cve-scanner 0.0.0 → 0.0.2

package/dist/core/ProjectRootDiscovery.test.js

@@ -0,0 +1,47 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const node_test_1 = require("node:test");
+const ProjectRootDiscovery_1 = require("./ProjectRootDiscovery");
+function makeScanDir() {
+    return (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'cve-scanner-roots-'));
+}
+(0, node_test_1.test)('finds the scan dir itself when it has a manifest', () => {
+    const dir = makeScanDir();
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(dir, 'package-lock.json'), '{}');
+    strict_1.default.deepEqual((0, ProjectRootDiscovery_1.findProjectRoots)(dir), [dir]);
+});
+(0, node_test_1.test)('discovers independent sub-projects in a monorepo with no root manifest', () => {
+    const dir = makeScanDir();
+    (0, node_fs_1.mkdirSync)((0, node_path_1.join)(dir, 'backend'), { recursive: true });
+    (0, node_fs_1.mkdirSync)((0, node_path_1.join)(dir, 'frontend'), { recursive: true });
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(dir, 'backend', 'pom.xml'), '<project/>');
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(dir, 'frontend', 'package-lock.json'), '{}');
+    strict_1.default.deepEqual((0, ProjectRootDiscovery_1.findProjectRoots)(dir).sort(), [(0, node_path_1.join)(dir, 'backend'), (0, node_path_1.join)(dir, 'frontend')].sort());
+});
+(0, node_test_1.test)('does not descend into a directory once it qualifies as a root', () => {
+    const dir = makeScanDir();
+    (0, node_fs_1.mkdirSync)((0, node_path_1.join)(dir, 'nested-module'), { recursive: true });
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(dir, 'pom.xml'), '<project/>');
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(dir, 'nested-module', 'pom.xml'), '<project/>');
+    strict_1.default.deepEqual((0, ProjectRootDiscovery_1.findProjectRoots)(dir), [dir]);
+});
+(0, node_test_1.test)('skips noise directories like node_modules and .git', () => {
+    const dir = makeScanDir();
+    (0, node_fs_1.mkdirSync)((0, node_path_1.join)(dir, 'node_modules', 'some-lib'), { recursive: true });
+    (0, node_fs_1.mkdirSync)((0, node_path_1.join)(dir, '.git'), { recursive: true });
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(dir, 'node_modules', 'some-lib', 'package-lock.json'), '{}');
+    (0, node_fs_1.writeFileSync)((0, node_path_1.join)(dir, '.git', 'pom.xml'), '<project/>');
+    strict_1.default.deepEqual((0, ProjectRootDiscovery_1.findProjectRoots)(dir), []);
+});
+(0, node_test_1.test)('returns an empty list when no manifest exists anywhere', () => {
+    const dir = makeScanDir();
+    strict_1.default.deepEqual((0, ProjectRootDiscovery_1.findProjectRoots)(dir), []);
+});
+//# sourceMappingURL=ProjectRootDiscovery.test.js.map

package/dist/core/ProjectRootDiscovery.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProjectRootDiscovery.test.js","sourceRoot":"","sources":["../../src/core/ProjectRootDiscovery.test.ts"],"names":[],"mappings":";;;;;AAAA,gEAAwC;AACxC,qCAAgE;AAChE,qCAAiC;AACjC,yCAAiC;AACjC,yCAAiC;AACjC,iEAA0D;AAE1D,SAAS,WAAW;IAClB,OAAO,IAAA,qBAAW,EAAC,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,IAAA,gBAAI,EAAC,kDAAkD,EAAE,GAAG,EAAE;IAC5D,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;IAC1B,IAAA,uBAAa,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,mBAAmB,CAAC,EAAE,IAAI,CAAC,CAAC;IACpD,gBAAM,CAAC,SAAS,CAAC,IAAA,uCAAgB,EAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AACjD,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,wEAAwE,EAAE,GAAG,EAAE;IAClF,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;IAC1B,IAAA,mBAAS,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,IAAA,mBAAS,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,IAAA,uBAAa,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,YAAY,CAAC,CAAC;IAC7D,IAAA,uBAAa,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,UAAU,EAAE,mBAAmB,CAAC,EAAE,IAAI,CAAC,CAAC;IAEhE,gBAAM,CAAC,SAAS,CACd,IAAA,uCAAgB,EAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAC5B,CAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,SAAS,CAAC,EAAE,IAAA,gBAAI,EAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CACrD,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,+DAA+D,EAAE,GAAG,EAAE;IACzE,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;IAC1B,IAAA,mBAAS,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,eAAe,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,IAAA,uBAAa,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,SAAS,CAAC,EAAE,YAAY,CAAC,CAAC;IAClD,IAAA,uBAAa,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,eAAe,EAAE,SAAS,CAAC,EAAE,YAAY,CAAC,CAAC;IAEnE,gBAAM,CAAC,SAAS,CAAC,IAAA,uCAAgB,EAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;AACjD,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,oDAAoD,EAAE,GAAG,EAAE;IAC9D,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;IAC1B,IAAA,mBAAS,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,cAAc,EAAE,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtE,IAAA,mBAAS,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,IAAA,uBAAa,EACX,IAAA,gBAAI,EAAC,GAAG,EAAE,cAAc,EAAE,UAAU,EAAE,mBAAmB,CAAC,EAC1D,IAAI,CACL,CAAC;IACF,IAAA,uBAAa,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,YAAY,CAAC,CAAC;IAE1D,gBAAM,CAAC,SAAS,CAAC,IAAA,uCAAgB,EAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;AAC9C,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,wDAAwD,EAAE,GAAG,EAAE;IAClE,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;IAC1B,gBAAM,CAAC,SAAS,CAAC,IAAA,uCAAgB,EAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;AAC9C,CAAC,CAAC,CAAC"}

