@lockhawk/core 0.2.4 → 0.2.6

package/dist/index.js

@@ -1,2174 +1,4 @@
-// src/types.ts
-var SEVERITY_RANK = {
-  none: 0,
-  unknown: 1,
-  low: 2,
-  medium: 3,
-  high: 4,
-  critical: 5
-};
-function severityAtLeast(level, threshold) {
-  return SEVERITY_RANK[level] >= SEVERITY_RANK[threshold];
-}
-function pkgKey(name, version) {
-  return `${name}@${version}`;
-}
-
-// src/lockfiles/normalize.ts
-import { resolve } from "path";
-
-// src/lockfiles/detect.ts
-import { existsSync, readFileSync, statSync } from "fs";
-import { join } from "path";
-var LOCKFILES = [
-  { filename: "pnpm-lock.yaml", manager: "pnpm" },
-  { filename: "yarn.lock", manager: "yarn" },
-  { filename: "package-lock.json", manager: "npm" },
-  { filename: "npm-shrinkwrap.json", manager: "npm" }
-];
-function detectLockfile(dir) {
-  for (const { filename, manager } of LOCKFILES) {
-    const path = join(dir, filename);
-    if (existsSync(path) && statSync(path).isFile()) {
-      return { manager, path, filename };
-    }
-  }
-  return void 0;
-}
-function readRootManifest(dir) {
-  const path = join(dir, "package.json");
-  let raw = {};
-  if (existsSync(path)) {
-    try {
-      raw = JSON.parse(readFileSync(path, "utf8"));
-    } catch {
-      raw = {};
-    }
-  }
-  const asMap = (v) => v && typeof v === "object" ? v : {};
-  return {
-    name: typeof raw.name === "string" ? raw.name : "project",
-    version: typeof raw.version === "string" ? raw.version : void 0,
-    dependencies: asMap(raw.dependencies),
-    devDependencies: asMap(raw.devDependencies),
-    optionalDependencies: asMap(raw.optionalDependencies),
-    peerDependencies: asMap(raw.peerDependencies)
-  };
-}
-
-// src/lockfiles/raw.ts
-function reachable(start, nodes) {
-  const seen = /* @__PURE__ */ new Set();
-  const queue = [];
-  for (const k of start) {
-    if (!seen.has(k)) {
-      seen.add(k);
-      queue.push(k);
-    }
-  }
-  for (let i = 0; i < queue.length; i++) {
-    const node = nodes[queue[i]];
-    if (!node) continue;
-    for (const dep of node.dependencies) {
-      if (!seen.has(dep)) {
-        seen.add(dep);
-        queue.push(dep);
-      }
-    }
-  }
-  return seen;
-}
-function buildDependencyGraph(raw) {
-  const prodReach = reachable(raw.directProd, raw.nodes);
-  const optionalReach = reachable(raw.directOptional, raw.nodes);
-  const devReach = reachable(raw.directDev, raw.nodes);
-  const direct = /* @__PURE__ */ new Set([...raw.directProd, ...raw.directOptional, ...raw.directDev]);
-  const nodes = {};
-  for (const [key, rn] of Object.entries(raw.nodes)) {
-    let scope;
-    if (prodReach.has(key)) scope = "prod";
-    else if (optionalReach.has(key)) scope = "optional";
-    else if (devReach.has(key)) scope = "dev";
-    else scope = "prod";
-    nodes[key] = {
-      key,
-      name: rn.name,
-      version: rn.version,
-      scope,
-      direct: direct.has(key),
-      dependencies: dedupe(rn.dependencies),
-      ...rn.unscannable ? { unscannable: rn.unscannable } : {}
-    };
-  }
-  return {
-    manager: raw.manager,
-    lockfilePath: raw.lockfilePath,
-    lockfileVersion: raw.lockfileVersion,
-    root: raw.root,
-    nodes,
-    directKeys: [...direct].filter((k) => nodes[k] !== void 0)
-  };
-}
-function dedupe(keys) {
-  return keys.length > 1 ? [...new Set(keys)] : keys;
-}
-
-// src/lockfiles/npm.ts
-import { readFileSync as readFileSync2 } from "fs";
-import { dirname } from "path";
-function parseNpm(lockfilePath) {
-  const data = JSON.parse(readFileSync2(lockfilePath, "utf8"));
-  if (data.packages) {
-    return parsePackages(data, lockfilePath);
-  }
-  return parseLegacy(data, lockfilePath);
-}
-function nameFromPath(p) {
-  const marker = "node_modules/";
-  const idx = p.lastIndexOf(marker);
-  return idx === -1 ? p : p.slice(idx + marker.length);
-}
-function parsePackages(data, lockfilePath) {
-  const packages = data.packages ?? {};
-  const rootEntry = packages[""] ?? {};
-  const root = {
-    name: rootEntry.name ?? data.name ?? "project",
-    version: rootEntry.version ?? data.version
-  };
-  const nodes = /* @__PURE__ */ Object.create(null);
-  const unscannable = [];
-  const pathToKey = /* @__PURE__ */ Object.create(null);
-  for (const [p, entry] of Object.entries(packages)) {
-    if (p === "" || entry.link) continue;
-    const name = entry.name ?? nameFromPath(p);
-    const version = entry.version;
-    if (!version) continue;
-    const key = pkgKey(name, version);
-    pathToKey[p] = key;
-    if (!nodes[key]) {
-      const node = { key, name, version, dependencies: [] };
-      if (!p.includes("node_modules")) {
-        node.unscannable = { reason: "local workspace package" };
-        unscannable.push({ name, version, reason: "local workspace package" });
-      }
-      nodes[key] = node;
-    }
-  }
-  const resolveDep = (fromPath, depName) => {
-    let prefix = fromPath;
-    for (; ; ) {
-      const candidate = `${prefix ? `${prefix}/` : ""}node_modules/${depName}`;
-      const entry = packages[candidate];
-      if (entry) {
-        if (entry.link && typeof entry.resolved === "string") return entry.resolved;
-        return candidate;
-      }
-      if (!prefix) return void 0;
-      const i = prefix.lastIndexOf("/node_modules/");
-      prefix = i === -1 ? "" : prefix.slice(0, i);
-    }
-  };
-  const directProd = /* @__PURE__ */ new Set();
-  const directDev = /* @__PURE__ */ new Set();
-  const directOptional = /* @__PURE__ */ new Set();
-  for (const [p, entry] of Object.entries(packages)) {
-    if (entry.link) continue;
-    const fromKey = p === "" ? void 0 : pathToKey[p];
-    const isLocalRoot = p === "" || !p.includes("node_modules");
-    const addEdges = (names, bucket) => {
-      for (const depName of names) {
-        const targetPath = resolveDep(p, depName);
-        if (!targetPath) continue;
-        const targetKey = pathToKey[targetPath];
-        if (!targetKey) continue;
-        if (fromKey && fromKey !== targetKey) nodes[fromKey].dependencies.push(targetKey);
-        if (bucket) bucket.add(targetKey);
-      }
-    };
-    addEdges(Object.keys(entry.dependencies ?? {}), isLocalRoot ? directProd : void 0);
-    addEdges(
-      Object.keys(entry.optionalDependencies ?? {}),
-      isLocalRoot ? directOptional : void 0
-    );
-    if (isLocalRoot) {
-      addEdges(Object.keys(entry.devDependencies ?? {}), directDev);
-    }
-  }
-  return {
-    manager: "npm",
-    lockfilePath,
-    lockfileVersion: data.lockfileVersion,
-    root,
-    nodes,
-    directProd: [...directProd],
-    directDev: [...directDev],
-    directOptional: [...directOptional],
-    unscannable
-  };
-}
-function parseLegacy(data, lockfilePath) {
-  const manifest = readRootManifest(dirname(lockfilePath));
-  const root = { name: data.name ?? manifest.name, version: data.version ?? manifest.version };
-  const nodes = /* @__PURE__ */ Object.create(null);
-  const buildLevel = (deps) => {
-    const m2 = /* @__PURE__ */ new Map();
-    for (const [name, info] of Object.entries(deps ?? {})) {
-      if (info?.version) m2.set(name, info.version);
-    }
-    return m2;
-  };
-  const resolveFromChain = (name, chain) => {
-    for (let i = chain.length - 1; i >= 0; i--) {
-      const v = chain[i].get(name);
-      if (v) return v;
-    }
-    return void 0;
-  };
-  const visit = (deps, ancestors) => {
-    const level = buildLevel(deps);
-    const chain = [...ancestors, level];
-    for (const [name, info] of Object.entries(deps ?? {})) {
-      const version = info?.version;
-      if (!version) continue;
-      const key = pkgKey(name, version);
-      if (!nodes[key]) nodes[key] = { key, name, version, dependencies: [] };
-      const ownChain = [...chain, buildLevel(info.dependencies)];
-      for (const reqName of Object.keys(info.requires ?? {})) {
-        const v = resolveFromChain(reqName, ownChain);
-        if (v) {
-          const targetKey = pkgKey(reqName, v);
-          if (targetKey !== key) nodes[key].dependencies.push(targetKey);
-        }
-      }
-      if (info.dependencies) visit(info.dependencies, chain);
-    }
-  };
-  visit(data.dependencies, []);
-  const topLevel = buildLevel(data.dependencies);
-  const directProd = [];
-  const directDev = [];
-  const directOptional = [];
-  const classify = (names, out) => {
-    for (const name of names) {
-      const v = topLevel.get(name);
-      if (v) out.push(pkgKey(name, v));
-    }
-  };
-  classify(Object.keys(manifest.dependencies), directProd);
-  classify(Object.keys(manifest.optionalDependencies), directOptional);
-  classify(Object.keys(manifest.devDependencies), directDev);
-  return {
-    manager: "npm",
-    lockfilePath,
-    lockfileVersion: data.lockfileVersion,
-    root,
-    nodes,
-    directProd,
-    directDev,
-    directOptional,
-    unscannable: []
-  };
-}
-
-// src/lockfiles/yarn.ts
-import { readFileSync as readFileSync3 } from "fs";
-import { dirname as dirname2 } from "path";
-import { createRequire } from "module";
-import yaml from "js-yaml";
-var require2 = createRequire(import.meta.url);
-var yarnLockfile = require2("@yarnpkg/lockfile");
-function parseYarn(lockfilePath) {
-  const content = readFileSync3(lockfilePath, "utf8");
-  const manifest = readRootManifest(dirname2(lockfilePath));
-  const isBerry = content.includes("__metadata");
-  const { descriptorToVersion, entryByVersion, lockfileVersion } = isBerry ? parseBerry(content) : parseClassic(content);
-  return assemble(
-    lockfilePath,
-    manifest,
-    descriptorToVersion,
-    entryByVersion,
-    lockfileVersion,
-    isBerry
-  );
-}
-function splitDescriptor(descriptor) {
-  const at = descriptor.lastIndexOf("@");
-  if (at <= 0) return void 0;
-  return { name: descriptor.slice(0, at), range: descriptor.slice(at + 1) };
-}
-function parseClassic(content) {
-  const parsed = yarnLockfile.parse(content);
-  const descriptorToVersion = /* @__PURE__ */ new Map();
-  const entryByVersion = /* @__PURE__ */ new Map();
-  for (const [rawKey, entry] of Object.entries(parsed.object)) {
-    if (!entry.version) continue;
-    for (const descriptor of rawKey.split(/,\s*/)) {
-      const split = splitDescriptor(descriptor);
-      if (split) descriptorToVersion.set(`${split.name}@${split.range}`, entry.version);
-      if (split) entryByVersion.set(pkgKey(split.name, entry.version), entry);
-    }
-  }
-  return { descriptorToVersion, entryByVersion, lockfileVersion: 1 };
-}
-function parseBerry(content) {
-  const doc = yaml.load(content) ?? {};
-  const descriptorToVersion = /* @__PURE__ */ new Map();
-  const entryByVersion = /* @__PURE__ */ new Map();
-  let lockfileVersion = "berry";
-  for (const [rawKey, entry] of Object.entries(doc)) {
-    if (rawKey === "__metadata") {
-      const v = entry.version;
-      if (v !== void 0) lockfileVersion = v;
-      continue;
-    }
-    if (!entry.version) continue;
-    for (const descriptor of rawKey.split(/,\s*/)) {
-      const split = splitDescriptor(descriptor);
-      if (!split) continue;
-      descriptorToVersion.set(`${split.name}@${split.range}`, entry.version);
-      entryByVersion.set(pkgKey(split.name, entry.version), entry);
-    }
-  }
-  return { descriptorToVersion, entryByVersion, lockfileVersion };
-}
-function assemble(lockfilePath, manifest, descriptorToVersion, entryByVersion, lockfileVersion, isBerry) {
-  const resolve3 = (name, range) => {
-    const candidates = isBerry ? [`${name}@${range}`, `${name}@npm:${range}`] : [`${name}@${range}`];
-    for (const c of candidates) {
-      const v = descriptorToVersion.get(c);
-      if (v) return v;
-    }
-    return void 0;
-  };
-  const nodes = /* @__PURE__ */ Object.create(null);
-  for (const [key, entry] of entryByVersion) {
-    const at = key.lastIndexOf("@");
-    const name = key.slice(0, at);
-    const version = key.slice(at + 1);
-    if (!nodes[key]) nodes[key] = { key, name, version, dependencies: [] };
-    const addEdges = (deps) => {
-      for (const [depName, depRange] of Object.entries(deps ?? {})) {
-        const v = resolve3(depName, depRange);
-        if (!v) continue;
-        const targetKey = pkgKey(depName, v);
-        if (targetKey !== key) nodes[key].dependencies.push(targetKey);
-      }
-    };
-    addEdges(entry.dependencies);
-    addEdges(entry.optionalDependencies);
-  }
-  const toDirect = (deps) => {
-    const out = [];
-    for (const [name, range] of Object.entries(deps)) {
-      const v = resolve3(name, range);
-      if (v) out.push(pkgKey(name, v));
-    }
-    return out;
-  };
-  return {
-    manager: "yarn",
-    lockfilePath,
-    lockfileVersion,
-    root: { name: manifest.name, version: manifest.version },
-    nodes,
-    directProd: toDirect(manifest.dependencies),
-    directDev: toDirect(manifest.devDependencies),
-    directOptional: toDirect(manifest.optionalDependencies),
-    unscannable: []
-  };
-}
-
-// src/lockfiles/pnpm.ts
-import { readFileSync as readFileSync4 } from "fs";
-import { dirname as dirname3 } from "path";
-import yaml2 from "js-yaml";
-function parsePnpm(lockfilePath) {
-  const doc = yaml2.load(readFileSync4(lockfilePath, "utf8")) ?? {};
-  const manifest = readRootManifest(dirname3(lockfilePath));
-  const major = majorVersion(doc.lockfileVersion);
-  const nodes = /* @__PURE__ */ Object.create(null);
-  for (const key of Object.keys(doc.packages ?? {})) {
-    const parsed = parseKey(key, major);
-    if (!parsed) continue;
-    const nodeKey = pkgKey(parsed.name, parsed.version);
-    if (!nodes[nodeKey]) {
-      nodes[nodeKey] = {
-        key: nodeKey,
-        name: parsed.name,
-        version: parsed.version,
-        dependencies: []
-      };
-    }
-  }
-  const edgeSource = major >= 9 ? doc.snapshots ?? {} : doc.packages ?? {};
-  for (const [key, entry] of Object.entries(edgeSource)) {
-    const parsed = parseKey(key, major);
-    if (!parsed) continue;
-    const fromKey = pkgKey(parsed.name, parsed.version);
-    if (!nodes[fromKey]) {
-      nodes[fromKey] = {
-        key: fromKey,
-        name: parsed.name,
-        version: parsed.version,
-        dependencies: []
-      };
-    }
-    const addEdges = (deps) => {
-      for (const [depName, depValue] of Object.entries(deps ?? {})) {
-        const targetKey = pkgKey(depName, stripVersion(depValue, major));
-        if (targetKey !== fromKey && nodes[targetKey]) nodes[fromKey].dependencies.push(targetKey);
-      }
-    };
-    addEdges(entry.dependencies);
-    addEdges(entry.optionalDependencies);
-  }
-  const importers = doc.importers ?? {
-    ".": {
-      dependencies: doc.dependencies,
-      devDependencies: doc.devDependencies,
-      optionalDependencies: doc.optionalDependencies
-    }
-  };
-  const directProd = /* @__PURE__ */ new Set();
-  const directDev = /* @__PURE__ */ new Set();
-  const directOptional = /* @__PURE__ */ new Set();
-  const collect = (deps, into) => {
-    for (const [name, val] of Object.entries(deps ?? {})) {
-      const version = importerVersion(val, major);
-      if (!version) continue;
-      const key = pkgKey(name, version);
-      if (nodes[key]) into.add(key);
