@reneturcios/tracewatch 0.0.0-stage → 0.1.0

package/dist/ingest.js

@@ -0,0 +1,182 @@
+/**
+ * Ingest: run the published tranche 1 tools against a target, or import
+ * report files, and store the result as one scan record plus one
+ * observation per finding.
+ *
+ * Tools are child processes resolved in this order: the
+ * TRACEWATCH_<TOOL>_CMD override, the tool on PATH, then
+ * `npx -y @reneturcios/<tool>`. Their stdout is collected through a pipe
+ * and parsed as JSON; a tool's exit code of 0 or 1 both mean "report
+ * produced" (the tools exit 1 when their verdict is not clean), anything
+ * else, or unparseable output, is recorded as a per-tool error on the
+ * scan record. One tool failing never blocks the others.
+ */
+import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { basename, join, resolve } from "node:path";
+import { adaptReport } from "./adapters.js";
+import { headSha, remoteSlug } from "./git.js";
+import { TOOLS } from "./types.js";
+import { makeScanId } from "./util.js";
+export function resolveToolCommand(tool) {
+    const override = process.env[`TRACEWATCH_${tool.toUpperCase()}_CMD`];
+    if (override) {
+        const parts = override.split(/\s+/).filter(Boolean);
+        if (parts.length > 0)
+            return { cmd: parts[0], args: parts.slice(1) };
+    }
+    for (const dir of (process.env.PATH ?? "").split(":")) {
+        if (dir && existsSync(join(dir, tool)))
+            return { cmd: tool, args: [] };
+    }
+    return { cmd: "npx", args: ["-y", `@reneturcios/${tool}`] };
+}
+export function runCapture(cmd, args, timeoutMs = 180000) {
+    return new Promise((resolvePromise) => {
+        const child = spawn(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
+        let stdout = "";
+        let stderr = "";
+        let timedOut = false;
+        const timer = setTimeout(() => {
+            timedOut = true;
+            child.kill("SIGKILL");
+        }, timeoutMs);
+        child.stdout.on("data", (d) => {
+            if (stdout.length < 64 * 1024 * 1024)
+                stdout += d.toString("utf8");
+        });
+        child.stderr.on("data", (d) => {
+            if (stderr.length < 1024 * 1024)
+                stderr += d.toString("utf8");
+        });
+        child.on("error", (err) => {
+            clearTimeout(timer);
+            resolvePromise({ code: null, stdout, stderr: `${stderr}${err.message}`, timedOut });
+        });
+        child.on("close", (code) => {
+            clearTimeout(timer);
+            resolvePromise({ code, stdout, stderr, timedOut });
+        });
+    });
+}
+const versionCache = new Map();
+export async function toolVersion(tool) {
+    const cached = versionCache.get(tool);
+    if (cached)
+        return cached;
+    const { cmd, args } = resolveToolCommand(tool);
+    const res = await runCapture(cmd, [...args, "--version"], 120000);
+    const first = res.stdout.split("\n").map((s) => s.trim()).find((s) => /\d+\.\d+\.\d+/.test(s));
+    const version = first ? (first.match(/\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?/)?.[0] ?? first) : "unknown";
+    versionCache.set(tool, version);
+    return version;
+}
+const SCAN_ARGS = {
+    hookcheck: (t) => ["scan", t, "--json"],
+    actionpin: (t) => ["audit", t, "--json"],
+    injectcheck: (t) => ["scan", t, "--json"],
+};
+export async function runTool(tool, target) {
+    const version = await toolVersion(tool);
+    const { cmd, args } = resolveToolCommand(tool);
+    const res = await runCapture(cmd, [...args, ...SCAN_ARGS[tool](target)]);
+    const fail = (error) => ({
+        tool,
+        info: { version, verdict: "ERROR", counts: {}, status: "error", error },
+        adapted: null,
+    });
+    if (res.timedOut)
+        return fail(`${tool} timed out`);
+    const start = res.stdout.indexOf("{");
+    if (start === -1)
+        return fail(`${tool} produced no JSON report (exit ${res.code ?? "spawn error"})`);
+    let parsed;
+    try {
+        parsed = JSON.parse(res.stdout.slice(start));
+    }
+    catch {
+        return fail(`${tool} report did not parse as JSON (exit ${res.code ?? "spawn error"})`);
+    }
+    const adapted = adaptReport(tool, parsed, target);
+    return {
+        tool,
+        info: { version, verdict: adapted.verdict, counts: adapted.counts, status: "ok" },
+        adapted,
+    };
+}
+/** Run injectcheck against a single text file (watch mode issue/file scans). */
+export async function runInjectcheckFile(file) {
+    const { cmd, args } = resolveToolCommand("injectcheck");
+    const res = await runCapture(cmd, [...args, "file", file, "--json"], 120000);
+    const start = res.stdout.indexOf("{");
+    if (start === -1)
+        return null;
+    try {
+        return adaptReport("injectcheck", JSON.parse(res.stdout.slice(start)), file);
+    }
+    catch {
+        return null;
+    }
+}
+/** Stamp adapted reports into the store as one scan record. Exported for watch mode. */
+export function recordScan(store, repo, source, adaptedList, infos, extra) {
+    const at = extra.at ?? new Date().toISOString();
+    const flat = adaptedList.flatMap((a) => a.findings);
+    const scanId = makeScanId(repo, at, flat.map((f) => f.findingId));
+    const record = {
+        scanId,
+        repo,
+        at,
+        source,
+        path: extra.path,
+        github: extra.github,
+        headSha: extra.headSha ?? null,
+        tools: infos,
+        warnings: [...(extra.warnings ?? []), ...adaptedList.flatMap((a) => a.warnings)],
+    };
+    const observations = flat.map((f) => ({ ...f, scanId, repo }));
+    store.appendScan(record);
+    store.appendFindings(observations);
+    return { record, observations, runs: [] };
+}
+export async function ingestPath(store, target, opts = {}) {
+    const abs = resolve(target);
+    const github = opts.github ?? (await remoteSlug(abs)) ?? undefined;
+    const repo = opts.name ?? github ?? basename(abs);
+    const head = await headSha(abs);
+    const wanted = opts.tools ?? TOOLS;
+    const runs = await Promise.all(wanted.map((t) => runTool(t, abs)));
+    const infos = {};
+    const adaptedList = [];
+    const warnings = [];
+    for (const run of runs) {
+        infos[run.tool] = run.info;
+        if (run.adapted)
+            adaptedList.push(run.adapted);
+        if (run.info.status === "error")
+            warnings.push(run.info.error ?? `${run.tool} failed`);
+    }
+    const result = recordScan(store, repo, opts.source ?? "run", adaptedList, infos, {
+        path: abs,
+        github,
+        headSha: head,
+        warnings,
+    });
+    return { ...result, runs };
+}
+export function importReports(store, opts) {
+    const root = opts.path ? resolve(opts.path) : "";
+    const adaptedList = [];
+    const infos = {};
+    for (const { tool, report } of opts.reports) {
+        const adapted = adaptReport(tool, report, root);
+        adaptedList.push(adapted);
+        infos[tool] = { version: "imported", verdict: adapted.verdict, counts: adapted.counts, status: "ok" };
+    }
+    return recordScan(store, opts.repo, "import", adaptedList, infos, {
+        path: opts.path ? resolve(opts.path) : undefined,
+        github: opts.github,
+        at: opts.at,
+    });
+}
+//# sourceMappingURL=ingest.js.map

