAA+C,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/E,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,oBAAoB,SAAS,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAChG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,KAAK,4CAA4C,CAAC,CAAC;QACrF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,sCAAsC;IACtC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACxC,MAAM,CAAC,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAE1C,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,CAAC,IAAI,GAAG,QAAQ,CAAC,MAAM,WAAW,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC3G,CAAC;IACF,IAAI,SAAS,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,CAAC,MAAM,GAAG,SAAS,CAAC,SAAS,GAAG,CAAC,CAAC,KAAK,+CAA+C,CAC3F,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,oBAAoB,SAAS,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAChG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,mEAAmE;IACnE,MAAM,GAAG,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC/D,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpD,KAAK,CAAC,IAAI,CACR,KAAK,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,KAAK,GAAG,EAAE,CAC5G,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,QAAQ,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAEjE,iFAAiF;IACjF,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,MAAM,CAAC,GAAG,kBAAkB,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/D,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACzC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,wEAAwE;AACxE,SAAS,QAAQ,CAAC,QAAmB;IACnC,MAAM,KAAK,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK;QAAE,OAAO,4BAA4B,CAAC;IAChD,6EAA6E;IAC7E,0DAA0D;IAC1D,IAAI,KAAK,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QACpC,OAAO,KAAK,CAAC,WAAW;YACtB,CAAC,CAAC,wCAAwC,KAAK,CAAC,QAAQ,CAAC,IAAI,MAAM,KAAK,CAAC,WAAW,EAAE;YACtF,CAAC,CAAC,wCAAwC,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC;IACrE,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,OAAO,WAAW,KAAK,CAAC,QAAQ,CAAC,IAAI,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC;IACjE,CAAC;IACD,OAAO,UAAU,KAAK,CAAC,MAAM,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC;AACpF,CAAC;AAED,uEAAuE;AACvE,SAAS,eAAe,CAAC,CAAU,EAAE,CAAU;IAC7C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAClE,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9D,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAChC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;AAC3C,CAAC;AAED,0DAA0D;AAC1D,SAAS,SAAS,CAAC,KAAa,EAAE,CAAU;IAC1C,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACrE,OAAO,GAAG,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC;AACtC,CAAC;AAED,2CAA2C;AAC3C,SAAS,aAAa,CAAC,QAAkB,EAAE,CAAU;IACnD,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,CAAC,CAAC,GAAG,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,CAAC,CAAC,MAAM,CAAC;QAClB;YACE,OAAO,CAAC,CAAC,GAAG,CAAC;IACjB,CAAC;AACH,CAAC","sourcesContent":["/**\n * qScan report rendering.\n *\n * Produces the three output formats the CLI supports:\n *  - `human`  — a tasteful plain-text banner (counts, top findings, readiness\n *               score, and a one-line next step). Optional raw ANSI color.\n *  - `json`   — the structured scan result via core's `toJson`.\n *  - `sarif`  — SARIF 2.1.0 via core's `toSarif`.\n *\n * Only `human` lives here; `json`/`sarif` delegate to `@quantakrypto/core` so the\n * serialized shape stays consistent across every tool in the monorepo.\n */\n\nimport {\n  ANALYZABLE_LANGUAGES_LABEL,\n  defaultRegistry,\n  DEP_VULNERABLE_RULE,\n  formatTierGuidance,\n  SEVERITY_ORDER,\n  severityRank,\n  toCbom,\n  toJson,\n  toSarif,\n} from \"@quantakrypto/core\";\nimport type {\n  Finding,\n  ReportOptions,\n  ScanResult,\n  SecurityTier,\n  Severity,\n} from \"@quantakrypto/core\";\n\n/** Minimal ANSI palette. Empty strings when color is disabled. */\ninterface Palette {\n  reset: string;\n  bold: string;\n  dim: string;\n  red: string;\n  yellow: string;\n  green: string;\n  cyan: string;\n}\n\nconst PLAIN: Palette = { reset: \"\", bold: \"\", dim: \"\", red: \"\", yellow: \"\", green: \"\", cyan: \"\" };\nconst COLOR: Palette = {\n  reset: \"\\x1b[0m\",\n  bold: \"\\x1b[1m\",\n  dim: \"\\x1b[2m\",\n  red: \"\\x1b[31m\",\n  yellow: \"\\x1b[33m\",\n  green: \"\\x1b[32m\",\n  cyan: \"\\x1b[36m\",\n};\n\n/**\n * Render the JSON report (pretty-printed, no trailing newline).