0sec-cli 0.15.0 → 0.18.0

package/chunks/chunk-YYRBQVFE.js

@@ -0,0 +1,2572 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+import {
+  homeStateDir
+} from "./chunk-6L26OBWI.js";
+
+// packages/core/dist/scope/waf-detect.js
+function readHeader(headers, name) {
+  const lower = name.toLowerCase();
+  if (headers == null)
+    return null;
+  const maybeGet = headers.get;
+  if (typeof maybeGet === "function") {
+    const v = headers.get(name);
+    return v ?? null;
+  }
+  for (const [k, v] of Object.entries(headers)) {
+    if (k.toLowerCase() === lower) {
+      if (Array.isArray(v))
+        return v.join(", ");
+      return v == null ? null : String(v);
+    }
+  }
+  return null;
+}
+function readCookies(resp) {
+  if (resp.cookies && resp.cookies.length > 0)
+    return resp.cookies;
+  const h = resp.headers;
+  const getSet = h.getSetCookie;
+  if (typeof getSet === "function") {
+    try {
+      const arr = getSet.call(h);
+      if (Array.isArray(arr) && arr.length)
+        return arr;
+    } catch {
+    }
+  }
+  const single = readHeader(h, "set-cookie");
+  return single ? [single] : [];
+}
+var WAF_SIGNATURES = [
+  {
+    vendor: "cloudflare",
+    label: "Cloudflare",
+    headers: [
+      { name: "server", contains: "cloudflare" },
+      { name: "cf-ray" },
+      { name: "cf-mitigated" }
+    ],
+    cookies: ["__cfduid", "cf_clearance", "__cf_bm"],
+    body: ["attention required! | cloudflare", "cf-error-details", "ray id:", "cloudflare to restrict access"]
+  },
+  {
+    vendor: "akamai",
+    label: "Akamai (Kona/Ghost)",
+    headers: [
+      { name: "server", contains: "akamaighost" },
+      { name: "x-akamai-transformed" }
+    ],
+    cookies: ["ak_bmsc", "ak_bmsc", "bm_sz", "bm_sv"],
+    body: ["access denied", "reference #", "you don't have permission to access"]
+  },
+  {
+    vendor: "aws-waf",
+    label: "AWS WAF",
+    headers: [
+      { name: "x-amzn-requestid" },
+      { name: "x-amz-cf-id" },
+      { name: "x-amzn-waf-action" }
+    ],
+    cookies: ["aws-waf-token"],
+    body: ["request blocked", "aws waf"]
+  },
+  {
+    vendor: "imperva-incapsula",
+    label: "Imperva / Incapsula",
+    headers: [
+      { name: "x-iinfo" },
+      { name: "x-cdn", contains: "incapsula" }
+    ],
+    cookies: ["incap_ses", "visid_incap", "nlbi_"],
+    body: ["incapsula incident id", "powered by incapsula", "_incapsula_resource"]
+  },
+  {
+    vendor: "sucuri",
+    label: "Sucuri CloudProxy",
+    headers: [
+      { name: "server", contains: "sucuri" },
+      { name: "x-sucuri-id" },
+      { name: "x-sucuri-cache" }
+    ],
+    body: ["access denied - sucuri website firewall", "sucuri/cloudproxy", "questions about why you are blocked"]
+  },
+  {
+    vendor: "f5-big-ip",
+    label: "F5 BIG-IP ASM",
+    headers: [{ name: "server", contains: "big-ip" }],
+    cookies: ["ts", "bigipserver", "f5_cspm"],
+    body: ["the requested url was rejected", "support id", "please consult with your administrator"]
+  },
+  {
+    vendor: "fortinet-fortiweb",
+    label: "Fortinet FortiWeb",
+    headers: [{ name: "server", contains: "fortiweb" }],
+    cookies: ["cookiesession1", "fortiwafsid"],
+    body: ["web page blocked", ".fgd_icon", "blocked by fortiweb"]
+  },
+  {
+    vendor: "barracuda",
+    label: "Barracuda WAF",
+    headers: [{ name: "server", contains: "barracuda" }],
+    cookies: ["barra_counter_session", "bni_"],
+    body: ["you are being redirected", "barracuda"]
+  },
+  {
+    vendor: "wordfence",
+    label: "Wordfence",
+    body: ["generated by wordfence", "your access to this site has been limited", "wordfence"]
+  },
+  {
+    vendor: "modsecurity",
+    label: "ModSecurity / OWASP CRS",
+    headers: [{ name: "server", contains: "mod_security" }],
+    body: ["mod_security", "modsecurity", "this error was generated by mod_security", "not acceptable!"]
+  }
+];
+var WAF_BLOCK_STATUSES = /* @__PURE__ */ new Set([403, 406, 418, 429, 501, 503]);
+var GENERIC_BLOCK_MARKERS = [
+  "request blocked",
+  "access denied",
+  "forbidden",
+  "the requested url was rejected",
+  "your request has been blocked",
+  "this request was blocked",
+  "security policy",
+  "web application firewall",
+  "blocked for security reasons"
+];
+function fingerprintWaf(resp) {
+  const headers = resp.headers;
+  const cookies = readCookies(resp).map((c) => c.toLowerCase());
+  const body = (resp.body ?? "").toLowerCase();
+  let best = null;
+  for (const sig of WAF_SIGNATURES) {
+    const signals = [];
+    let weight = 0;
+    for (const h of sig.headers ?? []) {
+      const val = readHeader(headers, h.name);
+      if (val == null)
+        continue;
+      if (h.contains == null || val.toLowerCase().includes(h.contains)) {
+        signals.push({ kind: "header", detail: `${h.name}: ${val}` });
+        weight += 3;
+      }
+    }
+    for (const cookiePrefix of sig.cookies ?? []) {
+      const hit = cookies.find((c) => c.startsWith(cookiePrefix) || c.includes(`${cookiePrefix}=`) || c.includes(` ${cookiePrefix}`));
+      if (hit) {
+        signals.push({ kind: "cookie", detail: cookiePrefix });
+        weight += 3;
+      }
+    }
+    for (const marker of sig.body ?? []) {
+      if (body.includes(marker)) {
+        signals.push({ kind: "body", detail: marker });
+        weight += 1;
+      }
+    }
+    if (signals.length > 0 && (best == null || weight > best.weight)) {
+      best = { sig, signals, weight };
+    }
+  }
+  if (!best)
+    return null;
+  const confidence = Math.min(1, best.weight / 6);
+  return {
+    vendor: best.sig.vendor,
+    label: best.sig.label,
+    confidence: Math.round(confidence * 100) / 100,
+    signals: best.signals
+  };
+}
+function classifyResponse(resp) {
+  const status = resp.status;
+  const fingerprint = fingerprintWaf(resp);
+  const body = (resp.body ?? "").toLowerCase();
+  const signals = fingerprint ? [...fingerprint.signals] : [];
+  const statusIsBlock = WAF_BLOCK_STATUSES.has(status);
+  if (statusIsBlock)
+    signals.push({ kind: "status", detail: String(status) });
+  const genericMarker = GENERIC_BLOCK_MARKERS.find((m) => body.includes(m));
+  const challengeMarker = body.includes("checking your browser") || body.includes("just a moment") || body.includes("enable javascript and cookies to continue") || body.includes("verify you are a human") || body.includes("ddos protection by");
+  let blocked = false;
+  let reason;
+  if (fingerprint && statusIsBlock) {
+    blocked = true;
+    reason = `${fingerprint.label} block (HTTP ${status})`;
+  } else if (fingerprint && (genericMarker || challengeMarker)) {
+    blocked = true;
+    reason = `${fingerprint.label} interstitial/challenge page`;
+  } else if (statusIsBlock && genericMarker) {
+    blocked = true;
+    if (genericMarker)
+      signals.push({ kind: "body", detail: genericMarker });
+    reason = `generic WAF block marker "${genericMarker}" (HTTP ${status})`;
+  } else if (status === 429) {
+    blocked = true;
+    reason = "HTTP 429 rate-limit rejection (edge throttle)";
+  } else if (challengeMarker) {
+    blocked = true;
+    reason = "browser-challenge interstitial";
+  } else {
+    reason = fingerprint ? `${fingerprint.label} fingerprinted but response looks legitimate (HTTP ${status})` : `no WAF block detected (HTTP ${status})`;
+  }
+  return { blocked, status, fingerprint, reason, signals };
+}
+var EVASION_KEYWORDS = [
+  "select",
+  "union",
+  "insert",
+  "update",
+  "delete",
+  "drop",
+  "from",
+  "where",
+  "or",
+  "and",
+  "script",
+  "alert",
+  "onerror",
+  "onload",
+  "javascript",
+  "eval",
+  "etc/passwd",
+  "concat",
+  "sleep",
+  "benchmark"
+];
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function percentEncodeAll(value) {
+  let out = "";
+  for (const ch of Buffer.from(value, "utf8")) {
+    out += "%" + ch.toString(16).toUpperCase().padStart(2, "0");
+  }
+  return out;
+}
+function transformParamValues(parts, fn) {
+  let changed = false;
+  let url = parts.url;
+  try {
+    const u = new URL(parts.url);
+    const next = new URLSearchParams();
+    for (const [k, v] of u.searchParams.entries()) {
+      const nv = fn(v);
+      if (nv !== v)
+        changed = true;
+      next.append(k, nv);
+    }
+    const qs = Array.from(next.entries()).map(([k, v]) => `${encodeURIComponent(k)}=${v}`).join("&");
+    u.search = qs ? `?${qs}` : "";
+    url = u.toString();
+  } catch {
+  }
+  let body = parts.body;
+  if (typeof body === "string" && body.length > 0) {
+    const nb = fn(body);
+    if (nb !== body) {
+      changed = true;
+      body = nb;
+    }
+  }
+  return { parts: { ...parts, url, body }, changed };
+}
+function caseFoldKeywords(value) {
+  let out = value;
+  for (const kw of EVASION_KEYWORDS) {
+    const re = new RegExp(escapeRegExp(kw), "gi");
+    out = out.replace(re, (match) => match.split("").map((c, i) => i % 2 === 0 ? c.toUpperCase() : c.toLowerCase()).join(""));
+  }
+  return out;
+}
+function inlineCommentKeywords(value) {
+  let out = value;
+  for (const kw of EVASION_KEYWORDS) {
+    if (kw.length < 3 || kw.includes("/"))
+      continue;
+    const re = new RegExp(escapeRegExp(kw), "gi");
+    out = out.replace(re, (match) => {
+      const mid = Math.floor(match.length / 2);
+      return match.slice(0, mid) + "/**/" + match.slice(mid);
+    });
+  }
+  return out;
+}
+function altWhitespace(value) {
+  return value.includes(" ") ? value.replace(/ /g, "/**/") : value;
+}
+function varyHeaderCasing(parts) {
+  const next = {};
+  let changed = false;
+  for (const [k, v] of Object.entries(parts.headers)) {
+    const recased = k.split("-").map((seg, i) => i % 2 === 0 ? seg.toLowerCase() : seg.toUpperCase()).join("-");
+    if (recased !== k)
+      changed = true;
+    next[recased] = v;
+  }
+  if (!("x-forwarded-for" in parts.headers) && !("X-Forwarded-For" in parts.headers)) {
+    next["X-Forwarded-For"] = "127.0.0.1";
+    changed = true;
+  }
+  return { headers: next, changed };
+}
+var EVASION_STRATEGIES = [
+  {
+    name: "percent-encode-params",
+    description: "percent-encode query/body values (origin URL-decodes; defeats literal signature match)",
+    apply(parts) {
+      const r = transformParamValues(parts, percentEncodeAll);
+      return { parts: r.parts, changed: r.changed, note: "percent-encoded parameter values" };
+    }
+  },
+  {
+    name: "double-encode-params",
+    description: "double percent-encode values (defeats single-pass URL-decode normalizers)",
+    apply(parts) {
+      const r = transformParamValues(parts, (v) => percentEncodeAll(percentEncodeAll(v)));
+      return { parts: r.parts, changed: r.changed, note: "double percent-encoded parameter values" };
+    }
+  },
+  {
+    name: "case-fold-keywords",
+    description: "alternate keyword casing (SeLeCt) to slip case-sensitive rules",
+    apply(parts) {
+      const r = transformParamValues(parts, caseFoldKeywords);
+      return { parts: r.parts, changed: r.changed, note: "case-folded SQL/XSS keywords" };
+    }
+  },
+  {
+    name: "inline-comment-keywords",
+    description: "insert SQL inline comments inside keywords (UN/**/ION)",
+    apply(parts) {
+      const r = transformParamValues(parts, inlineCommentKeywords);
+      return { parts: r.parts, changed: r.changed, note: "inline-commented keywords" };
+    }
+  },
+  {
+    name: "alt-whitespace",
+    description: "replace spaces with /**/ to evade whitespace-anchored rules",
+    apply(parts) {
+      const r = transformParamValues(parts, altWhitespace);
+      return { parts: r.parts, changed: r.changed, note: "alternate whitespace tokens" };
+    }
+  },
+  {
+    name: "header-casing",
+    description: "vary header-name casing + add benign X-Forwarded-For (IP/geo rule probe)",
+    apply(parts) {
+      const r = varyHeaderCasing(parts);
+      return { parts: { ...parts, headers: r.headers }, changed: r.changed, note: "varied header casing / origin headers" };
+    }
+  }
+];
+function jitterFor(attempt, baseMs = 250, rng) {
+  const factor = attempt + 1;
+  if (rng) {
+    return Math.floor(rng() * baseMs * factor);
+  }
+  return baseMs * factor;
+}
+function defaultSleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+async function runEvasionCampaign(blockedParts, send, opts = {}) {
+  const ladder = opts.strategies ?? EVASION_STRATEGIES;
+  const max = Math.min(opts.maxAttempts ?? ladder.length, ladder.length);
+  const sleepFn = opts.sleepFn ?? defaultSleep;
+  const attempts = [];
+  let lastResponse = null;
+  let attemptNo = 0;
+  for (let i = 0; i < max; i++) {
+    const strategy = ladder[i];
+    const transformed = strategy.apply(blockedParts);
+    if (!transformed.changed) {
+      attempts.push({
+        strategy: strategy.name,
+        description: strategy.description,
+        note: `skipped (no-op for this request)`,
+        jitterMs: 0,
+        status: lastResponse?.status ?? 0,
+        blocked: true,
+        url: blockedParts.url
+      });
+      continue;
+    }
+    const jitterMs = jitterFor(attemptNo, opts.jitterBaseMs, opts.rng);
+    attemptNo += 1;
+    if (jitterMs > 0) {
+      await sleepFn(jitterMs);
+    }
+    const res = await send(transformed.parts);
+    lastResponse = res;
+    const verdict = classifyResponse(res);
+    attempts.push({
+      strategy: strategy.name,
+      description: strategy.description,
+      note: transformed.note,
+      jitterMs,
+      status: res.status,
+      blocked: verdict.blocked,
+      url: transformed.parts.url
+    });
+    if (!verdict.blocked) {
+      return {
+        final: res,
+        attempts,
+        bypassed: true,
+        bypassStrategy: strategy.name
+      };
+    }
+  }
+  return {
+    final: lastResponse ?? { status: 0, headers: {}, body: "" },
+    attempts,
+    bypassed: false,
+    bypassStrategy: null
+  };
+}
+var WafDetector = class {
+  nowFn;
+  hosts = /* @__PURE__ */ new Map();
+  evidenceLog = [];
+  /** Cap so a pathological scan can't grow the evidence log unbounded. */
+  maxEvidence;
+  constructor(opts = {}) {
+    this.nowFn = opts.nowFn ?? (() => Date.now());
+    this.maxEvidence = opts.maxEvidence ?? 500;
+  }
+  /** Host key for a URL (lowercased hostname; falls back to the raw string). */
+  hostOf(url) {
+    try {
+      return new URL(url).hostname.toLowerCase();
+    } catch {
+      return url.toLowerCase();
+    }
+  }
+  /**
+   * Record a detected block for `url`. Returns the verdict so the caller can
+   * decide whether to launch an evasion campaign. Updates per-host state.
