project-athena 0.4.0 → 0.5.0

package/dist/scan-JVKCVHPD.js

@@ -0,0 +1,939 @@
+#!/usr/bin/env node
+import {
+  GATE_SEVERITIES,
+  TRIAGE_STATUSES,
+  baselineFindings,
+  evaluateFindings,
+  loadBaseline,
+  pruneBaselineFile,
+  triageFinding,
+  untriageFinding
+} from "./chunk-KJYSNZXS.js";
+import {
+  dependencyScanner,
+  loadFindings,
+  saveFindings
+} from "./chunk-IDODPGTX.js";
+import "./chunk-UMWX4UTK.js";
+import {
+  createReviewScanner
+} from "./chunk-C25FDXOO.js";
+import {
+  CATEGORIES,
+  CONFIDENCES,
+  CONFIDENCE_RANK,
+  Coverage,
+  FINGERPRINT_VERSION,
+  Finding,
+  compareFindings,
+  dedupeFindings,
+  secretsScanner
+} from "./chunk-Y6SDMZET.js";
+import "./chunk-3IS2X2Z7.js";
+import {
+  dim,
+  heading,
+  info,
+  isJson,
+  json,
+  line,
+  ok,
+  relativeTime,
+  spinner,
+  warn
+} from "./chunk-Z6QWMJLK.js";
+import {
+  requireProjectRoot
+} from "./chunk-XFN7UZCS.js";
+import "./chunk-KBO7XRBW.js";
+import {
+  projectSession
+} from "./chunk-GU3ZX2J7.js";
+import {
+  ATHENA_VERSION
+} from "./chunk-2R6PXY6Z.js";
+import {
+  analyzeProject
+} from "./chunk-44EGCEB2.js";
+import "./chunk-PVCIGUIT.js";
+import "./chunk-ELKFRTZT.js";
+import {
+  changesSince,
+  git,
+  isSafeRef,
+  workingChanges
+} from "./chunk-AKOI4VTD.js";
+import "./chunk-SVTEJYMS.js";
+import "./chunk-QCC4VJUH.js";
+import {
+  SECRET_PATTERNS
+} from "./chunk-WWQ5NKEC.js";
+import {
+  loadConfig
+} from "./chunk-2DY4PUR4.js";
+import {
+  writeFileAtomic
+} from "./chunk-IQQBAWSM.js";
+import {
+  AthenaError,
+  EXIT
+} from "./chunk-AD4OZCU2.js";
+import "./chunk-XW3MLHI2.js";
+import "./chunk-EUPETUWA.js";
+
+// src/cli/commands/scan.ts
+import { promises as fs } from "fs";
+import path from "path";
+
+// src/core/report/shared.ts
+var TOOL_NAME = "athena";
+var INFORMATION_URI = "https://athena.sabari.me";
+var DISPLAY_ORDER = ["critical", "high", "unrated", "medium", "low", "info"];
+var statusOf = (input, f) => input.statuses?.[f.fingerprint] ?? "open";
+var statusKind = (s) => s.startsWith("triaged:") ? "triaged" : s;
+var statusTag = (s) => s.startsWith("triaged:") ? `triaged (${s.slice("triaged:".length) || "unspecified"})` : s;
+function summarize(input) {
+  const s = {
+    total: input.result.findings.length,
+    open: 0,
+    openBySeverity: { critical: 0, high: 0, medium: 0, low: 0, info: 0, unrated: 0 },
+    openPotential: 0,
+    baselined: 0,
+    suppressed: 0,
+    triaged: 0,
+    excluded: 0
+  };
+  for (const f of input.result.findings) {
+    const k = statusKind(statusOf(input, f));
+    if (k === "open") {
+      s.open++;
+      s.openBySeverity[f.severity]++;
+      if (f.potential) s.openPotential++;
+    } else s[k]++;
+  }
+  return s;
+}
+function sortForDisplay(findings) {
+  return [...findings].sort((a, b) => DISPLAY_ORDER.indexOf(a.severity) - DISPLAY_ORDER.indexOf(b.severity) || compareFindings(a, b));
+}
+var displayTitle = (f) => f.potential && !/^potential\b/i.test(f.title) ? `Potential ${lowerFirst(f.title)}` : f.title;
+var lowerFirst = (s) => /^[A-Z][a-z]/.test(s) ? s[0].toLowerCase() + s.slice(1) : s;
+function relPath(file, root) {
+  let p = file.replace(/\\/g, "/");
+  if (root) {
+    const r = root.replace(/\\/g, "/").replace(/\/+$/, "");
+    if (p === r) p = ".";
+    else if (p.startsWith(`${r}/`)) p = p.slice(r.length + 1);
+  }
+  return p.replace(/^(?:\.\/)+/, "");
+}
+var fileOf = (f, root) => {
+  const file = f.location?.file ?? f.package?.manifest;
+  return file ? relPath(file, root) : void 0;
+};
+function whereOf(f, root) {
+  const file = fileOf(f, root);
+  const pkg = f.package ? `${f.package.name}${f.package.version ? `@${f.package.version}` : ""}` : "";
+  if (f.location) return `${file}${f.location.startLine ? `:${f.location.startLine}` : ""}`;
+  if (file && pkg) return `${file} (${pkg})`;
+  return pkg || file || "(no location)";
+}
+var engineText = (f) => `${f.engine.id}${f.alsoReportedBy.length ? ` (+${f.alsoReportedBy.join(", ")})` : ""}`;
+var coverageGaps = (coverage) => coverage.filter((c) => c.status !== "ok");
+var uncoveredCategories = (coverage) => CATEGORIES.filter((cat) => !coverage.some((c) => c.category === cat && c.status === "ok"));
+function filesSkippedText(c) {
+  const s = c.filesSkipped;
+  if (!s) return "";
+  const parts = [
+    ["too large", s.tooLarge],
+    ["binary", s.binary],
+    ["minified", s.minified],
+    ["unreadable", s.unreadable],
+    ["unsupported", s.unsupported]
+  ].filter(([, n]) => n > 0).map(([k, n]) => `${n} ${k}`);
+  return parts.join(", ");
+}
+var coverageGapText = (c) => `${c.engine} (${c.category}${c.target ? `, ${c.target}` : ""}): ${c.status}${c.reason ? ` \u2014 ${c.reason}` : ""}`;
+var scopeText = (r) => `${r.scope.mode}${r.scope.base ? ` vs ${r.scope.base}` : ""}${r.scope.files !== void 0 ? ` (${r.scope.files} file${r.scope.files === 1 ? "" : "s"})` : ""}`;
+var plural = (n, one, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
+
+// src/core/report/github.ts
+var MAX_ANNOTATIONS = 50;
+var KIND = { critical: "error", high: "error", medium: "warning", unrated: "warning", low: "notice", info: "notice" };
+var ghData = (s) => String(s).replace(/%/g, "%25").replace(/\r/g, "%0D").replace(/\n/g, "%0A");
+var ghProp = (s) => ghData(s).replace(/:/g, "%3A").replace(/,/g, "%2C");
+function command(kind, props, message) {
+  const p = Object.entries(props).filter(([, v]) => v !== void 0 && v !== "").map(([k, v]) => `${k}=${typeof v === "number" ? v : ghProp(v)}`).join(",");
+  return `::${kind}${p ? ` ${p}` : ""}::${ghData(message)}`;
+}
+function renderGithub(input) {
+  const r = input.result;
+  const s = summarize(input);
+  const out = [];
+  const open = sortForDisplay(r.findings).filter((f) => statusKind(statusOf(input, f)) === "open");