package/dist/core/Scanner.d.ts

@@ -0,0 +1,19 @@
+import { DatasetLoader } from './DatasetLoader';
+import { Detector, Finding, ScanOptions } from './types';
+export type ProjectRootFinder = (scanDir: string) => string[];
+export declare class Scanner {
+    private detectors;
+    private dataset;
+    private findRoots;
+    constructor(detectors: Detector[], dataset: DatasetLoader, findRoots?: ProjectRootFinder);
+    scan(options: ScanOptions): Promise<Finding[]>;
+    /**
+     * Runs every applicable detector in every independent project root found
+     * under `options.scanDir` (a monorepo of unrelated projects yields more
+     * than one root) — see specs/35-project-discovery.md.
+     */
+    private detectArtifacts;
+    private detectArtifactsInRoot;
+    private match;
+    private isAffected;
+}

package/dist/core/Scanner.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Scanner = void 0;
+const ProjectRootDiscovery_1 = require("./ProjectRootDiscovery");
+const VersionComparator_1 = require("./VersionComparator");
+class Scanner {
+    constructor(detectors, dataset, findRoots = ProjectRootDiscovery_1.findProjectRoots) {
+        this.detectors = detectors;
+        this.dataset = dataset;
+        this.findRoots = findRoots;
+    }
+    async scan(options) {
+        const artifacts = await this.detectArtifacts(options);
+        return artifacts.flatMap((artifact) => this.match(artifact));
+    }
+    /**
+     * Runs every applicable detector in every independent project root found
+     * under `options.scanDir` (a monorepo of unrelated projects yields more
+     * than one root) — see specs/35-project-discovery.md.
+     */
+    async detectArtifacts(options) {
+        const roots = this.findRoots(options.scanDir);
+        const perRoot = await Promise.all(roots.map((root) => this.detectArtifactsInRoot({ ...options, scanDir: root })));
+        return perRoot.flat();
+    }
+    async detectArtifactsInRoot(options) {
+        const applicable = await Promise.all(this.detectors.map(async (detector) => (await detector.isApplicable(options)) ? detector : undefined));
+        const results = await Promise.all(applicable
+            .filter((d) => d !== undefined)
+            .map((d) => d.detect(options)));
+        return results.flat();
+    }
+    match(artifact) {
+        const entries = this.dataset.findEntries(artifact.ecosystem, artifact.coordinate);
+        return entries
+            .filter((entry) => this.isAffected(artifact.version, entry))
+            .flatMap((entry) => entry.cves.map((cve) => ({ artifact, cve })));
+    }
+    isAffected(version, entry) {
+        if (entry.versionExact !== undefined) {
+            return (0, VersionComparator_1.compareVersions)(version, entry.versionExact) === 0;
+        }
+        if (entry.versionStartIncluding !== undefined &&
+            (0, VersionComparator_1.compareVersions)(version, entry.versionStartIncluding) < 0) {
+            return false;
+        }
+        if (entry.versionStartExcluding !== undefined &&
+            (0, VersionComparator_1.compareVersions)(version, entry.versionStartExcluding) <= 0) {
+            return false;
+        }
+        if (entry.versionEndIncluding !== undefined &&
+            (0, VersionComparator_1.compareVersions)(version, entry.versionEndIncluding) > 0) {
+            return false;
+        }
+        if (entry.versionEndExcluding !== undefined &&
+            (0, VersionComparator_1.compareVersions)(version, entry.versionEndExcluding) >= 0) {
+            return false;
+        }
+        return (entry.versionStartIncluding !== undefined ||
+            entry.versionStartExcluding !== undefined ||
+            entry.versionEndIncluding !== undefined ||
+            entry.versionEndExcluding !== undefined);
+    }
+}
+exports.Scanner = Scanner;
+//# sourceMappingURL=Scanner.js.map

