project-athena 0.3.0 → 0.5.0

package/dist/chunk-IDODPGTX.js

@@ -0,0 +1,595 @@
+#!/usr/bin/env node
+import {
+  whichExecutable
+} from "./chunk-UMWX4UTK.js";
+import {
+  Coverage,
+  Finding,
+  SECRETS_ENGINE,
+  ScanResult,
+  dedupeFindings,
+  packageFingerprint
+} from "./chunk-Y6SDMZET.js";
+import {
+  loadScanFromDir
+} from "./chunk-44EGCEB2.js";
+import {
+  walkProject
+} from "./chunk-ELKFRTZT.js";
+import {
+  athenaDir
+} from "./chunk-2DY4PUR4.js";
+import {
+  readTextIfExists,
+  writeFileAtomic
+} from "./chunk-IQQBAWSM.js";
+
+// src/core/findings/store.ts
+import path2 from "path";
+
+// src/core/scanners/dependencies.ts
+import { execFile } from "child_process";
+import { promises as fs } from "fs";
+import path from "path";
+var AuditToolError = class extends Error {
+};
+var asRecord = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : {};
+var isObject = (v) => Boolean(v) && typeof v === "object" && !Array.isArray(v);
+var strings = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string" && x.trim() !== "") : [];
+var cwes = (v) => strings(v).filter((c) => /^CWE-\d+$/.test(c));
+var uniq = (xs) => [...new Set(xs.filter((x) => Boolean(x)))];
+var GHSA = /GHSA-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}/i;
+var sev = (s) => {
+  const v = String(s ?? "").toLowerCase();
+  if (v === "critical") return "critical";
+  if (v === "high") return "high";
+  if (v === "moderate" || v === "medium") return "moderate";
+  if (v === "low" || v === "info") return "low";
+  return "unrated";
+};
+function parseJsonObject(stdout, tool) {
+  const text = stdout.trim();
+  if (!text) throw new AuditToolError(`${tool} produced no output`);
+  const json = JSON.parse(text);
+  if (!isObject(json)) throw new AuditToolError(`${tool} produced unexpected output`);
+  return json;
+}
+function throwIfToolError(json, tool) {
+  if (json.error === void 0) return;
+  const e = asRecord(json.error);
+  const parts = [e.code, e.summary ?? e.message].filter((x) => typeof x === "string" && x.trim());
+  const text = parts.length ? parts.join(": ") : typeof json.error === "string" ? json.error : "unknown error";
+  throw new AuditToolError(`${tool} reported an error: ${text.split("\n")[0].slice(0, 200)}`);
+}
+function parseAdvisories(advisories) {
+  const out = [];
+  for (const [key, raw] of Object.entries(advisories)) {
+    const a = asRecord(raw);
+    const versions = [...new Set((Array.isArray(a.findings) ? a.findings : []).map((f) => asRecord(f).version).filter((v) => typeof v === "string"))];
+    const patched = typeof a.patched_versions === "string" ? a.patched_versions.trim() : "";
+    const id = typeof a.github_advisory_id === "string" ? a.github_advisory_id : Array.isArray(a.cves) && typeof a.cves[0] === "string" ? a.cves[0] : String(a.id ?? key);
+    const url = typeof a.url === "string" ? a.url : void 0;
+    const title = String(a.title ?? `Vulnerable dependency: ${String(a.module_name ?? key)}`);
+    const range = typeof a.vulnerable_versions === "string" ? a.vulnerable_versions : void 0;
+    out.push({
+      package: String(a.module_name ?? "unknown"),
+      severity: sev(a.severity),
+      title,
+      id,
+      url,
+      vulnerableRange: range !== void 0 ? range + (versions.length ? ` (installed ${versions.join(", ")})` : "") : void 0,
+      fixAvailable: Boolean(patched) && patched !== "<0.0.0",
+      ...versions.length === 1 ? { version: versions[0] } : {},
+      advisories: [{ id, ids: uniq([id, typeof a.github_advisory_id === "string" ? a.github_advisory_id : void 0, ...strings(a.cves), a.id !== void 0 ? String(a.id) : void 0]), title, severity: sev(a.severity), url, cwe: cwes(a.cwe), range, ...patched && patched !== "<0.0.0" ? { fixedIn: patched } : {} }]
