@reneturcios/tracewatch 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Rene Turcios
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,139 @@
-# Temporary Holding Version
+# tracewatch
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Observability, tracking, and root-cause for the Security Wave.
+
+The tranche 1 tools (hookcheck, actionpin, injectcheck) answer "what is wrong right now, in this one scan." tracewatch is the wave's memory and stopwatch. It ingests their JSON reports over time and answers the questions an incident actually turns on:
+
+- What changed since the last scan? Did a pin silently regress to a mutable tag? Did the ref under an already-pinned action move? That move is the tj-actions shape from March 2025: a tag retargeted under every repo that trusted it, invisible to anyone who only ever ran one scan.
+- Where did this finding come from? tracewatch blames a finding to the commit that introduced it (git pickaxe on the finding's own content) and to the pull request that carried it, and labels every statement confirmed, inferred, or not established.
+- How fast do we notice? Watch mode scans new issues, PRs, files, and tree changes on arrival and records time-to-detect for each one, so "early detection" is a measured number. The comparison point matters: hosted AI firewalls detect at prompt time, after the agent has already read the content. tracewatch detects at rest and on arrival, before any agent session exists.
+- Is the estate getting better? Verdict trends, open findings by tool and severity, mean time open for resolved findings, and detection latency stats, per repo, over the whole scan history.
+
+Deterministic, offline-first, local store you can grep. No hosted backend, no account, no telemetry.
+
+## Install
+
+```
+npx -y @reneturcios/tracewatch --version
+npm install -g @reneturcios/tracewatch
+docker run -i --rm ghcr.io/cloudcorprecords/tracewatch mcp
+```
+
+## Quick start
+
+```
+# scan a repo with all three tools and start tracking it
+tracewatch ingest ~/src/myrepo
+
+# what changed since the previous scan?
+tracewatch diff myrepo
+
+# where did this finding come from?
+tracewatch blame myrepo --finding tw_0123456789abcdef
+
+# health over time
+tracewatch report myrepo
+
+# watch a directory and scan new content on arrival
+tracewatch watch ~/src/myrepo --interval 30
+```
+
+## What it tracks
+
+Every ingest stores one scan record (timestamp, tool versions, verdicts, git HEAD) plus one observation per finding. Findings carry stable IDs: a hash of tool, rule, normalized location, and a content signature. The same finding keeps its identity across scans and tool versions; a content edit keeps the identity and changes the ID version, which is what diff reports as CHANGED.
+
+Diff groups: NEW, RESOLVED, CHANGED (with field-level old to new), verdict moves, and REF EVENTS. A ref event fires whenever an action's ref or classification moves, with both values spelled out:
+
+- pin-regression: PINNED to MUTABLE or BRANCH
+- pin-improvement: MUTABLE or BRANCH to PINNED
+- ref-move: the ref changed inside one classification (for a pinned action, the SHA itself moved)
+
+## Blame (root cause)
+
+```
+tracewatch blame myrepo --rule CURL-PIPE-SH --file package.json
+tracewatch blame myrepo --finding tw_0123456789abcdef --json
+```
+
+Evidence is labeled, never blended:
+
+- CONFIRMED: the introducing commit from `git log -S` on the finding's needle in your local clone; the current-line commit from `git blame`; the PR association from the GitHub API (`commits/{sha}/pulls`) when the clone has a GitHub remote; ref history and first/last seen from the store itself.
+- INFERRED: circumstantial statements, written as inferences (for example, when the introducing commit and the current-line commit differ, the line was rewritten later without introducing the content).
+- NOT ESTABLISHED: whatever could not be proven, with the reason (no clone recorded, no GitHub remote, API unreachable). Provenance is never guessed to fill the page.
+
+## Watch and time-to-detect
+
+```
+tracewatch watch ~/src/myrepo --interval 60 --alerts alerts.jsonl
+tracewatch watch owner/repo --path ~/src/myrepo-clone --interval 60
+```
+
+Local mode polls a directory: new or changed text files are scanned with injectcheck the poll they appear in; a git HEAD move triggers a full ingest plus diff. GitHub mode polls an owner/repo slug: new issues and PRs are scanned on arrival, HEAD moves are recorded (and scanned when you pass a local clone with --path). Every detection writes a record with time-to-detect = detection time minus the content's own creation time (issue created_at, commit time, file birth time). State checkpoints after every cycle, so a restarted watch resumes without re-alerting history. Alerts stream as JSONL to stdout and to the --alerts file.