package/dist/core/Scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Scanner.js","sourceRoot":"","sources":["../../src/core/Scanner.ts"],"names":[],"mappings":";;;AACA,iEAA0D;AAC1D,2DAAsD;AAWtD;IACE,YACU,SAAqB,EACrB,OAAsB,EACtB,SAAS,GAAsB,uCAAgB;yBAF/C,SAAS;uBACT,OAAO;yBACP,SAAS;IAChB,CAAC;IAEJ,KAAK,CAAC,IAAI,CAAC,OAAoB;QAC7B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACtD,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,eAAe,CAC3B,OAAoB;QAEpB,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACjB,IAAI,CAAC,qBAAqB,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAC1D,CACF,CAAC;QACF,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;IACxB,CAAC;IAEO,KAAK,CAAC,qBAAqB,CACjC,OAAoB;QAEpB,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAClC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CACpC,CAAC,MAAM,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAC9D,CACF,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,UAAU;aACP,MAAM,CAAC,CAAC,CAAC,EAAiB,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;aAC7C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CACjC,CAAC;QACF,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;IACxB,CAAC;IAEO,KAAK,CAAC,QAA0B;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CACtC,QAAQ,CAAC,SAAS,EAClB,QAAQ,CAAC,UAAU,CACpB,CAAC;QACF,OAAO,OAAO;aACX,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;aAC3D,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC;IAEO,UAAU,CAAC,OAAe,EAAE,KAAsB;QACxD,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,IAAA,mCAAe,EAAC,OAAO,EAAE,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC5D,CAAC;QAED,IACE,KAAK,CAAC,qBAAqB,KAAK,SAAS;YACzC,IAAA,mCAAe,EAAC,OAAO,EAAE,KAAK,CAAC,qBAAqB,CAAC,GAAG,CAAC,EACzD,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IACE,KAAK,CAAC,qBAAqB,KAAK,SAAS;YACzC,IAAA,mCAAe,EAAC,OAAO,EAAE,KAAK,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAC1D,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IACE,KAAK,CAAC,mBAAmB,KAAK,SAAS;YACvC,IAAA,mCAAe,EAAC,OAAO,EAAE,KAAK,CAAC,mBAAmB,CAAC,GAAG,CAAC,EACvD,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IACE,KAAK,CAAC,mBAAmB,KAAK,SAAS;YACvC,IAAA,mCAAe,EAAC,OAAO,EAAE,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,EACxD,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,CACL,KAAK,CAAC,qBAAqB,KAAK,SAAS;YACzC,KAAK,CAAC,qBAAqB,KAAK,SAAS;YACzC,KAAK,CAAC,mBAAmB,KAAK,SAAS;YACvC,KAAK,CAAC,mBAAmB,KAAK,SAAS,CACxC,CAAC;IACJ,CAAC;CACF"}

package/dist/core/Scanner.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/Scanner.test.js