+    });
+  }
+  return out;
+}
+function parseNpmAudit(stdout) {
+  const json = parseJsonObject(stdout, "npm audit");
+  throwIfToolError(json, "npm audit");
+  if (!isObject(json.vulnerabilities)) {
+    if (isObject(json.advisories)) return parseAdvisories(json.advisories);
+    throw new AuditToolError('npm audit output has no "vulnerabilities" report');
+  }
+  const out = [];
+  for (const [name, raw] of Object.entries(json.vulnerabilities)) {
+    const v = asRecord(raw);
+    const via = Array.isArray(v.via) ? v.via : [];
+    const objects = via.filter(isObject);
+    const advisory = objects[0];
+    const viaNames = via.filter((x) => typeof x === "string");
+    const fix = asRecord(v.fixAvailable);
+    out.push({
+      package: name,
+      severity: sev(v.severity),
+      title: String(advisory?.title ?? (viaNames.length ? `Depends on vulnerable ${viaNames.join(", ")}` : `Vulnerable dependency: ${name}`)),
+      id: advisory?.source !== void 0 ? String(advisory.source) : void 0,
+      url: typeof advisory?.url === "string" ? advisory.url : void 0,
+      vulnerableRange: typeof v.range === "string" ? v.range : void 0,
+      fixAvailable: Boolean(v.fixAvailable),
+      via: viaNames,
+      advisories: objects.filter((a) => typeof a.name !== "string" || a.name === name).map((a) => {
+        const url = typeof a.url === "string" ? a.url : void 0;
+        const ghsa = url ? GHSA.exec(url)?.[0] : void 0;
+        return {
+          id: ghsa ?? (a.source !== void 0 ? String(a.source) : void 0),
+          ids: uniq([ghsa, a.source !== void 0 ? String(a.source) : void 0]),
+          title: String(a.title ?? `Vulnerable dependency: ${name}`),
+          severity: sev(a.severity ?? v.severity),
+          url,
+          cwe: cwes(a.cwe),
+          range: typeof a.range === "string" ? a.range : typeof v.range === "string" ? v.range : void 0,
+          ...fix.name === name && typeof fix.version === "string" ? { fixedIn: fix.version } : {}
+        };
+      })
+    });
+  }
+  return out;
+}
+function parsePnpmAudit(stdout) {
+  const json = parseJsonObject(stdout, "pnpm audit");
+  throwIfToolError(json, "pnpm audit");
+  if (!isObject(json.advisories)) throw new AuditToolError('pnpm audit output has no "advisories" report');
+  return parseAdvisories(json.advisories);
+}
+function parsePipAudit(stdout) {
+  const text = stdout.trim();
+  if (!text) throw new AuditToolError("pip-audit produced no output");
+  const json = JSON.parse(text);
+  const deps = isObject(json) && Array.isArray(json.dependencies) ? json.dependencies : Array.isArray(json) ? json : null;
+  if (!deps) throw new AuditToolError('pip-audit output has no "dependencies" list');
+  const out = [];
+  for (const raw of deps) {
+    const d = asRecord(raw);
+    for (const vRaw of Array.isArray(d.vulns) ? d.vulns : []) {
+      const v = asRecord(vRaw);
+      const aliases = strings(v.aliases);
+      const id = typeof v.id === "string" ? v.id : void 0;
+      const fixes = strings(v.fix_versions);
+      const title = String(v.description ?? id ?? "Known vulnerability").split("\n")[0].slice(0, 300);
+      const url = id ? `https://osv.dev/vulnerability/${id}` : void 0;
+      out.push({
+        package: String(d.name ?? "unknown"),
+        severity: "unrated",
+        // pip-audit does not report severity
+        title,
+        id: id ?? aliases[0],
+        url,
+        vulnerableRange: typeof d.version === "string" ? `installed ${d.version}` : void 0,
+        fixAvailable: fixes.length > 0,
+        ...typeof d.version === "string" ? { version: d.version } : {},
+        advisories: [{ id: id ?? aliases[0], ids: uniq([id, ...aliases]), title, severity: "unrated", url, cwe: [], ...fixes[0] ? { fixedIn: fixes[0] } : {} }]
