@wrongstack/techstack 0.289.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ECOSTACK TECHNOLOGY OÜ
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/adapters/cpp.d.ts

@@ -0,0 +1,16 @@
+/**
+ * TechStack — C/C++ ecosystem adapter (Tier C).
+ *
+ * Best-effort: parses conanfile.txt / conanfile.py for `[requires]` and
+ * vcpkg.json for dependencies. No lockfile resolution; coverage='unsupported'.
+ *
+ * @see docs/specs/techstack-sdd.md §6 Tier C
+ */
+import type { DependencyObservation, EcosystemId, Workspace } from '../types.js';
+import type { EcosystemAdapter, InventoryOptions } from './interface.js';
+export declare class CppAdapter implements EcosystemAdapter {
+    readonly ecosystem: EcosystemId;
+    inventory(workspace: Workspace, _options: InventoryOptions): Promise<readonly DependencyObservation[]>;
+}
+export declare const cppAdapter: CppAdapter;
+//# sourceMappingURL=cpp.d.ts.map

package/dist/adapters/cpp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cpp.d.ts","sourceRoot":"","sources":["../../src/adapters/cpp.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EACV,qBAAqB,EAErB,WAAW,EACX,SAAS,EACV,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAiDzE,qBAAa,UAAW,YAAW,gBAAgB;IACjD,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAS;IAElC,SAAS,CACb,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,qBAAqB,EAAE,CAAC,CAiD3C;CACF;AAED,eAAO,MAAM,UAAU,YAAmB,CAAC"}

package/dist/adapters/dart.d.ts

@@ -0,0 +1,20 @@
+/**
+ * TechStack — Dart ecosystem adapter.
+ *
+ * Parses pubspec.yaml and pubspec.lock to produce
+ * DependencyObservation[] for Dart/Flutter workspaces.
+ *
+ * @see docs/specs/techstack-sdd.md §6 Tier A
+ */
+import type { DependencyObservation, EcosystemId, Workspace } from '../types.js';
+import type { EcosystemAdapter, InventoryOptions } from './interface.js';
+export declare class DartAdapter implements EcosystemAdapter {
+    readonly ecosystem: EcosystemId;
+    inventory(workspace: Workspace, options: InventoryOptions): Promise<readonly DependencyObservation[]>;
+    private fileExists;
+}
+/**
+ * Default singleton instance.
+ */
+export declare const dartAdapter: DartAdapter;
+//# sourceMappingURL=dart.d.ts.map

package/dist/adapters/dart.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dart.d.ts","sourceRoot":"","sources":["../../src/adapters/dart.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EACV,qBAAqB,EAGrB,WAAW,EACX,SAAS,EACV,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EACjB,MAAM,gBAAgB,CAAC;AAsHxB,qBAAa,WAAY,YAAW,gBAAgB;IAClD,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAU;IAEnC,SAAS,CACb,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,SAAS,qBAAqB,EAAE,CAAC,CAmG3C;IAED,OAAO,CAAC,UAAU;CAQnB;AAED;;GAEG;AACH,eAAO,MAAM,WAAW,aAAoB,CAAC"}

package/dist/adapters/dotnet.d.ts

@@ -0,0 +1,19 @@
+/**
+ * TechStack — .NET ecosystem adapter.
+ *
+ * Parses .csproj files and project.assets.json to produce
+ * DependencyObservation[] for .NET workspaces.
+ *
+ * @see docs/specs/techstack-sdd.md §6 Tier A
+ */
+import type { DependencyObservation, EcosystemId, Workspace } from '../types.js';
+import type { EcosystemAdapter, InventoryOptions } from './interface.js';
+export declare class DotNetAdapter implements EcosystemAdapter {
+    readonly ecosystem: EcosystemId;
+    inventory(workspace: Workspace, options: InventoryOptions): Promise<readonly DependencyObservation[]>;
+}
+/**
+ * Default singleton instance.
+ */
+export declare const dotNetAdapter: DotNetAdapter;
+//# sourceMappingURL=dotnet.d.ts.map

