0sec-cli 0.21.4 → 0.22.1

package/chunks/chunk-UELXHK2Y.js

@@ -0,0 +1,1950 @@
+#!/usr/bin/env node
+import { createRequire as __0CreateRequire } from "node:module";
+const require = __0CreateRequire(import.meta.url);
+
+// packages/core/dist/disclose/cwe.js
+var CWE_MAP = {
+  // LLM / agent
+  "prompt-injection": [
+    { id: "CWE-1039", name: "Inadequate Detection or Handling of Adversarial Input Perturbations in AI/ML Classifier", role: "primary" },
+    { id: "CWE-20", name: "Improper Input Validation", role: "secondary" },
+    { id: "CWE-94", name: "Improper Control of Generation of Code ('Code Injection')", role: "secondary" }
+  ],
+  "jailbreak": [
+    { id: "CWE-1039", name: "Inadequate Detection or Handling of Adversarial Input Perturbations in AI/ML Classifier", role: "primary" },
+    { id: "CWE-284", name: "Improper Access Control", role: "secondary" }
+  ],
+  "system-prompt-extraction": [
+    { id: "CWE-200", name: "Exposure of Sensitive Information to an Unauthorized Actor", role: "primary" },
+    { id: "CWE-1039", name: "Inadequate Detection or Handling of Adversarial Input Perturbations in AI/ML Classifier", role: "secondary" }
+  ],
+  "data-exfiltration": [
+    { id: "CWE-200", name: "Exposure of Sensitive Information to an Unauthorized Actor", role: "primary" },
+    { id: "CWE-522", name: "Insufficiently Protected Credentials", role: "secondary" }
+  ],
+  "tool-misuse": [
+    { id: "CWE-284", name: "Improper Access Control", role: "primary" },
+    { id: "CWE-441", name: "Unintended Proxy or Intermediary ('Confused Deputy')", role: "secondary" },
+    { id: "CWE-285", name: "Improper Authorization", role: "secondary" }
+  ],
+  "output-manipulation": [
+    { id: "CWE-116", name: "Improper Encoding or Escaping of Output", role: "primary" },
+    { id: "CWE-74", name: "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')", role: "secondary" }
+  ],
+  "encoding-bypass": [
+    { id: "CWE-176", name: "Improper Handling of Unicode Encoding", role: "primary" },
+    { id: "CWE-20", name: "Improper Input Validation", role: "secondary" }
+  ],
+  "multi-turn": [
+    { id: "CWE-1039", name: "Inadequate Detection or Handling of Adversarial Input Perturbations in AI/ML Classifier", role: "primary" },
+    { id: "CWE-841", name: "Improper Enforcement of Behavioral Workflow", role: "secondary" }
+  ],
+  // Source-code audit
+  "prototype-pollution": [
+    { id: "CWE-1321", name: "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", role: "primary" },
+    { id: "CWE-915", name: "Improperly Controlled Modification of Dynamically-Determined Object Attributes", role: "secondary" }
+  ],
+  "path-traversal": [
+    { id: "CWE-22", name: "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", role: "primary" },
+    { id: "CWE-73", name: "External Control of File Name or Path", role: "secondary" },
+    { id: "CWE-284", name: "Improper Access Control", role: "secondary" }
+  ],
+  "command-injection": [
+    { id: "CWE-78", name: "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')", role: "primary" },
+    { id: "CWE-77", name: "Improper Neutralization of Special Elements used in a Command ('Command Injection')", role: "secondary" }
+  ],
+  "code-injection": [
+    { id: "CWE-94", name: "Improper Control of Generation of Code ('Code Injection')", role: "primary" },
+    { id: "CWE-95", name: "Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')", role: "secondary" }
+  ],
+  "regex-dos": [
+    { id: "CWE-1333", name: "Inefficient Regular Expression Complexity", role: "primary" },
+    { id: "CWE-400", name: "Uncontrolled Resource Consumption", role: "secondary" }
+  ],
+  "unsafe-deserialization": [
+    { id: "CWE-502", name: "Deserialization of Untrusted Data", role: "primary" },
+    { id: "CWE-915", name: "Improperly Controlled Modification of Dynamically-Determined Object Attributes", role: "secondary" }
+  ],
+  "information-disclosure": [
+    { id: "CWE-200", name: "Exposure of Sensitive Information to an Unauthorized Actor", role: "primary" },
+    { id: "CWE-285", name: "Improper Authorization", role: "secondary" },
+    { id: "CWE-522", name: "Insufficiently Protected Credentials", role: "secondary" }
+  ],
+  "ssrf": [
+    { id: "CWE-918", name: "Server-Side Request Forgery (SSRF)", role: "primary" },
+    { id: "CWE-20", name: "Improper Input Validation", role: "secondary" },
+    { id: "CWE-441", name: "Unintended Proxy or Intermediary ('Confused Deputy')", role: "secondary" }
+  ],
+  "sql-injection": [
+    { id: "CWE-89", name: "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", role: "primary" }
+  ],
+  "xss": [
+    { id: "CWE-79", name: "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", role: "primary" },
+    { id: "CWE-80", name: "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)", role: "secondary" }
+  ],
+  "cors": [
+    { id: "CWE-942", name: "Permissive Cross-domain Policy with Untrusted Domains", role: "primary" },
+    { id: "CWE-346", name: "Origin Validation Error", role: "secondary" }
+  ],
+  "security-misconfiguration": [
+    { id: "CWE-1188", name: "Initialization of a Resource with an Insecure Default", role: "primary" },
+    { id: "CWE-16", name: "Configuration", role: "secondary" }
+  ],
+  "missing-validation": [
+    { id: "CWE-20", name: "Improper Input Validation", role: "primary" }
+  ],
+  "crypto-misuse": [
+    { id: "CWE-327", name: "Use of a Broken or Risky Cryptographic Algorithm", role: "primary" },
+    { id: "CWE-328", name: "Use of Weak Hash", role: "secondary" },
+    { id: "CWE-321", name: "Use of Hard-coded Cryptographic Key", role: "secondary" },
+    { id: "CWE-329", name: "Generation of Predictable IV with CBC Mode", role: "secondary" },
+    { id: "CWE-330", name: "Use of Insufficiently Random Values", role: "secondary" },
+    { id: "CWE-347", name: "Improper Verification of Cryptographic Signature", role: "secondary" }
+  ],
+  // Memory corruption / binary
+  "heap-overflow": [
+    { id: "CWE-122", name: "Heap-based Buffer Overflow", role: "primary" },
+    { id: "CWE-787", name: "Out-of-bounds Write", role: "secondary" }
+  ],
+  "out-of-bounds-read": [
+    { id: "CWE-125", name: "Out-of-bounds Read", role: "primary" }
+  ],
+  "out-of-bounds-write": [
+    { id: "CWE-787", name: "Out-of-bounds Write", role: "primary" },
+    { id: "CWE-122", name: "Heap-based Buffer Overflow", role: "secondary" }
+  ],
+  "use-after-free": [
+    { id: "CWE-416", name: "Use After Free", role: "primary" },
+    { id: "CWE-672", name: "Operation on a Resource after Expiration or Release", role: "secondary" }
+  ],
+  "stack-buffer-overflow": [
+    { id: "CWE-121", name: "Stack-based Buffer Overflow", role: "primary" },
+    { id: "CWE-787", name: "Out-of-bounds Write", role: "secondary" }
+  ],
+  "null-pointer-deref": [
+    { id: "CWE-476", name: "NULL Pointer Dereference", role: "primary" }
+  ],
+  "null-deref": [
+    { id: "CWE-476", name: "NULL Pointer Dereference", role: "primary" }
+  ],
+  "integer-overflow": [
+    { id: "CWE-190", name: "Integer Overflow or Wraparound", role: "primary" },
+    { id: "CWE-191", name: "Integer Underflow (Wrap or Wraparound)", role: "secondary" }
+  ],
+  "integer-truncation": [
+    { id: "CWE-197", name: "Numeric Truncation Error", role: "primary" },
+    { id: "CWE-681", name: "Incorrect Conversion between Numeric Types", role: "secondary" }
+  ],
+  "denial-of-service": [
+    { id: "CWE-400", name: "Uncontrolled Resource Consumption", role: "primary" },
+    { id: "CWE-833", name: "Deadlock", role: "secondary" }
+  ],
+  "race-condition": [
+    { id: "CWE-362", name: "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", role: "primary" },
+    { id: "CWE-367", name: "Time-of-check Time-of-use (TOCTOU) Race Condition", role: "secondary" }
+  ],
+  "toctou": [
+    { id: "CWE-367", name: "Time-of-check Time-of-use (TOCTOU) Race Condition", role: "primary" },
+    { id: "CWE-362", name: "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", role: "secondary" }
+  ],
+  "type-confusion": [
+    { id: "CWE-843", name: "Access of Resource Using Incompatible Type ('Type Confusion')", role: "primary" }
+  ],
+  "double-free": [
+    { id: "CWE-415", name: "Double Free", role: "primary" }
+  ],
+  "format-string": [
+    { id: "CWE-134", name: "Use of Externally-Controlled Format String", role: "primary" }
+  ],
+  "uninitialized-memory": [
+    { id: "CWE-457", name: "Use of Uninitialized Variable", role: "primary" },
+    { id: "CWE-908", name: "Use of Uninitialized Resource", role: "secondary" }
+  ],
+  // Supply-chain / package
+  "known-vulnerable-package": [
+    { id: "CWE-1395", name: "Dependency on Vulnerable Third-Party Component", role: "primary" },
+    { id: "CWE-1104", name: "Use of Unmaintained Third Party Components", role: "secondary" },
+    { id: "CWE-937", name: "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities", role: "secondary" }
+  ],
+  "supply-chain": [