+
+Polling is the portable fallback. The fastest path is event-driven, in CI:
+
+```yaml
+name: tracewatch-issues
+on:
+  issues:
+    types: [opened, edited]
+  pull_request:
+    types: [opened, edited, synchronize]
+permissions:
+  contents: read
+jobs:
+  scan-new-content:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 24
+      - name: Scan the new issue or PR body on arrival
+        env:
+          BODY: ${{ github.event.issue.body || github.event.pull_request.body }}
+        run: |
+          printf '%s' "$BODY" > /tmp/body.md
+          npx -y @reneturcios/injectcheck file /tmp/body.md --json > /tmp/report.json
+          npx -y @reneturcios/tracewatch import ${{ github.repository }} --report injectcheck=/tmp/report.json
+```
+
+Known limit, stated plainly: GitHub watch mode reads through the local ghapi helper, whose output truncates long responses; an issue poll that cannot be parsed in full is logged as a watch note and retried next cycle rather than partially trusted. The CI pattern above has no such limit and is the recommended production path for issue scanning.
+
+## Reports
+
+```
+tracewatch report myrepo          # human
+tracewatch report myrepo --json   # machine
+tracewatch findings myrepo --tool hookcheck --status open
+```
+
+The health report carries the verdict trend across every scan, open findings by tool and severity, resolved count, mean time open for resolved findings (first-seen scan to the scan where the finding disappeared), all ref events, and detection latency stats (count, median, max, by kind).
+
+## MCP
+
+`tracewatch mcp` serves a stdio MCP server with seven tools:
+
+| Tool | What it does |
+| --- | --- |
+| ingest_scan | Run the three tools on a local path and store the scan |
+| diff_scans | NEW / RESOLVED / CHANGED, verdict moves, ref events between two scans |
+| finding_provenance | Introducing commit, current-line commit, PR, ref history for one finding |
+| repo_health | Verdict trend, open findings, mean time open, detection latency |
+| watch_status | Every tracked repo: scans, last scan, open findings, median TTD |
+| list_findings | Tracked findings filtered by tool, severity, status |
+| explain_finding | The full evidence bundle for one finding, written to act on |
+
+## Store
+
+Append-only JSONL under ~/.tracewatch (override with --store <dir> or TRACEWATCH_STORE): scans.jsonl, findings.jsonl, detections.jsonl, alerts.jsonl, plus watch-state.json checkpoints. Plain text on purpose. Finding status is derived from the observation series on every read, never stored as mutable state, so the store cannot disagree with itself. Identical store state always renders identical diff and report output.
+
+Exit codes: 0 success or no changes, 1 a diff found changes, 2 usage error or total failure, 141 the reader closed the output pipe before the report was delivered.
+
+## Honesty rules
+
+- A verdict is a scan result, never a safety claim. tracewatch reports what the three tools found and when; it does not certify a repo clean.
+- Time-to-detect is measured against the content's own timestamps and recorded per detection; the report shows the distribution, not a best case.
+- Blame separates confirmed evidence from inference and says "not established" out loud.
+
+MIT. Part of the Security Wave: hookcheck (persistence hooks), actionpin (Actions pinning), injectcheck (prompt injection in agent-read content), tracewatch (observability and root cause).

package/dist/adapters.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Adapters: translate each tool's published JSON report shape into
+ * tracewatch's normalized finding observations.
+ *
+ * The shapes consumed are the tools' public contracts, verified against
+ * hookcheck 0.1.14, actionpin 0.1.6, injectcheck 0.1.13:
+ *
+ * - hookcheck: {verdict, findings: [{id, file, source, hook, command,
+ *   line?, classification, rules, evidence}], counts, warnings}
+ * - actionpin: {verdict, actions: [{workflow, line, uses, action, ref,
+ *   classification, ownerType, rawLine}], counts}
+ * - injectcheck: {verdict, findings: [{file, line, rule, severity,
+ *   excerpt, detail}], counts, warnings}
+ *
+ * Adapters are pure and total: a malformed entry is skipped and counted
+ * in the returned warnings, never thrown through, so one bad record can
+ * not take down an ingest of the other tools.