@@ -0,0 +1,157 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_test_1 = require("node:test");
+const DatasetLoader_1 = require("./DatasetLoader");
+const Scanner_1 = require("./Scanner");
+const SINGLE_ROOT = (scanDir) => [scanDir];
+function fakeDetector(artifacts) {
+    return {
+        ecosystem: artifacts[0]?.ecosystem ?? 'npm',
+        isApplicable: async () => true,
+        detect: async () => artifacts,
+    };
+}
+const dataset = {
+    generatedAt: '2026-01-01T00:00:00.000Z',
+    entries: [
+        {
+            ecosystem: 'maven',
+            cpe: 'cpe:2.3:a:com.example:lib:*:*:*:*:*:*:*:*',
+            versionEndExcluding: '2.0.0',
+            cves: [{ id: 'CVE-1', score: 8, title: 'range bound' }],
+        },
+        {
+            ecosystem: 'npm',
+            cpe: 'cpe:2.3:a:left-pad:left-pad:*:*:*:*:*:*:*:*',
+            versionExact: '1.0.0',
+            cves: [{ id: 'CVE-2', score: 5, title: 'exact match' }],
+        },
+    ],
+};
+(0, node_test_1.test)('matches an artifact whose version falls within a bounded range', async () => {
+    const scanner = new Scanner_1.Scanner([
+        fakeDetector([
+            {
+                ecosystem: 'maven',
+                coordinate: 'com.example:lib',
+                version: '1.5.0',
+                source: 'test',
+                projectRoot: '/irrelevant',
+            },
+        ]),
+    ], new DatasetLoader_1.DatasetLoader(dataset), SINGLE_ROOT);
+    const findings = await scanner.scan({ scanDir: '/irrelevant' });
+    strict_1.default.equal(findings.length, 1);
+    strict_1.default.equal(findings[0].cve.id, 'CVE-1');
+});
+(0, node_test_1.test)('does not match an artifact whose version is outside the range', async () => {
+    const scanner = new Scanner_1.Scanner([
+        fakeDetector([
+            {
+                ecosystem: 'maven',
+                coordinate: 'com.example:lib',
+                version: '2.0.0',
+                source: 'test',
+                projectRoot: '/irrelevant',
+            },
+        ]),
+    ], new DatasetLoader_1.DatasetLoader(dataset), SINGLE_ROOT);
+    strict_1.default.deepEqual(await scanner.scan({ scanDir: '/irrelevant' }), []);
+});
+(0, node_test_1.test)('matches an exact-version entry only on that exact version', async () => {
+    const matching = new Scanner_1.Scanner([
+        fakeDetector([
+            {
+                ecosystem: 'npm',
+                coordinate: 'left-pad',
+                version: '1.0.0',
+                source: 'test',
+                projectRoot: '/irrelevant',
+            },
+        ]),
+    ], new DatasetLoader_1.DatasetLoader(dataset), SINGLE_ROOT);
+    strict_1.default.equal((await matching.scan({ scanDir: '/irrelevant' }))[0].cve.id, 'CVE-2');
+    const nonMatching = new Scanner_1.Scanner([
+        fakeDetector([
+            {
+                ecosystem: 'npm',
+                coordinate: 'left-pad',
+                version: '1.0.1',
+                source: 'test',
+                projectRoot: '/irrelevant',
+            },
+        ]),
+    ], new DatasetLoader_1.DatasetLoader(dataset), SINGLE_ROOT);
+    strict_1.default.deepEqual(await nonMatching.scan({ scanDir: '/irrelevant' }), []);
+});
+(0, node_test_1.test)('merges results across multiple applicable detectors', async () => {
+    const scanner = new Scanner_1.Scanner([
+        fakeDetector([
+            {
+                ecosystem: 'maven',
+                coordinate: 'com.example:lib',
+                version: '1.0.0',
+                source: 'test',
+                projectRoot: '/irrelevant',
+            },
+        ]),
+        fakeDetector([
+            {
+                ecosystem: 'npm',
+                coordinate: 'left-pad',
+                version: '1.0.0',
+                source: 'test',
+                projectRoot: '/irrelevant',
+            },
+        ]),
+    ], new DatasetLoader_1.DatasetLoader(dataset), SINGLE_ROOT);
+    const findings = await scanner.scan({ scanDir: '/irrelevant' });
+    strict_1.default.deepEqual(findings.map((f) => f.cve.id).sort(), ['CVE-1', 'CVE-2']);
+});
+(0, node_test_1.test)('merges results across multiple discovered project roots in a monorepo', async () => {
+    // A detector that only "sees" its own project's artifact, keyed by the root it was invoked with.
+    const detector = {
+        ecosystem: 'npm',
+        isApplicable: async () => true,
+        detect: async (options) => {
+            if (options.scanDir === '/monorepo/backend') {
+                return [
+                    {
+                        ecosystem: 'maven',
+                        coordinate: 'com.example:lib',
+                        version: '1.0.0',
+                        source: 'test',
+                        projectRoot: options.scanDir,
+                    },
+                ];
+            }
+            if (options.scanDir === '/monorepo/frontend') {
+                return [
+                    {
+                        ecosystem: 'npm',
+                        coordinate: 'left-pad',
+                        version: '1.0.0',
+                        source: 'test',
+                        projectRoot: options.scanDir,
+                    },
+                ];
+            }
+            return [];
+        },
+    };
+    const scanner = new Scanner_1.Scanner([detector], new DatasetLoader_1.DatasetLoader(dataset), () => [
+        '/monorepo/backend',
+        '/monorepo/frontend',
+    ]);
+    const findings = await scanner.scan({ scanDir: '/monorepo' });
+    strict_1.default.deepEqual(findings.map((f) => f.cve.id).sort(), ['CVE-1', 'CVE-2']);
+    strict_1.default.deepEqual(findings.map((f) => f.artifact.projectRoot).sort(), [
+        '/monorepo/backend',
+        '/monorepo/frontend',
+    ]);
+});
+//# sourceMappingURL=Scanner.test.js.map