+    { id: "CWE-1357", name: "Reliance on Insufficiently Trustworthy Component", role: "primary" },
+    { id: "CWE-506", name: "Embedded Malicious Code", role: "secondary" },
+    { id: "CWE-829", name: "Inclusion of Functionality from Untrusted Control Sphere", role: "secondary" }
+  ],
+  "other": [
+    { id: "CWE-693", name: "Protection Mechanism Failure", role: "primary" }
+  ]
+};
+function suggestCwesForCategory(category) {
+  return CWE_MAP[category] ?? [
+    { id: "CWE-693", name: "Protection Mechanism Failure", role: "primary" }
+  ];
+}
+function formatCweSection(entries) {
+  if (entries.length === 0)
+    return "";
+  const lines = ["# CWE", ""];
+  lines.push("Pick these in the GHSA form's CWE selector (multi-select):");
+  lines.push("");
+  for (const entry of entries) {
+    const emphasis = entry.role === "primary" ? " *(primary)*" : "";
+    lines.push(`- **${entry.id}**: ${entry.name}${emphasis}`);
+  }
+  return lines.join("\n");
+}
+
+// packages/core/dist/disclose/cvss.js
+var IMPACT_BY_CATEGORY = {
+  "prompt-injection": { C: "L", I: "L", A: "N", scope: "U" },
+  "jailbreak": { C: "L", I: "L", A: "N", scope: "U" },
+  "system-prompt-extraction": { C: "H", I: "N", A: "N", scope: "U" },
+  "data-exfiltration": { C: "H", I: "N", A: "N", scope: "C" },
+  "tool-misuse": { C: "H", I: "H", A: "L", scope: "C" },
+  "output-manipulation": { C: "L", I: "H", A: "N", scope: "U" },
+  "encoding-bypass": { C: "L", I: "L", A: "N", scope: "U" },
+  "multi-turn": { C: "L", I: "L", A: "N", scope: "U" },
+  "prototype-pollution": { C: "H", I: "H", A: "H", scope: "U" },
+  "path-traversal": { C: "H", I: "H", A: "L", scope: "U" },
+  "command-injection": { C: "H", I: "H", A: "H", scope: "U" },
+  "code-injection": { C: "H", I: "H", A: "H", scope: "U" },
+  "regex-dos": { C: "N", I: "N", A: "H", scope: "U" },
+  "unsafe-deserialization": { C: "H", I: "H", A: "H", scope: "U" },
+  "information-disclosure": { C: "H", I: "N", A: "N", scope: "C" },
+  "ssrf": { C: "H", I: "N", A: "N", scope: "C" },
+  "sql-injection": { C: "H", I: "H", A: "H", scope: "U" },
+  "xss": { C: "L", I: "L", A: "N", scope: "C" },
+  "cors": { C: "L", I: "L", A: "N", scope: "U" },
+  "security-misconfiguration": { C: "L", I: "L", A: "N", scope: "U" },
+  "missing-validation": { C: "L", I: "L", A: "L", scope: "U" },
+  "crypto-misuse": { C: "H", I: "H", A: "N", scope: "U" },
+  "heap-overflow": { C: "H", I: "H", A: "H", scope: "U" },
+  "out-of-bounds-read": { C: "H", I: "N", A: "L", scope: "U" },
+  "out-of-bounds-write": { C: "H", I: "H", A: "H", scope: "U" },
+  "use-after-free": { C: "H", I: "H", A: "H", scope: "U" },
+  "stack-buffer-overflow": { C: "H", I: "H", A: "H", scope: "U" },
+  "null-pointer-deref": { C: "N", I: "N", A: "H", scope: "U" },
+  "null-deref": { C: "N", I: "N", A: "H", scope: "U" },
+  "integer-overflow": { C: "L", I: "L", A: "L", scope: "U" },
+  "integer-truncation": { C: "L", I: "L", A: "L", scope: "U" },
+  "race-condition": { C: "L", I: "L", A: "L", scope: "U" },
+  "denial-of-service": { C: "N", I: "N", A: "H", scope: "U" },
+  "toctou": { C: "L", I: "L", A: "L", scope: "U" },
+  "type-confusion": { C: "H", I: "H", A: "H", scope: "U" },
+  "double-free": { C: "H", I: "H", A: "H", scope: "U" },
+  "format-string": { C: "H", I: "H", A: "H", scope: "U" },
+  "uninitialized-memory": { C: "H", I: "N", A: "L", scope: "U" },
+  "known-vulnerable-package": { C: "L", I: "L", A: "L", scope: "U" },
+  "supply-chain": { C: "H", I: "H", A: "H", scope: "C" },
+  "other": { C: "L", I: "L", A: "L", scope: "U" }
+};
+var W = {
+  AV: { N: 0.85, A: 0.62, L: 0.55, P: 0.2 },
+  AC: { L: 0.77, H: 0.44 },
+  PR_U: { N: 0.85, L: 0.62, H: 0.27 },
+  PR_C: { N: 0.85, L: 0.68, H: 0.5 },
+  UI: { N: 0.85, R: 0.62 },
+  CIA: { N: 0, L: 0.22, H: 0.56 }
+};
+function roundUp(n) {
+  return Math.ceil(n * 10) / 10;
+}
+function computeBaseScore(av, ac, pr, ui, scope, c, i, a) {
+  const iss = 1 - (1 - W.CIA[c]) * (1 - W.CIA[i]) * (1 - W.CIA[a]);
+  const impact = scope === "U" ? 6.42 * iss : 7.52 * (iss - 0.029) - 3.25 * Math.pow(iss - 0.02, 15);
+  const prWeight = (scope === "C" ? W.PR_C : W.PR_U)[pr];
+  const exploit = 8.22 * W.AV[av] * W.AC[ac] * prWeight * W.UI[ui];
+  if (impact <= 0)
+    return 0;
+  const base = scope === "U" ? Math.min(impact + exploit, 10) : Math.min(1.08 * (impact + exploit), 10);
+  return roundUp(base);
+}
+function prForSeverity(severity) {
+  switch (severity) {
+    case "critical":
+      return "N";
+    case "high":
+      return "L";
+    case "medium":
+    case "low":
+      return "L";
+    default:
+      return "H";
+  }
+}
+function metricsForReachability(tier) {
+  switch (tier) {
+    case "remote-unauth":
+      return { av: "N", pr: "N", ui: "N" };
+    case "remote-auth":
+      return { av: "N", pr: "L", ui: "N" };
+    case "proximity-rf":
+      return { av: "A", pr: "N", ui: "N" };
+    case "local-unpriv":
+      return { av: "L", pr: "L", ui: "N" };
+    case "local-priv":
+      return { av: "L", pr: "H", ui: "N" };
+    case "needs-hardware":
+      return { av: "P", pr: "N", ui: "N" };
+    case "needs-host-migration":
+      return { av: "L", pr: "N", ui: "R" };
+  }
+}
+function suggestCvss(finding) {
+  if (finding.cvssVector && finding.cvssScore !== void 0) {
+    return { vector: finding.cvssVector, score: finding.cvssScore, source: "finding" };
+  }
+  const impact = IMPACT_BY_CATEGORY[finding.category] ?? { C: "L", I: "L", A: "L", scope: "U" };
+  const ac = "L";
+  const assessed = finding.impactAssessment ? metricsForReachability(finding.impactAssessment.reachability_tier) : void 0;
+  const av = assessed?.av ?? "N";
+  const pr = assessed?.pr ?? prForSeverity(finding.severity);
+  const ui = assessed?.ui ?? "N";
+  const vector = `CVSS:3.1/AV:${av}/AC:${ac}/PR:${pr}/UI:${ui}/S:${impact.scope}/C:${impact.C}/I:${impact.I}/A:${impact.A}`;
+  const score = computeBaseScore(av, ac, pr, ui, impact.scope, impact.C, impact.I, impact.A);
+  return { vector, score, source: assessed ? "impact-assessment" : "heuristic" };
+}
+var Cvss4ParseError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "Cvss4ParseError";
+  }
+};
+var CVSS4_ALLOWED = {
+  AV: /* @__PURE__ */ new Set(["N", "A", "L", "P"]),
+  AC: /* @__PURE__ */ new Set(["L", "H"]),
+  AT: /* @__PURE__ */ new Set(["N", "P"]),
+  PR: /* @__PURE__ */ new Set(["N", "L", "H"]),
+  UI: /* @__PURE__ */ new Set(["N", "P", "A"]),
+  VC: /* @__PURE__ */ new Set(["H", "L", "N"]),
+  VI: /* @__PURE__ */ new Set(["H", "L", "N"]),
+  VA: /* @__PURE__ */ new Set(["H", "L", "N"]),
+  SC: /* @__PURE__ */ new Set(["H", "L", "N"]),
+  SI: /* @__PURE__ */ new Set(["H", "L", "N"]),
+  SA: /* @__PURE__ */ new Set(["H", "L", "N"]),
+  // Threat
+  E: /* @__PURE__ */ new Set(["X", "A", "P", "U"]),
+  // Environmental (requirements)
+  CR: /* @__PURE__ */ new Set(["X", "H", "M", "L"]),
+  IR: /* @__PURE__ */ new Set(["X", "H", "M", "L"]),
+  AR: /* @__PURE__ */ new Set(["X", "H", "M", "L"]),
+  // Environmental (modified base)
+  MAV: /* @__PURE__ */ new Set(["X", "N", "A", "L", "P"]),
+  MAC: /* @__PURE__ */ new Set(["X", "L", "H"]),
+  MAT: /* @__PURE__ */ new Set(["X", "N", "P"]),
+  MPR: /* @__PURE__ */ new Set(["X", "N", "L", "H"]),
+  MUI: /* @__PURE__ */ new Set(["X", "N", "P", "A"]),
+  MVC: /* @__PURE__ */ new Set(["X", "H", "L", "N"]),
+  MVI: /* @__PURE__ */ new Set(["X", "H", "L", "N"]),
+  MVA: /* @__PURE__ */ new Set(["X", "H", "L", "N"]),
+  MSC: /* @__PURE__ */ new Set(["X", "H", "L", "N"]),
+  MSI: /* @__PURE__ */ new Set(["X", "S", "H", "L", "N"]),
+  MSA: /* @__PURE__ */ new Set(["X", "S", "H", "L", "N"]),
+  // Supplemental (do not affect score)
+  S: /* @__PURE__ */ new Set(["X", "N", "P"]),
+  AU: /* @__PURE__ */ new Set(["X", "N", "Y"]),
+  R: /* @__PURE__ */ new Set(["X", "A", "U", "I"]),
+  V: /* @__PURE__ */ new Set(["X", "D", "C"]),
+  RE: /* @__PURE__ */ new Set(["X", "L", "M", "H"]),
+  U: /* @__PURE__ */ new Set(["X", "Clear", "Green", "Amber", "Red"])
+};
+var CVSS4_BASE_KEYS = [
+  "AV",
+  "AC",
+  "AT",
+  "PR",
+  "UI",
+  "VC",
+  "VI",
+  "VA",
+  "SC",
+  "SI",
+  "SA"
+];
+var AV_levels = { N: 0, A: 0.1, L: 0.2, P: 0.3 };
+var PR_levels = { N: 0, L: 0.1, H: 0.2 };
+var UI_levels = { N: 0, P: 0.1, A: 0.2 };
+var AC_levels = { L: 0, H: 0.1 };
+var AT_levels = { N: 0, P: 0.1 };
+var VC_levels = { H: 0, L: 0.1, N: 0.2 };
+var VI_levels = { H: 0, L: 0.1, N: 0.2 };
+var VA_levels = { H: 0, L: 0.1, N: 0.2 };
+var SC_levels = { H: 0.1, L: 0.2, N: 0.3 };
+var SI_levels = { S: 0, H: 0.1, L: 0.2, N: 0.3 };
+var SA_levels = { S: 0, H: 0.1, L: 0.2, N: 0.3 };
+var CR_levels = { H: 0, M: 0.1, L: 0.2 };
+var IR_levels = { H: 0, M: 0.1, L: 0.2 };
+var AR_levels = { H: 0, M: 0.1, L: 0.2 };
+var CVSS40_LOOKUP = {
+  "000000": 10,
+  "000001": 9.9,
+  "000010": 9.8,
+  "000011": 9.5,
+  "000020": 9.5,
+  "000021": 9.2,
+  "000100": 10,
+  "000101": 9.6,
+  "000110": 9.3,
+  "000111": 8.7,
+  "000120": 9.1,
+  "000121": 8.1,
+  "000200": 9.3,