\n *\n * Delegates to core's `toJson` for a monorepo-consistent shape. `opts` is passed\n * straight through (e.g. `{ redactSnippets: true }` for `--no-snippets`).\n */\nexport function renderJson(result: ScanResult, opts?: ReportOptions): string {\n  return JSON.stringify(toJson(result, opts), null, 2);\n}\n\n/**\n * Render the SARIF 2.1.0 report (pretty-printed, no trailing newline).\n *\n * Delegates to core's `toSarif` — the monorepo's single source of truth for the\n * SARIF shape (schema, tool driver, rules, taxonomies). `opts` is passed through\n * (e.g. `{ redactSnippets: true }` for `--no-snippets`).\n */\nexport function renderSarif(result: ScanResult, opts?: ReportOptions): string {\n  // Advertise the full rule catalog (not just the rules that fired) so SARIF\n  // consumers see complete metadata for every rule qScan can emit. The detector\n  // registry's catalog is source/config rules only; `dep-vulnerable` comes from\n  // the manifest scanner, so add its generic entry — otherwise SARIF would build\n  // that rule from the first dependency finding and leak one package's specifics\n  // into the shared rule description.\n  const catalog = [...defaultRegistry.ruleCatalog(), DEP_VULNERABLE_RULE];\n  return JSON.stringify(toSarif(result, { catalog, ...opts }), null, 2);\n}\n\n/**\n * Render a CycloneDX 1.6 CBOM (cryptographic bill of materials) for the scan,\n * pretty-printed with no trailing newline. Delegates to core's `toCbom` so the\n * serialized shape stays consistent across every tool in the monorepo.\n */\nexport function renderCbom(result: ScanResult): string {\n  return JSON.stringify(toCbom(result), null, 2);\n}\n\n/**\n * Render the human-readable banner.\n *\n * @param result The scan result.\n * @param opts.color Emit raw ANSI escapes (default: false / plain text).\n * @param opts.topN How many findings to list (default: 5).\n */\nexport function renderHuman(\n  result: ScanResult,\n  opts: { color?: boolean; topN?: number; tier?: SecurityTier } = {},\n): string {\n  const c = opts.color ? COLOR : PLAIN;\n  const topN = opts.topN ?? 5;\n  const { findings, inventory, filesScanned } = result;\n  // `analyzedFiles`: of the scanned files, how many were in a language the\n  // scanner can actually inspect for crypto (JS/TS, Python, Go, Java). When it's 0 the\n  // readiness score reflects no analyzable code — say so rather than imply safe.\n  const analyzedFiles = result.analyzedFiles;\n  const noAnalyzable = analyzedFiles === 0;\n  const lines: string[] = [];\n\n  lines.push(`${c.bold}qScan — quantum-vulnerable cryptography report${c.reset}`);\n  const coverage =\n    analyzedFiles === undefined\n      ? \"\"\n      : `  •  analyzed: ${analyzedFiles} (${ANALYZABLE_LANGUAGES_LABEL})`;\n  lines.push(\n    `${c.dim}root: ${result.root}  •  files scanned: ${filesScanned}${coverage}  •  qscan v${result.toolVersion}${c.reset}`,\n  );\n  // Coverage diagnostics: warn when files were skipped, so a low finding count\n  // isn't mistaken for a clean scan of the whole tree.\n  const diag = result.diagnostics;\n  if (diag && (diag.unreadable > 0 || diag.skippedMinified > 0)) {\n    const parts: string[] = [];\n    if (diag.unreadable > 0) parts.push(`${diag.unreadable} unreadable`);\n    if (diag.skippedMinified > 0) parts.push(`${diag.skippedMinified} skipped (minified)`);\n    lines.push(`${c.yellow}Coverage: ${parts.join(\", \")} — results may be incomplete.${c.reset}`);\n  }\n  lines.push(\"\");\n\n  if (findings.length === 0) {\n    if (noAnalyzable && filesScanned > 0) {\n      // Honesty guard: don't let a 100/100 read as \"safe\" when nothing the\n      // scanner understands was analyzed — the crypto may live in an\n      // unsupported language (Go, Java, Rust, C#, …).\n      lines.push(\n        `${c.yellow}No analyzable source found.${c.reset} Scanned ${filesScanned} file${\n          filesScanned === 1 ? \"\" : \"s\"\n        }, but none were in a supported language (${ANALYZABLE_LANGUAGES_LABEL}).`,\n      );\n      lines.push(\n        `${c.dim}The score below covers only what qScan can read today — it is NOT a clean bill of health for this codebase.${c.reset}`,\n      );\n      lines.push(\n        `${c.bold}Readiness score: ${readiness(inventory.readinessScore, c)}/100 (no analyzable source)${c.reset}`,\n      );\n      lines.push(\"\");\n      lines.push(\n        `${c.dim}Next step:${c.reset} multi-language support is expanding; track coverage before relying on the score.