lockhawk 0.2.5 → 0.2.7

package/README.md

@@ -1,23 +1,15 @@
-<div align="center">
-
 # 🛡️ lockhawk
 
-### Fast, free, and accurate npm dependency vulnerability scanning — for your machine **and** your pipeline.
+**Fast, free, and accurate vulnerability scanning for your npm dependencies — on your machine and in your pipeline.**
 
 [![npm](https://img.shields.io/npm/v/lockhawk.svg)](https://www.npmjs.com/package/lockhawk)
 [![CI](https://github.com/lockhawk/lockhawk/actions/workflows/ci.yml/badge.svg)](https://github.com/lockhawk/lockhawk/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://github.com/lockhawk/lockhawk/blob/main/LICENSE)
 [![Data: OSV.dev](https://img.shields.io/badge/data-OSV.dev-4285F4.svg)](https://osv.dev)
 
-</div>
-
----
+`lockhawk` reads your lockfile (`package-lock.json`, `yarn.lock`, or `pnpm-lock.yaml`), builds the full dependency tree including every transitive dependency, and checks each package against the free [OSV.dev](https://osv.dev) vulnerability database. You get a clear terminal report, a polished HTML dashboard, and structured output (JSON, SARIF, JUnit) for CI.
 
-`lockhawk` reads your lockfile (`package-lock.json`, `yarn.lock`, or `pnpm-lock.yaml`), builds the
-full dependency tree — including transitive dependencies — and checks every package against the
-free [OSV.dev](https://osv.dev) vulnerability database. It produces a beautiful, self-contained
-HTML dashboard and machine-readable reports so you can understand and prioritise fixes.
-**No account, no API key, no usage limits.**
+**No account. No API key. No usage limits.**
 
 ```console
 $ npx lockhawk scan
@@ -36,59 +28,51 @@ Found 3 vulnerabilities (1 critical, 1 high, 1 medium) · 3 fixable
 Data from OSV.dev · database: offline · scanned in 184ms
 ```
 
-## 🚀 Quick start
+## Quick start
 
 ```bash
-# One-off, no install
+# Run once, no install needed
 npx lockhawk scan
 
-# Fail the build on high+ severity and emit SARIF for the GitHub Security tab
+# Fail the build on high or critical findings and write SARIF for the GitHub Security tab
 npx lockhawk scan --format sarif --output scan.sarif --fail-on high
 
-# Generate the standalone HTML dashboard
+# Generate a standalone HTML dashboard
 npx lockhawk scan --format html --output report.html
 
-# Explore findings in an interactive local dashboard
+# Explore findings in an interactive dashboard in your browser
 npx lockhawk serve
 ```
 
-Install it globally or as a dev dependency:
+Prefer to install it?
 
 ```bash
 npm install -g lockhawk            # global `lockhawk` command
-npm install --save-dev lockhawk    # for use in package scripts / CI
+npm install --save-dev lockhawk    # for use in package scripts and CI
 ```
 
-## ✨ Features
-
-- **⚡ Fast & non-intrusive** — a warm scan does **zero network I/O** and finishes in well under a
-  second. The vulnerability database is cached on disk (and downloadable for fully offline CI),
-  lookups are batched, and the scanner is **fail-open**: a transient network blip never breaks
-  your build.
-- **🆓 Free forever** — powered by Google's [OSV.dev](https://osv.dev). No API key, no
-  rate-limited account, no seat licensing.
-- **🎯 Accurate** — canonical OSV range matching with `semver`, **CVSS v3 _and_ v4** scoring,
-  withdrawn-advisory handling, and alias de-duplication.
-- **📦 Every package manager** — npm (`package-lock` v1/v2/v3 + shrinkwrap), Yarn (classic &
-  Berry), and pnpm (v5/v6/v9), including workspaces.
-- **📊 Beautiful analysis** — a self-contained HTML dashboard you can open anywhere or attach as
-  a CI artifact, plus `lockhawk serve` for interactive drill-down with dependency-path tracing.
-- **🔌 Built for CI/CD** — first-class **SARIF** (GitHub Security tab), **JUnit** (Azure DevOps /
-  GitLab test dashboards), JSON, and a stable exit-code contract for build gating.
