@reneturcios/tracewatch 0.0.0-stage → 0.1.1

package/dist/cli.js

@@ -0,0 +1,236 @@
+#!/usr/bin/env node
+/**
+ * tracewatch CLI.
+ *
+ *   tracewatch ingest <path> [--name <repo>] [--github <owner/repo>] [--tools a,b,c] [--json]
+ *   tracewatch import <repo> --report <tool>=<file> [--report ...] [--path <p>] [--at <ISO>] [--json]
+ *   tracewatch diff <repo> [--from <scanId>] [--to <scanId>] [--json]
+ *   tracewatch blame <repo> (--finding <id> | --rule <rule> --file <path>) [--path <clone>] [--offline] [--json]
+ *   tracewatch report <repo> [--json]
+ *   tracewatch findings <repo> [--tool <t>] [--severity <s>] [--status open|resolved|all] [--json]
+ *   tracewatch watch <path-or-owner/repo> [--path <clone>] [--interval <s>] [--once] [--max-minutes <n>] [--alerts <file>]
+ *   tracewatch mcp
+ *   tracewatch --version
+ *
+ * Every command accepts --store <dir> (default ~/.tracewatch or
+ * TRACEWATCH_STORE). Exit codes: 0 success / no changes, 1 a diff found
+ * changes, 2 usage error or total failure, 141 when the reader closed
+ * the output pipe before the report was delivered.
+ *
+ * Every report goes through emit(), which waits for stdout to flush
+ * before the exit code takes effect: the factory emit contract in
+ * FACTORY-NOTES.md. Calling process.exit() right after console.log()
+ * truncates piped output past one pipe buffer (64 KiB on Linux) while
+ * still exiting 0, which is how agents and CI silently lose reports.
+ */
+import { readFileSync } from "node:fs";
+import { VERSION, Store, defaultStoreDir, diffScans, explainFinding, importReports, ingestPath, renderDiff, renderFindings, renderHealth, renderProvenance, renderScanSummary, repoHealth, watch, } from "./core.js";
+function exitBrokenPipe() {
+    process.exit(141);
+}
+process.stdout.on("error", (err) => {
+    if (err.code === "EPIPE")
+        exitBrokenPipe();
+    throw err;
+});
+/** Write one full report and resolve only after stdout has flushed it. */
+async function emit(text, code) {
+    process.exitCode = code;
+    await new Promise((resolve, reject) => {
+        process.stdout.write(`${text}\n`, (err) => {
+            if (!err) {
+                resolve();
+                return;
+            }
+            if (err.code === "EPIPE")
+                exitBrokenPipe();
+            reject(err);
+        });
+    });
+}
+function usage() {
+    console.error(`Usage:
+  tracewatch ingest <path> [--name <repo>] [--github <owner/repo>] [--tools a,b,c] [--json]
+  tracewatch import <repo> --report <tool>=<file> [--report ...] [--path <p>] [--at <ISO>] [--json]
+  tracewatch diff <repo> [--from <scanId>] [--to <scanId>] [--json]
+  tracewatch blame <repo> (--finding <id> | --rule <rule> --file <path>) [--path <clone>] [--offline] [--json]
+  tracewatch report <repo> [--json]
+  tracewatch findings <repo> [--tool <t>] [--severity <s>] [--status open|resolved|all] [--json]
+  tracewatch watch <path-or-owner/repo> [--path <clone>] [--interval <s>] [--once] [--max-minutes <n>] [--alerts <file>]
+  tracewatch mcp
+  tracewatch --version
+  (every command accepts --store <dir>)`);
+    process.exit(2);
+}
+function flagValue(args, name) {
+    const i = args.indexOf(name);
+    return i >= 0 && i + 1 < args.length ? args[i + 1] : undefined;
+}
+function flagValues(args, name) {
+    const out = [];
+    for (let i = 0; i + 1 < args.length; i++)
+        if (args[i] === name)
+            out.push(args[i + 1]);
+    return out;
+}
+function has(args, name) {
+    return args.includes(name);
+}
+function positional(args, skipFlagsWithValues) {
+    const out = [];
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (skipFlagsWithValues.includes(a)) {
+            i++;
+            continue;
+        }
+        if (a.startsWith("--"))
+            continue;
+        out.push(a);
+    }
+    return out;
+}
+const VALUE_FLAGS = ["--name", "--github", "--tools", "--store", "--report", "--path", "--at", "--from", "--to", "--finding", "--rule", "--file", "--tool", "--severity", "--status", "--interval", "--max-minutes", "--alerts"];
+async function main() {
+    const argv = process.argv.slice(2);
+    const [cmd, ...rest] = argv;
+    if (cmd === "--version" || cmd === "-v" || cmd === "version") {
+        console.log(VERSION);
+        return;
+    }
+    if (cmd === "mcp") {
+        await import("./mcp.js");
+        return;
+    }
+    if (!cmd)
+        usage();
+    const store = new Store(flagValue(argv, "--store") ?? defaultStoreDir());
+    const json = has(argv, "--json");
+    try {
+        if (cmd === "ingest") {
+            const [target] = positional(rest, VALUE_FLAGS);
+            if (!target)
+                usage();
+            const toolsArg = flagValue(rest, "--tools");
+            const tools = toolsArg
+                ? toolsArg.split(",").map((s) => s.trim()).filter(Boolean)
+                : undefined;
+            const result = await ingestPath(store, target, {
+                name: flagValue(rest, "--name"),
+                github: flagValue(rest, "--github"),
+                tools,
+            });
+            const allFailed = result.runs.length > 0 && result.runs.every((r) => r.info.status === "error");
+            const text = json ? JSON.stringify({ scan: result.record, findings: result.observations }, null, 2) : renderScanSummary(result);
+            await emit(text, allFailed ? 2 : 0);
+        }
+        else if (cmd === "import") {
+            const [repo] = positional(rest, VALUE_FLAGS);
+            const reportArgs = flagValues(rest, "--report");
+            if (!repo || reportArgs.length === 0)