+   */
+  recordBlock(url, verdict) {
+    const host = this.hostOf(url);
+    const vendor = verdict.fingerprint?.vendor ?? "generic";
+    const label = verdict.fingerprint?.label ?? "unfingerprinted WAF";
+    const confidence = verdict.fingerprint?.confidence ?? 0.3;
+    const now = this.nowFn();
+    let state = this.hosts.get(host);
+    if (!state) {
+      state = {
+        host,
+        vendor,
+        label,
+        confidence,
+        firstSeenMs: now,
+        blockCount: 0,
+        evasionAttempts: 0,
+        bypasses: 0
+      };
+      this.hosts.set(host, state);
+    } else if (confidence > state.confidence) {
+      state.vendor = vendor;
+      state.label = label;
+      state.confidence = confidence;
+    }
+    state.blockCount += 1;
+  }
+  /** Record the outcome of an evasion campaign as evidence. */
+  recordEvasion(url, verdict, campaign) {
+    const host = this.hostOf(url);
+    const state = this.hosts.get(host);
+    if (state) {
+      state.evasionAttempts += campaign.attempts.filter((a) => a.jitterMs > 0 || a.note !== "skipped (no-op for this request)").length;
+      if (campaign.bypassed)
+        state.bypasses += 1;
+    }
+    if (this.evidenceLog.length < this.maxEvidence) {
+      this.evidenceLog.push({
+        ts: this.nowFn(),
+        host,
+        url,
+        vendor: verdict.fingerprint?.vendor ?? "generic",
+        label: verdict.fingerprint?.label ?? "unfingerprinted WAF",
+        reason: verdict.reason,
+        attempts: campaign.attempts,
+        bypassed: campaign.bypassed,
+        authorizedEngagement: true
+      });
+    }
+  }
+  /** True if we've ever seen a block for this URL's host. */
+  isKnownWafHost(url) {
+    return this.hosts.has(this.hostOf(url));
+  }
+  /** All per-host WAF states. */
+  hostStates() {
+    return Array.from(this.hosts.values());
+  }
+  /** Full evidence trail (capped). */
+  evidence() {
+    return [...this.evidenceLog];
+  }
+  /** Compact summary for the report. */
+  summary() {
+    const hosts = this.hostStates();
+    return {
+      waf_detected: hosts.length > 0,
+      hosts,
+      total_blocks: hosts.reduce((n, h) => n + h.blockCount, 0),
+      total_evasion_attempts: hosts.reduce((n, h) => n + h.evasionAttempts, 0),
+      total_bypasses: hosts.reduce((n, h) => n + h.bypasses, 0)
+    };
+  }
+};
+
+// packages/core/dist/recon/subdomains.js
+var DEFAULT_TIMEOUT_MS = 15e3;
+var CRT_SH_BASE = "https://crt.sh";
+function isApexOrEmpty(host, apex) {
+  return host === apex || host.length === 0;
+}
+function normalizeCertName(raw, apex) {
+  let host = raw.trim().toLowerCase();
+  if (!host)
+    return void 0;
+  if (host.startsWith("*."))
+    host = host.slice(2);
+  if (host.includes("*"))
+    return void 0;
+  if (host.endsWith("."))
+    host = host.slice(0, -1);
+  if (!host)
+    return void 0;
+  if (host !== apex && !host.endsWith(`.${apex}`))
+    return void 0;
+  return host;
+}
+function parseCrtShRows(rows, apex) {
+  if (!Array.isArray(rows))
+    return [];
+  const hosts = /* @__PURE__ */ new Set();
+  for (const row of rows) {
+    const fields = [];
+    if (typeof row?.common_name === "string")
+      fields.push(row.common_name);
+    if (typeof row?.name_value === "string")
+      fields.push(...row.name_value.split(/\n+/));
+    for (const field of fields) {
+      const host = normalizeCertName(field, apex);
+      if (host && !isApexOrEmpty(host, apex))
+        hosts.add(host);
+    }
+  }
+  return [...hosts].sort();
+}
+async function defaultFetchJson(url, timeoutMs) {
+  if (new URL(url).hostname.toLowerCase() !== "crt.sh") {
+    throw new Error(`subdomains: refusing non-crt.sh fetch (${url})`);
+  }
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const res = await fetch(url, {
+      signal: controller.signal,
+      headers: { Accept: "application/json", "User-Agent": "0sec-recon" }
+    });
+    if (!res.ok)
+      throw new Error(`crt.sh HTTP ${res.status}`);
+    return await res.json();
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function defaultResolve(host) {
+  const dns = await import("node:dns/promises");
+  const [a, aaaa, cname] = await Promise.allSettled([
+    dns.resolve4(host),
+    dns.resolve6(host),
+    dns.resolveCname(host)
+  ]);
+  const addresses = [
+    ...a.status === "fulfilled" ? a.value : [],
+    ...aaaa.status === "fulfilled" ? aaaa.value : []
+  ];
+  if (addresses.length === 0)
+    throw new Error(`no A/AAAA records for ${host}`);
+  const cnameTarget = cname.status === "fulfilled" ? cname.value[0] : void 0;
+  return { addresses, ...cnameTarget ? { cname: cnameTarget } : {} };
+}
+async function enumerateSubdomains(opts) {
+  const apex = opts.domain.trim().toLowerCase().replace(/\.$/, "");
+  if (!apex)
+    throw new Error("subdomains: empty domain");
+  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const fetchJson2 = opts.fetchJson ?? ((url2) => defaultFetchJson(url2, timeoutMs));
+  const resolve = opts.resolve ?? defaultResolve;
+  const url = `${CRT_SH_BASE}/?q=${encodeURIComponent(`%.${apex}`)}&output=json`;
+  let candidates;
+  try {
+    candidates = parseCrtShRows(await fetchJson2(url), apex);
+  } catch {
+    return [];
+  }
+  const resolved = await Promise.allSettled(candidates.map(async (host) => {
+    const { addresses, cname } = await resolve(host);
+    return {
+      host,
+      source: "crt.sh",
+      addresses,
+      ...cname ? { cname } : {}
+    };
+  }));
+  const out = [];
+  for (const result of resolved) {
+    if (result.status === "fulfilled")
+      out.push(result.value);
+  }
+  out.sort((a, b) => a.host.localeCompare(b.host));
+  return out;
+}
+
+// packages/core/dist/recon/js-artifacts.js
+var SECRET_PATTERNS = [
+  // ---- Known-public / expected keys (noise, never a real finding) ----
+  // PostHog project key — shipped client-side by design.
+  { kind: "posthog_public_key", source: /\bphc_[A-Za-z0-9]{32,}\b/, confidence: "low" },
+  // Vercel Web Analytics / Speed Insights public token.
+  { kind: "vercel_analytics_key", source: /\b(?:va_pub_|vercel_analytics_)[A-Za-z0-9]{16,}\b/, confidence: "low" },
+  // ---- High-signal credentials (ported from foxguard src/secrets.rs) ----
+  // Stripe live secret / restricted key.
+  { kind: "stripe_live_key", source: /\b(?:sk|rk)_live_[A-Za-z0-9]{20,}\b/, confidence: "high" },
+  // AWS access key id.
+  { kind: "aws_access_key_id", source: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/, confidence: "high" },
+  // AWS secret access key — assignment form (the 40-char secret is meaningless
+  // without the `aws_secret_access_key =` anchor, so we require it).
+  {
+    kind: "aws_secret_access_key",
+    source: /aws_secret_access_key\s*[:=]\s*["']?[A-Za-z0-9/+=]{40}["']?/i,
+    confidence: "high"
+  },
+  // Google API key.
+  { kind: "google_api_key", source: /\bAIza[A-Za-z0-9_-]{35}\b/, confidence: "high" },
+  // GitHub personal-access / app tokens (ghp_/gho_/ghu_/ghs_/ghr_ + fine-grained github_pat_).
+  { kind: "github_token", source: /\bgh[pousr]_[A-Za-z0-9]{36,}\b|\bgithub_pat_[A-Za-z0-9_]{20,}\b/, confidence: "high" },
+  // GitLab personal-access token.
+  { kind: "gitlab_token", source: /\bglpat-[A-Za-z0-9\-_]{20,}\b/, confidence: "high" },
+  // npm access token.
+  { kind: "npm_token", source: /\bnpm_[A-Za-z0-9]{36}\b/, confidence: "high" },
+  // Slack token.
+  { kind: "slack_token", source: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/, confidence: "high" },
+  // Private-key material (RSA/DSA/EC/OpenSSH/PKCS#8 PEM header).
+  { kind: "private_key", source: /-----BEGIN (?:RSA |DSA |EC |OPENSSH )?PRIVATE KEY-----/, confidence: "high" },
+  // Generic credential assignment: `api_key`/`apikey`/`secret`/`token`/`password`
+  // assigned a non-trivial quoted literal. Lower-precision than the vendor
+  // patterns above, so it sits last and is the catch-all for a hardcoded
+  // `const API_KEY = "…"` in a bundle (the CodeWall Bain move). Still `high`:
+  // a quoted 16+ char credential literal in served JS is a real leak.
+  {
+    kind: "generic_api_key",
+    source: /\b(?:api[_-]?key|apikey|secret|token|passwd|password)\b\s*[:=]\s*["'][A-Za-z0-9_\-./+=]{16,}["']/i,
+    confidence: "high"
+  },
+  // HTTP Authorization bearer token embedded in a bundle.
+  {
+    kind: "bearer_token",
+    source: /\bbearer\s+[A-Za-z0-9_\-.=]{20,}\b/i,
+    confidence: "high"
+  },
+  // JWT (three base64url segments). Catches Supabase service_role keys, which
+  // are JWTs — a service_role key in a client bundle is a serious leak.
