trawly 0.0.1

package/dist/index.js

@@ -0,0 +1,393 @@
+// src/scanner.ts
+import { existsSync, statSync } from "fs";
+import { resolve as resolve2, join } from "path";
+
+// src/extractors/npm-package-lock.ts
+import { readFileSync } from "fs";
+import { resolve } from "path";
+function parseNpmPackageLock(filePath) {
+  const absolute = resolve(filePath);
+  const raw = readFileSync(absolute, "utf8");
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new Error(
+      `Failed to parse ${absolute}: ${err.message}`
+    );
+  }
+  if (parsed.lockfileVersion !== 2 && parsed.lockfileVersion !== 3) {
+    throw new Error(
+      `Unsupported npm lockfileVersion ${String(
+        parsed.lockfileVersion
+      )} in ${absolute}. Only v2 and v3 are supported.`
+    );
+  }
+  const packages = parsed.packages;
+  if (!packages || typeof packages !== "object") {
+    throw new Error(
+      `Lockfile ${absolute} has no "packages" map; cannot extract installed versions.`
+    );
+  }
+  const directDeps = collectDirectDependencyNames(packages[""] ?? {});
+  const instances = [];
+  for (const [path, entry] of Object.entries(packages)) {
+    if (path === "") continue;
+    if (entry.link) continue;
+    const name = packagePathToName(path);
+    if (!name) continue;
+    if (!entry.version) continue;
+    instances.push({
+      name,
+      version: entry.version,
+      ecosystem: "npm",
+      path,
+      direct: directDeps.has(name) && isTopLevelInstance(path),
+      dev: Boolean(entry.dev || entry.devOptional),
+      optional: Boolean(entry.optional || entry.devOptional),
+      resolved: entry.resolved,
+      integrity: entry.integrity
+    });
+  }
+  return instances;
+}
+function collectDirectDependencyNames(rootEntry) {
+  const names = /* @__PURE__ */ new Set();
+  for (const key of [
+    "dependencies",
+    "devDependencies",
+    "optionalDependencies",
+    "peerDependencies"
+  ]) {
+    const block = rootEntry[key];
+    if (!block) continue;
+    for (const name of Object.keys(block)) names.add(name);
+  }
+  return names;
+}
+function packagePathToName(path) {
+  const marker = "node_modules/";
+  const idx = path.lastIndexOf(marker);
+  if (idx === -1) return null;
+  const tail = path.slice(idx + marker.length);
+  if (!tail) return null;
+  if (tail.startsWith("@")) {
+    const firstSlash = tail.indexOf("/");
+    if (firstSlash === -1) return null;
+    const secondSlash = tail.indexOf("/", firstSlash + 1);
+    return secondSlash === -1 ? tail : tail.slice(0, secondSlash);
+  }
+  const next = tail.indexOf("/");
+  return next === -1 ? tail : tail.slice(0, next);
+}
+function isTopLevelInstance(path) {
+  const first = path.indexOf("node_modules/");
+  if (first === -1) return false;
+  return path.indexOf("node_modules/", first + 1) === -1;
+}
+
+// src/sources/osv.ts
+var OSV_QUERYBATCH_URL = "https://api.osv.dev/v1/querybatch";
+var OSV_VULN_URL = "https://api.osv.dev/v1/vulns";
+var QUERY_CHUNK_SIZE = 500;
+var REQUEST_TIMEOUT_MS = 15e3;
+var MAX_RETRIES = 2;
+function dedupeForQuery(packages) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const pkg of packages) {
+    const key = `${pkg.name}@${pkg.version}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push({ name: pkg.name, version: pkg.version });
+  }
+  return out;
+}
+async function queryOsv(packages, deps = {}) {
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  const unique = dedupeForQuery(packages);
+  if (unique.length === 0) return [];
+  const idsByPackage = /* @__PURE__ */ new Map();
+  for (const chunk of chunked(unique, QUERY_CHUNK_SIZE)) {
+    const body = {
+      queries: chunk.map((q) => ({
+        package: { ecosystem: "npm", name: q.name },
+        version: q.version
+      }))
+    };
+    const res = await postJson(
+      fetchImpl,
+      OSV_QUERYBATCH_URL,
+      body
+    );
+    res.results.forEach((result, i) => {
+      const q = chunk[i];
+      if (!q) return;
+      const key = `${q.name}@${q.version}`;
+      if (!result.vulns || result.vulns.length === 0) return;
+      const ids = idsByPackage.get(key) ?? /* @__PURE__ */ new Set();
+      for (const v of result.vulns) ids.add(v.id);
+      idsByPackage.set(key, ids);
+    });
+  }
+  const allIds = /* @__PURE__ */ new Set();
+  for (const ids of idsByPackage.values()) {
+    for (const id of ids) allIds.add(id);
+  }
+  const detailsById = /* @__PURE__ */ new Map();
+  for (const id of allIds) {
+    try {
+      const detail = await getJson(
+        fetchImpl,
+        `${OSV_VULN_URL}/${encodeURIComponent(id)}`
+      );
+      detailsById.set(id, detail);
+    } catch {
+    }
+  }
+  const findings = [];
+  for (const pkg of packages) {
+    const key = `${pkg.name}@${pkg.version}`;
+    const ids = idsByPackage.get(key);
+    if (!ids) continue;
+    for (const id of ids) {
+      const detail = detailsById.get(id);
