@lockhawk/core 0.2.5 → 0.2.7

package/dist/index.js

@@ -1,2490 +1,64 @@
-// src/types.ts
-var SEVERITY_RANK = {
-  none: 0,
-  unknown: 1,
-  low: 2,
-  medium: 3,
-  high: 4,
-  critical: 5
-};
-function severityAtLeast(level, threshold) {
-  return SEVERITY_RANK[level] >= SEVERITY_RANK[threshold];
-}
-function pkgKey(name, version) {
-  return `${name}@${version}`;
-}
-
-// src/lockfiles/normalize.ts
-import { resolve } from "path";
-
-// src/lockfiles/detect.ts
-import { existsSync, readFileSync, statSync } from "fs";
-import { join } from "path";
-var LOCKFILES = [
-  { filename: "pnpm-lock.yaml", manager: "pnpm" },
-  { filename: "yarn.lock", manager: "yarn" },
-  { filename: "package-lock.json", manager: "npm" },
-  { filename: "npm-shrinkwrap.json", manager: "npm" }
-];
-function detectLockfile(dir) {
-  for (const { filename, manager } of LOCKFILES) {
-    const path = join(dir, filename);
-    if (existsSync(path) && statSync(path).isFile()) {
-      return { manager, path, filename };
-    }
-  }
-  return void 0;
-}
-function readRootManifest(dir) {
-  const path = join(dir, "package.json");
-  let raw = {};
-  if (existsSync(path)) {
-    try {
-      raw = JSON.parse(readFileSync(path, "utf8"));
-    } catch {
-      raw = {};
-    }
-  }
-  const asMap = (v) => v && typeof v === "object" ? v : {};
-  return {
-    name: typeof raw.name === "string" ? raw.name : "project",
-    version: typeof raw.version === "string" ? raw.version : void 0,
-    dependencies: asMap(raw.dependencies),
-    devDependencies: asMap(raw.devDependencies),
-    optionalDependencies: asMap(raw.optionalDependencies),
-    peerDependencies: asMap(raw.peerDependencies)
-  };
-}
-
-// src/lockfiles/raw.ts
-function reachable(start, nodes) {
-  const seen = /* @__PURE__ */ new Set();
-  const queue = [];
-  for (const k of start) {
-    if (!seen.has(k)) {
-      seen.add(k);
-      queue.push(k);
-    }
-  }
-  for (let i = 0; i < queue.length; i++) {
-    const node = nodes[queue[i]];
-    if (!node) continue;
-    for (const dep of node.dependencies) {
-      if (!seen.has(dep)) {
-        seen.add(dep);
-        queue.push(dep);
-      }
-    }
-  }
-  return seen;
-}
-function buildDependencyGraph(raw) {
-  const prodReach = reachable(raw.directProd, raw.nodes);
-  const optionalReach = reachable(raw.directOptional, raw.nodes);
-  const devReach = reachable(raw.directDev, raw.nodes);
-  const direct = /* @__PURE__ */ new Set([...raw.directProd, ...raw.directOptional, ...raw.directDev]);
-  const nodes = {};
-  for (const [key, rn] of Object.entries(raw.nodes)) {
-    let scope;
-    if (prodReach.has(key)) scope = "prod";
-    else if (optionalReach.has(key)) scope = "optional";
-    else if (devReach.has(key)) scope = "dev";
-    else scope = "prod";
-    nodes[key] = {
-      key,
-      name: rn.name,
-      version: rn.version,
-      scope,
-      direct: direct.has(key),
-      dependencies: dedupe(rn.dependencies),
-      ...rn.unscannable ? { unscannable: rn.unscannable } : {}
-    };
-  }
-  return {
-    manager: raw.manager,
-    lockfilePath: raw.lockfilePath,
-    lockfileVersion: raw.lockfileVersion,
-    root: raw.root,
-    nodes,
-    directKeys: [...direct].filter((k) => nodes[k] !== void 0)
-  };
-}
-function dedupe(keys) {
-  return keys.length > 1 ? [...new Set(keys)] : keys;
-}
-
-// src/lockfiles/npm.ts
-import { readFileSync as readFileSync2 } from "fs";
-import { dirname } from "path";
-function parseNpm(lockfilePath) {
-  const data = JSON.parse(readFileSync2(lockfilePath, "utf8"));
-  if (data.packages) {
-    return parsePackages(data, lockfilePath);
-  }
-  return parseLegacy(data, lockfilePath);
-}
-function nameFromPath(p) {
-  const marker = "node_modules/";
-  const idx = p.lastIndexOf(marker);
-  return idx === -1 ? p : p.slice(idx + marker.length);
-}
-function parsePackages(data, lockfilePath) {
-  const packages = data.packages ?? {};
-  const rootEntry = packages[""] ?? {};
-  const root = {
-    name: rootEntry.name ?? data.name ?? "project",
-    version: rootEntry.version ?? data.version
-  };
-  const nodes = /* @__PURE__ */ Object.create(null);
-  const unscannable = [];
-  const pathToKey = /* @__PURE__ */ Object.create(null);
-  for (const [p, entry] of Object.entries(packages)) {
-    if (p === "" || entry.link) continue;
-    const name = entry.name ?? nameFromPath(p);
-    const version = entry.version;
-    if (!version) continue;
-    const key = pkgKey(name, version);
-    pathToKey[p] = key;
-    if (!nodes[key]) {
-      const node = { key, name, version, dependencies: [] };
-      if (!p.includes("node_modules")) {
-        node.unscannable = { reason: "local workspace package" };
-        unscannable.push({ name, version, reason: "local workspace package" });
-      }
-      nodes[key] = node;
-    }
-  }
-  const resolveDep = (fromPath, depName) => {
-    let prefix = fromPath;
-    for (; ; ) {
-      const candidate = `${prefix ? `${prefix}/` : ""}node_modules/${depName}`;
-      const entry = packages[candidate];
-      if (entry) {
-        if (entry.link && typeof entry.resolved === "string") return entry.resolved;
-        return candidate;
-      }
-      if (!prefix) return void 0;
-      const i = prefix.lastIndexOf("/node_modules/");
-      prefix = i === -1 ? "" : prefix.slice(0, i);
-    }
-  };
-  const directProd = /* @__PURE__ */ new Set();
-  const directDev = /* @__PURE__ */ new Set();
-  const directOptional = /* @__PURE__ */ new Set();
-  for (const [p, entry] of Object.entries(packages)) {
-    if (entry.link) continue;
-    const fromKey = p === "" ? void 0 : pathToKey[p];
-    const isLocalRoot = p === "" || !p.includes("node_modules");
-    const addEdges = (names, bucket) => {
-      for (const depName of names) {
-        const targetPath = resolveDep(p, depName);
-        if (!targetPath) continue;
-        const targetKey = pathToKey[targetPath];
-        if (!targetKey) continue;
-        if (fromKey && fromKey !== targetKey) nodes[fromKey].dependencies.push(targetKey);
-        if (bucket) bucket.add(targetKey);
-      }
-    };
-    addEdges(Object.keys(entry.dependencies ?? {}), isLocalRoot ? directProd : void 0);
-    addEdges(
-      Object.keys(entry.optionalDependencies ?? {}),
-      isLocalRoot ? directOptional : void 0
-    );
-    if (isLocalRoot) {
-      addEdges(Object.keys(entry.devDependencies ?? {}), directDev);
-    }
-  }
-  return {
-    manager: "npm",
-    lockfilePath,
-    lockfileVersion: data.lockfileVersion,
-    root,
-    nodes,
-    directProd: [...directProd],
-    directDev: [...directDev],
-    directOptional: [...directOptional],
-    unscannable
-  };
-}
-function parseLegacy(data, lockfilePath) {
-  const manifest = readRootManifest(dirname(lockfilePath));
-  const root = { name: data.name ?? manifest.name, version: data.version ?? manifest.version };
-  const nodes = /* @__PURE__ */ Object.create(null);
-  const buildLevel = (deps) => {
-    const m2 = /* @__PURE__ */ new Map();
-    for (const [name, info] of Object.entries(deps ?? {})) {
-      if (info?.version) m2.set(name, info.version);
-    }
-    return m2;
-  };
-  const resolveFromChain = (name, chain) => {
-    for (let i = chain.length - 1; i >= 0; i--) {
-      const v = chain[i].get(name);
-      if (v) return v;
-    }
-    return void 0;
-  };
-  const visit = (deps, ancestors) => {
-    const level = buildLevel(deps);
-    const chain = [...ancestors, level];
-    for (const [name, info] of Object.entries(deps ?? {})) {
-      const version = info?.version;
-      if (!version) continue;
-      const key = pkgKey(name, version);
-      if (!nodes[key]) nodes[key] = { key, name, version, dependencies: [] };
-      const ownChain = [...chain, buildLevel(info.dependencies)];
-      for (const reqName of Object.keys(info.requires ?? {})) {
-        const v = resolveFromChain(reqName, ownChain);
-        if (v) {
-          const targetKey = pkgKey(reqName, v);
-          if (targetKey !== key) nodes[key].dependencies.push(targetKey);
-        }
-      }
-      if (info.dependencies) visit(info.dependencies, chain);
-    }
-  };
-  visit(data.dependencies, []);
-  const topLevel = buildLevel(data.dependencies);
-  const directProd = [];
-  const directDev = [];
-  const directOptional = [];
-  const classify = (names, out) => {
-    for (const name of names) {
-      const v = topLevel.get(name);
-      if (v) out.push(pkgKey(name, v));
-    }
-  };
-  classify(Object.keys(manifest.dependencies), directProd);
-  classify(Object.keys(manifest.optionalDependencies), directOptional);
-  classify(Object.keys(manifest.devDependencies), directDev);
-  return {
-    manager: "npm",
-    lockfilePath,
-    lockfileVersion: data.lockfileVersion,
-    root,
-    nodes,
-    directProd,
-    directDev,
-    directOptional,
-    unscannable: []
-  };
-}
-
-// src/lockfiles/yarn.ts
-import { readFileSync as readFileSync3 } from "fs";
-import { dirname as dirname2 } from "path";
-import { createRequire } from "module";
-import yaml from "js-yaml";
-var require2 = createRequire(import.meta.url);
-var yarnLockfile = require2("@yarnpkg/lockfile");
-function parseYarn(lockfilePath) {
-  const content = readFileSync3(lockfilePath, "utf8");
-  const manifest = readRootManifest(dirname2(lockfilePath));
-  const isBerry = content.includes("__metadata");
-  const { descriptorToVersion, entryByVersion, lockfileVersion } = isBerry ? parseBerry(content) : parseClassic(content);
-  return assemble(
-    lockfilePath,
-    manifest,
-    descriptorToVersion,
-    entryByVersion,
-    lockfileVersion,
-    isBerry
-  );
-}
-function splitDescriptor(descriptor) {
-  const at = descriptor.lastIndexOf("@");
-  if (at <= 0) return void 0;
-  return { name: descriptor.slice(0, at), range: descriptor.slice(at + 1) };
-}
-function parseClassic(content) {
-  const parsed = yarnLockfile.parse(content);
-  const descriptorToVersion = /* @__PURE__ */ new Map();
-  const entryByVersion = /* @__PURE__ */ new Map();
-  for (const [rawKey, entry] of Object.entries(parsed.object)) {
-    if (!entry.version) continue;
-    for (const descriptor of rawKey.split(/,\s*/)) {
-      const split = splitDescriptor(descriptor);
-      if (split) descriptorToVersion.set(`${split.name}@${split.range}`, entry.version);
-      if (split) entryByVersion.set(pkgKey(split.name, entry.version), entry);
-    }
-  }
-  return { descriptorToVersion, entryByVersion, lockfileVersion: 1 };
-}
-function parseBerry(content) {
-  const doc = yaml.load(content) ?? {};
-  const descriptorToVersion = /* @__PURE__ */ new Map();
-  const entryByVersion = /* @__PURE__ */ new Map();
-  let lockfileVersion = "berry";
-  for (const [rawKey, entry] of Object.entries(doc)) {
-    if (rawKey === "__metadata") {
-      const v = entry.version;
-      if (v !== void 0) lockfileVersion = v;
-      continue;
-    }
-    if (!entry.version) continue;
-    for (const descriptor of rawKey.split(/,\s*/)) {
-      const split = splitDescriptor(descriptor);
-      if (!split) continue;
-      descriptorToVersion.set(`${split.name}@${split.range}`, entry.version);
-      entryByVersion.set(pkgKey(split.name, entry.version), entry);
-    }
-  }
-  return { descriptorToVersion, entryByVersion, lockfileVersion };
-}
-function assemble(lockfilePath, manifest, descriptorToVersion, entryByVersion, lockfileVersion, isBerry) {
-  const resolve3 = (name, range) => {
-    const candidates = isBerry ? [`${name}@${range}`, `${name}@npm:${range}`] : [`${name}@${range}`];
-    for (const c of candidates) {
-      const v = descriptorToVersion.get(c);
-      if (v) return v;
-    }
-    return void 0;
-  };
-  const nodes = /* @__PURE__ */ Object.create(null);
-  for (const [key, entry] of entryByVersion) {
-    const at = key.lastIndexOf("@");
-    const name = key.slice(0, at);
-    const version = key.slice(at + 1);
-    if (!nodes[key]) nodes[key] = { key, name, version, dependencies: [] };
-    const addEdges = (deps) => {
-      for (const [depName, depRange] of Object.entries(deps ?? {})) {
-        const v = resolve3(depName, depRange);
-        if (!v) continue;
-        const targetKey = pkgKey(depName, v);
-        if (targetKey !== key) nodes[key].dependencies.push(targetKey);
-      }
-    };
-    addEdges(entry.dependencies);
-    addEdges(entry.optionalDependencies);
-  }
-  const toDirect = (deps) => {
-    const out = [];
-    for (const [name, range] of Object.entries(deps)) {
-      const v = resolve3(name, range);
-      if (v) out.push(pkgKey(name, v));
-    }
-    return out;
-  };
-  return {
-    manager: "yarn",
-    lockfilePath,
-    lockfileVersion,
-    root: { name: manifest.name, version: manifest.version },
-    nodes,
-    directProd: toDirect(manifest.dependencies),
-    directDev: toDirect(manifest.devDependencies),
-    directOptional: toDirect(manifest.optionalDependencies),
-    unscannable: []
-  };
-}
-
-// src/lockfiles/pnpm.ts
-import { readFileSync as readFileSync4 } from "fs";
-import { dirname as dirname3 } from "path";
-import yaml2 from "js-yaml";
-function parsePnpm(lockfilePath) {
-  const doc = yaml2.load(readFileSync4(lockfilePath, "utf8")) ?? {};
-  const manifest = readRootManifest(dirname3(lockfilePath));
-  const major = majorVersion(doc.lockfileVersion);
-  const nodes = /* @__PURE__ */ Object.create(null);
-  for (const key of Object.keys(doc.packages ?? {})) {
-    const parsed = parseKey(key, major);
-    if (!parsed) continue;
-    const nodeKey = pkgKey(parsed.name, parsed.version);
-    if (!nodes[nodeKey]) {
-      nodes[nodeKey] = {
-        key: nodeKey,
-        name: parsed.name,
-        version: parsed.version,
-        dependencies: []
-      };
-    }
-  }
-  const edgeSource = major >= 9 ? doc.snapshots ?? {} : doc.packages ?? {};
-  for (const [key, entry] of Object.entries(edgeSource)) {
-    const parsed = parseKey(key, major);
-    if (!parsed) continue;
-    const fromKey = pkgKey(parsed.name, parsed.version);
-    if (!nodes[fromKey]) {
-      nodes[fromKey] = {
-        key: fromKey,
-        name: parsed.name,
-        version: parsed.version,
-        dependencies: []
-      };
-    }
-    const addEdges = (deps) => {
-      for (const [depName, depValue] of Object.entries(deps ?? {})) {
-        const targetKey = pkgKey(depName, stripVersion(depValue, major));
-        if (targetKey !== fromKey && nodes[targetKey]) nodes[fromKey].dependencies.push(targetKey);
-      }
-    };
-    addEdges(entry.dependencies);
-    addEdges(entry.optionalDependencies);
-  }
-  const importers = doc.importers ?? {
-    ".": {
-      dependencies: doc.dependencies,
-      devDependencies: doc.devDependencies,
-      optionalDependencies: doc.optionalDependencies
-    }
-  };
-  const directProd = /* @__PURE__ */ new Set();
-  const directDev = /* @__PURE__ */ new Set();
-  const directOptional = /* @__PURE__ */ new Set();
-  const collect = (deps, into) => {
-    for (const [name, val] of Object.entries(deps ?? {})) {
-      const version = importerVersion(val, major);
-      if (!version) continue;
-      const key = pkgKey(name, version);
-      if (nodes[key]) into.add(key);
-    }
-  };
-  for (const imp of Object.values(importers)) {
-    collect(imp.dependencies, directProd);
-    collect(imp.optionalDependencies, directOptional);
-    collect(imp.devDependencies, directDev);
-  }
-  return {
-    manager: "pnpm",
-    lockfilePath,
-    lockfileVersion: doc.lockfileVersion,
-    root: { name: manifest.name, version: manifest.version },
-    nodes,
-    directProd: [...directProd],
-    directDev: [...directDev],
-    directOptional: [...directOptional],
-    unscannable: []
-  };
-}
-function majorVersion(v) {
-  const n = parseFloat(String(v ?? "9"));
-  return Number.isNaN(n) ? 9 : Math.floor(n);
-}
-function parseKey(key, major) {
-  const k = key.startsWith("/") ? key.slice(1) : key;
-  if (major < 6) {
-    const lastSlash = k.lastIndexOf("/");
-    if (lastSlash <= 0) return void 0;
-    const name2 = k.slice(0, lastSlash);
-    const version2 = stripVersion(k.slice(lastSlash + 1), major);
-    return version2 ? { name: name2, version: version2 } : void 0;
-  }
-  const at = k.lastIndexOf("@");
-  if (at <= 0) return void 0;
-  const name = k.slice(0, at);
-  const version = stripVersion(k.slice(at + 1), major);
-  return version ? { name, version } : void 0;
-}
-function stripVersion(value, major) {
