project-athena 0.4.0 → 0.5.0

package/dist/{security-LME3XFL3.js → security-JTJN3E7K.js}

@@ -1,8 +1,11 @@
 #!/usr/bin/env node
 import {
-  runSecurityScan
-} from "./chunk-SJ4DQFIJ.js";
-import "./chunk-VSYBC3VY.js";
+  runSecurityScanWithFindings,
+  saveScan
+} from "./chunk-4IIBVTBS.js";
+import "./chunk-IDODPGTX.js";
+import "./chunk-UMWX4UTK.js";
+import "./chunk-Y6SDMZET.js";
 import {
   c,
   dim,
@@ -22,21 +25,20 @@ import {
 import "./chunk-KBO7XRBW.js";
 import {
   projectSession
-} from "./chunk-WVQC2EGO.js";
+} from "./chunk-GU3ZX2J7.js";
 import {
   RATED_SEVERITIES,
   SEVERITY_ORDER,
   analyzeProject,
   meetsThreshold,
-  saveScan,
   unratedFindings
-} from "./chunk-MPG3IEGB.js";
-import "./chunk-ELKFRTZT.js";
+} from "./chunk-44EGCEB2.js";
 import "./chunk-PVCIGUIT.js";
-import "./chunk-OLPSEQS5.js";
+import "./chunk-ELKFRTZT.js";
+import "./chunk-AKOI4VTD.js";
 import "./chunk-SVTEJYMS.js";
 import "./chunk-QCC4VJUH.js";
-import "./chunk-JCGDR4UV.js";
+import "./chunk-WWQ5NKEC.js";
 import "./chunk-2DY4PUR4.js";
 import "./chunk-IQQBAWSM.js";
 import {
@@ -125,7 +127,7 @@ async function securityCommand(opts) {
     try {
       model = await loadModel(root, opts.signal);
       sp.update("Scanning files for secrets...");
-      scan = await runSecurityScan(root, model, { signal: opts.signal, skipAudit: opts.noAudit, onTool: (tool) => sp.update(`Running ${tool}...`) });
+      scan = (await runSecurityScanWithFindings(root, model, { signal: opts.signal, skipAudit: opts.noAudit, onTool: (tool) => sp.update(`Running ${tool}...`) })).scan;
       sp.succeed(`Security scan finished in ${(scan.durationMs / 1e3).toFixed(1)}s`);
     } catch (err) {
       sp.stop();
@@ -174,4 +176,4 @@ export {
   printScan,
   securityCommand
 };
-//# sourceMappingURL=security-LME3XFL3.js.map
+//# sourceMappingURL=security-JTJN3E7K.js.map

package/dist/{staged-check-X24C3YRD.js → staged-check-PQSLGQBW.js}

@@ -1,33 +1,33 @@
 #!/usr/bin/env node
 import {
   HISTORY_SECTIONS
-} from "./chunk-KHMBNT66.js";
-import "./chunk-WVQC2EGO.js";
+} from "./chunk-PZPMWCXS.js";
+import "./chunk-GU3ZX2J7.js";
 import "./chunk-GR4DL2VM.js";
 import {
   planKnowledge
-} from "./chunk-GGXPG6OE.js";
+} from "./chunk-4FETKOY3.js";
+import "./chunk-2R6PXY6Z.js";
 import {
   REAL_ENV_NAMES,
   SCAN_FILE,
   analyzeProject,
   redactDeep
-} from "./chunk-MPG3IEGB.js";
-import {
-  mapLimit
-} from "./chunk-ELKFRTZT.js";
-import "./chunk-2R6PXY6Z.js";
+} from "./chunk-44EGCEB2.js";
 import {
   readLocalConfig
 } from "./chunk-PVCIGUIT.js";
+import {
+  mapLimit
+} from "./chunk-ELKFRTZT.js";
 import {
   git,
   gitInfo,
   isGitRepo
-} from "./chunk-OLPSEQS5.js";
+} from "./chunk-AKOI4VTD.js";
 import "./chunk-SVTEJYMS.js";
 import "./chunk-QCC4VJUH.js";
-import "./chunk-JCGDR4UV.js";
+import "./chunk-WWQ5NKEC.js";
 import "./chunk-YRIS7ZS6.js";
 import "./chunk-GHFRQAYT.js";
 import "./chunk-INT3IGMQ.js";
@@ -499,4 +499,4 @@ async function checkStaged(rootInput, opts = {}) {
 export {
   checkStaged
 };
-//# sourceMappingURL=staged-check-X24C3YRD.js.map
+//# sourceMappingURL=staged-check-PQSLGQBW.js.map

package/dist/{status-RR57ZNGI.js → status-PO27BSOZ.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   buildStatus
-} from "./chunk-ZB7LC6FP.js";
+} from "./chunk-3KFOI2X4.js";
 import {
   bullet,
   c,
@@ -20,7 +20,7 @@ import {
 import "./chunk-KBO7XRBW.js";