+      findings.push(buildFinding(pkg, id, detail));
+    }
+  }
+  return findings;
+}
+function buildFinding(pkg, id, detail) {
+  const severity = detail ? parseSeverity(detail) : "unknown";
+  const summary = detail?.summary ?? detail?.details ?? id;
+  return {
+    id,
+    source: "osv",
+    type: "vulnerability",
+    severity,
+    packageName: pkg.name,
+    installedVersion: pkg.version,
+    summary: truncate(summary, 240),
+    url: pickAdvisoryUrl(detail) ?? `https://osv.dev/vulnerability/${id}`,
+    fixedVersions: detail ? collectFixedVersions(detail, pkg.name) : [],
+    affectedPaths: [pkg.path]
+  };
+}
+function parseSeverity(detail) {
+  const dbSpecific = detail.database_specific?.severity?.toLowerCase();
+  if (dbSpecific === "critical" || dbSpecific === "high" || dbSpecific === "moderate" || dbSpecific === "low") {
+    return dbSpecific;
+  }
+  if (dbSpecific === "medium") return "moderate";
+  const cvss = detail.severity?.find((s) => s.type?.startsWith("CVSS_"));
+  if (cvss) {
+    const score = parseCvssScore(cvss.score);
+    if (score === void 0) return "unknown";
+    if (score >= 9) return "critical";
+    if (score >= 7) return "high";
+    if (score >= 4) return "moderate";
+    if (score > 0) return "low";
+  }
+  return "unknown";
+}
+function parseCvssScore(vector) {
+  const direct = Number.parseFloat(vector);
+  if (!Number.isNaN(direct) && vector.trim() !== "") return direct;
+  return void 0;
+}
+function pickAdvisoryUrl(detail) {
+  if (!detail?.references) return void 0;
+  const advisory = detail.references.find((r) => r.type === "ADVISORY");
+  return advisory?.url ?? detail.references[0]?.url;
+}
+function collectFixedVersions(detail, packageName) {
+  const out = /* @__PURE__ */ new Set();
+  for (const aff of detail.affected ?? []) {
+    if (aff.package?.name && aff.package.name !== packageName) continue;
+    for (const range of aff.ranges ?? []) {
+      for (const event of range.events ?? []) {
+        if (event.fixed) out.add(event.fixed);
+      }
+    }
+  }
+  return [...out];
+}
+function* chunked(items, size) {
+  for (let i = 0; i < items.length; i += size) {
+    yield items.slice(i, i + size);
+  }
+}
+async function postJson(fetchImpl, url, body) {
+  return withRetry(async () => {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+    try {
+      const res = await fetchImpl(url, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(body),
+        signal: controller.signal
+      });
+      if (!res.ok) {
+        throw new HttpError(`OSV ${res.status}: ${res.statusText}`, res.status);
+      }
+      return await res.json();
+    } finally {
+      clearTimeout(timer);
+    }
+  });
+}
+async function getJson(fetchImpl, url) {
+  return withRetry(async () => {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+    try {
+      const res = await fetchImpl(url, { signal: controller.signal });
+      if (!res.ok) {
+        throw new HttpError(`OSV ${res.status}: ${res.statusText}`, res.status);
+      }
+      return await res.json();
+    } finally {
+      clearTimeout(timer);
+    }
+  });
+}
+var HttpError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+  }
+  status;
+};
+async function withRetry(fn) {
+  let lastErr;
+  for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
+    try {
+      return await fn();
+    } catch (err) {
+      lastErr = err;
+      if (!isRetryable(err) || attempt === MAX_RETRIES) break;
+      await new Promise((r) => setTimeout(r, 250 * 2 ** attempt));
+    }
+  }
+  throw lastErr;
+}
+function isRetryable(err) {
+  if (err instanceof HttpError) return err.status >= 500;
+  return true;
+}
+function truncate(s, max) {
+  if (s.length <= max) return s;
+  return `${s.slice(0, max - 1)}\u2026`;
+}
+
+// src/types.ts
+var SEVERITY_RANK = {
+  critical: 4,
+  high: 3,
+  moderate: 2,
+  low: 1,
+  unknown: 0
+};
+
+// src/scanner.ts
+async function scanProject(options = {}) {
+  const cwd = resolve2(options.cwd ?? process.cwd());
+  const lockfilePath = options.lockfile ? resolve2(cwd, options.lockfile) : detectLockfile(cwd);
+  if (!lockfilePath) {
+    throw new ScanInputError(
+      `No npm lockfile found in ${cwd}. Pass --lockfile or run in a directory with package-lock.json.`
+    );
+  }
+  return scanLockfile({
+    lockfilePath,
+    includeDev: options.includeDev,
+    prodOnly: options.prodOnly,
+    fetchImpl: options.fetchImpl
+  });
+}
+async function scanLockfile(options) {
+  const { lockfilePath } = options;
+  if (!existsSync(lockfilePath)) {
+    throw new ScanInputError(`Lockfile does not exist: ${lockfilePath}`);
+  }
+  const stat = statSync(lockfilePath);
+  if (!stat.isFile()) {
+    throw new ScanInputError(`Lockfile path is not a file: ${lockfilePath}`);
+  }
+  const allInstances = parseNpmPackageLock(lockfilePath);
+  const instances = filterInstances(allInstances, options);