+      });
+    }
+  }
+  return out;
+}
+function splitJsonStream(text) {
+  const out = [];
+  let depth = 0;
+  let inString = false;
+  let escaped = false;
+  let start = -1;
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i];
+    if (inString) {
+      if (escaped) escaped = false;
+      else if (ch === "\\") escaped = true;
+      else if (ch === '"') inString = false;
+      continue;
+    }
+    if (ch === '"') {
+      if (depth > 0) inString = true;
+    } else if (ch === "{") {
+      if (depth === 0) start = i;
+      depth++;
+    } else if (ch === "}" && depth > 0) {
+      depth--;
+      if (depth === 0) {
+        out.push(JSON.parse(text.slice(start, i + 1)));
+        start = -1;
+      }
+    }
+  }
+  if (depth !== 0) throw new AuditToolError("truncated JSON output");
+  return out;
+}
+var REACH_RANK = { required: 0, imported: 1, called: 2 };
+function parseGovulncheck(stdout) {
+  const messages = splitJsonStream(stdout).map(asRecord);
+  if (!messages.some((m) => isObject(m.config))) throw new AuditToolError("govulncheck produced no JSON report");
+  const osvs = /* @__PURE__ */ new Map();
+  for (const m of messages) {
+    const osv = asRecord(m.osv);
+    if (typeof osv.id === "string") osvs.set(osv.id, osv);
+  }
+  const found = /* @__PURE__ */ new Map();
+  for (const m of messages) {
+    const f = asRecord(m.finding);
+    if (typeof f.osv !== "string") continue;
+    const trace = (Array.isArray(f.trace) ? f.trace : []).map(asRecord);
+    const reach = trace.some((t) => typeof t.function === "string") ? "called" : trace.some((t) => typeof t.package === "string") ? "imported" : "required";
+    const first2 = trace[0] ?? {};
+    const prev = found.get(f.osv);
+    if (prev && REACH_RANK[prev.reach] >= REACH_RANK[reach]) continue;
+    found.set(f.osv, {
+      module: typeof first2.module === "string" ? first2.module : prev?.module,
+      version: typeof first2.version === "string" ? first2.version : prev?.version,
+      fixed: typeof f.fixed_version === "string" ? f.fixed_version : prev?.fixed,
+      reach
+    });
+  }
+  const label = { called: "called by your code", imported: "package imported, vulnerable symbol not called", required: "module required, package not imported" };
+  return [...found].map(([id, f]) => {
+    const osv = osvs.get(id) ?? {};
+    const affected = Array.isArray(osv.affected) ? asRecord(osv.affected[0]) : {};
+    const title = `${String(osv.summary ?? id)} (${label[f.reach]})`;
+    const url = `https://pkg.go.dev/vuln/${id}`;
+    return {
+      package: f.module ?? String(asRecord(affected.package).name ?? "unknown"),
+      severity: "unrated",
+      // the Go vulnerability database does not assign severities
+      title,
+      id,
+      url,
+      vulnerableRange: f.version ? `installed ${f.version}` : void 0,
+      fixAvailable: Boolean(f.fixed),
+      ...f.version ? { version: f.version } : {},
+      advisories: [{ id, ids: uniq([id, ...strings(osv.aliases)]), title, severity: "unrated", url, cwe: [], ...f.fixed ? { fixedIn: f.fixed } : {} }]
+    };
+  });
+}
+function parseCargoAudit(stdout) {
+  const json = parseJsonObject(stdout, "cargo audit");
+  if (!isObject(json.vulnerabilities)) throw new AuditToolError('cargo audit output has no "vulnerabilities" report');
+  const list = Array.isArray(json.vulnerabilities.list) ? json.vulnerabilities.list : [];
+  return list.map((raw) => {
+    const v = asRecord(raw);
+    const advisory = asRecord(v.advisory);
+    const pkg = asRecord(v.package);
+    const id = typeof advisory.id === "string" ? advisory.id : void 0;
+    const title = String(advisory.title ?? "Known vulnerability");
+    const url = typeof advisory.url === "string" ? advisory.url : void 0;
