@wrongstack/techstack 0.289.0

package/dist/index.js

@@ -0,0 +1,4287 @@
+// src/registry/purl.ts
+var ECOSYSTEM_TO_PURL_TYPE = {
+  npm: "npm",
+  python: "pypi",
+  rust: "cargo",
+  go: "golang",
+  dotnet: "nuget",
+  php: "composer",
+  dart: "pub",
+  maven: "maven",
+  gradle: "maven",
+  ruby: "gem",
+  swift: "swift",
+  elixir: "hex",
+  cpp: "conan"
+};
+var PURL_TYPE_TO_ECOSYSTEM = {
+  npm: "npm",
+  pypi: "python",
+  cargo: "rust",
+  golang: "go",
+  nuget: "dotnet",
+  composer: "php",
+  pub: "dart",
+  maven: "maven",
+  gem: "ruby",
+  swift: "swift",
+  hex: "elixir",
+  conan: "cpp"
+};
+function buildPurl(parts) {
+  const segments = ["pkg:", parts.type, "/"];
+  if (parts.namespace) {
+    segments.push(encodePurlSegment(parts.namespace), "/");
+  }
+  segments.push(encodePurlSegment(parts.name));
+  if (parts.version) {
+    segments.push("@", encodePurlSegment(parts.version));
+  }
+  if (parts.qualifiers && parts.qualifiers.size > 0) {
+    const qs = [...parts.qualifiers.entries()].map(([k, v]) => `${encodeURIComponent(k)}=${encodeURIComponent(v)}`).join("&");
+    segments.push("?", qs);
+  }
+  if (parts.subpath) {
+    segments.push("#", encodePurlSegment(parts.subpath));
+  }
+  return segments.join("");
+}
+function parsePurl(purl) {
+  if (!purl.startsWith("pkg:")) return void 0;
+  const withoutPrefix = purl.slice(4);
+  let main = withoutPrefix;
+  let subpath;
+  const hashIdx = main.indexOf("#");
+  if (hashIdx >= 0) {
+    subpath = decodePurlSegment(main.slice(hashIdx + 1));
+    main = main.slice(0, hashIdx);
+  }
+  let qualifiers;
+  const qIdx = main.indexOf("?");
+  if (qIdx >= 0) {
+    const qs = main.slice(qIdx + 1);
+    main = main.slice(0, qIdx);
+    qualifiers = /* @__PURE__ */ new Map();
+    for (const pair of qs.split("&")) {
+      const eqIdx = pair.indexOf("=");
+      if (eqIdx > 0) {
+        qualifiers.set(
+          decodeURIComponent(pair.slice(0, eqIdx)),
+          decodeURIComponent(pair.slice(eqIdx + 1))
+        );
+      }
+    }
+  }
+  let version;
+  const atIdx = main.lastIndexOf("@");
+  if (atIdx > 0) {
+    version = decodePurlSegment(main.slice(atIdx + 1));
+    main = main.slice(0, atIdx);
+  }
+  const slashIdx = main.indexOf("/");
+  if (slashIdx < 0) return void 0;
+  const type = main.slice(0, slashIdx);
+  let remainder = main.slice(slashIdx + 1);
+  let namespace;
+  let name;
+  const nsSlashIdx = remainder.indexOf("/");
+  if (nsSlashIdx >= 0 && type !== "npm") {
+    namespace = decodePurlSegment(remainder.slice(0, nsSlashIdx));
+    name = decodePurlSegment(remainder.slice(nsSlashIdx + 1));
+  } else if (nsSlashIdx >= 0 && type === "npm" && remainder.startsWith("%40")) {
+    namespace = decodePurlSegment(remainder.slice(0, nsSlashIdx));
+    name = decodePurlSegment(remainder.slice(nsSlashIdx + 1));
+  } else {
+    name = decodePurlSegment(remainder);
+  }
+  if (!type || !name) return void 0;
+  return {
+    type,
+    ...namespace ? { namespace } : {},
+    name,
+    ...version ? { version } : {},
+    ...qualifiers && qualifiers.size > 0 ? { qualifiers } : {},
+    ...subpath ? { subpath } : {}
+  };
+}
+function purlTypeForEcosystem(ecosystem) {
+  return ECOSYSTEM_TO_PURL_TYPE[ecosystem];
+}
+function ecosystemForPurlType(type) {
+  return PURL_TYPE_TO_ECOSYSTEM[type];
+}
+function constructPurl(ecosystem, name, version) {
+  const type = purlTypeForEcosystem(ecosystem);
+  if (ecosystem === "go") {
+    const versionSuffix = version !== void 0 ? `@${encodePurlSegment(version)}` : "";
+    return `pkg:${type}/${name}${versionSuffix}`;
+  }
+  const slashIdx = name.indexOf("/");
+  if (slashIdx > 0) {
+    const namespace = name.slice(0, slashIdx);
+    const pkgName = name.slice(slashIdx + 1);
+    if (pkgName.length > 0) {
+      return buildPurl({
+        type,
+        namespace,
+        name: pkgName,
+        ...version !== void 0 ? { version } : {}
+      });
+    }
+  }
+  return buildPurl({
+    type,
+    name,
+    ...version !== void 0 ? { version } : {}
+  });
+}
+function parsePurlEcosystem(purl) {
+  const parts = parsePurl(purl);
+  if (!parts) return void 0;
+  const ecosystem = ecosystemForPurlType(parts.type);
+  if (!ecosystem) return void 0;
+  const namespace = parts.namespace;
+  const name = namespace ? `${namespace}/${parts.name}` : parts.name;
+  return {
+    ecosystem,
+    name,
+    ...parts.version !== void 0 ? { version: parts.version } : {}
+  };
+}
+function encodePurlSegment(segment) {
+  return segment.replace(/%/g, "%25").replace(/@/g, "%40").replace(/\//g, "%2F");
+}
+function decodePurlSegment(segment) {
+  try {
+    return decodeURIComponent(segment);
+  } catch {
+    return segment;
+  }
+}
+
+// src/discovery/workspace.ts
+import { detectLanguageWorkspaces } from "@wrongstack/tools/languages";
+var STATIC_LANGUAGE_TO_ECOSYSTEM = {
+  typescript: "npm",
+  javascript: "npm",
+  deno: void 0,
+  python: "python",
+  go: "go",
+  rust: "rust",
+  csharp: "dotnet",
+  php: "php",
+  ruby: "ruby",
+  swift: "swift",
+  dart: "dart",
+  elixir: "elixir",
+  c: "cpp",
+  cpp: "cpp",
+  java: "maven",
+  // overridden by `resolveJavaEcosystem` when gradle evidence is present
+  shell: void 0
+};
+var ECOSYSTEM_TIER = {
+  npm: "full",
+  python: "full",
+  rust: "full",
+  go: "full",
+  dotnet: "full",
+  php: "full",
+  dart: "full",
+  maven: "partial",
+  gradle: "partial",
+  ruby: "partial",
+  swift: "partial",
+  elixir: "partial",
+  cpp: "unsupported"
+};
+function resolveJavaEcosystem(evidence) {
+  for (const item of evidence) {
+    if (item.kind === "lockfile" && item.value === "gradle.lockfile") return "gradle";
+    if (item.kind === "manifest" && (item.value === "build.gradle" || item.value === "build.gradle.kts" || item.value === "settings.gradle")) {
+      return "gradle";
+    }
+  }
+  return "maven";
+}
+function ecosystemForWorkspace(detected) {
+  if (detected.language === "java") {
+    return resolveJavaEcosystem(detected.evidence);
+  }
+  return STATIC_LANGUAGE_TO_ECOSYSTEM[detected.language];
+}
+function extractLockfiles(evidence) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const item of evidence) {
+    if (item.kind !== "lockfile") continue;
+    if (seen.has(item.path)) continue;
+    seen.add(item.path);
+    out.push(item.path);
+  }
+  return out.sort();
+}
+function mapDetectedWorkspace(detected, projectRoot) {
+  const ecosystem = ecosystemForWorkspace(detected);
+  if (!ecosystem) return void 0;
+  const relativeRoot = detected.root === projectRoot ? "." : detected.root.startsWith(`${projectRoot}/`) || detected.root.startsWith(`${projectRoot}\\`) ? detected.root.slice(projectRoot.length + 1) : detected.root;
+  const lockfiles = extractLockfiles(detected.evidence);
+  return {
+    id: detected.id,
+    relativeRoot,
+    ecosystem,
+    ...detected.packageManager ? { packageManager: detected.packageManager } : {},
+    manifests: [...detected.manifests].sort(),
+    lockfiles,
+    confidence: Math.max(0, Math.min(1, detected.confidence)),
+    coverage: ECOSYSTEM_TIER[ecosystem]
+  };
+}
+var TEST_FIXTURE_DIRECTORIES = [
+  "fixtures",
+  "__fixtures__",
+  "test-fixtures",
+  "testdata",
+  "__mocks__"
+];
+async function discoverWorkspaces(projectRoot, options) {
+  const result = await detectLanguageWorkspaces({
+    ...options ?? {},
+    projectRoot,
+    ignoredDirectories: [...TEST_FIXTURE_DIRECTORIES, ...options?.ignoredDirectories ?? []]
+  });
+  const mapped = [];
+  for (const detected of result.workspaces) {
+    const workspace = mapDetectedWorkspace(detected, result.projectRoot);
+    if (workspace) mapped.push(workspace);
+  }
+  mapped.sort((a, b) => {
+    return a.ecosystem.localeCompare(b.ecosystem) || a.relativeRoot.localeCompare(b.relativeRoot) || a.id.localeCompare(b.id);
+  });
+  return mapped;
+}
+function coverageForEcosystem(ecosystem) {
+  return ECOSYSTEM_TIER[ecosystem];
+}
+
+// src/adapters/npm.ts
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join, relative, resolve as resolve2 } from "node:path";
+
+// src/adapters/paths.ts
+import { resolve } from "node:path";
+function workspaceRoot(workspace, options) {
+  const relative2 = workspace.relativeRoot || ".";
+  return options.projectRoot ? resolve(options.projectRoot, relative2) : resolve(relative2);
+}
+function resolveIn(root, candidate) {
+  return resolve(root, candidate);
+}
+
+// src/adapters/npm.ts
+function detectLockfile(workspaceDir, stopAt) {
+  const candidates = [
+    { file: "pnpm-lock.yaml", kind: "pnpm" },
+    { file: "package-lock.json", kind: "npm" },
+    { file: "yarn.lock", kind: "yarn" },
+    { file: "bun.lockb", kind: "bun" }
+  ];
+  const ceiling = stopAt ? resolve2(stopAt) : void 0;
+  let dir = resolve2(workspaceDir);
+  for (; ; ) {
+    for (const c of candidates) {
+      const candidate = join(dir, c.file);
+      if (existsSync(candidate)) return { kind: c.kind, path: candidate };
+    }
+    if (ceiling && dir === ceiling) break;
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    if (!ceiling) break;
+    dir = parent;
+  }
+  return { kind: "none", path: "" };
+}
+function stripPeerSuffix(version) {
+  const paren = version.indexOf("(");
+  return (paren === -1 ? version : version.slice(0, paren)).trim();
+}
+function parsePnpmImporterVersions(lockContent, importerPath) {
+  const versions = /* @__PURE__ */ new Map();
+  const lines = lockContent.split(/\r?\n/);
+  let inImporters = false;
+  let inTargetImporter = false;
+  let currentPackage;
+  for (const raw of lines) {
+    if (raw.trim() === "" || raw.trimStart().startsWith("#")) continue;
+    if (!/^\s/.test(raw)) {
+      if (inImporters) break;
+      inImporters = raw.startsWith("importers:");
+      continue;
+    }
+    if (!inImporters) continue;
+    const indent = raw.length - raw.trimStart().length;
+    const line = raw.trim();
+    if (indent === 2) {
+      const key = line.endsWith(":") ? unquote(line.slice(0, -1)) : void 0;
+      inTargetImporter = key === importerPath;
+      currentPackage = void 0;
+      continue;
+    }
+    if (!inTargetImporter) continue;
+    if (indent === 4) {
+      currentPackage = void 0;
+      continue;
+    }
+    if (indent === 6 && line.endsWith(":")) {
+      currentPackage = unquote(line.slice(0, -1));
+      continue;
+    }
+    if (indent >= 8 && currentPackage && line.startsWith("version:")) {
+      const version = stripPeerSuffix(unquote(line.slice("version:".length).trim()));
+      if (version && !version.startsWith("link:") && !version.startsWith("file:")) {
+        versions.set(currentPackage, version);
+      }
+      currentPackage = void 0;
+    }
+  }
+  return versions;
+}
+function unquote(value) {
+  const trimmed = value.trim();
+  if (trimmed.startsWith("'") && trimmed.endsWith("'") || trimmed.startsWith('"') && trimmed.endsWith('"')) {
+    return trimmed.slice(1, -1);
+  }
+  return trimmed;
+}
+function parseNpmLockVersions(lockContent) {
+  const versions = /* @__PURE__ */ new Map();
+  try {
+    const lock = JSON.parse(lockContent);
+    const deps = lock.dependencies ?? {};
+    for (const [name, info] of Object.entries(deps)) {
+      const depInfo = info;
+      if (depInfo.version) {
+        const cleanVersion = depInfo.version.replace(/^[^0-9]+/, "");
+        versions.set(name, cleanVersion);
+      }
+    }
+    const packages = lock.packages ?? {};
+    for (const key of Object.keys(packages)) {
+      const pkgInfo = packages[key];
+      if (pkgInfo.version) {
+        const name = key.replace(/^node_modules\//, "");
+        if (!versions.has(name)) {
+          versions.set(name, pkgInfo.version);
+        }
+      }
+    }
+  } catch {
+  }
+  return versions;
+}
+function manifestEvidence(path) {
+  return {
+    kind: "manifest",
+    source: path,
+    retrievedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function lockfileEvidence(path) {
+  return {
+    kind: "lockfile",
+    source: path,
+    retrievedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function scopeForSection(section) {
+  switch (section) {
+    case "dependencies":
+      return "runtime";
+    case "devDependencies":
+      return "development";
+    case "peerDependencies":
+      return "peer";
+    case "optionalDependencies":
+      return "optional";
+    default:
+      return "runtime";
+  }
+}
+function statusForSpec(spec) {
+  if (spec.startsWith("file:") || spec.startsWith("link:") || spec.startsWith("workspace:")) {
+    return "local_path";
+  }
+  if (spec.startsWith("git+") || spec.startsWith("github:") || spec.startsWith("git:")) {
+    return "git_dependency";
+  }
+  return "current";
+}
+function isRegistrySpec(spec) {
+  return !spec.startsWith("file:") && !spec.startsWith("link:") && !spec.startsWith("workspace:") && !spec.startsWith("git+") && !spec.startsWith("github:") && !spec.startsWith("git:");
+}
+var NpmAdapter = class {
+  ecosystem = "npm";
+  async inventory(workspace, options) {
+    const observations = [];