+  const errors = [];
+  let findings = [];
+  try {
+    findings = await queryOsv(instances, { fetchImpl: options.fetchImpl });
+  } catch (err) {
+    errors.push({
+      message: "Failed to query OSV advisory database",
+      cause: err.message
+    });
+  }
+  findings.sort(compareFindings);
+  return {
+    scannedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    packagesScanned: instances.length,
+    findings,
+    summary: summarize(findings),
+    errors
+  };
+}
+var ScanInputError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ScanInputError";
+  }
+};
+function detectLockfile(cwd) {
+  const candidate = join(cwd, "package-lock.json");
+  return existsSync(candidate) ? candidate : void 0;
+}
+function filterInstances(instances, options) {
+  const includeDev = options.prodOnly ? false : options.includeDev !== false;
+  if (includeDev) return instances;
+  return instances.filter((p) => !p.dev);
+}
+function compareFindings(a, b) {
+  const sev = SEVERITY_RANK[b.severity] - SEVERITY_RANK[a.severity];
+  if (sev !== 0) return sev;
+  if (a.packageName !== b.packageName) {
+    return a.packageName.localeCompare(b.packageName);
+  }
+  if (a.installedVersion !== b.installedVersion) {
+    return a.installedVersion.localeCompare(b.installedVersion);
+  }
+  return a.id.localeCompare(b.id);
+}
+function summarize(findings) {
+  const summary = {
+    critical: 0,
+    high: 0,
+    moderate: 0,
+    low: 0,
+    unknown: 0
+  };
+  for (const f of findings) summary[f.severity]++;
+  return summary;
+}
+function meetsThreshold(findings, threshold) {
+  if (threshold === "none") return false;
+  const min = SEVERITY_RANK[threshold];
+  return findings.some((f) => SEVERITY_RANK[f.severity] >= min);
+}
+export {
+  SEVERITY_RANK,
+  ScanInputError,
+  compareFindings,
+  dedupeForQuery,
+  meetsThreshold,
+  parseNpmPackageLock,
+  queryOsv,
+  scanLockfile,
+  scanProject,
+  summarize
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/scanner.ts","../src/extractors/npm-package-lock.ts","../src/sources/osv.ts","../src/types.ts"],"sourcesContent":["import { existsSync, statSync } from \"node:fs\";\nimport { resolve, join } from \"node:path\";\nimport { parseNpmPackageLock } from \"./extractors/npm-package-lock.js\";\nimport { queryOsv } from \"./sources/osv.js\";\nimport { SEVERITY_RANK } from \"./types.js\";\nimport type {\n  Finding,\n  PackageInstance,\n  ScanError,\n  ScanLockfileOptions,\n  ScanProjectOptions,\n  ScanResult,\n  Severity,\n} from \"./types.js\";\n\nexport async function scanProject(\n  options: ScanProjectOptions = {},\n): Promise<ScanResult> {\n  const cwd = resolve(options.cwd ?? process.cwd());\n  const lockfilePath = options.lockfile\n    ? resolve(cwd, options.lockfile)\n    : detectLockfile(cwd);\n\n  if (!lockfilePath) {\n    throw new ScanInputError(\n      `No npm lockfile found in ${cwd}. Pass --lockfile or run in a directory with package-lock.json.`,\n    );\n  }\n\n  return scanLockfile({\n    lockfilePath,\n    includeDev: options.includeDev,\n    prodOnly: options.prodOnly,\n    fetchImpl: options.fetchImpl,\n  });\n}\n\nexport async function scanLockfile(\n  options: ScanLockfileOptions,\n): Promise<ScanResult> {\n  const { lockfilePath } = options;\n  if (!existsSync(lockfilePath)) {\n    throw new ScanInputError(`Lockfile does not exist: ${lockfilePath}`);\n  }\n  const stat = statSync(lockfilePath);\n  if (!stat.isFile()) {\n    throw new ScanInputError(`Lockfile path is not a file: ${lockfilePath}`);\n  }\n\n  const allInstances = parseNpmPackageLock(lockfilePath);\n  const instances = filterInstances(allInstances, options);\n  const errors: ScanError[] = [];\n\n  let findings: Finding[] = [];\n  try {\n    findings = await queryOsv(instances, { fetchImpl: options.fetchImpl });\n  } catch (err) {\n    errors.push({\n      message: \"Failed to query OSV advisory database\",\n      cause: (err as Error).message,\n    });\n  }\n\n  findings.sort(compareFindings);\n\n  return {\n    scannedAt: new Date().toISOString(),\n    packagesScanned: instances.length,\n    findings,\n    summary: summarize(findings),\n    errors,\n  };\n}\n\nexport class ScanInputError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"ScanInputError\";\n  }\n}\n\nfunction detectLockfile(cwd: string): string | undefined {\n  const candidate = join(cwd, \"package-lock.json\");\n  return existsSync(candidate) ? candidate : undefined;\n}\n\nfunction filterInstances(\n  instances: PackageInstance[],\n  options: { includeDev?: boolean; prodOnly?: boolean },\n): PackageInstance[] {\n  const includeDev = options.prodOnly ? false : options.includeDev !== false;\n  if (includeDev) return instances;\n  return instances.filter((p) => !p.dev);\n}\n\nexport function compareFindings(a: Finding, b: Finding): number {\n  const sev = SEVERITY_RANK[b.severity] - SEVERITY_RANK[a.severity];\n  if (sev !