package/dist/adapters/dotnet.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dotnet.d.ts","sourceRoot":"","sources":["../../src/adapters/dotnet.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EACV,qBAAqB,EAErB,WAAW,EACX,SAAS,EACV,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EACjB,MAAM,gBAAgB,CAAC;AAgFxB,qBAAa,aAAc,YAAW,gBAAgB;IACpD,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAY;IAErC,SAAS,CACb,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,SAAS,qBAAqB,EAAE,CAAC,CAwE3C;CACF;AAED;;GAEG;AACH,eAAO,MAAM,aAAa,eAAsB,CAAC"}

package/dist/adapters/elixir.d.ts

@@ -0,0 +1,16 @@
+/**
+ * TechStack — Elixir/Hex ecosystem adapter (Tier B).
+ *
+ * Parses mix.exs for direct dependencies and mix.lock for resolved versions.
+ * Partial support — no registry API; OSV-only advisory enrichment.
+ *
+ * @see docs/specs/techstack-sdd.md §6 Tier B
+ */
+import type { DependencyObservation, EcosystemId, Workspace } from '../types.js';
+import type { EcosystemAdapter, InventoryOptions } from './interface.js';
+export declare class ElixirAdapter implements EcosystemAdapter {
+    readonly ecosystem: EcosystemId;
+    inventory(workspace: Workspace, _options: InventoryOptions): Promise<readonly DependencyObservation[]>;
+}
+export declare const elixirAdapter: ElixirAdapter;
+//# sourceMappingURL=elixir.d.ts.map

package/dist/adapters/elixir.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"elixir.d.ts","sourceRoot":"","sources":["../../src/adapters/elixir.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EACV,qBAAqB,EAGrB,WAAW,EACX,SAAS,EACV,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAuCzE,qBAAa,aAAc,YAAW,gBAAgB;IACpD,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAY;IAErC,SAAS,CACb,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,qBAAqB,EAAE,CAAC,CA4D3C;CACF;AAED,eAAO,MAAM,aAAa,eAAsB,CAAC"}

package/dist/adapters/go.d.ts

@@ -0,0 +1,20 @@
+/**
+ * TechStack — Go ecosystem adapter.
+ *
+ * Parses go.mod manifests and go.sum to produce DependencyObservation[]
+ * for Go workspaces.
+ *
+ * @see docs/specs/techstack-sdd.md §6 Tier A
+ */
+import type { DependencyObservation, EcosystemId, Workspace } from '../types.js';
+import type { EcosystemAdapter, InventoryOptions } from './interface.js';
+export declare class GoAdapter implements EcosystemAdapter {
+    readonly ecosystem: EcosystemId;
+    inventory(workspace: Workspace, options: InventoryOptions): Promise<readonly DependencyObservation[]>;
+    private fileExists;
+}
+/**
+ * Default singleton instance.
+ */
+export declare const goAdapter: GoAdapter;
+//# sourceMappingURL=go.d.ts.map

package/dist/adapters/go.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"go.d.ts","sourceRoot":"","sources":["../../src/adapters/go.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EACV,qBAAqB,EAGrB,WAAW,EACX,SAAS,EACV,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EACjB,MAAM,gBAAgB,CAAC;AA6HxB,qBAAa,SAAU,YAAW,gBAAgB;IAChD,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAQ;IAEjC,SAAS,CACb,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,SAAS,qBAAqB,EAAE,CAAC,CA4E3C;IAED,OAAO,CAAC,UAAU;CAQnB;AAED;;GAEG;AACH,eAAO,MAAM,SAAS,WAAkB,CAAC"}