-    }
-  };
-  for (const imp of Object.values(importers)) {
-    collect(imp.dependencies, directProd);
-    collect(imp.optionalDependencies, directOptional);
-    collect(imp.devDependencies, directDev);
-  }
-  return {
-    manager: "pnpm",
-    lockfilePath,
-    lockfileVersion: doc.lockfileVersion,
-    root: { name: manifest.name, version: manifest.version },
-    nodes,
-    directProd: [...directProd],
-    directDev: [...directDev],
-    directOptional: [...directOptional],
-    unscannable: []
-  };
-}
-function majorVersion(v) {
-  const n = parseFloat(String(v ?? "9"));
-  return Number.isNaN(n) ? 9 : Math.floor(n);
-}
-function parseKey(key, major) {
-  const k = key.startsWith("/") ? key.slice(1) : key;
-  if (major < 6) {
-    const lastSlash = k.lastIndexOf("/");
-    if (lastSlash <= 0) return void 0;
-    const name2 = k.slice(0, lastSlash);
-    const version2 = stripVersion(k.slice(lastSlash + 1), major);
-    return version2 ? { name: name2, version: version2 } : void 0;
-  }
-  const at = k.lastIndexOf("@");
-  if (at <= 0) return void 0;
-  const name = k.slice(0, at);
-  const version = stripVersion(k.slice(at + 1), major);
-  return version ? { name, version } : void 0;
-}
-function stripVersion(value, major) {
-  let v = value;
-  if (major < 6) {
-    const us = v.indexOf("_");
-    if (us !== -1) v = v.slice(0, us);
-  }
-  const paren = v.indexOf("(");
-  if (paren !== -1) v = v.slice(0, paren);
-  return v;
-}
-function importerVersion(val, major) {
-  let ref;
-  if (typeof val === "string") ref = val;
-  else if (val && typeof val === "object" && typeof val.version === "string") {
-    ref = val.version;
-  }
-  if (!ref) return void 0;
-  if (ref.startsWith("link:") || ref.startsWith("file:") || ref.startsWith("workspace:"))
-    return void 0;
-  return stripVersion(ref, major);
-}
-
-// src/lockfiles/normalize.ts
-var LockfileError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "LockfileError";
-  }
-};
-function parseLockfile(detected) {
-  try {
-    switch (detected.manager) {
-      case "npm":
-        return parseNpm(detected.path);
-      case "yarn":
-        return parseYarn(detected.path);
-      case "pnpm":
-        return parsePnpm(detected.path);
-    }
-  } catch (err) {
-    throw new LockfileError(
-      `Failed to parse ${detected.filename}: ${err instanceof Error ? err.message : String(err)}`
-    );
-  }
-}
-function loadDependencyGraph(dir) {
-  const detected = detectLockfile(resolve(dir));
-  if (!detected) {
-    throw new LockfileError(
-      `No lockfile found in ${dir}. Expected one of: package-lock.json, yarn.lock, pnpm-lock.yaml.`
-    );
-  }
-  return buildDependencyGraph(parseLockfile(detected));
-}
-
-// src/graph/paths.ts
-function rootLabel(graph) {
-  return graph.root.version ? `${graph.root.name}@${graph.root.version}` : graph.root.name;
-}
-function shortestPath(graph, targetKey) {
-  if (!graph.nodes[targetKey]) return null;
-  const VIRTUAL_ROOT = "\0root";
-  const prev = /* @__PURE__ */ new Map();
-  const visited = /* @__PURE__ */ new Set([VIRTUAL_ROOT]);
-  const queue = [VIRTUAL_ROOT];
-  for (let i = 0; i < queue.length; i++) {
-    const current = queue[i];
-    const neighbors = current === VIRTUAL_ROOT ? graph.directKeys : graph.nodes[current]?.dependencies ?? [];
-    for (const next of neighbors) {
-      if (visited.has(next)) continue;
-      visited.add(next);
-      prev.set(next, current);
-      if (next === targetKey) return reconstruct(graph, prev, targetKey, VIRTUAL_ROOT);
-      queue.push(next);
-    }
-  }
-  return [rootLabel(graph), targetKey];
-}
-function reconstruct(graph, prev, target, virtualRoot) {
-  const path = [];
-  let cursor = target;
-  while (cursor !== void 0 && cursor !== virtualRoot) {
-    path.unshift(cursor);
-    cursor = prev.get(cursor);
-  }
-  path.unshift(rootLabel(graph));
-  return path;
-}
-
-// src/match/ranges.ts
-import semver from "semver";
-function isVersionAffected(version, affected) {
-  if (affected.versions?.includes(version)) return true;
-  const installed = semver.parse(version, { loose: true });
-  if (!installed) return false;
-  for (const range of affected.ranges ?? []) {
-    if (range.type === "GIT") continue;
-    if (rangeAffects(installed, range.events)) return true;
-  }
-  return false;
-}
-function rangeAffects(installed, events) {
-  const boundaries = [];
-  for (const event of events) {
-    if (event.introduced !== void 0) {
-      boundaries.push({
-        kind: "introduced",
-        version: event.introduced === "0" ? null : parse(event.introduced)
-      });
-    } else if (event.fixed !== void 0) {
-      boundaries.push({ kind: "fixed", version: parse(event.fixed) });
-    } else if (event.last_affected !== void 0) {
-      boundaries.push({ kind: "last_affected", version: parse(event.last_affected) });
-    }
-  }
-  boundaries.sort((a, b) => {
-    if (a.version === null) return b.version === null ? 0 : -1;
-    if (b.version === null) return 1;
-    return a.version.compare(b.version);
-  });
-  let affected = false;
-  for (const boundary of boundaries) {
-    if (boundary.version === null) {
-      affected = true;
-      continue;
-    }
-    const cmp = installed.compare(boundary.version);
-    switch (boundary.kind) {
-      case "introduced":
-        if (cmp >= 0) affected = true;
-        break;
-      case "fixed":
-        if (cmp >= 0) affected = false;
-        break;
-      case "last_affected":
-        if (cmp > 0) affected = false;
-        break;
-    }
-  }
-  return affected;
-}
-function parse(version) {
-  return semver.parse(version, { loose: true }) ?? semver.coerce(version);
-}
-function vulnerabilityAffects(name, version, vuln) {
-  if (vuln.withdrawn) return { affected: false, fixedVersions: [] };
-  let affected = false;
-  const fixed = /* @__PURE__ */ new Set();
-  for (const entry of vuln.affected ?? []) {
-    const ecosystem = entry.package?.ecosystem;
-    if (ecosystem && ecosystem !== "npm") continue;
-    if (entry.package?.name && entry.package.name !== name) continue;
-    if (!isVersionAffected(version, entry)) continue;
-    affected = true;
-    for (const range of entry.ranges ?? []) {
-      for (const event of range.events) {
-        if (event.fixed) fixed.add(event.fixed);
-      }
-    }
-  }
-  return { affected, fixedVersions: [...fixed] };
-}
-function nearestFix(installed, fixedVersions) {
-  const current = semver.parse(installed, { loose: true });
-  const candidates = fixedVersions.map((v) => semver.parse(v, { loose: true }) ?? semver.coerce(v)).filter((v) => v !== null).filter((v) => current ? v.compare(current) > 0 : true).sort((a, b) => a.compare(b));
-  return candidates[0]?.version;
-}
-
-// src/match/dedupe.ts
-function tokensOf(vuln) {
-  return [vuln.id, ...vuln.aliases ?? []];
-}
-function canonicalId(ids) {
-  const list = [...ids];
-  return list.find((id) => id.startsWith("CVE-")) ?? list.find((id) => id.startsWith("GHSA-")) ?? list[0];
-}
-function dedupeVulnerabilities(vulns) {
-  if (vulns.length <= 1) return vulns;
-  const parent = /* @__PURE__ */ new Map();
-  const find = (x) => {
-    let root = x;
-    while (parent.get(root) !== void 0 && parent.get(root) !== root) root = parent.get(root);
-    parent.set(x, root);
-    return root;
-  };
-  const union = (a, b) => {
-    parent.set(find(a), find(b));
-  };
-  for (const vuln of vulns) {
-    const tokens = tokensOf(vuln);
-    if (!parent.has(tokens[0])) parent.set(tokens[0], tokens[0]);
-    for (const token of tokens.slice(1)) {
-      if (!parent.has(token)) parent.set(token, token);
-      union(tokens[0], token);
-    }
-  }
-  const groups = /* @__PURE__ */ new Map();
-  for (const vuln of vulns) {
-    const root = find(vuln.id);
-    const group = groups.get(root);
-    if (group) group.push(vuln);
-    else groups.set(root, [vuln]);
-  }
-  return [...groups.values()].map(mergeGroup);
-}
-function mergeGroup(group) {
-  if (group.length === 1) return group[0];
-  const allIds = /* @__PURE__ */ new Set();
-  const references = /* @__PURE__ */ new Map();
-  const severity = [];
-  const affected = [];
-  let summary;
-  let details;
-  let database_specific;
-  for (const vuln of group) {
-    for (const token of tokensOf(vuln)) allIds.add(token);
-    for (const ref of vuln.references ?? []) references.set(ref.url, ref);
-    for (const sev of vuln.severity ?? []) severity.push(sev);
-    for (const aff of vuln.affected ?? []) affected.push(aff);
-    summary ??= vuln.summary;
-    details ??= vuln.details;
-    database_specific ??= vuln.database_specific;
-  }
-  const id = canonicalId(allIds);
-  return {
-    id,
-    aliases: [...allIds].filter((token) => token !== id),
-    summary,
-    details,
-    references: [...references.values()],
-    severity,
-    affected,
-    database_specific
-  };
-}
-
-// src/match/findings.ts
-import semver2 from "semver";
-
-// src/score/cvss4-data.ts
-var CVSS4_LOOKUP = {
-  "100000": 9.8,
-  "100001": 9.5,
-  "100010": 9.4,
-  "100011": 8.7,
-  "100020": 9.1,
-  "100021": 8.1,
-  "100100": 9.4,
-  "100101": 8.9,
-  "100110": 8.6,
-  "100111": 7.4,
-  "100120": 7.7,
-  "100121": 6.4,
-  "100200": 8.7,
-  "100201": 7.5,
-  "100210": 7.4,
-  "100211": 6.3,
-  "100220": 6.3,
-  "100221": 4.9,
-  "101000": 9.4,
-  "101001": 8.9,
-  "101010": 8.8,
-  "101011": 7.7,
-  "101020": 7.6,
-  "101021": 6.7,
-  "101100": 8.6,
-  "101101": 7.6,
-  "101110": 7.4,
-  "101111": 5.8,
-  "101120": 5.9,
-  "101121": 5,
-  "101200": 7.2,
-  "101201": 5.7,
-  "101210": 5.7,
-  "101211": 5.2,
-  "101220": 5.2,
-  "101221": 2.5,
-  "102001": 8.3,
-  "102011": 7,
-  "102021": 5.4,
-  "102101": 6.5,
-  "102111": 5.8,
-  "102121": 2.6,
-  "102201": 5.3,
-  "102211": 2.1,
-  "102221": 1.3,
-  "110000": 9.5,
-  "110001": 9,
-  "110010": 8.8,
-  "110011": 7.6,
-  "110020": 7.6,
-  "110021": 7,
-  "110100": 9,
-  "110101": 7.7,
-  "110110": 7.5,
-  "110111": 6.2,
-  "110120": 6.1,
-  "110121": 5.3,
-  "110200": 7.7,
-  "110201": 6.6,
-  "110210": 6.8,
-  "110211": 5.9,
-  "110220": 5.2,
-  "110221": 3,
-  "111000": 8.9,
-  "111001": 7.8,
-  "111010": 7.6,
-  "111011": 6.7,
-  "111020": 6.2,
-  "111021": 5.8,
-  "111100": 7.4,
-  "111101": 5.9,
-  "111110": 5.7,
-  "111111": 5.7,
-  "111120": 4.7,
-  "111121": 2.3,
-  "111200": 6.1,
-  "111201": 5.2,
-  "111210": 5.7,
-  "111211": 2.9,
-  "111220": 2.4,
-  "111221": 1.6,
-  "112001": 7.1,
-  "112011": 5.9,
-  "112021": 3,
-  "112101": 5.8,
-  "112111": 2.6,
-  "112121": 1.5,
-  "112201": 2.3,
-  "112211": 1.3,
-  "112221": 0.6,
-  "200000": 9.3,
-  "200001": 8.7,
-  "200010": 8.6,
-  "200011": 7.2,
-  "200020": 7.5,
-  "200021": 5.8,
-  "200100": 8.6,
-  "200101": 7.4,
-  "200110": 7.4,
-  "200111": 6.1,
-  "200120": 5.6,
-  "200121": 3.4,
-  "200200": 7,
-  "200201": 5.4,
-  "200210": 5.2,
-  "200211": 4,
-  "200220": 4,
-  "200221": 2.2,
-  "201000": 8.5,
-  "201001": 7.5,
-  "201010": 7.4,
-  "201011": 5.5,
-  "201020": 6.2,
-  "201021": 5.1,
-  "201100": 7.2,
-  "201101": 5.7,
-  "201110": 5.5,
-  "201111": 4.1,
-  "201120": 4.6,
-  "201121": 1.9,
-  "201200": 5.3,
-  "201201": 3.6,
-  "201210": 3.4,
-  "201211": 1.9,
-  "201220": 1.9,
-  "201221": 0.8,
-  "202001": 6.4,
-  "202011": 5.1,
-  "202021": 2,
-  "202101": 4.7,
-  "202111": 2.1,
-  "202121": 1.1,
-  "202201": 2.4,
-  "202211": 0.9,
-  "202221": 0.4,
-  "210000": 8.8,
-  "210001": 7.5,
-  "210010": 7.3,
-  "210011": 5.3,
-  "210020": 6,
-  "210021": 5,
-  "210100": 7.3,
-  "210101": 5.5,
-  "210110": 5.9,
-  "210111": 4,
-  "210120": 4.1,
-  "210121": 2,
-  "210200": 5.4,
-  "210201": 4.3,
-  "210210": 4.5,
-  "210211": 2.2,
-  "210220": 2,
-  "210221": 1.1,
-  "211000": 7.5,
-  "211001": 5.5,
-  "211010": 5.8,
-  "211011": 4.5,
-  "211020": 4,
-  "211021": 2.1,
-  "211100": 6.1,
-  "211101": 5.1,
-  "211110": 4.8,
-  "211111": 1.8,
-  "211120": 2,
-  "211121": 0.9,
-  "211200": 4.6,
-  "211201": 1.8,
-  "211210": 1.7,
-  "211211": 0.7,
-  "211220": 0.8,
-  "211221": 0.2,
-  "212001": 5.3,
-  "212011": 2.4,
-  "212021": 1.4,
-  "212101": 2.4,
-  "212111": 1.2,
-  "212121": 0.5,
-  "212201": 1,
-  "212211": 0.3,
-  "212221": 0.1,
-  "000000": 10,
-  "000001": 9.9,
-  "000010": 9.8,
-  "000011": 9.5,
-  "000020": 9.5,
-  "000021": 9.2,
-  "000100": 10,
-  "000101": 9.6,
-  "000110": 9.3,
-  "000111": 8.7,
-  "000120": 9.1,
-  "000121": 8.1,
-  "000200": 9.3,
-  "000201": 9,
-  "000210": 8.9,
-  "000211": 8,
-  "000220": 8.1,
-  "000221": 6.8,
-  "001000": 9.8,
-  "001001": 9.5,
-  "001010": 9.5,
-  "001011": 9.2,
-  "001020": 9,
-  "001021": 8.4,
-  "001100": 9.3,
-  "001101": 9.2,
-  "001110": 8.9,
-  "001111": 8.1,
-  "001120": 8.1,
-  "001121": 6.5,
-  "001200": 8.8,
-  "001201": 8,
-  "001210": 7.8,
-  "001211": 7,
-  "001220": 6.9,
-  "001221": 4.8,
-  "002001": 9.2,
-  "002011": 8.2,
-  "002021": 7.2,
-  "002101": 7.9,
-  "002111": 6.9,
-  "002121": 5,
-  "002201": 6.9,
-  "002211": 5.5,
-  "002221": 2.7,
-  "010000": 9.9,
-  "010001": 9.7,
-  "010010": 9.5,
-  "010011": 9.2,
-  "010020": 9.2,
-  "010021": 8.5,
-  "010100": 9.5,
-  "010101": 9.1,
-  "010110": 9,
-  "010111": 8.3,
-  "010120": 8.4,
-  "010121": 7.1,
-  "010200": 9.2,
-  "010201": 8.1,
-  "010210": 8.2,
-  "010211": 7.1,
-  "010220": 7.2,
-  "010221": 5.3,
-  "011000": 9.5,
-  "011001": 9.3,
-  "011010": 9.2,
-  "011011": 8.5,
-  "011020": 8.5,
-  "011021": 7.3,
-  "011100": 9.2,
-  "011101": 8.2,
-  "011110": 8,
-  "011111": 7.2,
-  "011120": 7,
-  "011121": 5.9,
-  "011200": 8.4,
-  "011201": 7,
-  "011210": 7.1,
-  "011211": 5.2,
-  "011220": 5,
-  "011221": 3,
-  "012001": 8.6,
-  "012011": 7.5,
-  "012021": 5.2,
-  "012101": 7.1,
-  "012111": 5.2,
-  "012121": 2.9,
-  "012201": 6.3,
-  "012211": 2.9,
-  "012221": 1.7
-};
-var CVSS4_MAX_COMPOSED = {
-  eq1: {
-    "0": ["AV:N/PR:N/UI:N/"],
-    "1": ["AV:A/PR:N/UI:N/", "AV:N/PR:L/UI:N/", "AV:N/PR:N/UI:P/"],
-    "2": ["AV:P/PR:N/UI:N/", "AV:A/PR:L/UI:P/"]
-  },
-  eq2: {
-    "0": ["AC:L/AT:N/"],
-    "1": ["AC:H/AT:N/", "AC:L/AT:P/"]
-  },
-  eq3: {
-    "0": {
-      "0": ["VC:H/VI:H/VA:H/CR:H/IR:H/AR:H/"],
-      "1": ["VC:H/VI:H/VA:L/CR:M/IR:M/AR:H/", "VC:H/VI:H/VA:H/CR:M/IR:M/AR:M/"]
-    },
-    "1": {
-      "0": ["VC:L/VI:H/VA:H/CR:H/IR:H/AR:H/", "VC:H/VI:L/VA:H/CR:H/IR:H/AR:H/"],
-      "1": [
-        "VC:L/VI:H/VA:L/CR:H/IR:M/AR:H/",
-        "VC:L/VI:H/VA:H/CR:H/IR:M/AR:M/",
-        "VC:H/VI:L/VA:H/CR:M/IR:H/AR:M/",
-        "VC:H/VI:L/VA:L/CR:M/IR:H/AR:H/",
-        "VC:L/VI:L/VA:H/CR:H/IR:H/AR:M/"
-      ]
-    },
-    "2": {
-      "1": ["VC:L/VI:L/VA:L/CR:H/IR:H/AR:H/"]
-    }
-  },
-  eq4: {
-    "0": ["SC:H/SI:S/SA:S/"],
-    "1": ["SC:H/SI:H/SA:H/"],
-    "2": ["SC:L/SI:L/SA:L/"]
-  },
-  eq5: {
-    "0": ["E:A/"],
-    "1": ["E:P/"],
-    "2": ["E:U/"]
-  }
-};
-var CVSS4_MAX_SEVERITY = {
-  eq1: {
-    "0": 1,
-    "1": 4,
-    "2": 5
-  },
-  eq2: {
-    "0": 1,
-    "1": 2
-  },
-  eq3eq6: {
-    "0": {
-      "0": 7,
-      "1": 6
-    },
-    "1": {
-      "0": 8,
-      "1": 8
-    },
-    "2": {
-      "1": 10
-    }
-  },
-  eq4: {
-    "0": 6,
-    "1": 5,
-    "2": 4
-  },
-  eq5: {
