codesentry 0.1.11 → 0.3.0

package/dist/index.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { readFileSync as readFileSync2 } from "fs";
-import { createRequire as createRequire4 } from "module";
+import { readFileSync as readFileSync3 } from "fs";
+import { createRequire as createRequire5 } from "module";
 import { Command } from "commander";
 import figlet from "figlet";
 import gradient from "gradient-string";
@@ -45,13 +45,13 @@ var isExecImport = (specifier) => {
   return specifier.type === "ImportSpecifier" && imported?.type === "Identifier" && EXEC_METHOD_NAMES.has(imported.name);
 };
 var isNamespaceImport = (specifier) => specifier.type === "ImportDefaultSpecifier" || specifier.type === "ImportNamespaceSpecifier";
+var bindingSetForImportSpecifier = (specifier, bindings) => isExecImport(specifier) ? bindings.directCalls : isNamespaceImport(specifier) ? bindings.namespaces : void 0;
 var collectImportBinding = (specifier, bindings) => {
   const name = localName(specifier);
   if (!name) {
     return;
   }
-  const bindingSet = isExecImport(specifier) ? bindings.directCalls : isNamespaceImport(specifier) ? bindings.namespaces : void 0;
-  bindingSet?.add(name);
+  bindingSetForImportSpecifier(specifier, bindings)?.add(name);
 };
 var collectFromImportDeclaration = (node, bindings) => {
   if (!isChildProcessModuleSpecifier(node.source)) {
@@ -71,13 +71,15 @@ var collectDirectCallBindings = (id, bindings) => {
     }
   }
 };
+var namespaceNameFromDeclaratorId = (id) => id?.type === "Identifier" ? id.name : void 0;
+var destructuredBindingsFromDeclaratorId = (id) => id?.type === "ObjectPattern" ? id : void 0;
 var collectFromVariableDeclarator = (node, bindings) => {
   if (!isRequireCall(node.init)) {
     return;
   }
   const id = node.id;
-  const namespaceName = id?.type === "Identifier" ? id.name : void 0;
-  const destructuredBindings = id?.type === "ObjectPattern" ? id : void 0;
+  const namespaceName = namespaceNameFromDeclaratorId(id);
+  const destructuredBindings = destructuredBindingsFromDeclaratorId(id);
   namespaceName && bindings.namespaces.add(namespaceName);
   destructuredBindings && collectDirectCallBindings(destructuredBindings, bindings);
 };
@@ -92,11 +94,8 @@ var collectChildProcessBindings = (sourceFile) => {
   });
   return bindings;
 };
-var isKnownChildProcessCallee = (callee, bindings) => {
-  if (callee?.type === "Identifier") {
-    return bindings.directCalls.has(callee.name);
-  }
-  if (callee?.type !== "MemberExpression") {
+var isKnownChildProcessMemberCallee = (callee, bindings) => {
+  if (callee.type !== "MemberExpression") {
     return false;
   }
   const object = callee.object;
@@ -104,6 +103,12 @@ var isKnownChildProcessCallee = (callee, bindings) => {
   const methodName = property?.type === "Identifier" ? property.name : void 0;
   return !!methodName && EXEC_METHOD_NAMES.has(methodName) && object?.type === "Identifier" && bindings.namespaces.has(object.name);
 };
+var isKnownChildProcessCallee = (callee, bindings) => {
+  if (callee?.type === "Identifier") {
+    return bindings.directCalls.has(callee.name);
+  }
+  return callee !== void 0 && isKnownChildProcessMemberCallee(callee, bindings);
+};
 var isDynamicCommandArgument = (argument) => argument?.type === "StringLiteral" ? false : argument?.type === "TemplateLiteral" ? (argument.expressions?.length ?? 0) > 0 : argument !== void 0;
 var isCommandInjectionCall = (node, bindings) => {
   if (node.type !== "CallExpression") {
@@ -145,8 +150,8 @@ var commandInjectionRule = {
 var withScanOptions = (command) => command.option("--json", "exibe o resultado em JSON").option("--tests", "inclui arquivos de teste na an\xE1lise (por padr\xE3o s\xE3o ignorados)");
 
 // src/commands/scan/scan-runner.ts
-import { writeFile } from "fs/promises";
-import { join as join2 } from "path";
+import { writeFile as writeFile2 } from "fs/promises";
+import { join as join4 } from "path";
 import chalk2 from "chalk";
 import { Listr } from "listr2";
 
@@ -181,13 +186,16 @@ var mergeScanResults = (nativeResult, semgrepResult) => ({
   findings: [...nativeResult.findings, ...semgrepResult.findings],
   durationMs: nativeResult.durationMs + semgrepResult.durationMs,
   engines: {
+    ...nativeResult.engines,
+    ...semgrepResult.engines,
     codesentry: nativeResult.engines?.codesentry ?? nativeResult.scannedFiles,
     semgrep: semgrepResult.engines?.semgrep ?? semgrepResult.scannedFiles
-  }
+  },
+  warnings: [...nativeResult.warnings ?? [], ...semgrepResult.warnings ?? []]
 });
-var finalizeScanResult = (result) => ({
+var finalizeScanResult = (result, dependencyAuditCoverage2 = false) => ({
   ...result,
-  engines: { ...result.engines, dependencyAudit: false },
+  engines: { ...result.engines, dependencyAudit: dependencyAuditCoverage2 },
   warnings: result.engines?.semgrep === 0 ? [...result.warnings ?? [], ZERO_SEMGREP_COVERAGE_WARNING] : result.warnings
 });
 
@@ -198,7 +206,21 @@ var SEVERITY_COLOR = {
   high: (text2) => chalk.red(text2),
   critical: (text2) => chalk.bgRed.white(text2)
 };
-var coverageText = (result) => result.engines?.semgrep === void 0 ? "" : ` CodeSentry: ${result.engines.codesentry ?? result.scannedFiles} JS/TS; Semgrep: ${result.engines.semgrep} arquivo(s).`;
+var semgrepCoverage = (result) => result.engines?.semgrep === void 0 ? void 0 : `CodeSentry: ${result.engines.codesentry ?? result.scannedFiles} JS/TS; Semgrep: ${result.engines.semgrep} arquivo(s)`;
+var dependencyAuditCoverage = (result) => typeof result.engines?.dependencyAudit === "number" ? `Dependency audit: ${result.engines.dependencyAudit} pacote(s) considerado(s)` : void 0;
+var osvCoverage = (result) => result.engines?.osv ? `OSV.dev: ${result.engines.osv.checked}/${result.engines.osv.total} verificados` : void 0;
+var nvdCoverage = (result) => {
+  const nvd = result.engines?.nvd;
+  if (!nvd || nvd.total === 0) return void 0;
+  return `NVD: ${nvd.total} CVE(s); ${nvd.enriched} enriquecido(s); ${nvd.notFound} sem resultado; ${nvd.failed} falha(s); ${nvd.cacheHits} cache hit(s)`;
+};
+var coverageParts = (result) => [semgrepCoverage(result), dependencyAuditCoverage(result), osvCoverage(result), nvdCoverage(result)].filter(
+  (part) => part !== void 0
+);
+var coverageText = (result) => {
+  const parts = coverageParts(result);
+  return parts.length ? ` ${parts.join("; ")}.` : "";
+};
 var printNotes = (result) => {
   if (result.engines?.dependencyAudit === false) {
     console.log(chalk.cyan(DEPENDENCY_AUDIT_NOTE));
@@ -211,9 +233,9 @@ var printCleanReport = (result, coverage) => {
   console.log(chalk.green(`Nenhum problema encontrado (${result.scannedFiles} arquivos analisados).${coverage}`));
   printNotes(result);
 };
-var findingsTable = (result) => {
+var findingsTable = (findings) => {
   const table = new Table({ head: ["Severity", "Rule", "File", "Line", "Message"] });
-  for (const finding of result.findings) {
+  for (const finding of findings) {
     const colorize = SEVERITY_COLOR[finding.severity];
     table.push([
       colorize(finding.severity),
@@ -225,8 +247,132 @@ var findingsTable = (result) => {
   }
   return table;
 };
+var titleCaseMetric = (value) => value.toLowerCase().split("_").map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
+var labeledLines = (pairs, format) => pairs.filter((pair) => Boolean(pair[1])).map(([label, value]) => format(label, value));
+var cvssMetricLines = (cvss) => labeledLines(
+  [
+    ["Vetor de ataque", cvss.attackVector],
+    ["Complexidade", cvss.attackComplexity],
+    ["Privil\xE9gios necess\xE1rios", cvss.privilegesRequired],
+    ["Intera\xE7\xE3o do usu\xE1rio", cvss.userInteraction],
+    ["Escopo", cvss.scope],
+    ["Confidentiality", cvss.confidentialityImpact],
+    ["Integrity", cvss.integrityImpact],
+    ["Availability", cvss.availabilityImpact]
+  ],
+  (label, value) => `  ${label}: ${titleCaseMetric(value)}`
+);
+var cvssLines = (cvss) => [
+  `  Severidade: ${cvss.severity ?? "n\xE3o informada"}`,
+  `  CVSS: ${cvss.score}`,
+  `  Vers\xE3o CVSS: ${cvss.version}`,
+  `  Vetor: ${cvss.vectorString}`,
+  ...cvssMetricLines(cvss)
+];
+var cvssBlock = (data) => data.cvss ? cvssLines(data.cvss) : ["  CVSS: registro encontrado, ainda sem m\xE9trica CVSS"];
+var metadataLines = (data, summary) => labeledLines(
+  [
+    ["CWE", data.cwes.join(", ") || void 0],
+    ["Descri\xE7\xE3o NVD", data.description !== summary ? data.description : void 0],
+    ["Publicado", data.published],
+    ["Modificado", data.lastModified]
+  ],
+  (label, value) => `  ${label}: ${value}`
+);
+var cisaKevLines = (kev) => [
+  `  CISA KEV desde: ${kev.addedAt}`,
+  ...labeledLines(
+    [
+      ["Nome CISA", kev.vulnerabilityName],
+      ["Prazo CISA", kev.actionDue],
+      ["A\xE7\xE3o CISA", kev.requiredAction]
+    ],
+    (label, value) => `  ${label}: ${value}`
+  )
+];
+var cisaSsvcLines = (ssvc) => {
+  const parts = labeledLines(
+    [
+      ["explora\xE7\xE3o", ssvc.exploitation],
+      ["automatiz\xE1vel", ssvc.automatable],
+      ["impacto t\xE9cnico", ssvc.technicalImpact]
+    ],
+    (label, value) => `${label}=${value}`
+  );
+  return labeledLines(
+    [
+      ["CISA SSVC", parts.length > 0 ? parts.join("; ") : void 0],
+      ["CISA SSVC atualizado", ssvc.timestamp]
+    ],
+    (label, value) => `  ${label}: ${value}`
+  );
+};
+var cisaLines = (cisa) => [
+  ...cisa?.kev ? cisaKevLines(cisa.kev) : [],
+  ...cisa?.ssvc ? cisaSsvcLines(cisa.ssvc) : []
+];
+var referencesLines = (references) => {
+  const shown = references.slice(0, 5);
+  const extraCount = references.length - shown.length;
+  return labeledLines(
+    [
+      ["Refer\xEAncias", shown.length > 0 ? shown.map((reference) => reference.url).join(", ") : void 0],
+      ["Refer\xEAncias adicionais", extraCount > 0 ? `${extraCount}` : void 0]
+    ],
+    (label, value) => `  ${label}: ${value}`
+  );
+};
+var foundNvdLines = (result, summary) => {
+  const { data } = result;
+  return [
+    `  CVE: ${result.cveId}`,
+    `  Status NVD: ${data.vulnerabilityStatus ?? "n\xE3o informado"}`,
+    ...cvssBlock(data),
+    ...metadataLines(data, summary),
+    ...cisaLines(data.cisa),
+    ...referencesLines(data.references)
+  ];
+};
+var httpStatusSuffix = (httpStatus) => httpStatus ? ` HTTP ${httpStatus}` : "";
+var nvdLines = (result, summary) => {
+  if (result.status === "found") return foundNvdLines(result, summary);
+  if (result.status === "not-found") return [`  CVE: ${result.cveId}`, "  NVD: sem resultado"];
+  return [
+    `  CVE: ${result.cveId}`,
+    `  NVD: falha ao consultar (${result.error.kind}${httpStatusSuffix(result.error.httpStatus)})`
+  ];
+};
+var aliasesLine = (aliases) => aliases.length > 0 ? [`Aliases: ${aliases.join(", ")}`] : [];
+var summaryLine = (summary, label) => summary ? [`${label}: ${summary}`] : [];
+var nvdResultLines = (results, summary) => (results ?? []).flatMap((result) => ["", ...nvdLines(result, summary)]);
+var sourcesLabel = (source, foundNvd) => source === "osv" ? `OSV${foundNvd ? ", NVD" : ""}` : "npm";
+var dependencyBlock = (finding) => {
+  const dependency = finding.dependency;
+  if (!dependency) return "";
+  const foundNvd = (dependency.nvd ?? []).some((result) => result.status === "found");
+  const lines = [
+    `Pacote: ${dependency.package.name}`,
+    `Vers\xE3o instalada: ${dependency.package.installedVersion}`,
+    `Vers\xE3o corrigida: ${dependency.package.fixedVersions.join(" ou ") || "n\xE3o informada"}`,
+    `${dependency.advisory.source.toUpperCase()}: ${dependency.advisory.id ?? "identificador n\xE3o informado"}`,
+    ...aliasesLine(dependency.advisory.aliases),
+    `Severidade do finding: ${finding.severity.toUpperCase()}`,
+    ...summaryLine(dependency.advisory.summary, "Descri\xE7\xE3o OSV/npm"),
+    ...nvdResultLines(dependency.nvd, dependency.advisory.summary),
+    `Fontes: ${sourcesLabel(dependency.advisory.source, foundNvd)}`
+  ];
+  return lines.join("\n");
+};
+var printDependencyFindings = (findings) => {
+  if (findings.length === 0) return;
+  console.log(chalk.bold("\nDepend\xEAncias vulner\xE1veis"));
+  console.log(findings.map(dependencyBlock).join("\n\n"));
+};
 var printFindingsReport = (result, coverage) => {
-  console.log(findingsTable(result).toString());
+  const codeFindings = result.findings.filter((finding) => !finding.dependency);
+  const dependencyFindings = result.findings.filter((finding) => finding.dependency);
+  if (codeFindings.length) console.log(findingsTable(codeFindings).toString());
+  printDependencyFindings(dependencyFindings);
   console.log(
     chalk.bold(
       `
@@ -250,6 +396,7 @@ var toJsonReport = (result) => {
 };
 