-  let v = value;
-  if (major < 6) {
-    const us = v.indexOf("_");
-    if (us !== -1) v = v.slice(0, us);
-  }
-  const paren = v.indexOf("(");
-  if (paren !== -1) v = v.slice(0, paren);
-  return v;
-}
-function importerVersion(val, major) {
-  let ref;
-  if (typeof val === "string") ref = val;
-  else if (val && typeof val === "object" && typeof val.version === "string") {
-    ref = val.version;
-  }
-  if (!ref) return void 0;
-  if (ref.startsWith("link:") || ref.startsWith("file:") || ref.startsWith("workspace:"))
-    return void 0;
-  return stripVersion(ref, major);
-}
-
-// src/lockfiles/normalize.ts
-var LockfileError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "LockfileError";
-  }
-};
-function parseLockfile(detected) {
-  try {
-    switch (detected.manager) {
-      case "npm":
-        return parseNpm(detected.path);
-      case "yarn":
-        return parseYarn(detected.path);
-      case "pnpm":
-        return parsePnpm(detected.path);
-    }
-  } catch (err) {
-    throw new LockfileError(
-      `Failed to parse ${detected.filename}: ${err instanceof Error ? err.message : String(err)}`
-    );
-  }
-}
-function loadDependencyGraph(dir) {
-  const detected = detectLockfile(resolve(dir));
-  if (!detected) {
-    throw new LockfileError(
-      `No lockfile found in ${dir}. Expected one of: package-lock.json, yarn.lock, pnpm-lock.yaml.`
-    );
-  }
-  return buildDependencyGraph(parseLockfile(detected));
-}
-
-// src/graph/paths.ts
-function rootLabel(graph) {
-  return graph.root.version ? `${graph.root.name}@${graph.root.version}` : graph.root.name;
-}
-function shortestPath(graph, targetKey) {
-  if (!graph.nodes[targetKey]) return null;
-  const VIRTUAL_ROOT = "\0root";
-  const prev = /* @__PURE__ */ new Map();
-  const visited = /* @__PURE__ */ new Set([VIRTUAL_ROOT]);
-  const queue = [VIRTUAL_ROOT];
-  for (let i = 0; i < queue.length; i++) {
-    const current = queue[i];
-    const neighbors = current === VIRTUAL_ROOT ? graph.directKeys : graph.nodes[current]?.dependencies ?? [];
-    for (const next of neighbors) {
-      if (visited.has(next)) continue;
-      visited.add(next);
-      prev.set(next, current);
-      if (next === targetKey) return reconstruct(graph, prev, targetKey, VIRTUAL_ROOT);
-      queue.push(next);
-    }
-  }
-  return [rootLabel(graph), targetKey];
-}
-function reconstruct(graph, prev, target, virtualRoot) {
-  const path = [];
-  let cursor = target;
-  while (cursor !== void 0 && cursor !== virtualRoot) {
-    path.unshift(cursor);
-    cursor = prev.get(cursor);
-  }
-  path.unshift(rootLabel(graph));
-  return path;
-}
-
-// src/match/ranges.ts
-import semver from "semver";
-function isVersionAffected(version, affected) {
-  if (affected.versions?.includes(version)) return true;
-  const installed = semver.parse(version, { loose: true });
-  if (!installed) return false;
-  for (const range of affected.ranges ?? []) {
-    if (range.type === "GIT") continue;
-    if (rangeAffects(installed, range.events)) return true;
-  }
-  return false;
-}
-function rangeAffects(installed, events) {
-  const boundaries = [];
-  for (const event of events) {
-    if (event.introduced !== void 0) {
-      boundaries.push({
-        kind: "introduced",
-        version: event.introduced === "0" ? null : parse(event.introduced)
-      });
-    } else if (event.fixed !== void 0) {
-      boundaries.push({ kind: "fixed", version: parse(event.fixed) });
-    } else if (event.last_affected !== void 0) {
-      boundaries.push({ kind: "last_affected", version: parse(event.last_affected) });
-    }
-  }
-  boundaries.sort((a, b) => {
-    if (a.version === null) return b.version === null ? 0 : -1;
-    if (b.version === null) return 1;
-    return a.version.compare(b.version);
-  });
-  let affected = false;
-  for (const boundary of boundaries) {
-    if (boundary.version === null) {
-      affected = true;
-      continue;
-    }
-    const cmp = installed.compare(boundary.version);
-    switch (boundary.kind) {
-      case "introduced":
-        if (cmp >= 0) affected = true;
-        break;
-      case "fixed":
-        if (cmp >= 0) affected = false;
-        break;
-      case "last_affected":
-        if (cmp > 0) affected = false;
-        break;
-    }
-  }
-  return affected;
-}
-function parse(version) {
-  return semver.parse(version, { loose: true }) ?? semver.coerce(version);
-}
-function vulnerabilityAffects(name, version, vuln) {
-  if (vuln.withdrawn) return { affected: false, fixedVersions: [] };
-  let affected = false;
-  const fixed = /* @__PURE__ */ new Set();
-  for (const entry of vuln.affected ?? []) {
-    const ecosystem = entry.package?.ecosystem;
-    if (ecosystem && ecosystem !== "npm") continue;
-    if (entry.package?.name && entry.package.name !== name) continue;
-    if (!isVersionAffected(version, entry)) continue;
-    affected = true;
-    for (const range of entry.ranges ?? []) {
-      for (const event of range.events) {
-        if (event.fixed) fixed.add(event.fixed);
-      }
-    }
-  }
-  return { affected, fixedVersions: [...fixed] };
-}
-function nearestFix(installed, fixedVersions) {
-  const current = semver.parse(installed, { loose: true });
-  const candidates = fixedVersions.map((v) => semver.parse(v, { loose: true }) ?? semver.coerce(v)).filter((v) => v !== null).filter((v) => current ? v.compare(current) > 0 : true).sort((a, b) => a.compare(b));
-  return candidates[0]?.version;
-}
-
-// src/match/dedupe.ts
-function tokensOf(vuln) {
-  return [vuln.id, ...vuln.aliases ?? []];
-}
-function canonicalId(ids) {
-  const list = [...ids];
-  return list.find((id) => id.startsWith("CVE-")) ?? list.find((id) => id.startsWith("GHSA-")) ?? list[0];
-}
-function dedupeVulnerabilities(vulns) {
-  if (vulns.length <= 1) return vulns;
-  const parent = /* @__PURE__ */ new Map();
-  const find = (x) => {
-    let root = x;
-    while (parent.get(root) !== void 0 && parent.get(root) !== root) root = parent.get(root);
-    parent.set(x, root);
-    return root;
-  };
-  const union = (a, b) => {
-    parent.set(find(a), find(b));
-  };
-  for (const vuln of vulns) {
-    const tokens = tokensOf(vuln);
-    if (!parent.has(tokens[0])) parent.set(tokens[0], tokens[0]);
-    for (const token of tokens.slice(1)) {
-      if (!parent.has(token)) parent.set(token, token);
-      union(tokens[0], token);
-    }
-  }
-  const groups = /* @__PURE__ */ new Map();
-  for (const vuln of vulns) {
-    const root = find(vuln.id);
-    const group = groups.get(root);
-    if (group) group.push(vuln);
-    else groups.set(root, [vuln]);
-  }
-  return [...groups.values()].map(mergeGroup);
-}
-function mergeGroup(group) {
-  if (group.length === 1) return group[0];
-  const allIds = /* @__PURE__ */ new Set();
-  const references = /* @__PURE__ */ new Map();
-  const severity = [];
-  const affected = [];
-  let summary;
-  let details;
-  let database_specific;
-  for (const vuln of group) {
-    for (const token of tokensOf(vuln)) allIds.add(token);
-    for (const ref of vuln.references ?? []) references.set(ref.url, ref);
-    for (const sev of vuln.severity ?? []) severity.push(sev);
-    for (const aff of vuln.affected ?? []) affected.push(aff);
-    summary ??= vuln.summary;
-    details ??= vuln.details;
-    database_specific ??= vuln.database_specific;
-  }
-  const id = canonicalId(allIds);
-  return {
-    id,
-    aliases: [...allIds].filter((token) => token !== id),
-    summary,
-    details,
-    references: [...references.values()],
-    severity,
-    affected,
-    database_specific
-  };
-}
-
-// src/match/findings.ts
-import semver2 from "semver";
-
-// src/score/cvss4-data.ts
-var CVSS4_LOOKUP = {
-  "100000": 9.8,
-  "100001": 9.5,
-  "100010": 9.4,
-  "100011": 8.7,
-  "100020": 9.1,
-  "100021": 8.1,
-  "100100": 9.4,
-  "100101": 8.9,
-  "100110": 8.6,
-  "100111": 7.4,
-  "100120": 7.7,
-  "100121": 6.4,
-  "100200": 8.7,
-  "100201": 7.5,
-  "100210": 7.4,
-  "100211": 6.3,
-  "100220": 6.3,
-  "100221": 4.9,
-  "101000": 9.4,
-  "101001": 8.9,
-  "101010": 8.8,
-  "101011": 7.7,
-  "101020": 7.6,
-  "101021": 6.7,
-  "101100": 8.6,
-  "101101": 7.6,
-  "101110": 7.4,
-  "101111": 5.8,
-  "101120": 5.9,
-  "101121": 5,
-  "101200": 7.2,
-  "101201": 5.7,
-  "101210": 5.7,
-  "101211": 5.2,
-  "101220": 5.2,
-  "101221": 2.5,
-  "102001": 8.3,
-  "102011": 7,
-  "102021": 5.4,
-  "102101": 6.5,
-  "102111": 5.8,
-  "102121": 2.6,
-  "102201": 5.3,
-  "102211": 2.1,
-  "102221": 1.3,
-  "110000": 9.5,
-  "110001": 9,
-  "110010": 8.8,
-  "110011": 7.6,
-  "110020": 7.6,
-  "110021": 7,
-  "110100": 9,
-  "110101": 7.7,
-  "110110": 7.5,
-  "110111": 6.2,
-  "110120": 6.1,
-  "110121": 5.3,
-  "110200": 7.7,
-  "110201": 6.6,
-  "110210": 6.8,
-  "110211": 5.9,
-  "110220": 5.2,
-  "110221": 3,
-  "111000": 8.9,
-  "111001": 7.8,
-  "111010": 7.6,
-  "111011": 6.7,
-  "111020": 6.2,
-  "111021": 5.8,
-  "111100": 7.4,
-  "111101": 5.9,
-  "111110": 5.7,
-  "111111": 5.7,
-  "111120": 4.7,
-  "111121": 2.3,
-  "111200": 6.1,
-  "111201": 5.2,
-  "111210": 5.7,
-  "111211": 2.9,
-  "111220": 2.4,
-  "111221": 1.6,
-  "112001": 7.1,
-  "112011": 5.9,
-  "112021": 3,
-  "112101": 5.8,
-  "112111": 2.6,
-  "112121": 1.5,
-  "112201": 2.3,
-  "112211": 1.3,
-  "112221": 0.6,
-  "200000": 9.3,
-  "200001": 8.7,
-  "200010": 8.6,
-  "200011": 7.2,
-  "200020": 7.5,
-  "200021": 5.8,
-  "200100": 8.6,
-  "200101": 7.4,
-  "200110": 7.4,
-  "200111": 6.1,
-  "200120": 5.6,
-  "200121": 3.4,
-  "200200": 7,
-  "200201": 5.4,
-  "200210": 5.2,
-  "200211": 4,
-  "200220": 4,
-  "200221": 2.2,
-  "201000": 8.5,
-  "201001": 7.5,
-  "201010": 7.4,
-  "201011": 5.5,
-  "201020": 6.2,
-  "201021": 5.1,
-  "201100": 7.2,
-  "201101": 5.7,
-  "201110": 5.5,
-  "201111": 4.1,
-  "201120": 4.6,
-  "201121": 1.9,
-  "201200": 5.3,
-  "201201": 3.6,
-  "201210": 3.4,
-  "201211": 1.9,
-  "201220": 1.9,
-  "201221": 0.8,
-  "202001": 6.4,
-  "202011": 5.1,
-  "202021": 2,
-  "202101": 4.7,
-  "202111": 2.1,
-  "202121": 1.1,
-  "202201": 2.4,
-  "202211": 0.9,
-  "202221": 0.4,
-  "210000": 8.8,
-  "210001": 7.5,
-  "210010": 7.3,
-  "210011": 5.3,
-  "210020": 6,
-  "210021": 5,
-  "210100": 7.3,
-  "210101": 5.5,
-  "210110": 5.9,
-  "210111": 4,
-  "210120": 4.1,
-  "210121": 2,
-  "210200": 5.4,
-  "210201": 4.3,
-  "210210": 4.5,
-  "210211": 2.2,
-  "210220": 2,
-  "210221": 1.1,
-  "211000": 7.5,
-  "211001": 5.5,
-  "211010": 5.8,
-  "211011": 4.5,
-  "211020": 4,
-  "211021": 2.1,
-  "211100": 6.1,
-  "211101": 5.1,
-  "211110": 4.8,
-  "211111": 1.8,
-  "211120": 2,
-  "211121": 0.9,
-  "211200": 4.6,
-  "211201": 1.8,
-  "211210": 1.7,
-  "211211": 0.7,
-  "211220": 0.8,
-  "211221": 0.2,
-  "212001": 5.3,
-  "212011": 2.4,
-  "212021": 1.4,
-  "212101": 2.4,
-  "212111": 1.2,
-  "212121": 0.5,
-  "212201": 1,
-  "212211": 0.3,
-  "212221": 0.1,
-  "000000": 10,
-  "000001": 9.9,
-  "000010": 9.8,
-  "000011": 9.5,
-  "000020": 9.5,
-  "000021": 9.2,
-  "000100": 10,
-  "000101": 9.6,
-  "000110": 9.3,
-  "000111": 8.7,
-  "000120": 9.1,
-  "000121": 8.1,
-  "000200": 9.3,
-  "000201": 9,
-  "000210": 8.9,
-  "000211": 8,
-  "000220": 8.1,
-  "000221": 6.8,
-  "001000": 9.8,
-  "001001": 9.5,
-  "001010": 9.5,
-  "001011": 9.2,
-  "001020": 9,
-  "001021": 8.4,
-  "001100": 9.3,
-  "001101": 9.2,
-  "001110": 8.9,
-  "001111": 8.1,
-  "001120": 8.1,
-  "001121": 6.5,
-  "001200": 8.8,
-  "001201": 8,
-  "001210": 7.8,
-  "001211": 7,
-  "001220": 6.9,
-  "001221": 4.8,
-  "002001": 9.2,
-  "002011": 8.2,
-  "002021": 7.2,
-  "002101": 7.9,
-  "002111": 6.9,
-  "002121": 5,
-  "002201": 6.9,
-  "002211": 5.5,
-  "002221": 2.7,
-  "010000": 9.9,
-  "010001": 9.7,
-  "010010": 9.5,
-  "010011": 9.2,
-  "010020": 9.2,
-  "010021": 8.5,
-  "010100": 9.5,
-  "010101": 9.1,
-  "010110": 9,
-  "010111": 8.3,
-  "010120": 8.4,
-  "010121": 7.1,
-  "010200": 9.2,
-  "010201": 8.1,
-  "010210": 8.2,
-  "010211": 7.1,
-  "010220": 7.2,
-  "010221": 5.3,
-  "011000": 9.5,
-  "011001": 9.3,
-  "011010": 9.2,
-  "011011": 8.5,
-  "011020": 8.5,
-  "011021": 7.3,
-  "011100": 9.2,
-  "011101": 8.2,
-  "011110": 8,
-  "011111": 7.2,
-  "011120": 7,
-  "011121": 5.9,
-  "011200": 8.4,
-  "011201": 7,
-  "011210": 7.1,
-  "011211": 5.2,
-  "011220": 5,
-  "011221": 3,
-  "012001": 8.6,
-  "012011": 7.5,
-  "012021": 5.2,
-  "012101": 7.1,
-  "012111": 5.2,
-  "012121": 2.9,
-  "012201": 6.3,
-  "012211": 2.9,
-  "012221": 1.7
-};
-var CVSS4_MAX_COMPOSED = {
-  eq1: {
-    "0": ["AV:N/PR:N/UI:N/"],
-    "1": ["AV:A/PR:N/UI:N/", "AV:N/PR:L/UI:N/", "AV:N/PR:N/UI:P/"],
-    "2": ["AV:P/PR:N/UI:N/", "AV:A/PR:L/UI:P/"]
-  },
-  eq2: {
-    "0": ["AC:L/AT:N/"],
-    "1": ["AC:H/AT:N/", "AC:L/AT:P/"]
-  },
-  eq3: {
-    "0": {
-      "0": ["VC:H/VI:H/VA:H/CR:H/IR:H/AR:H/"],
-      "1": ["VC:H/VI:H/VA:L/CR:M/IR:M/AR:H/", "VC:H/VI:H/VA:H/CR:M/IR:M/AR:M/"]
-    },
-    "1": {
-      "0": ["VC:L/VI:H/VA:H/CR:H/IR:H/AR:H/", "VC:H/VI:L/VA:H/CR:H/IR:H/AR:H/"],
-      "1": [
-        "VC:L/VI:H/VA:L/CR:H/IR:M/AR:H/",
-        "VC:L/VI:H/VA:H/CR:H/IR:M/AR:M/",
-        "VC:H/VI:L/VA:H/CR:M/IR:H/AR:M/",
-        "VC:H/VI:L/VA:L/CR:M/IR:H/AR:H/",
-        "VC:L/VI:L/VA:H/CR:H/IR:H/AR:M/"
-      ]
-    },
-    "2": {
-      "1": ["VC:L/VI:L/VA:L/CR:H/IR:H/AR:H/"]
-    }
-  },
-  eq4: {
-    "0": ["SC:H/SI:S/SA:S/"],
-    "1": ["SC:H/SI:H/SA:H/"],
-    "2": ["SC:L/SI:L/SA:L/"]
-  },
-  eq5: {
-    "0": ["E:A/"],
-    "1": ["E:P/"],
-    "2": ["E:U/"]
-  }
-};
-var CVSS4_MAX_SEVERITY = {
-  eq1: {
-    "0": 1,
-    "1": 4,
-    "2": 5
-  },
-  eq2: {
-    "0": 1,
-    "1": 2
-  },
-  eq3eq6: {
-    "0": {
-      "0": 7,
-      "1": 6
-    },
-    "1": {
-      "0": 8,
-      "1": 8
-    },
-    "2": {
-      "1": 10
-    }
-  },
-  eq4: {
-    "0": 6,
-    "1": 5,
-    "2": 4
-  },
-  eq5: {
-    "0": 1,
-    "1": 1,
-    "2": 1
-  }
-};
-
-// src/score/cvss4.ts
-var BASE_METRICS = ["AV", "AC", "AT", "PR", "UI", "VC", "VI", "VA", "SC", "SI", "SA"];
-var AV_levels = { N: 0, A: 0.1, L: 0.2, P: 0.3 };
-var PR_levels = { N: 0, L: 0.1, H: 0.2 };
-var UI_levels = { N: 0, P: 0.1, A: 0.2 };
-var AC_levels = { L: 0, H: 0.1 };
-var AT_levels = { N: 0, P: 0.1 };
-var VC_levels = { H: 0, L: 0.1, N: 0.2 };
-var VI_levels = { H: 0, L: 0.1, N: 0.2 };
-var VA_levels = { H: 0, L: 0.1, N: 0.2 };
-var SC_levels = { H: 0.1, L: 0.2, N: 0.3 };
-var SI_levels = { S: 0, H: 0.1, L: 0.2, N: 0.3 };
-var SA_levels = { S: 0, H: 0.1, L: 0.2, N: 0.3 };
-var CR_levels = { H: 0, M: 0.1, L: 0.2 };
-var IR_levels = { H: 0, M: 0.1, L: 0.2 };
-var AR_levels = { H: 0, M: 0.1, L: 0.2 };
-function scoreV4(vector) {
-  const sel = parseV4(vector);
-  if (!sel) return null;
-  const macro = macroVector(sel);
-  if (CVSS4_LOOKUP[macro] === void 0) return null;
-  return cvssScore(sel, macro);
-}
-function parseV4(vector) {
-  const parts = vector.split("/");
-  if (parts[0] !== "CVSS:4.0") return null;
-  const sel = {};
-  for (const part of parts.slice(1)) {
-    const [k, v] = part.split(":");
-    if (k && v) sel[k] = v;
-  }
-  for (const metric of BASE_METRICS) if (!(metric in sel)) return null;
-  for (const metric of ["E", "CR", "IR", "AR"]) if (!(metric in sel)) sel[metric] = "X";
-  return sel;
-}
-function m(sel, metric) {
-  const selected = sel[metric];
-  if (metric === "E" && selected === "X") return "A";
-  if ((metric === "CR" || metric === "IR" || metric === "AR") && selected === "X") return "H";
-  const modified = sel[`M${metric}`];
-  if (modified !== void 0 && modified !== "X") return modified;
-  return selected ?? "";
-}
-function macroVector(sel) {
-  const av = m(sel, "AV");
-  const pr = m(sel, "PR");
-  const ui = m(sel, "UI");
-  let eq1 = "2";
-  if (av === "N" && pr === "N" && ui === "N") eq1 = "0";
-  else if ((av === "N" || pr === "N" || ui === "N") && av !== "P") eq1 = "1";
-  const eq2 = m(sel, "AC") === "L" && m(sel, "AT") === "N" ? "0" : "1";
-  const vc = m(sel, "VC");
-  const vi = m(sel, "VI");
-  const va = m(sel, "VA");
-  let eq3 = "2";
-  if (vc === "H" && vi === "H") eq3 = "0";
-  else if (vc === "H" || vi === "H" || va === "H") eq3 = "1";
-  const msi = m(sel, "MSI");
-  const msa = m(sel, "MSA");
-  let eq4 = "2";
-  if (msi === "S" || msa === "S") eq4 = "0";
-  else if (m(sel, "SC") === "H" || m(sel, "SI") === "H" || m(sel, "SA") === "H") eq4 = "1";
-  const e = m(sel, "E");