`,\n      );\n      return lines.join(\"\\n\");\n    }\n    lines.push(`${c.green}No quantum-vulnerable cryptography detected.${c.reset}`);\n    lines.push(`${c.bold}Readiness score: ${readiness(inventory.readinessScore, c)}/100${c.reset}`);\n    lines.push(\"\");\n    lines.push(`${c.dim}Next step:${c.reset} keep scanning in CI to catch regressions.`);\n    return lines.join(\"\\n\");\n  }\n\n  // Severity counts, most-severe first.\n  const counts = SEVERITY_ORDER.map((sev) => {\n    const n = inventory.bySeverity[sev] ?? 0;\n    return n > 0 ? `${severityColor(sev, c)}${n} ${sev}${c.reset}` : null;\n  }).filter((s): s is string => s !== null);\n\n  lines.push(\n    `${c.bold}${findings.length} finding${findings.length === 1 ? \"\" : \"s\"}${c.reset}  (${counts.join(\", \")})`,\n  );\n  if (inventory.hndlCount > 0) {\n    lines.push(\n      `${c.yellow}${inventory.hndlCount}${c.reset} exposed to harvest-now-decrypt-later (HNDL).`,\n    );\n  }\n  lines.push(`${c.bold}Readiness score: ${readiness(inventory.readinessScore, c)}/100${c.reset}`);\n  lines.push(\"\");\n\n  // Top findings, sorted by severity then file/line for determinism.\n  const top = [...findings].sort(compareFindings).slice(0, topN);\n  lines.push(`${c.bold}Top findings${c.reset}`);\n  for (const f of top) {\n    const loc = `${f.location.file}:${f.location.line}`;\n    lines.push(\n      `  ${severityColor(f.severity, c)}${f.severity.padEnd(8)}${c.reset} ${c.cyan}${f.ruleId}${c.reset}  ${loc}`,\n    );\n    lines.push(`           ${f.message}`);\n    if (f.remediation) {\n      lines.push(`           ${c.dim}→ ${f.remediation}${c.reset}`);\n    }\n  }\n  if (findings.length > top.length) {\n    lines.push(`  ${c.dim}…and ${findings.length - top.length} more${c.reset}`);\n  }\n  lines.push(\"\");\n  lines.push(`${c.dim}Next step:${c.reset} ${nextStep(findings)}`);\n\n  // CNSA security-tier migration targets (`--tier`), surfacing remediationForTier.\n  if (opts.tier) {\n    lines.push(\"\");\n    const g = formatTierGuidance(inventory.byAlgorithm, opts.tier);\n    lines.push(`${c.bold}${g[0]}${c.reset}`);\n    for (const t of g.slice(1)) lines.push(`${c.cyan}${t}${c.reset}`);\n  }\n\n  return lines.join(\"\\n\");\n}\n\n/** Suggest a single concrete next action based on the worst finding. */\nfunction nextStep(findings: Finding[]): string {\n  const worst = [...findings].sort(compareFindings)[0];\n  if (!worst) return \"review the findings above.\";\n  // A dependency finding points at a manifest — you replace the *package*, not\n  // \"migrate package.json\". Phrase it as a dependency swap.\n  if (worst.category === \"dependency\") {\n    return worst.remediation\n      ? `replace the vulnerable dependency in ${worst.location.file} — ${worst.remediation}`\n      : `replace the vulnerable dependency in ${worst.location.file}.`;\n  }\n  if (worst.remediation) {\n    return `migrate ${worst.location.file} — ${worst.remediation}`;\n  }\n  return `triage ${worst.ruleId} in ${worst.location.file}:${worst.location.line}.`;\n}\n\n/** Deterministic ordering: most severe first, then file, then line. */\nfunction compareFindings(a: Finding, b: Finding): number {\n  const bySev = severityRank(a.severity) - severityRank(b.severity);\n  if (bySev !== 0) return bySev;\n  const byFile = a.location.file.localeCompare(b.location.file);\n  if (byFile !== 0) return byFile;\n  return a.location.line - b.location.line;\n}\n\n/** Color the readiness score green/yellow/red by band. */\nfunction readiness(score: number, c: Palette): string {\n  const color = score >= 80 ? c.green : score >= 50 ? c.yellow : c.red;\n  return `${color}${score}${c.reset}`;\n}\n\n/** Map a severity to its palette color. */\nfunction severityColor(severity: Severity, c: Palette): string {\n  switch (severity) {\n    case \"critical\":\n    case \"high\":\n      return c.red;\n    case \"medium\":\n      return c.yellow;\n    default:\n      return c.dim;\n  }\n}\n"]}
