codesentry 0.2.1 → 0.3.0

package/dist/index.js

@@ -150,8 +150,8 @@ var commandInjectionRule = {
 var withScanOptions = (command) => command.option("--json", "exibe o resultado em JSON").option("--tests", "inclui arquivos de teste na an\xE1lise (por padr\xE3o s\xE3o ignorados)");
 
 // src/commands/scan/scan-runner.ts
-import { writeFile } from "fs/promises";
-import { join as join3 } from "path";
+import { writeFile as writeFile2 } from "fs/promises";
+import { join as join4 } from "path";
 import chalk2 from "chalk";
 import { Listr } from "listr2";
 
@@ -186,9 +186,12 @@ var mergeScanResults = (nativeResult, semgrepResult) => ({
   findings: [...nativeResult.findings, ...semgrepResult.findings],
   durationMs: nativeResult.durationMs + semgrepResult.durationMs,
   engines: {
+    ...nativeResult.engines,
+    ...semgrepResult.engines,
     codesentry: nativeResult.engines?.codesentry ?? nativeResult.scannedFiles,
     semgrep: semgrepResult.engines?.semgrep ?? semgrepResult.scannedFiles
-  }
+  },
+  warnings: [...nativeResult.warnings ?? [], ...semgrepResult.warnings ?? []]
 });
 var finalizeScanResult = (result, dependencyAuditCoverage2 = false) => ({
   ...result,
@@ -204,9 +207,14 @@ var SEVERITY_COLOR = {
   critical: (text2) => chalk.bgRed.white(text2)
 };
 var semgrepCoverage = (result) => result.engines?.semgrep === void 0 ? void 0 : `CodeSentry: ${result.engines.codesentry ?? result.scannedFiles} JS/TS; Semgrep: ${result.engines.semgrep} arquivo(s)`;
-var dependencyAuditCoverage = (result) => typeof result.engines?.dependencyAudit === "number" ? `Dependency audit: ${result.engines.dependencyAudit} pacote(s) via npm audit` : void 0;
+var dependencyAuditCoverage = (result) => typeof result.engines?.dependencyAudit === "number" ? `Dependency audit: ${result.engines.dependencyAudit} pacote(s) considerado(s)` : void 0;
 var osvCoverage = (result) => result.engines?.osv ? `OSV.dev: ${result.engines.osv.checked}/${result.engines.osv.total} verificados` : void 0;
-var coverageParts = (result) => [semgrepCoverage(result), dependencyAuditCoverage(result), osvCoverage(result)].filter(
+var nvdCoverage = (result) => {
+  const nvd = result.engines?.nvd;
+  if (!nvd || nvd.total === 0) return void 0;
+  return `NVD: ${nvd.total} CVE(s); ${nvd.enriched} enriquecido(s); ${nvd.notFound} sem resultado; ${nvd.failed} falha(s); ${nvd.cacheHits} cache hit(s)`;
+};
+var coverageParts = (result) => [semgrepCoverage(result), dependencyAuditCoverage(result), osvCoverage(result), nvdCoverage(result)].filter(
   (part) => part !== void 0
 );
 var coverageText = (result) => {
@@ -225,9 +233,9 @@ var printCleanReport = (result, coverage) => {
   console.log(chalk.green(`Nenhum problema encontrado (${result.scannedFiles} arquivos analisados).${coverage}`));
   printNotes(result);
 };
-var findingsTable = (result) => {
+var findingsTable = (findings) => {
   const table = new Table({ head: ["Severity", "Rule", "File", "Line", "Message"] });
-  for (const finding of result.findings) {
+  for (const finding of findings) {
     const colorize = SEVERITY_COLOR[finding.severity];
     table.push([
       colorize(finding.severity),
@@ -239,8 +247,132 @@ var findingsTable = (result) => {
   }
   return table;
 };
+var titleCaseMetric = (value) => value.toLowerCase().split("_").map((part) => part.charAt(0).toUpperCase() + part.slice(1)).join(" ");
+var labeledLines = (pairs, format) => pairs.filter((pair) => Boolean(pair[1])).map(([label, value]) => format(label, value));
+var cvssMetricLines = (cvss) => labeledLines(
+  [
+    ["Vetor de ataque", cvss.attackVector],
+    ["Complexidade", cvss.attackComplexity],
+    ["Privil\xE9gios necess\xE1rios", cvss.privilegesRequired],
+    ["Intera\xE7\xE3o do usu\xE1rio", cvss.userInteraction],
+    ["Escopo", cvss.scope],
+    ["Confidentiality", cvss.confidentialityImpact],
+    ["Integrity", cvss.integrityImpact],
+    ["Availability", cvss.availabilityImpact]
+  ],
+  (label, value) => `  ${label}: ${titleCaseMetric(value)}`
+);
+var cvssLines = (cvss) => [
+  `  Severidade: ${cvss.severity ?? "n\xE3o informada"}`,
+  `  CVSS: ${cvss.score}`,
+  `  Vers\xE3o CVSS: ${cvss.version}`,
+  `  Vetor: ${cvss.vectorString}`,
+  ...cvssMetricLines(cvss)
+];
+var cvssBlock = (data) => data.cvss ? cvssLines(data.cvss) : ["  CVSS: registro encontrado, ainda sem m\xE9trica CVSS"];
+var metadataLines = (data, summary) => labeledLines(
+  [
+    ["CWE", data.cwes.join(", ") || void 0],
+    ["Descri\xE7\xE3o NVD", data.description !== summary ? data.description : void 0],
+    ["Publicado", data.published],
+    ["Modificado", data.lastModified]
+  ],
+  (label, value) => `  ${label}: ${value}`
+);
+var cisaKevLines = (kev) => [
+  `  CISA KEV desde: ${kev.addedAt}`,
+  ...labeledLines(
+    [
+      ["Nome CISA", kev.vulnerabilityName],
+      ["Prazo CISA", kev.actionDue],
+      ["A\xE7\xE3o CISA", kev.requiredAction]
+    ],
+    (label, value) => `  ${label}: ${value}`
+  )
+];
+var cisaSsvcLines = (ssvc) => {
+  const parts = labeledLines(
+    [
+      ["explora\xE7\xE3o", ssvc.exploitation],
+      ["automatiz\xE1vel", ssvc.automatable],
+      ["impacto t\xE9cnico", ssvc.technicalImpact]
+    ],
+    (label, value) => `${label}=${value}`
+  );
+  return labeledLines(
+    [
+      ["CISA SSVC", parts.length > 0 ? parts.join("; ") : void 0],
+      ["CISA SSVC atualizado", ssvc.timestamp]
+    ],
+    (label, value) => `  ${label}: ${value}`
+  );
+};
+var cisaLines = (cisa) => [
+  ...cisa?.kev ? cisaKevLines(cisa.kev) : [],
+  ...cisa?.ssvc ? cisaSsvcLines(cisa.ssvc) : []
+];
+var referencesLines = (references) => {
+  const shown = references.slice(0, 5);
+  const extraCount = references.length - shown.length;
+  return labeledLines(
+    [
+      ["Refer\xEAncias", shown.length > 0 ? shown.map((reference) => reference.url).join(", ") : void 0],
+      ["Refer\xEAncias adicionais", extraCount > 0 ? `${extraCount}` : void 0]
+    ],
+    (label, value) => `  ${label}: ${value}`
+  );
+};
+var foundNvdLines = (result, summary) => {
+  const { data } = result;
+  return [
+    `  CVE: ${result.cveId}`,
+    `  Status NVD: ${data.vulnerabilityStatus ?? "n\xE3o informado"}`,
+    ...cvssBlock(data),
+    ...metadataLines(data, summary),
+    ...cisaLines(data.cisa),
+    ...referencesLines(data.references)
+  ];
+};
+var httpStatusSuffix = (httpStatus) => httpStatus ? ` HTTP ${httpStatus}` : "";
+var nvdLines = (result, summary) => {
+  if (result.status === "found") return foundNvdLines(result, summary);
+  if (result.status === "not-found") return [`  CVE: ${result.cveId}`, "  NVD: sem resultado"];
+  return [
+    `  CVE: ${result.cveId}`,
+    `  NVD: falha ao consultar (${result.error.kind}${httpStatusSuffix(result.error.httpStatus)})`
+  ];
+};
+var aliasesLine = (aliases) => aliases.length > 0 ? [`Aliases: ${aliases.join(", ")}`] : [];
+var summaryLine = (summary, label) => summary ? [`${label}: ${summary}`] : [];
+var nvdResultLines = (results, summary) => (results ?? []).flatMap((result) => ["", ...nvdLines(result, summary)]);
+var sourcesLabel = (source, foundNvd) => source === "osv" ? `OSV${foundNvd ? ", NVD" : ""}` : "npm";
+var dependencyBlock = (finding) => {
+  const dependency = finding.dependency;
+  if (!dependency) return "";
+  const foundNvd = (dependency.nvd ?? []).some((result) => result.status === "found");
+  const lines = [
+    `Pacote: ${dependency.package.name}`,
+    `Vers\xE3o instalada: ${dependency.package.installedVersion}`,
+    `Vers\xE3o corrigida: ${dependency.package.fixedVersions.join(" ou ") || "n\xE3o informada"}`,
+    `${dependency.advisory.source.toUpperCase()}: ${dependency.advisory.id ?? "identificador n\xE3o informado"}`,
+    ...aliasesLine(dependency.advisory.aliases),
+    `Severidade do finding: ${finding.severity.toUpperCase()}`,
+    ...summaryLine(dependency.advisory.summary, "Descri\xE7\xE3o OSV/npm"),
+    ...nvdResultLines(dependency.nvd, dependency.advisory.summary),
+    `Fontes: ${sourcesLabel(dependency.advisory.source, foundNvd)}`
+  ];
+  return lines.join("\n");
+};
+var printDependencyFindings = (findings) => {
+  if (findings.length === 0) return;
+  console.log(chalk.bold("\nDepend\xEAncias vulner\xE1veis"));
+  console.log(findings.map(dependencyBlock).join("\n\n"));
+};
 var printFindingsReport = (result, coverage) => {
-  console.log(findingsTable(result).toString());
+  const codeFindings = result.findings.filter((finding) => !finding.dependency);
+  const dependencyFindings = result.findings.filter((finding) => finding.dependency);
+  if (codeFindings.length) console.log(findingsTable(codeFindings).toString());
+  printDependencyFindings(dependencyFindings);
   console.log(
     chalk.bold(
       `
@@ -264,6 +396,7 @@ var toJsonReport = (result) => {
 };
 
 // src/reporters/markdown.reporter.ts
+var LOGO_URL = "https://raw.githubusercontent.com/Ivan-ReisDev/code-sentry/main/docs/assets/logo.png";