+  {
+    kind: "jwt",
+    source: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/,
+    confidence: "high"
+  }
+];
+var SOURCE_MAPPING_URL_RE = /\/\/[#@]\s*sourceMappingURL=([^\s'"]+)/;
+function redactSecret(value) {
+  const prefixLen = Math.min(6, value.length);
+  const prefix = value.slice(0, prefixLen);
+  return `${prefix}\u2026(${value.length} chars)`;
+}
+function resolveSourceMapUrl(bundleUrl, mappingValue) {
+  const trimmed = mappingValue.trim();
+  if (!trimmed || trimmed.startsWith("data:"))
+    return void 0;
+  try {
+    return new URL(trimmed, bundleUrl).toString();
+  } catch {
+    return void 0;
+  }
+}
+function scanBody(chunkUrl, body) {
+  const hits = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const pattern of SECRET_PATTERNS) {
+    const flags = pattern.source.flags.includes("g") ? pattern.source.flags : `${pattern.source.flags}g`;
+    const re = new RegExp(pattern.source.source, flags);
+    let m;
+    while ((m = re.exec(body)) !== null) {
+      const raw = m[0];
+      const dedupeKey = `${pattern.kind}::${raw}`;
+      if (seen.has(dedupeKey))
+        continue;
+      seen.add(dedupeKey);
+      hits.push({
+        kind: pattern.kind,
+        match: redactSecret(raw),
+        chunk: chunkUrl,
+        confidence: pattern.confidence
+      });
+      if (m.index === re.lastIndex)
+        re.lastIndex++;
+    }
+  }
+  return hits;
+}
+async function probeSourceMaps(chunkUrl, body, fetchText) {
+  const candidates = /* @__PURE__ */ new Set();
+  const comment = body.match(SOURCE_MAPPING_URL_RE);
+  if (comment) {
+    const resolved = resolveSourceMapUrl(chunkUrl, comment[1]);
+    if (resolved)
+      candidates.add(resolved);
+  }
+  try {
+    const sibling = new URL(chunkUrl);
+    sibling.search = "";
+    sibling.hash = "";
+    candidates.add(`${sibling.toString()}.map`);
+  } catch {
+  }
+  const results = [];
+  for (const url of candidates) {
+    let res;
+    try {
+      res = await fetchText(url);
+    } catch {
+      results.push({ url, exposed: false });
+      continue;
+    }
+    results.push({ url, exposed: res.status === 200 && res.body.trim().length > 0 });
+  }
+  return results;
+}
+async function scanJsArtifacts(opts) {
+  const { chunkUrls, fetchText } = opts;
+  const sourceMaps = [];
+  const secrets = [];
+  const seenMapUrls = /* @__PURE__ */ new Set();
+  for (const chunkUrl of chunkUrls) {
+    let res;
+    try {
+      res = await fetchText(chunkUrl);
+    } catch {
+      continue;
+    }
+    if (res.status !== 200 || !res.body)
+      continue;
+    for (const sm of await probeSourceMaps(chunkUrl, res.body, fetchText)) {
+      if (seenMapUrls.has(sm.url))
+        continue;
+      seenMapUrls.add(sm.url);
+      sourceMaps.push(sm);
+    }
+    secrets.push(...scanBody(chunkUrl, res.body));
+  }
+  return { sourceMaps, secrets };
+}
+
+// packages/core/dist/intel/cache.js
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+var DEFAULT_TTL_MS = 24 * 60 * 60 * 1e3;
+function defaultIntelCacheDir() {
+  return join(homeStateDir(), "intel-cache");
+}
+var IntelCache = class {
+  cacheDir;
+  constructor(cacheDir = defaultIntelCacheDir()) {
+    this.cacheDir = cacheDir;
+  }
+  get(source, key, opts = {}) {
+    const path = this.pathFor(source, key);
+    if (!existsSync(path))
+      return null;
+    try {
+      const parsed = JSON.parse(readFileSync(path, "utf8"));
+      const expiresAtMs = Date.parse(parsed.expiresAt);
+      if (Number.isNaN(expiresAtMs))
+        return null;
+      if (!opts.offline && expiresAtMs <= Date.now())
+        return null;
+      return parsed.value;
+    } catch {
+      return null;
+    }
+  }
+  set(source, key, value, ttlMs = DEFAULT_TTL_MS) {
+    const path = this.pathFor(source, key);
+    mkdirSync(dirname(path), { recursive: true });
+    const now = /* @__PURE__ */ new Date();
+    const envelope = {
+      key,
+      source,
+      fetchedAt: now.toISOString(),
+      expiresAt: new Date(now.getTime() + ttlMs).toISOString(),
+      value
+    };
+    writeFileSync(path, `${JSON.stringify(envelope, null, 2)}
+`);
+  }
+  pathFor(source, key) {
+    const digest = createHash("sha256").update(key).digest("hex");
+    return join(this.cacheDir, source, `${digest}.json`);
+  }
+};
+async function cachedJson(cache, source, key, fetcher, opts = {}) {
+  const cached = cache.get(source, key, { offline: opts.offline });
+  if (cached)
+    return cached;
+  if (opts.offline) {
+    throw new Error(`offline cache miss for ${source}:${key}`);
+  }
+  const value = await fetcher();
+  cache.set(source, key, value, opts.ttlMs);
+  return value;
+}
+async function fetchJson(url, init = {}, opts = {}) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? 2e4);
+  try {
+    const res = await (opts.fetchImpl ?? fetch)(url, {
+      ...init,
+      signal: controller.signal
+    });
+    if (!res.ok) {
+      throw new Error(`HTTP ${res.status} for ${url}`);
+    }
+    return await res.json();
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// packages/core/dist/intel/normalize.js
+function normalizeSeverity(value) {
+  const normalized = String(value ?? "").trim().toLowerCase();
+  if (normalized === "critical")
+    return "critical";
+  if (normalized === "high")
+    return "high";
+  if (normalized === "moderate" || normalized === "medium")
+    return "medium";
+  if (normalized === "low")
+    return "low";
+  return "info";
+}
+function uniqueStrings(values) {
+  return [...new Set(values.filter((v) => typeof v === "string" && v.trim().length > 0).map((v) => v.trim()))];
+}
+function uniqueReferences(refs) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const ref of refs) {
+    if (!ref.url || seen.has(ref.url))
+      continue;
+    seen.add(ref.url);
+    out.push(ref);
+  }
+  return out;
+}
+function primaryId(ids, fallback) {
+  const cve = ids.find((id) => /^CVE-\d{4}-\d{4,}$/i.test(id));
+  if (cve)
+    return cve.toUpperCase();
+  const ghsa = ids.find((id) => /^GHSA-/i.test(id));
+  if (ghsa)
+    return ghsa.toUpperCase();
+  const osv = ids.find(Boolean);
+  return osv ?? fallback;
+}
+function normalizeCveId(cveId) {
+  const normalized = cveId.trim().toUpperCase();
+  if (!/^CVE-\d{4}-\d{4,}$/.test(normalized)) {
+    throw new Error(`invalid CVE id: ${cveId}`);
+  }
+  return normalized;
+}
+function parseCvssVectorSeverity(vector) {
+  if (!vector)
+    return void 0;
+  if (vector.trim().toUpperCase().startsWith("CVSS:"))
+    return void 0;
+  return normalizeSeverity(vector);
+}
+function mergeIntel(intels) {
+  const byKey = /* @__PURE__ */ new Map();
+  for (const intel of intels) {
+    const allIds = uniqueStrings([intel.id, ...intel.aliases]).map((id) => id.toUpperCase());
+    const existingKey = allIds.find((id) => byKey.has(id));
+    if (!existingKey) {
+      const copy = {
+        ...intel,
+        aliases: uniqueStrings([intel.id, ...intel.aliases]).map((id) => id.toUpperCase()),
+        sources: uniqueStrings(intel.sources),
+        references: uniqueReferences(intel.references),
+        cwes: uniqueStrings(intel.cwes).map((cwe) => cwe.toUpperCase()),
+        affectedRanges: uniqueStrings(intel.affectedRanges),
+        fixedVersions: uniqueStrings(intel.fixedVersions)
+      };
+      for (const id of allIds)
+        byKey.set(id, copy);
+      continue;
+    }
+    const existing = byKey.get(existingKey);
+    const merged = {
+      ...existing,
+      summary: existing.summary ?? intel.summary,
+      details: existing.details ?? intel.details,
+      package: existing.package ?? intel.package,
+      aliases: uniqueStrings([existing.id, ...existing.aliases, intel.id, ...intel.aliases]).map((id) => id.toUpperCase()),
+      sources: uniqueStrings([...existing.sources, ...intel.sources]),
+      affectedRanges: uniqueStrings([...existing.affectedRanges, ...intel.affectedRanges]),
+      fixedVersions: uniqueStrings([...existing.fixedVersions, ...intel.fixedVersions]),
+      severity: higherSeverity(existing.severity, intel.severity),
+      cvss: existing.cvss?.score && (!intel.cvss?.score || existing.cvss.score >= intel.cvss.score) ? existing.cvss : intel.cvss ?? existing.cvss,
+      cwes: uniqueStrings([...existing.cwes, ...intel.cwes]).map((cwe) => cwe.toUpperCase()),
+      references: uniqueReferences([...existing.references, ...intel.references]),
+      kev: existing.kev ?? intel.kev,
+      publishedAt: existing.publishedAt ?? intel.publishedAt,
+      modifiedAt: existing.modifiedAt ?? intel.modifiedAt,
+      fetchedAt: existing.fetchedAt > intel.fetchedAt ? existing.fetchedAt : intel.fetchedAt
+    };
+    for (const id of merged.aliases)
+      byKey.set(id, merged);
+    byKey.set(merged.id.toUpperCase(), merged);
+  }
+  return [...new Set(byKey.values())];
+}
+function severityRank(severity) {
+  return { info: 1, low: 2, medium: 3, high: 4, critical: 5 }[severity];
+}
+function higherSeverity(a, b) {
+  return severityRank(a) >= severityRank(b) ? a : b;
+}
+function toGraphSnapshot(intels) {
+  const nodes = /* @__PURE__ */ new Map();
+  const edges = [];
+  const addNode = (node) => {
+    if (!nodes.has(node.id))
+      nodes.set(node.id, node);
+  };
+  const addEdge = (edge) => {
+    edges.push(edge);
+  };
+  for (const intel of intels) {
+    const advisoryId = `advisory:${intel.id}`;
+    addNode({
+      id: advisoryId,
+      kind: "advisory",
+      key: intel.id,
+      title: intel.summary ?? intel.id,
+      data: {
+        severity: intel.severity,
+        sources: intel.sources,
+        publishedAt: intel.publishedAt,
+        modifiedAt: intel.modifiedAt
+      }
+    });
+    for (const alias of intel.aliases) {
+      if (alias === intel.id)
+        continue;
+      const aliasId = `advisory:${alias}`;
+      addNode({ id: aliasId, kind: "advisory", key: alias });
+      addEdge({ from: advisoryId, to: aliasId, kind: "HAS_ALIAS" });
+    }
+    if (intel.package) {
+      const pkgId = `package:${intel.package.ecosystem}:${intel.package.name}`;
+      addNode({
+        id: pkgId,
+        kind: "package",
+        key: `${intel.package.ecosystem}:${intel.package.name}`,
+        title: intel.package.name
+      });
+      addEdge({ from: advisoryId, to: pkgId, kind: "AFFECTS_PACKAGE" });
+    }
+    for (const fixed of intel.fixedVersions) {
+      const versionId = `version:${intel.package?.ecosystem ?? "unknown"}:${intel.package?.name ?? "unknown"}:${fixed}`;
+      addNode({ id: versionId, kind: "version", key: fixed });
+      addEdge({ from: advisoryId, to: versionId, kind: "FIXED_IN" });
+    }
+    for (const cwe of intel.cwes) {
+      const cweId = `cwe:${cwe}`;
+      addNode({ id: cweId, kind: "cwe", key: cwe });
+      addEdge({ from: advisoryId, to: cweId, kind: "MAPS_TO_CWE" });
+    }
+    for (const ref of intel.references) {
+      const refId = `reference:${ref.url}`;
+      addNode({ id: refId, kind: "reference", key: ref.url, title: ref.kind });
+      addEdge({ from: advisoryId, to: refId, kind: "REFERENCES", data: { kind: ref.kind, source: ref.source } });
+    }
+    if (intel.kev?.knownExploited) {
+      const kevId = `kev:${intel.id}`;
+      addNode({ id: kevId, kind: "kev", key: intel.id, title: intel.kev.vulnerabilityName });
+      addEdge({ from: advisoryId, to: kevId, kind: "KNOWN_EXPLOITED" });
+    }
+  }
+  return { nodes: [...nodes.values()], edges };
+}
+
+// packages/core/dist/intel/cisa-kev.js
+var DEFAULT_KEV_URL = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json";
+async function lookupKev(input, opts = {}) {
+  const cveId = normalizeCveId(input.cveId);
+  const catalog = await fetchKevCatalog(input, opts);
+  const entry = (catalog.vulnerabilities ?? []).find((item) => item.cveID?.toUpperCase() === cveId);
+  if (!entry)
+    return null;
+  return {
+    knownExploited: true,
+    dateAdded: entry.dateAdded,
+    dueDate: entry.dueDate,
+    requiredAction: entry.requiredAction,
+    ransomwareUse: entry.knownRansomwareCampaignUse,
+    vulnerabilityName: entry.vulnerabilityName
+  };
+}
+async function fetchKevCatalog(input, opts) {
+  const cache = new IntelCache(input.cacheDir);
+  const url = process.env["0SEC_CISA_KEV_URL"] ?? DEFAULT_KEV_URL;
+  return await cachedJson(cache, "cisa-kev", url, async () => await fetchJson(url, { headers: { "User-Agent": "0sec-intel/0.1" } }, opts), { offline: input.offline, ttlMs: input.ttlMs });
+}
+
+// packages/core/dist/intel/github.js
+import { execFileSync } from "node:child_process";
+async function queryGitHubAdvisories(input, opts = {}) {
+  const cache = new IntelCache(input.cacheDir);
+  const key = JSON.stringify({
+    ecosystem: input.ecosystem,
+    packageName: input.packageName
+  });
+  const raw = await cachedJson(cache, "github-advisories", key, async () => {
+    const query = new URLSearchParams({
+      ecosystem: githubEcosystem(input.ecosystem),
+      affects: input.packageName,
+      per_page: "100"
+    });
+    return await fetchGitHubAdvisoryPages(`https://api.github.com/advisories?${query}`, opts);
+  }, { offline: input.offline, ttlMs: input.ttlMs });
+  return parseGitHubAdvisories(raw);
+}
+async function lookupGitHubAdvisory(input, opts = {}) {
+  const ghsaId = normalizeGhsaId(input.ghsaId);
+  const cache = new IntelCache(input.cacheDir);
+  const raw = await cachedJson(cache, "github-advisory", ghsaId, async () => await fetchGitHubAdvisory(`https://api.github.com/advisories/${ghsaId}`, opts), { offline: input.offline, ttlMs: input.ttlMs });
+  if (!raw)
+    return null;
+  return parseGitHubAdvisories([raw])[0] ?? null;
+}
+function normalizeGhsaId(ghsaId) {