+ */
+import type { FindingObs, ToolName } from "./types.js";
+export type NormalizedFinding = Omit<FindingObs, "scanId" | "repo">;
+export interface AdaptedReport {
+    tool: ToolName;
+    verdict: string;
+    counts: Record<string, number>;
+    findings: NormalizedFinding[];
+    warnings: string[];
+}
+export declare function adaptHookcheck(report: unknown, root: string): AdaptedReport;
+export declare function adaptActionpin(report: unknown, root: string): AdaptedReport;
+export declare function adaptInjectcheck(report: unknown, root: string): AdaptedReport;
+export declare function adaptReport(tool: ToolName, report: unknown, root: string): AdaptedReport;

package/dist/adapters.js

@@ -0,0 +1,128 @@
+import { collapseWs, makeFindingId, makeIdentity, normalizePath, signatureOf } from "./util.js";
+function asObj(v) {
+    return typeof v === "object" && v !== null ? v : null;
+}
+function str(v, fallback = "") {
+    return typeof v === "string" ? v : fallback;
+}
+function num(v) {
+    return typeof v === "number" && Number.isFinite(v) ? v : undefined;
+}
+function countsOf(raw) {
+    const c = asObj(raw.counts);
+    const out = {};
+    if (c)
+        for (const [k, v] of Object.entries(c))
+            if (typeof v === "number")
+                out[k] = v;
+    return out;
+}
+const HOOK_SEVERITY = { RISKY: "high", UNKNOWN: "medium", SAFE: "low" };
+const ACTION_SEVERITY = { BRANCH: "high", MUTABLE: "medium", PINNED: "info", LOCAL: "low" };
+const INJECT_SEVERITY = { high: "high", medium: "medium", low: "low" };
+export function adaptHookcheck(report, root) {
+    const raw = asObj(report) ?? {};
+    const findings = [];
+    const warnings = (Array.isArray(raw.warnings) ? raw.warnings : []).map((w) => `hookcheck: ${String(w)}`);
+    const list = Array.isArray(raw.findings) ? raw.findings : [];
+    for (const entry of list) {
+        const f = asObj(entry);
+        if (!f) {
+            warnings.push("hookcheck: skipped a malformed finding entry");
+            continue;
+        }
+        const location = str(f.id, str(f.file, "unknown"));
+        const rules = Array.isArray(f.rules) ? f.rules.map(String) : [];
+        const rule = rules.length > 0 ? rules.join("+") : "inventory";
+        const command = str(f.command);
+        const signature = signatureOf([command]);
+        findings.push({
+            findingId: makeFindingId("hookcheck", rule, location, signature),
+            identity: makeIdentity("hookcheck", location, rule),
+            tool: "hookcheck",
+            rule,
+            severity: HOOK_SEVERITY[str(f.classification)] ?? "medium",
+            file: normalizePath(str(f.file, location), root),
+            line: num(f.line),
+            detail: str(f.evidence),
+            excerpt: command ? command.slice(0, 200) : undefined,
+            signature,
+            data: { source: str(f.source), hook: str(f.hook), command, classification: str(f.classification) },
+        });
+    }
+    return { tool: "hookcheck", verdict: str(raw.verdict, "UNKNOWN"), counts: countsOf(raw), findings, warnings };
+}
+export function adaptActionpin(report, root) {
+    const raw = asObj(report) ?? {};
+    const findings = [];
+    const warnings = [];
+    const list = Array.isArray(raw.actions) ? raw.actions : [];
+    for (const entry of list) {
+        const a = asObj(entry);
+        if (!a) {
+            warnings.push("actionpin: skipped a malformed action entry");
+            continue;
+        }
+        const file = normalizePath(str(a.workflow), root);
+        const action = str(a.action, str(a.uses));
+        const uses = str(a.uses);
+        const ref = str(a.ref);
+        const classification = str(a.classification, "MUTABLE");
+        const rule = "action-ref";
+        const location = `${file}|${action}`;
+        const signature = signatureOf([uses, ref, classification]);
+        findings.push({
+            findingId: makeFindingId("actionpin", rule, location, signature),
+            identity: makeIdentity("actionpin", location, rule),
+            tool: "actionpin",
+            rule,
+            severity: ACTION_SEVERITY[classification] ?? "medium",
+            file,
+            line: num(a.line),
+            detail: `${uses} is ${classification.toLowerCase()} (${str(a.ownerType, "unknown")} action)`,
+            excerpt: uses,
+            signature,