+  "000201": 9,
+  "000210": 8.9,
+  "000211": 8,
+  "000220": 8.1,
+  "000221": 6.8,
+  "001000": 9.8,
+  "001001": 9.5,
+  "001010": 9.5,
+  "001011": 9.2,
+  "001020": 9,
+  "001021": 8.4,
+  "001100": 9.3,
+  "001101": 9.2,
+  "001110": 8.9,
+  "001111": 8.1,
+  "001120": 8.1,
+  "001121": 6.5,
+  "001200": 8.8,
+  "001201": 8,
+  "001210": 7.8,
+  "001211": 7,
+  "001220": 6.9,
+  "001221": 4.8,
+  "002001": 9.2,
+  "002011": 8.2,
+  "002021": 7.2,
+  "002101": 7.9,
+  "002111": 6.9,
+  "002121": 5,
+  "002201": 6.9,
+  "002211": 5.5,
+  "002221": 2.7,
+  "010000": 9.9,
+  "010001": 9.7,
+  "010010": 9.5,
+  "010011": 9.2,
+  "010020": 9.2,
+  "010021": 8.5,
+  "010100": 9.5,
+  "010101": 9.1,
+  "010110": 9,
+  "010111": 8.3,
+  "010120": 8.4,
+  "010121": 7.1,
+  "010200": 9.2,
+  "010201": 8.1,
+  "010210": 8.2,
+  "010211": 7.1,
+  "010220": 7.2,
+  "010221": 5.3,
+  "011000": 9.5,
+  "011001": 9.3,
+  "011010": 9.2,
+  "011011": 8.5,
+  "011020": 8.5,
+  "011021": 7.3,
+  "011100": 9.2,
+  "011101": 8.2,
+  "011110": 8,
+  "011111": 7.2,
+  "011120": 7,
+  "011121": 5.9,
+  "011200": 8.4,
+  "011201": 7,
+  "011210": 7.1,
+  "011211": 5.2,
+  "011220": 5,
+  "011221": 3,
+  "012001": 8.6,
+  "012011": 7.5,
+  "012021": 5.2,
+  "012101": 7.1,
+  "012111": 5.2,
+  "012121": 2.9,
+  "012201": 6.3,
+  "012211": 2.9,
+  "012221": 1.7,
+  "100000": 9.8,
+  "100001": 9.5,
+  "100010": 9.4,
+  "100011": 8.7,
+  "100020": 9.1,
+  "100021": 8.1,
+  "100100": 9.4,
+  "100101": 8.9,
+  "100110": 8.6,
+  "100111": 7.4,
+  "100120": 7.7,
+  "100121": 6.4,
+  "100200": 8.7,
+  "100201": 7.5,
+  "100210": 7.4,
+  "100211": 6.3,
+  "100220": 6.3,
+  "100221": 4.9,
+  "101000": 9.4,
+  "101001": 8.9,
+  "101010": 8.8,
+  "101011": 7.7,
+  "101020": 7.6,
+  "101021": 6.7,
+  "101100": 8.6,
+  "101101": 7.6,
+  "101110": 7.4,
+  "101111": 5.8,
+  "101120": 5.9,
+  "101121": 5,
+  "101200": 7.2,
+  "101201": 5.7,
+  "101210": 5.7,
+  "101211": 5.2,
+  "101220": 5.2,
+  "101221": 2.5,
+  "102001": 8.3,
+  "102011": 7,
+  "102021": 5.4,
+  "102101": 6.5,
+  "102111": 5.8,
+  "102121": 2.6,
+  "102201": 5.3,
+  "102211": 2.1,
+  "102221": 1.3,
+  "110000": 9.5,
+  "110001": 9,
+  "110010": 8.8,
+  "110011": 7.6,
+  "110020": 7.6,
+  "110021": 7,
+  "110100": 9,
+  "110101": 7.7,
+  "110110": 7.5,
+  "110111": 6.2,
+  "110120": 6.1,
+  "110121": 5.3,
+  "110200": 7.7,
+  "110201": 6.6,
+  "110210": 6.8,
+  "110211": 5.9,
+  "110220": 5.2,
+  "110221": 3,
+  "111000": 8.9,
+  "111001": 7.8,
+  "111010": 7.6,
+  "111011": 6.7,
+  "111020": 6.2,
+  "111021": 5.8,
+  "111100": 7.4,
+  "111101": 5.9,
+  "111110": 5.7,
+  "111111": 5.7,
+  "111120": 4.7,
+  "111121": 2.3,
+  "111200": 6.1,
+  "111201": 5.2,
+  "111210": 5.7,
+  "111211": 2.9,
+  "111220": 2.4,
+  "111221": 1.6,
+  "112001": 7.1,
+  "112011": 5.9,
+  "112021": 3,
+  "112101": 5.8,
+  "112111": 2.6,
+  "112121": 1.5,
+  "112201": 2.3,
+  "112211": 1.3,
+  "112221": 0.6,
+  "200000": 9.3,
+  "200001": 8.7,
+  "200010": 8.6,
+  "200011": 7.2,
+  "200020": 7.5,
+  "200021": 5.8,
+  "200100": 8.6,
+  "200101": 7.4,
+  "200110": 7.4,
+  "200111": 6.1,
+  "200120": 5.6,
+  "200121": 3.4,
+  "200200": 7,
+  "200201": 5.4,
+  "200210": 5.2,
+  "200211": 4,
+  "200220": 4,
+  "200221": 2.2,
+  "201000": 8.5,
+  "201001": 7.5,
+  "201010": 7.4,
+  "201011": 5.5,
+  "201020": 6.2,
+  "201021": 5.1,
+  "201100": 7.2,
+  "201101": 5.7,
+  "201110": 5.5,
+  "201111": 4.1,
+  "201120": 4.6,
+  "201121": 1.9,
+  "201200": 5.3,
+  "201201": 3.6,
+  "201210": 3.4,
+  "201211": 1.9,
+  "201220": 1.9,
+  "201221": 0.8,
+  "202001": 6.4,
+  "202011": 5.1,
+  "202021": 2,
+  "202101": 4.7,
+  "202111": 2.1,
+  "202121": 1.1,
+  "202201": 2.4,
+  "202211": 0.9,
+  "202221": 0.4,
+  "210000": 8.8,
+  "210001": 7.5,
+  "210010": 7.3,
+  "210011": 5.3,
+  "210020": 6,
+  "210021": 5,
+  "210100": 7.3,
+  "210101": 5.5,
+  "210110": 5.9,
+  "210111": 4,
+  "210120": 4.1,
+  "210121": 2,
+  "210200": 5.4,
+  "210201": 4.3,
+  "210210": 4.5,
+  "210211": 2.2,
+  "210220": 2,
+  "210221": 1.1,
+  "211000": 7.5,
+  "211001": 5.5,
+  "211010": 5.8,
+  "211011": 4.5,
+  "211020": 4,
+  "211021": 2.1,
+  "211100": 6.1,
+  "211101": 5.1,
+  "211110": 4.8,
+  "211111": 1.8,
+  "211120": 2,
+  "211121": 0.9,
+  "211200": 4.6,
+  "211201": 1.8,
+  "211210": 1.7,
+  "211211": 0.7,
+  "211220": 0.8,
+  "211221": 0.2,
+  "212001": 5.3,
+  "212011": 2.4,
+  "212021": 1.4,
+  "212101": 2.4,
+  "212111": 1.2,
+  "212121": 0.5,
+  "212201": 1,
+  "212211": 0.3,
+  "212221": 0.1
+};
+var CVSS40_MAX_COMPOSED = {
+  eq1: {
+    0: ["AV:N/PR:N/UI:N/"],
+    1: ["AV:A/PR:N/UI:N/", "AV:N/PR:L/UI:N/", "AV:N/PR:N/UI:P/"],
+    2: ["AV:P/PR:N/UI:N/", "AV:A/PR:L/UI:P/"]
+  },
+  eq2: {
+    0: ["AC:L/AT:N/"],
+    1: ["AC:H/AT:N/", "AC:L/AT:P/"]
+  },
+  eq3: {
+    0: { "0": ["VC:H/VI:H/VA:H/CR:H/IR:H/AR:H/"], "1": ["VC:H/VI:H/VA:L/CR:M/IR:M/AR:H/", "VC:H/VI:H/VA:H/CR:M/IR:M/AR:M/"] },
+    1: { "0": ["VC:L/VI:H/VA:H/CR:H/IR:H/AR:H/", "VC:H/VI:L/VA:H/CR:H/IR:H/AR:H/"], "1": ["VC:L/VI:H/VA:L/CR:H/IR:M/AR:H/", "VC:L/VI:H/VA:H/CR:H/IR:M/AR:M/", "VC:H/VI:L/VA:H/CR:M/IR:H/AR:M/", "VC:H/VI:L/VA:L/CR:M/IR:H/AR:H/", "VC:L/VI:L/VA:H/CR:H/IR:H/AR:M/"] },
+    2: { "1": ["VC:L/VI:L/VA:L/CR:H/IR:H/AR:H/"] }
+  },
+  eq4: {
+    0: ["SC:H/SI:S/SA:S/"],
+    1: ["SC:H/SI:H/SA:H/"],
+    2: ["SC:L/SI:L/SA:L/"]
+  },
+  eq5: {
+    0: ["E:A/"],
+    1: ["E:P/"],
+    2: ["E:U/"]
+  }
+};
+var CVSS40_MAX_SEVERITY = {
+  eq1: { 0: 1, 1: 4, 2: 5 },
+  eq2: { 0: 1, 1: 2 },
+  eq3eq6: { 0: { 0: 7, 1: 6 }, 1: { 0: 8, 1: 8 }, 2: { 1: 10 } },
+  eq4: { 0: 6, 1: 5, 2: 4 },
+  eq5: { 0: 1, 1: 1, 2: 1 }
+};
+function m4(sel, metric) {
+  const selected = sel[metric];
+  if (metric === "E" && (selected === void 0 || selected === "X"))
+    return "A";
+  if ((metric === "CR" || metric === "IR" || metric === "AR") && (selected === void 0 || selected === "X")) {
+    return "H";
+  }
+  const modified = sel["M" + metric];
+  if (modified !== void 0 && modified !== "X")
+    return modified;
+  return selected ?? "";
+}
+function cvss4MacroVector(sel) {
+  let eq1;
+  if (m4(sel, "AV") === "N" && m4(sel, "PR") === "N" && m4(sel, "UI") === "N") {
+    eq1 = "0";
+  } else if ((m4(sel, "AV") === "N" || m4(sel, "PR") === "N" || m4(sel, "UI") === "N") && !(m4(sel, "AV") === "N" && m4(sel, "PR") === "N" && m4(sel, "UI") === "N") && m4(sel, "AV") !== "P") {
+    eq1 = "1";
+  } else {
+    eq1 = "2";
+  }
+  const eq2 = m4(sel, "AC") === "L" && m4(sel, "AT") === "N" ? "0" : "1";
+  let eq3;
+  if (m4(sel, "VC") === "H" && m4(sel, "VI") === "H") {
+    eq3 = "0";
+  } else if (!(m4(sel, "VC") === "H" && m4(sel, "VI") === "H") && (m4(sel, "VC") === "H" || m4(sel, "VI") === "H" || m4(sel, "VA") === "H")) {
+    eq3 = "1";
+  } else {
+    eq3 = "2";
+  }
+  let eq4;
+  if (m4(sel, "MSI") === "S" || m4(sel, "MSA") === "S") {
+    eq4 = "0";
+  } else if (m4(sel, "SC") === "H" || m4(sel, "SI") === "H" || m4(sel, "SA") === "H") {
+    eq4 = "1";
+  } else {
+    eq4 = "2";
+  }
+  let eq5;
+  if (m4(sel, "E") === "A")
+    eq5 = "0";
+  else if (m4(sel, "E") === "P")
+    eq5 = "1";
+  else
+    eq5 = "2";
+  const eq6 = m4(sel, "CR") === "H" && m4(sel, "VC") === "H" || m4(sel, "IR") === "H" && m4(sel, "VI") === "H" || m4(sel, "AR") === "H" && m4(sel, "VA") === "H" ? "0" : "1";
+  return eq1 + eq2 + eq3 + eq4 + eq5 + eq6;
+}
+function cvss4EqMaxes(macro, eq) {
+  const idx = Number(macro[eq - 1]);
+  if (eq === 1)
+    return CVSS40_MAX_COMPOSED.eq1[idx];
+  if (eq === 2)
+    return CVSS40_MAX_COMPOSED.eq2[idx];
+  if (eq === 4)
+    return CVSS40_MAX_COMPOSED.eq4[idx];
+  return CVSS40_MAX_COMPOSED.eq5[idx];
+}
+function extractValueMetric(metric, str) {
+  const start = str.indexOf(metric) + metric.length + 1;
+  const extracted = str.slice(start);
+  const slash = extracted.indexOf("/");
+  return slash > 0 ? extracted.substring(0, slash) : extracted;
+}
+function computeCvss4BaseScore(sel) {
+  if (["VC", "VI", "VA", "SC", "SI", "SA"].every((metric) => m4(sel, metric) === "N")) {
+    return 0;
+  }
+  const macroVectorResult = cvss4MacroVector(sel);
+  let value = CVSS40_LOOKUP[macroVectorResult];
+  const eq1 = parseInt(macroVectorResult[0], 10);
+  const eq2 = parseInt(macroVectorResult[1], 10);
+  const eq3 = parseInt(macroVectorResult[2], 10);
+  const eq4 = parseInt(macroVectorResult[3], 10);
+  const eq5 = parseInt(macroVectorResult[4], 10);
+  const eq6 = parseInt(macroVectorResult[5], 10);
+  const eq1_next_lower_macro = `${eq1 + 1}${eq2}${eq3}${eq4}${eq5}${eq6}`;
+  const eq2_next_lower_macro = `${eq1}${eq2 + 1}${eq3}${eq4}${eq5}${eq6}`;
+  let eq3eq6_next_lower_macro = "";
+  let eq3eq6_next_lower_macro_left = "";
+  let eq3eq6_next_lower_macro_right = "";
+  if (eq3 === 1 && eq6 === 1) {
+    eq3eq6_next_lower_macro = `${eq1}${eq2}${eq3 + 1}${eq4}${eq5}${eq6}`;
+  } else if (eq3 === 0 && eq6 === 1) {
+    eq3eq6_next_lower_macro = `${eq1}${eq2}${eq3 + 1}${eq4}${eq5}${eq6}`;