-
-## 🧭 CLI
+## Why lockhawk
+
+- **⚡ Fast and quiet.** A warm scan does zero network requests and finishes in well under a second. The vulnerability database is cached on disk (and you can download it for fully offline CI), and lookups are batched. The scanner also fails open: a temporary network problem never breaks your build.
+- **🆓 Free forever.** Powered by Google's [OSV.dev](https://osv.dev). There is no API key, no rate-limited account, and no per-seat license.
+- **🎯 Accurate.** Canonical OSV range matching with `semver`, CVSS v3 and v4 scoring, correct handling of withdrawn advisories, and de-duplication of aliased advisories.
+- **📦 Every package manager.** npm (`package-lock` v1, v2, v3, and shrinkwrap), Yarn (classic and Berry), and pnpm (v5, v6, v9), including workspaces.
+- **📊 Clear results.** A standalone HTML dashboard (one file, works offline) that you can open anywhere or attach as a CI artifact, plus `lockhawk serve` to drill into findings interactively.
+- **🔌 Built for CI.** First-class SARIF (GitHub Security tab), JUnit (Azure DevOps and GitLab test dashboards), JSON, and a stable exit-code contract for gating builds.
+
+## CLI reference
 
 ```
-lockhawk scan [path]            Scan a project (default command)
+lockhawk scan [path]            Scan a project (this is the default command)
   -f, --format <fmt>               table | json | sarif | html | junit   (default: table)
   -o, --output <file>              write the report to a file
-  --severity-threshold <level>     minimum severity to report
-  --fail-on <level>                minimum severity for a non-zero exit (default: high)
-  --offline | --online             force the offline DB or live OSV.dev queries
-  --strict-network                 fail on network errors instead of degrading
+  --severity-threshold <level>     minimum severity to include in the report
+  --fail-on <level>                minimum severity that causes a non-zero exit (default: high)
+  --offline | --online             force the offline database or live OSV.dev queries
+  --strict-network                 fail on network errors instead of degrading gracefully
   --prod-only                      ignore dev dependencies
   --ignore <ids...>                suppress specific advisory ids
-  --ignore-file <path>             a .lockhawkignore file (ids, optional expiry date)
+  --ignore-file <path>             a .lockhawkignore file (ids, with an optional expiry date)
   --cache-dir <dir> | --cache-ttl <hours> | --no-cache | --concurrency <n>
 
 lockhawk report -i result.json -f html -o report.html   Re-render a saved result
@@ -98,21 +82,21 @@ lockhawk db update | status | path                       Manage the offline OSV
 
 ### Exit codes
 
-| Code | Meaning                                       |
-| ---- | --------------------------------------------- |
-| `0`  | Clean — no finding at or above `--fail-on`    |
-| `1`  | At least one finding at or above `--fail-on`  |
-| `2`  | Usage error (e.g. no lockfile found)          |
-| `3`  | Internal error                                |
-| `4`  | Network error while `--strict-network` is set |
+| Code | Meaning                                        |
+| ---- | ---------------------------------------------- |
+| `0`  | Clean. No finding at or above `--fail-on`.     |
+| `1`  | At least one finding at or above `--fail-on`.  |
+| `2`  | Usage error, for example no lockfile found.    |
+| `3`  | Internal error.                                |
+| `4`  | Network error while `--strict-network` is set. |
 
-Plain network failures never fail the build unless you opt in with `--strict-network`.
+Network failures never fail the build unless you opt in with `--strict-network`.
 
-## 🔁 CI/CD
+## Continuous integration
 
-Runs in any pipeline without slowing it down — warm the cached DB once, then scan offline in well
-under a second. Full recipes for **GitHub Actions**, **Azure DevOps**, and **GitLab CI** are in
-[docs/ci-cd.md](https://github.com/lockhawk/lockhawk/blob/main/docs/ci-cd.md).
+lockhawk runs in any pipeline without slowing it down. Warm the cached database once, then scan offline in well under a second. The snippets below are the short version; full, copy-paste recipes for all three platforms are in [docs/ci-cd.md](https://github.com/lockhawk/lockhawk/blob/main/docs/ci-cd.md).