-    "0": 1,
-    "1": 1,
-    "2": 1
-  }
-};
-
-// src/score/cvss4.ts
-var BASE_METRICS = ["AV", "AC", "AT", "PR", "UI", "VC", "VI", "VA", "SC", "SI", "SA"];
-var AV_levels = { N: 0, A: 0.1, L: 0.2, P: 0.3 };
-var PR_levels = { N: 0, L: 0.1, H: 0.2 };
-var UI_levels = { N: 0, P: 0.1, A: 0.2 };
-var AC_levels = { L: 0, H: 0.1 };
-var AT_levels = { N: 0, P: 0.1 };
-var VC_levels = { H: 0, L: 0.1, N: 0.2 };
-var VI_levels = { H: 0, L: 0.1, N: 0.2 };
-var VA_levels = { H: 0, L: 0.1, N: 0.2 };
-var SC_levels = { H: 0.1, L: 0.2, N: 0.3 };
-var SI_levels = { S: 0, H: 0.1, L: 0.2, N: 0.3 };
-var SA_levels = { S: 0, H: 0.1, L: 0.2, N: 0.3 };
-var CR_levels = { H: 0, M: 0.1, L: 0.2 };
-var IR_levels = { H: 0, M: 0.1, L: 0.2 };
-var AR_levels = { H: 0, M: 0.1, L: 0.2 };
-function scoreV4(vector) {
-  const sel = parseV4(vector);
-  if (!sel) return null;
-  const macro = macroVector(sel);
-  if (CVSS4_LOOKUP[macro] === void 0) return null;
-  return cvssScore(sel, macro);
-}
-function parseV4(vector) {
-  const parts = vector.split("/");
-  if (parts[0] !== "CVSS:4.0") return null;
-  const sel = {};
-  for (const part of parts.slice(1)) {
-    const [k, v] = part.split(":");
-    if (k && v) sel[k] = v;
-  }
-  for (const metric of BASE_METRICS) if (!(metric in sel)) return null;
-  for (const metric of ["E", "CR", "IR", "AR"]) if (!(metric in sel)) sel[metric] = "X";
-  return sel;
-}
-function m(sel, metric) {
-  const selected = sel[metric];
-  if (metric === "E" && selected === "X") return "A";
-  if ((metric === "CR" || metric === "IR" || metric === "AR") && selected === "X") return "H";
-  const modified = sel[`M${metric}`];
-  if (modified !== void 0 && modified !== "X") return modified;
-  return selected ?? "";
-}
-function macroVector(sel) {
-  const av = m(sel, "AV");
-  const pr = m(sel, "PR");
-  const ui = m(sel, "UI");
-  let eq1 = "2";
-  if (av === "N" && pr === "N" && ui === "N") eq1 = "0";
-  else if ((av === "N" || pr === "N" || ui === "N") && av !== "P") eq1 = "1";
-  const eq2 = m(sel, "AC") === "L" && m(sel, "AT") === "N" ? "0" : "1";
-  const vc = m(sel, "VC");
-  const vi = m(sel, "VI");
-  const va = m(sel, "VA");
-  let eq3 = "2";
-  if (vc === "H" && vi === "H") eq3 = "0";
-  else if (vc === "H" || vi === "H" || va === "H") eq3 = "1";
-  const msi = m(sel, "MSI");
-  const msa = m(sel, "MSA");
-  let eq4 = "2";
-  if (msi === "S" || msa === "S") eq4 = "0";
-  else if (m(sel, "SC") === "H" || m(sel, "SI") === "H" || m(sel, "SA") === "H") eq4 = "1";
-  const e = m(sel, "E");
-  const eq5 = e === "A" ? "0" : e === "P" ? "1" : "2";
-  const cr = m(sel, "CR");
-  const ir = m(sel, "IR");
-  const ar = m(sel, "AR");
-  const eq6 = cr === "H" && vc === "H" || ir === "H" && vi === "H" || ar === "H" && va === "H" ? "0" : "1";
-  return `${eq1}${eq2}${eq3}${eq4}${eq5}${eq6}`;
-}
-function lvl(map, key) {
-  return map[key] ?? 0;
-}
-function eqMaxes(macro, eq) {
-  const group = CVSS4_MAX_COMPOSED[`eq${eq}`];
-  return group[macro[eq - 1]] ?? [];
-}
-function extractValueMetric(metric, str) {
-  const start = str.indexOf(metric) + metric.length + 1;
-  const rest = str.slice(start);
-  const slash = rest.indexOf("/");
-  return slash > 0 ? rest.substring(0, slash) : rest;
-}
-function cvssScore(sel, macro) {
-  if (BASE_METRICS.slice(5).every((metric) => m(sel, metric) === "N")) return 0;
-  let value = CVSS4_LOOKUP[macro];
-  const eq1 = Number(macro[0]);
-  const eq3 = Number(macro[2]);
-  const eq6 = Number(macro[5]);
-  const lower = (parts) => CVSS4_LOOKUP[parts.join("")] ?? NaN;
-  const d = macro.split("").map(Number);
-  const scoreEq1Lower = lower([d[0] + 1, d[1], d[2], d[3], d[4], d[5]]);
-  const scoreEq2Lower = lower([d[0], d[1] + 1, d[2], d[3], d[4], d[5]]);
-  let scoreEq3Eq6Lower;
-  if (eq3 === 1 && eq6 === 1) scoreEq3Eq6Lower = lower([d[0], d[1], d[2] + 1, d[3], d[4], d[5]]);
-  else if (eq3 === 0 && eq6 === 1)
-    scoreEq3Eq6Lower = lower([d[0], d[1], d[2] + 1, d[3], d[4], d[5]]);
-  else if (eq3 === 1 && eq6 === 0)
-    scoreEq3Eq6Lower = lower([d[0], d[1], d[2], d[3], d[4], d[5] + 1]);
-  else if (eq3 === 0 && eq6 === 0) {
-    const left = lower([d[0], d[1], d[2], d[3], d[4], d[5] + 1]);
-    const right = lower([d[0], d[1], d[2] + 1, d[3], d[4], d[5]]);
-    scoreEq3Eq6Lower = left > right ? left : right;
-  } else scoreEq3Eq6Lower = lower([d[0], d[1], d[2] + 1, d[3], d[4], d[5] + 1]);
-  const scoreEq4Lower = lower([d[0], d[1], d[2], d[3] + 1, d[4], d[5]]);
-  const scoreEq5Lower = lower([d[0], d[1], d[2], d[3], d[4] + 1, d[5]]);
-  const eq1Maxes = eqMaxes(macro, 1);
-  const eq2Maxes = eqMaxes(macro, 2);
-  const eq3Eq6Maxes = CVSS4_MAX_COMPOSED.eq3[macro[2]][macro[5]];
-  const eq4Maxes = eqMaxes(macro, 4);
-  const eq5Maxes = eqMaxes(macro, 5);
-  const maxVectors = [];
-  for (const a of eq1Maxes)
-    for (const b of eq2Maxes)
-      for (const c of eq3Eq6Maxes)
-        for (const e of eq4Maxes) for (const f of eq5Maxes) maxVectors.push(a + b + c + e + f);
-  let sdAV = 0, sdPR = 0, sdUI = 0, sdAC = 0, sdAT = 0, sdVC = 0, sdVI = 0, sdVA = 0, sdSC = 0, sdSI = 0, sdSA = 0, sdCR = 0, sdIR = 0, sdAR = 0;
-  for (const maxVector of maxVectors) {
-    sdAV = lvl(AV_levels, m(sel, "AV")) - lvl(AV_levels, extractValueMetric("AV", maxVector));
-    sdPR = lvl(PR_levels, m(sel, "PR")) - lvl(PR_levels, extractValueMetric("PR", maxVector));
-    sdUI = lvl(UI_levels, m(sel, "UI")) - lvl(UI_levels, extractValueMetric("UI", maxVector));
-    sdAC = lvl(AC_levels, m(sel, "AC")) - lvl(AC_levels, extractValueMetric("AC", maxVector));
-    sdAT = lvl(AT_levels, m(sel, "AT")) - lvl(AT_levels, extractValueMetric("AT", maxVector));
-    sdVC = lvl(VC_levels, m(sel, "VC")) - lvl(VC_levels, extractValueMetric("VC", maxVector));
-    sdVI = lvl(VI_levels, m(sel, "VI")) - lvl(VI_levels, extractValueMetric("VI", maxVector));
-    sdVA = lvl(VA_levels, m(sel, "VA")) - lvl(VA_levels, extractValueMetric("VA", maxVector));
-    sdSC = lvl(SC_levels, m(sel, "SC")) - lvl(SC_levels, extractValueMetric("SC", maxVector));
-    sdSI = lvl(SI_levels, m(sel, "SI")) - lvl(SI_levels, extractValueMetric("SI", maxVector));
-    sdSA = lvl(SA_levels, m(sel, "SA")) - lvl(SA_levels, extractValueMetric("SA", maxVector));
-    sdCR = lvl(CR_levels, m(sel, "CR")) - lvl(CR_levels, extractValueMetric("CR", maxVector));
-    sdIR = lvl(IR_levels, m(sel, "IR")) - lvl(IR_levels, extractValueMetric("IR", maxVector));
-    sdAR = lvl(AR_levels, m(sel, "AR")) - lvl(AR_levels, extractValueMetric("AR", maxVector));
-    const distances = [
-      sdAV,
-      sdPR,
-      sdUI,
-      sdAC,
-      sdAT,
-      sdVC,
-      sdVI,
-      sdVA,
-      sdSC,
-      sdSI,
-      sdSA,
-      sdCR,
-      sdIR,
-      sdAR
-    ];
-    if (distances.some((x) => x < 0)) continue;
-    break;
-  }
-  const csdEq1 = sdAV + sdPR + sdUI;
-  const csdEq2 = sdAC + sdAT;
-  const csdEq3Eq6 = sdVC + sdVI + sdVA + sdCR + sdIR + sdAR;
-  const csdEq4 = sdSC + sdSI + sdSA;
-  const step = 0.1;
-  const availEq1 = value - scoreEq1Lower;
-  const availEq2 = value - scoreEq2Lower;
-  const availEq3Eq6 = value - scoreEq3Eq6Lower;
-  const availEq4 = value - scoreEq4Lower;
-  const availEq5 = value - scoreEq5Lower;
-  const maxSev = CVSS4_MAX_SEVERITY;
-  const maxSevEq1 = maxSev.eq1[String(eq1)] * step;
-  const maxSevEq2 = maxSev.eq2[macro[1]] * step;
-  const maxSevEq3Eq6 = maxSev.eq3eq6[String(eq3)][String(eq6)] * step;
-  const maxSevEq4 = maxSev.eq4[macro[3]] * step;
-  let n = 0;
-  let nsEq1 = 0, nsEq2 = 0, nsEq3Eq6 = 0, nsEq4 = 0;
-  if (!Number.isNaN(availEq1)) {
-    n++;
-    nsEq1 = availEq1 * (csdEq1 / maxSevEq1);
-  }
-  if (!Number.isNaN(availEq2)) {
-    n++;
-    nsEq2 = availEq2 * (csdEq2 / maxSevEq2);
-  }
-  if (!Number.isNaN(availEq3Eq6)) {
-    n++;
-    nsEq3Eq6 = availEq3Eq6 * (csdEq3Eq6 / maxSevEq3Eq6);
-  }
-  if (!Number.isNaN(availEq4)) {
-    n++;
-    nsEq4 = availEq4 * (csdEq4 / maxSevEq4);
-  }
-  if (!Number.isNaN(availEq5)) {
-    n++;
-  }
-  const meanDistance = n === 0 ? 0 : (nsEq1 + nsEq2 + nsEq3Eq6 + nsEq4) / n;
-  value -= meanDistance;
-  if (value < 0) value = 0;
-  if (value > 10) value = 10;
-  return Math.round(value * 10) / 10;
-}
-
-// src/score/cvss.ts
-var AV = { N: 0.85, A: 0.62, L: 0.55, P: 0.2 };
-var AC = { L: 0.77, H: 0.44 };
-var UI = { N: 0.85, R: 0.62 };
-var PR_UNCHANGED = { N: 0.85, L: 0.62, H: 0.27 };
-var PR_CHANGED = { N: 0.85, L: 0.68, H: 0.5 };
-var CIA = { H: 0.56, L: 0.22, N: 0 };
-function levelFromScore(score) {
-  if (score <= 0) return "none";
-  if (score < 4) return "low";
-  if (score < 7) return "medium";
-  if (score < 9) return "high";
-  return "critical";
-}
-function levelFromLabel(label) {
-  switch (label.trim().toUpperCase()) {
-    case "CRITICAL":
-      return "critical";
-    case "HIGH":
-      return "high";
-    case "MODERATE":
-    case "MEDIUM":
-      return "medium";
-    case "LOW":
-      return "low";
-    case "NONE":
-      return "none";
-    default:
-      return "unknown";
-  }
-}
-function roundUp(input) {
-  const scaled = Math.round(input * 1e5);
-  if (scaled % 1e4 === 0) return scaled / 1e5;
-  return (Math.floor(scaled / 1e4) + 1) / 10;
-}
-function scoreFromVector(vector) {
-  const parts = vector.split("/");
-  const header = parts[0] ?? "";
-  if (header === "CVSS:4.0") {
-    const score2 = scoreV4(vector);
-    return score2 === null ? null : { score: score2, level: levelFromScore(score2), version: header };
-  }
-  if (!/^CVSS:3\.[01]$/.test(header)) return null;
-  const m2 = {};
-  for (const part of parts.slice(1)) {
-    const [k, v] = part.split(":");
-    if (k && v) m2[k] = v;
-  }
-  const av = AV[m2.AV ?? ""];
-  const ac = AC[m2.AC ?? ""];
-  const ui = UI[m2.UI ?? ""];
-  const scopeChanged = m2.S === "C";
-  const pr = (scopeChanged ? PR_CHANGED : PR_UNCHANGED)[m2.PR ?? ""];
-  const c = CIA[m2.C ?? ""];
-  const i = CIA[m2.I ?? ""];
-  const a = CIA[m2.A ?? ""];
-  if ([av, ac, ui, pr, c, i, a].some((x) => x === void 0)) return null;
-  const iss = 1 - (1 - c) * (1 - i) * (1 - a);
-  const impact = scopeChanged ? 7.52 * (iss - 0.029) - 3.25 * Math.pow(iss - 0.02, 15) : 6.42 * iss;
-  const exploitability = 8.22 * av * ac * pr * ui;
-  let score;
-  if (impact <= 0) score = 0;
-  else if (scopeChanged) score = roundUp(Math.min(1.08 * (impact + exploitability), 10));
-  else score = roundUp(Math.min(impact + exploitability, 10));
-  return { score, level: levelFromScore(score), version: header };
-}
-function resolveSeverity(vuln) {
-  const vectors = [];
-  for (const s of vuln.severity ?? []) if (s.score) vectors.push(s.score);
-  for (const affected of vuln.affected ?? []) {
-    for (const s of affected.severity ?? []) if (s.score) vectors.push(s.score);
-  }
-  let best = null;
-  for (const vector of vectors) {
-    const result = scoreFromVector(vector);
-    if (result && (!best || result.score > best.score)) best = result;
-  }
-  if (best) {
-    return {
-      level: best.level,
-      score: best.score,
-      vector: vectorFor(best, vectors),
-      cvssVersion: best.version,
-      source: "cvss"
-    };
-  }
-  const label = qualitativeLabel(vuln);
-  if (label) return { level: levelFromLabel(label), source: "database" };
-  return { level: "unknown", source: "unknown" };
-}
-function vectorFor(best, vectors) {
-  return vectors.find((v) => v.startsWith(best.version));
-}
-function qualitativeLabel(vuln) {
-  const fromRecord = (db) => {
-    const sev = db?.severity;
-    return typeof sev === "string" ? sev : void 0;
-  };
-  const top = fromRecord(vuln.database_specific);
-  if (top) return top;
-  for (const affected of vuln.affected ?? []) {
-    const label = fromRecord(affected.database_specific);
-    if (label) return label;
-  }
-  return void 0;
-}
-
-// src/match/findings.ts
-function buildFindings(graph, candidatesFor, options = {}) {
-  const findings = [];
-  for (const node of Object.values(graph.nodes)) {
-    if (node.unscannable) continue;
-    if (options.prodOnly && node.scope === "dev") continue;
-    const candidates = candidatesFor(node.name);
-    if (candidates.length === 0) continue;
-    const matched = candidates.filter(
-      (vuln) => vulnerabilityAffects(node.name, node.version, vuln).affected
-    );
-    if (matched.length === 0) continue;
-    const path = shortestPath(graph, node.key);
-    for (const vuln of dedupeVulnerabilities(matched)) {
-      if (isIgnored(vuln, options.ignore)) continue;
-      const { fixedVersions } = vulnerabilityAffects(node.name, node.version, vuln);
-      const sortedFixes = sortVersions(fixedVersions);
-      const nearest = nearestFix(node.version, fixedVersions);
-      findings.push({
-        id: vuln.id,
-        aliases: vuln.aliases ?? [],
-        packageName: node.name,
-        version: node.version,
-        scope: node.scope,
-        direct: node.direct,
-        severity: resolveSeverity(vuln),
-        summary: vuln.summary ?? vuln.id,
-        details: vuln.details,
-        references: (vuln.references ?? []).map((ref) => ref.url),
-        fixedVersions: sortedFixes,
-        recommendation: buildRecommendation(node.name, node.direct, nearest, graph.manager),
-        dependencyPaths: path ? [path] : [],
-        source: "osv"
-      });
-    }
-  }
-  return findings;
-}
-function isIgnored(vuln, ignore) {
-  if (!ignore || ignore.size === 0) return false;
-  if (ignore.has(vuln.id)) return true;
-  return (vuln.aliases ?? []).some((alias) => ignore.has(alias));
-}
-function sortVersions(versions) {
-  return [...new Set(versions)].sort((a, b) => {
-    const pa = semver2.parse(a, { loose: true });
-    const pb = semver2.parse(b, { loose: true });
-    if (pa && pb) return pa.compare(pb);
-    return a.localeCompare(b);
-  });
-}
-var INSTALL_COMMAND = {
-  npm: "npm install",
-  yarn: "yarn add",
-  pnpm: "pnpm add"
-};
-function buildRecommendation(name, direct, nearest, manager) {
-  if (!nearest) {
-    return direct ? "No fixed version is available yet. Watch the advisory, or evaluate an alternative package." : "No fixed version is available yet. Pressure the parent dependency to update, or override the version.";
-  }
-  if (direct) {
-    return `Upgrade to ${name}@${nearest} or later (e.g. \`${INSTALL_COMMAND[manager]} ${name}@${nearest}\`).`;
-  }
-  return `Update the dependency that pulls in ${name} so it resolves to ${name}@${nearest} or later. If it cannot, force the resolution via an override.`;
-}
-
-// src/osv/database.ts
-var OsvDatabase = class {
-  byName = /* @__PURE__ */ new Map();
-  ids = /* @__PURE__ */ new Set();
-  add(vuln) {
-    if (vuln.withdrawn) return;
-    if (this.ids.has(vuln.id)) return;
-    this.ids.add(vuln.id);
-    const names = /* @__PURE__ */ new Set();
-    for (const affected of vuln.affected ?? []) {
-      const ecosystem = affected.package?.ecosystem;
-      if (ecosystem && ecosystem !== "npm") continue;
-      if (affected.package?.name) names.add(affected.package.name);
-    }
-    for (const name of names) {
-      const list = this.byName.get(name);
-      if (list) list.push(vuln);
-      else this.byName.set(name, [vuln]);
-    }
-  }
-  addAll(vulns) {