-  const eq5 = e === "A" ? "0" : e === "P" ? "1" : "2";
-  const cr = m(sel, "CR");
-  const ir = m(sel, "IR");
-  const ar = m(sel, "AR");
-  const eq6 = cr === "H" && vc === "H" || ir === "H" && vi === "H" || ar === "H" && va === "H" ? "0" : "1";
-  return `${eq1}${eq2}${eq3}${eq4}${eq5}${eq6}`;
-}
-function lvl(map, key) {
-  return map[key] ?? 0;
-}
-function eqMaxes(macro, eq) {
-  const group = CVSS4_MAX_COMPOSED[`eq${eq}`];
-  return group[macro[eq - 1]] ?? [];
-}
-function extractValueMetric(metric, str) {
-  const start = str.indexOf(metric) + metric.length + 1;
-  const rest = str.slice(start);
-  const slash = rest.indexOf("/");
-  return slash > 0 ? rest.substring(0, slash) : rest;
-}
-function cvssScore(sel, macro) {
-  if (BASE_METRICS.slice(5).every((metric) => m(sel, metric) === "N")) return 0;
-  let value = CVSS4_LOOKUP[macro];
-  const eq1 = Number(macro[0]);
-  const eq3 = Number(macro[2]);
-  const eq6 = Number(macro[5]);
-  const lower = (parts) => CVSS4_LOOKUP[parts.join("")] ?? NaN;
-  const d = macro.split("").map(Number);
-  const scoreEq1Lower = lower([d[0] + 1, d[1], d[2], d[3], d[4], d[5]]);
-  const scoreEq2Lower = lower([d[0], d[1] + 1, d[2], d[3], d[4], d[5]]);
-  let scoreEq3Eq6Lower;
-  if (eq3 === 1 && eq6 === 1) scoreEq3Eq6Lower = lower([d[0], d[1], d[2] + 1, d[3], d[4], d[5]]);
-  else if (eq3 === 0 && eq6 === 1)
-    scoreEq3Eq6Lower = lower([d[0], d[1], d[2] + 1, d[3], d[4], d[5]]);
-  else if (eq3 === 1 && eq6 === 0)
-    scoreEq3Eq6Lower = lower([d[0], d[1], d[2], d[3], d[4], d[5] + 1]);
-  else if (eq3 === 0 && eq6 === 0) {
-    const left = lower([d[0], d[1], d[2], d[3], d[4], d[5] + 1]);
-    const right = lower([d[0], d[1], d[2] + 1, d[3], d[4], d[5]]);
-    scoreEq3Eq6Lower = left > right ? left : right;
-  } else scoreEq3Eq6Lower = lower([d[0], d[1], d[2] + 1, d[3], d[4], d[5] + 1]);
-  const scoreEq4Lower = lower([d[0], d[1], d[2], d[3] + 1, d[4], d[5]]);
-  const scoreEq5Lower = lower([d[0], d[1], d[2], d[3], d[4] + 1, d[5]]);
-  const eq1Maxes = eqMaxes(macro, 1);
-  const eq2Maxes = eqMaxes(macro, 2);
-  const eq3Eq6Maxes = CVSS4_MAX_COMPOSED.eq3[macro[2]][macro[5]];
-  const eq4Maxes = eqMaxes(macro, 4);
-  const eq5Maxes = eqMaxes(macro, 5);
-  const maxVectors = [];
-  for (const a of eq1Maxes)
-    for (const b of eq2Maxes)
-      for (const c of eq3Eq6Maxes)
-        for (const e of eq4Maxes) for (const f of eq5Maxes) maxVectors.push(a + b + c + e + f);
-  let sdAV = 0, sdPR = 0, sdUI = 0, sdAC = 0, sdAT = 0, sdVC = 0, sdVI = 0, sdVA = 0, sdSC = 0, sdSI = 0, sdSA = 0, sdCR = 0, sdIR = 0, sdAR = 0;
-  for (const maxVector of maxVectors) {
-    sdAV = lvl(AV_levels, m(sel, "AV")) - lvl(AV_levels, extractValueMetric("AV", maxVector));
-    sdPR = lvl(PR_levels, m(sel, "PR")) - lvl(PR_levels, extractValueMetric("PR", maxVector));
-    sdUI = lvl(UI_levels, m(sel, "UI")) - lvl(UI_levels, extractValueMetric("UI", maxVector));
-    sdAC = lvl(AC_levels, m(sel, "AC")) - lvl(AC_levels, extractValueMetric("AC", maxVector));
-    sdAT = lvl(AT_levels, m(sel, "AT")) - lvl(AT_levels, extractValueMetric("AT", maxVector));
-    sdVC = lvl(VC_levels, m(sel, "VC")) - lvl(VC_levels, extractValueMetric("VC", maxVector));
-    sdVI = lvl(VI_levels, m(sel, "VI")) - lvl(VI_levels, extractValueMetric("VI", maxVector));
-    sdVA = lvl(VA_levels, m(sel, "VA")) - lvl(VA_levels, extractValueMetric("VA", maxVector));
-    sdSC = lvl(SC_levels, m(sel, "SC")) - lvl(SC_levels, extractValueMetric("SC", maxVector));
-    sdSI = lvl(SI_levels, m(sel, "SI")) - lvl(SI_levels, extractValueMetric("SI", maxVector));
-    sdSA = lvl(SA_levels, m(sel, "SA")) - lvl(SA_levels, extractValueMetric("SA", maxVector));
-    sdCR = lvl(CR_levels, m(sel, "CR")) - lvl(CR_levels, extractValueMetric("CR", maxVector));
-    sdIR = lvl(IR_levels, m(sel, "IR")) - lvl(IR_levels, extractValueMetric("IR", maxVector));
-    sdAR = lvl(AR_levels, m(sel, "AR")) - lvl(AR_levels, extractValueMetric("AR", maxVector));
-    const distances = [
-      sdAV,
-      sdPR,
-      sdUI,
-      sdAC,
-      sdAT,
-      sdVC,
-      sdVI,
-      sdVA,
-      sdSC,
-      sdSI,
-      sdSA,
-      sdCR,
-      sdIR,
-      sdAR
-    ];
-    if (distances.some((x) => x < 0)) continue;
-    break;
-  }
-  const csdEq1 = sdAV + sdPR + sdUI;
-  const csdEq2 = sdAC + sdAT;
-  const csdEq3Eq6 = sdVC + sdVI + sdVA + sdCR + sdIR + sdAR;
-  const csdEq4 = sdSC + sdSI + sdSA;
-  const step = 0.1;
-  const availEq1 = value - scoreEq1Lower;
-  const availEq2 = value - scoreEq2Lower;
-  const availEq3Eq6 = value - scoreEq3Eq6Lower;
-  const availEq4 = value - scoreEq4Lower;
-  const availEq5 = value - scoreEq5Lower;
-  const maxSev = CVSS4_MAX_SEVERITY;
-  const maxSevEq1 = maxSev.eq1[String(eq1)] * step;
-  const maxSevEq2 = maxSev.eq2[macro[1]] * step;
-  const maxSevEq3Eq6 = maxSev.eq3eq6[String(eq3)][String(eq6)] * step;
-  const maxSevEq4 = maxSev.eq4[macro[3]] * step;
-  let n = 0;
-  let nsEq1 = 0, nsEq2 = 0, nsEq3Eq6 = 0, nsEq4 = 0;
-  if (!Number.isNaN(availEq1)) {
-    n++;
-    nsEq1 = availEq1 * (csdEq1 / maxSevEq1);
-  }
-  if (!Number.isNaN(availEq2)) {
-    n++;
-    nsEq2 = availEq2 * (csdEq2 / maxSevEq2);
-  }
-  if (!Number.isNaN(availEq3Eq6)) {
-    n++;
-    nsEq3Eq6 = availEq3Eq6 * (csdEq3Eq6 / maxSevEq3Eq6);
-  }
-  if (!Number.isNaN(availEq4)) {
-    n++;
-    nsEq4 = availEq4 * (csdEq4 / maxSevEq4);
-  }
-  if (!Number.isNaN(availEq5)) {
-    n++;
-  }
-  const meanDistance = n === 0 ? 0 : (nsEq1 + nsEq2 + nsEq3Eq6 + nsEq4) / n;
-  value -= meanDistance;
-  if (value < 0) value = 0;
-  if (value > 10) value = 10;
-  return Math.round(value * 10) / 10;
-}
-
-// src/score/cvss.ts
-var AV = { N: 0.85, A: 0.62, L: 0.55, P: 0.2 };
-var AC = { L: 0.77, H: 0.44 };
-var UI = { N: 0.85, R: 0.62 };
-var PR_UNCHANGED = { N: 0.85, L: 0.62, H: 0.27 };
-var PR_CHANGED = { N: 0.85, L: 0.68, H: 0.5 };
-var CIA = { H: 0.56, L: 0.22, N: 0 };
-function levelFromScore(score) {
-  if (score <= 0) return "none";
-  if (score < 4) return "low";
-  if (score < 7) return "medium";
-  if (score < 9) return "high";
-  return "critical";
-}
-function levelFromLabel(label) {
-  switch (label.trim().toUpperCase()) {
-    case "CRITICAL":
-      return "critical";
-    case "HIGH":
-      return "high";
-    case "MODERATE":
-    case "MEDIUM":
-      return "medium";
-    case "LOW":
-      return "low";
-    case "NONE":
-      return "none";
-    default:
-      return "unknown";
-  }
-}
-function roundUp(input) {
-  const scaled = Math.round(input * 1e5);
-  if (scaled % 1e4 === 0) return scaled / 1e5;
-  return (Math.floor(scaled / 1e4) + 1) / 10;
-}
-function scoreFromVector(vector) {
-  const parts = vector.split("/");
-  const header = parts[0] ?? "";
-  if (header === "CVSS:4.0") {
-    const score2 = scoreV4(vector);
-    return score2 === null ? null : { score: score2, level: levelFromScore(score2), version: header };
-  }
-  if (!/^CVSS:3\.[01]$/.test(header)) return null;
-  const m2 = {};
-  for (const part of parts.slice(1)) {
-    const [k, v] = part.split(":");
-    if (k && v) m2[k] = v;
-  }
-  const av = AV[m2.AV ?? ""];
-  const ac = AC[m2.AC ?? ""];
-  const ui = UI[m2.UI ?? ""];
-  const scopeChanged = m2.S === "C";
-  const pr = (scopeChanged ? PR_CHANGED : PR_UNCHANGED)[m2.PR ?? ""];
-  const c = CIA[m2.C ?? ""];
-  const i = CIA[m2.I ?? ""];
-  const a = CIA[m2.A ?? ""];
-  if ([av, ac, ui, pr, c, i, a].some((x) => x === void 0)) return null;
-  const iss = 1 - (1 - c) * (1 - i) * (1 - a);
-  const impact = scopeChanged ? 7.52 * (iss - 0.029) - 3.25 * Math.pow(iss - 0.02, 15) : 6.42 * iss;
-  const exploitability = 8.22 * av * ac * pr * ui;
-  let score;
-  if (impact <= 0) score = 0;
-  else if (scopeChanged) score = roundUp(Math.min(1.08 * (impact + exploitability), 10));
-  else score = roundUp(Math.min(impact + exploitability, 10));
-  return { score, level: levelFromScore(score), version: header };
-}
-function resolveSeverity(vuln) {
-  const vectors = [];
-  for (const s of vuln.severity ?? []) if (s.score) vectors.push(s.score);
-  for (const affected of vuln.affected ?? []) {
-    for (const s of affected.severity ?? []) if (s.score) vectors.push(s.score);
-  }
-  let best = null;
-  for (const vector of vectors) {
-    const result = scoreFromVector(vector);
-    if (result && (!best || result.score > best.score)) best = result;
-  }
-  if (best) {
-    return {
-      level: best.level,
-      score: best.score,
-      vector: vectorFor(best, vectors),
-      cvssVersion: best.version,
-      source: "cvss"
-    };
-  }
-  const label = qualitativeLabel(vuln);
-  if (label) return { level: levelFromLabel(label), source: "database" };
-  return { level: "unknown", source: "unknown" };
-}
-function vectorFor(best, vectors) {
-  return vectors.find((v) => v.startsWith(best.version));
-}
-function qualitativeLabel(vuln) {
-  const fromRecord = (db) => {
-    const sev = db?.severity;
-    return typeof sev === "string" ? sev : void 0;
-  };
-  const top = fromRecord(vuln.database_specific);
-  if (top) return top;
-  for (const affected of vuln.affected ?? []) {
-    const label = fromRecord(affected.database_specific);
-    if (label) return label;
-  }
-  return void 0;
-}
-
-// src/match/findings.ts
-function buildFindings(graph, candidatesFor, options = {}) {
-  const findings = [];
-  for (const node of Object.values(graph.nodes)) {
-    if (node.unscannable) continue;
-    if (options.prodOnly && node.scope === "dev") continue;
-    const candidates = candidatesFor(node.name);
-    if (candidates.length === 0) continue;
-    const matched = candidates.filter(
-      (vuln) => vulnerabilityAffects(node.name, node.version, vuln).affected
-    );
-    if (matched.length === 0) continue;
-    const path = shortestPath(graph, node.key);
-    for (const vuln of dedupeVulnerabilities(matched)) {
-      if (isIgnored(vuln, options.ignore)) continue;
-      const { fixedVersions } = vulnerabilityAffects(node.name, node.version, vuln);
-      const sortedFixes = sortVersions(fixedVersions);
-      const nearest = nearestFix(node.version, fixedVersions);
-      findings.push({
-        id: vuln.id,
-        aliases: vuln.aliases ?? [],
-        packageName: node.name,
-        version: node.version,
-        scope: node.scope,
-        direct: node.direct,
-        severity: resolveSeverity(vuln),
-        summary: vuln.summary ?? vuln.id,
-        details: vuln.details,
-        references: (vuln.references ?? []).map((ref) => ref.url),
-        fixedVersions: sortedFixes,
-        recommendation: buildRecommendation(node.name, node.direct, nearest, graph.manager),
-        dependencyPaths: path ? [path] : [],
-        source: "osv"
-      });
-    }
-  }
-  return findings;
-}
-function isIgnored(vuln, ignore) {
-  if (!ignore || ignore.size === 0) return false;
-  if (ignore.has(vuln.id)) return true;
-  return (vuln.aliases ?? []).some((alias) => ignore.has(alias));
-}
-function sortVersions(versions) {
-  return [...new Set(versions)].sort((a, b) => {
-    const pa = semver2.parse(a, { loose: true });
-    const pb = semver2.parse(b, { loose: true });
-    if (pa && pb) return pa.compare(pb);
-    return a.localeCompare(b);
-  });
-}
-var INSTALL_COMMAND = {
-  npm: "npm install",
-  yarn: "yarn add",
-  pnpm: "pnpm add"
-};
-function buildRecommendation(name, direct, nearest, manager) {
-  if (!nearest) {
-    return direct ? "No fixed version is available yet. Watch the advisory, or evaluate an alternative package." : "No fixed version is available yet. Pressure the parent dependency to update, or override the version.";
-  }
-  if (direct) {
-    return `Upgrade to ${name}@${nearest} or later (e.g. \`${INSTALL_COMMAND[manager]} ${name}@${nearest}\`).`;
-  }
-  return `Update the dependency that pulls in ${name} so it resolves to ${name}@${nearest} or later. If it cannot, force the resolution via an override.`;
-}
-
-// src/osv/database.ts
-var OsvDatabase = class {
-  byName = /* @__PURE__ */ new Map();
-  ids = /* @__PURE__ */ new Set();
-  add(vuln) {
-    if (vuln.withdrawn) return;
-    if (this.ids.has(vuln.id)) return;
-    this.ids.add(vuln.id);
-    const names = /* @__PURE__ */ new Set();
-    for (const affected of vuln.affected ?? []) {
-      const ecosystem = affected.package?.ecosystem;
-      if (ecosystem && ecosystem !== "npm") continue;
-      if (affected.package?.name) names.add(affected.package.name);
-    }
-    for (const name of names) {
-      const list = this.byName.get(name);
-      if (list) list.push(vuln);
-      else this.byName.set(name, [vuln]);
-    }
-  }
-  addAll(vulns) {
-    for (const vuln of vulns) this.add(vuln);
-  }
-  /** Candidate advisories that name `packageName` (still need a version check). */
-  vulnerabilitiesFor(packageName) {
-    return this.byName.get(packageName) ?? [];
-  }
-  /** Number of distinct advisories indexed. */
-  get size() {
-    return this.ids.size;
-  }
-};
-
-// src/engine.ts
-import { resolve as resolve2 } from "path";
-
-// src/cache/paths.ts
-import { join as join2 } from "path";
-import envPaths from "env-paths";
-function resolveCacheDir(override) {
-  if (override) return override;
-  if (process.env.LOCKHAWK_CACHE) return process.env.LOCKHAWK_CACHE;
-  return envPaths("lockhawk", { suffix: "" }).cache;
-}
-function offlineDbDir(cacheDir) {
-  return join2(cacheDir, "osv-db", "npm");
-}
-var SHARD_BUCKETS = 4096;
-function shardBucket(packageName) {
-  let hash = 2166136261;
-  for (let i = 0; i < packageName.length; i++) {
-    hash ^= packageName.charCodeAt(i);
-    hash = Math.imul(hash, 16777619);
-  }
-  return (hash >>> 0) % SHARD_BUCKETS;
-}
-function offlineMetaPath(cacheDir) {
-  return join2(offlineDbDir(cacheDir), "meta.json");
-}
-function queryCachePath(cacheDir, id) {
-  return join2(cacheDir, "query-cache", `${encodeURIComponent(id)}.json`);
-}
-
-// src/osv/client.ts
-import { mkdir, readFile, writeFile } from "fs/promises";
-import { dirname as dirname4 } from "path";
-import pLimit from "p-limit";
-import pRetry, { AbortError } from "p-retry";
-var OSV_API = "https://api.osv.dev/v1";
-var BATCH_SIZE = 1e3;
-var OsvClient = class {
-  constructor(opts) {
-    this.opts = opts;
-    this.limit = pLimit(opts.concurrency ?? 5);
-  }
-  opts;
-  limit;
-  /** Fetch advisories naming the given packages, keyed by package name. */
-  async fetchAdvisories(packages) {
-    const names = [...new Set(packages.map((p) => p.name))];
-    const idsByName = await this.queryBatch(names);
-    const allIds = /* @__PURE__ */ new Set();
-    for (const ids of idsByName.values()) for (const id of ids) allIds.add(id);
-    const records = await this.hydrate([...allIds]);
-    const byName = /* @__PURE__ */ new Map();
-    for (const [name, ids] of idsByName) {
-      const list = [];
-      for (const id of ids) {
-        const record = records.get(id);
-        if (record) list.push(record);
-      }
-      if (list.length) byName.set(name, list);
-    }
-    return byName;
-  }
-  async queryBatch(names) {
-    const idsByName = /* @__PURE__ */ new Map();
-    for (let i = 0; i < names.length; i += BATCH_SIZE) {
-      const chunk = names.slice(i, i + BATCH_SIZE);
-      const body = {
-        queries: chunk.map((name) => ({ package: { name, ecosystem: "npm" } }))
-      };
-      const data = await this.request(`${OSV_API}/querybatch`, body);
-      for (let j = 0; j < chunk.length; j++) {
-        const name = chunk[j];
-        const result = data.results[j];
-        if (!result) continue;
-        const set = idsByName.get(name) ?? /* @__PURE__ */ new Set();
-        for (const vuln of result.vulns ?? []) set.add(vuln.id);
-        let pageToken = result.next_page_token;
-        while (pageToken) {
-          const page = await this.request(`${OSV_API}/query`, {
-            package: { name, ecosystem: "npm" },
-            page_token: pageToken
-          });
-          for (const vuln of page.vulns ?? []) set.add(vuln.id);
-          pageToken = page.next_page_token;
-        }
-        if (set.size) idsByName.set(name, set);
-      }
-    }
-    return idsByName;
-  }
-  async hydrate(ids) {
-    const records = /* @__PURE__ */ new Map();
-    await Promise.all(
-      ids.map(
-        (id) => this.limit(async () => {
-          const record = await this.getVulnerability(id);
-          if (record) records.set(id, record);
-        })