+    const severity = sev(asRecord(advisory.cvss).severity ?? advisory.severity);
+    const patched = strings(asRecord(v.versions).patched);
+    return {
+      package: String(pkg.name ?? "unknown"),
+      severity,
+      title,
+      id,
+      url,
+      ...typeof pkg.version === "string" ? { version: pkg.version } : {},
+      advisories: [{ id, ids: uniq([id, ...strings(advisory.aliases)]), title, severity, url, cwe: [], ...patched[0] ? { fixedIn: patched.join(", ") } : {} }]
+    };
+  });
+}
+function parseComposerAudit(stdout) {
+  const json = parseJsonObject(stdout, "composer audit");
+  if (json.advisories === void 0) throw new AuditToolError('composer audit output has no "advisories" report');
+  const advisories = asRecord(json.advisories);
+  const out = [];
+  for (const [pkg, raw] of Object.entries(advisories)) {
+    for (const aRaw of Array.isArray(raw) ? raw : Object.values(asRecord(raw))) {
+      const a = asRecord(aRaw);
+      const id = typeof a.cve === "string" ? a.cve : typeof a.advisoryId === "string" ? a.advisoryId : void 0;
+      const title = String(a.title ?? "Known vulnerability");
+      const url = typeof a.link === "string" ? a.link : void 0;
+      const range = typeof a.affectedVersions === "string" ? a.affectedVersions : void 0;
+      out.push({
+        package: pkg,
+        severity: sev(a.severity),
+        title,
+        id,
+        url,
+        vulnerableRange: range,
+        advisories: [{ id, ids: uniq([id, typeof a.advisoryId === "string" ? a.advisoryId : void 0, typeof a.cve === "string" ? a.cve : void 0]), title, severity: sev(a.severity), url, cwe: [], range }]
+      });
+    }
+  }
+  return out;
+}
+var MAX_PIP_TARGETS = 10;
+var REQUIREMENTS_FILE = /(^|\/)requirements[\w.-]*\.txt$/i;
+var PYTHON_MANIFEST = /(^|\/)(pyproject\.toml|setup\.py|setup\.cfg|Pipfile)$/;
+async function planPipAudit(ctx) {
+  const common = ["--format", "json", "--progress-spinner", "off"];
+  const reqs = ctx.files.filter((f) => REQUIREMENTS_FILE.test(f)).sort();
+  const reqDirs = new Set(reqs.map((f) => path.posix.dirname(f)));
+  const out = reqs.map((f) => ({ target: f, args: ["-r", f, ...common] }));
+  for (const f of ctx.files.filter((x) => x === "pyproject.toml" || x.endsWith("/pyproject.toml")).sort()) {
+    const dir = path.posix.dirname(f);
+    if (reqDirs.has(dir)) continue;
+    const text = await fs.readFile(path.join(ctx.root, f), "utf8").catch(() => "");
+    if (!/^\s*\[project\]\s*$/m.test(text)) continue;
+    out.push({ target: f, args: [...common, dir === "." ? "." : `./${dir}`] });
+  }
+  if (!out.length) return "no requirements file to audit (pip-audit needs requirements*.txt or a PEP 621 pyproject.toml; the active Python environment is never audited)";
+  return out.slice(0, MAX_PIP_TARGETS);
+}
+var single = (args) => async () => [{ args }];
+var first = (...files) => (has) => files.find(has);
+var RUNNERS = [
+  {
+    tool: "npm audit",
+    engine: "npm-audit",
+    ecosystem: "npm",
+    command: "npm",
+    manifest: first("package-lock.json", "npm-shrinkwrap.json"),
+    applies: (_m, has) => has("package-lock.json") || has("npm-shrinkwrap.json"),
+    plan: single(["audit", "--json", "--audit-level=low"]),
+    parse: parseNpmAudit
+  },
+  {
+    tool: "pnpm audit",
+    engine: "pnpm-audit",
+    ecosystem: "npm",
+    command: "pnpm",
+    manifest: first("pnpm-lock.yaml"),
+    applies: (_m, has) => has("pnpm-lock.yaml"),
+    plan: single(["audit", "--json"]),
+    parse: parsePnpmAudit
+  },
+  {
+    tool: "pip-audit",
+    engine: "pip-audit",
+    ecosystem: "python",
+    command: "pip-audit",
+    applies: (m, _has, ctx) => m.manifests.some((x) => x.ecosystem === "python") || ctx.files.some((f) => REQUIREMENTS_FILE.test(f)),