+  for (const f of open.slice(0, MAX_ANNOTATIONS)) {
+    const loc = f.location;
+    const message = f.message && f.message !== f.title ? `${f.message} (${f.ruleId}, ${f.label}, ${f.engine.id})` : `${f.ruleId}, ${f.label}, ${f.engine.id}`;
+    out.push(
+      command(
+        KIND[f.severity],
+        {
+          file: fileOf(f, input.root),
+          line: loc?.startLine,
+          col: loc?.startLine ? loc.startColumn : void 0,
+          endLine: loc?.startLine ? loc.endLine : void 0,
+          endColumn: loc?.startLine && loc.endLine === loc.startLine ? loc.endColumn : void 0,
+          title: `Athena [${f.severity}]: ${displayTitle(f)}`
+        },
+        message
+      )
+    );
+  }
+  const rest = open.length - Math.min(open.length, MAX_ANNOTATIONS);
+  const hidden = ["baselined", "suppressed", "triaged", "excluded"].filter((k) => s[k] > 0).map((k) => `${s[k]} ${k}`);
+  const summary = `Athena: ${plural(s.open, "open finding")}${rest ? `, ${rest} not annotated (limit ${MAX_ANNOTATIONS})` : ""}${hidden.length ? `; not counted: ${hidden.join(", ")}` : ""}.`;
+  out.push(command(s.openBySeverity.critical + s.openBySeverity.high ? "error" : s.open ? "warning" : "notice", { title: "Athena scan" }, summary));
+  if (input.gate) {
+    const text = `Gate ${input.gate.passed ? "passed" : "failed"}${input.gate.reasons.length ? `: ${input.gate.reasons.join("; ")}` : "."}`;
+    out.push(command(input.gate.passed ? "notice" : "error", { title: "Athena gate" }, text));
+  }
+  for (const g of coverageGaps(r.coverage)) {
+    out.push(command(g.status === "failed" || g.status === "timeout" ? "warning" : "notice", { title: "Athena coverage gap" }, coverageGapText(g)));
+  }
+  if (!r.coverage.length) out.push(command("warning", { title: "Athena coverage gap" }, "No engine reported coverage: nothing was checked."));
+  const uncovered = uncoveredCategories(r.coverage);
+  if (uncovered.length) out.push(command("notice", { title: "Athena coverage" }, `Not covered by any engine: ${uncovered.join(", ")}.`));
+  return `${out.join("\n")}
+`;
+}
+
+// src/core/report/json.ts
+function toJsonReport(input) {
+  const r = input.result;
+  return {
+    schemaVersion: 1,
+    tool: { name: TOOL_NAME, version: input.toolVersion },
+    fingerprintVersion: FINGERPRINT_VERSION,
+    scope: r.scope,
+    scannedAt: r.scannedAt,
+    durationMs: r.durationMs,
+    summary: summarize(input),
+    findings: sortForDisplay(r.findings).map((f) => ({ ...f, status: statusOf(input, f) })),
+    coverage: r.coverage,
+    ...input.gate ? { gate: input.gate } : {},
+    ...input.ratings ? { ratings: input.ratings } : {}
+  };
+}
+var renderJson = (input) => `${JSON.stringify(toJsonReport(input), null, 2)}
+`;
+
+// src/core/report/markdown.ts
+var SCAN_MARKER = "<!-- athena-scan:v1 -->";
+var MAX_MARKDOWN_FINDINGS = 50;
+var MAX_CELL = 200;
+var SEV_LABEL = { critical: "Critical", high: "High", unrated: "Unrated", medium: "Medium", low: "Low", info: "Info" };
+function mdText(s, max = MAX_CELL) {
+  let t = String(s).replace(/[\r\n\t\x00-\x1f\x7f]+/g, " ").trim();
+  if ([...t].length > max) t = `${[...t].slice(0, max - 1).join("")}\u2026`;
+  return t.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/[\\`*_[\]|~]/g, (ch) => `\\${ch}`).replace(/^([#+=-])/, "\\$1").replace(/^(\d+)([.)])/, "$1\\$2").replace(/@/g, "@\u200B");
+}
+function mdCode(s, inTable = false) {
+  let t = String(s).replace(/[\r\n\x00-\x1f\x7f`]+/g, "");
+  if ([...t].length > MAX_CELL) t = `${[...t].slice(0, MAX_CELL - 1).join("")}\u2026`;
+  if (inTable) t = t.replace(/\|/g, "\\|");
+  return t ? `\`${t}\`` : "";
+}
+function renderMarkdown(input) {
+  const r = input.result;
+  const s = summarize(input);
+  const lines = [SCAN_MARKER, "### Athena scan", ""];
+  lines.push(`Scope: ${mdCode(scopeText(r))} \xB7 ${plural(s.open, "open finding")}${s.openPotential ? ` (${s.openPotential} potential)` : ""}`, "");
+  if (input.gate) {
+    lines.push(`**Gate: ${input.gate.passed ? "passed" : "failed"}**`);
+    for (const reason of input.gate.reasons) lines.push(`- ${mdText(reason)}`);
+    lines.push("");
+  }
+  if (s.open) {
+    lines.push("| Severity | Open |", "| --- | ---: |");
+    for (const sev of DISPLAY_ORDER) if (s.openBySeverity[sev]) lines.push(`| ${SEV_LABEL[sev]} | ${s.openBySeverity[sev]} |`);
+    lines.push("");
+  } else lines.push("No open findings.", "");
+  const hidden = ["baselined", "suppressed", "triaged", "excluded"].filter((k) => s[k] > 0).map((k) => `${s[k]} ${k}`);
+  if (hidden.length) lines.push(`Not counted: ${hidden.join(", ")}.`, "");
+  const open = sortForDisplay(r.findings).filter((f) => statusKind(statusOf(input, f)) === "open");
+  if (open.length) {
+    const shown = open.slice(0, MAX_MARKDOWN_FINDINGS);
+    lines.push("#### Open findings", "", "| Severity | Finding | Location | Rule | Source |", "| --- | --- | --- | --- | --- |");
+    for (const f of shown) {
+      lines.push(`| ${SEV_LABEL[f.severity]} | ${mdText(displayTitle(f))} | ${mdCode(whereOf(f, input.root), true)} | ${mdCode(f.ruleId, true)} | ${f.label} \xB7 ${mdText(engineText(f))} |`);
+    }
+    lines.push("");
+    if (open.length > shown.length) lines.push(`_Showing ${shown.length} of ${open.length} open findings; ${open.length - shown.length} more not shown. Run \`athena scan\` for the full list._`, "");
+  }
+  const ratings = Object.entries(input.ratings ?? {}).filter(([, v]) => v);
+  if (ratings.length) {
+    lines.push("#### Ratings", "", "| Category | Grade | Basis |", "| --- | :---: | --- |");
+    for (const [cat, rating] of ratings) lines.push(`| ${mdText(cat)} | ${rating.grade} | ${mdText(rating.basis)} |`);
+    lines.push("");
+  }
+  const gaps = coverageGaps(r.coverage);
+  const uncovered = uncoveredCategories(r.coverage);
+  lines.push("#### Coverage", "");