-      )
-    );
-    return records;
-  }
-  async getVulnerability(id) {
-    const cached = await this.readCache(id);
-    if (cached) return cached;
-    const record = await this.request(
-      `${OSV_API}/vulns/${encodeURIComponent(id)}`
-    );
-    await this.writeCache(id, record);
-    return record;
-  }
-  async request(url, body) {
-    const retries = this.opts.retries ?? 3;
-    return pRetry(
-      async () => {
-        const res = await fetch(url, {
-          method: body ? "POST" : "GET",
-          headers: body ? { "content-type": "application/json" } : void 0,
-          body: body ? JSON.stringify(body) : void 0
-        });
-        if (res.ok) return await res.json();
-        if (res.status === 429 || res.status >= 500) {
-          throw new Error(`OSV ${res.status} for ${url}`);
-        }
-        throw new AbortError(`OSV ${res.status} for ${url}`);
-      },
-      { retries }
-    );
-  }
-  async readCache(id) {
-    if (this.opts.noCache) return void 0;
-    try {
-      const parsed = JSON.parse(await readFile(queryCachePath(this.opts.cacheDir, id), "utf8"));
-      const ttlMs = (this.opts.cacheTtlHours ?? 24) * 36e5;
-      if (Date.now() - parsed.fetchedAt > ttlMs) return void 0;
-      return parsed.vuln;
-    } catch {
-      return void 0;
-    }
-  }
-  async writeCache(id, vuln) {
-    if (this.opts.noCache) return;
-    try {
-      const path = queryCachePath(this.opts.cacheDir, id);
-      await mkdir(dirname4(path), { recursive: true });
-      await writeFile(path, JSON.stringify({ fetchedAt: Date.now(), vuln }));
-    } catch {
-    }
-  }
-};
-
-// src/osv/offline-db.ts
-import { createWriteStream } from "fs";
-import { mkdir as mkdir2, mkdtemp, readFile as readFile2, rm, writeFile as writeFile2 } from "fs/promises";
-import { tmpdir } from "os";
-import { join as join3 } from "path";
-import { Readable } from "stream";
-import { pipeline } from "stream/promises";
-import { gunzipSync, gzipSync } from "zlib";
-import yauzl from "yauzl";
-var OSV_NPM_ZIP_URL = "https://storage.googleapis.com/osv-vulnerabilities/npm/all.zip";
-var MAX_ENTRY_BYTES = 8 * 1024 * 1024;
-var OfflineDbMissingError = class extends Error {
-  constructor() {
-    super("No offline OSV database found. Run `lockhawk db update` first.");
-    this.name = "OfflineDbMissingError";
-  }
-};
-var IMF_FIXDATE = /^[A-Za-z]{3}, \d{2} [A-Za-z]{3} \d{4} \d{2}:\d{2}:\d{2} GMT$/;
-var ENTITY_TAG = /^(?:W\/)?"[\x21\x23-\x7e]*"$/;
-function sanitizeHttpDate(value) {
-  return value && IMF_FIXDATE.test(value) ? value : void 0;
-}
-function sanitizeETag(value) {
-  return value && ENTITY_TAG.test(value) ? value : void 0;
-}
-async function readOfflineMeta(cacheDir) {
-  try {
-    return JSON.parse(await readFile2(offlineMetaPath(cacheDir), "utf8"));
-  } catch {
-    return void 0;
-  }
-}
-async function updateOfflineDatabase(opts) {
-  const { cacheDir, nowIso, force, onProgress } = opts;
-  const dir = offlineDbDir(cacheDir);
-  await mkdir2(dir, { recursive: true });
-  const previous = force ? void 0 : await readOfflineMeta(cacheDir);
-  const headers = {};
-  const etag = sanitizeETag(previous?.etag);
-  const lastModified = sanitizeHttpDate(previous?.lastModified);
-  if (etag) headers["If-None-Match"] = etag;
-  if (lastModified) headers["If-Modified-Since"] = lastModified;
-  onProgress?.("Fetching npm advisory database from OSV.dev\u2026");
-  const res = await fetch(OSV_NPM_ZIP_URL, { headers });
-  if (res.status === 304 && previous) {
-    const meta2 = { ...previous, lastUpdated: nowIso };
-    await writeFile2(offlineMetaPath(cacheDir), JSON.stringify(meta2, null, 2));
-    return { status: "unchanged", meta: meta2 };
-  }
-  if (!res.ok || !res.body) {
-    throw new Error(`OSV database download failed: HTTP ${res.status}`);
-  }
-  const tmp = await mkdtemp(join3(tmpdir(), "lockhawk-osv-"));
-  const zipPath = join3(tmp, "all.zip");
-  let records;
-  try {
-    await pipeline(
-      Readable.fromWeb(res.body),
-      createWriteStream(zipPath)
-    );
-    onProgress?.("Extracting advisories\u2026");
-    records = await readZipRecords(zipPath);
-  } finally {
-    await rm(tmp, { recursive: true, force: true });
-  }
-  onProgress?.("Building package index\u2026");
-  const byName = groupByPackage(records);
-  await writeShards(cacheDir, byName);
-  const meta = {
-    ecosystem: "npm",
-    source: "osv.dev",
-    lastUpdated: nowIso,
-    recordCount: records.length,
-    packageCount: byName.size,
-    etag: res.headers.get("etag") ?? void 0,
-    lastModified: res.headers.get("last-modified") ?? void 0
-  };
-  await writeFile2(offlineMetaPath(cacheDir), JSON.stringify(meta, null, 2));
-  return { status: "updated", meta };
-}
-function bucketDir(cacheDir) {
-  return join3(offlineDbDir(cacheDir), "by-name");
-}
-function bucketPath(cacheDir, bucket) {
-  return join3(bucketDir(cacheDir), `${bucket}.json.gz`);
-}
-async function loadAdvisoriesForPackages(cacheDir, names) {
-  if (!await readOfflineMeta(cacheDir)) throw new OfflineDbMissingError();
-  const namesByBucket = /* @__PURE__ */ new Map();
-  for (const name of new Set(names)) {
-    const bucket = shardBucket(name);
-    const list = namesByBucket.get(bucket);
-    if (list) list.push(name);
-    else namesByBucket.set(bucket, [name]);
-  }
-  const result = /* @__PURE__ */ new Map();
-  await Promise.all(
-    [...namesByBucket.entries()].map(async ([bucket, bucketNames]) => {
-      try {
-        const data = JSON.parse(
-          gunzipSync(await readFile2(bucketPath(cacheDir, bucket))).toString("utf8")
-        );
-        for (const name of bucketNames) {
-          const records = data[name];
-          if (records?.length) result.set(name, records);
-        }
-      } catch {
-      }
-    })
-  );
-  return result;
-}
-function groupByPackage(records) {
-  const byName = /* @__PURE__ */ new Map();
-  for (const record of records) {
-    if (record.withdrawn) continue;
-    const names = /* @__PURE__ */ new Set();
-    for (const affected of record.affected ?? []) {
-      const ecosystem = affected.package?.ecosystem;
-      if (ecosystem && ecosystem !== "npm") continue;
-      if (affected.package?.name) names.add(affected.package.name);
-    }
-    for (const name of names) {
-      const list = byName.get(name);
-      if (list) list.push(record);
-      else byName.set(name, [record]);
-    }
-  }
-  return byName;
-}
-async function writeShards(cacheDir, byName) {
-  const dir = bucketDir(cacheDir);
-  await rm(dir, { recursive: true, force: true });
-  await mkdir2(dir, { recursive: true });
-  const buckets = /* @__PURE__ */ new Map();
-  for (const [name, records] of byName) {
-    const bucket = shardBucket(name);
-    const map = buckets.get(bucket) ?? {};
-    map[name] = records;
-    buckets.set(bucket, map);
-  }
-  const entries = [...buckets.entries()];
-  const BATCH = 256;
-  for (let i = 0; i < entries.length; i += BATCH) {
-    await Promise.all(
-      entries.slice(i, i + BATCH).map(
-        ([bucket, map]) => writeFile2(bucketPath(cacheDir, bucket), gzipSync(Buffer.from(JSON.stringify(map))))
-      )
-    );
-  }
-}
-function readZipRecords(zipPath) {
-  return new Promise((resolve3, reject) => {
-    const out = [];
-    yauzl.open(zipPath, { lazyEntries: true }, (err, zip) => {
-      if (err || !zip) return reject(err ?? new Error("Failed to open OSV zip"));
-      zip.on("entry", (entry) => {
-        if (!entry.fileName.endsWith(".json")) return zip.readEntry();
-        if (entry.uncompressedSize > MAX_ENTRY_BYTES) return zip.readEntry();
-        zip.openReadStream(entry, (streamErr, stream) => {
-          if (streamErr || !stream) return zip.readEntry();
-          const chunks = [];
-          stream.on("data", (chunk) => chunks.push(chunk));
-          stream.on("error", () => zip.readEntry());
-          stream.on("end", () => {
-            try {
-              out.push(JSON.parse(Buffer.concat(chunks).toString("utf8")));
-            } catch {
-            }
-            zip.readEntry();
-          });
-        });
-      });
-      zip.on("end", () => resolve3(out));
-      zip.on("error", reject);
-      zip.readEntry();
-    });
-  });
-}
-
-// src/osv/source.ts
-var HOUR_MS = 36e5;
-var OfflineSource = class {
-  constructor(opts) {
-    this.opts = opts;
-  }
-  opts;
-  async prepare(packages) {
-    const meta = await readOfflineMeta(this.opts.cacheDir);
-    if (!meta) throw new OfflineDbMissingError();
-    const map = await loadAdvisoriesForPackages(
-      this.opts.cacheDir,
-      packages.map((p) => p.name)
-    );
-    const ageHours = (Date.now() - Date.parse(meta.lastUpdated)) / HOUR_MS;
-    const stale = ageHours > (this.opts.staleAfterHours ?? 24);
-    const warnings = stale ? [
-      `Offline database is ${Math.round(ageHours)}h old. Run \`lockhawk db update\` for current results.`
-    ] : [];
-    return {
-      candidatesFor: (name) => map.get(name) ?? [],
-      database: {
-        source: "offline",
-        recordCount: meta.recordCount,
-        lastUpdated: meta.lastUpdated,
-        ageHours: Math.round(ageHours * 10) / 10,
-        stale,
-        warnings
-      }
-    };
-  }
-};
-var OnlineSource = class {
-  constructor(opts) {
-    this.opts = opts;
-  }
-  opts;
-  async prepare(packages) {
-    const client = new OsvClient({
-      cacheDir: this.opts.cacheDir,
-      concurrency: this.opts.concurrency,
-      noCache: this.opts.noCache,
-      cacheTtlHours: this.opts.cacheTtlHours
-    });
-    try {
-      const map = await client.fetchAdvisories(packages);
-      return {
-        candidatesFor: (name) => map.get(name) ?? [],
-        database: { source: "online", stale: false, warnings: [] }
-      };
-    } catch (err) {
-      if (this.opts.strictNetwork) throw err;
-      const reason = err instanceof Error ? err.message : String(err);
-      return {
-        candidatesFor: () => [],
-        database: {
-          source: "online",
-          stale: true,
-          warnings: [
-            `OSV.dev was unreachable (${reason}). Scan completed without online data \u2014 results may be incomplete.`
-          ]
-        }
-      };
-    }
-  }
-};
-var AutoSource = class {
-  constructor(opts) {
-    this.opts = opts;
-  }
-  opts;
-  async prepare(packages) {
-    const meta = await readOfflineMeta(this.opts.cacheDir);
-    const ttl = this.opts.staleAfterHours ?? 24;
-    if (meta) {
-      const ageHours = (Date.now() - Date.parse(meta.lastUpdated)) / HOUR_MS;
-      if (ageHours <= ttl) {
-        return new OfflineSource(this.opts).prepare(packages);
-      }
-    }
-    try {
-      return await new OnlineSource({ ...this.opts, strictNetwork: true }).prepare(packages);
-    } catch (err) {
-      if (meta) {
-        const resolved = await new OfflineSource(this.opts).prepare(packages);
-        resolved.database.warnings.push(
-          "Used the stale offline database because OSV.dev was unreachable."
-        );
-        return resolved;
-      }
-      if (this.opts.strictNetwork) throw err;
-      const reason = err instanceof Error ? err.message : String(err);
-      return {
-        candidatesFor: () => [],
-        database: {
-          source: "online",
-          stale: true,
-          warnings: [
-            `No offline database and OSV.dev was unreachable (${reason}). Run \`lockhawk db update\`.`
-          ]
-        }
-      };
-    }
-  }
-};
-function createSource(mode, opts) {
-  switch (mode) {
-    case "offline":
-      return new OfflineSource(opts);
-    case "online":
-      return new OnlineSource(opts);
-    default:
-      return new AutoSource(opts);
-  }
-}
-
-// src/engine.ts
-var TOOL = { name: "lockhawk", version: "0.1.0" };
-async function scan(options = {}, source) {
-  const start = Date.now();
-  const dir = resolve2(options.path ?? ".");
-  const graph = loadDependencyGraph(dir);
-  const detected = detectLockfile(dir);
-  const scannable = uniqueScannablePackages(graph, options.prodOnly);
-  const cacheDir = resolveCacheDir(options.cacheDir);
-  const src = source ?? createSource(options.mode ?? "auto", {
-    cacheDir,
-    concurrency: options.concurrency,
-    noCache: options.noCache,
-    cacheTtlHours: options.cacheTtlHours,
-    strictNetwork: options.strictNetwork
-  });
-  options.onProgress?.("Checking dependencies against OSV.dev\u2026");
-  const resolved = await src.prepare(scannable);
-  let findings = buildFindings(graph, resolved.candidatesFor, {
-    prodOnly: options.prodOnly,
-    ignore: options.ignore && options.ignore.length ? new Set(options.ignore) : void 0
-  });
-  if (options.severityThreshold && options.severityThreshold !== "none") {
-    findings = findings.filter(
-      (f) => severityAtLeast(f.severity.level, options.severityThreshold)
-    );
-  }
-  findings.sort(bySeverityThenName);
-  const unscannable = unscannablePackages(graph);
-  return {
-    schemaVersion: 1,
-    tool: { ...TOOL },
-    scannedAt: new Date(start).toISOString(),
-    target: {
-      path: dir,
-      manager: graph.manager,
-      lockfile: detected?.filename ?? "",
-      root: graph.root
-    },
-    database: resolved.database,
-    summary: summarize(findings),
-    stats: {
-      totalPackages: Object.keys(graph.nodes).length,
-      uniquePackages: scannable.length,
-      directDependencies: graph.directKeys.length,
-      unscannable: unscannable.length,
-      durationMs: Date.now() - start
-    },
-    findings,
-    unscannable
-  };
-}
-function uniqueScannablePackages(graph, prodOnly) {
-  const seen = /* @__PURE__ */ new Set();
-  const out = [];
-  for (const node of Object.values(graph.nodes)) {
-    if (node.unscannable) continue;
-    if (prodOnly && node.scope === "dev") continue;
-    if (seen.has(node.key)) continue;
-    seen.add(node.key);
-    out.push({ name: node.name, version: node.version });
-  }
-  return out;
-}
-function unscannablePackages(graph) {
-  const out = [];
-  for (const node of Object.values(graph.nodes)) {
-    if (node.unscannable)
-      out.push({ name: node.name, version: node.version, reason: node.unscannable.reason });
-  }
-  return out;
-}
-function summarize(findings) {
-  const summary = {
-    total: findings.length,
-    critical: 0,
-    high: 0,
-    medium: 0,
-    low: 0,
-    unknown: 0,
-    none: 0,
-    vulnerablePackages: 0,
-    fixable: 0
-  };
-  const vulnerable = /* @__PURE__ */ new Set();
-  for (const f of findings) {
-    summary[f.severity.level] += 1;
-    vulnerable.add(`${f.packageName}@${f.version}`);
-    if (f.fixedVersions.length > 0) summary.fixable += 1;
-  }
-  summary.vulnerablePackages = vulnerable.size;
-  return summary;
-}
-function bySeverityThenName(a, b) {
-  const rank = SEVERITY_RANK[b.severity.level] - SEVERITY_RANK[a.severity.level];
-  if (rank !== 0) return rank;
-  return a.packageName.localeCompare(b.packageName);
-}
-function shouldFail(summary, failOn) {
-  const levels = ["critical", "high", "medium", "low", "unknown"];
-  return levels.some(
-    (level) => SEVERITY_RANK[level] >= SEVERITY_RANK[failOn] && summary[level] > 0
-  );
-}
-
-// src/report/json.ts
-function toJson(result) {
-  return JSON.stringify(result, null, 2);
-}
-
-// src/report/sarif.ts
-var INFO_URI = "https://github.com/lockhawk/lockhawk";
-function helpUriFor(references) {
-  return references.find((ref) => {
-    try {
-      const u = new URL(ref);
-      return u.protocol === "http:" || u.protocol === "https:";
-    } catch {
-      return false;
-    }
-  });
-}
-function securitySeverity(finding) {
-  if (typeof finding.severity.score === "number") return finding.severity.score;
-  switch (finding.severity.level) {
-    case "critical":
-      return 9.5;
-    case "high":
-      return 7.5;
-    case "medium":
-      return 5;
-    case "low":
-      return 2;
-    default:
-      return 0;
-  }
-}
-function sarifLevel(severity) {
-  if (severity === "critical" || severity === "high") return "error";
-  if (severity === "medium") return "warning";
-  return "note";
-}
-function toSarif(result) {
-  const lockfileUri = result.target.lockfile || "package-lock.json";
-  const rules = /* @__PURE__ */ new Map();
-  const results = [];
-  for (const finding of result.findings) {
-    if (!rules.has(finding.id)) {
-      rules.set(finding.id, {
-        id: finding.id,
-        name: `${finding.packageName} ${finding.id}`,