+    plan: planPipAudit,
+    parse: parsePipAudit
+  },
+  {
+    tool: "govulncheck",
+    engine: "govulncheck",
+    ecosystem: "go",
+    command: "govulncheck",
+    manifest: first("go.mod"),
+    applies: (_m, has) => has("go.mod"),
+    plan: single(["-format=json", "./..."]),
+    parse: parseGovulncheck
+  },
+  {
+    tool: "cargo audit",
+    engine: "cargo-audit",
+    ecosystem: "cargo",
+    command: "cargo",
+    manifest: first("Cargo.lock"),
+    applies: (_m, has) => has("Cargo.lock"),
+    plan: single(["audit", "--json"]),
+    parse: parseCargoAudit
+  },
+  {
+    tool: "composer audit",
+    engine: "composer-audit",
+    ecosystem: "composer",
+    command: "composer",
+    manifest: first("composer.lock"),
+    applies: (_m, has) => has("composer.lock"),
+    plan: single(["audit", "--format=json"]),
+    parse: parseComposerAudit
+  }
+];
+var engineIdForTool = (tool) => RUNNERS.find((r) => r.tool === tool)?.engine ?? tool.trim().toLowerCase().replace(/\s+/g, "-");
+function run(command, args, cwd, timeoutMs, signal) {
+  return new Promise((resolve) => {
+    execFile(command, args, { cwd, timeout: timeoutMs, maxBuffer: 32 * 1024 * 1024, windowsHide: true, signal, env: { ...process.env, NO_COLOR: "1", npm_config_color: "false" } }, (error, stdout, stderr) => {
+      const timedOut = Boolean(error && (error.code === "ETIMEDOUT" || error.killed && !signal?.aborted));
+      resolve({ stdout: String(stdout ?? ""), stderr: String(stderr ?? ""), timedOut, error: error ?? null });
+    });
+  });
+}
+async function runTool(runner, inv, root, timeoutMs, manifest, signal) {
+  const t = Date.now();
+  const base = { tool: runner.tool, engine: runner.engine, ecosystem: runner.ecosystem, ...inv.target ? { target: inv.target } : {}, ...manifest ? { manifest } : {}, network: true };
+  const r = await run(runner.command, inv.args, root, timeoutMs, signal);
+  signal?.throwIfAborted();
+  if (r.timedOut) return { ...base, status: "timeout", message: `Timed out after ${timeoutMs / 1e3}s`, durationMs: Date.now() - t, findings: [] };
+  try {
+    const findings = runner.parse(r.stdout, r.stderr);
+    return { ...base, status: "ok", durationMs: Date.now() - t, findings };
+  } catch (err) {
+    const reason = err instanceof AuditToolError ? err.message : `Could not parse output: ${r.stderr.trim().split("\n")[0] || r.error?.message || err.message || "unreadable output"}`;
+    return { ...base, status: "failed", message: reason.slice(0, 300), durationMs: Date.now() - t, findings: [] };
+  }
+}
+async function runAudits(ctx, opts = {}) {
+  const timeoutMs = opts.timeoutMs ?? 12e4;
+  const walk = opts.walk ?? (await walkProject(ctx.root, { config: ctx.config, signal: ctx.signal })).files;
+  const plan = { root: ctx.root, files: walk.map((f) => f.path) };
+  const model = opts.model ?? { manifests: plan.files.filter((f) => PYTHON_MANIFEST.test(f)).map((p) => ({ path: p, ecosystem: "python" })) };
+  const files = new Set(model.manifests.map((m) => m.path));
+  for (const pm of opts.model?.packageManagers ?? []) for (const e of pm.provenance.evidence) files.add(e.file);
+  for (const f of plan.files) files.add(f);
+  const has = (file) => files.has(file);
+  const runs = [];
+  for (const runner of RUNNERS) {
+    if (!runner.applies(model, has, plan)) continue;
+    ctx.signal?.throwIfAborted();
+    const t = Date.now();
+    const manifest = runner.manifest?.(has);
+    const base = { tool: runner.tool, engine: runner.engine, ecosystem: runner.ecosystem, ...manifest ? { manifest } : {}, findings: [] };
+    if (ctx.offline) {
+      runs.push({ ...base, status: "skipped", message: `offline: ${runner.tool} queries an online advisory database`, network: false, durationMs: 0 });
+      continue;
+    }