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,0BAA0B,EAC1B,eAAe,EACf,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,YAAY,EACZ,iBAAiB,EACjB,MAAM,EACN,MAAM,EACN,OAAO,GACR,MAAM,oBAAoB,CAAC;AAoB5B,MAAM,KAAK,GAAY,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AAClG,MAAM,KAAK,GAAY;IACrB,KAAK,EAAE,SAAS;IAChB,IAAI,EAAE,SAAS;IACf,GAAG,EAAE,SAAS;IACd,GAAG,EAAE,UAAU;IACf,MAAM,EAAE,UAAU;IAClB,KAAK,EAAE,UAAU;IACjB,IAAI,EAAE,UAAU;CACjB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,MAAkB,EAAE,IAAoB;IACjE,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,MAAkB,EAAE,IAAoB;IAClE,2EAA2E;IAC3E,8EAA8E;IAC9E,8EAA8E;IAC9E,+EAA+E;IAC/E,+EAA+E;IAC/E,oCAAoC;IACpC,MAAM,OAAO,GAAG,CAAC,GAAG,eAAe,CAAC,WAAW,EAAE,EAAE,mBAAmB,CAAC,CAAC;IACxE,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACxE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,MAAkB;IAC3C,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CACzB,MAAkB,EAClB,OAAgE,EAAE;IAElE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;IAC5B,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;IACrD,yEAAyE;IACzE,qFAAqF;IACrF,+EAA+E;IAC/E,MAAM,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;IAC3C,MAAM,YAAY,GAAG,aAAa,KAAK,CAAC,CAAC;IACzC,gFAAgF;IAChF,6EAA6E;IAC7E,gFAAgF;IAChF,6EAA6E;IAC7E,wBAAwB;IACxB,MAAM,WAAW,GACf,aAAa,KAAK,SAAS;QAC3B,aAAa,GAAG,CAAC;QACjB,YAAY,GAAG,CAAC;QAChB,aAAa,GAAG,YAAY,GAAG,IAAI,CAAC;IACtC,MAAM,cAAc,GAAG,WAAW;QAChC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,+BAA+B,aAAa,kBAAkB,YAAY,mBAAmB,0BAA0B,uDAAuD,CAAC,CAAC,KAAK,EAAE;QACjM,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,iDAAiD,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAChF,MAAM,QAAQ,GACZ,aAAa,KAAK,SAAS;QACzB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,kBAAkB,aAAa,KAAK,0BAA0B,GAAG,CAAC;IACxE,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,CAAC,GAAG,SAAS,MAAM,CAAC,IAAI,uBAAuB,YAAY,GAAG,QAAQ,eAAe,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC,KAAK,EAAE,CACxH,CAAC;IACF,6EAA6E;IAC7E,qDAAqD;IACrD,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC;IAChC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,IAAI,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC,EAAE,CAAC;QAC9D,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,UAAU,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,aAAa,CAAC,CAAC;QACrE,IAAI,IAAI,CAAC,eAAe,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,eAAe,qBAAqB,CAAC,CAAC;QACvF,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,aAAa,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,IAAI,YAAY,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACrC,qEAAqE;YACrE,+DAA+D;YAC/D,gDAAgD;YAChD,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,CAAC,MAAM,8BAA8B,CAAC,CAAC,KAAK,YAAY,YAAY,QACtE,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAC5B,4CAA4C,0BAA0B,IAAI,CAC3E,CAAC;YACF,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,CAAC,GAAG,8GAA8G,CAAC,CAAC,KAAK,EAAE,CAChI,CAAC;YACF,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,CAAC,IAAI,oBAAoB,SAAS,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC,8BAA8B,CAAC,CAAC,KAAK,EAAE,CAC3G,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,KAAK,mFAAmF,CAChH,CAAC;YACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,+CAA+C,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/E,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,oBAAoB,SAAS,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAChG,IAAI,cAAc;YAAE,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,KAAK,4CAA4C,CAAC,CAAC;QACrF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,sCAAsC;IACtC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACxC,MAAM,CAAC,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAE1C,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,CAAC,IAAI,GAAG,QAAQ,CAAC,MAAM,WAAW,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC3G,CAAC;IACF,IAAI,SAAS,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CACR,GAAG,CAAC,CAAC,MAAM,GAAG,SAAS,CAAC,SAAS,GAAG,CAAC,CAAC,KAAK,+CAA+C,CAC3F,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,oBAAoB,SAAS,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAChG,IAAI,cAAc;QAAE,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC/C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,mEAAmE;IACnE,MAAM,GAAG,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC/D,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpD,KAAK,CAAC,IAAI,CACR,KAAK,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,KAAK,GAAG,EAAE,CAC5G,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YAClB,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,QAAQ,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAEjE,iFAAiF;IACjF,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,MAAM,CAAC,GAAG,kBAAkB,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/D,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACzC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,6EAA6E;IAC7E,qEAAqE;IACrE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,uBAAuB,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACtD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,mBAAmB,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACvD,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,WAAW,CAAC,EAAE,CAAC;QACrD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,iBAAiB,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,wEAAwE;AACxE,SAAS,QAAQ,CAAC,QAAmB;IACnC,MAAM,KAAK,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK;QAAE,OAAO,4BAA4B,CAAC;IAChD,6EAA6E;IAC7E,0DAA0D;IAC1D,IAAI,KAAK,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QACpC,OAAO,KAAK,CAAC,WAAW;YACtB,CAAC,CAAC,wCAAwC,KAAK,CAAC,QAAQ,CAAC,IAAI,MAAM,KAAK,CAAC,WAAW,EAAE;YACtF,CAAC,CAAC,wCAAwC,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC;IACrE,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,OAAO,WAAW,KAAK,CAAC,QAAQ,CAAC,IAAI,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC;IACjE,CAAC;IACD,OAAO,UAAU,KAAK,CAAC,MAAM,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC;AACpF,CAAC;AAED,uEAAuE;AACvE,SAAS,eAAe,CAAC,CAAU,EAAE,CAAU;IAC7C,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAClE,IAAI,KAAK,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9B,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9D,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAChC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;AAC3C,CAAC;AAED,0DAA0D;AAC1D,SAAS,SAAS,CAAC,KAAa,EAAE,CAAU;IAC1C,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACrE,OAAO,GAAG,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC;AACtC,CAAC;AAED,2CAA2C;AAC3C,SAAS,aAAa,CAAC,QAAkB,EAAE,CAAU;IACnD,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU,CAAC;QAChB,KAAK,MAAM;YACT,OAAO,CAAC,CAAC,GAAG,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,CAAC,CAAC,MAAM,CAAC;QAClB;YACE,OAAO,CAAC,CAAC,GAAG,CAAC;IACjB,CAAC;AACH,CAAC","sourcesContent":["/**\n * qScan report rendering.\n *\n * Produces the three output formats the CLI supports:\n *  - `human`  — a tasteful plain-text banner (counts, top findings, readiness\n *               score, and a one-line next step). Optional raw ANSI color.\n *  - `json`   — the structured scan result via core's `toJson`.\n *  - `sarif`  — SARIF 2.1.0 via core's `toSarif`.\n *\n * Only `human` lives here; `json`/`sarif` delegate to `@quantakrypto/core` so the\n * serialized shape stays consistent across every tool in the monorepo.\n */\n\nimport {\n  ANALYZABLE_LANGUAGES_LABEL,\n  defaultRegistry,\n  DEP_VULNERABLE_RULE,\n  formatTierGuidance,\n  PQC_TRANSITION_NOTE,\n  SEVERITY_ORDER,\n  severityRank,\n  STATEFUL_HBS_NOTE,\n  toCbom,\n  toJson,\n  toSarif,\n} from \"@quantakrypto/core\";\nimport type {\n  Finding,\n  ReportOptions,\n  ScanResult,\n  SecurityTier,\n  Severity,\n} from \"@quantakrypto/core\";\n\n/** Minimal ANSI palette. Empty strings when color is disabled. */\ninterface Palette {\n  reset: string;\n  bold: string;\n  dim: string;\n  red: string;\n  yellow: string;\n  green: string;\n  cyan: string;\n}\n\nconst PLAIN: Palette = { reset: \"\", bold: \"\", dim: \"\", red: \"\", yellow: \"\", green: \"\", cyan: \"\" };\nconst COLOR: Palette = {\n  reset: \"\\x1b[0m\",\n  bold: \"\\x1b[1m\",\n  dim: \"\\x1b[2m\",\n  red: \"\\x1b[31m\",\n  yellow: \"\\x1b[33m\",\n  green: \"\\x1b[32m\",\n  cyan: \"\\x1b[36m\",\n};\n\n/**\n * Render the JSON report (pretty-printed, no trailing newline).\n *\n * Delegates to core's `toJson` for a monorepo-consistent shape. `opts` is passed\n * straight through (e.g. `{ redactSnippets: true }` for `--no-snippets`).\n */\nexport function renderJson(result: ScanResult, opts?: ReportOptions): string {\n  return JSON.stringify(toJson(result, opts), null, 2);\n}\n\n/**\n * Render the SARIF 2.1.0 report (pretty-printed, no trailing newline).\n *\n * Delegates to core's `toSarif` — the monorepo's single source of truth for the\n * SARIF shape (schema, tool driver, rules, taxonomies). `opts` is passed through\n * (e.g. `{ redactSnippets: true }` for `--no-snippets`).