verimu 0.0.14 → 0.0.16

package/dist/cli.js

@@ -1,3188 +0,0 @@
-#!/usr/bin/env node
-
-// src/cli.ts
-import { resolve } from "path";
-import { createRequire } from "module";
-
-// src/scan.ts
-import { writeFile } from "fs/promises";
-import { basename, join, parse } from "path";
-
-// src/scanners/npm/npm-scanner.ts
-import { readFile } from "fs/promises";
-import { existsSync } from "fs";
-import path from "path";
-
-// src/core/errors.ts
-var VerimuError = class extends Error {
-  constructor(message, code) {
-    super(message);
-    this.code = code;
-    this.name = "VerimuError";
-  }
-};
-var NoLockfileError = class extends VerimuError {
-  constructor(projectPath) {
-    super(
-      `No supported lockfile found in ${projectPath}. Supported: package-lock.json (npm), packages.lock.json (NuGet), Cargo.lock (Rust), requirements.txt / Pipfile.lock (pip), poetry.lock (Poetry), uv.lock (uv), pom.xml (Maven), go.sum (Go), Gemfile.lock (Ruby), composer.lock (Composer), yarn.lock (Yarn), pnpm-lock.yaml (pnpm)`,
-      "NO_LOCKFILE"
-    );
-    this.name = "NoLockfileError";
-  }
-};
-var LockfileParseError = class extends VerimuError {
-  constructor(lockfilePath, reason) {
-    super(`Failed to parse ${lockfilePath}: ${reason}`, "LOCKFILE_PARSE_ERROR");
-    this.name = "LockfileParseError";
-  }
-};
-
-// src/scanners/npm/npm-scanner.ts
-var NpmScanner = class {
-  ecosystem = "npm";
-  lockfileNames = ["package-lock.json"];
-  async detect(projectPath) {
-    const lockfilePath = path.join(projectPath, "package-lock.json");
-    return existsSync(lockfilePath) ? lockfilePath : null;
-  }
-  async scan(projectPath, lockfilePath) {
-    const [lockfileRaw, packageJsonRaw] = await Promise.all([
-      readFile(lockfilePath, "utf-8"),
-      readFile(path.join(projectPath, "package.json"), "utf-8").catch(() => null)
-    ]);
-    let lockfile;
-    try {
-      lockfile = JSON.parse(lockfileRaw);
-    } catch {
-      throw new LockfileParseError(lockfilePath, "Invalid JSON");
-    }
-    const directNames = /* @__PURE__ */ new Set();
-    if (packageJsonRaw) {
-      try {
-        const pkg2 = JSON.parse(packageJsonRaw);
-        for (const name of Object.keys(pkg2.dependencies ?? {})) {
-          directNames.add(name);
-        }
-        for (const name of Object.keys(pkg2.devDependencies ?? {})) {
-          directNames.add(name);
-        }
-      } catch {
-      }
-    }
-    const dependencies = this.parseLockfile(lockfile, directNames);
-    return {
-      projectPath,
-      ecosystem: "npm",
-      dependencies,
-      lockfilePath,
-      scannedAt: (/* @__PURE__ */ new Date()).toISOString()
-    };
-  }
-  /**
-   * Parses package-lock.json and extracts dependencies.
-   * Supports lockfile v2 and v3 (uses the `packages` field).
-   * Falls back to `dependencies` field for lockfile v1.
-   */
-  parseLockfile(lockfile, directNames) {
-    const deps = [];
-    if (lockfile.packages) {
-      for (const [pkgPath, pkgInfo] of Object.entries(lockfile.packages)) {
-        if (pkgPath === "") continue;
-        const name = this.extractPackageName(pkgPath);
-        if (!name || !pkgInfo.version) continue;
-        if (pkgInfo.link) continue;
-        deps.push({
-          name,
-          version: pkgInfo.version,
-          direct: directNames.has(name),
-          ecosystem: "npm",
-          purl: this.buildPurl(name, pkgInfo.version)
-        });
-      }
-    } else if (lockfile.dependencies) {
-      this.parseDependenciesV1(lockfile.dependencies, directNames, deps);
-    }
-    return deps;
-  }
-  /**
-   * Builds a purl (Package URL) for an npm package.
-   *
-   * Per the purl spec (https://github.com/package-url/purl-spec/blob/main/types-doc/npm-definition.md):
-   * "The npm scope @ sign prefix is always percent encoded."
-   *
-   * So @types/node@20.11.5 → pkg:npm/%40types/node@20.11.5
-   * And express@4.18.2 → pkg:npm/express@4.18.2
-   */
-  buildPurl(name, version) {
-    if (name.startsWith("@")) {
-      return `pkg:npm/%40${name.slice(1)}@${version}`;
-    }
-    return `pkg:npm/${name}@${version}`;
-  }
-  /** Extracts the package name from a node_modules path */
-  extractPackageName(pkgPath) {
-    const parts = pkgPath.split("node_modules/");
-    const last = parts[parts.length - 1];
-    return last || null;
-  }
-  /** Recursively parses lockfile v1 `dependencies` tree */
-  parseDependenciesV1(depsObj, directNames, result) {
-    for (const [name, info] of Object.entries(depsObj)) {
-      if (info.version) {
-        result.push({
-          name,
-          version: info.version,
-          direct: directNames.has(name),
-          ecosystem: "npm",
-          purl: this.buildPurl(name, info.version)
-        });
-      }
-      if (info.dependencies) {
-        this.parseDependenciesV1(info.dependencies, directNames, result);
-      }
-    }
-  }
-};
-
-// src/scanners/nuget/nuget-scanner.ts
-import { readFile as readFile2 } from "fs/promises";
-import { existsSync as existsSync2 } from "fs";
-import path2 from "path";
-var NugetScanner = class {
-  ecosystem = "nuget";
-  lockfileNames = ["packages.lock.json"];
-  async detect(projectPath) {
-    const lockfilePath = path2.join(projectPath, "packages.lock.json");
-    return existsSync2(lockfilePath) ? lockfilePath : null;
-  }
-  async scan(projectPath, lockfilePath) {
-    const lockfileRaw = await readFile2(lockfilePath, "utf-8");
-    let lockfile;
-    try {
-      lockfile = JSON.parse(lockfileRaw);
-    } catch {
-      throw new LockfileParseError(lockfilePath, "Invalid JSON");
-    }
-    if (!lockfile.dependencies) {
-      throw new LockfileParseError(lockfilePath, 'Missing "dependencies" field');
-    }
-    const dependencies = this.parseLockfile(lockfile);
-    return {
-      projectPath,
-      ecosystem: "nuget",
-      dependencies,
-      lockfilePath,
-      scannedAt: (/* @__PURE__ */ new Date()).toISOString()
-    };
-  }
-  /**
-   * Parses packages.lock.json and extracts dependencies across all
-   * target frameworks. Deduplicates by package name (keeps highest version
-   * if the same package appears under multiple frameworks).
-   */
-  parseLockfile(lockfile) {
-    const depMap = /* @__PURE__ */ new Map();
-    for (const [_framework, packages] of Object.entries(lockfile.dependencies)) {
-      for (const [name, info] of Object.entries(packages)) {
-        if (!info.resolved) continue;
-        const isDirect = info.type === "Direct";
-        const existing = depMap.get(name);
-        if (!existing) {
-          depMap.set(name, {
-            name,
-            version: info.resolved,
-            direct: isDirect,
-            ecosystem: "nuget",
-            purl: this.buildPurl(name, info.resolved)
-          });
-        } else if (isDirect && !existing.direct) {
-          existing.direct = true;
-        }
-      }
-    }
-    return Array.from(depMap.values());
-  }
-  /**
-   * Builds a purl for a NuGet package.
-   * NuGet purls are straightforward: pkg:nuget/Name@Version
-   */
-  buildPurl(name, version) {
-    return `pkg:nuget/${name}@${version}`;
-  }
-};
-
-// src/scanners/cargo/cargo-scanner.ts
-import { readFile as readFile3 } from "fs/promises";
-import { existsSync as existsSync3 } from "fs";
-import path3 from "path";
-var CargoScanner = class {
-  ecosystem = "cargo";
-  lockfileNames = ["Cargo.lock"];
-  async detect(projectPath) {
-    const lockfilePath = path3.join(projectPath, "Cargo.lock");
-    return existsSync3(lockfilePath) ? lockfilePath : null;
-  }
-  async scan(projectPath, lockfilePath) {
-    const [lockfileRaw, cargoTomlRaw] = await Promise.all([
-      readFile3(lockfilePath, "utf-8"),
-      readFile3(path3.join(projectPath, "Cargo.toml"), "utf-8").catch(() => null)
-    ]);
-    const packages = this.parseLockfile(lockfileRaw, lockfilePath);
-    const directNames = cargoTomlRaw ? this.parseCargoToml(cargoTomlRaw) : /* @__PURE__ */ new Set();
-    const rootName = packages.length > 0 ? packages[0].name : null;
-    const dependencies = [];
-    for (const pkg2 of packages) {
-      if (pkg2.name === rootName && pkg2.source === void 0) continue;
-      dependencies.push({
-        name: pkg2.name,
-        version: pkg2.version,
-        direct: directNames.has(pkg2.name),
-        ecosystem: "cargo",
-        purl: this.buildPurl(pkg2.name, pkg2.version)
-      });
-    }
-    return {
-      projectPath,
-      ecosystem: "cargo",
-      dependencies,
-      lockfilePath,
-      scannedAt: (/* @__PURE__ */ new Date()).toISOString()
-    };
-  }
-  /**
-   * Parses Cargo.lock by splitting on [[package]] blocks.
-   * This is a lightweight parser that handles the regular structure
-   * of Cargo.lock without needing a full TOML parser.
-   */
-  parseLockfile(content, lockfilePath) {
-    const packages = [];
-    const blocks = content.split(/^\[\[package\]\]$/m);
-    for (const block of blocks) {
-      if (!block.trim()) continue;
-      const name = this.extractField(block, "name");
-      const version = this.extractField(block, "version");
-      const source = this.extractField(block, "source");
-      if (name && version) {
-        packages.push({ name, version, source: source || void 0 });
-      }
-    }
-    if (packages.length === 0 && content.includes("[[package]]")) {
-      throw new LockfileParseError(lockfilePath, "Failed to parse any packages from Cargo.lock");
-    }
-    return packages;
-  }
-  /**
-   * Extracts a string field value from a TOML block.
-   * Handles: `name = "value"` format.
-   */
-  extractField(block, fieldName) {
-    const regex = new RegExp(`^${fieldName}\\s*=\\s*"([^"]*)"`, "m");
-    const match = block.match(regex);
-    return match ? match[1] : null;
-  }
-  /**
-   * Parses Cargo.toml to extract direct dependency names.
-   * Looks for [dependencies] and [dev-dependencies] sections.
-   */
-  parseCargoToml(content) {
-    const directNames = /* @__PURE__ */ new Set();
-    let inDepsSection = false;
-    for (const rawLine of content.split("\n")) {
-      const line = rawLine.trim();
-      if (line.startsWith("[")) {
-        inDepsSection = line === "[dependencies]" || line === "[dev-dependencies]" || line === "[build-dependencies]";
-        continue;
-      }
-      if (inDepsSection && line && !line.startsWith("#")) {
-        const match = line.match(/^([a-zA-Z0-9_-]+)\s*=/);
-        if (match) {
-          directNames.add(match[1]);
-        }
-      }
-    }
-    return directNames;
-  }
-  /**
-   * Builds a purl for a Cargo (crates.io) package.
-   */
-  buildPurl(name, version) {
-    return `pkg:cargo/${name}@${version}`;
-  }
-};
-
-// src/scanners/pip/pip-scanner.ts
-import { readFile as readFile4 } from "fs/promises";
-import { existsSync as existsSync4 } from "fs";
-import path4 from "path";
-var PipScanner = class {
-  ecosystem = "pip";
-  lockfileNames = ["Pipfile.lock", "requirements.txt"];
-  async detect(projectPath) {
-    for (const lockfile of this.lockfileNames) {
-      const fullPath = path4.join(projectPath, lockfile);
-      if (existsSync4(fullPath)) return fullPath;
-    }
-    return null;
-  }
-  async scan(projectPath, lockfilePath) {
-    const raw = await readFile4(lockfilePath, "utf-8");
-    const filename = path4.basename(lockfilePath);
-    let dependencies;
-    if (filename === "Pipfile.lock") {
-      dependencies = this.parsePipfileLock(raw, lockfilePath);
-    } else {
-      dependencies = await this.parseRequirementsTxt(raw, lockfilePath);
-    }
-    return {
-      projectPath,
-      ecosystem: "pip",
-      dependencies,
-      lockfilePath,
-      scannedAt: (/* @__PURE__ */ new Date()).toISOString()
-    };
-  }
-  /**
-   * Parses `requirements.txt` format.
-   *
-   * Supports:
-   *   - `package==1.2.3` (pinned) — REQUIRED
-   *   - Comments (`#`) and blank lines are skipped
-   *   - `-r other-file.txt` (include directive) — recursively parsed
-   *   - `--index-url` and other pip flags — skipped
-   *
-   * Throws if any dependency is not strictly pinned with ==.
-   * Use `pip freeze` to generate a properly pinned requirements.txt.
-   */
-  async parseRequirementsTxt(content, lockfilePath, visited = /* @__PURE__ */ new Set()) {
-    const deps = [];
-    const currentDir = path4.dirname(lockfilePath);
-    const normalizedPath = path4.resolve(lockfilePath);
-    if (visited.has(normalizedPath)) {
-      return deps;
-    }
-    visited.add(normalizedPath);
-    for (const rawLine of content.split("\n")) {
-      const line = rawLine.trim();
-      if (!line || line.startsWith("#")) {
-        continue;
-      }
-      const includeMatch = line.match(/^-r\s+(.+)$/) || line.match(/^--requirement\s+(.+)$/);
-      if (includeMatch) {
-        const includePath = path4.resolve(currentDir, includeMatch[1].trim());
-        if (existsSync4(includePath)) {
-          const includeContent = await readFile4(includePath, "utf-8");
-          const includedDeps = await this.parseRequirementsTxt(includeContent, includePath, visited);
-          deps.push(...includedDeps);
-        }
-        continue;
-      }
-      if (line.startsWith("-") || line.startsWith("--")) {
-        continue;
-      }
-      const pinnedMatch = line.match(/^([a-zA-Z0-9_][a-zA-Z0-9._-]*)\s*==\s*([^,\s]+)$/);
-      if (pinnedMatch) {
-        const [, name, version] = pinnedMatch;
-        if (name && version) {
-          deps.push({
-            name: this.normalizePipName(name),
-            version,
-            direct: true,
-            // requirements.txt doesn't distinguish
-            ecosystem: "pip",
-            purl: this.buildPurl(name, version)
-          });
-        }
-        continue;
-      }
-      const depMatch = line.match(/^([a-zA-Z0-9_][a-zA-Z0-9._-]*)\s*([~=!<>].*)$/);
-      if (depMatch) {
-        throw new LockfileParseError(
-          lockfilePath,
-          `Non-pinned dependency detected: "${line}". Use pip freeze or Pipfile.lock.`
-        );
-      }
-    }
-    return deps;
-  }
-  /**
-   * Parses `Pipfile.lock` (JSON format from Pipenv).