 // src/reporters/markdown.reporter.ts
+var LOGO_URL = "https://raw.githubusercontent.com/Ivan-ReisDev/code-sentry/main/docs/assets/logo.png";
 var SEVERITY_ORDER = ["critical", "high", "medium", "low"];
 var SEVERITY_LABEL = /* @__PURE__ */ new Map([
   ["critical", "Critical"],
@@ -257,7 +404,14 @@ var SEVERITY_LABEL = /* @__PURE__ */ new Map([
   ["medium", "Medium"],
   ["low", "Low"]
 ]);
+var SEVERITY_EMOJI = /* @__PURE__ */ new Map([
+  ["critical", "\u{1F534}"],
+  ["high", "\u{1F7E0}"],
+  ["medium", "\u{1F7E1}"],
+  ["low", "\u{1F535}"]
+]);
 var severityLabel = (severity) => SEVERITY_LABEL.get(severity) ?? severity;
+var severityBadge = (severity) => `${SEVERITY_EMOJI.get(severity) ?? ""} ${severityLabel(severity)}`;
 var escapeCell = (text2) => text2.replaceAll("|", "\\|");
 var groupBy = (items, keyOf) => {
   const map = /* @__PURE__ */ new Map();
@@ -276,7 +430,7 @@ var findingsTable2 = (findings) => {
   return lines;
 };
 var severitySection = (severity, findings) => {
-  const lines = [`## ${severityLabel(severity)} (${findings.length})`, ""];
+  const lines = [`## ${severityBadge(severity)} (${findings.length})`, ""];
   const byRule = groupBy(findings, (f) => f.ruleId);
   for (const ruleId of [...byRule.keys()].sort()) {
     const ruleFindings = byRule.get(ruleId) ?? [];
@@ -284,24 +438,38 @@ var severitySection = (severity, findings) => {
   }
   return lines;
 };
+var semgrepCoverageLine = (result) => result.engines?.semgrep === void 0 ? [] : [
+  `- **Cobertura por motor:** CodeSentry ${result.engines.codesentry ?? result.scannedFiles} JS/TS; Semgrep ${result.engines.semgrep} arquivos`
+];
+var dependencyAuditConsideredLine = (result) => typeof result.engines?.dependencyAudit === "number" ? [`- **Depend\xEAncias consideradas:** ${result.engines.dependencyAudit}`] : [];
+var nvdCoverageLine = (result) => {
+  const nvd = result.engines?.nvd;
+  if (!nvd || nvd.total === 0) return [];
+  return [
+    `- **Cobertura NVD:** ${nvd.enriched}/${nvd.total} enriquecidos; ${nvd.notFound} sem resultado; ${nvd.failed} falhas; ${nvd.cacheHits} cache hits`
+  ];
+};
+var dependencyAuditNoteLine = (result) => result.engines?.dependencyAudit === false ? [`- **Nota:** ${DEPENDENCY_AUDIT_NOTE}`] : [];
 var reportHeader = (result, generatedAt) => [
+  `<p align="center"><img src="${LOGO_URL}" alt="CodeSentry" width="320"></p>`,
+  "",
   "# Relat\xF3rio CodeSentry",
   "",
   `- **Gerado em:** ${generatedAt.toISOString()}`,
   `- **Arquivos analisados:** ${result.scannedFiles}`,
-  ...result.engines?.semgrep === void 0 ? [] : [
-    `- **Cobertura por motor:** CodeSentry ${result.engines.codesentry ?? result.scannedFiles} JS/TS; Semgrep ${result.engines.semgrep} arquivos`
-  ],
+  ...semgrepCoverageLine(result),
+  ...dependencyAuditConsideredLine(result),
+  ...nvdCoverageLine(result),
   `- **Dura\xE7\xE3o:** ${result.durationMs}ms`,
   `- **Total de problemas:** ${result.findings.length}`,
-  ...result.engines?.dependencyAudit === false ? [`- **Nota:** ${DEPENDENCY_AUDIT_NOTE}`] : [],
+  ...dependencyAuditNoteLine(result),
   ""
 ];
 var warningsSection = (result) => (result.warnings ?? []).length === 0 ? [] : ["## Avisos", "", ...(result.warnings ?? []).map((warning) => `- ${warning}`), ""];
 var summaryTable = (bySeverity) => {
   const lines = ["## Resumo por severidade", "", "| Severidade | Quantidade |", "| --- | --- |"];
   for (const severity of SEVERITY_ORDER) {
-    lines.push(`| ${severityLabel(severity)} | ${(bySeverity.get(severity) ?? []).length} |`);
+    lines.push(`| ${severityBadge(severity)} | ${(bySeverity.get(severity) ?? []).length} |`);
   }
   lines.push("");
   return lines;
@@ -316,26 +484,1207 @@ var severitySections = (bySeverity) => {
   }
   return lines;
 };
+var labeledLines2 = (pairs, format) => pairs.filter((pair) => Boolean(pair[1])).map(([label, value]) => format(label, value));
+var mdCvssMetricLines = (cvss) => labeledLines2(
+  [
+    ["Attack Vector", cvss.attackVector],
+    ["Attack Complexity", cvss.attackComplexity],
+    ["Privileges Required", cvss.privilegesRequired],
+    ["User Interaction", cvss.userInteraction],
+    ["Scope", cvss.scope],
+    ["Confidentiality", cvss.confidentialityImpact],
+    ["Integrity", cvss.integrityImpact],
+    ["Availability", cvss.availabilityImpact]
+  ],
+  (key, value) => `${key}=${value}`
+);
+var mdCvssLines = (cvss) => {
+  const lines = [
+    `- **CVSS:** ${cvss.score} (${cvss.severity ?? "sem severidade"}), vers\xE3o ${cvss.version}`,
+    `- **Vetor:** \`${cvss.vectorString}\``
+  ];
+  const metrics = mdCvssMetricLines(cvss);
+  return metrics.length ? [...lines, `- **M\xE9tricas:** ${metrics.join("; ")}`] : lines;
+};
+var mdCvssBlock = (data) => data.cvss ? mdCvssLines(data.cvss) : ["- **CVSS:** registro encontrado, ainda sem m\xE9trica CVSS"];
+var mdMetadataLines = (data, summary) => labeledLines2(
+  [
+    ["CWE", data.cwes.join(", ") || void 0],
+    ["Descri\xE7\xE3o NVD", data.description !== summary ? data.description : void 0],
+    ["Publicado", data.published],
+    ["Modificado", data.lastModified]
+  ],
+  (label, value) => `- **${label}:** ${value}`
+);
+var mdCisaKevLines = (kev) => [
+  `- **CISA KEV:** \u26A0\uFE0F inclu\xEDdo em ${kev.addedAt}`,
+  ...labeledLines2(
+    [
+      ["Nome CISA", kev.vulnerabilityName],
+      ["Prazo CISA", kev.actionDue],
+      ["A\xE7\xE3o requerida", kev.requiredAction]
+    ],
+    (label, value) => `- **${label}:** ${value}`
+  )
+];
+var mdCisaSsvcLines = (ssvc) => {
+  const parts = labeledLines2(
+    [
+      ["explora\xE7\xE3o", ssvc.exploitation],
+      ["automatiz\xE1vel", ssvc.automatable],
+      ["impacto t\xE9cnico", ssvc.technicalImpact]
+    ],
+    (label, value) => `${label}=${value}`
+  );
+  return labeledLines2(
+    [
+      ["CISA SSVC", parts.length > 0 ? parts.join("; ") : void 0],
+      ["CISA SSVC atualizado", ssvc.timestamp]
+    ],
+    (label, value) => `- **${label}:** ${value}`
+  );
+};
+var mdCisaLines = (cisa) => [
+  ...cisa?.kev ? mdCisaKevLines(cisa.kev) : [],
+  ...cisa?.ssvc ? mdCisaSsvcLines(cisa.ssvc) : []
+];
+var mdReferencesBlock = (references) => references.length ? [
+  "",
+  "**Refer\xEAncias:**",
+  "",
+  ...references.map((reference) => {
+    const metadata = [reference.source, ...reference.tags].filter(Boolean);
+    return `- ${reference.url}${metadata.length ? ` \u2014 ${metadata.join(", ")}` : ""}`;
+  })
+] : [];
+var nvdHttpStatusSuffix = (httpStatus) => httpStatus ? `, HTTP ${httpStatus}` : "";
+var nvdMarkdown = (result, advisorySummary) => {
+  if (result.status === "not-found") return [`- **${result.cveId}:** sem resultado no NVD`];
+  if (result.status === "error") {
+    return [
+      `- **${result.cveId}:** falha ao consultar (${result.error.kind}${nvdHttpStatusSuffix(result.error.httpStatus)})`
+    ];
+  }
+  const { data } = result;
+  return [
+    `#### ${result.cveId}`,
+    "",
+    `- **Status NVD:** ${data.vulnerabilityStatus ?? "n\xE3o informado"}`,
+    ...mdCvssBlock(data),
+    ...mdMetadataLines(data, advisorySummary),
+    ...mdCisaLines(data.cisa),
+    ...mdReferencesBlock(data.references)
+  ];
+};
+var mdSourcesLabel = (source, foundNvd) => source === "osv" ? `OSV${foundNvd ? ", NVD" : ""}` : "npm";
+var mdSummaryLine = (summary) => summary ? [`- **Descri\xE7\xE3o OSV/npm:** ${summary}`] : [];
+var firstCvssScore = (nvd) => {
+  const withCvss = (nvd ?? []).find(
+    (result) => result.status === "found" && Boolean(result.data.cvss)
+  );
+  return withCvss?.data.cvss ? `${withCvss.data.cvss.score}` : "\u2014";
+};
+var dependencySummaryRow = (finding, dependency) => `| ${dependency.package.name}@${dependency.package.installedVersion} | ${severityBadge(finding.severity)} | ${dependency.advisory.id ?? "\u2014"} | ${dependency.advisory.aliases.join(", ") || "\u2014"} | ${firstCvssScore(dependency.nvd)} | ${dependency.package.fixedVersions.join(" ou ") || "\u2014"} |`;
+var dependencySummaryTable = (findings) => {
+  const rows = findings.filter((finding) => Boolean(finding.dependency)).map((finding) => dependencySummaryRow(finding, finding.dependency));
+  if (!rows.length) return [];
+  return [
+    "| Pacote | Severidade | Advisory | CVE(s) | CVSS | Corrigir para |",
+    "| --- | --- | --- | --- | --- | --- |",
+    ...rows,
+    ""
+  ];
+};
+var dependencySection = (finding) => {
+  const dependency = finding.dependency;
+  if (!dependency) return [];
+  const foundNvd = (dependency.nvd ?? []).some((result) => result.status === "found");
+  return [
+    "<details>",
+    `<summary>${severityBadge(finding.severity)} <strong>${dependency.package.name}@${dependency.package.installedVersion}</strong></summary>`,
+    "",
+    `- **Fonte principal:** ${dependency.advisory.source.toUpperCase()}`,
+    `- **Advisory:** ${dependency.advisory.id ?? "n\xE3o informado"}`,
+    `- **Aliases:** ${dependency.advisory.aliases.join(", ") || "nenhum"}`,
+    `- **Vers\xF5es corrigidas:** ${dependency.package.fixedVersions.join(" ou ") || "n\xE3o informadas"}`,
+    `- **Fontes:** ${mdSourcesLabel(dependency.advisory.source, foundNvd)}`,
+    ...mdSummaryLine(dependency.advisory.summary),
+    ...(dependency.nvd ?? []).flatMap((result) => ["", ...nvdMarkdown(result, dependency.advisory.summary)]),
+    "",
+    "</details>",
+    ""
+  ];
+};
+var dependencySections = (findings) => {
+  const dependencies = findings.filter((finding) => finding.dependency);
+  if (dependencies.length === 0) return [];
+  return [
+    "## Depend\xEAncias vulner\xE1veis",
+    "",
+    ...dependencySummaryTable(findings),
+    ...dependencies.flatMap(dependencySection)
+  ];
+};
+var osvCheckedSection = (result) => {
+  const { osvCheckedPackages } = result;
+  if (!osvCheckedPackages || osvCheckedPackages.length === 0) {
+    return [];
+  }
+  const checked = result.engines?.osv?.checked ?? osvCheckedPackages.length;
+  const total = result.engines?.osv?.total ?? osvCheckedPackages.length;
+  return [
+    `## Depend\xEAncias verificadas no OSV.dev (${checked}/${total})`,
+    "",
+    "<details>",
+    "<summary>Ver lista completa</summary>",
+    "",
+    ...osvCheckedPackages.map((pkg) => `- ${pkg}`),
+    "",
+    "</details>",
+    ""
+  ];
+};
 var toMarkdownReport = (result, generatedAt = /* @__PURE__ */ new Date()) => {
+  const codeFindings = result.findings.filter((finding) => !finding.dependency);
   const bySeverity = groupBy(result.findings, (f) => f.severity);
+  const codeBySeverity = groupBy(codeFindings, (f) => f.severity);
   return [
     ...reportHeader(result, generatedAt),
     ...warningsSection(result),
     ...summaryTable(bySeverity),
-    ...severitySections(bySeverity)
+    ...severitySections(codeBySeverity),
+    ...dependencySections(result.findings),
+    ...osvCheckedSection(result)
   ].join("\n");
 };
 