+  } else if (eq3 === 1 && eq6 === 0) {
+    eq3eq6_next_lower_macro = `${eq1}${eq2}${eq3}${eq4}${eq5}${eq6 + 1}`;
+  } else if (eq3 === 0 && eq6 === 0) {
+    eq3eq6_next_lower_macro_left = `${eq1}${eq2}${eq3}${eq4}${eq5}${eq6 + 1}`;
+    eq3eq6_next_lower_macro_right = `${eq1}${eq2}${eq3 + 1}${eq4}${eq5}${eq6}`;
+  } else {
+    eq3eq6_next_lower_macro = `${eq1}${eq2}${eq3 + 1}${eq4}${eq5}${eq6 + 1}`;
+  }
+  const eq4_next_lower_macro = `${eq1}${eq2}${eq3}${eq4 + 1}${eq5}${eq6}`;
+  const eq5_next_lower_macro = `${eq1}${eq2}${eq3}${eq4}${eq5 + 1}${eq6}`;
+  const score_eq1_next_lower_macro = CVSS40_LOOKUP[eq1_next_lower_macro];
+  const score_eq2_next_lower_macro = CVSS40_LOOKUP[eq2_next_lower_macro];
+  let score_eq3eq6_next_lower_macro;
+  if (eq3 === 0 && eq6 === 0) {
+    const left = CVSS40_LOOKUP[eq3eq6_next_lower_macro_left];
+    const right = CVSS40_LOOKUP[eq3eq6_next_lower_macro_right];
+    score_eq3eq6_next_lower_macro = left > right ? left : right;
+  } else {
+    score_eq3eq6_next_lower_macro = CVSS40_LOOKUP[eq3eq6_next_lower_macro];
+  }
+  const score_eq4_next_lower_macro = CVSS40_LOOKUP[eq4_next_lower_macro];
+  const score_eq5_next_lower_macro = CVSS40_LOOKUP[eq5_next_lower_macro];
+  const eq1_maxes = cvss4EqMaxes(macroVectorResult, 1);
+  const eq2_maxes = cvss4EqMaxes(macroVectorResult, 2);
+  const eq3_eq6_maxes = CVSS40_MAX_COMPOSED.eq3[eq3][macroVectorResult[5]];
+  const eq4_maxes = cvss4EqMaxes(macroVectorResult, 4);
+  const eq5_maxes = cvss4EqMaxes(macroVectorResult, 5);
+  const max_vectors = [];
+  for (const a of eq1_maxes)
+    for (const b of eq2_maxes)
+      for (const c of eq3_eq6_maxes)
+        for (const d of eq4_maxes)
+          for (const e of eq5_maxes)
+            max_vectors.push(a + b + c + d + e);
+  let severity_distance_AV = 0, severity_distance_PR = 0, severity_distance_UI = 0;
+  let severity_distance_AC = 0, severity_distance_AT = 0;
+  let severity_distance_VC = 0, severity_distance_VI = 0, severity_distance_VA = 0;
+  let severity_distance_SC = 0, severity_distance_SI = 0, severity_distance_SA = 0;
+  let severity_distance_CR = 0, severity_distance_IR = 0, severity_distance_AR = 0;
+  for (const max_vector of max_vectors) {
+    severity_distance_AV = AV_levels[m4(sel, "AV")] - AV_levels[extractValueMetric("AV", max_vector)];
+    severity_distance_PR = PR_levels[m4(sel, "PR")] - PR_levels[extractValueMetric("PR", max_vector)];
+    severity_distance_UI = UI_levels[m4(sel, "UI")] - UI_levels[extractValueMetric("UI", max_vector)];
+    severity_distance_AC = AC_levels[m4(sel, "AC")] - AC_levels[extractValueMetric("AC", max_vector)];
+    severity_distance_AT = AT_levels[m4(sel, "AT")] - AT_levels[extractValueMetric("AT", max_vector)];
+    severity_distance_VC = VC_levels[m4(sel, "VC")] - VC_levels[extractValueMetric("VC", max_vector)];
+    severity_distance_VI = VI_levels[m4(sel, "VI")] - VI_levels[extractValueMetric("VI", max_vector)];
+    severity_distance_VA = VA_levels[m4(sel, "VA")] - VA_levels[extractValueMetric("VA", max_vector)];
+    severity_distance_SC = SC_levels[m4(sel, "SC")] - SC_levels[extractValueMetric("SC", max_vector)];
+    severity_distance_SI = SI_levels[m4(sel, "SI")] - SI_levels[extractValueMetric("SI", max_vector)];
+    severity_distance_SA = SA_levels[m4(sel, "SA")] - SA_levels[extractValueMetric("SA", max_vector)];
+    severity_distance_CR = CR_levels[m4(sel, "CR")] - CR_levels[extractValueMetric("CR", max_vector)];
+    severity_distance_IR = IR_levels[m4(sel, "IR")] - IR_levels[extractValueMetric("IR", max_vector)];
+    severity_distance_AR = AR_levels[m4(sel, "AR")] - AR_levels[extractValueMetric("AR", max_vector)];
+    const anyNegative = [
+      severity_distance_AV,
+      severity_distance_PR,
+      severity_distance_UI,
+      severity_distance_AC,
+      severity_distance_AT,
+      severity_distance_VC,
+      severity_distance_VI,
+      severity_distance_VA,
+      severity_distance_SC,
+      severity_distance_SI,
+      severity_distance_SA,
+      severity_distance_CR,
+      severity_distance_IR,
+      severity_distance_AR
+    ].some((v) => v < 0);
+    if (anyNegative)
+      continue;
+    break;
+  }
+  const current_severity_distance_eq1 = severity_distance_AV + severity_distance_PR + severity_distance_UI;
+  const current_severity_distance_eq2 = severity_distance_AC + severity_distance_AT;
+  const current_severity_distance_eq3eq6 = severity_distance_VC + severity_distance_VI + severity_distance_VA + severity_distance_CR + severity_distance_IR + severity_distance_AR;
+  const current_severity_distance_eq4 = severity_distance_SC + severity_distance_SI + severity_distance_SA;
+  const step = 0.1;
+  const available_distance_eq1 = value - score_eq1_next_lower_macro;
+  const available_distance_eq2 = value - score_eq2_next_lower_macro;
+  const available_distance_eq3eq6 = value - score_eq3eq6_next_lower_macro;
+  const available_distance_eq4 = value - score_eq4_next_lower_macro;
+  const available_distance_eq5 = value - score_eq5_next_lower_macro;
+  let n_existing_lower = 0;
+  let normalized_severity_eq1 = 0;
+  let normalized_severity_eq2 = 0;
+  let normalized_severity_eq3eq6 = 0;
+  let normalized_severity_eq4 = 0;
+  let normalized_severity_eq5 = 0;
+  const maxSeverity_eq1 = CVSS40_MAX_SEVERITY.eq1[eq1] * step;
+  const maxSeverity_eq2 = CVSS40_MAX_SEVERITY.eq2[eq2] * step;
+  const maxSeverity_eq3eq6 = CVSS40_MAX_SEVERITY.eq3eq6[eq3][eq6] * step;
+  const maxSeverity_eq4 = CVSS40_MAX_SEVERITY.eq4[eq4] * step;
+  if (!Number.isNaN(available_distance_eq1)) {
+    n_existing_lower += 1;
+    normalized_severity_eq1 = available_distance_eq1 * (current_severity_distance_eq1 / maxSeverity_eq1);
+  }
+  if (!Number.isNaN(available_distance_eq2)) {
+    n_existing_lower += 1;
+    normalized_severity_eq2 = available_distance_eq2 * (current_severity_distance_eq2 / maxSeverity_eq2);
+  }
+  if (!Number.isNaN(available_distance_eq3eq6)) {
+    n_existing_lower += 1;
+    normalized_severity_eq3eq6 = available_distance_eq3eq6 * (current_severity_distance_eq3eq6 / maxSeverity_eq3eq6);
+  }
+  if (!Number.isNaN(available_distance_eq4)) {
+    n_existing_lower += 1;
+    normalized_severity_eq4 = available_distance_eq4 * (current_severity_distance_eq4 / maxSeverity_eq4);
+  }
+  if (!Number.isNaN(available_distance_eq5)) {
+    n_existing_lower += 1;
+    normalized_severity_eq5 = available_distance_eq5 * 0;
+  }
+  let mean_distance;
+  if (n_existing_lower === 0) {
+    mean_distance = 0;
+  } else {
+    mean_distance = (normalized_severity_eq1 + normalized_severity_eq2 + normalized_severity_eq3eq6 + normalized_severity_eq4 + normalized_severity_eq5) / n_existing_lower;
+  }
+  value -= mean_distance;
+  if (value < 0)
+    value = 0;
+  if (value > 10)
+    value = 10;
+  return Math.round(value * 10) / 10;
+}
+function cvss4Severity(score) {
+  if (score <= 0)
+    return "None";
+  if (score < 4)
+    return "Low";
+  if (score < 7)
+    return "Medium";
+  if (score < 9)
+    return "High";
+  return "Critical";
+}
+var CVSS4_METRIC_ORDER = [
+  "AV",
+  "AC",
+  "AT",
+  "PR",
+  "UI",
+  "VC",
+  "VI",
+  "VA",
+  "SC",
+  "SI",
+  "SA",
+  "E",
+  "CR",
+  "IR",
+  "AR",
+  "MAV",
+  "MAC",
+  "MAT",
+  "MPR",
+  "MUI",
+  "MVC",
+  "MVI",
+  "MVA",
+  "MSC",
+  "MSI",
+  "MSA",
+  "S",
+  "AU",
+  "R",
+  "V",
+  "RE",
+  "U"
+];
+function parseCvss4Vector(vector) {
+  const trimmed = vector.trim();
+  if (!trimmed.startsWith("CVSS:4.0/")) {
+    throw new Cvss4ParseError(`Not a CVSS 4.0 vector (must start with "CVSS:4.0/"): ${vector}`);
+  }
+  const body = trimmed.slice("CVSS:4.0/".length);
+  const parts = body.split("/").filter((p) => p.length > 0);
+  if (parts.length === 0) {
+    throw new Cvss4ParseError(`CVSS 4.0 vector has no metrics: ${vector}`);
+  }
+  const sel = {};
+  for (const part of parts) {
+    const eq = part.indexOf(":");
+    if (eq < 0)
+      throw new Cvss4ParseError(`Malformed metric segment "${part}" in ${vector}`);
+    const key = part.slice(0, eq);
+    const val = part.slice(eq + 1);
+    const allowed = CVSS4_ALLOWED[key];
+    if (!allowed)
+      throw new Cvss4ParseError(`Unknown CVSS 4.0 metric "${key}" in ${vector}`);
+    if (!allowed.has(val)) {
+      throw new Cvss4ParseError(`Illegal value "${val}" for metric "${key}" in ${vector}`);
+    }
+    if (key in sel)
+      throw new Cvss4ParseError(`Duplicate metric "${key}" in ${vector}`);
+    sel[key] = val;
+  }
+  for (const base of CVSS4_BASE_KEYS) {
+    if (!(base in sel)) {
+      throw new Cvss4ParseError(`Missing mandatory base metric "${base}" in ${vector}`);
+    }
+  }
+  return sel;
+}
+function formatCvss4Vector(sel) {
+  const segs = [];
+  for (const key of CVSS4_METRIC_ORDER) {
+    const v = sel[key];
+    if (v !== void 0 && v !== "X")
+      segs.push(`${key}:${v}`);
+  }
+  return `CVSS:4.0/${segs.join("/")}`;
+}
+function scoreCvss4Vector(vector) {
+  const sel = parseCvss4Vector(vector);
