@wrongstack/tools 0.318.0 → 0.319.1

package/dist/_edit-match.d.ts

@@ -74,9 +74,7 @@ export declare function adjustIndent(newLf: string, fromIndent: string, toIndent
 };
 /**
  * Best-effort locator for the no-match error: find the window whose trimmed
- * lines are most similar to the needle (cheap common-prefix scoring — this
- * runs on the failure path where the needle by definition doesn't match, so
- * precision matters less than never being slow). Returns the 1-based line
+ * lines are most similar to the needle. Returns the 1-based line
  * and a short snippet the model can use to correct itself without re-reading.
  */
 export declare function nearestMatchHint(fileLf: string, oldLf: string): {

package/dist/_util.d.ts

@@ -69,6 +69,19 @@ export declare function resolveRealInsideRoot(absPath: string, ctx: Context): Pr
  * caller then opened.
  */
 export declare function safeResolveReal(input: string, ctx: Context): Promise<string>;
+/**
+ * Project-root-relative variant of {@link safeResolveReal} for the codebase
+ * tools whose documented input contract is "relative to projectRoot or
+ * absolute" (codebase-skeleton, security-ast-scan, codebase-invariant-check,
+ * codebase-ast-replace). The sibling file tools (edit/grep/glob/…) resolve
+ * relative input against the session cwd — that is THEIR contract; these four
+ * always resolved against the project root and their schemas say so. Routing
+ * them through plain safeResolveReal silently changed that: with a nested
+ * workingDir (worktrees, set_working_dir) a relative input resolved to the
+ * wrong file. Containment is still enforced exactly as in safeResolveReal
+ * (realpath + allowOutsideProjectRoot honored).
+ */
+export declare function safeResolveProjectPath(input: string, ctx: Context): Promise<string>;
 /**
  * Truncate a diff (or similar text payload) to `maxBytes`, cutting at a line
  * boundary and appending an explicit marker. Used by the mutating file tools
@@ -79,6 +92,13 @@ export declare function truncateDiffPayload(diff: string, maxBytes: number): {
     text: string;
     truncated: boolean;
 };
+/**
+ * Truncate to `max` UTF-8 bytes keeping BOTH ends, appending a marker that
+ * reports the true omitted byte count. Like `truncateHeadTail` and
+ * `truncateDiffPayload`, marker room is reserved from the budget and both
+ * slices are cut byte-accurately (not by UTF-16 code unit), so the result
+ * never exceeds `max` — the contract `fetchTool`'s `maxOutputBytes` relies on.
+ */
 export declare function truncateMiddle(s: string, max: number): string;
 export declare function isBinaryBuffer(buf: Buffer): boolean;
 /** Unified byte cap for all command tool output fed to the model. */

package/dist/audit.js

@@ -1,14 +1,14 @@
 import {
   auditTool
-} from "./chunk-CVALEVGA.js";
-import "./chunk-4E42D7UF.js";
-import "./chunk-SOG7XIRF.js";
+} from "./chunk-64VIJPFV.js";
+import "./chunk-ATSKPZUK.js";
+import "./chunk-TTZOK6IY.js";
 import "./chunk-ZHH3BEWU.js";
 import "./chunk-2VSZC6QM.js";
 import "./chunk-3PVYQFRQ.js";
 import "./chunk-HFXSNKCV.js";
 import "./chunk-V43EQ6VR.js";
-import "./chunk-D33S4RQG.js";
+import "./chunk-ZUFHAHTE.js";
 export {
   auditTool
 };

package/dist/bash.js

@@ -1,13 +1,13 @@
 import {
   bashTool
-} from "./chunk-HTYEO67J.js";
+} from "./chunk-AKHYMB4V.js";
 import "./chunk-BTSFTGIL.js";
 import "./chunk-NKNOBUBU.js";
 import "./chunk-2VSZC6QM.js";
 import "./chunk-3PVYQFRQ.js";
 import "./chunk-HFXSNKCV.js";
 import "./chunk-V43EQ6VR.js";
-import "./chunk-D33S4RQG.js";
+import "./chunk-ZUFHAHTE.js";
 export {
   bashTool
 };