package/dist/adapters/interface.d.ts

@@ -0,0 +1,104 @@
+/**
+ * TechStack — Ecosystem adapter interface.
+ *
+ * Every ecosystem (npm, Python, Rust, Go, etc.) implements this contract.
+ * The inventory engine discovers workspaces via detectLanguageWorkspaces(),
+ * then dispatches to the matching adapter for each workspace.
+ *
+ * @see docs/specs/techstack-sdd.md §3.2, §6
+ */
+import type { DependencyObservation, EcosystemId, Evidence, Workspace } from '../types.js';
+/**
+ * Options passed to inventory() controlling what data the adapter collects.
+ */
+export interface InventoryOptions {
+    /**
+     * Absolute path of the project being analyzed. `Workspace.relativeRoot` is
+     * resolved against it.
+     *
+     * Without this, adapters resolve against `process.cwd()` and read nothing
+     * whenever the server was started from anywhere but the project root.
+     *
+     * @see ./paths.ts
+     */
+    readonly projectRoot?: string | undefined;
+    /** Include transitive dependencies from lockfiles, not just direct. */
+    readonly includeTransitive?: boolean | undefined;
+    /** Abort signal for cancellation. */
+    readonly signal?: AbortSignal | undefined;
+}
+/**
+ * Options passed to enrich() for online registry lookups.
+ */
+export interface EnrichOptions {
+    /** Skip network calls; use only cached/offline data. */
+    readonly offline?: boolean | undefined;
+    /** Abort signal for cancellation. */
+    readonly signal?: AbortSignal | undefined;
+}
+/**
+ * Options passed to audit() for security advisory checks.
+ */
+export interface AuditOptions {
+    /** Skip network calls; use only cached/offline data. */
+    readonly offline?: boolean | undefined;
+    /** Abort signal for cancellation. */
+    readonly signal?: AbortSignal | undefined;
+}
+/**
+ * Result of enriching a single dependency with registry metadata.
+ */
+export interface RegistryEvidence {
+    readonly latestStable?: string | undefined;
+    readonly license?: string | undefined;
+    readonly deprecated?: boolean | undefined;
+    readonly yanked?: boolean | undefined;
+    readonly evidence: readonly Evidence[];
+}
+/**
+ * Result of auditing a single dependency for vulnerabilities.
+ */
+export interface AdvisoryEvidence {
+    readonly hasAdvisory: boolean;
+    readonly severity: 'info' | 'low' | 'medium' | 'high' | 'critical' | undefined;
+    readonly summary?: string | undefined;
+    readonly url?: string | undefined;
+    readonly evidence: readonly Evidence[];
+}
+/**
+ * The contract every ecosystem adapter must implement.
+ *
+ * Adapters are pure data-extraction/enrichment modules. They never:
+ * - Modify any files (analysis is read-only).
+ * - Execute arbitrary project code (commands that do are permission-gated).
+ * - Set version fields without evidence.
+ * - Classify private/unresolved packages (404) as "dead" or "deprecated".
+ */
+export interface EcosystemAdapter {
+    /** The ecosystem this adapter handles. */
+    readonly ecosystem: EcosystemId;
+    /**
+     * Extract all dependencies from a workspace's manifests and lockfiles.
+     *
+     * This is the deterministic offline pass — no network calls.
+     * Returns one DependencyObservation per package/version combination.
+     * Each observation must carry at least one Evidence entry (manifest or lockfile).
+     */
+    inventory(workspace: Workspace, options: InventoryOptions): Promise<readonly DependencyObservation[]>;
+    /**
+     * Enrich dependencies with registry metadata (latest version, license, deprecation).
+     *
+     * May make network calls to package registries.
+     * Must not fabricate version numbers — only return data backed by registry evidence.
+     * Must handle 404/401 gracefully → status stays `private_or_unresolved`.
+     */
+    enrich?(dependencies: readonly DependencyObservation[], options: EnrichOptions): Promise<readonly RegistryEvidence[]>;
+    /**
+     * Check dependencies for known security advisories.
+     *
+     * Uses ecosystem-native audit commands and/or OSV batch queries.
+     * Must not classify a package as vulnerable without advisory evidence.
+     */
+    audit?(dependencies: readonly DependencyObservation[], options: AuditOptions): Promise<readonly AdvisoryEvidence[]>;
+}
+//# sourceMappingURL=interface.d.ts.map

package/dist/adapters/interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interface.d.ts","sourceRoot":"","sources":["../../src/adapters/interface.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,qBAAqB,EACrB,WAAW,EACX,QAAQ,EACR,SAAS,EACV,MAAM,aAAa,CAAC;AAErB;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,uEAAuE;IACvE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACjD,qCAAqC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,wDAAwD;IACxD,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACvC,qCAAqC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,wDAAwD;IACxD,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACvC,qCAAqC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,SAAS,QAAQ,EAAE,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC/E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,SAAS,QAAQ,EAAE,CAAC;CACxC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC/B,0CAA0C;IAC1C,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC;IAEhC;;;;;;OAMG;IACH,SAAS,CACP,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,SAAS,qBAAqB,EAAE,CAAC,CAAC;IAE7C;;;;;;OAMG;IACH,MAAM,CAAC,CACL,YAAY,EAAE,SAAS,qBAAqB,EAAE,EAC9C,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,SAAS,gBAAgB,EAAE,CAAC,CAAC;IAExC;;;;;OAKG;IACH,KAAK,CAAC,CACJ,YAAY,EAAE,SAAS,qBAAqB,EAAE,EAC9C,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,SAAS,gBAAgB,EAAE,CAAC,CAAC;CACzC"}