-   *
-   * Structure:
-   * ```json
-   * {
-   *   "_meta": { ... },
-   *   "default": {
-   *     "requests": { "version": "==2.31.0", ... }
-   *   },
-   *   "develop": {
-   *     "pytest": { "version": "==7.4.0", ... }
-   *   }
-   * }
-   * ```
-   */
-  parsePipfileLock(content, lockfilePath) {
-    let lockfile;
-    try {
-      lockfile = JSON.parse(content);
-    } catch {
-      throw new LockfileParseError(lockfilePath, "Invalid JSON in Pipfile.lock");
-    }
-    const deps = [];
-    if (lockfile.default) {
-      for (const [name, info] of Object.entries(lockfile.default)) {
-        const version = info.version?.replace(/^==/, "") ?? "";
-        if (version) {
-          deps.push({
-            name: this.normalizePipName(name),
-            version,
-            direct: true,
-            ecosystem: "pip",
-            purl: this.buildPurl(name, version)
-          });
-        }
-      }
-    }
-    if (lockfile.develop) {
-      for (const [name, info] of Object.entries(lockfile.develop)) {
-        const version = info.version?.replace(/^==/, "") ?? "";
-        if (version) {
-          deps.push({
-            name: this.normalizePipName(name),
-            version,
-            direct: true,
-            ecosystem: "pip",
-            purl: this.buildPurl(name, version)
-          });
-        }
-      }
-    }
-    return deps;
-  }
-  /**
-   * Normalizes a pip package name per PEP 503.
-   * Converts to lowercase and replaces any run of [-_.] with a single hyphen.
-   */
-  normalizePipName(name) {
-    return name.toLowerCase().replace(/[-_.]+/g, "-");
-  }
-  /**
-   * Builds a purl for a PyPI package.
-   * Per purl spec, the type is "pypi" (not "pip").
-   */
-  buildPurl(name, version) {
-    return `pkg:pypi/${this.normalizePipName(name)}@${version}`;
-  }
-};
-
-// src/scanners/maven/maven-scanner.ts
-import { readFile as readFile5 } from "fs/promises";
-import { existsSync as existsSync5 } from "fs";
-import { execSync } from "child_process";
-import path5 from "path";
-var MavenScanner = class {
-  ecosystem = "maven";
-  lockfileNames = ["pom.xml"];
-  /** Allow injection for testing */
-  execSyncFn;
-  constructor(execSyncImpl) {
-    this.execSyncFn = execSyncImpl ?? execSync;
-  }
-  async detect(projectPath) {
-    const pomPath = path5.join(projectPath, "pom.xml");
-    return existsSync5(pomPath) ? pomPath : null;
-  }
-  async scan(projectPath, _lockfilePath) {
-    const pomPath = path5.join(projectPath, "pom.xml");
-    const pomContent = await readFile5(pomPath, "utf-8").catch(() => null);
-    const directDeps = pomContent ? this.parsePomDependencies(pomContent) : /* @__PURE__ */ new Set();
-    const depTreePath = path5.join(projectPath, "dependency-tree.txt");
-    if (existsSync5(depTreePath)) {
-      const content = await readFile5(depTreePath, "utf-8");
-      const dependencies = this.parseDependencyList(content, directDeps);
-      return this.buildResult(projectPath, depTreePath, dependencies);
-    }
-    if (this.isMavenAvailable()) {
-      const output = this.runMavenDependencyList(projectPath);
-      const dependencies = this.parseDependencyList(output, directDeps);
-      return this.buildResult(projectPath, pomPath, dependencies);
-    }
-    throw new LockfileParseError(
-      pomPath,
-      "Maven project detected (pom.xml found) but could not resolve dependencies. Either install Maven (`mvn` must be on $PATH) or pre-generate a dependency list:\n  mvn dependency:list -DoutputFile=dependency-tree.txt -DappendOutput=true"
-    );
-  }
-  /**
-   * Parses pom.xml to extract direct dependency coordinates (groupId:artifactId).
-   * This is a simple regex-based parser that handles standard dependency declarations.
-   */
-  parsePomDependencies(pomContent) {
-    const directDeps = /* @__PURE__ */ new Set();
-    const depBlockRegex = /<dependency>\s*([\s\S]*?)<\/dependency>/g;
-    const groupIdRegex = /<groupId>\s*([^<]+)\s*<\/groupId>/;
-    const artifactIdRegex = /<artifactId>\s*([^<]+)\s*<\/artifactId>/;
-    let match;
-    while ((match = depBlockRegex.exec(pomContent)) !== null) {
-      const block = match[1];
-      const groupMatch = block.match(groupIdRegex);
-      const artifactMatch = block.match(artifactIdRegex);
-      if (groupMatch && artifactMatch) {
-        const groupId = groupMatch[1].trim();
-        const artifactId = artifactMatch[1].trim();
-        directDeps.add(`${groupId}:${artifactId}`);
-      }
-    }
-    return directDeps;
-  }
-  /**
-   * Parses Maven `dependency:list` output.
-   *
-   * Each dependency line has the format:
-   *   groupId:artifactId:type:version:scope (5 parts)
-   *   groupId:artifactId:type:classifier:version:scope (6 parts)
-   *
-   * Lines are typically indented with leading whitespace.
-   */
-  parseDependencyList(content, directDeps) {
-    const deps = [];
-    const seen = /* @__PURE__ */ new Set();
-    for (const rawLine of content.split("\n")) {
-      const line = rawLine.trim();
-      if (!line) continue;
-      const parts = line.split(":");
-      if (parts.length < 5) continue;
-      const groupId = parts[0];
-      const artifactId = parts[1];
-      let version;
-      let scope;
-      if (parts.length >= 6) {
-        version = parts[4];
-        scope = parts[5];
-      } else {
-        version = parts[3];
-        scope = parts[4];
-      }
-      if (!groupId || !artifactId || !version) continue;
-      if (scope === "test") continue;
-      const name = `${groupId}:${artifactId}`;
-      if (seen.has(name)) continue;
-      seen.add(name);
-      const isDirect = directDeps.has(name);
-      deps.push({
-        name,
-        version,
-        direct: isDirect,
-        ecosystem: "maven",
-        purl: this.buildPurl(groupId, artifactId, version)
-      });
-    }
-    return deps;
-  }
-  /** Checks if `mvn` is available on PATH */
-  isMavenAvailable() {
-    try {
-      this.execSyncFn("mvn --version", { stdio: "pipe", timeout: 1e4 });
-      return true;
-    } catch {
-      return false;
-    }
-  }
-  /**
-   * Runs `mvn dependency:list` and returns the output.
-   */
-  runMavenDependencyList(projectPath) {
-    try {
-      const output = this.execSyncFn(
-        "mvn dependency:list -DoutputType=text -DincludeScope=compile",
-        {
-          cwd: projectPath,
-          stdio: "pipe",
-          timeout: 12e4,
-          // 2 minute timeout
-          encoding: "utf-8"
-        }
-      );
-      return output.toString();
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      throw new LockfileParseError(
-        path5.join(projectPath, "pom.xml"),
-        `Failed to run 'mvn dependency:list': ${message}`
-      );
-    }
-  }
-  /**
-   * Builds a purl for a Maven package.
-   * Format: pkg:maven/groupId/artifactId@version
-   */
-  buildPurl(groupId, artifactId, version) {
-    return `pkg:maven/${groupId}/${artifactId}@${version}`;
-  }
-  buildResult(projectPath, lockfilePath, dependencies) {
-    return {
-      projectPath,
-      ecosystem: "maven",
-      dependencies,
-      lockfilePath,
-      scannedAt: (/* @__PURE__ */ new Date()).toISOString()
-    };
-  }
-};
-
-// src/scanners/go/go-scanner.ts
-import { readFile as readFile6 } from "fs/promises";
-import { existsSync as existsSync6 } from "fs";
-import path6 from "path";
-var GoScanner = class {
-  ecosystem = "go";
-  lockfileNames = ["go.sum"];
-  async detect(projectPath) {
-    const goSumPath = path6.join(projectPath, "go.sum");
-    return existsSync6(goSumPath) ? goSumPath : null;
-  }
-  async scan(projectPath, lockfilePath) {
-    const [goSumRaw, goModRaw] = await Promise.all([
-      readFile6(lockfilePath, "utf-8"),
-      readFile6(path6.join(projectPath, "go.mod"), "utf-8").catch(() => null)
-    ]);
-    const { directNames, indirectNames } = goModRaw ? this.parseGoMod(goModRaw) : { directNames: /* @__PURE__ */ new Set(), indirectNames: /* @__PURE__ */ new Set() };
-    const dependencies = this.parseGoSum(goSumRaw, lockfilePath, directNames, indirectNames);
-    return {
-      projectPath,
-      ecosystem: "go",
-      dependencies,
-      lockfilePath,
-      scannedAt: (/* @__PURE__ */ new Date()).toISOString()
-    };
-  }
-  /**
-   * Parses go.sum and extracts unique module dependencies.
-   *
-   * Each module may appear twice in go.sum (once for the source archive,
-   * once for go.mod). We deduplicate by module path + version, keeping
-   * only the `h1:` entry (not the `/go.mod` entry).
-   */
-  parseGoSum(content, lockfilePath, directNames, indirectNames) {
-    const depMap = /* @__PURE__ */ new Map();
-    for (const rawLine of content.split("\n")) {
-      const line = rawLine.trim();
-      if (!line) continue;
-      const parts = line.split(/\s+/);
-      if (parts.length < 3) continue;
-      const modulePath = parts[0];
-      let version = parts[1];
-      if (version.endsWith("/go.mod")) continue;
-      version = version.replace(/\+incompatible$/, "");
-      const key = `${modulePath}@${version}`;
-      if (depMap.has(key)) continue;
-      const isDirect = directNames.size > 0 || indirectNames.size > 0 ? directNames.has(modulePath) || (!indirectNames.has(modulePath) && !directNames.has(modulePath) ? false : directNames.has(modulePath)) : true;
-      depMap.set(key, {
-        name: modulePath,
-        version,
-        direct: isDirect,
-        ecosystem: "go",
-        purl: this.buildPurl(modulePath, version)
-      });
-    }
-    return Array.from(depMap.values());
-  }
-  /**
-   * Parses go.mod to extract direct and indirect dependency names.
-   *
-   * Handles both single-line and block `require` directives:
-   * ```
-   * require github.com/pkg/errors v0.9.1
-   *
-   * require (
-   *     github.com/gin-gonic/gin v1.9.1
-   *     golang.org/x/text v0.14.0 // indirect
-   * )
-   * ```
-   */
-  parseGoMod(content) {
-    const directNames = /* @__PURE__ */ new Set();
-    const indirectNames = /* @__PURE__ */ new Set();
-    let inRequireBlock = false;
-    for (const rawLine of content.split("\n")) {
-      const line = rawLine.trim();
-      if (line.startsWith("require ") && !line.includes("(")) {
-        const match = line.match(/^require\s+(\S+)\s+\S+(.*)$/);
-        if (match) {
-          const modulePath = match[1];
-          const rest = match[2];
-          if (rest.includes("// indirect")) {
-            indirectNames.add(modulePath);
-          } else {
-            directNames.add(modulePath);
-          }
-        }
-        continue;
-      }
-      if (line === "require (" || line.startsWith("require (")) {
-        inRequireBlock = true;
-        continue;
-      }
-      if (inRequireBlock && line === ")") {
-        inRequireBlock = false;
-        continue;
-      }
-      if (inRequireBlock && line && !line.startsWith("//")) {
-        const match = line.match(/^(\S+)\s+\S+(.*)$/);
-        if (match) {
-          const modulePath = match[1];
-          const rest = match[2];
-          if (rest.includes("// indirect")) {
-            indirectNames.add(modulePath);
-          } else {
-            directNames.add(modulePath);
-          }
-        }
-      }
-    }
-    return { directNames, indirectNames };
-  }
-  /**
-   * Builds a purl for a Go module.
-   *
-   * Per purl spec, the type is "golang" and the module path
-   * uses `/` separators (no encoding needed for path segments).
-   *
-   * Example: `pkg:golang/github.com/gin-gonic/gin@v1.9.1`
-   */
-  buildPurl(modulePath, version) {
-    return `pkg:golang/${modulePath}@${version}`;
-  }
-};
-
-// src/scanners/ruby/ruby-scanner.ts
-import { readFile as readFile7 } from "fs/promises";
-import { existsSync as existsSync7 } from "fs";
-import path7 from "path";
-var RubyScanner = class {
-  ecosystem = "ruby";
-  lockfileNames = ["Gemfile.lock"];
-  async detect(projectPath) {
-    const lockfilePath = path7.join(projectPath, "Gemfile.lock");
-    return existsSync7(lockfilePath) ? lockfilePath : null;
-  }
-  async scan(projectPath, lockfilePath) {
-    const content = await readFile7(lockfilePath, "utf-8");
-    const specs = this.parseSpecs(content, lockfilePath);
-    const directNames = this.parseDependencies(content);
-    const dependencies = specs.map(({ name, version }) => ({
-      name,
-      version,
-      direct: directNames.has(name),
-      ecosystem: "ruby",
-      purl: `pkg:gem/${name}@${version}`
-    }));
-    return {
-      projectPath,
-      ecosystem: "ruby",
-      dependencies,
-      lockfilePath,
-      scannedAt: (/* @__PURE__ */ new Date()).toISOString()
-    };
-  }
-  /**
-   * Parses the GEM > specs section to extract all resolved gems.
-   *
-   * Gems at the top level of the specs section (indented 4 spaces) are
-   * resolved packages. Their sub-dependencies (indented 6+ spaces) are
-   * constraints, not separate entries — those sub-deps appear as their
-   * own top-level spec entries elsewhere.
-   *
-   * Format: `    gem-name (1.2.3)`
-   */
-  parseSpecs(content, lockfilePath) {
-    const gems = [];
-    let inGemSection = false;
-    let inSpecs = false;
-    for (const rawLine of content.split("\n")) {
-      const line = rawLine;
-      if (line.length > 0 && line[0] !== " ") {
-        if (line.startsWith("GEM")) {
-          inGemSection = true;
-          inSpecs = false;
-          continue;
-        }
-        inGemSection = false;
-        inSpecs = false;
-        continue;
-      }
-      if (inGemSection && line.trimStart().startsWith("specs:")) {
-        inSpecs = true;
-        continue;
-      }
-      if (!inSpecs) continue;
-      const match = line.match(/^ {4}(\S+)\s+\(([^)]+)\)$/);
-      if (match) {
-        const [, name, version] = match;
-        gems.push({ name, version });
-      }
-    }
-    if (gems.length === 0) {
-      throw new LockfileParseError(
-        lockfilePath,
-        "No gems found in GEM specs section"
-      );
-    }
-    return gems;
-  }
-  /**
-   * Parses the DEPENDENCIES section to get direct dependency names.
