vetguard 0.0.0 → 0.2.0

package/dist/{chunk-XXICU3EZ.js → chunk-2DIOTV5P.js}

@@ -1,3 +1,52 @@
+// src/core/ignore.ts
+function matches(finding, ignore) {
+  return finding.ruleId === ignore.rule && finding.packageName === ignore.package;
+}
+function applyIgnores(findings, ignores) {
+  if (ignores.length === 0) return { active: [...findings], suppressed: [] };
+  const active = [];
+  const suppressed = [];
+  for (const finding of findings) {
+    const ignore = ignores.find((rule) => matches(finding, rule));
+    if (ignore) {
+      suppressed.push({ ...finding, suppressedReason: ignore.reason });
+    } else {
+      active.push(finding);
+    }
+  }
+  return { active, suppressed };
+}
+
+// src/core/baseline.ts
+var BASELINE_REASON = "in baseline (pre-existing)";
+function matches2(finding, entry) {
+  return finding.ruleId === entry.rule && finding.packageName === entry.package && (finding.packageVersion ?? "") === (entry.version ?? "");
+}
+function applyBaseline(findings, baseline) {
+  if (baseline.length === 0) return { active: [...findings], suppressed: [] };
+  const active = [];
+  const suppressed = [];
+  for (const finding of findings) {
+    if (baseline.some((entry) => matches2(finding, entry))) {
+      suppressed.push({ ...finding, suppressedReason: BASELINE_REASON });
+    } else {
+      active.push(finding);
+    }
+  }
+  return { active, suppressed };
+}
+function toBaselineEntries(findings) {
+  return findings.map((f) => ({
+    rule: f.ruleId,
+    package: f.packageName,
+    ...f.packageVersion === void 0 ? {} : { version: f.packageVersion }
+  }));
+}
+
+// src/config.ts
+import { readFile } from "fs/promises";
+import path from "path";
+
 // src/core/model.ts
 var SEVERITY_ORDER = {
   critical: 4,
@@ -7,24 +56,148 @@ var SEVERITY_ORDER = {
   info: 0
 };
 
