@4da/mcp-server 6.0.2 → 6.1.0

package/dist/live/fix-paths.js

@@ -0,0 +1,498 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Fix paths for vulnerable dependencies: WHICH version to move to, and HOW.
+ *
+ * Two defects found by the fix-path oracle (2026-10-10, 19 public repos;
+ * each recommendation applied in a copy, re-resolved, re-scanned):
+ *
+ * 1. The target could itself be vulnerable. It was the highest fix among the
+ *    advisories that affect the installed version, so an advisory the
+ *    installed version predates was never consulted: openssl 0.10.38 was sent
+ *    to 0.10.79, which GHSA-phqj-4mhp-q6mq affects (0.10.50 up to 0.10.80).
+ *    Now: the smallest published version at or above every per-advisory fix
+ *    that NO advisory of the package affects (osv-ranges.ts).
+ * 2. Every transitive finding was "waiting on upstream", 3 wrong out of 3:
+ *    minimist 1.2.5 (npm), braces 3.0.2 (pnpm) and mio 0.8.0 (Cargo) all had
+ *    parents whose declared requirement already admitted the fix, and a
+ *    lockfile refresh fixed each one. Now: the parents' requirements are
+ *    read (from the lockfile, or from the parent's registry metadata for
+ *    pnpm and Cargo) and a refresh is recommended when they all admit a
+ *    clean version.
+ *
+ * Network: api.osv.dev (one /v1/query per vulnerable package) and the
+ * package's own registry; package names and versions only. Every lookup is
+ * cached, and any failure degrades to the old answer, never to a guess.
+ */
+import { fetchWithTimeout } from "./http-utils.js";
+import { escapeModulePath } from "./go-registry.js";
+import { advisoryRanges, advisoryAffects, isPrereleaseVersion, smallestCleanVersion } from "./osv-ranges.js";
+import * as fs from "node:fs";
+import { readLockfileParents } from "./lockfile-parents.js";
+import { parseCargoLockPackages } from "./lockfile-parsers.js";
+import { cargoReqAdmits, npmRangeAdmits } from "./range-satisfies.js";
+import { compareVersions } from "./version-compare.js";
+import { CRATES_USER_AGENT } from "./crates-versions.js";
+const TIMEOUT_MS = 15_000;
+const ADVISORY_TTL = 6 * 3600;
+const VERSIONS_TTL = 6 * 3600;
+/** A published version's manifest never changes. */
+const VERSION_DEPS_TTL = 30 * 86_400;
+const MAX_OSV_PAGES = 10;
+/** Bump when the shape of anything this module caches changes. */
+const CACHE_VERSION = 2;
+export class FixPathSources {
+    cache;
+    rateLimiter;
+    constructor(cache, rateLimiter) {
+        this.cache = cache;
+        this.rateLimiter = rateLimiter;
+    }
+    /** Every non-withdrawn OSV advisory for a package, as ranges; null when OSV could not be read. */
+    async packageAdvisories(ecosystem, name) {
+        const key = `fixpath:v${CACHE_VERSION}:osv-package:${ecosystem}:${name}`;
+        const hit = this.cache.get(key);
+        if (hit)
+            return hit;
+        if (!this.rateLimiter.consume("osv-package"))
+            return null;
+        const out = [];
+        let token;
+        try {
+            for (let page = 0; page < MAX_OSV_PAGES; page++) {
+                const res = await fetchWithTimeout("https://api.osv.dev/v1/query", {
+                    method: "POST",
+                    headers: { "Content-Type": "application/json" },
+                    body: JSON.stringify({ package: { name, ecosystem }, ...(token ? { page_token: token } : {}) }),
+                }, TIMEOUT_MS);
+                if (!res.ok)
+                    return null;
+                const body = (await res.json());
+                for (const v of body.vulns ?? []) {
+                    const ranges = advisoryRanges(v, name, ecosystem);
+                    if (ranges)
+                        out.push(ranges);
+                }
+                token = body.next_page_token;
+                if (!token)
+                    break;
+            }
+            if (token)
+                return null; // more pages than the cap: an incomplete list cannot prove a version clean
+        }
+        catch {
+            return null;
+        }
+        this.cache.set(key, out, "osv", ADVISORY_TTL);
+        return out;
+    }
+    /** Published, installable versions (not yanked); null when the registry could not be read or is not supported. */
+    async publishedVersions(ecosystem, name) {
+        switch (ecosystem) {
+            case "npm":
+                return this.npmVersions(name);
+            case "crates.io":
+                return (await this.cratesSparse(name))?.versions ?? null;
+            case "PyPI":
+                return this.pypiVersions(name);
+            case "Go":
+                return this.goVersions(name);
+            default:
+                return null;
+        }
+    }
+    /**
+     * The requirements `parent@parentVersion` declares on `dep`, from the
+     * registry: npm (pnpm lockfiles record none) and crates.io (Cargo.lock
+     * records none). Null when unknown; [] when the parent declares none.