 var SEVERITY_ORDER = ["critical", "high", "medium", "low"];
 var SEVERITY_LABEL = /* @__PURE__ */ new Map([
   ["critical", "Critical"],
@@ -271,7 +404,14 @@ var SEVERITY_LABEL = /* @__PURE__ */ new Map([
   ["medium", "Medium"],
   ["low", "Low"]
 ]);
+var SEVERITY_EMOJI = /* @__PURE__ */ new Map([
+  ["critical", "\u{1F534}"],
+  ["high", "\u{1F7E0}"],
+  ["medium", "\u{1F7E1}"],
+  ["low", "\u{1F535}"]
+]);
 var severityLabel = (severity) => SEVERITY_LABEL.get(severity) ?? severity;
+var severityBadge = (severity) => `${SEVERITY_EMOJI.get(severity) ?? ""} ${severityLabel(severity)}`;
 var escapeCell = (text2) => text2.replaceAll("|", "\\|");
 var groupBy = (items, keyOf) => {
   const map = /* @__PURE__ */ new Map();
@@ -290,7 +430,7 @@ var findingsTable2 = (findings) => {
   return lines;
 };
 var severitySection = (severity, findings) => {
-  const lines = [`## ${severityLabel(severity)} (${findings.length})`, ""];
+  const lines = [`## ${severityBadge(severity)} (${findings.length})`, ""];
   const byRule = groupBy(findings, (f) => f.ruleId);
   for (const ruleId of [...byRule.keys()].sort()) {
     const ruleFindings = byRule.get(ruleId) ?? [];
@@ -298,24 +438,38 @@ var severitySection = (severity, findings) => {
   }
   return lines;
 };
+var semgrepCoverageLine = (result) => result.engines?.semgrep === void 0 ? [] : [
+  `- **Cobertura por motor:** CodeSentry ${result.engines.codesentry ?? result.scannedFiles} JS/TS; Semgrep ${result.engines.semgrep} arquivos`
+];
+var dependencyAuditConsideredLine = (result) => typeof result.engines?.dependencyAudit === "number" ? [`- **Depend\xEAncias consideradas:** ${result.engines.dependencyAudit}`] : [];
+var nvdCoverageLine = (result) => {
+  const nvd = result.engines?.nvd;
+  if (!nvd || nvd.total === 0) return [];
+  return [
+    `- **Cobertura NVD:** ${nvd.enriched}/${nvd.total} enriquecidos; ${nvd.notFound} sem resultado; ${nvd.failed} falhas; ${nvd.cacheHits} cache hits`
+  ];
+};
+var dependencyAuditNoteLine = (result) => result.engines?.dependencyAudit === false ? [`- **Nota:** ${DEPENDENCY_AUDIT_NOTE}`] : [];
 var reportHeader = (result, generatedAt) => [
+  `<p align="center"><img src="${LOGO_URL}" alt="CodeSentry" width="320"></p>`,
+  "",
   "# Relat\xF3rio CodeSentry",
   "",
   `- **Gerado em:** ${generatedAt.toISOString()}`,
   `- **Arquivos analisados:** ${result.scannedFiles}`,
-  ...result.engines?.semgrep === void 0 ? [] : [
-    `- **Cobertura por motor:** CodeSentry ${result.engines.codesentry ?? result.scannedFiles} JS/TS; Semgrep ${result.engines.semgrep} arquivos`
-  ],
+  ...semgrepCoverageLine(result),
+  ...dependencyAuditConsideredLine(result),
+  ...nvdCoverageLine(result),
   `- **Dura\xE7\xE3o:** ${result.durationMs}ms`,
   `- **Total de problemas:** ${result.findings.length}`,
-  ...result.engines?.dependencyAudit === false ? [`- **Nota:** ${DEPENDENCY_AUDIT_NOTE}`] : [],
+  ...dependencyAuditNoteLine(result),
   ""
 ];
 var warningsSection = (result) => (result.warnings ?? []).length === 0 ? [] : ["## Avisos", "", ...(result.warnings ?? []).map((warning) => `- ${warning}`), ""];
 var summaryTable = (bySeverity) => {
   const lines = ["## Resumo por severidade", "", "| Severidade | Quantidade |", "| --- | --- |"];
   for (const severity of SEVERITY_ORDER) {
-    lines.push(`| ${severityLabel(severity)} | ${(bySeverity.get(severity) ?? []).length} |`);
+    lines.push(`| ${severityBadge(severity)} | ${(bySeverity.get(severity) ?? []).length} |`);
   }
   lines.push("");
   return lines;
@@ -330,6 +484,147 @@ var severitySections = (bySeverity) => {
   }
   return lines;
 };
+var labeledLines2 = (pairs, format) => pairs.filter((pair) => Boolean(pair[1])).map(([label, value]) => format(label, value));
+var mdCvssMetricLines = (cvss) => labeledLines2(
+  [
+    ["Attack Vector", cvss.attackVector],
+    ["Attack Complexity", cvss.attackComplexity],
+    ["Privileges Required", cvss.privilegesRequired],
+    ["User Interaction", cvss.userInteraction],
+    ["Scope", cvss.scope],
+    ["Confidentiality", cvss.confidentialityImpact],
+    ["Integrity", cvss.integrityImpact],
+    ["Availability", cvss.availabilityImpact]
+  ],
+  (key, value) => `${key}=${value}`
+);
+var mdCvssLines = (cvss) => {
+  const lines = [
+    `- **CVSS:** ${cvss.score} (${cvss.severity ?? "sem severidade"}), vers\xE3o ${cvss.version}`,
+    `- **Vetor:** \`${cvss.vectorString}\``
+  ];
+  const metrics = mdCvssMetricLines(cvss);
+  return metrics.length ? [...lines, `- **M\xE9tricas:** ${metrics.join("; ")}`] : lines;
+};
+var mdCvssBlock = (data) => data.cvss ? mdCvssLines(data.cvss) : ["- **CVSS:** registro encontrado, ainda sem m\xE9trica CVSS"];
+var mdMetadataLines = (data, summary) => labeledLines2(
+  [
+    ["CWE", data.cwes.join(", ") || void 0],
+    ["Descri\xE7\xE3o NVD", data.description !== summary ? data.description : void 0],
+    ["Publicado", data.published],
+    ["Modificado", data.lastModified]
+  ],
+  (label, value) => `- **${label}:** ${value}`
+);
+var mdCisaKevLines = (kev) => [
+  `- **CISA KEV:** \u26A0\uFE0F inclu\xEDdo em ${kev.addedAt}`,
+  ...labeledLines2(
+    [
+      ["Nome CISA", kev.vulnerabilityName],
+      ["Prazo CISA", kev.actionDue],
+      ["A\xE7\xE3o requerida", kev.requiredAction]
+    ],
+    (label, value) => `- **${label}:** ${value}`
+  )
+];
+var mdCisaSsvcLines = (ssvc) => {
+  const parts = labeledLines2(
+    [
+      ["explora\xE7\xE3o", ssvc.exploitation],
+      ["automatiz\xE1vel", ssvc.automatable],
+      ["impacto t\xE9cnico", ssvc.technicalImpact]
+    ],
+    (label, value) => `${label}=${value}`
+  );
+  return labeledLines2(
+    [
+      ["CISA SSVC", parts.length > 0 ? parts.join("; ") : void 0],
+      ["CISA SSVC atualizado", ssvc.timestamp]
+    ],
+    (label, value) => `- **${label}:** ${value}`
+  );
+};
+var mdCisaLines = (cisa) => [
+  ...cisa?.kev ? mdCisaKevLines(cisa.kev) : [],
+  ...cisa?.ssvc ? mdCisaSsvcLines(cisa.ssvc) : []
+];
+var mdReferencesBlock = (references) => references.length ? [
+  "",
+  "**Refer\xEAncias:**",
+  "",
+  ...references.map((reference) => {
+    const metadata = [reference.source, ...reference.tags].filter(Boolean);
+    return `- ${reference.url}${metadata.length ? ` \u2014 ${metadata.join(", ")}` : ""}`;
+  })
+] : [];
+var nvdHttpStatusSuffix = (httpStatus) => httpStatus ? `, HTTP ${httpStatus}` : "";
+var nvdMarkdown = (result, advisorySummary) => {
+  if (result.status === "not-found") return [`- **${result.cveId}:** sem resultado no NVD`];
+  if (result.status === "error") {
+    return [
+      `- **${result.cveId}:** falha ao consultar (${result.error.kind}${nvdHttpStatusSuffix(result.error.httpStatus)})`
+    ];
+  }
+  const { data } = result;
+  return [
+    `#### ${result.cveId}`,
+    "",
+    `- **Status NVD:** ${data.vulnerabilityStatus ?? "n\xE3o informado"}`,
+    ...mdCvssBlock(data),
+    ...mdMetadataLines(data, advisorySummary),
+    ...mdCisaLines(data.cisa),
+    ...mdReferencesBlock(data.references)
+  ];
+};
+var mdSourcesLabel = (source, foundNvd) => source === "osv" ? `OSV${foundNvd ? ", NVD" : ""}` : "npm";
+var mdSummaryLine = (summary) => summary ? [`- **Descri\xE7\xE3o OSV/npm:** ${summary}`] : [];
+var firstCvssScore = (nvd) => {
+  const withCvss = (nvd ?? []).find(
+    (result) => result.status === "found" && Boolean(result.data.cvss)
+  );
+  return withCvss?.data.cvss ? `${withCvss.data.cvss.score}` : "\u2014";
+};
+var dependencySummaryRow = (finding, dependency) => `| ${dependency.package.name}@${dependency.package.installedVersion} | ${severityBadge(finding.severity)} | ${dependency.advisory.id ?? "\u2014"} | ${dependency.advisory.aliases.join(", ") || "\u2014"} | ${firstCvssScore(dependency.nvd)} | ${dependency.package.fixedVersions.join(" ou ") || "\u2014"} |`;
+var dependencySummaryTable = (findings) => {
+  const rows = findings.filter((finding) => Boolean(finding.dependency)).map((finding) => dependencySummaryRow(finding, finding.dependency));
+  if (!rows.length) return [];
+  return [
+    "| Pacote | Severidade | Advisory | CVE(s) | CVSS | Corrigir para |",
+    "| --- | --- | --- | --- | --- | --- |",
+    ...rows,
+    ""
+  ];
+};
+var dependencySection = (finding) => {
+  const dependency = finding.dependency;
+  if (!dependency) return [];
+  const foundNvd = (dependency.nvd ?? []).some((result) => result.status === "found");
+  return [
+    "<details>",
+    `<summary>${severityBadge(finding.severity)} <strong>${dependency.package.name}@${dependency.package.installedVersion}</strong></summary>`,
+    "",
+    `- **Fonte principal:** ${dependency.advisory.source.toUpperCase()}`,
+    `- **Advisory:** ${dependency.advisory.id ?? "n\xE3o informado"}`,
+    `- **Aliases:** ${dependency.advisory.aliases.join(", ") || "nenhum"}`,