package/dist/builtin.d.ts

@@ -1,4 +1,13 @@
 import type { Tool } from '@wrongstack/core/types';
+/**
+ * Provider-facing descriptions for every built-in tool.
+ *
+ * Keep these decision-oriented: state the primary job, the appropriate time
+ * to use the tool, and any important boundary. This is deliberately kept next
+ * to the canonical catalog so tools discovered lazily receive the same useful
+ * guidance as directly exposed tools.
+ */
+export declare const BUILTIN_TOOL_DESCRIPTIONS: Readonly<Record<string, string>>;
 /**
  * Non-essential tools that can be omitted in token-saving mode to reduce
  * per-request token consumption. Each tool definition adds ~50-200 tokens
@@ -55,5 +64,6 @@ export declare const TIER2_TOOLS: Tool[];
  * tokens while keeping all core capabilities available.
  */
 export declare const TIER3_TOOLS: Tool[];
+/** The executable catalog always exposes the reviewed description above. */
 export declare const builtinTools: Tool[];
 //# sourceMappingURL=builtin.d.ts.map

package/dist/builtin.js

@@ -1,74 +1,76 @@
 import {
+  BUILTIN_TOOL_DESCRIPTIONS,
   OFF_ONLY_TOOLS,
   OPTIONAL_TOOLS,
   TIER1_TOOLS,
   TIER2_TOOLS,
   TIER3_TOOLS,
   builtinTools
-} from "./chunk-K23JNFE3.js";
-import "./chunk-5WNDJHT6.js";
-import "./chunk-YF3D5INN.js";
-import "./chunk-EEOFQDT6.js";
-import "./chunk-H6AWAZ2Y.js";
-import "./chunk-X5K3U6GI.js";
+} from "./chunk-OTINMOKK.js";
+import "./chunk-VPALDFYM.js";
+import "./chunk-RTZWBNTY.js";
+import "./chunk-XRNN44QY.js";
+import "./chunk-B4HTSV6Z.js";
+import "./chunk-3M7LLN7W.js";
 import "./chunk-RJZQWEMS.js";
 import "./chunk-FRN7TIAA.js";
 import "./chunk-WXJY3BKV.js";
 import "./chunk-QBV725YG.js";
-import "./chunk-6RNIFLG4.js";
-import "./chunk-CPVLVQYT.js";
-import "./chunk-UE3UBMCP.js";
-import "./chunk-CVALEVGA.js";
-import "./chunk-MRZOVQ5D.js";
-import "./chunk-CPSAF2AU.js";
-import "./chunk-EMRGN4KM.js";
-import "./chunk-TKA4VEX2.js";
-import "./chunk-ZE6KLBUO.js";
-import "./chunk-AGUSOFNI.js";
-import "./chunk-VB3MJGCV.js";
-import "./chunk-P7ZQ2FAJ.js";
-import "./chunk-J5SKD6LN.js";
-import "./chunk-WJYXMB2R.js";
-import "./chunk-3QQSBUXR.js";
-import "./chunk-4AEZIFOW.js";
-import "./chunk-4E42D7UF.js";
-import "./chunk-SOG7XIRF.js";
+import "./chunk-ELRRTWNP.js";
+import "./chunk-UQQS3VNT.js";
+import "./chunk-RLMX75EM.js";
+import "./chunk-64VIJPFV.js";
+import "./chunk-IYKXK356.js";
+import "./chunk-FQNXYA6W.js";
+import "./chunk-IU4DV2PA.js";
+import "./chunk-2OXHS3KZ.js";
+import "./chunk-6AAOT4PW.js";
+import "./chunk-IWS56OY7.js";
+import "./chunk-VD2LV5WO.js";
+import "./chunk-OG2BEUBY.js";
+import "./chunk-MNP3GE7H.js";
+import "./chunk-LOBRWKCR.js";
+import "./chunk-EADULOZV.js";
+import "./chunk-5EUJF3WC.js";
+import "./chunk-ATSKPZUK.js";
+import "./chunk-TTZOK6IY.js";
 import "./chunk-ZHH3BEWU.js";
-import "./chunk-CISOLTOP.js";
-import "./chunk-6GZPSWP3.js";
-import "./chunk-EOOFNYIT.js";
+import "./chunk-X5FOFGXX.js";
+import "./chunk-JDPQOR7C.js";
+import "./chunk-YOKD4GWJ.js";
 import "./chunk-Q5JPPCZC.js";
 import "./chunk-NWZ6XGBJ.js";
-import "./chunk-HTYEO67J.js";
-import "./chunk-WI3VDXHD.js";
+import "./chunk-AKHYMB4V.js";
+import "./chunk-BSJSNVGA.js";
 import "./chunk-BTSFTGIL.js";
 import "./chunk-NKNOBUBU.js";
 import "./chunk-2VSZC6QM.js";
 import "./chunk-3PVYQFRQ.js";
 import "./chunk-HFXSNKCV.js";
-import "./chunk-UKGMDCXT.js";
-import "./chunk-PQTONQ4P.js";
+import "./chunk-C2DQKVLO.js";
+import "./chunk-QPNYDH5B.js";
 import "./chunk-NBDZMMG2.js";
-import "./chunk-5ZYEGP2P.js";
-import "./chunk-FJEQZHZN.js";
-import "./chunk-CWALNI6K.js";
+import "./chunk-BK732J7I.js";
+import "./chunk-W2CECGTG.js";
+import "./chunk-X6KXNHUO.js";
 import "./chunk-45JPRMC2.js";
-import "./chunk-3U4H6ZRF.js";
-import "./chunk-S2GBLQ5S.js";
-import "./chunk-CIFAIIHI.js";
+import "./chunk-RNWUCZ2U.js";
+import "./chunk-O44IMQCN.js";
+import "./chunk-CFLJFDYV.js";
 import "./chunk-FQZOHLG3.js";
-import "./chunk-VZLX2JZG.js";
-import "./chunk-6GVXZCQV.js";
-import "./chunk-BLCSYKNN.js";
-import "./chunk-JJQB6R7Y.js";
-import "./chunk-ZLTFLC25.js";
-import "./chunk-A6BRWIXN.js";
+import "./chunk-DP6CXMJZ.js";
+import "./chunk-UDVKRX5R.js";
+import "./chunk-KY4PXYSO.js";
+import "./chunk-CMOUCKGC.js";
+import "./chunk-IIF5HIVF.js";
+import "./chunk-6IEBD27U.js";
 import "./chunk-UCYQTZ7F.js";
 import "./chunk-YOHO4DVT.js";
 import "./chunk-DTQ75VBC.js";
 import "./chunk-V43EQ6VR.js";
-import "./chunk-D33S4RQG.js";
+import "./chunk-ZUFHAHTE.js";
 export {
+  BUILTIN_TOOL_DESCRIPTIONS,
   OFF_ONLY_TOOLS,
   OPTIONAL_TOOLS,
   TIER1_TOOLS,