+  const score = computeCvss4BaseScore(sel);
+  return {
+    vector: formatCvss4Vector(sel),
+    score,
+    severity: cvss4Severity(score),
+    macroVector: cvss4MacroVector(sel)
+  };
+}
+function cvss4MetricsForReachability(tier) {
+  switch (tier) {
+    case "remote-unauth":
+      return { AV: "N", AT: "N", PR: "N", UI: "N" };
+    case "remote-auth":
+      return { AV: "N", AT: "N", PR: "L", UI: "N" };
+    case "proximity-rf":
+      return { AV: "A", AT: "N", PR: "N", UI: "N" };
+    case "local-unpriv":
+      return { AV: "L", AT: "N", PR: "L", UI: "N" };
+    case "local-priv":
+      return { AV: "L", AT: "N", PR: "H", UI: "N" };
+    case "needs-hardware":
+      return { AV: "P", AT: "N", PR: "N", UI: "N" };
+    case "needs-host-migration":
+      return { AV: "L", AT: "N", PR: "N", UI: "A" };
+  }
+}
+function suggestCvss4(finding) {
+  const impact = IMPACT_BY_CATEGORY[finding.category] ?? { C: "L", I: "L", A: "L", scope: "U" };
+  const assessed = finding.impactAssessment ? cvss4MetricsForReachability(finding.impactAssessment.reachability_tier) : void 0;
+  const AV = assessed?.AV ?? "N";
+  const AT = assessed?.AT ?? "N";
+  const pr31 = assessed ? assessed.PR : prForSeverity(finding.severity);
+  const UI = assessed?.UI ?? "N";
+  const subsequent = impact.scope === "C";
+  const sel = {
+    AV,
+    AC: "L",
+    AT,
+    PR: pr31,
+    UI,
+    VC: impact.C,
+    VI: impact.I,
+    VA: impact.A,
+    SC: subsequent ? impact.C : "N",
+    SI: subsequent ? impact.I : "N",
+    SA: subsequent ? impact.A : "N"
+  };
+  const score = computeCvss4BaseScore(sel);
+  return {
+    vector: formatCvss4Vector(sel),
+    score,
+    severity: cvss4Severity(score),
+    source: assessed ? "impact-assessment" : "heuristic"
+  };
+}
+function renderCvssSection(opts) {
+  const version = opts.vector.startsWith("CVSS:4.0/") ? "4.0" : opts.vector.startsWith("CVSS:3.1/") ? "3.1" : opts.vector.startsWith("CVSS:3.0/") ? "3.0" : void 0;
+  const label = version ? `CVSS ${version}` : "CVSS";
+  const rating = opts.severity ? ` (${opts.severity})` : "";
+  return `**${label}: ${opts.score.toFixed(1)}${rating}** \u2014 \`${opts.vector}\``;
+}
+
+// packages/core/dist/disclose/canary.js
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { resolve, join } from "node:path";
+function extractFileRefs(finding) {
+  const haystack = [
+    finding.description,
+    finding.evidence?.analysis,
+    finding.evidence?.request,
+    finding.evidence?.response
+  ].filter((s) => typeof s === "string" && s.length > 0).join("\n\n");
+  const seen = /* @__PURE__ */ new Map();
+  const regex = /(?<![\w/\-:])([a-zA-Z0-9_./\-]+\.(?:ts|tsx|js|jsx|mjs|cjs|py|rb|go|rs|c|h|cc|cpp|java|kt|swift|php|sh|sql))(?::(\d+)(?:-\d+)?)?/g;
+  let match;
+  while ((match = regex.exec(haystack)) !== null) {
+    const file = match[1];
+    const line = match[2] ? Number(match[2]) : void 0;
+    if (file.startsWith("http:") || file.startsWith("https:"))
+      continue;
+    const key = `${file}:${line ?? ""}`;
+    if (!seen.has(key))
+      seen.set(key, { file, line });
+  }
+  return Array.from(seen.values());
+}
+function gitCmd(repoPath, args) {
+  try {
+    return execFileSync("git", args, { cwd: repoPath, stdio: ["ignore", "pipe", "pipe"], encoding: "utf8" });
+  } catch {
+    return null;
+  }
+}
+function verifyAgainstRef(finding, options) {
+  const refs = extractFileRefs(finding);
+  const repoPath = resolve(options.repoPath);
+  if (options.checkout && options.ref) {
+    gitCmd(repoPath, ["checkout", "-q", options.ref]);
+  }
+  const currentRef = options.ref ?? gitCmd(repoPath, ["rev-parse", "--abbrev-ref", "HEAD"])?.trim() ?? gitCmd(repoPath, ["rev-parse", "--short", "HEAD"])?.trim() ?? "HEAD";
+  if (refs.length === 0) {
+    return {
+      status: "unknown",
+      ref: currentRef,
+      notes: ["Could not extract any file:line references from the finding. Consider adding `server/src/.../file.ts:NNN` style citations to the description before re-running."],
+      refsChecked: [],
+      refsStillPresent: [],
+      refsMissing: []
+    };
+  }
+  const notes = [];
+  const refsStillPresent = [];
+  const refsMissing = [];
+  for (const ref of refs) {
+    const abs = join(repoPath, ref.file);
+    if (!existsSync(abs)) {
+      refsMissing.push(ref);
+      notes.push(`${ref.file} \u2014 file does not exist at ${currentRef}.`);
+      continue;
+    }
+    if (ref.line !== void 0) {
+      try {
+        const content = readFileSync(abs, "utf8").split("\n");
+        if (ref.line > content.length) {
+          refsMissing.push(ref);
+          notes.push(`${ref.file}:${ref.line} \u2014 line is out of range (file has ${content.length} lines at ${currentRef}).`);
+          continue;
+        }
+      } catch {
+      }
+    }
+    refsStillPresent.push(ref);
+  }
+  let status;
+  if (refsStillPresent.length === 0) {
+    status = refsMissing.some((r) => !existsSync(join(repoPath, r.file))) ? "file-removed" : "fixed";
+  } else if (refsMissing.length === 0) {
+    status = "still-vulnerable";
+  } else {
+    status = "partial-fix";
+  }
+  if (status === "still-vulnerable") {
+    notes.unshift(`All ${refsStillPresent.length} cited file${refsStillPresent.length === 1 ? "" : "s"} still resolve at ${currentRef}. Status is conservative \u2014 a human should confirm the *shape* of the code at each line hasn't been patched.`);
+  }
+  return {
+    status,
+    ref: currentRef,
+    notes,
+    refsChecked: refs,
+    refsStillPresent,
+    refsMissing
+  };
+}
+function refsMatch(a, b) {
+  return a.file === b.file && a.line === b.line;
+}
+function formatPatchStatusSection(result) {
+  const banner = {
+    "still-vulnerable": `**Still vulnerable** on \`${result.ref}\`.`,
+    "partial-fix": `**Partial fix** on \`${result.ref}\` \u2014 some cited references changed, others remain.`,
+    "fixed": `**Fixed** on \`${result.ref}\`. All cited references have been edited or removed upstream.`,
+    "file-removed": `**Vulnerable file removed** on \`${result.ref}\`. The affected path no longer exists in the tree.`,
+    "unknown": `**Could not auto-verify** against \`${result.ref}\`. No machine-checkable references were extractable from the finding.`
+  };
+  const lines = [];
+  lines.push(banner[result.status]);
+  if (result.refsChecked.length > 0) {
+    lines.push("");
+    lines.push(`Refs checked (${result.refsChecked.length}):`);
+    for (const ref of result.refsChecked) {
+      const present = result.refsStillPresent.some((r) => refsMatch(r, ref));
+      const marker = present ? "\u2713" : "\u2717";
+      lines.push(`- ${marker} \`${ref.file}${ref.line ? `:${ref.line}` : ""}\``);
+    }
+  }
+  if (result.notes.length > 0) {
+    lines.push("");
+    for (const note of result.notes)
+      lines.push(`> ${note}`);
+  }
+  return lines.join("\n");
+}
+
+// packages/core/dist/disclose/version-range.js
+import { execFileSync as execFileSync2 } from "node:child_process";
+import { resolve as resolve2 } from "node:path";
+function gitCmd2(repoPath, args) {
+  try {
+    return execFileSync2("git", args, {
+      cwd: repoPath,
+      stdio: ["ignore", "pipe", "pipe"],
+      encoding: "utf8",
+      maxBuffer: 4 * 1024 * 1024
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function listTags(repoPath, limit, glob) {
+  const baseArgs = ["tag"];
+  if (glob)
+    baseArgs.push("-l", glob);
+  const byVersion = gitCmd2(repoPath, [...baseArgs, "--sort=-v:refname"]);
+  if (byVersion && byVersion.length > 0) {
+    return byVersion.split("\n").filter(Boolean).slice(0, limit);
+  }
+  const byDate = gitCmd2(repoPath, [...baseArgs, "--sort=-creatordate"]);
+  if (!byDate)
+    return [];
+  return byDate.split("\n").filter(Boolean).slice(0, limit);
+}
+function fileExistsAtRef(repoPath, ref, filePath) {
+  const out = gitCmd2(repoPath, ["cat-file", "-e", `${ref}:${filePath}`]);
+  return out !== null;
+}
+function lineExistsAtRef(repoPath, ref, filePath, line) {
+  const content = gitCmd2(repoPath, ["show", `${ref}:${filePath}`]);
+  if (content === null)
+    return false;
+  const lineCount = content.split("\n").length;
+  return line <= lineCount;
+}
+function findingPresentAtRef(repoPath, ref, refs) {
+  if (refs.length === 0)
+    return false;
+  for (const r of refs) {
+    if (!fileExistsAtRef(repoPath, ref, r.file))
+      return false;
+    if (r.line !== void 0 && !lineExistsAtRef(repoPath, ref, r.file, r.line))
+      return false;
+  }
+  return true;
+}
+function detectVersionRange(finding, options) {
+  const repoPath = resolve2(options.repoPath);
+  const tagLimit = options.tagLimit ?? 30;
+  const refs = extractFileRefs(finding);
+  const notes = [];
+  if (refs.length === 0) {
+    return {
+      affectedTags: [],
+      presentOnHead: false,
+      status: "indeterminate",
+      notes: ["Could not extract file:line references from the finding. Add explicit `path/to/file.ts:NNN` citations to the description and re-run."]