 import "./chunk-GR4DL2VM.js";
 import "./chunk-ELKFRTZT.js";
-import "./chunk-OLPSEQS5.js";
+import "./chunk-AKOI4VTD.js";
 import "./chunk-673EPYYH.js";
 import "./chunk-FQEGEVLY.js";
 import "./chunk-2DY4PUR4.js";
@@ -33,7 +33,7 @@ import "./chunk-EUPETUWA.js";
 async function statusCommand(opts) {
   const root = await requireProjectRoot(opts);
   const report = await buildStatus(root, opts.signal);
-  const memory = await (await import("./memory-VSVNLEJC.js")).memorySummary(root);
+  const memory = await (await import("./memory-XBZCYQLW.js")).memorySummary(root);
   if (isJson()) {
     json(memory ? { ...report, memory: { total: memory.total, unreviewed: memory.unreviewed, stale: memory.stale } } : report);
     return;
@@ -78,4 +78,4 @@ async function statusCommand(opts) {
 export {
   statusCommand
 };
-//# sourceMappingURL=status-RR57ZNGI.js.map
+//# sourceMappingURL=status-PO27BSOZ.js.map

package/dist/{sync-KFJANRXF.js → sync-GVO2VHPI.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   confirm
-} from "./chunk-7DZK6WSQ.js";
+} from "./chunk-DH5AGULY.js";
 import {
   bullet,
   c,
@@ -28,18 +28,18 @@ import {
   planSync,
   staleForCheck,
   summarizePlan
-} from "./chunk-KHMBNT66.js";
-import "./chunk-WVQC2EGO.js";
+} from "./chunk-PZPMWCXS.js";
+import "./chunk-GU3ZX2J7.js";
 import "./chunk-GR4DL2VM.js";
-import "./chunk-GGXPG6OE.js";
-import "./chunk-MPG3IEGB.js";
-import "./chunk-ELKFRTZT.js";
+import "./chunk-4FETKOY3.js";
 import "./chunk-2R6PXY6Z.js";
+import "./chunk-44EGCEB2.js";
 import "./chunk-PVCIGUIT.js";
-import "./chunk-OLPSEQS5.js";
+import "./chunk-ELKFRTZT.js";
+import "./chunk-AKOI4VTD.js";
 import "./chunk-SVTEJYMS.js";
 import "./chunk-QCC4VJUH.js";
-import "./chunk-JCGDR4UV.js";
+import "./chunk-WWQ5NKEC.js";
 import "./chunk-YRIS7ZS6.js";
 import "./chunk-GHFRQAYT.js";
 import "./chunk-INT3IGMQ.js";
@@ -183,7 +183,7 @@ async function syncCommand(opts) {
   return EXIT.OK;
 }
 async function stagedCheckCommand(root, opts) {
-  const { checkStaged } = await import("./staged-check-X24C3YRD.js");
+  const { checkStaged } = await import("./staged-check-PQSLGQBW.js");
   const sp = spinner("Checking staged knowledge...");
   let r;
   try {
@@ -215,4 +215,4 @@ export {
   printPlan,
   syncCommand
 };
-//# sourceMappingURL=sync-KFJANRXF.js.map
+//# sourceMappingURL=sync-GVO2VHPI.js.map

package/dist/{watch-CY7QHIYN.js → watch-TEHFO47V.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import {
   watchProject
-} from "./chunk-DZDI2HRT.js";
-import "./chunk-RVTNSNGK.js";
+} from "./chunk-6OSQMXUP.js";
+import "./chunk-X7EYOAEX.js";
 import {
   c,
   dim,
@@ -15,18 +15,18 @@ import {
   requireProjectRoot
 } from "./chunk-XFN7UZCS.js";
 import "./chunk-KBO7XRBW.js";
-import "./chunk-KHMBNT66.js";
-import "./chunk-WVQC2EGO.js";
+import "./chunk-PZPMWCXS.js";
+import "./chunk-GU3ZX2J7.js";
 import "./chunk-GR4DL2VM.js";
-import "./chunk-GGXPG6OE.js";
-import "./chunk-MPG3IEGB.js";
-import "./chunk-ELKFRTZT.js";
+import "./chunk-4FETKOY3.js";
 import "./chunk-2R6PXY6Z.js";
+import "./chunk-44EGCEB2.js";
 import "./chunk-PVCIGUIT.js";
-import "./chunk-OLPSEQS5.js";
+import "./chunk-ELKFRTZT.js";
+import "./chunk-AKOI4VTD.js";
 import "./chunk-SVTEJYMS.js";
 import "./chunk-QCC4VJUH.js";
-import "./chunk-JCGDR4UV.js";
+import "./chunk-WWQ5NKEC.js";
 import "./chunk-YRIS7ZS6.js";
 import "./chunk-GHFRQAYT.js";
