{
  "purpose": "Historical dependency-audit evidence for the migration scope; this is not the current lockfile.",
  "baseline": {
    "total": 7,
    "high": 1,
    "moderate": 5,
    "low": 1,
    "source": "npm audit --json captured during the migration"
  },
  "intermediate": {
    "total": 1,
    "high": 0,
    "moderate": 0,
    "low": 1
  },
  "current": {
    "total": 0,
    "high": 0,
    "moderate": 0,
    "low": 0,
    "command": "npm --prefix web audit --audit-level=low"
  },
  "scopeDecision": "Do not restore the vulnerable baseline. The current development lockfile remains at zero vulnerabilities; production security review may be repeated before release."
}