package/dist/{chunk-TKA4VEX2.js → chunk-2OXHS3KZ.js}

@@ -1,6 +1,6 @@
 import {
   safeResolveReal
-} from "./chunk-D33S4RQG.js";
+} from "./chunk-ZUFHAHTE.js";
 
 // src/scaffold.ts
 import * as fs from "node:fs/promises";
@@ -132,13 +132,23 @@ var scaffoldTool = {
     },
     required: ["template", "name"]
   },
-  async execute(input, ctx) {
+  async execute(input, ctx, _opts) {
+    const signal = _opts?.signal ?? ctx?.signal;
+    signal?.throwIfAborted();
     const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
     const name = input.name;
     const vars = { name, ...input.vars };
     const builtIn = BUILT_IN_TEMPLATES[input.template];
     if (builtIn) {
-      return await handleBuiltIn(name, builtIn.files, cwd, ctx, input.dry_run ?? false, vars);
+      return await handleBuiltIn(
+        name,
+        builtIn.files,
+        cwd,
+        ctx,
+        input.dry_run ?? false,
+        vars,
+        signal
+      );
     }
     return {
       template: input.template,
@@ -150,10 +160,11 @@ var scaffoldTool = {
     };
   }
 };
-async function handleBuiltIn(name, templateFiles, cwd, ctx, dryRun, vars) {
+async function handleBuiltIn(name, templateFiles, cwd, ctx, dryRun, vars, signal) {
   const files = [];
   let filesCreated = 0;
   for (const [filePath, content] of Object.entries(templateFiles)) {
+    if (signal?.aborted) break;
     const resolvedPath = substituteVars(filePath, name, vars);
     const joinedPath = path.join(cwd, resolvedPath);
     const root = path.resolve(ctx.projectRoot ?? ctx.cwd ?? process.cwd());
@@ -189,6 +200,7 @@ function substituteVars(content, name, vars) {
   result = result.replace(/\{\{name\}\}/g, () => kebab);
   result = result.replace(/\{\{Name\}\}/g, () => pascal);
   for (const [k, v] of Object.entries(vars)) {
+    if (k === "name" || k === "Name") continue;
     result = result.replace(new RegExp(`\\{\\{${escapeRegexLiteral(k)}\\}\\}`, "g"), () => v);
   }
   return result;
@@ -197,4 +209,4 @@ function substituteVars(content, name, vars) {
 export {
   scaffoldTool
 };
-//# sourceMappingURL=chunk-TKA4VEX2.js.map
+//# sourceMappingURL=chunk-2OXHS3KZ.js.map