+    opts.onTool?.(runner.tool);
+    const bin = await whichExecutable(runner.command);
+    if (!bin) {
+      runs.push({ ...base, status: "unavailable", message: `${runner.command} is not installed or not on PATH`, network: false, durationMs: Date.now() - t });
+      continue;
+    }
+    const invocations = await runner.plan(plan);
+    if (typeof invocations === "string") {
+      runs.push({ ...base, status: "unavailable", message: invocations, network: false, durationMs: Date.now() - t });
+      continue;
+    }
+    for (const inv of invocations) {
+      ctx.signal?.throwIfAborted();
+      runs.push(await runTool(runner, inv, ctx.root, timeoutMs, inv.target ?? manifest, ctx.signal));
+    }
+  }
+  return runs;
+}
+var SEVERITY = { critical: "critical", high: "high", moderate: "medium", low: "low", unrated: "unrated" };
+var mapLegacySeverity = (s) => SEVERITY[s];
+function legacyVulnerability(v) {
+  return {
+    package: v.package,
+    severity: v.severity,
+    title: v.title,
+    ...v.id !== void 0 ? { id: v.id } : {},
+    ...v.url !== void 0 ? { url: v.url } : {},
+    ...v.vulnerableRange !== void 0 ? { vulnerableRange: v.vulnerableRange } : {},
+    ...v.fixAvailable !== void 0 ? { fixAvailable: v.fixAvailable } : {}
+  };
+}
+function legacyToolResult(r) {
+  return {
+    tool: r.tool,
+    ecosystem: r.ecosystem,
+    ...r.target ? { target: r.target } : {},
+    status: r.status === "skipped" ? "unavailable" : r.status,
+    ...r.message ? { message: r.message } : {},
+    durationMs: r.durationMs,
+    findings: r.findings.map(legacyVulnerability)
+  };
+}
+var DEPENDENCY_RULE = "dependency/vulnerable-package";
+function auditFindings(r) {
+  const reported = new Set(r.findings.filter((v) => v.advisories === void 0 || v.advisories.length > 0).map((v) => v.package));
+  const manifest = r.target ?? r.manifest;
+  const out = /* @__PURE__ */ new Map();
+  for (const v of r.findings) {
+    let advisories = v.advisories;
+    if (advisories && !advisories.length) {
+      if ((v.via ?? []).some((name) => reported.has(name))) continue;
+      advisories = void 0;
+    }
+    for (const a of advisories ?? [{ id: v.id, ids: uniq([v.id]), title: v.title, severity: v.severity, url: v.url, cwe: [], range: v.vulnerableRange }]) {
+      const advisoryId = a.id ?? a.ids[0];
+      const fingerprint = packageFingerprint({ ruleId: DEPENDENCY_RULE, ecosystem: r.ecosystem, name: v.package, manifest, advisoryId: advisoryId ?? a.title });
+      if (out.has(fingerprint)) continue;
+      const fixedIn = a.fixedIn;
+      const at = v.version ? `${v.package}@${v.version}` : v.package;
+      out.set(fingerprint, {
+        fingerprint,
+        ruleId: DEPENDENCY_RULE,
+        category: "dependency",
+        severity: mapLegacySeverity(a.severity),
+        confidence: "high",
+        label: "FACT",
+        potential: false,
+        title: `${v.package}: ${a.title}`.slice(0, 300),
+        message: `${at} is affected by ${advisoryId ?? "a known vulnerability"}${a.title ? ` (${a.title})` : ""}, as reported by ${r.engine}.`.slice(0, 600),
+        cwe: a.cwe,
+        package: {
+          ecosystem: r.ecosystem,
+          name: v.package,
+          ...v.version ? { version: v.version } : {},
+          ...manifest ? { manifest } : {},
+          advisoryIds: a.ids,
+          ...a.range ? { vulnerableRange: a.range } : {},
+          ...fixedIn ? { fixedIn } : {},
+          ...v.fixAvailable !== void 0 || fixedIn ? { fixAvailable: Boolean(v.fixAvailable || fixedIn) } : {}
+        },
+        engine: { id: r.engine },
+        help: {
+          text: fixedIn ? `Upgrade ${v.package} to ${fixedIn} or later.` : v.fixAvailable ? `A fixed version of ${v.package} is available; upgrade it.` : `No fixed version was reported for ${v.package}. Check the advisory for mitigations.`,