-        shortDescription: { text: finding.summary },
-        fullDescription: finding.details ? { text: finding.details } : void 0,
-        helpUri: helpUriFor(finding.references),
-        properties: {
-          "security-severity": String(securitySeverity(finding)),
-          tags: ["security", "dependency", finding.severity.level]
-        }
-      });
-    }
-    const path = finding.dependencyPaths[0]?.join(" \u203A ") ?? finding.packageName;
-    const fix = finding.fixedVersions[0] ? ` Fixed in ${finding.fixedVersions[0]}.` : "";
-    results.push({
-      ruleId: finding.id,
-      level: sarifLevel(finding.severity.level),
-      message: {
-        text: `${finding.severity.level.toUpperCase()}: ${finding.packageName}@${finding.version} \u2014 ${finding.summary}.${fix} Path: ${path}.`
-      },
-      locations: [
-        {
-          physicalLocation: {
-            artifactLocation: { uri: lockfileUri },
-            region: { startLine: 1 }
-          }
-        }
-      ],
-      partialFingerprints: {
-        lockhawkFinding: `${finding.packageName}@${finding.version}@${finding.id}`
-      },
-      properties: {
-        package: finding.packageName,
-        version: finding.version,
-        scope: finding.scope,
-        fixedVersions: finding.fixedVersions
-      }
-    });
-  }
-  return {
-    $schema: "https://json.schemastore.org/sarif-2.1.0.json",
-    version: "2.1.0",
-    runs: [
-      {
-        tool: {
-          driver: {
-            name: result.tool.name,
-            version: result.tool.version,
-            informationUri: INFO_URI,
-            rules: [...rules.values()]
-          }
-        },
-        results,
-        properties: {
-          scannedAt: result.scannedAt,
-          databaseSource: result.database.source,
-          databaseAgeHours: result.database.ageHours,
-          databaseStale: result.database.stale
-        }
-      }
-    ]
-  };
-}
-function toSarifString(result) {
-  return JSON.stringify(toSarif(result), null, 2);
-}
-
-// src/report/html.ts
-function toHtml(result) {
-  return renderHtml(result);
-}
-var SEVERITY_COLORS = {
-  critical: "#ff5d67",
-  high: "#ff9f43",
-  medium: "#ffd23f",
-  low: "#5b9dff",
-  unknown: "#8b95a5",
-  none: "#34d399"
-};
-function esc(text) {
-  return text.replace(
-    /[&<>"]/g,
-    (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;" })[c]
-  );
-}
-function httpHref(url) {
-  try {
-    const u = new URL(url);
-    return u.protocol === "http:" || u.protocol === "https:" ? url : void 0;
-  } catch {
-    return void 0;
-  }
-}
-var MARK = `<svg class="mark" viewBox="0 0 48 48" fill="none" aria-hidden="true">
-  <defs>
-    <linearGradient id="lh-g" x1="6" y1="4" x2="40" y2="44" gradientUnits="userSpaceOnUse">
-      <stop stop-color="#ffc266"/><stop offset="1" stop-color="#ff5d67"/>
-    </linearGradient>
-  </defs>
-  <path d="M24 4 40 11v13c0 9-7 15.2-16 20-9-4.8-16-11-16-20V11Z" stroke="url(#lh-g)" stroke-width="2.2" stroke-linejoin="round"/>
-  <path d="M14 18.5 24 15l10 3.5" stroke="url(#lh-g)" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round"/>
-  <circle cx="24" cy="23" r="3.2" fill="url(#lh-g)"/>
-  <path d="M24 26.2V32" stroke="url(#lh-g)" stroke-width="2.2" stroke-linecap="round"/>
-</svg>`;
-var CHEVRON = `<svg class="chev" width="11" height="11" viewBox="0 0 16 16" fill="none" aria-hidden="true"><path d="M6 4l4 4-4 4" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/></svg>`;
-function renderFix(rec) {
-  const match = rec.match(/`([^`]+)`/);
-  const command = match?.[1];
-  const pending = /^No fixed version/i.test(rec);
-  const prose = command ? rec.replace(/\s*\(e\.g\.[^)]*\)/, "") : rec;
-  const bar = command ? `<div class="cmdbar"><code class="cmd" title="Click to select, then \u2318/Ctrl+C to copy">${esc(
-    command
-  )}</code><span class="hint">click to select</span></div>` : "";
-  return `<div class="fix${pending ? " fix-pending" : ""}">
-        <div class="fix-label">${CHEVRON.replace("chev", "spark")}${pending ? "No fix available yet" : "Recommended fix"}</div>
-        <p class="fix-text">${esc(prose)}</p>${bar}
-      </div>`;
-}
-function renderHtml(result) {
-  const { summary } = result;
-  const cards = ["critical", "high", "medium", "low", "unknown"].map(
-    (sev, i) => `
-      <div class="card${summary[sev] === 0 ? " zero" : ""}" style="--c:${SEVERITY_COLORS[sev]};--i:${i}">
-        <div class="count">${summary[sev]}</div><div class="label">${sev}</div>
-      </div>`
-  ).join("");
-  const rows = result.findings.map((f, i) => {
-    const path = f.dependencyPaths[0]?.join(" \u203A ") ?? f.packageName;
-    const refs = f.references.slice(0, 3).map((u) => httpHref(u)).filter((u) => u !== void 0).map((u) => `<a class="ref" href="${esc(u)}" target="_blank" rel="noopener">link</a>`).join("");
-    const fixed = f.fixedVersions[0] ? `<span class="fixchip" title="Click to select, then \u2318/Ctrl+C to copy">${esc(
-      f.fixedVersions[0]
-    )}</span>` : '<span class="nofix">\u2014</span>';
-    return `
-      <tr class="main" style="--i:${i}">
-        <td><span class="pill" style="--c:${SEVERITY_COLORS[f.severity.level]}">${esc(
-      f.severity.level
-    )}${f.severity.score ? ` ${f.severity.score}` : ""}</span></td>
-        <td><span class="pkg">${esc(f.packageName)}@${esc(f.version)}</span><div class="scope">${esc(
-      f.scope
-    )}${f.direct ? " \xB7 direct" : ""}</div></td>
-        <td><a class="advid" href="https://osv.dev/${encodeURIComponent(
-      f.id
-    )}" target="_blank" rel="noopener">${esc(f.id)}</a></td>
-        <td><div class="summary">${esc(f.summary)}</div><div class="path">${esc(path)}</div></td>
-        <td>${fixed}</td>
-        <td class="refs">${refs}</td>
-      </tr>
-      <tr class="detail-row">
-        <td colspan="6">
-          ${f.recommendation ? renderFix(f.recommendation) : ""}
-          <details>
-            <summary>${CHEVRON}<span>Advisory details</span></summary>
-            <div class="detail-body">
-              <div class="advisory-wrap">
-                <div class="advisory-head"><span class="dots"><i></i><i></i><i></i></span><span class="advisory-title">advisory \xB7 ${esc(
-      f.id
-    )}</span></div>
-                <pre class="advisory">${esc(f.details ?? f.summary)}</pre>
-              </div>
-            </div>
-          </details>
-        </td>
-      </tr>`;
-  }).join("");
-  const dbWarnings = result.database.warnings.map((w) => `<div class="warn"><span class="warn-i">\u26A0</span>${esc(w)}</div>`).join("");
-  const resultsMeta = result.findings.length === 0 ? "" : `<div class="results-meta">
-      <span><b>${summary.total}</b> findings</span><span class="sep">\xB7</span>
-      <span><b>${summary.vulnerablePackages}</b> packages</span><span class="sep">\xB7</span>
-      <span><b>${summary.fixable}</b> fixable</span>
-    </div>`;
-  return `<!doctype html>
+var N={none:0,unknown:1,low:2,medium:3,high:4,critical:5};function qe(e,n){return N[e]>=N[n]}function w(e,n){return`${e}@${n}`}import{statSync as gt}from"fs";import{resolve as mt}from"path";import{existsSync as Fe,readFileSync as Gn,statSync as Bn}from"fs";import{join as Te}from"path";var zn=[{filename:"pnpm-lock.yaml",manager:"pnpm"},{filename:"yarn.lock",manager:"yarn"},{filename:"package-lock.json",manager:"npm"},{filename:"npm-shrinkwrap.json",manager:"npm"}];function F(e){for(let{filename:n,manager:t}of zn){let s=Te(e,n);if(Fe(s)&&Bn(s).isFile())return{manager:t,path:s,filename:n}}}function M(e){let n=Te(e,"package.json"),t={};if(Fe(n))try{t=JSON.parse(Gn(n,"utf8"))}catch{t={}}let s=r=>r&&typeof r=="object"?r:{};return{name:typeof t.name=="string"?t.name:"project",version:typeof t.version=="string"?t.version:void 0,dependencies:s(t.dependencies),devDependencies:s(t.devDependencies),optionalDependencies:s(t.optionalDependencies),peerDependencies:s(t.peerDependencies)}}function fe(e,n){let t=new Set,s=[];for(let r of e)t.has(r)||(t.add(r),s.push(r));for(let r=0;r<s.length;r++){let a=n[s[r]];if(a)for(let i of a.dependencies)t.has(i)||(t.add(i),s.push(i))}return t}function ue(e){let n=fe(e.directProd,e.nodes),t=fe(e.directOptional,e.nodes),s=fe(e.directDev,e.nodes),r=new Set([...e.directProd,...e.directOptional,...e.directDev]),a={};for(let[i,o]of Object.entries(e.nodes)){let d;n.has(i)?d="prod":t.has(i)?d="optional":s.has(i)?d="dev":d="prod",a[i]={key:i,name:o.name,version:o.version,scope:d,direct:r.has(i),dependencies:Yn(o.dependencies),...o.unscannable?{unscannable:o.unscannable}:{}}}return{manager:e.manager,lockfilePath:e.lockfilePath,lockfileVersion:e.lockfileVersion,root:e.root,nodes:a,directKeys:[...r].filter(i=>a[i]!==void 0)}}function Yn(e){return e.length>1?[...new Set(e)]:e}import{readFileSync as Wn}from"fs";import{dirname as Jn}from"path";function Ue(e){let n=JSON.parse(Wn(e,"utf8"));return n.packages?Zn(n,e):Qn(n,e)}function Xn(e){let n="node_modules/",t=e.lastIndexOf(n);return t===-1?e:e.slice(t+n.length)}function Zn(e,n){let t=e.packages??{},s=t[""]??{},r={name:s.name??e.name??"project",version:s.version??e.version},a=Object.create(null),i=[],o=Object.create(null);for(let[l,u]of Object.entries(t)){if(l===""||u.link)continue;let g=u.name??Xn(l),y=u.version;if(!y)continue;let p=w(g,y);if(o[l]=p,!a[p]){let k={key:p,name:g,version:y,dependencies:[]};l.includes("node_modules")||(k.unscannable={reason:"local workspace package"},i.push({name:g,version:y,reason:"local workspace package"})),a[p]=k}}let d=(l,u)=>{let g=l;for(;;){let y=`${g?`${g}/`:""}node_modules/${u}`,p=t[y];if(p)return p.link&&typeof p.resolved=="string"?p.resolved:y;if(!g)return;let k=g.lastIndexOf("/node_modules/");g=k===-1?"":g.slice(0,k)}},c=new Set,f=new Set,m=new Set;for(let[l,u]of Object.entries(t)){if(u.link)continue;let g=l===""?void 0:o[l],y=l===""||!l.includes("node_modules"),p=(k,R)=>{for(let S of k){let O=d(l,S);if(!O)continue;let P=o[O];P&&(g&&g!==P&&a[g].dependencies.push(P),R&&R.add(P))}};p(Object.keys(u.dependencies??{}),y?c:void 0),p(Object.keys(u.optionalDependencies??{}),y?m:void 0),y&&p(Object.keys(u.devDependencies??{}),f)}return{manager:"npm",lockfilePath:n,lockfileVersion:e.lockfileVersion,root:r,nodes:a,directProd:[...c],directDev:[...f],directOptional:[...m],unscannable:i}}var Ke=500;function Qn(e,n){let t=M(Jn(n)),s={name:e.name??t.name,version:e.version??t.version},r=Object.create(null),a=u=>{let g=new Map;for(let[y,p]of Object.entries(u??{}))p?.version&&g.set(y,p.version);return g},i=(u,g)=>{for(let y=g.length-1;y>=0;y--){let p=g[y].get(u);if(p)return p}},o=(u,g)=>{if(g.length>Ke)throw new Error(`dependency nesting exceeds ${Ke} levels (malformed or malicious lockfile)`);let y=a(u),p=[...g,y];for(let[k,R]of Object.entries(u??{})){let S=R?.version;if(!S)continue;let O=w(k,S);r[O]||(r[O]={key:O,name:k,version:S,dependencies:[]});let P=[...p,a(R.dependencies)];for(let C of Object.keys(R.requires??{})){let D=i(C,P);if(D){let $=w(C,D);$!==O&&r[O].dependencies.push($)}}R.dependencies&&o(R.dependencies,p)}};o(e.dependencies,[]);let d=a(e.dependencies),c=[],f=[],m=[],l=(u,g)=>{for(let y of u){let p=d.get(y);p&&g.push(w(y,p))}};return l(Object.keys(t.dependencies),c),l(Object.keys(t.optionalDependencies),m),l(Object.keys(t.devDependencies),f),{manager:"npm",lockfilePath:n,lockfileVersion:e.lockfileVersion,root:s,nodes:r,directProd:c,directDev:f,directOptional:m,unscannable:[]}}import{readFileSync as et}from"fs";import{dirname as nt}from"path";import{createRequire as tt}from"module";import rt from"js-yaml";var st=tt(import.meta.url),ot=st("@yarnpkg/lockfile");function Ge(e){let n=et(e,"utf8"),t=M(nt(e)),s=n.includes("__metadata"),{descriptorToVersion:r,entryByVersion:a,lockfileVersion:i}=s?at(n):it(n);return ct(e,t,r,a,i,s)}function Be(e){let n=e.lastIndexOf("@");if(!(n<=0))return{name:e.slice(0,n),range:e.slice(n+1)}}function it(e){let n=ot.parse(e),t=new Map,s=new Map;for(let[r,a]of Object.entries(n.object))if(a.version)for(let i of r.split(/,\s*/)){let o=Be(i);o&&t.set(`${o.name}@${o.range}`,a.version),o&&s.set(w(o.name,a.version),a)}return{descriptorToVersion:t,entryByVersion:s,lockfileVersion:1}}function at(e){let n=rt.load(e)??{},t=new Map,s=new Map,r="berry";for(let[a,i]of Object.entries(n)){if(a==="__metadata"){let o=i.version;o!==void 0&&(r=o);continue}if(i.version)for(let o of a.split(/,\s*/)){let d=Be(o);d&&(t.set(`${d.name}@${d.range}`,i.version),s.set(w(d.name,i.version),i))}}return{descriptorToVersion:t,entryByVersion:s,lockfileVersion:r}}function ct(e,n,t,s,r,a){let i=(c,f)=>{let m=a?[`${c}@${f}`,`${c}@npm:${f}`]:[`${c}@${f}`];for(let l of m){let u=t.get(l);if(u)return u}},o=Object.create(null);for(let[c,f]of s){let m=c.lastIndexOf("@"),l=c.slice(0,m),u=c.slice(m+1);o[c]||(o[c]={key:c,name:l,version:u,dependencies:[]});let g=y=>{for(let[p,k]of Object.entries(y??{})){let R=i(p,k);if(!R)continue;let S=w(p,R);S!==c&&o[c].dependencies.push(S)}};g(f.dependencies),g(f.optionalDependencies)}let d=c=>{let f=[];for(let[m,l]of Object.entries(c)){let u=i(m,l);u&&f.push(w(m,u))}return f};return{manager:"yarn",lockfilePath:e,lockfileVersion:r,root:{name:n.name,version:n.version},nodes:o,directProd:d(n.dependencies),directDev:d(n.devDependencies),directOptional:d(n.optionalDependencies),unscannable:[]}}import{readFileSync as dt}from"fs";import{dirname as ft}from"path";import ut from"js-yaml";function Ye(e){let n=ut.load(dt(e,"utf8"))??{},t=M(ft(e)),s=lt(n.lockfileVersion),r=Object.create(null);for(let m of Object.keys(n.packages??{})){let l=ze(m,s);if(!l)continue;let u=w(l.name,l.version);r[u]||(r[u]={key:u,name:l.name,version:l.version,dependencies:[]})}let a=s>=9?n.snapshots??{}:n.packages??{};for(let[m,l]of Object.entries(a)){let u=ze(m,s);if(!u)continue;let g=w(u.name,u.version);r[g]||(r[g]={key:g,name:u.name,version:u.version,dependencies:[]});let y=p=>{for(let[k,R]of Object.entries(p??{})){let S=w(k,Y(R,s));S!==g&&r[S]&&r[g].dependencies.push(S)}};y(l.dependencies),y(l.optionalDependencies)}let i=n.importers??{".":{dependencies:n.dependencies,devDependencies:n.devDependencies,optionalDependencies:n.optionalDependencies}},o=new Set,d=new Set,c=new Set,f=(m,l)=>{for(let[u,g]of Object.entries(m??{})){let y=pt(g,s);if(!y)continue;let p=w(u,y);r[p]&&l.add(p)}};for(let m of Object.values(i))f(m.dependencies,o),f(m.optionalDependencies,c),f(m.devDependencies,d);return{manager:"pnpm",lockfilePath:e,lockfileVersion:n.lockfileVersion,root:{name:t.name,version:t.version},nodes:r,directProd:[...o],directDev:[...d],directOptional:[...c],unscannable:[]}}function lt(e){let n=parseFloat(String(e??"9"));return Number.isNaN(n)?9:Math.floor(n)}function ze(e,n){let t=e.startsWith("/")?e.slice(1):e;if(n<6){let i=t.lastIndexOf("/");if(i<=0)return;let o=t.slice(0,i),d=Y(t.slice(i+1),n);return d?{name:o,version:d}:void 0}let s=t.lastIndexOf("@");if(s<=0)return;let r=t.slice(0,s),a=Y(t.slice(s+1),n);return a?{name:r,version:a}:void 0}function Y(e,n){let t=e;if(n<6){let r=t.indexOf("_");r!==-1&&(t=t.slice(0,r))}let s=t.indexOf("(");return s!==-1&&(t=t.slice(0,s)),t}function pt(e,n){let t;if(typeof e=="string"?t=e:e&&typeof e=="object"&&typeof e.version=="string"&&(t=e.version),!!t&&!(t.startsWith("link:")||t.startsWith("file:")||t.startsWith("workspace:")))return Y(t,n)}var E=class extends Error{constructor(n){super(n),this.name="LockfileError"}};function yt(){let e=Number(process.env.LOCKHAWK_MAX_LOCKFILE_BYTES);return Number.isFinite(e)&&e>0?e:64*1024*1024}function We(e){let n=0;try{n=gt(e.path).size}catch{}let t=yt();if(n>t)throw new E(`${e.filename} is ${n} bytes, exceeding the ${t}-byte safety limit. Set LOCKHAWK_MAX_LOCKFILE_BYTES to raise it.`);try{switch(e.manager){case"npm":return Ue(e.path);case"yarn":return Ge(e.path);case"pnpm":return Ye(e.path)}}catch(s){throw new E(`Failed to parse ${e.filename}: ${s instanceof Error?s.message:String(s)}`)}}function le(e){let n=F(mt(e));if(!n)throw new E(`No lockfile found in ${e}. Expected one of: package-lock.json, yarn.lock, pnpm-lock.yaml.`);return ue(We(n))}function pe(e){return e.root.version?`${e.root.name}@${e.root.version}`:e.root.name}function ge(e,n){if(!e.nodes[n])return null;let t="\0root",s=new Map,r=new Set([t]),a=[t];for(let i=0;i<a.length;i++){let o=a[i],d=o===t?e.directKeys:e.nodes[o]?.dependencies??[];for(let c of d)if(!r.has(c)){if(r.add(c),s.set(c,o),c===n)return vt(e,s,n,t);a.push(c)}}return[pe(e),n]}function vt(e,n,t,s){let r=[],a=t;for(;a!==void 0&&a!