@appland/scanner 1.89.1 → 1.90.0

package/CHANGELOG.md

@@ -1,3 +1,10 @@
+# [@appland/scanner-v1.90.0](https://github.com/getappmap/appmap-js/compare/@appland/scanner-v1.89.1...@appland/scanner-v1.90.0) (2026-06-24)
+
+
+### Features
+
+* **scanner:** revive enriched scan:completed telemetry (watch mode) ([4dd20b1](https://github.com/getappmap/appmap-js/commit/4dd20b1c124dbb00badc21cd44afcb0d7ae3fd67))
+
 # [@appland/scanner-v1.89.1](https://github.com/getappmap/appmap-js/compare/@appland/scanner-v1.89.0...@appland/scanner-v1.89.1) (2026-03-04)
 
 

package/built/analyzer/recordSecrets.d.ts

@@ -1,5 +1,5 @@
 import { Event } from '@appland/models';
-export declare type Secret = {
+export type Secret = {
     generatorEvent: Event;
     value: string;
 };

package/built/appMapIndex.js

@@ -1,12 +1,9 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 const models_1 = require("@appland/models");
-const lru_cache_1 = __importDefault(require("lru-cache"));
-const NormalizedSQLBySQLString = new lru_cache_1.default({ max: 10000 });
-const ASTBySQLString = new lru_cache_1.default({ max: 1000 });
+const lru_cache_1 = require("lru-cache");
+const NormalizedSQLBySQLString = new lru_cache_1.LRUCache({ max: 10000 });
+const ASTBySQLString = new lru_cache_1.LRUCache({ max: 1000 });
 class AppMapIndex {
     constructor(appMap) {
         this.appMap = appMap;

package/built/cli/scan/breakpoint.d.ts

@@ -1,7 +1,7 @@
 import { Event } from '@appland/models';
 import Check from '../../check';
 import { MatchResult } from '../../types';
-export declare type ExecutionContext = {
+export type ExecutionContext = {
     counter: number;
     depth: number;
     eventName: string;

package/built/cli/scan/interactiveScan.d.ts

@@ -1,5 +1,5 @@
 import Configuration from '../../configuration/types/configuration';
-declare type InteractiveScanOptions = {
+type InteractiveScanOptions = {
     configuration: Configuration;
     appmapFile?: string | string[];
     appmapDir?: string;

package/built/cli/scan/singleScan.d.ts

@@ -1,5 +1,5 @@
 import Configuration from '../../configuration/types/configuration';
-declare type SingleScanOptions = {
+type SingleScanOptions = {
     appmapFile?: string | string[];
     appmapDir?: string;
     configuration: Configuration;

package/built/cli/scan/ui/interactiveProgess.d.ts

@@ -7,7 +7,7 @@ import ProgressReporter from '../../../progressReporter';
 import { MatchResult } from '../../../types';
 import { ScopeName } from '../../../index';
 import { Breakpoint } from '../breakpoint';
-declare type ContextVariables = {
+type ContextVariables = {
     event?: Event;
     matchResult?: string | boolean | MatchResult[];
 };

package/built/cli/scan/ui/state/hitBreakpoint.js

@@ -40,6 +40,7 @@ const initial_1 = __importDefault(require("./initial"));
 function hitBreakpoint(context) {
     var _a, _b;
     return __awaiter(this, void 0, void 0, function* () {
+        var _c;
         const choices = {
             'show hints': 'hint',
             'evaluate expression': 'eval',
@@ -62,7 +63,7 @@ function hitBreakpoint(context) {
         const action = choices[actionName];
         if (!action)
             return initial_1.default;
-        return (yield Promise.resolve().then(() => __importStar(require(`./${action}`)))).default;
+        return (yield (_c = `./${action}`, Promise.resolve().then(() => __importStar(require(_c))))).default;
     });
 }
 exports.default = hitBreakpoint;

package/built/cli/scan/ui/state/initial.js

@@ -38,6 +38,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const userInteraction_1 = __importDefault(require("../userInteraction"));
 function initial(_context) {
     return __awaiter(this, void 0, void 0, function* () {
+        var _a;
         const choices = {
             'add breakpoint': 'addBreakpoint',
             'run scan': 'scan',
@@ -52,7 +53,7 @@ function initial(_context) {
         const action = choices[actionName];
         if (!action)
             return;
-        return (yield Promise.resolve().then(() => __importStar(require(`./${action}`)))).default;
+        return (yield (_a = `./${action}`, Promise.resolve().then(() => __importStar(require(_a))))).default;
     });
 }
 exports.default = initial;