package/dist/core/Scanner.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Scanner.test.js","sourceRoot":"","sources":["../../src/core/Scanner.test.ts"],"names":[],"mappings":";;;;;AAAA,gEAAwC;AACxC,yCAAiC;AACjC,mDAAgD;AAChD,uCAAoC;AAQpC,MAAM,WAAW,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;AAEnD,SAAS,YAAY,CAAC,SAA6B;IACjD,OAAO;QACL,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,IAAI,KAAK;QAC3C,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;QAC9B,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS;KAC9B,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,GAAyB;IACpC,WAAW,EAAE,0BAA0B;IACvC,OAAO,EAAE;QACP;YACE,SAAS,EAAE,OAAO;YAClB,GAAG,EAAE,2CAA2C;YAChD,mBAAmB,EAAE,OAAO;YAC5B,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;SACxD;QACD;YACE,SAAS,EAAE,KAAK;YAChB,GAAG,EAAE,6CAA6C;YAClD,YAAY,EAAE,OAAO;YACrB,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;SACxD;KACF;CACF,CAAC;AAEF,IAAA,gBAAI,EAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;IAChF,MAAM,OAAO,GAAG,IAAI,iBAAO,CACzB;QACE,YAAY,CAAC;YACX;gBACE,SAAS,EAAE,OAAO;gBAClB,UAAU,EAAE,iBAAiB;gBAC7B,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,aAAa;aAC3B;SACF,CAAC;KACH,EACD,IAAI,6BAAa,CAAC,OAAO,CAAC,EAC1B,WAAW,CACZ,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;IAChE,gBAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACjC,gBAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;IAC/E,MAAM,OAAO,GAAG,IAAI,iBAAO,CACzB;QACE,YAAY,CAAC;YACX;gBACE,SAAS,EAAE,OAAO;gBAClB,UAAU,EAAE,iBAAiB;gBAC7B,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,aAAa;aAC3B;SACF,CAAC;KACH,EACD,IAAI,6BAAa,CAAC,OAAO,CAAC,EAC1B,WAAW,CACZ,CAAC;IACF,gBAAM,CAAC,SAAS,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AACvE,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;IAC3E,MAAM,QAAQ,GAAG,IAAI,iBAAO,CAC1B;QACE,YAAY,CAAC;YACX;gBACE,SAAS,EAAE,KAAK;gBAChB,UAAU,EAAE,UAAU;gBACtB,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,aAAa;aAC3B;SACF,CAAC;KACH,EACD,IAAI,6BAAa,CAAC,OAAO,CAAC,EAC1B,WAAW,CACZ,CAAC;IACF,gBAAM,CAAC,KAAK,CACV,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAC3D,OAAO,CACR,CAAC;IAEF,MAAM,WAAW,GAAG,IAAI,iBAAO,CAC7B;QACE,YAAY,CAAC;YACX;gBACE,SAAS,EAAE,KAAK;gBAChB,UAAU,EAAE,UAAU;gBACtB,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,aAAa;aAC3B;SACF,CAAC;KACH,EACD,IAAI,6BAAa,CAAC,OAAO,CAAC,EAC1B,WAAW,CACZ,CAAC;IACF,gBAAM,CAAC,SAAS,CAAC,MAAM,WAAW,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;IACrE,MAAM,OAAO,GAAG,IAAI,iBAAO,CACzB;QACE,YAAY,CAAC;YACX;gBACE,SAAS,EAAE,OAAO;gBAClB,UAAU,EAAE,iBAAiB;gBAC7B,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,aAAa;aAC3B;SACF,CAAC;QACF,YAAY,CAAC;YACX;gBACE,SAAS,EAAE,KAAK;gBAChB,UAAU,EAAE,UAAU;gBACtB,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,MAAM;gBACd,WAAW,EAAE,aAAa;aAC3B;SACF,CAAC;KACH,EACD,IAAI,6BAAa,CAAC,OAAO,CAAC,EAC1B,WAAW,CACZ,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;IAChE,gBAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAC7E,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;IACvF,iGAAiG;IACjG,MAAM,QAAQ,GAAa;QACzB,SAAS,EAAE,KAAK;QAChB,YAAY,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;QAC9B,MAAM,EAAE,KAAK,EAAE,OAAoB,EAAE,EAAE;YACrC,IAAI,OAAO,CAAC,OAAO,KAAK,mBAAmB,EAAE,CAAC;gBAC5C,OAAO;oBACL;wBACE,SAAS,EAAE,OAAO;wBAClB,UAAU,EAAE,iBAAiB;wBAC7B,OAAO,EAAE,OAAO;wBAChB,MAAM,EAAE,MAAM;wBACd,WAAW,EAAE,OAAO,CAAC,OAAO;qBAC7B;iBACF,CAAC;YACJ,CAAC;YACD,IAAI,OAAO,CAAC,OAAO,KAAK,oBAAoB,EAAE,CAAC;gBAC7C,OAAO;oBACL;wBACE,SAAS,EAAE,KAAK;wBAChB,UAAU,EAAE,UAAU;wBACtB,OAAO,EAAE,OAAO;wBAChB,MAAM,EAAE,MAAM;wBACd,WAAW,EAAE,OAAO,CAAC,OAAO;qBAC7B;iBACF,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;KACF,CAAC;IAEF,MAAM,OAAO,GAAG,IAAI,iBAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,6BAAa,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC;QACxE,mBAAmB;QACnB,oBAAoB;KACrB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;IAC9D,gBAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3E,gBAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,EAAE;QACnE,mBAAmB;QACnB,oBAAoB;KACrB,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/core/VersionComparator.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Minimal, dependency-free version ordering: not a full semver implementation,
+ * just consistent enough to compare the start/end bounds in a VulnerableEntry
+ * against a detected artifact's version. See specs/20-data-format.md.
+ */
+export declare function compareVersions(a: string, b: string): number;