+            data: { action, uses, ref, classification, ownerType: str(a.ownerType) },
+        });
+    }
+    return { tool: "actionpin", verdict: str(raw.verdict, "UNKNOWN"), counts: countsOf(raw), findings, warnings };
+}
+export function adaptInjectcheck(report, root) {
+    const raw = asObj(report) ?? {};
+    const findings = [];
+    const warnings = (Array.isArray(raw.warnings) ? raw.warnings : []).map((w) => `injectcheck: ${String(w)}`);
+    const list = Array.isArray(raw.findings) ? raw.findings : [];
+    for (const entry of list) {
+        const f = asObj(entry);
+        if (!f) {
+            warnings.push("injectcheck: skipped a malformed finding entry");
+            continue;
+        }
+        const file = normalizePath(str(f.file, str(raw.target, "text")), root);
+        const rule = str(f.rule, "unknown-rule");
+        const excerpt = str(f.excerpt);
+        const signature = signatureOf([collapseWs(excerpt)]);
+        findings.push({
+            findingId: makeFindingId("injectcheck", rule, file, signature),
+            identity: makeIdentity("injectcheck", file, rule),
+            tool: "injectcheck",
+            rule,
+            severity: INJECT_SEVERITY[str(f.severity)] ?? "low",
+            file,
+            line: num(f.line),
+            detail: str(f.detail),
+            excerpt: excerpt ? excerpt.slice(0, 200) : undefined,
+            signature,
+            data: { excerpt },
+        });
+    }
+    return { tool: "injectcheck", verdict: str(raw.verdict, "UNKNOWN"), counts: countsOf(raw), findings, warnings };
+}
+export function adaptReport(tool, report, root) {
+    if (tool === "hookcheck")
+        return adaptHookcheck(report, root);
+    if (tool === "actionpin")
+        return adaptActionpin(report, root);
+    return adaptInjectcheck(report, root);
+}
+//# sourceMappingURL=adapters.js.map

package/dist/adapters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapters.js","sourceRoot":"","sources":["../src/adapters.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAchG,SAAS,KAAK,CAAC,CAAU;IACvB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAE,CAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AACjE,CAAC;AAED,SAAS,GAAG,CAAC,CAAU,EAAE,QAAQ,GAAG,EAAE;IACpC,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC9C,CAAC;AAED,SAAS,GAAG,CAAC,CAAU;IACrB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACrE,CAAC;AAED,SAAS,QAAQ,CAAC,GAAQ;IACxB,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,IAAI,CAAC;QAAE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACrF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,aAAa,GAA6B,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAClG,MAAM,eAAe,GAA6B,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AACtH,MAAM,eAAe,GAA6B,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AAEjG,MAAM,UAAU,cAAc,CAAC,MAAe,EAAE,IAAY;IAC1D,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAa,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnH,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,QAAQ,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;YAC9D,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;QAC9D,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACzC,QAAQ,CAAC,IAAI,CAAC;YACZ,SAAS,EAAE,aAAa,CAAC,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC;YAChE,QAAQ,EAAE,YAAY,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC;YACnD,IAAI,EAAE,WAAW;YACjB,IAAI;YACJ,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,IAAI,QAAQ;YAC1D,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC;YAChD,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YACjB,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;YACvB,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;YACpD,SAAS;YACT,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE;SACnG,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAe,EAAE,IAAY;IAC1D,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,QAAQ,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;YAC7D,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzB,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACvB,MAAM,cAAc,GAAG,GAAG,CAAC,CAAC,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,YAAY,CAAC;QAC1B,MAAM,QAAQ,GAAG,GAAG,IAAI,IAAI,MAAM,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC;QAC3D,QAAQ,CAAC,IAAI,CAAC;YACZ,SAAS,EAAE,aAAa,CAAC,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,CAAC;YAChE,QAAQ,EAAE,YAAY,