package/dist/adapters/maven.d.ts

@@ -0,0 +1,17 @@
+/**
+ * TechStack — Maven ecosystem adapter (Tier B).
+ *
+ * Parses pom.xml for direct dependencies. Partial support — no lockfile
+ * parsing (Maven has no standardized lockfile); version resolution
+ * requires `mvn dependency:tree` which is not invoked here.
+ *
+ * @see docs/specs/techstack-sdd.md §6 Tier B
+ */
+import type { DependencyObservation, EcosystemId, Workspace } from '../types.js';
+import type { EcosystemAdapter, InventoryOptions } from './interface.js';
+export declare class MavenAdapter implements EcosystemAdapter {
+    readonly ecosystem: EcosystemId;
+    inventory(workspace: Workspace, _options: InventoryOptions): Promise<readonly DependencyObservation[]>;
+}
+export declare const mavenAdapter: MavenAdapter;
+//# sourceMappingURL=maven.d.ts.map

package/dist/adapters/maven.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"maven.d.ts","sourceRoot":"","sources":["../../src/adapters/maven.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EACV,qBAAqB,EAGrB,WAAW,EACX,SAAS,EACV,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AA6CzE,qBAAa,YAAa,YAAW,gBAAgB;IACnD,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAW;IAEpC,SAAS,CACb,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,qBAAqB,EAAE,CAAC,CAyC3C;CACF;AAED,eAAO,MAAM,YAAY,cAAqB,CAAC"}

package/dist/adapters/npm.d.ts

@@ -0,0 +1,21 @@
+/**
+ * TechStack — npm ecosystem adapter.
+ *
+ * Parses package.json manifests and pnpm-lock.yaml (or package-lock.json /
+ * yarn.lock) to produce DependencyObservation[] for Node.js workspaces.
+ *
+ * Supports: pnpm, npm, yarn, bun — determined by lockfile presence.
+ *
+ * @see docs/specs/techstack-sdd.md §6 Tier A
+ */
+import type { DependencyObservation, EcosystemId, Workspace } from '../types.js';
+import type { EcosystemAdapter, InventoryOptions } from './interface.js';
+export declare class NpmAdapter implements EcosystemAdapter {
+    readonly ecosystem: EcosystemId;
+    inventory(workspace: Workspace, options: InventoryOptions): Promise<readonly DependencyObservation[]>;
+}
+/**
+ * Default singleton instance.
+ */
+export declare const npmAdapter: NpmAdapter;
+//# sourceMappingURL=npm.d.ts.map

package/dist/adapters/npm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm.d.ts","sourceRoot":"","sources":["../../src/adapters/npm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EACV,qBAAqB,EAIrB,WAAW,EACX,SAAS,EACV,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EACjB,MAAM,gBAAgB,CAAC;AAmQxB,qBAAa,UAAW,YAAW,gBAAgB;IACjD,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAS;IAElC,SAAS,CACb,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,SAAS,qBAAqB,EAAE,CAAC,CA0G3C;CACF;AAED;;GAEG;AACH,eAAO,MAAM,UAAU,YAAmB,CAAC"}