+    `- **Vers\xF5es corrigidas:** ${dependency.package.fixedVersions.join(" ou ") || "n\xE3o informadas"}`,
+    `- **Fontes:** ${mdSourcesLabel(dependency.advisory.source, foundNvd)}`,
+    ...mdSummaryLine(dependency.advisory.summary),
+    ...(dependency.nvd ?? []).flatMap((result) => ["", ...nvdMarkdown(result, dependency.advisory.summary)]),
+    "",
+    "</details>",
+    ""
+  ];
+};
+var dependencySections = (findings) => {
+  const dependencies = findings.filter((finding) => finding.dependency);
+  if (dependencies.length === 0) return [];
+  return [
+    "## Depend\xEAncias vulner\xE1veis",
+    "",
+    ...dependencySummaryTable(findings),
+    ...dependencies.flatMap(dependencySection)
+  ];
+};
 var osvCheckedSection = (result) => {
   const { osvCheckedPackages } = result;
   if (!osvCheckedPackages || osvCheckedPackages.length === 0) {
@@ -340,27 +635,618 @@ var osvCheckedSection = (result) => {
   return [
     `## Depend\xEAncias verificadas no OSV.dev (${checked}/${total})`,
     "",
+    "<details>",
+    "<summary>Ver lista completa</summary>",
+    "",
     ...osvCheckedPackages.map((pkg) => `- ${pkg}`),
+    "",
+    "</details>",
     ""
   ];
 };
 var toMarkdownReport = (result, generatedAt = /* @__PURE__ */ new Date()) => {
+  const codeFindings = result.findings.filter((finding) => !finding.dependency);
   const bySeverity = groupBy(result.findings, (f) => f.severity);
+  const codeBySeverity = groupBy(codeFindings, (f) => f.severity);
   return [
     ...reportHeader(result, generatedAt),
     ...warningsSection(result),
     ...summaryTable(bySeverity),
-    ...severitySections(bySeverity),
+    ...severitySections(codeBySeverity),
+    ...dependencySections(result.findings),
     ...osvCheckedSection(result)
   ].join("\n");
 };
 
 // src/scanner/dependency-audit.ts
 import { execFile } from "child_process";
-import { readFile } from "fs/promises";
-import { join } from "path";
+import { readFile as readFile2 } from "fs/promises";
+import { join as join2 } from "path";
 import { promisify } from "util";
 
+// src/scanner/nvd-cache.ts
+import { homedir } from "os";
+import { dirname, join } from "path";
+import { mkdir, readFile, rename, writeFile } from "fs/promises";
+var CACHE_SCHEMA_VERSION = 1;
+var FOUND_TTL_MS = 24 * 60 * 60 * 1e3;
+var NOT_FOUND_TTL_MS = 60 * 60 * 1e3;
+var isRecord = (value) => typeof value === "object" && value !== null;
+var defaultCacheFile = () => {
+  if (process.platform === "win32") {
+    return join(process.env.LOCALAPPDATA ?? join(homedir(), "AppData", "Local"), "CodeSentry", "nvd-v1.json");
+  }
+  if (process.platform === "darwin") {
+    return join(homedir(), "Library", "Caches", "CodeSentry", "nvd-v1.json");
+  }
+  return join(process.env.XDG_CACHE_HOME ?? join(homedir(), ".cache"), "codesentry", "nvd-v1.json");
+};
+var isValidReference = (value) => isRecord(value) && typeof value.url === "string";
+var isNvdData = (value, cveId) => isRecord(value) && value.id === cveId && Array.isArray(value.cwes) && value.cwes.every((item) => typeof item === "string") && Array.isArray(value.references) && value.references.every(isValidReference);
+var isStoredEnvelope = (value) => isRecord(value) && typeof value.expiresAt === "number" && isRecord(value.result);
+var parseFoundResult = (cveId, result) => result.status === "found" && isNvdData(result.data, cveId) ? { status: "found", cveId, data: result.data } : void 0;
+var parseStoredResult = (cveId, result) => {
+  if (result.cveId !== cveId) return void 0;
+  if (result.status === "not-found") return { status: "not-found", cveId };
+  return parseFoundResult(cveId, result);
+};
+var parseStoredEntry = (cveId, value) => {
+  if (!isStoredEnvelope(value)) return void 0;
+  const result = parseStoredResult(cveId, value.result);
+  return result ? { expiresAt: value.expiresAt, result } : void 0;
+};
+var parseCacheFileBody = (parsed, now) => {
+  if (!isRecord(parsed) || parsed.schemaVersion !== CACHE_SCHEMA_VERSION || !isRecord(parsed.entries)) {
+    return { entries: /* @__PURE__ */ new Map(), incompatible: true };
+  }
+  const entries = /* @__PURE__ */ new Map();
+  for (const [cveId, value] of Object.entries(parsed.entries)) {
+    const entry = parseStoredEntry(cveId, value);
+    if (entry && entry.expiresAt > now) entries.set(cveId, entry);
+  }
+  return { entries, incompatible: false };
+};
+var cleanCacheableResult = (result) => result.status === "found" ? { status: "found", cveId: result.cveId, data: result.data } : { status: "not-found", cveId: result.cveId };
+var toStoredEntry = (result, now) => ({
+  expiresAt: now + (result.status === "found" ? FOUND_TTL_MS : NOT_FOUND_TTL_MS),
+  result
+});
+var PersistentNvdCache = class {
+  #filePath;
+  #now;
+  #entries = /* @__PURE__ */ new Map();
+  #warnings = [];
+  #loadPromise;
+  #writeCounter = 0;
+  #writeQueue = Promise.resolve();
+  constructor(options) {
+    this.#filePath = options.filePath ?? defaultCacheFile();
+    this.#now = options.now ?? Date.now;
+  }
+  async #loadFromDisk() {
+    try {
+      const raw = await readFile(this.#filePath, "utf-8");
+      const parsed = JSON.parse(raw);
+      const { entries, incompatible } = parseCacheFileBody(parsed, this.#now());
+      if (incompatible) {
+        this.#warnings.push("O cache do NVD possui vers\xE3o ou formato incompat\xEDvel e foi ignorado.");
+        return;
+      }
+      entries.forEach((entry, cveId) => this.#entries.set(cveId, entry));
+    } catch (error) {
+      if (error.code !== "ENOENT") {
+        this.#warnings.push("N\xE3o foi poss\xEDvel ler o cache do NVD; as consultas continuar\xE3o sem ele.");
+      }
+    }
+  }
+  async #load() {
+    this.#loadPromise ??= this.#loadFromDisk();
+    await this.#loadPromise;
+  }
+  async get(cveId) {
+    await this.#load();
+    const entry = this.#entries.get(cveId);
+    if (!entry) return void 0;
+    if (entry.expiresAt <= this.#now()) {
+      this.#entries.delete(cveId);
+      return void 0;
+    }
+    return { ...entry.result, fromCache: true };
+  }
+  async set(result) {
+    if (result.status === "error") return;
+    await this.#load();
+    const entry = toStoredEntry(cleanCacheableResult(result), this.#now());
+    this.#entries.set(result.cveId, entry);
+    this.#writeQueue = this.#writeQueue.then(() => this.#persist()).catch(() => void 0);
+    await this.#writeQueue;
+  }
+  async #persist() {
+    try {
+      const directory = dirname(this.#filePath);
+      await mkdir(directory, { recursive: true });
+      const entries = Object.fromEntries(this.#entries);
+      const body = { schemaVersion: CACHE_SCHEMA_VERSION, entries };
+      const temporary = `${this.#filePath}.${process.pid}.${this.#writeCounter++}.tmp`;
+      await writeFile(temporary, JSON.stringify(body, null, 2), { encoding: "utf-8", mode: 384 });
+      await rename(temporary, this.#filePath);
+    } catch {
+      this.#warnings.push("N\xE3o foi poss\xEDvel gravar o cache do NVD; o scan continuar\xE1 normalmente.");
+    }
+  }
+  consumeWarnings() {
+    return this.#warnings.splice(0);
+  }
+};
+var createNvdCache = (options = {}) => new PersistentNvdCache(options);
+
+// src/scanner/nvd-normalizer.ts
+var isRecord2 = (value) => typeof value === "object" && value !== null;
+var asString = (value) => typeof value === "string" && value.trim() ? value.trim() : void 0;
+var asArray = (value) => Array.isArray(value) ? value : [];
+var pickBy = (condition, whenTrue, whenFalse) => condition ? whenTrue : whenFalse;
+var pickEnum = (value, accepted) => {
+  const candidate = asString(value)?.toUpperCase();
+  return candidate && accepted.includes(candidate) ? candidate : void 0;
+};
+var SEVERITIES = ["LOW", "MEDIUM", "HIGH", "CRITICAL"];
+var ATTACK_VECTORS = ["NETWORK", "ADJACENT", "LOCAL", "PHYSICAL"];
+var ATTACK_COMPLEXITIES = ["LOW", "MEDIUM", "HIGH"];
+var PRIVILEGES = ["NONE", "LOW", "HIGH"];
+var USER_INTERACTIONS = ["NONE", "REQUIRED", "PASSIVE", "ACTIVE"];
+var SCOPES = ["UNCHANGED", "CHANGED"];
+var IMPACTS = ["NONE", "LOW", "HIGH", "PARTIAL", "COMPLETE"];
+var METRIC_BUCKETS = [
+  { key: "cvssMetricV40", version: "4.0" },
+  { key: "cvssMetricV31", version: "3.1" },
+  { key: "cvssMetricV30", version: "3.0" },
+  { key: "cvssMetricV2", version: "2.0" }
+];
+var isNvdSource = (metric) => asString(metric.source)?.toLowerCase() === "nvd@nist.gov";
+var isPrimaryType = (metric) => asString(metric.type) === "Primary";
+var fallbackMetricPriority = (metric) => {
+  if (isPrimaryType(metric)) return 1;
+  if (isNvdSource(metric)) return 2;
+  return 3;
+};
+var metricPriority = (metric) => isNvdSource(metric) && isPrimaryType(metric) ? 0 : fallbackMetricPriority(metric);
+var isValidCvssScore = (score, version) => score >= 0 && score <= 10 && (score !== 0 || version === "2.0");
+var classifyHighOrCritical = (score, version) => version === "2.0" || score < 9 ? "HIGH" : "CRITICAL";