package/built/cli/scan/ui/state.d.ts

@@ -1,2 +1,2 @@
 import ScanContext from './scanContext';
-export declare type State = (context: ScanContext) => Promise<State | undefined>;
+export type State = (context: ScanContext) => Promise<State | undefined>;

package/built/cli/scan/watchScan.d.ts

@@ -2,7 +2,7 @@
 import * as chokidar from 'chokidar';
 import { TimestampedConfiguration } from '../../configuration/configurationProvider';
 import EventEmitter from 'events';
-export declare type WatchScanOptions = {
+export type WatchScanOptions = {
     appId?: string;
     appmapDir: string;
     configFile: string;
@@ -19,6 +19,7 @@ export declare class Watcher {
     appmapPoller?: chokidar.FSWatcher;
     configWatcher?: chokidar.FSWatcher;
     scanEventEmitter: EventEmitter;
+    private scanTelemetry;
     constructor(options: WatchScanOptions);
     watch(): Promise<void>;
     isError(error: unknown, code: string): boolean;

package/built/cli/scan/watchScan.js

@@ -47,6 +47,7 @@ const scanner_1 = __importDefault(require("./scanner"));
 const configurationProvider_1 = require("../../configuration/configurationProvider");
 const telemetry_1 = require("@appland/telemetry");
 const events_1 = __importDefault(require("events"));
+const watchScanTelemetry_1 = require("./watchScanTelemetry");
 const isAncestorPath_1 = __importDefault(require("../../util/isAncestorPath"));
 const util_1 = require("util");
 const console_1 = require("console");
@@ -80,6 +81,7 @@ class Watcher {
         this.queue = (0, async_1.queue)((0, node_util_1.callbackify)(this.scan.bind(this)), 2);
         this.processing = new Set();
         this.queue.error((error, task) => console.warn(`Problem processing ${task}:\n`, error));
+        this.scanTelemetry = new watchScanTelemetry_1.WatchScanTelemetry(this.scanEventEmitter, options.appmapDir);
     }
     watch() {
         return __awaiter(this, void 0, void 0, function* () {
@@ -155,6 +157,7 @@ class Watcher {
     }
     close() {
         return __awaiter(this, void 0, void 0, function* () {
+            yield this.scanTelemetry.cancel();
             yield Promise.all(['appmapWatcher', 'appmapPoller', 'configWatcher'].map((k) => {
                 var _a;
                 const closer = (_a = this[k]) === null || _a === void 0 ? void 0 : _a.close();

package/built/cli/scan/watchScanTelemetry.d.ts

@@ -0,0 +1,14 @@
+/// <reference types="node" />
+import type { EventEmitter } from 'stream';
+import { ScanResults } from '../../report/scanResults';
+export type ScanEvent = {
+    scanResults: ScanResults;
+    elapsed: number;
+};
+export declare class WatchScanTelemetry {
+    private readonly appmapDir?;
+    private readonly aggregator;
+    constructor(scanEvents: EventEmitter, appmapDir?: string | undefined);
+    cancel(): Promise<void>;
+    private sendTelemetry;
+}

package/built/cli/scan/watchScanTelemetry.js

@@ -0,0 +1,35 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WatchScanTelemetry = void 0;
+const eventAggregator_1 = __importDefault(require("../../util/eventAggregator"));
+const scanResults_1 = require("../../report/scanResults");
+class WatchScanTelemetry {
+    constructor(scanEvents, appmapDir) {
+        this.appmapDir = appmapDir;
+        this.aggregator = new eventAggregator_1.default(scanEvents, 'scan', (events) => this.sendTelemetry(events));
+    }
+    cancel() {
+        return this.aggregator.cancel();
+    }
+    sendTelemetry(scanEvents) {
+        let elapsed = 0;
+        const telemetryScanResults = new scanResults_1.ScanResults();
+        for (const scanEvent of scanEvents) {
+            telemetryScanResults.aggregate(scanEvent.scanResults);
+            elapsed += scanEvent.elapsed;
+        }
+        return (0, scanResults_1.sendScanResultsTelemetry)({
+            ruleIds: telemetryScanResults.summary.rules,
+            numAppMaps: telemetryScanResults.summary.numAppMaps,
+            numFindings: telemetryScanResults.summary.numFindings,
+            findingCountsByRule: telemetryScanResults.summary.findingCountsByRule,
+            findingCountsByImpactDomain: telemetryScanResults.summary.findingCountsByImpactDomain,
+            elapsedMs: elapsed,
+            appmapDir: this.appmapDir,
+        });
+    }
+}
+exports.WatchScanTelemetry = WatchScanTelemetry;