+     */
+    async parentRequirements(ecosystem, parent, parentVersion, dep) {
+        if (ecosystem === "crates.io") {
+            const sparse = await this.cratesSparse(parent);
+            const deps = sparse?.reqs[parentVersion];
+            return deps ? (deps[dep] ?? []).map((d) => d.req) : null;
+        }
+        if (ecosystem !== "npm")
+            return null;
+        const key = `fixpath:v${CACHE_VERSION}:npm-version-deps:${parent}@${parentVersion}`;
+        let deps = this.cache.get(key);
+        if (!deps) {
+            if (!this.rateLimiter.consume("fixpath-registry"))
+                return null;
+            try {
+                const res = await fetchWithTimeout(`https://registry.npmjs.org/${encodeURIComponent(parent)}/${encodeURIComponent(parentVersion)}`, { headers: { Accept: "application/json" } }, TIMEOUT_MS);
+                if (!res.ok)
+                    return null;
+                const doc = (await res.json());
+                deps = { ...doc.peerDependencies, ...doc.optionalDependencies, ...doc.dependencies };
+                this.cache.set(key, deps, "npm", VERSION_DEPS_TTL);
+            }
+            catch {
+                return null;
+            }
+        }
+        return typeof deps[dep] === "string" ? [deps[dep]] : [];
+    }
+    async npmVersions(name) {
+        const key = `fixpath:v${CACHE_VERSION}:npm-versions:${name}`;
+        const hit = this.cache.get(key);
+        if (hit)
+            return hit;
+        if (!this.rateLimiter.consume("fixpath-registry"))
+            return null;
+        try {
+            // The abbreviated document: versions without READMEs.
+            const res = await fetchWithTimeout(`https://registry.npmjs.org/${encodeURIComponent(name)}`, { headers: { Accept: "application/vnd.npm.install-v1+json" } }, TIMEOUT_MS);
+            if (!res.ok)
+                return null;
+            const doc = (await res.json());
+            const versions = Object.keys(doc.versions ?? {});
+            this.cache.set(key, versions, "npm", VERSIONS_TTL);
+            return versions;
+        }
+        catch {
+            return null;
+        }
+    }
+    /** A crate's sparse-index record: versions and per-version dependency requirements. */
+    async cratesSparse(name) {
+        const key = `fixpath:v${CACHE_VERSION}:crates-sparse:${name}`;
+        const hit = this.cache.get(key);
+        if (hit)
+            return hit;
+        if (!this.rateLimiter.consume("fixpath-registry"))
+            return null;
+        try {
+            const res = await fetchWithTimeout(sparseIndexUrl(name), { headers: { "User-Agent": CRATES_USER_AGENT } }, TIMEOUT_MS);
+            if (!res.ok)
+                return null;
+            const out = { versions: [], reqs: {} };
+            for (const line of (await res.text()).split("\n")) {
+                if (!line.trim())
+                    continue;
+                try {
+                    const entry = JSON.parse(line);
+                    if (!entry.yanked)
+                        out.versions.push(entry.vers);
+                    const reqs = {};
+                    for (const d of entry.deps ?? []) {
+                        if (d.kind === "dev")
+                            continue;
+                        const crate = d.package ?? d.name;