+// src/config.ts
+var CONFIG_FILENAME = "vetguard.config.json";
+var ConfigError = class extends Error {
+};
+function isSeverity(value) {
+  return typeof value === "string" && value in SEVERITY_ORDER;
+}
+function validateIgnore(entry, index) {
+  if (typeof entry !== "object" || entry === null) {
+    throw new ConfigError(`ignore[${index}] must be an object`);
+  }
+  const { rule, package: pkg2, reason } = entry;
+  if (typeof rule !== "string" || rule.length === 0) {
+    throw new ConfigError(`ignore[${index}].rule is required (the detector id to suppress)`);
+  }
+  if (typeof pkg2 !== "string" || pkg2.length === 0) {
+    throw new ConfigError(`ignore[${index}].package is required (the package name to suppress)`);
+  }
+  if (typeof reason !== "string" || reason.trim().length === 0) {
+    throw new ConfigError(
+      `ignore[${index}].reason is required and must be non-empty (${rule} on ${pkg2}); a suppression must be explained`
+    );
+  }
+  return { rule, package: pkg2, reason };
+}
+function validate(raw) {
+  if (typeof raw !== "object" || raw === null) {
+    throw new ConfigError(`${CONFIG_FILENAME} must contain a JSON object`);
+  }
+  const obj = raw;
+  const config = {};
+  if (obj.failOn !== void 0) {
+    if (!isSeverity(obj.failOn)) {
+      throw new ConfigError(`failOn must be one of ${Object.keys(SEVERITY_ORDER).join(", ")}`);
+    }
+    config.failOn = obj.failOn;
+  }
+  if (obj.offline !== void 0) {
+    if (typeof obj.offline !== "boolean") throw new ConfigError("offline must be a boolean");
+    config.offline = obj.offline;
+  }
+  if (obj.ignore !== void 0) {
+    if (!Array.isArray(obj.ignore)) throw new ConfigError("ignore must be an array");
+    config.ignore = obj.ignore.map(validateIgnore);
+  }
+  return config;
+}
+async function loadConfig(dir) {
+  const configPath = path.join(dir, CONFIG_FILENAME);
+  let text;
+  try {
+    text = await readFile(configPath, "utf8");
+  } catch {
+    return void 0;
+  }
+  let raw;
+  try {
+    raw = JSON.parse(text);
+  } catch (err) {
+    throw new ConfigError(
+      `${configPath} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  return validate(raw);
+}
+
+// src/baseline-io.ts
+import { readFile as readFile2, writeFile } from "fs/promises";
+import path2 from "path";
+var BASELINE_FILENAME = ".vetguard-baseline.json";
+var BASELINE_SCHEMA_VERSION = 1;
+var BaselineError = class extends Error {
+};
+function validateEntry(entry, index) {
+  if (typeof entry !== "object" || entry === null) {
+    throw new BaselineError(`${BASELINE_FILENAME} findings[${index}] must be an object`);
+  }
+  const { rule, package: pkg2, version } = entry;
+  if (typeof rule !== "string" || typeof pkg2 !== "string") {
+    throw new BaselineError(
+      `${BASELINE_FILENAME} findings[${index}] needs string rule and package`
+    );
+  }
+  if (version !== void 0 && typeof version !== "string") {
+    throw new BaselineError(`${BASELINE_FILENAME} findings[${index}].version must be a string`);
+  }
+  return { rule, package: pkg2, ...version === void 0 ? {} : { version } };
+}
+async function readBaseline(dir) {
+  const filePath = path2.join(dir, BASELINE_FILENAME);
+  let text;
+  try {
+    text = await readFile2(filePath, "utf8");
+  } catch {
+    return void 0;
+  }
+  let raw;
+  try {
+    raw = JSON.parse(text);
+  } catch (err) {
+    throw new BaselineError(
+      `${filePath} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  if (typeof raw !== "object" || raw === null || !Array.isArray(raw.findings)) {
+    throw new BaselineError(`${filePath} must be an object with a findings array`);
+  }
+  return raw.findings.map(validateEntry);
+}
+async function writeBaseline(dir, findings, generatedAt) {
+  const filePath = path2.join(dir, BASELINE_FILENAME);
+  const file = {
+    schemaVersion: BASELINE_SCHEMA_VERSION,
+    generatedAt,
+    findings
+  };
+  await writeFile(filePath, JSON.stringify(file, null, 2) + "\n", "utf8");
+  return filePath;
+}
+
 // src/core/engine.ts
 function runDetectors(facts, detectors, context) {
-  const findings = [];
+  const raw = [];
   for (const pkg2 of facts) {
     for (const detector of detectors) {
-      findings.push(...detector.detect(pkg2));
+      raw.push(...detector.detect(pkg2));
     }
   }
-  findings.sort(
+  raw.sort(
     (a, b) => SEVERITY_ORDER[b.severity] - SEVERITY_ORDER[a.severity] || a.packageName.localeCompare(b.packageName)
   );
-  const verdict = decideVerdict(findings, context.unverified);
+  const ignored = applyIgnores(raw, context.ignore ?? []);
+  const baselined = applyBaseline(ignored.active, context.baseline ?? []);
+  const suppressed = [...ignored.suppressed, ...baselined.suppressed];
+  const verdict = decideVerdict(baselined.active, context.unverified);
   return {
     verdict,
     target: context.target,
     ecosystem: context.ecosystem,
     packagesScanned: facts.length,
-    findings,
+    findings: baselined.active,
+    ...suppressed.length > 0 ? { suppressed } : {},
     unverified: context.unverified,
     generatedAt: context.generatedAt
   };
@@ -330,9 +503,25 @@ function createTyposquatDetector(corpus = defaultCorpus) {
       if (pkg2.source !== "registry") return [];
       if (pkg2.name.startsWith("@")) return [];
       if (corpus.has(pkg2.name)) return [];
-      if (pkg2.existsOnRegistry === void 0) return [];
+      const offline = pkg2.existsOnRegistry === void 0 && pkg2.existenceUnverifiedReason === "offline";
+      if (pkg2.existsOnRegistry === void 0 && !offline) return [];
       const near = corpus.findNearMiss(pkg2.name);
       if (!near) return [];
+      if (offline) {
+        return [
+          {
+            ruleId: this.id,
+            severity: "low",
+            confidence: "low",
+            packageName: pkg2.name,
+            ...pkg2.version === void 0 ? {} : { packageVersion: pkg2.version },
+            title: "Name closely resembles a popular package",
+            detail: `This name differs from the popular package "${near.target}" by a single ${near.transform}. Attackers register look-alikes to catch typos and hallucinated names. Confirm you meant this package and not "${near.target}".`,
+            evidence: `resembles "${near.target}" (popularity rank ${near.rank + 1}) via ${near.transform}; existence and adoption unverified (offline scan)`,
+            ...pkg2.evidencePath === void 0 ? {} : { location: pkg2.evidencePath }
+          }
+        ];
+      }
       const downloads = pkg2.weeklyDownloads;
       const established = downloads !== void 0 && downloads >= TYPOSQUAT_POPULAR_FLOOR;
       if (pkg2.existsOnRegistry === true && established) return [];
@@ -388,9 +577,26 @@ function createHallucinationNameDetector(corpus = defaultCorpus) {
       if (pkg2.source !== "registry") return [];
       if (pkg2.name.startsWith("@")) return [];
       if (corpus.has(pkg2.name)) return [];
-      if (pkg2.existsOnRegistry === void 0) return [];
+      const offline = pkg2.existsOnRegistry === void 0 && pkg2.existenceUnverifiedReason === "offline";
+      if (pkg2.existsOnRegistry === void 0 && !offline) return [];
       const match = corpus.findRecombination(pkg2.name);
       if (!match) return [];
+      const how = match.kind === "affix-drop" ? `drops the convention prefix of "${match.victim}"` : `reorders the tokens of "${match.victim}"`;
+      if (offline) {
+        return [
+          {
+            ruleId: this.id,
+            severity: "low",
+            confidence: "low",
+            packageName: pkg2.name,
+            ...pkg2.version === void 0 ? {} : { packageVersion: pkg2.version },
+            title: "Name looks like a recombination of a popular package",
+            detail: `This name ${how}, a popular package, but is not itself that package. AI assistants hallucinate plausible names like this, and attackers register them. Confirm you did not mean "${match.victim}".`,
+            evidence: `token match to "${match.victim}" (popularity rank ${match.rank + 1}), ${match.kind}; existence and adoption unverified (offline scan)`,
+            ...pkg2.evidencePath === void 0 ? {} : { location: pkg2.evidencePath }
+          }
+        ];
+      }
       const downloads = pkg2.weeklyDownloads;
       const established = downloads !== void 0 && downloads >= HALLUCINATION_POPULAR_FLOOR;
       if (pkg2.existsOnRegistry === true && established) return [];
@@ -413,7 +619,6 @@ function createHallucinationNameDetector(corpus = defaultCorpus) {
           confidence = "low";
         }
       }
-      const how = match.kind === "affix-drop" ? `drops the convention prefix of "${match.victim}"` : `reorders the tokens of "${match.victim}"`;
       return [
         {
           ruleId: this.id,
@@ -442,6 +647,22 @@ var builtinDetectors = [
   hallucinationName
 ];
 