package/dist/ingest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ingest.js","sourceRoot":"","sources":["../src/ingest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,WAAW,EAAsB,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAE/C,OAAO,EAAE,KAAK,EAAsE,MAAM,YAAY,CAAC;AACvG,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAOvC,MAAM,UAAU,kBAAkB,CAAC,IAAc;IAC/C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACrE,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,IAAI,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,gBAAgB,IAAI,EAAE,CAAC,EAAE,CAAC;AAC9D,CAAC;AASD,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,IAAc,EAAE,SAAS,GAAG,MAAM;IACxE,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE;QACpC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACtE,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,QAAQ,GAAG,IAAI,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxB,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;YACpC,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI;gBAAE,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;YACpC,IAAI,MAAM,CAAC,MAAM,GAAG,IAAI,GAAG,IAAI;gBAAE,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,cAAc,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACtF,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,cAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,YAAY,GAAG,IAAI,GAAG,EAAoB,CAAC;AAEjD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAc;IAC9C,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,sCAAsC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxG,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,SAAS,GAAmD;IAChE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,QAAQ,CAAC;IACvC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,QAAQ,CAAC;IACxC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,QAAQ,CAAC;CAC1C,CAAC;AAQF,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAc,EAAE,MAAc;IAC1D,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,CAAC;QACxC,IAAI;QACJ,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE;QACvE,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC,GAAG,IAAI,YAAY,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,IAAI,kCAAkC,GAAG,CAAC,IAAI,IAAI,aAAa,GAAG,CAAC,CAAC;IACrG,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,GAAG,IAAI,uCAAuC,GAAG,CAAC,IAAI,IAAI,aAAa,GAAG,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAClD,OAAO;QACL,IAAI;QACJ,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE;QACjF,OAAO;KACR,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAY;IACnD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAQD,wFAAwF;AACxF,MAAM,UAAU,UAAU,CACxB,KAAY,EACZ,IAAY,EACZ,MAA4B,EAC5B,WAA4B,EAC5B,KAA8C,EAC9C,KAAoG;IAEpG,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChD,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAClE,MAAM,MAAM,GAAe;QACzB,MAAM;QACN,IAAI;QACJ,EAAE;QACF,MAAM;QACN,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;QAC9B,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;KACjF,CAAC;IACF,MAAM,YAAY,GAAiB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7E,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACzB,KAAK,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;IACnC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,KAAY,EACZ,MAAc,EACd,OAA8F,EAAE;IAEhG,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,SAAS,CAAC;IACnE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,KAAK,GAA4C,EAAE,CAAC;IAC1D,MAAM,WAAW,GAAoB,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC;QAC3B,IAAI,GAAG,CAAC,OAAO;YAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,CAAC,IAAI,SAAS,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE;QAC/E,IAAI,EAAE,GAAG;QACT,MAAM;QACN,OAAO,EAAE,IAAI;QACb,QAAQ;KACT,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,KAAY,EACZ,IAMC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,MAAM,WAAW,GAAoB,EAAE,CAAC;IACxC,MAAM,KAAK,GAA4C,EAAE,CAAC;IAC1D,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAChD,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACxG,CAAC;IACD,OAAO,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE;QAChE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;QAChD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,EAAE,EAAE,IAAI,CAAC,EAAE;KACZ,CAAC,CAAC;AACL,CAAC"}