+    const root = workspaceRoot(workspace, options);
+    const manifestPath = resolveIn(
+      root,
+      workspace.manifests.find((m) => m.endsWith("package.json")) ?? "package.json"
+    );
+    let pkg;
+    let manifestContent;
+    try {
+      manifestContent = readFileSync(manifestPath, "utf-8");
+      pkg = JSON.parse(manifestContent);
+    } catch {
+      return [];
+    }
+    const manifestEv = manifestEvidence(manifestPath);
+    const lockInfo = detectLockfile(root, options.projectRoot);
+    const resolvedVersions = /* @__PURE__ */ new Map();
+    let lockEv;
+    if (lockInfo.kind === "pnpm") {
+      try {
+        const lockContent = readFileSync(lockInfo.path, "utf-8");
+        const importerPath = relative(dirname(lockInfo.path), root).split(/[/\\]/).filter(Boolean).join("/") || ".";
+        const parsed = parsePnpmImporterVersions(lockContent, importerPath);
+        for (const [k, v] of parsed) resolvedVersions.set(k, v);
+        if (parsed.size > 0) lockEv = lockfileEvidence(lockInfo.path);
+      } catch {
+      }
+    } else if (lockInfo.kind === "npm") {
+      try {
+        const lockContent = readFileSync(lockInfo.path, "utf-8");
+        const parsed = parseNpmLockVersions(lockContent);
+        for (const [k, v] of parsed) resolvedVersions.set(k, v);
+        lockEv = lockfileEvidence(lockInfo.path);
+      } catch {
+      }
+    }
+    const sections = [
+      { name: "dependencies", deps: pkg.dependencies },
+      { name: "devDependencies", deps: pkg.devDependencies },
+      { name: "peerDependencies", deps: pkg.peerDependencies },
+      { name: "optionalDependencies", deps: pkg.optionalDependencies }
+    ];
+    const seen = /* @__PURE__ */ new Set();
+    for (const section of sections) {
+      if (!section.deps) continue;
+      const scope = scopeForSection(section.name);
+      for (const [name, requested] of Object.entries(section.deps)) {
+        const dedupKey2 = `${name}`;
+        if (seen.has(dedupKey2)) continue;
+        seen.add(dedupKey2);
+        const isRegistry = isRegistrySpec(requested);
+        const status = statusForSpec(requested);
+        const locked = resolvedVersions.get(name);
+        const purl = isRegistry && locked ? buildPurl({ type: "npm", name, version: locked }) : isRegistry ? buildPurl({ type: "npm", name }) : void 0;
+        const evidence = [manifestEv];
+        if (lockEv && locked) evidence.push(lockEv);
+        observations.push({
+          id: `dep-${workspace.id}-${name}`,
+          workspaceId: workspace.id,
+          ...purl ? { purl } : {},
+          ecosystem: "npm",
+          name,
+          sourceType: isRegistry ? "registry" : status === "local_path" ? "path" : "git",
+          direct: true,
+          scope,
+          requested,
+          ...locked ? { locked } : {},
+          status,
+          evidence
+        });
+      }
+    }
+    return observations;
+  }
+};
+var npmAdapter = new NpmAdapter();
+
+// src/adapters/python.ts
+import { readFileSync as readFileSync2 } from "node:fs";
+import { join as join2 } from "node:path";
+function manifestEvidence2(path) {
+  return { kind: "manifest", source: path, retrievedAt: (/* @__PURE__ */ new Date()).toISOString() };
+}
+function lockfileEvidence2(path) {
+  return { kind: "lockfile", source: path, retrievedAt: (/* @__PURE__ */ new Date()).toISOString() };
+}
+function parseTomlSections(content) {
+  const sections = [];
+  let currentSection = "__header__";
+  let currentLines = [];
+  for (const raw of content.split("\n")) {
+    const line = raw.trim();
+    if (line.startsWith("#") || line === "") continue;
+    const sectionMatch = line.match(/^\[([^\]]+)\]$/);
+    if (sectionMatch) {
+      if (currentLines.length > 0) sections.push({ name: currentSection, lines: currentLines });
+      currentSection = sectionMatch[1];
+      currentLines = [];
+    } else {
+      currentLines.push(raw);
+    }
+  }
+  if (currentLines.length > 0) sections.push({ name: currentSection, lines: currentLines });
+  return sections;
+}
+function extractTomlArray(sectionLines, key) {
+  const result = [];
+  let inArray = false;
+  for (const line of sectionLines) {
+    const trimmed = line.trim();
+    if (!inArray) {
+      const match = trimmed.match(new RegExp(`^${key}\\s*=\\s*\\[`));
+      if (match) {
+        inArray = true;
+        const rest = trimmed.slice(match[0].length);
+        if (rest.includes("]")) {
+          const items = rest.replace(/\]\s*,?\s*$/, "").trim();
+          for (const item of items.split(",")) {
+            const cleaned = item.trim().replace(/^"|"$/g, "").trim();
+            if (cleaned) result.push(cleaned);
+          }
+          inArray = false;
+        }
+      }
+    } else {
+      const closeIdx = trimmed.indexOf("]");
+      if (closeIdx >= 0) {
+        const items = trimmed.slice(0, closeIdx).trim();
+        for (const item of items.split(",")) {
+          const cleaned = item.trim().replace(/^"|"$/g, "").trim();
+          if (cleaned) result.push(cleaned);
+        }
+        inArray = false;
+      } else {
+        const cleaned = trimmed.replace(/,$/, "").trim().replace(/^"|"$/g, "").trim();
+        if (cleaned) result.push(cleaned);
+      }
+    }
+  }
+  return result;
+}
+function parsePep508(spec) {
+  let s = spec.trim();
+  s = s.replace(/\[.*?\]/g, "");
+  const match = s.match(/^([a-zA-Z0-9][a-zA-Z0-9._-]*)\s*(.*)$/);
+  if (!match) return { name: s, constraint: void 0 };
+  return { name: match[1], constraint: match[2]?.trim() || void 0 };
+}
+function parsePyprojectDeps(content) {
+  const deps = [];
+  const sections = parseTomlSections(content);
+  const projectSection = sections.find((s) => s.name === "project");
+  if (projectSection) {
+    const depSpecs = extractTomlArray(projectSection.lines, "dependencies");
+    for (const spec of depSpecs) {
+      const { name, constraint } = parsePep508(spec);
+      if (name) deps.push({ name, constraint, scope: "runtime" });
+    }
+  }
+  for (const section of sections) {
+    if (section.name === "project.optional-dependencies") {
+      for (const line of section.lines) {
+        const trimmed = line.trim();
+        const groupMatch = trimmed.match(/^([a-zA-Z0-9_-]+)\s*=\s*\[/);
+        if (groupMatch) {
+          const depSpecs = extractTomlArray(section.lines, groupMatch[1]);
+          for (const spec of depSpecs) {
+            const { name, constraint } = parsePep508(spec);
+            if (name) deps.push({ name, constraint, scope: "optional" });
+          }
+        }
+      }
+    }
+  }
+  return deps;
+}
+function parseRequirementsTxt(content) {
+  const deps = [];
+  for (const raw of content.split("\n")) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#") || line.startsWith("-")) continue;
+    const { name, constraint } = parsePep508(line);
+    if (name) deps.push({ name, constraint });
+  }
+  return deps;
+}
+function parsePipfileDeps(content) {
+  const deps = [];
+  const sections = parseTomlSections(content);
+  for (const section of sections) {
+    const scope = section.name === "dev-packages" ? "development" : "runtime";
+    for (const line of section.lines) {
+      const trimmed = line.trim();
+      if (trimmed.startsWith("#")) continue;
+      const match = trimmed.match(/^([a-zA-Z0-9][a-zA-Z0-9._-]*)\s*=\s*"([^"]*)"$/);
+      if (match) {
+        const constraint = match[2] === "*" ? void 0 : match[2];
+        deps.push({ name: match[1], constraint, scope });
+      }
+    }
+  }
+  return deps;
+}
+function parseRequirementsLockVersions(content) {
+  const versions = /* @__PURE__ */ new Map();
+  for (const raw of content.split("\n")) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#") || line.startsWith("-")) continue;
+    const match = line.match(/^([a-zA-Z0-9][a-zA-Z0-9._-]*)\s*==\s*([^\s;]+)/);
+    if (match) versions.set(match[1], match[2]);
+  }
+  return versions;
+}
+var PythonAdapter = class {
+  ecosystem = "python";
+  async inventory(workspace, options) {
+    const observations = [];
+    const root = workspaceRoot(workspace, options);
+    const seen = /* @__PURE__ */ new Set();
+    const hasPyproject = workspace.manifests.some((m) => m.includes("pyproject.toml")) || this.fileExists(join2(root, "pyproject.toml"));
+    const hasRequirements = workspace.manifests.some((m) => m.includes("requirements.txt")) || this.fileExists(join2(root, "requirements.txt"));
+    const hasPipfile = workspace.manifests.some((m) => m.includes("Pipfile")) || this.fileExists(join2(root, "Pipfile"));
+    const lockfilePath = this.detectLockfile(root);
+    let allDeps = [];
+    let pyprojectEv;
+    if (hasPyproject) {
+      try {
+        const content = readFileSync2(join2(root, "pyproject.toml"), "utf-8");
+        pyprojectEv = manifestEvidence2(join2(root, "pyproject.toml"));
+        const parsed = parsePyprojectDeps(content);
+        for (const d of parsed) allDeps.push({ ...d, source: "pyproject.toml" });
+      } catch {
+      }
+    }
+    let reqLockVersions = /* @__PURE__ */ new Map();
+    let requirementsEv;
+    if (hasRequirements) {
+      try {
+        const content = readFileSync2(join2(root, "requirements.txt"), "utf-8");
+        requirementsEv = manifestEvidence2(join2(root, "requirements.txt"));
+        const parsed = parseRequirementsTxt(content);
+        for (const d of parsed) {
+          if (!allDeps.some((existing) => existing.name === d.name)) {
+            allDeps.push({ ...d, scope: "runtime", source: "requirements.txt" });
+          }
+        }
+        reqLockVersions = parseRequirementsLockVersions(content);
+      } catch {
+      }
+    }
+    if (hasPipfile) {
+      try {
+        const content = readFileSync2(join2(root, "Pipfile"), "utf-8");
+        if (!pyprojectEv) pyprojectEv = manifestEvidence2(join2(root, "Pipfile"));
+        const parsed = parsePipfileDeps(content);
+        for (const d of parsed) {
+          if (!allDeps.some((existing) => existing.name === d.name)) {
+            allDeps.push({ ...d, source: "Pipfile" });
+          }
+        }
+      } catch {
+      }
+    }
+    let lockEv;
+    if (lockfilePath) {
+      try {
+        readFileSync2(lockfilePath, "utf-8");
+        lockEv = lockfileEvidence2(lockfilePath);
+      } catch {
+      }
+    }
+    const manifestEv = pyprojectEv || requirementsEv;
+    for (const dep of allDeps) {
+      if (seen.has(dep.name)) continue;
+      seen.add(dep.name);
+      const locked = reqLockVersions.get(dep.name) || void 0;
+      const isRegistry = !dep.constraint || !dep.constraint.startsWith("file:") && !dep.constraint.startsWith("git+") && !dep.constraint.startsWith("-e");
+      const purl = isRegistry && locked ? buildPurl({ type: "python", name: dep.name, version: locked }) : isRegistry ? buildPurl({ type: "python", name: dep.name }) : void 0;
+      const evidence = [];
+      if (manifestEv) evidence.push(manifestEv);
+      if (lockEv && locked) evidence.push(lockEv);
+      if (evidence.length === 0) {
+        evidence.push({ kind: "manifest", source: dep.source, retrievedAt: (/* @__PURE__ */ new Date()).toISOString() });
+      }
+      const status = dep.constraint && (dep.constraint.startsWith("file:") || dep.constraint.startsWith("-e")) ? "local_path" : dep.constraint?.startsWith("git+") ? "git_dependency" : "current";
+      observations.push({
+        id: `dep-${workspace.id}-${dep.name}`,
+        workspaceId: workspace.id,
+        ...purl ? { purl } : {},
+        ecosystem: "python",
+        name: dep.name,
+        sourceType: isRegistry ? "registry" : status === "local_path" ? "path" : "git",
+        direct: true,
+        scope: dep.scope,
+        ...dep.constraint ? { requested: dep.constraint } : {},
+        ...locked ? { locked } : {},
+        status,
+        evidence
+      });
+    }
+    return observations;
+  }
+  fileExists(filePath) {
+    try {
+      readFileSync2(filePath, "utf-8");
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  detectLockfile(workspaceRoot2) {
+    for (const file of ["Pipfile.lock", "poetry.lock", "uv.lock"]) {
+      try {
+        readFileSync2(join2(workspaceRoot2, file), "utf-8");
+        return join2(workspaceRoot2, file);
+      } catch {
+      }
+    }
+    return void 0;
+  }
+};
+var pythonAdapter = new PythonAdapter();
+
+// src/adapters/rust.ts
+import { readFileSync as readFileSync3 } from "node:fs";
+function manifestEvidence3(path) {
+  return { kind: "manifest", source: path, retrievedAt: (/* @__PURE__ */ new Date()).toISOString() };
+}
+function lockfileEvidence3(path) {
+  return { kind: "lockfile", source: path, retrievedAt: (/* @__PURE__ */ new Date()).toISOString() };
+}
+function parseTomlSections2(content) {
+  const sections = [];
+  let currentSection = "__header__";
+  let currentLines = [];
+  for (const raw of content.split("\n")) {
+    const line = raw.trim();
+    if (line.startsWith("#") || line === "") continue;
+    const sectionMatch = line.match(/^\[([^\]]+)\]$/);
+    if (sectionMatch) {
+      if (currentLines.length > 0) sections.push({ name: currentSection, lines: currentLines });
+      currentSection = sectionMatch[1];
+      currentLines = [];
+    } else {
+      currentLines.push(raw);
+    }
+  }
+  if (currentLines.length > 0) sections.push({ name: currentSection, lines: currentLines });
+  return sections;
+}
+function parseTomlKeyValue(line) {
+  const trimmed = line.trim();
+  if (trimmed.startsWith("#")) return void 0;
+  const match = trimmed.match(/^([a-zA-Z0-9_-]+)\s*=\s*(.+)$/);
+  if (!match) return void 0;
+  return { key: match[1], value: match[2].trim() };
+}
+function extractTomlDeps(sectionLines) {
+  const deps = [];
+  for (const raw of sectionLines) {
+    const line = raw.trim();
+    if (line.startsWith("#") || line === "") continue;
+    const tableMatch = line.match(/^([a-zA-Z0-9_-]+)\s*=\s*\{\s*(.*?)\s*\}$/);
+    if (tableMatch) {
+      const name = tableMatch[1];
+      const inner = tableMatch[2];
+      const versionMatch = inner.match(/version\s*=\s*"([^"]+)"/);
+      deps.push({ name, version: versionMatch ? versionMatch[1] : void 0 });
+      continue;
+    }
+    const simpleMatch = line.match(/^([a-zA-Z0-9_-]+)\s*=\s*"([^"]*)"$/);
+    if (simpleMatch) {
+      deps.push({ name: simpleMatch[1], version: simpleMatch[2] || void 0 });
+      continue;
+    }
+    const partialMatch = parseTomlKeyValue(line);
+    if (partialMatch && !partialMatch.value.startsWith("{") && !partialMatch.value.startsWith('"')) {
+    }
+  }
+  return deps;
+}
+function parseCargoLock(content) {
+  const versions = /* @__PURE__ */ new Map();
+  const lines = content.split("\n");
+  let currentName;
+  let currentVersion;
+  let inPackage = false;
+  for (const raw of lines) {
+    const line = raw.trim();
+    if (line.startsWith("#") || line === "") continue;
+    if (line.startsWith("[[") && line.includes("package")) {
+      if (inPackage && currentName && currentVersion) {
+        versions.set(currentName, currentVersion);
+      }
+      currentName = void 0;
+      currentVersion = void 0;
+      inPackage = true;
+      continue;
+    }
+    if (inPackage) {
+      if (line.startsWith("name")) {
+        const m = line.match(/^name\s*=\s*"([^"]+)"/);
+        if (m) currentName = m[1];
+      } else if (line.startsWith("version")) {
+        const m = line.match(/^version\s*=\s*"([^"]+)"/);
+        if (m) currentVersion = m[1];
+      }
+    }
+  }
+  if (inPackage && currentName && currentVersion) {
+    versions.set(currentName, currentVersion);
+  }
+  return versions;
+}
+function scopeForCargoSection(section) {
+  switch (section) {
+    case "dependencies":
+      return "runtime";
+    case "dev-dependencies":
+      return "development";
+    case "build-dependencies":
+      return "build";
+    default:
+      return "runtime";
+  }
+}
+var RustAdapter = class {
+  ecosystem = "rust";
+  async inventory(workspace, options) {
+    const observations = [];
+    const root = workspaceRoot(workspace, options);
+    const seen = /* @__PURE__ */ new Set();
+    const cargoTomlPath = workspace.manifests.find((m) => m.includes("Cargo.toml")) || (this.fileExists(resolveIn(root, "Cargo.toml")) ? "Cargo.toml" : void 0);
+    if (!cargoTomlPath) return [];
+    const fullManifestPath = resolveIn(root, cargoTomlPath);
+    let cargoContent;
+    try {
+      cargoContent = readFileSync3(fullManifestPath, "utf-8");
+    } catch {
+      return [];
+    }
+    const manifestEv = manifestEvidence3(fullManifestPath);
+    const cargoLockPath = resolveIn(root, "Cargo.lock");
+    let lockVersions = /* @__PURE__ */ new Map();
+    let lockEv;
+    try {
+      const lockContent = readFileSync3(cargoLockPath, "utf-8");
+      lockVersions = parseCargoLock(lockContent);
+      lockEv = lockfileEvidence3(cargoLockPath);
+    } catch {
+    }
+    const sections = parseTomlSections2(cargoContent);
+    const depSections = ["dependencies", "dev-dependencies", "build-dependencies"];
+    for (const section of sections) {
+      const sectionName = section.name;
+      let matchedScope;
+      for (const depSec of depSections) {
+        if (sectionName === depSec || sectionName.endsWith(`.${depSec}`)) {
+          matchedScope = depSec;
+          break;
+        }
+      }
+      if (!matchedScope) continue;
+      const scope = scopeForCargoSection(matchedScope);
+      const deps = extractTomlDeps(section.lines);
+      for (const dep of deps) {
+        if (seen.has(dep.name)) continue;
+        seen.add(dep.name);
+        const locked = lockVersions.get(dep.name) || dep.version;
+        const isRegistry = !dep.version || !dep.version.startsWith("path=") && !dep.version.startsWith("git=") && !dep.version.startsWith("../");
+        const purl = isRegistry && locked ? buildPurl({ type: "rust", name: dep.name, version: locked }) : isRegistry ? buildPurl({ type: "rust", name: dep.name }) : void 0;
+        const evidence = [manifestEv];
+        if (lockEv && locked && lockVersions.has(dep.name)) evidence.push(lockEv);
+        const status = dep.version && (dep.version.startsWith("path=") || dep.version.startsWith("git=")) ? dep.version.startsWith("git=") ? "git_dependency" : "local_path" : "current";
+        observations.push({
+          id: `dep-${workspace.id}-${dep.name}`,
+          workspaceId: workspace.id,
+          ...purl ? { purl } : {},
+          ecosystem: "rust",
+          name: dep.name,
+          sourceType: isRegistry ? "registry" : status === "local_path" ? "path" : "git",
+          direct: true,
+          scope,
+          ...dep.version ? { requested: dep.version } : {},
+          ...locked ? { locked } : {},
+          status,
+          evidence
+        });
+      }
+    }
+    return observations;
+  }
+  fileExists(filePath) {
+    try {
+      readFileSync3(filePath, "utf-8");
+      return true;
+    } catch {
+      return false;
+    }
+  }
+};
+var rustAdapter = new RustAdapter();
+
+// src/adapters/go.ts
+import { readFileSync as readFileSync4 } from "node:fs";
+function manifestEvidence4(path) {
+  return { kind: "manifest", source: path, retrievedAt: (/* @__PURE__ */ new Date()).toISOString() };
+}
+function lockfileEvidence4(path) {
+  return { kind: "lockfile", source: path, retrievedAt: (/* @__PURE__ */ new Date()).toISOString() };
+}
+function cleanGoVersion(v) {
+  return v.replace(/^v/i, "");
+}
+function parseGoMod(content) {
+  const deps = [];
+  const lines = content.split("\n");
+  let inRequireBlock = false;
+  for (const raw of lines) {
+    const line = raw.trim();
+    if (line === "" || line.startsWith("//")) continue;
+    if (line.startsWith("require (") && line.endsWith("(")) {
+      inRequireBlock = true;
+      continue;
+    }
+    if (line.startsWith("require ") && !line.includes("(")) {
+      const m = line.match(/^require\s+(\S+)\s+(\S+)/);
+      if (m) {
+        const indirect = raw.includes("// indirect");
+        deps.push({ modulePath: m[1], version: cleanGoVersion(m[2]), indirect });
+      }
+      continue;
+    }
+    if (inRequireBlock) {
+      if (line === ")") {
+        inRequireBlock = false;
+        continue;
+      }
+      const m = line.match(/^(\S+)\s+(\S+)/);
+      if (m) {
+        const indirect = raw.includes("// indirect");
+        deps.push({ modulePath: m[1], version: cleanGoVersion(m[2]), indirect });
+      }
+      continue;
+    }
+    if (line.startsWith("exclude") || line.startsWith("replace") || line.startsWith("retract")) {
+      continue;
+    }
+  }
+  return deps;
+}
+function parseGoSum(content) {
+  const versions = /* @__PURE__ */ new Map();
+  for (const raw of content.split("\n")) {
+    const line = raw.trim();
+    if (!line) continue;
+    const m = line.match(/^(\S+)\s+(\S+)\s+\S+/);
+    if (m) {
+      const modulePath = m[1];
+      const version = cleanGoVersion(m[2]);
+      if (!versions.has(modulePath)) {
+        versions.set(modulePath, version);
+      }
+    }
+  }
+  return versions;
+}
+function parseGoModuleName(content) {
+  for (const raw of content.split("\n")) {
+    const line = raw.trim();
+    const m = line.match(/^module\s+(\S+)/);
+    if (m) return m[1];
+  }
+  return void 0;
+}
+var GoAdapter = class {
+  ecosystem = "go";
+  async inventory(workspace, options) {
+    const observations = [];
+    const root = workspaceRoot(workspace, options);
+    const seen = /* @__PURE__ */ new Set();
+    const goModPath = workspace.manifests.find((m) => m.includes("go.mod")) || (this.fileExists(resolveIn(root, "go.mod")) ? "go.mod" : void 0);
+    if (!goModPath) return [];
+    const fullManifestPath = resolveIn(root, goModPath);
+    let goModContent;
+    try {
+      goModContent = readFileSync4(fullManifestPath, "utf-8");
+    } catch {
+      return [];
+    }
+    const manifestEv = manifestEvidence4(fullManifestPath);
+    const requires = parseGoMod(goModContent);
+    const modName = parseGoModuleName(goModContent);
+    const goSumPath = resolveIn(root, "go.sum");
+    let lockVersions = /* @__PURE__ */ new Map();
+    let lockEv;
+    try {
+      const sumContent = readFileSync4(goSumPath, "utf-8");
+      lockVersions = parseGoSum(sumContent);
+      lockEv = lockfileEvidence4(goSumPath);
+    } catch {
+    }
+    for (const req of requires) {
+      if (seen.has(req.modulePath)) continue;
+      seen.add(req.modulePath);
+      if (req.modulePath === modName) continue;
+      const scope = req.indirect ? "transitive" : "runtime";
+      const direct = !req.indirect;
+      const locked = lockVersions.get(req.modulePath) || req.version;
+      const purl = buildPurl({ type: "go", name: req.modulePath, version: locked });
+      const evidence = [manifestEv];
+      if (lockEv && lockVersions.has(req.modulePath)) evidence.push(lockEv);
+      observations.push({
+        id: `dep-${workspace.id}-${req.modulePath}`,
+        workspaceId: workspace.id,
+        purl,
+        ecosystem: "go",
+        name: req.modulePath,
+        sourceType: "registry",
+        direct,
+        scope,
+        requested: req.version,
+        ...locked ? { locked } : {},
+        status: "current",
+        evidence
+      });
+    }
+    return observations;
+  }
+  fileExists(filePath) {
+    try {
+      readFileSync4(filePath, "utf-8");
+      return true;
+    } catch {
+      return false;
+    }
+  }
+};
+var goAdapter = new GoAdapter();
+
+// src/adapters/dotnet.ts
+import { readFileSync as readFileSync5, readdirSync } from "node:fs";
+import { join as join3 } from "node:path";
+function manifestEvidence5(path) {
+  return { kind: "manifest", source: path, retrievedAt: (/* @__PURE__ */ new Date()).toISOString() };
+}
+function lockfileEvidence5(path) {
+  return { kind: "lockfile", source: path, retrievedAt: (/* @__PURE__ */ new Date()).toISOString() };
+}
+function parseCsproj(content) {
+  const refs = [];
+  const regex = /<PackageReference\s+Include\s*=\s*"([^"]+)"\s*(?:Version\s*=\s*"([^"]*)")?\s*\/?\s*>/g;
+  let match;
+  while ((match = regex.exec(content)) !== null) {
+    const name = match[1];
+    const version = match[2] || void 0;
+    refs.push({ name, version });
+  }
+  return refs;
+}
+function parseProjectAssetsJson(content) {
+  const versions = /* @__PURE__ */ new Map();
+  try {
+    const json = JSON.parse(content);
+    if (json.libraries) {
+      for (const key of Object.keys(json.libraries)) {
+        const sepIndex = key.lastIndexOf("/");
+        if (sepIndex >= 0) {
+          const name = key.slice(0, sepIndex);
+          const version = key.slice(sepIndex + 1);
+          if (name && version) {
+            versions.set(name, version);
+          }
+        }
+      }
+    }
+  } catch {
+  }
+  return versions;
+}
+var DotNetAdapter = class {
+  ecosystem = "dotnet";
+  async inventory(workspace, options) {
+    const observations = [];
+    const root = workspaceRoot(workspace, options);
+    const seen = /* @__PURE__ */ new Set();
+    let csprojPath;
+    try {
+      const files = readdirSync(root);
+      const csproj = files.find((f) => f.endsWith(".csproj"));
+      if (csproj) csprojPath = join3(root, csproj);
+    } catch {
+    }
+    if (!csprojPath) return [];
+    let csprojContent;
+    try {
+      csprojContent = readFileSync5(csprojPath, "utf-8");
+    } catch {
+      return [];
+    }
+    const manifestEv = manifestEvidence5(csprojPath);
+    const refs = parseCsproj(csprojContent);
+    const assetsPath = join3(root, "project.assets.json");
+    let lockVersions = /* @__PURE__ */ new Map();
+    let lockEv;
+    try {
+      const assetsContent = readFileSync5(assetsPath, "utf-8");
+      lockVersions = parseProjectAssetsJson(assetsContent);
+      lockEv = lockfileEvidence5(assetsPath);
+    } catch {
+    }
+    for (const ref of refs) {
+      if (seen.has(ref.name)) continue;
+      seen.add(ref.name);
+      const locked = lockVersions.get(ref.name) || ref.version;
+      const purl = locked ? buildPurl({ type: "dotnet", name: ref.name, version: locked }) : buildPurl({ type: "dotnet", name: ref.name });