+var classifySeverity = (score, version) => {
+  if (score < 4) return "LOW";
+  if (score < 7) return "MEDIUM";
+  return classifyHighOrCritical(score, version);
+};
+var deriveSeverity = (score, version) => isValidCvssScore(score, version) ? classifySeverity(score, version) : void 0;
+var normalizeAttackVector = (value) => {
+  const normalized = asString(value)?.toUpperCase();
+  return pickEnum(normalized === "ADJACENT_NETWORK" ? "ADJACENT" : normalized, ATTACK_VECTORS);
+};
+var validatedCvssData = (metric, version) => {
+  if (!isRecord2(metric.cvssData)) return void 0;
+  const data = metric.cvssData;
+  const dataVersion = asString(data.version);
+  const vectorString = asString(data.vectorString);
+  const score = data.baseScore;
+  const scoreIsValidNumber = typeof score === "number" && Number.isFinite(score) && score >= 0 && score <= 10;
+  if (dataVersion !== version || !vectorString || !scoreIsValidNumber) return void 0;
+  return { data, vectorString, score };
+};
+var metricSeverity = (metric, data, score, version) => {
+  const wrapperSeverity = pickBy(version === "2.0", metric.baseSeverity, data.baseSeverity);
+  const rawSeverity = asString(wrapperSeverity);
+  return rawSeverity === void 0 ? deriveSeverity(score, version) : pickEnum(rawSeverity, SEVERITIES);
+};
+var metricUserInteraction = (metric, data, version) => {
+  if (version === "2.0" && typeof metric.userInteractionRequired === "boolean") {
+    return metric.userInteractionRequired ? "REQUIRED" : "NONE";
+  }
+  return pickEnum(data.userInteraction, USER_INTERACTIONS);
+};
+var metricType = (rawType) => rawType === "Primary" || rawType === "Secondary" ? rawType : void 0;
+var privilegesRequiredValue = (data, version) => version === "2.0" ? void 0 : pickEnum(data.privilegesRequired, PRIVILEGES);
+var scopeValue = (data, version) => version === "4.0" || version === "2.0" ? void 0 : pickEnum(data.scope, SCOPES);
+var computeMetricFields = (metric, data, score, version) => ({
+  severity: metricSeverity(metric, data, score, version),
+  source: asString(metric.source),
+  type: metricType(asString(metric.type)),
+  attackVector: normalizeAttackVector(pickBy(version === "2.0", data.accessVector, data.attackVector)),
+  attackComplexity: pickEnum(
+    pickBy(version === "2.0", data.accessComplexity, data.attackComplexity),
+    ATTACK_COMPLEXITIES
+  ),
+  privilegesRequired: privilegesRequiredValue(data, version),
+  userInteraction: metricUserInteraction(metric, data, version),
+  scope: scopeValue(data, version),
+  confidentialityImpact: pickEnum(
+    pickBy(version === "4.0", data.vulnConfidentialityImpact, data.confidentialityImpact),
+    IMPACTS
+  ),
+  integrityImpact: pickEnum(pickBy(version === "4.0", data.vulnIntegrityImpact, data.integrityImpact), IMPACTS),
+  availabilityImpact: pickEnum(
+    pickBy(version === "4.0", data.vulnAvailabilityImpact, data.availabilityImpact),
+    IMPACTS
+  )
+});
+var withOptionalFields = (base, fields) => ({
+  ...base,
+  ...fields.severity && { severity: fields.severity },
+  ...fields.source && { source: fields.source },
+  ...fields.type && { type: fields.type },
+  ...fields.attackVector && { attackVector: fields.attackVector },
+  ...fields.attackComplexity && { attackComplexity: fields.attackComplexity },
+  ...fields.privilegesRequired && { privilegesRequired: fields.privilegesRequired },
+  ...fields.userInteraction && { userInteraction: fields.userInteraction },
+  ...fields.scope && { scope: fields.scope },
+  ...fields.confidentialityImpact && { confidentialityImpact: fields.confidentialityImpact },
+  ...fields.integrityImpact && { integrityImpact: fields.integrityImpact },
+  ...fields.availabilityImpact && { availabilityImpact: fields.availabilityImpact }
+});
+var normalizeMetric = (metric, version) => {
+  const validated = validatedCvssData(metric, version);
+  if (!validated) return void 0;
+  const { data, vectorString, score } = validated;
+  const fields = computeMetricFields(metric, data, score, version);
+  return withOptionalFields({ score, version, vectorString }, fields);
+};
+var rankedCandidates = (metrics, key) => (
+  // codesentry-disable-next-line security/detect-object-injection -- key always comes from the hardcoded METRIC_BUCKETS list, never attacker input.
+  asArray(metrics[key]).filter(isRecord2).map((metric, index) => ({ metric, index, priority: metricPriority(metric) })).sort((a, b) => a.priority - b.priority || a.index - b.index).map(({ metric }) => metric)
+);
+var firstNormalizedCandidate = (candidates, version) => {
+  for (const metric of candidates) {
+    const normalized = normalizeMetric(metric, version);
+    if (normalized) return normalized;
+  }
+  return void 0;
+};
+var selectCvss = (metrics) => {
+  if (!isRecord2(metrics)) return void 0;
+  for (const bucket of METRIC_BUCKETS) {
+    const normalized = firstNormalizedCandidate(rankedCandidates(metrics, bucket.key), bucket.version);
+    if (normalized) return normalized;
+  }
+  return void 0;
+};
+var selectDescription = (descriptions) => {
+  const candidates = asArray(descriptions).filter(isRecord2);
+  const selected = candidates.find((item) => asString(item.lang)?.toLowerCase() === "en") ?? candidates.find((item) => asString(item.lang)?.toLowerCase().startsWith("en-")) ?? candidates[0];
+  if (!selected) return {};
+  return { description: asString(selected.value), descriptionLanguage: asString(selected.lang) };
+};
+var normalizeCwes = (weaknesses) => {
+  const values = asArray(weaknesses).filter(isRecord2).flatMap((weakness) => asArray(weakness.description)).filter(isRecord2).map((description) => asString(description.value)?.toUpperCase()).filter((value) => value !== void 0 && /^CWE-\d+$/.test(value));
+  return [...new Set(values)];
+};
+var normalizeReferences = (references) => {
+  const deduped = /* @__PURE__ */ new Map();
+  for (const reference of asArray(references).filter(isRecord2)) {
+    const url = asString(reference.url);
+    if (!url || deduped.has(url)) continue;
+    deduped.set(url, {
+      url,
+      source: asString(reference.source),
+      tags: asArray(reference.tags).map(asString).filter((tag) => tag !== void 0)
+    });
+  }
+  return [...deduped.values()];
+};
+var ssvcOption = (options, key) => {
+  for (const option of asArray(options).filter(isRecord2)) {
+    const value = asString(option[key]);
+    if (value) return value;
+  }
+  return void 0;
+};
+var normalizeKev = (cve) => {
+  const addedAt = asString(cve.cisaExploitAdd);
+  return addedAt ? {
+    addedAt,
+    actionDue: asString(cve.cisaActionDue),
+    requiredAction: asString(cve.cisaRequiredAction),
+    vulnerabilityName: asString(cve.cisaVulnerabilityName)
+  } : void 0;
+};
+var findSsvcMetric = (cve) => {
+  const metrics = isRecord2(cve.metrics) ? cve.metrics : void 0;
+  return asArray(metrics?.ssvcV203).filter(isRecord2).map((entry) => entry.ssvcData).find((data) => isRecord2(data) && asString(data.role) === "CISA Coordinator");
+};
+var normalizeSsvc = (ssvcMetric) => ssvcMetric ? {
+  exploitation: ssvcOption(ssvcMetric.options, "exploitation"),
+  automatable: ssvcOption(ssvcMetric.options, "automatable"),
+  technicalImpact: ssvcOption(ssvcMetric.options, "technicalImpact"),
+  timestamp: asString(ssvcMetric.timestamp)
+} : void 0;
+var normalizeCisa = (cve) => {
+  const kev = normalizeKev(cve);
+  const ssvc = normalizeSsvc(findSsvcMetric(cve));
+  return kev || ssvc ? { kev, ssvc } : void 0;
+};
+var normalizeNvdCve = (value, expectedCveId) => {
+  if (!isRecord2(value)) return void 0;
+  const id = asString(value.id)?.toUpperCase();
+  if (!id || id !== expectedCveId.toUpperCase()) return void 0;
+  return {
+    id,
+    vulnerabilityStatus: asString(value.vulnStatus),
+    ...selectDescription(value.descriptions),
+    published: asString(value.published),
+    lastModified: asString(value.lastModified),
+    cvss: selectCvss(value.metrics),
+    cwes: normalizeCwes(value.weaknesses),
+    references: normalizeReferences(value.references),
+    cisa: normalizeCisa(value)
+  };
+};
+
+// src/scanner/nvd-client.ts
+var NVD_API_URL = "https://services.nvd.nist.gov/rest/json/cves/2.0";
+var DEFAULT_TIMEOUT_MS = 1e4;
+var DEFAULT_MAX_ATTEMPTS = 3;
+var TRANSIENT_FAILURE_CIRCUIT_THRESHOLD = 3;
+var CVE_PATTERN = /^CVE-\d{4}-\d{4,}$/;
+var isRecord3 = (value) => typeof value === "object" && value !== null;
+var defaultSleep = (milliseconds) => new Promise((resolve3) => setTimeout(resolve3, milliseconds));
+var isAttemptFailure = (outcome) => "result" in outcome;
+var errorResult = (cveId, kind, httpStatus) => ({
+  status: "error",
+  cveId,
+  error: { kind, ...httpStatus === void 0 ? {} : { httpStatus } }
+});
+var parseRetryAfterDate = (value, now) => {
+  const date = Date.parse(value);
+  return Number.isNaN(date) ? void 0 : Math.max(0, date - now);
+};
+var retryAfterMilliseconds = (value, now) => {