package/dist/adapters/paths.d.ts

@@ -0,0 +1,37 @@
+/**
+ * TechStack — adapter path resolution.
+ *
+ * `Workspace.relativeRoot` is deliberately project-relative: snapshots are
+ * persisted and shipped to the browser, so they must stay portable across
+ * machines. Adapters, however, have to actually open files, and a relative
+ * root resolves against `process.cwd()` — which is only the project root by
+ * coincidence. The server can be started from anywhere, and switching projects
+ * mid-session doesn't move `cwd` at all.
+ *
+ * So the absolute base travels alongside the workspace, via
+ * `InventoryOptions.projectRoot`, instead of being baked into the persisted
+ * type.
+ *
+ * @see docs/specs/techstack-sdd.md §3.2
+ */
+import type { Workspace } from '../types.js';
+import type { InventoryOptions } from './interface.js';
+/**
+ * Absolute filesystem root of a workspace.
+ *
+ * Falls back to resolving against `cwd` when no `projectRoot` is supplied, to
+ * keep older direct callers working.
+ */
+export declare function workspaceRoot(workspace: Workspace, options: InventoryOptions): string;
+/**
+ * Resolve a manifest/lockfile path that may arrive either absolute (as
+ * `Workspace.manifests` entries do, straight from discovery) or as a bare
+ * filename (as adapter fallbacks use).
+ *
+ * Use this instead of `join`: `join('/a/b', '/a/b/package.json')` yields
+ * `/a/b/a/b/package.json`, which is exactly the bug that silently emptied the
+ * npm, Go, and Rust inventories — every workspace threw on read and the
+ * engine's `catch { deps = [] }` swallowed it.
+ */
+export declare function resolveIn(root: string, candidate: string): string;
+//# sourceMappingURL=paths.d.ts.map

package/dist/adapters/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/adapters/paths.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAGrF;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAEjE"}

package/dist/adapters/php.d.ts

@@ -0,0 +1,20 @@
+/**
+ * TechStack — PHP ecosystem adapter.
+ *
+ * Parses composer.json and composer.lock to produce
+ * DependencyObservation[] for PHP workspaces.
+ *
+ * @see docs/specs/techstack-sdd.md §6 Tier A
+ */
+import type { DependencyObservation, EcosystemId, Workspace } from '../types.js';
+import type { EcosystemAdapter, InventoryOptions } from './interface.js';
+export declare class PhpAdapter implements EcosystemAdapter {
+    readonly ecosystem: EcosystemId;
+    inventory(workspace: Workspace, options: InventoryOptions): Promise<readonly DependencyObservation[]>;
+    private fileExists;
+}
+/**
+ * Default singleton instance.
+ */
+export declare const phpAdapter: PhpAdapter;
+//# sourceMappingURL=php.d.ts.map

package/dist/adapters/php.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"php.d.ts","sourceRoot":"","sources":["../../src/adapters/php.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EACV,qBAAqB,EAGrB,WAAW,EACX,SAAS,EACV,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EACjB,MAAM,gBAAgB,CAAC;AAwExB,qBAAa,UAAW,YAAW,gBAAgB;IACjD,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAS;IAElC,SAAS,CACb,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,SAAS,qBAAqB,EAAE,CAAC,CAmF3C;IAED,OAAO,CAAC,UAAU;CAQnB;AAED;;GAEG;AACH,eAAO,MAAM,UAAU,YAAmB,CAAC"}

package/dist/adapters/python.d.ts

@@ -0,0 +1,26 @@
+/**
+ * TechStack — Python ecosystem adapter.
+ *
+ * Parses pyproject.toml (PEP 621), requirements.txt, and Pipfile to produce
+ * DependencyObservation[] for Python workspaces.
+ *
+ * Supports: pip, pipenv, poetry, uv — determined by manifest/lockfile presence.
+ */
+import type { DependencyObservation, EcosystemId, Workspace } from '../types.js';
+import type { EcosystemAdapter, InventoryOptions } from './interface.js';
+/**
+ * Parse poetry.lock to extract resolved versions.
+ * Format:
+ * [[package]]
+ * name = "flask"
+ * version = "3.0.3"
+ */
+export declare function parsePoetryLock(content: string): Map<string, string>;
+export declare class PythonAdapter implements EcosystemAdapter {
+    readonly ecosystem: EcosystemId;
+    inventory(workspace: Workspace, options: InventoryOptions): Promise<readonly DependencyObservation[]>;
+    private fileExists;
+    private detectLockfile;
+}
+export declare const pythonAdapter: PythonAdapter;
+//# sourceMappingURL=python.d.ts.map

