Walk a repository root, parse its manifest and lockfile, and return a typed set of findings (vulnerabilities, secrets, malformed inputs). Safe by default: paths are resolved through security/paths.ts and the run is bounded by ResourceGovernor.

Build a CycloneDX 1.5 SBOM for the repository. Components include name, version, purl, and declared licenses when available. Output is validated against the official CycloneDX JS schema before being returned.

Audit the repository dependencies against OSV (api.osv.dev). Supports a deterministic mock adapter (default, no network) and a live adapter (timeout, bounded retry, TTL cache, sliding-window rate limit). Returns the dependency list and the matched vulnerabilities.

Assemble the final evidence report. The JSON form carries schemaVersion, generatedAt, inputs, findings, reachability, remediation, verification, limitations, and redactions. The HTML form is self-contained (no external assets, inline CSS/JS, accessible markup) and renders a stable layout suitable for review and audit.