+                        (reqs[crate] ??= []).push({ req: d.req, optional: d.optional === true });
+                    }
+                    out.reqs[entry.vers] = reqs;
+                }
+                catch {
+                    // a malformed line
+                }
+            }
+            this.cache.set(key, out, "crates", VERSIONS_TTL);
+            return out;
+        }
+        catch {
+            return null;
+        }
+    }
+    async pypiVersions(name) {
+        const key = `fixpath:v${CACHE_VERSION}:pypi-versions:${name}`;
+        const hit = this.cache.get(key);
+        if (hit)
+            return hit;
+        if (!this.rateLimiter.consume("fixpath-registry"))
+            return null;
+        try {
+            const res = await fetchWithTimeout(`https://pypi.org/pypi/${encodeURIComponent(name)}/json`, {}, TIMEOUT_MS);
+            if (!res.ok)
+                return null;
+            const doc = (await res.json());
+            // A release with files, not all of them yanked.
+            const versions = Object.entries(doc.releases ?? {})
+                .filter(([, files]) => files.length > 0 && files.some((f) => !f.yanked))
+                .map(([v]) => v);
+            this.cache.set(key, versions, "pypi", VERSIONS_TTL);
+            return versions;
+        }
+        catch {
+            return null;
+        }
+    }
+    async goVersions(name) {
+        const key = `fixpath:v${CACHE_VERSION}:go-versions:${name}`;
+        const hit = this.cache.get(key);
+        if (hit)
+            return hit;
+        if (!this.rateLimiter.consume("fixpath-registry"))
+            return null;
+        try {
+            const res = await fetchWithTimeout(`https://proxy.golang.org/${escapeModulePath(name)}/@v/list`, {}, TIMEOUT_MS);
+            if (!res.ok)
+                return null;
+            // OSV's Go ranges carry no `v`.
+            const versions = (await res.text()).split("\n").map((v) => v.trim().replace(/^v/, "")).filter(Boolean);
+            this.cache.set(key, versions, "go", VERSIONS_TTL);
+            return versions;
+        }
+        catch {
+            return null;
+        }
+    }
+}
+function sparseIndexUrl(name) {
+    const n = name.toLowerCase();
+    switch (n.length) {
+        case 1: return `https://index.crates.io/1/${n}`;
+        case 2: return `https://index.crates.io/2/${n}`;
+        case 3: return `https://index.crates.io/3/${n[0]}/${n}`;
+        default: return `https://index.crates.io/${n.slice(0, 2)}/${n.slice(2, 4)}/${n}`;
+    }
+}
+/** The minimal clean target for one installed copy, or null when the advisories could not be read. */
+export async function cleanFixTarget(sources, ecosystem, name, perAdvisoryFixes) {
+    if (perAdvisoryFixes.length === 0)
+        return null;
+    const [advisories, published] = await Promise.all([
+        sources.packageAdvisories(ecosystem, name),
+        sources.publishedVersions(ecosystem, name),
+    ]);
+    if (!advisories)
+        return null;
+    return smallestCleanVersion({ ecosystem, fixes: perAdvisoryFixes, advisories, published });
+}
+/**
+ * Verified targets for many installed copies at once, within a time budget:
+ * the copies that could not be checked in time (or offline) are simply
+ * absent from the result, and the caller says so. Keyed by `key`.