package/dist/adapters/python.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"python.d.ts","sourceRoot":"","sources":["../../src/adapters/python.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EACV,qBAAqB,EAGrB,WAAW,EACX,SAAS,EACV,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EACjB,MAAM,gBAAgB,CAAC;AAqKxB;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAiBpE;AAYD,qBAAa,aAAc,YAAW,gBAAgB;IACpD,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAY;IAErC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,SAAS,qBAAqB,EAAE,CAAC,CAqG1G;IAED,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,cAAc;CAMvB;AAED,eAAO,MAAM,aAAa,eAAsB,CAAC"}

package/dist/adapters/ruby.d.ts

@@ -0,0 +1,16 @@
+/**
+ * TechStack — Ruby/Bundler ecosystem adapter (Tier B).
+ *
+ * Parses Gemfile and Gemfile.lock for direct and transitive dependencies.
+ * Partial support — no registry API; OSV-only advisory enrichment.
+ *
+ * @see docs/specs/techstack-sdd.md §6 Tier B
+ */
+import type { DependencyObservation, EcosystemId, Workspace } from '../types.js';
+import type { EcosystemAdapter, InventoryOptions } from './interface.js';
+export declare class RubyAdapter implements EcosystemAdapter {
+    readonly ecosystem: EcosystemId;
+    inventory(workspace: Workspace, _options: InventoryOptions): Promise<readonly DependencyObservation[]>;
+}
+export declare const rubyAdapter: RubyAdapter;
+//# sourceMappingURL=ruby.d.ts.map

package/dist/adapters/ruby.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ruby.d.ts","sourceRoot":"","sources":["../../src/adapters/ruby.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EACV,qBAAqB,EAGrB,WAAW,EACX,SAAS,EACV,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAgDzE,qBAAa,WAAY,YAAW,gBAAgB;IAClD,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAU;IAEnC,SAAS,CACb,SAAS,EAAE,SAAS,EACpB,QAAQ,EAAE,gBAAgB,GACzB,OAAO,CAAC,SAAS,qBAAqB,EAAE,CAAC,CA4D3C;CACF;AAED,eAAO,MAAM,WAAW,aAAoB,CAAC"}

package/dist/adapters/rust.d.ts

@@ -0,0 +1,20 @@
+/**
+ * TechStack — Rust ecosystem adapter.
+ *
+ * Parses Cargo.toml manifests and Cargo.lock lockfiles to produce
+ * DependencyObservation[] for Rust workspaces.
+ *
+ * @see docs/specs/techstack-sdd.md §6 Tier A
+ */
+import type { DependencyObservation, EcosystemId, Workspace } from '../types.js';
+import type { EcosystemAdapter, InventoryOptions } from './interface.js';
+export declare class RustAdapter implements EcosystemAdapter {
+    readonly ecosystem: EcosystemId;
+    inventory(workspace: Workspace, options: InventoryOptions): Promise<readonly DependencyObservation[]>;
+    private fileExists;
+}
+/**
+ * Default singleton instance.
+ */
+export declare const rustAdapter: RustAdapter;
+//# sourceMappingURL=rust.d.ts.map

package/dist/adapters/rust.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rust.d.ts","sourceRoot":"","sources":["../../src/adapters/rust.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EACV,qBAAqB,EAGrB,WAAW,EACX,SAAS,EACV,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EACjB,MAAM,gBAAgB,CAAC;AA2JxB,qBAAa,WAAY,YAAW,gBAAgB;IAClD,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAU;IAEnC,SAAS,CACb,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,SAAS,qBAAqB,EAAE,CAAC,CAoG3C;IAED,OAAO,CAAC,UAAU;CAQnB;AAED;;GAEG;AACH,eAAO,MAAM,WAAW,aAAoB,CAAC"}