+// src/output/color.ts
+var CODES = { red: 31, green: 32, yellow: 33, blue: 34, gray: 90, bold: 1 };
+function paint(text, color, enabled) {
+  return enabled ? `\x1B[${CODES[color]}m${text}\x1B[0m` : text;
+}
+var SEVERITY_COLOR = {
+  critical: "red",
+  high: "red",
+  medium: "yellow",
+  low: "blue",
+  info: "gray"
+};
+function severityColor(severity) {
+  return SEVERITY_COLOR[severity];
+}
+
 // src/output/terminal.ts
 var SEVERITY_LABEL = {
   critical: "CRIT",
@@ -450,31 +671,56 @@ var SEVERITY_LABEL = {
   low: "LOW ",
   info: "INFO"
 };
-function renderTerminal(report) {
+var VERDICT_COLOR = {
+  findings: "red",
+  "could-not-verify": "yellow",
+  clean: "green"
+};
+function renderTerminal(report, options = {}) {
+  const color = options.color ?? false;
+  const quiet = options.quiet ?? false;
   const lines = [];
-  const from = report.basis === "lockfile" ? " from package-lock.json" : "";
-  lines.push(`vetguard: scanned ${report.packagesScanned} package(s) in ${report.target}${from}`);
-  for (const warning of report.warnings ?? []) {
-    lines.push(`warning: ${warning}`);
-  }
-  if (report.findings.length === 0) {
-    lines.push(
-      report.verdict === "could-not-verify" ? "No findings, but some packages could not be verified (see below)." : "No findings."
-    );
+  if (!quiet) {
+    const from = report.basis === "lockfile" ? " from package-lock.json" : "";
+    lines.push(`vetguard: scanned ${report.packagesScanned} package(s) in ${report.target}${from}`);
+    for (const warning of report.warnings ?? []) {
+      lines.push(paint(`warning: ${warning}`, "yellow", color));
+    }
+    if (report.findings.length === 0) {
+      lines.push(
+        report.verdict === "could-not-verify" ? "No findings, but some packages could not be verified (see below)." : "No findings."
+      );
+    }
   }
   for (const f of report.findings) {
     const version = f.packageVersion ? `@${f.packageVersion}` : "";
-    lines.push(`[${SEVERITY_LABEL[f.severity]}] ${f.packageName}${version}  (${f.ruleId})`);
+    const label = paint(`[${SEVERITY_LABEL[f.severity]}]`, severityColor(f.severity), color);
+    lines.push(`${label} ${f.packageName}${version}  (${f.ruleId})`);
     lines.push(`       ${f.title}`);
     lines.push(`       ${f.detail}`);
     if (f.location) lines.push(`       at ${f.location}`);
   }
-  if (report.unverified.length > 0) {
-    lines.push(`Could not verify: ${report.unverified.join(", ")}`);
+  if (!quiet) {
+    if (report.unverified.length > 0) {
+      lines.push(`Could not verify: ${report.unverified.join(", ")}`);
+    }
+    for (const f of report.suppressed ?? []) {
+      const version = f.packageVersion ? `@${f.packageVersion}` : "";
+      lines.push(
+        paint(
+          `[SUPPRESSED] ${f.packageName}${version} (${f.ruleId}): ${f.suppressedReason}`,
+          "gray",
+          color
+        )
+      );
+    }
   }
-  lines.push(`Verdict: ${report.verdict}`);
+  lines.push(`Verdict: ${paint(report.verdict, verdictColor(report.verdict), color)}`);
   return lines.join("\n");
 }
+function verdictColor(verdict) {
+  return VERDICT_COLOR[verdict];
+}
 