+  const normalized = ghsaId.trim().toUpperCase();
+  if (!/^GHSA(-[0-9A-Z]{4}){3}$/.test(normalized)) {
+    throw new Error(`invalid GHSA id: ${ghsaId}`);
+  }
+  return normalized;
+}
+async function fetchGitHubAdvisory(url, opts) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? 2e4);
+  try {
+    const res = await (opts.fetchImpl ?? fetch)(url, {
+      headers: githubHeaders(opts.headers),
+      signal: controller.signal
+    });
+    if (res.status === 404)
+      return null;
+    if (!res.ok)
+      throw new Error(`HTTP ${res.status} for ${url}`);
+    return await res.json();
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function fetchGitHubAdvisoryPages(url, opts) {
+  const out = [];
+  let nextUrl = url;
+  while (nextUrl) {
+    const { data, next } = await fetchGitHubAdvisoryPage(nextUrl, opts);
+    out.push(...data);
+    nextUrl = next;
+  }
+  return out;
+}
+async function fetchGitHubAdvisoryPage(url, opts) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? 2e4);
+  try {
+    const res = await (opts.fetchImpl ?? fetch)(url, {
+      headers: githubHeaders(opts.headers),
+      signal: controller.signal
+    });
+    if (!res.ok)
+      throw new Error(`HTTP ${res.status} for ${url}`);
+    return {
+      data: await res.json(),
+      next: parseNextLink(res.headers.get("link"))
+    };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function parseNextLink(link) {
+  if (!link)
+    return void 0;
+  for (const part of link.split(",")) {
+    const match = part.match(/<([^>]+)>;\s*rel="next"/i);
+    if (match?.[1])
+      return match[1];
+  }
+  return void 0;
+}
+function parseGitHubAdvisories(raw) {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  return raw.flatMap((advisory) => {
+    const ids = uniqueStrings([
+      advisory.ghsa_id,
+      advisory.cve_id ?? void 0,
+      ...(advisory.identifiers ?? []).map((id2) => id2.value)
+    ]).map((id2) => id2.toUpperCase());
+    const id = advisory.cve_id?.toUpperCase() ?? advisory.ghsa_id?.toUpperCase();
+    if (!id)
+      return [];
+    const vuln = advisory.vulnerabilities?.[0];
+    return [{
+      id,
+      aliases: ids.length > 0 ? ids : [id],
+      source: "github",
+      sources: ["github"],
+      summary: advisory.summary,
+      details: advisory.description,
+      package: vuln?.package?.name ? {
+        ecosystem: vuln.package.ecosystem ?? "",
+        name: vuln.package.name
+      } : void 0,
+      affectedRanges: uniqueStrings((advisory.vulnerabilities ?? []).map((v) => v.vulnerable_version_range)),
+      fixedVersions: uniqueStrings((advisory.vulnerabilities ?? []).map((v) => v.first_patched_version?.identifier)),
+      severity: normalizeSeverity(advisory.severity),
+      cvss: advisory.cvss ? { score: advisory.cvss.score, vector: advisory.cvss.vector_string, version: "3.x" } : void 0,
+      cwes: uniqueStrings((advisory.cwes ?? []).map((cwe) => cwe.cwe_id)).map((cwe) => cwe.toUpperCase()),
+      references: uniqueReferences([
+        ...advisory.html_url ? [{ url: advisory.html_url, kind: "advisory", source: "github" }] : [],
+        ...(advisory.references ?? []).map((url) => ({ url, kind: "reference", source: "github" }))
+      ]),
+      publishedAt: advisory.published_at,
+      modifiedAt: advisory.updated_at,
+      fetchedAt: now
+    }];
+  });
+}
+function githubEcosystem(ecosystem) {
+  const normalized = ecosystem.trim().toLowerCase();
+  if (normalized === "pypi" || normalized === "python")
+    return "pip";
+  if (normalized === "cargo" || normalized === "crates.io" || normalized === "rust")
+    return "rust";
+  return normalized;
+}
+function githubHeaders(extra) {
+  const headers = {
+    Accept: "application/vnd.github+json",
+    "X-GitHub-Api-Version": "2022-11-28",
+    "User-Agent": "0sec-intel/0.1",
+    ...extra ?? {}
+  };
+  const token = resolveGitHubToken();
+  if (token)
+    headers.Authorization = `Bearer ${token}`;
+  return headers;
+}
+var cachedGitHubToken;
+function resolveGitHubToken() {
+  const envToken = process.env.GITHUB_TOKEN ?? process.env.GH_TOKEN ?? process.env["0SEC_GITHUB_TOKEN"];
+  if (envToken && envToken.trim())
+    return envToken.trim();
+  if (cachedGitHubToken !== void 0)
+    return cachedGitHubToken || void 0;
+  cachedGitHubToken = readGhCliToken() ?? false;
+  return cachedGitHubToken || void 0;
+}
+function readGhCliToken() {
+  try {
+    const out = execFileSync("gh", ["auth", "token"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 5e3
+    }).trim();
+    return out || void 0;
+  } catch {
+    return void 0;
+  }
+}
+
+// packages/core/dist/intel/audit-graph.js
+function buildPriorVulnerabilityAuditGraph(playbooks) {
+  const nodes = /* @__PURE__ */ new Map();
+  const edges = /* @__PURE__ */ new Map();
+  const entrypointNodeIds = [];
+  const addNode = (node) => {
+    if (!nodes.has(node.id))
+      nodes.set(node.id, node);
+  };
+  const addEdge = (edge) => {
+    edges.set(`${edge.from}\0${edge.kind}\0${edge.to}`, edge);
+  };
+  for (const playbook of playbooks) {
+    const playbookId = stableNodeId("bug-class", playbook.id);
+    entrypointNodeIds.push(playbookId);
+    addNode({
+      id: playbookId,
+      kind: "bug_class",
+      key: playbook.id,
+      title: playbook.bugClass,
+      data: {
+        cwes: playbook.cwes,
+        relevance: playbook.relevance
+      }
+    });
+    for (const priorId of playbook.priorVulnerabilityIds) {
+      const priorNodeId = stableNodeId("prior", priorId);
+      addNode({
+        id: priorNodeId,
+        kind: "prior_vulnerability",
+        key: priorId,
+        title: priorId
+      });
+      addEdge({ from: priorNodeId, to: playbookId, kind: "INFORMS" });
+    }
+    let previousStepId;
+    for (const [index, step] of playbook.steps.entries()) {
+      const stepNodeId = stableNodeId(playbookId, "step", step.id);
+      addNode({
+        id: stepNodeId,
+        kind: "investigation_step",
+        key: step.id,
+        title: step.title,
+        data: {
+          order: index + 1,
+          rationale: step.rationale,
+          actions: step.actions
+        }
+      });
+      addEdge({ from: playbookId, to: stepNodeId, kind: "HAS_STEP", data: { order: index + 1 } });
+      if (previousStepId) {
+        addEdge({ from: previousStepId, to: stepNodeId, kind: "NEXT_STEP" });
+      }
+      previousStepId = stepNodeId;
+      for (const [evidenceIndex, expectedEvidence] of step.expectedEvidence.entries()) {
+        const evidenceNodeId = stableNodeId(stepNodeId, "evidence", String(evidenceIndex + 1), expectedEvidence);
+        addNode({
+          id: evidenceNodeId,
+          kind: "evidence_query",
+          key: expectedEvidence,
+          title: expectedEvidence,
+          data: { order: evidenceIndex + 1 }
+        });
+        addEdge({
+          from: stepNodeId,
+          to: evidenceNodeId,
+          kind: "SEEKS_EVIDENCE",
+          data: { order: evidenceIndex + 1 }
+        });
+      }
+    }
+  }
+  return {
+    entrypointNodeIds,
+    nodes: [...nodes.values()],
+    edges: [...edges.values()]
+  };
+}
+function stableNodeId(...parts) {
+  return parts.map((part) => part.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "node").join(":");
+}
+
+// packages/core/dist/intel/target-history.js
+import { readFileSync as readFileSync2, realpathSync } from "node:fs";
+import { join as join2, sep } from "node:path";
+
+// packages/core/dist/intel/dossier.js
+async function buildIntelDossierFromSearch(input, searchAdvisoriesFn, searchSimilarFn, opts = {}) {
+  const advisoryResult = await searchAdvisoriesFn(input, opts);
+  const advisories = advisoryResult.advisories;
+  const cwes = uniqueStrings(advisories.flatMap((advisory) => advisory.cwes));
+  const similarTerms = dossierSearchTerms(input, advisories, cwes);
+  const similarResult = input.includeSimilar === false || cwes.length === 0 && similarTerms.length === 0 ? { advisories: [], graph: { nodes: [], edges: [] } } : await searchSimilarFn({
+    cwe: cwes[0],
+    ecosystem: input.ecosystem,
+    keywords: similarTerms,
+    limit: input.similarLimit ?? 10,
+    cacheDir: input.cacheDir,
+    offline: input.offline,
+    ttlMs: input.ttlMs
+  }, opts);
+  const variantLeads = toVariantLeads(advisories, similarResult.advisories);
+  const playbooks = buildPriorVulnerabilityPlaybooks(advisories, variantLeads);
+  const auditGraph = buildPriorVulnerabilityAuditGraph(playbooks);
+  const graph = mergeGraphs(advisoryResult.graph, similarResult.graph);
+  const sources = uniqueStrings([
+    ...advisories.flatMap((advisory) => advisory.sources),
+    ...similarResult.advisories.flatMap((advisory) => advisory.sources)
+  ]);
+  return {
+    package: {
+      ecosystem: input.ecosystem,
+      name: input.packageName
+    },
+    version: input.version,
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    summary: summarizeDossier(advisories, variantLeads, playbooks),
+    advisories,
+    variantLeads,
+    playbooks,
+    auditGraph,
+    graph,
+    provenance: {
+      sources,
+      offline: input.offline || void 0
+    }
+  };
+}
+function buildPriorVulnerabilityPlaybooks(advisories, variantLeads) {
+  const byClass = /* @__PURE__ */ new Map();
+  for (const item of [...advisories, ...variantLeads]) {
+    const bugClass = classifyBugClass(item.cwes, item.summary);
+    const entry = byClass.get(bugClass.id) ?? { cwes: /* @__PURE__ */ new Set(), ids: /* @__PURE__ */ new Set(), summaries: [] };
+    for (const cwe of item.cwes)
+      entry.cwes.add(cwe);
+    entry.ids.add(item.id);
+    for (const alias of item.aliases)
+      entry.ids.add(alias);
+    if (item.summary)
+      entry.summaries.push(item.summary);
+    byClass.set(bugClass.id, entry);
+  }
+  return [...byClass.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([id, entry]) => {
+    const bugClass = bugClassLabel(id);
+    const cwes = [...entry.cwes].sort((a, b) => a.localeCompare(b));
+    const priorVulnerabilityIds = [...entry.ids].filter((value) => /^(CVE-|GHSA-)/i.test(value)).sort((a, b) => a.localeCompare(b)).slice(0, 12);
+    return {
+      id: `playbook:${id}`,
+      bugClass,
+      cwes,
+      priorVulnerabilityIds,
+      relevance: playbookRelevance(bugClass, cwes, priorVulnerabilityIds),
+      steps: playbookSteps(id, bugClass, cwes)
+    };
+  }).filter((playbook) => playbook.priorVulnerabilityIds.length > 0).slice(0, 6);
+}
+function classifyBugClass(cwes, summary) {
+  const text = `${cwes.join(" ")} ${summary ?? ""}`.toLowerCase();
+  if (text.includes("cwe-22") || text.includes("path traversal") || text.includes("zip slip"))
+    return { id: "path-traversal" };
+  if (text.includes("cwe-434") || text.includes("file upload") || text.includes("unrestricted upload"))
+    return { id: "file-upload" };
+  if (text.includes("cwe-338") || text.includes("random") || text.includes("cryptographic"))
+    return { id: "weak-randomness" };
+  if (text.includes("cwe-78") || text.includes("command injection"))
+    return { id: "command-injection" };
+  if (text.includes("cwe-89") || text.includes("sql injection"))
+    return { id: "sql-injection" };
+  if (text.includes("cwe-79") || text.includes("xss") || text.includes("cross-site scripting"))
+    return { id: "xss" };
+  if (text.includes("cwe-918") || text.includes("ssrf") || text.includes("server-side request forgery") || text.includes("server side request forgery"))
+    return { id: "ssrf" };
+  if (text.includes("prototype pollution"))
+    return { id: "prototype-pollution" };
+  if (text.includes("deserialization"))
+    return { id: "deserialization" };
+  if (text.includes("auth bypass") || text.includes("authentication bypass") || text.includes("authorization bypass") || text.includes("access control bypass") || text.includes("broken access control") || text.includes("privilege escalation") && text.includes("bypass"))
+    return { id: "auth-bypass" };
+  return { id: cwes[0]?.toLowerCase() ?? "generic-vulnerability" };
+}
+function bugClassLabel(id) {
+  const labels = {
+    "path-traversal": "Path traversal / archive extraction escape",
+    "file-upload": "Unrestricted or unsafe file upload",
+    "weak-randomness": "Predictable randomness or identifier generation",
+    "command-injection": "Command injection",
+    "sql-injection": "SQL injection",
+    xss: "Cross-site scripting",
+    ssrf: "Server-side request forgery",
+    "prototype-pollution": "Prototype pollution",
+    deserialization: "Unsafe deserialization",
+    "auth-bypass": "Authentication or authorization bypass"
+  };
+  return labels[id] ?? id.toUpperCase();
+}
+function playbookRelevance(bugClass, cwes, ids) {
+  const cweText = cwes.length > 0 ? ` (${cwes.slice(0, 3).join(", ")})` : "";
+  return `${bugClass}${cweText} appears in prior advisories ${ids.slice(0, 4).join(", ")}; use the old bug shape to drive source/sink/guard verification before reporting.`;
+}
+function playbookSteps(id, bugClass, cwes) {
+  const cweHint = cwes.length > 0 ? `Relevant CWE context: ${cwes.join(", ")}.` : `Relevant bug class: ${bugClass}.`;
+  const common = [
+    {
+      id: "map-entrypoints",
+      title: "Map reachable entry points",
+      rationale: `Prior vulnerabilities only matter if the same bug shape is reachable. ${cweHint}`,
+      actions: [
+        "Find exported APIs, HTTP handlers, CLI commands, parser hooks, and framework integrations that accept attacker-controlled input.",
+        "Record the concrete input object, parameter, file, URL, archive entry, or request field that enters the code."