+// src/scanner/dependency-audit.ts
+import { execFile } from "child_process";
+import { readFile as readFile2 } from "fs/promises";
+import { join as join2 } from "path";
+import { promisify } from "util";
+
+// src/scanner/nvd-cache.ts
+import { homedir } from "os";
+import { dirname, join } from "path";
+import { mkdir, readFile, rename, writeFile } from "fs/promises";
+var CACHE_SCHEMA_VERSION = 1;
+var FOUND_TTL_MS = 24 * 60 * 60 * 1e3;
+var NOT_FOUND_TTL_MS = 60 * 60 * 1e3;
+var isRecord = (value) => typeof value === "object" && value !== null;
+var defaultCacheFile = () => {
+  if (process.platform === "win32") {
+    return join(process.env.LOCALAPPDATA ?? join(homedir(), "AppData", "Local"), "CodeSentry", "nvd-v1.json");
+  }
+  if (process.platform === "darwin") {
+    return join(homedir(), "Library", "Caches", "CodeSentry", "nvd-v1.json");
+  }
+  return join(process.env.XDG_CACHE_HOME ?? join(homedir(), ".cache"), "codesentry", "nvd-v1.json");
+};
+var isValidReference = (value) => isRecord(value) && typeof value.url === "string";
+var isNvdData = (value, cveId) => isRecord(value) && value.id === cveId && Array.isArray(value.cwes) && value.cwes.every((item) => typeof item === "string") && Array.isArray(value.references) && value.references.every(isValidReference);
+var isStoredEnvelope = (value) => isRecord(value) && typeof value.expiresAt === "number" && isRecord(value.result);
+var parseFoundResult = (cveId, result) => result.status === "found" && isNvdData(result.data, cveId) ? { status: "found", cveId, data: result.data } : void 0;
+var parseStoredResult = (cveId, result) => {
+  if (result.cveId !== cveId) return void 0;
+  if (result.status === "not-found") return { status: "not-found", cveId };
+  return parseFoundResult(cveId, result);
+};
+var parseStoredEntry = (cveId, value) => {
+  if (!isStoredEnvelope(value)) return void 0;
+  const result = parseStoredResult(cveId, value.result);
+  return result ? { expiresAt: value.expiresAt, result } : void 0;
+};
+var parseCacheFileBody = (parsed, now) => {
+  if (!isRecord(parsed) || parsed.schemaVersion !== CACHE_SCHEMA_VERSION || !isRecord(parsed.entries)) {
+    return { entries: /* @__PURE__ */ new Map(), incompatible: true };
+  }
+  const entries = /* @__PURE__ */ new Map();
+  for (const [cveId, value] of Object.entries(parsed.entries)) {
+    const entry = parseStoredEntry(cveId, value);
+    if (entry && entry.expiresAt > now) entries.set(cveId, entry);
+  }
+  return { entries, incompatible: false };
+};
+var cleanCacheableResult = (result) => result.status === "found" ? { status: "found", cveId: result.cveId, data: result.data } : { status: "not-found", cveId: result.cveId };
+var toStoredEntry = (result, now) => ({
+  expiresAt: now + (result.status === "found" ? FOUND_TTL_MS : NOT_FOUND_TTL_MS),
+  result
+});
+var PersistentNvdCache = class {
+  #filePath;
+  #now;
+  #entries = /* @__PURE__ */ new Map();
+  #warnings = [];
+  #loadPromise;
+  #writeCounter = 0;
+  #writeQueue = Promise.resolve();
+  constructor(options) {
+    this.#filePath = options.filePath ?? defaultCacheFile();
+    this.#now = options.now ?? Date.now;
+  }
+  async #loadFromDisk() {
+    try {
+      const raw = await readFile(this.#filePath, "utf-8");
+      const parsed = JSON.parse(raw);
+      const { entries, incompatible } = parseCacheFileBody(parsed, this.#now());
+      if (incompatible) {
+        this.#warnings.push("O cache do NVD possui vers\xE3o ou formato incompat\xEDvel e foi ignorado.");
+        return;
+      }
+      entries.forEach((entry, cveId) => this.#entries.set(cveId, entry));
+    } catch (error) {
+      if (error.code !== "ENOENT") {
+        this.#warnings.push("N\xE3o foi poss\xEDvel ler o cache do NVD; as consultas continuar\xE3o sem ele.");
+      }
+    }
+  }
+  async #load() {
+    this.#loadPromise ??= this.#loadFromDisk();
+    await this.#loadPromise;
+  }
+  async get(cveId) {
+    await this.#load();
+    const entry = this.#entries.get(cveId);
+    if (!entry) return void 0;
+    if (entry.expiresAt <= this.#now()) {
+      this.#entries.delete(cveId);
+      return void 0;
+    }
+    return { ...entry.result, fromCache: true };
+  }
+  async set(result) {
+    if (result.status === "error") return;
+    await this.#load();
+    const entry = toStoredEntry(cleanCacheableResult(result), this.#now());
+    this.#entries.set(result.cveId, entry);
+    this.#writeQueue = this.#writeQueue.then(() => this.#persist()).catch(() => void 0);
+    await this.#writeQueue;
+  }
+  async #persist() {
+    try {
+      const directory = dirname(this.#filePath);
+      await mkdir(directory, { recursive: true });
+      const entries = Object.fromEntries(this.#entries);
+      const body = { schemaVersion: CACHE_SCHEMA_VERSION, entries };
+      const temporary = `${this.#filePath}.${process.pid}.${this.#writeCounter++}.tmp`;
+      await writeFile(temporary, JSON.stringify(body, null, 2), { encoding: "utf-8", mode: 384 });
+      await rename(temporary, this.#filePath);
+    } catch {
+      this.#warnings.push("N\xE3o foi poss\xEDvel gravar o cache do NVD; o scan continuar\xE1 normalmente.");
+    }
+  }
+  consumeWarnings() {
+    return this.#warnings.splice(0);
+  }
+};
+var createNvdCache = (options = {}) => new PersistentNvdCache(options);
+
+// src/scanner/nvd-normalizer.ts
+var isRecord2 = (value) => typeof value === "object" && value !== null;
+var asString = (value) => typeof value === "string" && value.trim() ? value.trim() : void 0;
+var asArray = (value) => Array.isArray(value) ? value : [];
+var pickBy = (condition, whenTrue, whenFalse) => condition ? whenTrue : whenFalse;
+var pickEnum = (value, accepted) => {
+  const candidate = asString(value)?.toUpperCase();
+  return candidate && accepted.includes(candidate) ? candidate : void 0;
+};
+var SEVERITIES = ["LOW", "MEDIUM", "HIGH", "CRITICAL"];
+var ATTACK_VECTORS = ["NETWORK", "ADJACENT", "LOCAL", "PHYSICAL"];
+var ATTACK_COMPLEXITIES = ["LOW", "MEDIUM", "HIGH"];
+var PRIVILEGES = ["NONE", "LOW", "HIGH"];
+var USER_INTERACTIONS = ["NONE", "REQUIRED", "PASSIVE", "ACTIVE"];
+var SCOPES = ["UNCHANGED", "CHANGED"];
+var IMPACTS = ["NONE", "LOW", "HIGH", "PARTIAL", "COMPLETE"];
+var METRIC_BUCKETS = [
+  { key: "cvssMetricV40", version: "4.0" },
+  { key: "cvssMetricV31", version: "3.1" },
+  { key: "cvssMetricV30", version: "3.0" },
+  { key: "cvssMetricV2", version: "2.0" }
+];
+var isNvdSource = (metric) => asString(metric.source)?.toLowerCase() === "nvd@nist.gov";
+var isPrimaryType = (metric) => asString(metric.type) === "Primary";
+var fallbackMetricPriority = (metric) => {
+  if (isPrimaryType(metric)) return 1;
+  if (isNvdSource(metric)) return 2;
+  return 3;
+};
+var metricPriority = (metric) => isNvdSource(metric) && isPrimaryType(metric) ? 0 : fallbackMetricPriority(metric);
+var isValidCvssScore = (score, version) => score >= 0 && score <= 10 && (score !== 0 || version === "2.0");
+var classifyHighOrCritical = (score, version) => version === "2.0" || score < 9 ? "HIGH" : "CRITICAL";
+var classifySeverity = (score, version) => {
+  if (score < 4) return "LOW";
+  if (score < 7) return "MEDIUM";
+  return classifyHighOrCritical(score, version);
+};
+var deriveSeverity = (score, version) => isValidCvssScore(score, version) ? classifySeverity(score, version) : void 0;
+var normalizeAttackVector = (value) => {
+  const normalized = asString(value)?.toUpperCase();
+  return pickEnum(normalized === "ADJACENT_NETWORK" ? "ADJACENT" : normalized, ATTACK_VECTORS);
+};
+var validatedCvssData = (metric, version) => {
+  if (!isRecord2(metric.cvssData)) return void 0;
+  const data = metric.cvssData;
+  const dataVersion = asString(data.version);
+  const vectorString = asString(data.vectorString);
+  const score = data.baseScore;
+  const scoreIsValidNumber = typeof score === "number" && Number.isFinite(score) && score >= 0 && score <= 10;
+  if (dataVersion !== version || !vectorString || !scoreIsValidNumber) return void 0;
+  return { data, vectorString, score };
+};
+var metricSeverity = (metric, data, score, version) => {
+  const wrapperSeverity = pickBy(version === "2.0", metric.baseSeverity, data.baseSeverity);
+  const rawSeverity = asString(wrapperSeverity);
+  return rawSeverity === void 0 ? deriveSeverity(score, version) : pickEnum(rawSeverity, SEVERITIES);
+};
+var metricUserInteraction = (metric, data, version) => {
+  if (version === "2.0" && typeof metric.userInteractionRequired === "boolean") {
+    return metric.userInteractionRequired ? "REQUIRED" : "NONE";
+  }
+  return pickEnum(data.userInteraction, USER_INTERACTIONS);
+};
+var metricType = (rawType) => rawType === "Primary" || rawType === "Secondary" ? rawType : void 0;
+var privilegesRequiredValue = (data, version) => version === "2.0" ? void 0 : pickEnum(data.privilegesRequired, PRIVILEGES);
+var scopeValue = (data, version) => version === "4.0" || version === "2.0" ? void 0 : pickEnum(data.scope, SCOPES);
+var computeMetricFields = (metric, data, score, version) => ({
+  severity: metricSeverity(metric, data, score, version),
+  source: asString(metric.source),
+  type: metricType(asString(metric.type)),
+  attackVector: normalizeAttackVector(pickBy(version === "2.0", data.accessVector, data.attackVector)),
+  attackComplexity: pickEnum(
+    pickBy(version === "2.0", data.accessComplexity, data.attackComplexity),
+    ATTACK_COMPLEXITIES
+  ),
+  privilegesRequired: privilegesRequiredValue(data, version),
+  userInteraction: metricUserInteraction(metric, data, version),
+  scope: scopeValue(data, version),
+  confidentialityImpact: pickEnum(
+    pickBy(version === "4.0", data.vulnConfidentialityImpact, data.confidentialityImpact),
+    IMPACTS
+  ),
+  integrityImpact: pickEnum(pickBy(version === "4.0", data.vulnIntegrityImpact, data.integrityImpact), IMPACTS),
+  availabilityImpact: pickEnum(
+    pickBy(version === "4.0", data.vulnAvailabilityImpact, data.availabilityImpact),
+    IMPACTS
+  )
+});
+var withOptionalFields = (base, fields) => ({
+  ...base,
+  ...fields.severity && { severity: fields.severity },
+  ...fields.source && { source: fields.source },
+  ...fields.type && { type: fields.type },
+  ...fields.attackVector && { attackVector: fields.attackVector },
+  ...fields.attackComplexity && { attackComplexity: fields.attackComplexity },
+  ...fields.privilegesRequired && { privilegesRequired: fields.privilegesRequired },
+  ...fields.userInteraction && { userInteraction: fields.userInteraction },
+  ...fields.scope && { scope: fields.scope },
+  ...fields.confidentialityImpact && { confidentialityImpact: fields.confidentialityImpact },
+  ...fields.integrityImpact && { integrityImpact: fields.integrityImpact },
+  ...fields.availabilityImpact && { availabilityImpact: fields.availabilityImpact }
+});
+var normalizeMetric = (metric, version) => {
+  const validated = validatedCvssData(metric, version);
+  if (!validated) return void 0;
+  const { data, vectorString, score } = validated;
+  const fields = computeMetricFields(metric, data, score, version);
+  return withOptionalFields({ score, version, vectorString }, fields);
+};
+var rankedCandidates = (metrics, key) => (
+  // codesentry-disable-next-line security/detect-object-injection -- key always comes from the hardcoded METRIC_BUCKETS list, never attacker input.
+  asArray(metrics[key]).filter(isRecord2).map((metric, index) => ({ metric, index, priority: metricPriority(metric) })).sort((a, b) => a.priority - b.priority || a.index - b.index).map(({ metric }) => metric)
+);
+var firstNormalizedCandidate = (candidates, version) => {
+  for (const metric of candidates) {
+    const normalized = normalizeMetric(metric, version);
+    if (normalized) return normalized;
+  }
+  return void 0;
+};
+var selectCvss = (metrics) => {
+  if (!isRecord2(metrics)) return void 0;
+  for (const bucket of METRIC_BUCKETS) {
+    const normalized = firstNormalizedCandidate(rankedCandidates(metrics, bucket.key), bucket.version);
+    if (normalized) return normalized;
+  }
+  return void 0;
+};
+var selectDescription = (descriptions) => {
+  const candidates = asArray(descriptions).filter(isRecord2);
+  const selected = candidates.find((item) => asString(item.lang)?.toLowerCase() === "en") ?? candidates.find((item) => asString(item.lang)?.toLowerCase().startsWith("en-")) ?? candidates[0];
+  if (!selected) return {};
+  return { description: asString(selected.value), descriptionLanguage: asString(selected.lang) };
+};
+var normalizeCwes = (weaknesses) => {
+  const values = asArray(weaknesses).filter(isRecord2).flatMap((weakness) => asArray(weakness.description)).filter(isRecord2).map((description) => asString(description.value)?.toUpperCase()).filter((value) => value !== void 0 && /^CWE-\d+$/.test(value));
+  return [...new Set(values)];
+};
+var normalizeReferences = (references) => {
+  const deduped = /* @__PURE__ */ new Map();
+  for (const reference of asArray(references).filter(isRecord2)) {
+    const url = asString(reference.url);
+    if (!url || deduped.has(url)) continue;
+    deduped.set(url, {
+      url,
+      source: asString(reference.source),
+      tags: asArray(reference.tags).map(asString).filter((tag) => tag !== void 0)
+    });
+  }
+  return [...deduped.values()];
+};
+var ssvcOption = (options, key) => {
+  for (const option of asArray(options).filter(isRecord2)) {
+    const value = asString(option[key]);
+    if (value) return value;
+  }
+  return void 0;
+};
+var normalizeKev = (cve) => {
+  const addedAt = asString(cve.cisaExploitAdd);
+  return addedAt ? {
+    addedAt,
+    actionDue: asString(cve.cisaActionDue),
+    requiredAction: asString(cve.cisaRequiredAction),
+    vulnerabilityName: asString(cve.cisaVulnerabilityName)
+  } : void 0;
+};
+var findSsvcMetric = (cve) => {
+  const metrics = isRecord2(cve.metrics) ? cve.metrics : void 0;
+  return asArray(metrics?.ssvcV203).filter(isRecord2).map((entry) => entry.ssvcData).find((data) => isRecord2(data) && asString(data.role) === "CISA Coordinator");
+};
+var normalizeSsvc = (ssvcMetric) => ssvcMetric ? {
+  exploitation: ssvcOption(ssvcMetric.options, "exploitation"),
+  automatable: ssvcOption(ssvcMetric.options, "automatable"),
+  technicalImpact: ssvcOption(ssvcMetric.options, "technicalImpact"),
+  timestamp: asString(ssvcMetric.timestamp)
+} : void 0;
+var normalizeCisa = (cve) => {
+  const kev = normalizeKev(cve);
+  const ssvc = normalizeSsvc(findSsvcMetric(cve));
+  return kev || ssvc ? { kev, ssvc } : void 0;
+};
+var normalizeNvdCve = (value, expectedCveId) => {
+  if (!isRecord2(value)) return void 0;
+  const id = asString(value.id)?.toUpperCase();
+  if (!id || id !== expectedCveId.toUpperCase()) return void 0;
+  return {
+    id,
+    vulnerabilityStatus: asString(value.vulnStatus),
+    ...selectDescription(value.descriptions),
+    published: asString(value.published),
+    lastModified: asString(value.lastModified),
+    cvss: selectCvss(value.metrics),
+    cwes: normalizeCwes(value.weaknesses),
+    references: normalizeReferences(value.references),
+    cisa: normalizeCisa(value)
+  };
+};
+
+// src/scanner/nvd-client.ts
+var NVD_API_URL = "https://services.nvd.nist.gov/rest/json/cves/2.0";
+var DEFAULT_TIMEOUT_MS = 1e4;
+var DEFAULT_MAX_ATTEMPTS = 3;
+var TRANSIENT_FAILURE_CIRCUIT_THRESHOLD = 3;
+var CVE_PATTERN = /^CVE-\d{4}-\d{4,}$/;
+var isRecord3 = (value) => typeof value === "object" && value !== null;
+var defaultSleep = (milliseconds) => new Promise((resolve3) => setTimeout(resolve3, milliseconds));
+var isAttemptFailure = (outcome) => "result" in outcome;
+var errorResult = (cveId, kind, httpStatus) => ({
+  status: "error",
+  cveId,
+  error: { kind, ...httpStatus === void 0 ? {} : { httpStatus } }
+});
+var parseRetryAfterDate = (value, now) => {
+  const date = Date.parse(value);
+  return Number.isNaN(date) ? void 0 : Math.max(0, date - now);
+};
+var retryAfterMilliseconds = (value, now) => {
+  if (!value) return void 0;
+  const seconds = Number(value);
+  if (Number.isFinite(seconds) && seconds >= 0) return seconds * 1e3;
+  return parseRetryAfterDate(value, now);
+};
+var extractCveEntries = (body) => {
+  if (!isRecord3(body) || !Array.isArray(body.vulnerabilities)) return void 0;
+  return body.vulnerabilities;
+};
+var buildRequestHeaders = (apiKey) => {
+  const headers = { Accept: "application/json" };
+  if (apiKey) headers.apiKey = apiKey;
+  return headers;
+};
+var errorKindForStatus = (status) => {
+  if (status === 429) return "rate-limit";
+  if (status >= 500) return "server";
+  return "http";
+};
+var isRetryableStatus = (status) => status === 408 || status === 429 || status >= 500;
+var isEmptyResultBody = (body, entries) => entries.length === 0 || isRecord3(body) && body.totalResults === 0;
+var outcomeFromEntries = (entries, cveId) => {
+  for (const entry of entries) {
+    if (!isRecord3(entry)) continue;
+    const normalized = normalizeNvdCve(entry.cve, cveId);
+    if (normalized) return { status: "found", cveId, data: normalized };
+  }
+  return { result: errorResult(cveId, "invalid-response"), retryable: false };
+};
+var parseSuccessBody = (body, cveId) => {
+  const entries = extractCveEntries(body);
+  if (!entries) return { result: errorResult(cveId, "invalid-response"), retryable: false };
+  if (isEmptyResultBody(body, entries)) return { status: "not-found", cveId };
+  return outcomeFromEntries(entries, cveId);
+};
+var isTimeoutError = (error, signal) => signal.aborted || error instanceof Error && error.name === "AbortError";
+var attemptCatchResult = (error, signal, cveId) => ({
+  result: errorResult(cveId, isTimeoutError(error, signal) ? "timeout" : "network"),
+  retryable: true
+});
+var DefaultNvdClient = class {
+  #fetch;
+  #apiKey;
+  #cache;
+  #timeoutMs;
+  #maxAttempts;
+  #minIntervalMs;
+  #sleep;
+  #now;
+  #random;
+  #lookups = /* @__PURE__ */ new Map();
+  #warnings = [];
+  #requestQueue = Promise.resolve();
+  #nextRequestAt = 0;
+  #circuitOpen = false;
+  #consecutiveTransientFailures = 0;
+  constructor(options) {
+    this.#fetch = options.fetchImpl ?? fetch;
+    this.#apiKey = options.apiKey?.trim() || void 0;
+    this.#cache = options.cache ?? createNvdCache();
+    this.#timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    this.#maxAttempts = options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;
+    this.#minIntervalMs = options.minIntervalMs ?? (this.#apiKey ? 610 : 6100);
+    this.#sleep = options.sleep ?? defaultSleep;
+    this.#now = options.now ?? Date.now;
+    this.#random = options.random ?? Math.random;
+  }
+  lookupCve(cveId) {
+    const normalizedId = cveId.trim().toUpperCase();
+    if (!CVE_PATTERN.test(normalizedId)) {
+      return Promise.resolve(errorResult(normalizedId, "invalid-response"));
+    }
+    const existing = this.#lookups.get(normalizedId);
+    if (existing) return existing;
+    const lookup = this.#lookup(normalizedId);
+    this.#lookups.set(normalizedId, lookup);
+    return lookup;
+  }
+  async #shortCircuit(cveId) {
+    const cached = await this.#cache.get(cveId);
+    if (cached) return cached;
+    if (this.#circuitOpen) return errorResult(cveId, "unavailable");
+    return void 0;
+  }
+  async #retryUntilSuccess(cveId) {
+    let finalFailure;
+    for (let attempt = 0; attempt < this.#maxAttempts; attempt += 1) {
+      const outcome = await this.#scheduleAttempt(cveId);
+      if (!isAttemptFailure(outcome)) {
+        this.#consecutiveTransientFailures = 0;
+        await this.#cache.set(outcome);
+        return { success: outcome };
+      }
+      finalFailure = outcome;
+      if (!outcome.retryable || attempt === this.#maxAttempts - 1) break;
+      const baseBackoff = Math.min(3e4, 1e3 * 2 ** attempt);
+      const jitteredBackoff = baseBackoff * (0.8 + this.#random() * 0.4);
+      await this.#sleep(Math.max(jitteredBackoff, outcome.retryAfterMs ?? 0));
+    }
+    return { failure: finalFailure ?? { result: errorResult(cveId, "unavailable"), retryable: false } };
+  }
+  #recordFailure(failure) {
+    if (failure.retryable) {
+      this.#consecutiveTransientFailures += 1;
+      if (failure.result.error.kind === "rate-limit" || this.#consecutiveTransientFailures >= TRANSIENT_FAILURE_CIRCUIT_THRESHOLD) {
+        this.#circuitOpen = true;
+      }
+    }
+    return failure.result;
+  }
+  async #lookup(cveId) {
+    const shortCircuited = await this.#shortCircuit(cveId);
+    if (shortCircuited) return shortCircuited;
+    const outcome = await this.#retryUntilSuccess(cveId);
+    return "success" in outcome ? outcome.success : this.#recordFailure(outcome.failure);
+  }
+  #scheduleAttempt(cveId) {
+    const scheduled = this.#requestQueue.then(async () => {
+      if (this.#circuitOpen) return errorResult(cveId, "unavailable");
+      const waitMs = Math.max(0, this.#nextRequestAt - this.#now());
+      if (waitMs > 0) await this.#sleep(waitMs);
+      this.#nextRequestAt = this.#now() + this.#minIntervalMs;
+      return this.#attempt(cveId);
+    }).catch(() => ({ result: errorResult(cveId, "unavailable"), retryable: true }));
+    this.#requestQueue = scheduled.then(
+      () => void 0,
+      () => void 0
+    );
+    return scheduled;
+  }
+  #failureForStatus(cveId, status, response) {
+    if (status === 401 || status === 403) {
+      this.#circuitOpen = true;
+      return { result: errorResult(cveId, "forbidden", status), retryable: false };
+    }
+    return {
+      result: errorResult(cveId, errorKindForStatus(status), status),
+      retryable: isRetryableStatus(status),
+      retryAfterMs: retryAfterMilliseconds(response.headers?.get("Retry-After"), this.#now())
+    };
+  }
+  async #safeFetch(url, headers, signal, cveId) {
+    try {
+      return await this.#fetch(url, { method: "GET", headers, signal });
+    } catch (error) {
+      return attemptCatchResult(error, signal, cveId);
+    }
+  }
+  async #parseBodySafely(response, cveId) {
+    try {
