@lockhawk/core 0.2.5 → 0.2.7

package/README.md

@@ -1,12 +1,12 @@
 # @lockhawk/core
 
-The scanning engine behind [**lockhawk**](https://github.com/lockhawk/lockhawk) — lockfile
-parsing, dependency-graph building, [OSV.dev](https://osv.dev) matching, CVSS v3/v4 scoring, and
-report generation (table, JSON, SARIF, JUnit, HTML).
+The scanning engine behind [**lockhawk**](https://github.com/lockhawk/lockhawk): lockfile parsing,
+dependency graph building, [OSV.dev](https://osv.dev) matching, CVSS v3 and v4 scoring, and report
+generation (table, JSON, SARIF, JUnit, HTML).
 
 > **Most people want the CLI, not this package.** To scan a project, use
-> [`lockhawk`](https://www.npmjs.com/package/lockhawk) — `npx lockhawk scan`. Install
-> `@lockhawk/core` only if you're building a tool on top of the engine.
+> [`lockhawk`](https://www.npmjs.com/package/lockhawk) and run `npx lockhawk scan`. Install
+> `@lockhawk/core` only if you are building a tool on top of the engine.
 
 ## Install
 
@@ -24,8 +24,8 @@ console.log(result.summary, result.findings);
 ```
 
 `scan()` reads the project's lockfile (`package-lock.json`, `yarn.lock`, or `pnpm-lock.yaml`),
-resolves the full dependency tree (including transitive dependencies), queries OSV.dev — offline
-from a cached database or online via the batch API — and returns scored, de-duplicated findings.
+resolves the full dependency tree including transitive dependencies, queries OSV.dev (offline from a
+cached database or online via the batch API), and returns scored, de-duplicated findings.
 
 ## Documentation
 

package/dist/index.d.ts

@@ -390,6 +390,8 @@ interface OnlineClientOptions {
     noCache?: boolean;
     cacheTtlHours?: number;
     retries?: number;
+    /** Per-request network timeout in milliseconds (default 15s). */
+    timeoutMs?: number;
 }
 /**
  * Online OSV source. Queries the batch endpoint by package *name only* — never
@@ -546,20 +548,16 @@ declare function toSarif(result: ScanResult): SarifLog;
 /** Stringified SARIF log. */
 declare function toSarifString(result: ScanResult): string;
 
+/** Placeholder the report UI shell embeds so we can inject scan data at scan time. */
+declare const DATA_MARKER = "<!--LOCKHAWK_DATA-->";
 /**
- * Produce a self-contained HTML report for a scan result.
- *
- * The page is fully server-rendered: no client-side JavaScript, no embedded
- * data blob, no external resources (fonts included). Every dynamic value is
- * HTML-escaped, the layout flows within a width-constrained container, and long
- * advisory text lives in a collapsed, contained block — so the report cannot
- * overflow the viewport or render attacker-controlled advisory text as live
- * markup. Copy affordances use CSS `user-select: all` (one click selects a whole
- * command/version) rather than a clipboard script, preserving the no-JS model.
+ * Produce a self-contained HTML report. When given the built report-UI `shell`
+ * (M6), the scan data is injected into it; otherwise a dependency-free fallback
+ * template is rendered so `--format html` always works.
  */
-declare function toHtml(result: ScanResult): string;
+declare function toHtml(result: ScanResult, shell?: string): string;
 
 /** Render a scan result as JUnit XML (one failed test per finding). */
 declare function toJunit(result: ScanResult): string;
 
-export { AutoSource, type CvssResult, type DatabaseInfo, type DepNode, type DepScope, type DependencyGraph, type DetectedLockfile, type Finding, type FindingsOptions, LockfileError, OfflineDbMissingError, type OfflineMeta, OfflineSource, type OnlineClientOptions, OnlineSource, type OsvAffected, OsvClient, OsvDatabase, type OsvEvent, type OsvRange, type OsvReference, type OsvSeverity, type OsvVulnerability, type PackageManager, type PackageRef, type PkgKey, type RawGraph, type RawNode, type ResolvedSource, type RootManifest, SEVERITY_RANK, SHARD_BUCKETS, type SarifLog, type ScanOptions, type ScanResult, type ScanStats, type ScanSummary, type Severity, type SeverityInfo, type SourceMode, type SourceOptions, TOOL, type UnscannablePackage, type UpdateResult, type VulnMatch, type VulnSource, buildDependencyGraph, buildFindings, canonicalId, createSource, dedupeVulnerabilities, detectLockfile, isVersionAffected, levelFromLabel, levelFromScore, loadAdvisoriesForPackages, loadDependencyGraph, nearestFix, offlineDbDir, offlineMetaPath, parseLockfile, pkgKey, readOfflineMeta, readRootManifest, resolveCacheDir, resolveSeverity, rootLabel, scan, scoreFromVector, severityAtLeast, shardBucket, shortestPath, shouldFail, toHtml, toJson, toJunit, toSarif, toSarifString, uniqueScannablePackages, updateOfflineDatabase, vulnerabilityAffects };
+export { AutoSource, type CvssResult, DATA_MARKER, type DatabaseInfo, type DepNode, type DepScope, type DependencyGraph, type DetectedLockfile, type Finding, type FindingsOptions, LockfileError, OfflineDbMissingError, type OfflineMeta, OfflineSource, type OnlineClientOptions, OnlineSource, type OsvAffected, OsvClient, OsvDatabase, type OsvEvent, type OsvRange, type OsvReference, type OsvSeverity, type OsvVulnerability, type PackageManager, type PackageRef, type PkgKey, type RawGraph, type RawNode, type ResolvedSource, type RootManifest, SEVERITY_RANK, SHARD_BUCKETS, type SarifLog, type ScanOptions, type ScanResult, type ScanStats, type ScanSummary, type Severity, type SeverityInfo, type SourceMode, type SourceOptions, TOOL, type UnscannablePackage, type UpdateResult, type VulnMatch, type VulnSource, buildDependencyGraph, buildFindings, canonicalId, createSource, dedupeVulnerabilities, detectLockfile, isVersionAffected, levelFromLabel, levelFromScore, loadAdvisoriesForPackages, loadDependencyGraph, nearestFix, offlineDbDir, offlineMetaPath, parseLockfile, pkgKey, readOfflineMeta, readRootManifest, resolveCacheDir, resolveSeverity, rootLabel, scan, scoreFromVector, severityAtLeast, shardBucket, shortestPath, shouldFail, toHtml, toJson, toJunit, toSarif, toSarifString, uniqueScannablePackages, updateOfflineDatabase, vulnerabilityAffects };