+ */
+export async function verifyFixTargets(sources, items, budgetMs, concurrency = 12) {
+    const out = new Map();
+    const todo = items.filter((i) => i.fixes.length > 0);
+    if (!sources || todo.length === 0)
+        return out;
+    const deadline = Date.now() + budgetMs;
+    let next = 0;
+    const worker = async () => {
+        while (next < todo.length && Date.now() < deadline) {
+            const item = todo[next++];
+            let timer;
+            const late = new Promise((resolve) => {
+                timer = setTimeout(() => resolve(null), Math.max(0, deadline - Date.now()));
+            });
+            try {
+                const clean = await Promise.race([cleanFixTarget(sources, item.ecosystem, item.name, item.fixes).catch(() => null), late]);
+                if (clean)
+                    out.set(item.key, clean);
+            }
+            finally {
+                if (timer !== undefined)
+                    clearTimeout(timer);
+            }
+        }
+    };
+    await Promise.all(Array.from({ length: Math.min(concurrency, todo.length) }, worker));
+    return out;
+}
+/** One clause for a target that is not the highest per-advisory fix, or null when it is. */
+export function targetNote(clean) {
+    const parts = [];
+    if (clean.target && clean.target !== clean.floor) {
+        parts.push(`${clean.target} is the smallest version clear of every advisory a release fixes; ${clean.floor}, the highest per-advisory fix, ${clean.floorAffectedBy.length > 0 ? `is itself affected by ${clean.floorAffectedBy.join(", ")}` : "is not a published release"}`);
+    }
+    if (clean.target && clean.stillAffectedBy.length > 0) {
+        parts.push(`${clean.stillAffectedBy.join(", ")} also affect${clean.stillAffectedBy.length === 1 ? "s" : ""} it and every newer release (no fix published)`);
+    }
+    return parts.length > 0 ? parts.join("; ") : null;
+}
+/** The refresh command for one lockfile format. */
+export function refreshCommand(format, name, installed, target) {
+    switch (format) {
+        case "package-lock":
+            return `npm update ${name}`;
+        case "pnpm":
+            return `pnpm update ${name}`;
+        case "yarn-berry":
+            return `yarn up -R ${name}`;
+        case "yarn":
+            return `delete the ${name}@ entries from yarn.lock, then run yarn install`;
+        case "bun":
+            return `delete the ${name} entries from bun.lock, then run bun install`;
+        case "cargo":
+            return `cargo update -p ${name}@${installed} --precise ${target}`;
+    }
+}
+/**
+ * Whether refreshing `lockfile` moves `name@installed` to a clean version
+ * without any parent changing its declared requirement. Null when the
+ * lockfile or a requirement cannot be read (the caller keeps "waiting on
+ * upstream", the conservative answer).
+ */
+export async function refreshVerdict(sources, ecosystem, lockfile, name, installed, target, advisories, published) {
+    const parents = readLockfileParents(lockfile, name, installed);
+    if (!parents || parents.edges.length === 0)
+        return null;
+    const isCargo = parents.format === "cargo";
+    const admits = (range, version) => (isCargo ? cargoReqAdmits(range, version) : npmRangeAdmits(range, version));
+    const clean = (v) => !advisories || !advisories.some((a) => advisoryAffects(a, v, ecosystem));
+    const releases = (published ?? []).filter((v) => !isPrereleaseVersion(v, ecosystem));
+    const blocking = [];
+    let resolvesTo = null;
+    const edgeReqs = await Promise.all(parents.edges.map((edge) => requirementsOf(sources, ecosystem, edge, name)));
+    for (const [i, edge] of parents.edges.entries()) {
+        const all = edgeReqs[i];
+        if (all === null || all.length === 0)
+            return null;
+        // A parent can declare the same crate twice under different names (feature-gated
+        // `mio-0_6` / `mio-0_7` aliases): only the requirements this copy satisfies apply.
+        const matching = all.filter((req) => admits(req, installed) === true);
+        const reqs = matching.length > 0 ? [...new Set(matching)] : [...new Set(all)];
+        for (const req of reqs) {
+            if (isCargo) {
+                // `cargo update --precise` moves to exactly the clean target, if every requirement admits it.