-   *
-   * Format: `  gem-name (>= 1.0)` or `  gem-name`
-   * The version constraint is optional and we only need the name.
-   */
-  parseDependencies(content) {
-    const directNames = /* @__PURE__ */ new Set();
-    let inDependencies = false;
-    for (const rawLine of content.split("\n")) {
-      const line = rawLine;
-      if (line.length > 0 && line[0] !== " ") {
-        if (line.startsWith("DEPENDENCIES")) {
-          inDependencies = true;
-          continue;
-        }
-        if (inDependencies) break;
-        continue;
-      }
-      if (!inDependencies) continue;
-      const match = line.match(/^ {2}(\S+?)!?\s*(?:\(|$)/);
-      if (match) {
-        directNames.add(match[1]);
-      }
-    }
-    return directNames;
-  }
-};
-
-// src/scanners/composer/composer-scanner.ts
-import { readFile as readFile8 } from "fs/promises";
-import { existsSync as existsSync8 } from "fs";
-import path8 from "path";
-var ComposerScanner = class {
-  ecosystem = "composer";
-  lockfileNames = ["composer.lock"];
-  async detect(projectPath) {
-    const lockfilePath = path8.join(projectPath, "composer.lock");
-    return existsSync8(lockfilePath) ? lockfilePath : null;
-  }
-  async scan(projectPath, lockfilePath) {
-    const [lockRaw, manifestRaw] = await Promise.all([
-      readFile8(lockfilePath, "utf-8"),
-      readFile8(path8.join(projectPath, "composer.json"), "utf-8").catch(() => null)
-    ]);
-    const directNames = manifestRaw ? this.parseComposerManifest(manifestRaw) : null;
-    const dependencies = this.parseComposerLock(lockRaw, lockfilePath, directNames);
-    return {
-      projectPath,
-      ecosystem: "composer",
-      dependencies,
-      lockfilePath,
-      scannedAt: (/* @__PURE__ */ new Date()).toISOString()
-    };
-  }
-  parseComposerLock(content, lockfilePath, directNames) {
-    let lock;
-    try {
-      lock = JSON.parse(content);
-    } catch {
-      throw new LockfileParseError(lockfilePath, "Invalid JSON in composer.lock");
-    }
-    const allPackages = [...lock.packages ?? [], ...lock["packages-dev"] ?? []];
-    if (allPackages.length === 0) {
-      throw new LockfileParseError(lockfilePath, "No packages found in composer.lock");
-    }
-    return allPackages.filter((pkg2) => pkg2.name && pkg2.version).map((pkg2) => ({
-      name: pkg2.name,
-      version: this.normalizeVersion(pkg2.version),
-      direct: directNames ? directNames.has(pkg2.name) : true,
-      ecosystem: "composer",
-      purl: this.buildPurl(pkg2.name, this.normalizeVersion(pkg2.version))
-    }));
-  }
-  parseComposerManifest(content) {
-    let manifest;
-    try {
-      manifest = JSON.parse(content);
-    } catch {
-      return /* @__PURE__ */ new Set();
-    }
-    const names = /* @__PURE__ */ new Set();
-    for (const section of [manifest.require ?? {}, manifest["require-dev"] ?? {}]) {
-      for (const name of Object.keys(section)) {
-        if (name === "php" || name.startsWith("ext-") || name.startsWith("lib-")) continue;
-        names.add(name);
-      }
-    }
-    return names;
-  }
-  normalizeVersion(version) {
-    return version.trim();
-  }
-  buildPurl(name, version) {
-    return `pkg:composer/${name}@${version}`;
-  }
-};
-
-// src/scanners/yarn/yarn-scanner.ts
-import { readFile as readFile9 } from "fs/promises";
-import { existsSync as existsSync9 } from "fs";
-import path9 from "path";
-import { parse as parseYaml } from "yaml";
-var YarnScanner = class {
-  ecosystem = "npm";
-  lockfileNames = ["yarn.lock"];
-  async detect(projectPath) {
-    const lockfilePath = path9.join(projectPath, "yarn.lock");
-    return existsSync9(lockfilePath) ? lockfilePath : null;
-  }
-  async scan(projectPath, lockfilePath) {
-    const [lockfileRaw, packageJsonRaw] = await Promise.all([
-      readFile9(lockfilePath, "utf-8"),
-      readFile9(path9.join(projectPath, "package.json"), "utf-8").catch(() => null)
-    ]);
-    const directNames = /* @__PURE__ */ new Set();
-    if (packageJsonRaw) {
-      try {
-        const pkg2 = JSON.parse(packageJsonRaw);
-        for (const name of Object.keys(pkg2.dependencies ?? {})) {
-          directNames.add(name);
-        }
-        for (const name of Object.keys(pkg2.devDependencies ?? {})) {
-          directNames.add(name);
-        }
-      } catch {
-      }
-    }
-    const dependencies = this.parseLockfile(lockfileRaw, lockfilePath, directNames);
-    return {
-      projectPath,
-      ecosystem: "npm",
-      dependencies,
-      lockfilePath,
-      scannedAt: (/* @__PURE__ */ new Date()).toISOString()
-    };
-  }
-  /**
-   * Parses yarn.lock file and extracts dependencies.
-   * Automatically detects and handles both v1 (Classic) and v2+ (Berry) formats.
-   */
-  parseLockfile(content, lockfilePath, directNames) {
-    try {
-      const isV2Plus = this.isYarnV2Plus(content);
-      if (isV2Plus) {
-        return this.parseLockfileV2Plus(content, lockfilePath, directNames);
-      } else {
-        return this.parseLockfileV1(content, lockfilePath, directNames);
-      }
-    } catch (err) {
-      throw new LockfileParseError(
-        lockfilePath,
-        `Failed to parse yarn.lock: ${err instanceof Error ? err.message : "Unknown error"}`
-      );
-    }
-  }
-  /**
-   * Detects if the lockfile is Yarn v2+ (Berry) format.
-   * v2+ uses YAML format and contains __metadata section.
-   */
-  isYarnV2Plus(content) {
-    return content.startsWith("__metadata:") || content.includes("\n__metadata:");
-  }
-  /**
-   * Parses Yarn v2+ (Berry) lockfile format.
-   * 
-   * Yarn v2+ format (YAML):
-   * ```yaml
-   * __metadata:
-   *   version: 6
-   * 
-   * "package-name@npm:^1.0.0":
-   *   version: 1.2.3
-   *   resolution: "package-name@npm:1.2.3"
-   *   dependencies:
-   *     dep1: ^2.0.0
-   *   checksum: ...
-   *   languageName: node
-   *   linkType: hard
-   * ```
-   */
-  parseLockfileV2Plus(content, lockfilePath, directNames) {
-    const deps = [];
-    const seen = /* @__PURE__ */ new Map();
-    try {
-      const parsed = parseYaml(content);
-      if (!parsed || typeof parsed !== "object") {
-        throw new Error("Invalid YAML format");
-      }
-      for (const [key, value] of Object.entries(parsed)) {
-        if (key === "__metadata" || key.includes("@workspace:")) {
-          continue;
-        }
-        if (typeof value !== "object" || value === null) {
-          continue;
-        }
-        const entry = value;
-        let name = null;
-        if (entry.resolution && typeof entry.resolution === "string") {
-          name = this.extractPackageNameFromResolution(entry.resolution);
-        }
-        if (!name) {
-          name = this.extractPackageNameV2Plus(key);
-        }
-        const version = entry.version;
-        if (!name || !version || typeof version !== "string") {
-          continue;
-        }
-        const depKey = `${name}@${version}`;
-        if (seen.has(depKey)) {
-          continue;
-        }
-        seen.set(depKey, true);
-        deps.push({
-          name,
-          version,
-          direct: directNames.has(name),
-          ecosystem: "npm",
-          purl: this.buildPurl(name, version)
-        });
-      }
-    } catch (err) {
-      throw new Error(`Failed to parse Yarn v2+ lockfile: ${err instanceof Error ? err.message : "Unknown error"}`);
-    }
-    return deps;
-  }
-  /**
-   * Extracts package name from Yarn v2+ resolution field.
-   * The resolution field contains the real package name.
-   * Examples:
-   *   "express@npm:4.18.2" → "express"
-   *   "@types/node@npm:20.11.5" → "@types/node"
-   *   "lodash@npm:4.17.21" → "lodash"
-   */
-  extractPackageNameFromResolution(resolution) {
-    if (resolution.startsWith("@")) {
-      const match2 = resolution.match(/^(@[^@]+\/[^@]+)@/);
-      if (match2) {
-        return match2[1];
-      }
-    }
-    const match = resolution.match(/^([^@]+)@/);
-    if (match) {
-      return match[1];
-    }
-    return null;
-  }
-  /**
-   * Extracts package name from Yarn v2+ package key.
-   * Examples:
-   *   "express@npm:^4.18.0" → "express"
-   *   "@types/node@npm:^20.0.0" → "@types/node"
-   *   "pkg@npm:other@npm:^1.0.0" → "pkg" (aliased packages)
-   */
-  extractPackageNameV2Plus(key) {
-    if (key.startsWith("@")) {
-      const match2 = key.match(/^(@[^@]+\/[^@]+)@/);
-      if (match2) {
-        return match2[1];
-      }
-    }
-    const match = key.match(/^([^@]+)@/);
-    if (match) {
-      return match[1];
-    }
-    return null;
-  }
-  /**
-   * Parses Yarn v1 (Classic) lockfile format.
-   *
-   * Yarn v1 format:
-   * ```
-   * "package-name@^1.0.0":
-   *   version "1.2.3"
-   *   resolved "https://..."
-   *   integrity sha512-...
-   *   dependencies:
-   *     dep1 "^2.0.0"
-   * ```
-   */
-  parseLockfileV1(content, lockfilePath, directNames) {
-    const deps = [];
-    const seen = /* @__PURE__ */ new Map();
-    const lines = content.split("\n");
-    let currentPackage = null;
-    for (let i = 0; i < lines.length; i++) {
-      const line = lines[i];
-      if (line.trim().startsWith("#") || line.trim() === "") {
-        continue;
-      }
-      if (line.match(/^["\w@]/) && line.includes(":") && !line.startsWith("  ")) {
-        if (currentPackage?.version) {
-          this.addDependency(currentPackage, directNames, seen, deps);
-        }
-        const pkgLine = line.substring(0, line.lastIndexOf(":"));
-        const names = pkgLine.split(",").map((s) => s.trim().replace(/^["']|["']$/g, "")).map((s) => this.extractPackageName(s)).filter((s) => !!s);
-        currentPackage = { names, version: void 0 };
-      } else if (line.trim().startsWith("version ") && currentPackage) {
-        const match = line.match(/version\s+"([^"]+)"/);
-        if (match) {
-          currentPackage.version = match[1];
-        }
-      }
-    }
-    if (currentPackage?.version) {
-      this.addDependency(currentPackage, directNames, seen, deps);
-    }
-    return deps;
-  }
-  /**
-   * Adds a dependency to the result list (deduplicates by name@version)
-   */
-  addDependency(pkg2, directNames, seen, deps) {
-    if (!pkg2.version) return;
-    const name = pkg2.names[0];
-    if (!name) return;
-    const key = `${name}@${pkg2.version}`;
-    if (seen.has(key)) return;
-    seen.set(key, true);
-    deps.push({
-      name,
-      version: pkg2.version,
-      direct: directNames.has(name),
-      ecosystem: "npm",
-      purl: this.buildPurl(name, pkg2.version)
-    });
-  }
-  /**
-   * Extracts package name from yarn.lock package declaration.
-   * Examples:
-   *   "express@^4.18.0" → "express"
-   *   "@types/node@^20.0.0" → "@types/node"
-   *   "pkg@npm:other@^1.0.0" → "pkg" (aliased packages)
-   */
-  extractPackageName(pkgDeclaration) {
-    if (pkgDeclaration.includes("@npm:")) {
-      const beforeAlias = pkgDeclaration.split("@npm:")[0];
-      return beforeAlias || null;
-    }
-    if (pkgDeclaration.startsWith("@")) {
-      const parts = pkgDeclaration.split("@");
-      if (parts.length >= 3) {
-        return `@${parts[1]}`;
-      }
-    } else {
-      const atIndex = pkgDeclaration.indexOf("@");
-      if (atIndex > 0) {
-        return pkgDeclaration.substring(0, atIndex);
-      }
-    }
-    return null;
-  }
-  /**
-   * Builds a purl (Package URL) for an npm package.
-   *
-   * Per the purl spec:
-   * "The npm scope @ sign prefix is always percent encoded."
-   *
-   * So @types/node@20.11.5 → pkg:npm/%40types/node@20.11.5
-   * And express@4.18.2 → pkg:npm/express@4.18.2
-   */
-  buildPurl(name, version) {
-    if (name.startsWith("@")) {
-      return `pkg:npm/%40${name.slice(1)}@${version}`;
-    }
-    return `pkg:npm/${name}@${version}`;
-  }
-};
-
-// src/scanners/pnpm/pnpm-scanner.ts
-import { readFile as readFile10 } from "fs/promises";
-import { existsSync as existsSync10 } from "fs";
-import path10 from "path";
-import { parse as parseYaml2 } from "yaml";
-var PnpmScanner = class {
-  ecosystem = "npm";
-  lockfileNames = ["pnpm-lock.yaml"];
-  async detect(projectPath) {
-    const lockfilePath = path10.join(projectPath, "pnpm-lock.yaml");
-    return existsSync10(lockfilePath) ? lockfilePath : null;
-  }
-  async scan(projectPath, lockfilePath) {
-    const lockfileRaw = await readFile10(lockfilePath, "utf-8");
-    const dependencies = this.parseLockfile(lockfileRaw, lockfilePath);
-    return {
-      projectPath,
-      ecosystem: "npm",
-      dependencies,
-      lockfilePath,
-      scannedAt: (/* @__PURE__ */ new Date()).toISOString()
-    };
-  }
-  /**
-   * Parses pnpm-lock.yaml file and extracts dependencies.