+                usage();
+            const reports = reportArgs.map((spec) => {
+                const eq = spec.indexOf("=");
+                if (eq <= 0)
+                    usage();
+                const tool = spec.slice(0, eq);
+                const file = spec.slice(eq + 1);
+                return { tool, report: JSON.parse(readFileSync(file, "utf8")) };
+            });
+            const result = importReports(store, {
+                repo,
+                path: flagValue(rest, "--path"),
+                github: flagValue(rest, "--github"),
+                at: flagValue(rest, "--at"),
+                reports,
+            });
+            const text = json ? JSON.stringify({ scan: result.record, findings: result.observations }, null, 2) : renderScanSummary(result);
+            await emit(text, 0);
+        }
+        else if (cmd === "diff") {
+            const [repo] = positional(rest, VALUE_FLAGS);
+            if (!repo)
+                usage();
+            const diff = diffScans(store, repo, flagValue(rest, "--from"), flagValue(rest, "--to"));
+            const changed = diff.added.length + diff.resolved.length + diff.changed.length > 0;
+            await emit(json ? JSON.stringify(diff, null, 2) : renderDiff(diff), changed ? 1 : 0);
+        }
+        else if (cmd === "blame") {
+            const [repo] = positional(rest, VALUE_FLAGS);
+            if (!repo)
+                usage();
+            let id = flagValue(rest, "--finding");
+            if (!id) {
+                const rule = flagValue(rest, "--rule");
+                const file = flagValue(rest, "--file");
+                if (!rule || !file)
+                    usage();
+                const match = store
+                    .trackedFindings(repo)
+                    .filter((t) => t.latest.rule === rule && t.latest.file === file)
+                    .sort((a, b) => b.lastSeenAt.localeCompare(a.lastSeenAt))[0];
+                if (!match) {
+                    console.error(`error: no tracked finding for rule ${rule} in ${file} on repo "${repo}"`);
+                    process.exitCode = 2;
+                    return;
+                }
+                id = match.latest.findingId;
+            }
+            const explained = await explainFinding(store, repo, id, {
+                path: flagValue(rest, "--path"),
+                offline: has(rest, "--offline"),
+            });
+            if (!explained) {
+                console.error(`error: finding "${id}" not found on repo "${repo}"`);
+                process.exitCode = 2;
+                return;
+            }
+            await emit(json ? JSON.stringify(explained.provenance, null, 2) : renderProvenance(explained.provenance), 0);
+        }
+        else if (cmd === "report") {
+            const [repo] = positional(rest, VALUE_FLAGS);
+            if (!repo)
+                usage();
+            const health = repoHealth(store, repo);
+            await emit(json ? JSON.stringify(health, null, 2) : renderHealth(health), 0);
+        }
+        else if (cmd === "findings") {
+            const [repo] = positional(rest, VALUE_FLAGS);
+            if (!repo)
+                usage();
+            const tool = flagValue(rest, "--tool");
+            const severity = flagValue(rest, "--severity");
+            const status = flagValue(rest, "--status") ?? "open";
+            const tracked = store
+                .trackedFindings(repo)
+                .filter((t) => (tool ? t.latest.tool === tool : true))
+                .filter((t) => (severity ? t.latest.severity === severity : true))
+                .filter((t) => (status === "all" ? true : t.status === status));
+            await emit(json ? JSON.stringify(tracked, null, 2) : renderFindings(repo, tracked), 0);
+        }
+        else if (cmd === "watch") {
+            const [target] = positional(rest, VALUE_FLAGS);
+            if (!target)
+                usage();
+            await watch({
+                store,
+                target,
+                name: flagValue(rest, "--name"),
+                path: flagValue(rest, "--path"),
+                intervalSec: Number(flagValue(rest, "--interval") ?? 60),
+                once: has(rest, "--once"),
+                maxMinutes: flagValue(rest, "--max-minutes") ? Number(flagValue(rest, "--max-minutes")) : undefined,
+                alertsFile: flagValue(rest, "--alerts"),
+            });
+        }
+        else {
+            usage();
+        }
+    }
+    catch (err) {
+        console.error(`error: ${err instanceof Error ? err.message : String(err)}`);
+        process.exitCode = 2;
+    }
+}
+void main();
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EACL,OAAO,EACP,KAAK,EACL,eAAe,EACf,SAAS,EACT,cAAc,EACd,aAAa,EACb,UAAU,EACV,UAAU,EACV,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,KAAK,GAEN,MAAM,WAAW,CAAC;AAEnB,SAAS,cAAc;IACrB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpB,CAAC;AAED,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;IACxD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;QAAE,cAAc,EAAE,CAAC;IAC3C,MAAM,GAAG,CAAC;AACZ,CAAC,CAAC,CAAC;AAEH,0EAA0E;AAC1E,KAAK,UAAU,IAAI,CAAC,IAAY,EAAE,IAAY;IAC5C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IACxB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE;YACxC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YACD,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO;gBAAE,cAAc,EAAE,CAAC;YACtE,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,KAAK;IACZ,OAAO,CAAC,KAAK,CAAC;;;;;;;;;;wCAUwB,CAAC,CAAC;IACxC