 import "./chunk-INT3IGMQ.js";
@@ -120,4 +120,4 @@ async function watchCommand(opts) {
 export {
   watchCommand
 };
-//# sourceMappingURL=watch-CY7QHIYN.js.map
+//# sourceMappingURL=watch-TEHFO47V.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "project-athena",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Athena — local-first project intelligence layer for AI coding agents",
   "author": "Sabarivasan",
   "license": "MIT",
@@ -68,6 +68,8 @@
     "@types/react": "^19.3.0",
     "@types/react-dom": "^19.3.0",
     "@vitejs/plugin-react": "^6.1.1",
+    "ajv": "^8.20.0",
+    "ajv-formats": "^3.0.1",
     "codemirror": "^6.0.2",
     "dompurify": "^3.4.15",
     "jsdom": "^30.1.0",

package/dist/chunk-SJ4DQFIJ.js

@@ -1,379 +0,0 @@
-#!/usr/bin/env node
-import {
-  whichExecutable
-} from "./chunk-VSYBC3VY.js";
-import {
-  scanFilesForSecrets,
-  secretFingerprinter
-} from "./chunk-MPG3IEGB.js";
-import {
-  walkProject
-} from "./chunk-ELKFRTZT.js";
-import {
-  loadConfig
-} from "./chunk-2DY4PUR4.js";
-
-// src/services/security.ts
-import { execFile } from "child_process";
-import { promises as fs } from "fs";
-import path from "path";
-var AuditToolError = class extends Error {
-};
-var asRecord = (v) => v && typeof v === "object" && !Array.isArray(v) ? v : {};
-var isObject = (v) => Boolean(v) && typeof v === "object" && !Array.isArray(v);
-var sev = (s) => {
-  const v = String(s ?? "").toLowerCase();
-  if (v === "critical") return "critical";
-  if (v === "high") return "high";
-  if (v === "moderate" || v === "medium") return "moderate";
-  if (v === "low" || v === "info") return "low";
-  return "unrated";
-};
-function parseJsonObject(stdout, tool) {
-  const text = stdout.trim();
-  if (!text) throw new AuditToolError(`${tool} produced no output`);
-  const json = JSON.parse(text);
-  if (!isObject(json)) throw new AuditToolError(`${tool} produced unexpected output`);
-  return json;
-}
-function throwIfToolError(json, tool) {
-  if (json.error === void 0) return;
-  const e = asRecord(json.error);
-  const parts = [e.code, e.summary ?? e.message].filter((x) => typeof x === "string" && x.trim());
-  const text = parts.length ? parts.join(": ") : typeof json.error === "string" ? json.error : "unknown error";
-  throw new AuditToolError(`${tool} reported an error: ${text.split("\n")[0].slice(0, 200)}`);
-}
-function parseAdvisories(advisories) {
-  const out = [];
-  for (const [key, raw] of Object.entries(advisories)) {
-    const a = asRecord(raw);
-    const versions = [...new Set((Array.isArray(a.findings) ? a.findings : []).map((f) => asRecord(f).version).filter((v) => typeof v === "string"))];
-    const patched = typeof a.patched_versions === "string" ? a.patched_versions.trim() : "";
-    out.push({
-      package: String(a.module_name ?? "unknown"),
-      severity: sev(a.severity),
-      title: String(a.title ?? `Vulnerable dependency: ${String(a.module_name ?? key)}`),
-      id: typeof a.github_advisory_id === "string" ? a.github_advisory_id : Array.isArray(a.cves) && typeof a.cves[0] === "string" ? a.cves[0] : String(a.id ?? key),
-      url: typeof a.url === "string" ? a.url : void 0,
-      vulnerableRange: typeof a.vulnerable_versions === "string" ? a.vulnerable_versions + (versions.length ? ` (installed ${versions.join(", ")})` : "") : void 0,
-      fixAvailable: Boolean(patched) && patched !== "<0.0.0"
-    });
-  }