+    };
+  }
+  const tags = listTags(repoPath, tagLimit, options.tagGlob);
+  const presentOnHead = findingPresentAtRef(repoPath, "HEAD", refs);
+  if (tags.length === 0) {
+    notes.push(`No tags found in ${repoPath}${options.tagGlob ? ` matching '${options.tagGlob}'` : ""}.`);
+    return {
+      affectedTags: [],
+      presentOnHead,
+      status: "no-tags",
+      notes
+    };
+  }
+  const classified = tags.map((tag) => ({
+    tag,
+    present: findingPresentAtRef(repoPath, tag, refs)
+  }));
+  const affectedTags = classified.filter((c) => c.present).map((c) => c.tag);
+  const introducedIn = affectedTags[affectedTags.length - 1];
+  let fixedIn;
+  const firstPresentIdx = classified.findIndex((c) => c.present);
+  if (firstPresentIdx > 0) {
+    fixedIn = classified[firstPresentIdx - 1]?.tag;
+  }
+  let status;
+  if (presentOnHead)
+    status = "present-on-head";
+  else if (affectedTags.length > 0)
+    status = "removed-upstream";
+  else
+    status = "indeterminate";
+  if (affectedTags.length === tagLimit) {
+    notes.push(`Hit the ${tagLimit}-tag walk limit \u2014 the introducing tag may be older than reported. Pass --tag-limit to extend.`);
+  }
+  return {
+    affectedTags,
+    introducedIn,
+    fixedIn,
+    presentOnHead,
+    status,
+    notes
+  };
+}
+function formatVersionRangeLine(result) {
+  switch (result.status) {
+    case "present-on-head":
+      if (result.introducedIn) {
+        return `\`>= ${result.introducedIn}\`, including the repo's current \`HEAD\`. Confirmed on: ${result.affectedTags.map((t) => "`" + t + "`").join(", ")}.`;
+      }
+      return "Present on the repo's current `HEAD` (no tagged introduction point detected).";
+    case "removed-upstream":
+      if (result.introducedIn && result.fixedIn) {
+        return `\`>= ${result.introducedIn}\`, \`< ${result.fixedIn}\`. Confirmed affected: ${result.affectedTags.map((t) => "`" + t + "`").join(", ")}. Fixed from \`${result.fixedIn}\` onward.`;
+      }
+      if (result.introducedIn) {
+        return `\`>= ${result.introducedIn}\`. Confirmed affected: ${result.affectedTags.map((t) => "`" + t + "`").join(", ")}. Fixed upstream at HEAD.`;
+      }
+      return "Removed upstream since the last release.";
+    case "no-tags":
+      return "_No release tags available in the target repo to infer a range._";
+    case "indeterminate":
+    default:
+      return "_Could not auto-detect a version range \u2014 add file:line citations to the finding and re-run._";
+  }
+}
+
+// packages/core/dist/disclose/template.js
+var EmptyPocError = class extends Error {
+  findingId;
+  constructor(findingId) {
+    super(`Finding ${findingId} has no PoC content (pocSteps, evidence, or screenshots) \u2014 refusing to render advisory.`);
+    this.name = "EmptyPocError";
+    this.findingId = findingId;
+  }
+};
+var SENSITIVE_HEADER_NAMES = /* @__PURE__ */ new Set([
+  "authorization",
+  "proxy-authorization",
+  "cookie",
+  "set-cookie",
+  "x-auth-token",
+  "x-api-key",
+  "x-csrf-token",
+  "x-xsrf-token"
+]);
+var AWS_KEY_RE = /\bAKIA[0-9A-Z]{16}\b/g;
+var JWT_RE = /\b[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+={0,2}\b/g;
+var INLINE_BEARER_RE = /\b(Bearer)\s+([^\s"'`]+)/gi;
+var INLINE_CURL_HEADER_RE = /(-H|--header)(\s+|=)(["']?)([A-Za-z][A-Za-z0-9-]*)\s*:\s*([^"'\n]*)\3/gi;
+function redactSensitiveHeaders(text) {
+  if (!text)
+    return text;
+  let out = redactAuthHeaders(text);
+  out = out.replace(AWS_KEY_RE, "<REDACTED-AWS-KEY>");
+  out = out.replace(JWT_RE, (match) => {
+    if (match.length < 80)
+      return match;
+    return "<REDACTED-JWT>";
+  });
+  return out;
+}
+function redactAuthHeaders(text) {
+  if (!text)
+    return text;
+  const lines = text.split("\n");
+  const redactedLines = lines.map((line) => {
+    const m = /^(\s*)([A-Za-z][A-Za-z0-9-]*)\s*:\s*(.*)$/.exec(line);
+    if (m && SENSITIVE_HEADER_NAMES.has(m[2].toLowerCase())) {
+      return `${m[1]}${m[2]}: <REDACTED-${m[2]}>`;
+    }
+    return line;
+  });
+  let out = redactedLines.join("\n");
+  out = out.replace(INLINE_CURL_HEADER_RE, (match, flag, sep, quote, name, _value) => {
+    if (!SENSITIVE_HEADER_NAMES.has(name.toLowerCase()))
+      return match;
+    return `${flag}${sep}${quote}${name}: <REDACTED-${name}>${quote}`;
+  });
+  return out.replace(INLINE_BEARER_RE, "$1 <REDACTED-Bearer>");
+}
+function reachabilityLabel(tier) {
+  switch (tier) {
+    case "remote-unauth":
+      return "remote, unauthenticated \u2014 reachable over the network with no credentials";
+    case "remote-auth":
+      return "remote, authenticated \u2014 requires an account or contributor access";
+    case "proximity-rf":
+      return "RF/physical proximity \u2014 attacker must be within radio range (NFC/BLE/Wi-Fi)";
+    case "local-unpriv":
+      return "local, unprivileged \u2014 requires an unprivileged account on the host";
+    case "local-priv":
+      return "local, privileged \u2014 requires an already-privileged local account";
+    case "needs-hardware":
+      return "requires specific or attacker-supplied hardware";
+    case "needs-host-migration":
+      return "requires the victim to mount/import an attacker-supplied artifact";
+  }
+}
+function weaponizabilityLabel(w) {
+  switch (w) {
+    case "rce":
+      return "remote code execution";
+    case "lpe-to-root":
+      return "local privilege escalation to root/SYSTEM";
+    case "integrity-tampering":
+      return "workflow integrity manipulation";
+    case "info-leak":
+      return "information disclosure";
+    case "dos-crash":
+      return "denial of service (crash)";
+  }
+}
+function severityHeading(severity) {
+  const upper = severity.toUpperCase();
+  return upper === "CRITICAL" || upper === "HIGH" || upper === "MEDIUM" || upper === "LOW" ? upper : severity;
+}
+function slugifyTitle(title, max = 80) {
+  return title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, max);
+}
+function indentEvidenceBlock(raw, lang = "") {
+  const trimmed = raw.trim();
+  if (!trimmed)
+    return "";
+  return "```" + lang + "\n" + trimmed + "\n```";
+}
+function renderPocSteps(finding) {
+  if (!finding.pocSteps || finding.pocSteps.length === 0)
+    return [];
+  const lines = ["**Step graph:**", ""];
+  for (const [index, step] of finding.pocSteps.entries()) {
+    lines.push(`${index + 1}. **${step.kind}** \u2014 ${step.summary} _(id: \`${step.id}\`)_`);
+    if (step.action.type === "shell") {
+      lines.push("", indentEvidenceBlock(step.action.cmd, "bash"));
+    } else if (step.action.type === "http") {
+      const method = step.action.method.toUpperCase();
+      lines.push("", indentEvidenceBlock(`${method} ${step.action.url}${step.action.body ? `
+
+${step.action.body}` : ""}`, "http"));
+    } else if (step.action.type === "docker") {
+      lines.push("", indentEvidenceBlock(`docker run ${step.action.image} ${step.action.args.join(" ")}`.trim(), "bash"));
+    } else {
+      lines.push("", step.action.text);
+    }
+    if (step.expect) {
+      lines.push("", `Expected result: \`${step.expect.type}\``);
+    }
+    lines.push("");
+  }
+  return lines;
+}
+function renderAdvisoryMarkdown(finding, ctx = {}) {
+  const cwes = suggestCwesForCategory(finding.category);
+  const cvss = suggestCvss(finding);
+  const severity = severityHeading(finding.severity);
+  const rank = { critical: "1", high: "2", medium: "3", low: "4", info: "5" };
+  const filenameSlug = slugifyTitle(finding.title);