+      return parseSuccessBody(await response.json(), cveId);
+    } catch {
+      return { result: errorResult(cveId, "invalid-response"), retryable: false };
+    }
+  }
+  async #handleResponse(response, cveId) {
+    const status = response.status ?? 0;
+    if (status === 404) return { status: "not-found", cveId };
+    if (!response.ok) return this.#failureForStatus(cveId, status, response);
+    return this.#parseBodySafely(response, cveId);
+  }
+  async #handleFetchOutcome(fetched, cveId) {
+    if ("result" in fetched) return fetched;
+    return this.#handleResponse(fetched, cveId);
+  }
+  async #attempt(cveId) {
+    const url = new URL(NVD_API_URL);
+    url.searchParams.set("cveId", cveId);
+    const headers = buildRequestHeaders(this.#apiKey);
+    const signal = AbortSignal.timeout(this.#timeoutMs);
+    const fetched = await this.#safeFetch(url.toString(), headers, signal, cveId);
+    return this.#handleFetchOutcome(fetched, cveId);
+  }
+  consumeWarnings() {
+    return [...this.#warnings.splice(0), ...this.#cache.consumeWarnings()];
+  }
+};
+var createNvdClient = (options = {}) => new DefaultNvdClient(options);
+
+// src/scanner/nvd-enrichment.ts
+var CVE_PATTERN2 = /^CVE-\d{4}-\d{4,}$/;
+var extractCveAliases = (aliases) => {
+  const cves = (aliases ?? []).map((alias) => alias.trim().toUpperCase()).filter((alias) => CVE_PATTERN2.test(alias));
+  return [...new Set(cves)];
+};
+var coverageFrom = (results) => ({
+  total: results.length,
+  enriched: results.filter((result) => result.status === "found").length,
+  notFound: results.filter((result) => result.status === "not-found").length,
+  failed: results.filter((result) => result.status === "error").length,
+  cacheHits: results.filter((result) => result.status !== "error" && result.fromCache).length
+});
+var resolveLookups = async (lookups) => {
+  const resolved = /* @__PURE__ */ new Map();
+  let unexpectedFailure = false;
+  try {
+    await Promise.all(
+      [...lookups].map(async ([cveId, lookup]) => {
+        try {
+          resolved.set(cveId, await lookup);
+        } catch {
+          resolved.set(cveId, { status: "error", cveId, error: { kind: "unavailable" } });
+        }
+      })
+    );
+  } catch {
+    unexpectedFailure = true;
+  }
+  return { resolved, unexpectedFailure };
+};
+var enrichMatch = (match, cveIds, resolved) => ({
+  ...match,
+  cveIds,
+  nvd: cveIds.map((cveId) => resolved.get(cveId)).filter((item) => item !== void 0)
+});
+var enrichmentWarnings = (client, coverage, unexpectedFailure) => [
+  ...client.consumeWarnings(),
+  ...coverage.failed > 0 ? [`N\xE3o foi poss\xEDvel consultar o NVD para ${coverage.failed} CVE(s); os findings OSV foram preservados.`] : [],
+  ...unexpectedFailure ? [
+    "Falha interna inesperada ao consolidar as consultas do NVD; alguns CVEs podem n\xE3o ter sido enriquecidos."
+  ] : []
+];
+var enrichOsvMatchesWithNvd = async (matches, client) => {
+  const cveIdsByMatch = matches.map((match) => extractCveAliases(match.vuln.aliases));
+  const uniqueCveIds = [...new Set(cveIdsByMatch.flat())];
+  const lookups = new Map(
+    uniqueCveIds.map((cveId) => [cveId, client.lookupCve(cveId)])
+  );
+  let resolution;
+  try {
+    resolution = await resolveLookups(lookups);
+  } catch {
+    resolution = { resolved: /* @__PURE__ */ new Map(), unexpectedFailure: true };
+  }
+  const { resolved, unexpectedFailure } = resolution;
+  const results = uniqueCveIds.map((cveId) => resolved.get(cveId)).filter((item) => Boolean(item));
+  const coverage = coverageFrom(results);
+  return {
+    matches: matches.map(
+      (match, index) => (
+        // codesentry-disable-next-line security/detect-object-injection -- index originates from map over the same cveIdsByMatch array.
+        enrichMatch(match, cveIdsByMatch[index] ?? [], resolved)
+      )
+    ),
+    coverage,
+    warnings: enrichmentWarnings(client, coverage, unexpectedFailure)
+  };
+};
+
+// src/scanner/run-with-concurrency-limit.ts
+import pLimit from "p-limit";
+var runWithConcurrencyLimit = async (items, concurrency, task) => {
+  const limit = pLimit(concurrency);
+  return Promise.all(items.map((item) => limit(() => task(item))));
+};
+
+// src/scanner/osv-client.ts
+var OSV_BATCH_CHUNK_SIZE = 100;
+var OSV_DETAIL_CONCURRENCY = 10;
+var OSV_API_BASE = "https://api.osv.dev/v1";
+var SEVERITY_MAP = {
+  LOW: "low",
+  MODERATE: "medium",
+  HIGH: "high",
+  CRITICAL: "critical"
+};
+var chunk = (items, size) => {
+  const chunks = [];
+  for (let i = 0; i < items.length; i += size) {
+    chunks.push(items.slice(i, i + size));
+  }
+  return chunks;
+};
+var zipVulnIdsByPackage = (packages, body) => {
+  const vulnIdsByPackage = /* @__PURE__ */ new Map();
+  packages.forEach((pkg, index) => {
+    const ids = body.results?.[index]?.vulns?.map((v) => v.id);
+    if (ids?.length) {
+      vulnIdsByPackage.set(`${pkg.name}@${pkg.version}`, ids);
+    }
+  });
+  return vulnIdsByPackage;
+};
+var queryBatchChunk = async (packages, fetchImpl) => {
+  try {
+    const response = await fetchImpl(`${OSV_API_BASE}/querybatch`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        queries: packages.map((p) => ({
+          package: { name: p.name, ecosystem: "npm" },
+          version: p.version
+        }))
+      })
+    });
+    if (!response.ok) {
+      return { vulnIdsByPackage: /* @__PURE__ */ new Map(), checkedPackages: [], failedCount: packages.length };
+    }
+    const body = await response.json();
+    return { vulnIdsByPackage: zipVulnIdsByPackage(packages, body), checkedPackages: packages, failedCount: 0 };
+  } catch {
+    return { vulnIdsByPackage: /* @__PURE__ */ new Map(), checkedPackages: [], failedCount: packages.length };
+  }
+};
+var queryOsvBatch = async (packages, fetchImpl = fetch) => {
+  const vulnIdsByPackage = /* @__PURE__ */ new Map();
+  const checkedPackages = [];
+  let failedCount = 0;
+  try {
+    for (const packageChunk of chunk(packages, OSV_BATCH_CHUNK_SIZE)) {
+      const result = await queryBatchChunk(packageChunk, fetchImpl);
+      result.vulnIdsByPackage.forEach((ids, key) => vulnIdsByPackage.set(key, ids));
+      checkedPackages.push(...result.checkedPackages);
+      failedCount += result.failedCount;
+    }
+  } catch {
+    failedCount += packages.length - checkedPackages.length;
+  }
+  return {
+    vulnIdsByPackage,
+    checkedPackages,
+    warning: failedCount > 0 ? `N\xE3o foi poss\xEDvel consultar o OSV.dev para ${failedCount} pacote(s).` : void 0
+  };
+};
+var fetchOneVulnerabilityDetail = async (id, fetchImpl, detailsById) => {
+  try {
+    const response = await fetchImpl(`${OSV_API_BASE}/vulns/${id}`);
+    if (!response.ok) {
+      return false;
+    }
+    detailsById.set(id, await response.json());
+    return true;
+  } catch {
+    return false;
+  }
+};
+var fetchOsvVulnerabilityDetails = async (ids, fetchImpl = fetch) => {
+  const uniqueIds = [...new Set(ids)];
+  const detailsById = /* @__PURE__ */ new Map();
+  let results;
+  try {
+    results = await runWithConcurrencyLimit(
+      uniqueIds,
+      OSV_DETAIL_CONCURRENCY,
+      (id) => fetchOneVulnerabilityDetail(id, fetchImpl, detailsById)
+    );
+  } catch (error) {
+    throw error;
+  }
+  const failedCount = results.filter((ok) => !ok).length;
+  return {
+    detailsById,
+    warning: failedCount > 0 ? `N\xE3o foi poss\xEDvel obter detalhes do OSV.dev para ${failedCount} advisory(s).` : void 0
+  };
+};
+var isMatchingNpmPackage = (affected, packageName) => affected.package.ecosystem === "npm" && affected.package.name === packageName;
+var extractFixedVersions = (vuln, packageName) => {
+  const fixedVersions = (vuln.affected ?? []).filter((affected) => isMatchingNpmPackage(affected, packageName)).flatMap((affected) => affected.ranges ?? []).flatMap((range) => range.events).map((event) => event.fixed).filter((fixed) => Boolean(fixed));
+  return [...new Set(fixedVersions)];
+};
+var mapOsvSeverity = (vuln) => {
+  const severity = vuln.database_specific?.severity;
+  if (!severity) {
+    return "medium";
+  }
+  return SEVERITY_MAP[severity] ?? "medium";
+};
+
+// src/scanner/package-lock-parser.ts
+var NODE_MODULES_SEGMENT = "node_modules/";
+var isUnresolvableSource = (resolved) => resolved !== void 0 && (resolved.startsWith("file:") || resolved.startsWith("git"));
+var nameFromKey = (key) => {
+  const lastIndex = key.lastIndexOf(NODE_MODULES_SEGMENT);
+  return lastIndex === -1 ? void 0 : key.slice(lastIndex + NODE_MODULES_SEGMENT.length);
+};
+var toLockedPackage = (key, entry) => {
+  if (entry.link || !entry.version || isUnresolvableSource(entry.resolved)) {
+    return void 0;
+  }
+  const name = entry.name ?? nameFromKey(key);
+  return name ? { name, version: entry.version } : void 0;
+};
+var assertSupportedLockfileVersion = (lockfileVersion) => {
+  if (lockfileVersion !== 2 && lockfileVersion !== 3) {
+    throw new Error("lockfileVersion 1 n\xE3o \xE9 suportado \u2014 regenere o lockfile com npm 7+.");
+  }
+};
+var parsePackageLock = (rawJson) => {
+  const parsed = JSON.parse(rawJson);
+  assertSupportedLockfileVersion(parsed.lockfileVersion);
+  const deduped = /* @__PURE__ */ new Map();
+  Object.entries(parsed.packages ?? {}).filter(([key]) => key.includes(NODE_MODULES_SEGMENT)).forEach(([key, entry]) => {
+    const locked = toLockedPackage(key, entry);
+    if (locked) {
+      deduped.set(`${locked.name}@${locked.version}`, locked);
+    }
+  });
+  return [...deduped.values()];
+};
+
+// src/scanner/dependency-audit.ts
+var execFileAsync = promisify(execFile);
+var SEVERITY_MAP2 = {
+  info: "low",
+  low: "low",
+  moderate: "medium",
+  high: "high",
+  critical: "critical"
+};
+var NVD_SEVERITY_MAP = {
+  LOW: "low",
+  MEDIUM: "medium",
+  HIGH: "high",
+  CRITICAL: "critical"
+};
+var SEVERITY_WEIGHT = { low: 0, medium: 1, high: 2, critical: 3 };
+var CANONICAL_ADVISORY_PATTERN = /(?:CVE-\d{4}-\d{4,}|GHSA-[0-9A-Z]{4}-[0-9A-Z]{4}-[0-9A-Z]{4})/gi;
+var npmFixSuggestion = (vulnerability) => {
+  const { fixAvailable } = vulnerability;
+  if (fixAvailable === false) return "sem corre\xE7\xE3o dispon\xEDvel ainda";
+  if (fixAvailable === true)
+    return `atualize para uma vers\xE3o fora do intervalo vulner\xE1vel (${vulnerability.range})`;
+  return `atualize para ${fixAvailable.name}@${fixAvailable.version}`;
+};
+var canonicalIdsFrom = (...values) => [
+  ...new Set(
+    values.flatMap((value) => String(value ?? "").match(CANONICAL_ADVISORY_PATTERN) ?? []).map((id) => id.toUpperCase())
+  )
+];
+var npmAdvisoryTitle = (advisory) => {
+  if (typeof advisory === "object" && advisory.title) return advisory.title;
+  if (typeof advisory === "string") return `vulnerabilidade transitiva via ${advisory}`;
+  return 'ver "npm audit" para detalhes';
+};
+var npmFixedVersions = (fixAvailable) => typeof fixAvailable === "object" ? [fixAvailable.version] : [];
+var npmFinding = (vulnerability, advisory, ids) => {
+  const title = npmAdvisoryTitle(advisory);
+  return {
+    ruleId: "dependency-audit",
+    message: `Depend\xEAncia vulner\xE1vel: ${vulnerability.name} (${vulnerability.severity}) \u2014 ${title} \u2014 ${npmFixSuggestion(vulnerability)}`,
+    file: "package.json",
+    line: 1,
+    // codesentry-disable-next-line security/detect-object-injection -- vulnerability.severity is npm audit's own NpmAuditSeverity union, not attacker input; unknown values just look up as undefined.
+    severity: SEVERITY_MAP2[vulnerability.severity],
+    dependency: {
+      package: {
+        name: vulnerability.name,
+        installedVersion: "n\xE3o informada pelo npm audit",
+        fixedVersions: npmFixedVersions(vulnerability.fixAvailable)
+      },
+      advisory: { source: "npm", id: ids[0], aliases: ids.slice(1), summary: title }
+    }
+  };
+};
+var advisoryIds = (advisory) => typeof advisory === "object" ? canonicalIdsFrom(advisory.source, advisory.url, advisory.title) : canonicalIdsFrom(advisory);
+var advisoryIdentity = (advisory, ids) => {
+  if (ids.length) return `ids:${[...ids].sort().join(",")}`;
+  if (typeof advisory === "object")
+    return `fields:${advisory.source ?? ""}|${advisory.url ?? ""}|${advisory.title ?? ""}`;
+  return `via:${advisory ?? "unknown"}`;
+};
+var npmAdvisoryEntries = (vulnerability) => {
+  const structured = vulnerability.via.filter(
+    (advisory) => typeof advisory === "object"
+  );
+  const candidates = structured.length ? structured : [vulnerability.via.find((advisory) => typeof advisory === "string")];
+  const seen = /* @__PURE__ */ new Set();
+  return candidates.filter((advisory) => {
+    const identity = advisoryIdentity(advisory, advisoryIds(advisory));
+    if (seen.has(identity)) return false;
+    seen.add(identity);
+    return true;
+  });
+};
+var mapAuditReportToFindings = (report, osvIdsByPackage = /* @__PURE__ */ new Map()) => Object.values(report.vulnerabilities).flatMap((vulnerability) => {
+  const osvIds = osvIdsByPackage.get(vulnerability.name) ?? /* @__PURE__ */ new Set();
+  return npmAdvisoryEntries(vulnerability).flatMap((advisory) => {
+    const ids = advisoryIds(advisory);
+    return ids.some((id) => osvIds.has(id)) ? [] : [npmFinding(vulnerability, advisory, ids)];
+  });
+});
+var osvFixSuggestion = (fixedVersions) => fixedVersions.length ? `atualize para ${fixedVersions.join(" ou ")}` : "nenhuma vers\xE3o corrigida publicada pelo OSV.dev ainda";
+var normalizeOsvAliases = (aliases) => {
+  const normalized = /* @__PURE__ */ new Map();
+  for (const alias of aliases ?? []) {
+    const trimmed = alias.trim();
+    if (!trimmed) continue;
+    const value = extractCveAliases([trimmed])[0] ?? trimmed;
+    const key = value.toUpperCase();
+    if (!normalized.has(key)) normalized.set(key, value);
+  }
+  return [...normalized.values()];
+};
+var highestNvdSeverity = (results) => results.filter((result) => result.status === "found").map((result) => result.data.cvss?.severity).filter((severity) => severity !== void 0).map((severity) => NVD_SEVERITY_MAP[severity]).filter((severity) => severity !== void 0).sort((a, b) => SEVERITY_WEIGHT[b] - SEVERITY_WEIGHT[a])[0];
+var buildOsvFinding = (match) => ({
+  ruleId: "dependency-audit",
+  message: `OSV ${match.vuln.id}: ${match.pkg.name}@${match.pkg.version} \u2014 ${match.vuln.summary ?? "ver OSV.dev para detalhes"} \u2014 ${osvFixSuggestion(match.fixedVersions)}`,
+  file: "package-lock.json",
+  line: 1,
+  severity: highestNvdSeverity(match.nvd) ?? mapOsvSeverity(match.vuln),
+  dependency: {
+    package: {
+      name: match.pkg.name,
+      installedVersion: match.pkg.version,
+      fixedVersions: match.fixedVersions
+    },
+    advisory: {
+      source: "osv",
+      id: match.vuln.id,
+      aliases: normalizeOsvAliases(match.vuln.aliases),
+      summary: match.vuln.summary
+    },
+    nvd: match.nvd
+  }
+});
+var unenrichedMatch = (match) => ({
+  ...match,
+  cveIds: extractCveAliases(match.vuln.aliases),
+  nvd: []
+});
+var collectMatches = (lockedPackages, vulnIdsByPackage, detailsById) => lockedPackages.flatMap(
+  (pkg) => [...new Set(vulnIdsByPackage.get(`${pkg.name}@${pkg.version}`) ?? [])].map((id) => detailsById.get(id)).filter((vuln) => vuln !== void 0).map((vuln) => ({ pkg, vuln, fixedVersions: extractFixedVersions(vuln, pkg.name) }))
+);
+var errorMessage = (error) => error instanceof Error ? error.message : "erro desconhecido";
+var hasVulnerabilitiesRecord = (value) => typeof value === "object" && value !== null && typeof value.vulnerabilities === "object" && value.vulnerabilities !== null;
+var normalizeNpmAuditReport = (raw) => {
+  if (hasVulnerabilitiesRecord(raw)) return { report: { vulnerabilities: raw.vulnerabilities } };
+  const errorSummary = typeof raw === "object" && raw !== null && "error" in raw ? raw.error?.summary ?? "formato de resposta inesperado" : "formato de resposta inesperado";
+  return {
+    report: { vulnerabilities: {} },
+    warning: `"npm audit" n\xE3o retornou um relat\xF3rio v\xE1lido: ${errorSummary}.`
+  };
+};
+var collectOsvMatches = async (lockedPackages, fetchImpl) => {
+  try {
+    const {
+      vulnIdsByPackage,
+      checkedPackages,
+      warning: batchWarning
+    } = await queryOsvBatch(lockedPackages, fetchImpl);
+    const ids = [...new Set([...vulnIdsByPackage.values()].flat())];
+    const detailResult = ids.length ? await fetchOsvVulnerabilityDetails(ids, fetchImpl) : { detailsById: /* @__PURE__ */ new Map(), warning: void 0 };
+    return {
+      matches: collectMatches(lockedPackages, vulnIdsByPackage, detailResult.detailsById),
+      checkedPackages,
+      warnings: [batchWarning, detailResult.warning].filter(
+        (warning) => Boolean(warning)
+      )
+    };
+  } catch (error) {
+    return {
+      matches: [],
+      checkedPackages: [],
+      warnings: [`N\xE3o foi poss\xEDvel consultar o OSV.dev: ${errorMessage(error)}.`]
+    };
+  }
+};
+var runNpmAudit = async (targetDir) => {
+  let stdout;
+  try {
+    ({ stdout } = await execFileAsync("npm", ["audit", "--json"], {
+      cwd: targetDir,
+      maxBuffer: 10 * 1024 * 1024
+    }));
+  } catch (error) {
+    const stdoutFromError = error.stdout;
+    if (!stdoutFromError)
+      throw new Error(`N\xE3o foi poss\xEDvel executar "npm audit" em "${targetDir}".`, { cause: error });
+    stdout = stdoutFromError;
+  }
+  return JSON.parse(stdout);
+};
+var osvIdentityIndex = (matches) => {
+  const index = /* @__PURE__ */ new Map();
+  matches.forEach((match) => {
+    const ids = index.get(match.pkg.name) ?? /* @__PURE__ */ new Set();
+    [match.vuln.id, ...match.vuln.aliases ?? []].forEach((id) => ids.add(id.trim().toUpperCase()));
+    index.set(match.pkg.name, ids);
+  });
+  return index;
+};
+var emptyNvdCoverage = (total, failed) => ({
+  total,
+  enriched: 0,
+  notFound: 0,
+  failed,
+  cacheHits: 0
+});
+var resolveNvdClient = (options) => options.nvdClient ?? createNvdClient({
+  fetchImpl: options.fetchImpl,
+  apiKey: options.nvdApiKey ?? process.env.NVD_API_KEY,
+  cache: options.nvdCache ?? createNvdCache()
+});
+var enrichWithNvdIfEnabled = async (collected, options) => {
+  if (!options.nvdEnabled) {
+    return { matches: collected.matches.map(unenrichedMatch), nvd: false, warnings: [] };
+  }
+  const uniqueCveIds = new Set(collected.matches.flatMap((match) => extractCveAliases(match.vuln.aliases)));
+  if (uniqueCveIds.size === 0) {
+    return { matches: collected.matches.map(unenrichedMatch), nvd: emptyNvdCoverage(0, 0), warnings: [] };
+  }
+  try {
+    const enrichment = await enrichOsvMatchesWithNvd(collected.matches, resolveNvdClient(options));
+    return { matches: enrichment.matches, nvd: enrichment.coverage, warnings: enrichment.warnings };
+  } catch {
+    const total = uniqueCveIds.size;
+    return {
+      matches: collected.matches.map(unenrichedMatch),
+      nvd: emptyNvdCoverage(total, total),
+      warnings: [
+        `N\xE3o foi poss\xEDvel consultar o NVD para ${total} CVE(s); os findings OSV foram preservados.`
+      ]
+    };
+  }
+};
+var successfulLockfileAudit = (lockedPackages, collected, enrichment) => ({
+  findings: enrichment.matches.map(buildOsvFinding),
+  matches: collected.matches,
+  packagesAudited: lockedPackages.length,
+  osvChecked: { checked: collected.checkedPackages.length, total: lockedPackages.length },
+  osvCheckedPackages: collected.checkedPackages.map((pkg) => `${pkg.name}@${pkg.version}`).sort(),
+  nvd: enrichment.nvd,
+  warnings: [...collected.warnings, ...enrichment.warnings]
+});
+var auditPackagesFromLockfile = async (targetDir, options) => {
+  try {
+    const raw = await readFile2(join2(targetDir, "package-lock.json"), "utf-8");
+    const lockedPackages = parsePackageLock(raw);
+    const collected = await collectOsvMatches(lockedPackages, options.fetchImpl);
+    const enrichment = await enrichWithNvdIfEnabled(collected, options);
+    return successfulLockfileAudit(lockedPackages, collected, enrichment);
+  } catch (error) {
+    return {
+      findings: [],
+      matches: [],
+      packagesAudited: false,
+      nvd: options.nvdEnabled ? { total: 0, enriched: 0, notFound: 0, failed: 0, cacheHits: 0 } : false,
+      warnings: [`N\xE3o foi poss\xEDvel checar o OSV.dev: ${errorMessage(error)}.`]
+    };
+  }
+};
+var normalizeOptions = (optionsOrFetch) => typeof optionsOrFetch === "function" ? { fetchImpl: optionsOrFetch } : optionsOrFetch ?? {};
+var buildDependencyAuditResult = (startedAt, npmReport, npmWarning, osv) => {
+  const npmFindings = mapAuditReportToFindings(npmReport, osvIdentityIndex(osv.matches));
+  const warnings = [npmWarning, ...osv.warnings].filter((warning) => Boolean(warning));
+  return {
+    scannedFiles: 1,
+    findings: [...npmFindings, ...osv.findings],
+    durationMs: Date.now() - startedAt,
+    engines: {
+      dependencyAudit: osv.packagesAudited === false ? Object.keys(npmReport.vulnerabilities).length : osv.packagesAudited,
+      osv: osv.osvChecked,
+      nvd: osv.nvd
+    },
+    osvCheckedPackages: osv.osvCheckedPackages,
+    warnings: warnings.length ? warnings : void 0
+  };
+};
+var runDependencyAudit = async (targetDir, optionsOrFetch) => {
+  const startedAt = Date.now();
+  const supplied = normalizeOptions(optionsOrFetch);
+  const options = {
+    ...supplied,
+    fetchImpl: supplied.fetchImpl ?? fetch,
+    nvdEnabled: supplied.nvdEnabled ?? true
+  };
+  try {
+    const { report: npmReport, warning: npmWarning } = normalizeNpmAuditReport(
+      await (options.npmAuditRunner ?? runNpmAudit)(targetDir)
+    );
+    const osv = await auditPackagesFromLockfile(targetDir, options);
+    return buildDependencyAuditResult(startedAt, npmReport, npmWarning, osv);
+  } catch (error) {
+    throw new Error(`N\xE3o foi poss\xEDvel auditar depend\xEAncias em "${targetDir}".`, { cause: error });
+  }
+};
+
 // src/scanner/scanner.ts
-import { readFile } from "fs/promises";
+import { readFile as readFile3 } from "fs/promises";
 import { availableParallelism } from "os";
 