+                const ok = admits(req, target);
+                if (ok === null)
+                    return null;
+                if (!ok)
+                    blocking.push({ parent: edge.parent, parentVersion: edge.parentVersion, requirement: req });
+                else
+                    resolvesTo = target;
+                continue;
+            }
+            // npm, pnpm, yarn and bun resolve each requirement to its newest match.
+            if (releases.length > 0) {
+                const newest = releases
+                    .filter((v) => admits(req, v) === true)
+                    .sort((a, b) => compareVersions(b, a, ecosystem))[0];
+                if (!newest || compareVersions(newest, target, ecosystem) < 0 || !clean(newest)) {
+                    blocking.push({ parent: edge.parent, parentVersion: edge.parentVersion, requirement: req });
+                }
+                else if (!resolvesTo || compareVersions(newest, resolvesTo, ecosystem) < 0) {
+                    resolvesTo = newest;
+                }
+            }
+            else {
+                const ok = admits(req, target);
+                if (ok === null)
+                    return null;
+                if (!ok)
+                    blocking.push({ parent: edge.parent, parentVersion: edge.parentVersion, requirement: req });
+            }
+        }
+    }
+    let command = refreshCommand(parents.format, name, installed, target);
+    if (isCargo && blocking.length === 0) {
+        let content;
+        try {
+            content = fs.readFileSync(lockfile, "utf-8");
+        }
+        catch {
+            return null;
+        }
+        const prereqs = await cargoPrecisePrerequisites(sources, content, name, installed, target);
+        if (prereqs === null)
+            return null;
+        if (prereqs.length > 0)
+            command = `cargo update ${prereqs.map((p) => `-p ${p}`).join(" ")} && ${command}`;
+    }
+    return {
+        refreshFixes: blocking.length === 0,
+        format: parents.format,
+        command,
+        blocking,
+        resolvesTo: blocking.length === 0 ? resolvesTo : null,
+    };
+}
+async function requirementsOf(sources, ecosystem, edge, name) {
+    if (edge.range !== null)
+        return [edge.range];
+    if (edge.parentVersion === null)
+        return null;
+    return sources.parentRequirements(ecosystem, edge.parent, edge.parentVersion, name);
+}
+// ---------------------------------------------------------------------------
+// Cargo: what `--precise` needs moved first
+// ---------------------------------------------------------------------------
+/** Cargo's compatibility line: one copy per line per lockfile ("1", "0.10", "0.0.3"). */
+function cargoLine(version) {
+    const [major, minor, patch] = version.split(/[.+-]/);
+    return major !== "0" ? major : minor !== "0" ? `0.${minor}` : `0.0.${patch}`;
+}
+const MAX_CLOSURE_CRATES = 60;
+/**
+ * The locked crates `cargo update -p name@installed --precise target` cannot
+ * move by itself, as `crate@lockedVersion` specs to update first; null when it
+ * cannot be worked out (a registry read failed, or the walk is too large).
+ *
+ * Measured on nushell (2026-10-10): `cargo update -p openssl@0.10.38
+ * --precise 0.10.80` fails. 0.10.80 needs openssl-macros 0.1.1 -> syn 2 ->
+ * quote ^1.0.25, and quote 1.0.15 is locked by rstest, outside openssl's own
+ * dependency tree, so cargo keeps it and reports a conflict. `cargo update -p
+ * quote` first, then the precise update, works. Crates in the installed
+ * version's own tree may move with it (openssl-sys did) and are not listed.
+ *
+ * The walk follows the target's normal and build dependencies (optional ones
+ * only when the crate is already in the lockfile): a requirement a locked copy
+ * satisfies is reused; one whose compatibility line holds a locked copy that
+ * does not satisfy it names that copy; anything else is a new crate, walked
+ * at its newest matching version.