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,SAAS,CAAC,IAAc,EAAE,IAAY;IAC7C,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACjE,CAAC;AAED,SAAS,UAAU,CAAC,IAAc,EAAE,IAAY;IAC9C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACtF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,GAAG,CAAC,IAAc,EAAE,IAAY;IACvC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,UAAU,CAAC,IAAc,EAAE,mBAA6B;IAC/D,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACpC,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QACjC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;AAEjO,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC5B,IAAI,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;QAClB,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QACzB,OAAO;IACT,CAAC;IACD,IAAI,CAAC,GAAG;QAAE,KAAK,EAAE,CAAC;IAElB,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,eAAe,EAAE,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAEjC,IAAI,CAAC;QACH,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrB,MAAM,CAAC,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC/C,IAAI,CAAC,MAAM;gBAAE,KAAK,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAC5C,MAAM,KAAK,GAAG,QAAQ;gBACpB,CAAC,CAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAgB;gBAC1E,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE;gBAC7C,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC;gBAC/B,MAAM,EAAE,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC;gBACnC,KAAK;aACN,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC;YAChG,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAChI,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtC,CAAC;aAAM,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC7C,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;gBAAE,KAAK,EAAE,CAAC;YAC9C,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;gBACtC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC7B,IAAI,EAAE,IAAI,CAAC;oBAAE,KAAK,EAAE,CAAC;gBACrB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAa,CAAC;gBAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBAChC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,EAAE,CAAC;YAC7E,CAAC,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE;gBAClC,IAAI;gBACJ,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC;gBAC/B,MAAM,EAAE,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC;gBACnC,EAAE,EAAE,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC;gBAC3B,OAAO;aACR,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAChI,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACtB,CAAC;aAAM,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC7C,IAAI,CAAC,IAAI;gBAAE,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,SAAS,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YACxF,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;YACnF,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvF,CAAC;aAAM,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC7C,IAAI,CAAC,IAAI;gBAAE,KAAK,EAAE,CAAC;YACnB,IAAI,EAAE,GAAG,SAAS,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YACtC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBACvC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBACvC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI;oBAAE,KAAK,EAAE,CAAC;gBAC5B,MAAM,KAAK,GAAG,KAAK;qBAChB,eAAe,CAAC,IAAI,CAAC;qBACrB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC;qBAC/D,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC/D,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,OAAO,CAAC,KAAK,CAAC,sCAAsC,IAAI,OAAO,IAAI,aAAa,IAAI,GAAG,CAAC,CAAC;oBACzF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;oBACrB,OAAO;gBACT,CAAC;gBACD,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC;YAC9B,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE;gBACtD,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC;gBAC/B,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC;aAChC,CAAC,CAAC;YACH,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,mBAAmB,EAAE,wBAAwB,IAAI,GAAG,CAAC,CAAC;gBACpE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YACD,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/G,CAAC;aAAM,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC7C,IAAI,CAAC,IAAI;gBAAE,KAAK,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACvC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/E,CAAC;aAAM,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC7C,IAAI,CAAC,IAAI;gBAAE,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACvC,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC;YACrD,MAAM,OAAO,GAAG,KAAK;iBAClB,eAAe,CAAC,IAAI,CAAC;iBACrB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;iBACrD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;iBACjE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC;YAClE,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QACzF,CAAC;aAAM,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YAC3B,MAAM,CAAC,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YAC/C,IAAI,CAAC,MAAM;gBAAE,KAAK,EAAE,CAAC;YACrB,MAAM,KAAK,CAAC;gBACV,KAAK;gBACL,MAAM;gBACN,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC;gBAC/B,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,QAAQ,CAAC;gBAC/B,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC;gBACxD,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC;gBACzB,UAAU,EAAE,SAAS,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;gBACnG,UAAU,EAAE,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC;aACxC,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,KAAK,EAAE,CAAC;QACV,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,KAAK,IAAI,EAAE,CAAC"}