 // src/scanner/file-finder.ts
 import { readdir } from "fs/promises";
-import { join } from "path";
+import { join as join3 } from "path";
 
 // src/scanner/ignore-patterns.ts
-var ALWAYS_IGNORED_DIR_NAMES = ["node_modules", ".git", "dist", ".next"];
+var ALWAYS_IGNORED_DIR_NAMES = ["node_modules", ".git", "dist", ".next", ".angular"];
 var TEST_DIR_NAMES = ["tests", "test", "__tests__"];
 var TEST_FILE_GLOBS = ["*.spec.*", "*.test.*"];
 var TEST_FILE_NAME_PATTERN = /\.(spec|test)\.[^./]+$/;
@@ -345,11 +1694,17 @@ var isTestFileName = (fileName) => TEST_FILE_NAME_PATTERN.test(fileName);
 // src/scanner/file-finder.ts
 var SCANNABLE_EXTENSIONS = [".js", ".ts", ".jsx", ".tsx"];
 var isScannable = (fileName) => SCANNABLE_EXTENSIONS.some((ext) => fileName.endsWith(ext));
+var filesFromDirectory = async (currentDir, entry, includeTests) => {
+  return isIgnoredDirName(entry.name, includeTests) ? [] : walk(join3(currentDir, entry.name), includeTests);
+};
+var filesFromFile = (currentDir, entry, includeTests) => {
+  return entry.isFile() && isScannable(entry.name) && (includeTests || !isTestFileName(entry.name)) ? [join3(currentDir, entry.name)] : [];
+};
 var filesFromEntry = async (currentDir, entry, includeTests) => {
   if (entry.isDirectory()) {
-    return isIgnoredDirName(entry.name, includeTests) ? [] : walk(join(currentDir, entry.name), includeTests);
+    return filesFromDirectory(currentDir, entry, includeTests);
   }
-  return entry.isFile() && isScannable(entry.name) && (includeTests || !isTestFileName(entry.name)) ? [join(currentDir, entry.name)] : [];
+  return filesFromFile(currentDir, entry, includeTests);
 };
 var walk = async (currentDir, includeTests) => {
   try {
@@ -367,26 +1722,19 @@ var findFiles = async (targetDir, includeTests = false) => {
   }
 };
 