-  return out;
-}
-function parseNpmAudit(stdout) {
-  const json = parseJsonObject(stdout, "npm audit");
-  throwIfToolError(json, "npm audit");
-  if (!isObject(json.vulnerabilities)) {
-    if (isObject(json.advisories)) return parseAdvisories(json.advisories);
-    throw new AuditToolError('npm audit output has no "vulnerabilities" report');
-  }
-  const out = [];
-  for (const [name, raw] of Object.entries(json.vulnerabilities)) {
-    const v = asRecord(raw);
-    const via = Array.isArray(v.via) ? v.via : [];
-    const advisory = via.find((x) => x && typeof x === "object");
-    const viaNames = via.filter((x) => typeof x === "string");
-    out.push({
-      package: name,
-      severity: sev(v.severity),
-      title: String(advisory?.title ?? (viaNames.length ? `Depends on vulnerable ${viaNames.join(", ")}` : `Vulnerable dependency: ${name}`)),
-      id: advisory?.source !== void 0 ? String(advisory.source) : void 0,
-      url: typeof advisory?.url === "string" ? advisory.url : void 0,
-      vulnerableRange: typeof v.range === "string" ? v.range : void 0,
-      fixAvailable: Boolean(v.fixAvailable)
-    });
-  }
-  return out;
-}
-function parsePnpmAudit(stdout) {
-  const json = parseJsonObject(stdout, "pnpm audit");
-  throwIfToolError(json, "pnpm audit");
-  if (!isObject(json.advisories)) throw new AuditToolError('pnpm audit output has no "advisories" report');
-  return parseAdvisories(json.advisories);
-}
-function parsePipAudit(stdout) {
-  const text = stdout.trim();
-  if (!text) throw new AuditToolError("pip-audit produced no output");
-  const json = JSON.parse(text);
-  const deps = isObject(json) && Array.isArray(json.dependencies) ? json.dependencies : Array.isArray(json) ? json : null;
-  if (!deps) throw new AuditToolError('pip-audit output has no "dependencies" list');
-  const out = [];
-  for (const raw of deps) {
-    const d = asRecord(raw);
-    for (const vRaw of Array.isArray(d.vulns) ? d.vulns : []) {
-      const v = asRecord(vRaw);
-      const aliases = Array.isArray(v.aliases) ? v.aliases.filter((a) => typeof a === "string") : [];
-      const id = typeof v.id === "string" ? v.id : void 0;
-      out.push({
-        package: String(d.name ?? "unknown"),
-        severity: "unrated",
-        // pip-audit does not report severity
-        title: String(v.description ?? id ?? "Known vulnerability").split("\n")[0].slice(0, 300),
-        id: id ?? aliases[0],
-        url: id ? `https://osv.dev/vulnerability/${id}` : void 0,
-        vulnerableRange: typeof d.version === "string" ? `installed ${d.version}` : void 0,
-        fixAvailable: Array.isArray(v.fix_versions) && v.fix_versions.length > 0
-      });
-    }
-  }
-  return out;
-}
-function splitJsonStream(text) {
-  const out = [];
-  let depth = 0;
-  let inString = false;
-  let escaped = false;
-  let start = -1;
-  for (let i = 0; i < text.length; i++) {
-    const ch = text[i];
-    if (inString) {
-      if (escaped) escaped = false;
-      else if (ch === "\\") escaped = true;
-      else if (ch === '"') inString = false;
-      continue;
-    }
-    if (ch === '"') {
-      if (depth > 0) inString = true;
-    } else if (ch === "{") {
-      if (depth === 0) start = i;
-      depth++;
-    } else if (ch === "}" && depth > 0) {
-      depth--;
-      if (depth === 0) {
-        out.push(JSON.parse(text.slice(start, i + 1)));
-        start = -1;