+      const evidence = [manifestEv];
+      if (lockEv && lockVersions.has(ref.name)) evidence.push(lockEv);
+      observations.push({
+        id: `dep-${workspace.id}-${ref.name}`,
+        workspaceId: workspace.id,
+        purl,
+        ecosystem: "dotnet",
+        name: ref.name,
+        sourceType: "registry",
+        direct: true,
+        scope: "runtime",
+        ...ref.version ? { requested: ref.version } : {},
+        ...locked ? { locked } : {},
+        status: "current",
+        evidence
+      });
+    }
+    return observations;
+  }
+};
+var dotNetAdapter = new DotNetAdapter();
+
+// src/adapters/php.ts
+import { readFileSync as readFileSync6 } from "node:fs";
+import { join as join4 } from "node:path";
+function manifestEvidence6(path) {
+  return { kind: "manifest", source: path, retrievedAt: (/* @__PURE__ */ new Date()).toISOString() };
+}
+function lockfileEvidence6(path) {
+  return { kind: "lockfile", source: path, retrievedAt: (/* @__PURE__ */ new Date()).toISOString() };
+}
+function parseComposerLock(content) {
+  const versions = /* @__PURE__ */ new Map();
+  try {
+    const lock = JSON.parse(content);
+    for (const pkg of [...lock.packages ?? [], ...lock["packages-dev"] ?? []]) {
+      versions.set(pkg.name, pkg.version);
+    }
+  } catch {
+  }
+  return versions;
+}
+function statusForComposerSpec(spec) {
+  if (spec.startsWith("file:") || spec.startsWith("path:")) return "local_path";
+  if (spec.startsWith("git@") || spec.startsWith("git:") || spec.startsWith("http")) return "git_dependency";
+  return "current";
+}
+function sourceTypeForComposerSpec(spec) {
+  if (spec.startsWith("file:") || spec.startsWith("path:")) return "path";
+  if (spec.startsWith("git@") || spec.startsWith("git:") || spec.startsWith("http")) return "git";
+  return "registry";
+}
+var PhpAdapter = class {
+  ecosystem = "php";
+  async inventory(workspace, options) {
+    const observations = [];
+    const root = workspaceRoot(workspace, options);
+    const seen = /* @__PURE__ */ new Set();
+    const composerJsonPath = workspace.manifests.find((m) => m.includes("composer.json")) || (this.fileExists(join4(root, "composer.json")) ? join4(root, "composer.json") : void 0);
+    if (!composerJsonPath) return [];
+    let content;
+    try {
+      content = readFileSync6(composerJsonPath, "utf-8");
+    } catch {
+      return [];
+    }
+    const manifestEv = manifestEvidence6(composerJsonPath);
+    let composerJson;
+    try {
+      composerJson = JSON.parse(content);
+    } catch {
+      return [];
+    }
+    const lockPath = join4(root, "composer.lock");
+    let lockVersions = /* @__PURE__ */ new Map();
+    let lockEv;
+    try {
+      const lockContent = readFileSync6(lockPath, "utf-8");
+      lockVersions = parseComposerLock(lockContent);
+      lockEv = lockfileEvidence6(lockPath);
+    } catch {
+    }
+    const sections = [
+      { deps: composerJson.require, scope: "runtime" },
+      { deps: composerJson["require-dev"], scope: "development" }
+    ];
+    for (const { deps, scope } of sections) {
+      if (!deps) continue;
+      for (const [name, constraint] of Object.entries(deps)) {
+        if (seen.has(name)) continue;
+        seen.add(name);
+        const locked = lockVersions.get(name);
+        const status = statusForComposerSpec(constraint);
+        const sourceType = sourceTypeForComposerSpec(constraint);
+        const isRegistry = sourceType === "registry";
+        const purl = isRegistry && locked ? buildPurl({ type: "php", name, version: locked }) : isRegistry ? buildPurl({ type: "php", name }) : void 0;
+        const evidence = [manifestEv];
+        if (lockEv && locked) evidence.push(lockEv);
+        observations.push({
+          id: `dep-${workspace.id}-${name}`,
+          workspaceId: workspace.id,
+          ...purl ? { purl } : {},
+          ecosystem: "php",
+          name,
+          sourceType,
+          direct: true,
+          scope,
+          requested: constraint,
+          ...locked ? { locked } : {},
+          status,
+          evidence
+        });
+      }
+    }
+    return observations;
+  }
+  fileExists(filePath) {
+    try {
+      readFileSync6(filePath, "utf-8");
+      return true;
+    } catch {
+      return false;
+    }
+  }
+};
+var phpAdapter = new PhpAdapter();
+
+// src/adapters/dart.ts
+import { readFileSync as readFileSync7 } from "node:fs";
+import { join as join5 } from "node:path";
+function manifestEvidence7(path) {
+  return { kind: "manifest", source: path, retrievedAt: (/* @__PURE__ */ new Date()).toISOString() };
+}
+function lockfileEvidence7(path) {
+  return { kind: "lockfile", source: path, retrievedAt: (/* @__PURE__ */ new Date()).toISOString() };
+}
+function parsePubspecYaml(content) {
+  const sections = /* @__PURE__ */ new Map();
+  let currentSection;
+  let currentName;
+  for (const raw of content.split("\n")) {
+    const line = raw.trimEnd();
+    const trimmed = line.trim();
+    if (trimmed === "" || trimmed.startsWith("#")) continue;
+    const sectionMatch = trimmed.match(/^(\w[\w-]*):\s*$/);
+    if (sectionMatch && line.startsWith(sectionMatch[1])) {
+      currentSection = sectionMatch[1];
+      currentName = void 0;
+      if (!sections.has(currentSection)) {
+        sections.set(currentSection, /* @__PURE__ */ new Map());
+      }
+      continue;
+    }
+    if (!currentSection) continue;
+    const depMatch = trimmed.match(/^(\S[^:]*?):\s*(.*)$/);
+    if (depMatch && line.startsWith("  ") && !line.startsWith("    ")) {
+      currentName = depMatch[1].trim();
+      let constraint = depMatch[2].trim();
+      if (!constraint || constraint.startsWith("{")) {
+        constraint = "*";
+      }
+      const sec = sections.get(currentSection);
+      sec.set(currentName, constraint);
+    }
+  }
+  return sections;
+}
+function parsePubspecLock(content) {
+  const versions = /* @__PURE__ */ new Map();
+  const lines = content.split("\n");
+  let currentPackage;
+  let inPackages = false;
+  for (const raw of lines) {
+    const trimmed = raw.trim();
+    if (trimmed === "") continue;
+    if (trimmed === "packages:") {
+      inPackages = true;
+      continue;
+    }
+    if (!inPackages) continue;
+    const pkgMatch = trimmed.match(/^(\S[^:]*):\s*$/);
+    if (pkgMatch && raw.startsWith("  ") && !raw.startsWith("    ")) {
+      currentPackage = pkgMatch[1].trim();
+      continue;
+    }
+    if (currentPackage) {
+      const verMatch = trimmed.match(/^version:\s*"?([^"\s]+)"?\s*$/);
+      if (verMatch && raw.startsWith("    ")) {
+        versions.set(currentPackage, verMatch[1]);
+        currentPackage = void 0;
+      }
+    }
+  }
+  return versions;
+}
+var DartAdapter = class {
+  ecosystem = "dart";
+  async inventory(workspace, options) {
+    const observations = [];
+    const root = workspaceRoot(workspace, options);
+    const seen = /* @__PURE__ */ new Set();
+    const pubspecPath = workspace.manifests.find((m) => m.includes("pubspec.yaml")) || (this.fileExists(join5(root, "pubspec.yaml")) ? join5(root, "pubspec.yaml") : void 0);
+    if (!pubspecPath) return [];
+    let content;
+    try {
+      content = readFileSync7(pubspecPath, "utf-8");
+    } catch {
+      return [];
+    }
+    const manifestEv = manifestEvidence7(pubspecPath);
+    const sections = parsePubspecYaml(content);
+    const lockPath = join5(root, "pubspec.lock");
+    let lockVersions = /* @__PURE__ */ new Map();
+    let lockEv;
+    try {
+      const lockContent = readFileSync7(lockPath, "utf-8");
+      lockVersions = parsePubspecLock(lockContent);
+      lockEv = lockfileEvidence7(lockPath);
+    } catch {
+    }
+    const sectionMapping = [
+      { yamlSection: "dependencies", scope: "runtime" },
+      { yamlSection: "dev_dependencies", scope: "development" },
+      { yamlSection: "dependency_overrides", scope: "runtime" }
+    ];
+    for (const { yamlSection, scope } of sectionMapping) {
+      const deps = sections.get(yamlSection);
+      if (!deps) continue;
+      for (const [name, constraint] of deps) {
+        if (seen.has(name)) continue;
+        seen.add(name);
+        if (constraint === "*" || constraint.startsWith("{")) continue;
+        const locked = lockVersions.get(name);
+        let status = "current";
+        let sourceType = "registry";
+        if (constraint.startsWith("path:")) {
+          status = "local_path";
+          sourceType = "path";
+        } else if (constraint.startsWith("git:")) {
+          status = "git_dependency";
+          sourceType = "git";
+        } else if (constraint.startsWith("{")) {
+          status = "local_path";
+          sourceType = "path";
+        }
+        const isRegistry = sourceType === "registry";
+        const purl = isRegistry && (locked || constraint) ? buildPurl({ type: "dart", name, version: locked || constraint.replace(/^[\^~>=<\s]+/, "") }) : isRegistry ? buildPurl({ type: "dart", name }) : void 0;
+        const evidence = [manifestEv];
+        if (lockEv && locked) evidence.push(lockEv);
+        observations.push({
+          id: `dep-${workspace.id}-${name}`,
+          workspaceId: workspace.id,
+          ...purl ? { purl } : {},
+          ecosystem: "dart",
+          name,
+          sourceType,
+          direct: true,
+          scope,
+          ...constraint && constraint !== "*" ? { requested: constraint } : {},
+          ...locked ? { locked } : {},
+          status,
+          evidence
+        });
+      }
+    }
+    return observations;
+  }
+  fileExists(filePath) {
+    try {
+      readFileSync7(filePath, "utf-8");
+      return true;
+    } catch {
+      return false;
+    }
+  }
+};
+var dartAdapter = new DartAdapter();
+
+// src/adapters/maven.ts
+import { readFileSync as readFileSync8 } from "node:fs";
+function manifestEvidence8(path) {
+  return { kind: "manifest", source: path, retrievedAt: (/* @__PURE__ */ new Date()).toISOString() };
+}
+function parsePomDependencies(xml) {
+  const deps = [];
+  const depRegex = /<dependency>\s*([\s\S]*?)<\/dependency>/g;
+  let match;
+  while ((match = depRegex.exec(xml)) !== null) {
+    const block = match[1];
+    const groupId = block.match(/<groupId>([^<]+)<\/groupId>/)?.[1]?.trim();
+    const artifactId = block.match(/<artifactId>([^<]+)<\/artifactId>/)?.[1]?.trim();
+    const version = block.match(/<version>([^<]+)<\/version>/)?.[1]?.trim();
+    const scope = block.match(/<scope>([^<]+)<\/scope>/)?.[1]?.trim();
+    if (groupId && artifactId) {
+      deps.push({ groupId, artifactId, version, scope });
+    }
+  }
+  return deps;
+}
+function mavenScopeToScope(scope) {
+  switch (scope) {
+    case "test":
+      return "development";
+    case "provided":
+      return "optional";
+    case "runtime":
+      return "runtime";
+    case "compile":
+      return "runtime";
+    default:
+      return "runtime";
+  }
+}
+var MavenAdapter = class {
+  ecosystem = "maven";
+  async inventory(workspace, _options) {
+    const observations = [];
+    const pomPath = workspace.manifests.find((m) => m.includes("pom.xml"));
+    if (!pomPath) return [];
+    let content;
+    try {
+      content = readFileSync8(pomPath, "utf-8");
+    } catch {
+      return [];
+    }
+    const manifestEv = manifestEvidence8(pomPath);
+    const deps = parsePomDependencies(content);
+    const seen = /* @__PURE__ */ new Set();
+    for (const dep of deps) {
+      const name = `${dep.groupId}:${dep.artifactId}`;
+      if (seen.has(name)) continue;
+      seen.add(name);
+      const purl = dep.version ? buildPurl({ type: "maven", name, version: dep.version }) : buildPurl({ type: "maven", name });
+      observations.push({
+        id: `dep-${workspace.id}-${name}`,
+        workspaceId: workspace.id,
+        purl,
+        ecosystem: "maven",
+        name,
+        sourceType: "registry",
+        direct: true,
+        scope: mavenScopeToScope(dep.scope),
+        ...dep.version ? { requested: dep.version } : {},
+        status: "current",
+        evidence: [manifestEv]
+      });
+    }
+    return observations;
+  }
+};
+var mavenAdapter = new MavenAdapter();
+
+// src/adapters/ruby.ts
+import { readFileSync as readFileSync9 } from "node:fs";
+function manifestEvidence9(path) {
+  return { kind: "manifest", source: path, retrievedAt: (/* @__PURE__ */ new Date()).toISOString() };
+}
+function lockfileEvidence8(path) {
+  return { kind: "lockfile", source: path, retrievedAt: (/* @__PURE__ */ new Date()).toISOString() };
+}
+function parseGemfile(content) {
+  const gems = [];
+  const gemRegex = /gem\s+['"]([^'"]+)['"](?:\s*,\s*['"]([^'"]+)['"])?/g;
+  let match;
+  while ((match = gemRegex.exec(content)) !== null) {
+    const name = match[1];
+    if (name === "rails" || name === "ruby") continue;
+    gems.push({ name, version: match[2] });
+  }
+  return gems;
+}
+function parseGemfileLock(content) {
+  const versions = /* @__PURE__ */ new Map();
+  const lines = content.split("\n");