\n */\nexport function renderSarif(result: ScanResult, opts?: ReportOptions): string {\n  // Advertise the full rule catalog (not just the rules that fired) so SARIF\n  // consumers see complete metadata for every rule qScan can emit. The detector\n  // registry's catalog is source/config rules only; `dep-vulnerable` comes from\n  // the manifest scanner, so add its generic entry — otherwise SARIF would build\n  // that rule from the first dependency finding and leak one package's specifics\n  // into the shared rule description.\n  const catalog = [...defaultRegistry.ruleCatalog(), DEP_VULNERABLE_RULE];\n  return JSON.stringify(toSarif(result, { catalog, ...opts }), null, 2);\n}\n\n/**\n * Render a CycloneDX 1.6 CBOM (cryptographic bill of materials) for the scan,\n * pretty-printed with no trailing newline. Delegates to core's `toCbom` so the\n * serialized shape stays consistent across every tool in the monorepo.\n */\nexport function renderCbom(result: ScanResult): string {\n  return JSON.stringify(toCbom(result), null, 2);\n}\n\n/**\n * Render the human-readable banner.\n *\n * @param result The scan result.\n * @param opts.color Emit raw ANSI escapes (default: false / plain text).\n * @param opts.topN How many findings to list (default: 5).\n */\nexport function renderHuman(\n  result: ScanResult,\n  opts: { color?: boolean; topN?: number; tier?: SecurityTier } = {},\n): string {\n  const c = opts.color ? COLOR : PLAIN;\n  const topN = opts.topN ?? 5;\n  const { findings, inventory, filesScanned } = result;\n  // `analyzedFiles`: of the scanned files, how many were in a language the\n  // scanner can actually inspect for crypto (JS/TS, Python, Go, Java). When it's 0 the\n  // readiness score reflects no analyzable code — say so rather than imply safe.\n  const analyzedFiles = result.analyzedFiles;\n  const noAnalyzable = analyzedFiles === 0;\n  // Partial-coverage honesty: when the analyzable subset is only a small slice of\n  // what was scanned, a high score reflects that slice, not the whole tree. We\n  // surface a one-line caveat next to the score so the number isn't over-trusted.\n  // Skips the zero case (handled explicitly below) and normal repos where most\n  // files are analyzable.\n  const lowCoverage =\n    analyzedFiles !== undefined &&\n    analyzedFiles > 0 &&\n    filesScanned > 0 &&\n    analyzedFiles / filesScanned < 0.25;\n  const coverageCaveat = lowCoverage\n    ? `${c.dim}Note: the score covers only ${analyzedFiles} analyzable of ${filesScanned} scanned files (${ANALYZABLE_LANGUAGES_LABEL}); crypto in unsupported languages is not reflected.${c.reset}`\n    : \"\";\n  const lines: string[] = [];\n\n  lines.push(`${c.bold}qScan — quantum-vulnerable cryptography report${c.reset}`);\n  const coverage =\n    analyzedFiles === undefined\n      ? \"\"\n      : `  •  analyzed: ${analyzedFiles} (${ANALYZABLE_LANGUAGES_LABEL})`;\n  lines.push(\n    `${c.dim}root: ${result.root}  •  files scanned: ${filesScanned}${coverage}  •  qscan v${result.toolVersion}${c.reset}`,\n  );\n  // Coverage diagnostics: warn when files were skipped, so a low finding count\n  // isn't mistaken for a clean scan of the whole tree.\n  const diag = result.diagnostics;\n  if (diag && (diag.unreadable > 0 || diag.skippedMinified > 0)) {\n    const parts: string[] = [];\n    if (diag.unreadable > 0) parts.push(`${diag.unreadable} unreadable`);\n    if (diag.skippedMinified > 0) parts.push(`${diag.skippedMinified} skipped (minified)`);\n    lines.push(`${c.yellow}Coverage: ${parts.join(\", \")} — results may be incomplete.${c.reset}`);\n  }\n  lines.push(\"\");\n\n  if (findings.length === 0) {\n    if (noAnalyzable && filesScanned > 0) {\n      // Honesty guard: don't let a 100/100 read as \"safe\" when nothing the\n      // scanner understands was analyzed — the crypto may live in an\n      // unsupported language (Go, Java, Rust, C#, …).\n      lines.push(\n        `${c.yellow}No analyzable source found.${c.reset} Scanned ${filesScanned} file${\n          filesScanned === 1 ? \"\" : \"s\"\n        }, but none were in a supported language (${ANALYZABLE_LANGUAGES_LABEL}).`,\n      );\n      lines.push(\n        `${c.dim}The score below covers only what qScan can read today — it is NOT a clean bill of health for this codebase.${c.reset}`,\n      );\n      lines.push(\n        `${c.bold}Readiness score: ${readiness(inventory.readinessScore, c)}/100 (no analyzable source)${c.reset}`,\n      );\n      lines.push(\"\");\n      lines.push(\n        `${c.dim}Next step:${c.reset} multi-language support is expanding; track coverage before relying on the score.