package/dist/core.d.ts

@@ -0,0 +1,18 @@
+/**
+ * tracewatch core facade. The domain logic lives in focused modules:
+ * adapters (report shapes), ingest (tool runs and imports), store
+ * (JSONL persistence and derived status), diff, blame (provenance),
+ * report (health), and watch (early detection with time-to-detect).
+ */
+export declare const VERSION = "0.1.1";
+export * from "./types.js";
+export * from "./util.js";
+export * from "./store.js";
+export * from "./adapters.js";
+export * from "./ingest.js";
+export * from "./diff.js";
+export * from "./blame.js";
+export * from "./report.js";
+export * from "./watch.js";
+export * from "./render.js";
+export * from "./git.js";

package/dist/core.js

@@ -0,0 +1,19 @@
+/**
+ * tracewatch core facade. The domain logic lives in focused modules:
+ * adapters (report shapes), ingest (tool runs and imports), store
+ * (JSONL persistence and derived status), diff, blame (provenance),
+ * report (health), and watch (early detection with time-to-detect).
+ */
+export const VERSION = "0.1.1";
+export * from "./types.js";
+export * from "./util.js";
+export * from "./store.js";
+export * from "./adapters.js";
+export * from "./ingest.js";
+export * from "./diff.js";
+export * from "./blame.js";
+export * from "./report.js";
+export * from "./watch.js";
+export * from "./render.js";
+export * from "./git.js";
+//# sourceMappingURL=core.js.map

package/dist/core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.js","sourceRoot":"","sources":["../src/core.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAE/B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC"}

package/dist/diff.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Scan diffing. Two scans of one repo are compared by finding identity:
+ *
+ * - NEW: identity only in the later scan
+ * - RESOLVED: identity only in the earlier scan
+ * - CHANGED: identity in both, but the findingId or severity moved
+ *   (content edit, severity regrade, or, for actionpin, a ref move)
+ *
+ * Action ref moves are first-class: a pin regression (PINNED to MUTABLE
+ * or BRANCH), a pin improvement, or a bare ref move (the tj-actions
+ * shape, where the ref under a name changed) each produce a RefEvent
+ * with both values spelled out. Output ordering is by identity
+ * everywhere, so the same store state always renders the same diff.
+ */
+import type { Store } from "./store.js";
+import { type FindingObs, type RefEvent, type ScanDiff, type ScanRecord } from "./types.js";
+export declare function diffObs(repo: string, fromScan: ScanRecord | null, toScan: ScanRecord, fromObs: FindingObs[], toObs: FindingObs[]): ScanDiff;
+/** Diff two scans of a repo by id; defaults to the last two scans. */
+export declare function diffScans(store: Store, repo: string, fromId?: string, toId?: string): ScanDiff;
+/** Every ref event across consecutive scan pairs, oldest first. */
+export declare function allRefEvents(store: Store, repo: string): RefEvent[];