+  if (!value) return void 0;
+  const seconds = Number(value);
+  if (Number.isFinite(seconds) && seconds >= 0) return seconds * 1e3;
+  return parseRetryAfterDate(value, now);
+};
+var extractCveEntries = (body) => {
+  if (!isRecord3(body) || !Array.isArray(body.vulnerabilities)) return void 0;
+  return body.vulnerabilities;
+};
+var buildRequestHeaders = (apiKey) => {
+  const headers = { Accept: "application/json" };
+  if (apiKey) headers.apiKey = apiKey;
+  return headers;
+};
+var errorKindForStatus = (status) => {
+  if (status === 429) return "rate-limit";
+  if (status >= 500) return "server";
+  return "http";
+};
+var isRetryableStatus = (status) => status === 408 || status === 429 || status >= 500;
+var isEmptyResultBody = (body, entries) => entries.length === 0 || isRecord3(body) && body.totalResults === 0;
+var outcomeFromEntries = (entries, cveId) => {
+  for (const entry of entries) {
+    if (!isRecord3(entry)) continue;
+    const normalized = normalizeNvdCve(entry.cve, cveId);
+    if (normalized) return { status: "found", cveId, data: normalized };
+  }
+  return { result: errorResult(cveId, "invalid-response"), retryable: false };
+};
+var parseSuccessBody = (body, cveId) => {
+  const entries = extractCveEntries(body);
+  if (!entries) return { result: errorResult(cveId, "invalid-response"), retryable: false };
+  if (isEmptyResultBody(body, entries)) return { status: "not-found", cveId };
+  return outcomeFromEntries(entries, cveId);
+};
+var isTimeoutError = (error, signal) => signal.aborted || error instanceof Error && error.name === "AbortError";
+var attemptCatchResult = (error, signal, cveId) => ({
+  result: errorResult(cveId, isTimeoutError(error, signal) ? "timeout" : "network"),
+  retryable: true
+});
+var DefaultNvdClient = class {
+  #fetch;
+  #apiKey;
+  #cache;
+  #timeoutMs;
+  #maxAttempts;
+  #minIntervalMs;
+  #sleep;
+  #now;
+  #random;
+  #lookups = /* @__PURE__ */ new Map();
+  #warnings = [];
+  #requestQueue = Promise.resolve();
+  #nextRequestAt = 0;
+  #circuitOpen = false;
+  #consecutiveTransientFailures = 0;
+  constructor(options) {
+    this.#fetch = options.fetchImpl ?? fetch;
+    this.#apiKey = options.apiKey?.trim() || void 0;
+    this.#cache = options.cache ?? createNvdCache();
+    this.#timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    this.#maxAttempts = options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;
+    this.#minIntervalMs = options.minIntervalMs ?? (this.#apiKey ? 610 : 6100);
+    this.#sleep = options.sleep ?? defaultSleep;
+    this.#now = options.now ?? Date.now;
+    this.#random = options.random ?? Math.random;
+  }
+  lookupCve(cveId) {
+    const normalizedId = cveId.trim().toUpperCase();
+    if (!CVE_PATTERN.test(normalizedId)) {
+      return Promise.resolve(errorResult(normalizedId, "invalid-response"));
+    }
+    const existing = this.#lookups.get(normalizedId);
+    if (existing) return existing;
+    const lookup = this.#lookup(normalizedId);
+    this.#lookups.set(normalizedId, lookup);
+    return lookup;
+  }
+  async #shortCircuit(cveId) {
+    const cached = await this.#cache.get(cveId);
+    if (cached) return cached;
+    if (this.#circuitOpen) return errorResult(cveId, "unavailable");
+    return void 0;
+  }
+  async #retryUntilSuccess(cveId) {
+    let finalFailure;
+    for (let attempt = 0; attempt < this.#maxAttempts; attempt += 1) {
+      const outcome = await this.#scheduleAttempt(cveId);
+      if (!isAttemptFailure(outcome)) {
+        this.#consecutiveTransientFailures = 0;
+        await this.#cache.set(outcome);
+        return { success: outcome };
+      }
+      finalFailure = outcome;
+      if (!outcome.retryable || attempt === this.#maxAttempts - 1) break;
+      const baseBackoff = Math.min(3e4, 1e3 * 2 ** attempt);
+      const jitteredBackoff = baseBackoff * (0.8 + this.#random() * 0.4);
+      await this.#sleep(Math.max(jitteredBackoff, outcome.retryAfterMs ?? 0));
+    }
+    return { failure: finalFailure ?? { result: errorResult(cveId, "unavailable"), retryable: false } };
+  }
+  #recordFailure(failure) {
+    if (failure.retryable) {
+      this.#consecutiveTransientFailures += 1;
+      if (failure.result.error.kind === "rate-limit" || this.#consecutiveTransientFailures >= TRANSIENT_FAILURE_CIRCUIT_THRESHOLD) {
+        this.#circuitOpen = true;
+      }
+    }
+    return failure.result;
+  }
+  async #lookup(cveId) {
+    const shortCircuited = await this.#shortCircuit(cveId);
+    if (shortCircuited) return shortCircuited;
+    const outcome = await this.#retryUntilSuccess(cveId);
+    return "success" in outcome ? outcome.success : this.#recordFailure(outcome.failure);
+  }
+  #scheduleAttempt(cveId) {
+    const scheduled = this.#requestQueue.then(async () => {
+      if (this.#circuitOpen) return errorResult(cveId, "unavailable");
+      const waitMs = Math.max(0, this.#nextRequestAt - this.#now());
+      if (waitMs > 0) await this.#sleep(waitMs);
+      this.#nextRequestAt = this.#now() + this.#minIntervalMs;
+      return this.#attempt(cveId);
+    }).catch(() => ({ result: errorResult(cveId, "unavailable"), retryable: true }));
+    this.#requestQueue = scheduled.then(
+      () => void 0,
+      () => void 0
+    );
+    return scheduled;
+  }
+  #failureForStatus(cveId, status, response) {
+    if (status === 401 || status === 403) {
+      this.#circuitOpen = true;
+      return { result: errorResult(cveId, "forbidden", status), retryable: false };
+    }
+    return {
+      result: errorResult(cveId, errorKindForStatus(status), status),
+      retryable: isRetryableStatus(status),
+      retryAfterMs: retryAfterMilliseconds(response.headers?.get("Retry-After"), this.#now())
+    };
+  }
+  async #safeFetch(url, headers, signal, cveId) {
+    try {
+      return await this.#fetch(url, { method: "GET", headers, signal });
+    } catch (error) {
+      return attemptCatchResult(error, signal, cveId);
+    }
+  }
+  async #parseBodySafely(response, cveId) {
+    try {
+      return parseSuccessBody(await response.json(), cveId);
+    } catch {
+      return { result: errorResult(cveId, "invalid-response"), retryable: false };
+    }
+  }
+  async #handleResponse(response, cveId) {
+    const status = response.status ?? 0;
+    if (status === 404) return { status: "not-found", cveId };
+    if (!response.ok) return this.#failureForStatus(cveId, status, response);
+    return this.#parseBodySafely(response, cveId);
+  }
+  async #handleFetchOutcome(fetched, cveId) {
+    if ("result" in fetched) return fetched;
+    return this.#handleResponse(fetched, cveId);
+  }
+  async #attempt(cveId) {
+    const url = new URL(NVD_API_URL);
+    url.searchParams.set("cveId", cveId);
+    const headers = buildRequestHeaders(this.#apiKey);
+    const signal = AbortSignal.timeout(this.#timeoutMs);
+    const fetched = await this.#safeFetch(url.toString(), headers, signal, cveId);
+    return this.#handleFetchOutcome(fetched, cveId);
+  }
+  consumeWarnings() {
+    return [...this.#warnings.splice(0), ...this.#cache.consumeWarnings()];
+  }
+};
+var createNvdClient = (options = {}) => new DefaultNvdClient(options);
+
+// src/scanner/nvd-enrichment.ts
+var CVE_PATTERN2 = /^CVE-\d{4}-\d{4,}$/;
+var extractCveAliases = (aliases) => {
+  const cves = (aliases ?? []).map((alias) => alias.trim().toUpperCase()).filter((alias) => CVE_PATTERN2.test(alias));
+  return [...new Set(cves)];
+};
+var coverageFrom = (results) => ({
+  total: results.length,
+  enriched: results.filter((result) => result.status === "found").length,
+  notFound: results.filter((result) => result.status === "not-found").length,
+  failed: results.filter((result) => result.status === "error").length,
+  cacheHits: results.filter((result) => result.status !== "error" && result.fromCache).length
+});
+var resolveLookups = async (lookups) => {
+  const resolved = /* @__PURE__ */ new Map();
+  let unexpectedFailure = false;
+  try {
+    await Promise.all(
+      [...lookups].map(async ([cveId, lookup]) => {
+        try {
+          resolved.set(cveId, await lookup);
+        } catch {
+          resolved.set(cveId, { status: "error", cveId, error: { kind: "unavailable" } });
+        }
+      })
+    );
+  } catch {
+    unexpectedFailure = true;
+  }
+  return { resolved, unexpectedFailure };
+};
+var enrichMatch = (match, cveIds, resolved) => ({
+  ...match,
+  cveIds,
+  nvd: cveIds.map((cveId) => resolved.get(cveId)).filter((item) => item !== void 0)
+});
+var enrichmentWarnings = (client, coverage, unexpectedFailure) => [
+  ...client.consumeWarnings(),
+  ...coverage.failed > 0 ? [`N\xE3o foi poss\xEDvel consultar o NVD para ${coverage.failed} CVE(s); os findings OSV foram preservados.`] : [],
+  ...unexpectedFailure ? [
+    "Falha interna inesperada ao consolidar as consultas do NVD; alguns CVEs podem n\xE3o ter sido enriquecidos."