+  let inSpecs = false;
+  for (const line of lines) {
+    if (line.startsWith("GEM")) {
+      inSpecs = true;
+      continue;
+    }
+    if (inSpecs && /^[A-Z]/.test(line) && !line.startsWith(" ")) {
+      inSpecs = false;
+      continue;
+    }
+    if (!inSpecs) continue;
+    const match = /^\s{4,}([\w-]+)\s+\(([^)]+)\)/.exec(line);
+    if (match) {
+      const version = match[2].split(" ")[0] ?? match[2];
+      versions.set(match[1], version);
+    }
+  }
+  return versions;
+}
+var RubyAdapter = class {
+  ecosystem = "ruby";
+  async inventory(workspace, _options) {
+    const observations = [];
+    const gemfilePath = workspace.manifests.find((m) => m.includes("Gemfile"));
+    if (!gemfilePath) return [];
+    let content;
+    try {
+      content = readFileSync9(gemfilePath, "utf-8");
+    } catch {
+      return [];
+    }
+    const manifestEv = manifestEvidence9(gemfilePath);
+    const gems = parseGemfile(content);
+    const seen = /* @__PURE__ */ new Set();
+    const lockfilePath = workspace.lockfiles.find((l) => l.includes("Gemfile.lock"));
+    let lockVersions = /* @__PURE__ */ new Map();
+    let lockEv;
+    if (lockfilePath) {
+      try {
+        const lockContent = readFileSync9(lockfilePath, "utf-8");
+        lockVersions = parseGemfileLock(lockContent);
+        lockEv = lockfileEvidence8(lockfilePath);
+      } catch {
+      }
+    }
+    for (const gem of gems) {
+      if (seen.has(gem.name)) continue;
+      seen.add(gem.name);
+      const locked = lockVersions.get(gem.name);
+      const version = locked ?? gem.version;
+      const purl = version ? buildPurl({ type: "gem", name: gem.name, version }) : buildPurl({ type: "gem", name: gem.name });
+      const evidence = [manifestEv];
+      if (lockEv && locked) evidence.push(lockEv);
+      observations.push({
+        id: `dep-${workspace.id}-${gem.name}`,
+        workspaceId: workspace.id,
+        purl,
+        ecosystem: "ruby",
+        name: gem.name,
+        sourceType: "registry",
+        direct: true,
+        scope: "runtime",
+        ...gem.version ? { requested: gem.version } : {},
+        ...locked ? { locked } : {},
+        status: "current",
+        evidence
+      });
+    }
+    return observations;
+  }
+};
+var rubyAdapter = new RubyAdapter();
+
+// src/adapters/elixir.ts
+import { readFileSync as readFileSync10 } from "node:fs";
+function manifestEvidence10(path) {
+  return { kind: "manifest", source: path, retrievedAt: (/* @__PURE__ */ new Date()).toISOString() };
+}
+function lockfileEvidence9(path) {
+  return { kind: "lockfile", source: path, retrievedAt: (/* @__PURE__ */ new Date()).toISOString() };
+}
+function parseMixExsDeps(content) {
+  const deps = [];
+  const depRegex = /\{:(\w+),\s*["']([^"']+)["']\}/g;
+  let match;
+  while ((match = depRegex.exec(content)) !== null) {
+    deps.push({ name: match[1], version: match[2] });
+  }
+  return deps;
+}
+function parseMixLock(content) {
+  const versions = /* @__PURE__ */ new Map();
+  const lockRegex = /\{:"(\w+)",\s*hex: "[^"]*",\s*"([^"]+)"/g;
+  let match;
+  while ((match = lockRegex.exec(content)) !== null) {
+    versions.set(match[1], match[2]);
+  }
+  return versions;
+}
+var ElixirAdapter = class {
+  ecosystem = "elixir";
+  async inventory(workspace, _options) {
+    const observations = [];
+    const mixExsPath = workspace.manifests.find((m) => m.includes("mix.exs"));
+    if (!mixExsPath) return [];
+    let content;
+    try {
+      content = readFileSync10(mixExsPath, "utf-8");
+    } catch {
+      return [];
+    }
+    const manifestEv = manifestEvidence10(mixExsPath);
+    const deps = parseMixExsDeps(content);
+    const seen = /* @__PURE__ */ new Set();
+    const lockfilePath = workspace.lockfiles.find((l) => l.includes("mix.lock"));
+    let lockVersions = /* @__PURE__ */ new Map();
+    let lockEv;
+    if (lockfilePath) {
+      try {
+        const lockContent = readFileSync10(lockfilePath, "utf-8");
+        lockVersions = parseMixLock(lockContent);
+        lockEv = lockfileEvidence9(lockfilePath);
+      } catch {
+      }
+    }
+    for (const dep of deps) {
+      if (seen.has(dep.name)) continue;
+      seen.add(dep.name);
+      const locked = lockVersions.get(dep.name);
+      const version = locked ?? dep.version;
+      const purl = version ? buildPurl({ type: "hex", name: dep.name, version }) : buildPurl({ type: "hex", name: dep.name });
+      const evidence = [manifestEv];
+      if (lockEv && locked) evidence.push(lockEv);
+      observations.push({
+        id: `dep-${workspace.id}-${dep.name}`,
+        workspaceId: workspace.id,
+        purl,
+        ecosystem: "elixir",
+        name: dep.name,
+        sourceType: "registry",
+        direct: true,
+        scope: "runtime",
+        ...dep.version ? { requested: dep.version } : {},
+        ...locked ? { locked } : {},
+        status: "current",
+        evidence
+      });
+    }
+    return observations;
+  }
+};
+var elixirAdapter = new ElixirAdapter();
+
+// src/adapters/cpp.ts
+import { readFileSync as readFileSync11 } from "node:fs";
+function manifestEvidence11(path) {
+  return { kind: "manifest", source: path, retrievedAt: (/* @__PURE__ */ new Date()).toISOString() };
+}
+function parseConanTxt(content) {
+  const deps = [];
+  const requiresMatch = /\[requires\]\s*\n([\s\S]*?)(?:\[|$)/;
+  const block = requiresMatch.exec(content)?.[1];
+  if (!block) return deps;
+  for (const line of block.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const parts = trimmed.split("/");
+    if (parts.length >= 2) {
+      deps.push({ name: parts[0], version: parts[1] });
+    } else {
+      deps.push({ name: trimmed });
+    }
+  }
+  return deps;
+}
+function parseVcpkgJson(content) {
+  const deps = [];
+  try {
+    const json = JSON.parse(content);
+    for (const dep of json.dependencies ?? []) {
+      if (typeof dep === "string") {
+        deps.push({ name: dep });
+      } else {
+        deps.push({ name: dep.name, version: dep.version });
+      }
+    }
+  } catch {
+  }
+  return deps;
+}
+var CppAdapter = class {
+  ecosystem = "cpp";
+  async inventory(workspace, _options) {
+    const observations = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const manifestPath of workspace.manifests) {
+      let content;
+      try {
+        content = readFileSync11(manifestPath, "utf-8");
+      } catch {
+        continue;
+      }
+      const manifestEv = manifestEvidence11(manifestPath);
+      let deps = [];
+      if (manifestPath.includes("conanfile")) {
+        deps = parseConanTxt(content);
+      } else if (manifestPath.includes("vcpkg.json")) {
+        deps = parseVcpkgJson(content);
+      } else {
+        continue;
+      }
+      for (const dep of deps) {
+        if (seen.has(dep.name)) continue;
+        seen.add(dep.name);
+        const purl = dep.version ? buildPurl({ type: "conan", name: dep.name, version: dep.version }) : buildPurl({ type: "conan", name: dep.name });
+        observations.push({
+          id: `dep-${workspace.id}-${dep.name}`,
+          workspaceId: workspace.id,
+          purl,
+          ecosystem: "cpp",
+          name: dep.name,
+          sourceType: "registry",
+          direct: true,
+          scope: "runtime",
+          ...dep.version ? { requested: dep.version } : {},
+          // Tier C — we cannot verify current/version status
+          status: "unknown",
+          evidence: [manifestEv]
+        });
+      }
+    }
+    return observations;
+  }
+};
+var cppAdapter = new CppAdapter();
+
+// src/snapshot-diff.ts
+function diffSnapshots(oldSnapshot, newSnapshot) {
+  const oldByKey = /* @__PURE__ */ new Map();
+  for (const dep of oldSnapshot.dependencies) {
+    oldByKey.set(`${dep.ecosystem}:${dep.name}`, dep);
+  }
+  const newByKey = /* @__PURE__ */ new Map();
+  for (const dep of newSnapshot.dependencies) {
+    newByKey.set(`${dep.ecosystem}:${dep.name}`, dep);
+  }
+  const added = [];
+  const removed = [];
+  const changed = [];
+  for (const [key, newDep] of newByKey) {
+    const oldDep = oldByKey.get(key);
+    if (!oldDep) {
+      added.push(newDep);
+      continue;
+    }
+    const fields = ["locked", "requested", "status", "latestStable"];
+    for (const field of fields) {
+      const oldVal = String(oldDep[field] ?? "");
+      const newVal = String(newDep[field] ?? "");
+      if (oldVal !== newVal) {
+        changed.push({
+          name: newDep.name,
+          ecosystem: newDep.ecosystem,
+          field: String(field),
+          from: oldVal,
+          to: newVal
+        });
+      }
+    }
+  }
+  for (const [key, oldDep] of oldByKey) {
+    if (!newByKey.has(key)) {
+      removed.push(oldDep);
+    }
+  }
+  return { added, removed, changed };
+}
+
+// src/sbom.ts
+function toSpdx(snapshot) {
+  const created = snapshot.createdAt;
+  return {
+    spdxVersion: "SPDX-2.3",
+    dataLicense: "CC0-1.0",
+    SPDXID: "SPDXRef-DOCUMENT",
+    name: `TechStack-SBOM-${snapshot.projectId}`,
+    documentNamespace: `https://wrongstack.dev/spdx/${snapshot.id}`,
+    creationInfo: {
+      created,
+      creators: ["Tool: WrongStack TechStack Engine"]
+    },
+    packages: snapshot.dependencies.map((dep, index) => ({
+      name: dep.name,
+      SPDXID: `SPDXRef-Package-${index}`,
+      versionInfo: dep.locked ?? dep.requested,
+      downloadLocation: dep.purl ? `https://purl.io/${dep.purl}` : "NOASSERTION",
+      licenseConcluded: dep.license ?? "NOASSERTION"
+    }))
+  };
+}
+function toCycloneDX(snapshot) {
+  return {
+    bomFormat: "CycloneDX",
+    specVersion: "1.5",
+    version: 1,
+    metadata: {
+      timestamp: snapshot.createdAt,
+      tools: [{ name: "WrongStack TechStack Engine", version: snapshot.adapterVersion }]
+    },
+    components: snapshot.dependencies.map((dep) => ({
+      type: "library",
+      name: dep.name,
+      version: dep.locked ?? dep.requested,
+      ...dep.purl ? { purl: dep.purl } : {},
+      ...dep.license ? { licenses: [{ license: { id: dep.license } }] } : {}
+    }))
+  };
+}
+
+// src/remediation.ts
+function suggestCommand(ecosystem, name, action, targetVersion) {
+  const ver = targetVersion ? `@${targetVersion}` : "@latest";
+  switch (ecosystem) {
+    case "npm":
+      if (action === "remove") return `npm uninstall ${name}`;
+      return `npm install ${name}${ver}`;
+    case "python":
+      if (action === "remove") return `pip uninstall ${name}`;
+      return `pip install ${name}${ver}`;
+    case "rust":
+      if (action === "remove") return `cargo remove ${name}`;
+      return `cargo add ${name}@${targetVersion ?? "latest"}`;
+    case "go":
+      if (action === "remove") return `go get ${name}@none`;
+      return `go get ${name}@${targetVersion ?? "latest"}`;
+    case "php":
+      if (action === "remove") return `composer remove ${name}`;
+      return `composer require ${name}:${targetVersion ?? "latest"}`;
+    case "dotnet":
+      if (action === "remove") return `dotnet remove package ${name}`;
+      return `dotnet add package ${name}`;
+    default:
+      return void 0;
+  }
+}
+function generateUpgradePlan(snapshot) {
+  const findings = snapshot.findings;
+  const items = [];
+  for (const finding of findings) {
+    if (finding.action === "none") continue;
+    const dep = snapshot.dependencies.find(
+      (d) => d.id === finding.dependencyId
+    );
+    if (!dep) continue;
+    const targetVersion = dep.latestStable ?? dep.resolvable ?? dep.wanted;
+    items.push({
+      dependencyName: dep.name,
+      ecosystem: dep.ecosystem,
+      workspaceId: dep.workspaceId,
+      currentVersion: dep.locked ?? dep.installed ?? dep.requested,
+      targetVersion,
+      action: finding.action,
+      severity: finding.severity,
+      rationale: finding.rationale,
+      breakingRisk: finding.breakingRisk,
+      suggestedCommand: suggestCommand(dep.ecosystem, dep.name, finding.action, targetVersion)
+    });
+  }
+  const severityOrder = /* @__PURE__ */ new Map([
+    ["critical", 0],
+    ["high", 1],
+    ["medium", 2],
+    ["low", 3],
+    ["info", 4]
+  ]);
+  items.sort((a, b) => {
+    const sa = severityOrder.get(a.severity) ?? 5;
+    const sb = severityOrder.get(b.severity) ?? 5;
+    return sa - sb;
+  });
+  const summary = {
+    total: items.length,
+    patch: items.filter((i) => i.action === "upgrade_patch").length,
+    minor: items.filter((i) => i.action === "upgrade_minor").length,
+    major: items.filter((i) => i.action === "upgrade_major").length,
+    replace: items.filter((i) => i.action === "replace").length,
+    remove: items.filter((i) => i.action === "remove").length,
+    investigate: items.filter((i) => i.action === "investigate").length
+  };
+  return {
+    snapshotId: snapshot.id,
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    items,
+    summary,
+    warning: "This plan is read-only. No dependency files will be modified unless you explicitly approve and execute each item."