==s;)r.unshift(a),a=n.get(a);return r.unshift(pe(e)),r}import I from"semver";function Je(e,n){if(n.versions?.includes(e))return!0;let t=I.parse(e,{loose:!0});if(!t)return!1;for(let s of n.ranges??[])if(s.type!=="GIT"&&ht(t,s.events))return!0;return!1}function ht(e,n){let t=[];for(let r of n)r.introduced!==void 0?t.push({kind:"introduced",version:r.introduced==="0"?null:me(r.introduced)}):r.fixed!==void 0?t.push({kind:"fixed",version:me(r.fixed)}):r.last_affected!==void 0&&t.push({kind:"last_affected",version:me(r.last_affected)});t.sort((r,a)=>r.version===null?a.version===null?0:-1:a.version===null?1:r.version.compare(a.version));let s=!1;for(let r of t){if(r.version===null){s=!0;continue}let a=e.compare(r.version);switch(r.kind){case"introduced":a>=0&&(s=!0);break;case"fixed":a>=0&&(s=!1);break;case"last_affected":a>0&&(s=!1);break}}return s}function me(e){return I.parse(e,{loose:!0})??I.coerce(e)}function W(e,n,t){if(t.withdrawn)return{affected:!1,fixedVersions:[]};let s=!1,r=new Set;for(let a of t.affected??[]){let i=a.package?.ecosystem;if(!(i&&i!=="npm")&&!(a.package?.name&&a.package.name!==e)&&Je(n,a)){s=!0;for(let o of a.ranges??[])for(let d of o.events)d.fixed&&r.add(d.fixed)}}return{affected:s,fixedVersions:[...r]}}function ye(e,n){let t=I.parse(e,{loose:!0});return n.map(r=>I.parse(r,{loose:!0})??I.coerce(r)).filter(r=>r!==null).filter(r=>t?r.compare(t)>0:!0).sort((r,a)=>r.compare(a))[0]?.version}function Xe(e){return[e.id,...e.aliases??[]]}function Ze(e){let n=[...e];return n.find(t=>t.startsWith("CVE-"))??n.find(t=>t.startsWith("GHSA-"))??n[0]}function ve(e){if(e.length<=1)return e;let n=new Map,t=a=>{let i=a;for(;n.get(i)!==void 0&&n.get(i)!==i;)i=n.get(i);return n.set(a,i),i},s=(a,i)=>{n.set(t(a),t(i))};for(let a of e){let i=Xe(a);n.has(i[0])||n.set(i[0],i[0]);for(let o of i.slice(1))n.has(o)||n.set(o,o),s(i[0],o)}let r=new Map;for(let a of e){let i=t(a.id),o=r.get(i);o?o.push(a):r.set(i,[a])}return[...r.values()].map(bt)}function bt(e){if(e.length===1)return e[0];let n=new Set,t=new Map,s=[],r=[],a,i,o;for(let c of e){for(let f of Xe(c))n.add(f);for(let f of c.references??[])t.set(f.url,f);for(let f of c.severity??[])s.push(f);for(let f of c.affected??[])r.push(f);a??=c.summary,i??=c.details,o??=c.database_specific}let d=Ze(n);return{id:d,aliases:[...n].filter(c=>c!==d),summary:a,details:i,references:[...t.values()],severity:s,affected:r,database_specific:o}}import kn from"semver";var J={1e5:9.8,100001:9.5,100010:9.4,100011:8.7,100020:9.1,100021:8.1,100100:9.4,100101:8.9,100110:8.6,100111:7.4,100120:7.7,100121:6.4,100200:8.7,100201:7.5,100210:7.4,100211:6.3,100220:6.3,100221:4.9,101e3:9.4,101001:8.9,101010:8.8,101011:7.7,101020:7.6,101021:6.7,101100:8.6,101101:7.6,101110:7.4,101111:5.8,101120:5.9,101121:5,101200:7.2,101201:5.7,101210:5.7,101211:5.2,101220:5.2,101221:2.5,102001:8.3,102011:7,102021:5.4,102101:6.5,102111:5.8,102121:2.6,102201:5.3,102211:2.1,102221:1.3,11e4:9.5,110001:9,110010:8.8,110011:7.6,110020:7.6,110021:7,110100:9,110101:7.7,110110:7.5,110111:6.2,110120:6.1,110121:5.3,110200:7.7,110201:6.6,110210:6.8,110211:5.9,110220:5.2,110221:3,111e3:8.9,111001:7.8,111010:7.6,111011:6.7,111020:6.2,111021:5.8,111100:7.4,111101:5.9,111110:5.7,111111:5.7,111120:4.7,111121:2.3,111200:6.1,111201:5.2,111210:5.7,111211:2.9,111220:2.4,111221:1.6,112001:7.1,112011:5.9,112021:3,112101:5.8,112111:2.6,112121:1.5,112201:2.3,112211:1.3,112221:.6,2e5:9.3,200001:8.7,200010:8.6,200011:7.2,200020:7.5,200021:5.8,200100:8.6,200101:7.4,200110:7.4,200111:6.1,200120:5.6,200121:3.4,200200:7,200201:5.4,200210:5.2,200211:4,200220:4,200221:2.2,201e3:8.5,201001:7.5,201010:7.4,201011:5.5,201020:6.2,201021:5.1,201100:7.2,201101:5.7,201110:5.5,201111:4.1,201120:4.6,201121:1.9,201200:5.3,201201:3.6,201210:3.4,201211:1.9,201220:1.9,201221:.8,202001:6.4,202011:5.1,202021:2,202101:4.7,202111:2.1,202121:1.1,202201:2.4,202211:.9,202221:.4,21e4:8.8,210001:7.5,210010:7.3,210011:5.3,210020:6,210021:5,210100:7.3,210101:5.5,210110:5.9,210111:4,210120:4.1,210121:2,210200:5.4,210201:4.3,210210:4.5,210211:2.2,210220:2,210221:1.1,211e3:7.5,211001:5.5,211010:5.8,211011:4.5,211020:4,211021:2.1,211100:6.1,211101:5.1,211110:4.8,211111:1.8,211120:2,211121:.9,211200:4.6,211201:1.8,211210:1.7,211211:.7,211220:.8,211221:.2,212001:5.3,212011:2.4,212021:1.4,212101:2.4,212111:1.2,212121:.5,212201:1,212211:.3,212221:.1,"000000":10,"000001":9.9,"000010":9.8,"000011":9.5,"000020":9.5,"000021":9.2,"000100":10,"000101":9.6,"000110":9.3,"000111":8.7,"000120":9.1,"000121":8.1,"000200":9.3,"000201":9,"000210":8.9,"000211":8,"000220":8.1,"000221":6.8,"001000":9.8,"001001":9.5,"001010":9.5,"001011":9.2,"001020":9,"001021":8.4,"001100":9.3,"001101":9.2,"001110":8.9,"001111":8.1,"001120":8.1,"001121":6.5,"001200":8.8,"001201":8,"001210":7.8,"001211":7,"001220":6.9,"001221":4.8,"002001":9.2,"002011":8.2,"002021":7.2,"002101":7.9,"002111":6.9,"002121":5,"002201":6.9,"002211":5.5,"002221":2.7,"010000":9.9,"010001":9.7,"010010":9.5,"010011":9.2,"010020":9.2,"010021":8.5,"010100":9.5,"010101":9.1,"010110":9,"010111":8.3,"010120":8.4,"010121":7.1,"010200":9.2,"010201":8.1,"010210":8.2,"010211":7.1,"010220":7.2,"010221":5.3,"011000":9.5,"011001":9.3,"011010":9.2,"011011":8.5,"011020":8.5,"011021":7.3,"011100":9.2,"011101":8.2,"011110":8,"011111":7.2,"011120":7,"011121":5.9,"011200":8.4,"011201":7,"011210":7.1,"011211":5.2,"011220":5,"011221":3,"012001":8.6,"012011":7.5,"012021":5.2,"012101":7.1,"012111":5.2,"012121":2.9,"012201":6.3,"012211":2.9,"012221":1.7},he={eq1:{0:["AV:N/PR:N/UI:N/"],1:["AV:A/PR:N/UI:N/","AV:N/PR:L/UI:N/","AV:N/PR:N/UI:P/"],2:["AV:P/PR:N/UI:N/","AV:A/PR:L/UI:P/"]},eq2:{0:["AC:L/AT:N/"],1:["AC:H/AT:N/","AC:L/AT:P/"]},eq3:{0:{0:["VC:H/VI:H/VA:H/CR:H/IR:H/AR:H/"],1:["VC:H/VI:H/VA:L/CR:M/IR:M/AR:H/","VC:H/VI:H/VA:H/CR:M/IR:M/AR:M/"]},1:{0:["VC:L/VI:H/VA:H/CR:H/IR:H/AR:H/","VC:H/VI:L/VA:H/CR:H/IR:H/AR:H/"],1:["VC:L/VI:H/VA:L/CR:H/IR:M/AR:H/","VC:L/VI:H/VA:H/CR:H/IR:M/AR:M/","VC:H/VI:L/VA:H/CR:M/IR:H/AR:M/","VC:H/VI:L/VA:L/CR:M/IR:H/AR:H/","VC:L/VI:L/VA:H/CR:H/IR:H/AR:M/"]},2:{1:["VC:L/VI:L/VA:L/CR:H/IR:H/AR:H/"]}},eq4:{0:["SC:H/SI:S/SA:S/"],1:["SC:H/SI:H/SA:H/"],2:["SC:L/SI:L/SA:L/"]},eq5:{0:["E:A/"],1:["E:P/"],2:["E:U/"]}},Qe={eq1:{0:1,1:4,2:5},eq2:{0:1,1:2},eq3eq6:{0:{0:7,1:6},1:{0:8,1:8},2:{1:10}},eq4:{0:6,1:5,2:4},eq5:{0:1,1:1,2:1}};var mn=["AV","AC","AT","PR","UI","VC","VI","VA","SC","SI","SA"],en={N:0,A:.1,L:.2,P:.3},nn={N:0,L:.1,H:.2},tn={N:0,P:.1,A:.2},rn={L:0,H:.1},sn={N:0,P:.1},on={H:0,L:.1,N:.2},an={H:0,L:.1,N:.2},cn={H:0,L:.1,N:.2},dn={H:.1,L:.2,N:.3},fn={S:0,H:.1,L:.2,N:.3},un={S:0,H:.1,L:.2,N:.3},ln={H:0,M:.1,L:.2},pn={H:0,M:.1,L:.2},gn={H:0,M:.1,L:.2};function yn(e){let n=kt(e);if(!n)return null;let t=Rt(n);return J[t]===void 0?null:St(n,t)}function kt(e){let n=e.split("/");if(n[0]!=="CVSS:4.0")return null;let t={};for(let s of n.slice(1)){let[r,a]=s.split(":");r&&a&&(t[r]=a)}for(let s of mn)if(!(s in t))return null;for(let s of["E","CR","IR","AR"])s in t||(t[s]="X");return t}function v(e,n){let t=e[n];if(n==="E"&&t==="X")return"A";if((n==="CR"||n==="IR"||n==="AR")&&t==="X")return"H";let s=e[`M${n}`];return s!==void 0&&s!=="X"?s:t??""}function Rt(e){let n=v(e,"AV"),t=v(e,"PR"),s=v(e,"UI"),r="2";n==="N"&&t==="N"&&s==="N"?r="0":(n==="N"||t==="N"||s==="N")&&n!=="P"&&(r="1");let a=v(e,"AC")==="L"&&v(e,"AT")==="N"?"0":"1",i=v(e,"VC"),o=v(e,"VI"),d=v(e,"VA"),c="2";i==="H"&&o==="H"?c="0":(i==="H"||o==="H"||d==="H")&&(c="1");let f=v(e,"MSI"),m=v(e,"MSA"),l="2";f==="S"||m==="S"?l="0":(v(e,"SC")==="H"||v(e,"SI")==="H"||v(e,"SA")==="H")&&(l="1");let u=v(e,"E"),g=u==="A"?"0":u==="P"?"1":"2",y=v(e,"CR"),p=v(e,"IR"),k=v(e,"AR");return`${r}${a}${c}${l}${g}${y==="H"&&i==="H"||p==="H"&&o==="H"||k==="H"&&d==="H"?"0":"1"}`}function h(e,n){return e[n]??0}function X(e,n){return he[`eq${n}`][e[n-1]]??[]}function V(e,n){let t=n.indexOf(e)+e.length+1,s=n.slice(t),r=s.indexOf("/");return r>0?s.substring(0,r):s}function St(e,n){if(mn.slice(5).every(b=>v(e,b)==="N"))return 0;let t=J[n],s=Number(n[0]),r=Number(n[2]),a=Number(n[5]),i=b=>J[b.join("")]??NaN,o=n.split("").map(Number),d=i([o[0]+1,o[1],o[2],o[3],o[4],o[5]]),c=i([o[0],o[1]+1,o[2],o[3],o[4],o[5]]),f;if(r===1&&a===1)f=i([o[0],o[1],o[2]+1,o[3],o[4],o[5]]);else if(r===0&&a===1)f=i([o[0],o[1],o[2]+1,o[3],o[4],o[5]]);else if(r===1&&a===0)f=i([o[0],o[1],o[2],o[3],o[4],o[5]+1]);else if(r===0&&a===0){let b=i([o[0],o[1],o[2],o[3],o[4],o[5]+1]),q=i([o[0],o[1],o[2]+1,o[3],o[4],o[5]]);f=b>q?b:q}else f=i([o[0],o[1],o[2]+1,o[3],o[4],o[5]+1]);let m=i([o[0],o[1],o[2],o[3]+1,o[4],o[5]]),l=i([o[0],o[1],o[2],o[3],o[4]+1,o[5]]),u=X(n,1),g=X(n,2),y=he.eq3[n[2]][n[5]],p=X(n,4),k=X(n,5),R=[];for(let b of u)for(let q of g)for(let de of y)for(let Kn of p)for(let Un of k)R.push(b+q+de+Kn+Un);let S=0,O=0,P=0,C=0,D=0,$=0,ne=0,te=0,re=0,se=0,oe=0,ie=0,ae=0,ce=0;for(let b of R)if(S=h(en,v(e,"AV"))-h(en,V("AV",b)),O=h(nn,v(e,"PR"))-h(nn,V("PR",b)),P=h(tn,v(e,"UI"))-h(tn,V("UI",b)),C=h(rn,v(e,"AC"))-h(rn,V("AC",b)),D=h(sn,v(e,"AT"))-h(sn,V("AT",b)),$=h(on,v(e,"VC"))-h(on,V("VC",b)),ne=h(an,v(e,"VI"))-h(an,V("VI",b)),te=h(cn,v(e,"VA"))-h(cn,V("VA",b)),re=h(dn,v(e,"SC"))-h(dn,V("SC",b)),se=h(fn,v(e,"SI"))-h(fn,V("SI",b)),oe=h(un,v(e,"SA"))-h(un,V("SA",b)),ie=h(ln,v(e,"CR"))-h(ln,V("CR",b)),ae=h(pn,v(e,"IR"))-h(pn,V("IR",b)),ce=h(gn,v(e,"AR"))-h(gn,V("AR",b)),![S,O,P,C,D,$,ne,te,re,se,oe,ie,ae,ce].some(de=>de<0))break;let $n=S+O+P,En=C+D,In=$+ne+te+ie+ae+ce,Hn=re+se+oe,B=.1,De=t-d,$e=t-c,Ee=t-f,Ie=t-m,Ln=t-l,z=Qe,jn=z.eq1[String(s)]*B,_n=z.eq2[n[1]]*B,qn=z.eq3eq6[String(r)][String(a)]*B,Fn=z.eq4[n[3]]*B,A=0,He=0,Le=0,je=0,_e=0;Number.isNaN(De)||(A++,He=De*($n/jn)),Number.isNaN($e)||(A++,Le=$e*(En/_n)),Number.isNaN(Ee)||(A++,je=Ee*(In/qn)),Number.isNaN(Ie)||(A++,_e=Ie*(Hn/Fn)),Number.isNaN(Ln)||A++;let Tn=A===0?0:(He+Le+je+_e)/A;return t-=Tn,t<0&&(t=0),t>10&&(t=10),Math.round(t*10)/10}var xt={N:.85,A:.62,L:.55,P:.2},wt={L:.77,H:.44},Vt={N:.85,R:.62},Ot={N:.85,L:.62,H:.27},Pt={N:.85,L:.68,H:.5},be={H:.56,L:.22,N:0};function ke(e){return e<=0?"none":e<4?"low":e<7?"medium":e<9?"high":"critical"}function hn(e){switch(e.trim().toUpperCase()){case"CRITICAL":return"critical";case"HIGH":return"high";case"MODERATE":case"MEDIUM":return"medium";case"LOW":return"low";case"NONE":return"none";default:return"unknown"}}function vn(e){let n=Math.round(e*1e5);return n%1e4===0?n/1e5:(Math.floor(n/1e4)+1)/10}function bn(e){let n=e.split("/"),t=n[0]??"";if(t==="CVSS:4.0"){let p=yn(e);return p===null?null:{score:p,level:ke(p),version:t}}if(!/^CVSS:3\.[01]$/.test(t))return null;let s={};for(let p of n.slice(1)){let[k,R]=p.split(":");k&&R&&(s[k]=R)}let r=xt[s.AV??""],a=wt[s.AC??""],i=Vt[s.UI??""],o=s.S==="C",d=(o?Pt:Ot)[s.PR??""],c=be[s.C??""],f=be[s.I??""],m=be[s.A??""];if([r,a,i,d,c,f,m].some(p=>p===void 0))return null;let l=1-(1-c)*(1-f)*(1-m),u=o?7.52*(l-.029)-3.25*Math.pow(l-.02,15):6.42*l,g=8.22*r*a*d*i,y;return u<=0?y=0:o?y=vn(Math.min(1.08*(u+g),10)):y=vn(Math.min(u+g,10)),{score:y,level:ke(y),version:t}}function Re(e){let n=[];for(let r of e.severity??[])r.score&&n.push(r.score);for(let r of e.affected??[])for(let a of r.severity??[])a.score&&n.push(a.score);let t=null;for(let r of n){let a=bn(r);a&&(!t||a.score>t.score)&&(t=a)}if(t)return{level:t.level,score:t.score,vector:At(t,n),cvssVersion:t.version,source:"cvss"};let s=Nt(e);return s?{level:hn(s),source:"database"}:{level:"unknown",source:"unknown"}}function At(e,n){return n.find(t=>t.startsWith(e.version))}function Nt(e){let n=s=>{let r=s?.severity;return typeof r=="string"?r:void 0},t=n(e.database_specific);if(t)return t;for(let s of e.affected??[]){let r=n(s.database_specific);if(r)return r}}function Se(e,n,t={}){let s=[];for(let r of Object.values(e.nodes)){if(r.unscannable||t.prodOnly&&r.scope==="dev")continue;let a=n(r.name);if(a.length===0)continue;let i=new Map,o=a.filter(c=>{let f=W(r.name,r.version,c);return i.set(c,f),f.affected});if(o.length===0)continue;let d=ge(e,r.key);for(let c of ve(o)){if(Mt(c,t.ignore))continue;let{fixedVersions:f}=i.get(c)??W(r.name,r.version,c),m=Ct(f),l=ye(r.version,f);s.push({id:c.id,aliases:c.aliases??[],packageName:r.name,version:r.version,scope:r.scope,direct:r.direct,severity:Re(c),summary:c.summary??c.id,details:c.details,references:(c.references??[]).map(u=>u.url),fixedVersions:m,recommendation:$t(r.name,r.direct,l,e.manager),dependencyPaths:d?[d]:[],source:"osv"})}}return s}function Mt(e,n){return!n||n.size===0?!1:n.has(e.id)?!0:(e.aliases??[]).some(t=>n.has(t))}function Ct(e){return[...new Set(e)].sort((n,t)=>{let s=kn.parse(n,{loose:!0}),r=kn.parse(t,{loose:!0});return s&&r?s.compare(r):n.localeCompare(t)})}var Dt={npm:"npm install",yarn:"yarn add",pnpm:"pnpm add"};function $t(e,n,t,s){return t?n?`Upgrade to ${e}@${t} or later (e.g. \`${Dt[s]} ${e}@${t}\`).`:`Update the dependency that pulls in ${e} so it resolves to ${e}@${t} or later. If it cannot, force the resolution via an override.`:n?"No fixed version is available yet. Watch the advisory, or evaluate an alternative package.":"No fixed version is available yet. Pressure the parent dependency to update, or override the version."}var xe=class{byName=new Map;ids=new Set;add(n){if(n.withdrawn||this.ids.has(n.id))return;this.ids.add(n.id);let t=new Set;for(let s of n.affected??[]){let r=s.package?.ecosystem;r&&r!=="npm"||s.package?.name&&t.add(s.package.name)}for(let s of t){let r=this.byName.get(s);r?r.push(n):this.byName.set(s,[n])}}addAll(n){for(let t of n)this.add(t)}vulnerabilitiesFor(n){return this.byName.get(n)??[]}get size(){return this.ids.size}};import{resolve as cr}from"path";import{join as we}from"path";import Et from"env-paths";function Ve(e){return e||(process.env.LOCKHAWK_CACHE?process.env.LOCKHAWK_CACHE:Et("lockhawk",{suffix:""}).cache)}function T(e){return we(e,"osv-db","npm")}var Rn=4096;function Z(e){let n=2166136261;for(let t=0;t<e.length;t++)n^=e.charCodeAt(t),n=Math.imul(n,16777619);return(n>>>0)%Rn}function K(e){return we(T(e),"meta.json")}function Oe(e,n){return we(e,"query-cache",`${encodeURIComponent(n)}.json`)}import{mkdir as It,readFile as Ht,writeFile as Lt}from"fs/promises";import{dirname as jt}from"path";import _t from"p-limit";import qt,{AbortError as Ft}from"p-retry";var Pe="https://api.osv.dev/v1",Sn=1e3,U=class{constructor(n){this.opts=n;this.limit=_t(n.concurrency??16)}opts;limit;async fetchAdvisories(n){let t=[...new Set(n.map(o=>o.name))],s=await this.queryBatch(t),r=new Set;for(let o of s.values())for(let d of o)r.add(d);let a=await this.hydrate([...r]),i=new Map;for(let[o,d]of s){let c=[];for(let f of d){let m=a.get(f);m&&c.push(m)}c.length&&i.set(o,c)}return i}async queryBatch(n){let t=new Map;for(let s=0;s<n.length;s+=Sn){let r=n.slice(s,s+Sn),a={queries:r.map(o=>({package:{name:o,ecosystem:"npm"}}))},i=await this.request(`${Pe}/querybatch`,a);for(let o=0;o<r.length;o++){let d=r[o],c=i.results[o];if(!c)continue;let f=t.get(d)??new Set;for(let l of c.vulns??[])f.add(l.id);let m=c.next_page_token;for(;m;){let l=await this.request(`${Pe}/query`,{package:{name:d,ecosystem:"npm"},page_token:m});for(let u of l.vulns??[])f.add(u.id);m=l.next_page_token}f.size&&t.set(d,f)}}return t}async hydrate(n){let t=new Map;return await Promise.all(n.map(s=>this.limit(async()=>{let r=await this.getVulnerability(s);r&&t.set(s,r)}))),t}async getVulnerability(n){let t=await this.readCache(n);if(t)return t;let s=await this.request(`${Pe}/vulns/${encodeURIComponent(n)}`);return await this.writeCache(n,s),s}async request(n,t){let s=this.opts.retries??3;return qt(async()=>{let r=await fetch(n,{method:t?"POST":"GET",headers:t?{"content-type":"application/json"}:void 0,body:t?JSON.stringify(t):void 0,signal:AbortSignal.timeout(this.opts.timeoutMs??15e3)});if(r.ok)return await r.json();throw r.status===429||r.status>=500?new Error(`OSV ${r.status} for ${n}`):new Ft(`OSV ${r.status} for ${n}`)},{retries:s})}async readCache(n){if(!this.opts.noCache)try{let t=JSON.parse(await Ht(Oe(this.opts.cacheDir,n),"utf8")),s=(this.opts.cacheTtlHours??24)*36e5;return Date.now()-t.fetchedAt>s?void 0:t.vuln}catch{return}}async writeCache(n,t){if(!this.opts.noCache)try{let s=Oe(this.opts.cacheDir,n);await It(jt(s),{recursive:!0}),await Lt(s,JSON.stringify({fetchedAt:Date.now(),vuln:t}))}catch{}}};import{createWriteStream as Tt}from"fs";import{mkdir as xn,mkdtemp as Kt,readFile as wn,rm as Vn,writeFile as Ae}from"fs/promises";import{tmpdir as Ut}from"os";import{join as Q}from"path";import{Readable as Gt}from"stream";import{pipeline as Bt}from"stream/promises";import{gunzipSync as zt,gzipSync as Yt}from"zlib";import Wt from"p-limit";import Jt from"yauzl";var Xt="https://storage.googleapis.com/osv-vulnerabilities/npm/all.zip",Zt=32,Qt=8*1024*1024,H=class extends Error{constructor(){super("No offline OSV database found. Run `lockhawk db update` first."),this.name="OfflineDbMissingError"}},er=/^[A-Za-z]{3}, \d{2} [A-Za-z]{3} \d{4} \d{2}:\d{2}:\d{2} GMT$/,nr=/^(?:W\/)?"