package/dist/core/VersionComparator.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.compareVersions = compareVersions;
+function segments(version) {
+    return version.split(/[.-]/).filter((s) => s.length > 0);
+}
+/**
+ * Minimal, dependency-free version ordering: not a full semver implementation,
+ * just consistent enough to compare the start/end bounds in a VulnerableEntry
+ * against a detected artifact's version. See specs/20-data-format.md.
+ */
+function compareVersions(a, b) {
+    const segA = segments(a);
+    const segB = segments(b);
+    const len = Math.max(segA.length, segB.length);
+    for (let i = 0; i < len; i++) {
+        if (i >= segA.length)
+            return -1;
+        if (i >= segB.length)
+            return 1;
+        const sa = segA[i];
+        const sb = segB[i];
+        const na = Number(sa);
+        const nb = Number(sb);
+        if (!Number.isNaN(na) && !Number.isNaN(nb)) {
+            if (na !== nb)
+                return na < nb ? -1 : 1;
+        }
+        else if (sa !== sb) {
+            return sa < sb ? -1 : 1;
+        }
+    }
+    return 0;
+}
+//# sourceMappingURL=VersionComparator.js.map

package/dist/core/VersionComparator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"VersionComparator.js","sourceRoot":"","sources":["../../src/core/VersionComparator.ts"],"names":[],"mappings":";;;AAAA,SAAS,QAAQ,CAAC,OAAe;IAC/B,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,yBAAgC,CAAS,EAAE,CAAS;IAClD,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAE/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC;QAE/B,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;QACtB,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;QAEtB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;YAC3C,IAAI,EAAE,KAAK,EAAE;gBAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,CAAC;aAAM,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACrB,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/core/VersionComparator.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/VersionComparator.test.js

@@ -0,0 +1,21 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_test_1 = require("node:test");
+const VersionComparator_1 = require("./VersionComparator");
+(0, node_test_1.test)('compares numeric segments numerically', () => {
+    strict_1.default.equal((0, VersionComparator_1.compareVersions)('2.9.8', '2.9.9'), -1);
+    strict_1.default.equal((0, VersionComparator_1.compareVersions)('2.10.0', '2.9.9'), 1);
+    strict_1.default.equal((0, VersionComparator_1.compareVersions)('1.0.0', '1.0.0'), 0);
+});
+(0, node_test_1.test)('a version with fewer segments is less than one with more', () => {
+    strict_1.default.equal((0, VersionComparator_1.compareVersions)('1.2', '1.2.1'), -1);
+    strict_1.default.equal((0, VersionComparator_1.compareVersions)('1.2.1', '1.2'), 1);
+});
+(0, node_test_1.test)('treats hyphenated qualifiers as extra segments', () => {
+    strict_1.default.equal((0, VersionComparator_1.compareVersions)('2.15.0', '2.0'), 1);
+});
+//# sourceMappingURL=VersionComparator.test.js.map

package/dist/core/VersionComparator.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"VersionComparator.test.js","sourceRoot":"","sources":["../../src/core/VersionComparator.test.ts"],"names":[],"mappings":";;;;;AAAA,gEAAwC;AACxC,yCAAiC;AACjC,2DAAsD;AAEtD,IAAA,gBAAI,EAAC,uCAAuC,EAAE,GAAG,EAAE;IACjD,gBAAM,CAAC,KAAK,CAAC,IAAA,mCAAe,EAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpD,gBAAM,CAAC,KAAK,CAAC,IAAA,mCAAe,EAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IACpD,gBAAM,CAAC,KAAK,CAAC,IAAA,mCAAe,EAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;AACrD,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,0DAA0D,EAAE,GAAG,EAAE;IACpE,gBAAM,CAAC,KAAK,CAAC,IAAA,mCAAe,EAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAClD,gBAAM,CAAC,KAAK,CAAC,IAAA,mCAAe,EAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AACnD,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,gDAAgD,EAAE,GAAG,EAAE;IAC1D,gBAAM,CAAC,KAAK,CAAC,IAAA,mCAAe,EAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AACpD,CAAC,CAAC,CAAC"}