+
+**GitHub Actions** (the bundled action):
 
 ```yaml
 permissions: { contents: read, security-events: write }
@@ -122,9 +106,38 @@ steps:
     with: { fail-on: high }
 ```
 
-## ⚙️ Configuration
+**Azure DevOps** (findings render natively in the Tests tab via JUnit):
+
+```yaml
+- script: npx lockhawk db update
+  displayName: Warm OSV database
+- script: npx lockhawk scan --offline --format junit --output lockhawk.junit.xml --fail-on none
+  displayName: Scan dependencies
+- task: PublishTestResults@2
+  condition: always()
+  inputs:
+    testResultsFormat: JUnit
+    testResultsFiles: lockhawk.junit.xml
+    failTaskOnFailedTests: true # fail the pipeline when there are findings
+```
+
+**GitLab CI** (JUnit surfaces in the pipeline and merge-request test widgets):
 
-Add a `.lockhawkrc`, `lockhawk.config.js`, or a `"lockhawk"` key in `package.json`:
+```yaml
+dependency_scan:
+  image: node:22
+  script:
+    - npx lockhawk db update
+    - npx lockhawk scan --offline --format junit --output scan.junit.xml --fail-on high
+  artifacts:
+    when: always
+    reports:
+      junit: scan.junit.xml
+```
+
+## Configuration
+
+Add a `.lockhawkrc`, a `lockhawk.config.js`, or a `"lockhawk"` key in `package.json`:
 
 ```json
 {
@@ -135,10 +148,11 @@ Add a `.lockhawkrc`, `lockhawk.config.js`, or a `"lockhawk"` key in `package.jso
 }
 ```
 
-## 🧩 Programmatic API
+`failOn` is a severity gate: the scan exits non-zero when any finding is at or above that level. With `"failOn": "high"`, a single high or critical finding fails the build, while `"critical"` tolerates highs and `"none"` never fails on findings (report-only). CLI flags always override config-file values.
+
+## Programmatic API
 
-To embed the scanner in your own tooling, use the engine package
-[`@lockhawk/core`](https://www.npmjs.com/package/@lockhawk/core):
+To embed the scanner in your own tooling, use the engine package [`@lockhawk/core`](https://www.npmjs.com/package/@lockhawk/core):
 
 ```ts
 import { scan } from '@lockhawk/core';
@@ -147,11 +161,10 @@ const result = await scan({ path: '.', mode: 'auto', failOn: 'high' });
 console.log(result.summary, result.findings);
 ```
 
-## 📚 Full documentation
+## Full documentation
 
-Full docs, CI/CD recipes, configuration reference, and the contributing guide live in the main
-repository: **https://github.com/lockhawk/lockhawk**
+Full docs, CI recipes, the configuration reference, and the contributing guide live in the main repository: **https://github.com/lockhawk/lockhawk**
 
-## 📄 License
+## License
 
-[MIT](https://github.com/lockhawk/lockhawk/blob/main/LICENSE) — free to use, modify, and distribute.
+[MIT](https://github.com/lockhawk/lockhawk/blob/main/LICENSE). Free to use, modify, and distribute.

package/dist/chunk-IJMHOVBV.js

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import{readFile as n}from"fs/promises";import{fileURLToPath as t}from"url";import{dirname as i,join as o}from"path";var e;async function u(){if(e!==void 0)return e??void 0;try{let r=i(t(import.meta.url));e=await n(o(r,"report-shell.html"),"utf8")}catch{e=null}return e??void 0}export{u as a};
+//# sourceMappingURL=chunk-IJMHOVBV.js.map

package/dist/chunk-OIXS6N3H.js

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+import{a as c}from"./chunk-IJMHOVBV.js";import{toHtml as b,toJson as w,toJunit as k,toSarifString as v}from"@lockhawk/core";import t from"chalk";import m from"cli-table3";var i={critical:n=>t.bgRed.white.bold(` ${n} `),high:n=>t.hex("#d9822b").bold(n),medium:n=>t.yellow(n),low:n=>t.blue(n),unknown:n=>t.gray(n),none:n=>t.green(n)};function l(n){let e=[],{summary:h,target:r,stats:u,database:p}=n;e.push(t.bold(`
+lockhawk`)+t.dim(` \xB7 ${r.root.name}${r.root.version?`@${r.root.version}`:""} \xB7 ${r.manager} \xB7 ${u.totalPackages} packages`));for(let o of p.warnings)e.push(t.yellow(`\u26A0 ${o}`));if(n.findings.length===0)return e.push(t.green.bold(`
+\u2713 No known vulnerabilities found.