+  };
+}
+function renderPlanMarkdown(plan) {
+  const lines = [
+    "# TechStack Remediation Plan",
+    "",
+    `**Generated:** ${plan.generatedAt}`,
+    `**Snapshot:** ${plan.snapshotId}`,
+    `**Total items:** ${plan.summary.total}`,
+    "",
+    `> \u26A0\uFE0F ${plan.warning}`,
+    ""
+  ];
+  if (plan.items.length === 0) {
+    lines.push("_No remediation actions needed \u2014 all dependencies are current._");
+    return lines.join("\n");
+  }
+  lines.push("## Summary", "");
+  lines.push("| Action | Count |");
+  lines.push("|---|---|");
+  lines.push(`| Patch upgrade | ${plan.summary.patch} |`);
+  lines.push(`| Minor upgrade | ${plan.summary.minor} |`);
+  lines.push(`| Major upgrade | ${plan.summary.major} |`);
+  lines.push(`| Replace | ${plan.summary.replace} |`);
+  lines.push(`| Remove | ${plan.summary.remove} |`);
+  lines.push(`| Investigate | ${plan.summary.investigate} |`);
+  lines.push("");
+  lines.push("## Items", "");
+  for (const item of plan.items) {
+    const icon = item.severity === "critical" ? "\u{1F534}" : item.severity === "high" ? "\u{1F7E0}" : item.severity === "medium" ? "\u{1F7E1}" : item.severity === "low" ? "\u{1F535}" : "\u2139\uFE0F";
+    lines.push(`### ${icon} ${item.dependencyName} (${item.ecosystem})`, "");
+    lines.push(`- **Action:** ${item.action}`);
+    lines.push(`- **Current:** ${item.currentVersion ?? "unknown"}`);
+    lines.push(`- **Target:** ${item.targetVersion ?? "latest"}`);
+    lines.push(`- **Severity:** ${item.severity}`);
+    lines.push(`- **Rationale:** ${item.rationale}`);
+    if (item.breakingRisk) lines.push(`- **Breaking risk:** ${item.breakingRisk}`);
+    if (item.suggestedCommand) {
+      lines.push(`- **Suggested command:** \`${item.suggestedCommand}\``);
+    }
+    lines.push("");
+  }
+  return lines.join("\n");
+}
+
+// src/registry/client.ts
+import { get as httpsGet } from "node:https";
+import { get as httpGet } from "node:http";
+var DEFAULT_TTL_MS = 10 * 60 * 1e3;
+var MAX_CONCURRENCY_PER_HOST = 3;
+var MAX_RETRIES = 3;
+var BASE_BACKOFF_MS = 1e3;
+var registryCache = /* @__PURE__ */ new Map();
+var hostConcurrency = /* @__PURE__ */ new Map();
+function getCacheKey(host, path) {
+  return `${host}${path}`;
+}
+function getCached(key) {
+  const entry = registryCache.get(key);
+  if (!entry) return void 0;
+  if (Date.now() > entry.expiresAt) {
+    registryCache.delete(key);
+    return void 0;
+  }
+  return entry.data;
+}
+function setCache(key, data, etag, ttlMs = DEFAULT_TTL_MS) {
+  registryCache.set(key, {
+    data,
+    etag,
+    expiresAt: Date.now() + ttlMs
+  });
+}
+function acquireHostSlot(host) {
+  let concurrency = hostConcurrency.get(host);
+  if (!concurrency) {
+    concurrency = { active: 0, queue: [] };
+    hostConcurrency.set(host, concurrency);
+  }
+  if (concurrency.active < MAX_CONCURRENCY_PER_HOST) {
+    concurrency.active++;
+    return Promise.resolve();
+  }
+  return new Promise((resolve3) => {
+    concurrency.queue.push(resolve3);
+  });
+}
+function releaseHostSlot(host) {
+  const concurrency = hostConcurrency.get(host);
+  if (!concurrency) return;
+  concurrency.active--;
+  if (concurrency.queue.length > 0) {
+    const next = concurrency.queue.shift();
+    if (next) {
+      concurrency.active++;
+      next();
+    }
+  }
+}
+function sleep(ms) {
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
+}
+function computeBackoff(attempt, statusCode) {
+  const base = statusCode === 429 ? BASE_BACKOFF_MS * 2 : BASE_BACKOFF_MS;
+  return base * Math.pow(2, attempt) + Math.random() * 500;
+}
+function httpsFetch(hostname, path, etag, signal) {
+  return new Promise((resolve3, reject) => {
+    const options = {
+      hostname,
+      path,
+      method: "GET",
+      headers: {
+        Accept: "application/json",
+        "User-Agent": "WrongStack-TechStack/1.0",
+        ...etag ? { "If-None-Match": etag } : {}
+      },
+      signal,
+      timeout: 15e3
+    };
+    const mod = hostname === "localhost" || hostname === "127.0.0.1" ? httpGet : httpsGet;
+    const req = mod(options, (res) => {
+      const statusCode = res.statusCode ?? 0;
+      const responseHeaders = res.headers;
+      let body = "";
+      res.on("data", (chunk) => {
+        body += chunk;
+      });
+      res.on("end", () => {
+        resolve3({
+          statusCode,
+          headers: responseHeaders,
+          body,
+          isFromCache: false
+        });
+      });
+    });
+    req.on("error", (err) => {
+      reject(err);
+    });
+    req.on("timeout", () => {
+      req.destroy();
+      reject(new Error(`Request timeout for ${hostname}${path}`));
+    });
+    req.end();
+  });
+}
+function parseNpmPackument(json, name) {
+  const latestVersion = json["dist-tags"]?.["latest"];
+  let deprecated;
+  if (latestVersion && json.versions && typeof json.versions === "object") {
+    const versions = json.versions;
+    deprecated = versions[latestVersion]?.deprecated ? true : void 0;
+  }
+  return {
+    latestStable: latestVersion,
+    license: json.license ?? void 0,
+    deprecated: deprecated ?? void 0,
+    yanked: void 0,
+    retrievedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    source: `https://registry.npmjs.org/${name}`
+  };
+}
+var ECOSYSTEM_FETCHERS = {
+  npm: {
+    host: "registry.npmjs.org",
+    path: (name) => {
+      const encoded = name.startsWith("@") ? name.replace("/", "%2F") : name;
+      return `/${encoded}`;
+    },
+    parser: parseNpmPackument
+  },
+  python: {
+    host: "pypi.org",
+    path: (name) => `/pypi/${name}/json`,
+    parser: (json) => {
+      const info = json.info;
+      return {
+        latestStable: info?.version ?? void 0,
+        license: info?.license ?? void 0,
+        deprecated: info?.deprecated ?? void 0,
+        yanked: void 0,
+        retrievedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        source: `https://pypi.org/pypi/${info?.name ?? ""}/json`
+      };
+    }
+  },
+  cargo: {
+    host: "crates.io",
+    path: (name) => `/api/v1/crates/${name}`,
+    parser: (json) => {
+      const crate = json.crate;
+      return {
+        latestStable: crate?.max_stable_version ?? crate?.max_version ?? void 0,
+        license: crate?.license ?? void 0,
+        deprecated: void 0,
+        // crates.io doesn't have deprecation
+        yanked: void 0,
+        retrievedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        source: `https://crates.io/api/v1/crates/${crate?.name ?? ""}`
+      };
+    }
+  },
+  golang: {
+    host: "proxy.golang.org",
+    path: (module) => `/${module}/@latest`,
+    parser: (json, module) => {
+      return {
+        latestStable: json.Version ?? void 0,
+        license: void 0,
+        // Go proxy doesn't provide license
+        deprecated: void 0,
+        yanked: void 0,
+        retrievedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        source: `https://proxy.golang.org/${module}/@latest`
+      };
+    }
+  },
+  nuget: {
+    host: "api.nuget.org",
+    path: (name) => {
+      const lower = name.toLowerCase();
+      return `/v3/registration5-semver1/${lower}/index.json`;
+    },
+    parser: (json, name) => {
+      const items = json.items;
+      let latestStable;
+      if (items && items.length > 0) {
+        for (const item of items) {
+          const itemItems = item.items;
+          if (itemItems && Array.isArray(itemItems)) {
+            for (const entry of itemItems) {
+              const catalogEntry = entry.catalogEntry;
+              if (catalogEntry?.version) {
+                const ver = catalogEntry.version;
+                if (!latestStable || !ver.includes("-") && latestStable.includes("-")) {
+                  latestStable = ver;
+                } else if (!ver.includes("-") && !latestStable.includes("-")) {
+                  if (ver > latestStable) latestStable = ver;
+                }
+              }
+            }
+          }
+        }
+      }
+      return {
+        latestStable,
+        license: void 0,
+        // License requires per-version catalog entry
+        deprecated: void 0,
+        yanked: void 0,
+        retrievedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        source: `https://api.nuget.org/v3/registration5-semver1/${name.toLowerCase()}/index.json`
+      };
+    }
+  },
+  composer: {
+    host: "repo.packagist.org",
+    path: (name) => `/p2/${name}.json`,
+    parser: (json, name) => {
+      const packages = json.packages;
+      const versions = packages?.[name];
+      if (!versions || versions.length === 0) {
+        return { retrievedAt: (/* @__PURE__ */ new Date()).toISOString(), source: "packagist" };
+      }
+      let latestStable;
+      for (const ver of versions) {
+        const version = ver.version;
+        if (version && !version.includes("dev") && !version.includes("alpha") && !version.includes("beta") && !version.includes("RC") && !version.includes("rc")) {
+          if (!latestStable || version > latestStable) {
+            latestStable = version;
+          }
+        }
+      }
+      const latest = versions[0];
+      return {
+        latestStable,
+        license: latest.license ?? void 0,
+        deprecated: latest.deprecated ?? void 0,
+        yanked: latest.abandoned ?? void 0,
+        retrievedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        source: `https://repo.packagist.org/p2/${name}.json`
+      };
+    }
+  },
+  pub: {
+    host: "pub.dev",
+    path: (name) => `/api/packages/${name}`,
+    parser: (json) => {
+      const latest = json.latest;
+      return {
+        latestStable: json.latestVersion ?? latest?.version ?? json.version ?? void 0,
+        license: latest?.license ?? void 0,
+        deprecated: json.isDiscontinued ?? void 0,
+        yanked: json.isRetracted ?? void 0,
+        retrievedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        source: `https://pub.dev/api/packages/${json.name ?? ""}`
+      };
+    }
+  }
+};
+async function lookupRegistry(ecosystem, name, options = {}) {
+  const fetcher = ECOSYSTEM_FETCHERS[ecosystem];
+  if (!fetcher) {
+    throw new Error(`Unsupported ecosystem for registry lookup: ${ecosystem}`);
+  }
+  const path = fetcher.path(name);
+  const cacheKey = getCacheKey(fetcher.host, path);
+  if (!options.force) {
+    const cached = getCached(cacheKey);
+    if (cached) return cached;
+  }
+  await acquireHostSlot(fetcher.host);
+  try {
+    const existingEntry = registryCache.get(cacheKey);
+    const etag = existingEntry?.etag;
+    let lastError;
+    for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
+      try {
+        const response = await httpsFetch(fetcher.host, path, etag, options.signal);
+        if (response.statusCode === 304 && existingEntry) {
+          setCache(cacheKey, existingEntry.data, existingEntry.etag, DEFAULT_TTL_MS);
+          return existingEntry.data;
+        }
+        if (response.statusCode === 401 || response.statusCode === 403 || response.statusCode === 404) {
+          return void 0;
+        }
+        if (response.statusCode === 429 || response.statusCode >= 500) {
+          if (attempt < MAX_RETRIES - 1) {
+            const backoff = computeBackoff(attempt, response.statusCode);
+            await sleep(backoff);
+            continue;
+          }
+          throw new Error(`Registry ${fetcher.host} returned ${response.statusCode} after ${MAX_RETRIES} attempts`);
+        }
+        let json;
+        try {
+          json = JSON.parse(response.body);
+        } catch {
+          throw new Error(`Invalid JSON response from ${fetcher.host}${path}`);
+        }
+        const parsed = fetcher.parser(json, name, ecosystem);
+        if (!parsed) {
+          return void 0;
+        }
+        const responseEtag = response.headers["etag"];
+        setCache(cacheKey, parsed, responseEtag, DEFAULT_TTL_MS);
+        return parsed;
+      } catch (err) {
+        lastError = err instanceof Error ? err : new Error(String(err));
+        if (attempt < MAX_RETRIES - 1) {
+          const isRateLimit = err instanceof Error && err.message.includes("429");
+          const backoff = computeBackoff(attempt, isRateLimit ? 429 : 500);
+          await sleep(backoff);
+        }
+      }
+    }
+    throw lastError ?? new Error(`Failed to look up ${ecosystem}:${name}`);
+  } finally {
+    releaseHostSlot(fetcher.host);
+  }
+}
+async function lookupRegistryBatch(ecosystem, names, options = {}) {
+  const results = /* @__PURE__ */ new Map();
+  const entries = await Promise.all(
+    names.map(async (name) => {
+      try {
+        const entry = await lookupRegistry(ecosystem, name, options);
+        return { name, entry };
+      } catch {
+        return { name, entry: void 0 };
+      }
+    })
+  );
+  for (const { name, entry } of entries) {
+    results.set(name, entry);
+  }
+  return results;
+}
+function supportedRegistryEcosystems() {
+  return Object.keys(ECOSYSTEM_FETCHERS);
+}
+function clearRegistryCache() {
+  registryCache.clear();
+  hostConcurrency.clear();
+}
+
+// src/advisory/osv.ts
+import { get as httpsGet2 } from "node:https";
+var OSV_API_BASE = "api.osv.dev";
+var OSV_QUERY_BATCH_PATH = "/v1/querybatch";
+var MAX_BATCH_SIZE = 500;
+var MAX_RETRIES2 = 3;
+var BASE_BACKOFF_MS2 = 1e3;
+function mapSeverity(osvSeverity, databaseSeverity) {
+  if (osvSeverity && osvSeverity.length > 0) {