+  ] : []
+];
+var enrichOsvMatchesWithNvd = async (matches, client) => {
+  const cveIdsByMatch = matches.map((match) => extractCveAliases(match.vuln.aliases));
+  const uniqueCveIds = [...new Set(cveIdsByMatch.flat())];
+  const lookups = new Map(
+    uniqueCveIds.map((cveId) => [cveId, client.lookupCve(cveId)])
+  );
+  let resolution;
+  try {
+    resolution = await resolveLookups(lookups);
+  } catch {
+    resolution = { resolved: /* @__PURE__ */ new Map(), unexpectedFailure: true };
+  }
+  const { resolved, unexpectedFailure } = resolution;
+  const results = uniqueCveIds.map((cveId) => resolved.get(cveId)).filter((item) => Boolean(item));
+  const coverage = coverageFrom(results);
+  return {
+    matches: matches.map(
+      (match, index) => (
+        // codesentry-disable-next-line security/detect-object-injection -- index originates from map over the same cveIdsByMatch array.
+        enrichMatch(match, cveIdsByMatch[index] ?? [], resolved)
+      )
+    ),
+    coverage,
+    warnings: enrichmentWarnings(client, coverage, unexpectedFailure)
+  };
+};
+
 // src/scanner/run-with-concurrency-limit.ts
 import pLimit from "p-limit";
 var runWithConcurrencyLimit = async (items, concurrency, task) => {
@@ -521,77 +1407,131 @@ var SEVERITY_MAP2 = {
   high: "high",
   critical: "critical"
 };
-var vulnerabilityTitle = (vulnerability) => {
-  const firstVia = vulnerability.via[0];
-  if (typeof firstVia === "object" && firstVia?.title) {
-    return firstVia.title;
-  }
-  return 'ver "npm audit" para detalhes';
+var NVD_SEVERITY_MAP = {
+  LOW: "low",
+  MEDIUM: "medium",
+  HIGH: "high",
+  CRITICAL: "critical"
 };
+var SEVERITY_WEIGHT = { low: 0, medium: 1, high: 2, critical: 3 };
+var CANONICAL_ADVISORY_PATTERN = /(?:CVE-\d{4}-\d{4,}|GHSA-[0-9A-Z]{4}-[0-9A-Z]{4}-[0-9A-Z]{4})/gi;
 var npmFixSuggestion = (vulnerability) => {
   const { fixAvailable } = vulnerability;
-  if (fixAvailable === false) {
-    return "sem corre\xE7\xE3o dispon\xEDvel ainda";
-  }
-  if (fixAvailable === true) {
+  if (fixAvailable === false) return "sem corre\xE7\xE3o dispon\xEDvel ainda";
+  if (fixAvailable === true)
     return `atualize para uma vers\xE3o fora do intervalo vulner\xE1vel (${vulnerability.range})`;
-  }
   return `atualize para ${fixAvailable.name}@${fixAvailable.version}`;
 };
-var mapAuditReportToFindings = (report) => {
-  return Object.values(report.vulnerabilities).map((vulnerability) => ({
-    ruleId: "dependency-audit",
-    message: `Depend\xEAncia vulner\xE1vel: ${vulnerability.name} (${vulnerability.severity}) \u2014 ${vulnerabilityTitle(vulnerability)} \u2014 ${npmFixSuggestion(vulnerability)}`,
-    file: "package.json",
-    line: 1,
-    severity: SEVERITY_MAP2[vulnerability.severity]
-  }));
+var canonicalIdsFrom = (...values) => [
+  ...new Set(
+    values.flatMap((value) => String(value ?? "").match(CANONICAL_ADVISORY_PATTERN) ?? []).map((id) => id.toUpperCase())
+  )
+];
+var npmAdvisoryTitle = (advisory) => {
+  if (typeof advisory === "object" && advisory.title) return advisory.title;
+  if (typeof advisory === "string") return `vulnerabilidade transitiva via ${advisory}`;
+  return 'ver "npm audit" para detalhes';
 };
-var osvFixSuggestion = (fixedVersions) => fixedVersions.length ? `atualize para ${fixedVersions.join(" ou ")}` : "nenhuma vers\xE3o corrigida publicada pelo OSV.dev ainda";
-var buildOsvFinding = (pkg, vuln) => {
-  const fixedVersions = extractFixedVersions(vuln, pkg.name);
+var npmFixedVersions = (fixAvailable) => typeof fixAvailable === "object" ? [fixAvailable.version] : [];
+var npmFinding = (vulnerability, advisory, ids) => {
+  const title = npmAdvisoryTitle(advisory);
   return {
     ruleId: "dependency-audit",
-    message: `OSV ${vuln.id}: ${pkg.name}@${pkg.version} (${mapOsvSeverity(vuln)}) \u2014 ${vuln.summary ?? "ver OSV.dev para detalhes"} \u2014 ${osvFixSuggestion(fixedVersions)}`,
-    file: "package-lock.json",
+    message: `Depend\xEAncia vulner\xE1vel: ${vulnerability.name} (${vulnerability.severity}) \u2014 ${title} \u2014 ${npmFixSuggestion(vulnerability)}`,
+    file: "package.json",
     line: 1,
-    severity: mapOsvSeverity(vuln)
+    // codesentry-disable-next-line security/detect-object-injection -- vulnerability.severity is npm audit's own NpmAuditSeverity union, not attacker input; unknown values just look up as undefined.
+    severity: SEVERITY_MAP2[vulnerability.severity],
+    dependency: {
+      package: {
+        name: vulnerability.name,
+        installedVersion: "n\xE3o informada pelo npm audit",
+        fixedVersions: npmFixedVersions(vulnerability.fixAvailable)
+      },
+      advisory: { source: "npm", id: ids[0], aliases: ids.slice(1), summary: title }
+    }
   };
 };
-var findingsForLockedPackage = (pkg, vulnIdsByPackage, detailsById) => {
-  const ids = vulnIdsByPackage.get(`${pkg.name}@${pkg.version}`) ?? [];
-  return ids.map((id) => detailsById.get(id)).filter((vuln) => vuln !== void 0).map((vuln) => buildOsvFinding(pkg, vuln));
+var advisoryIds = (advisory) => typeof advisory === "object" ? canonicalIdsFrom(advisory.source, advisory.url, advisory.title) : canonicalIdsFrom(advisory);
+var advisoryIdentity = (advisory, ids) => {
+  if (ids.length) return `ids:${[...ids].sort().join(",")}`;
+  if (typeof advisory === "object")
+    return `fields:${advisory.source ?? ""}|${advisory.url ?? ""}|${advisory.title ?? ""}`;
+  return `via:${advisory ?? "unknown"}`;
 };
-var mapOsvFindingsToRuleFindings = (lockedPackages, vulnIdsByPackage, detailsById, npmFlaggedNames) => lockedPackages.filter((pkg) => !npmFlaggedNames.has(pkg.name)).flatMap((pkg) => findingsForLockedPackage(pkg, vulnIdsByPackage, detailsById));
+var npmAdvisoryEntries = (vulnerability) => {
+  const structured = vulnerability.via.filter(
+    (advisory) => typeof advisory === "object"
+  );
+  const candidates = structured.length ? structured : [vulnerability.via.find((advisory) => typeof advisory === "string")];
+  const seen = /* @__PURE__ */ new Set();
+  return candidates.filter((advisory) => {
+    const identity = advisoryIdentity(advisory, advisoryIds(advisory));
+    if (seen.has(identity)) return false;
+    seen.add(identity);
+    return true;
+  });
+};
+var mapAuditReportToFindings = (report, osvIdsByPackage = /* @__PURE__ */ new Map()) => Object.values(report.vulnerabilities).flatMap((vulnerability) => {
+  const osvIds = osvIdsByPackage.get(vulnerability.name) ?? /* @__PURE__ */ new Set();
+  return npmAdvisoryEntries(vulnerability).flatMap((advisory) => {
+    const ids = advisoryIds(advisory);
+    return ids.some((id) => osvIds.has(id)) ? [] : [npmFinding(vulnerability, advisory, ids)];
+  });
+});
+var osvFixSuggestion = (fixedVersions) => fixedVersions.length ? `atualize para ${fixedVersions.join(" ou ")}` : "nenhuma vers\xE3o corrigida publicada pelo OSV.dev ainda";
+var normalizeOsvAliases = (aliases) => {
+  const normalized = /* @__PURE__ */ new Map();
+  for (const alias of aliases ?? []) {
+    const trimmed = alias.trim();
+    if (!trimmed) continue;
+    const value = extractCveAliases([trimmed])[0] ?? trimmed;
+    const key = value.toUpperCase();
+    if (!normalized.has(key)) normalized.set(key, value);
+  }
+  return [...normalized.values()];
+};
+var highestNvdSeverity = (results) => results.filter((result) => result.status === "found").map((result) => result.data.cvss?.severity).filter((severity) => severity !== void 0).map((severity) => NVD_SEVERITY_MAP[severity]).filter((severity) => severity !== void 0).sort((a, b) => SEVERITY_WEIGHT[b] - SEVERITY_WEIGHT[a])[0];
+var buildOsvFinding = (match) => ({
+  ruleId: "dependency-audit",
+  message: `OSV ${match.vuln.id}: ${match.pkg.name}@${match.pkg.version} \u2014 ${match.vuln.summary ?? "ver OSV.dev para detalhes"} \u2014 ${osvFixSuggestion(match.fixedVersions)}`,
+  file: "package-lock.json",
+  line: 1,
+  severity: highestNvdSeverity(match.nvd) ?? mapOsvSeverity(match.vuln),
+  dependency: {
+    package: {
+      name: match.pkg.name,
+      installedVersion: match.pkg.version,
+      fixedVersions: match.fixedVersions
+    },
+    advisory: {
+      source: "osv",
+      id: match.vuln.id,
+      aliases: normalizeOsvAliases(match.vuln.aliases),
+      summary: match.vuln.summary
+    },
+    nvd: match.nvd
+  }
+});
+var unenrichedMatch = (match) => ({
+  ...match,
+  cveIds: extractCveAliases(match.vuln.aliases),
+  nvd: []
+});
+var collectMatches = (lockedPackages, vulnIdsByPackage, detailsById) => lockedPackages.flatMap(
+  (pkg) => [...new Set(vulnIdsByPackage.get(`${pkg.name}@${pkg.version}`) ?? [])].map((id) => detailsById.get(id)).filter((vuln) => vuln !== void 0).map((vuln) => ({ pkg, vuln, fixedVersions: extractFixedVersions(vuln, pkg.name) }))
+);
 var errorMessage = (error) => error instanceof Error ? error.message : "erro desconhecido";