package/dist/mcp.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/mcp.js

@@ -0,0 +1,80 @@
+/**
+ * tracewatch MCP server. Tools: ingest_scan, diff_scans,
+ * finding_provenance, repo_health, watch_status, list_findings,
+ * explain_finding. The store is TRACEWATCH_STORE or ~/.tracewatch.
+ */
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+import { VERSION, Store, defaultStoreDir, diffScans, explainFinding, ingestPath, repoHealth, } from "./core.js";
+const store = new Store(defaultStoreDir());
+const server = new McpServer({ name: "tracewatch", version: VERSION });
+function text(value) {
+    return { content: [{ type: "text", text: JSON.stringify(value, null, 2) }] };
+}
+server.tool("ingest_scan", "Run hookcheck, actionpin, and injectcheck against a local repo path and store the results as a timestamped scan record with stable finding IDs. Returns the scan record and every finding observation. Use this to start or refresh tracking for a repo.", {
+    path: z.string().describe("Local path of the repo or directory to scan"),
+    name: z.string().optional().describe("Repo key to file the scan under (default: GitHub slug from the git remote, else the directory name)"),
+    tools: z.array(z.enum(["hookcheck", "actionpin", "injectcheck"])).optional().describe("Subset of tools to run (default: all three)"),
+}, async ({ path, name, tools }) => {
+    const result = await ingestPath(store, path, { name, tools });
+    return text({ scan: result.record, findings: result.observations });
+});
+server.tool("diff_scans", "Diff two scans of a repo (default: the last two). Reports NEW, RESOLVED, and CHANGED findings, verdict moves, and action ref events with both refs spelled out, including pin regressions (PINNED to MUTABLE or BRANCH) and bare ref moves on pinned actions.", {
+    repo: z.string().describe("Repo key used at ingest"),
+    from: z.string().optional().describe("Earlier scanId (default: the scan before `to`)"),
+    to: z.string().optional().describe("Later scanId (default: the latest scan)"),
+}, async ({ repo, from, to }) => text(diffScans(store, repo, from, to)));
+server.tool("finding_provenance", "Root-cause provenance for one finding: the introducing commit from git pickaxe on the finding's content, the current-line commit from git blame, the associated GitHub PR when the API answers, and the finding's ref history from the scan store. Confirmed evidence, inferences, and unestablished items are reported separately; nothing is guessed.", {
+    repo: z.string().describe("Repo key used at ingest"),
+    findingId: z.string().describe("Full findingId (tw_...) or a prefix of at least 8 characters"),
+    path: z.string().optional().describe("Local clone path to run git evidence against (default: the path recorded at ingest)"),
+}, async ({ repo, findingId, path }) => {
+    const explained = await explainFinding(store, repo, findingId, { path });
+    if (!explained)
+        return text({ error: `finding "${findingId}" not found on repo "${repo}"` });
+    return text(explained.provenance);
+});
+server.tool("repo_health", "Health report for a repo across all its scans: verdict trend, open findings by tool and severity, resolved count, mean time open for resolved findings, all action ref events, and watch detection latency stats (count, median, max time-to-detect).", { repo: z.string().describe("Repo key used at ingest") }, async ({ repo }) => text(repoHealth(store, repo)));
+server.tool("watch_status", "Summarize the tracewatch store: every tracked repo with its scan count, last scan time, open finding count, detection count, and median time-to-detect. Use this to see what is being watched and tracked before drilling into one repo.", {}, async () => {
+    const repos = store.repos().map((repo) => {
+        const health = repoHealth(store, repo);
+        return {
+            repo,
+            scans: health.scanCount,
+            lastScanAt: health.lastScanAt,
+            openFindings: health.open.total,
+            detections: health.detections.count,
+            medianTimeToDetectMs: health.detections.medianMs,
+        };
+    });
+    return text({ storeDir: store.dir, repos });
+});
+server.tool("list_findings", "List tracked findings for a repo with derived status. Filter by tool, severity, and status (open, resolved, or all; default open). Each entry carries the stable findingId usable with finding_provenance and explain_finding.", {
+    repo: z.string().describe("Repo key used at ingest"),
+    tool: z.enum(["hookcheck", "actionpin", "injectcheck"]).optional(),
+    severity: z.enum(["critical", "high", "medium", "low", "info"]).optional(),
+    status: z.enum(["open", "resolved", "all"]).optional(),
+}, async ({ repo, tool, severity, status }) => {
+    const tracked = store
+        .trackedFindings(repo)
+        .filter((t) => (tool ? t.latest.tool === tool : true))
+        .filter((t) => (severity ? t.latest.severity === severity : true))
+        .filter((t) => (status && status !== "all" ? t.status === status : status === "all" ? true : t.status === "open"));
+    return text(tracked);
+});
+server.tool("explain_finding", "The full evidence bundle for one finding, written to act on: the tracked finding (status, first and last seen, content versions), its scan history is summarized in the provenance record, and the provenance itself (introducing commit, PR, ref history, confirmed versus inferred versus not established).", {
+    repo: z.string().describe("Repo key used at ingest"),
+    findingId: z.string().describe("Full findingId (tw_...) or a prefix of at least 8 characters"),
+    path: z.string().optional().describe("Local clone path for git evidence (default: the path recorded at ingest)"),
+}, async ({ repo, findingId, path }) => {
+    const explained = await explainFinding(store, repo, findingId, { path });
+    if (!explained)
+        return text({ error: `finding "${findingId}" not found on repo "${repo}"` });
+    return text(explained);
+});
+async function main() {
+    await server.connect(new StdioServerTransport());
+}
+void main();
+//# sourceMappingURL=mcp.js.map