+          ...a.url ? { url: a.url } : {}
+        }
+      });
+    }
+  }
+  return [...out.values()];
+}
+function auditCoverage(r) {
+  const target = r.target ?? r.manifest;
+  return {
+    engine: r.engine,
+    category: "dependency",
+    status: r.status,
+    ...r.message ? { reason: r.message } : {},
+    ...target ? { target } : {},
+    network: r.network,
+    durationMs: r.durationMs
+  };
+}
+async function auditDependencies(ctx, opts = {}) {
+  const runs = await runAudits(ctx, opts);
+  return { runs, findings: runs.flatMap((r) => r.status === "ok" ? auditFindings(r) : []), coverage: runs.map(auditCoverage) };
+}
+function dependencyScanner(opts = {}) {
+  return {
+    id: "athena-dependencies",
+    category: "dependency",
+    title: "Vulnerable dependencies",
+    async run(ctx) {
+      const { findings, coverage } = await auditDependencies(ctx, opts);
+      return { findings, coverage };
+    }
+  };
+}
+
+// src/core/findings/store.ts
+var FINDINGS_FILE = "findings.json";
+async function readFindingsFile(root) {
+  const raw = await readTextIfExists(path2.join(athenaDir(root), FINDINGS_FILE));
+  if (!raw) return null;
+  try {
+    const parsed = ScanResult.safeParse(JSON.parse(raw));
+    return parsed.success ? parsed.data : null;
+  } catch {
+    return null;
+  }
+}
+async function loadFindingsWithSource(root) {
+  const [current, legacy] = await Promise.all([readFindingsFile(root), loadScanFromDir(athenaDir(root))]);
+  if (current && (!legacy || Date.parse(legacy.scannedAt) <= Date.parse(current.scannedAt))) return { result: current, source: "findings" };
+  if (legacy) return { result: migrateLegacyScan(legacy), source: "migrated" };
+  return null;
+}
+async function loadFindings(root) {
+  return (await loadFindingsWithSource(root))?.result ?? null;
+}
+async function saveFindings(root, result) {
+  const valid = ScanResult.parse(result);
+  await writeFileAtomic(path2.join(athenaDir(root), FINDINGS_FILE), `${JSON.stringify(valid, null, 2)}
+`);
+}
+function migrateLegacyScan(scan) {
+  const findings = [];
+  const coverage = [];
+  for (const t of scan.tools) {
+    const engine = engineIdForTool(t.tool);
+    const ran = t.status !== "unavailable";
+    if (t.status === "ok") {
+      for (const f of auditFindings({ engine, ecosystem: t.ecosystem, target: t.target, findings: t.findings })) findings.push(Finding.parse(f));
+    }
+    coverage.push(Coverage.parse(auditCoverage({ engine, status: t.status, message: t.message, target: t.target, network: ran, durationMs: t.durationMs })));
+  }
+  const s = scan.secrets;
+  const notes = [
+    s.count ? `migrated from security-scan.json (v1): ${s.count} potential secret(s) in ${s.files.length} file(s) (${s.files.slice(0, 10).join(", ")}${s.files.length > 10 ? ", \u2026" : ""}); v1 did not record lines, so they are not listed as findings \u2014 run the scan again for locations` : "migrated from security-scan.json (v1): no secrets matched",
+    ...s.skippedLongLines ? [`generic keyword patterns not applied to ${s.skippedLongLines} long line(s)`] : [],
+    ...s.truncated ? ["the scan stopped early after too many findings"] : []
+  ];
+  coverage.push(Coverage.parse({ engine: SECRETS_ENGINE, category: "secret", status: "ok", reason: notes.join("; "), network: false, durationMs: 0 }));
+  return ScanResult.parse({
+    schemaVersion: 1,
+    scannedAt: scan.scannedAt,
+    durationMs: scan.durationMs,
+    scope: { mode: "all" },
+    findings: dedupeFindings(findings),
+    coverage
+  });
+}
+
+export {
+  legacyToolResult,
+  auditDependencies,
+  dependencyScanner,
+  loadFindings,
+  saveFindings
+};
+//# sourceMappingURL=chunk-IDODPGTX.js.map