package/dist/diff.js

@@ -0,0 +1,131 @@
+import { TOOLS } from "./types.js";
+function refEventFor(before, after, scan) {
+    if (before.tool !== "actionpin" || after.tool !== "actionpin")
+        return undefined;
+    const oldRef = String(before.data.ref ?? "");
+    const newRef = String(after.data.ref ?? "");
+    const oldClass = String(before.data.classification ?? "");
+    const newClass = String(after.data.classification ?? "");
+    if (oldRef === newRef && oldClass === newClass)
+        return undefined;
+    let kind = "ref-move";
+    if (oldClass === "PINNED" && newClass !== "PINNED")
+        kind = "pin-regression";
+    else if (newClass === "PINNED" && oldClass !== "PINNED")
+        kind = "pin-improvement";
+    return {
+        identity: after.identity,
+        file: after.file,
+        action: String(after.data.action ?? after.file),
+        oldRef,
+        newRef,
+        oldClassification: oldClass,
+        newClassification: newClass,
+        kind,
+        scanId: scan.scanId,
+        at: scan.at,
+    };
+}
+function describeChanges(before, after) {
+    const changes = [];
+    if (before.severity !== after.severity)
+        changes.push(`severity: ${before.severity} -> ${after.severity}`);
+    if (before.rule !== after.rule)
+        changes.push(`rule: ${before.rule} -> ${after.rule}`);
+    if (before.tool === "actionpin" && after.tool === "actionpin") {
+        if (before.data.ref !== after.data.ref)
+            changes.push(`ref: ${String(before.data.ref)} -> ${String(after.data.ref)}`);
+        if (before.data.classification !== after.data.classification) {
+            changes.push(`classification: ${String(before.data.classification)} -> ${String(after.data.classification)}`);
+        }
+    }
+    if (before.tool === "hookcheck" && after.tool === "hookcheck" && before.data.command !== after.data.command) {
+        changes.push("command changed");
+    }
+    if (before.tool === "injectcheck" && after.tool === "injectcheck" && before.excerpt !== after.excerpt) {
+        changes.push("matched content changed");
+    }
+    if (changes.length === 0 && before.findingId !== after.findingId)
+        changes.push("content changed");
+    return changes;
+}
+export function diffObs(repo, fromScan, toScan, fromObs, toObs) {
+    const fromById = new Map(fromObs.map((o) => [o.identity, o]));
+    const toById = new Map(toObs.map((o) => [o.identity, o]));
+    const added = [];
+    const resolved = [];
+    const changed = [];
+    const refEvents = [];
+    let unchangedCount = 0;
+    for (const [identity, after] of toById) {
+        const before = fromById.get(identity);
+        if (!before) {
+            added.push(after);
+            continue;
+        }
+        if (before.findingId === after.findingId && before.severity === after.severity) {
+            unchangedCount++;
+            continue;
+        }
+        const refEvent = refEventFor(before, after, toScan);
+        if (refEvent)
+            refEvents.push(refEvent);
+        changed.push({ identity, before, after, changes: describeChanges(before, after), refEvent });
+    }
+    for (const [identity, before] of fromById) {
+        if (!toById.has(identity))
+            resolved.push(before);
+    }
+    const byIdentity = (a, b) => a.identity.localeCompare(b.identity);
+    added.sort(byIdentity);
+    resolved.sort(byIdentity);
+    changed.sort(byIdentity);
+    refEvents.sort(byIdentity);
+    const verdictMoves = TOOLS.map((tool) => ({
+        tool,
+        from: fromScan?.tools[tool]?.verdict ?? null,
+        to: toScan.tools[tool]?.verdict ?? null,
+    })).filter((m) => m.from !== m.to);
+    return {
+        repo,
+        from: fromScan ? { scanId: fromScan.scanId, at: fromScan.at } : null,
+        to: { scanId: toScan.scanId, at: toScan.at },
+        added,
+        resolved,
+        changed,
+        unchangedCount,
+        refEvents,
+        verdictMoves,
+    };
+}
+/** Diff two scans of a repo by id; defaults to the last two scans. */
+export function diffScans(store, repo, fromId, toId) {
+    const scans = store.scans(repo);
+    if (scans.length === 0)
+        throw new Error(`no scans recorded for repo "${repo}"`);
+    const to = toId ? store.scanById(toId) : scans[scans.length - 1];
+    if (!to || to.repo !== repo)
+        throw new Error(`scan "${toId}" not found for repo "${repo}"`);
+    let from = null;
+    if (fromId) {
+        from = store.scanById(fromId) ?? null;
+        if (!from || from.repo !== repo)
+            throw new Error(`scan "${fromId}" not found for repo "${repo}"`);
+    }
+    else {
+        const idx = scans.findIndex((s) => s.scanId === to.scanId);
+        from = idx > 0 ? scans[idx - 1] : null;
+    }
+    return diffObs(repo, from, to, from ? store.observations(from.scanId) : [], store.observations(to.scanId));
+}
+/** Every ref event across consecutive scan pairs, oldest first. */
+export function allRefEvents(store, repo) {
+    const scans = store.scans(repo);
+    const events = [];
+    for (let i = 1; i < scans.length; i++) {
+        const d = diffObs(repo, scans[i - 1], scans[i], store.observations(scans[i - 1].scanId), store.observations(scans[i].scanId));
+        events.push(...d.refEvents);
+    }
+    return events;
+}
+//# sourceMappingURL=diff.js.map