package/built/cli/scan.d.ts

@@ -1,7 +1,7 @@
 import { Metadata } from '@appland/models';
 import Check from '../check';
 import { Finding } from '../index';
-declare type Result = {
+type Result = {
     appMapMetadata: Record<string, Metadata>;
     findings: Finding[];
 };

package/built/configuration/configurationProvider.d.ts

@@ -3,7 +3,7 @@ import Configuration from './types/configuration';
 import RuleInstance from '../ruleInstance';
 export declare function loadRule(ruleName: string): Promise<RuleInstance>;
 export declare function loadConfig(config: Configuration): Promise<Check[]>;
-export declare type TimestampedConfiguration = Configuration & {
+export type TimestampedConfiguration = Configuration & {
     timestampMs: number;
 };
 export declare function parseConfigFile(configPath: string): Promise<TimestampedConfiguration>;

package/built/configuration/configurationProvider.js

@@ -52,9 +52,10 @@ const ajv = new ajv_1.default();
 ajv.addSchema(match_pattern_config_json_1.default);
 function loadFromFile(ruleName) {
     return () => __awaiter(this, void 0, void 0, function* () {
+        var _a;
         let ruleSpec;
         try {
-            ruleSpec = yield Promise.resolve().then(() => __importStar(require(`../rules/${ruleName}`)));
+            ruleSpec = yield (_a = `../rules/${ruleName}`, Promise.resolve().then(() => __importStar(require(_a))));
         }
         catch (e) {
             return;
@@ -64,30 +65,31 @@ function loadFromFile(ruleName) {
 }
 function loadFromDir(ruleName) {
     return () => __awaiter(this, void 0, void 0, function* () {
+        var _a, _b, _c;
         let metadata;
         let rule;
         let options;
         try {
-            metadata = (yield Promise.resolve().then(() => __importStar(require(`../rules/${ruleName}/metadata`)))).default;
+            metadata = (yield (_a = `../rules/${ruleName}/metadata`, Promise.resolve().then(() => __importStar(require(_a))))).default;
         }
         catch (e) {
             return;
         }
         try {
-            rule = (yield Promise.resolve().then(() => __importStar(require(`../rules/${ruleName}/rule`)))).default;
+            rule = (yield (_b = `../rules/${ruleName}/rule`, Promise.resolve().then(() => __importStar(require(_b))))).default;
         }
-        catch (_a) {
+        catch (_d) {
             console.warn(`Rule ${ruleName} has no rule.js or rule.ts file, or the file doesn't have a default export`);
             return;
         }
         if ((0, util_1.verbose)())
             console.log(`Loaded rule ${ruleName}: ${rule}`);
         try {
-            options = (yield Promise.resolve().then(() => __importStar(require(`../rules/${ruleName}/options`)))).default;
+            options = (yield (_c = `../rules/${ruleName}/options`, Promise.resolve().then(() => __importStar(require(_c))))).default;
             if ((0, util_1.verbose)())
                 console.log(`Loaded rule ${ruleName} options: ${options}`);
         }
-        catch (_b) {
+        catch (_e) {
             // This is OK
         }
         const description = (0, parseRuleDescription_1.default)(ruleName);

package/built/configuration/types/matchEventConfig.d.ts

@@ -1,5 +1,5 @@
 import MatchPatternConfig from './matchPatternConfig';
-declare type PropertyName = 'id' | 'type' | 'fqid' | 'query' | 'route';
+type PropertyName = 'id' | 'type' | 'fqid' | 'query' | 'route';
 export default interface MatchEventConfig {
     property: PropertyName;
     test: MatchPatternConfig;