-    for (const vuln of vulns) this.add(vuln);
-  }
-  /** Candidate advisories that name `packageName` (still need a version check). */
-  vulnerabilitiesFor(packageName) {
-    return this.byName.get(packageName) ?? [];
-  }
-  /** Number of distinct advisories indexed. */
-  get size() {
-    return this.ids.size;
-  }
-};
-
-// src/engine.ts
-import { resolve as resolve2 } from "path";
-
-// src/cache/paths.ts
-import { join as join2 } from "path";
-import envPaths from "env-paths";
-function resolveCacheDir(override) {
-  if (override) return override;
-  if (process.env.LOCKHAWK_CACHE) return process.env.LOCKHAWK_CACHE;
-  return envPaths("lockhawk", { suffix: "" }).cache;
-}
-function offlineDbDir(cacheDir) {
-  return join2(cacheDir, "osv-db", "npm");
-}
-var SHARD_BUCKETS = 4096;
-function shardBucket(packageName) {
-  let hash = 2166136261;
-  for (let i = 0; i < packageName.length; i++) {
-    hash ^= packageName.charCodeAt(i);
-    hash = Math.imul(hash, 16777619);
-  }
-  return (hash >>> 0) % SHARD_BUCKETS;
-}
-function offlineMetaPath(cacheDir) {
-  return join2(offlineDbDir(cacheDir), "meta.json");
-}
-function queryCachePath(cacheDir, id) {
-  return join2(cacheDir, "query-cache", `${encodeURIComponent(id)}.json`);
-}
-
-// src/osv/client.ts
-import { mkdir, readFile, writeFile } from "fs/promises";
-import { dirname as dirname4 } from "path";
-import pLimit from "p-limit";
-import pRetry, { AbortError } from "p-retry";
-var OSV_API = "https://api.osv.dev/v1";
-var BATCH_SIZE = 1e3;
-var OsvClient = class {
-  constructor(opts) {
-    this.opts = opts;
-    this.limit = pLimit(opts.concurrency ?? 5);
-  }
-  opts;
-  limit;
-  /** Fetch advisories affecting the given packages, keyed by package name. */
-  async fetchAdvisories(packages) {
-    const unique = dedupePackages(packages);
-    const idsByName = await this.queryBatch(unique);
-    const allIds = /* @__PURE__ */ new Set();
-    for (const ids of idsByName.values()) for (const id of ids) allIds.add(id);
-    const records = await this.hydrate([...allIds]);
-    const byName = /* @__PURE__ */ new Map();
-    for (const [name, ids] of idsByName) {
-      const list = [];
-      for (const id of ids) {
-        const record = records.get(id);
-        if (record) list.push(record);
-      }
-      if (list.length) byName.set(name, list);
-    }
-    return byName;
-  }
-  async queryBatch(packages) {
-    const idsByName = /* @__PURE__ */ new Map();
-    for (let i = 0; i < packages.length; i += BATCH_SIZE) {
-      const chunk = packages.slice(i, i + BATCH_SIZE);
-      const body = {
-        queries: chunk.map((p) => ({
-          package: { name: p.name, ecosystem: "npm" },
-          version: p.version
-        }))
-      };
-      const data = await this.request(`${OSV_API}/querybatch`, body);
-      for (let j = 0; j < chunk.length; j++) {
-        const pkg = chunk[j];
-        const result = data.results[j];
-        if (!result) continue;
-        const set = idsByName.get(pkg.name) ?? /* @__PURE__ */ new Set();
-        for (const vuln of result.vulns ?? []) set.add(vuln.id);
-        let pageToken = result.next_page_token;
-        while (pageToken) {
-          const page = await this.request(`${OSV_API}/query`, {
-            package: { name: pkg.name, ecosystem: "npm" },
-            version: pkg.version,
-            page_token: pageToken
-          });
-          for (const vuln of page.vulns ?? []) set.add(vuln.id);
-          pageToken = page.next_page_token;
-        }
-        if (set.size) idsByName.set(pkg.name, set);
-      }
-    }
-    return idsByName;
-  }
-  async hydrate(ids) {
-    const records = /* @__PURE__ */ new Map();
-    await Promise.all(
-      ids.map(
-        (id) => this.limit(async () => {
-          const record = await this.getVulnerability(id);
-          if (record) records.set(id, record);
-        })
-      )
-    );
-    return records;
-  }
-  async getVulnerability(id) {
-    const cached = await this.readCache(id);
-    if (cached) return cached;
-    const record = await this.request(
-      `${OSV_API}/vulns/${encodeURIComponent(id)}`
-    );
-    await this.writeCache(id, record);
-    return record;
-  }
-  async request(url, body) {
-    const retries = this.opts.retries ?? 3;
-    return pRetry(
-      async () => {
-        const res = await fetch(url, {
-          method: body ? "POST" : "GET",
-          headers: body ? { "content-type": "application/json" } : void 0,
-          body: body ? JSON.stringify(body) : void 0
-        });
-        if (res.ok) return await res.json();
-        if (res.status === 429 || res.status >= 500) {
-          throw new Error(`OSV ${res.status} for ${url}`);
-        }
-        throw new AbortError(`OSV ${res.status} for ${url}`);
-      },
-      { retries }
-    );
-  }
-  async readCache(id) {
-    if (this.opts.noCache) return void 0;
-    try {
-      const parsed = JSON.parse(await readFile(queryCachePath(this.opts.cacheDir, id), "utf8"));
-      const ttlMs = (this.opts.cacheTtlHours ?? 24) * 36e5;
-      if (Date.now() - parsed.fetchedAt > ttlMs) return void 0;
-      return parsed.vuln;
-    } catch {
-      return void 0;
-    }
-  }
-  async writeCache(id, vuln) {
-    if (this.opts.noCache) return;
-    try {
-      const path = queryCachePath(this.opts.cacheDir, id);
-      await mkdir(dirname4(path), { recursive: true });
-      await writeFile(path, JSON.stringify({ fetchedAt: Date.now(), vuln }));
-    } catch {
-    }
-  }
-};
-function dedupePackages(packages) {
-  const seen = /* @__PURE__ */ new Set();
-  const out = [];
-  for (const p of packages) {
-    const key = `${p.name}@${p.version}`;
-    if (!seen.has(key)) {
-      seen.add(key);
-      out.push(p);
-    }
-  }
-  return out;
-}
-
-// src/osv/offline-db.ts
-import { createWriteStream } from "fs";
-import { mkdir as mkdir2, mkdtemp, readFile as readFile2, rm, writeFile as writeFile2 } from "fs/promises";
-import { tmpdir } from "os";
-import { join as join3 } from "path";
-import { Readable } from "stream";
-import { pipeline } from "stream/promises";
-import { gunzipSync, gzipSync } from "zlib";
-import yauzl from "yauzl";
-var OSV_NPM_ZIP_URL = "https://storage.googleapis.com/osv-vulnerabilities/npm/all.zip";
-var MAX_ENTRY_BYTES = 8 * 1024 * 1024;
-var OfflineDbMissingError = class extends Error {
-  constructor() {
-    super("No offline OSV database found. Run `lockhawk db update` first.");
-    this.name = "OfflineDbMissingError";
-  }
-};
-var IMF_FIXDATE = /^[A-Za-z]{3}, \d{2} [A-Za-z]{3} \d{4} \d{2}:\d{2}:\d{2} GMT$/;
-var ENTITY_TAG = /^(?:W\/)?"[\x21\x23-\x7e]*"$/;
-function sanitizeHttpDate(value) {
-  return value && IMF_FIXDATE.test(value) ? value : void 0;
-}
-function sanitizeETag(value) {
-  return value && ENTITY_TAG.test(value) ? value : void 0;
-}
-async function readOfflineMeta(cacheDir) {
-  try {
-    return JSON.parse(await readFile2(offlineMetaPath(cacheDir), "utf8"));
-  } catch {
-    return void 0;
-  }
-}
-async function updateOfflineDatabase(opts) {
-  const { cacheDir, nowIso, force, onProgress } = opts;
-  const dir = offlineDbDir(cacheDir);
-  await mkdir2(dir, { recursive: true });
-  const previous = force ? void 0 : await readOfflineMeta(cacheDir);
-  const headers = {};
-  const etag = sanitizeETag(previous?.etag);
-  const lastModified = sanitizeHttpDate(previous?.lastModified);
-  if (etag) headers["If-None-Match"] = etag;
-  if (lastModified) headers["If-Modified-Since"] = lastModified;
-  onProgress?.("Fetching npm advisory database from OSV.dev\u2026");
-  const res = await fetch(OSV_NPM_ZIP_URL, { headers });
-  if (res.status === 304 && previous) {
-    const meta2 = { ...previous, lastUpdated: nowIso };
-    await writeFile2(offlineMetaPath(cacheDir), JSON.stringify(meta2, null, 2));
-    return { status: "unchanged", meta: meta2 };
-  }
-  if (!res.ok || !res.body) {
-    throw new Error(`OSV database download failed: HTTP ${res.status}`);
-  }
-  const tmp = await mkdtemp(join3(tmpdir(), "lockhawk-osv-"));
-  const zipPath = join3(tmp, "all.zip");
-  let records;
-  try {
-    await pipeline(
-      Readable.fromWeb(res.body),
-      createWriteStream(zipPath)
-    );
-    onProgress?.("Extracting advisories\u2026");
-    records = await readZipRecords(zipPath);
-  } finally {
-    await rm(tmp, { recursive: true, force: true });
-  }
-  onProgress?.("Building package index\u2026");
-  const byName = groupByPackage(records);
-  await writeShards(cacheDir, byName);
-  const meta = {
-    ecosystem: "npm",
-    source: "osv.dev",
-    lastUpdated: nowIso,
-    recordCount: records.length,
-    packageCount: byName.size,
-    etag: res.headers.get("etag") ?? void 0,
-    lastModified: res.headers.get("last-modified") ?? void 0
-  };
-  await writeFile2(offlineMetaPath(cacheDir), JSON.stringify(meta, null, 2));
-  return { status: "updated", meta };
-}
-function bucketDir(cacheDir) {
-  return join3(offlineDbDir(cacheDir), "by-name");
-}
-function bucketPath(cacheDir, bucket) {
-  return join3(bucketDir(cacheDir), `${bucket}.json.gz`);
-}
-async function loadAdvisoriesForPackages(cacheDir, names) {
-  if (!await readOfflineMeta(cacheDir)) throw new OfflineDbMissingError();
-  const namesByBucket = /* @__PURE__ */ new Map();
-  for (const name of new Set(names)) {
-    const bucket = shardBucket(name);
-    const list = namesByBucket.get(bucket);
-    if (list) list.push(name);
-    else namesByBucket.set(bucket, [name]);
-  }
-  const result = /* @__PURE__ */ new Map();
-  await Promise.all(
-    [...namesByBucket.entries()].map(async ([bucket, bucketNames]) => {
-      try {
-        const data = JSON.parse(
-          gunzipSync(await readFile2(bucketPath(cacheDir, bucket))).toString("utf8")
-        );
-        for (const name of bucketNames) {
-          const records = data[name];
-          if (records?.length) result.set(name, records);
-        }
-      } catch {
-      }
-    })
-  );
-  return result;
-}
-function groupByPackage(records) {
-  const byName = /* @__PURE__ */ new Map();
-  for (const record of records) {
-    if (record.withdrawn) continue;
-    const names = /* @__PURE__ */ new Set();
-    for (const affected of record.affected ?? []) {
-      const ecosystem = affected.package?.ecosystem;
-      if (ecosystem && ecosystem !== "npm") continue;
-      if (affected.package?.name) names.add(affected.package.name);
-    }
-    for (const name of names) {
-      const list = byName.get(name);
-      if (list) list.push(record);
-      else byName.set(name, [record]);
-    }
-  }
-  return byName;
-}
-async function writeShards(cacheDir, byName) {
-  const dir = bucketDir(cacheDir);
-  await rm(dir, { recursive: true, force: true });
-  await mkdir2(dir, { recursive: true });
-  const buckets = /* @__PURE__ */ new Map();
-  for (const [name, records] of byName) {
-    const bucket = shardBucket(name);
-    const map = buckets.get(bucket) ?? {};
-    map[name] = records;
-    buckets.set(bucket, map);
-  }
-  const entries = [...buckets.entries()];
-  const BATCH = 256;
-  for (let i = 0; i < entries.length; i += BATCH) {
-    await Promise.all(
-      entries.slice(i, i + BATCH).map(
-        ([bucket, map]) => writeFile2(bucketPath(cacheDir, bucket), gzipSync(Buffer.from(JSON.stringify(map))))
-      )
-    );
-  }
-}
-function readZipRecords(zipPath) {
-  return new Promise((resolve3, reject) => {
-    const out = [];
-    yauzl.open(zipPath, { lazyEntries: true }, (err, zip) => {
-      if (err || !zip) return reject(err ?? new Error("Failed to open OSV zip"));
-      zip.on("entry", (entry) => {
-        if (!entry.fileName.endsWith(".json")) return zip.readEntry();
-        if (entry.uncompressedSize > MAX_ENTRY_BYTES) return zip.readEntry();
-        zip.openReadStream(entry, (streamErr, stream) => {
-          if (streamErr || !stream) return zip.readEntry();
-          const chunks = [];
-          stream.on("data", (chunk) => chunks.push(chunk));
-          stream.on("error", () => zip.readEntry());
-          stream.on("end", () => {
-            try {
-              out.push(JSON.parse(Buffer.concat(chunks).toString("utf8")));
-            } catch {
-            }
-            zip.readEntry();
-          });
-        });
-      });
-      zip.on("end", () => resolve3(out));
-      zip.on("error", reject);
-      zip.readEntry();
-    });
-  });
-}
-
-// src/osv/source.ts
-var HOUR_MS = 36e5;
-var OfflineSource = class {
-  constructor(opts) {
-    this.opts = opts;
-  }
-  opts;
-  async prepare(packages) {
-    const meta = await readOfflineMeta(this.opts.cacheDir);
-    if (!meta) throw new OfflineDbMissingError();
-    const map = await loadAdvisoriesForPackages(
-      this.opts.cacheDir,
-      packages.map((p) => p.name)
-    );
-    const ageHours = (Date.now() - Date.parse(meta.lastUpdated)) / HOUR_MS;
-    const stale = ageHours > (this.opts.staleAfterHours ?? 24);
-    const warnings = stale ? [
-      `Offline database is ${Math.round(ageHours)}h old. Run \`lockhawk db update\` for current results.`
-    ] : [];
-    return {
-      candidatesFor: (name) => map.get(name) ?? [],
-      database: {
-        source: "offline",
-        recordCount: meta.recordCount,
-        lastUpdated: meta.lastUpdated,
-        ageHours: Math.round(ageHours * 10) / 10,
-        stale,
-        warnings
-      }
-    };
-  }
-};
-var OnlineSource = class {
-  constructor(opts) {
-    this.opts = opts;
-  }
-  opts;
-  async prepare(packages) {
-    const client = new OsvClient({
-      cacheDir: this.opts.cacheDir,
-      concurrency: this.opts.concurrency,
-      noCache: this.opts.noCache,
-      cacheTtlHours: this.opts.cacheTtlHours
-    });
-    try {
-      const map = await client.fetchAdvisories(packages);
-      return {
-        candidatesFor: (name) => map.get(name) ?? [],
-        database: { source: "online", stale: false, warnings: [] }
-      };
-    } catch (err) {
-      if (this.opts.strictNetwork) throw err;
-      const reason = err instanceof Error ? err.message : String(err);
-      return {
-        candidatesFor: () => [],
-        database: {
-          source: "online",
-          stale: true,
-          warnings: [
-            `OSV.dev was unreachable (${reason}). Scan completed without online data \u2014 results may be incomplete.`
-          ]
-        }
-      };
-    }
-  }
-};
-var AutoSource = class {
-  constructor(opts) {
-    this.opts = opts;
-  }
-  opts;
-  async prepare(packages) {
-    const meta = await readOfflineMeta(this.opts.cacheDir);
-    const ttl = this.opts.staleAfterHours ?? 24;
-    if (meta) {
-      const ageHours = (Date.now() - Date.parse(meta.lastUpdated)) / HOUR_MS;
-      if (ageHours <= ttl) {
-        return new OfflineSource(this.opts).prepare(packages);
-      }
-    }
-    try {
-      return await new OnlineSource({ ...this.opts, strictNetwork: true }).prepare(packages);
-    } catch (err) {
-      if (meta) {
-        const resolved = await new OfflineSource(this.opts).prepare(packages);
-        resolved.database.warnings.push(
-          "Used the stale offline database because OSV.dev was unreachable."