package/dist/diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.js","sourceRoot":"","sources":["../src/diff.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,KAAK,EAAuF,MAAM,YAAY,CAAC;AAExH,SAAS,WAAW,CAAC,MAAkB,EAAE,KAAiB,EAAE,IAAgB;IAC1E,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,SAAS,CAAC;IAChF,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;IACzD,IAAI,MAAM,KAAK,MAAM,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACjE,IAAI,IAAI,GAAqB,UAAU,CAAC;IACxC,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,QAAQ;QAAE,IAAI,GAAG,gBAAgB,CAAC;SACvE,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,QAAQ;QAAE,IAAI,GAAG,iBAAiB,CAAC;IAClF,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC;QAC/C,MAAM;QACN,MAAM;QACN,iBAAiB,EAAE,QAAQ;QAC3B,iBAAiB,EAAE,QAAQ;QAC3B,IAAI;QACJ,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,EAAE,EAAE,IAAI,CAAC,EAAE;KACZ,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,MAAkB,EAAE,KAAiB;IAC5D,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,QAAQ,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1G,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;QAAE,OAAO,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACtF,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAC9D,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrH,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,KAAK,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YAC7D,OAAO,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;QAChH,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAC5G,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;QACtG,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAClG,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,OAAO,CACrB,IAAY,EACZ,QAA2B,EAC3B,MAAkB,EAClB,OAAqB,EACrB,KAAmB;IAEnB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAClC,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,MAAM,SAAS,GAAe,EAAE,CAAC;IACjC,IAAI,cAAc,GAAG,CAAC,CAAC;IAEvB,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAClB,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,CAAC;YAC/E,cAAc,EAAE,CAAC;YACjB,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACpD,IAAI,QAAQ;YAAE,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,CAAuB,EAAE,CAAuB,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC9G,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1B,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzB,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAE3B,MAAM,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACxC,IAAI;QACJ,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,IAAI,IAAI;QAC5C,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,IAAI,IAAI;KACxC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;IAEnC,OAAO;QACL,IAAI;QACJ,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI;QACpE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE;QAC5C,KAAK;QACL,QAAQ;QACR,OAAO;QACP,cAAc;QACd,SAAS;QACT,YAAY;KACb,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,SAAS,CAAC,KAAY,EAAE,IAAY,EAAE,MAAe,EAAE,IAAa;IAClF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,IAAI,GAAG,CAAC,CAAC;IAChF,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACjE,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,yBAAyB,IAAI,GAAG,CAAC,CAAC;IAC5F,IAAI,IAAI,GAAsB,IAAI,CAAC;IACnC,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;QACtC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,SAAS,MAAM,yBAAyB,IAAI,GAAG,CAAC,CAAC;IACpG,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC;QAC3D,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IACD,OAAO,OAAO,CACZ,IAAI,EACJ,IAAI,EACJ,EAAE,EACF,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAC3C,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,MAAM,CAAC,CAC9B,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,YAAY,CAAC,KAAY,EAAE,IAAY;IACrD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,MAAM,GAAe,EAAE,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9H,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/git.d.ts