== 0) return sev;\n  if (a.packageName !== b.packageName) {\n    return a.packageName.localeCompare(b.packageName);\n  }\n  if (a.installedVersion !== b.installedVersion) {\n    return a.installedVersion.localeCompare(b.installedVersion);\n  }\n  return a.id.localeCompare(b.id);\n}\n\nexport function summarize(findings: Finding[]): Record<Severity, number> {\n  const summary: Record<Severity, number> = {\n    critical: 0,\n    high: 0,\n    moderate: 0,\n    low: 0,\n    unknown: 0,\n  };\n  for (const f of findings) summary[f.severity]++;\n  return summary;\n}\n\n/**\n * Returns true when any finding meets or exceeds the given severity threshold.\n * \"none\" means never fail.\n */\nexport function meetsThreshold(\n  findings: Finding[],\n  threshold: Severity | \"none\",\n): boolean {\n  if (threshold === \"none\") return false;\n  const min = SEVERITY_RANK[threshold];\n  return findings.some((f) => SEVERITY_RANK[f.severity] >= min);\n}\n","import { readFileSync } from \"node:fs\";\nimport { resolve } from \"node:path\";\nimport type { PackageInstance } from \"../types.js\";\n\ninterface NpmLockEntry {\n  version?: string;\n  resolved?: string;\n  integrity?: string;\n  dev?: boolean;\n  devOptional?: boolean;\n  optional?: boolean;\n  peer?: boolean;\n  link?: boolean;\n  // Present on the root (\"\") entry only.\n  dependencies?: Record<string, string>;\n  devDependencies?: Record<string, string>;\n  optionalDependencies?: Record<string, string>;\n  peerDependencies?: Record<string, string>;\n}\n\ninterface NpmLockfile {\n  name?: string;\n  lockfileVersion?: number;\n  packages?: Record<string, NpmLockEntry>;\n}\n\n/**\n * Parse an npm `package-lock.json` (v2 or v3) and return one\n * PackageInstance per node in the `packages` map.\n *\n * The empty-string key represents the root project and is skipped.\n */\nexport function parseNpmPackageLock(filePath: string): PackageInstance[] {\n  const absolute = resolve(filePath);\n  const raw = readFileSync(absolute, \"utf8\");\n  let parsed: NpmLockfile;\n  try {\n    parsed = JSON.parse(raw) as NpmLockfile;\n  } catch (err) {\n    throw new Error(\n      `Failed to parse ${absolute}: ${(err as Error).message}`,\n    );\n  }\n\n  if (parsed.lockfileVersion !== 2 && parsed.lockfileVersion !== 3) {\n    throw new Error(\n      `Unsupported npm lockfileVersion ${String(\n        parsed.lockfileVersion,\n      )} in ${absolute}. Only v2 and v3 are supported.`,\n    );\n  }\n\n  const packages = parsed.packages;\n  if (!packages || typeof packages !== \"object\") {\n    throw new Error(\n      `Lockfile ${absolute} has no \"packages\" map; cannot extract installed versions.`,\n    );\n  }\n\n  const directDeps = collectDirectDependencyNames(packages[\"\"] ?? {});\n  const instances: PackageInstance[] = [];\n\n  for (const [path, entry] of Object.entries(packages)) {\n    if (path === \"\") continue;\n    if (entry.link) continue; // workspace symlink, not a real install\n    const name = packagePathToName(path);\n    if (!name) continue;\n    if (!entry.version) continue;\n\n    instances.push({\n      name,\n      version: entry.version,\n      ecosystem: \"npm\",\n      path,\n      direct: directDeps.has(name) && isTopLevelInstance(path),\n      dev: Boolean(entry.dev || entry.devOptional),\n      optional: Boolean(entry.optional || entry.devOptional),\n      resolved: entry.resolved,\n      integrity: entry.integrity,\n    });\n  }\n\n  return instances;\n}\n\nfunction collectDirectDependencyNames(rootEntry: NpmLockEntry): Set<string> {\n  const names = new Set<string>();\n  for (const key of [\n    \"dependencies\",\n    \"devDependencies\",\n    \"optionalDependencies\",\n    \"peerDependencies\",\n  ] as const) {\n    const block = rootEntry[key];\n    if (!block) continue;\n    for (const name of Object.keys(block)) names.add(name);\n  }\n  return names;\n}\n\n/**\n * \"node_modules/foo\" -> \"foo\"\n * \"node_modules/@scope/bar\" -> \"@scope/bar\"\n * \"node_modules/foo/node_modules/bar\" -> \"bar\"\n */\nexport function packagePathToName(path: string): string | null {\n  const marker = \"node_modules/\";\n  const idx = path.lastIndexOf(marker);\n  if (idx === -1) return null;\n  const tail = path.slice(idx + marker.length);\n  if (!tail) return null;\n  if (tail.startsWith(\"@\")) {\n    const firstSlash = tail.indexOf(\"/\");\n    if (firstSlash === -1) return null;\n    const secondSlash = tail.indexOf(\"/\", firstSlash + 1);\n    return secondSlash === -1 ? tail : tail.slice(0, secondSlash);\n  }\n  const next = tail.indexOf(\"/\");\n  return next === -1 ? tail : tail.slice(0, next);\n}\n\n/** A direct-install path has exactly one `node_modules/` segment. */\nfunction isTopLevelInstance(path: string): boolean {\n  const first = path.indexOf(\"node_modules/\");\n  if (first === -1) return false;\n  return