+  if (!r.coverage.length) lines.push("- **No engine reported coverage: nothing was checked.**");
+  for (const g of gaps) lines.push(`- ${mdCode(g.engine)} (${mdText(g.category)}${g.target ? `, ${mdCode(g.target)}` : ""}): **${g.status}**${g.reason ? ` \u2014 ${mdText(g.reason)}` : ""}`);
+  if (r.coverage.length && !gaps.length) lines.push(`- All ${plural(r.coverage.length, "engine")} ran cleanly.`);
+  const network = r.coverage.filter((c) => c.network).map((c) => mdCode(c.engine));
+  if (network.length) lines.push(`- Used the network: ${network.join(", ")}.`);
+  if (uncovered.length) lines.push(`- Not covered by any engine: ${uncovered.join(", ")}.`);
+  lines.push("");
+  lines.push(
+    `<sub>Generated by <a href="https://athena.sabari.me">Athena</a> ${mdText(input.toolVersion, 40)}. Findings show a type and location only, never a matched value. \u201CPotential\u201D findings are heuristics: check them.</sub>`
+  );
+  return `${lines.join("\n")}
+`;
+}
+
+// src/core/report/rules.ts
+var SECRET_HELP = "Remove the value from the code, load it from an environment variable or a secret manager, and rotate the credential: anyone with access to the repository or its history may already have it. Removing it from the latest commit does not remove it from Git history.";
+var HEURISTIC_SECRETS = /* @__PURE__ */ new Set(["generic-secret-assignment", "env-secret-assignment"]);
+var secretRules = SECRET_PATTERNS.map((p) => ({
+  id: `secret/${p.id}`,
+  category: "secret",
+  title: `${p.description} in source`,
+  description: HEURISTIC_SECRETS.has(p.id) ? `A value that looks like a credential (${p.description.toLowerCase()}) was found by a keyword and entropy heuristic. It may be a real secret or a false positive; check it.` : `A string matching the format of a ${p.description} was found in a tracked file. Athena reports the type and location only, never the value.`,
+  help: SECRET_HELP,
+  cwe: ["CWE-798"],
+  ...HEURISTIC_SECRETS.has(p.id) ? { potential: true } : {}
+}));
+var review = (id, title, description, help, cwe = []) => ({ id: `review/${id}`, category: "review", title, description, help, cwe });
+var OTHER_RULES = [
+  {
+    id: "dependency/vulnerable-package",
+    category: "dependency",
+    title: "Dependency with a known vulnerability",
+    description: "A package in the dependency tree matches a published security advisory, as reported by the ecosystem audit tool (npm audit, pip-audit, cargo audit, \u2026).",
+    help: "Upgrade to a fixed version when one is available (see the advisory), or remove the dependency. If the vulnerable code path is not reachable, record that with a triage decision instead of ignoring the finding.",
+    cwe: ["CWE-1395"]
+  },
+  review("env-file", "Environment file in the change", "A .env-style file is part of the change. These usually hold credentials and machine-specific settings.", "Add it to .gitignore and commit a .env.example with variable names only.", ["CWE-538"]),
+  review("dependencies", "New dependencies", "The change adds dependencies to a manifest.", "Justify each addition; check its licence, maintenance and size."),
+  review("tests", "Source changed without tests", "Source files changed but no test files did.", "Add or update tests for the changed behaviour, or say why none are needed."),
+  review("api", "API surface changed", "Route or API handler files changed.", "Check authentication, authorization and error handling for the changed endpoints."),
+  review("database", "Database schema or migrations changed", "Schema or migration files changed.", "Check indexes, constraints and backward compatibility with running code and existing data."),
+  review("auth", "Authentication or authorization code changed", "Files that implement authentication or authorization changed.", "Review the change against the project security notes; such code deserves a second reviewer."),
+  review("large-files", "Large files added", "The change adds unusually large files.", "Consider whether these belong in Git (Git LFS, an artifact store, or generated at build time)."),
+  review("leftovers", "TODO/FIXME or debug statements added", "Added lines contain TODO/FIXME markers or debug statements.", "Remove debug output and resolve or track the TODOs before merging.", ["CWE-489"]),
+  review("vulnerabilities", "Known vulnerable dependencies", "The last dependency scan reported high or critical advisories.", "Run the dependency scan for details and upgrade the affected packages.", ["CWE-1395"]),
+  review("knowledge", "Project knowledge out of date", "Athena knowledge (.athena/) does not reflect these changes.", "Run `athena sync` so agents read current context."),
+  review("skipped", "Changed files not checked", "Some changed files could not be read (too large, binary or unreadable), so their contents were not checked.", "Check these files yourself; Athena makes no claim about them."),
+  review("policy-weakened", "Security policy changed on this branch", "The branch changes .athena/policy.json, baseline.json or triage.json, or adds an athena-ignore comment, compared with the base branch. High when the change relaxes the quality gate.", "Have a maintainer review the change. With `--policy-from <base>` the gate keeps using the base branch policy until this merges."),
+  review("suppression-without-reason", "Inline suppression without a reason", "An `athena-ignore <ruleId>` comment has no `-- <reason>`, so it was not applied.", "Add a reason: `athena-ignore <ruleId> -- <why this is safe>`."),
+  review("invalid-suppression", "Inline suppression with no valid rule id", "An `athena-ignore` comment does not name a valid rule id, so it was not applied.", "Name exactly one rule: `athena-ignore secret/stripe-key -- <reason>`. Run `athena scan --list-rules` for ids.")