[\x21\x23-\x7e]*"$/;function tr(e){return e&&er.test(e)?e:void 0}function rr(e){return e&&nr.test(e)?e:void 0}async function L(e){try{return JSON.parse(await wn(K(e),"utf8"))}catch{return}}async function sr(e){let{cacheDir:n,nowIso:t,force:s,onProgress:r}=e,a=T(n);await xn(a,{recursive:!0});let i=s?void 0:await L(n),o={},d=rr(i?.etag),c=tr(i?.lastModified);d&&(o["If-None-Match"]=d),c&&(o["If-Modified-Since"]=c),r?.("Fetching npm advisory database from OSV.dev\u2026");let f=await fetch(Xt,{headers:o});if(f.status===304&&i){let p={...i,lastUpdated:t};return await Ae(K(n),JSON.stringify(p,null,2)),{status:"unchanged",meta:p}}if(!f.ok||!f.body)throw new Error(`OSV database download failed: HTTP ${f.status}`);let m=await Kt(Q(Ut(),"lockhawk-osv-")),l=Q(m,"all.zip"),u;try{await Bt(Gt.fromWeb(f.body),Tt(l)),r?.("Extracting advisories\u2026"),u=await ar(l)}finally{await Vn(m,{recursive:!0,force:!0})}r?.("Building package index\u2026");let g=or(u);await ir(n,g);let y={ecosystem:"npm",source:"osv.dev",lastUpdated:t,recordCount:u.length,packageCount:g.size,etag:f.headers.get("etag")??void 0,lastModified:f.headers.get("last-modified")??void 0};return await Ae(K(n),JSON.stringify(y,null,2)),{status:"updated",meta:y}}function On(e){return Q(T(e),"by-name")}function Pn(e,n){return Q(On(e),`${n}.json.gz`)}async function Ne(e,n){if(!await L(e))throw new H;let t=new Map;for(let a of new Set(n)){let i=Z(a),o=t.get(i);o?o.push(a):t.set(i,[a])}let s=new Map,r=Wt(Zt);return await Promise.all([...t.entries()].map(([a,i])=>r(async()=>{try{let o=JSON.parse(zt(await wn(Pn(e,a))).toString("utf8"));for(let d of i){let c=o[d];c?.length&&s.set(d,c)}}catch{}}))),s}function or(e){let n=new Map;for(let t of e){if(t.withdrawn)continue;let s=new Set;for(let r of t.affected??[]){let a=r.package?.ecosystem;a&&a!=="npm"||r.package?.name&&s.add(r.package.name)}for(let r of s){let a=n.get(r);a?a.push(t):n.set(r,[t])}}return n}async function ir(e,n){let t=On(e);await Vn(t,{recursive:!0,force:!0}),await xn(t,{recursive:!0});let s=new Map;for(let[i,o]of n){let d=Z(i),c=s.get(d)??{};c[i]=o,s.set(d,c)}let r=[...s.entries()],a=256;for(let i=0;i<r.length;i+=a)await Promise.all(r.slice(i,i+a).map(([o,d])=>Ae(Pn(e,o),Yt(Buffer.from(JSON.stringify(d))))))}function ar(e){return new Promise((n,t)=>{let s=[];Jt.open(e,{lazyEntries:!0},(r,a)=>{if(r||!a)return t(r??new Error("Failed to open OSV zip"));a.on("entry",i=>{if(!i.fileName.endsWith(".json")||i.uncompressedSize>Qt)return a.readEntry();a.openReadStream(i,(o,d)=>{if(o||!d)return a.readEntry();let c=[];d.on("data",f=>c.push(f)),d.on("error",()=>a.readEntry()),d.on("end",()=>{try{s.push(JSON.parse(Buffer.concat(c).toString("utf8")))}catch{}a.readEntry()})})}),a.on("end",()=>n(s)),a.on("error",t),a.readEntry()})})}var An=36e5,j=class{constructor(n){this.opts=n}opts;async prepare(n){let t=await L(this.opts.cacheDir);if(!t)throw new H;let s=await Ne(this.opts.cacheDir,n.map(o=>o.name)),r=(Date.now()-Date.parse(t.lastUpdated))/An,a=r>(this.opts.staleAfterHours??24),i=a?[`Offline database is ${Math.round(r)}h old. Run \`lockhawk db update\` for current results.`]:[];return{candidatesFor:o=>s.get(o)??[],database:{source:"offline",recordCount:t.recordCount,lastUpdated:t.lastUpdated,ageHours:Math.round(r*10)/10,stale:a,warnings:i}}}},G=class{constructor(n){this.opts=n}opts;async prepare(n){let t=new U({cacheDir:this.opts.cacheDir,concurrency:this.opts.concurrency,noCache:this.opts.noCache,cacheTtlHours:this.opts.cacheTtlHours});try{let s=await t.fetchAdvisories(n);return{candidatesFor:r=>s.get(r)??[],database:{source:"online",stale:!1,warnings:[]}}}catch(s){if(this.opts.strictNetwork)throw s;let r=s instanceof Error?s.message:String(s);return{candidatesFor:()=>[],database:{source:"online",stale:!0,warnings:[`OSV.dev was unreachable (${r}). Scan completed without online data \u2014 results may be incomplete.`]}}}}},ee=class{constructor(n){this.opts=n}opts;async prepare(n){let t=await L(this.opts.cacheDir),s=this.opts.staleAfterHours??24;if(t&&(Date.now()-Date.parse(t.lastUpdated))/An<=s)return new j(this.opts).prepare(n);try{return await new G({...this.opts,strictNetwork:!0}).prepare(n)}catch(r){if(t){let i=await new j(this.opts).prepare(n);return i.database.warnings.push("Used the stale offline database because OSV.dev was unreachable."),i}if(this.opts.strictNetwork)throw r;let a=r instanceof Error?r.message:String(r);return{candidatesFor:()=>[],database:{source:"online",stale:!0,warnings:[`No offline database and OSV.dev was unreachable (${a}). Run \`lockhawk db update\`.`]}}}}};function Me(e,n){switch(e){case"offline":return new j(n);case"online":return new G(n);default:return new ee(n)}}var Nn={name:"lockhawk",version:"0.1.0"};async function dr(e={},n){let t=Date.now(),s=cr(e.path??"."),r=le(s),a=F(s),i=Mn(r,e.prodOnly),o=Ve(e.cacheDir),d=n??Me(e.mode??"auto",{cacheDir:o,concurrency:e.concurrency,noCache:e.noCache,cacheTtlHours:e.cacheTtlHours,strictNetwork:e.strictNetwork});e.onProgress?.("Checking dependencies against OSV.dev\u2026");let c=await d.prepare(i),f=Se(r,c.candidatesFor,{prodOnly:e.prodOnly,ignore:e.ignore&&e.ignore.length?new Set(e.ignore):void 0});e.severityThreshold&&e.severityThreshold!=="none"&&(f=f.filter(l=>qe(l.severity.level,e.severityThreshold))),f.sort(lr);let m=fr(r);return{schemaVersion:1,tool:{...Nn},scannedAt:new Date(t).toISOString(),target:{path:s,manager:r.manager,lockfile:a?.filename??"",root:r.root},database:c.database,summary:ur(f),stats:{totalPackages:Object.keys(r.nodes).length,uniquePackages:i.length,directDependencies:r.directKeys.length,unscannable:m.length,durationMs:Date.now()-t},findings:f,unscannable:m}}function Mn(e,n){let t=new Set,s=[];for(let r of Object.values(e.nodes))r.unscannable||n&&r.scope==="dev"||t.has(r.key)||(t.add(r.key),s.push({name:r.name,version:r.version}));return s}function fr(e){let n=[];for(let t of Object.values(e.nodes))t.unscannable&&n.push({name:t.name,version:t.version,reason:t.unscannable.reason});return n}function ur(e){let n={total:e.length,critical:0,high:0,medium:0,low:0,unknown:0,none:0,vulnerablePackages:0,fixable:0},t=new Set;for(let s of e)n[s.severity.level]+=1,t.add(`${s.packageName}@${s.version}`),s.fixedVersions.length>0&&(n.fixable+=1);return n.vulnerablePackages=t.size,n}function lr(e,n){let t=N[n.severity.level]-N[e.severity.level];return t!==0?t:e.packageName.localeCompare(n.packageName)}function pr(e,n){return["critical","high","medium","low","unknown"].some(s=>N[s]>=N[n]&&e[s]>0)}function gr(e){return JSON.stringify(e,null,2)}var mr="https://github.com/lockhawk/lockhawk";function yr(e){return e.find(n=>{try{let t=new URL(n);return t.protocol==="http:"||t.protocol==="https:"}catch{return!1}})}function vr(e){if(typeof e.severity.score=="number")return e.severity.score;switch(e.severity.level){case"critical":return 9.5;case"high":return 7.5;case"medium":return 5;case"low":return 2;default:return 0}}function hr(e){return e==="critical"||e==="high"?"error":e==="medium"?"warning":"note"}function Cn(e){let n=e.target.lockfile||"package-lock.json",t=new Map,s=[];for(let r of e.findings){t.has(r.id)||t.set(r.id,{id:r.id,name:`${r.packageName} ${r.id}`,shortDescription:{text:r.summary},fullDescription:r.details?{text:r.details}:void 0,helpUri:yr(r.references),properties:{"security-severity":String(vr(r)),tags:["security","dependency",r.severity.level]}});let a=r.dependencyPaths[0]?.join(" \u203A ")??r.packageName,i=r.fixedVersions[0]?` Fixed in ${r.fixedVersions[0]}.`:"";s.push({ruleId:r.id,level:hr(r.severity.level),message:{text:`${r.severity.level.toUpperCase()}: ${r.packageName}@${r.version} \u2014 ${r.summary}.${i} Path: ${a}.`},locations:[{physicalLocation:{artifactLocation:{uri:n},region:{startLine:1}}}],partialFingerprints:{lockhawkFinding:`${r.packageName}@${r.version}@${r.id}`},properties:{package:r.packageName,version:r.version,scope:r.scope,fixedVersions:r.fixedVersions}})}return{$schema:"https://json.schemastore.org/sarif-2.1.0.json",version:"2.1.0",runs:[{tool:{driver:{name:e.tool.name,version:e.tool.version,informationUri:mr,rules:[...t.values()]}},results:s,properties:{scannedAt:e.scannedAt,databaseSource:e.database.source,databaseAgeHours:e.database.ageHours,databaseStale:e.database.stale}}]}}function br(e){return JSON.stringify(Cn(e),null,2)}var Ce="<!--LOCKHAWK_DATA-->";function kr(e){return`<script>window.__SCAN_RESULT__ = ${JSON.stringify(e).replace(/</g,"\\u003c").replace(/\u2028/g,"\\u2028").replace(/\u2029/g,"\\u2029")};</script>`}function Rr(e,n){let t=kr(e);return n?n.includes(Ce)?n.replace(Ce,()=>t):n.replace("</head>",()=>`${t}</head>`):xr(e,t)}var Dn={critical:"#b4232c",high:"#d9822b",medium:"#c9a227",low:"#3a7bd5",unknown:"#7a7a7a",none:"#3a9e54"};function x(e){return e.replace(/[&<>"]/g,n=>({"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;"})[n])}function Sr(e){try{let n=new URL(e);return n.protocol==="http:"||n.protocol==="https:"?e:void 0}catch{return}}function xr(e,n){let{summary:t}=e,s=["critical","high","medium","low","unknown"].map(i=>`
+      <div class="card" style="border-top:4px solid ${Dn[i]}">
+        <div class="count">${t[i]}</div><div class="label">${i}</div>
+      </div>`).join(""),r=e.findings.map(i=>{let o=i.dependencyPaths[0]?.join(" \u203A ")??i.packageName,d=i.references.slice(0,3).map(c=>Sr(c)).filter(c=>c!==void 0).map(c=>`<a href="${x(c)}" target="_blank" rel="noopener">link</a>`).join(" ");return`
+      <tr>
+        <td><span class="pill" style="background:${Dn[i.severity.level]}">${i.severity.level}${i.severity.score?` ${i.severity.score}`:""}</span></td>
+        <td><code>${x(i.packageName)}@${x(i.version)}</code><div class="scope">${i.scope}${i.direct?" \xB7 direct":""}</div></td>
+        <td><a href="https://osv.dev/${x(i.id)}" target="_blank" rel="noopener">${x(i.id)}</a></td>
+        <td>${x(i.summary)}<div class="path">${x(o)}</div></td>
+        <td>${i.fixedVersions[0]?x(i.fixedVersions[0]):"\u2014"}</td>
+        <td>${d}</td>
+      </tr>`}).join(""),a=e.database.warnings.map(i=>`<div class="warn">\u26A0 ${x(i)}</div>`).join("");return`<!doctype html>
 <html lang="en">
 <head>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
-<title>lockhawk report \u2014 ${esc(result.target.root.name)}</title>
+<title>lockhawk report \u2014 ${x(e.target.root.name)}</title>
+${n}
 <style>
-  :root {
-    --bg:#070a12; --panel:#11151e; --panel-2:#141926; --elev:#171d2b;
-    --border:#222a3a; --border-soft:#1b2230;
-    --text:#f1f4fa; --muted:#aeb8cc; --faint:#808b9f;
-    --accent:#ffc266; --fix:#48e0a6;
-    --glass: rgba(255,255,255,.055); --glass-2: rgba(255,255,255,.09);
-    --glass-line: rgba(255,255,255,.14); --glass-hi: inset 0 1px 0 rgba(255,255,255,.10);
-    --glass-dark: rgba(8,11,18,.42);
-    --blur: blur(18px) saturate(160%);
-    --mono: ui-monospace,'SF Mono','JetBrains Mono','Cascadia Code','Fira Code',Menlo,Consolas,monospace;
-    --sans: -apple-system,BlinkMacSystemFont,'SF Pro Text','Segoe UI',system-ui,Roboto,sans-serif;
-    color-scheme: dark;
-  }
+  :root { color-scheme: light dark; }
   * { box-sizing: border-box; }
-  html, body { max-width: 100%; overflow-x: hidden; }
-  body {
-    margin: 0; min-height: 100vh; font: 15px/1.6 var(--sans); color: var(--text);
-    background:
-      radial-gradient(820px 620px at 8% -8%, rgba(91,157,255,.22), transparent 58%),
-      radial-gradient(760px 600px at 94% -4%, rgba(255,93,103,.16), transparent 56%),
-      radial-gradient(900px 760px at 80% 108%, rgba(72,224,166,.16), transparent 58%),
-      radial-gradient(720px 640px at 16% 98%, rgba(255,179,71,.13), transparent 58%),
-      linear-gradient(180deg, #0a1020, #070a12 60%);
-    background-attachment: fixed;
-    -webkit-font-smoothing: antialiased;
-  }
-
-  /* ---- Header / wordmark ------------------------------------------------ */
-  header { position: relative; overflow: hidden; padding: 30px clamp(18px,5vw,40px) 28px; background: linear-gradient(180deg, rgba(255,255,255,.08), rgba(255,255,255,.03)); -webkit-backdrop-filter: var(--blur); backdrop-filter: var(--blur); border-bottom: 1px solid var(--glass-line); box-shadow: var(--glass-hi); }
-  header::before { content:''; position:absolute; inset:0; pointer-events:none;
-    background: radial-gradient(620px 220px at 10% 0%, rgba(255,194,102,.12), transparent 70%),
-                radial-gradient(520px 240px at 58% -25%, rgba(255,93,103,.10), transparent 70%); }
-  header::after { content:''; position:absolute; inset:0; opacity:.35; pointer-events:none;
-    background-image: linear-gradient(rgba(255,255,255,.025) 1px,transparent 1px), linear-gradient(90deg,rgba(255,255,255,.025) 1px,transparent 1px);
-    background-size: 34px 34px; -webkit-mask: linear-gradient(180deg,#000,transparent); mask: linear-gradient(180deg,#000,transparent); }
-  header > * { position: relative; }
-  .brand { display:flex; align-items:center; gap:14px; }
-  .mark { width:38px; height:38px; flex:none; filter: drop-shadow(0 3px 12px rgba(255,93,103,.3)); }
-  .wordmark { font-family: var(--mono); font-size: clamp(22px,4vw,27px); letter-spacing:-.02em; display:flex; align-items:center; }
-  .wordmark .lock { color: var(--muted); font-weight:500; }
-  .wordmark .hawk { color: var(--text); font-weight:700; }
-  .caret { display:inline-block; width:9px; height:1em; margin-left:5px; background: var(--accent); border-radius:1px; box-shadow:0 0 12px var(--accent); animation: blink 1.2s steps(1) infinite; }
-  .meta { margin-top:12px; color: var(--muted); font:12.5px/1.7 var(--mono); letter-spacing:.01em; overflow-wrap:anywhere; }
-  .meta b { color: var(--text); font-weight:600; }
-
-  /* ---- Layout ----------------------------------------------------------- */
-  main { max-width: 1120px; margin: 0 auto; padding: 26px clamp(16px,4vw,32px) 48px; }
-  .cards { display:grid; grid-template-columns: repeat(auto-fit, minmax(116px,1fr)); gap:14px; }
-  .card { position:relative; overflow:hidden; background: linear-gradient(180deg, var(--glass-2), var(--glass)); -webkit-backdrop-filter: var(--blur); backdrop-filter: var(--blur); border:1px solid var(--glass-line); border-radius:16px; padding:16px 18px; box-shadow: 0 12px 36px -18px rgba(0,0,0,.75), var(--glass-hi); animation: rise .55s both cubic-bezier(.2,.7,.2,1); animation-delay: calc(var(--i)*55ms); }
-  .card::before { content:''; position:absolute; top:0; left:0; right:0; height:3px; background:var(--c); box-shadow:0 0 16px var(--c); }
-  .card .count { font:700 32px/1 var(--mono); font-variant-numeric: tabular-nums; letter-spacing:-.03em; color:var(--c); text-shadow: 0 0 24px color-mix(in srgb, var(--c) 45%, transparent); }
-  .card .label { margin-top:7px; color:var(--muted); font-size:11.5px; text-transform:uppercase; letter-spacing:.09em; }
-  .card.zero .count { color: var(--faint); text-shadow:none; }
-  .card.zero::before { box-shadow:none; opacity:.45; }
-
-  .warn { display:flex; gap:9px; align-items:flex-start; background: rgba(255,210,63,.1); -webkit-backdrop-filter: blur(10px); backdrop-filter: blur(10px); border:1px solid rgba(255,210,63,.32); color:#ffe6a6; padding:10px 14px; border-radius:12px; margin-top:14px; font-size:13px; overflow-wrap:anywhere; }
-  .warn-i { color: var(--accent); }
-
-  .results-meta { display:flex; gap:14px; flex-wrap:wrap; align-items:center; margin:26px 2px 0; color:var(--muted); font:12px/1 var(--mono); letter-spacing:.04em; }
-  .results-meta b { color:var(--text); font-weight:600; }
-  .results-meta .sep { color:var(--faint); }
-
-  /* ---- Table ------------------------------------------------------------ */
-  .table-wrap { margin-top:14px; border:1px solid var(--glass-line); border-radius:18px; overflow:hidden; background: linear-gradient(180deg, rgba(255,255,255,.06), rgba(255,255,255,.025)); -webkit-backdrop-filter: var(--blur); backdrop-filter: var(--blur); box-shadow: 0 22px 60px -32px rgba(0,0,0,.85), var(--glass-hi); }
-  .scroll { overflow-x:auto; -webkit-overflow-scrolling:touch; }