+      ],
+      expectedEvidence: [
+        "File/function references for attacker-controlled sources.",
+        "A short source-to-parser call chain."
+      ]
+    },
+    {
+      id: "trace-sinks",
+      title: "Trace into dangerous sinks",
+      rationale: "A prior CVE shape becomes actionable when user-controlled data reaches a sink with insufficient transformation.",
+      actions: [
+        "Follow the input through normalization, decoding, validation, and wrapper helpers.",
+        "Identify filesystem, process, template, database, network, deserialization, or object-merge sinks."
+      ],
+      expectedEvidence: [
+        "Source-to-sink path with function names.",
+        "Sink arguments showing which values remain attacker-influenced."
+      ]
+    }
+  ];
+  return [...common, ...classSpecificSteps(id), {
+    id: "prove-or-retire",
+    title: "Prove impact or retire the lead",
+    rationale: "Intel leads are not findings until local behavior proves reachability and impact.",
+    actions: [
+      "Write the smallest local harness or command that exercises the source-to-sink path.",
+      "Test the old payload shape and at least one bypass mutation against current guards.",
+      "If guards hold, record why the prior vulnerability does not apply."
+    ],
+    expectedEvidence: [
+      "Passing exploit/negative test output, or a concise non-applicability note.",
+      "Version/commit context tying the conclusion to the scanned target."
+    ]
+  }];
+}
+function classSpecificSteps(id) {
+  const steps = {
+    "path-traversal": [{
+      id: "exercise-path-bypasses",
+      title: "Exercise traversal and archive-entry bypasses",
+      rationale: "Historical traversal bugs often hide in decode order, separator handling, and archive entry normalization.",
+      actions: [
+        "Check whether paths are decoded before or after validation.",
+        "Try absolute paths, dot-dot segments, mixed separators, symlinks, unicode separators, and nested archive entries.",
+        "Verify final resolved paths remain inside the intended base directory."
+      ],
+      expectedEvidence: [
+        "Resolved-path comparison at the final write/read sink.",
+        "Positive or negative payload matrix for traversal mutations."
+      ]
+    }],
+    "file-upload": [{
+      id: "audit-upload-controls",
+      title: "Audit upload naming, type, and execution controls",
+      rationale: "Prior upload CVEs usually depend on extension handling, filename trust, storage location, or executable delivery.",
+      actions: [
+        "Trace uploaded filename, generated name, extension, MIME sniffing, and destination directory.",
+        "Check whether attacker input can influence executable extensions, overwrite paths, or public serving paths.",
+        "Test double extensions, null bytes where relevant, path separators, content-type mismatch, and archive/polyglot files."
+      ],
+      expectedEvidence: [
+        "Filename/type validation logic with sink arguments.",
+        "Upload harness output showing accepted/rejected payloads."
+      ]
+    }],
+    "weak-randomness": [{
+      id: "measure-identifier-predictability",
+      title: "Measure identifier entropy and guessability",
+      rationale: "Prior randomness bugs become exploitable when generated IDs protect access to attacker-reachable objects.",
+      actions: [
+        "Locate ID/token generation and the security decision that relies on secrecy.",
+        "Estimate entropy from alphabet, length, seed source, truncation, and collision behavior.",
+        "Check whether partial disclosure or predictable prefixes reduce the search space."
+      ],
+      expectedEvidence: [
+        "Generator code and entropy estimate.",
+        "Object access path showing whether guessing has security impact."
+      ]
+    }],
+    "command-injection": [{
+      id: "separate-argv-from-shell",
+      title: "Separate argv-safe execution from shell execution",
+      rationale: "Command-injection variants hinge on whether attacker data enters a shell-parsed string.",
+      actions: [
+        "Find process execution calls and determine whether they use shell strings or argv arrays.",
+        "Trace quoting, escaping, allowlists, and environment-variable influence.",
+        "Test metacharacters, argument injection, option smuggling, and newline payloads."
+      ],
+      expectedEvidence: [
+        "Exact command construction site.",
+        "Harness showing payload behavior at the process boundary."
+      ]
+    }]
+  };
+  return steps[id] ?? [{
+    id: "derive-bug-shape",
+    title: "Derive the historical bug shape locally",
+    rationale: "No specialized deterministic playbook exists yet, so preserve the prior advisory shape and verify it against local code.",
+    actions: [
+      "Extract source, transformation, sink, guard, and impact from the prior advisory summaries and references.",
+      "Map each element to equivalent local code paths.",
+      "Create a small proof or negative test for the most similar path."
+    ],
+    expectedEvidence: [
+      "Prior-to-local mapping table.",
+      "Proof or non-applicability result."
+    ]
+  }];
+}
+function summarizeDossier(advisories, variantLeads, playbooks) {
+  const criticalCount = advisories.filter((advisory) => advisory.severity === "critical").length;
+  const highCount = advisories.filter((advisory) => advisory.severity === "high").length;
+  const kevCount = advisories.filter((advisory) => advisory.kev?.knownExploited).length;
+  const cwes = uniqueStrings(advisories.flatMap((advisory) => advisory.cwes));
+  const topSeverity = highestSeverity(advisories.map((advisory) => advisory.severity));
+  const riskScore = computeRiskScore(advisories, variantLeads.length);
+  return {
+    advisoryCount: advisories.length,
+    variantLeadCount: variantLeads.length,
+    playbookCount: playbooks.length,
+    criticalCount,
+    highCount,
+    kevCount,
+    cweCount: cwes.length,
+    topSeverity,
+    riskScore,
+    riskLevel: riskLevel(riskScore),
+    recommendedFocus: recommendedFocus(advisories, variantLeads)
+  };
+}
+function computeRiskScore(advisories, variantLeadCount) {
+  const severityScore = advisories.reduce((score, advisory) => score + severityPoints(advisory.severity), 0);
+  const kevScore = advisories.filter((advisory) => advisory.kev?.knownExploited).length * 45;
+  const cvssScore = Math.max(0, ...advisories.map((advisory) => advisory.cvss?.score ?? 0));
+  return Math.min(100, Math.round(severityScore + kevScore + cvssScore + Math.min(variantLeadCount, 5) * 2));
+}
+function severityPoints(severity) {
+  if (severity === "critical")
+    return 35;
+  if (severity === "high")
+    return 25;
+  if (severity === "medium")
+    return 12;
+  if (severity === "low")
+    return 4;
+  return 0;
+}
+function highestSeverity(severities) {
+  const order = ["critical", "high", "medium", "low", "info"];
+  return order.find((severity) => severities.includes(severity)) ?? "info";
+}
+function riskLevel(score) {
+  if (score <= 0)
+    return "none";
+  if (score >= 80)
+    return "critical";
+  if (score >= 55)
+    return "high";
+  if (score >= 25)
+    return "medium";
+  return "low";
+}
+function recommendedFocus(advisories, variantLeads) {
+  const focus = /* @__PURE__ */ new Set();
+  if (advisories.some((advisory) => advisory.kev?.knownExploited))
+    focus.add("known exploited CVEs");
+  for (const cwe of uniqueStrings(advisories.flatMap((advisory) => advisory.cwes)).slice(0, 4))
+    focus.add(cwe);
+  for (const advisory of advisories.filter((item) => item.severity === "critical" || item.severity === "high").slice(0, 3)) {
+    focus.add(advisory.id);
+  }
+  if (variantLeads.length > 0)
+    focus.add("variant-hunt similar advisories");
+  return [...focus];
+}
+function dossierSearchTerms(input, advisories, cwes) {
+  const summaryTerms = advisories.flatMap((advisory) => extractSecurityTerms(advisory.summary ?? advisory.details ?? ""));
+  return uniqueStrings([
+    ...input.keywords ?? [],
+    ...cwes,
+    ...summaryTerms
+  ]).slice(0, 8);
+}
+function extractSecurityTerms(text) {
+  const lower = text.toLowerCase();
+  const terms = [];
+  for (const term of [
+    "path traversal",
+    "zip slip",
+    "prototype pollution",
+    "command injection",
+    "sql injection",
+    "cross-site scripting",
+    "xss",
+    "ssrf",
+    "deserialization",
+    "auth bypass"
+  ]) {
+    if (lower.includes(term))
+      terms.push(term);
+  }
+  return terms;
+}
+function toVariantLeads(advisories, similar) {
+  const knownIds = new Set(advisories.flatMap((advisory) => [advisory.id, ...advisory.aliases]).map((id) => id.toUpperCase()));
+  return mergeIntel(similar).filter((lead) => ![lead.id, ...lead.aliases].some((id) => knownIds.has(id.toUpperCase()))).slice(0, 10).map((lead) => ({
+    id: lead.id,
+    aliases: lead.aliases,
+    severity: lead.severity,
+    cwes: lead.cwes,
+    summary: lead.summary,
+    reason: lead.cwes.length > 0 ? `Shares ${lead.cwes.slice(0, 3).join(", ")} with package advisory context.` : "Matched dossier variant-hunt keywords.",
+    references: lead.references.slice(0, 3)
+  }));
+}
+function mergeGraphs(left, right) {
+  const nodes = new Map(left.nodes.map((node) => [node.id, node]));
+  const edges = new Map(left.edges.map((edge) => [`${edge.from}\0${edge.kind}\0${edge.to}`, edge]));
+  for (const node of right.nodes)
+    nodes.set(node.id, node);
+  for (const edge of right.edges)
+    edges.set(`${edge.from}\0${edge.kind}\0${edge.to}`, edge);
+  return {
+    nodes: [...nodes.values()],
+    edges: [...edges.values()]
+  };
+}
+
+// packages/core/dist/intel/target-history.js
+var MIN_LOOSE_HINT_LENGTH = 4;
+var MIN_STRONG_HINT_LENGTH = 3;
+var CONFIDENCE_RANK = { high: 3, medium: 2, low: 1 };
+function buildTargetHistoryResult(input, advisories) {
+  const hints = targetHistoryHints(input);
+  const matcher = buildTargetMatcher(input);
+  const filtered = mergeIntel(advisories).flatMap((advisory) => {
+    const confidence = scoreTargetMatch(advisory, matcher);
+    return confidence ? [{ ...advisory, matchConfidence: confidence }] : [];
+  }).sort((a, b) => CONFIDENCE_RANK[b.matchConfidence] - CONFIDENCE_RANK[a.matchConfidence]);
+  const playbooks = buildPriorVulnerabilityPlaybooks(filtered, []);
+  const auditGraph = buildPriorVulnerabilityAuditGraph(playbooks);
+  const graph = toGraphSnapshot(filtered);
+  return {
+    target: {
+      target: input.target,
+      repoPath: input.repoPath,
+      repository: normalizeRepositoryHint(input.repository ?? input.target),
+      ecosystem: input.ecosystem,
+      packageName: input.packageName,
+      product: input.product,
+      vendor: input.vendor,
+      keywords: input.keywords ?? []
+    },
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    summary: summarizeTargetHistory(filtered, playbooks.length, hints),
+    advisories: filtered,
+    playbooks,
+    auditGraph,
+    graph,
+    provenance: {
+      sources: uniqueStrings(filtered.flatMap((advisory) => advisory.sources)),
+      offline: input.offline || void 0
+    }
+  };
+}
+function resolveTargetHistoryInput(input) {
+  if (!input.repoPath)
+    return input;
+  const inferred = inferTargetHistoryInputFromRepo(input.repoPath).input;
+  return {
+    ...inferred,
+    ...input,
+    repository: input.repository ?? inferred.repository,
+    ecosystem: input.ecosystem ?? inferred.ecosystem,
+    packageName: input.packageName ?? inferred.packageName,
+    product: input.product ?? inferred.product,
+    vendor: input.vendor ?? inferred.vendor,
+    keywords: uniqueStrings([...inferred.keywords ?? [], ...input.keywords ?? []])
+  };
+}
+function inferTargetHistoryInputFromRepo(repoPath) {