+];
+var RULES = new Map([...secretRules, ...OTHER_RULES].map((r) => [r.id, r]));
+var ruleInfo = (id) => RULES.get(id);
+var listRules = () => [...RULES.values()].sort((a, b) => a.id.localeCompare(b.id));
+
+// src/core/report/sarif.ts
+var SECURITY_SEVERITY = { critical: "9.5", high: "8.0", medium: "5.5", low: "3.0", info: "0.0", unrated: "7.0" };
+var SARIF_LEVEL = { critical: "error", high: "error", medium: "warning", unrated: "warning", low: "note", info: "note" };
+var SECURITY_CATEGORIES = /* @__PURE__ */ new Set(["secret", "dependency", "sast", "iac"]);
+var SARIF_SCHEMA = "https://json.schemastore.org/sarif-2.1.0.json";
+var SEMVER = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+var uriOf = (p) => p.split("/").map(encodeURIComponent).join("/");
+var isAbsolute = (p) => p.startsWith("/") || /^[A-Za-z]:\//.test(p);
+function artifactLocation(file) {
+  if (isAbsolute(file)) return { uri: `file://${file.startsWith("/") ? "" : "/"}${uriOf(file)}` };
+  return { uri: uriOf(file), uriBaseId: "%SRCROOT%" };
+}
+function buildRule(id, findings) {
+  const info2 = ruleInfo(id);
+  const score = (f) => Number(SECURITY_SEVERITY[f.severity]);
+  const top = findings.reduce((a, b) => score(b) > score(a) ? b : a);
+  const severity = top.severity;
+  const confidence = findings.map((f) => f.confidence).reduce((a, b) => CONFIDENCE_RANK[b] > CONFIDENCE_RANK[a] ? b : a, "low");
+  const cwe = [.../* @__PURE__ */ new Set([...info2?.cwe ?? [], ...findings.flatMap((f) => f.cwe)])].sort();
+  const categories = [...new Set(findings.map((f) => f.category))];
+  const security = categories.some((c) => SECURITY_CATEGORIES.has(c)) || cwe.length > 0;
+  const withHelp = findings.find((f) => f.help);
+  const helpText = withHelp?.help?.text ?? info2?.help ?? top.message ?? top.title;
+  const helpUrl = withHelp?.help?.url ?? info2?.helpUrl;
+  return {
+    id,
+    shortDescription: { text: info2?.title ?? top.title },
+    ...info2?.description ? { fullDescription: { text: info2.description } } : {},
+    help: { text: helpText, markdown: `${mdText(helpText, 4e3)}${helpUrl && /^https?:\/\//.test(helpUrl) ? `
+
+[More information](${encodeURI(helpUrl)})` : ""}` },
+    ...helpUrl && /^https?:\/\//.test(helpUrl) ? { helpUri: encodeURI(helpUrl) } : {},
+    defaultConfiguration: { level: SARIF_LEVEL[severity] },
+    properties: {
+      tags: [...categories, ...security ? ["security"] : [], ...cwe.map((c) => `external/cwe/${c.toLowerCase()}`)],
+      "security-severity": SECURITY_SEVERITY[severity],
+      precision: confidence
+    }
+  };
+}
+function notification(c) {
+  const level = c.status === "failed" || c.status === "timeout" ? "error" : c.status === "unavailable" ? "warning" : "note";
+  return {
+    level,
+    message: { text: `${c.engine} (${c.category}${c.target ? `, ${c.target}` : ""}): ${c.status}${c.reason ? ` \u2014 ${c.reason}` : ""}. Not covered by this run.` },
+    descriptor: { id: `athena/coverage/${c.status}` },
+    properties: { engine: c.engine, category: c.category, status: c.status, network: c.network, ...c.target ? { target: c.target } : {} }
+  };
+}
+function toSarif(input) {
+  const r = input.result;
+  const findings = sortForDisplay(r.findings).filter((f) => statusKind(statusOf(input, f)) !== "excluded");
+  const baselineApplied = Object.values(input.statuses ?? {}).includes("baselined") || r.scope.mode !== "all";
+  const ruleIds = [...new Set(findings.map((f) => f.ruleId))].sort();
+  const rules = ruleIds.map((id) => buildRule(id, findings.filter((f) => f.ruleId === id)));
+  const ruleIndex = new Map(ruleIds.map((id, i) => [id, i]));
+  const results = findings.map((f) => {
+    const status = statusOf(input, f);
+    const kind = statusKind(status);
+    const file = fileOf(f, input.root);
+    const loc = f.location;
+    const region = loc?.startLine ? {
+      startLine: loc.startLine,
+      ...loc.startColumn ? { startColumn: loc.startColumn } : {},
+      ...loc.endLine && loc.endLine >= loc.startLine ? { endLine: loc.endLine } : {},
+      ...loc.endColumn && (loc.endLine ?? loc.startLine) >= loc.startLine ? { endColumn: loc.endColumn } : {}
+    } : void 0;
+    const note = input.notes?.[f.fingerprint];
+    const suppression = kind === "suppressed" ? { kind: "inSource", status: "accepted", justification: note ?? "Suppressed by an inline Athena comment." } : kind === "triaged" ? { kind: "external", status: "accepted", justification: note ?? `Triaged as ${status.slice("triaged:".length) || "unspecified"} in Athena triage.` } : kind === "baselined" ? { kind: "external", status: "accepted", justification: note ?? "Accepted in the Athena baseline (existing finding)." } : void 0;
+    const title = displayTitle(f);
+    return {
+      ruleId: f.ruleId,
+      ruleIndex: ruleIndex.get(f.ruleId),
+      level: SARIF_LEVEL[f.severity],
+      message: { text: f.message && f.message !== f.title ? `${title}: ${f.message}` : title },
+      ...file ? { locations: [{ physicalLocation: { artifactLocation: artifactLocation(file), ...region ? { region } : {} } }] } : {},
+      partialFingerprints: { [`athena/v${FINGERPRINT_VERSION}`]: f.fingerprint },
+      ...baselineApplied ? { baselineState: kind === "baselined" ? "unchanged" : "new" } : {},
+      ...suppression ? { suppressions: [suppression] } : {},
+      properties: {
+        severity: f.severity,
+        confidence: f.confidence,
+        category: f.category,
+        label: f.label,
+        potential: f.potential,
+        engine: f.engine.id,
+        ...f.engine.version ? { engineVersion: f.engine.version } : {},
+        alsoReportedBy: f.alsoReportedBy,
+        status,
+        ...f.owasp.length ? { owasp: f.owasp } : {},
+        ...f.package ? { package: f.package } : {}
+      }
+    };
+  });
+  const gaps = r.coverage.filter((c) => c.status !== "ok");
+  const endTime = Number.isNaN(Date.parse(r.scannedAt)) ? void 0 : new Date(Date.parse(r.scannedAt)).toISOString();
+  return {
+    $schema: SARIF_SCHEMA,
+    version: "2.1.0",
+    runs: [
+      {
+        tool: {
+          driver: {
+            name: "Athena",
+            version: input.toolVersion,
+            ...SEMVER.test(input.toolVersion) ? { semanticVersion: input.toolVersion } : {},