-// src/scanner/run-with-concurrency-limit.ts
-import pLimit from "p-limit";
-var runWithConcurrencyLimit = async (items, concurrency, task) => {
-  const limit = pLimit(concurrency);
-  return Promise.all(items.map((item) => limit(() => task(item))));
-};
-
 // src/scanner/scanner.ts
 var DEFAULT_SCAN_CONCURRENCY = Math.max(1, Math.min(8, availableParallelism()));
-var errorMessage = (error) => error instanceof Error ? error.message : "erro desconhecido";
+var errorMessage2 = (error) => error instanceof Error ? error.message : "erro desconhecido";
 var parseErrorFinding = (filePath, error) => ({
   ruleId: "parse-error",
-  message: `N\xE3o foi poss\xEDvel analisar este arquivo (erro de sintaxe): ${errorMessage(error)}`,
+  message: `N\xE3o foi poss\xEDvel analisar este arquivo (erro de sintaxe): ${errorMessage2(error)}`,
   file: filePath,
   line: 1,
   severity: "low"
 });
 var readFileContent = async (filePath) => {
   try {
-    return await readFile(filePath, "utf-8");
+    return await readFile3(filePath, "utf-8");
   } catch (error) {
     throw new Error(`N\xE3o foi poss\xEDvel ler o arquivo "${filePath}".`, { cause: error });
   }
@@ -433,14 +1781,14 @@ var runScan = async (targetDir, rules, concurrency = DEFAULT_SCAN_CONCURRENCY, i
 };
 
 // src/scanner/semgrep.ts
-import { execFile } from "child_process";
-import { delimiter, dirname as dirname2 } from "path";
-import { promisify } from "util";
+import { execFile as execFile2 } from "child_process";
+import { delimiter, dirname as dirname3 } from "path";
+import { promisify as promisify2 } from "util";
 
 // src/scanner/semgrep-runtime.ts
 import { existsSync, readFileSync } from "fs";
 import { createRequire } from "module";
-import { dirname, resolve } from "path";
+import { dirname as dirname2, resolve } from "path";
 var require2 = createRequire(import.meta.url);
 var packageForPlatform = (platform, architecture) => {
   if (platform === "linux" && architecture === "x64") {
@@ -452,6 +1800,7 @@ var packageForPlatform = (platform, architecture) => {
   return void 0;
 };
 var unsupportedRuntimeMessage = (platform, architecture) => `O runtime Semgrep embutido n\xE3o est\xE1 dispon\xEDvel para ${platform}-${architecture}. O CodeSentry oferece suporte a Linux x64 e Windows x64.`;
+var errorReason = (error) => error instanceof Error ? error.message : "erro desconhecido";
 var resolveBundledSemgrepRuntime = (platform = process.platform, architecture = process.arch, resolveManifestPath = (packageName) => require2.resolve(`${packageName}/runtime.json`)) => {
   const packageName = packageForPlatform(platform, architecture);
   if (!packageName) {
@@ -461,15 +1810,14 @@ var resolveBundledSemgrepRuntime = (platform = process.platform, architecture =
     const manifestPath = resolveManifestPath(packageName);
     const manifest = JSON.parse(readFileSync(manifestPath, "utf-8"));
     const runtime = {
-      semgrep: resolve(dirname(manifestPath), manifest.semgrep)
+      semgrep: resolve(dirname2(manifestPath), manifest.semgrep)
     };
     if (!existsSync(runtime.semgrep)) {
       throw new Error("artefatos do runtime ausentes");
     }
     return runtime;
   } catch (error) {
-    const reason = error instanceof Error ? error.message : "erro desconhecido";
-    throw new Error(`N\xE3o foi poss\xEDvel carregar o runtime Semgrep embutido: ${reason}`, { cause: error });
+    throw new Error(`N\xE3o foi poss\xEDvel carregar o runtime Semgrep embutido: ${errorReason(error)}`, { cause: error });
   }
 };
 
@@ -491,7 +1839,7 @@ var resolveBundledSemgrepRuleset = () => {
 };
 
 // src/scanner/semgrep.ts
-var execFileAsync = promisify(execFile);
+var execFileAsync2 = promisify2(execFile2);
 var SEMGREP_SEVERITIES = {
   INFO: "low",
   WARNING: "medium",
@@ -533,11 +1881,11 @@ var semgrepArgs = (ruleset, includeTests) => [
   "."
 ];
 var semgrepEnvironment = (runtime) => {
-  const semgrepDir = dirname2(runtime.semgrep);
+  const semgrepDir = dirname3(runtime.semgrep);
   const systemPathFallback = process.platform === "win32" ? "C:\\Windows\\System32;C:\\Windows" : "/usr/local/bin:/usr/bin:/bin";
   return {
     ...process.env,
-    PATH: `${semgrepDir}${delimiter}${dirname2(semgrepDir)}${delimiter}${process.env.PATH ?? ""}${delimiter}${systemPathFallback}`
+    PATH: `${semgrepDir}${delimiter}${dirname3(semgrepDir)}${delimiter}${process.env.PATH ?? ""}${delimiter}${systemPathFallback}`
   };
 };
 var executeSemgrep = async (targetDir, runtime, ruleset, execute, includeTests) => {
@@ -556,7 +1904,7 @@ var executeSemgrep = async (targetDir, runtime, ruleset, execute, includeTests)
     throw new Error("N\xE3o foi poss\xEDvel executar o Semgrep embutido.", { cause: error });
   }
 };
-var runBundledSemgrep = async (targetDir, runtime = resolveBundledSemgrepRuntime(), ruleset = resolveBundledSemgrepRuleset(), execute = execFileAsync, includeTests = false) => {
+var runBundledSemgrep = async (targetDir, runtime = resolveBundledSemgrepRuntime(), ruleset = resolveBundledSemgrepRuleset(), execute = execFileAsync2, includeTests = false) => {
   const startedAt = Date.now();
   try {
     const report = parseSemgrepReport(await executeSemgrep(targetDir, runtime, ruleset, execute, includeTests));
@@ -580,7 +1928,7 @@ var generateMarkdownReportFilename = (date = /* @__PURE__ */ new Date()) => {
 };
 