-   * 
-   * pnpm-lock.yaml format (v5.4+):
-   * ```yaml
-   * lockfileVersion: 5.4
-   * 
-   * dependencies:
-   *   express: 4.18.2
-   * 
-   * devDependencies:
-   *   typescript: 5.0.0
-   * 
-   * packages:
-   *   /express/4.18.2:
-   *     resolution: {integrity: sha512-...}
-   *     dependencies:
-   *       accepts: 1.3.8
-   *   /@types/node/20.11.5:
-   *     resolution: {integrity: sha512-...}
-   *     dev: true
-   * ```
-   * 
-   * pnpm-lock.yaml format (v6.0+):
-   * ```yaml
-   * lockfileVersion: '6.0'
-   * 
-   * dependencies:
-   *   express:
-   *     specifier: ^4.18.0
-   *     version: 4.18.2
-   * 
-   * packages:
-   *   /express@4.18.2:
-   *     resolution: {integrity: sha512-...}
-   * ```
-   */
-  parseLockfile(content, lockfilePath) {
-    try {
-      const parsed = parseYaml2(content);
-      if (!parsed || typeof parsed !== "object") {
-        throw new Error("Invalid YAML format");
-      }
-      const lockfile = parsed;
-      const lockfileVersion = this.parseLockfileVersion(lockfile.lockfileVersion);
-      const directNames = this.extractDirectDependencies(lockfile);
-      return this.extractDependencies(lockfile, lockfileVersion, directNames);
-    } catch (err) {
-      throw new LockfileParseError(
-        lockfilePath,
-        `Failed to parse pnpm-lock.yaml: ${err instanceof Error ? err.message : "Unknown error"}`
-      );
-    }
-  }
-  /**
-   * Extracts direct dependency names from pnpm lockfile.
-   * 
-   * Supports both formats:
-   * - pnpm v5.x: root-level dependencies/devDependencies
-   * - pnpm v6+: importers['.'].dependencies/devDependencies
-   */
-  extractDirectDependencies(lockfile) {
-    const directNames = /* @__PURE__ */ new Set();
-    if (lockfile.importers && typeof lockfile.importers === "object") {
-      const rootImporter = lockfile.importers["."];
-      if (rootImporter && typeof rootImporter === "object") {
-        if (rootImporter.dependencies && typeof rootImporter.dependencies === "object") {
-          for (const name of Object.keys(rootImporter.dependencies)) {
-            directNames.add(name);
-          }
-        }
-        if (rootImporter.devDependencies && typeof rootImporter.devDependencies === "object") {
-          for (const name of Object.keys(rootImporter.devDependencies)) {
-            directNames.add(name);
-          }
-        }
-      }
-    }
-    if (directNames.size === 0) {
-      if (lockfile.dependencies && typeof lockfile.dependencies === "object") {
-        for (const name of Object.keys(lockfile.dependencies)) {
-          directNames.add(name);
-        }
-      }
-      if (lockfile.devDependencies && typeof lockfile.devDependencies === "object") {
-        for (const name of Object.keys(lockfile.devDependencies)) {
-          directNames.add(name);
-        }
-      }
-    }
-    return directNames;
-  }
-  /**
-   * Parses lockfile version (can be string or number)
-   */
-  parseLockfileVersion(version) {
-    if (typeof version === "number") {
-      return version;
-    }
-    if (typeof version === "string") {
-      const parsed = parseFloat(version);
-      return isNaN(parsed) ? 5.4 : parsed;
-    }
-    return 5.4;
-  }
-  /**
-   * Extracts dependencies from the lockfile packages section
-   */
-  extractDependencies(lockfile, lockfileVersion, directNames) {
-    const deps = [];
-    const seen = /* @__PURE__ */ new Map();
-    if (!lockfile.packages || typeof lockfile.packages !== "object") {
-      return deps;
-    }
-    for (const [pkgPath, pkgInfo] of Object.entries(lockfile.packages)) {
-      if (!pkgInfo || typeof pkgInfo !== "object") {
-        continue;
-      }
-      if (pkgPath.includes("@workspace:")) {
-        continue;
-      }
-      const { name, version } = this.parsePackagePath(pkgPath, lockfileVersion);
-      if (!name || !version) {
-        continue;
-      }
-      const depKey = `${name}@${version}`;
-      if (seen.has(depKey)) {
-        continue;
-      }
-      seen.set(depKey, true);
-      deps.push({
-        name,
-        version,
-        direct: directNames.has(name),
-        ecosystem: "npm",
-        purl: this.buildPurl(name, version)
-      });
-    }
-    return deps;
-  }
-  /**
-   * Parses package path to extract name and version.
-   * 
-   * pnpm v5.x format:
-   *   "/express/4.18.2" → name: "express", version: "4.18.2"
-   *   "/@types/node/20.11.5" → name: "@types/node", version: "20.11.5"
-   *   "/accepts/1.3.8" → name: "accepts", version: "1.3.8"
-   * 
-   * pnpm v6+ format:
-   *   "/express@4.18.2" → name: "express", version: "4.18.2"
-   *   "/@types/node@20.11.5" → name: "@types/node", version: "20.11.5"
-   *   "/accepts@1.3.8" → name: "accepts", version: "1.3.8"
-   * 
-   * Also handles peer dependency suffixes:
-   *   "/pkg@1.0.0_dep@2.0.0" → name: "pkg", version: "1.0.0"
-   *   "/pkg@1.0.0(dep@2.0.0)" → name: "pkg", version: "1.0.0"
-   */
-  parsePackagePath(pkgPath, lockfileVersion) {
-    const path14 = pkgPath.startsWith("/") ? pkgPath.slice(1) : pkgPath;
-    const cleanPath = path14.split("_")[0].split("(")[0];
-    if (!cleanPath) {
-      return { name: null, version: null };
-    }
-    if (lockfileVersion >= 6) {
-      return this.parseV6Format(cleanPath);
-    }
-    return this.parseV5Format(cleanPath);
-  }
-  /**
-   * Parses v6+ format: "express@4.18.2" or "@types/node@20.11.5"
-   */
-  parseV6Format(path14) {
-    if (path14.startsWith("@")) {
-      const lastAtIndex = path14.lastIndexOf("@");
-      if (lastAtIndex <= 0) {
-        return { name: null, version: null };
-      }
-      const name2 = path14.substring(0, lastAtIndex);
-      const version2 = path14.substring(lastAtIndex + 1);
-      return { name: name2, version: version2 };
-    }
-    const atIndex = path14.indexOf("@");
-    if (atIndex < 0) {
-      return { name: null, version: null };
-    }
-    const name = path14.substring(0, atIndex);
-    const version = path14.substring(atIndex + 1);
-    return { name, version };
-  }
-  /**
-   * Parses v5.x format: "express/4.18.2" or "@types/node/20.11.5"
-   */
-  parseV5Format(path14) {
-    if (path14.startsWith("@")) {
-      const parts = path14.split("/");
-      if (parts.length < 3) {
-        return { name: null, version: null };
-      }
-      const name2 = `${parts[0]}/${parts[1]}`;
-      const version2 = parts[2];
-      return { name: name2, version: version2 };
-    }
-    const slashIndex = path14.indexOf("/");
-    if (slashIndex < 0) {
-      return { name: null, version: null };
-    }
-    const name = path14.substring(0, slashIndex);
-    const version = path14.substring(slashIndex + 1);
-    return { name, version };
-  }
-  /**
-   * Builds a purl (Package URL) for an npm package.
-   *
-   * Per the purl spec:
-   * "The npm scope @ sign prefix is always percent encoded."
-   *
-   * So @types/node@20.11.5 → pkg:npm/%40types/node@20.11.5
-   * And express@4.18.2 → pkg:npm/express@4.18.2
-   */
-  buildPurl(name, version) {
-    if (name.startsWith("@")) {
-      return `pkg:npm/%40${name.slice(1)}@${version}`;
-    }
-    return `pkg:npm/${name}@${version}`;
-  }
-};
-
-// src/scanners/deno/deno-scanner.ts
-import { readFile as readFile11 } from "fs/promises";
-import { existsSync as existsSync11 } from "fs";
-import path11 from "path";
-var DenoScanner = class {
-  ecosystem = "deno";
-  lockfileNames = ["deno.lock"];
-  async detect(projectPath) {
-    for (const name of this.lockfileNames) {
-      const lockfilePath = path11.join(projectPath, name);
-      if (existsSync11(lockfilePath)) return lockfilePath;
-    }
-    return null;
-  }
-  async scan(projectPath, lockfilePath) {
-    const lockfileRaw = await readFile11(lockfilePath, "utf-8");
-    let lockfile;
-    try {
-      lockfile = JSON.parse(lockfileRaw);
-    } catch {
-      throw new LockfileParseError(lockfilePath, "Invalid JSON");
-    }
-    const dependencies = this.parseLockfile(lockfile);
-    return {
-      projectPath,
-      ecosystem: "deno",
-      dependencies,
-      lockfilePath,
-      scannedAt: (/* @__PURE__ */ new Date()).toISOString()
-    };
-  }
-  /**
-   * Parses the lockfile and extracts dependencies from both
-   * npm and jsr package registries.
-   *
-   * Supports v3 (packages nested under `packages`), v4, and v5 (top-level jsr/npm sections).
-   * Uses lockfile specifiers to determine direct vs transitive dependencies.
-   */
-  parseLockfile(lockfile) {
-    const deps = [];
-    const directNames = this.extractDirectDependencies(lockfile);
-    const jsrPackages = lockfile.jsr ?? lockfile.packages?.jsr ?? {};
-    const npmPackages = lockfile.npm ?? lockfile.packages?.npm ?? {};
-    for (const key of Object.keys(jsrPackages)) {
-      const parsed = this.parsePackageKey(key);
-      if (!parsed) continue;
-      deps.push({
-        name: parsed.name,
-        version: parsed.version,
-        direct: directNames.has(`jsr:${parsed.name}`),
-        ecosystem: "deno",
-        // JSR packages belong to Deno ecosystem
-        purl: this.buildJsrPurl(parsed.name, parsed.version)
-      });
-    }
-    for (const key of Object.keys(npmPackages)) {
-      const parsed = this.parsePackageKey(key);
-      if (!parsed) continue;
-      deps.push({
-        name: parsed.name,
-        version: parsed.version,
-        direct: directNames.has(`npm:${parsed.name}`),
-        ecosystem: "npm",
-        // npm packages belong to npm ecosystem (for CVE tracking)
-        purl: this.buildNpmPurl(parsed.name, parsed.version)
-      });
-    }
-    return deps;
-  }
-  /**
-   * Extracts direct dependency names from lockfile specifiers.
-   *
-   * Returns a set of ecosystem-qualified package names like "jsr:@std/assert" or "npm:express".
-   * The ecosystem prefix prevents collisions if the same package name exists in both registries.
-   */
-  extractDirectDependencies(lockfile) {
-    const directNames = /* @__PURE__ */ new Set();
-    const specifiers = lockfile.specifiers ?? lockfile.packages?.specifiers ?? {};
-    for (const [constraint, resolved] of Object.entries(specifiers)) {
-      if (resolved.startsWith("file:") || resolved.startsWith("https:") || resolved.startsWith("http:") || resolved.startsWith("data:")) {
-        continue;
-      }
-      let ecosystem = null;
-      if (constraint.startsWith("jsr:")) {
-        ecosystem = "jsr";
-      } else if (constraint.startsWith("npm:")) {
-        ecosystem = "npm";
-      }
-      if (!ecosystem) continue;
-      let resolvedKey = resolved;
-      if (resolved.startsWith("jsr:") || resolved.startsWith("npm:")) {
-        resolvedKey = resolved.replace(/^(jsr:|npm:)/, "");
-        const parsed = this.parsePackageKey(resolvedKey);
-        if (parsed) {
-          directNames.add(`${ecosystem}:${parsed.name}`);
-        }
-      } else {
-        const name = this.extractNameFromSpecifier(constraint);
-        if (name) {
-          directNames.add(`${ecosystem}:${name}`);
-        }
-      }
-    }
-    return directNames;
-  }
-  /**
-   * Parses a package key like "@std/assert@1.0.10" or "express@4.21.2"
-   * into { name, version }.
-   *
-   * Handles scoped packages where the name starts with @ (e.g., @std/assert).
-   * In that case the version separator is the LAST @ sign.
-   */
-  parsePackageKey(key) {
-    const lastAtIndex = key.lastIndexOf("@");
-    if (lastAtIndex <= 0) return null;
-    const name = key.slice(0, lastAtIndex);
-    const version = key.slice(lastAtIndex + 1);
-    if (!name || !version) return null;
-    return { name, version };
-  }
-  /**
-   * Extracts the package name from a Deno import specifier.
-   *
-   * Examples:
-   *   "jsr:@std/assert@^1.0.0" → "@std/assert"
-   *   "npm:express@^4.18.0"    → "express"
-   *   "npm:@hono/hono@^4.0.0"  → "@hono/hono"
-   *   "lodash" (bare)          → "lodash"
-   */
-  extractNameFromSpecifier(specifier) {
-    const withoutPrefix = specifier.replace(/^(jsr:|npm:)/, "");
-    if (!withoutPrefix) return null;
-    if (withoutPrefix.startsWith("@")) {
-      const slashIndex = withoutPrefix.indexOf("/");
-      if (slashIndex === -1) return null;
-      const afterSlash = withoutPrefix.indexOf("@", slashIndex);
-      if (afterSlash === -1) return withoutPrefix;
-      return withoutPrefix.slice(0, afterSlash);
-    }
-    const atIndex = withoutPrefix.indexOf("@");
-    if (atIndex === -1) return withoutPrefix;
-    return withoutPrefix.slice(0, atIndex);
-  }
-  /**
-   * Builds a purl for a JSR package.
-   *
-   * JSR packages use the "jsr" purl type (non-standard but descriptive).
-   * For scoped packages, both @ and all / characters are percent-encoded.
-   * Example: `pkg:jsr/%40std%2Fassert@1.0.10`
-   */
-  buildJsrPurl(name, version) {
-    if (name.startsWith("@")) {
-      const encoded = "%40" + name.slice(1).replace(/\//g, "%2F");
-      return `pkg:jsr/${encoded}@${version}`;
-    }
-    return `pkg:jsr/${name}@${version}`;
-  }
-  /**
-   * Builds a purl for an npm package used via Deno.
-   *
-   * Uses the standard npm purl type since these are npm packages.
-   * Per npm purl spec, only @ is encoded, / remains as namespace separator.
-   * Example: `pkg:npm/%40std/assert@1.0.10` or `pkg:npm/express@4.21.2`
-   */
-  buildNpmPurl(name, version) {
-    if (name.startsWith("@")) {
-      return `pkg:npm/%40${name.slice(1)}@${version}`;
-    }
-    return `pkg:npm/${name}@${version}`;
-  }
-};
-
-// src/scanners/poetry/poetry-scanner.ts
-import { readFile as readFile12 } from "fs/promises";
-import { existsSync as existsSync12 } from "fs";
-import path12 from "path";
-var PoetryScanner = class {
-  ecosystem = "poetry";
-  lockfileNames = ["poetry.lock"];
-  async detect(projectPath) {
-    const lockfilePath = path12.join(projectPath, "poetry.lock");
-    return existsSync12(lockfilePath) ? lockfilePath : null;
-  }
-  async scan(projectPath, lockfilePath) {
-    const [lockfileRaw, pyprojectRaw] = await Promise.all([
-      readFile12(lockfilePath, "utf-8"),
-      readFile12(path12.join(projectPath, "pyproject.toml"), "utf-8").catch(() => null)
-    ]);
-    const packages = this.parseLockfile(lockfileRaw, lockfilePath);
-    const directNames = pyprojectRaw ? this.parsePyprojectToml(pyprojectRaw) : /* @__PURE__ */ new Set();
-    const dependencies = [];
-    for (const pkg2 of packages) {
-      dependencies.push({
-        name: this.normalizePipName(pkg2.name),
-        version: pkg2.version,
-        direct: directNames.size > 0 ? directNames.has(this.normalizePipName(pkg2.name)) : true,
-        ecosystem: "poetry",
-        purl: this.buildPurl(pkg2.name, pkg2.version)
-      });
-    }
-    return {
-      projectPath,
-      ecosystem: "poetry",
-      dependencies,
-      lockfilePath,
-      scannedAt: (/* @__PURE__ */ new Date()).toISOString()
-    };
-  }
-  /**
-   * Parses poetry.lock by splitting on [[package]] blocks.