 // src/output/json.ts
 var JSON_SCHEMA_VERSION = 1;
@@ -541,6 +787,60 @@ function renderSarif(report, toolVersion, detectors = builtinDetectors) {
   return JSON.stringify(doc, null, 2);
 }
 
+// src/output/markdown.ts
+var MARKDOWN_COMMENT_MARKER = "<!-- vetguard-report -->";
+var SEVERITY_LABEL2 = {
+  critical: "critical",
+  high: "high",
+  medium: "medium",
+  low: "low",
+  info: "info"
+};
+function cell(value) {
+  return value.replace(/[\r\n]+/g, " ").replace(/`/g, "\\`").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/\|/g, "\\|");
+}
+function renderMarkdown(report) {
+  const lines = [MARKDOWN_COMMENT_MARKER];
+  const from = report.basis === "lockfile" ? " from `package-lock.json`" : "";
+  lines.push(`### vetguard: ${report.verdict}`);
+  lines.push("");
+  lines.push(`Scanned ${report.packagesScanned} package(s)${from} in \`${report.target}\`.`);
+  for (const warning of report.warnings ?? []) {
+    lines.push("");
+    lines.push(`> warning: ${warning}`);
+  }
+  if (report.findings.length > 0) {
+    lines.push("");
+    lines.push("| Severity | Package | Rule | Finding |");
+    lines.push("| --- | --- | --- | --- |");
+    for (const f of report.findings) {
+      const pkg2 = f.packageVersion ? `${f.packageName}@${f.packageVersion}` : f.packageName;
+      lines.push(
+        `| ${SEVERITY_LABEL2[f.severity]} | ${cell(pkg2)} | ${cell(f.ruleId)} | ${cell(f.title)} |`
+      );
+    }
+  } else {
+    lines.push("");
+    lines.push(
+      report.verdict === "could-not-verify" ? "No findings, but some packages could not be verified." : "No findings."
+    );
+  }
+  if (report.unverified.length > 0) {
+    lines.push("");
+    lines.push(`Could not verify ${report.unverified.length} package(s).`);
+  }
+  const suppressed = report.suppressed ?? [];
+  if (suppressed.length > 0) {
+    lines.push("");
+    lines.push(`${suppressed.length} finding(s) suppressed by config:`);
+    for (const f of suppressed) {
+      const pkg2 = f.packageVersion ? `${f.packageName}@${f.packageVersion}` : f.packageName;
+      lines.push(`- ${cell(pkg2)} (${cell(f.ruleId)}): ${cell(f.suppressedReason)}`);
+    }
+  }
+  return lines.join("\n") + "\n";
+}
+
 // src/output/exit-code.ts
 function resolveExitCode(report, failOn) {
   if (report.findings.length === 0) return 0;
@@ -549,9 +849,19 @@ function resolveExitCode(report, failOn) {
   return report.findings.some((f) => SEVERITY_ORDER[f.severity] >= threshold) ? 1 : 0;
 }
 