+            informationUri: INFORMATION_URI,
+            rules
+          }
+        },
+        invocations: [
+          {
+            executionSuccessful: !r.coverage.some((c) => c.status === "failed" || c.status === "timeout"),
+            ...endTime ? { endTimeUtc: endTime } : {},
+            toolExecutionNotifications: gaps.map(notification)
+          }
+        ],
+        columnKind: "utf16CodeUnits",
+        results,
+        properties: {
+          scope: r.scope,
+          coverage: r.coverage.map((c) => ({ engine: c.engine, category: c.category, status: c.status, network: c.network, ...c.reason ? { reason: c.reason } : {}, ...c.target ? { target: c.target } : {} })),
+          ...input.gate ? { gate: input.gate } : {},
+          ...input.ratings ? { ratings: input.ratings } : {}
+        }
+      }
+    ]
+  };
+}
+var renderSarif = (input) => `${JSON.stringify(toSarif(input), null, 2)}
+`;
+
+// src/core/report/text.ts
+import pc from "picocolors";
+var BADGE = { critical: "CRITICAL", high: "HIGH", unrated: "UNRATED", medium: "MEDIUM", low: "LOW", info: "INFO" };
+var BADGE_W = 8;
+var INDENT = " ".repeat(4 + BADGE_W + 1);
+function cut(s, max) {
+  const chars = [...s.replace(/[\r\n\t]+/g, " ")];
+  if (chars.length <= max) return chars.join("");
+  return max <= 1 ? chars.slice(0, Math.max(0, max)).join("") : `${chars.slice(0, max - 1).join("")}\u2026`;
+}
+var clean = (s) => s.replace(/[\x00-\x08\x0b-\x1f\x7f-\x9f]/g, "");
+var len = (s) => [...s].length;
+function renderText(input, opts = {}) {
+  const c = pc.createColors(opts.color ?? pc.isColorSupported);
+  const W = Math.max(40, opts.width ?? (process.stdout.columns ? Math.min(process.stdout.columns, 160) : 100));
+  const r = input.result;
+  const out = [];
+  const sevColor = {
+    critical: (s2) => c.bold(c.red(s2)),
+    high: c.red,
+    unrated: c.magenta,
+    medium: c.yellow,
+    low: c.cyan,
+    info: c.dim
+  };
+  out.push(c.bold(cut(`Athena scan \u2014 ${scopeText(r)} \xB7 ${r.scannedAt}`, W)));
+  out.push("");
+  const s = summarize(input);
+  const bySev = DISPLAY_ORDER.filter((k) => s.openBySeverity[k] > 0).map((k) => `${s.openBySeverity[k]} ${k}`);
+  const headline = `Open findings: ${s.open}`;
+  const detail = `${bySev.length ? ` (${bySev.join(" \xB7 ")})` : ""}${s.openPotential ? ` \xB7 ${s.openPotential} potential (heuristic, check them)` : ""}`;
+  out.push(`${c.bold(headline)}${cut(detail, W - headline.length)}`);
+  const hidden = ["baselined", "suppressed", "triaged", "excluded"].filter((k) => s[k] > 0).map((k) => `${s[k]} ${k}`);
+  if (hidden.length) out.push(c.dim(cut(`Not counted: ${hidden.join(" \xB7 ")}`, W)));
+  const findings = sortForDisplay(r.findings);
+  for (const sev of DISPLAY_ORDER) {
+    const inSev = findings.filter((f) => f.severity === sev);
+    if (!inSev.length) continue;
+    out.push("", sevColor[sev](BADGE[sev]));
+    const cats = [...new Set(inSev.map((f) => f.category))].sort();
+    for (const cat of cats) {
+      out.push(`  ${c.bold(cat)}`);
+      for (const f of inSev.filter((x) => x.category === cat)) out.push(...findingLines(f));
+    }
+  }
+  if (!findings.length) out.push("", "No findings.");
+  function findingLines(f) {
+    const status = statusOf(input, f);
+    const open = statusKind(status) === "open";
+    const badge = BADGE[f.severity].padEnd(BADGE_W);
+    const where2 = clean(whereOf(f, input.root));
+    const title = clean(displayTitle(f));
+    const tag = open ? "" : `  [${statusTag(status)}]`;
+    const room = W - 4 - BADGE_W - 1;
+    const right = `  ${where2}${tag}`;
+    const head = cut(cut(title, Math.max(12, room - len(right))) + right, room);
+    const meta = cut(`${f.ruleId} \xB7 ${f.label} \xB7 ${clean(engineText(f))}`, room);
+    if (!open) return [c.dim(`    ${badge} ${head}`), c.dim(`${INDENT}${meta}`)];
+    const lines = [`    ${sevColor[f.severity](badge)} ${head}`];
+    const msg = clean(f.message);
+    if (msg && msg !== f.title) lines.push(`${INDENT}${cut(msg, room)}`);
+    lines.push(c.dim(`${INDENT}${meta}`));
+    return lines;
+  }
+  if (input.gate) {
+    out.push("", `${c.bold("Gate:")} ${input.gate.passed ? c.green("PASSED") : c.red(c.bold("FAILED"))}`);
+    for (const reason of input.gate.reasons) out.push(`  - ${cut(clean(reason), W - 4)}`);
+  }
+  const ratings = Object.entries(input.ratings ?? {});
+  if (ratings.length) {
+    out.push("", c.bold("Ratings"));
+    const cw = Math.max(...ratings.map(([k]) => k.length));
+    for (const [cat, rating] of ratings) if (rating) out.push(`  ${cat.padEnd(cw)}  ${c.bold(rating.grade)}  ${cut(clean(rating.basis), W - cw - 7)}`);
+  }
+  out.push("", c.bold("Coverage"));
+  if (!r.coverage.length) out.push(c.yellow(cut("  No engine reported coverage: nothing was checked.", W)));
+  const ew = Math.max(0, ...r.coverage.map((x) => x.engine.length));
+  const kw = Math.max(0, ...r.coverage.map((x) => x.category.length));
+  const sw = Math.max(0, ...r.coverage.map((x) => x.status.length));
+  for (const cov of r.coverage) {
+    const details = [];
+    if (cov.target) details.push(cov.target);
+    if (cov.filesScanned !== void 0) details.push(plural(cov.filesScanned, "file") + " scanned");
+    const skipped = filesSkippedText(cov);
+    if (skipped) details.push(`skipped ${skipped}`);
+    if (cov.network) details.push("used network");
+    if (cov.reason) details.push(cov.reason);
+    const status = cov.status === "ok" ? c.green("ok") : cov.status === "failed" || cov.status === "timeout" ? c.red(cov.status) : c.yellow(cov.status);
+    const prefix = `  ${clean(cov.engine).padEnd(ew)}  ${cov.category.padEnd(kw)}  `;
+    const plain = cut(`${prefix}${cov.status.padEnd(sw)}${details.length ? `  ${clean(details.join(" \xB7 "))}` : ""}`.trimEnd(), W);
+    const head = `${prefix}${cov.status}`;
+    out.push(plain.startsWith(head) ? `${prefix}${status}${plain.slice(head.length)}` : plain);
+  }
+  const gaps = coverageGaps(r.coverage);
+  if (gaps.length) out.push(c.yellow(cut(`  ${plural(gaps.length, "engine")} did not run cleanly; the results above are incomplete.`, W)));
+  const uncovered = uncoveredCategories(r.coverage);