-        );
-        return resolved;
-      }
-      if (this.opts.strictNetwork) throw err;
-      const reason = err instanceof Error ? err.message : String(err);
-      return {
-        candidatesFor: () => [],
-        database: {
-          source: "online",
-          stale: true,
-          warnings: [
-            `No offline database and OSV.dev was unreachable (${reason}). Run \`lockhawk db update\`.`
-          ]
-        }
-      };
-    }
-  }
-};
-function createSource(mode, opts) {
-  switch (mode) {
-    case "offline":
-      return new OfflineSource(opts);
-    case "online":
-      return new OnlineSource(opts);
-    default:
-      return new AutoSource(opts);
-  }
-}
-
-// src/engine.ts
-var TOOL = { name: "lockhawk", version: "0.1.0" };
-async function scan(options = {}, source) {
-  const start = Date.now();
-  const dir = resolve2(options.path ?? ".");
-  const graph = loadDependencyGraph(dir);
-  const detected = detectLockfile(dir);
-  const scannable = uniqueScannablePackages(graph, options.prodOnly);
-  const cacheDir = resolveCacheDir(options.cacheDir);
-  const src = source ?? createSource(options.mode ?? "auto", {
-    cacheDir,
-    concurrency: options.concurrency,
-    noCache: options.noCache,
-    cacheTtlHours: options.cacheTtlHours,
-    strictNetwork: options.strictNetwork
-  });
-  options.onProgress?.("Checking dependencies against OSV.dev\u2026");
-  const resolved = await src.prepare(scannable);
-  let findings = buildFindings(graph, resolved.candidatesFor, {
-    prodOnly: options.prodOnly,
-    ignore: options.ignore && options.ignore.length ? new Set(options.ignore) : void 0
-  });
-  if (options.severityThreshold && options.severityThreshold !== "none") {
-    findings = findings.filter(
-      (f) => severityAtLeast(f.severity.level, options.severityThreshold)
-    );
-  }
-  findings.sort(bySeverityThenName);
-  const unscannable = unscannablePackages(graph);
-  return {
-    schemaVersion: 1,
-    tool: { ...TOOL },
-    scannedAt: new Date(start).toISOString(),
-    target: {
-      path: dir,
-      manager: graph.manager,
-      lockfile: detected?.filename ?? "",
-      root: graph.root
-    },
-    database: resolved.database,
-    summary: summarize(findings),
-    stats: {
-      totalPackages: Object.keys(graph.nodes).length,
-      uniquePackages: scannable.length,
-      directDependencies: graph.directKeys.length,
-      unscannable: unscannable.length,
-      durationMs: Date.now() - start
-    },
-    findings,
-    unscannable
-  };
-}
-function uniqueScannablePackages(graph, prodOnly) {
-  const seen = /* @__PURE__ */ new Set();
-  const out = [];
-  for (const node of Object.values(graph.nodes)) {
-    if (node.unscannable) continue;
-    if (prodOnly && node.scope === "dev") continue;
-    if (seen.has(node.key)) continue;
-    seen.add(node.key);
-    out.push({ name: node.name, version: node.version });
-  }
-  return out;
-}
-function unscannablePackages(graph) {
-  const out = [];
-  for (const node of Object.values(graph.nodes)) {
-    if (node.unscannable)
-      out.push({ name: node.name, version: node.version, reason: node.unscannable.reason });
-  }
-  return out;
-}
-function summarize(findings) {
-  const summary = {
-    total: findings.length,
-    critical: 0,
-    high: 0,
-    medium: 0,
-    low: 0,
-    unknown: 0,
-    none: 0,
-    vulnerablePackages: 0,
-    fixable: 0
-  };
-  const vulnerable = /* @__PURE__ */ new Set();
-  for (const f of findings) {
-    summary[f.severity.level] += 1;
-    vulnerable.add(`${f.packageName}@${f.version}`);
-    if (f.fixedVersions.length > 0) summary.fixable += 1;
-  }
-  summary.vulnerablePackages = vulnerable.size;
-  return summary;
-}
-function bySeverityThenName(a, b) {
-  const rank = SEVERITY_RANK[b.severity.level] - SEVERITY_RANK[a.severity.level];
-  if (rank !== 0) return rank;
-  return a.packageName.localeCompare(b.packageName);
-}
-function shouldFail(summary, failOn) {
-  const levels = ["critical", "high", "medium", "low", "unknown"];
-  return levels.some(
-    (level) => SEVERITY_RANK[level] >= SEVERITY_RANK[failOn] && summary[level] > 0
-  );
-}
-
-// src/report/json.ts
-function toJson(result) {
-  return JSON.stringify(result, null, 2);
-}
-
-// src/report/sarif.ts
-var INFO_URI = "https://github.com/lockhawk/lockhawk";
-function helpUriFor(references) {
-  return references.find((ref) => {
-    try {
-      const u = new URL(ref);
-      return u.protocol === "http:" || u.protocol === "https:";
-    } catch {
-      return false;
-    }
-  });
-}
-function securitySeverity(finding) {
-  if (typeof finding.severity.score === "number") return finding.severity.score;
-  switch (finding.severity.level) {
-    case "critical":
-      return 9.5;
-    case "high":
-      return 7.5;
-    case "medium":
-      return 5;
-    case "low":
-      return 2;
-    default:
-      return 0;
-  }
-}
-function sarifLevel(severity) {
-  if (severity === "critical" || severity === "high") return "error";
-  if (severity === "medium") return "warning";
-  return "note";
-}
-function toSarif(result) {
-  const lockfileUri = result.target.lockfile || "package-lock.json";
-  const rules = /* @__PURE__ */ new Map();
-  const results = [];
-  for (const finding of result.findings) {
-    if (!rules.has(finding.id)) {
-      rules.set(finding.id, {
-        id: finding.id,
-        name: `${finding.packageName} ${finding.id}`,
-        shortDescription: { text: finding.summary },
-        fullDescription: finding.details ? { text: finding.details } : void 0,
-        helpUri: helpUriFor(finding.references),
-        properties: {
-          "security-severity": String(securitySeverity(finding)),
-          tags: ["security", "dependency", finding.severity.level]
-        }
-      });
-    }
-    const path = finding.dependencyPaths[0]?.join(" \u203A ") ?? finding.packageName;
-    const fix = finding.fixedVersions[0] ? ` Fixed in ${finding.fixedVersions[0]}.` : "";
-    results.push({
-      ruleId: finding.id,
-      level: sarifLevel(finding.severity.level),
-      message: {
-        text: `${finding.severity.level.toUpperCase()}: ${finding.packageName}@${finding.version} \u2014 ${finding.summary}.${fix} Path: ${path}.`
-      },
-      locations: [
-        {
-          physicalLocation: {
-            artifactLocation: { uri: lockfileUri },
-            region: { startLine: 1 }
-          }
-        }
-      ],
-      partialFingerprints: {
-        lockhawkFinding: `${finding.packageName}@${finding.version}@${finding.id}`
-      },
-      properties: {
-        package: finding.packageName,
-        version: finding.version,
-        scope: finding.scope,
-        fixedVersions: finding.fixedVersions
-      }
-    });
-  }
-  return {
-    $schema: "https://json.schemastore.org/sarif-2.1.0.json",
-    version: "2.1.0",
-    runs: [
-      {
-        tool: {
-          driver: {
-            name: result.tool.name,
-            version: result.tool.version,
-            informationUri: INFO_URI,
-            rules: [...rules.values()]
-          }
-        },
-        results,
-        properties: {
-          scannedAt: result.scannedAt,
-          databaseSource: result.database.source,
-          databaseAgeHours: result.database.ageHours,
-          databaseStale: result.database.stale
-        }
-      }
-    ]
-  };
-}
-function toSarifString(result) {
-  return JSON.stringify(toSarif(result), null, 2);
-}
-
-// src/report/html.ts
-function toHtml(result) {
-  return renderHtml(result);
-}
-var SEVERITY_COLORS = {
-  critical: "#ff5d67",
-  high: "#ff9f43",
-  medium: "#ffd23f",
-  low: "#5b9dff",
-  unknown: "#8b95a5",
-  none: "#34d399"
-};
-function esc(text) {
-  return text.replace(
-    /[&<>"]/g,
-    (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;" })[c]
-  );
-}
-function httpHref(url) {
-  try {
-    const u = new URL(url);
-    return u.protocol === "http:" || u.protocol === "https:" ? url : void 0;
-  } catch {
-    return void 0;
-  }
-}
-var MARK = `<svg class="mark" viewBox="0 0 48 48" fill="none" aria-hidden="true">
+var $={none:0,unknown:1,low:2,medium:3,high:4,critical:5};function _e(e,n){return $[e]>=$[n]}function S(e,n){return`${e}@${n}`}import{statSync as gr}from"fs";import{resolve as mr}from"path";import{existsSync as qe,readFileSync as Gn,statSync as Bn}from"fs";import{join as Fe}from"path";var zn=[{filename:"pnpm-lock.yaml",manager:"pnpm"},{filename:"yarn.lock",manager:"yarn"},{filename:"package-lock.json",manager:"npm"},{filename:"npm-shrinkwrap.json",manager:"npm"}];function F(e){for(let{filename:n,manager:r}of zn){let s=Fe(e,n);if(qe(s)&&Bn(s).isFile())return{manager:r,path:s,filename:n}}}function C(e){let n=Fe(e,"package.json"),r={};if(qe(n))try{r=JSON.parse(Gn(n,"utf8"))}catch{r={}}let s=t=>t&&typeof t=="object"?t:{};return{name:typeof r.name=="string"?r.name:"project",version:typeof r.version=="string"?r.version:void 0,dependencies:s(r.dependencies),devDependencies:s(r.devDependencies),optionalDependencies:s(r.optionalDependencies),peerDependencies:s(r.peerDependencies)}}function le(e,n){let r=new Set,s=[];for(let t of e)r.has(t)||(r.add(t),s.push(t));for(let t=0;t<s.length;t++){let a=n[s[t]];if(a)for(let i of a.dependencies)r.has(i)||(r.add(i),s.push(i))}return r}function pe(e){let n=le(e.directProd,e.nodes),r=le(e.directOptional,e.nodes),s=le(e.directDev,e.nodes),t=new Set([...e.directProd,...e.directOptional,...e.directDev]),a={};for(let[i,o]of Object.entries(e.nodes)){let d;n.has(i)?d="prod":r.has(i)?d="optional":s.has(i)?d="dev":d="prod",a[i]={key:i,name:o.name,version:o.version,scope:d,direct:t.has(i),dependencies:Yn(o.dependencies),...o.unscannable?{unscannable:o.unscannable}:{}}}return{manager:e.manager,lockfilePath:e.lockfilePath,lockfileVersion:e.lockfileVersion,root:e.root,nodes:a,directKeys:[...t].filter(i=>a[i]!==void 0)}}function Yn(e){return e.length>1?[...new Set(e)]:e}import{readFileSync as Wn}from"fs";import{dirname as Jn}from"path";function Ke(e){let n=JSON.parse(Wn(e,"utf8"));return n.packages?Zn(n,e):Qn(n,e)}function Xn(e){let n="node_modules/",r=e.lastIndexOf(n);return r===-1?e:e.slice(r+n.length)}function Zn(e,n){let r=e.packages??{},s=r[""]??{},t={name:s.name??e.name??"project",version:s.version??e.version},a=Object.create(null),i=[],o=Object.create(null);for(let[f,p]of Object.entries(r)){if(f===""||p.link)continue;let m=p.name??Xn(f),v=p.version;if(!v)continue;let g=S(m,v);if(o[f]=g,!a[g]){let x={key:g,name:m,version:v,dependencies:[]};f.includes("node_modules")||(x.unscannable={reason:"local workspace package"},i.push({name:m,version:v,reason:"local workspace package"})),a[g]=x}}let d=(f,p)=>{let m=f;for(;;){let v=`${m?`${m}/`:""}node_modules/${p}`,g=r[v];if(g)return g.link&&typeof g.resolved=="string"?g.resolved:v;if(!m)return;let x=m.lastIndexOf("/node_modules/");m=x===-1?"":m.slice(0,x)}},c=new Set,l=new Set,u=new Set;for(let[f,p]of Object.entries(r)){if(p.link)continue;let m=f===""?void 0:o[f],v=f===""||!f.includes("node_modules"),g=(x,w)=>{for(let R of x){let O=d(f,R);if(!O)continue;let P=o[O];P&&(m&&m!==P&&a[m].dependencies.push(P),w&&w.add(P))}};g(Object.keys(p.dependencies??{}),v?c:void 0),g(Object.keys(p.optionalDependencies??{}),v?u:void 0),v&&g(Object.keys(p.devDependencies??{}),l)}return{manager:"npm",lockfilePath:n,lockfileVersion:e.lockfileVersion,root:t,nodes:a,directProd:[...c],directDev:[...l],directOptional:[...u],unscannable:i}}var Te=500;function Qn(e,n){let r=C(Jn(n)),s={name:e.name??r.name,version:e.version??r.version},t=Object.create(null),a=p=>{let m=new Map;for(let[v,g]of Object.entries(p??{}))g?.version&&m.set(v,g.version);return m},i=(p,m)=>{for(let v=m.length-1;v>=0;v--){let g=m[v].get(p);if(g)return g}},o=(p,m)=>{if(m.length>Te)throw new Error(`dependency nesting exceeds ${Te} levels (malformed or malicious lockfile)`);let v=a(p),g=[...m,v];for(let[x,w]of Object.entries(p??{})){let R=w?.version;if(!R)continue;let O=S(x,R);t[O]||(t[O]={key:O,name:x,version:R,dependencies:[]});let P=[...g,a(w.dependencies)];for(let M of Object.keys(w.requires??{})){let N=i(M,P);if(N){let D=S(M,N);D!==O&&t[O].dependencies.push(D)}}w.dependencies&&o(w.dependencies,g)}};o(e.dependencies,[]);let d=a(e.dependencies),c=[],l=[],u=[],f=(p,m)=>{for(let v of p){let g=d.get(v);g&&m.push(S(v,g))}};return f(Object.keys(r.dependencies),c),f(Object.keys(r.optionalDependencies),u),f(Object.keys(r.devDependencies),l),{manager:"npm",lockfilePath:n,lockfileVersion:e.lockfileVersion,root:s,nodes:t,directProd:c,directDev:l,directOptional:u,unscannable:[]}}import{readFileSync as er}from"fs";import{dirname as nr}from"path";import{createRequire as rr}from"module";import tr from"js-yaml";var sr=rr(import.meta.url),or=sr("@yarnpkg/lockfile");function Ue(e){let n=er(e,"utf8"),r=C(nr(e)),s=n.includes("__metadata"),{descriptorToVersion:t,entryByVersion:a,lockfileVersion:i}=s?ar(n):ir(n);return cr(e,r,t,a,i,s)}function Ge(e){let n=e.lastIndexOf("@");if(!(n<=0))return{name:e.slice(0,n),range:e.slice(n+1)}}function ir(e){let n=or.parse(e),r=new Map,s=new Map;for(let[t,a]of Object.entries(n.object))if(a.version)for(let i of t.split(/,\s*/)){let o=Ge(i);o&&r.set(`${o.name}@${o.range}`,a.version),o&&s.set(S(o.name,a.version),a)}return{descriptorToVersion:r,entryByVersion:s,lockfileVersion:1}}function ar(e){let n=tr.load(e)??{},r=new Map,s=new Map,t="berry";for(let[a,i]of Object.entries(n)){if(a==="__metadata"){let o=i.version;o!==void 0&&(t=o);continue}if(i.version)for(let o of a.split(/,\s*/)){let d=Ge(o);d&&(r.set(`${d.name}@${d.range}`,i.version),s.set(S(d.name,i.version),i))}}return{descriptorToVersion:r,entryByVersion:s,lockfileVersion:t}}function cr(e,n,r,s,t,a){let i=(c,l)=>{let u=a?[`${c}@${l}`,`${c}@npm:${l}`]:[`${c}@${l}`];for(let f of u){let p=r.get(f);if(p)return p}},o=Object.create(null);for(let[c,l]of s){let u=c.lastIndexOf("@"),f=c.slice(0,u),p=c.slice(u+1);o[c]||(o[c]={key:c,name:f,version:p,dependencies:[]});let m=v=>{for(let[g,x]of Object.entries(v??{})){let w=i(g,x);if(!w)continue;let R=S(g,w);R!==c&&o[c].dependencies.push(R)}};m(l.dependencies),m(l.optionalDependencies)}let d=c=>{let l=[];for(let[u,f]of Object.entries(c)){let p=i(u,f);p&&l.push(S(u,p))}return l};return{manager:"yarn",lockfilePath:e,lockfileVersion:t,root:{name:n.name,version:n.version},nodes:o,directProd:d(n.dependencies),directDev:d(n.devDependencies),directOptional:d(n.optionalDependencies),unscannable:[]}}import{readFileSync as dr}from"fs";import{dirname as lr}from"path";import pr from"js-yaml";function ze(e){let n=pr.load(dr(e,"utf8"))??