Module db 

Advisory-DB loading, freshness, provenance, and enrichment fetch — the binary’s I/O wiring, kept out of the command runners. Everything here is Args-agnostic (it takes primitives), so scan and the vex subcommands share it without coupling to a particular clap struct.