+    for (const s of osvSeverity) {
+      if (s.type === "CVSS_V3" || s.type === "CVSS_V2") {
+        const score = parseFloat(s.score);
+        if (score >= 9) return "critical";
+        if (score >= 7) return "high";
+        if (score >= 4) return "medium";
+        if (score >= 0.1) return "low";
+      }
+    }
+  }
+  if (databaseSeverity) {
+    const ds = databaseSeverity.toLowerCase();
+    if (ds === "critical") return "critical";
+    if (ds === "high") return "high";
+    if (ds === "medium" || ds === "moderate") return "medium";
+    if (ds === "low") return "low";
+  }
+  return "info";
+}
+function osvPostRequest(body, signal) {
+  return new Promise((resolve3, reject) => {
+    const options = {
+      hostname: OSV_API_BASE,
+      path: OSV_QUERY_BATCH_PATH,
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "Content-Length": Buffer.byteLength(body).toString(),
+        "User-Agent": "WrongStack-TechStack/1.0"
+      },
+      signal,
+      timeout: 3e4
+    };
+    const req = httpsGet2(options, (res) => {
+      const statusCode = res.statusCode ?? 0;
+      let responseBody = "";
+      res.on("data", (chunk) => {
+        responseBody += chunk;
+      });
+      res.on("end", () => {
+        resolve3({ statusCode, body: responseBody });
+      });
+    });
+    req.on("error", (err) => {
+      reject(err);
+    });
+    req.on("timeout", () => {
+      req.destroy();
+      reject(new Error("OSV API request timeout"));
+    });
+    req.write(body);
+    req.end();
+  });
+}
+function sleep2(ms) {
+  return new Promise((resolve3) => setTimeout(resolve3, ms));
+}
+async function queryOsvBatch(purls, options = {}) {
+  const advisories = /* @__PURE__ */ new Map();
+  for (const purl of purls) {
+    advisories.set(purl, []);
+  }
+  const batches = [];
+  for (let i = 0; i < purls.length; i += MAX_BATCH_SIZE) {
+    batches.push(purls.slice(i, i + MAX_BATCH_SIZE));
+  }
+  let lastError;
+  for (const batch of batches) {
+    const requestBody = {
+      queries: batch.map((purl) => ({
+        package: { purl }
+      }))
+    };
+    const jsonBody = JSON.stringify(requestBody);
+    let success = false;
+    for (let attempt = 0; attempt < MAX_RETRIES2 && !success; attempt++) {
+      try {
+        const response = await osvPostRequest(jsonBody, options.signal);
+        if (response.statusCode === 200) {
+          const result = JSON.parse(response.body);
+          if (result.results && Array.isArray(result.results)) {
+            for (let i = 0; i < result.results.length; i++) {
+              const purl = batch[i];
+              if (!purl) continue;
+              const vulns = result.results[i]?.vulns;
+              if (!vulns || vulns.length === 0) continue;
+              const parsed = [];
+              for (const vuln of vulns) {
+                const dbSpecific = vuln.database_specific;
+                const affectedDbSpecific = vuln.affected?.[0]?.database_specific;
+                const severitySource = dbSpecific?.severity ?? affectedDbSpecific?.severity;
+                parsed.push({
+                  id: vuln.id,
+                  summary: vuln.summary ?? vuln.details ?? "No summary available",
+                  severity: mapSeverity(vuln.severity, severitySource),
+                  aliases: vuln.aliases ?? []
+                });
+              }
+              advisories.set(purl, parsed);
+            }
+          }
+          success = true;
+        } else if (response.statusCode === 429 || response.statusCode >= 500) {
+          if (attempt < MAX_RETRIES2 - 1) {
+            const backoff = BASE_BACKOFF_MS2 * Math.pow(2, attempt) + Math.random() * 500;
+            await sleep2(backoff);
+          } else {
+            throw new Error(`OSV API returned ${response.statusCode} after ${MAX_RETRIES2} attempts: ${response.body}`);
+          }
+        } else {
+          throw new Error(`OSV API returned ${response.statusCode}: ${response.body}`);
+        }
+      } catch (err) {
+        lastError = err instanceof Error ? err : new Error(String(err));
+        if (attempt < MAX_RETRIES2 - 1) {
+          const backoff = BASE_BACKOFF_MS2 * Math.pow(2, attempt) + Math.random() * 500;
+          await sleep2(backoff);
+        }
+      }
+    }
+    if (!success && lastError) {
+      throw lastError;
+    }
+  }
+  const evidence = {
+    kind: "osv",
+    source: "https://api.osv.dev/v1/querybatch",
+    retrievedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    detail: `Queried ${purls.length} packages in ${batches.length} batch(es)`
+  };
+  return { advisories, evidence };
+}
+async function queryOsvSingle(purl, options = {}) {
+  const result = await queryOsvBatch([purl], options);
+  return result.advisories.get(purl) ?? [];
+}
+
+// src/advisory/native-audit.ts
+import { spawnSync } from "node:child_process";
+import { existsSync as existsSync2 } from "node:fs";
+import { join as join6 } from "node:path";
+function npmSeverity(s) {
+  switch (s.toLowerCase()) {
+    case "critical":
+      return "critical";
+    case "high":
+      return "high";
+    case "moderate":
+    case "medium":
+      return "medium";
+    case "low":
+      return "low";
+    default:
+      return "info";
+  }
+}
+function cargoSeverity(s) {
+  switch (s.toLowerCase()) {
+    case "critical":
+      return "critical";
+    case "high":
+      return "high";
+    case "medium":
+      return "medium";
+    case "low":
+      return "low";
+    default:
+      return "info";
+  }
+}
+function runNpmAudit(workspaceRoot2) {
+  const result = runAuditCommand("npm", ["audit", "--json"], workspaceRoot2);
+  const advisories = [];
+  let detailLines = [];
+  if (result.status === 0 || result.status === 1) {
+    try {
+      const json = JSON.parse(result.stdout || "{}");
+      const vulnerabilities = json.vulnerabilities;
+      if (vulnerabilities) {
+        for (const [pkg, info] of Object.entries(vulnerabilities)) {
+          const via = info.via;
+          if (!via) continue;
+          for (const advisory of via) {
+            if (typeof advisory === "string") continue;
+            const source = advisory.source;
+            const name = advisory.name;
+            if (typeof source === "number") continue;
+            advisories.push({
+              id: advisory.cve ?? advisory.ghsa ?? `npm-${pkg}-${name ?? "unknown"}`,
+              packageName: pkg,
+              severity: npmSeverity(info.severity ?? "info"),
+              summary: advisory.title ?? (name ?? "No summary"),
+              fixVersion: info.fixAvailable ?? void 0,
+              url: advisory.url ?? void 0,
+              aliases: advisory.cve ? [advisory.cve] : []
+            });
+          }
+        }
+      }
+      const metadata = json.metadata;
+      if (metadata) {
+        detailLines = [
+          `Total vulnerabilities: ${metadata.vulnerabilities ?? "unknown"}`,
+          `Total dependencies: ${metadata.totalDependencies ?? "unknown"}`
+        ];
+      }
+    } catch {
+      detailLines = ["Failed to parse npm audit JSON output"];
+    }
+  } else {
+    detailLines = [`npm audit exited with code ${result.status}`];
+  }
+  const evidence = {
+    kind: "audit",
+    source: "npm audit --json",
+    retrievedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    detail: detailLines.join("\n") || `Found ${advisories.length} advisories`
+  };
+  return { advisories, evidence };
+}
+function runPipAudit(workspaceRoot2) {
+  const reqFiles = ["requirements.txt", "requirements-dev.txt"];
+  let reqFlag = "";
+  for (const f of reqFiles) {
+    if (existsSync2(join6(workspaceRoot2, f))) {
+      reqFlag = `--requirement ${f}`;
+      break;
+    }
+  }
+  const args = ["audit", "--format", "json"];
+  if (reqFlag) {
+    args.push(...reqFlag.split(" "));
+  }
+  const result = runAuditCommand("pip-audit" in process.env ? "pip-audit" : "pip-audit", args, workspaceRoot2);
+  return parsePipAuditOutput(result);
+}
+function parsePipAuditOutput(result) {
+  const advisories = [];
+  let detailLines = [];
+  if (result.status === 0) {
+    try {
+      const json = JSON.parse(result.stdout || "[]");
+      for (const entry of json) {
+        advisories.push({
+          id: entry.id ?? entry.vulnerability_id ?? "unknown",
+          packageName: entry.name ?? "",
+          severity: npmSeverity(entry.severity ?? "info"),
+          summary: entry.description ?? entry.vulnerability_id ?? "No summary",
+          fixVersion: entry.fix_version ?? void 0,
+          url: entry.advisory_url ?? void 0,
+          aliases: entry.aliases ?? []
+        });
+      }
+    } catch {
+      detailLines = ["Failed to parse pip-audit JSON output"];
+    }
+  } else {
+    detailLines = [`pip-audit exited with code ${result.status}: ${result.stderr}`];
+  }
+  const evidence = {
+    kind: "audit",
+    source: "pip-audit --format json",
+    retrievedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    detail: detailLines.join("\n") || `Found ${advisories.length} advisories`
+  };
+  return { advisories, evidence };
+}
+function runCargoAudit(workspaceRoot2) {
+  const result = runAuditCommand("cargo", ["audit", "--json"], workspaceRoot2);
+  return parseCargoAuditOutput(result);
+}
+function parseCargoAuditOutput(result) {
+  const advisories = [];
+  let detailLines = [];
+  if (result.status === 0) {
+    try {
+      const json = JSON.parse(result.stdout || "{}");
+      const vulnerabilities = json.vulnerabilities;
+      const advisoriesList = vulnerabilities?.list;
+      if (advisoriesList) {
+        for (const adv of advisoriesList) {
+          const advisory = adv.advisory;
+          const pkg = adv.package;
+          if (!advisory) continue;
+          advisories.push({
+            id: advisory.id ?? "unknown",
+            packageName: pkg?.name ?? "",
+            severity: cargoSeverity((advisory.cvss ?? "").split("/")?.[0] ?? "info"),
+            summary: advisory.title ?? advisory.description ?? "No summary",
+            fixVersion: advisory.patched_versions ?? void 0,
+            url: advisory.url ?? void 0,
+            aliases: advisory.aliases ?? []
+          });
+        }
+      }
+    } catch {
+      detailLines = ["Failed to parse cargo audit JSON output"];
+    }
+  } else {
+    detailLines = [`cargo audit exited with code ${result.status}: ${result.stderr}`];
+  }
+  const evidence = {
+    kind: "audit",
+    source: "cargo audit --json",
+    retrievedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    detail: detailLines.join("\n") || `Found ${advisories.length} advisories`
+  };
+  return { advisories, evidence };
+}
+function runGoVulncheck(workspaceRoot2) {
+  const result = runAuditCommand("govulncheck", ["-json"], workspaceRoot2);
+  const advisories = [];
+  let detailLines = [];
+  if (result.status === 0 || result.status === 3) {
+    try {
+      const json = JSON.parse(result.stdout || "{}");
+      const vulns = json.vulns;
+      if (vulns) {
+        for (const v of vulns) {
+          const osv = v.osv;
+          advisories.push({
+            id: v.id ?? osv ?? "unknown",
+            packageName: v.package ?? v.module_path ?? "",
+            severity: "high",
+            // govulncheck doesn't provide CVSS — default to high
+            summary: v.details ?? v.description ?? osv ?? "No summary",
+            fixVersion: v.fixed_version ?? void 0,
+            url: v.url ?? void 0,
+            aliases: osv ? [osv] : []
+          });
+        }
+      }
+    } catch {
+      detailLines = ["Failed to parse govulncheck JSON output"];
+    }
+  } else if (result.status === 1) {
+    detailLines = ["govulncheck: no vulnerabilities found"];
+  } else {
+    detailLines = [`govulncheck exited with code ${result.status}: ${result.stderr}`];
+  }
+  const evidence = {
+    kind: "audit",
+    source: "govulncheck -json",
+    retrievedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    detail: detailLines.join("\n") || `Found ${advisories.length} advisories`
+  };
+  return { advisories, evidence };
+}
+function runComposerAudit(workspaceRoot2) {
+  const result = runAuditCommand("composer", ["audit", "--format=json"], workspaceRoot2);
+  const advisories = [];
+  let detailLines = [];
+  if (result.status === 0) {
+    try {
+      const json = JSON.parse(result.stdout || "{}");
+      const advisoriesJson = json.advisories;
+      if (advisoriesJson) {
+        for (const [pkg, advs] of Object.entries(advisoriesJson)) {
+          for (const adv of advs) {
+            advisories.push({
+              id: adv.cve ?? adv.reference ?? `composer-${pkg}`,
+              packageName: pkg,
+              severity: npmSeverity(adv.severity ?? "medium"),
+              summary: adv.title ?? adv.description ?? "No summary",
+              fixVersion: adv.link ? adv.link.split("/").pop() : void 0,
+              url: adv.link ?? void 0,
+              aliases: adv.cve ? [adv.cve] : []
+            });
+          }
+        }
+      }
+    } catch {
+      detailLines = ["Failed to parse composer audit JSON output"];
+    }
+  } else {
+    detailLines = [`composer audit exited with code ${result.status}: ${result.stderr}`];
+  }
+  const evidence = {
+    kind: "audit",
+    source: "composer audit --format=json",
+    retrievedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    detail: detailLines.join("\n") || `Found ${advisories.length} advisories`