-      }
-    }
-  }
-  if (depth !== 0) throw new AuditToolError("truncated JSON output");
-  return out;
-}
-var REACH_RANK = { required: 0, imported: 1, called: 2 };
-function parseGovulncheck(stdout) {
-  const messages = splitJsonStream(stdout).map(asRecord);
-  if (!messages.some((m) => isObject(m.config))) throw new AuditToolError("govulncheck produced no JSON report");
-  const osvs = /* @__PURE__ */ new Map();
-  for (const m of messages) {
-    const osv = asRecord(m.osv);
-    if (typeof osv.id === "string") osvs.set(osv.id, osv);
-  }
-  const found = /* @__PURE__ */ new Map();
-  for (const m of messages) {
-    const f = asRecord(m.finding);
-    if (typeof f.osv !== "string") continue;
-    const trace = (Array.isArray(f.trace) ? f.trace : []).map(asRecord);
-    const reach = trace.some((t) => typeof t.function === "string") ? "called" : trace.some((t) => typeof t.package === "string") ? "imported" : "required";
-    const first = trace[0] ?? {};
-    const prev = found.get(f.osv);
-    if (prev && REACH_RANK[prev.reach] >= REACH_RANK[reach]) continue;
-    found.set(f.osv, {
-      module: typeof first.module === "string" ? first.module : prev?.module,
-      version: typeof first.version === "string" ? first.version : prev?.version,
-      fixed: typeof f.fixed_version === "string" ? f.fixed_version : prev?.fixed,
-      reach
-    });
-  }
-  const label = { called: "called by your code", imported: "package imported, vulnerable symbol not called", required: "module required, package not imported" };
-  return [...found].map(([id, f]) => {
-    const osv = osvs.get(id) ?? {};
-    const affected = Array.isArray(osv.affected) ? asRecord(osv.affected[0]) : {};
-    return {
-      package: f.module ?? String(asRecord(affected.package).name ?? "unknown"),
-      severity: "unrated",
-      // the Go vulnerability database does not assign severities
-      title: `${String(osv.summary ?? id)} (${label[f.reach]})`,
-      id,
-      url: `https://pkg.go.dev/vuln/${id}`,
-      vulnerableRange: f.version ? `installed ${f.version}` : void 0,
-      fixAvailable: Boolean(f.fixed)
-    };
-  });
-}
-function parseCargoAudit(stdout) {
-  const json = parseJsonObject(stdout, "cargo audit");
-  if (!isObject(json.vulnerabilities)) throw new AuditToolError('cargo audit output has no "vulnerabilities" report');
-  const list = Array.isArray(json.vulnerabilities.list) ? json.vulnerabilities.list : [];
-  return list.map((raw) => {
-    const v = asRecord(raw);
-    const advisory = asRecord(v.advisory);
-    const pkg = asRecord(v.package);
-    return {
-      package: String(pkg.name ?? "unknown"),
-      severity: sev(asRecord(advisory.cvss).severity ?? advisory.severity),
-      title: String(advisory.title ?? "Known vulnerability"),
-      id: typeof advisory.id === "string" ? advisory.id : void 0,
-      url: typeof advisory.url === "string" ? advisory.url : void 0
-    };
-  });
-}
-function parseComposerAudit(stdout) {
-  const json = parseJsonObject(stdout, "composer audit");
-  if (json.advisories === void 0) throw new AuditToolError('composer audit output has no "advisories" report');
-  const advisories = asRecord(json.advisories);
-  const out = [];
-  for (const [pkg, raw] of Object.entries(advisories)) {
-    for (const aRaw of Array.isArray(raw) ? raw : Object.values(asRecord(raw))) {
-      const a = asRecord(aRaw);
-      out.push({