package/built/database/visit.d.ts

@@ -1,5 +1,5 @@
 import { SqliteParser } from '@appland/models/types/sqlite-parser';
-declare type Callbacks = {
+type Callbacks = {
     [Node in SqliteParser.Node as `${Node['type']}.${Node['variant']}`]?: (node: Node) => void;
 };
 export declare function visit(node: SqliteParser.Node, callbacks: Callbacks): void;

package/built/index.d.ts

@@ -19,11 +19,11 @@ import Configuration from './configuration/types/configuration';
  * of what the code is trying to do. But, anticipating that this may sometimes happen, "root" scope is a good choice for a rule that may flag code
  * anywhere in the AppMap.
  */
-export declare type ScopeName = 'root' | 'command' | 'http_client_request' | 'http_server_request' | 'transaction';
+export type ScopeName = 'root' | 'command' | 'http_client_request' | 'http_server_request' | 'transaction';
 /**
  * Indicates the aspect of software quality that is most relevant to a rule.
  */
-export declare type ImpactDomain = 'Security' | 'Performance' | 'Maintainability' | 'Stability';
+export type ImpactDomain = 'Security' | 'Performance' | 'Maintainability' | 'Stability';
 /**
  * Finding is the full data structure that is created when a Rule matches an Event.
  *

package/built/integration/github/commitStatus.d.ts

@@ -1,3 +1,3 @@
-declare type CommitStatusState = 'pending' | 'success' | 'error' | 'failure';
+type CommitStatusState = 'pending' | 'success' | 'error' | 'failure';
 export default function postCommitStatus(state: CommitStatusState, description: string): Promise<unknown>;
 export {};

package/built/report/scanResults.d.ts

@@ -1,4 +1,5 @@
 import { Metadata } from '@appland/models';
+import { type TelemetryData } from '@appland/telemetry';
 import Check from '../check';
 import Configuration from '../configuration/types/configuration';
 import { Finding } from '../index';
@@ -17,3 +18,18 @@ export declare class ScanResults {
     withFindings(findings: Finding[]): ScanResults;
     aggregate(sourceScanResults: ScanResults): void;
 }
+export type ScanTelemetry = {
+    ruleIds: string[];
+    numAppMaps: number;
+    numFindings: number;
+    findingCountsByRule: Record<string, number>;
+    findingCountsByImpactDomain: Record<string, number>;
+    elapsedMs: number;
+    appmapDir?: string;
+};
+/**
+ * Build the `scan:completed` telemetry payload. Pure and synchronous: git state and
+ * contributor count are resolved by the caller and passed in.
+ */
+export declare function scanCompletedEvent(telemetry: ScanTelemetry, gitState: string, contributors: number): TelemetryData;
+export declare function sendScanResultsTelemetry(telemetry: ScanTelemetry): Promise<void>;