package/dist/mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.js","sourceRoot":"","sources":["../src/mcp.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,OAAO,EACP,KAAK,EACL,eAAe,EACf,SAAS,EACT,cAAc,EACd,UAAU,EACV,UAAU,GACX,MAAM,WAAW,CAAC;AAEnB,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC;AAC3C,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;AAEvE,SAAS,IAAI,CAAC,KAAc;IAC1B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACxF,CAAC;AAED,MAAM,CAAC,IAAI,CACT,aAAa,EACb,0PAA0P,EAC1P;IACE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;IACxE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qGAAqG,CAAC;IAC3I,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;CACrI,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;IAC9B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;AACtE,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,IAAI,CACT,YAAY,EACZ,+PAA+P,EAC/P;IACE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC;IACpD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,gDAAgD,CAAC;IACtF,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;CAC9E,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CACrE,CAAC;AAEF,MAAM,CAAC,IAAI,CACT,oBAAoB,EACpB,yVAAyV,EACzV;IACE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC;IACpD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8DAA8D,CAAC;IAC9F,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,qFAAqF,CAAC;CAC5H,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE;IAClC,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACzE,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,SAAS,wBAAwB,IAAI,GAAG,EAAE,CAAC,CAAC;IAC7F,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;AACpC,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,IAAI,CACT,aAAa,EACb,uPAAuP,EACvP,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,EACxD,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAClD,CAAC;AAEF,MAAM,CAAC,IAAI,CACT,cAAc,EACd,0OAA0O,EAC1O,EAAE,EACF,KAAK,IAAI,EAAE;IACT,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACvC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACvC,OAAO;YACL,IAAI;YACJ,KAAK,EAAE,MAAM,CAAC,SAAS;YACvB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;YAC/B,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK;YACnC,oBAAoB,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ;SACjD,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;AAC9C,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,IAAI,CACT,eAAe,EACf,gOAAgO,EAChO;IACE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC;IACpD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC1E,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE;CACvD,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE;IACzC,MAAM,OAAO,GAAG,KAAK;SAClB,eAAe,CAAC,IAAI,CAAC;SACrB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SACrD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SACjE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC;IACrH,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;AACvB,CAAC,CACF,CAAC;AAEF,MAAM,CAAC,IAAI,CACT,iBAAiB,EACjB,+SAA+S,EAC/S;IACE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yBAAyB,CAAC;IACpD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8DAA8D,CAAC;IAC9F,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,0EAA0E,CAAC;CACjH,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE;IAClC,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACzE,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,SAAS,wBAAwB,IAAI,GAAG,EAAE,CAAC,CAAC;IAC7F,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC;AACzB,CAAC,CACF,CAAC;AAEF,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,oBAAoB,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,IAAI,EAAE,CAAC"}