+  if (uncovered.length) out.push(c.dim(cut(`  Not covered by any engine: ${uncovered.join(", ")}`, W)));
+  return `${out.join("\n")}
+`;
+}
+
+// src/core/report/index.ts
+var REPORT_FORMATS = ["text", "json", "markdown", "github", "sarif"];
+function render(format, input, opts = {}) {
+  switch (format) {
+    case "text":
+      return renderText(input, opts);
+    case "json":
+      return renderJson(input);
+    case "markdown":
+      return renderMarkdown(input);
+    case "github":
+      return renderGithub(input);
+    case "sarif":
+      return renderSarif(input);
+  }
+}
+
+// src/core/scanners/index.ts
+function builtinScanners(opts = {}) {
+  const { review: review2, skipAudit, ...deps } = opts;
+  return [secretsScanner, ...skipAudit ? [] : [dependencyScanner(deps)], ...review2 ? [review2] : []];
+}
+
+// src/core/scanners/types.ts
+async function runScanners(scanners, ctx) {
+  const started = Date.now();
+  const findings = [];
+  const coverage = [];
+  for (const s of scanners) {
+    ctx.signal?.throwIfAborted();
+    const t = Date.now();
+    try {
+      const out = await s.run(ctx);
+      for (const f of out.findings) findings.push(Finding.parse(f));
+      for (const c of out.coverage) coverage.push(Coverage.parse(c));
+    } catch (err) {
+      if (ctx.signal?.aborted) throw err;
+      coverage.push(Coverage.parse({ engine: s.id, category: s.category, status: "failed", reason: err.message.slice(0, 300), durationMs: Date.now() - t }));
+    }
+  }
+  return {
+    schemaVersion: 1,
+    scannedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    durationMs: Date.now() - started,
+    scope: { mode: ctx.mode, ...ctx.base ? { base: ctx.base } : {}, ...ctx.files ? { files: ctx.files.length } : {} },
+    findings: dedupeFindings(findings),
+    coverage
+  };
+}
+
+// src/services/scan.ts
+var SCAN_TARGETS = ["secrets", "deps", "review"];
+function parseTargets(raw) {
+  if (raw === void 0) return void 0;
+  const alias = { secret: "secrets", secrets: "secrets", dep: "deps", deps: "deps", dependencies: "deps", dependency: "deps", review: "review" };
+  const out = /* @__PURE__ */ new Set();
+  for (const part of raw.split(",").map((s) => s.trim().toLowerCase()).filter(Boolean)) {
+    const t = alias[part];
+    if (!t) throw new AthenaError(`Unknown scanner in --only: ${part}`, `Use a comma-separated list of: ${SCAN_TARGETS.join(", ")}`);
+    out.add(t);
+  }
+  if (!out.size) throw new AthenaError("--only needs at least one scanner", `Use a comma-separated list of: ${SCAN_TARGETS.join(", ")}`);
+  return [...out];
+}
+async function filesInScope(root, mode, base, signal) {
+  if (mode === "all") return void 0;
+  const hint = "Athena did not scan this change. Fix the Git problem and run the scan again.";
+  if (mode === "base") {
+    if (!base || !isSafeRef(base)) throw new AthenaError(`Invalid base ref: ${base ?? "(none)"}`);
+    const changes2 = await changesSince(root, base, { signal });
+    if (!changes2) throw new AthenaError(`Could not compute the changes since ${base}.`, `Check that the ref exists and that the clone has enough history (fetch-depth: 0 in CI). ${hint}`, EXIT.NOT_AVAILABLE);
+    return changes2.filter((c) => c.status !== "deleted").map((c) => c.path);
+  }
+  if (mode === "staged") {
+    const r = await git(root, ["diff", "--cached", "--name-only", "-z", "--relative", "--no-color", "--diff-filter=d"], { signal });
+    if (!r.ok) throw new AthenaError("Could not list staged files.", hint, EXIT.NOT_AVAILABLE);
+    return r.stdout.split("\0").filter(Boolean);
+  }
+  const changes = await workingChanges(root, { signal });
+  if (!changes) throw new AthenaError("Could not list changed files (is this a Git repository?).", hint, EXIT.NOT_AVAILABLE);
+  return changes.filter((c) => c.status !== "deleted").map((c) => c.path);
+}
+async function runScan(root, opts) {
+  const targets = new Set(opts.only ?? (opts.mode === "all" ? ["secrets", "deps"] : ["secrets", "deps", "review"]));
+  const { config } = await loadConfig(root);
+  const files = await filesInScope(root, opts.mode, opts.base, opts.signal);
+  const ctx = { root, config, mode: opts.mode, ...opts.base ? { base: opts.base } : {}, ...files ? { files } : {}, offline: opts.offline, signal: opts.signal };
+  const model = targets.has("deps") ? await projectSession(root).model() ?? (await analyzeProject(root, { signal: opts.signal })).model : void 0;
+  const scanners = builtinScanners({
+    review: targets.has("review") ? createReviewScanner() : void 0,
+    skipAudit: !targets.has("deps"),
+    model,
+    timeoutMs: opts.timeoutMs,
+    onTool: opts.onTool
+  }).filter((s) => targets.has("secrets") || s.category !== "secret");
+  const result = await runScanners(scanners, ctx);
+  if (targets.has("review") && opts.mode === "all") {
+    result.coverage = result.coverage.map((c) => c.category === "review" && c.status === "skipped" ? Coverage.parse({ ...c, reason: "review checks need a change: use --base <ref>, --staged or --changed" }) : c);
+  }
+  if (opts.save && opts.mode === "all") await saveFindings(root, result);
+  return result;
+}
+function reportInput(root, result, evaluated) {
+  if (!evaluated) return { result, root, toolVersion: ATHENA_VERSION };
+  const statuses = {};
+  for (const [fp, s] of Object.entries(evaluated.statuses)) statuses[fp] = s.status;
+  const ratings = {};
+  for (const r of evaluated.ratings) if (r.rating) ratings[r.category] = { grade: r.rating, basis: r.basis };
+  return {
+    result: { ...result, findings: evaluated.findings },
+    statuses,
+    notes: evaluated.notes,
+    gate: { passed: evaluated.gate.passed, reasons: [...evaluated.gate.reasons, ...evaluated.gate.warnings.map((w) => `warning: ${w}`)] },
+    ratings,
+    root,
+    toolVersion: ATHENA_VERSION
+  };
+}
+async function scanAndEvaluate(root, opts) {
+  const result = await runScan(root, opts);
+  const evaluated = await evaluateFindings(root, result, opts);
+  return { result, evaluated };
+}
+function findByPrefix(findings, prefix) {
+  const p = prefix.trim().toLowerCase();
+  if (!/^[a-f0-9]{6,32}$/.test(p)) throw new AthenaError(`Not a fingerprint: ${prefix}`, "Use at least 6 hex characters of a fingerprint from `athena findings list`.");