path.indexOf(\"node_modules/\", first + 1) === -1;\n}\n","import type { Finding, PackageInstance, Severity } from \"../types.js\";\n\nconst OSV_QUERYBATCH_URL = \"https://api.osv.dev/v1/querybatch\";\nconst OSV_VULN_URL = \"https://api.osv.dev/v1/vulns\";\nconst QUERY_CHUNK_SIZE = 500;\nconst REQUEST_TIMEOUT_MS = 15_000;\nconst MAX_RETRIES = 2;\n\ninterface OsvQueryBatchResponse {\n  results: Array<{ vulns?: Array<{ id: string; modified?: string }> }>;\n}\n\ninterface OsvSeverity {\n  type: string;\n  score: string;\n}\n\ninterface OsvAffectedRange {\n  type: string;\n  events: Array<{ introduced?: string; fixed?: string; last_affected?: string }>;\n}\n\ninterface OsvAffectedPackage {\n  package?: { ecosystem?: string; name?: string };\n  ranges?: OsvAffectedRange[];\n  versions?: string[];\n}\n\ninterface OsvVulnDetail {\n  id: string;\n  summary?: string;\n  details?: string;\n  references?: Array<{ type?: string; url?: string }>;\n  severity?: OsvSeverity[];\n  database_specific?: { severity?: string };\n  affected?: OsvAffectedPackage[];\n}\n\nexport interface OsvQueryDeps {\n  fetchImpl?: typeof fetch;\n}\n\ninterface UniquePackage {\n  name: string;\n  version: string;\n}\n\n/**\n * Build the deduplicated list of unique name@version pairs to query OSV with.\n */\nexport function dedupeForQuery(\n  packages: PackageInstance[],\n): UniquePackage[] {\n  const seen = new Set<string>();\n  const out: UniquePackage[] = [];\n  for (const pkg of packages) {\n    const key = `${pkg.name}@${pkg.version}`;\n    if (seen.has(key)) continue;\n    seen.add(key);\n    out.push({ name: pkg.name, version: pkg.version });\n  }\n  return out;\n}\n\n/**\n * Query OSV for the given installed packages and return one Finding per\n * (advisory, affected package instance) pair.\n */\nexport async function queryOsv(\n  packages: PackageInstance[],\n  deps: OsvQueryDeps = {},\n): Promise<Finding[]> {\n  const fetchImpl = deps.fetchImpl ?? fetch;\n  const unique = dedupeForQuery(packages);\n  if (unique.length === 0) return [];\n\n  const idsByPackage = new Map<string, Set<string>>();\n  for (const chunk of chunked(unique, QUERY_CHUNK_SIZE)) {\n    const body = {\n      queries: chunk.map((q) => ({\n        package: { ecosystem: \"npm\", name: q.name },\n        version: q.version,\n      })),\n    };\n    const res = await postJson<OsvQueryBatchResponse>(\n      fetchImpl,\n      OSV_QUERYBATCH_URL,\n      body,\n    );\n    res.results.forEach((result, i) => {\n      const q = chunk[i];\n      if (!q) return;\n      const key = `${q.name}@${q.version}`;\n      if (!result.vulns || result.vulns.length === 0) return;\n      const ids = idsByPackage.get(key) ?? new Set<string>();\n      for (const v of result.vulns) ids.add(v.id);\n      idsByPackage.set(key, ids);\n    });\n  }\n\n  const allIds = new Set<string>();\n  for (const ids of idsByPackage.values()) {\n    for (const id of ids) allIds.add(id);\n  }\n\n  const detailsById = new Map<string, OsvVulnDetail>();\n  for (const id of allIds) {\n    try {\n      const detail = await getJson<OsvVulnDetail>(\n        fetchImpl,\n        `${OSV_VULN_URL}/${encodeURIComponent(id)}`,\n      );\n      detailsById.set(id, detail);\n    } catch {\n      // Skip missing/broken records; we still have the id reported below.\n    }\n  }\n\n  const findings: Finding[] = [];\n  for (const pkg of packages) {\n    const key = `${pkg.name}@${pkg.version}`;\n    const ids = idsByPackage.get(key);\n    if (!ids) continue;\n    for (const id of ids) {\n      const detail = detailsById.get(id);\n      findings.push(buildFinding(pkg, id, detail));\n    }\n  }\n  return findings;\n}\n\nfunction buildFinding(\n  pkg: PackageInstance,\n  id: string,\n  detail: OsvVulnDetail | undefined,\n): Finding {\n  const severity = detail ? parseSeverity(detail) : \"unknown\";\n  const summary = detail?.summary ?? detail?.details ?? id;\n  return {\n    id,\n    source: \"osv\",\n    type: \"vulnerability\",\n    severity,\n    packageName: pkg.name,\n    installedVersion: pkg.version,\n    summary: truncate(summary, 240),\n    url: pickAdvisoryUrl(detail) ?? `https://osv.dev/vulnerability/${id}`,\n    fixedVersions: detail ? collectFixedVersions(detail, pkg.name) : [],\n    affectedPaths: [pkg.path],\n  };\n}\n\nexport function parseSeverity(detail: OsvVulnDetail): Severity {\n  // GHSA records expose a normalized severity in database_specific.severity.\n  const dbSpecific = detail.database_specific?.severity?.toLowerCase();\n  if (\n    dbSpecific === \"critical\" ||\n    dbSpecific === \"high\" ||\n    dbSpecific === \"moderate\" ||\n    dbSpecific === \"low\"\n  ) {\n    return dbSpecific;\n  }\n  if (dbSpecific === \"medium\") return \"moderate\";\n\n  const cvss = detail.severity?.find((s) => s.type?.startsWith(\"CVSS_\"));\n  if (cvss) {\n    const score = parseCvssScore(cvss.score);\n    if (score === undefined) return \"unknown\";\n    if (score >= 9.0) return \"critical\";\n    if (score >= 7.0) return \"high\";\n    if (score >= 4.0) return \"moderate\";\n    if (score > 0) return \"low\";\n  }\n  return \"unknown\";\n}\n\nfunction parseCvssScore(vector: string): number | undefined {\n  const direct = Number.parseFloat(vector);\n  if (!Number.isNaN(direct) && vector.trim() !