package/dist/render.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Human renderers. Deterministic: every line derives from store data,
+ * sorted where the underlying structure is a set, and no wall-clock
+ * "generated at" text appears anywhere, so identical store state renders
+ * byte-identical output (acceptance T6).
+ */
+import type { IngestResult } from "./ingest.js";
+import { type HealthReport, type Provenance, type ScanDiff, type TrackedFinding } from "./types.js";
+export declare function renderScanSummary(result: IngestResult): string;
+export declare function renderDiff(diff: ScanDiff): string;
+export declare function renderProvenance(prov: Provenance): string;
+export declare function renderHealth(h: HealthReport): string;
+export declare function renderFindings(repo: string, tracked: TrackedFinding[]): string;

package/dist/render.js

@@ -0,0 +1,151 @@
+import { SEVERITY_ORDER } from "./types.js";
+import { formatDuration } from "./util.js";
+export function renderScanSummary(result) {
+    const r = result.record;
+    const lines = [];
+    lines.push(`scan ${r.scanId} repo ${r.repo} at ${r.at} (source: ${r.source})`);
+    if (r.headSha)
+        lines.push(`head: ${r.headSha}`);
+    const tools = Object.entries(r.tools).sort(([a], [b]) => a.localeCompare(b));
+    if (tools.length === 0)
+        lines.push("tools: none recorded");
+    for (const [tool, info] of tools) {
+        if (!info)
+            continue;
+        const counts = Object.entries(info.counts)
+            .sort(([a], [b]) => a.localeCompare(b))
+            .map(([k, v]) => `${k}=${v}`)
+            .join(" ");
+        lines.push(`  ${tool} ${info.version}: ${info.verdict}${info.status === "error" ? ` (ERROR: ${info.error ?? "failed"})` : ""}${counts ? ` [${counts}]` : ""}`);
+    }
+    lines.push(`findings recorded: ${result.observations.length}`);
+    for (const w of r.warnings)
+        lines.push(`warning: ${w}`);
+    return lines.join("\n");
+}
+function obsLine(o) {
+    const loc = o.line !== undefined ? `${o.file}:${o.line}` : o.file;
+    return `  [${o.severity}] ${o.findingId} ${o.tool}/${o.rule} ${loc} - ${o.detail}`;
+}
+export function renderDiff(diff) {
+    const lines = [];
+    lines.push(`diff repo ${diff.repo}`);
+    lines.push(`  from: ${diff.from ? `${diff.from.scanId} at ${diff.from.at}` : "(no earlier scan)"}`);
+    lines.push(`  to:   ${diff.to.scanId} at ${diff.to.at}`);
+    if (diff.verdictMoves.length > 0) {
+        lines.push("verdict moves:");
+        for (const m of diff.verdictMoves)
+            lines.push(`  ${m.tool}: ${m.from ?? "(none)"} -> ${m.to ?? "(none)"}`);
+    }
+    lines.push(`new findings (${diff.added.length}):`);
+    for (const o of diff.added)
+        lines.push(obsLine(o));
+    lines.push(`resolved findings (${diff.resolved.length}):`);
+    for (const o of diff.resolved)
+        lines.push(obsLine(o));
+    lines.push(`changed findings (${diff.changed.length}):`);
+    for (const c of diff.changed) {
+        lines.push(obsLine(c.after));
+        for (const change of c.changes)
+            lines.push(`    ${change}`);
+    }
+    if (diff.refEvents.length > 0) {
+        lines.push(`ref events (${diff.refEvents.length}):`);
+        for (const ev of diff.refEvents) {
+            lines.push(`  ${ev.kind}: ${ev.action} in ${ev.file}: ${ev.oldRef} -> ${ev.newRef} (${ev.oldClassification} -> ${ev.newClassification})`);
+        }
+    }
+    lines.push(`unchanged: ${diff.unchangedCount}`);
+    if (diff.added.length === 0 && diff.resolved.length === 0 && diff.changed.length === 0) {
+        lines.push("no changes between these scans");
+    }
+    return lines.join("\n");
+}
+export function renderProvenance(prov) {
+    const o = prov.finding;
+    const lines = [];
+    lines.push(`provenance for ${o.findingId} (${o.tool}/${o.rule})`);
+    lines.push(`  repo: ${prov.repo}  status: ${prov.status}`);
+    lines.push(`  location: ${o.line !== undefined ? `${o.file}:${o.line}` : o.file}`);
+    lines.push(`  detail: ${o.detail}`);