+  const hits = findings.filter((f) => f.fingerprint.startsWith(p));
+  if (!hits.length) throw new AthenaError(`No finding with fingerprint ${p} in the last scan.`, "Run `athena scan` and `athena findings list` to see current fingerprints.", EXIT.ERROR, "not-found");
+  if (hits.length > 1) throw new AthenaError(`Fingerprint prefix ${p} matches ${hits.length} findings.`, "Use more characters.");
+  return hits[0];
+}
+
+// src/cli/commands/scan.ts
+function scanMode(o) {
+  const picked = [o.base !== void 0, Boolean(o.staged), Boolean(o.changed)].filter(Boolean).length;
+  if (picked > 1) throw new AthenaError("Use only one of --base, --staged and --changed.");
+  return o.base !== void 0 ? "base" : o.staged ? "staged" : o.changed ? "changed" : "all";
+}
+function pick(flag, value, allowed) {
+  if (value === void 0) return void 0;
+  const v = value.toLowerCase();
+  if (!allowed.includes(v)) throw new AthenaError(`Invalid ${flag} value: ${value}`, `Use one of: ${allowed.join(", ")}`);
+  return v;
+}
+function printRules() {
+  const rules = listRules();
+  if (isJson()) return json(rules);
+  heading(`Athena rules (${rules.length})`);
+  for (const r of rules) line(`  ${r.id.padEnd(44)} ${dim(`${r.category}${r.potential ? ", potential" : ""}`)}  ${r.title}`);
+  line(dim("\nRun `athena explain <ruleId>` for details. External engines (later releases) bring their own rules."));
+}
+async function scanCommand(opts) {
+  if (opts.listRules) {
+    printRules();
+    return EXIT.OK;
+  }
+  const root = await requireProjectRoot(opts);
+  const mode = scanMode(opts);
+  const only = parseTargets(opts.only);
+  const format = pick("--format", opts.format ?? (isJson() ? "json" : "text"), REPORT_FORMATS);
+  const failOn = pick("--fail-on", opts.failOn === "moderate" ? "medium" : opts.failOn, GATE_SEVERITIES);
+  const minConfidence = pick("--min-confidence", opts.minConfidence, CONFIDENCES);
+  const unrated = pick("--unrated", opts.unrated, ["fail", "warn"]);
+  const interactive = format === "text" && !opts.output && !isJson();
+  const sp = interactive ? spinner("Scanning...") : null;
+  let scanned;
+  try {
+    scanned = await scanAndEvaluate(root, {
+      mode,
+      base: opts.base,
+      only,
+      offline: opts.offline,
+      signal: opts.signal,
+      onTool: (tool) => sp?.update(`Running ${tool}...`),
+      save: true,
+      noBaseline: opts.noBaseline,
+      policyFrom: opts.policyFrom,
+      gate: { failOn, minConfidence, unrated }
+    });
+    sp?.stop();
+  } catch (err) {
+    sp?.stop();
+    throw err;
+  }
+  const { result, evaluated } = scanned;
+  const report = render(format, reportInput(root, result, evaluated), { color: interactive ? void 0 : false });
+  if (opts.output) {
+    const out = path.resolve(opts.output);
+    await fs.mkdir(path.dirname(out), { recursive: true });
+    await writeFileAtomic(out, report.endsWith("\n") ? report : `${report}
+`);
+    if (!isJson()) {
+      const open = Object.values(evaluated.statuses).filter((s) => s.status === "open").length;
+      info(`${format} report written to ${path.relative(process.cwd(), out) || out}: ${open} open finding(s); gate ${evaluated.gate.passed ? "passed" : "failed"}`);
+    }
+  } else {
+    process.stdout.write(report.endsWith("\n") ? report : `${report}
+`);
+  }
+  if (!evaluated.gate.passed && !opts.noFail) {
+    process.stderr.write(`athena scan: quality gate failed: ${evaluated.gate.reasons.join("; ")}
+`);
+    return 1;
+  }
+  return EXIT.OK;
+}
+async function explainCommand(ruleId, opts) {
+  const r = ruleInfo(ruleId.trim().toLowerCase());
+  if (!r) throw new AthenaError(`Unknown rule: ${ruleId}`, "Run `athena scan --list-rules` for the rule ids Athena knows.", EXIT.ERROR, "not-found");
+  void opts;
+  if (isJson()) {
+    json(r);
+    return EXIT.OK;
+  }
+  heading(`${r.id}${r.potential ? dim('  (heuristic: findings are "potential")') : ""}`);
+  line(r.title);
+  line(dim(`Category: ${r.category}${r.cwe.length ? ` \xB7 ${r.cwe.join(", ")}` : ""}`));
+  line();
+  line(r.description);
+  line();
+  heading("What to do");
+  line(r.help);
+  if (r.helpUrl) line(dim(r.helpUrl));
+  line();
+  line(dim(`To accept a specific finding: \`athena findings triage <fingerprint> <status> --reason \u2026\` or an inline \`athena-ignore ${r.id} -- <reason>\` comment.`));
+  return EXIT.OK;
+}
+async function fullScan(root, opts) {
+  if (opts.last) {
+    const last = await loadFindings(root);
+    if (!last) throw new AthenaError("No previous scan found.", "Run `athena scan` first, or drop --last.");
+    if (last.scope.mode !== "all") throw new AthenaError("The last scan was not a full-project scan.", "Run `athena scan` (no --base/--staged/--changed) first.");
+    return last;
+  }
+  const sp = isJson() ? null : spinner("Scanning the whole project...");
+  try {
+    const r = await runScan(root, { mode: "all", offline: opts.offline, signal: opts.signal, save: true, onTool: (t) => sp?.update(`Running ${t}...`) });
+    sp?.stop();
+    return r;
+  } catch (err) {
+    sp?.stop();
+    throw err;
+  }
+}
+async function baselineCreateCommand(opts) {
+  const root = await requireProjectRoot(opts);
+  if (!opts.update && !opts.force && await loadBaseline(root)) {
+    throw new AthenaError(".athena/baseline.json already exists.", "Use `athena baseline update` to add new findings, or `--force` to add to it anyway.");
+  }
+  const result = await fullScan(root, opts);
+  const r = await baselineFindings(root, result, { reason: opts.reason });
+  if (isJson()) json({ added: r.added.length, total: r.total, created: r.created });
+  else {
+    ok(`${r.created ? "Created" : "Updated"} .athena/baseline.json: ${r.added.length} finding(s) added, ${r.total} in total`);
+    line(dim('  Commit it. Baselined findings stay visible but only new findings fail the gate (scope "new").'));
+    const broken = result.coverage.filter((c) => c.status === "failed" || c.status === "timeout");
+    if (broken.length) warn(`Not in the baseline because the engine did not complete: ${broken.map((c) => `${c.engine} (${c.status})`).join(", ")}`);
+  }
+  return EXIT.OK;
+}
+async function baselinePruneCommand(opts) {
+  const root = await requireProjectRoot(opts);