-        package: pkg,
-        severity: sev(a.severity),
-        title: String(a.title ?? "Known vulnerability"),
-        id: typeof a.cve === "string" ? a.cve : typeof a.advisoryId === "string" ? a.advisoryId : void 0,
-        url: typeof a.link === "string" ? a.link : void 0,
-        vulnerableRange: typeof a.affectedVersions === "string" ? a.affectedVersions : void 0
-      });
-    }
-  }
-  return out;
-}
-var MAX_PIP_TARGETS = 10;
-var REQUIREMENTS_FILE = /(^|\/)requirements[\w.-]*\.txt$/i;
-async function planPipAudit(ctx) {
-  const common = ["--format", "json", "--progress-spinner", "off"];
-  const reqs = ctx.files.filter((f) => REQUIREMENTS_FILE.test(f)).sort();
-  const reqDirs = new Set(reqs.map((f) => path.posix.dirname(f)));
-  const out = reqs.map((f) => ({ target: f, args: ["-r", f, ...common] }));
-  for (const f of ctx.files.filter((x) => x === "pyproject.toml" || x.endsWith("/pyproject.toml")).sort()) {
-    const dir = path.posix.dirname(f);
-    if (reqDirs.has(dir)) continue;
-    const text = await fs.readFile(path.join(ctx.root, f), "utf8").catch(() => "");
-    if (!/^\s*\[project\]\s*$/m.test(text)) continue;
-    out.push({ target: f, args: [...common, dir === "." ? "." : `./${dir}`] });
-  }
-  if (!out.length) return "no requirements file to audit (pip-audit needs requirements*.txt or a PEP 621 pyproject.toml; the active Python environment is never audited)";
-  return out.slice(0, MAX_PIP_TARGETS);
-}
-var single = (args) => async () => [{ args }];
-var RUNNERS = [
-  {
-    tool: "npm audit",
-    ecosystem: "npm",
-    command: "npm",
-    applies: (_m, has) => has("package-lock.json") || has("npm-shrinkwrap.json"),
-    plan: single(["audit", "--json", "--audit-level=low"]),
-    parse: parseNpmAudit
-  },
-  {
-    tool: "pnpm audit",
-    ecosystem: "npm",
-    command: "pnpm",
-    applies: (_m, has) => has("pnpm-lock.yaml"),
-    plan: single(["audit", "--json"]),
-    parse: parsePnpmAudit
-  },
-  {
-    tool: "pip-audit",
-    ecosystem: "python",
-    command: "pip-audit",
-    applies: (m, _has, ctx) => m.manifests.some((x) => x.ecosystem === "python") || ctx.files.some((f) => REQUIREMENTS_FILE.test(f)),
-    plan: planPipAudit,
-    parse: parsePipAudit
-  },
-  {
-    tool: "govulncheck",
-    ecosystem: "go",
-    command: "govulncheck",
-    applies: (_m, has) => has("go.mod"),
-    plan: single(["-format=json", "./..."]),
-    parse: parseGovulncheck
-  },
-  {
-    tool: "cargo audit",
-    ecosystem: "cargo",
-    command: "cargo",
-    applies: (_m, has) => has("Cargo.lock"),
-    plan: single(["audit", "--json"]),
-    parse: parseCargoAudit
-  },
-  {
-    tool: "composer audit",
-    ecosystem: "composer",
-    command: "composer",
-    applies: (_m, has) => has("composer.lock"),
-    plan: single(["audit", "--format=json"]),
-    parse: parseComposerAudit
-  }
-];
-function run(command, args, cwd, timeoutMs) {
-  return new Promise((resolve) => {
-    execFile(command, args, { cwd, timeout: timeoutMs, maxBuffer: 32 * 1024 * 1024, windowsHide: true, env: { ...process.env, NO_COLOR: "1", npm_config_color: "false" } }, (error, stdout, stderr) => {
-      const timedOut = Boolean(error && (error.code === "ETIMEDOUT" || error.killed));
-      resolve({ stdout: String(stdout ?? ""), stderr: String(stderr ?? ""), timedOut, error: error ?? null });
-    });
-  });
-}
-async function runTool(runner, inv, root, timeoutMs) {