== \"\") return direct;\n  // Some entries store the full CVSS vector string; we don't compute it here.\n  return undefined;\n}\n\nfunction pickAdvisoryUrl(detail: OsvVulnDetail | undefined): string | undefined {\n  if (!detail?.references) return undefined;\n  const advisory = detail.references.find((r) => r.type === \"ADVISORY\");\n  return advisory?.url ?? detail.references[0]?.url;\n}\n\nexport function collectFixedVersions(\n  detail: OsvVulnDetail,\n  packageName: string,\n): string[] {\n  const out = new Set<string>();\n  for (const aff of detail.affected ?? []) {\n    if (aff.package?.name && aff.package.name !== packageName) continue;\n    for (const range of aff.ranges ?? []) {\n      for (const event of range.events ?? []) {\n        if (event.fixed) out.add(event.fixed);\n      }\n    }\n  }\n  return [...out];\n}\n\nfunction* chunked<T>(items: T[], size: number): Generator<T[]> {\n  for (let i = 0; i < items.length; i += size) {\n    yield items.slice(i, i + size);\n  }\n}\n\nasync function postJson<T>(\n  fetchImpl: typeof fetch,\n  url: string,\n  body: unknown,\n): Promise<T> {\n  return withRetry(async () => {\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);\n    try {\n      const res = await fetchImpl(url, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/json\" },\n        body: JSON.stringify(body),\n        signal: controller.signal,\n      });\n      if (!res.ok) {\n        throw new HttpError(`OSV ${res.status}: ${res.statusText}`, res.status);\n      }\n      return (await res.json()) as T;\n    } finally {\n      clearTimeout(timer);\n    }\n  });\n}\n\nasync function getJson<T>(fetchImpl: typeof fetch, url: string): Promise<T> {\n  return withRetry(async () => {\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);\n    try {\n      const res = await fetchImpl(url, { signal: controller.signal });\n      if (!res.ok) {\n        throw new HttpError(`OSV ${res.status}: ${res.statusText}`, res.status);\n      }\n      return (await res.json()) as T;\n    } finally {\n      clearTimeout(timer);\n    }\n  });\n}\n\nclass HttpError extends Error {\n  constructor(message: string, public readonly status: number) {\n    super(message);\n  }\n}\n\nasync function withRetry<T>(fn: () => Promise<T>): Promise<T> {\n  let lastErr: unknown;\n  for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {\n    try {\n      return await fn();\n    } catch (err) {\n      lastErr = err;\n      if (!isRetryable(err) || attempt === MAX_RETRIES) break;\n      await new Promise((r) => setTimeout(r, 250 * 2 ** attempt));\n    }\n  }\n  throw lastErr;\n}\n\nfunction isRetryable(err: unknown): boolean {\n  if (err instanceof HttpError) return err.status >= 500;\n  // AbortError (timeout) and network errors are retryable.\n  return true;\n}\n\nfunction truncate(s: string, max: number): string {\n  if (s.length <= max) return s;\n  return `${s.slice(0, max - 1)}…`;\n}\n","export type Severity = \"critical\" | \"high\" | \"moderate\" | \"low\" | \"unknown\";\n\nexport type Ecosystem = \"npm\";\n\nexport type FindingType =\n  | \"vulnerability\"\n  | \"malware\"\n  | \"risk-signal\"\n  | \"integrity\";\n\nexport const SEVERITY_RANK: Record<Severity, number> = {\n  critical: 4,\n  high: 3,\n  moderate: 2,\n  low: 1,\n  unknown: 0,\n};\n\nexport interface PackageInstance {\n  name: string;\n  version: string;\n  ecosystem: Ecosystem;\n  /** Path within the lockfile's `packages` map (e.g. \"node_modules/foo\"). */\n  path: string;\n  direct: boolean;\n  dev: boolean;\n  optional: boolean;\n  resolved?: string;\n  integrity?: string;\n}\n\nexport interface Finding {\n  id: string;\n  source: \"osv\";\n  type: FindingType;\n  severity: Severity;\n  packageName: string;\n  installedVersion: string;\n  summary: string;\n  url?: string;\n  fixedVersions: string[];\n  affectedPaths: string[];\n}\n\nexport interface ScanError {\n  message: string;\n  cause?: string;\n}\n\nexport interface ScanResult {\n  scannedAt: string;\n  packagesScanned: number;\n  findings: Finding[];\n  summary: Record<Severity, number>;\n  errors: ScanError[];\n}\n\nexport interface ScanProjectOptions {\n  cwd?: string;\n  lockfile?: string;\n  includeDev?: boolean;\n  prodOnly?: boolean;\n  cache?: boolean;\n  fetchImpl?: typeof fetch;\n}\n\nexport interface ScanLockfileOptions {\n  lockfilePath: string;\n  includeDev?: boolean;\n  prodOnly?: boolean;\n  fetchImpl?: typeof fetch;\n}\n\nexport type FailOnLevel = Severity | \"none\";\n"],"mappings":";AAAA,SAAS,YAAY,gBAAgB;AACrC,SAAS,WAAAA,UAAS,YAAY;;;ACD9B,SAAS,oBAAoB;AAC7B,SAAS,eAAe;AA+BjB,SAAS,oBAAoB,UAAqC;AACvE,QAAM,WAAW,QAAQ,QAAQ;AACjC,QAAM,MAAM,aAAa,UAAU,MAAM;AACzC,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,KAAK;AACZ,UAAM,IAAI;AAAA,MACR,mBAAmB,QAAQ,KAAM,IAAc,OAAO;AAAA,IACxD;AAAA,EACF;AAEA,MAAI,OAAO,oBAAoB,KAAK,OAAO,oBAAoB,GAAG;AAChE,UAAM,IAAI;AAAA,MACR,mCAAmC;AAAA,QACjC,OAAO;AAAA,MACT,CAAC,OAAO,QAAQ;AAAA,IAClB;AAAA,EACF;AAEA,QAAM,WAAW,OAAO;AACxB,MAAI,CAAC,YAAY,OAAO,aAAa,UAAU;AAC7C,UAAM,IAAI;AAAA,MACR,YAAY,QAAQ;AAAA,IACtB;AAAA,EACF;AAEA,QAAM,aAAa,6BAA6B,SAAS,EAAE,KAAK,CAAC,CAAC;AAClE,QAAM,YAA+B,CAAC;AAEtC,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,QAAQ,GAAG;AACpD,QAAI,SAAS,GAAI;AACjB,QAAI,MAAM,KAAM;AAChB,UAAM,OAAO,kBAAkB,IAAI;AACnC,QAAI,CAAC,KAAM;AACX,QAAI,CAAC,MAAM,QAAS;AAEpB,cAAU,KAAK;AAAA,MACb;AAAA,MACA,SAAS,MAAM;AAAA,MACf,WAAW;AAAA,MACX;AAAA,MACA,QAAQ,WAAW,IAAI,IAAI,KAAK,mBAAmB,IAAI;AAAA,MACvD,KAAK,QAAQ,MAAM,OAAO,MAAM,WAAW;AAAA,MAC3C,UAAU,QAAQ,MAAM,YAAY,MAAM,WAAW;AAAA,MACrD,UAAU,MAAM;AAAA,MAChB,WAAW,MAAM;AAAA,IACnB,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAEA,SAAS,6BAA6B,WAAsC;AAC1E,QAAM,QAAQ,oBAAI,IAAY;AAC9B,aAAW,OAAO;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAAY;AACV,UAAM,QAAQ,UAAU,GAAG;AAC3B,QAAI,CAAC,MAAO;AACZ,eAAW,QAAQ,OAAO,KAAK,KAAK,EAAG,OAAM,IAAI,IAAI;AAAA,EACvD;AACA,SAAO;AACT;AAOO,SAAS,kBAAkB,MAA6B;AAC7D,QAAM,SAAS;AACf,QAAM,MAAM,KAAK,YAAY,MAAM;AACnC,MAAI,QAAQ,GAAI,QAAO;AACvB,QAAM,OAAO,KAAK,MAAM,MAAM,OAAO,MAAM;AAC3C,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,KAAK,WAAW,GAAG,GAAG;AACxB,UAAM,aAAa,KAAK,QAAQ,GAAG;AACnC,QAAI,eAAe,GAAI,QAAO;AAC9B,UAAM,cAAc,KAAK,QAAQ,KAAK,aAAa,CAAC;AACpD,WAAO,gBAAgB,KAAK,OAAO,KAAK,MAAM,GAAG,WAAW;AAAA,EAC9D;AACA,QAAM,OAAO,KAAK,QAAQ,GAAG;AAC7B,SAAO,SAAS,KAAK,OAAO,KAAK,MAAM,GAAG,IAAI;AAChD;AAGA,SAAS,mBAAmB,MAAuB;AACjD,QAAM,QAAQ,KAAK,QAAQ,eAAe;AAC1C,MAAI,UAAU,GAAI,QAAO;AACzB,SAAO,KAAK,QAAQ,iBAAiB,QAAQ,CAAC,MAAM;AACtD;;;AC5HA,IAAM,qBAAqB;AAC3B,IAAM,eAAe;AACrB,IAAM,mBAAmB;AACzB,IAAM,qBAAqB;AAC3B,IAAM,cAAc;AA4Cb,SAAS,eACd,UACiB;AACjB,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,MAAuB,CAAC;AAC9B,aAAW,OAAO,UAAU;AAC1B,UAAM,MAAM,GAAG,IAAI,IAAI,IAAI,IAAI,OAAO;AACtC,QAAI,KAAK,IAAI,GAAG,EAAG;AACnB,SAAK,IAAI,GAAG;AACZ,QAAI,KAAK,EAAE,MAAM,IAAI,MAAM,SAAS,IAAI,QAAQ,CAAC;AAAA,EACnD;AACA,SAAO;AACT;AAMA,eAAsB,SACpB,UACA,OAAqB,CAAC,GACF;AACpB,QAAM,YAAY,KAAK,aAAa;AACpC,QAAM,SAAS,eAAe,QAAQ;AACtC,MAAI,OAAO,WAAW,EAAG,QAAO,CAAC;AAEjC,QAAM,eAAe,oBAAI,IAAyB;AAClD,aAAW,SAAS,QAAQ,QAAQ,gBAAgB,GAAG;AACrD,UAAM,OAAO;AAAA,MACX,SAAS,MAAM,IAAI,CAAC,OAAO;AAAA,QACzB,SAAS,EAAE,WAAW,OAAO,MAAM,EAAE,KAAK;AAAA,QAC1C,SAAS,EAAE;AAAA,MACb,EAAE;AAAA,IACJ;AACA,UAAM,MAAM,MAAM;AAAA,MAChB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,QAAQ,QAAQ,CAAC,QAAQ,MAAM;AACjC,YAAM,IAAI,MAAM,CAAC;AACjB,UAAI,CAAC,EAAG;AACR,YAAM,MAAM,GAAG,EAAE,IAAI,IAAI,EAAE,OAAO;AAClC,UAAI,CAAC,OAAO,SAAS,OAAO,MAAM,WAAW,EAAG;AAChD,YAAM,MAAM,aAAa,IAAI,GAAG,KAAK,oBAAI,IAAY;AACrD,iBAAW,KAAK,OAAO,MAAO,KAAI,IAAI,EAAE,EAAE;AAC1C,mBAAa,IAAI,KAAK,GAAG;AAAA,IAC3B,CAAC;AAAA,EACH;AAEA,QAAM,SAAS,oBAAI,IAAY;AAC/B,aAAW,OAAO,aAAa,OAAO,GAAG;AACvC,eAAW,MAAM,IAAK,QAAO,IAAI,EAAE;AAAA,EACrC;AAEA,QAAM,cAAc,oBAAI,IAA2B;AACnD,aAAW,MAAM,QAAQ;AACvB,QAAI;AACF,YAAM,SAAS,MAAM;AAAA,QACnB;AAAA,QACA,GAAG,YAAY,IAAI,mBAAmB,EAAE,CAAC;AAAA,MAC3C;AACA,kBAAY,IAAI,IAAI,MAAM;AAAA,IAC5B,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,QAAM,WAAsB,CAAC;AAC7B,aAAW,OAAO,UAAU;AAC1B,UAAM,MAAM,GAAG,IAAI,IAAI,IAAI,IAAI,OAAO;AACtC,UAAM,MAAM,aAAa,IAAI,GAAG;AAChC,QAAI,CAAC,IAAK;AACV,eAAW,MAAM,KAAK;AACpB,YAAM,SAAS,YAAY,IAAI,EAAE;AACjC,eAAS,KAAK,aAAa,KAAK,IAAI,MAAM,CAAC;AAAA,IAC7C;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,aACP,KACA,IACA,QACS;AACT,QAAM,WAAW,SAAS,cAAc,MAAM,IAAI;AAClD,QAAM,UAAU,QAAQ,WAAW,QAAQ,WAAW;AACtD,SAAO;AAAA,IACL;AAAA,IACA,QAAQ;AAAA,IACR,MAAM;AAAA,IACN;AAAA,IACA,aAAa,IAAI;AAAA,IACjB,kBAAkB,IAAI;AAAA,IACtB,SAAS,SAAS,SAAS,GAAG;AAAA,IAC9B,KAAK,gBAAgB,MAAM,KAAK,iCAAiC,EAAE;AAAA,IACnE,eAAe,SAAS,qBAAqB,QAAQ,IAAI,IAAI,IAAI,CAAC;AAAA,IAClE,eAAe,CAAC,IAAI,IAAI;AAAA,EAC1B;AACF;AAEO,SAAS,cAAc,QAAiC;AAE7D,QAAM,aAAa,OAAO,mBAAmB,UAAU,YAAY;AACnE,MACE,eAAe,cACf,eAAe,UACf,eAAe,cACf,eAAe,OACf;AACA,WAAO;AAAA,EACT;AACA,MAAI,eAAe,SAAU,QAAO;AAEpC,QAAM,OAAO,OAAO,UAAU,KAAK,CAAC,MAAM,EAAE,MAAM,WAAW,OAAO,CAAC;AACrE,MAAI,MAAM;AACR,UAAM,QAAQ,eAAe,KAAK,KAAK;AACvC,QAAI,UAAU,OAAW,QAAO;AAChC,QAAI,SAAS,EAAK,QAAO;AACzB,QAAI,SAAS,EAAK,QAAO;AACzB,QAAI,SAAS,EAAK,QAAO;AACzB,QAAI,QAAQ,EAAG,QAAO;AAAA,EACxB;AACA,SAAO;AACT;AAEA,SAAS,eAAe,QAAoC;AAC1D,QAAM,SAAS,OAAO,WAAW,MAAM;AACvC,MAAI,CAAC,OAAO,MAAM,MAAM,KAAK,OAAO,KAAK,MAAM,GAAI,QAAO;AAE1D,SAAO;AACT;AAEA,SAAS,gBAAgB,QAAuD;AAC9E,MAAI,CAAC,QAAQ,WAAY,QAAO;AAChC,QAAM,WAAW,OAAO,WAAW,KAAK,CAAC,MAAM,EAAE,SAAS,UAAU;AACpE,SAAO,UAAU,OAAO,OAAO,WAAW,CAAC,GAAG;AAChD;AAEO,SAAS,qBACd,QACA,aACU;AACV,QAAM,MAAM,oBAAI,IAAY;AAC5B,aAAW,OAAO,OAAO,YAAY,CAAC,GAAG;AACvC,QAAI,IAAI,SAAS,QAAQ,IAAI,QAAQ,SAAS,YAAa;AAC3D,eAAW,SAAS,IAAI,UAAU,CAAC,GAAG;AACpC,iBAAW,SAAS,MAAM,UAAU,CAAC,GAAG;AACtC,YAAI,MAAM,MAAO,KAAI,IAAI,MAAM,KAAK;AAAA,MACtC;AAAA,IACF;AAAA,EACF;AACA,SAAO,CAAC,GAAG,GAAG;AAChB;AAEA,UAAU,QAAW,OAAY,MAA8B;AAC7D,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK,MAAM;AAC3C,UAAM,MAAM,MAAM,GAAG,IAAI,IAAI;AAAA,EAC/B;AACF;AAEA,eAAe,SACb,WACA,KACA,MACY;AACZ,SAAO,UAAU,YAAY;AAC3B,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,kBAAkB;AACrE,QAAI;AACF,YAAM,MAAM,MAAM,UAAU,KAAK;AAAA,QAC/B,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,IAAI;AAAA,QACzB,QAAQ,WAAW;AAAA,MACrB,CAAC;AACD,UAAI,CAAC,IAAI,IAAI;AACX,cAAM,IAAI,UAAU,OAAO,IAAI,MAAM,KAAK,IAAI,UAAU,IAAI,IAAI,MAAM;AAAA,MACxE;AACA,aAAQ,MAAM,IAAI,KAAK;AAAA,IACzB,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF,CAAC;AACH;AAEA,eAAe,QAAW,WAAyB,KAAyB;AAC1E,SAAO,UAAU,YAAY;AAC3B,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,kBAAkB;AACrE,QAAI;AACF,YAAM,MAAM,MAAM,UAAU,KAAK,EAAE,QAAQ,WAAW,OAAO,CAAC;AAC9D,UAAI,CAAC,IAAI,IAAI;AACX,cAAM,IAAI,UAAU,OAAO,IAAI,MAAM,KAAK,IAAI,UAAU,IAAI,IAAI,MAAM;AAAA,MACxE;AACA,aAAQ,MAAM,IAAI,KAAK;AAAA,IACzB,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF,CAAC;AACH;AAEA,IAAM,YAAN,cAAwB,MAAM;AAAA,EAC5B,YAAY,SAAiC,QAAgB;AAC3D,UAAM,OAAO;AAD8B;AAAA,EAE7C;AAAA,EAF6C;AAG/C;AAEA,eAAe,UAAa,IAAkC;AAC5D,MAAI;AACJ,WAAS,UAAU,GAAG,WAAW,aAAa,WAAW;AACvD,QAAI;AACF,aAAO,MAAM,GAAG;AAAA,IAClB,SAAS,KAAK;AACZ,gBAAU;AACV,UAAI,CAAC,YAAY,GAAG,KAAK,YAAY,YAAa;AAClD,YAAM,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,MAAM,KAAK,OAAO,CAAC;AAAA,IAC5D;AAAA,EACF;AACA,QAAM;AACR;AAEA,SAAS,YAAY,KAAuB;AAC1C,MAAI,eAAe,UAAW,QAAO,IAAI,UAAU;AAEnD,SAAO;AACT;AAEA,SAAS,SAAS,GAAW,KAAqB;AAChD,MAAI,EAAE,UAAU,IAAK,QAAO;AAC5B,SAAO,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;AAC/B;;;AChRO,IAAM,gBAA0C;AAAA,EACrD,UAAU;AAAA,EACV,MAAM;AAAA,EACN,UAAU;AAAA,EACV,KAAK;AAAA,EACL,SAAS;AACX;;;AHDA,eAAsB,YACpB,UAA8B,CAAC,GACV;AACrB,QAAM,MAAMC,SAAQ,QAAQ,OAAO,QAAQ,IAAI,CAAC;AAChD,QAAM,eAAe,QAAQ,WACzBA,SAAQ,KAAK,QAAQ,QAAQ,IAC7B,eAAe,GAAG;AAEtB,MAAI,CAAC,cAAc;AACjB,UAAM,IAAI;AAAA,MACR,4BAA4B,GAAG;AAAA,IACjC;AAAA,EACF;AAEA,SAAO,aAAa;AAAA,IAClB;AAAA,IACA,YAAY,QAAQ;AAAA,IACpB,UAAU,QAAQ;AAAA,IAClB,WAAW,QAAQ;AAAA,EACrB,CAAC;AACH;AAEA,eAAsB,aACpB,SACqB;AACrB,QAAM,EAAE,aAAa,IAAI;AACzB,MAAI,CAAC,WAAW,YAAY,GAAG;AAC7B,UAAM,IAAI,eAAe,4BAA4B,YAAY,EAAE;AAAA,EACrE;AACA,QAAM,OAAO,SAAS,YAAY;AAClC,MAAI,CAAC,KAAK,OAAO,GAAG;AAClB,UAAM,IAAI,eAAe,gCAAgC,YAAY,EAAE;AAAA,EACzE;AAEA,QAAM,eAAe,oBAAoB,YAAY;AACrD,QAAM,YAAY,gBAAgB,cAAc,OAAO;AACvD,QAAM,SAAsB,CAAC;AAE7B,MAAI,WAAsB,CAAC;AAC3B,MAAI;AACF,eAAW,MAAM,SAAS,WAAW,EAAE,WAAW,QAAQ,UAAU,CAAC;AAAA,EACvE,SAAS,KAAK;AACZ,WAAO,KAAK;AAAA,MACV,SAAS;AAAA,MACT,OAAQ,IAAc;AAAA,IACxB,CAAC;AAAA,EACH;AAEA,WAAS,KAAK,eAAe;AAE7B,SAAO;AAAA,IACL,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IAClC,iBAAiB,UAAU;AAAA,IAC3B;AAAA,IACA,SAAS,UAAU,QAAQ;AAAA,IAC3B;AAAA,EACF;AACF;AAEO,IAAM,iBAAN,cAA6B,MAAM;AAAA,EACxC,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEA,SAAS,eAAe,KAAiC;AACvD,QAAM,YAAY,KAAK,KAAK,mBAAmB;AAC/C,SAAO,WAAW,SAAS,IAAI,YAAY;AAC7C;AAEA,SAAS,gBACP,WACA,SACmB;AACnB,QAAM,aAAa,QAAQ,WAAW,QAAQ,QAAQ,eAAe;AACrE,MAAI,WAAY,QAAO;AACvB,SAAO,UAAU,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG;AACvC;AAEO,SAAS,gBAAgB,GAAY,GAAoB;AAC9D,QAAM,MAAM,cAAc,EAAE,QAAQ,IAAI,cAAc,EAAE,QAAQ;AAChE,MAAI,QAAQ,EAAG,QAAO;AACtB,MAAI,EAAE,gBAAgB,EAAE,aAAa;AACnC,WAAO,EAAE,YAAY,cAAc,EAAE,WAAW;AAAA,EAClD;AACA,MAAI,EAAE,qBAAqB,EAAE,kBAAkB;AAC7C,WAAO,EAAE,iBAAiB,cAAc,EAAE,gBAAgB;AAAA,EAC5D;AACA,SAAO,EAAE,GAAG,cAAc,EAAE,EAAE;AAChC;AAEO,SAAS,UAAU,UAA+C;AACvE,QAAM,UAAoC;AAAA,IACxC,UAAU;AAAA,IACV,MAAM;AAAA,IACN,UAAU;AAAA,IACV,KAAK;AAAA,IACL,SAAS;AAAA,EACX;AACA,aAAW,KAAK,SAAU,SAAQ,EAAE,QAAQ;AAC5C,SAAO;AACT;AAMO,SAAS,eACd,UACA,WACS;AACT,MAAI,cAAc,OAAQ,QAAO;AACjC,QAAM,MAAM,cAAc,SAAS;AACnC,SAAO,SAAS,KAAK,CAAC,MAAM,cAAc,EAAE,QAAQ,KAAK,GAAG;AAC9D;","names":["resolve","resolve"]}

package/package.json

@@ -0,0 +1,58 @@
+{
+  "name": "trawly",
+  "version": "0.0.1",
+  "description": "Dependency sanity scanner for npm projects. Scans installed package versions against OSV and reports known vulnerabilities.",
+  "type": "module",
+  "license": "Apache-2.0",
+  "engines": {
+    "node": ">=20"
+  },
+  "bin": {
+    "trawly": "./dist/cli.js"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "SECURITY.md"
+  ],
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit",
+    "scan": "node --import tsx/esm src/cli.ts scan",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "security",
+    "vulnerability",
+    "scanner",
+    "npm",
+    "osv",
+    "supply-chain",
+    "dependency",
+    "audit"
+  ],
+  "dependencies": {
+    "commander": "^12.1.0",
+    "kleur": "^4.1.5",
+    "zod": "^3.23.8"
+  },
+  "devDependencies": {
+    "@types/node": "^20.14.0",
+    "tsup": "^8.3.0",
+    "tsx": "^4.19.0",
+    "typescript": "^5.6.0",
+    "vitest": "^2.1.0"
+  }
+}