{},r=C(lr(e)),s=fr(n.lockfileVersion),t=Object.create(null);for(let u of Object.keys(n.packages??{})){let f=Be(u,s);if(!f)continue;let p=S(f.name,f.version);t[p]||(t[p]={key:p,name:f.name,version:f.version,dependencies:[]})}let a=s>=9?n.snapshots??{}:n.packages??{};for(let[u,f]of Object.entries(a)){let p=Be(u,s);if(!p)continue;let m=S(p.name,p.version);t[m]||(t[m]={key:m,name:p.name,version:p.version,dependencies:[]});let v=g=>{for(let[x,w]of Object.entries(g??{})){let R=S(x,Y(w,s));R!==m&&t[R]&&t[m].dependencies.push(R)}};v(f.dependencies),v(f.optionalDependencies)}let i=n.importers??{".":{dependencies:n.dependencies,devDependencies:n.devDependencies,optionalDependencies:n.optionalDependencies}},o=new Set,d=new Set,c=new Set,l=(u,f)=>{for(let[p,m]of Object.entries(u??{})){let v=ur(m,s);if(!v)continue;let g=S(p,v);t[g]&&f.add(g)}};for(let u of Object.values(i))l(u.dependencies,o),l(u.optionalDependencies,c),l(u.devDependencies,d);return{manager:"pnpm",lockfilePath:e,lockfileVersion:n.lockfileVersion,root:{name:r.name,version:r.version},nodes:t,directProd:[...o],directDev:[...d],directOptional:[...c],unscannable:[]}}function fr(e){let n=parseFloat(String(e??"9"));return Number.isNaN(n)?9:Math.floor(n)}function Be(e,n){let r=e.startsWith("/")?e.slice(1):e;if(n<6){let i=r.lastIndexOf("/");if(i<=0)return;let o=r.slice(0,i),d=Y(r.slice(i+1),n);return d?{name:o,version:d}:void 0}let s=r.lastIndexOf("@");if(s<=0)return;let t=r.slice(0,s),a=Y(r.slice(s+1),n);return a?{name:t,version:a}:void 0}function Y(e,n){let r=e;if(n<6){let t=r.indexOf("_");t!==-1&&(r=r.slice(0,t))}let s=r.indexOf("(");return s!==-1&&(r=r.slice(0,s)),r}function ur(e,n){let r;if(typeof e=="string"?r=e:e&&typeof e=="object"&&typeof e.version=="string"&&(r=e.version),!!r&&!(r.startsWith("link:")||r.startsWith("file:")||r.startsWith("workspace:")))return Y(r,n)}var E=class extends Error{constructor(n){super(n),this.name="LockfileError"}};function vr(){let e=Number(process.env.LOCKHAWK_MAX_LOCKFILE_BYTES);return Number.isFinite(e)&&e>0?e:64*1024*1024}function Ye(e){let n=0;try{n=gr(e.path).size}catch{}let r=vr();if(n>r)throw new E(`${e.filename} is ${n} bytes, exceeding the ${r}-byte safety limit. Set LOCKHAWK_MAX_LOCKFILE_BYTES to raise it.`);try{switch(e.manager){case"npm":return Ke(e.path);case"yarn":return Ue(e.path);case"pnpm":return ze(e.path)}}catch(s){throw new E(`Failed to parse ${e.filename}: ${s instanceof Error?s.message:String(s)}`)}}function fe(e){let n=F(mr(e));if(!n)throw new E(`No lockfile found in ${e}. Expected one of: package-lock.json, yarn.lock, pnpm-lock.yaml.`);return pe(Ye(n))}function ue(e){return e.root.version?`${e.root.name}@${e.root.version}`:e.root.name}function ge(e,n){if(!e.nodes[n])return null;let r="\0root",s=new Map,t=new Set([r]),a=[r];for(let i=0;i<a.length;i++){let o=a[i],d=o===r?e.directKeys:e.nodes[o]?.dependencies??[];for(let c of d)if(!t.has(c)){if(t.add(c),s.set(c,o),c===n)return br(e,s,n,r);a.push(c)}}return[ue(e),n]}function br(e,n,r,s){let t=[],a=r;for(;a!==void 0&&a!==s;)t.unshift(a),a=n.get(a);return t.unshift(ue(e)),t}import I from"semver";function We(e,n){if(n.versions?.includes(e))return!0;let r=I.parse(e,{loose:!0});if(!r)return!1;for(let s of n.ranges??[])if(s.type!=="GIT"&&yr(r,s.events))return!0;return!1}function yr(e,n){let r=[];for(let t of n)t.introduced!==void 0?r.push({kind:"introduced",version:t.introduced==="0"?null:me(t.introduced)}):t.fixed!==void 0?r.push({kind:"fixed",version:me(t.fixed)}):t.last_affected!==void 0&&r.push({kind:"last_affected",version:me(t.last_affected)});r.sort((t,a)=>t.version===null?a.version===null?0:-1:a.version===null?1:t.version.compare(a.version));let s=!1;for(let t of r){if(t.version===null){s=!0;continue}let a=e.compare(t.version);switch(t.kind){case"introduced":a>=0&&(s=!0);break;case"fixed":a>=0&&(s=!1);break;case"last_affected":a>0&&(s=!1);break}}return s}function me(e){return I.parse(e,{loose:!0})??I.coerce(e)}function W(e,n,r){if(r.withdrawn)return{affected:!1,fixedVersions:[]};let s=!1,t=new Set;for(let a of r.affected??[]){let i=a.package?.ecosystem;if(!(i&&i!=="npm")&&!(a.package?.name&&a.package.name!==e)&&We(n,a)){s=!0;for(let o of a.ranges??[])for(let d of o.events)d.fixed&&t.add(d.fixed)}}return{affected:s,fixedVersions:[...t]}}function ve(e,n){let r=I.parse(e,{loose:!0});return n.map(t=>I.parse(t,{loose:!0})??I.coerce(t)).filter(t=>t!==null).filter(t=>r?t.compare(r)>0:!0).sort((t,a)=>t.compare(a))[0]?.version}function Je(e){return[e.id,...e.aliases??[]]}function Xe(e){let n=[...e];return n.find(r=>r.startsWith("CVE-"))??n.find(r=>r.startsWith("GHSA-"))??n[0]}function be(e){if(e.length<=1)return e;let n=new Map,r=a=>{let i=a;for(;n.get(i)!==void 0&&n.get(i)!==i;)i=n.get(i);return n.set(a,i),i},s=(a,i)=>{n.set(r(a),r(i))};for(let a of e){let i=Je(a);n.has(i[0])||n.set(i[0],i[0]);for(let o of i.slice(1))n.has(o)||n.set(o,o),s(i[0],o)}let t=new Map;for(let a of e){let i=r(a.id),o=t.get(i);o?o.push(a):t.set(i,[a])}return[...t.values()].map(hr)}function hr(e){if(e.length===1)return e[0];let n=new Set,r=new Map,s=[],t=[],a,i,o;for(let c of e){for(let l of Je(c))n.add(l);for(let l of c.references??[])r.set(l.url,l);for(let l of c.severity??[])s.push(l);for(let l of c.affected??[])t.push(l);a??=c.summary,i??=c.details,o??=c.database_specific}let d=Xe(n);return{id:d,aliases:[...n].filter(c=>c!==d),summary:a,details:i,references:[...r.values()],severity:s,affected:t,database_specific:o}}import hn from"semver";var J={1e5:9.8,100001:9.5,100010:9.4,100011:8.7,100020:9.1,100021:8.1,100100:9.4,100101:8.9,100110:8.6,100111:7.4,100120:7.7,100121:6.4,100200:8.7,100201:7.5,100210:7.4,100211:6.3,100220:6.3,100221:4.9,101e3:9.4,101001:8.9,101010:8.8,101011:7.7,101020:7.6,101021:6.7,101100:8.6,101101:7.6,101110:7.4,101111:5.8,101120:5.9,101121:5,101200:7.2,101201:5.7,101210:5.7,101211:5.2,101220:5.2,101221:2.5,102001:8.3,102011:7,102021:5.4,102101:6.5,102111:5.8,102121:2.6,102201:5.3,102211:2.1,102221:1.3,11e4:9.5,110001:9,110010:8.8,110011:7.6,110020:7.6,110021:7,110100:9,110101:7.7,110110:7.5,110111:6.2,110120:6.1,110121:5.3,110200:7.7,110201:6.6,110210:6.8,110211:5.9,110220:5.2,110221:3,111e3:8.9,111001:7.8,111010:7.6,111011:6.7,111020:6.2,111021:5.8,111100:7.4,111101:5.9,111110:5.7,111111:5.7,111120:4.7,111121:2.3,111200:6.1,111201:5.2,111210:5.7,111211:2.9,111220:2.4,111221:1.6,112001:7.1,112011:5.9,112021:3,112101:5.8,112111:2.6,112121:1.5,112201:2.3,112211:1.3,112221:.6,2e5:9.3,200001:8.7,200010:8.6,200011:7.2,200020:7.5,200021:5.8,200100:8.6,200101:7.4,200110:7.4,200111:6.1,200120:5.6,200121:3.4,200200:7,200201:5.4,200210:5.2,200211:4,200220:4,200221:2.2,201e3:8.5,201001:7.5,201010:7.4,201011:5.5,201020:6.2,201021:5.1,201100:7.2,201101:5.7,201110:5.5,201111:4.1,201120:4.6,201121:1.9,201200:5.3,201201:3.6,201210:3.4,201211:1.9,201220:1.9,201221:.8,202001:6.4,202011:5.1,202021:2,202101:4.7,202111:2.1,202121:1.1,202201:2.4,202211:.9,202221:.4,21e4:8.8,210001:7.5,210010:7.3,210011:5.3,210020:6,210021:5,210100:7.3,210101:5.5,210110:5.9,210111:4,210120:4.1,210121:2,210200:5.4,210201:4.3,210210:4.5,210211:2.2,210220:2,210221:1.1,211e3:7.5,211001:5.5,211010:5.8,211011:4.5,211020:4,211021:2.1,211100:6.1,211101:5.1,211110:4.8,211111:1.8,211120:2,211121:.9,211200:4.6,211201:1.8,211210:1.7,211211:.7,211220:.8,211221:.2,212001:5.3,212011:2.4,212021:1.4,212101:2.4,212111:1.2,212121:.5,212201:1,212211:.3,212221:.1,"000000":10,"000001":9.9,"000010":9.8,"000011":9.5,"000020":9.5,"000021":9.2,"000100":10,"000101":9.6,"000110":9.3,"000111":8.7,"000120":9.1,"000121":8.1,"000200":9.3,"000201":9,"000210":8.9,"000211":8,"000220":8.1,"000221":6.8,"001000":9.8,"001001":9.5,"001010":9.5,"001011":9.2,"001020":9,"001021":8.4,"001100":9.3,"001101":9.2,"001110":8.9,"001111":8.1,"001120":8.1,"001121":6.5,"001200":8.8,"001201":8,"001210":7.8,"001211":7,"001220":6.9,"001221":4.8,"002001":9.2,"002011":8.2,"002021":7.2,"002101":7.9,"002111":6.9,"002121":5,"002201":6.9,"002211":5.5,"002221":2.7,"010000":9.9,"010001":9.7,"010010":9.5,"010011":9.2,"010020":9.2,"010021":8.5,"010100":9.5,"010101":9.1,"010110":9,"010111":8.3,"010120":8.4,"010121":7.1,"010200":9.2,"010201":8.1,"010210":8.2,"010211":7.1,"010220":7.2,"010221":5.3,"011000":9.5,"011001":9.3,"011010":9.2,"011011":8.5,"011020":8.5,"011021":7.3,"011100":9.2,"011101":8.2,"011110":8,"011111":7.2,"011120":7,"011121":5.9,"011200":8.4,"011201":7,"011210":7.1,"011211":5.2,"011220":5,"011221":3,"012001":8.6,"012011":7.5,"012021":5.2,"012101":7.1,"012111":5.2,"012121":2.9,"012201":6.3,"012211":2.9,"012221":1.7},ye={eq1:{0:["AV:N/PR:N/UI:N/"],1:["AV:A/PR:N/UI:N/","AV:N/PR:L/UI:N/","AV:N/PR:N/UI:P/"],2:["AV:P/PR:N/UI:N/","AV:A/PR:L/UI:P/"]},eq2:{0:["AC:L/AT:N/"],1:["AC:H/AT:N/","AC:L/AT:P/"]},eq3:{0:{0:["VC:H/VI:H/VA:H/CR:H/IR:H/AR:H/"],1:["VC:H/VI:H/VA:L/CR:M/IR:M/AR:H/","VC:H/VI:H/VA:H/CR:M/IR:M/AR:M/"]},1:{0:["VC:L/VI:H/VA:H/CR:H/IR:H/AR:H/","VC:H/VI:L/VA:H/CR:H/IR:H/AR:H/"],1:["VC:L/VI:H/VA:L/CR:H/IR:M/AR:H/","VC:L/VI:H/VA:H/CR:H/IR:M/AR:M/","VC:H/VI:L/VA:H/CR:M/IR:H/AR:M/","VC:H/VI:L/VA:L/CR:M/IR:H/AR:H/","VC:L/VI:L/VA:H/CR:H/IR:H/AR:M/"]},2:{1:["VC:L/VI:L/VA:L/CR:H/IR:H/AR:H/"]}},eq4:{0:["SC:H/SI:S/SA:S/"],1:["SC:H/SI:H/SA:H/"],2:["SC:L/SI:L/SA:L/"]},eq5:{0:["E:A/"],1:["E:P/"],2:["E:U/"]}},Ze={eq1:{0:1,1:4,2:5},eq2:{0:1,1:2},eq3eq6:{0:{0:7,1:6},1:{0:8,1:8},2:{1:10}},eq4:{0:6,1:5,2:4},eq5:{0:1,1:1,2:1}};var gn=["AV","AC","AT","PR","UI","VC","VI","VA","SC","SI","SA"],Qe={N:0,A:.1,L:.2,P:.3},en={N:0,L:.1,H:.2},nn={N:0,P:.1,A:.2},rn={L:0,H:.1},tn={N:0,P:.1},sn={H:0,L:.1,N:.2},on={H:0,L:.1,N:.2},an={H:0,L:.1,N:.2},cn={H:.1,L:.2,N:.3},dn={S:0,H:.1,L:.2,N:.3},ln={S:0,H:.1,L:.2,N:.3},pn={H:0,M:.1,L:.2},fn={H:0,M:.1,L:.2},un={H:0,M:.1,L:.2};function mn(e){let n=xr(e);if(!n)return null;let r=kr(n);return J[r]===void 0?null:wr(n,r)}function xr(e){let n=e.split("/");if(n[0]!=="CVSS:4.0")return null;let r={};for(let s of n.slice(1)){let[t,a]=s.split(":");t&&a&&(r[t]=a)}for(let s of gn)if(!(s in r))return null;for(let s of["E","CR","IR","AR"])s in r||(r[s]="X");return r}function b(e,n){let r=e[n];if(n==="E"&&r==="X")return"A";if((n==="CR"||n==="IR"||n==="AR")&&r==="X")return"H";let s=e[`M${n}`];return s!==void 0&&s!=="X"?s:r??""}function kr(e){let n=b(e,"AV"),r=b(e,"PR"),s=b(e,"UI"),t="2";n==="N"&&r==="N"&&s==="N"?t="0":(n==="N"||r==="N"||s==="N")&&n!=="P"&&(t="1");let a=b(e,"AC")==="L"&&b(e,"AT")==="N"?"0":"1",i=b(e,"VC"),o=b(e,"VI"),d=b(e,"VA"),c="2";i==="H"&&o==="H"?c="0":(i==="H"||o==="H"||d==="H")&&(c="1");let l=b(e,"MSI"),u=b(e,"MSA"),f="2";l==="S"||u==="S"?f="0":(b(e,"SC")==="H"||b(e,"SI")==="H"||b(e,"SA")==="H")&&(f="1");let p=b(e,"E"),m=p==="A"?"0":p==="P"?"1":"2",v=b(e,"CR"),g=b(e,"IR"),x=b(e,"AR");return`${t}${a}${c}${f}${m}${v==="H"&&i==="H"||g==="H"&&o==="H"||x==="H"&&d==="H"?"0":"1"}`}function y(e,n){return e[n]??0}function X(e,n){return ye[`eq${n}`][e[n-1]]??[]}function V(e,n){let r=n.indexOf(e)+e.length+1,s=n.slice(r),t=s.indexOf("/");return t>0?s.substring(0,t):s}function wr(e,n){if(gn.slice(5).every(h=>b(e,h)==="N"))return 0;let r=J[n],s=Number(n[0]),t=Number(n[2]),a=Number(n[5]),i=h=>J[h.join("")]??NaN,o=n.split("").map(Number),d=i([o[0]+1,o[1],o[2],o[3],o[4],o[5]]),c=i([o[0],o[1]+1,o[2],o[3],o[4],o[5]]),l;if(t===1&&a===1)l=i([o[0],o[1],o[2]+1,o[3],o[4],o[5]]);else if(t===0&&a===1)l=i([o[0],o[1],o[2]+1,o[3],o[4],o[5]]);else if(t===1&&a===0)l=i([o[0],o[1],o[2],o[3],o[4],o[5]+1]);else if(t===0&&a===0){let h=i([o[0],o[1],o[2],o[3],o[4],o[5]+1]),q=i([o[0],o[1],o[2]+1,o[3],o[4],o[5]]);l=h>q?h:q}else l=i([o[0],o[1],o[2]+1,o[3],o[4],o[5]+1]);let u=i([o[0],o[1],o[2],o[3]+1,o[4],o[5]]),f=i([o[0],o[1],o[2],o[3],o[4]+1,o[5]]),p=X(n,1),m=X(n,2),v=ye.eq3[n[2]][n[5]],g=X(n,4),x=X(n,5),w=[];for(let h of p)for(let q of m)for(let de of v)for(let Kn of g)for(let Un of x)w.push(h+q+de+Kn+Un);let R=0,O=0,P=0,M=0,N=0,D=0,ne=0,re=0,te=0,se=0,oe=0,ie=0,ae=0,ce=0;for(let h of w)if(R=y(Qe,b(e,"AV"))-y(Qe,V("AV",h)),O=y(en,b(e,"PR"))-y(en,V("PR",h)),P=y(nn,b(e,"UI"))-y(nn,V("UI",h)),M=y(rn,b(e,"AC"))-y(rn,V("AC",h)),N=y(tn,b(e,"AT"))-y(tn,V("AT",h)),D=y(sn,b(e,"VC"))-y(sn,V("VC",h)),ne=y(on,b(e,"VI"))-y(on,V("VI",h)),re=y(an,b(e,"VA"))-y(an,V("VA",h)),te=y(cn,b(e,"SC"))-y(cn,V("SC",h)),se=y(dn,b(e,"SI"))-y(dn,V("SI",h)),oe=y(ln,b(e,"SA"))-y(ln,V("SA",h)),ie=y(pn,b(e,"CR"))-y(pn,V("CR",h)),ae=y(fn,b(e,"IR"))-y(fn,V("IR",h)),ce=y(un,b(e,"AR"))-y(un,V("AR",h)),![R,O,P,M,N,D,ne,re,te,se,oe,ie,ae,ce].some(de=>de<0))break;let Dn=R+O+P,En=M+N,In=D+ne+re+ie+ae+ce,Hn=te+se+oe,B=.1,Me=r-d,Ne=r-c,De=r-l,Ee=r-u,Ln=r-f,z=Ze,jn=z.eq1[String(s)]*B,_n=z.eq2[n[1]]*B,qn=z.eq3eq6[String(t)][String(a)]*B,Fn=z.eq4[n[3]]*B,A=0,Ie=0,He=0,Le=0,je=0;Number.isNaN(Me)||(A++,Ie=Me*(Dn/jn)),Number.isNaN(Ne)||(A++,He=Ne*(En/_n)),Number.isNaN(De)||(A++,Le=De*(In/qn)),Number.isNaN(Ee)||(A++,je=Ee*(Hn/Fn)),Number.isNaN(Ln)||A++;let Tn=A===0?0:(Ie+He+Le+je)/A;return r-=Tn,r<0&&(r=0),r>10&&(r=10),Math.round(r*10)/10}var Rr={N:.85,A:.62,L:.55,P:.2},Sr={L:.77,H:.44},Vr={N:.85,R:.62},Or={N:.85,L:.62,H:.27},Pr={N:.85,L:.68,H:.5},he={H:.56,L:.22,N:0};function xe(e){return e<=0?"none":e<4?"low":e<7?"medium":e<9?"high":"critical"}function bn(e){switch(e.trim().toUpperCase()){case"CRITICAL":return"critical";case"HIGH":return"high";case"MODERATE":case"MEDIUM":return"medium";case"LOW":return"low";case"NONE":return"none";default:return"unknown"}}function vn(e){let n=Math.round(e*1e5);return n%1e4===0?n/1e5:(Math.floor(n/1e4)+1)/10}function yn(e){let n=e.split("/"),r=n[0]??"";if(r==="CVSS:4.0"){let g=mn(e);return g===null?null:{score:g,level:xe(g),version:r}}if(!/^CVSS:3\.[01]$/.test(r))return null;let s={};for(let g of n.slice(1)){let[x,w]=g.split(":");x&&w&&(s[x]=w)}let t=Rr[s.AV??""],a=Sr[s.AC??""],i=Vr[s.UI??""],o=s.S==="C",d=(o?Pr:Or)[s.PR??""],c=he[s.C??""],l=he[s.I??""],u=he[s.A??""];if([t,a,i,d,c,l,u].some(g=>g===void 0))return null;let f=1-(1-c)*(1-l)*(1-u),p=o?7.52*(f-.029)-3.25*Math.pow(f-.02,15):6.42*f,m=8.22*t*a*d*i,v;return p<=0?v=0:o?v=vn(Math.min(1.08*(p+m),10)):v=vn(Math.min(p+m,10)),{score:v,level:xe(v),version:r}}function ke(e){let n=[];for(let t of e.severity??[])t.score&&n.push(t.score);for(let t of e.affected??[])for(let a of t.severity??[])a.score&&n.push(a.score);let r=null;for(let t of n){let a=yn(t);a&&(!r||a.score>r.score)&&(r=a)}if(r)return{level:r.level,score:r.score,vector:Ar(r,n),cvssVersion:r.version,source:"cvss"};let s=$r(e);return s?