-   * Lightweight parser that handles the regular structure
-   * without needing a full TOML library.
-   */
-  parseLockfile(content, lockfilePath) {
-    const packages = [];
-    const blocks = content.split(/^\[\[package\]\]$/m);
-    for (const block of blocks) {
-      if (!block.trim()) continue;
-      const name = this.extractField(block, "name");
-      const version = this.extractField(block, "version");
-      if (name && version) {
-        packages.push({ name, version });
-      }
-    }
-    if (packages.length === 0 && content.includes("[[package]]")) {
-      throw new LockfileParseError(lockfilePath, "Failed to parse any packages from poetry.lock");
-    }
-    return packages;
-  }
-  /**
-   * Extracts a string field value from a TOML block.
-   * Handles: `name = "value"` format.
-   */
-  extractField(block, fieldName) {
-    const regex = new RegExp(`^${fieldName}\\s*=\\s*"([^"]*)"`, "m");
-    const match = block.match(regex);
-    return match ? match[1] : null;
-  }
-  /**
-   * Parses `pyproject.toml` to extract direct dependency names.
-   *
-   * Looks for:
-   *   - `[tool.poetry.dependencies]` — main dependencies
-   *   - `[tool.poetry.group.dev.dependencies]` — dev dependencies
-   *   - `[tool.poetry.group.*.dependencies]` — other groups
-   *
-   * Supports formats:
-   *   - `requests = "^2.31.0"`
-   *   - `requests = { version = "^2.31.0", optional = true }`
-   *   - `python = "^3.12"` — skipped (the Python interpreter itself)
-   */
-  parsePyprojectToml(content) {
-    const directNames = /* @__PURE__ */ new Set();
-    let inDepsSection = false;
-    for (const rawLine of content.split("\n")) {
-      const line = rawLine.trim();
-      if (line.startsWith("[")) {
-        inDepsSection = line === "[tool.poetry.dependencies]" || /^\[tool\.poetry\.group\.[^\]]+\.dependencies\]$/.test(line);
-        continue;
-      }
-      if (inDepsSection && line && !line.startsWith("#")) {
-        const match = line.match(/^([a-zA-Z0-9_][a-zA-Z0-9._-]*)\s*=/);
-        if (match && match[1]) {
-          const name = this.normalizePipName(match[1]);
-          if (name !== "python") {
-            directNames.add(name);
-          }
-        }
-      }
-    }
-    return directNames;
-  }
-  /**
-   * Normalizes a pip package name per PEP 503.
-   * Converts to lowercase and replaces any run of [-_.] with a single hyphen.
-   */
-  normalizePipName(name) {
-    return name.toLowerCase().replace(/[-_.]+/g, "-");
-  }
-  /**
-   * Builds a purl for a PyPI package.
-   * Per purl spec, the type is "pypi" (not "poetry").
-   */
-  buildPurl(name, version) {
-    return `pkg:pypi/${this.normalizePipName(name)}@${version}`;
-  }
-};
-
-// src/scanners/uv/uv-scanner.ts
-import { readFile as readFile13 } from "fs/promises";
-import { existsSync as existsSync13 } from "fs";
-import path13 from "path";
-var UvScanner = class {
-  ecosystem = "uv";
-  lockfileNames = ["uv.lock"];
-  async detect(projectPath) {
-    const lockfilePath = path13.join(projectPath, "uv.lock");
-    return existsSync13(lockfilePath) ? lockfilePath : null;
-  }
-  async scan(projectPath, lockfilePath) {
-    const [lockfileRaw, pyprojectRaw] = await Promise.all([
-      readFile13(lockfilePath, "utf-8"),
-      readFile13(path13.join(projectPath, "pyproject.toml"), "utf-8").catch(() => null)
-    ]);
-    const packages = this.parseLockfile(lockfileRaw, lockfilePath);
-    const projectName = pyprojectRaw ? this.extractProjectName(pyprojectRaw) : null;
-    const directNames = pyprojectRaw ? this.parsePyprojectDeps(pyprojectRaw) : /* @__PURE__ */ new Set();
-    const dependencies = [];
-    for (const pkg2 of packages) {
-      if (pkg2.isEditable) continue;
-      if (projectName && this.normalizePipName(pkg2.name) === this.normalizePipName(projectName)) {
-        continue;
-      }
-      dependencies.push({
-        name: this.normalizePipName(pkg2.name),
-        version: pkg2.version,
-        direct: directNames.size > 0 ? directNames.has(this.normalizePipName(pkg2.name)) : true,
-        ecosystem: "uv",
-        purl: this.buildPurl(pkg2.name, pkg2.version)
-      });
-    }
-    return {
-      projectPath,
-      ecosystem: "uv",
-      dependencies,
-      lockfilePath,
-      scannedAt: (/* @__PURE__ */ new Date()).toISOString()
-    };
-  }
-  /**
-   * Parses uv.lock by splitting on [[package]] blocks.
-   * Lightweight parser that handles the regular structure
-   * without needing a full TOML library.
-   */
-  parseLockfile(content, lockfilePath) {
-    const packages = [];
-    const blocks = content.split(/^\[\[package\]\]$/m);
-    for (const block of blocks) {
-      if (!block.trim()) continue;
-      const name = this.extractField(block, "name");
-      const version = this.extractField(block, "version");
-      if (name && version) {
-        const isEditable = /source\s*=\s*\{[^}]*editable\s*=/.test(block) || /source\s*=\s*\{[^}]*virtual\s*=/.test(block);
-        packages.push({ name, version, isEditable });
-      }
-    }
-    if (packages.length === 0 && content.includes("[[package]]")) {
-      throw new LockfileParseError(lockfilePath, "Failed to parse any packages from uv.lock");
-    }
-    return packages;
-  }
-  /**
-   * Extracts a string field value from a TOML block.
-   * Handles: `name = "value"` format.
-   */
-  extractField(block, fieldName) {
-    const regex = new RegExp(`^${fieldName}\\s*=\\s*"([^"]*)"`, "m");
-    const match = block.match(regex);
-    return match ? match[1] : null;
-  }
-  /**
-   * Extracts the project name from `pyproject.toml`.
-   * Looks for `name = "..."` under `[project]`.
-   */
-  extractProjectName(content) {
-    let inProjectSection = false;
-    for (const rawLine of content.split("\n")) {
-      const line = rawLine.trim();
-      if (line.startsWith("[")) {
-        inProjectSection = line === "[project]";
-        continue;
-      }
-      if (inProjectSection) {
-        const match = line.match(/^name\s*=\s*"([^"]*)"/);
-        if (match) return match[1];
-      }
-    }
-    return null;
-  }
-  /**
-   * Parses `pyproject.toml` to extract direct dependency names.
-   *
-   * Looks for:
-   *   - `[project]` → `dependencies = [...]` (PEP 621)
-   *   - `[project.optional-dependencies]` (extras)
-   *   - `[dependency-groups]` (PEP 735, used by uv for dev deps)
-   *
-   * Dependency strings follow PEP 508:
-   *   - `"requests>=2.31.0"`
-   *   - `"flask[dotenv]>=3.0"`
-   *   - `"black"` (bare name)
-   */
-  parsePyprojectDeps(content) {
-    const directNames = /* @__PURE__ */ new Set();
-    this.extractInlineArray(content, directNames);
-    this.extractDependencyGroups(content, directNames);
-    return directNames;
-  }
-  /**
-   * Extracts dependency names from PEP 621 `dependencies = [...]` arrays
-   * and `[project.optional-dependencies]` sections.
-   */
-  extractInlineArray(content, directNames) {
-    const arrayRegex = /(?:^dependencies|^[a-zA-Z0-9_-]+)\s*=\s*\[([^\]]*)\]/gm;
-    let match;
-    while ((match = arrayRegex.exec(content)) !== null) {
-      const arrayContent = match[1];
-      this.extractPepNames(arrayContent, directNames);
-    }
-  }
-  /**
-   * Extracts dependency names from [dependency-groups] sections.
-   * Format:
-   * ```toml
-   * [dependency-groups]
-   * dev = ["pytest>=7.0", "black"]
-   * ```
-   */
-  extractDependencyGroups(content, directNames) {
-    let inDepGroups = false;
-    for (const rawLine of content.split("\n")) {
-      const line = rawLine.trim();
-      if (line.startsWith("[")) {
-        inDepGroups = line === "[dependency-groups]";
-        continue;
-      }
-      if (inDepGroups && line && !line.startsWith("#")) {
-        const arrayMatch = line.match(/^[a-zA-Z0-9_-]+\s*=\s*\[([^\]]*)\]/);
-        if (arrayMatch) {
-          this.extractPepNames(arrayMatch[1], directNames);
-        }
-      }
-    }
-  }
-  /**
-   * Extracts PEP 508 package names from a comma-separated
-   * list of quoted dependency strings.
-   */
-  extractPepNames(content, directNames) {
-    const depStrings = content.match(/"([^"]*)"/g);
-    if (!depStrings) return;
-    for (const quoted of depStrings) {
-      const depStr = quoted.replace(/"/g, "").trim();
-      if (!depStr) continue;
-      const nameMatch = depStr.match(/^([a-zA-Z0-9_][a-zA-Z0-9._-]*)/);
-      if (nameMatch && nameMatch[1]) {
-        directNames.add(this.normalizePipName(nameMatch[1]));
-      }
-    }
-  }
-  /**
-   * Normalizes a pip package name per PEP 503.
-   * Converts to lowercase and replaces any run of [-_.] with a single hyphen.
-   */
-  normalizePipName(name) {
-    return name.toLowerCase().replace(/[-_.]+/g, "-");
-  }
-  /**
-   * Builds a purl for a PyPI package.
-   * Per purl spec, the type is "pypi" (not "uv").
-   */
-  buildPurl(name, version) {
-    return `pkg:pypi/${this.normalizePipName(name)}@${version}`;
-  }
-};
-
-// src/scanners/registry.ts
-var ScannerRegistry = class {
-  scanners;
-  constructor() {
-    this.scanners = [
-      new NpmScanner(),
-      new NugetScanner(),
-      new CargoScanner(),
-      new PipScanner(),
-      new PoetryScanner(),
-      new UvScanner(),
-      new MavenScanner(),
-      new GoScanner(),
-      new RubyScanner(),
-      new ComposerScanner(),
-      new YarnScanner(),
-      new PnpmScanner(),
-      new DenoScanner()
-    ];
-  }
-  /**
-   * Auto-detects the project's ecosystem and scans dependencies.
-   * Tries each registered scanner in order until one matches.
-   */
-  async detectAndScan(projectPath) {
-    for (const scanner of this.scanners) {
-      const lockfilePath = await scanner.detect(projectPath);
-      if (lockfilePath) {
-        return scanner.scan(projectPath, lockfilePath);
-      }
-    }
-    throw new NoLockfileError(projectPath);
-  }
-  /** Returns a specific scanner by ecosystem name */
-  getScanner(ecosystem) {
-    return this.scanners.find((s) => s.ecosystem === ecosystem);
-  }
-  /** Lists all registered ecosystems */
-  listEcosystems() {
-    return this.scanners.map((s) => s.ecosystem);
-  }
-};
-
-// src/sbom/shared.ts
-var VERIMU_TOOL_NAME = "verimu";
-var VERIMU_TOOL_WEBSITE = "https://verimu.com";
-var VERIMU_TOOL_DESCRIPTION = "Verimu CRA Compliance Scanner";
-var DEFAULT_TOOL_VERSION = "0.1.0";
-var DEFAULT_SWID_VERSION = "0.0.0";
-var PURL_TYPE_MAP = {
-  npm: "npm",
-  nuget: "nuget",
-  cargo: "cargo",
-  maven: "maven",
-  pip: "pypi",
-  poetry: "pypi",
-  uv: "pypi",
-  go: "golang",
-  ruby: "gem",
-  composer: "composer",
-  deno: "deno"
-};
-function buildPurl(name, version, ecosystem) {
-  const type = PURL_TYPE_MAP[ecosystem] || ecosystem;
-  if (ecosystem === "npm" && name.startsWith("@")) {
-    return `pkg:${type}/%40${name.slice(1)}@${version}`;
-  }
-  return `pkg:${type}/${name}@${version}`;
-}
-function deriveSupplierName(packageName) {
-  if (packageName.startsWith("@")) {
-    return packageName.split("/")[0];
-  }
-  return packageName;
-}
-function extractProjectName(projectPath) {
-  const parts = projectPath.replace(/\\/g, "/").split("/");
-  return parts[parts.length - 1] || "unknown-project";
-}
-function normalizeDependencies(dependencies) {
-  return dependencies.map((dep) => ({
-    name: dep.name,
-    version: dep.version,
-    ecosystem: dep.ecosystem,
-    direct: dep.direct ?? true,
-    purl: dep.purl ?? buildPurl(dep.name, dep.version, dep.ecosystem),
-    supplierName: deriveSupplierName(dep.name)
-  }));
-}
-
-// src/sbom/cyclonedx.ts
-import { randomUUID } from "crypto";
-var SCHEMA_URLS = {
-  "1.4": "http://cyclonedx.org/schema/bom-1.4.schema.json",
-  "1.5": "http://cyclonedx.org/schema/bom-1.5.schema.json",
-  "1.6": "http://cyclonedx.org/schema/bom-1.6.schema.json",
-  "1.7": "http://cyclonedx.org/schema/bom-1.7.schema.json"
-};
-var CycloneDxGenerator = class {
-  constructor(specVersion = "1.7") {
-    this.specVersion = specVersion;
-  }
-  format = "cyclonedx-json";
-  generate(scanResult, toolVersion = DEFAULT_TOOL_VERSION) {
-    const bom = this.buildBom(scanResult, toolVersion);
-    const content = JSON.stringify(bom, null, 2);
-    return {
-      format: "cyclonedx-json",
-      specVersion: this.specVersion,
-      content,
-      componentCount: scanResult.dependencies.length,
-      generatedAt: (/* @__PURE__ */ new Date()).toISOString()
-    };
-  }
-  buildBom(scanResult, toolVersion) {
-    const projectName = extractProjectName(scanResult.projectPath);
-    return {
-      $schema: SCHEMA_URLS[this.specVersion],
-      bomFormat: "CycloneDX",
-      specVersion: this.specVersion,
-      serialNumber: `urn:uuid:${randomUUID()}`,
-      version: 1,
-      metadata: {
-        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        tools: this.buildTools(toolVersion),
-        // NTIA: metadata.supplier — the org supplying the root software
-        supplier: {
-          name: projectName
-        },
-        component: {
-          type: "application",
-          name: projectName,
-          "bom-ref": "root-component",
-          supplier: { name: projectName }
-        }
-      },
-      components: scanResult.dependencies.map((dep) => this.toComponent(dep)),
-      dependencies: this.buildDependencyGraph(scanResult)
-    };
-  }
-  /** Converts a Verimu Dependency to a CycloneDX component */
-  toComponent(dep) {
-    return {
-      type: "library",
-      name: dep.name,
-      version: dep.version,
-      purl: dep.purl,
-      "bom-ref": dep.purl,
-      scope: dep.direct ? "required" : "optional",
-      // NTIA: component.supplier — derived from npm scope or package name
-      supplier: {
-        name: deriveSupplierName(dep.name)
-      }
-    };
-  }
-  /**
-   * Builds the dependency graph section of the SBOM.