+  if (!await loadBaseline(root)) throw new AthenaError("No .athena/baseline.json to prune.", "Create one with `athena baseline create`.");
+  const result = await fullScan(root, opts);
+  const r = await pruneBaselineFile(root, result);
+  if (isJson()) json({ removed: r.removed.length, keptUnverified: r.keptUnverified.length, total: r.total });
+  else {
+    ok(`Removed ${r.removed.length} baseline entr${r.removed.length === 1 ? "y" : "ies"} the scan no longer reports; ${r.total} remain`);
+    if (r.keptUnverified.length) line(dim(`  Kept ${r.keptUnverified.length} entr${r.keptUnverified.length === 1 ? "y" : "ies"} whose engine did not run fully, so Athena can't tell whether they were fixed.`));
+  }
+  return EXIT.OK;
+}
+async function baselineShowCommand(opts) {
+  const root = await requireProjectRoot(opts);
+  const b = await loadBaseline(root);
+  if (isJson()) {
+    json(b ?? { entries: [] });
+    return EXIT.OK;
+  }
+  if (!b) {
+    line("No baseline (.athena/baseline.json). Every finding counts as new.");
+    return EXIT.OK;
+  }
+  heading(`Baseline: ${b.entries.length} entr${b.entries.length === 1 ? "y" : "ies"} (created ${relativeTime(b.createdAt)})`);
+  const byRule = /* @__PURE__ */ new Map();
+  for (const e of b.entries) byRule.set(e.ruleId, (byRule.get(e.ruleId) ?? 0) + 1);
+  for (const [rule, n] of [...byRule].sort((a, z) => z[1] - a[1])) line(`  ${String(n).padStart(4)}  ${rule}`);
+  return EXIT.OK;
+}
+async function lastEvaluated(root, signal) {
+  const result = await loadFindings(root);
+  if (!result) throw new AthenaError("No scan results yet.", "Run `athena scan` first.");
+  return { result, evaluated: await evaluateFindings(root, result, { signal }) };
+}
+var short = (fp) => fp.slice(0, 12);
+var where = (f) => f.location ? `${f.location.file}${f.location.startLine ? `:${f.location.startLine}` : ""}` : f.package ? `${f.package.name}${f.package.version ? `@${f.package.version}` : ""}` : "";
+async function findingsListCommand(opts) {
+  const root = await requireProjectRoot(opts);
+  const { result, evaluated } = await lastEvaluated(root, opts.signal);
+  const wantStatus = opts.status?.toLowerCase();
+  const rows = evaluated.findings.map((f) => ({ f, s: evaluated.statuses[f.fingerprint] })).filter(({ s }) => opts.all || wantStatus ? true : s.active).filter(({ s }) => !wantStatus || s.status === wantStatus || s.status.startsWith(`${wantStatus}:`) || s.triage === wantStatus).filter(({ f }) => !opts.severity || f.severity === opts.severity.toLowerCase()).filter(({ f }) => !opts.category || f.category === opts.category.toLowerCase());
+  if (isJson()) {
+    json({ scannedAt: result.scannedAt, scope: result.scope, findings: rows.map(({ f, s }) => ({ ...f, status: s.status, ...s.triage ? { triage: s.triage } : {} })) });
+    return EXIT.OK;
+  }
+  heading(`Findings from the scan ${relativeTime(result.scannedAt)} (${rows.length} shown)`);
+  for (const { f, s } of rows) {
+    const title = f.potential && !/^potential\b/i.test(f.title) ? `Potential ${f.title.charAt(0).toLowerCase()}${f.title.slice(1)}` : f.title;
+    line(`  ${dim(short(f.fingerprint))}  ${f.severity.padEnd(8)} ${title}  ${dim(where(f))}${s.status === "open" ? "" : dim(`  [${s.status}]`)}`);
+  }
+  if (!rows.length) line(dim("  None."));
+  if (!opts.all && !wantStatus) line(dim("\nShowing active findings. Use --all for baselined, suppressed, triaged and excluded ones too."));
+  return EXIT.OK;
+}
+async function findingsShowCommand(fp, opts) {
+  const root = await requireProjectRoot(opts);
+  const { evaluated } = await lastEvaluated(root, opts.signal);
+  const f = findByPrefix(evaluated.findings, fp);
+  const s = evaluated.statuses[f.fingerprint];
+  if (isJson()) {
+    json({ ...f, status: s.status, ...s.triage ? { triage: s.triage } : {}, ...s.reason ? { statusReason: s.reason } : {}, rule: ruleInfo(f.ruleId) ?? null });
+    return EXIT.OK;
+  }
+  heading(f.title);
+  line(dim(`${f.fingerprint} \xB7 ${f.ruleId} \xB7 ${f.category} \xB7 ${f.severity} \xB7 confidence ${f.confidence} \xB7 ${f.label}${f.potential ? " \xB7 potential" : ""}`));
+  if (where(f)) line(`Where: ${where(f)}`);
+  line(`Status: ${s.status}${s.triage === "to-review" ? " (triaged: to-review)" : ""}${s.reason ? dim(` \u2014 ${s.reason}`) : ""}`);
+  line(`Engine: ${f.engine.id}${f.alsoReportedBy.length ? ` (also: ${f.alsoReportedBy.join(", ")})` : ""}`);
+  if (f.cwe.length) line(`CWE: ${f.cwe.join(", ")}`);
+  if (f.package?.advisoryIds.length) line(`Advisories: ${f.package.advisoryIds.join(", ")}${f.package.fixedIn ? ` \xB7 fixed in ${f.package.fixedIn}` : ""}`);
+  line();
+  line(f.message);
+  const help = f.help?.text ?? ruleInfo(f.ruleId)?.help;
+  if (help) {
+    line();
+    line(dim(help));
+  }
+  return EXIT.OK;
+}
+async function findingsTriageCommand(fp, status, opts) {
+  const root = await requireProjectRoot(opts);
+  const { evaluated } = await lastEvaluated(root, opts.signal);
+  const f = findByPrefix(evaluated.findings, fp);
+  if (opts.clear || status === "clear") {
+    const removed = await untriageFinding(root, f.fingerprint);
+    if (isJson()) json({ fingerprint: f.fingerprint, removed });
+    else ok(removed ? `Removed the triage decision for ${short(f.fingerprint)}` : `${short(f.fingerprint)} had no triage decision`);
+    return EXIT.OK;
+  }
+  const st = pick("status", status, TRIAGE_STATUSES);
+  if (!opts.reason?.trim()) throw new AthenaError("A triage decision needs a reason.", 'Add --reason "<why>" (it is committed in .athena/triage.json for reviewers).');
+  await triageFinding(root, f.fingerprint, { status: st, reason: opts.reason.trim(), ...opts.by ? { by: opts.by } : {} });
+  if (isJson()) json({ fingerprint: f.fingerprint, status: st });
+  else {
+    ok(`${short(f.fingerprint)} (${f.ruleId}) triaged as ${st}`);
+    line(dim("  Recorded in .athena/triage.json \u2014 commit it so the decision is reviewed with the code."));
+  }
+  return EXIT.OK;
+}
+export {
+  baselineCreateCommand,
+  baselinePruneCommand,
+  baselineShowCommand,
+  explainCommand,
+  findingsListCommand,
+  findingsShowCommand,
+  findingsTriageCommand,
+  scanCommand
+};
+//# sourceMappingURL=scan-JVKCVHPD.js.map