package/dist/advisory/native-audit.d.ts

@@ -0,0 +1,61 @@
+/**
+ * TechStack — Native audit command wrappers.
+ *
+ * Spawns ecosystem-native audit tools (npm audit, pip-audit, cargo-audit,
+ * govulncheck, composer audit, dotnet package audit) and parses their
+ * output into the TechStack advisory model.
+ *
+ * @see docs/specs/techstack-sdd.md §6, §7
+ */
+import type { EcosystemId, Evidence } from '../types.js';
+export interface NativeAdvisory {
+    readonly id: string;
+    readonly packageName: string;
+    readonly severity: 'info' | 'low' | 'medium' | 'high' | 'critical';
+    readonly summary: string;
+    readonly fixVersion?: string | undefined;
+    readonly url?: string | undefined;
+    readonly aliases: readonly string[];
+}
+export interface NativeAuditResult {
+    readonly advisories: readonly NativeAdvisory[];
+    readonly evidence: Evidence;
+}
+/**
+ * Run npm audit in the given workspace directory and parse JSON output.
+ */
+export declare function runNpmAudit(workspaceRoot: string): NativeAuditResult;
+/**
+ * Run pip-audit in the given workspace directory.
+ * pip-audit supports --requirement, --format json flags.
+ */
+export declare function runPipAudit(workspaceRoot: string): NativeAuditResult;
+/**
+ * Run cargo-audit in the given workspace directory.
+ */
+export declare function runCargoAudit(workspaceRoot: string): NativeAuditResult;
+/**
+ * Run govulncheck in the given workspace directory.
+ * Output is JSON with vulnerabilities in the format:
+ * { vulns: [{ id, details, osv, ... }] }
+ */
+export declare function runGoVulncheck(workspaceRoot: string): NativeAuditResult;
+/**
+ * Run composer audit in the given workspace directory.
+ */
+export declare function runComposerAudit(workspaceRoot: string): NativeAuditResult;
+/**
+ * Run `dotnet package audit` in the given workspace directory.
+ * .NET 8+ supports `dotnet package audit --format json`.
+ */
+export declare function runDotnetAudit(workspaceRoot: string): NativeAuditResult;
+/**
+ * Run the native audit command for the given ecosystem.
+ * Returns advisories found by the native tool.
+ */
+export declare function runNativeAudit(ecosystem: EcosystemId, workspaceRoot: string): NativeAuditResult;
+/**
+ * Check if the native audit tool is available for the given ecosystem.
+ */
+export declare function isNativeAuditAvailable(ecosystem: EcosystemId): boolean;
+//# sourceMappingURL=native-audit.d.ts.map

package/dist/advisory/native-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"native-audit.d.ts","sourceRoot":"","sources":["../../src/advisory/native-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAIzD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IACnE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,UAAU,EAAE,SAAS,cAAc,EAAE,CAAC;IAC/C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;CAC7B;AA6BD;;GAEG;AACH,wBAAgB,WAAW,CAAC,aAAa,EAAE,MAAM,GAAG,iBAAiB,CA0DpE;AAID;;;GAGG;AACH,wBAAgB,WAAW,CAAC,aAAa,EAAE,MAAM,GAAG,iBAAiB,CAkBpE;AAuCD;;GAEG;AACH,wBAAgB,aAAa,CAAC,aAAa,EAAE,MAAM,GAAG,iBAAiB,CAGtE;AAgDD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,iBAAiB,CA2CvE;AAID;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,aAAa,EAAE,MAAM,GAAG,iBAAiB,CAwCzE;AAID;;;GAGG;AACH,wBAAgB,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,iBAAiB,CA4DvE;AA0CD;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,WAAW,EACtB,aAAa,EAAE,MAAM,GACpB,iBAAiB,CA0BnB;AAID;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,WAAW,GAAG,OAAO,CAatE"}

package/dist/advisory/osv.d.ts

@@ -0,0 +1,41 @@
+/**
+ * TechStack — OSV (Open Source Vulnerabilities) advisory client.
+ *
+ * Uses the OSV /v1/querybatch endpoint to batch-query vulnerability
+ * information for lists of PackageURLs. Chunks requests into batches
+ * of at most 500 packages per the OSV API limits.
+ *
+ * @see https://osv.dev/docs/
+ */
+import type { Evidence } from '../types.js';
+/** Parsed advisory for a single package */
+export interface OsvAdvisory {
+    readonly id: string;
+    readonly summary: string;
+    readonly severity: 'info' | 'low' | 'medium' | 'high' | 'critical';
+    readonly aliases: readonly string[];
+}
+/** Result of querying OSV for a batch of packages */
+export interface OsvBatchResult {
+    /** Map from PURL to advisories found for that package */
+    readonly advisories: Map<string, readonly OsvAdvisory[]>;
+    readonly evidence: Evidence;
+}
+/**
+ * Query OSV for advisories matching a list of PackageURLs.
+ *
+ * Chunks requests into batches of at most 500 PURLs per the OSV API limits.
+ * Returns a map from each queried PURL to its list of advisories (empty array
+ * means no advisories found).
+ */
+export declare function queryOsvBatch(purls: readonly string[], options?: {
+    signal?: AbortSignal | undefined;
+}): Promise<OsvBatchResult>;
+/**
+ * Query OSV for a single PURL.
+ * Convenience wrapper around queryOsvBatch.
+ */
+export declare function queryOsvSingle(purl: string, options?: {
+    signal?: AbortSignal | undefined;
+}): Promise<readonly OsvAdvisory[]>;
+//# sourceMappingURL=osv.d.ts.map