@@ -0,0 +1,16 @@
+import type { CommitInfo } from "./types.js";
+export declare function git(args: string[], cwd: string, timeoutMs?: number): Promise<string | null>;
+export declare function headSha(cwd: string): Promise<string | null>;
+export declare function commitTime(cwd: string, ref?: string): Promise<string | null>;
+/** Parse "git@github.com:owner/repo.git" and https forms to owner/repo. */
+export declare function parseGithubSlug(remoteUrl: string): string | null;
+export declare function remoteSlug(cwd: string): Promise<string | null>;
+export declare function parseLogLine(line: string): CommitInfo | null;
+/**
+ * Commits whose diff introduced (or removed) the needle in the file,
+ * newest first, via the pickaxe. -S is a literal string search, so
+ * needles with regex characters are safe as single arguments.
+ */
+export declare function logPickaxe(cwd: string, needle: string, file?: string): Promise<CommitInfo[]>;
+/** The commit git blame assigns to one line of a file at HEAD. */
+export declare function blameLine(cwd: string, file: string, line: number): Promise<CommitInfo | null>;

package/dist/git.js

@@ -0,0 +1,80 @@
+/**
+ * Thin git helpers. Every function returns null (never throws) when git
+ * is unavailable or the directory is not a repo, so callers can state
+ * "not established" instead of crashing on a non-repo target.
+ */
+import { execFile } from "node:child_process";
+export function git(args, cwd, timeoutMs = 30000) {
+    return new Promise((resolve) => {
+        execFile("git", args, { cwd, timeout: timeoutMs, maxBuffer: 16 * 1024 * 1024 }, (err, stdout) => {
+            resolve(err ? null : stdout);
+        });
+    });
+}
+export async function headSha(cwd) {
+    const out = await git(["rev-parse", "HEAD"], cwd);
+    const sha = out?.trim();
+    return sha && /^[0-9a-f]{40}$/.test(sha) ? sha : null;
+}
+export async function commitTime(cwd, ref = "HEAD") {
+    const out = await git(["show", "-s", "--format=%cI", ref], cwd);
+    return out ? out.trim() : null;
+}
+/** Parse "git@github.com:owner/repo.git" and https forms to owner/repo. */
+export function parseGithubSlug(remoteUrl) {
+    const m = remoteUrl.match(/github\.com[:/]([^/]+)\/([^/]+?)(?:\.git)?$/) ??
+        remoteUrl.match(/^([^/\s]+)\/([^/\s]+)$/);
+    return m ? `${m[1]}/${m[2]}` : null;
+}
+export async function remoteSlug(cwd) {
+    const out = await git(["remote", "get-url", "origin"], cwd);
+    return out ? parseGithubSlug(out.trim()) : null;
+}
+const LOG_FORMAT = "%H%x1f%an%x1f%aI%x1f%s";
+export function parseLogLine(line) {
+    const parts = line.split("\x1f");
+    if (parts.length < 4 || !/^[0-9a-f]{40}$/.test(parts[0]))
+        return null;
+    return { sha: parts[0], author: parts[1], date: parts[2], subject: parts.slice(3).join("\x1f") };
+}
+/**
+ * Commits whose diff introduced (or removed) the needle in the file,
+ * newest first, via the pickaxe. -S is a literal string search, so
+ * needles with regex characters are safe as single arguments.
+ */
+export async function logPickaxe(cwd, needle, file) {
+    if (!needle)
+        return [];
+    const args = ["log", `--format=${LOG_FORMAT}`, "-S", needle, "--"];
+    if (file)
+        args.push(file);
+    const out = await git(args, cwd, 60000);
+    if (!out)
+        return [];
+    return out.split("\n").map(parseLogLine).filter((c) => c !== null);
+}
+/** The commit git blame assigns to one line of a file at HEAD. */
+export async function blameLine(cwd, file, line) {
+    const out = await git(["blame", "--porcelain", "-L", `${line},${line}`, "HEAD", "--", file], cwd);
+    if (!out)
+        return null;
+    let sha = "";
+    let author = "";
+    let time = "";
+    let subject = "";
+    for (const l of out.split("\n")) {
+        if (!sha && /^[0-9a-f]{40} /.test(l))
+            sha = l.split(" ")[0];
+        else if (l.startsWith("author "))
+            author = l.slice("author ".length);
+        else if (l.startsWith("author-time ")) {
+            const secs = Number(l.slice("author-time ".length));
+            if (Number.isFinite(secs))
+                time = new Date(secs * 1000).toISOString();
+        }
+        else if (l.startsWith("summary "))
+            subject = l.slice("summary ".length);
+    }
+    return sha ? { sha, author, date: time, subject } : null;
+}
+//# sourceMappingURL=git.js.map