package/built/report/scanResults.js

@@ -1,6 +1,49 @@
 "use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ScanResults = void 0;
+exports.sendScanResultsTelemetry = exports.scanCompletedEvent = exports.ScanResults = void 0;
+const telemetry_1 = require("@appland/telemetry");
+/** Tally values in `source` into `target`, summing counts for repeated keys. */
+function mergeCounts(target, source) {
+    var _a;
+    for (const [key, count] of Object.entries(source)) {
+        target[key] = ((_a = target[key]) !== null && _a !== void 0 ? _a : 0) + count;
+    }
+}
+/** Count findings by the value returned from `key`, skipping undefined keys. */
+function countFindings(findings, key) {
+    var _a;
+    const counts = {};
+    for (const finding of findings) {
+        const value = key(finding);
+        if (value === undefined)
+            continue;
+        counts[value] = ((_a = counts[value]) !== null && _a !== void 0 ? _a : 0) + 1;
+    }
+    return counts;
+}
+/**
+ * Serialize a counts map to JSON with keys sorted, so the output is deterministic
+ * regardless of the order findings were discovered (stable to compare downstream).
+ *
+ * This relies on JSON.stringify emitting keys in own-property order, which the spec
+ * fixes as integer-index keys first, then other string keys in insertion order. Rule
+ * IDs and impact domains are never integer-like, so inserting them sorted (via
+ * fromEntries) yields sorted JSON. If keys could be integer-like strings, they'd be
+ * hoisted ahead of insertion order and this wouldn't hold.
+ */
+function sortedCountsJson(counts) {
+    const sorted = Object.fromEntries(Object.entries(counts).sort(([a], [b]) => a.localeCompare(b)));
+    return JSON.stringify(sorted);
+}
 class DistinctItems {
     constructor() {
         this.members = {};
@@ -66,6 +109,8 @@ class ScanResults {
             rules: [...new Set(checks.map((check) => check.rule.id))].sort(),
             ruleLabels: [...new Set(checks.map((check) => check.rule.labels || []).flat())].sort(),
             numFindings: findings.length,
+            findingCountsByRule: countFindings(findings, (finding) => finding.ruleId),
+            findingCountsByImpactDomain: countFindings(findings, (finding) => finding.impactDomain),
             appMapMetadata: collectMetadata(Object.values(appMapMetadata)),
         };
     }
@@ -80,8 +125,47 @@ class ScanResults {
             ...new Set(this.summary.ruleLabels.concat(sourceScanResults.summary.ruleLabels)),
         ];
         this.summary.numFindings += sourceScanResults.summary.numFindings;
+        mergeCounts(this.summary.findingCountsByRule, sourceScanResults.summary.findingCountsByRule);
+        mergeCounts(this.summary.findingCountsByImpactDomain, sourceScanResults.summary.findingCountsByImpactDomain);
         // we don't need sourceScanResults.summary.appMetadata
         // appMapMetadata.Git may also contain secrets we don't want to transmit.
     }
 }
 exports.ScanResults = ScanResults;
+/**
+ * Build the `scan:completed` telemetry payload. Pure and synchronous: git state and
+ * contributor count are resolved by the caller and passed in.
+ */
+function scanCompletedEvent(telemetry, gitState, contributors) {
+    return {
+        name: 'scan:completed',
+        properties: {
+            rules: [...telemetry.ruleIds].sort().join(', '),
+            git_state: gitState,
+            findingsByRule: sortedCountsJson(telemetry.findingCountsByRule),
+            findingsByImpactDomain: sortedCountsJson(telemetry.findingCountsByImpactDomain),
+        },
+        metrics: {
+            duration: telemetry.elapsedMs / 1000,
+            numRules: telemetry.ruleIds.length,
+            numAppMaps: telemetry.numAppMaps,
+            numFindings: telemetry.numFindings,
+            contributors,
+        },
+    };
+}
+exports.scanCompletedEvent = scanCompletedEvent;
+function sendScanResultsTelemetry(telemetry) {
+    return __awaiter(this, void 0, void 0, function* () {
+        // Never let telemetry (git lookups, sending) reject and break the caller's shutdown.
+        try {
+            const gitState = telemetry_1.GitState[yield telemetry_1.Git.state(telemetry.appmapDir)];
+            const contributors = (yield telemetry_1.Git.contributors(60, telemetry.appmapDir)).length;
+            telemetry_1.Telemetry.sendEvent(scanCompletedEvent(telemetry, gitState, contributors));
+        }
+        catch (_a) {
+            // ignore
+        }
+    });
+}
+exports.sendScanResultsTelemetry = sendScanResultsTelemetry;

package/built/report/scanSummary.d.ts

@@ -16,5 +16,7 @@ export interface ScanSummary {
     ruleLabels: string[];
     numChecks: number;
     numFindings: number;
+    findingCountsByRule: Record<string, number>;
+    findingCountsByImpactDomain: Record<string, number>;
     appMapMetadata: AppMapMetadata;
 }

package/built/rules/lib/analyzeDataFlow.d.ts

@@ -4,7 +4,7 @@ import { Event, ValueBase } from '@appland/models';
  * its originating event and a list of any other such values that might have
  * been used in its generation.
  */
-export declare type TrackedValue = {
+export type TrackedValue = {
     value: ValueBase;
     origin: Event;
     parents: ReadonlyArray<TrackedValue>;

package/built/rules/lib/metadata.d.ts

@@ -1,5 +1,5 @@
 import { ImpactDomain, ScopeName } from '../../index';
-export declare type Metadata = {
+export type Metadata = {
     title: string;
     impactDomain: ImpactDomain;
     references: Record<string, string>;

package/built/rules/lib/util.d.ts

@@ -7,7 +7,7 @@ declare function responseContentType(event: Event): string | undefined;
 declare function appMapDir(appMapFileName: string): string;
 declare function isFalsey(valueObj?: ReturnValueObject): boolean;
 declare function parseValue(valueObj: ReturnValueObject): string[];
-declare const isTruthy: (valueObj?: ReturnValueObject | undefined) => boolean;
+declare const isTruthy: (valueObj?: ReturnValueObject) => boolean;
 declare function providesAuthentication(event: Event, label: string): boolean;
 declare function ideLink(filePath: string, ide: string, eventId: number): string;
 declare const toRegExp: (value: string | RegExp) => RegExp;