+`)),e.push(t.dim(d(n))),e.join(`
+`);let s=new m({head:["Severity","Package","Advisory","Fixed in","Path"].map(o=>t.dim(o)),style:{head:[],border:[]},colWidths:[12,26,22,12,40],wordWrap:!0});for(let o of n.findings){let a=o.severity,f=`${a.level}${a.score?` ${a.score}`:""}`,g=o.dependencyPaths[0]?.join(" \u203A ")??o.packageName;s.push([i[a.level](f),`${o.packageName}
+${t.dim(o.version)}${o.direct?t.dim(" (direct)"):""}`,o.id,o.fixedVersions[0]??t.dim("none"),t.dim(g)])}return e.push(""),e.push(s.toString()),e.push(""),e.push($(h)),e.push(t.dim(d(n))),e.join(`
+`)}function $(n){let e=[];return n.critical&&e.push(i.critical(`${n.critical} critical`)),n.high&&e.push(i.high(`${n.high} high`)),n.medium&&e.push(i.medium(`${n.medium} medium`)),n.low&&e.push(i.low(`${n.low} low`)),n.unknown&&e.push(i.unknown(`${n.unknown} unknown`)),t.bold(`Found ${n.total} ${n.total===1?"vulnerability":"vulnerabilities"}`)+(e.length?` (${e.join(", ")})`:"")+t.dim(` \xB7 ${n.fixable} fixable`)}function d(n){let e=n.database.ageHours!==void 0?`, ${n.database.ageHours}h old`:"";return`
+Data from OSV.dev \xB7 database: ${n.database.source}${e} \xB7 scanned in ${n.stats.durationMs??0}ms`}async function F(n,e){switch(e){case"json":return w(n);case"sarif":return v(n);case"junit":return k(n);case"html":return b(n,await c());default:return l(n)}}export{F as a};
+//# sourceMappingURL=chunk-OIXS6N3H.js.map

package/dist/db-FFGMJJW7.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+import p from"ora";import{offlineDbDir as d,readOfflineMeta as u,resolveCacheDir as n,updateOfflineDatabase as f}from"@lockhawk/core";async function b(s){let a=n(s.cacheDir),t=!!process.stderr.isTTY&&!process.env.CI?p({stream:process.stderr,text:"Updating database\u2026"}).start():void 0;try{let{status:r,meta:o}=await f({cacheDir:a,nowIso:new Date().toISOString(),force:s.force,onProgress:i=>{t?t.text=i:process.stderr.write(`${i}
+`)}}),c=`${r==="updated"?"Updated":"Already up to date"} \u2014 ${o.recordCount} advisories across ${o.packageCount} packages.`;t?t.succeed(c):process.stderr.write(`${c}
+`)}catch(r){let o=r instanceof Error?r.message:String(r);t?t.fail(`Database update failed: ${o}`):process.stderr.write(`Database update failed: ${o}
+`),process.exitCode=3}}async function $(s){let a=n(s.cacheDir),e=await u(a);if(!e){process.stdout.write("No offline database found. Run `lockhawk db update` to create one.\n");return}let t=Math.round((Date.now()-Date.parse(e.lastUpdated))/36e5);process.stdout.write([`Ecosystem:    ${e.ecosystem}`,`Source:       ${e.source}`,`Advisories:   ${e.recordCount}`,`Packages:     ${e.packageCount}`,`Last updated: ${e.lastUpdated} (${t}h ago)`,`Location:     ${d(a)}`].join(`
+`)+`
+`)}function m(s){process.stdout.write(`${d(n(s.cacheDir))}
+`)}export{m as runDbPath,$ as runDbStatus,b as runDbUpdate};
+//# sourceMappingURL=db-FFGMJJW7.js.map

package/dist/index.js

@@ -1,293 +1,4 @@
 #!/usr/bin/env node
-
-// src/index.ts
-import { Command, Option } from "commander";
-
-// src/commands/scan.ts
-import { writeFileSync } from "fs";
-import { join, resolve } from "path";
-import ora from "ora";
-import { LockfileError, scan, shouldFail } from "@lockhawk/core";
-
-// src/report/render.ts
-import { toHtml, toJson, toJunit, toSarifString } from "@lockhawk/core";
-
-// src/report/table.ts
-import chalk from "chalk";
-import Table from "cli-table3";
-var paint = {
-  critical: (s) => chalk.bgRed.white.bold(` ${s} `),
-  high: (s) => chalk.hex("#d9822b").bold(s),
-  medium: (s) => chalk.yellow(s),
-  low: (s) => chalk.blue(s),
-  unknown: (s) => chalk.gray(s),
-  none: (s) => chalk.green(s)
-};
-function renderTable(result) {
-  const lines = [];
-  const { summary, target, stats, database } = result;
-  lines.push(
-    chalk.bold(`