package/dist/core/cpe.d.ts

@@ -0,0 +1,9 @@
+import { Ecosystem } from './types';
+/**
+ * "maven" and "gradle" detected artifacts are matched against the same pool
+ * of entries (both consume the same Maven Central coordinate space) — only
+ * "maven" is ever used as a storage/lookup key. See specs/20-data-format.md.
+ */
+export declare function datasetEcosystem(ecosystem: Ecosystem): 'maven' | 'npm';
+export declare function buildCpe(ecosystem: Ecosystem, coordinate: string): string;
+export declare function vendorProductFromCpe(cpe: string): string;

package/dist/core/cpe.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.datasetEcosystem = datasetEcosystem;
+exports.buildCpe = buildCpe;
+exports.vendorProductFromCpe = vendorProductFromCpe;
+/**
+ * "maven" and "gradle" detected artifacts are matched against the same pool
+ * of entries (both consume the same Maven Central coordinate space) — only
+ * "maven" is ever used as a storage/lookup key. See specs/20-data-format.md.
+ */
+function datasetEcosystem(ecosystem) {
+    return ecosystem === 'npm' ? 'npm' : 'maven';
+}
+/**
+ * `coordinate` is "groupId:artifactId" for maven/gradle, or just the package
+ * name for npm (which has no vendor/product split).
+ */
+function vendorProduct(ecosystem, coordinate) {
+    if (datasetEcosystem(ecosystem) === 'npm')
+        return [coordinate, coordinate];
+    const [vendor, product] = coordinate.split(':');
+    return [vendor, product];
+}
+function buildCpe(ecosystem, coordinate) {
+    const [vendor, product] = vendorProduct(ecosystem, coordinate);
+    return `cpe:2.3:a:${vendor.toLowerCase()}:${product.toLowerCase()}:*:*:*:*:*:*:*:*`;
+}
+function vendorProductFromCpe(cpe) {
+    const parts = cpe.split(':');
+    return `${parts[3]}:${parts[4]}`;
+}
+//# sourceMappingURL=cpe.js.map

package/dist/core/cpe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cpe.js","sourceRoot":"","sources":["../../src/core/cpe.ts"],"names":[],"mappings":";;;;;AAEA;;;;GAIG;AACH,0BAAiC,SAAoB;IACnD,OAAO,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CACpB,SAAoB,EACpB,UAAkB;IAElB,IAAI,gBAAgB,CAAC,SAAS,CAAC,KAAK,KAAK;QAAE,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAC3E,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChD,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED,kBAAyB,SAAoB,EAAE,UAAkB;IAC/D,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,aAAa,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAC/D,OAAO,aAAa,MAAM,CAAC,WAAW,EAAE,IAAI,OAAO,CAAC,WAAW,EAAE,kBAAkB,CAAC;AACtF,CAAC;AAED,8BAAqC,GAAW;IAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AACnC,CAAC"}

package/dist/core/cpe.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/cpe.test.js

@@ -0,0 +1,25 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_test_1 = require("node:test");
+const cpe_1 = require("./cpe");
+(0, node_test_1.test)('maven/gradle coordinates split into vendor:product directly', () => {
+    strict_1.default.equal((0, cpe_1.buildCpe)('maven', 'com.example:lib'), 'cpe:2.3:a:com.example:lib:*:*:*:*:*:*:*:*');
+    strict_1.default.equal((0, cpe_1.buildCpe)('gradle', 'com.example:lib'), 'cpe:2.3:a:com.example:lib:*:*:*:*:*:*:*:*');
+});
+(0, node_test_1.test)('npm coordinates use the package name as both vendor and product', () => {
+    strict_1.default.equal((0, cpe_1.buildCpe)('npm', 'lodash'), 'cpe:2.3:a:lodash:lodash:*:*:*:*:*:*:*:*');
+});
+(0, node_test_1.test)('vendorProductFromCpe is the inverse of buildCpe', () => {
+    const cpe = (0, cpe_1.buildCpe)('maven', 'com.example:lib');
+    strict_1.default.equal((0, cpe_1.vendorProductFromCpe)(cpe), 'com.example:lib');
+});
+(0, node_test_1.test)('gradle aliases to maven for dataset lookup purposes', () => {
+    strict_1.default.equal((0, cpe_1.datasetEcosystem)('gradle'), 'maven');
+    strict_1.default.equal((0, cpe_1.datasetEcosystem)('maven'), 'maven');
+    strict_1.default.equal((0, cpe_1.datasetEcosystem)('npm'), 'npm');
+});
+//# sourceMappingURL=cpe.test.js.map