package/dist/advisory/osv.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"osv.d.ts","sourceRoot":"","sources":["../../src/advisory/osv.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAqC5C,2CAA2C;AAC3C,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IACnE,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,qDAAqD;AACrD,MAAM,WAAW,cAAc;IAC7B,yDAAyD;IACzD,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC,CAAC;IACzD,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;CAC7B;AA2FD;;;;;;GAMG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAA;CAAO,GACjD,OAAO,CAAC,cAAc,CAAC,CAiGzB;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAA;CAAO,GACjD,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAGjC"}

package/dist/delivery/coordinator.d.ts

@@ -0,0 +1,46 @@
+/**
+ * TechStack — DeliveryCoordinator.
+ *
+ * Per-session idle-delivery coordinator for TechStack reports.
+ *
+ * Guarantees (per SDD §5):
+ * 1. Idle-only: report is never injected while a run is in progress.
+ * 2. Exactly-once visible delivery: duplicate outbox entries → single delivery.
+ * 3. Durable: survives store close/reopen; pending entries retry on recovery.
+ * 4. Bounded: at most one delivery per report per session.
+ *
+ * @see docs/specs/techstack-sdd.md §5
+ */
+import type { TechStackStore } from '../store/sqlite.js';
+export interface DeliveryCoordinatorOptions {
+    readonly store: TechStackStore;
+    /** Check whether an agent run is currently in progress. */
+    readonly isRunInProgress: () => boolean;
+    /** Deliver the report summary to the chat session (append to journal). */
+    readonly deliverToSession: (sessionId: string, reportId: string, summary: string) => Promise<boolean>;
+    /** Called when a delivery completes (for WS event broadcasting). */
+    readonly onDelivered?: ((deliveryId: string, sessionId: string) => void) | undefined;
+    /** Poll interval in ms. Default: 2000. */
+    readonly pollIntervalMs?: number | undefined;
+}
+export interface DeliveryResult {
+    deliveryId: string;
+    sessionId: string;
+    delivered: boolean;
+}
+/**
+ * Attempt to deliver a single pending outbox entry.
+ *
+ * Returns `{ delivered: false }` if the run is still in progress or the
+ * entry has already been delivered. Returns `{ delivered: true }` on success.
+ *
+ * This function is idempotent: calling it twice for the same deliveryId
+ * will deliver exactly once (the CAS in claimOutbox prevents double-claim).
+ */
+export declare function attemptDelivery(deliveryId: string, opts: DeliveryCoordinatorOptions): Promise<DeliveryResult>;
+/**
+ * Process all pending outbox entries for a given session.
+ * Called by the coordinator loop when the session becomes idle.
+ */
+export declare function drainPendingDeliveries(sessionId: string, opts: DeliveryCoordinatorOptions): Promise<number>;
+//# sourceMappingURL=coordinator.d.ts.map

package/dist/delivery/coordinator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"coordinator.d.ts","sourceRoot":"","sources":["../../src/delivery/coordinator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGzD,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,2DAA2D;IAC3D,QAAQ,CAAC,eAAe,EAAE,MAAM,OAAO,CAAC;IACxC,0EAA0E;IAC1E,QAAQ,CAAC,gBAAgB,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACtG,oEAAoE;IACpE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IACrF,0CAA0C;IAC1C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9C;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,0BAA0B,GAC/B,OAAO,CAAC,cAAc,CAAC,CAoCzB;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,0BAA0B,GAC/B,OAAO,CAAC,MAAM,CAAC,CAYjB"}