-lockhawk`) + chalk.dim(
-      ` \xB7 ${target.root.name}${target.root.version ? `@${target.root.version}` : ""} \xB7 ${target.manager} \xB7 ${stats.totalPackages} packages`
-    )
-  );
-  for (const warning of database.warnings) lines.push(chalk.yellow(`\u26A0 ${warning}`));
-  if (result.findings.length === 0) {
-    lines.push(chalk.green.bold("\n\u2713 No known vulnerabilities found.\n"));
-    lines.push(chalk.dim(footer(result)));
-    return lines.join("\n");
-  }
-  const table = new Table({
-    head: ["Severity", "Package", "Advisory", "Fixed in", "Path"].map((h) => chalk.dim(h)),
-    style: { head: [], border: [] },
-    colWidths: [12, 26, 22, 12, 40],
-    wordWrap: true
-  });
-  for (const f of result.findings) {
-    const sev = f.severity;
-    const sevText = `${sev.level}${sev.score ? ` ${sev.score}` : ""}`;
-    const path = f.dependencyPaths[0]?.join(" \u203A ") ?? f.packageName;
-    table.push([
-      paint[sev.level](sevText),
-      `${f.packageName}
-${chalk.dim(f.version)}${f.direct ? chalk.dim(" (direct)") : ""}`,
-      f.id,
-      f.fixedVersions[0] ?? chalk.dim("none"),
-      chalk.dim(path)
-    ]);
-  }
-  lines.push("");
-  lines.push(table.toString());
-  lines.push("");
-  lines.push(summaryLine(summary));
-  lines.push(chalk.dim(footer(result)));
-  return lines.join("\n");
-}
-function summaryLine(summary) {
-  const parts = [];
-  if (summary.critical) parts.push(paint.critical(`${summary.critical} critical`));
-  if (summary.high) parts.push(paint.high(`${summary.high} high`));
-  if (summary.medium) parts.push(paint.medium(`${summary.medium} medium`));
-  if (summary.low) parts.push(paint.low(`${summary.low} low`));
-  if (summary.unknown) parts.push(paint.unknown(`${summary.unknown} unknown`));
-  return chalk.bold(
-    `Found ${summary.total} ${summary.total === 1 ? "vulnerability" : "vulnerabilities"}`
-  ) + (parts.length ? ` (${parts.join(", ")})` : "") + chalk.dim(` \xB7 ${summary.fixable} fixable`);
-}
-function footer(result) {
-  const age = result.database.ageHours !== void 0 ? `, ${result.database.ageHours}h old` : "";
-  return `
-Data from OSV.dev \xB7 database: ${result.database.source}${age} \xB7 scanned in ${result.stats.durationMs ?? 0}ms`;
-}
-
-// src/report/render.ts
-async function renderResult(result, format) {
-  switch (format) {
-    case "json":
-      return toJson(result);
-    case "sarif":
-      return toSarifString(result);
-    case "junit":
-      return toJunit(result);
-    case "html":
-      return toHtml(result);
-    default:
-      return renderTable(result);
-  }
-}
-
-// src/config.ts
-import { existsSync, readFileSync } from "fs";
-import { cosmiconfigSync } from "cosmiconfig";
-function loadFileConfig(cwd) {
-  try {
-    const result = cosmiconfigSync("lockhawk").search(cwd);
-    return result?.config ?? {};
-  } catch {
-    return {};
-  }
-}
-function readIgnoreFile(path, now = /* @__PURE__ */ new Date()) {
-  if (!existsSync(path)) return [];
-  const ids = [];
-  for (const raw of readFileSync(path, "utf8").split(/\r?\n/)) {
-    const line = raw.replace(/#.*$/, "").trim();
-    if (!line) continue;
-    const [id, expiry] = line.split(/\s+/);
-    if (!id) continue;
-    if (expiry) {
-      const when = Date.parse(expiry);
-      if (!Number.isNaN(when) && when < now.getTime()) continue;
-    }
-    ids.push(id);
-  }
-  return ids;
-}
-
-// src/commands/scan.ts
-var EXIT = { OK: 0, FINDINGS: 1, USAGE: 2, INTERNAL: 3, NETWORK: 4 };
-async function runScan(pathArg, cli) {
-  const dir = resolve(pathArg || ".");
-  const fileConfig = loadFileConfig(dir);
-  const mode = cli.offline ? "offline" : cli.online ? "online" : fileConfig.mode ?? "auto";
-  const format = cli.format ?? "table";