 // src/commands/scan/scan-runner.ts
-var errorMessage2 = (error) => error instanceof Error ? error.message : "erro desconhecido";
+var errorMessage3 = (error) => error instanceof Error ? error.message : "erro desconhecido";
 var reportScanFailure = (error) => {
   process.exitCode = 1;
   console.error(`Falha ao executar o scan: ${formatErrorChain(error)}`);
@@ -596,26 +1944,59 @@ var writeMarkdownReportIfNeeded = async (result, targetDir) => {
   if (result.findings.length <= MARKDOWN_REPORT_FINDINGS_THRESHOLD) {
     return;
   }
-  const filePath = join2(targetDir, generateMarkdownReportFilename());
+  const filePath = join4(targetDir, generateMarkdownReportFilename());
   try {
-    await writeFile(filePath, toMarkdownReport(result), "utf-8");
+    await writeFile2(filePath, toMarkdownReport(result), "utf-8");
     console.log(chalk2.cyan(`
 Relat\xF3rio detalhado gerado em: ${filePath}`));
   } catch (error) {
-    console.error(chalk2.red(`N\xE3o foi poss\xEDvel gerar o relat\xF3rio Markdown: ${errorMessage2(error)}`));
+    console.error(chalk2.red(`N\xE3o foi poss\xEDvel gerar o relat\xF3rio Markdown: ${errorMessage3(error)}`));
   }
 };
-var runScanEngines = async (path, rules, options) => {
+var runNativeAndSemgrep = async (path, rules, options) => {
   try {
     const includeTests = options.tests ?? false;
     const nativeResult = await runScan(path, rules, options.concurrency, includeTests);
-    if (!options.semgrep) {
-      return finalizeScanResult(nativeResult);
-    }
-    const semgrepResult = await runBundledSemgrep(path, void 0, options.config, void 0, includeTests);
-    return finalizeScanResult(mergeScanResults(nativeResult, semgrepResult));
+    return options.semgrep ? mergeScanResults(
+      nativeResult,
+      await runBundledSemgrep(path, void 0, options.config, void 0, includeTests)
+    ) : nativeResult;
+  } catch (error) {
+    throw new Error(`Falha durante a an\xE1lise: ${errorMessage3(error)}`, { cause: error });
+  }
+};
+var runOptionalDependencyAudit = async (path, merged, options) => {
+  try {
+    const auditResult = await runDependencyAudit(path, { nvdEnabled: options.nvd ?? true });
+    return finalizeScanResult(
+      {
+        ...merged,
+        findings: [...merged.findings, ...auditResult.findings],
+        durationMs: merged.durationMs + auditResult.durationMs,
+        warnings: [...merged.warnings ?? [], ...auditResult.warnings ?? []],
+        engines: {
+          ...merged.engines,
+          osv: auditResult.engines?.osv,
+          nvd: auditResult.engines?.nvd
+        },
+        osvCheckedPackages: auditResult.osvCheckedPackages
+      },
+      auditResult.engines?.dependencyAudit ?? false
+    );
   } catch (error) {
-    throw new Error(`Falha durante a an\xE1lise: ${errorMessage2(error)}`, { cause: error });
+    return finalizeScanResult({
+      ...merged,
+      warnings: [...merged.warnings ?? [], `Auditoria de depend\xEAncias falhou: ${errorMessage3(error)}.`],
+      engines: { ...merged.engines, nvd: false }
+    });
+  }
+};
+var runScanEngines = async (path, rules, options) => {
+  try {
+    const merged = await runNativeAndSemgrep(path, rules, options);
+    return options.deps ? runOptionalDependencyAudit(path, merged, options) : finalizeScanResult(merged);
+  } catch (error) {
+    throw error;
   }
 };
 var createScanTasks = (path, rules, taskTitle, options, onResult) => new Listr([
@@ -721,8 +2102,11 @@ var walkNestingBlock = (node, depth, results) => {
   checkDepth(newDepth, node.loc?.start.line, results);
   walkChildren(node, newDepth, results);
 };
+var selectNonFunctionWalker = (node) => {
+  return node.type === "IfStatement" ? walkIfChain : NESTING_TYPES.has(node.type) ? walkNestingBlock : walkChildren;
+};
 var selectWalker = (node) => {
-  return FUNCTION_TYPES.has(node.type) ? walkFunction : node.type === "IfStatement" ? walkIfChain : NESTING_TYPES.has(node.type) ? walkNestingBlock : walkChildren;
+  return FUNCTION_TYPES.has(node.type) ? walkFunction : selectNonFunctionWalker(node);
 };
 var walk2 = (node, depth, results) => {
   selectWalker(node)(node, depth, results);
@@ -756,56 +2140,6 @@ var registerDeepNestingCommand = (program) => {
   );
 };
 
-// src/scanner/dependency-audit.ts
-import { execFile as execFile2 } from "child_process";
-import { promisify as promisify2 } from "util";
-var execFileAsync2 = promisify2(execFile2);
-var SEVERITY_MAP = {
-  info: "low",
-  low: "low",
-  moderate: "medium",
-  high: "high",
-  critical: "critical"
-};
-var vulnerabilityTitle = (vulnerability) => {
-  const firstVia = vulnerability.via[0];
-  if (typeof firstVia === "object" && firstVia?.title) {
-    return firstVia.title;
-  }
-  return 'ver "npm audit" para detalhes';
-};
-var mapAuditReportToFindings = (report) => {
-  return Object.values(report.vulnerabilities).map((vulnerability) => ({
-    ruleId: "dependency-audit",
-    message: `Depend\xEAncia vulner\xE1vel: ${vulnerability.name} (${vulnerability.severity}) \u2014 ${vulnerabilityTitle(vulnerability)}`,
-    file: "package.json",
-    line: 1,
-    severity: SEVERITY_MAP[vulnerability.severity]
-  }));
-};
-var runDependencyAudit = async (targetDir) => {
-  const startedAt = Date.now();
-  let stdout;
-  try {
-    ({ stdout } = await execFileAsync2("npm", ["audit", "--json"], {
-      cwd: targetDir,
-      maxBuffer: 10 * 1024 * 1024
-    }));
-  } catch (error) {
-    const stdoutFromError = error.stdout;
-    if (!stdoutFromError) {
-      throw new Error(`N\xE3o foi poss\xEDvel executar "npm audit" em "${targetDir}".`, { cause: error });
-    }
-    stdout = stdoutFromError;
-  }
-  const report = JSON.parse(stdout);
-  return {
-    scannedFiles: 1,
-    findings: mapAuditReportToFindings(report),
-    durationMs: Date.now() - startedAt
-  };
-};
-
 // src/commands/dependency-audit/dependency-audit.command.ts
 var printAuditResult = (result, json) => {
   if (json) {
@@ -816,7 +2150,10 @@ var printAuditResult = (result, json) => {
 };
 var auditAndReport = async (path, options) => {
   try {
-    printAuditResult(await runDependencyAudit(path), options.json ?? false);
+    printAuditResult(
+      await runDependencyAudit(path, { nvdEnabled: options.nvd ?? true }),
+      options.json ?? false
+    );
   } catch (error) {
     const message = error instanceof Error ? error.message : "erro desconhecido";
     process.exitCode = 1;
@@ -824,9 +2161,7 @@ var auditAndReport = async (path, options) => {
   }
 };
 var registerDependencyAuditCommand = (program) => {
-  program.command("dependency-audit").description(
-    'Audita as depend\xEAncias do projeto contra vulnerabilidades conhecidas (via "npm audit"; requer npm no PATH e acesso \xE0 rede)'
-  ).argument("[path]", "diret\xF3rio do projeto a ser auditado", ".").option("--json", "exibe o resultado em JSON").action((path, options) => auditAndReport(path, options));
+  program.command("dependency-audit").description("Audita depend\xEAncias via npm audit e OSV.dev, com enriquecimento opcional do NVD").argument("[path]", "diret\xF3rio do projeto a ser auditado", ".").option("--json", "exibe o resultado em JSON").option("--no-nvd", "n\xE3o enriquece os resultados OSV com dados do NVD").action((path, options) => auditAndReport(path, options));
 };
 
 // src/rules/empty-catch.rule.ts
@@ -883,12 +2218,24 @@ var hasLimitOption = (options) => {
     return key?.type === "Identifier" && key.name === "limit";
   }) ?? false;
 };
+var getMemberCallParts = (node) => {
+  if (node.type !== "CallExpression") {
+    return { object: void 0, property: void 0, args: void 0 };
+  }
+  const callee = node.callee;
+  const args = node.arguments;
+  if (callee?.type !== "MemberExpression") {
+    return { object: void 0, property: void 0, args };
+  }
+  return {
+    object: callee.object,
+    property: callee.property,
+    args
+  };
+};
 var isBodyParserWithoutLimit = (node) => {
-  const callee = node.type === "CallExpression" ? node.callee : void 0;
-  const object = callee?.type === "MemberExpression" ? callee.object : void 0;
-  const property = callee?.type === "MemberExpression" ? callee.property : void 0;
+  const { object, property, args } = getMemberCallParts(node);
   const isBodyParserCall = object?.type === "Identifier" && BODY_PARSER_OBJECTS.has(object.name) && property?.type === "Identifier" && BODY_PARSER_METHODS.has(property.name);
-  const args = node.type === "CallExpression" ? node.arguments : void 0;
   return isBodyParserCall && !hasLimitOption(args?.[0]);
 };
 var findMissingBodyLimitLines = (filePath, content) => {
@@ -1133,9 +2480,10 @@ var createFunctionStatementCountRule = (config) => ({
 // src/rules/high-complexity.rule.ts
 var highComplexityRule = createFunctionStatementCountRule({
   id: "high-complexity",
-  description: "Detecta fun\xE7\xF5es com muitos condicionais/loops (complexidade alta)",
+  description: "Detecta fun\xE7\xF5es com muitos condicionais/loops/tern\xE1rios (complexidade alta)",
   statementTypes: /* @__PURE__ */ new Set([
     "IfStatement",
+    "ConditionalExpression",
     "ForStatement",
     "ForInStatement",
     "ForOfStatement",
@@ -1145,7 +2493,7 @@ var highComplexityRule = createFunctionStatementCountRule({
     "CatchClause"
   ]),
   maxCount: 5,
-  unitLabel: "condicionais/loops"
+  unitLabel: "condicionais/loops/tern\xE1rios"
 });
 
 // src/commands/high-complexity/high-complexity.command.ts
@@ -1216,13 +2564,16 @@ var isMathRandomCall = (node) => {
   return object?.type === "Identifier" && object.name === "Math" && property?.type === "Identifier" && property.name === "random";
 };
 var HASH_LIKE_NAME_PATTERN = /hash|md5|sha1/i;
+var memberPropertyName = (callee) => {
+  const property = callee.property;
+  return property?.type === "Identifier" ? property.name : void 0;
+};
 var calleeName = (callee) => {
   if (callee?.type === "Identifier") {
     return callee.name;
   }
   if (callee?.type === "MemberExpression") {
-    const property = callee.property;
-    return property?.type === "Identifier" ? property.name : void 0;
+    return memberPropertyName(callee);
   }
   return void 0;
 };
@@ -1408,12 +2759,24 @@ var objectHasProperty = (object, propertyName) => {
     return key?.type === "Identifier" && key.name === propertyName;
   }) ?? false;
 };
-var isJwtSignWithoutExpiration = (node) => {
+var getCallExpressionParts = (node) => {
   const callee = node.type === "CallExpression" ? node.callee : void 0;
+  const args = node.type === "CallExpression" ? node.arguments : void 0;
+  return { callee, args };
+};
+var getMemberExpressionParts = (callee) => {
   const object = callee?.type === "MemberExpression" ? callee.object : void 0;
   const property = callee?.type === "MemberExpression" ? callee.property : void 0;
+  return { object, property };
+};
+var getJwtSignCallParts = (node) => {
+  const { callee, args } = getCallExpressionParts(node);
+  const { object, property } = getMemberExpressionParts(callee);
+  return { object, property, args };
+};
+var isJwtSignWithoutExpiration = (node) => {
+  const { object, property, args } = getJwtSignCallParts(node);
   const isJwtSignCall = object?.type === "Identifier" && object.name === "jwt" && property?.type === "Identifier" && property.name === "sign";
-  const args = node.type === "CallExpression" ? node.arguments : void 0;
   const payload = args?.[0];
   const options = args?.[2];
   const hasExpInPayload = objectHasProperty(payload, "exp");
@@ -1686,12 +3049,26 @@ var isPermissiveCorsCall = (node) => {
   const args = node.arguments;
   return (args?.length ?? 0) === 0 || isWildcardOriginOption(args?.[0]);
 };
+var callExpressionParts = (node) => {
+  if (node.type !== "CallExpression") {
+    return void 0;
+  }
+  return {
+    callee: node.callee,
+    args: node.arguments
+  };
+};
+var memberCalleeProperty = (callee) => {
+  if (callee?.type !== "MemberExpression") {
+    return void 0;
+  }
+  return callee.property;
+};
 var isWildcardOriginHeader = (node) => {
-  const callee = node.type === "CallExpression" ? node.callee : void 0;
-  const property = callee?.type === "MemberExpression" ? callee.property : void 0;
-  const args = node.type === "CallExpression" ? node.arguments : void 0;
-  const headerName = args?.[0];
-  const headerValue = args?.[1];
+  const parts = callExpressionParts(node);
+  const property = memberCalleeProperty(parts?.callee);
+  const headerName = parts?.args?.[0];
+  const headerValue = parts?.args?.[1];
   return property?.type === "Identifier" && HEADER_SETTER_METHODS.has(property.name) && headerName?.type === "StringLiteral" && headerName.value === "Access-Control-Allow-Origin" && headerValue?.type === "StringLiteral" && headerValue.value === "*";
 };
 var findPermissiveCorsLines = (filePath, content) => {
@@ -1845,13 +3222,26 @@ var awaitNoTryCatchRule = {
 