`,\n      );\n      return lines.join(\"\\n\");\n    }\n    lines.push(`${c.green}No quantum-vulnerable cryptography detected.${c.reset}`);\n    lines.push(`${c.bold}Readiness score: ${readiness(inventory.readinessScore, c)}/100${c.reset}`);\n    if (coverageCaveat) lines.push(coverageCaveat);\n    lines.push(\"\");\n    lines.push(`${c.dim}Next step:${c.reset} keep scanning in CI to catch regressions.`);\n    return lines.join(\"\\n\");\n  }\n\n  // Severity counts, most-severe first.\n  const counts = SEVERITY_ORDER.map((sev) => {\n    const n = inventory.bySeverity[sev] ?? 0;\n    return n > 0 ? `${severityColor(sev, c)}${n} ${sev}${c.reset}` : null;\n  }).filter((s): s is string => s !== null);\n\n  lines.push(\n    `${c.bold}${findings.length} finding${findings.length === 1 ? \"\" : \"s\"}${c.reset}  (${counts.join(\", \")})`,\n  );\n  if (inventory.hndlCount > 0) {\n    lines.push(\n      `${c.yellow}${inventory.hndlCount}${c.reset} exposed to harvest-now-decrypt-later (HNDL).`,\n    );\n  }\n  lines.push(`${c.bold}Readiness score: ${readiness(inventory.readinessScore, c)}/100${c.reset}`);\n  if (coverageCaveat) lines.push(coverageCaveat);\n  lines.push(\"\");\n\n  // Top findings, sorted by severity then file/line for determinism.\n  const top = [...findings].sort(compareFindings).slice(0, topN);\n  lines.push(`${c.bold}Top findings${c.reset}`);\n  for (const f of top) {\n    const loc = `${f.location.file}:${f.location.line}`;\n    lines.push(\n      `  ${severityColor(f.severity, c)}${f.severity.padEnd(8)}${c.reset} ${c.cyan}${f.ruleId}${c.reset}  ${loc}`,\n    );\n    lines.push(`           ${f.message}`);\n    if (f.remediation) {\n      lines.push(`           ${c.dim}→ ${f.remediation}${c.reset}`);\n    }\n  }\n  if (findings.length > top.length) {\n    lines.push(`  ${c.dim}…and ${findings.length - top.length} more${c.reset}`);\n  }\n  lines.push(\"\");\n  lines.push(`${c.dim}Next step:${c.reset} ${nextStep(findings)}`);\n\n  // CNSA security-tier migration targets (`--tier`), surfacing remediationForTier.\n  if (opts.tier) {\n    lines.push(\"\");\n    const g = formatTierGuidance(inventory.byAlgorithm, opts.tier);\n    lines.push(`${c.bold}${g[0]}${c.reset}`);\n    for (const t of g.slice(1)) lines.push(`${c.cyan}${t}${c.reset}`);\n  }\n\n  // Forward-looking standards + the IR 8547 migration deadline (HQC / FN-DSA /\n  // X-Wing) — the long-horizon guidance behind anything flagged above.\n  lines.push(\"\");\n  lines.push(`${c.bold}Standards & timeline${c.reset}`);\n  lines.push(`${c.dim}${PQC_TRANSITION_NOTE}${c.reset}`);\n  if (findings.some((f) => f.category === \"signature\")) {\n    lines.push(`${c.dim}${STATEFUL_HBS_NOTE}${c.reset}`);\n  }\n\n  return lines.join(\"\\n\");\n}\n\n/** Suggest a single concrete next action based on the worst finding. */\nfunction nextStep(findings: Finding[]): string {\n  const worst = [...findings].sort(compareFindings)[0];\n  if (!worst) return \"review the findings above.\";\n  // A dependency finding points at a manifest — you replace the *package*, not\n  // \"migrate package.json\". Phrase it as a dependency swap.\n  if (worst.category === \"dependency\") {\n    return worst.remediation\n      ? `replace the vulnerable dependency in ${worst.location.file} — ${worst.remediation}`\n      : `replace the vulnerable dependency in ${worst.location.file}.`;\n  }\n  if (worst.remediation) {\n    return `migrate ${worst.location.file} — ${worst.remediation}`;\n  }\n  return `triage ${worst.ruleId} in ${worst.location.file}:${worst.location.line}.`;\n}\n\n/** Deterministic ordering: most severe first, then file, then line. */\nfunction compareFindings(a: Finding, b: Finding): number {\n  const bySev = severityRank(a.severity) - severityRank(b.severity);\n  if (bySev !== 0) return bySev;\n  const byFile = a.location.file.localeCompare(b.location.file);\n  if (byFile !== 0) return byFile;\n  return a.location.line - b.location.line;\n}\n\n/** Color the readiness score green/yellow/red by band. */\nfunction readiness(score: number, c: Palette): string {\n  const color = score >= 80 ? c.green : score >= 50 ? c.yellow : c.red;\n  return `${color}${score}${c.reset}`;\n}\n\n/** Map a severity to its palette color. */\nfunction severityColor(severity: Severity, c: Palette): string {\n  switch (severity) {\n    case \"critical\":\n    case \"high\":\n      return c.red;\n    case \"medium\":\n      return c.yellow;\n    default:\n      return c.dim;\n  }\n}\n"]}