{level:bn(s),source:"database"}:{level:"unknown",source:"unknown"}}function Ar(e,n){return n.find(r=>r.startsWith(e.version))}function $r(e){let n=s=>{let t=s?.severity;return typeof t=="string"?t:void 0},r=n(e.database_specific);if(r)return r;for(let s of e.affected??[]){let t=n(s.database_specific);if(t)return t}}function we(e,n,r={}){let s=[];for(let t of Object.values(e.nodes)){if(t.unscannable||r.prodOnly&&t.scope==="dev")continue;let a=n(t.name);if(a.length===0)continue;let i=new Map,o=a.filter(c=>{let l=W(t.name,t.version,c);return i.set(c,l),l.affected});if(o.length===0)continue;let d=ge(e,t.key);for(let c of be(o)){if(Cr(c,r.ignore))continue;let{fixedVersions:l}=i.get(c)??W(t.name,t.version,c),u=Mr(l),f=ve(t.version,l);s.push({id:c.id,aliases:c.aliases??[],packageName:t.name,version:t.version,scope:t.scope,direct:t.direct,severity:ke(c),summary:c.summary??c.id,details:c.details,references:(c.references??[]).map(p=>p.url),fixedVersions:u,recommendation:Dr(t.name,t.direct,f,e.manager),dependencyPaths:d?[d]:[],source:"osv"})}}return s}function Cr(e,n){return!n||n.size===0?!1:n.has(e.id)?!0:(e.aliases??[]).some(r=>n.has(r))}function Mr(e){return[...new Set(e)].sort((n,r)=>{let s=hn.parse(n,{loose:!0}),t=hn.parse(r,{loose:!0});return s&&t?s.compare(t):n.localeCompare(r)})}var Nr={npm:"npm install",yarn:"yarn add",pnpm:"pnpm add"};function Dr(e,n,r,s){return r?n?`Upgrade to ${e}@${r} or later (e.g. \`${Nr[s]} ${e}@${r}\`).`:`Update the dependency that pulls in ${e} so it resolves to ${e}@${r} or later. If it cannot, force the resolution via an override.`:n?"No fixed version is available yet. Watch the advisory, or evaluate an alternative package.":"No fixed version is available yet. Pressure the parent dependency to update, or override the version."}var Re=class{byName=new Map;ids=new Set;add(n){if(n.withdrawn||this.ids.has(n.id))return;this.ids.add(n.id);let r=new Set;for(let s of n.affected??[]){let t=s.package?.ecosystem;t&&t!=="npm"||s.package?.name&&r.add(s.package.name)}for(let s of r){let t=this.byName.get(s);t?t.push(n):this.byName.set(s,[n])}}addAll(n){for(let r of n)this.add(r)}vulnerabilitiesFor(n){return this.byName.get(n)??[]}get size(){return this.ids.size}};import{resolve as ct}from"path";import{join as Se}from"path";import Er from"env-paths";function Ve(e){return e||(process.env.LOCKHAWK_CACHE?process.env.LOCKHAWK_CACHE:Er("lockhawk",{suffix:""}).cache)}function T(e){return Se(e,"osv-db","npm")}var xn=4096;function Z(e){let n=2166136261;for(let r=0;r<e.length;r++)n^=e.charCodeAt(r),n=Math.imul(n,16777619);return(n>>>0)%xn}function K(e){return Se(T(e),"meta.json")}function Oe(e,n){return Se(e,"query-cache",`${encodeURIComponent(n)}.json`)}import{mkdir as Ir,readFile as Hr,writeFile as Lr}from"fs/promises";import{dirname as jr}from"path";import _r from"p-limit";import qr,{AbortError as Fr}from"p-retry";var Pe="https://api.osv.dev/v1",kn=1e3,U=class{constructor(n){this.opts=n;this.limit=_r(n.concurrency??16)}opts;limit;async fetchAdvisories(n){let r=[...new Set(n.map(o=>o.name))],s=await this.queryBatch(r),t=new Set;for(let o of s.values())for(let d of o)t.add(d);let a=await this.hydrate([...t]),i=new Map;for(let[o,d]of s){let c=[];for(let l of d){let u=a.get(l);u&&c.push(u)}c.length&&i.set(o,c)}return i}async queryBatch(n){let r=new Map;for(let s=0;s<n.length;s+=kn){let t=n.slice(s,s+kn),a={queries:t.map(o=>({package:{name:o,ecosystem:"npm"}}))},i=await this.request(`${Pe}/querybatch`,a);for(let o=0;o<t.length;o++){let d=t[o],c=i.results[o];if(!c)continue;let l=r.get(d)??new Set;for(let f of c.vulns??[])l.add(f.id);let u=c.next_page_token;for(;u;){let f=await this.request(`${Pe}/query`,{package:{name:d,ecosystem:"npm"},page_token:u});for(let p of f.vulns??[])l.add(p.id);u=f.next_page_token}l.size&&r.set(d,l)}}return r}async hydrate(n){let r=new Map;return await Promise.all(n.map(s=>this.limit(async()=>{let t=await this.getVulnerability(s);t&&r.set(s,t)}))),r}async getVulnerability(n){let r=await this.readCache(n);if(r)return r;let s=await this.request(`${Pe}/vulns/${encodeURIComponent(n)}`);return await this.writeCache(n,s),s}async request(n,r){let s=this.opts.retries??3;return qr(async()=>{let t=await fetch(n,{method:r?"POST":"GET",headers:r?{"content-type":"application/json"}:void 0,body:r?JSON.stringify(r):void 0,signal:AbortSignal.timeout(this.opts.timeoutMs??15e3)});if(t.ok)return await t.json();throw t.status===429||t.status>=500?new Error(`OSV ${t.status} for ${n}`):new Fr(`OSV ${t.status} for ${n}`)},{retries:s})}async readCache(n){if(!this.opts.noCache)try{let r=JSON.parse(await Hr(Oe(this.opts.cacheDir,n),"utf8")),s=(this.opts.cacheTtlHours??24)*36e5;return Date.now()-r.fetchedAt>s?void 0:r.vuln}catch{return}}async writeCache(n,r){if(!this.opts.noCache)try{let s=Oe(this.opts.cacheDir,n);await Ir(jr(s),{recursive:!0}),await Lr(s,JSON.stringify({fetchedAt:Date.now(),vuln:r}))}catch{}}};import{createWriteStream as Tr}from"fs";import{mkdir as wn,mkdtemp as Kr,readFile as Rn,rm as Sn,writeFile as Ae}from"fs/promises";import{tmpdir as Ur}from"os";import{join as Q}from"path";import{Readable as Gr}from"stream";import{pipeline as Br}from"stream/promises";import{gunzipSync as zr,gzipSync as Yr}from"zlib";import Wr from"p-limit";import Jr from"yauzl";var Xr="https://storage.googleapis.com/osv-vulnerabilities/npm/all.zip",Zr=32,Qr=8*1024*1024,H=class extends Error{constructor(){super("No offline OSV database found. Run `lockhawk db update` first."),this.name="OfflineDbMissingError"}},et=/^[A-Za-z]{3}, \d{2} [A-Za-z]{3} \d{4} \d{2}:\d{2}:\d{2} GMT$/,nt=/^(?:W\/)?"[\x21\x23-\x7e]*"$/;function rt(e){return e&&et.test(e)?e:void 0}function tt(e){return e&&nt.test(e)?e:void 0}async function L(e){try{return JSON.parse(await Rn(K(e),"utf8"))}catch{return}}async function st(e){let{cacheDir:n,nowIso:r,force:s,onProgress:t}=e,a=T(n);await wn(a,{recursive:!0});let i=s?void 0:await L(n),o={},d=tt(i?.etag),c=rt(i?.lastModified);d&&(o["If-None-Match"]=d),c&&(o["If-Modified-Since"]=c),t?.("Fetching npm advisory database from OSV.dev\u2026");let l=await fetch(Xr,{headers:o});if(l.status===304&&i){let g={...i,lastUpdated:r};return await Ae(K(n),JSON.stringify(g,null,2)),{status:"unchanged",meta:g}}if(!l.ok||!l.body)throw new Error(`OSV database download failed: HTTP ${l.status}`);let u=await Kr(Q(Ur(),"lockhawk-osv-")),f=Q(u,"all.zip"),p;try{await Br(Gr.fromWeb(l.body),Tr(f)),t?.("Extracting advisories\u2026"),p=await at(f)}finally{await Sn(u,{recursive:!0,force:!0})}t?.("Building package index\u2026");let m=ot(p);await it(n,m);let v={ecosystem:"npm",source:"osv.dev",lastUpdated:r,recordCount:p.length,packageCount:m.size,etag:l.headers.get("etag")??void 0,lastModified:l.headers.get("last-modified")??void 0};return await Ae(K(n),JSON.stringify(v,null,2)),{status:"updated",meta:v}}function Vn(e){return Q(T(e),"by-name")}function On(e,n){return Q(Vn(e),`${n}.json.gz`)}async function $e(e,n){if(!await L(e))throw new H;let r=new Map;for(let a of new Set(n)){let i=Z(a),o=r.get(i);o?o.push(a):r.set(i,[a])}let s=new Map,t=Wr(Zr);return await Promise.all([...r.entries()].map(([a,i])=>t(async()=>{try{let o=JSON.parse(zr(await Rn(On(e,a))).toString("utf8"));for(let d of i){let c=o[d];c?.length&&s.set(d,c)}}catch{}}))),s}function ot(e){let n=new Map;for(let r of e){if(r.withdrawn)continue;let s=new Set;for(let t of r.affected??[]){let a=t.package?.ecosystem;a&&a!=="npm"||t.package?.name&&s.add(t.package.name)}for(let t of s){let a=n.get(t);a?a.push(r):n.set(t,[r])}}return n}async function it(e,n){let r=Vn(e);await Sn(r,{recursive:!0,force:!0}),await wn(r,{recursive:!0});let s=new Map;for(let[i,o]of n){let d=Z(i),c=s.get(d)??{};c[i]=o,s.set(d,c)}let t=[...s.entries()],a=256;for(let i=0;i<t.length;i+=a)await Promise.all(t.slice(i,i+a).map(([o,d])=>Ae(On(e,o),Yr(Buffer.from(JSON.stringify(d))))))}function at(e){return new Promise((n,r)=>{let s=[];Jr.open(e,{lazyEntries:!0},(t,a)=>{if(t||!a)return r(t??new Error("Failed to open OSV zip"));a.on("entry",i=>{if(!i.fileName.endsWith(".json")||i.uncompressedSize>Qr)return a.readEntry();a.openReadStream(i,(o,d)=>{if(o||!d)return a.readEntry();let c=[];d.on("data",l=>c.push(l)),d.on("error",()=>a.readEntry()),d.on("end",()=>{try{s.push(JSON.parse(Buffer.concat(c).toString("utf8")))}catch{}a.readEntry()})})}),a.on("end",()=>n(s)),a.on("error",r),a.readEntry()})})}var Pn=36e5,j=class{constructor(n){this.opts=n}opts;async prepare(n){let r=await L(this.opts.cacheDir);if(!r)throw new H;let s=await $e(this.opts.cacheDir,n.map(o=>o.name)),t=(Date.now()-Date.parse(r.lastUpdated))/Pn,a=t>(this.opts.staleAfterHours??24),i=a?[`Offline database is ${Math.round(t)}h old. Run \`lockhawk db update\` for current results.`]:[];return{candidatesFor:o=>s.get(o)??[],database:{source:"offline",recordCount:r.recordCount,lastUpdated:r.lastUpdated,ageHours:Math.round(t*10)/10,stale:a,warnings:i}}}},G=class{constructor(n){this.opts=n}opts;async prepare(n){let r=new U({cacheDir:this.opts.cacheDir,concurrency:this.opts.concurrency,noCache:this.opts.noCache,cacheTtlHours:this.opts.cacheTtlHours});try{let s=await r.fetchAdvisories(n);return{candidatesFor:t=>s.get(t)??[],database:{source:"online",stale:!1,warnings:[]}}}catch(s){if(this.opts.strictNetwork)throw s;let t=s instanceof Error?s.message:String(s);return{candidatesFor:()=>[],database:{source:"online",stale:!0,warnings:[`OSV.dev was unreachable (${t}). Scan completed without online data \u2014 results may be incomplete.`]}}}}},ee=class{constructor(n){this.opts=n}opts;async prepare(n){let r=await L(this.opts.cacheDir),s=this.opts.staleAfterHours??24;if(r&&(Date.now()-Date.parse(r.lastUpdated))/Pn<=s)return new j(this.opts).prepare(n);try{return await new G({...this.opts,strictNetwork:!0}).prepare(n)}catch(t){if(r){let i=await new j(this.opts).prepare(n);return i.database.warnings.push("Used the stale offline database because OSV.dev was unreachable."),i}if(this.opts.strictNetwork)throw t;let a=t instanceof Error?t.message:String(t);return{candidatesFor:()=>[],database:{source:"online",stale:!0,warnings:[`No offline database and OSV.dev was unreachable (${a}). Run \`lockhawk db update\`.`]}}}}};function Ce(e,n){switch(e){case"offline":return new j(n);case"online":return new G(n);default:return new ee(n)}}var An={name:"lockhawk",version:"0.1.0"};async function dt(e={},n){let r=Date.now(),s=ct(e.path??"."),t=fe(s),a=F(s),i=$n(t,e.prodOnly),o=Ve(e.cacheDir),d=n??Ce(e.mode??"auto",{cacheDir:o,concurrency:e.concurrency,noCache:e.noCache,cacheTtlHours:e.cacheTtlHours,strictNetwork:e.strictNetwork});e.onProgress?.("Checking dependencies against OSV.dev\u2026");let c=await d.prepare(i),l=we(t,c.candidatesFor,{prodOnly:e.prodOnly,ignore:e.ignore&&e.ignore.length?new Set(e.ignore):void 0});e.severityThreshold&&e.severityThreshold!=="none"&&(l=l.filter(f=>_e(f.severity.level,e.severityThreshold))),l.sort(ft);let u=lt(t);return{schemaVersion:1,tool:{...An},scannedAt:new Date(r).toISOString(),target:{path:s,manager:t.manager,lockfile:a?.filename??"",root:t.root},database:c.database,summary:pt(l),stats:{totalPackages:Object.keys(t.nodes).length,uniquePackages:i.length,directDependencies:t.directKeys.length,unscannable:u.length,durationMs:Date.now()-r},findings:l,unscannable:u}}function $n(e,n){let r=new Set,s=[];for(let t of Object.values(e.nodes))t.unscannable||n&&t.scope==="dev"||r.has(t.key)||(r.add(t.key),s.push({name:t.name,version:t.version}));return s}function lt(e){let n=[];for(let r of Object.values(e.nodes))r.unscannable&&n.push({name:r.name,version:r.version,reason:r.unscannable.reason});return n}function pt(e){let n={total:e.length,critical:0,high:0,medium:0,low:0,unknown:0,none:0,vulnerablePackages:0,fixable:0},r=new Set;for(let s of e)n[s.severity.level]+=1,r.add(`${s.packageName}@${s.version}`),s.fixedVersions.length>0&&(n.fixable+=1);return n.vulnerablePackages=r.size,n}function ft(e,n){let r=$[n.severity.level]-$[e.severity.level];return r!==0?r:e.packageName.localeCompare(n.packageName)}function ut(e,n){return["critical","high","medium","low","unknown"].some(s=>$[s]>=$[n]&&e[s]>0)}function gt(e){return JSON.stringify(e,null,2)}var mt="https://github.com/lockhawk/lockhawk";function vt(e){return e.find(n=>{try{let r=new URL(n);return r.protocol==="http:"||r.protocol==="https:"}catch{return!1}})}function bt(e){if(typeof e.severity.score=="number")return e.severity.score;switch(e.severity.level){case"critical":return 9.5;case"high":return 7.5;case"medium":return 5;case"low":return 2;default:return 0}}function yt(e){return e==="critical"||e==="high"?"error":e==="medium"?"warning":"note"}function Cn(e){let n=e.target.lockfile||"package-lock.json",r=new Map,s=[];for(let t of e.findings){r.has(t.id)||r.set(t.id,{id:t.id,name:`${t.packageName} ${t.id}`,shortDescription:{text:t.summary},fullDescription:t.details?{text:t.details}:void 0,helpUri:vt(t.references),properties:{"security-severity":String(bt(t)),tags:["security","dependency",t.severity.level]}});let a=t.dependencyPaths[0]?.join(" \u203A ")??t.packageName,i=t.fixedVersions[0]?` Fixed in ${t.fixedVersions[0]}.`:"";s.push({ruleId:t.id,level:yt(t.severity.level),message:{text:`${t.severity.level.toUpperCase()}: ${t.packageName}@${t.version} \u2014 ${t.summary}.${i} Path: ${a}.`},locations:[{physicalLocation:{artifactLocation:{uri:n},region:{startLine:1}}}],partialFingerprints:{lockhawkFinding:`${t.packageName}@${t.version}@${t.id}`},properties:{package:t.packageName,version:t.version,scope:t.scope,fixedVersions:t.fixedVersions}})}return{$schema:"https://json.schemastore.org/sarif-2.1.0.json",version:"2.1.0",runs:[{tool:{driver:{name:e.tool.name,version:e.tool.version,informationUri:mt,rules:[...r.values()]}},results:s,properties:{scannedAt:e.scannedAt,databaseSource:e.database.source,databaseAgeHours:e.database.ageHours,databaseStale:e.database.stale}}]}}function ht(e){return JSON.stringify(Cn(e),null,2)}function xt(e){return St(e)}var Mn={critical:"#ff5d67",high:"#ff9f43",medium:"#ffd23f",low:"#5b9dff",unknown:"#8b95a5",none:"#34d399"};function k(e){return e.replace(/[&<>"]/g,n=>({"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;"})[n])}function kt(e){try{let n=new URL(e);return n.protocol==="http:"||n.protocol==="https:"?e:void 0}catch{return}}var wt=`<svg class="mark" viewBox="0 0 48 48" fill="none" aria-hidden="true">
   <defs>
     <linearGradient id="lh-g" x1="6" y1="4" x2="40" y2="44" gradientUnits="userSpaceOnUse">
       <stop stop-color="#ffc266"/><stop offset="1" stop-color="#ff5d67"/>