package/built/scan.js

@@ -15,7 +15,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 /* eslint-disable @typescript-eslint/no-empty-function */
 /* eslint-disable @typescript-eslint/naming-convention */
 /* eslint-disable @typescript-eslint/no-unused-vars */
-const lru_cache_1 = __importDefault(require("lru-cache"));
+const lru_cache_1 = require("lru-cache");
 const assert_1 = __importDefault(require("assert"));
 const promises_1 = require("fs/promises");
 const console_1 = require("console");
@@ -24,8 +24,8 @@ const configurationProvider_1 = require("./configuration/configurationProvider")
 const util_1 = require("./rules/lib/util");
 const ruleChecker_1 = __importDefault(require("./ruleChecker"));
 const appMapIndex_1 = __importDefault(require("./appMapIndex"));
-const ConfigurationByFileName = new lru_cache_1.default({ max: 10 });
-const ChecksByFileName = new lru_cache_1.default({ max: 10 });
+const ConfigurationByFileName = new lru_cache_1.LRUCache({ max: 10 });
+const ChecksByFileName = new lru_cache_1.LRUCache({ max: 10 });
 class StatsProgressReporter {
     constructor() {
         this.parseTime = new Array();

package/built/util/eventAggregator.d.ts

@@ -1,20 +1,24 @@
 /// <reference types="node" />
-import { EventEmitter } from 'events';
-export declare type PendingEvent<E> = {
-    emitter: EventEmitter;
-    event: string;
-    arg: E;
-};
+import type { EventEmitter } from 'events';
 export declare const MaxMSBetween: number;
-export declare type CancelFn = () => void;
+/**
+ * Batches the payloads emitted on a single emitter/event, invoking `callback` with the
+ * accumulated batch once `maxMsBetween` ms pass without a new event (or at process exit).
+ *
+ * The emitter is bound at construction and there is exactly one of everything (one event
+ * listener, one beforeExit listener), so `cancel()` can always tear down completely —
+ * there is no way to half-detach it.
+ */
 export default class EventAggregator<E> {
-    private callback;
-    private maxMsBetween;
+    private readonly emitter;
+    private readonly event;
+    private readonly callback;
+    private readonly maxMsBetween;
     private pending;
     private timeout?;
-    constructor(callback: (events: PendingEvent<E>[]) => void, maxMsBetween?: number);
-    private push;
-    private refresh;
-    private emitPending;
-    attach(emitter: EventEmitter, event: string): CancelFn;
+    private readonly onEvent;
+    private readonly onBeforeExit;
+    private flush;
+    constructor(emitter: EventEmitter, event: string, callback: (events: E[]) => void | Promise<void>, maxMsBetween?: number);
+    cancel(): Promise<void>;
 }