-  const failOn = cli.failOn ?? fileConfig.failOn ?? "high";
-  const ignore = [
-    ...cli.ignore ?? [],
-    ...fileConfig.ignore ?? [],
-    ...readIgnoreFile(cli.ignoreFile ?? join(dir, ".lockhawkignore"))
-  ];
-  const useSpinner = format === "table" && Boolean(process.stderr.isTTY) && !process.env.CI;
-  const spinner = useSpinner ? ora({ stream: process.stderr, text: "Scanning\u2026" }).start() : void 0;
-  const options = {
-    path: dir,
-    mode,
-    cacheDir: cli.cacheDir,
-    cacheTtlHours: cli.cacheTtl,
-    noCache: cli.cache === false,
-    concurrency: cli.concurrency,
-    prodOnly: cli.prodOnly ?? fileConfig.prodOnly,
-    ignore,
-    strictNetwork: cli.strictNetwork,
-    severityThreshold: cli.severityThreshold ?? fileConfig.severityThreshold,
-    onProgress: (message) => {
-      if (spinner) spinner.text = message;
-    }
-  };
-  let result;
-  try {
-    result = await scan(options);
-  } catch (err) {
-    spinner?.stop();
-    const message = err instanceof Error ? err.message : String(err);
-    process.stderr.write(`lockhawk: ${message}
-`);
-    if (err instanceof LockfileError) process.exitCode = EXIT.USAGE;
-    else process.exitCode = cli.strictNetwork ? EXIT.NETWORK : EXIT.INTERNAL;
-    return;
-  }
-  spinner?.stop();
-  const rendered = await renderResult(result, format);
-  if (cli.output) {
-    writeFileSync(cli.output, rendered.endsWith("\n") ? rendered : `${rendered}
-`);
-    process.stderr.write(`Report written to ${cli.output}
-${briefSummary(result)}
-`);
-  } else {
-    process.stdout.write(`${rendered}
-`);
-  }
-  process.exitCode = shouldFail(result.summary, failOn) ? EXIT.FINDINGS : EXIT.OK;
-}
-function briefSummary(result) {
-  const s = result.summary;
-  if (s.total === 0) return "\u2713 No known vulnerabilities found.";
-  const parts = ["critical", "high", "medium", "low", "unknown"].filter((level) => s[level] > 0).map((level) => `${s[level]} ${level}`);
-  return `Found ${s.total} ${s.total === 1 ? "vulnerability" : "vulnerabilities"} (${parts.join(", ")}).`;
-}
-
-// src/commands/report.ts
-import { readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
-async function runReport(opts) {
-  let result;
-  try {
-    result = JSON.parse(readFileSync2(opts.input, "utf8"));
-  } catch (err) {
-    process.stderr.write(
-      `lockhawk: could not read ${opts.input}: ${err instanceof Error ? err.message : err}
-`
-    );
-    process.exitCode = 2;
-    return;
-  }
-  const rendered = await renderResult(result, opts.format ?? "html");
-  if (opts.output) {
-    writeFileSync2(opts.output, rendered.endsWith("\n") ? rendered : `${rendered}
-`);
-    process.stderr.write(`Report written to ${opts.output}
-`);
-  } else {
-    process.stdout.write(`${rendered}
-`);
-  }
-}
-
-// src/commands/serve.ts
-import { createServer } from "http";
-import { readFileSync as readFileSync3 } from "fs";
-import { resolve as resolve2 } from "path";
-import open from "open";
-import { scan as scan2, toHtml as toHtml2, toJson as toJson2 } from "@lockhawk/core";
-async function runServe(pathArg, opts) {
-  let result;
-  if (opts.input) {
-    result = JSON.parse(readFileSync3(opts.input, "utf8"));
-  } else {
-    const mode = opts.offline ? "offline" : opts.online ? "online" : "auto";
-    process.stderr.write("Scanning\u2026\n");
-    result = await scan2({ path: resolve2(pathArg || "."), mode });
-  }
-  const html = toHtml2(result);
-  const json = toJson2(result);
-  const server = createServer(createDashboardHandler(html, json));
-  const port = opts.port ?? 7777;
-  server.listen(port, "127.0.0.1", () => {
-    const url = `http://localhost:${port}`;
-    process.stderr.write(
-      `
-lockhawk dashboard running at ${url}
-${summaryLine2(result)}
-Press Ctrl+C to stop.