-   *
-   * The root component depends on all dependencies (direct + transitive).
-   * This ensures a single root node in the graph, which NTIA validators expect.
-   *
-   * We include ALL deps under root (not just direct) because from a flat lockfile
-   * we can't reliably reconstruct which transitive dep belongs to which direct dep.
-   * This is still valid per the CycloneDX spec — it represents a complete but flat
-   * dependency relationship.
-   */
-  buildDependencyGraph(scanResult) {
-    const allDepPurls = scanResult.dependencies.map((d) => d.purl);
-    return [
-      {
-        ref: "root-component",
-        dependsOn: allDepPurls
-      }
-    ];
-  }
-  /**
-   * Builds the tools metadata section.
-   *
-   * CycloneDX 1.4: tools is a flat array of { vendor, name, version, ... }
-   * CycloneDX 1.5+: tools is an object { components: [...] }
-   */
-  buildTools(toolVersion) {
-    if (this.specVersion === "1.4") {
-      return [
-        {
-          vendor: "Verimu",
-          name: VERIMU_TOOL_NAME,
-          version: toolVersion,
-          externalReferences: [{ type: "website", url: VERIMU_TOOL_WEBSITE }]
-        }
-      ];
-    }
-    return {
-      components: [
-        {
-          type: "application",
-          name: VERIMU_TOOL_NAME,
-          version: toolVersion,
-          description: VERIMU_TOOL_DESCRIPTION,
-          supplier: { name: "Verimu" },
-          externalReferences: [{ type: "website", url: VERIMU_TOOL_WEBSITE }]
-        }
-      ]
-    };
-  }
-};
-
-// src/sbom/spdx.ts
-import { randomUUID as randomUUID2 } from "crypto";
-var SPDX_VERSION = "2.3";
-var SpdxJsonGenerator = class {
-  format = "spdx-json";
-  generate(scanResult, toolVersion = DEFAULT_TOOL_VERSION) {
-    const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-    const projectName = extractProjectName(scanResult.projectPath);
-    const rootPackageId = "SPDXRef-Package-root";
-    const dependencies = normalizeDependencies(scanResult.dependencies);
-    const document = {
-      spdxVersion: `SPDX-${SPDX_VERSION}`,
-      dataLicense: "CC0-1.0",
-      SPDXID: "SPDXRef-DOCUMENT",
-      name: `${projectName}-sbom`,
-      documentNamespace: `https://verimu.com/spdxdocs/${projectName}-${randomUUID2()}`,
-      creationInfo: {
-        created: timestamp,
-        creators: [`Tool: ${VERIMU_TOOL_NAME}@${toolVersion}`]
-      },
-      documentDescribes: [rootPackageId],
-      packages: [
-        {
-          name: projectName,
-          SPDXID: rootPackageId,
-          versionInfo: "NOASSERTION",
-          supplier: `Organization: ${projectName}`,
-          downloadLocation: "NOASSERTION",
-          filesAnalyzed: false,
-          licenseConcluded: "NOASSERTION",
-          licenseDeclared: "NOASSERTION",
-          primaryPackagePurpose: "APPLICATION"
-        },
-        ...dependencies.map((dep, index) => ({
-          name: dep.name,
-          SPDXID: `SPDXRef-Package-${index + 1}`,
-          versionInfo: dep.version,
-          supplier: `Organization: ${dep.supplierName}`,
-          downloadLocation: "NOASSERTION",
-          filesAnalyzed: false,
-          licenseConcluded: "NOASSERTION",
-          licenseDeclared: "NOASSERTION",
-          primaryPackagePurpose: "LIBRARY",
-          externalRefs: [
-            {
-              referenceCategory: "PACKAGE-MANAGER",
-              referenceType: "purl",
-              referenceLocator: dep.purl
-            }
-          ]
-        }))
-      ],
-      relationships: [
-        {
-          spdxElementId: "SPDXRef-DOCUMENT",
-          relationshipType: "DESCRIBES",
-          relatedSpdxElement: rootPackageId
-        },
-        ...dependencies.map((_dep, index) => ({
-          spdxElementId: rootPackageId,
-          relationshipType: "DEPENDS_ON",
-          relatedSpdxElement: `SPDXRef-Package-${index + 1}`
-        }))
-      ]
-    };
-    return {
-      format: "spdx-json",
-      specVersion: SPDX_VERSION,
-      content: JSON.stringify(document, null, 2),
-      componentCount: scanResult.dependencies.length,
-      generatedAt: timestamp
-    };
-  }
-};
-
-// src/sbom/swid.ts
-import { randomUUID as randomUUID3 } from "crypto";
-var SWID_SPEC_VERSION = "ISO/IEC 19770-2:2015";
-var SwidTagGenerator = class {
-  format = "swid-xml";
-  generate(scanResult, toolVersion = DEFAULT_TOOL_VERSION) {
-    const timestamp = (/* @__PURE__ */ new Date()).toISOString();
-    const projectName = extractProjectName(scanResult.projectPath);
-    const tagId = `com.verimu:${sanitizeTagId(projectName)}:${DEFAULT_SWID_VERSION}:${randomUUID3()}`;
-    const content = [
-      '<?xml version="1.0" encoding="UTF-8"?>',
-      "<SoftwareIdentity",
-      '  xmlns="http://standards.iso.org/iso/19770/-2/2015/schema.xsd"',
-      `  name="${escapeXml(projectName)}"`,
-      `  tagId="${escapeXml(tagId)}"`,
-      '  tagVersion="1"',
-      `  version="${DEFAULT_SWID_VERSION}"`,
-      '  versionScheme="semver">',
-      `  <Entity name="${escapeXml(projectName)}" role="softwareCreator" />`,
-      '  <Entity name="Verimu" role="tagCreator" />',
-      `  <Meta product="${escapeXml(projectName)}" generator="${VERIMU_TOOL_NAME}" toolVersion="${toolVersion}" generated="${timestamp}" />`,
-      "  <!-- TODO: Consider adding dependency/package evidence if we need richer SWID coverage. -->",
-      '  <Link rel="describedby" href="https://verimu.com" />',
-      "</SoftwareIdentity>"
-    ].join("\n");
-    return {
-      format: "swid-xml",
-      specVersion: SWID_SPEC_VERSION,
-      content,
-      componentCount: 1,
-      generatedAt: timestamp
-    };
-  }
-};
-function escapeXml(value) {
-  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
-}
-function sanitizeTagId(value) {
-  return value.toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "");
-}
-
-// src/sbom/artifacts.ts
-function generateSbomArtifacts(scanResult, toolVersion = DEFAULT_TOOL_VERSION, cyclonedxVersion = "1.7") {
-  return {
-    cyclonedx: new CycloneDxGenerator(cyclonedxVersion).generate(scanResult, toolVersion),
-    spdx: new SpdxJsonGenerator().generate(scanResult, toolVersion),
-    swid: new SwidTagGenerator().generate(scanResult, toolVersion)
-  };
-}
-
-// src/cve/osv.ts
-var OSV_API_BASE = "https://api.osv.dev/v1";
-var BATCH_SIZE = 1e3;
-var OsvSource = class {
-  sourceId = "osv";
-  name = "OSV.dev (Google Open Source Vulnerabilities)";
-  fetchFn;
-  constructor(fetchImpl) {
-    this.fetchFn = fetchImpl ?? globalThis.fetch;
-  }
-  async checkDependencies(dependencies) {
-    if (dependencies.length === 0) return [];
-    const allVulns = [];
-    for (let i = 0; i < dependencies.length; i += BATCH_SIZE) {
-      const batch = dependencies.slice(i, i + BATCH_SIZE);
-      const batchVulns = await this.queryBatch(batch);
-      allVulns.push(...batchVulns);
-    }
-    return allVulns;
-  }
-  /**
-   * Uses OSV's /querybatch endpoint to get vulnerability IDs,
-   * then fetches full details for each unique vulnerability.
-   */
-  async queryBatch(dependencies) {
-    const queries = dependencies.map((dep) => ({
-      version: dep.version,
-      package: {
-        name: dep.name,
-        ecosystem: this.mapEcosystem(dep.ecosystem)
-      }
-    }));
-    const response = await this.fetchFn(`${OSV_API_BASE}/querybatch`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ queries })
-    });
-    if (!response.ok) {
-      throw new Error(`OSV API error: ${response.status} ${response.statusText}`);
-    }
-    const data = await response.json();
-    const vulnIdToDeps = /* @__PURE__ */ new Map();
-    for (let i = 0; i < data.results.length; i++) {
-      const result = data.results[i];
-      const dep = dependencies[i];
-      if (result.vulns && result.vulns.length > 0) {
-        for (const vuln of result.vulns) {
-          const existing = vulnIdToDeps.get(vuln.id);
-          if (existing) {
-            existing.push(dep);
-          } else {
-            vulnIdToDeps.set(vuln.id, [dep]);
-          }
-        }
-      }
-    }
-    if (vulnIdToDeps.size === 0) {
-      return [];
-    }
-    const vulnIds = Array.from(vulnIdToDeps.keys());
-    const fullVulns = await this.fetchVulnerabilityDetails(vulnIds);
-    const vulnerabilities = [];
-    for (const osvVuln of fullVulns) {
-      const affectedDeps = vulnIdToDeps.get(osvVuln.id) ?? [];
-      for (const dep of affectedDeps) {
-        vulnerabilities.push(this.mapVulnerability(osvVuln, dep));
-      }
-    }
-    return vulnerabilities;
-  }
-  /**
-   * Fetches full vulnerability details from /v1/vulns/{id} for each ID.
-   * Makes parallel requests for efficiency.