+// src/core/diff.ts
+function key(fact) {
+  const origin = fact.integrity ?? fact.resolvedUrl ?? fact.source ?? "";
+  return `${fact.name}@${fact.version ?? ""}#${origin}`;
+}
+function introducedFacts(base, head) {
+  const baseKeys = new Set(base.map(key));
+  return head.filter((fact) => !baseKeys.has(key(fact)));
+}
+
 // src/ecosystems/npm/manifest.ts
-import { readFile } from "fs/promises";
-import path from "path";
+import { readFile as readFile3 } from "fs/promises";
+import path3 from "path";
 function classifySource(spec) {
   if (spec.startsWith("npm:")) return "alias";
   if (spec.startsWith("file:")) return "file";
@@ -564,10 +874,10 @@ function classifySource(spec) {
   return "registry";
 }
 async function readManifestFacts(dir) {
-  const manifestPath = path.join(dir, "package.json");
+  const manifestPath = path3.join(dir, "package.json");
   let raw;
   try {
-    raw = JSON.parse(await readFile(manifestPath, "utf8"));
+    raw = JSON.parse(await readFile3(manifestPath, "utf8"));
   } catch (err) {
     throw new Error(
       `Could not read ${manifestPath}: ${err instanceof Error ? err.message : String(err)}`
@@ -596,15 +906,15 @@ async function readManifestFacts(dir) {
 }
 
 // src/ecosystems/npm/lockfile.ts
-import { readFile as readFile2, access } from "fs/promises";
-import path2 from "path";
+import { readFile as readFile4, access } from "fs/promises";
+import path4 from "path";
 var REGISTRY_HOST = "registry.npmjs.org";
 var OTHER_LOCKFILES = ["yarn.lock", "pnpm-lock.yaml", "bun.lockb"];
 async function detectOtherLockfiles(dir) {
   const present = [];
   for (const file of OTHER_LOCKFILES) {
     try {
-      await access(path2.join(dir, file));
+      await access(path4.join(dir, file));
       present.push(file);
     } catch {
       continue;
@@ -633,11 +943,10 @@ function kindFromEntry(entry) {
   if (entry.optional) return "optional";
   return "prod";
 }
-async function readLockfile(dir) {
-  const lockPath = path2.join(dir, "package-lock.json");
+async function readLockfileFile(lockPath) {
   let text;
   try {
-    text = await readFile2(lockPath, "utf8");
+    text = await readFile4(lockPath, "utf8");
   } catch {
     return { status: "absent" };
   }
@@ -647,7 +956,7 @@ async function readLockfile(dir) {
   } catch (err) {
     return {
       status: "unsupported",
-      reason: `package-lock.json is not valid JSON: ${err instanceof Error ? err.message : String(err)}`
+      reason: `${lockPath} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`
     };
   }
   const version = doc.lockfileVersion ?? 0;
@@ -678,6 +987,9 @@ async function readLockfile(dir) {
   }
   return { status: "ok", facts, lockfileVersion: version };
 }
+async function readLockfile(dir) {
+  return readLockfileFile(path4.join(dir, "package-lock.json"));
+}
 