+  const input = { repoPath };
+  const sources = [];
+  let canonicalRoot;
+  try {
+    canonicalRoot = realpathSync(repoPath);
+  } catch {
+    return { input, sources };
+  }
+  const packageJson = readJsonFile(join2(canonicalRoot, "package.json"), canonicalRoot);
+  if (packageJson) {
+    sources.push("package.json");
+    const name = typeof packageJson.name === "string" ? packageJson.name : void 0;
+    const repo2 = repositoryFromPackageJson(packageJson.repository);
+    input.ecosystem = "npm";
+    input.packageName = name;
+    input.product = unscopedPackageName(name);
+    input.repository = repo2;
+  }
+  const pyproject = readTextFile(join2(canonicalRoot, "pyproject.toml"), canonicalRoot);
+  if (pyproject) {
+    sources.push("pyproject.toml");
+    input.ecosystem ??= "pypi";
+    input.packageName ??= matchTomlString(pyproject, "name");
+    input.product ??= input.packageName;
+    input.repository ??= normalizeRepositoryHint(matchTomlUrl(pyproject, "repository") ?? matchTomlUrl(pyproject, "source") ?? matchTomlUrl(pyproject, "homepage"));
+  }
+  const cargo = readTextFile(join2(canonicalRoot, "Cargo.toml"), canonicalRoot);
+  if (cargo) {
+    sources.push("Cargo.toml");
+    input.ecosystem ??= "cargo";
+    input.packageName ??= matchTomlString(cargo, "name");
+    input.product ??= input.packageName;
+    input.repository ??= normalizeRepositoryHint(matchTomlString(cargo, "repository"));
+  }
+  const goMod = readTextFile(join2(canonicalRoot, "go.mod"), canonicalRoot);
+  if (goMod) {
+    sources.push("go.mod");
+    input.ecosystem ??= "Go";
+    const module = goMod.match(/^module\s+(\S+)/m)?.[1];
+    input.packageName ??= module;
+    input.product ??= module?.split("/").filter(Boolean).at(-1);
+    input.repository ??= normalizeRepositoryHint(module);
+  }
+  const gitConfig = readTextFile(join2(canonicalRoot, ".git", "config"), canonicalRoot);
+  if (gitConfig) {
+    sources.push(".git/config");
+    input.repository ??= normalizeRepositoryHint(matchGitRemoteUrl(gitConfig));
+  }
+  const repo = normalizeRepositoryHint(input.repository);
+  const repoName = repo?.split("/")[1];
+  input.repository = repo ?? input.repository;
+  input.vendor ??= repo?.split("/")[0];
+  input.keywords = uniqueStrings([
+    input.product,
+    input.packageName,
+    repoName
+  ].filter((value) => value && value !== input.product));
+  return { input, sources };
+}
+function targetHistoryHints(input) {
+  const { repository, repoName, strongTokens, looseTokens } = buildTargetMatcher(input);
+  return uniqueStrings([
+    repository,
+    repoName,
+    ...strongTokens,
+    ...looseTokens
+  ]);
+}
+function buildTargetMatcher(input) {
+  const repository = normalizeRepositoryHint(input.repository ?? input.target)?.toLowerCase();
+  const repoName = repository?.split("/")[1];
+  const packageName = input.packageName?.toLowerCase();
+  const unscoped = unscopedPackageName(packageName);
+  const product = input.product?.toLowerCase();
+  const strongTokens = uniqueStrings([repoName, product, unscoped].map((t) => t ?? void 0)).filter((token) => token.length >= MIN_STRONG_HINT_LENGTH);
+  const vendorProduct = input.vendor && input.product ? `${input.vendor} ${input.product}`.toLowerCase() : void 0;
+  const looseTokens = uniqueStrings([vendorProduct, ...(input.keywords ?? []).map((k) => k.toLowerCase())]).filter((token) => token.length >= MIN_LOOSE_HINT_LENGTH);
+  const exactPackageNames = uniqueStrings([packageName, unscoped, product].map((t) => t ?? void 0));
+  return { repository, repoName, strongTokens, looseTokens, exactPackageNames };
+}
+function readJsonFile(path, root) {
+  const text = readTextFile(path, root);
+  if (!text)
+    return void 0;
+  try {
+    const parsed = JSON.parse(text);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function readTextFile(path, root) {
+  try {
+    const canonicalPath = realpathSync(path);
+    const prefix = root.endsWith(sep) ? root : root + sep;
+    if (canonicalPath !== root && !canonicalPath.startsWith(prefix))
+      return void 0;
+    return readFileSync2(canonicalPath, "utf-8");
+  } catch {
+    return void 0;
+  }
+}
+function repositoryFromPackageJson(value) {
+  if (typeof value === "string")
+    return normalizeRepositoryHint(value);
+  if (value && typeof value === "object" && "url" in value && typeof value.url === "string") {
+    return normalizeRepositoryHint(value.url);
+  }
+  return void 0;
+}
+function unscopedPackageName(name) {
+  if (!name)
+    return void 0;
+  return name.replace(/^@[^/]+\//, "");
+}
+function matchTomlString(text, key) {
+  return text.match(new RegExp(`^\\s*${escapeRegExp2(key)}\\s*=\\s*["']([^"']+)["']`, "m"))?.[1];
+}
+function matchTomlUrl(text, key) {
+  const direct = matchTomlString(text, key);
+  if (direct)
+    return direct;
+  return text.match(new RegExp(`^\\s*${escapeRegExp2(key)}\\s*=\\s*\\{[^}]*url\\s*=\\s*["']([^"']+)["']`, "m"))?.[1];
+}
+function matchGitRemoteUrl(text) {
+  const originBlock = text.match(/\[remote "origin"\]([\s\S]*?)(?:\n\[|$)/)?.[1];
+  return (originBlock ?? text).match(/^\s*url\s*=\s*(\S+)/m)?.[1];
+}
+function escapeRegExp2(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function normalizeRepositoryHint(value) {
+  if (!value)
+    return void 0;
+  const trimmed = value.trim().replace(/^git\+/, "");
+  if (!trimmed)
+    return void 0;
+  const plainMatch = trimmed.match(/^([^/\s:]+)\/([^/\s]+?)(?:\.git)?$/i);
+  if (plainMatch?.[1] && plainMatch[2] && !plainMatch[1].includes("."))
+    return `${plainMatch[1]}/${plainMatch[2]}`;
+  const sshMatch = trimmed.match(/^git@github\.com:([^/\s:]+)\/([^/\s]+?)(?:\.git)?$/i);
+  if (sshMatch?.[1] && sshMatch[2])
+    return `${sshMatch[1]}/${sshMatch[2]}`;
+  try {
+    const url = new URL(trimmed.startsWith("http") ? trimmed : `https://${trimmed}`);
+    if (!/github\.com$/i.test(url.hostname))
+      return void 0;
+    const [owner, repo] = url.pathname.split("/").filter(Boolean);
+    if (!owner || !repo)
+      return void 0;
+    return `${owner}/${repo.replace(/\.git$/i, "")}`;
+  } catch {
+    const match = trimmed.match(/(?:github\.com[:/])?([^/\s:]+)\/([^/\s]+?)(?:\.git)?$/i);
+    return match?.[1] && match[2] ? `${match[1]}/${match[2]}` : void 0;
+  }
+}
+function scoreTargetMatch(advisory, matcher) {
+  const hasCriteria = Boolean(matcher.repository) || matcher.strongTokens.length > 0 || matcher.looseTokens.length > 0 || matcher.exactPackageNames.length > 0;
+  if (!hasCriteria)
+    return null;
+  if (matcher.repository && advisory.references.some((ref) => referenceMatchesRepo(ref.url, matcher.repository))) {
+    return "high";
+  }
+  const advisoryPackage = advisory.package?.name?.toLowerCase();
+  if (advisoryPackage && matcher.exactPackageNames.includes(advisoryPackage)) {
+    return "high";
+  }
+  const haystack = [
+    advisory.summary,
+    advisory.details,
+    advisory.package?.name
+  ].filter((value) => Boolean(value)).join("\n").toLowerCase();
+  if (matcher.strongTokens.some((token) => tokenMatch(haystack, token)))
+    return "medium";
+  if (matcher.looseTokens.some((token) => tokenMatch(haystack, token)))
+    return "low";
+  return null;
+}
+function referenceMatchesRepo(url, repository) {
+  try {
+    const parsed = new URL(url);
+    if (!/github\.com$/i.test(parsed.hostname))
+      return false;
+    const [owner, repo] = parsed.pathname.split("/").filter(Boolean);
+    if (!owner || !repo)
+      return false;
+    return `${owner}/${repo.replace(/\.git$/i, "")}`.toLowerCase() === repository;
+  } catch {
+    return false;
+  }
+}
+function tokenMatch(haystack, needle) {
+  const trimmed = needle.trim().toLowerCase();
+  if (!trimmed)
+    return false;
+  const escaped = trimmed.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(`(^|[^a-z0-9])${escaped}(?=[^a-z0-9]|$)`, "i").test(haystack);
+}
+function summarizeTargetHistory(advisories, playbookCount, hints) {
+  const criticalCount = advisories.filter((advisory) => advisory.severity === "critical").length;
+  const highCount = advisories.filter((advisory) => advisory.severity === "high").length;
+  const kevCount = advisories.filter((advisory) => advisory.kev?.knownExploited).length;
+  const cwes = uniqueStrings(advisories.flatMap((advisory) => advisory.cwes));
+  const confidenceCounts = {
+    high: advisories.filter((advisory) => advisory.matchConfidence === "high").length,
+    medium: advisories.filter((advisory) => advisory.matchConfidence === "medium").length,
+    low: advisories.filter((advisory) => advisory.matchConfidence === "low").length
+  };
+  return {
+    advisoryCount: advisories.length,
+    playbookCount,
+    criticalCount,
+    highCount,
+    kevCount,
+    cweCount: cwes.length,
+    topSeverity: highestSeverity2(advisories.map((advisory) => advisory.severity)),
+    matchedHints: hints.slice(0, 10),
+    confidenceCounts
+  };
+}
+function highestSeverity2(severities) {
+  const order = ["critical", "high", "medium", "low", "info"];
+  return order.find((severity) => severities.includes(severity)) ?? "info";
+}
+
+// packages/core/dist/intel/github-issues.js
+var GITHUB_SEARCH_URL = "https://api.github.com/search/issues";
+var DEFAULT_LIMIT = 15;
+var MAX_LIMIT = 30;
+var SNIPPET_LENGTH = 280;
+function buildPublicReportQuery(input) {
+  const parts = [];
+  const repo = normalizeRepositoryHint(input.repository) ?? input.repository?.trim();
+  if (repo)
+    parts.push(`repo:${repo}`);
+  if (input.type === "issue")
+    parts.push("is:issue");
+  else if (input.type === "pr")
+    parts.push("is:pr");
+  const terms = input.terms?.trim();
+  if (terms)
+    parts.push(terms);
+  return parts.join(" ").trim();
+}
+async function searchGitHubIssues(input, opts = {}) {
+  const q = buildPublicReportQuery(input);
+  if (!q) {
+    throw new Error("search_public_reports requires repository and/or terms");
+  }
+  const limit = Math.min(Math.max(Math.trunc(input.limit ?? DEFAULT_LIMIT), 1), MAX_LIMIT);
+  const cache = new IntelCache(input.cacheDir);
+  const key = JSON.stringify({ q, limit });
+  const raw = await cachedJson(cache, "github-issues", key, async () => {
+    const query = new URLSearchParams({
+      q,
+      per_page: String(limit),
+      sort: "updated",
+      order: "desc"
+    });
+    return await fetchGitHubIssueSearch(`${GITHUB_SEARCH_URL}?${query}`, opts);
+  }, { offline: input.offline, ttlMs: input.ttlMs });
+  const reports = (raw.items ?? []).slice(0, limit).flatMap(parseIssue);
+  return {
+    query: q,
+    totalCount: typeof raw.total_count === "number" ? raw.total_count : reports.length,
+    reports,
+    provenance: {
+      source: "github",
+      offline: input.offline || void 0,
+      unverified: true
+    }
+  };
+}
+async function fetchGitHubIssueSearch(url, opts) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? 2e4);
+  try {
+    const res = await (opts.fetchImpl ?? fetch)(url, {
+      headers: githubHeaders(opts.headers),
+      signal: controller.signal
+    });
+    if (res.status === 403 || res.status === 429) {
+      const remaining = res.headers.get("x-ratelimit-remaining");
+      const reset = res.headers.get("x-ratelimit-reset");
+      throw new Error(`GitHub search rate limit (HTTP ${res.status}) for ${url}` + (remaining ? ` \u2014 remaining ${remaining}` : "") + (reset ? `, resets at ${reset}` : "") + " (set GITHUB_TOKEN/GH_TOKEN to raise the limit)");
+    }
+    if (!res.ok)
+      throw new Error(`HTTP ${res.status} for ${url}`);
+    return await res.json();
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function parseIssue(item) {
+  if (!item.html_url || typeof item.number !== "number")
+    return [];
+  return [{
+    title: item.title ?? `#${item.number}`,
+    url: item.html_url,
+    state: item.state ?? "unknown",