package/dist/{chunk-X5K3U6GI.js → chunk-3M7LLN7W.js}

@@ -1,13 +1,20 @@
 import {
   todoTool
-} from "./chunk-5ZYEGP2P.js";
+} from "./chunk-BK732J7I.js";
 import {
   mirrorSessionTasksToKanban
-} from "./chunk-CWALNI6K.js";
+} from "./chunk-X6KXNHUO.js";
 
 // src/task.ts
 import { randomUUID } from "node:crypto";
-import { addPlanItem, formatPlan, mutatePlan, mutateTasks } from "@wrongstack/core/storage";
+import {
+  addPlanItem,
+  formatPlan,
+  loadTasks,
+  mutatePlan,
+  mutateTasks
+} from "@wrongstack/core/storage";
+import { ToolValidationError } from "@wrongstack/core/types";
 import { computeTaskItemProgress, formatTaskList } from "@wrongstack/core/utils";
 function findTaskIndex(tasks, query) {
   const asNum = Number.parseInt(query, 10);
@@ -119,8 +126,34 @@ var taskTool = {
     },
     required: ["action"]
   },
-  async execute(input, ctx) {
-    const sessionTaskPath = ctx.meta["task.path"];
+  async execute(input, ctx, _opts) {
+    const signal = _opts?.signal ?? ctx?.signal;
+    signal?.throwIfAborted();
+    const VALID_ACTIONS = /* @__PURE__ */ new Set([
+      "replace",
+      "add",
+      "status",
+      "show",
+      "promote",
+      "planify"
+    ]);
+    if (!input?.action || !VALID_ACTIONS.has(input.action)) {
+      return {
+        ok: false,
+        message: `Unknown action "${input?.action}". Use replace | add | status | show | promote | planify.`,
+        count: 0,
+        completed: 0,
+        inProgress: 0
+      };
+    }
+    if (input.scope !== void 0 && input.scope !== "session" && input.scope !== "project") {
+      throw new ToolValidationError({
+        message: `task: invalid scope "${input.scope}". Allowed: session, project`,
+        field: "scope"
+      });
+    }
+    const meta = ctx.meta ??= {};
+    const sessionTaskPath = meta["task.path"];
     let taskPath;
     if (input.scope === "project") {
       if (typeof sessionTaskPath === "string") {
@@ -143,6 +176,19 @@ var taskTool = {
       };
     }
     const sessionId = ctx.session?.id ?? "unknown";
+    if (input.action === "show") {
+      meta["task.path.resolved"] = taskPath;
+      const file2 = await loadTasks(taskPath) ?? { version: 1, tasks: [] };
+      const p2 = computeTaskItemProgress(file2.tasks);
+      const summary2 = file2.tasks.length > 0 ? formatTaskList(file2.tasks) : "No tasks.";
+      return {
+        ok: true,
+        message: summary2,
+        count: file2.tasks.length,
+        completed: p2.completed,
+        inProgress: p2.inProgress
+      };
+    }
     let early = null;
     const promoteMeta = { count: 0, title: "" };
     const planifyMeta = { title: "", details: "" };
@@ -198,6 +244,7 @@ var taskTool = {
               };
               return f;
             }
+            const taskStatusById = new Map(input.tasks.map((t) => [t.id, t.status]));
             for (const t of input.tasks) {
               if (t.dependsOn && t.dependsOn.length > 0) {
                 const missing = t.dependsOn.filter((d) => !newIds.has(d));
@@ -214,7 +261,7 @@ var taskTool = {
               }
               if (t.status === "in_progress" || t.status === "completed") {
                 const unmet = (t.dependsOn ?? []).filter(
-                  (dependencyId) => input.tasks?.find((candidate) => candidate.id === dependencyId)?.status !== "completed"
+                  (dependencyId) => taskStatusById.get(dependencyId) !== "completed"
                 );
                 if (unmet.length > 0) {
                   early = {
@@ -280,6 +327,14 @@ var taskTool = {
             break;
           }
           case "status": {
+            const VALID_TASK_STATUSES = /* @__PURE__ */ new Set([
+              "pending",
+              "in_progress",
+              "blocked",
+              "failed",
+              "review",
+              "completed"
+            ]);
             if (!input.id || !input.status) {
               early = {
                 ok: false,
@@ -290,6 +345,15 @@ var taskTool = {
               };
               return f;
             }
+            if (!VALID_TASK_STATUSES.has(input.status)) {
+              early = {
+                ok: false,
+                message: `action=status requires valid status ('pending' | 'in_progress' | 'blocked' | 'failed' | 'review' | 'completed'), got "${input.status}".`,
+                count: f.tasks.length,
+                ...computeTaskItemProgress(f.tasks)
+              };
+              return f;
+            }
             const task = f.tasks.find((t) => t.id === input.id);
             if (!task) {
               early = {
@@ -517,4 +581,4 @@ ${formatTaskList(file.tasks)}` : file.tasks.length > 0 ? formatTaskList(file.tas
 export {
   taskTool
 };
-//# sourceMappingURL=chunk-X5K3U6GI.js.map
+//# sourceMappingURL=chunk-3M7LLN7W.js.map