+  const filename = `${rank[finding.severity] ?? "9"}-${finding.severity}-${filenameSlug}.md`;
+  let affectedLine;
+  if (ctx.versionRange) {
+    affectedLine = formatVersionRangeLine(ctx.versionRange);
+  } else if (ctx.target) {
+    affectedLine = `\`${ctx.target}\`${ctx.targetRef ? ` at \`${ctx.targetRef}\`` : ""}${ctx.commitHash ? ` (commit \`${ctx.commitHash.slice(0, 12)}\`)` : ""}`;
+  } else {
+    affectedLine = "_Pass `--repo <path>` to `@0/cli disclose` to auto-detect the affected version range from git tags._";
+  }
+  const cvssSource = cvss.source === "finding" ? "populated on the finding by 0" : cvss.source === "impact-assessment" ? "exploitability metrics derived from 0's reachability assessment; impact from category \u2014 verify against your deployment" : "heuristic from category + severity \u2014 override in the GHSA editor if the operator disagrees";
+  const remediation = finding.remediation;
+  const suggestedFixParts = [];
+  if (remediation?.summary)
+    suggestedFixParts.push(remediation.summary);
+  if (remediation?.steps?.length) {
+    suggestedFixParts.push(remediation.steps.map((step, i) => `${i + 1}. ${step}`).join("\n"));
+  }
+  if (remediation?.codeExample?.after) {
+    const lang = remediation.codeExample.language || "";
+    suggestedFixParts.push(remediation.codeExample.before ? `**Before:**
+
+\`\`\`${lang}
+${remediation.codeExample.before}
+\`\`\`
+
+**After:**
+
+\`\`\`${lang}
+${remediation.codeExample.after}
+\`\`\`` : `\`\`\`${lang}
+${remediation.codeExample.after}
+\`\`\``);
+  } else if (ctx.siblingFix) {
+    const ref = `${ctx.siblingFix.fileRef.file}${ctx.siblingFix.fileRef.line ? `:${ctx.siblingFix.fileRef.line}` : ""}`;
+    suggestedFixParts.push(`**Correct pattern already present in the repo at \`${ref}\`** *(extracted by 0):*
+
+\`\`\`${ctx.siblingFix.language}
+${ctx.siblingFix.snippet}
+\`\`\``);
+  }
+  const suggestedFix = suggestedFixParts.length > 0 ? suggestedFixParts.join("\n\n") : "_To fill in: copy-paste the correct pattern from a sibling handler in the same repo._";
+  const evidenceAnalysis = finding.evidence?.analysis?.trim() ?? "";
+  const out = [];
+  out.push("# Title", "");
+  out.push(finding.title, "");
+  out.push("# Severity", "");
+  out.push(`**${severity}** \u2014 ${cvss.vector} (~${cvss.score.toFixed(1)})`, "");
+  out.push(`_CVSS source: ${cvssSource}._`, "");
+  const impactAssessment = finding.impactAssessment;
+  if (impactAssessment) {
+    out.push("# Impact", "");
+    out.push(`**Attacker gains:** ${weaponizabilityLabel(impactAssessment.weaponizability)}`, "");
+    out.push(`**Attack prerequisites:** ${reachabilityLabel(impactAssessment.reachability_tier)}`, "");
+    if (impactAssessment.blast_radius) {
+      out.push(`**Blast radius:** ${impactAssessment.blast_radius}`, "");
+    }
+    if (impactAssessment.rationale) {
+      out.push(`_${impactAssessment.rationale}_`, "");
+    }
+  }
+  out.push(formatCweSection(cwes), "");
+  out.push("# Affected versions", "");
+  out.push(affectedLine, "");
+  if (ctx.osecVersion || ctx.scanId) {
+    const bits = [];
+    if (ctx.osecVersion)
+      bits.push(`0 \`${ctx.osecVersion}\``);
+    if (ctx.scanId)
+      bits.push(`scan \`${ctx.scanId.slice(0, 8)}\``);
+    const canaryPositive = ctx.patchStatus?.status === "still-vulnerable";
+    const behaviouralPositive = ctx.pocExecution?.overallVerdict === "exploit_still_works";
+    if (canaryPositive && behaviouralPositive) {
+      out.push(`> Code-verified by ${bits.join(", ")}.`, "");
+    } else {
+      out.push(`_Generated by ${bits.join(", ")}._`, "");
+    }
+  }
+  out.push("## Summary", "");
+  out.push(finding.description.trim(), "");
+  if (evidenceAnalysis && evidenceAnalysis !== finding.description.trim()) {
+    out.push("## Analysis", "");
+    out.push(evidenceAnalysis, "");
+  }
+  const pocStepsBlock = renderPocSteps(finding);
+  const hasRequest = !!finding.evidence?.request?.trim();
+  const hasResponse = !!finding.evidence?.response?.trim();
+  const hasScreenshots = !!ctx.screenshots && ctx.screenshots.length > 0;
+  if (pocStepsBlock.length === 0 && !hasRequest && !hasResponse && !hasScreenshots) {
+    throw new EmptyPocError(finding.id);
+  }
+  out.push("## PoC", "");
+  if (pocStepsBlock.length > 0) {
+    const redactedSteps = redactSensitiveHeaders(pocStepsBlock.join("\n")).split("\n");
+    out.push(...redactedSteps);
+  }
+  if (hasScreenshots) {
+    for (const shot of ctx.screenshots) {
+      const width = shot.width ? ` width="${shot.width}"` : "";
+      out.push(`<img${width} alt="${shot.alt}" src="${shot.relativePath}" />`, "");
+      if (shot.caption) {
+        out.push(`> ${shot.caption}`, "");
+      }
+    }
+  }
+  if (hasRequest) {
+    out.push("**Request:**", "");
+    out.push(indentEvidenceBlock(redactSensitiveHeaders(finding.evidence.request), "http"), "");
+  }
+  if (hasResponse) {
+    out.push("**Response:**", "");
+    out.push(indentEvidenceBlock(redactSensitiveHeaders(finding.evidence.response), "http"), "");
+  }
+  out.push("## Suggested fix", "");
+  out.push(suggestedFix, "");
+  out.push("## Patch status", "");
+  if (ctx.patchStatus) {
+    out.push(formatPatchStatusSection(ctx.patchStatus), "");
+  } else {
+    out.push("_Pass `--repo <path>` to `@0/cli disclose` to auto-verify this against the target's current HEAD or a specific tag._", "");
+  }
+  if (ctx.pocExecution) {
+    const verdict = ctx.pocExecution.overallVerdict === "exploit_still_works" ? "**Behavioural check: exploit still reproducible.**" : ctx.pocExecution.overallVerdict === "exploit_broken" ? "**Behavioural check: exploit no longer reproducible.**" : "**Behavioural check: could not run.**";
+    out.push(verdict, "");
+    out.push(`> Verdict: \`${ctx.pocExecution.overallVerdict}\` (${ctx.pocExecution.steps.length} step${ctx.pocExecution.steps.length === 1 ? "" : "s"} executed).`, "");
+  }
+  out.push("## Credits", "");
+  out.push("Discovered by **0.security**, the 0.security AI-assisted security engine ([0.security](https://0.security)).", "", "Reporter: _(your github handle)_", "");
+  return {
+    filename,
+    markdown: out.join("\n").replace(/\n{3,}/g, "\n\n"),
+    cvssVector: cvss.vector,
+    cvssScore: cvss.score,
+    primaryCwe: cwes[0]?.id ?? "",
+    severity: finding.severity
+  };
+}
+function buildAffectedLine(finding, ctx) {
+  if (ctx.versionRange)
+    return formatVersionRangeLine(ctx.versionRange);
+  if (ctx.target) {
+    return `\`${ctx.target}\`${ctx.targetRef ? ` at \`${ctx.targetRef}\`` : ""}${ctx.commitHash ? ` (commit \`${ctx.commitHash.slice(0, 12)}\`)` : ""}`;
+  }
+  return "_Affected component/version: to be filled in by the operator before submission._";
+}
+function buildImpactNarrative(finding) {
+  const a = finding.impactAssessment;
+  if (!a) {
+    return `This ${finding.category.replace(/-/g, " ")} issue is rated **${severityHeading(finding.severity)}**. ` + finding.description.trim();
+  }
+  const parts = [];
+  parts.push(`An attacker gains **${weaponizabilityLabel(a.weaponizability)}**. Attack prerequisites: ${reachabilityLabel(a.reachability_tier)}.`);
+  if (a.blast_radius)
+    parts.push(`**Blast radius:** ${a.blast_radius}`);
+  if (a.rationale)
+    parts.push(a.rationale);
+  return parts.join("\n\n");
+}
+function buildAttackScenario(finding) {
+  const a = finding.impactAssessment;
+  if (!a)
+    return "";
+  return `1. Attacker position: ${reachabilityLabel(a.reachability_tier)}.
+2. Trigger the ${finding.category.replace(/-/g, " ")} condition described above.