+    lines.push(`  first seen: ${prov.firstSeenAt}  last seen: ${prov.lastSeenAt}`);
+    const c = prov.confirmed;
+    lines.push("confirmed (evidence):");
+    if (c.introducingCommit) {
+        lines.push(`  introducing commit: ${c.introducingCommit.sha} by ${c.introducingCommit.author} on ${c.introducingCommit.date}`);
+        lines.push(`    subject: ${c.introducingCommit.subject}`);
+    }
+    if (c.currentLineCommit) {
+        lines.push(`  current line commit (git blame): ${c.currentLineCommit.sha} by ${c.currentLineCommit.author} on ${c.currentLineCommit.date}`);
+        lines.push(`    subject: ${c.currentLineCommit.subject}`);
+    }
+    if (c.pullRequests) {
+        if (c.pullRequests.length === 0)
+            lines.push("  pull requests: none listed by the GitHub API for the introducing commit");
+        for (const pr of c.pullRequests)
+            lines.push(`  pull request: #${pr.number} ${pr.title} (${pr.state}) ${pr.url}`);
+    }
+    if (c.refHistory) {
+        lines.push("  ref history (from the scan store):");
+        for (const h of c.refHistory) {
+            lines.push(`    ${h.ref} (${h.classification}) first ${h.firstAt} [${h.firstScanId}] last ${h.lastAt} [${h.lastScanId}]`);
+        }
+    }
+    if (c.source)
+        lines.push(`  content source: ${c.source.kind} ${c.source.ref}${c.source.url ? ` ${c.source.url}` : ""}`);
+    if (!c.introducingCommit && !c.currentLineCommit && !c.pullRequests && !c.refHistory && !c.source) {
+        lines.push("  (none)");
+    }
+    if (prov.inferred.length > 0) {
+        lines.push("inferred (circumstantial, labeled as such):");
+        for (const s of prov.inferred)
+            lines.push(`  ${s}`);
+    }
+    if (prov.notEstablished.length > 0) {
+        lines.push("not established:");
+        for (const s of prov.notEstablished)
+            lines.push(`  ${s}`);
+    }
+    return lines.join("\n");
+}
+export function renderHealth(h) {
+    const lines = [];
+    lines.push(`health report: ${h.repo}`);
+    lines.push(`scans: ${h.scanCount}${h.firstScanAt ? ` (${h.firstScanAt} to ${h.lastScanAt})` : ""}`);
+    lines.push("verdict trend:");
+    for (const t of h.verdictTrend) {
+        const vs = Object.entries(t.verdicts)
+            .sort(([a], [b]) => a.localeCompare(b))
+            .map(([k, v]) => `${k}=${v}`)
+            .join(" ");
+        lines.push(`  ${t.at} ${t.scanId} ${vs}`);
+    }
+    lines.push(`open findings: ${h.open.total}`);
+    for (const tool of Object.keys(h.open.byTool).sort())
+        lines.push(`  by tool ${tool}: ${h.open.byTool[tool]}`);
+    for (const sev of SEVERITY_ORDER) {
+        if (h.open.bySeverity[sev])
+            lines.push(`  by severity ${sev}: ${h.open.bySeverity[sev]}`);
+    }
+    lines.push(`resolved findings: ${h.resolvedCount}`);
+    lines.push(`mean time open (resolved): ${h.meanTimeOpenMs === null ? "n/a (nothing resolved yet)" : formatDuration(h.meanTimeOpenMs)}`);
+    lines.push(`ref events: ${h.refEvents.length}`);
+    for (const ev of h.refEvents) {
+        lines.push(`  ${ev.at} ${ev.kind}: ${ev.action} in ${ev.file}: ${ev.oldRef} -> ${ev.newRef}`);
+    }
+    lines.push(`detections: ${h.detections.count} (median time-to-detect ${formatDuration(h.detections.medianMs)}, max ${formatDuration(h.detections.maxMs)})`);
+    for (const [kind, s] of Object.entries(h.detections.byKind).sort(([a], [b]) => a.localeCompare(b))) {
+        lines.push(`  ${kind}: ${s.count} (median ${formatDuration(s.medianMs)}, max ${formatDuration(s.maxMs)})`);
+    }
+    return lines.join("\n");
+}
+export function renderFindings(repo, tracked) {
+    const lines = [`findings for ${repo}: ${tracked.length}`];
+    for (const t of tracked) {
+        const o = t.latest;
+        const loc = o.line !== undefined ? `${o.file}:${o.line}` : o.file;
+        lines.push(`[${t.status}] ${o.findingId} ${o.tool}/${o.rule} (${o.severity}) ${loc} first ${t.firstSeenAt} last ${t.lastSeenAt}${t.versions > 1 ? ` versions ${t.versions}` : ""} - ${o.detail}`);
+    }
+    return lines.join("\n");
+}
+//# sourceMappingURL=render.js.map