package/dist/core/cpe.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cpe.test.js","sourceRoot":"","sources":["../../src/core/cpe.test.ts"],"names":[],"mappings":";;;;;AAAA,gEAAwC;AACxC,yCAAiC;AACjC,+BAAyE;AAEzE,IAAA,gBAAI,EAAC,6DAA6D,EAAE,GAAG,EAAE;IACvE,gBAAM,CAAC,KAAK,CACV,IAAA,cAAQ,EAAC,OAAO,EAAE,iBAAiB,CAAC,EACpC,2CAA2C,CAC5C,CAAC;IACF,gBAAM,CAAC,KAAK,CACV,IAAA,cAAQ,EAAC,QAAQ,EAAE,iBAAiB,CAAC,EACrC,2CAA2C,CAC5C,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,iEAAiE,EAAE,GAAG,EAAE;IAC3E,gBAAM,CAAC,KAAK,CACV,IAAA,cAAQ,EAAC,KAAK,EAAE,QAAQ,CAAC,EACzB,yCAAyC,CAC1C,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,iDAAiD,EAAE,GAAG,EAAE;IAC3D,MAAM,GAAG,GAAG,IAAA,cAAQ,EAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IACjD,gBAAM,CAAC,KAAK,CAAC,IAAA,0BAAoB,EAAC,GAAG,CAAC,EAAE,iBAAiB,CAAC,CAAC;AAC7D,CAAC,CAAC,CAAC;AAEH,IAAA,gBAAI,EAAC,qDAAqD,EAAE,GAAG,EAAE;IAC/D,gBAAM,CAAC,KAAK,CAAC,IAAA,sBAAgB,EAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,CAAC;IAClD,gBAAM,CAAC,KAAK,CAAC,IAAA,sBAAgB,EAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;IACjD,gBAAM,CAAC,KAAK,CAAC,IAAA,sBAAgB,EAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;AAC/C,CAAC,CAAC,CAAC"}

package/dist/core/types.d.ts

@@ -0,0 +1,57 @@
+export type Ecosystem = 'maven' | 'gradle' | 'npm';
+export interface ScanOptions {
+    scanDir: string;
+    cveDataDir?: string;
+}
+export interface DetectedArtifact {
+    ecosystem: Ecosystem;
+    coordinate: string;
+    version: string;
+    source: string;
+    projectRoot: string;
+}
+export interface Detector {
+    readonly ecosystem: Ecosystem;
+    isApplicable(options: ScanOptions): Promise<boolean>;
+    detect(options: ScanOptions): Promise<DetectedArtifact[]>;
+}
+export interface Cve {
+    id: string;
+    score: number;
+    title: string;
+}
+export interface VulnerableEntry {
+    ecosystem: Ecosystem;
+    cpe: string;
+    versionStartIncluding?: string;
+    versionStartExcluding?: string;
+    versionEndIncluding?: string;
+    versionEndExcluding?: string;
+    versionExact?: string;
+    cves: Cve[];
+}
+export interface VulnerabilityDataset {
+    generatedAt: string;
+    entries: VulnerableEntry[];
+}
+export interface CveEnrichment {
+    description: string;
+    cvssVector?: string;
+    cwe?: string[];
+    references: string[];
+}
+export interface ProjectManifest {
+    fileName: string;
+    content: string;
+}
+export interface Finding {
+    artifact: DetectedArtifact;
+    cve: Cve;
+    enrichment?: CveEnrichment;
+    projectManifest?: ProjectManifest;
+    aiAnalysis?: string;
+}
+export interface ScanResult {
+    datasetGeneratedAt: string;
+    findings: Finding[];
+}

package/dist/core/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/core/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/core/types.ts"],"names":[],"mappings":""}

package/dist/ecosystems/enrichment/CveListCache.d.ts

@@ -0,0 +1,13 @@
+export declare function cacheRootDir(): string;
+/**
+ * Pure (given the marker's mtime as input): is the cache under `cacheRoot`
+ * still within the 12-hour TTL? See specs/80-cve-enrichment.md.
+ */
+export declare function isCacheFresh(cacheRoot: string, now?: number): boolean;
+/**
+ * Downloads and extracts the full CVE List (https://github.com/CVEProject/cvelistV5)
+ * into a 12-hour-TTL local cache, reusing it across runs when still fresh.
+ * Returns the directory to use as --cve-data-dir (the one containing cves/).
+ * See specs/80-cve-enrichment.md.
+ */
+export declare function ensureCveListCache(): Promise<string>;