package/dist/{chunk-4AEZIFOW.js → chunk-5EUJF3WC.js}

@@ -1,6 +1,6 @@
 import {
   tryLegacyCodeOperation
-} from "./chunk-4E42D7UF.js";
+} from "./chunk-ATSKPZUK.js";
 import {
   spawnStream
 } from "./chunk-ZHH3BEWU.js";
@@ -8,10 +8,11 @@ import {
   detectPackageManager,
   normalizeCommandOutput,
   safeResolveReal
-} from "./chunk-D33S4RQG.js";
+} from "./chunk-ZUFHAHTE.js";
 
 // src/typecheck.ts
 import * as path from "node:path";
+import { ToolValidationError } from "@wrongstack/core/types";
 var typecheckTool = {
   name: "typecheck",
   category: "Code Quality",
@@ -50,6 +51,21 @@ var typecheckTool = {
   async *executeStream(input, ctx, opts) {
     const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
     const signal = opts?.signal ?? ctx.signal ?? new AbortController().signal;
+    signal.throwIfAborted();
+    if (input.all && input.project !== void 0) {
+      throw new ToolValidationError({
+        message: 'typecheck: cannot specify both "all: true" and "project"',
+        field: "project"
+      });
+    }
+    if (input.project !== void 0) {
+      if (typeof input.project !== "string" || !input.project.trim()) {
+        throw new ToolValidationError({
+          message: 'typecheck: "project" must be a non-empty string path',
+          field: "project"
+        });
+      }
+    }
     const bridge = await tryLegacyCodeOperation("semantic", {
       cwd,
       projectRoot: ctx.projectRoot,
@@ -86,7 +102,7 @@ var typecheckTool = {
         cmdArgs = ["tsc", ...tscArgs];
       }
     } else {
-      const tsconfig = input.project ? await safeResolveReal(input.project, ctx) : await findTsConfig(cwd);
+      const tsconfig = input.project ? await safeResolveReal(input.project.trim(), ctx) : await findTsConfig(cwd);
       const tscArgs = ["--noEmit"];
       if (input.strict) tscArgs.push("--strict");
       if (tsconfig) tscArgs.push("--project", tsconfig);
@@ -104,8 +120,13 @@ var typecheckTool = {
     });
     const combined = `${result.stdout}
 ${result.stderr}`;
-    const errors = [...combined.matchAll(/^.*\berror TS\d+:/gm)].length;
-    const warnings = [...combined.matchAll(/^.*\bwarning TS\d+:/gm)].length;
+    let errors = [...combined.matchAll(/^.*\berror TS\d+:/gmi)].length;
+    const warnings = [...combined.matchAll(/^.*\bwarning TS\d+:/gmi)].length;
+    if (errors === 0 && result.exitCode !== 0) {
+      errors = 1;
+    }
+    const rawOutput = result.stdout && result.stderr ? `${result.stdout}
+${result.stderr}` : result.stdout || result.stderr || result.error || "";
     yield {
       type: "final",
       output: {
@@ -113,7 +134,7 @@ ${result.stderr}`;
         exit_code: result.exitCode,
         errors,
         warnings,
-        output: normalizeCommandOutput(result.stdout || result.stderr || result.error || ""),
+        output: normalizeCommandOutput(rawOutput),
         truncated: result.truncated
       }
     };
@@ -121,7 +142,14 @@ ${result.stderr}`;
 };
 async function findTsConfig(cwd) {
   const { stat } = await import("node:fs/promises");
-  const candidates = ["tsconfig.json", "tsconfig.base.json"];
+  const candidates = [
+    "tsconfig.json",
+    "tsconfig.base.json",
+    "tsconfig.build.json",
+    "tsconfig.app.json",
+    "tsconfig.node.json",
+    "tsconfig.lib.json"
+  ];
   for (const f of candidates) {
     try {
       const s = await stat(path.join(cwd, f));
@@ -135,4 +163,4 @@ async function findTsConfig(cwd) {
 export {
   typecheckTool
 };
-//# sourceMappingURL=chunk-4AEZIFOW.js.map
+//# sourceMappingURL=chunk-5EUJF3WC.js.map