 var hasVulnerabilitiesRecord = (value) => typeof value === "object" && value !== null && typeof value.vulnerabilities === "object" && value.vulnerabilities !== null;
 var normalizeNpmAuditReport = (raw) => {
-  if (hasVulnerabilitiesRecord(raw)) {
-    return { report: { vulnerabilities: raw.vulnerabilities } };
-  }
+  if (hasVulnerabilitiesRecord(raw)) return { report: { vulnerabilities: raw.vulnerabilities } };
   const errorSummary = typeof raw === "object" && raw !== null && "error" in raw ? raw.error?.summary ?? "formato de resposta inesperado" : "formato de resposta inesperado";
   return {
     report: { vulnerabilities: {} },
     warning: `"npm audit" n\xE3o retornou um relat\xF3rio v\xE1lido: ${errorSummary}.`
   };
 };
-var combineWarnings = (...warnings) => {
-  const present = warnings.filter((warning) => Boolean(warning));
-  return present.length ? present.join(" ") : void 0;
-};
-var fetchDetailsForIds = (ids, fetchImpl) => ids.length ? fetchOsvVulnerabilityDetails(ids, fetchImpl) : Promise.resolve({ detailsById: /* @__PURE__ */ new Map(), warning: void 0 });
-var auditPackagesWithOsv = async (lockedPackages, npmFlaggedNames, fetchImpl = fetch) => {
-  try {
-    return await collectOsvAuditResult(lockedPackages, npmFlaggedNames, fetchImpl);
-  } catch (error) {
-    return {
-      findings: [],
-      checkedPackages: [],
-      warning: `N\xE3o foi poss\xEDvel consultar o OSV.dev: ${errorMessage(error)}.`
-    };
-  }
-};
-var collectOsvAuditResult = async (lockedPackages, npmFlaggedNames, fetchImpl) => {
+var collectOsvMatches = async (lockedPackages, fetchImpl) => {
   try {
     const {
       vulnIdsByPackage,
@@ -599,19 +1539,20 @@ var collectOsvAuditResult = async (lockedPackages, npmFlaggedNames, fetchImpl) =
       warning: batchWarning
     } = await queryOsvBatch(lockedPackages, fetchImpl);
     const ids = [...new Set([...vulnIdsByPackage.values()].flat())];
-    const { detailsById, warning: detailsWarning } = await fetchDetailsForIds(ids, fetchImpl);
+    const detailResult = ids.length ? await fetchOsvVulnerabilityDetails(ids, fetchImpl) : { detailsById: /* @__PURE__ */ new Map(), warning: void 0 };
     return {
-      findings: mapOsvFindingsToRuleFindings(
-        lockedPackages,
-        vulnIdsByPackage,
-        detailsById,
-        npmFlaggedNames
-      ),
+      matches: collectMatches(lockedPackages, vulnIdsByPackage, detailResult.detailsById),
       checkedPackages,
-      warning: combineWarnings(batchWarning, detailsWarning)
+      warnings: [batchWarning, detailResult.warning].filter(
+        (warning) => Boolean(warning)
+      )
     };
   } catch (error) {
-    throw new Error("N\xE3o foi poss\xEDvel consolidar os resultados do OSV.dev.", { cause: error });
+    return {
+      matches: [],
+      checkedPackages: [],
+      warnings: [`N\xE3o foi poss\xEDvel consultar o OSV.dev: ${errorMessage(error)}.`]
+    };
   }
 };
 var runNpmAudit = async (targetDir) => {
@@ -623,64 +1564,124 @@ var runNpmAudit = async (targetDir) => {
     }));
   } catch (error) {
     const stdoutFromError = error.stdout;
-    if (!stdoutFromError) {
+    if (!stdoutFromError)
       throw new Error(`N\xE3o foi poss\xEDvel executar "npm audit" em "${targetDir}".`, { cause: error });
-    }
     stdout = stdoutFromError;
   }
   return JSON.parse(stdout);
 };
-var auditPackagesFromLockfile = async (targetDir, npmFlaggedNames, fetchImpl) => {
+var osvIdentityIndex = (matches) => {
+  const index = /* @__PURE__ */ new Map();
+  matches.forEach((match) => {
+    const ids = index.get(match.pkg.name) ?? /* @__PURE__ */ new Set();
+    [match.vuln.id, ...match.vuln.aliases ?? []].forEach((id) => ids.add(id.trim().toUpperCase()));
+    index.set(match.pkg.name, ids);
+  });
+  return index;
+};
+var emptyNvdCoverage = (total, failed) => ({
+  total,
+  enriched: 0,
+  notFound: 0,
+  failed,
+  cacheHits: 0
+});
+var resolveNvdClient = (options) => options.nvdClient ?? createNvdClient({
+  fetchImpl: options.fetchImpl,
+  apiKey: options.nvdApiKey ?? process.env.NVD_API_KEY,
+  cache: options.nvdCache ?? createNvdCache()
+});
+var enrichWithNvdIfEnabled = async (collected, options) => {
+  if (!options.nvdEnabled) {
+    return { matches: collected.matches.map(unenrichedMatch), nvd: false, warnings: [] };
+  }
+  const uniqueCveIds = new Set(collected.matches.flatMap((match) => extractCveAliases(match.vuln.aliases)));
+  if (uniqueCveIds.size === 0) {
+    return { matches: collected.matches.map(unenrichedMatch), nvd: emptyNvdCoverage(0, 0), warnings: [] };
+  }
   try {
-    const raw = await readFile(join(targetDir, "package-lock.json"), "utf-8");
-    const lockedPackages = parsePackageLock(raw);
-    const osvResult = await auditPackagesWithOsv(lockedPackages, npmFlaggedNames, fetchImpl);
+    const enrichment = await enrichOsvMatchesWithNvd(collected.matches, resolveNvdClient(options));
+    return { matches: enrichment.matches, nvd: enrichment.coverage, warnings: enrichment.warnings };
+  } catch {
+    const total = uniqueCveIds.size;
     return {
-      findings: osvResult.findings,
-      packagesAudited: lockedPackages.length,
-      osvChecked: { checked: osvResult.checkedPackages.length, total: lockedPackages.length },
-      osvCheckedPackages: osvResult.checkedPackages.map((pkg) => `${pkg.name}@${pkg.version}`).sort(),
-      warning: osvResult.warning
+      matches: collected.matches.map(unenrichedMatch),
+      nvd: emptyNvdCoverage(total, total),
+      warnings: [
+        `N\xE3o foi poss\xEDvel consultar o NVD para ${total} CVE(s); os findings OSV foram preservados.`
+      ]
     };
+  }
+};
+var successfulLockfileAudit = (lockedPackages, collected, enrichment) => ({
+  findings: enrichment.matches.map(buildOsvFinding),
+  matches: collected.matches,
+  packagesAudited: lockedPackages.length,
+  osvChecked: { checked: collected.checkedPackages.length, total: lockedPackages.length },
+  osvCheckedPackages: collected.checkedPackages.map((pkg) => `${pkg.name}@${pkg.version}`).sort(),
+  nvd: enrichment.nvd,
+  warnings: [...collected.warnings, ...enrichment.warnings]
+});
+var auditPackagesFromLockfile = async (targetDir, options) => {
+  try {
+    const raw = await readFile2(join2(targetDir, "package-lock.json"), "utf-8");
+    const lockedPackages = parsePackageLock(raw);
+    const collected = await collectOsvMatches(lockedPackages, options.fetchImpl);
+    const enrichment = await enrichWithNvdIfEnabled(collected, options);
+    return successfulLockfileAudit(lockedPackages, collected, enrichment);
   } catch (error) {
     return {
       findings: [],
+      matches: [],
       packagesAudited: false,
-      warning: `N\xE3o foi poss\xEDvel checar o OSV.dev: ${errorMessage(error)}.`
+      nvd: options.nvdEnabled ? { total: 0, enriched: 0, notFound: 0, failed: 0, cacheHits: 0 } : false,
+      warnings: [`N\xE3o foi poss\xEDvel checar o OSV.dev: ${errorMessage(error)}.`]
     };
   }
 };
-var runDependencyAudit = async (targetDir, fetchImpl = fetch) => {
+var normalizeOptions = (optionsOrFetch) => typeof optionsOrFetch === "function" ? { fetchImpl: optionsOrFetch } : optionsOrFetch ?? {};
+var buildDependencyAuditResult = (startedAt, npmReport, npmWarning, osv) => {
+  const npmFindings = mapAuditReportToFindings(npmReport, osvIdentityIndex(osv.matches));
+  const warnings = [npmWarning, ...osv.warnings].filter((warning) => Boolean(warning));
+  return {
+    scannedFiles: 1,
+    findings: [...npmFindings, ...osv.findings],
+    durationMs: Date.now() - startedAt,
+    engines: {
+      dependencyAudit: osv.packagesAudited === false ? Object.keys(npmReport.vulnerabilities).length : osv.packagesAudited,
+      osv: osv.osvChecked,
+      nvd: osv.nvd
+    },
+    osvCheckedPackages: osv.osvCheckedPackages,
+    warnings: warnings.length ? warnings : void 0
+  };
+};
+var runDependencyAudit = async (targetDir, optionsOrFetch) => {
   const startedAt = Date.now();
+  const supplied = normalizeOptions(optionsOrFetch);
+  const options = {
+    ...supplied,
+    fetchImpl: supplied.fetchImpl ?? fetch,
+    nvdEnabled: supplied.nvdEnabled ?? true
+  };
   try {
-    const { report: npmReport, warning: npmWarning } = normalizeNpmAuditReport(await runNpmAudit(targetDir));
-    const npmFindings = mapAuditReportToFindings(npmReport);
-    const npmFlaggedNames = new Set(Object.keys(npmReport.vulnerabilities));
-    const osv = await auditPackagesFromLockfile(targetDir, npmFlaggedNames, fetchImpl);
-    const warnings = combineWarnings(npmWarning, osv.warning);
-    return {
-      scannedFiles: 1,
-      findings: [...npmFindings, ...osv.findings],
-      durationMs: Date.now() - startedAt,
-      engines: {
-        dependencyAudit: osv.packagesAudited === false ? npmFlaggedNames.size : osv.packagesAudited,
-        osv: osv.osvChecked
-      },
-      osvCheckedPackages: osv.osvCheckedPackages,
-      warnings: warnings ? [warnings] : void 0
-    };
+    const { report: npmReport, warning: npmWarning } = normalizeNpmAuditReport(