+3. Result: ${weaponizabilityLabel(a.weaponizability)}${a.blast_radius ? ` \u2014 ${a.blast_radius}` : ""}.`;
+}
+function buildStepsToReproduce(finding) {
+  const block = renderPocSteps(finding);
+  if (block.length === 0)
+    return "";
+  return redactSensitiveHeaders(block.join("\n"));
+}
+function buildPocEvidence(finding, ctx) {
+  const out = [];
+  if (ctx.screenshots && ctx.screenshots.length > 0) {
+    for (const shot of ctx.screenshots) {
+      const width = shot.width ? ` width="${shot.width}"` : "";
+      out.push(`<img${width} alt="${shot.alt}" src="${shot.relativePath}" />`, "");
+      if (shot.caption)
+        out.push(`> ${shot.caption}`, "");
+    }
+  }
+  if (finding.evidence?.request?.trim()) {
+    out.push("**Request:**", "", indentEvidenceBlock(redactSensitiveHeaders(finding.evidence.request), "http"), "");
+  }
+  if (finding.evidence?.response?.trim()) {
+    out.push("**Response:**", "", indentEvidenceBlock(redactSensitiveHeaders(finding.evidence.response), "http"), "");
+  }
+  return out.join("\n").trim();
+}
+function buildRemediation(finding, ctx) {
+  const remediation = finding.remediation;
+  const parts = [];
+  if (remediation?.summary)
+    parts.push(remediation.summary);
+  if (remediation?.steps?.length) {
+    parts.push(remediation.steps.map((step, i) => `${i + 1}. ${step}`).join("\n"));
+  }
+  if (remediation?.codeExample?.after) {
+    const lang = remediation.codeExample.language || "";
+    parts.push(remediation.codeExample.before ? `**Before:**
+
+\`\`\`${lang}
+${remediation.codeExample.before}
+\`\`\`
+
+**After:**
+
+\`\`\`${lang}
+${remediation.codeExample.after}
+\`\`\`` : `\`\`\`${lang}
+${remediation.codeExample.after}
+\`\`\``);
+  } else if (ctx.siblingFix) {
+    const ref = `${ctx.siblingFix.fileRef.file}${ctx.siblingFix.fileRef.line ? `:${ctx.siblingFix.fileRef.line}` : ""}`;
+    parts.push(`**Correct pattern already present in the repo at \`${ref}\`** *(extracted by 0):*
+
+\`\`\`${ctx.siblingFix.language}
+${ctx.siblingFix.snippet}
+\`\`\``);
+  }
+  return parts.length > 0 ? parts.join("\n\n") : "_Recommended fix: apply input validation / correct handling per the referenced CWE guidance._";
+}
+function buildReferences(finding, cwes) {
+  const lines = [];
+  for (const cwe of cwes) {
+    const num = cwe.id.replace(/^CWE-/i, "");
+    lines.push(`- [${cwe.id}: ${cwe.name}](https://cwe.mitre.org/data/definitions/${num}.html)`);
+  }
+  for (const ref of finding.remediation?.references ?? []) {
+    lines.push(`- ${ref}`);
+  }
+  return lines.length > 0 ? lines.join("\n") : "_No external references._";
+}
+function bugcrowdPriority(severity) {
+  switch (severity) {
+    case "critical":
+      return "P1 (Critical)";
+    case "high":
+      return "P2 (High)";
+    case "medium":
+      return "P3 (Medium)";
+    case "low":
+      return "P4 (Low)";
+    default:
+      return "P5 (Informational)";
+  }
+}
+function immunefiSeverity(severity) {
+  switch (severity) {
+    case "critical":
+      return "Critical \u2014 direct loss/freezing of funds or protocol insolvency";
+    case "high":
+      return "High \u2014 significant impact to funds or protocol integrity";
+    case "medium":
+      return "Medium \u2014 limited impact, bounded or conditional";
+    default:
+      return "Low \u2014 informational / minor impact";
+  }
+}
+function buildCommonParts(finding, ctx) {
+  const cwes = suggestCwesForCategory(finding.category);
+  const cvss = suggestCvss(finding);
+  const cvss4 = suggestCvss4(finding);
+  const severity = severityHeading(finding.severity);
+  const steps = buildStepsToReproduce(finding);
+  const poc = buildPocEvidence(finding, ctx);
+  if (!steps && !poc)
+    throw new EmptyPocError(finding.id);
+  return {
+    cvss,
+    cwes,
+    severity,
+    title: finding.title,
+    summary: finding.description.trim(),
+    impact: buildImpactNarrative(finding),
+    attackScenario: buildAttackScenario(finding),
+    steps,
+    poc,
+    affected: buildAffectedLine(finding, ctx),
+    remediation: buildRemediation(finding, ctx),
+    references: buildReferences(finding, cwes),
+    severityCvss31: renderCvssSection({ vector: cvss.vector, score: cvss.score, severity }),
+    severityCvss40: renderCvssSection({
+      vector: cvss4.vector,
+      score: cvss4.score,
+      severity: cvss4.severity
+    })
+  };
+}
+function assembleReport(platform, parts, sections) {
+  const out = [`# ${parts.title}`, ""];
+  for (const s of sections) {
+    out.push(`## ${s.heading}`, "", s.body, "");
+  }
+  return {
+    platform,
+    title: parts.title,
+    markdown: out.join("\n").replace(/\n{3,}/g, "\n\n"),
+    cvssVector: parts.cvss.vector,
+    cvssScore: parts.cvss.score,
+    severity: parts.severity,
+    sections
+  };
+}
+function stepsBodyOrPoc(parts) {
+  return parts.steps || "_See the Proof of Concept section below for the reproduction._";
+}
+var HACKERONE_TEMPLATE = {
+  id: "hackerone",
+  label: "HackerOne",
+  description: "H1 field order: Summary \u2192 Steps To Reproduce \u2192 PoC \u2192 Impact \u2192 Severity (CVSS) \u2192 Remediation \u2192 Supporting Material.",
+  requiredSections: [
+    "Summary",
+    "Steps To Reproduce",
+    "Proof of Concept",
+    "Impact",
+    "Severity",
+    "Remediation",
+    "Supporting Material / References"
+  ],
+  render(finding, ctx = {}) {
+    const parts = buildCommonParts(finding, ctx);
+    const sections = [
+      { heading: "Summary", body: parts.summary },
+      { heading: "Affected Asset", body: parts.affected },
+      { heading: "Steps To Reproduce", body: stepsBodyOrPoc(parts) },
+      { heading: "Proof of Concept", body: parts.poc || "_See Steps To Reproduce._" },
+      { heading: "Impact", body: parts.impact },
+      { heading: "Severity", body: `${parts.severityCvss31}
+
+_${cvssSourceLabel(parts.cvss)}_` },
+      { heading: "Remediation", body: parts.remediation },
+      { heading: "Supporting Material / References", body: parts.references }
+    ];
+    return assembleReport("hackerone", parts, sections);
+  }
+};
+var BUGCROWD_TEMPLATE = {
+  id: "bugcrowd",
+  label: "Bugcrowd",
+  description: "Bugcrowd VRT-first: leads with Business Impact + VRT priority (P1\u2013P5), then Vulnerability Details, Steps, PoC, Remediation.",
+  requiredSections: [
+    "Vulnerability Details",
+    "Business Impact",
+    "Bugcrowd VRT / Priority",
+    "Steps to Reproduce",
+    "Proof of Concept",
+    "Remediation",
+    "References"
+  ],
+  render(finding, ctx = {}) {
+    const parts = buildCommonParts(finding, ctx);
+    const sections = [
+      { heading: "Business Impact", body: parts.impact },
+      {
+        heading: "Bugcrowd VRT / Priority",
+        body: `**${bugcrowdPriority(finding.severity)}**
+
+${parts.severityCvss31}`
+      },
+      { heading: "Vulnerability Details", body: parts.summary },
+      { heading: "Affected Target", body: parts.affected },
+      { heading: "Steps to Reproduce", body: stepsBodyOrPoc(parts) },
+      { heading: "Proof of Concept", body: parts.poc || "_See Steps to Reproduce._" },
+      { heading: "Remediation", body: parts.remediation },
+      { heading: "References", body: parts.references }
+    ];
+    return assembleReport("bugcrowd", parts, sections);
+  }
+};
+var INTIGRITI_TEMPLATE = {
+  id: "intigriti",
+  label: "Intigriti",
+  description: "Intigriti order: Summary \u2192 Domain/Endpoint \u2192 Vulnerability Type (CWE) \u2192 Impact \u2192 Steps \u2192 PoC \u2192 Severity (CVSS) \u2192 Recommended Fix.",
+  requiredSections: [
+    "Summary",
+    "Domain / Endpoint",
+    "Vulnerability Type",
+    "Impact",
+    "Steps to Reproduce",
+    "Proof of Concept",
+    "Severity",
+    "Recommended Fix"
+  ],
+  render(finding, ctx = {}) {
+    const parts = buildCommonParts(finding, ctx);
+    const primaryCwe = parts.cwes[0];
+    const sections = [
+      { heading: "Summary", body: parts.summary },
+      { heading: "Domain / Endpoint", body: parts.affected },
+      {
+        heading: "Vulnerability Type",
+        body: primaryCwe ? `${primaryCwe.id}: ${primaryCwe.name} (category: \`${finding.category}\`)` : `Category: \`${finding.category}\``
+      },
+      { heading: "Impact", body: parts.impact },
+      { heading: "Steps to Reproduce", body: stepsBodyOrPoc(parts) },
+      { heading: "Proof of Concept", body: parts.poc || "_See Steps to Reproduce._" },
+      { heading: "Severity", body: parts.severityCvss31 },
+      { heading: "Recommended Fix", body: parts.remediation },
+      { heading: "References", body: parts.references }
+    ];
+    return assembleReport("intigriti", parts, sections);
+  }
+};
+var IMMUNEFI_TEMPLATE = {
+  id: "immunefi",
+  label: "Immunefi (web3)",
+  description: "Immunefi web3 order: Bug Description \u2192 Impact (funds/assets at risk) \u2192 Impact-in-Detail \u2192 Attack Scenario \u2192 PoC \u2192 Affected Assets \u2192 Recommendation. Impact-based severity + CVSS 4.0.",
+  requiredSections: [
+    "Bug Description",
+    "Impact",
+    "Severity",
+    "Attack Scenario",
+    "Proof of Concept",
+    "Affected Assets",
+    "Recommendation"
+  ],
+  render(finding, ctx = {}) {
+    const parts = buildCommonParts(finding, ctx);
+    const sections = [
+      { heading: "Bug Description", body: parts.summary },
+      { heading: "Impact", body: parts.impact },
+      {
+        heading: "Severity",
+        body: `**${immunefiSeverity(finding.severity)}**
+
+${parts.severityCvss40}
+
+${parts.severityCvss31}`
+      },
+      {
+        heading: "Attack Scenario",
+        body: parts.attackScenario || stepsBodyOrPoc(parts)
+      },
+      {
+        heading: "Proof of Concept",
+        body: [parts.steps, parts.poc].filter(Boolean).join("\n\n") || "_Attach a runnable PoC / test before submission._"
+      },
+      { heading: "Affected Assets", body: parts.affected },
+      { heading: "Recommendation", body: parts.remediation },
+      { heading: "References", body: parts.references }
+    ];
+    return assembleReport("immunefi", parts, sections);
+  }
+};
+var GENERIC_TEMPLATE = {
+  id: "generic",
+  label: "Generic / Default",
+  description: "Platform-neutral, impact-first structure: Summary \u2192 Impact \u2192 Affected \u2192 Steps \u2192 PoC \u2192 Severity (CVSS) \u2192 Remediation \u2192 References.",
+  requiredSections: [
+    "Summary",
+    "Impact",
+    "Affected Assets",
+    "Steps to Reproduce",
+    "Proof of Concept",
+    "Severity",
+    "Remediation",
+    "References"
+  ],
+  render(finding, ctx = {}) {
+    const parts = buildCommonParts(finding, ctx);
+    const sections = [
+      { heading: "Summary", body: parts.summary },
+      { heading: "Impact", body: parts.impact },
+      { heading: "Affected Assets", body: parts.affected },
+      { heading: "Steps to Reproduce", body: stepsBodyOrPoc(parts) },
+      { heading: "Proof of Concept", body: parts.poc || "_See Steps to Reproduce._" },
+      { heading: "Severity", body: `${parts.severityCvss31}
+
+_${cvssSourceLabel(parts.cvss)}_` },
+      { heading: "Remediation", body: parts.remediation },
+      { heading: "References", body: parts.references }
+    ];
+    return assembleReport("generic", parts, sections);
+  }
+};
+function cvssSourceLabel(cvss) {
+  return cvss.source === "finding" ? "CVSS source: populated on the finding by 0." : cvss.source === "impact-assessment" ? "CVSS source: exploitability derived from 0's reachability assessment; impact from category \u2014 verify against your deployment." : "CVSS source: heuristic from category + severity \u2014 verify before submission.";
+}
+var TEMPLATE_REGISTRY = {
+  hackerone: HACKERONE_TEMPLATE,
+  bugcrowd: BUGCROWD_TEMPLATE,
+  intigriti: INTIGRITI_TEMPLATE,
+  immunefi: IMMUNEFI_TEMPLATE,
+  generic: GENERIC_TEMPLATE
+};
+var REPORT_PLATFORMS = Object.values(TEMPLATE_REGISTRY).map((t) => ({
+  id: t.id,
+  label: t.label,
+  description: t.description
+}));
+function reportTemplate(platform) {
+  if (platform && platform in TEMPLATE_REGISTRY) {
+    return TEMPLATE_REGISTRY[platform];
+  }
+  return GENERIC_TEMPLATE;
+}
+function renderPlatformReport(finding, platform, ctx = {}) {
+  return reportTemplate(platform).render(finding, ctx);
+}
+
+export {
+  suggestCwesForCategory,
+  formatCweSection,
+  suggestCvss,
+  Cvss4ParseError,
+  computeCvss4BaseScore,
+  cvss4Severity,
+  parseCvss4Vector,
+  formatCvss4Vector,
+  scoreCvss4Vector,
+  suggestCvss4,
+  renderCvssSection,
+  extractFileRefs,
+  verifyAgainstRef,
+  formatPatchStatusSection,
+  detectVersionRange,
+  formatVersionRangeLine,
+  EmptyPocError,
+  redactSensitiveHeaders,
+  redactAuthHeaders,
+  renderAdvisoryMarkdown,
+  REPORT_PLATFORMS,
+  reportTemplate,
+  renderPlatformReport
+};