-  table { width:100%; border-collapse:collapse; }
-  thead th { text-align:left; background: rgba(255,255,255,.05); color:var(--muted); font:600 11px/1 var(--mono); text-transform:uppercase; letter-spacing:.08em; padding:14px 16px; border-bottom:1px solid var(--glass-line); white-space:nowrap; }
-  tbody td { padding:15px 16px; border-bottom:1px solid rgba(255,255,255,.07); vertical-align:top; font-size:13.5px; overflow-wrap:anywhere; word-break:break-word; }
-  tbody tr.main { animation: rise .5s both ease; animation-delay: calc(var(--i)*30ms + 120ms); }
-  tbody tr.main:hover { background: rgba(255,255,255,.05); }
-
-  .pill { display:inline-flex; align-items:center; gap:7px; font:600 11.5px/1 var(--mono); padding:6px 10px; border-radius:8px; white-space:nowrap; text-transform:capitalize; color:var(--c); background: color-mix(in srgb, var(--c) 15%, transparent); border:1px solid color-mix(in srgb, var(--c) 34%, transparent); }
-  .pill::before { content:''; width:7px; height:7px; border-radius:50%; background:var(--c); box-shadow:0 0 9px var(--c); flex:none; }
-
-  .pkg { display:inline-block; font-family:var(--mono); font-size:12.5px; color:var(--text); background: rgba(255,255,255,.07); border:1px solid var(--glass-line); padding:4px 9px; border-radius:8px; }
-  .scope { margin-top:7px; color:var(--faint); font:11px/1 var(--mono); text-transform:uppercase; letter-spacing:.06em; }
-  .advid { font-family:var(--mono); font-size:12.5px; color:var(--accent); text-decoration:none; border-bottom:1px solid transparent; }
-  .advid:hover { border-bottom-color: color-mix(in srgb, var(--accent) 60%, transparent); }
-  .summary { color:var(--text); }
-  .path { margin-top:7px; color:var(--faint); font:11.5px/1.5 var(--mono); }
-
-  .fixchip { display:inline-block; font-family:var(--mono); font-size:12.5px; color:var(--fix); background: color-mix(in srgb, var(--fix) 13%, transparent); border:1px solid color-mix(in srgb, var(--fix) 30%, transparent); padding:4px 10px; border-radius:8px; cursor:copy; white-space:nowrap; user-select:all; -webkit-user-select:all; transition: background .15s ease; }
-  .fixchip:hover { background: color-mix(in srgb, var(--fix) 22%, transparent); }
-  .nofix { color:var(--faint); }
-  .refs { white-space:nowrap; }
-  .ref { display:inline-block; font:11.5px/1 var(--mono); color:var(--muted); text-decoration:none; padding:4px 8px; border:1px solid var(--glass-line); border-radius:7px; margin:0 4px 4px 0; background: rgba(255,255,255,.04); transition: color .15s, border-color .15s, background .15s; }
-  .ref:hover { color:var(--text); border-color: rgba(255,255,255,.28); background: rgba(255,255,255,.08); }
-
-  /* ---- Disclosure / advisory ------------------------------------------- */
-  .detail-row td { padding:0 16px 4px; background: rgba(0,0,0,.16); border-bottom:1px solid rgba(255,255,255,.07); }
-  details { margin:0; }
-  summary { list-style:none; cursor:pointer; display:inline-flex; align-items:center; gap:9px; color:var(--muted); font:600 11px/1 var(--mono); letter-spacing:.08em; text-transform:uppercase; padding:13px 0; user-select:none; transition: color .15s ease; }
-  summary::-webkit-details-marker { display:none; }
-  summary:hover { color:var(--text); }
-  summary .chev { color:var(--accent); transition: transform .25s cubic-bezier(.2,.7,.2,1); flex:none; }
-  details[open] summary .chev { transform: rotate(90deg); }
-  .detail-body { padding-bottom:18px; animation: fade .3s both ease; }
-
-  .fix { border:1px solid color-mix(in srgb, var(--fix) 28%, transparent); background: linear-gradient(180deg, color-mix(in srgb, var(--fix) 12%, transparent), rgba(255,255,255,.02)); -webkit-backdrop-filter: blur(8px); backdrop-filter: blur(8px); border-radius:13px; padding:13px 15px; margin:12px 0; box-shadow: var(--glass-hi); }
-  .fix-label { display:flex; align-items:center; gap:7px; font:700 10px/1 var(--mono); letter-spacing:.12em; text-transform:uppercase; color:var(--fix); margin-bottom:9px; }
-  .fix-label .spark { color:var(--fix); }
-  .fix-pending { border-color: color-mix(in srgb, var(--accent) 32%, transparent); background: linear-gradient(180deg, color-mix(in srgb, var(--accent) 11%, transparent), rgba(255,255,255,.02)); }
-  .fix-pending .fix-label, .fix-pending .spark { color: var(--accent); }
-  .fix-text { margin:0; color:var(--text); font-size:13px; }
-  .fix-text + .cmdbar { margin-top:11px; }
-  .cmdbar { display:flex; align-items:center; gap:14px; flex-wrap:wrap; background: rgba(4,7,12,.55); -webkit-backdrop-filter: blur(6px); backdrop-filter: blur(6px); border:1px solid var(--glass-line); border-radius:11px; padding:11px 14px; transition: border-color .18s ease, background .18s ease; }
-  .cmdbar:hover { border-color: color-mix(in srgb, var(--fix) 55%, transparent); background: rgba(4,7,12,.68); }
-  .cmdbar .cmd { font-family:var(--mono); font-size:13px; color:#d7f7e8; cursor:copy; white-space:pre-wrap; word-break:break-all; user-select:all; -webkit-user-select:all; }
-  .cmdbar .cmd::before { content:'$\\00a0\\00a0'; color:var(--fix); user-select:none; -webkit-user-select:none; }
-  .cmdbar .hint { margin-left:auto; font:11px/1 var(--sans); color:var(--muted); white-space:nowrap; }
-
-  .advisory-wrap { border:1px solid var(--glass-line); border-radius:13px; overflow:hidden; background: var(--glass-dark); -webkit-backdrop-filter: blur(10px); backdrop-filter: blur(10px); box-shadow: var(--glass-hi); }
-  .advisory-head { display:flex; align-items:center; gap:11px; padding:10px 15px; background: rgba(255,255,255,.05); border-bottom:1px solid var(--glass-line); font:600 10.5px/1 var(--mono); letter-spacing:.07em; text-transform:uppercase; color:var(--muted); }
-  .dots { display:flex; gap:6px; }
-  .dots i { width:9px; height:9px; border-radius:50%; background: rgba(255,255,255,.18); }
-  pre.advisory { margin:0; padding:15px 16px; white-space:pre-wrap; word-break:break-word; overflow-x:auto; max-width:100%; font-family:var(--mono); font-size:12.5px; line-height:1.65; color:#d2dae8; }
-
-  .empty { background: linear-gradient(180deg, var(--glass-2), var(--glass)); -webkit-backdrop-filter: var(--blur); backdrop-filter: var(--blur); border:1px solid var(--glass-line); border-radius:18px; padding:48px; text-align:center; color:var(--fix); font:600 19px/1.4 var(--sans); margin-top:16px; box-shadow: var(--glass-hi); }
-  footer { max-width:1120px; margin:0 auto; padding:18px clamp(16px,4vw,32px) 44px; color:var(--faint); font:12px/1.6 var(--mono); letter-spacing:.02em; }
-
-  /* Entrance animates position only \u2014 content stays fully opaque/visible throughout. */
-  @keyframes rise { from { transform: translateY(12px); } to { transform: none; } }
-  @keyframes fade { from { opacity:0; } to { opacity:1; } }
-  @keyframes blink { 50% { opacity:0; } }
-  @media (prefers-reduced-motion: reduce) { *, *::before, *::after { animation:none !important; transition:none !important; } }
-
-  @media print {
-    body { background:#fff; color:#111; }
-    header, .card, .table-wrap, .advisory-wrap, .cmdbar, .fix, thead th, .warn, .empty {
-      background:#fff !important; -webkit-backdrop-filter:none !important; backdrop-filter:none !important;
-      box-shadow:none !important; border-color:#ddd !important; color:#111;
-    }
-    .caret { display:none; }
-    pre.advisory, .fix-text, .summary, .pkg { color:#111 !important; }
-  }
+  body { font: 15px/1.5 -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; margin: 0; background: #f6f7f9; color: #1c1e21; }
+  header { background: #11161d; color: #fff; padding: 24px 32px; }
+  header h1 { margin: 0 0 4px; font-size: 20px; }
+  header .meta { color: #9aa4b2; font-size: 13px; }
+  main { max-width: 1100px; margin: 0 auto; padding: 24px 32px; }
+  .cards { display: grid; grid-template-columns: repeat(5, 1fr); gap: 12px; margin-bottom: 8px; }
+  .card { background: #fff; border-radius: 8px; padding: 14px 16px; box-shadow: 0 1px 3px rgba(0,0,0,.08); }
+  .card .count { font-size: 28px; font-weight: 700; }
+  .card .label { text-transform: capitalize; color: #6b7280; font-size: 13px; }
+  .warn { background: #fff7e6; border: 1px solid #ffd591; color: #874d00; padding: 8px 12px; border-radius: 6px; margin: 12px 0; font-size: 13px; }
+  table { width: 100%; border-collapse: collapse; background: #fff; border-radius: 8px; overflow: hidden; box-shadow: 0 1px 3px rgba(0,0,0,.08); margin-top: 16px; }
+  th, td { text-align: left; padding: 10px 12px; border-bottom: 1px solid #eef0f3; vertical-align: top; font-size: 13px; }
+  th { background: #f0f2f5; font-size: 12px; text-transform: uppercase; letter-spacing: .03em; color: #6b7280; }
+  .pill { color: #fff; padding: 2px 8px; border-radius: 999px; font-size: 12px; text-transform: capitalize; white-space: nowrap; }
+  .scope, .path { color: #6b7280; font-size: 12px; }
+  .path { margin-top: 4px; }
+  code { background: #eef0f3; padding: 1px 5px; border-radius: 4px; }
+  .empty { background: #fff; border-radius: 8px; padding: 40px; text-align: center; color: #3a9e54; font-size: 18px; box-shadow: 0 1px 3px rgba(0,0,0,.08); }
+  footer { max-width: 1100px; margin: 0 auto; padding: 16px 32px 40px; color: #9aa4b2; font-size: 12px; }
 </style>
 </head>
 <body>
 <header>
-  <div class="brand">${MARK}<div class="wordmark"><span class="lock">lock</span><span class="hawk">hawk</span><span class="caret"></span></div></div>
-  <div class="meta"><b>${esc(result.target.root.name)}${result.target.root.version ? `@${esc(result.target.root.version)}` : ""}</b> \xB7 ${esc(result.target.manager)} \xB7 ${result.stats.totalPackages} packages \xB7 scanned ${esc(
-    result.scannedAt
-  )}</div>
+  <h1>lockhawk report</h1>
+  <div class="meta">${x(e.target.root.name)}${e.target.root.version?`@${x(e.target.root.version)}`:""} \xB7 ${x(e.target.manager)} \xB7 ${e.stats.totalPackages} packages \xB7 scanned ${x(e.scannedAt)}</div>
 </header>
 <main>
-  <div class="cards">${cards}</div>
-  ${dbWarnings}
-  ${result.findings.length === 0 ? '<div class="empty">\u2713 No known vulnerabilities found.</div>' : `${resultsMeta}
-  <div class="table-wrap"><div class="scroll"><table>
+  <div class="cards">${s}</div>
+  ${a}
+  ${e.findings.length===0?'<div class="empty">\u2713 No known vulnerabilities found.</div>':`<table>
     <thead><tr><th>Severity</th><th>Package</th><th>Advisory</th><th>Summary &amp; path</th><th>Fixed in</th><th>Refs</th></tr></thead>
-    <tbody>${rows}</tbody>
-  </table></div></div>`}
+    <tbody>${r}</tbody>
+  </table>`}
 </main>
-<footer>Generated by lockhawk v${esc(result.tool.version)} \xB7 data from OSV.dev \xB7 database: ${esc(
-    result.database.source
-  )}</footer>
+<footer>Generated by lockhawk v${x(e.tool.version)} \xB7 data from OSV.dev \xB7 database: ${x(e.database.source)}</footer>
 </body>
-</html>`;
-}
-
-// src/report/junit.ts
-function xml(text) {
-  return text.replace(
-    /[&<>"']/g,
-    (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&apos;" })[c]
-  );
-}
-function failureBody(f) {
-  const lines = [
-    `Package: ${f.packageName}@${f.version} (${f.scope}${f.direct ? ", direct" : ", transitive"})`,
-    `Severity: ${f.severity.level}${f.severity.score !== void 0 ? `, CVSS ${f.severity.score}` : ""}${f.severity.vector ? ` (${f.severity.vector})` : ""}`,
-    f.fixedVersions.length ? `Fixed in: ${f.fixedVersions.join(", ")}` : "Fix: none available yet",
-    f.dependencyPaths[0] ? `Dependency path: ${f.dependencyPaths[0].join(" > ")}` : "",
-    f.recommendation ? `Recommendation: ${f.recommendation}` : "",
-    f.references.length ? `References:
-${f.references.join("\n")}` : ""
-  ];
-  return lines.filter(Boolean).join("\n");
-}
-function toJunit(result) {
-  const { findings } = result;
-  const failures = findings.length;
-  const tests = findings.length === 0 ? 1 : findings.length;
-  const time = ((result.stats.durationMs ?? 0) / 1e3).toFixed(3);
-  const suiteName = `${result.target.root.name} npm dependency vulnerabilities`;
-  const cases = findings.length === 0 ? ['    <testcase name="No known vulnerabilities" classname="lockhawk" time="0" />'] : findings.map((f) => {
-    const name = `${f.packageName}@${f.version}: ${f.id} (${f.severity.level})`;
-    const message = `${f.severity.level.toUpperCase()}${f.severity.score !== void 0 ? ` ${f.severity.score}` : ""} ${f.id}: ${f.summary}`;
-    return [
-      `    <testcase name="${xml(name)}" classname="lockhawk.${xml(f.severity.level)}" time="0">`,
-      `      <failure message="${xml(message)}" type="${xml(f.severity.level)}">${xml(failureBody(f))}</failure>`,
-      `    </testcase>`
-    ].join("\n");
-  });
-  return [
-    '<?xml version="1.0" encoding="UTF-8"?>',
-    `<testsuites name="lockhawk" tests="${tests}" failures="${failures}" errors="0" time="${time}">`,
-    `  <testsuite name="${xml(suiteName)}" tests="${tests}" failures="${failures}" errors="0" time="${time}">`,
-    ...cases,
-    "  </testsuite>",
-    "</testsuites>",
-    ""
-  ].join("\n");
-}
-export {
-  AutoSource,
-  LockfileError,
-  OfflineDbMissingError,
-  OfflineSource,
-  OnlineSource,
-  OsvClient,
-  OsvDatabase,
-  SEVERITY_RANK,
-  SHARD_BUCKETS,
-  TOOL,
-  buildDependencyGraph,
-  buildFindings,
-  canonicalId,
-  createSource,
-  dedupeVulnerabilities,
-  detectLockfile,
-  isVersionAffected,
-  levelFromLabel,
-  levelFromScore,
-  loadAdvisoriesForPackages,
-  loadDependencyGraph,
-  nearestFix,
-  offlineDbDir,
-  offlineMetaPath,
-  parseLockfile,
-  pkgKey,
-  readOfflineMeta,
-  readRootManifest,
-  resolveCacheDir,
-  resolveSeverity,
-  rootLabel,
-  scan,
-  scoreFromVector,
-  severityAtLeast,
-  shardBucket,
-  shortestPath,
-  shouldFail,
-  toHtml,
-  toJson,
-  toJunit,
-  toSarif,
-  toSarifString,
-  uniqueScannablePackages,
-  updateOfflineDatabase,
-  vulnerabilityAffects
-};
+</html>`}function _(e){return e.replace(/[&<>"']/g,n=>({"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&apos;"})[n])}function wr(e){return[`Package: ${e.packageName}@${e.version} (${e.scope}${e.direct?", direct":", transitive"})`,`Severity: ${e.severity.level}${e.severity.score!==void 0?`, CVSS ${e.severity.score}`:""}${e.severity.vector?` (${e.severity.vector})`:""}`,e.fixedVersions.length?`Fixed in: ${e.fixedVersions.join(", ")}`:"Fix: none available yet",e.dependencyPaths[0]?`Dependency path: ${e.dependencyPaths[0].join(" > ")}`:"",e.recommendation?`Recommendation: ${e.recommendation}`:"",e.references.length?`References:
+${e.references.join(`
+`)}`:""].filter(Boolean).join(`
+`)}function Vr(e){let{findings:n}=e,t=n.length,s=n.length===0?1:n.length,r=((e.stats.durationMs??0)/1e3).toFixed(3),a=`${e.target.root.name} npm dependency vulnerabilities`,i=n.length===0?['    <testcase name="No known vulnerabilities" classname="lockhawk" time="0" />']:n.map(o=>{let d=`${o.packageName}@${o.version}: ${o.id} (${o.severity.level})`,c=`${o.severity.level.toUpperCase()}${o.severity.score!==void 0?` ${o.severity.score}`:""} ${o.id}: ${o.summary}`;return[`    <testcase name="${_(d)}" classname="lockhawk.${_(o.severity.level)}" time="0">`,`      <failure message="${_(c)}" type="${_(o.severity.level)}">${_(wr(o))}</failure>`,"    </testcase>"].join(`
+`)});return['<?xml version="1.0" encoding="UTF-8"?>',`<testsuites name="lockhawk" tests="${s}" failures="${t}" errors="0" time="${r}">`,`  <testsuite name="${_(a)}" tests="${s}" failures="${t}" errors="0" time="${r}">`,...i,"  </testsuite>","</testsuites>",""].join(`
+`)}export{ee as AutoSource,Ce as DATA_MARKER,E as LockfileError,H as OfflineDbMissingError,j as OfflineSource,G as OnlineSource,U as OsvClient,xe as OsvDatabase,N as SEVERITY_RANK,Rn as SHARD_BUCKETS,Nn as TOOL,ue as buildDependencyGraph,Se as buildFindings,Ze as canonicalId,Me as createSource,ve as dedupeVulnerabilities,F as detectLockfile,Je as isVersionAffected,hn as levelFromLabel,ke as levelFromScore,Ne as loadAdvisoriesForPackages,le as loadDependencyGraph,ye as nearestFix,T as offlineDbDir,K as offlineMetaPath,We as parseLockfile,w as pkgKey,L as readOfflineMeta,M as readRootManifest,Ve as resolveCacheDir,Re as resolveSeverity,pe as rootLabel,dr as scan,bn as scoreFromVector,qe as severityAtLeast,Z as shardBucket,ge as shortestPath,pr as shouldFail,Rr as toHtml,gr as toJson,Vr as toJunit,Cn as toSarif,br as toSarifString,Mn as uniqueScannablePackages,sr as updateOfflineDatabase,W as vulnerabilityAffects};
 //# sourceMappingURL=index.js.map