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC;YACnD,IAAI,EAAE,WAAW;YACjB,IAAI;YACJ,QAAQ,EAAE,eAAe,CAAC,cAAc,CAAC,IAAI,QAAQ;YACrD,IAAI;YACJ,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YACjB,MAAM,EAAE,GAAG,IAAI,OAAO,cAAc,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,UAAU;YAC5F,OAAO,EAAE,IAAI;YACb,SAAS;YACT,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE;SACzE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAe,EAAE,IAAY;IAC5D,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAa,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrH,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,QAAQ,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;YAChE,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACvE,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACrD,QAAQ,CAAC,IAAI,CAAC;YACZ,SAAS,EAAE,aAAa,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC;YAC9D,QAAQ,EAAE,YAAY,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,CAAC;YACjD,IAAI,EAAE,aAAa;YACnB,IAAI;YACJ,QAAQ,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK;YACnD,IAAI;YACJ,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;YACjB,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;YACrB,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;YACpD,SAAS;YACT,IAAI,EAAE,EAAE,OAAO,EAAE;SAClB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAClH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAc,EAAE,MAAe,EAAE,IAAY;IACvE,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC9D,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC9D,OAAO,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AACxC,CAAC"}

package/dist/blame.d.ts

@@ -0,0 +1,15 @@
+import type { Store } from "./store.js";
+import type { Provenance, TrackedFinding } from "./types.js";
+export declare const GHAPI: string;
+export declare function blameFinding(store: Store, repo: string, tracked: TrackedFinding, opts?: {
+    path?: string;
+    offline?: boolean;
+}): Promise<Provenance>;
+/** explain_finding bundle: the tracked finding, its history, and its provenance. */
+export declare function explainFinding(store: Store, repo: string, idOrPrefix: string, opts?: {
+    path?: string;
+    offline?: boolean;
+}): Promise<{
+    tracked: TrackedFinding;
+    provenance: Provenance;
+} | null>;

package/dist/blame.js

@@ -0,0 +1,165 @@
+/**
+ * Blame: root-cause provenance for one tracked finding.
+ *
+ * Evidence is labeled, never blended:
+ *
+ * - CONFIRMED: the introducing commit from `git log -S` (pickaxe) on the
+ *   finding's own needle in the local clone; the current-line commit
+ *   from `git blame`; PR association from the GitHub API (commits/{sha}/
+ *   pulls) through the ghapi helper; ref history and first/last seen
+ *   from the tracewatch store itself.
+ * - INFERRED: circumstantial statements, each written as one.
+ * - NOT ESTABLISHED: whatever could not be proven, with the reason
+ *   (no clone, no remote, API unreachable). Provenance is never guessed.
+ */
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
+import { runCapture } from "./ingest.js";
+import { blameLine, logPickaxe, parseGithubSlug, remoteSlug } from "./git.js";
+import { collapseWs } from "./util.js";
+export const GHAPI = process.env.TRACEWATCH_GHAPI ?? `${process.env.HOME ?? ""}/workspace/custom-connectors/custom.github-pat/bin/ghapi.py`;
+function needleFor(obs) {
+    if (obs.tool === "hookcheck")
+        return String(obs.data.command ?? obs.excerpt ?? "");
+    if (obs.tool === "actionpin")
+        return String(obs.data.uses ?? obs.excerpt ?? "");
+    return collapseWs(String(obs.data.excerpt ?? obs.excerpt ?? "")).slice(0, 80);
+}
+async function pullsForCommit(slug, sha) {
+    if (!existsSync(GHAPI))
+        return null;
+    const res = await runCapture("python3", [GHAPI, "GET", `/repos/${slug}/commits/${sha}/pulls`], 30000);
+    if (res.code !== 0 || !res.stdout.includes("HTTP 200"))
+        return null;
+    const body = res.stdout.slice(res.stdout.indexOf("\n") + 1);
+    try {
+        const arr = JSON.parse(body);
+        if (Array.isArray(arr)) {
+            return arr.map((p) => ({
+                number: Number(p.number),
+                title: String(p.title ?? ""),
+                url: String(p.html_url ?? ""),
+                state: String(p.state ?? ""),
+            }));
+        }
+    }
+    catch {
+        // Helper output is truncated at 4000 chars; fall back to field extraction.