+      await (options.npmAuditRunner ?? runNpmAudit)(targetDir)
+    );
+    const osv = await auditPackagesFromLockfile(targetDir, options);
+    return buildDependencyAuditResult(startedAt, npmReport, npmWarning, osv);
   } catch (error) {
     throw new Error(`N\xE3o foi poss\xEDvel auditar depend\xEAncias em "${targetDir}".`, { cause: error });
   }
 };
 
 // src/scanner/scanner.ts
-import { readFile as readFile2 } from "fs/promises";
+import { readFile as readFile3 } from "fs/promises";
 import { availableParallelism } from "os";
 
 // src/scanner/file-finder.ts
 import { readdir } from "fs/promises";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 
 // src/scanner/ignore-patterns.ts
 var ALWAYS_IGNORED_DIR_NAMES = ["node_modules", ".git", "dist", ".next", ".angular"];
@@ -694,10 +1695,10 @@ var isTestFileName = (fileName) => TEST_FILE_NAME_PATTERN.test(fileName);
 var SCANNABLE_EXTENSIONS = [".js", ".ts", ".jsx", ".tsx"];
 var isScannable = (fileName) => SCANNABLE_EXTENSIONS.some((ext) => fileName.endsWith(ext));
 var filesFromDirectory = async (currentDir, entry, includeTests) => {
-  return isIgnoredDirName(entry.name, includeTests) ? [] : walk(join2(currentDir, entry.name), includeTests);
+  return isIgnoredDirName(entry.name, includeTests) ? [] : walk(join3(currentDir, entry.name), includeTests);
 };
 var filesFromFile = (currentDir, entry, includeTests) => {
-  return entry.isFile() && isScannable(entry.name) && (includeTests || !isTestFileName(entry.name)) ? [join2(currentDir, entry.name)] : [];
+  return entry.isFile() && isScannable(entry.name) && (includeTests || !isTestFileName(entry.name)) ? [join3(currentDir, entry.name)] : [];
 };
 var filesFromEntry = async (currentDir, entry, includeTests) => {
   if (entry.isDirectory()) {
@@ -733,7 +1734,7 @@ var parseErrorFinding = (filePath, error) => ({
 });
 var readFileContent = async (filePath) => {
   try {
-    return await readFile2(filePath, "utf-8");
+    return await readFile3(filePath, "utf-8");
   } catch (error) {
     throw new Error(`N\xE3o foi poss\xEDvel ler o arquivo "${filePath}".`, { cause: error });
   }
@@ -781,13 +1782,13 @@ var runScan = async (targetDir, rules, concurrency = DEFAULT_SCAN_CONCURRENCY, i
 
 // src/scanner/semgrep.ts
 import { execFile as execFile2 } from "child_process";
-import { delimiter, dirname as dirname2 } from "path";
+import { delimiter, dirname as dirname3 } from "path";
 import { promisify as promisify2 } from "util";
 
 // src/scanner/semgrep-runtime.ts
 import { existsSync, readFileSync } from "fs";
 import { createRequire } from "module";
-import { dirname, resolve } from "path";
+import { dirname as dirname2, resolve } from "path";
 var require2 = createRequire(import.meta.url);
 var packageForPlatform = (platform, architecture) => {
   if (platform === "linux" && architecture === "x64") {
@@ -809,7 +1810,7 @@ var resolveBundledSemgrepRuntime = (platform = process.platform, architecture =
     const manifestPath = resolveManifestPath(packageName);
     const manifest = JSON.parse(readFileSync(manifestPath, "utf-8"));
     const runtime = {
-      semgrep: resolve(dirname(manifestPath), manifest.semgrep)
+      semgrep: resolve(dirname2(manifestPath), manifest.semgrep)
     };
     if (!existsSync(runtime.semgrep)) {
       throw new Error("artefatos do runtime ausentes");
@@ -880,11 +1881,11 @@ var semgrepArgs = (ruleset, includeTests) => [
   "."
 ];
 var semgrepEnvironment = (runtime) => {
-  const semgrepDir = dirname2(runtime.semgrep);
+  const semgrepDir = dirname3(runtime.semgrep);
   const systemPathFallback = process.platform === "win32" ? "C:\\Windows\\System32;C:\\Windows" : "/usr/local/bin:/usr/bin:/bin";
   return {
     ...process.env,
-    PATH: `${semgrepDir}${delimiter}${dirname2(semgrepDir)}${delimiter}${process.env.PATH ?? ""}${delimiter}${systemPathFallback}`
+    PATH: `${semgrepDir}${delimiter}${dirname3(semgrepDir)}${delimiter}${process.env.PATH ?? ""}${delimiter}${systemPathFallback}`
   };
 };
 var executeSemgrep = async (targetDir, runtime, ruleset, execute, includeTests) => {
@@ -943,9 +1944,9 @@ var writeMarkdownReportIfNeeded = async (result, targetDir) => {
   if (result.findings.length <= MARKDOWN_REPORT_FINDINGS_THRESHOLD) {
     return;
   }
-  const filePath = join3(targetDir, generateMarkdownReportFilename());
+  const filePath = join4(targetDir, generateMarkdownReportFilename());
   try {
-    await writeFile(filePath, toMarkdownReport(result), "utf-8");
+    await writeFile2(filePath, toMarkdownReport(result), "utf-8");
     console.log(chalk2.cyan(`
 Relat\xF3rio detalhado gerado em: ${filePath}`));
   } catch (error) {
@@ -964,15 +1965,20 @@ var runNativeAndSemgrep = async (path, rules, options) => {
     throw new Error(`Falha durante a an\xE1lise: ${errorMessage3(error)}`, { cause: error });
   }
 };
-var runOptionalDependencyAudit = async (path, merged) => {
+var runOptionalDependencyAudit = async (path, merged, options) => {
   try {
-    const auditResult = await runDependencyAudit(path);
+    const auditResult = await runDependencyAudit(path, { nvdEnabled: options.nvd ?? true });
     return finalizeScanResult(
       {
         ...merged,
         findings: [...merged.findings, ...auditResult.findings],
+        durationMs: merged.durationMs + auditResult.durationMs,
         warnings: [...merged.warnings ?? [], ...auditResult.warnings ?? []],
-        engines: { ...merged.engines, osv: auditResult.engines?.osv },
+        engines: {
+          ...merged.engines,
+          osv: auditResult.engines?.osv,
+          nvd: auditResult.engines?.nvd
+        },
         osvCheckedPackages: auditResult.osvCheckedPackages
       },
       auditResult.engines?.dependencyAudit ?? false
@@ -980,14 +1986,15 @@ var runOptionalDependencyAudit = async (path, merged) => {
   } catch (error) {
     return finalizeScanResult({
       ...merged,
-      warnings: [...merged.warnings ?? [], `Auditoria de depend\xEAncias falhou: ${errorMessage3(error)}.`]
+      warnings: [...merged.warnings ?? [], `Auditoria de depend\xEAncias falhou: ${errorMessage3(error)}.`],
+      engines: { ...merged.engines, nvd: false }
     });
   }
 };
 var runScanEngines = async (path, rules, options) => {
   try {
     const merged = await runNativeAndSemgrep(path, rules, options);
-    return options.deps ? runOptionalDependencyAudit(path, merged) : finalizeScanResult(merged);
+    return options.deps ? runOptionalDependencyAudit(path, merged, options) : finalizeScanResult(merged);
   } catch (error) {
     throw error;
   }
@@ -1143,7 +2150,10 @@ var printAuditResult = (result, json) => {
 };
 var auditAndReport = async (path, options) => {
   try {
-    printAuditResult(await runDependencyAudit(path), options.json ?? false);
+    printAuditResult(
+      await runDependencyAudit(path, { nvdEnabled: options.nvd ?? true }),
+      options.json ?? false
+    );
   } catch (error) {
     const message = error instanceof Error ? error.message : "erro desconhecido";
     process.exitCode = 1;
@@ -1151,9 +2161,7 @@ var auditAndReport = async (path, options) => {
   }
 };
 var registerDependencyAuditCommand = (program) => {
-  program.command("dependency-audit").description(
-    'Audita as depend\xEAncias do projeto contra vulnerabilidades conhecidas (via "npm audit" e OSV.dev; requer npm no PATH e acesso \xE0 rede)'
-  ).argument("[path]", "diret\xF3rio do projeto a ser auditado", ".").option("--json", "exibe o resultado em JSON").action((path, options) => auditAndReport(path, options));
+  program.command("dependency-audit").description("Audita depend\xEAncias via npm audit e OSV.dev, com enriquecimento opcional do NVD").argument("[path]", "diret\xF3rio do projeto a ser auditado", ".").option("--json", "exibe o resultado em JSON").option("--no-nvd", "n\xE3o enriquece os resultados OSV com dados do NVD").action((path, options) => auditAndReport(path, options));
 };
 
 // src/rules/empty-catch.rule.ts
@@ -2952,9 +3960,9 @@ var registerScanCommand = (program) => {
   withScanOptions(
     program.command("scan").description("Analisa um diret\xF3rio em busca de vulnerabilidades e problemas de qualidade").argument("[path]", "diret\xF3rio a ser analisado", ".").option("--concurrency <n>", "limita arquivos processados em paralelo", parseConcurrency).option("--config <file>", "usa um ruleset Semgrep YAML local", parseLocalSemgrepConfig).option(
       "--no-deps",
-      "n\xE3o inclui a auditoria de depend\xEAncias (npm audit + OSV.dev) neste scan \u2014 permite rodar offline"
+      "n\xE3o inclui a auditoria de depend\xEAncias (npm audit + OSV.dev + NVD) neste scan \u2014 permite rodar offline"
     )
-  ).action(
+  ).option("--no-nvd", "n\xE3o enriquece os resultados OSV com dados do NVD").action(
     (path, options) => scanAndReport(path, allRules, "Scanning files...", { ...options, semgrep: true })
   );
 };