+ */
+export async function cargoPrecisePrerequisites(sources, lockContent, name, installed, target) {
+    const packages = parseCargoLockPackages(lockContent);
+    const locked = new Map();
+    for (const p of packages)
+        locked.set(p.name, [...(locked.get(p.name) ?? []), p.version]);
+    // The installed version's own dependency tree, which cargo may move with it.
+    const byKey = new Map(packages.map((p) => [`${p.name}@${p.version}`, p]));
+    const own = new Set();
+    const stack = [`${name}@${installed}`];
+    while (stack.length > 0) {
+        const key = stack.pop();
+        if (own.has(key))
+            continue;
+        own.add(key);
+        for (const dep of byKey.get(key)?.dependencies ?? []) {
+            const [depName, depVersion] = dep.split(" ");
+            const version = depVersion ?? (locked.get(depName)?.length === 1 ? locked.get(depName)[0] : null);
+            if (version)
+                stack.push(`${depName}@${version}`);
+        }
+    }
+    const prereqs = new Set();
+    const visited = new Set();
+    const queue = [[name, target]];
+    while (queue.length > 0) {
+        const [crate, version] = queue.shift();
+        if (visited.has(`${crate}@${version}`))
+            continue;
+        visited.add(`${crate}@${version}`);
+        if (visited.size > MAX_CLOSURE_CRATES)
+            return null;
+        const deps = (await sources.cratesSparse(crate))?.reqs[version];
+        if (!deps)
+            return null;
+        for (const [dep, entries] of Object.entries(deps)) {
+            const lockedVersions = locked.get(dep) ?? [];
+            for (const { req, optional } of entries) {
+                if (optional && lockedVersions.length === 0)
+                    continue; // a feature this build does not enable
+                if (lockedVersions.some((v) => cargoReqAdmits(req, v) === true))
+                    continue;
+                const available = (await sources.cratesSparse(dep))?.versions;
+                if (!available)
+                    return null;
+                const best = available
+                    .filter((v) => !isPrereleaseVersion(v, "crates.io") && cargoReqAdmits(req, v) === true)
+                    .sort((a, b) => compareVersions(b, a, "crates.io"))[0];
+                if (!best)
+                    return null;
+                const sameLine = lockedVersions.find((v) => cargoLine(v) === cargoLine(best));
+                if (sameLine) {
+                    if (!own.has(`${dep}@${sameLine}`))
+                        prereqs.add(`${dep}@${sameLine}`);
+                }
+                else if (!visited.has(`${dep}@${best}`)) {
+                    queue.push([dep, best]);
+                }
+            }
+        }
+    }
+    return [...prereqs].sort();
+}

package/dist/live/go-registry.d.ts

@@ -16,3 +16,8 @@ export declare class GoRegistry {
     constructor(cache: LiveCache, rateLimiter: RateLimiter);
     getPackageInfo(name: string, currentVersion: string | null, isDev: boolean): Promise<RegistryPackageInfo>;
 }
+/**
+ * Escape uppercase letters in Go module paths for the proxy URL.
+ * Go proxy convention: uppercase 'X' becomes '!x'.
+ */
+export declare function escapeModulePath(mod: string): string;

package/dist/live/go-registry.js

@@ -93,7 +93,7 @@ export class GoRegistry {
  * Escape uppercase letters in Go module paths for the proxy URL.
  * Go proxy convention: uppercase 'X' becomes '!x'.
  */
-function escapeModulePath(mod) {
+export function escapeModulePath(mod) {
     return mod.replace(/[A-Z]/g, (c) => "!" + c.toLowerCase());
 }
 /**

package/dist/live/index.d.ts

@@ -7,9 +7,11 @@
  * Privacy: Only sends package names/versions (public) and tech keywords (generic).
  * Set FOURDA_OFFLINE=true to disable all network calls.