+    }
+    const out = [];
+    const re = /"number":\s*(\d+)[\s\S]{0,800}?"html_url":\s*"([^"]+)"[\s\S]{0,400}?"title":\s*"([^"]*)"/g;
+    let m;
+    while ((m = re.exec(body)) !== null) {
+        out.push({ number: Number(m[1]), url: m[2], title: m[3], state: "unknown" });
+    }
+    return out.length > 0 ? out : null;
+}
+function refHistory(store, repo, identity) {
+    const obs = store.findings(repo).filter((o) => o.identity === identity && o.tool === "actionpin");
+    if (obs.length === 0)
+        return undefined;
+    const scanAt = new Map(store.scans(repo).map((s) => [s.scanId, s.at]));
+    const runs = [];
+    for (const o of obs) {
+        const ref = String(o.data.ref ?? "");
+        const classification = String(o.data.classification ?? "");
+        const last = runs[runs.length - 1];
+        if (last && last.ref === ref && last.classification === classification) {
+            last.lastScanId = o.scanId;
+            last.lastAt = scanAt.get(o.scanId) ?? last.lastAt;
+        }
+        else {
+            runs.push({
+                ref,
+                classification,
+                firstScanId: o.scanId,
+                firstAt: scanAt.get(o.scanId) ?? "",
+                lastScanId: o.scanId,
+                lastAt: scanAt.get(o.scanId) ?? "",
+            });
+        }
+    }
+    return runs;
+}
+export async function blameFinding(store, repo, tracked, opts = {}) {
+    const obs = tracked.latest;
+    const prov = {
+        repo,
+        finding: obs,
+        status: tracked.status,
+        firstSeenAt: tracked.firstSeenAt,
+        lastSeenAt: tracked.lastSeenAt,
+        confirmed: {},
+        inferred: [],
+        notEstablished: [],
+    };
+    const history = refHistory(store, repo, obs.identity);
+    if (history && history.length > 0)
+        prov.confirmed.refHistory = history;
+    const dataSource = obs.data.source;
+    if (dataSource && dataSource.kind) {
+        prov.confirmed.source = { kind: dataSource.kind, ref: String(dataSource.ref ?? ""), url: dataSource.url };
+    }
+    const scans = store.scans(repo);
+    const recordedPath = [...scans].reverse().find((s) => s.path)?.path;
+    const clonePath = opts.path ?? recordedPath;
+    if (!clonePath || !existsSync(clonePath)) {
+        prov.notEstablished.push("git provenance not established: no local clone path is recorded for this repo (ingest a local path, or pass a clone path)");
+        if (!prov.confirmed.source && obs.tool === "injectcheck") {
+            prov.notEstablished.push("text source not established: the ingest recorded no issue/PR or file origin beyond the scan target");
+        }
+        return prov;
+    }
+    const cwd = resolve(clonePath);
+    const needle = needleFor(obs);
+    if (needle) {
+        const commits = await logPickaxe(cwd, needle, obs.file);
+        if (commits.length > 0) {
+            prov.confirmed.introducingCommit = commits[commits.length - 1];
+        }
+        else {
+            prov.notEstablished.push(`introducing commit not established: git log -S found no commit introducing the needle in ${obs.file} (the content may predate the clone's history or live in an uncommitted state)`);
+        }
+    }
+    if (obs.line !== undefined) {
+        const lineCommit = await blameLine(cwd, obs.file, obs.line);
+        if (lineCommit)
+            prov.confirmed.currentLineCommit = lineCommit;
+    }
+    const intro = prov.confirmed.introducingCommit;
+    const line = prov.confirmed.currentLineCommit;
+    if (intro && line && intro.sha !== line.sha) {
+        prov.inferred.push(`the finding's content first appeared in ${intro.sha.slice(0, 12)}, but the current line was last rewritten by ${line.sha.slice(0, 12)}; the later commit touched the line without introducing the content`);
+    }
+    if (intro && !opts.offline) {
+        const slug = scans.find((s) => s.github)?.github ?? (await remoteSlug(cwd));
+        if (slug && parseGithubSlug(slug)) {
+            const pulls = await pullsForCommit(slug, intro.sha);
+            if (pulls !== null) {
+                prov.confirmed.pullRequests = pulls;
+                if (pulls.length === 0) {
+                    prov.inferred.push("the GitHub API lists no pull request for the introducing commit (direct push, or a PR from a deleted fork)");
+                }
+            }
+            else {
+                prov.notEstablished.push("PR association not established: the GitHub API helper did not answer for the introducing commit");
+            }
+        }
+        else {
+            prov.notEstablished.push("PR association not established: the clone has no GitHub remote");
+        }
+    }
+    else if (intro && opts.offline) {
+        prov.notEstablished.push("PR association not established: offline mode");
+    }
+    return prov;
+}
+/** explain_finding bundle: the tracked finding, its history, and its provenance. */