package/dist/git.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.js","sourceRoot":"","sources":["../src/git.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAG9C,MAAM,UAAU,GAAG,CAAC,IAAc,EAAE,GAAW,EAAE,SAAS,GAAG,KAAK;IAChE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;YAC9F,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAW;IACvC,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,GAAG,EAAE,IAAI,EAAE,CAAC;IACxB,OAAO,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAW,EAAE,GAAG,GAAG,MAAM;IACxD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,eAAe,CAAC,SAAiB;IAC/C,MAAM,CAAC,GACL,SAAS,CAAC,KAAK,CAAC,6CAA6C,CAAC;QAC9D,SAAS,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAW;IAC1C,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5D,OAAO,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,GAAG,wBAAwB,CAAC;AAE5C,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACtE,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;AACnG,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAW,EAAE,MAAc,EAAE,IAAa;IACzE,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,YAAY,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACnE,IAAI,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAmB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AACtF,CAAC;AAED,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,IAAY,EAAE,IAAY;IACrE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,CAAC,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;IAClG,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;aACvD,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;aAChE,IAAI,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;YACpD,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,IAAI,GAAG,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACxE,CAAC;aAAM,IAAI,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3D,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./types.js";
+export * from "./core.js";

package/dist/index.js

@@ -0,0 +1,3 @@
+export * from "./types.js";
+export * from "./core.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC"}

package/dist/ingest.d.ts

@@ -0,0 +1,54 @@
+import { type AdaptedReport } from "./adapters.js";
+import type { Store } from "./store.js";
+import { type FindingObs, type ScanRecord, type ToolName, type ToolScanInfo } from "./types.js";
+export interface ToolCommand {
+    cmd: string;
+    args: string[];
+}
+export declare function resolveToolCommand(tool: ToolName): ToolCommand;
+interface Capture {
+    code: number | null;
+    stdout: string;
+    stderr: string;
+    timedOut: boolean;
+}
+export declare function runCapture(cmd: string, args: string[], timeoutMs?: number): Promise<Capture>;
+export declare function toolVersion(tool: ToolName): Promise<string>;
+export interface ToolRun {
+    tool: ToolName;
+    info: ToolScanInfo;
+    adapted: AdaptedReport | null;
+}
+export declare function runTool(tool: ToolName, target: string): Promise<ToolRun>;
+/** Run injectcheck against a single text file (watch mode issue/file scans). */
+export declare function runInjectcheckFile(file: string): Promise<AdaptedReport | null>;
+export interface IngestResult {
+    record: ScanRecord;
+    observations: FindingObs[];
+    runs: ToolRun[];
+}
+/** Stamp adapted reports into the store as one scan record. Exported for watch mode. */
+export declare function recordScan(store: Store, repo: string, source: ScanRecord["source"], adaptedList: AdaptedReport[], infos: Partial<Record<ToolName, ToolScanInfo>>, extra: {
+    path?: string;
+    github?: string;
+    headSha?: string | null;
+    at?: string;
+    warnings?: string[];
+}): IngestResult;
+export declare function ingestPath(store: Store, target: string, opts?: {
+    name?: string;
+    github?: string;
+    tools?: ToolName[];
+    source?: ScanRecord["source"];
+}): Promise<IngestResult>;
+export declare function importReports(store: Store, opts: {
+    repo: string;
+    path?: string;
+    github?: string;
+    at?: string;
+    reports: {
+        tool: ToolName;
+        report: unknown;
+    }[];
+}): IngestResult;
+export {};