  */
-import type Database from "better-sqlite3";
+import type { SqliteDatabase } from "../sqlite-driver.js";
+import { FixPathSources } from "./fix-paths.js";
 import type { ReleaseMetadataSource } from "./release-metadata.js";
 import { type ResolutionGroup } from "./resolution.js";
+import type { TreeDiscovery } from "../project-tree.js";
 import type { InstallDriftRecord, ResolutionProvenance, ResolvedDependency, RegistryPackageInfo, VulnerabilityScanResult, LiveHeadline, LiveIntelligenceStatus } from "./types.js";
 export type { VulnerabilityScanResult, VulnerabilityEntry, LiveHeadline, LiveIntelligenceStatus, RegistryPackageInfo, DependencyHealthResult, InstallDriftRecord, ResolutionProvenance, } from "./types.js";
 export declare class LiveIntelligence {
@@ -24,6 +26,7 @@ export declare class LiveIntelligence {
     private goRegistry;
     private npmPackuments;
     private cratesVersions;
+    private fixPathSources;
     private enabled;
     private lastVulnScan;
     /** Whether the stored scan included direct devDependencies. */
@@ -37,6 +40,8 @@ export declare class LiveIntelligence {
      * runs, 2026-10-03 pre-publish verification).
      */
     private scanRequests;
+    /** Scans running now, by generation, scope and path: a request for one of them awaits it. */
+    private scansInFlight;
     private storedScanRequest;
     private lastHeadlines;
     private resolvedDeps;
@@ -45,6 +50,8 @@ export declare class LiveIntelligence {
     private projectRoot;
     /** One entry per resolution group: its inputs, result, and the file signatures that say when it went stale. */
     private groupResults;
+    /** The project-tree walk's report of what it left out, when the groups came from one. */
+    private discovery;
     /** When the dependency set in use was assembled: at init, or at the last re-resolution. */
     private resolvedAt;
     /**
@@ -61,7 +68,15 @@ export declare class LiveIntelligence {
     private warmup;
     /** When the last warmup came back offline; gates the retry so an offline host is not re-probed on every call. */
     private warmupFailedAt;
-    constructor(db: Database.Database);
+    constructor(db: SqliteDatabase | null);
+    /** Advisory, registry and parent-requirement lookups for fix paths; null when offline. */
+    getFixPathSources(): FixPathSources | null;
+    /**
+     * The lockfile one manifest directory resolved this ecosystem from, or null
+     * when it resolved from a manifest or nothing. `dir` is spelled as the
+     * resolution group spells it (the scan's sourceDirs).
+     */
+    lockfileFor(dir: string, ecosystem: string): string | null;
     /**
      * Initialize with project data. Call once after project scan.
      * @deprecated Use initFromMultiEcosystem for correct per-ecosystem resolution.
@@ -81,7 +96,18 @@ export declare class LiveIntelligence {
      * project-tree.ts): each group resolves from its own directory and keeps
      * its manifest's platform targets; `root` is the reported project root.
      */
-    initFromProjectTree(root: string, groups: ResolutionGroup[]): void;
+    initFromProjectTree(root: string, groups: ResolutionGroup[], discovery?: TreeDiscovery | null): void;
+    /**
+     * Manifests with no lockfile beside them, whose ranged dependencies were not
+     * scanned: their versions are declared ranges, not installs.
+     */
+    getUnresolvedManifests(): Array<{
+        dir: string;
+        manifest: string;
+        ranges: number;
+    }>;
+    /** What the project-tree walk left out (lockfiles past its bounds); null when the set did not come from a walk. */
+    getDiscovery(): TreeDiscovery | null;
     /**
      * Initialize from dependency groups that each carry their own resolution
      * directory. Used in 4DA database mode, where dependencies span multiple
@@ -133,6 +159,7 @@ export declare class LiveIntelligence {
         includeDev?: boolean;
         forceRefresh?: boolean;
     }): Promise<VulnerabilityScanResult>;
+    private runScan;
     /**
      * Start the vulnerability scan in the background without blocking startup.
      * Never rejects: a failed scan resolves to an empty OFFLINE result so the