+export async function explainFinding(store, repo, idOrPrefix, opts = {}) {
+    const tracked = store.findFinding(repo, idOrPrefix);
+    if (!tracked)
+        return null;
+    const provenance = await blameFinding(store, repo, tracked, opts);
+    return { tracked, provenance };
+}
+//# sourceMappingURL=blame.js.map

package/dist/blame.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"blame.js","sourceRoot":"","sources":["../src/blame.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAG9E,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,MAAM,CAAC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,6DAA6D,CAAC;AAE5I,SAAS,SAAS,CAAC,GAAe;IAChC,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IACnF,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAChF,OAAO,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,GAAW;IACrD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,IAAI,YAAY,GAAG,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC;IACtG,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA8B,CAAC;QAC1D,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACrB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;gBACxB,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC5B,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC;gBAC7B,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;aAC7B,CAAC,CAAC,CAAC;QACN,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;IAC7E,CAAC;IACD,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,MAAM,EAAE,GAAG,2FAA2F,CAAC;IACvG,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACpC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC;AAED,SAAS,UAAU,CAAC,KAAY,EAAE,IAAY,EAAE,QAAgB;IAC9D,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;IAClG,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,IAAI,GAAuD,EAAE,CAAC;IACpE,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QACrC,MAAM,cAAc,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACnC,IAAI,IAAI,IAAI,IAAI,CAAC,GAAG,KAAK,GAAG,IAAI,IAAI,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;YACvE,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;YAC3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC;QACpD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC;gBACR,GAAG;gBACH,cAAc;gBACd,WAAW,EAAE,CAAC,CAAC,MAAM;gBACrB,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;gBACnC,UAAU,EAAE,CAAC,CAAC,MAAM;gBACpB,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;aACnC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAY,EACZ,IAAY,EACZ,OAAuB,EACvB,OAA6C,EAAE;IAE/C,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;IAC3B,MAAM,IAAI,GAAe;QACvB,IAAI;QACJ,OAAO,EAAE,GAAG;QACZ,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE,EAAE;QACZ,cAAc,EAAE,EAAE;KACnB,CAAC;IAEF,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtD,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,SAAS,CAAC,UAAU,GAAG,OAAO,CAAC;IAEvE,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,MAAmE,CAAC;IAChG,IAAI,UAAU,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC;IAC5G,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,YAAY,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC;IACpE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,IAAI,YAAY,CAAC;IAC5C,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,cAAc,CAAC,IAAI,CACtB,2HAA2H,CAC5H,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACzD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,oGAAoG,CAAC,CAAC;QACjI,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAE/B,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,SAAS,CAAC,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACjE,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,cAAc,CAAC,IAAI,CACtB,4FAA4F,GAAG,CAAC,IAAI,gFAAgF,CACrL,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5D,IAAI,UAAU;YAAE,IAAI,CAAC,SAAS,CAAC,iBAAiB,GAAG,UAAU,CAAC;IAChE,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC;IAC9C,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAChB,2CAA2C,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,gDAAgD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,qEAAqE,CAC5M,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,IAAI,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5E,IAAI,IAAI,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;YACpD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,IAAI,CAAC,SAAS,CAAC,YAAY,GAAG,KAAK,CAAC;gBACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,4GAA4G,CAAC,CAAC;gBACnI,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,iGAAiG,CAAC,CAAC;YAC9H,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IAC3E,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAY,EACZ,IAAY,EACZ,UAAkB,EAClB,OAA6C,EAAE;IAE/C,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACpD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAClE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACjC,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};