-`
-    );
-    if (opts.open !== false) void open(url).catch(() => void 0);
-  });
-}
-function createDashboardHandler(html, json) {
-  return (req, res) => {
-    res.setHeader("cache-control", "no-store, max-age=0");
-    if (req.url && req.url.startsWith("/api/result")) {
-      res.setHeader("content-type", "application/json");
-      res.end(json);
-      return;
-    }
-    res.setHeader("content-type", "text/html; charset=utf-8");
-    res.end(html);
-  };
-}
-function summaryLine2(result) {
-  const s = result.summary;
-  return s.total === 0 ? "\u2713 No known vulnerabilities found." : `${s.total} findings \u2014 ${s.critical} critical, ${s.high} high, ${s.medium} medium, ${s.low} low.`;
-}
-
-// src/index.ts
-var program = new Command();
-program.name("lockhawk").description(
-  "Fast, free, accurate npm dependency vulnerability scanner (local + CI/CD), powered by OSV.dev"
-).version("0.1.0");
-var severityChoices = ["none", "low", "medium", "high", "critical"];
-program.command("scan", { isDefault: true }).description("Scan a project for vulnerable dependencies").argument("[path]", "project directory to scan", ".").addOption(
-  new Option("-f, --format <format>", "output format").choices(["table", "json", "sarif", "html", "junit"]).default("table")
-).option("-o, --output <file>", "write the report to a file instead of stdout").addOption(
-  new Option("--severity-threshold <level>", "minimum severity to report").choices(
-    severityChoices
-  )
-).addOption(
-  new Option("--fail-on <level>", "minimum severity that causes a non-zero exit").choices(severityChoices).default("high")
-).option("--offline", "use only the local offline database (no network)").option("--online", "force live OSV.dev queries").option("--strict-network", "fail the scan on network errors instead of degrading gracefully").option("--prod-only", "ignore dev dependencies").option("--ignore <ids...>", "advisory ids to suppress").option("--ignore-file <path>", "path to a .lockhawkignore file").option("--cache-dir <dir>", "override the cache directory").option("--cache-ttl <hours>", "cache freshness window in hours", (v) => Number(v)).option("--no-cache", "bypass the on-disk cache").option("--concurrency <n>", "max concurrent OSV requests", (v) => Number(v)).action((path, opts) => runScan(path, opts));
-var db = program.command("db").description("Manage the offline OSV database");
-db.command("update").description("Download or refresh the offline npm advisory database").option("--cache-dir <dir>", "override the cache directory").option("--force", "ignore conditional caching and re-download").action((opts) => import("./db-3KKJNIY5.js").then((m) => m.runDbUpdate(opts)));
-db.command("status").description("Show offline database freshness").option("--cache-dir <dir>", "override the cache directory").action((opts) => import("./db-3KKJNIY5.js").then((m) => m.runDbStatus(opts)));
-db.command("path").description("Print the offline database directory").option("--cache-dir <dir>", "override the cache directory").action((opts) => import("./db-3KKJNIY5.js").then((m) => m.runDbPath(opts)));
-program.command("report").description("Re-render a saved JSON result into another format").requiredOption("-i, --input <file>", "path to a JSON scan result").addOption(
-  new Option("-f, --format <format>", "output format").choices(["table", "json", "sarif", "html", "junit"]).default("html")
-).option("-o, --output <file>", "write the report to a file instead of stdout").action((opts) => runReport(opts));
-program.command("serve").description("Run a scan and open an interactive dashboard locally").argument("[path]", "project directory to scan", ".").option("-i, --input <file>", "serve a saved JSON result instead of scanning").option("-p, --port <port>", "port to listen on", (v) => Number(v), 7777).option("--no-open", "do not open the browser automatically").option("--offline", "use only the local offline database").option("--online", "force live OSV.dev queries").action((path, opts) => runServe(path, opts));
-program.parseAsync().catch((err) => {