package/dist/{chunk-CVALEVGA.js → chunk-64VIJPFV.js}

@@ -1,6 +1,6 @@
 import {
   tryLegacyPackageOperation
-} from "./chunk-4E42D7UF.js";
+} from "./chunk-ATSKPZUK.js";
 import {
   spawnStream
 } from "./chunk-ZHH3BEWU.js";
@@ -9,9 +9,10 @@ import {
   detectPackageManager,
   normalizeCommandOutput,
   safeResolveReal
-} from "./chunk-D33S4RQG.js";
+} from "./chunk-ZUFHAHTE.js";
 
 // src/audit.ts
+import { ToolValidationError } from "@wrongstack/core/types";
 var SEVERITY_RANK = {
   info: 0,
   low: 1,
@@ -56,12 +57,21 @@ var auditTool = {
   },
   async *executeStream(input, ctx, opts) {
     if (input.fix === true) {
-      throw new Error(
-        "audit: `fix: true` is not supported \u2014 this tool is read-only (mutating: false). To remediate vulnerabilities, upgrade the affected packages with the `install` tool (or `language_package` for non-JS ecosystems)."
-      );
+      throw new ToolValidationError({
+        message: "audit: `fix: true` is not supported \u2014 this tool is read-only (mutating: false). To remediate vulnerabilities, upgrade the affected packages with the `install` tool (or `language_package` for non-JS ecosystems).",
+        field: "fix"
+      });
+    }
+    const VALID_LEVELS = /* @__PURE__ */ new Set(["low", "moderate", "high", "critical"]);
+    if (input.level !== void 0 && !VALID_LEVELS.has(input.level)) {
+      throw new ToolValidationError({
+        message: `audit: invalid severity level "${input.level}". Allowed: low, moderate, high, critical`,
+        field: "level"
+      });
     }
     const cwd = input.cwd ? await safeResolveReal(input.cwd, ctx) : ctx.cwd;
     const signal = opts?.signal ?? ctx.signal ?? new AbortController().signal;
+    signal.throwIfAborted();
     const bridge = await tryLegacyPackageOperation("package-audit", {
       cwd,
       projectRoot: ctx.projectRoot,
@@ -173,13 +183,24 @@ function extractAdvisories(data) {
     for (const [pkg, value] of Object.entries(vulns)) {
       const vuln = value ?? {};
       const via = Array.isArray(vuln["via"]) ? vuln["via"] : [];
-      const detail = via.find((v) => !!v && typeof v === "object");
-      advisories.push({
-        severity: typeof vuln["severity"] === "string" ? vuln["severity"] : "unknown",
-        package: pkg,
-        title: detail && typeof detail["title"] === "string" ? detail["title"] : "Unknown vulnerability",
-        url: detail && typeof detail["url"] === "string" ? detail["url"] : ""
-      });
+      const details = via.filter((v) => !!v && typeof v === "object");
+      if (details.length > 0) {
+        for (const detail of details) {
+          advisories.push({
+            severity: typeof detail["severity"] === "string" ? detail["severity"] : typeof vuln["severity"] === "string" ? vuln["severity"] : "unknown",
+            package: pkg,
+            title: typeof detail["title"] === "string" ? detail["title"] : "Unknown vulnerability",
+            url: typeof detail["url"] === "string" ? detail["url"] : ""
+          });
+        }
+      } else {
+        advisories.push({
+          severity: typeof vuln["severity"] === "string" ? vuln["severity"] : "unknown",
+          package: pkg,
+          title: "Unknown vulnerability",
+          url: ""
+        });
+      }
     }
   }
   return advisories;
@@ -188,4 +209,4 @@ function extractAdvisories(data) {
 export {
   auditTool
 };
-//# sourceMappingURL=chunk-CVALEVGA.js.map
+//# sourceMappingURL=chunk-64VIJPFV.js.map