 // src/ecosystems/npm/registry.ts
 var DEFAULT_REGISTRY = "https://registry.npmjs.org";
@@ -745,11 +1057,11 @@ function createRegistryClient(options = {}) {
   }
   return {
     getPackument(name, version) {
-      const key = version ? `${name}@${version}` : name;
-      const existing = cache.get(key);
+      const key2 = version ? `${name}@${version}` : name;
+      const existing = cache.get(key2);
       if (existing) return existing;
       const pending = fetchPackument(name, version);
-      cache.set(key, pending);
+      cache.set(key2, pending);
       return pending;
     }
   };
@@ -820,7 +1132,10 @@ async function enrichWithRegistry(input, client, options = {}) {
   const now = options.now ? options.now() : /* @__PURE__ */ new Date();
   const unverified = [];
   const facts = await mapWithConcurrency(input, concurrency, async (fact) => {
-    if (fact.source !== "registry") return fact;
+    if (fact.source !== "registry") {
+      if (fact.source === "unknown") unverified.push(fact.name);
+      return fact;
+    }
     const [lookup, weeklyDownloads] = await Promise.all([
       client.getPackument(fact.name, fact.version),
       options.downloads?.getWeeklyDownloads(fact.name)
@@ -830,7 +1145,8 @@ async function enrichWithRegistry(input, client, options = {}) {
     }
     if (lookup.status === "unverified") {
       unverified.push(fact.name);
-      return fact;
+      const existenceUnverifiedReason = lookup.reason === "offline" ? "offline" : "error";
+      return { ...fact, existenceUnverifiedReason };
     }
     const p = lookup.packument;
     const ageDays = ageDaysFrom(p.firstPublishAt, now);
@@ -876,6 +1192,16 @@ function enrichOptions(options) {
     ...options.now === void 0 ? {} : { now: options.now }
   };
 }
+function reportContext(options, target, unverified) {
+  return {
+    target,
+    ecosystem: "npm",
+    unverified,
+    generatedAt: timestamp(options),
+    ...options.ignore === void 0 ? {} : { ignore: options.ignore },
+    ...options.baseline === void 0 ? {} : { baseline: options.baseline }
+  };
+}
 async function scanProject(dir, options = {}) {
   const lockfile = await readLockfile(dir);
   const warnings = [];
@@ -899,14 +1225,38 @@ async function scanProject(dir, options = {}) {
     registryFor(options),
     enrichOptions(options)
   );
-  const report = runDetectors(facts, options.detectors ?? builtinDetectors, {
-    target: dir,
-    ecosystem: "npm",
-    unverified,
-    generatedAt: timestamp(options)
-  });
+  const report = runDetectors(
+    facts,
+    options.detectors ?? builtinDetectors,
+    reportContext(options, dir, unverified)
+  );
   return { ...report, basis, ...warnings.length > 0 ? { warnings } : {} };
 }
+async function diffScan(basePath, headPath, options = {}) {
+  const base = await readLockfileFile(basePath);
+  if (base.status !== "ok") {
+    throw new Error(`base lockfile ${basePath}: ${lockfileProblem(base)}`);
+  }
+  const head = await readLockfileFile(headPath);
+  if (head.status !== "ok") {
+    throw new Error(`head lockfile ${headPath}: ${lockfileProblem(head)}`);
+  }
+  const introduced = introducedFacts(base.facts, head.facts);
+  const { facts, unverified } = await enrichWithRegistry(
+    introduced,
+    registryFor(options),
+    enrichOptions(options)
+  );
+  const report = runDetectors(
+    facts,
+    options.detectors ?? builtinDetectors,
+    reportContext(options, `${basePath}..${headPath}`, unverified)
+  );
+  return { ...report, basis: "lockfile" };
+}
+function lockfileProblem(outcome) {
+  return outcome.status === "unsupported" ? outcome.reason : "file not found";
+}
 async function checkPackage(specInput, options = {}) {
   const spec = parsePackageSpec(specInput);
   const base = {
@@ -920,12 +1270,11 @@ async function checkPackage(specInput, options = {}) {
     registryFor(options),
     enrichOptions(options)
   );
-  return runDetectors(facts, options.detectors ?? builtinDetectors, {
-    target: specInput,
-    ecosystem: "npm",
-    unverified,
-    generatedAt: timestamp(options)
-  });
+  return runDetectors(
+    facts,
+    options.detectors ?? builtinDetectors,
+    reportContext(options, specInput, unverified)
+  );
 }
 
 // src/index.ts
@@ -935,12 +1284,17 @@ var VERSION = pkg.version;
 
 export {
   SEVERITY_ORDER,
+  applyIgnores,
+  applyBaseline,
+  toBaselineEntries,
   runDetectors,
   builtinDetectors,
+  introducedFacts,
   classifySource,
   readManifestFacts,
   detectOtherLockfiles,
   nameFromLockPath,
+  readLockfileFile,
   readLockfile,
   enrichWithRegistry,
   encodePackageName,
@@ -948,11 +1302,21 @@ export {
   createDownloadsClient,
   parsePackageSpec,
   scanProject,
+  diffScan,
   checkPackage,
+  CONFIG_FILENAME,
+  ConfigError,
+  loadConfig,
+  BASELINE_FILENAME,
+  BaselineError,
+  readBaseline,
+  writeBaseline,
   renderTerminal,
   JSON_SCHEMA_VERSION,
   renderJson,
   renderSarif,
+  MARKDOWN_COMMENT_MARKER,
+  renderMarkdown,
   resolveExitCode,
   VERSION
 };