package/built/util/eventAggregator.js

@@ -1,40 +1,62 @@
 "use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MaxMSBetween = void 0;
 exports.MaxMSBetween = 10 * 1000;
-// TODO: Unify with the code in packages/cli - find a way to make a common import.
+/**
+ * Batches the payloads emitted on a single emitter/event, invoking `callback` with the
+ * accumulated batch once `maxMsBetween` ms pass without a new event (or at process exit).
+ *
+ * The emitter is bound at construction and there is exactly one of everything (one event
+ * listener, one beforeExit listener), so `cancel()` can always tear down completely —
+ * there is no way to half-detach it.
+ */
 class EventAggregator {
-    constructor(callback, maxMsBetween = exports.MaxMSBetween) {
+    // Emit the pending batch now and await the callback. No-op when nothing is pending.
+    flush() {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!this.timeout)
+                return;
+            clearTimeout(this.timeout);
+            this.timeout = undefined;
+            const batch = this.pending;
+            this.pending = [];
+            yield this.callback(batch);
+        });
+    }
+    constructor(emitter, event, callback, maxMsBetween = exports.MaxMSBetween) {
+        this.emitter = emitter;
+        this.event = event;
         this.callback = callback;
         this.maxMsBetween = maxMsBetween;
         this.pending = [];
-        process.on('beforeExit', () => {
-            if (this.timeout) {
+        this.onEvent = (event) => {
+            this.pending.push(event);
+            if (this.timeout)
                 clearTimeout(this.timeout);
-                this.emitPending();
-            }
-        });
-    }
-    push(emitter, event, arg) {
-        this.pending.push({ emitter, event, arg });
-        this.refresh();
-    }
-    refresh() {
-        if (this.timeout)
-            clearTimeout(this.timeout);
-        this.timeout = setTimeout(this.emitPending.bind(this), this.maxMsBetween).unref();
-    }
-    emitPending() {
-        this.callback(this.pending);
-        this.timeout = undefined;
-        this.pending = [];
-    }
-    attach(emitter, event) {
-        const listenerFn = (...args) => {
-            this.push(emitter, event, args[0]);
+            // The periodic/exit flushes are fire-and-forget; only cancel() awaits.
+            this.timeout = setTimeout(() => void this.flush(), this.maxMsBetween).unref();
         };
-        emitter.addListener(event, listenerFn);
-        return () => emitter.removeListener(event, listenerFn);
+        this.onBeforeExit = () => void this.flush();
+        emitter.addListener(event, this.onEvent);
+        process.on('beforeExit', this.onBeforeExit);
+    }
+    // Detach the listeners and emit any final pending batch. Idempotent; awaiting it
+    // ensures the final batch is delivered before the caller proceeds (e.g. shutdown).
+    cancel() {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.emitter.removeListener(this.event, this.onEvent);
+            process.removeListener('beforeExit', this.onBeforeExit);
+            yield this.flush();
+        });
     }
 }
 exports.default = EventAggregator;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@appland/scanner",
-  "version": "1.89.1",
+  "version": "1.90.0",
   "description": "Analyze AppMaps for code flaws",
   "bin": "built/cli.js",
   "main": "built/index.js",
@@ -18,6 +18,7 @@
     "schema-up-to-date": "git diff --exit-code src/configuration/schema/options.json",
     "doc-up-to-date": "git diff --exit-code doc/",
     "lint": "eslint src --ext .ts",
+    "typecheck": "tsc --noEmit",
     "ci": "yarn lint && yarn build && yarn schema-up-to-date && yarn doc-up-to-date && yarn test",
     "test": "yarn jest",
     "jest": "jest --filter=./test/testFilter.js --detectOpenHandles",
@@ -35,13 +36,13 @@
     "@types/glob": "^7.2.0",
     "@types/jest": "^29.4.1",
     "@types/js-yaml": "^4.0.3",
-    "@types/lru-cache": "^5.1.1",
     "@types/node": "^16.7.10",
     "@types/sinon": "^10.0.11",
     "@types/tar-stream": "^2.2.2",
     "@types/yargs": "^17.0.2",
     "@typescript-eslint/eslint-plugin": "^4.30.0",
     "@typescript-eslint/parser": "^4.30.0",
+    "@yao-pkg/pkg": "^6.20.0",
     "eslint": "^7.32.0",
     "eslint-config-prettier": "^8.3.0",
     "eslint-plugin-node": "^11.1.0",
@@ -50,7 +51,6 @@
     "jest": "^29.5.0",
     "nock": "^13.2.2",
     "openapi-types": "^9.3.0",
-    "pkg": "5.8.1-patched",
     "prettier": "^2.7.1",
     "semantic-release": "^19.0.2",
     "sinon": "^13.0.1",
@@ -78,8 +78,8 @@
     "glob": "7.2.3",
     "inquirer": "^8.1.2",
     "js-yaml": "^4.1.0",
-    "lru-cache": "^6.0.0",
-    "minimatch": "^5.1.2",
+    "lru-cache": "^10",
+    "minimatch": "^5.1.9",
     "octokit": "^2.0.19",
     "openapi-diff": "^0.23.6",
     "ora": "~5",
@@ -97,10 +97,11 @@
   },
   "pkg": {
     "targets": [
-      "node18-linux-x64",
-      "node18-win-x64",
-      "node18-macos-x64",
-      "node18-macos-arm64"
+      "node24-linux-x64",
+      "node24-linux-arm64",
+      "node24-win-x64",
+      "node24-macos-x64",
+      "node24-macos-arm64"
     ],
     "scripts": [
       "built/scanner/*.js",