-  const t = Date.now();
-  const base = { tool: runner.tool, ecosystem: runner.ecosystem, ...inv.target ? { target: inv.target } : {} };
-  const r = await run(runner.command, inv.args, root, timeoutMs);
-  if (r.timedOut) return { ...base, status: "timeout", message: `Timed out after ${timeoutMs / 1e3}s`, durationMs: Date.now() - t, findings: [] };
-  try {
-    const findings = runner.parse(r.stdout, r.stderr);
-    return { ...base, status: "ok", durationMs: Date.now() - t, findings };
-  } catch (err) {
-    const reason = err instanceof AuditToolError ? err.message : `Could not parse output: ${r.stderr.trim().split("\n")[0] || r.error?.message || err.message || "unreadable output"}`;
-    return { ...base, status: "failed", message: reason.slice(0, 300), durationMs: Date.now() - t, findings: [] };
-  }
-}
-async function runSecurityScan(root, model, opts = {}) {
-  const started = Date.now();
-  const timeoutMs = opts.timeoutMs ?? 12e4;
-  const { config } = await loadConfig(root);
-  const walk = await walkProject(root, { config, signal: opts.signal });
-  const ctx = { root, files: walk.files.map((f) => f.path) };
-  const files = new Set(model.manifests.map((m) => m.path));
-  for (const pm of model.packageManagers) for (const e of pm.provenance.evidence) files.add(e.file);
-  for (const f of ctx.files) files.add(f);
-  const has = (file) => files.has(file);
-  const tools = [];
-  if (!opts.skipAudit) {
-    for (const runner of RUNNERS) {
-      if (!runner.applies(model, has, ctx)) continue;
-      opts.signal?.throwIfAborted();
-      const t = Date.now();
-      opts.onTool?.(runner.tool);
-      const bin = await whichExecutable(runner.command);
-      if (!bin) {
-        tools.push({ tool: runner.tool, ecosystem: runner.ecosystem, status: "unavailable", message: `${runner.command} is not installed or not on PATH`, durationMs: Date.now() - t, findings: [] });
-        continue;
-      }
-      const plan = await runner.plan(ctx);
-      if (typeof plan === "string") {
-        tools.push({ tool: runner.tool, ecosystem: runner.ecosystem, status: "unavailable", message: plan, durationMs: Date.now() - t, findings: [] });
-        continue;
-      }
-      for (const inv of plan) {
-        opts.signal?.throwIfAborted();
-        tools.push(await runTool(runner, inv, root, timeoutMs));
-      }
-    }
-  }
-  const counts = { critical: 0, high: 0, moderate: 0, low: 0, unrated: 0 };
-  for (const t of tools) for (const f of t.findings) counts[f.severity]++;
-  const secrets = await scanProjectSecrets(root, walk.files, opts.signal);
-  const scan = {
-    schemaVersion: 1,
-    scannedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    durationMs: Date.now() - started,
-    tools,
-    counts,
-    secrets: {
-      count: secrets.findings.length,
-      files: [...new Set(secrets.findings.map((s) => s.file))].slice(0, 50),
-      skippedLongLines: secrets.skippedLongLines,
-      ...secrets.truncated ? { truncated: true } : {}
-    }
-  };
-  return scan;
-}
-async function scanProjectSecrets(root, files, signal) {
-  const fingerprint = await secretFingerprinter(root);
-  const read = async (rel) => fs.readFile(path.join(root, rel), "utf8").catch(() => null);
-  return scanFilesForSecrets(files, read, { fingerprint, signal });
-}
-
-export {
-  runSecurityScan
-};
-//# sourceMappingURL=chunk-SJ4DQFIJ.js.map