+    number: item.number,
+    isPullRequest: item.pull_request != null,
+    createdAt: item.created_at,
+    bodySnippet: snippet(item.body)
+  }];
+}
+function snippet(body) {
+  if (!body)
+    return void 0;
+  const collapsed = body.replace(/\s+/g, " ").trim();
+  if (!collapsed)
+    return void 0;
+  return collapsed.length > SNIPPET_LENGTH ? `${collapsed.slice(0, SNIPPET_LENGTH)}\u2026` : collapsed;
+}
+
+// packages/core/dist/intel/nvd.js
+async function lookupNvdCve(input, opts = {}) {
+  const cveId = normalizeCveId(input.cveId);
+  const cache = new IntelCache(input.cacheDir);
+  const raw = await cachedJson(cache, "nvd-cve", cveId, async () => await fetchJson(`https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=${encodeURIComponent(cveId)}`, { headers: nvdHeaders(opts.headers) }, opts), { offline: input.offline, ttlMs: input.ttlMs });
+  return parseNvdResponse(raw)[0] ?? null;
+}
+async function searchNvdSimilar(input, opts = {}) {
+  const terms = uniqueStrings([input.cwe, ...input.keywords ?? []]);
+  if (terms.length === 0)
+    return [];
+  const limit = Math.min(Math.max(input.limit ?? 10, 1), 50);
+  const key = JSON.stringify({ terms, limit });
+  const cache = new IntelCache(input.cacheDir);
+  const query = new URLSearchParams({
+    keywordSearch: terms.join(" "),
+    resultsPerPage: String(limit)
+  });
+  const raw = await cachedJson(cache, "nvd-search", key, async () => await fetchJson(`https://services.nvd.nist.gov/rest/json/cves/2.0?${query}`, { headers: nvdHeaders(opts.headers) }, opts), { offline: input.offline, ttlMs: input.ttlMs });
+  return parseNvdResponse(raw);
+}
+async function searchNvdTargetHistory(input, opts = {}) {
+  const terms = targetHistorySearchTerms(input);
+  if (terms.length === 0)
+    return [];
+  const limit = Math.min(Math.max(input.limit ?? 20, 1), 50);
+  const cache = new IntelCache(input.cacheDir);
+  const results = await Promise.all(terms.slice(0, 8).map(async (term) => {
+    const key = JSON.stringify({ term, limit });
+    const query = new URLSearchParams({
+      keywordSearch: term,
+      resultsPerPage: String(limit)
+    });
+    const raw = await cachedJson(cache, "nvd-target-history", key, async () => await fetchJson(`https://services.nvd.nist.gov/rest/json/cves/2.0?${query}`, { headers: nvdHeaders(opts.headers) }, opts), { offline: input.offline, ttlMs: input.ttlMs });
+    return parseNvdResponse(raw);
+  }));
+  return results.flat();
+}
+function targetHistorySearchTerms(input) {
+  const repo = normalizeRepositoryHint(input.repository ?? input.target);
+  const repoParts = repo?.split("/") ?? [];
+  return uniqueStrings([
+    input.product,
+    input.packageName,
+    input.vendor && input.product ? `${input.vendor} ${input.product}` : void 0,
+    repo,
+    repoParts[1],
+    ...input.keywords ?? []
+  ]).filter((term) => term.length >= 3);
+}
+function parseNvdResponse(raw) {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  return (raw.vulnerabilities ?? []).flatMap((item) => {
+    const cve = item.cve;
+    if (!cve?.id)
+      return [];
+    const metric = pickMetric(cve);
+    const cwes = uniqueStrings((cve.weaknesses ?? []).flatMap((w) => (w.description ?? []).map((d) => d.value).filter((value) => /^CWE-\d+$/i.test(value ?? "")))).map((cwe) => cwe.toUpperCase());
+    const references = Array.isArray(cve.references) ? cve.references : cve.references?.referenceData ?? [];
+    const kev = cve.cisaExploitAdd ? {
+      knownExploited: true,
+      dateAdded: cve.cisaExploitAdd,
+      dueDate: cve.cisaActionDue,
+      requiredAction: cve.cisaRequiredAction,
+      vulnerabilityName: cve.cisaVulnerabilityName
+    } : void 0;
+    return [{
+      id: cve.id.toUpperCase(),
+      aliases: [cve.id.toUpperCase()],
+      source: "nvd",
+      sources: ["nvd"],
+      summary: cve.descriptions?.find((d) => d.lang === "en")?.value,
+      affectedRanges: [],
+      fixedVersions: [],
+      severity: normalizeSeverity(metric?.cvssData?.baseSeverity),
+      cvss: metric?.cvssData ? {
+        score: metric.cvssData.baseScore,
+        vector: metric.cvssData.vectorString,
+        version: metric.cvssData.version
+      } : void 0,
+      cwes,
+      references: uniqueReferences(references.filter((ref) => typeof ref.url === "string").map((ref) => ({ url: ref.url, kind: ref.tags?.join(","), source: "nvd" }))),
+      kev,
+      publishedAt: cve.published,
+      modifiedAt: cve.lastModified,
+      fetchedAt: now
+    }];
+  });
+}
+function pickMetric(cve) {
+  return cve.metrics?.cvssMetricV40?.[0] ?? cve.metrics?.cvssMetricV31?.[0] ?? cve.metrics?.cvssMetricV30?.[0] ?? cve.metrics?.cvssMetricV2?.[0];
+}
+function nvdHeaders(extra) {
+  const headers = {
+    "User-Agent": "0sec-intel/0.1",
+    ...extra ?? {}
+  };
+  if (process.env.NVD_API_KEY)
+    headers.apiKey = process.env.NVD_API_KEY;
+  return headers;
+}
+
+// packages/core/dist/intel/osv.js
+function toOsvEcosystem(ecosystem) {
+  const normalized = ecosystem.trim().toLowerCase();
+  if (normalized === "npm")
+    return "npm";
+  if (normalized === "pypi" || normalized === "python")
+    return "PyPI";
+  if (normalized === "cargo" || normalized === "crates.io" || normalized === "rust")
+    return "crates.io";
+  if (normalized === "go" || normalized === "golang")
+    return "Go";
+  if (normalized === "maven")
+    return "Maven";
+  return null;
+}
+async function queryOsvAdvisories(input, opts = {}) {
+  const osvEcosystem = toOsvEcosystem(input.ecosystem);
+  if (!osvEcosystem)
+    return [];
+  const cache = new IntelCache(input.cacheDir);
+  const key = JSON.stringify({
+    ecosystem: osvEcosystem,
+    packageName: input.packageName,
+    version: input.version ?? null
+  });
+  const raw = await cachedJson(cache, "osv-query", key, async () => {
+    const body = {
+      package: { ecosystem: osvEcosystem, name: input.packageName }
+    };
+    if (input.version)
+      body.version = input.version;
+    return await fetchJson("https://api.osv.dev/v1/query", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    }, opts);
+  }, { offline: input.offline, ttlMs: input.ttlMs });
+  return parseOsvResponse(input.packageName, raw);
+}
+function parseOsvResponse(packageName, raw) {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  return (raw.vulns ?? []).map((vuln) => {
+    const aliases = uniqueStrings([vuln.id, ...vuln.aliases ?? []]).map((id2) => id2.toUpperCase());
+    const id = primaryId(aliases, vuln.id ?? "OSV advisory");
+    const packageInfo = vuln.affected?.find((a) => a.package?.name)?.package;
+    const affectedRanges = [];
+    const fixedVersions = [];
+    for (const affected of vuln.affected ?? []) {
+      for (const range of affected.ranges ?? []) {
+        const parts = (range.events ?? []).flatMap((event) => {
+          const out = [];
+          if (event.introduced)
+            out.push(`introduced:${event.introduced}`);
+          if (event.fixed) {
+            out.push(`fixed:${event.fixed}`);
+            fixedVersions.push(event.fixed);
+          }
+          if (event.last_affected)
+            out.push(`last_affected:${event.last_affected}`);
+          return out;
+        });
+        if (parts.length > 0)
+          affectedRanges.push(`${range.type ?? "range"}:${parts.join(",")}`);
+      }
+    }
+    const cvss = vuln.severity?.find((s) => typeof s.score === "string")?.score;
+    const severity = parseCvssVectorSeverity(cvss) ?? normalizeSeverity(vuln.database_specific?.severity);
+    return {
+      id,
+      aliases: aliases.length > 0 ? aliases : [id],
+      source: "osv",
+      sources: ["osv"],
+      summary: vuln.summary,
+      details: vuln.details,
+      package: {
+        ecosystem: packageInfo?.ecosystem ?? "",
+        name: packageInfo?.name ?? packageName
+      },
+      affectedRanges: uniqueStrings(affectedRanges),
+      fixedVersions: uniqueStrings(fixedVersions),
+      severity,
+      cvss: cvss ? { vector: cvss } : void 0,
+      cwes: [],
+      references: uniqueReferences((vuln.references ?? []).filter((ref) => typeof ref.url === "string").map((ref) => ({ url: ref.url, kind: ref.type, source: "osv" }))),
+      publishedAt: vuln.published,
+      modifiedAt: vuln.modified,
+      fetchedAt: now
+    };
+  });
+}
+
+// packages/core/dist/intel/prompt.js
+function formatTargetHistoryForPrompt(history) {
+  if (history.summary.advisoryCount === 0 && history.playbooks.length === 0)
+    return null;
+  const label = history.target.repository ?? history.target.packageName ?? history.target.product ?? history.target.target ?? history.target.repoPath ?? "target";
+  const lines = [
+    "## Prior Vulnerability Audit Graph",
+    `Target: ${label}`,
+    `Historical advisories: ${history.summary.advisoryCount}; playbooks: ${history.summary.playbookCount}; audit graph: ${history.auditGraph.nodes.length} nodes / ${history.auditGraph.edges.length} edges.`
+  ];
+  if (history.summary.matchedHints.length > 0) {
+    lines.push(`Matched hints: ${history.summary.matchedHints.slice(0, 8).join(", ")}`);
+  }
+  lines.push("The playbooks below document ground already covered by prior analysis. These known bug classes and their prior findings will be automatically deduplicated. DO NOT re-derive or re-report them. Instead treat this as a coverage map: focus effort on UNEXPLORED attack surface -- files, entry points, and vulnerability classes not represented in the list below.");
+  for (const playbook of history.playbooks.slice(0, 4)) {
+    lines.push("", `### ${playbook.bugClass}`);
+    if (playbook.cwes.length > 0)
+      lines.push(`CWE: ${playbook.cwes.slice(0, 5).join(", ")}`);
+    lines.push(`Prior IDs: ${playbook.priorVulnerabilityIds.slice(0, 8).join(", ")}`);
+    lines.push(`Relevance: ${playbook.relevance}`);
+    for (const [index, step] of playbook.steps.slice(0, 4).entries()) {
+      lines.push(`${index + 1}. ${step.title}`);
+      lines.push(`   Rationale: ${step.rationale}`);
+      if (step.expectedEvidence.length > 0) {
+        lines.push(`   Evidence to collect: ${step.expectedEvidence.slice(0, 3).join(" | ")}`);
+      }
+    }
+  }
+  return lines.join("\n");
+}
+
+// packages/core/dist/intel/index.js
+async function buildIntelDossier(input, opts = {}) {
+  return await buildIntelDossierFromSearch(input, searchAdvisories, searchSimilar, opts);
+}
+async function searchAdvisories(input, opts = {}) {
+  const sources = ["queryOsvAdvisories", "queryGitHubAdvisories"];
+  const results = await Promise.allSettled([
+    queryOsvAdvisories(input, opts),
+    queryGitHubAdvisories(input, opts)
+  ]);
+  warnRejectedSources(sources, results, { ecosystem: input.ecosystem, packageName: input.packageName });
+  const packageAdvisories = mergeIntel(results.flatMap((result) => result.status === "fulfilled" ? result.value : []));
+  const advisoryLeads = packageAdvisories.length === 0 ? await goStdlibNvdFallback(input, opts) : [];
+  const advisories = mergeIntel([...packageAdvisories, ...advisoryLeads]);
+  if (input.enrich !== false) {
+    const enriched = await enrichCveAliases(advisories, input, opts);
+    const merged = mergeIntel([...advisories, ...enriched]);
+    return { advisories: merged, graph: toGraphSnapshot(merged) };
+  }
+  return { advisories, graph: toGraphSnapshot(advisories) };
+}
+async function lookupCve(input, opts = {}) {
+  const cveId = normalizeCveId(input.cveId);
+  const [nvdResult, kevResult] = await Promise.allSettled([
+    lookupNvdCve({ ...input, cveId }, opts),
+    lookupKev({ ...input, cveId }, opts)
+  ]);
+  warnRejectedSources(["lookupNvdCve", "lookupKev"], [nvdResult, kevResult], { cveId });
+  const nvd = nvdResult.status === "fulfilled" ? nvdResult.value : null;
+  const kev = kevResult.status === "fulfilled" ? kevResult.value : null;