-   */
-  async fetchVulnerabilityDetails(vulnIds) {
-    const results = [];
-    const CONCURRENCY = 10;
-    for (let i = 0; i < vulnIds.length; i += CONCURRENCY) {
-      const batch = vulnIds.slice(i, i + CONCURRENCY);
-      const promises = batch.map(async (id) => {
-        try {
-          const response = await this.fetchFn(`${OSV_API_BASE}/vulns/${encodeURIComponent(id)}`, {
-            method: "GET",
-            headers: { "Content-Type": "application/json" }
-          });
-          if (!response.ok) {
-            console.warn(`Failed to fetch vulnerability ${id}: ${response.status}`);
-            return null;
-          }
-          return await response.json();
-        } catch (err) {
-          console.warn(`Error fetching vulnerability ${id}:`, err);
-          return null;
-        }
-      });
-      const batchResults = await Promise.all(promises);
-      results.push(...batchResults.filter((v) => v !== null));
-    }
-    return results;
-  }
-  /** Maps an OSV vulnerability record to our Vulnerability type */
-  mapVulnerability(osvVuln, dep) {
-    const cveId = this.extractCveId(osvVuln);
-    const severity = this.extractSeverity(osvVuln);
-    return {
-      id: cveId || osvVuln.id,
-      aliases: Array.from(/* @__PURE__ */ new Set([osvVuln.id, ...osvVuln.aliases ?? []])),
-      summary: osvVuln.summary ?? osvVuln.details?.slice(0, 200) ?? "No description available",
-      severity: severity.level,
-      cvssScore: severity.score,
-      packageName: dep.name,
-      ecosystem: dep.ecosystem,
-      affectedVersionRange: this.extractAffectedRange(osvVuln, dep.name),
-      fixedVersion: this.extractFixedVersion(osvVuln, dep.name),
-      exploitedInWild: false,
-      // OSV doesn't track this — CISA KEV does
-      source: "osv",
-      referenceUrl: `https://osv.dev/vulnerability/${osvVuln.id}`,
-      publishedAt: osvVuln.published
-    };
-  }
-  /** Extracts CVE ID from aliases (prefers CVE-xxxx over GHSA-xxxx) */
-  extractCveId(vuln) {
-    if (vuln.id.startsWith("CVE-")) return vuln.id;
-    if (vuln.aliases) {
-      const cve = vuln.aliases.find((a) => a.startsWith("CVE-"));
-      if (cve) return cve;
-    }
-    return null;
-  }
-  /** Extracts severity from CVSS scores in the OSV record */
-  extractSeverity(vuln) {
-    if (vuln.severity && vuln.severity.length > 0) {
-      for (const sev of vuln.severity) {
-        if (sev.type === "CVSS_V3") {
-          const score = this.parseCvssScore(sev.score);
-          if (score !== null) {
-            return { level: this.scoreToSeverity(score), score };
-          }
-        }
-      }
-    }
-    if (vuln.database_specific?.severity) {
-      const s = vuln.database_specific.severity.toUpperCase();
-      if (["CRITICAL", "HIGH", "MEDIUM", "LOW"].includes(s)) {
-        return { level: s };
-      }
-    }
-    return { level: "UNKNOWN" };
-  }
-  /** Parses CVSS v3 vector string to extract/calculate the base score */
-  parseCvssScore(vectorOrScore) {
-    const num = parseFloat(vectorOrScore);
-    if (!isNaN(num) && num >= 0 && num <= 10) return num;
-    if (vectorOrScore.startsWith("CVSS:3")) {
-      return this.calculateCvss3Score(vectorOrScore);
-    }
-    return null;
-  }
-  /** Calculate CVSS v3.x base score from vector string */
-  calculateCvss3Score(vector) {
-    const metricValues = {
-      AV: { N: 0.85, A: 0.62, L: 0.55, P: 0.2 },
-      // Attack Vector
-      AC: { L: 0.77, H: 0.44 },
-      // Attack Complexity
-      PR: {
-        // Privileges Required (varies by Scope)
-        N_U: 0.85,
-        L_U: 0.62,
-        H_U: 0.27,
-        N_C: 0.85,
-        L_C: 0.68,
-        H_C: 0.5
-      },
-      UI: { N: 0.85, R: 0.62 },
-      // User Interaction
-      C: { H: 0.56, L: 0.22, N: 0 },
-      // Confidentiality Impact
-      I: { H: 0.56, L: 0.22, N: 0 },
-      // Integrity Impact
-      A: { H: 0.56, L: 0.22, N: 0 }
-      // Availability Impact
-    };
-    const parts = vector.split("/");
-    const metrics = {};
-    for (const part of parts) {
-      const [key, value] = part.split(":");
-      if (key && value) metrics[key] = value;
-    }
-    const av = metricValues.AV[metrics.AV];
-    const ac = metricValues.AC[metrics.AC];
-    const ui = metricValues.UI[metrics.UI];
-    const scope = metrics.S;
-    const c = metricValues.C[metrics.C];
-    const i = metricValues.I[metrics.I];
-    const a = metricValues.A[metrics.A];
-    const prKey = `${metrics.PR}_${scope}`;
-    const pr = metricValues.PR[prKey];
-    if ([av, ac, pr, ui, c, i, a].some((v) => v === void 0)) {
-      return null;
-    }
-    const iss = 1 - (1 - c) * (1 - i) * (1 - a);
-    let impact;
-    if (scope === "U") {
-      impact = 6.42 * iss;
-    } else {
-      impact = 7.52 * (iss - 0.029) - 3.25 * Math.pow(iss - 0.02, 15);
-    }
-    const exploitability = 8.22 * av * ac * pr * ui;
-    if (impact <= 0) return 0;
-    let baseScore;
-    if (scope === "U") {
-      baseScore = Math.min(impact + exploitability, 10);
-    } else {
-      baseScore = Math.min(1.08 * (impact + exploitability), 10);
-    }
-    return Math.ceil(baseScore * 10) / 10;
-  }
-  /** Converts a CVSS score (0-10) to a severity level */
-  scoreToSeverity(score) {
-    if (score >= 9) return "CRITICAL";
-    if (score >= 7) return "HIGH";
-    if (score >= 4) return "MEDIUM";
-    if (score > 0) return "LOW";
-    return "UNKNOWN";
-  }
-  /** Extracts affected version range for a specific package */
-  extractAffectedRange(vuln, packageName) {
-    if (!vuln.affected) return void 0;
-    for (const affected of vuln.affected) {
-      if (affected.package?.name === packageName && affected.ranges) {
-        for (const range of affected.ranges) {
-          if (range.events) {
-            const introduced = range.events.find((e) => e.introduced)?.introduced;
-            const fixed = range.events.find((e) => e.fixed)?.fixed;
-            if (introduced && fixed) return `>=${introduced}, <${fixed}`;
-            if (introduced) return `>=${introduced}`;
-          }
-        }
-      }
-    }
-    return void 0;
-  }
-  /** Extracts the fixed version for a specific package */
-  extractFixedVersion(vuln, packageName) {
-    if (!vuln.affected) return void 0;
-    for (const affected of vuln.affected) {
-      if (affected.package?.name === packageName && affected.ranges) {
-        for (const range of affected.ranges) {
-          if (range.events) {
-            const fixed = range.events.find((e) => e.fixed)?.fixed;
-            if (fixed) return fixed;
-          }
-        }
-      }
-    }
-    return void 0;
-  }
-  /** Maps our ecosystem names to OSV ecosystem names */
-  mapEcosystem(ecosystem) {
-    const map = {
-      npm: "npm",
-      nuget: "NuGet",
-      cargo: "crates.io",
-      maven: "Maven",
-      pip: "PyPI",
-      poetry: "PyPI",
-      uv: "PyPI",
-      go: "Go",
-      ruby: "RubyGems",
-      composer: "Packagist",
-      deno: "JSR"
-      // JSR packages (Deno registry)
-    };
-    return map[ecosystem] ?? ecosystem;
-  }
-};
-
-// src/cve/aggregator.ts
-var CveAggregator = class {
-  sources;
-  constructor(sources) {
-    this.sources = sources ?? [
-      new OsvSource()
-      // Future: new NvdSource(), new EuvdSource(), new CisaKevSource()
-    ];
-  }
-  /**
-   * Checks dependencies against all registered CVE sources.
-   * Runs sources in parallel and merges/deduplicates results.
-   */
-  async check(dependencies) {
-    const startTime = Date.now();
-    const sourcesQueried = [];
-    const sourceErrors = [];
-    const allVulns = [];
-    const results = await Promise.allSettled(
-      this.sources.map(async (source) => {
-        const vulns = await source.checkDependencies(dependencies);
-        return { sourceId: source.sourceId, vulns };
-      })
-    );
-    for (const result of results) {
-      if (result.status === "fulfilled") {
-        sourcesQueried.push(result.value.sourceId);
-        allVulns.push(...result.value.vulns);
-      } else {
-        const sourceIndex = results.indexOf(result);
-        const sourceId = this.sources[sourceIndex].sourceId;
-        sourceErrors.push({
-          source: sourceId,
-          error: result.reason instanceof Error ? result.reason.message : String(result.reason)
-        });
-      }
-    }
-    const deduplicated = this.deduplicateVulnerabilities(allVulns);
-    return {
-      vulnerabilities: deduplicated,
-      sourcesQueried,
-      sourceErrors,
-      checkDurationMs: Date.now() - startTime
-    };
-  }
-  /**
-   * Deduplicates vulnerabilities by ID.
-   * When the same CVE appears from multiple sources,
-   * keeps the one with more complete data (has CVSS score, has fix version, etc.)
-   */
-  deduplicateVulnerabilities(vulns) {
-    const byKey = /* @__PURE__ */ new Map();
-    for (const vuln of vulns) {
-      const key = `${vuln.id}::${vuln.packageName}`;
-      const existing = byKey.get(key);
-      if (!existing) {
-        byKey.set(key, vuln);
-      } else {
-        byKey.set(key, this.pickBetterEntry(existing, vuln));
-      }
-    }
-    return Array.from(byKey.values());
-  }
-  /** Picks the vulnerability entry with more complete data */
-  pickBetterEntry(a, b) {
-    let scoreA = 0;
-    let scoreB = 0;
-    if (a.cvssScore !== void 0) scoreA++;
-    if (b.cvssScore !== void 0) scoreB++;
-    if (a.fixedVersion) scoreA++;
-    if (b.fixedVersion) scoreB++;
-    if (a.affectedVersionRange) scoreA++;
-    if (b.affectedVersionRange) scoreB++;
-    if (a.severity !== "UNKNOWN") scoreA++;
-    if (b.severity !== "UNKNOWN") scoreB++;
-    const strip = (obj) => Object.fromEntries(Object.entries(obj).filter(([, v]) => v !== void 0 && v !== null));
-    const winner = scoreB > scoreA ? { ...strip(a), ...strip(b) } : { ...strip(b), ...strip(a) };
-    const allAliases = /* @__PURE__ */ new Set([...a.aliases, ...b.aliases]);
-    winner.aliases = Array.from(allAliases);
-    winner.exploitedInWild = a.exploitedInWild || b.exploitedInWild;
-    return winner;
-  }
-};
-
-// src/reporters/console.ts
-var ConsoleReporter = class {
-  name = "console";
-  report(result) {
-    const lines = [];
-    lines.push("");
-    lines.push("\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510");
-    lines.push("\u2502          VERIMU CRA COMPLIANCE SCAN         \u2502");
-    lines.push("\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518");
-    lines.push("");
-    lines.push(`  Project:      ${result.project.path}`);
-    lines.push(`  Ecosystem:    ${result.project.ecosystem}`);
-    lines.push(`  Dependencies: ${result.project.dependencyCount}`);
-    lines.push(`  Scanned at:   ${result.generatedAt}`);
-    lines.push("");
-    lines.push(`  \u2713 SBOM generated (${result.sbom.format}, ${result.sbom.specVersion})`);
-    lines.push(`    Components: ${result.sbom.componentCount}`);
-    if (result.artifacts) {
-      lines.push(`    Also wrote: ${result.artifacts.spdx.format}, ${result.artifacts.swid.format}`);
-    }
-    lines.push("");
-    const vulns = result.cveCheck.vulnerabilities;
-    if (vulns.length === 0) {
-      lines.push("  \u2713 No known vulnerabilities found");
-    } else {
-      lines.push(`  \u26A0 ${vulns.length} vulnerabilit${vulns.length === 1 ? "y" : "ies"} found:`);
-      lines.push("");
-      const sorted = [...vulns].sort((a, b) => severityOrder(a.severity) - severityOrder(b.severity));
-      for (const vuln of sorted) {
-        const badge = severityBadge(vuln.severity);
-        const fix = vuln.fixedVersion ? ` \u2192 fix: ${vuln.fixedVersion}` : "";
-        lines.push(`    ${badge}  ${vuln.id}`);
-        lines.push(`           ${vuln.packageName}@${vuln.affectedVersionRange ?? "?"}${fix}`);
-        lines.push(`           ${vuln.summary.slice(0, 100)}`);
-        if (vuln.exploitedInWild) {
-          lines.push(`           \u{1F534} ACTIVELY EXPLOITED \u2014 24h CRA reporting required`);
-        }
-        lines.push("");
-      }
-    }
-    const sources = result.cveCheck.sourcesQueried.join(", ");
-    lines.push(`  Sources queried: ${sources} (${result.cveCheck.checkDurationMs}ms)`);
-    if (result.cveCheck.sourceErrors.length > 0) {
-      for (const err of result.cveCheck.sourceErrors) {
-        lines.push(`  \u26A0 ${err.source}: ${err.error}`);
-      }
-    }
-    lines.push("");
-    lines.push("  \u2500\u2500\u2500 Summary \u2500\u2500\u2500");
-    lines.push(`  Total: ${result.summary.totalVulnerabilities}  |  Critical: ${result.summary.critical}  |  High: ${result.summary.high}  |  Medium: ${result.summary.medium}  |  Low: ${result.summary.low}`);
-    if (result.summary.exploitedInWild > 0) {
-      lines.push(`  \u{1F534} ${result.summary.exploitedInWild} actively exploited \u2014 immediate action required`);
-    }
-    lines.push("");
-    return lines.join("\n");
-  }
-};
-function severityOrder(s) {
-  const order = {
-    CRITICAL: 0,
-    HIGH: 1,
-    MEDIUM: 2,
-    LOW: 3,
-    UNKNOWN: 4
-  };
-  return order[s] ?? 5;
-}
-function severityBadge(s) {
-  const badges = {
-    CRITICAL: "[CRIT]",
-    HIGH: "[HIGH]",
-    MEDIUM: "[MED] ",
-    LOW: "[LOW] ",
-    UNKNOWN: "[???] "
-  };
-  return badges[s] ?? "[???] ";
-}
-
-// src/api/client.ts
-var DEFAULT_API_BASE = "https://api.verimu.com";
-var VerimuApiClient = class {
-  baseUrl;
-  apiKey;
-  constructor(apiKey, baseUrl) {
-    this.apiKey = apiKey;
-    this.baseUrl = (baseUrl ?? DEFAULT_API_BASE).replace(/\/+$/, "");
-  }
-  /**
-   * Upsert a project — finds by name or creates it.
-   * Used so `npx verimu` auto-registers projects without manual dashboard setup.
-   */
-  async upsertProject(opts) {
-    const res = await fetch(`${this.baseUrl}/api/projects/upsert`, {
-      method: "POST",
-      headers: this.headers(),
-      body: JSON.stringify({
-        name: opts.name,
-        ecosystem: this.mapEcosystem(opts.ecosystem),
-        repository_url: opts.repositoryUrl ?? null,
-        platform: opts.platform ?? null
-      })
-    });
-    if (!res.ok) {
-      const body = await res.text();
-      throw new Error(`Verimu API: upsert project failed (${res.status}): ${body}`);
-    }
-    return res.json();
-  }
-  /**
-   * Upload a software inventory artifact payload to a project and trigger CVE scanning.
-   *
-   * Backward-compatible:
-   * - string payloads are treated as legacy raw CycloneDX JSON
-   * - object payloads can include CycloneDX + SPDX + SWID together
-   */
-  async uploadSbom(projectId, payload) {
-    const body = typeof payload === "string" ? JSON.stringify(JSON.parse(payload)) : JSON.stringify(payload);
-    const res = await fetch(`${this.baseUrl}/api/projects/${projectId}/scan`, {
-      method: "POST",
-      headers: this.headers(),
-      body
-    });
-    if (!res.ok) {
-      const body2 = await res.text();
-      throw new Error(`Verimu API: upload SBOM failed (${res.status}): ${body2}`);
-    }
-    return res.json();
-  }
-  headers() {
-    return {
-      "Content-Type": "application/json",
-      "X-API-Key": this.apiKey
-    };
-  }
-  /**
-   * Maps internal ecosystem names to what the backend expects.
-   * Currently 1:1, but keeps the mapping explicit.