package/dist/render.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"render.js","sourceRoot":"","sources":["../src/render.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,cAAc,EAA0E,MAAM,YAAY,CAAC;AACpH,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE3C,MAAM,UAAU,iBAAiB,CAAC,MAAoB;IACpD,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;IACxB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,SAAS,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/E,IAAI,CAAC,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC3D,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;aACvC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;aACtC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;aAC5B,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,KAAK,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjK,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/D,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,OAAO,CAAC,CAA2B;IAC1C,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,OAAO,MAAM,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,GAAG,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AACrF,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAc;IACvC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACrC,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,mBAAmB,EAAE,CAAC,CAAC;IACpG,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,EAAE,CAAC,MAAM,OAAO,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,YAAY;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,QAAQ,OAAO,CAAC,CAAC,EAAE,IAAI,QAAQ,EAAE,CAAC,CAAC;IAC7G,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,iBAAiB,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;IACnD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,KAAK,CAAC,IAAI,CAAC,sBAAsB,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;IAC3D,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,KAAK,CAAC,IAAI,CAAC,qBAAqB,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;IACzD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QAC7B,KAAK,MAAM,MAAM,IAAI,CAAC,CAAC,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,OAAO,MAAM,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,CAAC;QACrD,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAChC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,MAAM,OAAO,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,MAAM,OAAO,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,iBAAiB,OAAO,EAAE,CAAC,iBAAiB,GAAG,CAAC,CAAC;QAC5I,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;IAChD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvF,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAgB;IAC/C,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;IACvB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;IAClE,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,aAAa,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3D,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACnF,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACpC,KAAK,CAAC,IAAI,CAAC,iBAAiB,IAAI,CAAC,WAAW,gBAAgB,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IAC/E,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;IACzB,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;IACpC,IAAI,CAAC,CAAC,iBAAiB,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,iBAAiB,CAAC,GAAG,OAAO,CAAC,CAAC,iBAAiB,CAAC,MAAM,OAAO,CAAC,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/H,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,CAAC,CAAC,iBAAiB,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC,iBAAiB,CAAC,GAAG,OAAO,CAAC,CAAC,iBAAiB,CAAC,MAAM,OAAO,CAAC,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5I,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;QACnB,IAAI,CAAC,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;QACzH,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,YAAY;YAAE,KAAK,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;IACnH,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;QACnD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,cAAc,WAAW,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,WAAW,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC;QAC5H,CAAC;IACH,CAAC;IACD,IAAI,CAAC,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACxH,IAAI,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAClG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;QAC1D,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,cAAc;YAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,CAAe;IAC1C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACvC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,OAAO,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACpG,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;QAC/B,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;aAClC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;aACtC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;aAC5B,IAAI,CAAC,GAAG,CAAC,CAAC;QACb,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE;QAAE,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9G,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACjC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;IACpD,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;IACxI,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAChD,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,MAAM,OAAO,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,MAAM,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IAChG,CAAC;IACD,KAAK,CAAC,IAAI,CACR,eAAe,CAAC,CAAC,UAAU,CAAC,KAAK,2BAA2B,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAChJ,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnG,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,KAAK,YAAY,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7G,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,OAAyB;IACpE,MAAM,KAAK,GAAa,CAAC,gBAAgB,IAAI,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACpE,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACnB,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAClE,KAAK,CAAC,IAAI,CACR,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,KAAK,GAAG,UAAU,CAAC,CAAC,WAAW,SAAS,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CACtL,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/report.d.ts

@@ -0,0 +1,3 @@
+import type { Store } from "./store.js";
+import { type HealthReport } from "./types.js";
+export declare function repoHealth(store: Store, repo: string): HealthReport;