-  process.stderr.write(`lockhawk: ${err instanceof Error ? err.message : String(err)}
-`);
-  process.exitCode = 3;
-});
+import{Command as c,Option as n}from"commander";var t=new c;t.name("lockhawk").description("Fast, free, accurate npm dependency vulnerability scanner (local + CI/CD), powered by OSV.dev").version("0.2.6");var a=["none","low","medium","high","critical"];t.command("scan",{isDefault:!0}).description("Scan a project for vulnerable dependencies").argument("[path]","project directory to scan",".").addOption(new n("-f, --format <format>","output format").choices(["table","json","sarif","html","junit"]).default("table")).option("-o, --output <file>","write the report to a file instead of stdout").addOption(new n("--severity-threshold <level>","minimum severity to report").choices(a)).addOption(new n("--fail-on <level>","minimum severity that causes a non-zero exit").choices(a).default("high")).option("--offline","use only the local offline database (no network)").option("--online","force live OSV.dev queries").option("--strict-network","fail the scan on network errors instead of degrading gracefully").option("--prod-only","ignore dev dependencies").option("--ignore <ids...>","advisory ids to suppress").option("--ignore-file <path>","path to a .lockhawkignore file").option("--cache-dir <dir>","override the cache directory").option("--cache-ttl <hours>","cache freshness window in hours",e=>Number(e)).option("--no-cache","bypass the on-disk cache").option("--concurrency <n>","max concurrent OSV requests",e=>Number(e)).action((e,o)=>import("./scan-X3WQY53T.js").then(i=>i.runScan(e,o)));var r=t.command("db").description("Manage the offline OSV database");r.command("update").description("Download or refresh the offline npm advisory database").option("--cache-dir <dir>","override the cache directory").option("--force","ignore conditional caching and re-download").action(e=>import("./db-FFGMJJW7.js").then(o=>o.runDbUpdate(e)));r.command("status").description("Show offline database freshness").option("--cache-dir <dir>","override the cache directory").action(e=>import("./db-FFGMJJW7.js").then(o=>o.runDbStatus(e)));r.command("path").description("Print the offline database directory").option("--cache-dir <dir>","override the cache directory").action(e=>import("./db-FFGMJJW7.js").then(o=>o.runDbPath(e)));t.command("report").description("Re-render a saved JSON result into another format").requiredOption("-i, --input <file>","path to a JSON scan result").addOption(new n("-f, --format <format>","output format").choices(["table","json","sarif","html","junit"]).default("html")).option("-o, --output <file>","write the report to a file instead of stdout").action(e=>import("./report-O5PRSFAL.js").then(o=>o.runReport(e)));t.command("serve").description("Run a scan and open an interactive dashboard locally").argument("[path]","project directory to scan",".").option("-i, --input <file>","serve a saved JSON result instead of scanning").option("-p, --port <port>","port to listen on",e=>Number(e),7777).option("--no-open","do not open the browser automatically").option("--offline","use only the local offline database").option("--online","force live OSV.dev queries").action((e,o)=>import("./serve-WIIUVGR4.js").then(i=>i.runServe(e,o)));t.parseAsync().catch(e=>{process.stderr.write(`lockhawk: ${e instanceof Error?e.message:String(e)}
+`),process.exitCode=3});
 //# sourceMappingURL=index.js.map

package/dist/report-O5PRSFAL.js

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+import{a as n}from"./chunk-OIXS6N3H.js";import"./chunk-IJMHOVBV.js";import{readFileSync as i,writeFileSync as s}from"fs";async function a(r){let o;try{o=JSON.parse(i(r.input,"utf8"))}catch(e){process.stderr.write(`lockhawk: could not read ${r.input}: ${e instanceof Error?e.message:e}
+`),process.exitCode=2;return}let t=await n(o,r.format??"html");r.output?(s(r.output,t.endsWith(`
+`)?t:`${t}
+`),process.stderr.write(`Report written to ${r.output}
+`)):process.stdout.write(`${t}
+`)}export{a as runReport};
+//# sourceMappingURL=report-O5PRSFAL.js.map