+  if (!nvd && !kev)
+    return null;
+  if (!nvd) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    return {
+      id: cveId,
+      aliases: [cveId],
+      source: "cisa-kev",
+      sources: ["cisa-kev"],
+      affectedRanges: [],
+      fixedVersions: [],
+      severity: "info",
+      cwes: [],
+      references: [],
+      kev: kev ?? void 0,
+      fetchedAt: now
+    };
+  }
+  return {
+    ...nvd,
+    sources: kev ? mergeSources(nvd.sources, ["cisa-kev"]) : nvd.sources,
+    kev: kev ?? nvd.kev
+  };
+}
+async function searchSimilar(input, opts = {}) {
+  const advisories = mergeIntel(await searchNvdSimilar(input, opts));
+  return { advisories, graph: toGraphSnapshot(advisories) };
+}
+async function searchTargetHistory(input, opts = {}) {
+  const resolvedInput = resolveTargetHistoryInput(input);
+  const packageLookup = resolvedInput.ecosystem && resolvedInput.packageName ? searchAdvisories({
+    ecosystem: resolvedInput.ecosystem,
+    packageName: resolvedInput.packageName,
+    enrich: false,
+    cacheDir: resolvedInput.cacheDir,
+    offline: resolvedInput.offline,
+    ttlMs: resolvedInput.ttlMs
+  }, opts) : Promise.resolve({ advisories: [], graph: { nodes: [], edges: [] } });
+  const results = await Promise.allSettled([
+    packageLookup,
+    searchNvdTargetHistory(resolvedInput, opts)
+  ]);
+  warnRejectedSources(["searchAdvisories", "searchNvdTargetHistory"], results, {
+    target: resolvedInput.target,
+    repository: resolvedInput.repository,
+    packageName: resolvedInput.packageName,
+    product: resolvedInput.product
+  });
+  const packageResult = results[0]?.status === "fulfilled" ? results[0].value.advisories : [];
+  const nvdAdvisories = results[1]?.status === "fulfilled" ? results[1].value : [];
+  return buildTargetHistoryResult(resolvedInput, [...packageResult, ...nvdAdvisories]);
+}
+async function lookupAdvisory(input, opts = {}) {
+  return await lookupGitHubAdvisory(input, opts);
+}
+async function searchPublicReports(input, opts = {}) {
+  return await searchGitHubIssues(input, opts);
+}
+var BROAD_REPORT_TERMS = "security OR vulnerability OR CVE OR GHSA OR SSRF OR auth OR traversal OR injection OR memory OR DoS";
+var SWEEP_CAVEAT = "LEADS ONLY \u2014 'no public duplicate found' is NOT 'definitely unique'. Private/draft GitHub advisories, embargoed advisories, HackerOne (and other bug-bounty) reports, and internal tickets are invisible to this sweep. Verify local reachability before reporting a new bug.";
+async function advisorySweep(input, opts = {}) {
+  const limit = typeof input.limit === "number" ? Math.min(Math.max(Math.trunc(input.limit), 1), 50) : 15;
+  const ghsaIds = uniqueStrings(input.ghsaIds ?? []);
+  const keywords = uniqueStrings(input.keywords ?? []);
+  const shared = { cacheDir: input.cacheDir, offline: input.offline, ttlMs: input.ttlMs };
+  const advisoryTasks = [];
+  for (const ghsaId of ghsaIds) {
+    advisoryTasks.push({
+      label: `lookupAdvisory(${ghsaId})`,
+      run: async () => {
+        const advisory = await lookupAdvisory({ ghsaId, ...shared }, opts);
+        return advisory ? [advisory] : [];
+      }
+    });
+  }
+  if (input.ecosystem && input.packageName) {
+    advisoryTasks.push({
+      label: "searchAdvisories",
+      run: async () => (await searchAdvisories({
+        ecosystem: input.ecosystem,
+        packageName: input.packageName,
+        enrich: false,
+        ...shared
+      }, opts)).advisories
+    });
+  }
+  const reportTasks = [];
+  if (input.repository) {
+    reportTasks.push({
+      label: "searchPublicReports(broad)",
+      run: () => searchPublicReports({ repository: input.repository, terms: BROAD_REPORT_TERMS, limit, ...shared }, opts)
+    });
+    if (keywords.length > 0) {
+      reportTasks.push({
+        label: "searchPublicReports(keywords)",
+        run: () => searchPublicReports({ repository: input.repository, terms: keywords.join(" "), limit, ...shared }, opts)
+      });
+    }
+  }
+  const historyTask = input.includeTargetHistory && (input.repository || input.packageName) ? searchTargetHistory({ repository: input.repository, ecosystem: input.ecosystem, packageName: input.packageName, keywords, limit, ...shared }, opts) : Promise.resolve(null);
+  const [advisoryResults, reportResults, historyResult] = await Promise.all([
+    Promise.allSettled(advisoryTasks.map((task) => task.run())),
+    Promise.allSettled(reportTasks.map((task) => task.run())),
+    historyTask.catch((reason) => {
+      console.warn("[intel] advisorySweep target-history failed", { reason: reason instanceof Error ? reason.message : String(reason) });
+      return null;
+    })
+  ]);
+  warnRejectedSources(advisoryTasks.map((task) => task.label), advisoryResults, { sweep: "advisories" });
+  warnRejectedSources(reportTasks.map((task) => task.label), reportResults, { sweep: "reports" });
+  const advisorySourceById = /* @__PURE__ */ new Map();
+  const flatAdvisories = [];
+  advisoryResults.forEach((result, idx) => {
+    if (result.status !== "fulfilled")
+      return;
+    const source = idx < ghsaIds.length ? "github-advisory" : "package-advisory";
+    for (const advisory of result.value) {
+      flatAdvisories.push(advisory);
+      advisorySourceById.set(advisory.id.toUpperCase(), source);
+    }
+  });
+  const leads = [];
+  const seen = /* @__PURE__ */ new Map();
+  const addAdvisoryLead = (advisory, source, confidence) => {
+    const key = `advisory:${advisory.id.toUpperCase()}`;
+    const existing = seen.get(key);
+    const html = advisory.references.find((ref) => ref.kind === "advisory")?.url ?? advisory.references[0]?.url;
+    if (existing) {
+      if (!existing.sources.includes(source))
+        existing.sources.push(source);
+      if (rankConfidence(confidence) > rankConfidence(existing.confidence))
+        existing.confidence = confidence;
+      return;
+    }
+    const lead = {
+      id: advisory.id,
+      kind: "advisory",
+      confidence,
+      sources: [source],
+      title: advisory.summary ?? advisory.id,
+      url: html,
+      severity: advisory.severity,
+      aliases: advisory.aliases
+    };
+    seen.set(key, lead);
+    leads.push(lead);
+  };
+  for (const advisory of mergeIntel(flatAdvisories)) {
+    addAdvisoryLead(advisory, advisorySourceById.get(advisory.id.toUpperCase()) ?? "package-advisory", "high");
+  }
+  reportResults.forEach((result) => {
+    if (result.status !== "fulfilled")
+      return;
+    for (const report of result.value.reports) {
+      const key = `report:${report.url}`;
+      if (seen.has(key))
+        continue;
+      const lead = {
+        id: report.url,
+        kind: "public_report",
+        confidence: "low",
+        sources: ["github-issue"],
+        title: report.title,
+        url: report.url,
+        state: report.state,
+        isPullRequest: report.isPullRequest,
+        createdAt: report.createdAt,
+        snippet: report.bodySnippet
+      };
+      seen.set(key, lead);
+      leads.push(lead);
+    }
+  });
+  if (historyResult) {
+    for (const advisory of historyResult.advisories) {
+      addAdvisoryLead(advisory, "target-history", advisory.matchConfidence ?? "medium");
+    }
+  }
+  leads.sort((a, b) => rankConfidence(b.confidence) - rankConfidence(a.confidence) || severityRank2(b.severity) - severityRank2(a.severity));
+  const publicReports = leads.filter((lead) => lead.kind === "public_report").length;
+  const advisories = leads.length - publicReports;
+  const sources = uniqueStrings(leads.flatMap((lead) => lead.sources));
+  return {
+    query: { repository: input.repository, ecosystem: input.ecosystem, packageName: input.packageName, keywords, ghsaIds },
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    counts: {
+      total: leads.length,
+      advisories,
+      publicReports,
+      high: leads.filter((lead) => lead.confidence === "high").length,
+      medium: leads.filter((lead) => lead.confidence === "medium").length,
+      low: leads.filter((lead) => lead.confidence === "low").length
+    },
+    leads,
+    caveat: SWEEP_CAVEAT,
+    provenance: { sources, offline: input.offline || void 0, unverified: true }
+  };
+}
+function rankConfidence(confidence) {
+  return { high: 3, medium: 2, low: 1 }[confidence];
+}
+function severityRank2(severity) {
+  return { critical: 5, high: 4, medium: 3, low: 2, info: 1 }[severity ?? "info"];
+}
+async function goStdlibNvdFallback(input, opts) {
+  if (!isGoStdlibSearch(input))
+    return [];
+  const keywords = goStdlibKeywords(input.packageName);
+  if (keywords.length === 0)
+    return [];
+  const advisories = await searchNvdSimilar({
+    keywords,
+    limit: 20,
+    cacheDir: input.cacheDir,
+    offline: input.offline,
+    ttlMs: input.ttlMs
+  }, opts);
+  return advisories.filter(isGoStdlibIntel);
+}
+function isGoStdlibSearch(input) {
+  const ecosystem = input.ecosystem.trim().toLowerCase();
+  if (ecosystem !== "go" && ecosystem !== "golang")
+    return false;
+  const name = input.packageName.trim().toLowerCase();
+  return name === "stdlib" || name === "std" || name === "go" || name === "golang" || name === "github.com/golang/go" || name === "golang/go" || name.startsWith("std/") || name.startsWith("stdlib/");
+}
+function goStdlibKeywords(packageName) {
+  const normalized = packageName.trim().toLowerCase();
+  const pkg = normalized.replace(/^stdlib\//, "").replace(/^std\//, "");
+  if (pkg && pkg !== normalized)
+    return ["golang", pkg];
+  return ["golang", "standard library"];
+}
+function isGoStdlibIntel(advisory) {
+  const haystack = [
+    advisory.summary,
+    ...advisory.references.map((reference) => reference.url)
+  ].join("\n").toLowerCase();
+  return /\b(go|golang)\b/.test(haystack) && (haystack.includes("standard library") || haystack.includes("pkg.go.dev/std") || haystack.includes("github.com/golang/go") || haystack.includes("go.dev/issue") || haystack.includes("groups.google.com/g/golang-announce"));
+}
+async function enrichCveAliases(advisories, input, opts) {
+  const cves = uniqueStrings(advisories.flatMap((advisory) => [advisory.id, ...advisory.aliases]).filter((id) => /^CVE-\d{4}-\d{4,}$/i.test(id)));
+  const results = await Promise.allSettled(cves.slice(0, 10).map((cveId) => lookupCve({ cveId, cacheDir: input.cacheDir, offline: input.offline, ttlMs: input.ttlMs }, opts)));
+  return results.flatMap((result) => result.status === "fulfilled" && result.value ? [result.value] : []);
+}
+function mergeSources(a, b) {
+  return uniqueStrings([...a, ...b]);
+}
+function warnRejectedSources(sources, results, context) {
+  for (const [idx, result] of results.entries()) {
+    if (result.status !== "rejected")
+      continue;
+    const reason = result.reason instanceof Error ? result.reason.message : String(result.reason);
+    console.warn(`[intel] ${sources[idx] ?? "source"} failed`, { reason, context });
+  }
+}
+
+export {
+  classifyResponse,
+  jitterFor,
+  runEvasionCampaign,
+  WafDetector,
+  enumerateSubdomains,
+  scanBody,
+  scanJsArtifacts,
+  defaultIntelCacheDir,
+  IntelCache,
+  mergeIntel,
+  toGraphSnapshot,
+  lookupKev,
+  queryGitHubAdvisories,
+  lookupGitHubAdvisory,
+  normalizeGhsaId,
+  parseGitHubAdvisories,
+  buildPriorVulnerabilityAuditGraph,
+  resolveTargetHistoryInput,
+  inferTargetHistoryInputFromRepo,
+  normalizeRepositoryHint,
+  buildPublicReportQuery,
+  searchGitHubIssues,
+  lookupNvdCve,
+  searchNvdSimilar,
+  searchNvdTargetHistory,
+  parseNvdResponse,
+  toOsvEcosystem,
+  queryOsvAdvisories,
+  parseOsvResponse,
+  formatTargetHistoryForPrompt,
+  buildIntelDossier,
+  searchAdvisories,
+  lookupCve,
+  searchSimilar,
+  searchTargetHistory,
+  lookupAdvisory,
+  searchPublicReports,
+  advisorySweep
+};