package/dist/report.js

@@ -0,0 +1,61 @@
+/**
+ * Health report: what the store knows about one repo over time.
+ * Verdict trend, open findings by tool and severity, resolution speed
+ * (mean time open, first-seen scan to the scan where a finding was
+ * first absent), all ref events, and watch detection latency stats.
+ * Pure derivation from the store, sorted everywhere, so identical store
+ * state renders identical reports.
+ */
+import { allRefEvents } from "./diff.js";
+import { TOOLS } from "./types.js";
+import { median } from "./util.js";
+export function repoHealth(store, repo) {
+    const scans = store.scans(repo);
+    const tracked = store.trackedFindings(repo);
+    const open = tracked.filter((t) => t.status === "open");
+    const resolved = tracked.filter((t) => t.status === "resolved");
+    const byTool = {};
+    const bySeverity = {};
+    for (const t of open) {
+        byTool[t.latest.tool] = (byTool[t.latest.tool] ?? 0) + 1;
+        bySeverity[t.latest.severity] = (bySeverity[t.latest.severity] ?? 0) + 1;
+    }
+    const openDurations = [];
+    for (const t of resolved) {
+        if (!t.resolvedAt)
+            continue;
+        const ms = Date.parse(t.resolvedAt) - Date.parse(t.firstSeenAt);
+        if (Number.isFinite(ms) && ms >= 0)
+            openDurations.push(ms);
+    }
+    const meanTimeOpenMs = openDurations.length > 0 ? Math.round(openDurations.reduce((a, b) => a + b, 0) / openDurations.length) : null;
+    const detections = store.detections(repo);
+    const ttd = detections.map((d) => d.timeToDetectMs);
+    const byKind = {};
+    for (const kind of [...new Set(detections.map((d) => d.kind))].sort()) {
+        const vals = detections.filter((d) => d.kind === kind).map((d) => d.timeToDetectMs);
+        byKind[kind] = { count: vals.length, medianMs: median(vals), maxMs: vals.length ? Math.max(...vals) : null };
+    }
+    return {
+        repo,
+        scanCount: scans.length,
+        firstScanAt: scans[0]?.at ?? null,
+        lastScanAt: scans[scans.length - 1]?.at ?? null,
+        verdictTrend: scans.map((s) => ({
+            scanId: s.scanId,
+            at: s.at,
+            verdicts: Object.fromEntries(TOOLS.filter((t) => s.tools[t]).map((t) => [t, s.tools[t]?.verdict ?? ""])),
+        })),
+        open: { total: open.length, byTool, bySeverity },
+        resolvedCount: resolved.length,
+        meanTimeOpenMs,
+        refEvents: allRefEvents(store, repo),
+        detections: {
+            count: detections.length,
+            medianMs: median(ttd),
+            maxMs: ttd.length ? Math.max(...ttd) : null,
+            byKind,
+        },
+    };
+}
+//# sourceMappingURL=report.js.map

package/dist/report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../src/report.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,KAAK,EAAqB,MAAM,YAAY,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAEnC,MAAM,UAAU,UAAU,CAAC,KAAY,EAAE,IAAY;IACnD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC;IAEhE,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,UAAU,GAA2B,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACzD,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,CAAC,UAAU;YAAE,SAAS;QAC5B,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QAChE,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;YAAE,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,cAAc,GAClB,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEhH,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;IACpD,MAAM,MAAM,GAAyC,EAAE,CAAC;IACxD,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACtE,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;QACpF,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/G,CAAC;IAED,OAAO;QACL,IAAI;QACJ,SAAS,EAAE,KAAK,CAAC,MAAM;QACvB,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,IAAI;QACjC,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,IAAI,IAAI;QAC/C,YAAY,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9B,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;SACzG,CAAC,CAAC;QACH,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE;QAChD,aAAa,EAAE,QAAQ,CAAC,MAAM;QAC9B,cAAc;QACd,SAAS,EAAE,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC;QACpC,UAAU,EAAE;YACV,KAAK,EAAE,UAAU,CAAC,MAAM;YACxB,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC;YACrB,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;YAC3C,MAAM;SACP;KACF,CAAC;AACJ,CAAC"}

package/dist/store.d.ts

@@ -0,0 +1,31 @@
+import type { AlertRecord, DetectionRecord, FindingObs, ScanRecord, TrackedFinding } from "./types.js";
+export declare function defaultStoreDir(): string;
+export declare class Store {
+    readonly dir: string;
+    constructor(dir: string);
+    private file;
+    private ensure;
+    private append;
+    appendScan(rec: ScanRecord): void;
+    appendFindings(obs: FindingObs[]): void;
+    appendDetection(rec: DetectionRecord): void;
+    appendAlert(rec: AlertRecord): void;
+    scans(repo?: string): ScanRecord[];
+    findings(repo?: string): FindingObs[];
+    detections(repo?: string): DetectionRecord[];
+    alerts(repo?: string): AlertRecord[];
+    repos(): string[];
+    scanById(scanId: string): ScanRecord | undefined;
+    latestScan(repo: string): ScanRecord | undefined;
+    observations(scanId: string): FindingObs[];
+    /**
+     * Derive every tracked finding for a repo: status, first/last seen,
+     * resolution time, and content version count. Deterministic: output is
+     * sorted by identity, and scan order is store append order.
+     */
+    trackedFindings(repo: string): TrackedFinding[];
+    /** Find one tracked finding by full or prefix findingId, or by identity. */
+    findFinding(repo: string, idOrPrefix: string): TrackedFinding | undefined;
+    readWatchState<T>(): T | null;
+    writeWatchState(state: unknown): void;
+}