 // src/rules/floating-promise.rule.ts
 var PROMISE_STATIC_METHODS = /* @__PURE__ */ new Set(["all", "race", "allSettled", "any"]);
-var asyncFunctionName = (node) => {
+var functionDeclarationName = (node) => {
   const declarationId = node.type === "FunctionDeclaration" ? node.id : void 0;
-  const declarationName = declarationId?.type === "Identifier" ? declarationId.name : void 0;
-  const id = node.type === "VariableDeclarator" ? node.id : void 0;
-  const init = node.type === "VariableDeclarator" ? node.init : void 0;
-  const hasAsyncFunctionValue = (init?.type === "ArrowFunctionExpression" || init?.type === "FunctionExpression") && init.async;
-  return declarationName ?? (id?.type === "Identifier" && hasAsyncFunctionValue ? id.name : void 0);
+  return declarationId?.type === "Identifier" ? declarationId.name : void 0;
+};
+var isAsyncFunctionValue = (init) => {
+  return (init?.type === "ArrowFunctionExpression" || init?.type === "FunctionExpression") && init.async;
+};
+var asyncVariableDeclaratorId = (node) => {
+  return node.type === "VariableDeclarator" ? node.id : void 0;
+};
+var asyncVariableDeclaratorInit = (node) => {
+  return node.type === "VariableDeclarator" ? node.init : void 0;
+};
+var asyncVariableDeclaratorName = (node) => {
+  const id = asyncVariableDeclaratorId(node);
+  const init = asyncVariableDeclaratorInit(node);
+  return id?.type === "Identifier" && isAsyncFunctionValue(init) ? id.name : void 0;
+};
+var asyncFunctionName = (node) => {
+  return functionDeclarationName(node) ?? asyncVariableDeclaratorName(node);
 };
 var collectAsyncFunctionNames = (sourceFile) => {
   const names = /* @__PURE__ */ new Set();
@@ -1863,16 +3253,20 @@ var collectAsyncFunctionNames = (sourceFile) => {
   });
   return names;
 };
+var isKnownFunctionCall = (callee, asyncFunctionNames) => {
+  return callee.type === "Identifier" && (callee.name === "fetch" || asyncFunctionNames.has(callee.name));
+};
+var isPromiseStaticMethodCall = (callee) => {
+  const object = callee.type === "MemberExpression" ? callee.object : void 0;
+  const property = callee.type === "MemberExpression" ? callee.property : void 0;
+  return object?.type === "Identifier" && object.name === "Promise" && property?.type === "Identifier" && PROMISE_STATIC_METHODS.has(property.name);
+};
 var isKnownPromiseReturningCall = (call, asyncFunctionNames) => {
   const callee = call.callee;
   if (!callee) {
     return false;
   }
-  const isKnownFunction = callee.type === "Identifier" && (callee.name === "fetch" || asyncFunctionNames.has(callee.name));
-  const object = callee.type === "MemberExpression" ? callee.object : void 0;
-  const property = callee.type === "MemberExpression" ? callee.property : void 0;
-  const isPromiseStaticMethod = object?.type === "Identifier" && object.name === "Promise" && property?.type === "Identifier" && PROMISE_STATIC_METHODS.has(property.name);
-  return isKnownFunction || isPromiseStaticMethod;
+  return isKnownFunctionCall(callee, asyncFunctionNames) || isPromiseStaticMethodCall(callee);
 };
 var findFloatingPromiseLines = (filePath, content) => {
   const lines = /* @__PURE__ */ new Set();
@@ -1902,7 +3296,7 @@ var floatingPromiseRule = {
 };
 
 // src/rules/promise-no-catch.rule.ts
-var memberPropertyName = (member) => {
+var memberPropertyName2 = (member) => {
   const property = member.property;
   return property?.type === "Identifier" ? property.name : void 0;
 };
@@ -1915,7 +3309,11 @@ var isThenCall = (node) => {
   }
   const callee = node.callee;
   const args = node.arguments;
-  return callee?.type === "MemberExpression" && memberPropertyName(callee) === "then" && (args?.length ?? 0) < 2;
+  return callee?.type === "MemberExpression" && memberPropertyName2(callee) === "then" && (args?.length ?? 0) < 2;
+};
+var chainMethodName = (currentCall, member, nextCall) => {
+  const isChainMember = member !== void 0 && member.type === "MemberExpression" && member.object === currentCall && isCallOf(nextCall, member);
+  return isChainMember ? memberPropertyName2(member) : void 0;
 };
 var chainReachesCatch = (thenCall, ancestors) => {
   let currentCall = thenCall;
@@ -1923,8 +3321,7 @@ var chainReachesCatch = (thenCall, ancestors) => {
   while (i < ancestors.length) {
     const member = ancestors.at(i);
     const nextCall = ancestors.at(i + 1);
-    const isChainMember = member !== void 0 && member.type === "MemberExpression" && member.object === currentCall && isCallOf(nextCall, member);
-    const methodName = isChainMember ? memberPropertyName(member) : void 0;
+    const methodName = chainMethodName(currentCall, member, nextCall);
     const continuesChain = methodName === "then" || methodName === "finally";
     if (methodName === "catch") {
       return true;
@@ -2166,10 +3563,10 @@ var tooManyForLoopsRule = createFunctionStatementCountRule({
 // src/rules/too-many-ifs.rule.ts
 var tooManyIfsRule = createFunctionStatementCountRule({
   id: "too-many-ifs",
-  description: 'Detecta fun\xE7\xF5es com muitos "if" (incluindo "else if")',
-  statementTypes: /* @__PURE__ */ new Set(["IfStatement"]),
+  description: 'Detecta fun\xE7\xF5es com muitos "if" ou tern\xE1rios (incluindo "else if")',
+  statementTypes: /* @__PURE__ */ new Set(["IfStatement", "ConditionalExpression"]),
   maxCount: 2,
-  unitLabel: "declara\xE7\xF5es if (incluindo else if)"
+  unitLabel: "declara\xE7\xF5es if e express\xF5es tern\xE1rias (incluindo else if)"
 });
 
 // src/rules/too-many-switch-cases.rule.ts
@@ -2308,12 +3705,25 @@ var weakCipherModeRule = {
 
 // src/rules/weak-hash-algorithm.rule.ts
 var WEAK_ALGORITHMS = /^(md5|sha1)$/i;
+var getCallExpressionCallee = (node) => {
+  return node.type === "CallExpression" ? node.callee : void 0;
+};
+var getCallExpressionArgs = (node) => {
+  return node.type === "CallExpression" ? node.arguments : void 0;
+};
+var getCreateHashProperty = (callee) => {
+  return callee?.type === "MemberExpression" ? callee.property : void 0;
+};
+var isCreateHashProperty = (property) => {
+  return property?.type === "Identifier" && property.name === "createHash";
+};
+var isWeakAlgorithmLiteral = (algorithm) => {
+  return algorithm?.type === "StringLiteral" && WEAK_ALGORITHMS.test(algorithm.value);
+};
 var isWeakCreateHashCall = (node) => {
-  const callee = node.type === "CallExpression" ? node.callee : void 0;
-  const property = callee?.type === "MemberExpression" ? callee.property : void 0;
-  const args = node.type === "CallExpression" ? node.arguments : void 0;
-  const algorithm = args?.[0];
-  return property?.type === "Identifier" && property.name === "createHash" && algorithm?.type === "StringLiteral" && WEAK_ALGORITHMS.test(algorithm.value);
+  const property = getCreateHashProperty(getCallExpressionCallee(node));
+  const algorithm = getCallExpressionArgs(node)?.[0];
+  return isCreateHashProperty(property) && isWeakAlgorithmLiteral(algorithm);
 };
 var findWeakHashLines = (filePath, content) => {
   const lines = /* @__PURE__ */ new Set();
@@ -2548,8 +3958,11 @@ var parseLocalSemgrepConfig = (value) => {
 };
 var registerScanCommand = (program) => {
   withScanOptions(
-    program.command("scan").description("Analisa um diret\xF3rio em busca de vulnerabilidades e problemas de qualidade").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--concurrency <n>", "limita arquivos processados em paralelo", parseConcurrency).option("--config <file>", "usa um ruleset Semgrep YAML local", parseLocalSemgrepConfig)
-  ).action(
+    program.command("scan").description("Analisa um diret\xF3rio em busca de vulnerabilidades e problemas de qualidade").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--concurrency <n>", "limita arquivos processados em paralelo", parseConcurrency).option("--config <file>", "usa um ruleset Semgrep YAML local", parseLocalSemgrepConfig).option(
+      "--no-deps",
+      "n\xE3o inclui a auditoria de depend\xEAncias (npm audit + OSV.dev + NVD) neste scan \u2014 permite rodar offline"
+    )
+  ).option("--no-nvd", "n\xE3o enriquece os resultados OSV com dados do NVD").action(
     (path, options) => scanAndReport(path, allRules, "Scanning files...", { ...options, semgrep: true })
   );
 };
@@ -2649,6 +4062,118 @@ var registerUnsafeSqlCommand = (program) => {
   );
 };
 
+// src/engines/engine-metadata.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { createRequire as createRequire4 } from "module";
+var require5 = createRequire4(import.meta.url);
+var packageForPlatform2 = (platform, architecture) => {
+  if (platform === "linux" && architecture === "x64") {
+    return "codesentry-semgrep-linux-x64";
+  }
+  if (platform === "win32" && architecture === "x64") {
+    return "codesentry-semgrep-win32-x64";
+  }
+  return void 0;
+};
+var unsupportedRuntimeMessage2 = (platform, architecture) => `O runtime Semgrep embutido n\xE3o est\xE1 dispon\xEDvel para ${platform}-${architecture}. O CodeSentry oferece suporte a Linux x64 e Windows x64.`;
+var readJsonFile = (path) => {
+  return JSON.parse(readFileSync2(path, "utf-8"));
+};
+var nonEmptyString = (value) => typeof value === "string" && value.length > 0;
+var errorReason2 = (error) => error instanceof Error ? error.message : "erro desconhecido";
+var validRuntimeLock = (lock) => lock.schemaVersion === 1 && nonEmptyString(lock.semgrepVersion) && nonEmptyString(lock.pythonVersion) && /^[a-f0-9]{64}$/i.test(lock.runtimeSha256);
+var validRulesetLock = (lock) => lock.schemaVersion === 1 && nonEmptyString(lock.packageVersion) && nonEmptyString(lock.ruleset) && nonEmptyString(lock.source) && /^[a-f0-9]{64}$/i.test(lock.sha256) && nonEmptyString(lock.capturedAt) && !Number.isNaN(Date.parse(lock.capturedAt)) && (lock.upstreamRevision === void 0 || nonEmptyString(lock.upstreamRevision));
+var loadBundledSemgrepRuntimeMetadata = (platform = process.platform, architecture = process.arch, resolveLockPath = (packageName) => require5.resolve(`${packageName}/runtime.lock.json`)) => {
+  const packageName = packageForPlatform2(platform, architecture);
+  if (!packageName) {
+    throw new Error(unsupportedRuntimeMessage2(platform, architecture));
+  }
+  try {
+    const lock = readJsonFile(resolveLockPath(packageName));
+    if (!validRuntimeLock(lock)) {
+      throw new Error("manifesto de vers\xE3o inv\xE1lido");
+    }
+    return {
+      packageName,
+      semgrepVersion: lock.semgrepVersion,
+      pythonVersion: lock.pythonVersion,
+      runtimeSha256: lock.runtimeSha256
+    };
+  } catch (error) {
+    throw new Error(`N\xE3o foi poss\xEDvel carregar os metadados do runtime Semgrep embutido: ${errorReason2(error)}`, {
+      cause: error
+    });
+  }
+};
+var loadBundledOwaspRulesetMetadata = (resolveLockPath = () => require5.resolve("codesentry-semgrep-rules/rules/ruleset.lock.json")) => {
+  try {
+    const lock = readJsonFile(resolveLockPath());
+    if (!validRulesetLock(lock)) {
+      throw new Error("manifesto de vers\xE3o inv\xE1lido");
+    }
+    return {
+      packageVersion: lock.packageVersion,
+      ruleset: lock.ruleset,
+      source: lock.source,
+      sha256: lock.sha256,
+      capturedAt: lock.capturedAt,
+      ...lock.upstreamRevision ? { upstreamRevision: lock.upstreamRevision } : {}
+    };
+  } catch (error) {
+    throw new Error(`N\xE3o foi poss\xEDvel carregar os metadados do ruleset OWASP embutido: ${errorReason2(error)}`, {
+      cause: error
+    });
+  }
+};
+var loadEngineMetadata = () => ({
+  semgrep: loadBundledSemgrepRuntimeMetadata(),
+  owaspRuleset: loadBundledOwaspRulesetMetadata()
+});
+
+// src/commands/version/version.command.ts
+var buildVersionReport = (codesentryVersion, engines) => ({
+  codesentryVersion,
+  engines
+});
+var formatEngineVersions = (report) => {
+  const { semgrep, owaspRuleset } = report.engines;
+  return [
+    `CodeSentry: ${report.codesentryVersion}`,
+    "",
+    "Runtime Semgrep CE",
+    `  Vers\xE3o: ${semgrep.semgrepVersion}`,
+    `  Python: ${semgrep.pythonVersion}`,
+    `  Pacote: ${semgrep.packageName}`,
+    `  SHA-256: ${semgrep.runtimeSha256}`,
+    "",
+    "Ruleset OWASP",
+    `  Snapshot: ${owaspRuleset.ruleset}`,
+    `  Vers\xE3o do pacote: ${owaspRuleset.packageVersion}`,
+    `  Origem: ${owaspRuleset.source}`,
+    `  Capturado em: ${owaspRuleset.capturedAt}`,
+    ...owaspRuleset.upstreamRevision ? [`  Revis\xE3o upstream: ${owaspRuleset.upstreamRevision}`] : [],
+    `  SHA-256: ${owaspRuleset.sha256}`
+  ].join("\n");
+};
+var errorReason3 = (error) => error instanceof Error ? error.message : "erro desconhecido";
+var formatVersionOutput = (options, report) => options.json ? JSON.stringify(report, null, 2) : formatEngineVersions(report);
+var registerVersionCommand = (program, readPackageVersion2, readEngineMetadata = loadEngineMetadata) => {
+  program.command("version").description("Exibe a vers\xE3o do CodeSentry e dos motores embutidos").option("--engines", "inclui vers\xF5es e proveni\xEAncia do Semgrep e ruleset OWASP").option("--json", "emite o relat\xF3rio de vers\xF5es em JSON").action((options) => {
+    const codesentryVersion = readPackageVersion2();
+    if (!options.engines && !options.json) {
+      console.log(`CodeSentry: ${codesentryVersion}`);
+      return;
+    }
+    try {
+      const report = buildVersionReport(codesentryVersion, readEngineMetadata());
+      console.log(formatVersionOutput(options, report));
+    } catch (error) {
+      process.exitCode = 1;
+      console.error(`N\xE3o foi poss\xEDvel auditar as vers\xF5es dos motores: ${errorReason3(error)}`);
+    }
+  });
+};
+
 // src/commands/weak-cipher-mode/weak-cipher-mode.command.ts
 var registerWeakCipherModeCommand = (program) => {
   withScanOptions(
@@ -2744,16 +4269,17 @@ var registerSecurityCommands = (program) => {
   registerWeakCipherModeCommand(program);
   registerHardcodedAuthorizationValueCommand(program);
 };
-var require5 = createRequire4(import.meta.url);
+var require6 = createRequire5(import.meta.url);
 var readPackageVersion = () => {
-  const packageJsonPath = require5.resolve("../package.json");
-  const { version } = JSON.parse(readFileSync2(packageJsonPath, "utf-8"));
+  const packageJsonPath = require6.resolve("../package.json");
+  const { version } = JSON.parse(readFileSync3(packageJsonPath, "utf-8"));
   return version;
 };
 var createCli = () => {
   printBanner();
   const program = new Command().name("codesentry").description("CLI de verifica\xE7\xE3o de vulnerabilidades e qualidade de c\xF3digo").version(readPackageVersion()).helpCommand(false);
   registerInitCommand(program);
+  registerVersionCommand(program, readPackageVersion);
   registerAnalysisCommands(program);
   registerQualityCommands(program);
   registerSecurityCommands(program);