package.json

 {
   "name": "@quantakrypto/qscan",
-  "version": "0.4.3",
+  "version": "0.4.4",
   "description": "qScan — find quantum-vulnerable cryptography in any codebase (CLI). Zero runtime dependencies.",
@@ -40,4 +40,4 @@ "license": "Apache-2.0",
   "dependencies": {
-    "@quantakrypto/agent": "0.4.3",
-    "@quantakrypto/core": "0.4.3"
+    "@quantakrypto/agent": "0.4.4",
+    "@quantakrypto/core": "0.4.4"
   },
@@ -44,0 +44,0 @@ "scripts": {

README.md

@@ -24,4 +24,5 @@ # @quantakrypto/qscan
 Inline crypto detection currently covers **JavaScript/TypeScript**, **Python**,
-**Go**, **Java/Kotlin** (JCA + BouncyCastle), **C#/.NET**, **Rust**, **Ruby**,
-and **C/C++** (OpenSSL) source. PEM key material, SSH keys, TLS/certificate
+**Go**, **Java/Kotlin/Scala** (JCA + BouncyCastle), **C#/.NET**, **Rust**, **Ruby**,
+**PHP** (openssl / phpseclib3 / libsodium), **Elixir** (`:crypto` / X509 / JOSE),
+and **C/C++** (OpenSSL, Mbed TLS, wolfSSL) source. PEM key material, SSH keys, TLS/certificate
 config, and dependency manifests for **six ecosystems** — npm (plus
@@ -28,0 +29,0 @@ `yarn.lock` / `pnpm-lock.yaml`), PyPI, Cargo, Go modules, Maven, and RubyGems —

New alerts

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Fixed alerts

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Improved metrics

Total package byte prevSize

291252

2.73%

Lines of code

2268

2.25%

Number of lines in readme file

335

0.3%

Worsened metrics

Number of low supply chain risk alerts

18

5.88%

Dependency changes

• + Added

  @quantakrypto/agent@0.4.4
  (transitive)

• + Added

  @quantakrypto/core@0.4.4
  (transitive)

• - Removed

  @quantakrypto/agent@0.4.3
  (transitive)

• - Removed

  @quantakrypto/core@0.4.3
  (transitive)

• Updated

  @quantakrypto/agent@0.4.4

• Updated

  @quantakrypto/core@0.4.4