-   */
-  mapEcosystem(eco) {
-    const map = {
-      npm: "npm",
-      pip: "pip",
-      poetry: "poetry",
-      uv: "uv",
-      maven: "maven",
-      nuget: "nuget",
-      go: "gomod",
-      cargo: "cargo",
-      ruby: "bundler",
-      composer: "composer",
-      deno: "deno"
-    };
-    return map[eco] ?? eco;
-  }
-};
-
-// src/scan.ts
-async function scan(config) {
-  const {
-    projectPath,
-    sbomOutput = "./sbom.cdx.json",
-    skipCveCheck = false,
-    cyclonedxVersion = "1.7"
-  } = config;
-  const registry = new ScannerRegistry();
-  const scanResult = await registry.detectAndScan(projectPath);
-  const artifacts = generateSbomArtifacts(scanResult, void 0, cyclonedxVersion);
-  const sbom = artifacts.cyclonedx;
-  const outputPaths = deriveArtifactOutputPaths(sbomOutput);
-  await Promise.all([
-    writeFile(outputPaths.cyclonedx, artifacts.cyclonedx.content, "utf-8"),
-    writeFile(outputPaths.spdx, artifacts.spdx.content, "utf-8"),
-    writeFile(outputPaths.swid, artifacts.swid.content, "utf-8")
-  ]);
-  let cveCheck;
-  if (skipCveCheck) {
-    cveCheck = {
-      vulnerabilities: [],
-      sourcesQueried: [],
-      sourceErrors: [],
-      checkDurationMs: 0
-    };
-  } else {
-    const aggregator = new CveAggregator();
-    cveCheck = await aggregator.check(scanResult.dependencies);
-  }
-  const summary = {
-    totalDependencies: scanResult.dependencies.length,
-    totalVulnerabilities: cveCheck.vulnerabilities.length,
-    critical: cveCheck.vulnerabilities.filter((v) => v.severity === "CRITICAL").length,
-    high: cveCheck.vulnerabilities.filter((v) => v.severity === "HIGH").length,
-    medium: cveCheck.vulnerabilities.filter((v) => v.severity === "MEDIUM").length,
-    low: cveCheck.vulnerabilities.filter((v) => v.severity === "LOW").length,
-    exploitedInWild: cveCheck.vulnerabilities.filter((v) => v.exploitedInWild).length
-  };
-  const report = {
-    project: {
-      path: projectPath,
-      ecosystem: scanResult.ecosystem,
-      dependencyCount: scanResult.dependencies.length
-    },
-    sbom,
-    artifacts,
-    cveCheck,
-    summary,
-    generatedAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  if (config.apiKey) {
-    try {
-      const uploadResult = await uploadToVerimu(report, config);
-      report.upload = uploadResult;
-    } catch {
-    }
-  }
-  return report;
-}
-async function uploadToVerimu(report, config) {
-  if (!config.apiKey) {
-    throw new Error("API key required for upload");
-  }
-  const client = new VerimuApiClient(config.apiKey, config.apiBaseUrl);
-  const projectName = basename(config.projectPath);
-  const upsertRes = await client.upsertProject({
-    name: projectName,
-    ecosystem: report.project.ecosystem
-  });
-  const projectId = upsertRes.project.id;
-  const scanRes = await client.uploadSbom(projectId, buildUploadPayload(report));
-  return {
-    projectId,
-    projectCreated: upsertRes.created,
-    totalDependencies: scanRes.summary.total_dependencies,
-    vulnerableDependencies: scanRes.summary.vulnerable_dependencies,
-    dashboardUrl: `https://app.verimu.com/dashboard/projects/${projectId}`,
-    scanResponse: scanRes
-  };
-}
-function shouldFailCi(report, threshold) {
-  const severityOrder3 = {
-    CRITICAL: 0,
-    HIGH: 1,
-    MEDIUM: 2,
-    LOW: 3,
-    UNKNOWN: 4
-  };
-  const thresholdLevel = severityOrder3[threshold] ?? 4;
-  return report.cveCheck.vulnerabilities.some(
-    (v) => severityOrder3[v.severity] <= thresholdLevel
-  );
-}
-function deriveArtifactOutputPaths(cycloneDxOutput) {
-  const parsed = parse(cycloneDxOutput);
-  let baseName = parsed.name;
-  if (parsed.ext === ".json" && baseName.endsWith(".cdx")) {
-    baseName = baseName.slice(0, -4);
-  }
-  return {
-    cyclonedx: cycloneDxOutput,
-    spdx: join(parsed.dir, `${baseName}.spdx.json`),
-    swid: join(parsed.dir, `${baseName}.swid.xml`)
-  };
-}
-function buildUploadPayload(report) {
-  if (!report.artifacts) {
-    return report.sbom.content;
-  }
-  return {
-    cyclonedx: JSON.parse(report.artifacts.cyclonedx.content),
-    spdx: JSON.parse(report.artifacts.spdx.content),
-    swid: report.artifacts.swid.content
-  };
-}
-
-// src/reporters/platform.ts
-function renderPlatformScan(projectPath, result) {
-  const lines = [];
-  const vulns = collectVulnerabilities(result);
-  const summary = summarizeBySeverity(vulns.map((vuln) => vuln.severity));
-  lines.push("");
-  lines.push("\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510");
-  lines.push("\u2502         VERIMU PLATFORM SCAN RESULTS        \u2502");
-  lines.push("\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518");
-  lines.push("");
-  lines.push(`  Project:      ${projectPath}`);
-  lines.push("  Source:       Verimu platform backend");
-  lines.push(`  Dependencies: ${result.totalDependencies}`);
-  lines.push("");
-  if (vulns.length === 0) {
-    lines.push("  \u2713 No platform vulnerabilities found");
-  } else {
-    lines.push(`  \u26A0 ${vulns.length} backend vulnerabilit${vulns.length === 1 ? "y" : "ies"} found:`);
-    lines.push("");
-    const sorted = [...vulns].sort((a, b) => severityOrder2(a.severity) - severityOrder2(b.severity));
-    for (const vuln of sorted) {
-      const fix = vuln.fixedVersion ? ` \u2192 fix: ${vuln.fixedVersion}` : "";
-      lines.push(`    ${severityBadge2(vuln.severity)}  ${vuln.cveId}`);
-      lines.push(`           ${vuln.dependencyName}@${vuln.version}${fix}`);
-      lines.push(`           ${(vuln.summary ?? "").slice(0, 100)}`);
-      lines.push("");
-    }
-  }
-  lines.push("  \u2500\u2500\u2500 Summary \u2500\u2500\u2500");
-  lines.push(`  Total: ${vulns.length}  |  Critical: ${summary.CRITICAL}  |  High: ${summary.HIGH}  |  Medium: ${summary.MEDIUM}  |  Low: ${summary.LOW}`);
-  lines.push("");
-  return lines.join("\n");
-}
-function collectVulnerabilities(result) {
-  return (result.scanResponse.scan_results ?? []).flatMap(
-    (scanResult) => (scanResult.vulnerabilities ?? []).map((vuln) => ({
-      dependencyName: scanResult.dependency_name,
-      version: scanResult.version,
-      cveId: vuln.cve_id,
-      severity: normalizeSeverity(vuln.severity ?? "UNKNOWN"),
-      summary: pickSummary(vuln),
-      fixedVersion: pickFixedVersion(vuln)
-    }))
-  );
-}
-function pickSummary(vuln) {
-  const value = vuln.summary ?? vuln.description;
-  if (typeof value !== "string" || value.trim() === "") {
-    return "No description available";
-  }
-  return value;
-}
-function pickFixedVersion(vuln) {
-  if (typeof vuln.fixed_version === "string" && vuln.fixed_version.trim() !== "") {
-    return vuln.fixed_version;
-  }
-  for (const source of vuln.sources ?? []) {
-    const fixedVersion = source.data?.fixed_version;
-    if (typeof fixedVersion === "string" && fixedVersion.trim() !== "") {
-      return fixedVersion;
-    }
-  }
-  return null;
-}
-function normalizeSeverity(severity) {
-  const value = severity.trim().toUpperCase();
-  switch (value) {
-    case "CRITICAL":
-    case "HIGH":
-    case "MEDIUM":
-    case "LOW":
-      return value;
-    default:
-      return "UNKNOWN";
-  }
-}
-function summarizeBySeverity(severities) {
-  const summary = {
-    CRITICAL: 0,
-    HIGH: 0,
-    MEDIUM: 0,
-    LOW: 0,
-    UNKNOWN: 0
-  };
-  for (const severity of severities) {
-    summary[severity] += 1;
-  }
-  return summary;
-}
-function severityOrder2(severity) {
-  const order = {
-    CRITICAL: 0,
-    HIGH: 1,
-    MEDIUM: 2,
-    LOW: 3,
-    UNKNOWN: 4
-  };
-  return order[severity] ?? 5;
-}
-function severityBadge2(severity) {
-  const badges = {
-    CRITICAL: "[CRIT]",
-    HIGH: "[HIGH]",
-    MEDIUM: "[MED] ",
-    LOW: "[LOW] ",
-    UNKNOWN: "[???] "
-  };
-  return badges[severity] ?? "[???] ";
-}
-
-// src/cli.ts
-var require2 = createRequire(import.meta.url);
-var pkg = require2("../package.json");
-var VERSION = pkg.version ?? "0.0.0";
-var BRAND = `
-  \u2566  \u2566\u250C\u2500\u2510\u252C\u2500\u2510\u252C\u250C\u252C\u2510\u252C \u252C
-  \u255A\u2557\u2554\u255D\u251C\u2524 \u251C\u252C\u2518\u2502\u2502\u2502\u2502\u2502 \u2502
-   \u255A\u255D \u2514\u2500\u2518\u2534\u2514\u2500\u2534\u2534 \u2534\u2514\u2500\u2518
-  CRA Compliance Scanner v${VERSION}
-`;
-function log(msg) {
-  console.log(`  ${msg}`);
-}
-function logSuccess(msg) {
-  console.log(`  \u2713 ${msg}`);
-}
-function logWarn(msg) {
-  console.log(`  \u26A0 ${msg}`);
-}
-function logError(msg) {
-  console.error(`  \u2717 ${msg}`);
-}
-function parseArgs(argv) {
-  const args = argv.slice(2);
-  const result = {
-    command: "scan",
-    projectPath: ".",
-    sbomOutput: "./sbom.cdx.json",
-    failOnSeverity: null,
-    skipCveCheck: false,
-    skipUpload: false,
-    cyclonedxVersion: "1.7"
-  };
-  let i = 0;
-  while (i < args.length) {
-    const arg = args[i];
-    if (arg === "scan") {
-      result.command = "scan";
-    } else if (arg === "generate-sbom" || arg === "sbom") {
-      result.command = "generate-sbom";
-      result.skipCveCheck = true;
-    } else if (arg === "help" || arg === "--help" || arg === "-h") {
-      result.command = "help";
-    } else if (arg === "version" || arg === "--version" || arg === "-v") {
-      result.command = "version";
-    } else if (arg === "--path" || arg === "-p") {
-      result.projectPath = args[++i] ?? ".";
-    } else if (arg === "--output" || arg === "-o") {
-      result.sbomOutput = args[++i] ?? "./sbom.cdx.json";
-    } else if (arg === "--fail-on") {
-      const val = (args[++i] ?? "").toUpperCase();
-      if (["CRITICAL", "HIGH", "MEDIUM", "LOW"].includes(val)) {
-        result.failOnSeverity = val;
-      }
-    } else if (arg === "--skip-cve") {
-      result.skipCveCheck = true;
-    } else if (arg === "--skip-upload" || arg === "--offline") {
-      result.skipUpload = true;
-    } else if (arg === "--cdx-version" || arg.startsWith("--cdx-version=")) {
-      const val = arg === "--cdx-version" ? args[++i] : arg.split("=")[1];
-      if (!val || val.startsWith("--")) {
-        throw new Error("--cdx-version requires a value");
-      }
-      if (!["1.4", "1.5", "1.6", "1.7"].includes(val)) {
-        throw new Error(`Invalid CycloneDX version: ${val}`);
-      }
-      result.cyclonedxVersion = val;
-    }
-    i++;
-  }
-  return result;
-}
-async function main() {
-  let args;
-  try {
-    args = parseArgs(process.argv);
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    logError(msg);
-    log("Run 'npx verimu --help' for usage information");
-    process.exit(2);
-  }
-  if (args.command === "version") {
-    console.log(`verimu ${VERSION}`);
-    return;
-  }
-  if (args.command === "help") {
-    printHelp();
-    return;
-  }
-  console.log(BRAND);
-  const apiKey = process.env.VERIMU_API_KEY;
-  const apiBaseUrl = process.env.VERIMU_API_URL;
-  log(`Scanning ${resolve(args.projectPath)}...`);
-  if (apiKey && !args.skipUpload) {
-    log("API key detected \u2014 results will sync to Verimu platform");
-  } else if (!apiKey) {
-    log("No VERIMU_API_KEY set \u2014 running in offline mode");
-    log("Get your API key at https://app.verimu.com/dashboard/api-keys");
-  }
-  console.log("");
-  const config = {
-    projectPath: resolve(args.projectPath),
-    sbomOutput: args.sbomOutput,
-    skipCveCheck: args.skipCveCheck,
-    cyclonedxVersion: args.cyclonedxVersion,
-    // Don't pass apiKey to scan() if --skip-upload — we'll handle upload separately for better logging
-    apiKey: apiKey && !args.skipUpload ? void 0 : void 0,
-    apiBaseUrl
-  };
-  let report;
-  try {
-    report = await scan(config);
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    logError(msg);
-    process.exit(2);
-  }
-  const reporter = new ConsoleReporter();
-  console.log(reporter.report(report));
-  if (apiKey && !args.skipUpload) {
-    console.log("");
-    log("Syncing to Verimu platform...");
-    try {
-      const uploadConfig = {
-        ...config,
-        apiKey,
-        apiBaseUrl
-      };
-      const result = await uploadToVerimu(report, uploadConfig);
-      if (result.projectCreated) {
-        logSuccess(`Project created: ${report.project.path}`);
-      }
-      logSuccess(`${result.totalDependencies} dependencies tracked`);
-      console.log(renderPlatformScan(report.project.path, result));
-      logSuccess(`Dashboard: ${result.dashboardUrl}`);
-    } catch (err) {
-      const msg = err instanceof Error ? err.message : String(err);
-      logWarn(`Platform sync failed: ${msg}`);
-      log("Your SBOM was still generated locally. You can upload it manually.");
-    }
-  }
-  console.log("");
-  log("Thanks for using Verimu \u2014 helping your team with CRA readiness");
-  console.log("");
-  if (args.failOnSeverity && shouldFailCi(report, args.failOnSeverity)) {
-    logError(`Vulnerabilities found at or above ${args.failOnSeverity} severity`);
-    process.exit(1);
-  }
-}
-function printHelp() {
-  console.log(`
-  Verimu \u2014 CRA Compliance Scanner
-
-  Usage:
-    verimu                          Scan current directory
-    verimu scan [options]           Full scan (SBOM + CVE check)
-    verimu generate-sbom [options]  Generate SBOM only (no CVE check)
-    verimu help                     Show this help
-    verimu version                  Show version
-
-  Options:
-    --path, -p <dir>       Project directory to scan (default: .)
-    --output, -o <file>    CycloneDX output path (SPDX/SWID are written alongside it)
-    --fail-on <severity>   Exit 1 if vulns at or above: CRITICAL, HIGH, MEDIUM, LOW
-    --skip-cve             Skip CVE vulnerability checking
-    --skip-upload          Don't sync to Verimu platform (even if API key is set)
-    --cdx-version <ver>    CycloneDX spec: 1.4, 1.5, 1.6, 1.7 (default: 1.7)
-
-  Environment:
-    VERIMU_API_KEY         API key for Verimu platform (from app.verimu.com)
-    VERIMU_API_URL         Custom API URL (default: https://api.verimu.com)
-
-  Examples:
-    npx verimu                                    # Quick scan
-    VERIMU_API_KEY=vmu_xxx npx verimu             # Scan + sync to platform
-    npx verimu scan --fail-on HIGH                # Fail CI on HIGH+ vulns
-    npx verimu scan --cdx-version 1.5             # Specify CycloneDX version
-    npx verimu scan --path ./backend --output ./reports/sbom.json
-
-  Supported ecosystems:
-    npm (package-lock.json)         pip (requirements.txt)
-    Maven (pom.xml)                 NuGet (packages.lock.json)
-    Cargo (Cargo.lock)              Go (go.sum)
-    Ruby (Gemfile.lock)             Composer (composer.lock)
-
-  Learn more: https://verimu.com
-  Dashboard: https://app.verimu.com
-`);
-}
-main().catch((err) => {
-  console.error("Fatal:", err);
-  process.exit(2);
-});
-//# sourceMappingURL=cli.js.map