@@ -2178,79 +8,44 @@ var MARK = `<svg class="mark" viewBox="0 0 48 48" fill="none" aria-hidden="true"
   <path d="M14 18.5 24 15l10 3.5" stroke="url(#lh-g)" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"/>
   <circle cx="24" cy="23" r="3.2" fill="url(#lh-g)"/>
   <path d="M24 26.2V32" stroke="url(#lh-g)" stroke-width="2.2" stroke-linecap="round"/>
-</svg>`;
-var CHEVRON = `<svg class="chev" width="11" height="11" viewBox="0 0 16 16" fill="none" aria-hidden="true"><path d="M6 4l4 4-4 4" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/></svg>`;
-function renderFix(rec) {
-  const match = rec.match(/`([^`]+)`/);
-  const command = match?.[1];
-  const pending = /^No fixed version/i.test(rec);
-  const prose = command ? rec.replace(/\s*\(e\.g\.[^)]*\)/, "") : rec;
-  const bar = command ? `<div class="cmdbar"><code class="cmd" title="Click to select, then \u2318/Ctrl+C to copy">${esc(
-    command
-  )}</code><span class="hint">click to select</span></div>` : "";
-  return `<div class="fix${pending ? " fix-pending" : ""}">
-        <div class="fix-label">${CHEVRON.replace("chev", "spark")}${pending ? "No fix available yet" : "Recommended fix"}</div>
-        <p class="fix-text">${esc(prose)}</p>${bar}
-      </div>`;
-}
-function renderHtml(result) {
-  const { summary } = result;
-  const cards = ["critical", "high", "medium", "low", "unknown"].map(
-    (sev, i) => `
-      <div class="card${summary[sev] === 0 ? " zero" : ""}" style="--c:${SEVERITY_COLORS[sev]};--i:${i}">
-        <div class="count">${summary[sev]}</div><div class="label">${sev}</div>
-      </div>`
-  ).join("");
-  const rows = result.findings.map((f, i) => {
-    const path = f.dependencyPaths[0]?.join(" \u203A ") ?? f.packageName;
-    const refs = f.references.slice(0, 3).map((u) => httpHref(u)).filter((u) => u !== void 0).map((u) => `<a class="ref" href="${esc(u)}" target="_blank" rel="noopener">link</a>`).join("");
-    const fixed = f.fixedVersions[0] ? `<span class="fixchip" title="Click to select, then \u2318/Ctrl+C to copy">${esc(
-      f.fixedVersions[0]
-    )}</span>` : '<span class="nofix">\u2014</span>';
-    return `
-      <tr class="main" style="--i:${i}">
-        <td><span class="pill" style="--c:${SEVERITY_COLORS[f.severity.level]}">${esc(
-      f.severity.level
-    )}${f.severity.score ? ` ${f.severity.score}` : ""}</span></td>
-        <td><span class="pkg">${esc(f.packageName)}@${esc(f.version)}</span><div class="scope">${esc(
-      f.scope
-    )}${f.direct ? " \xB7 direct" : ""}</div></td>
-        <td><a class="advid" href="https://osv.dev/${encodeURIComponent(
-      f.id
-    )}" target="_blank" rel="noopener">${esc(f.id)}</a></td>
-        <td><div class="summary">${esc(f.summary)}</div><div class="path">${esc(path)}</div></td>
-        <td>${fixed}</td>
-        <td class="refs">${refs}</td>
+</svg>`,Nn='<svg class="chev" width="11" height="11" viewBox="0 0 16 16" fill="none" aria-hidden="true"><path d="M6 4l4 4-4 4" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/></svg>';function Rt(e){let r=e.match(/`([^`]+)`/)?.[1],s=/^No fixed version/i.test(e),t=r?e.replace(/\s*\(e\.g\.[^)]*\)/,""):e,a=r?`<div class="cmdbar"><code class="cmd" title="Click to select, then \u2318/Ctrl+C to copy">${k(r)}</code><span class="hint">click to select</span></div>`:"";return`<div class="fix${s?" fix-pending":""}">
+        <div class="fix-label">${Nn.replace("chev","spark")}${s?"No fix available yet":"Recommended fix"}</div>
+        <p class="fix-text">${k(t)}</p>${a}
+      </div>`}function St(e){let{summary:n}=e,r=["critical","high","medium","low","unknown"].map((i,o)=>`
+      <div class="card${n[i]===0?" zero":""}" style="--c:${Mn[i]};--i:${o}">
+        <div class="count">${n[i]}</div><div class="label">${i}</div>
+      </div>`).join(""),s=e.findings.map((i,o)=>{let d=i.dependencyPaths[0]?.join(" \u203A ")??i.packageName,c=i.references.slice(0,3).map(u=>kt(u)).filter(u=>u!==void 0).map(u=>`<a class="ref" href="${k(u)}" target="_blank" rel="noopener">link</a>`).join(""),l=i.fixedVersions[0]?`<span class="fixchip" title="Click to select, then \u2318/Ctrl+C to copy">${k(i.fixedVersions[0])}</span>`:'<span class="nofix">\u2014</span>';return`
+      <tr class="main" style="--i:${o}">
+        <td><span class="pill" style="--c:${Mn[i.severity.level]}">${k(i.severity.level)}${i.severity.score?` ${i.severity.score}`:""}</span></td>
+        <td><span class="pkg">${k(i.packageName)}@${k(i.version)}</span><div class="scope">${k(i.scope)}${i.direct?" \xB7 direct":""}</div></td>
+        <td><a class="advid" href="https://osv.dev/${encodeURIComponent(i.id)}" target="_blank" rel="noopener">${k(i.id)}</a></td>
+        <td><div class="summary">${k(i.summary)}</div><div class="path">${k(d)}</div></td>
+        <td>${l}</td>
+        <td class="refs">${c}</td>
       </tr>
       <tr class="detail-row">
         <td colspan="6">
-          ${f.recommendation ? renderFix(f.recommendation) : ""}
+          ${i.recommendation?Rt(i.recommendation):""}
           <details>
-            <summary>${CHEVRON}<span>Advisory details</span></summary>
+            <summary>${Nn}<span>Advisory details</span></summary>
             <div class="detail-body">
               <div class="advisory-wrap">
-                <div class="advisory-head"><span class="dots"><i></i><i></i><i></i></span><span class="advisory-title">advisory \xB7 ${esc(
-      f.id
-    )}</span></div>
-                <pre class="advisory">${esc(f.details ?? f.summary)}</pre>
+                <div class="advisory-head"><span class="dots"><i></i><i></i><i></i></span><span class="advisory-title">advisory \xB7 ${k(i.id)}</span></div>
+                <pre class="advisory">${k(i.details??i.summary)}</pre>
               </div>
             </div>
           </details>
         </td>
-      </tr>`;
-  }).join("");
-  const dbWarnings = result.database.warnings.map((w) => `<div class="warn"><span class="warn-i">\u26A0</span>${esc(w)}</div>`).join("");
-  const resultsMeta = result.findings.length === 0 ? "" : `<div class="results-meta">
-      <span><b>${summary.total}</b> findings</span><span class="sep">\xB7</span>
-      <span><b>${summary.vulnerablePackages}</b> packages</span><span class="sep">\xB7</span>
-      <span><b>${summary.fixable}</b> fixable</span>
-    </div>`;
-  return `<!doctype html>
+      </tr>`}).join(""),t=e.database.warnings.map(i=>`<div class="warn"><span class="warn-i">\u26A0</span>${k(i)}</div>`).join(""),a=e.findings.length===0?"":`<div class="results-meta">
+      <span><b>${n.total}</b> findings</span><span class="sep">\xB7</span>
+      <span><b>${n.vulnerablePackages}</b> packages</span><span class="sep">\xB7</span>
+      <span><b>${n.fixable}</b> fixable</span>
+    </div>`;return`<!doctype html>
 <html lang="en">
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
-<title>lockhawk report \u2014 ${esc(result.target.root.name)}</title>
+<title>lockhawk report \u2014 ${k(e.target.root.name)}</title>
 <style>
   :root {
     --bg:#070a12; --panel:#11151e; --panel-2:#141926; --elev:#171d2b;
@@ -2391,116 +186,24 @@ function renderHtml(result) {
 </head>
 <body>
 <header>
-  <div class="brand">${MARK}<div class="wordmark"><span class="lock">lock</span><span class="hawk">hawk</span><span class="caret"></span></div></div>
-  <div class="meta"><b>${esc(result.target.root.name)}${result.target.root.version ? `@${esc(result.target.root.version)}` : ""}</b> \xB7 ${esc(result.target.manager)} \xB7 ${result.stats.totalPackages} packages \xB7 scanned ${esc(
-    result.scannedAt
-  )}</div>
+  <div class="brand">${wt}<div class="wordmark"><span class="lock">lock</span><span class="hawk">hawk</span><span class="caret"></span></div></div>
+  <div class="meta"><b>${k(e.target.root.name)}${e.target.root.version?`@${k(e.target.root.version)}`:""}</b> \xB7 ${k(e.target.manager)} \xB7 ${e.stats.totalPackages} packages \xB7 scanned ${k(e.scannedAt)}</div>
 </header>
 <main>
-  <div class="cards">${cards}</div>
-  ${dbWarnings}
-  ${result.findings.length === 0 ? '<div class="empty">\u2713 No known vulnerabilities found.</div>' : `${resultsMeta}
+  <div class="cards">${r}</div>
+  ${t}
+  ${e.findings.length===0?'<div class="empty">\u2713 No known vulnerabilities found.</div>':`${a}
   <div class="table-wrap"><div class="scroll"><table>
     <thead><tr><th>Severity</th><th>Package</th><th>Advisory</th><th>Summary &amp; path</th><th>Fixed in</th><th>Refs</th></tr></thead>
-    <tbody>${rows}</tbody>
+    <tbody>${s}</tbody>
   </table></div></div>`}
 </main>
-<footer>Generated by lockhawk v${esc(result.tool.version)} \xB7 data from OSV.dev \xB7 database: ${esc(
-    result.database.source
-  )}</footer>
+<footer>Generated by lockhawk v${k(e.tool.version)} \xB7 data from OSV.dev \xB7 database: ${k(e.database.source)}</footer>
 </body>
-</html>`;
-}
-
-// src/report/junit.ts
-function xml(text) {
-  return text.replace(
-    /[&<>"']/g,
-    (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&apos;" })[c]
-  );
-}
-function failureBody(f) {
-  const lines = [
-    `Package: ${f.packageName}@${f.version} (${f.scope}${f.direct ? ", direct" : ", transitive"})`,
-    `Severity: ${f.severity.level}${f.severity.score !== void 0 ? `, CVSS ${f.severity.score}` : ""}${f.severity.vector ? ` (${f.severity.vector})` : ""}`,
-    f.fixedVersions.length ? `Fixed in: ${f.fixedVersions.join(", ")}` : "Fix: none available yet",
-    f.dependencyPaths[0] ? `Dependency path: ${f.dependencyPaths[0].join(" > ")}` : "",
-    f.recommendation ? `Recommendation: ${f.recommendation}` : "",
-    f.references.length ? `References:
-${f.references.join("\n")}` : ""
-  ];
-  return lines.filter(Boolean).join("\n");
-}
-function toJunit(result) {
-  const { findings } = result;
-  const failures = findings.length;
-  const tests = findings.length === 0 ? 1 : findings.length;
-  const time = ((result.stats.durationMs ?? 0) / 1e3).toFixed(3);
-  const suiteName = `${result.target.root.name} npm dependency vulnerabilities`;
-  const cases = findings.length === 0 ? ['    <testcase name="No known vulnerabilities" classname="lockhawk" time="0" />'] : findings.map((f) => {
-    const name = `${f.packageName}@${f.version}: ${f.id} (${f.severity.level})`;
-    const message = `${f.severity.level.toUpperCase()}${f.severity.score !== void 0 ? ` ${f.severity.score}` : ""} ${f.id}: ${f.summary}`;
-    return [
-      `    <testcase name="${xml(name)}" classname="lockhawk.${xml(f.severity.level)}" time="0">`,
-      `      <failure message="${xml(message)}" type="${xml(f.severity.level)}">${xml(failureBody(f))}</failure>`,
-      `    </testcase>`
-    ].join("\n");
-  });
-  return [
-    '<?xml version="1.0" encoding="UTF-8"?>',
-    `<testsuites name="lockhawk" tests="${tests}" failures="${failures}" errors="0" time="${time}">`,
-    `  <testsuite name="${xml(suiteName)}" tests="${tests}" failures="${failures}" errors="0" time="${time}">`,
-    ...cases,
-    "  </testsuite>",
-    "</testsuites>",
-    ""
-  ].join("\n");
-}
-export {
-  AutoSource,
-  LockfileError,
-  OfflineDbMissingError,
-  OfflineSource,
-  OnlineSource,
-  OsvClient,
-  OsvDatabase,
-  SEVERITY_RANK,
-  SHARD_BUCKETS,
-  TOOL,
-  buildDependencyGraph,
-  buildFindings,
-  canonicalId,
-  createSource,
-  dedupeVulnerabilities,
-  detectLockfile,
-  isVersionAffected,
-  levelFromLabel,
-  levelFromScore,
-  loadAdvisoriesForPackages,
-  loadDependencyGraph,
-  nearestFix,
-  offlineDbDir,
-  offlineMetaPath,
-  parseLockfile,
-  pkgKey,
-  readOfflineMeta,
-  readRootManifest,
-  resolveCacheDir,
-  resolveSeverity,
-  rootLabel,
-  scan,
-  scoreFromVector,
-  severityAtLeast,
-  shardBucket,
-  shortestPath,
-  shouldFail,
-  toHtml,
-  toJson,
-  toJunit,
-  toSarif,
-  toSarifString,
-  uniqueScannablePackages,
-  updateOfflineDatabase,
-  vulnerabilityAffects
-};
+</html>`}function _(e){return e.replace(/[&<>"']/g,n=>({"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&apos;"})[n])}function Vt(e){return[`Package: ${e.packageName}@${e.version} (${e.scope}${e.direct?", direct":", transitive"})`,`Severity: ${e.severity.level}${e.severity.score!==void 0?`, CVSS ${e.severity.score}`:""}${e.severity.vector?` (${e.severity.vector})`:""}`,e.fixedVersions.length?`Fixed in: ${e.fixedVersions.join(", ")}`:"Fix: none available yet",e.dependencyPaths[0]?`Dependency path: ${e.dependencyPaths[0].join(" > ")}`:"",e.recommendation?`Recommendation: ${e.recommendation}`:"",e.references.length?`References:
+${e.references.join(`
+`)}`:""].filter(Boolean).join(`
+`)}function Ot(e){let{findings:n}=e,r=n.length,s=n.length===0?1:n.length,t=((e.stats.durationMs??0)/1e3).toFixed(3),a=`${e.target.root.name} npm dependency vulnerabilities`,i=n.length===0?['    <testcase name="No known vulnerabilities" classname="lockhawk" time="0" />']:n.map(o=>{let d=`${o.packageName}@${o.version}: ${o.id} (${o.severity.level})`,c=`${o.severity.level.toUpperCase()}${o.severity.score!==void 0?` ${o.severity.score}`:""} ${o.id}: ${o.summary}`;return[`    <testcase name="${_(d)}" classname="lockhawk.${_(o.severity.level)}" time="0">`,`      <failure message="${_(c)}" type="${_(o.severity.level)}">${_(Vt(o))}</failure>`,"    </testcase>"].join(`
+`)});return['<?xml version="1.0" encoding="UTF-8"?>',`<testsuites name="lockhawk" tests="${s}" failures="${r}" errors="0" time="${t}">`,`  <testsuite name="${_(a)}" tests="${s}" failures="${r}" errors="0" time="${t}">`,...i,"  </testsuite>","</testsuites>",""].join(`
+`)}export{ee as AutoSource,E as LockfileError,H as OfflineDbMissingError,j as OfflineSource,G as OnlineSource,U as OsvClient,Re as OsvDatabase,$ as SEVERITY_RANK,xn as SHARD_BUCKETS,An as TOOL,pe as buildDependencyGraph,we as buildFindings,Xe as canonicalId,Ce as createSource,be as dedupeVulnerabilities,F as detectLockfile,We as isVersionAffected,bn as levelFromLabel,xe as levelFromScore,$e as loadAdvisoriesForPackages,fe as loadDependencyGraph,ve as nearestFix,T as offlineDbDir,K as offlineMetaPath,Ye as parseLockfile,S as pkgKey,L as readOfflineMeta,C as readRootManifest,Ve as resolveCacheDir,ke as resolveSeverity,ue as rootLabel,dt as scan,yn as scoreFromVector,_e as severityAtLeast,Z as shardBucket,ge as shortestPath,ut as shouldFail,xt as toHtml,gt as toJson,Ot as toJunit,Cn as toSarif,ht as toSarifString,$n as uniqueScannablePackages,st as updateOfflineDatabase,W as vulnerabilityAffects};
 //# sourceMappingURL=index.js.map