+  };
+  return { advisories, evidence };
+}
+function runDotnetAudit(workspaceRoot2) {
+  const result = runAuditCommand("dotnet", ["package", "audit", "--format", "json"], workspaceRoot2);
+  const advisories = [];
+  let detailLines = [];
+  if (result.status === 0) {
+    try {
+      const json = JSON.parse(result.stdout || "{}");
+      const vulnerabilities = json.vulnerabilities;
+      const packages = json.packages;
+      if (vulnerabilities) {
+        const vulnList = Array.isArray(vulnerabilities) ? vulnerabilities : [];
+        for (const v of vulnList) {
+          advisories.push({
+            id: v.advisoryId ?? v.id ?? "unknown",
+            packageName: v.packageName ?? "",
+            severity: npmSeverity(v.severity ?? "info"),
+            summary: v.description ?? v.title ?? "No summary",
+            fixVersion: v.fixedVersion ?? v.patchedVersion ?? void 0,
+            url: v.advisoryUrl ?? v.url ?? void 0,
+            aliases: v.aliases ?? []
+          });
+        }
+      } else if (packages) {
+        for (const [pkg, entries] of Object.entries(packages)) {
+          for (const entry of entries) {
+            advisories.push({
+              id: entry.advisoryId ?? entry.id ?? "unknown",
+              packageName: pkg,
+              severity: npmSeverity(entry.severity ?? "info"),
+              summary: entry.description ?? entry.title ?? "No summary",
+              fixVersion: entry.fixedVersion ?? entry.patchedVersion ?? void 0,
+              url: entry.advisoryUrl ?? entry.url ?? void 0,
+              aliases: entry.aliases ?? []
+            });
+          }
+        }
+      }
+    } catch {
+      detailLines = ["Failed to parse dotnet package audit JSON output"];
+    }
+  } else {
+    detailLines = [`dotnet package audit exited with code ${result.status}: ${result.stderr}`];
+  }
+  const evidence = {
+    kind: "audit",
+    source: "dotnet package audit --format json",
+    retrievedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    detail: detailLines.join("\n") || `Found ${advisories.length} advisories`
+  };
+  return { advisories, evidence };
+}
+function runAuditCommand(command, args, cwd) {
+  try {
+    const options = {
+      cwd,
+      encoding: "utf-8",
+      timeout: 6e4,
+      maxBuffer: 10 * 1024 * 1024,
+      // 10MB
+      windowsHide: true
+    };
+    const result = spawnSync(command, args, options);
+    return {
+      status: result.status,
+      stdout: result.stdout?.toString() ?? "",
+      stderr: result.stderr?.toString() ?? ""
+    };
+  } catch (err) {
+    return {
+      status: null,
+      stdout: "",
+      stderr: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+function runNativeAudit(ecosystem, workspaceRoot2) {
+  switch (ecosystem) {
+    case "npm":
+      return runNpmAudit(workspaceRoot2);
+    case "python":
+      return runPipAudit(workspaceRoot2);
+    case "rust":
+      return runCargoAudit(workspaceRoot2);
+    case "go":
+      return runGoVulncheck(workspaceRoot2);
+    case "php":
+      return runComposerAudit(workspaceRoot2);
+    case "dotnet":
+      return runDotnetAudit(workspaceRoot2);
+    // dart/pub doesn't have a standard audit command — use OSV instead
+    default:
+      return {
+        advisories: [],
+        evidence: {
+          kind: "audit",
+          source: `native-audit:${ecosystem}`,
+          retrievedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          detail: `No native audit tool for ecosystem: ${ecosystem}`
+        }
+      };
+  }
+}
+function isNativeAuditAvailable(ecosystem) {
+  const result = runAuditCommand(
+    ecosystem === "npm" ? "npm" : ecosystem === "python" ? "pip-audit" : ecosystem === "rust" ? "cargo" : ecosystem === "go" ? "govulncheck" : ecosystem === "php" ? "composer" : ecosystem === "dotnet" ? "dotnet" : "",
+    ["--version"],
+    process.cwd()
+  );
+  return result.status === 0;
+}
+
+// src/policy/status.ts
+function isValidSemver(version) {
+  return /^\d+\.\d+\.\d+/.test(version);
+}
+function compareVersions(a, b) {
+  const aMatch = a.match(/^([^-]+)(?:-(.+))?$/);
+  const bMatch = b.match(/^([^-]+)(?:-(.+))?$/);
+  const aBase = aMatch?.[1] ?? a;
+  const aPre = aMatch?.[2];
+  const bBase = bMatch?.[1] ?? b;
+  const bPre = bMatch?.[2];
+  const aBaseParts = aBase.split(".").map(Number);
+  const bBaseParts = bBase.split(".").map(Number);
+  for (let i = 0; i < Math.max(aBaseParts.length, bBaseParts.length); i++) {
+    const aNum = aBaseParts[i] ?? 0;
+    const bNum = bBaseParts[i] ?? 0;
+    if (aNum > bNum) return 1;
+    if (aNum < bNum) return -1;
+  }
+  if (aPre === bPre) return 0;
+  if (aPre === void 0) return 1;
+  if (bPre === void 0) return -1;
+  const aPreParts = aPre.split(".");
+  const bPreParts = bPre.split(".");
+  for (let i = 0; i < Math.max(aPreParts.length, bPreParts.length); i++) {
+    const aId = aPreParts[i] ?? "";
+    const bId = bPreParts[i] ?? "";
+    if (aId === bId) continue;
+    const aNum = Number(aId);
+    const bNum = Number(bId);
+    if (!Number.isNaN(aNum) && !Number.isNaN(bNum) && Number.isFinite(aNum) && Number.isFinite(bNum)) {
+      if (aNum > bNum) return 1;
+      if (aNum < bNum) return -1;
+    } else {
+      if (aId > bId) return 1;
+      if (aId < bId) return -1;
+    }
+    return aId > bId ? 1 : -1;
+  }
+  return 0;
+}
+function isSimpleConstraint(constraint) {
+  return constraint.startsWith("^") || constraint.startsWith("~") || constraint.startsWith(">=") || constraint.startsWith(">") || isValidSemver(constraint);
+}
+function isBreakingUpgrade(locked, latestStable, constraint) {
+  const constraintNorm = constraint?.trim() ?? "";
+  const lockedMajor = locked.split(".")[0];
+  const latestMajor = latestStable.split(".")[0];
+  if (!lockedMajor || !latestMajor) return true;
+  if (constraintNorm.startsWith("^")) {
+    return lockedMajor !== latestMajor;
+  }
+  if (constraintNorm.startsWith("~")) {
+    const lockedMinor = locked.split(".")[1];
+    const latestMinor = latestStable.split(".")[1];
+    if (lockedMinor && latestMinor && lockedMajor !== latestMajor) return true;
+    if (lockedMinor && latestMinor && lockedMinor !== latestMinor) return true;
+    return false;
+  }
+  if (constraintNorm.startsWith(">=") || constraintNorm.startsWith(">")) {
+    return lockedMajor !== latestMajor;
+  }
+  if (isValidSemver(constraintNorm)) {
+    return lockedMajor !== latestMajor;
+  }
+  return lockedMajor !== latestMajor;
+}
+function classifyStatus(dep, registryData, advisoryData) {
+  if (dep.sourceType === "path") {
+    return "local_path";
+  }
+  if (dep.sourceType === "git") {
+    return "git_dependency";
+  }
+  if (registryData?.privateOrUnresolved) {
+    return "private_or_unresolved";
+  }
+  if (registryData?.lookupFailed) {
+    return "unknown";
+  }
+  if (registryData?.deprecated) {
+    return "deprecated";
+  }
+  if (registryData?.yanked) {
+    return "yanked";
+  }
+  if (advisoryData?.hasAdvisory) {
+    return "vulnerable";
+  }
+  const locked = dep.locked;
+  const latestStable = registryData?.latestStable;
+  if (locked && latestStable) {
+    if (locked === latestStable) {
+      return "current";
+    }
+    try {
+      const cmp = compareVersions(locked, latestStable);
+      if (cmp < 0) {
+        const constraint = dep.requested;
+        if (constraint && isSimpleConstraint(constraint)) {
+          const breaking = isBreakingUpgrade(locked, latestStable, constraint);
+          return breaking ? "update_available_breaking" : "update_available_safe";
+        }
+        return "update_available_safe";
+      }
+      return "current";
+    } catch {
+    }
+  }
+  if (dep.status === "local_path" || dep.status === "git_dependency") {
+    return dep.status;
+  }
+  return dep.status ?? "current";
+}
+function privateOrUnresolvedStatus(source, detail) {
+  return {
+    privateOrUnresolved: true,
+    evidence: [
+      {
+        kind: "registry",
+        source,
+        retrievedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        detail: detail ?? "Package returned 404/401 \u2014 private or unresolved"
+      }
+    ]
+  };
+}
+function failedLookupStatus(source, error) {
+  return {
+    lookupFailed: true,
+    evidence: [
+      {
+        kind: "registry",
+        source,
+        retrievedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        detail: error ?? "Registry lookup failed \u2014 network error or timeout"
+      }
+    ]
+  };
+}
+
+// src/service.ts
+import { randomUUID } from "node:crypto";
+
+// src/research/triage.ts
+var DEFAULT_TRIAGE_LIMIT = 40;
+var CLUSTER_BY_STATUS = {
+  vulnerable: "vulnerability",
+  yanked: "replacement",
+  deprecated: "replacement",
+  unmaintained_suspected: "replacement",
+  update_available_breaking: "breaking_change"
+};
+var PRIORITY_BY_STATUS = {
+  vulnerable: 100,
+  yanked: 80,
+  deprecated: 60,
+  update_available_breaking: 40,
+  unmaintained_suspected: 30
+};
+var DIRECT_BONUS = 10;
+var RUNTIME_BONUS = 5;
+function priorityFor(dep) {
+  const base = PRIORITY_BY_STATUS[dep.status] ?? 0;
+  const direct = dep.direct ? DIRECT_BONUS : 0;
+  const runtime = dep.scope === "runtime" ? RUNTIME_BONUS : 0;
+  return base + direct + runtime;
+}
+function dedupKey(dep) {
+  return `${dep.ecosystem}\0${dep.name}\0${dep.locked ?? dep.requested ?? ""}`;
+}
+function triageCandidates(dependencies, options = {}) {
+  const limit = Math.max(0, options.limit ?? DEFAULT_TRIAGE_LIMIT);
+  if (limit === 0) return [];
+  const best = /* @__PURE__ */ new Map();
+  for (const dependency of dependencies) {
+    const cluster = CLUSTER_BY_STATUS[dependency.status];
+    if (!cluster) continue;
+    if (dependency.sourceType === "path" || dependency.sourceType === "git") continue;
+    const candidate = {
+      dependency,
+      cluster,
+      priority: priorityFor(dependency)
+    };
+    const key = dedupKey(dependency);
+    const existing = best.get(key);
+    if (!existing || candidate.priority > existing.priority) {
+      best.set(key, candidate);
+    }
+  }
+  return [...best.values()].sort(
+    (a, b) => b.priority - a.priority || a.dependency.name.localeCompare(b.dependency.name) || (a.dependency.locked ?? "").localeCompare(b.dependency.locked ?? "")
+  ).slice(0, limit);
+}
+function clusterCandidates(candidates) {
+  const out = /* @__PURE__ */ new Map();
+  for (const candidate of candidates) {
+    const list = out.get(candidate.cluster);
+    if (list) list.push(candidate);
+    else out.set(candidate.cluster, [candidate]);
+  }
+  return out;
+}
+
+// src/service.ts
+function getAdapter(ecosystem) {
+  switch (ecosystem) {
+    case "npm":
+      return npmAdapter;
+    case "python":
+      return pythonAdapter;
+    case "rust":
+      return rustAdapter;
+    case "go":
+      return goAdapter;
+    case "dotnet":
+      return dotNetAdapter;
+    case "php":
+      return phpAdapter;
+    case "dart":
+      return dartAdapter;
+    // Tier B — partial support
+    case "maven":
+      return mavenAdapter;
+    case "gradle":
+      return mavenAdapter;
+    // reuse Maven adapter (same manifest family)
+    case "ruby":
+      return rubyAdapter;
+    case "swift":
+      return void 0;
+    // no adapter yet
+    case "elixir":
+      return elixirAdapter;
+    // Tier C — best-effort
+    case "cpp":
+      return cppAdapter;
+    default:
+      return void 0;
+  }
+}
+var ADAPTER_VERSION = "0.1.0";
+var TechStackEngine = class {
+  store;
+  constructor(store) {
+    this.store = store;
+  }
+  // ── Inventory ─────────────────────────────────────────────────────────
+  /**
+   * Run an offline inventory: discover workspaces and parse dependencies
+   * from manifests and lockfiles. No network calls.
+   *
+   * Returns a Snapshot with workspace and dependency data but no
+   * registry/advisory enrichment.
+   */
+  async inventory(projectId, targetRoot, _jobId, onProgress) {
+    const snapshotId = randomUUID();
+    onProgress?.("discovering", 0, 1);
+    const rawWorkspaces = await discoverWorkspaces(targetRoot);
+    const workspaces = rawWorkspaces.map((w) => ({
+      id: w.id,
+      relativeRoot: w.relativeRoot,
+      ecosystem: w.ecosystem,
+      packageManager: w.packageManager,
+      manifests: [...w.manifests],
+      lockfiles: [...w.lockfiles],
+      confidence: w.confidence,
+      coverage: w.coverage
+    }));
+    onProgress?.("inventorying", 0, workspaces.length);
+    const allDependencies = [];
+    let totalCoverage = "full";
+    for (let i = 0; i < workspaces.length; i++) {
+      const ws = workspaces[i];
+      const adapter = getAdapter(ws.ecosystem);
+      let deps = [];
+      if (adapter) {
+        try {
+          deps = await adapter.inventory(ws, { projectRoot: targetRoot });
+        } catch {
+          deps = [];
+        }
+      }
+      if (ws.coverage === "unsupported") {
+        totalCoverage = "partial";
+      }
+      allDependencies.push(...deps);
+      onProgress?.("inventorying", i + 1, workspaces.length);
+    }
+    const fingerprint = computeFingerprint(allDependencies);
+    const snapshot = {
+      id: snapshotId,
+      projectId,
+      targetRoot,
+      fingerprint,
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      workspaces,
+      dependencies: allDependencies,
+      findings: [],
+      coverage: totalCoverage,
+      adapterVersion: ADAPTER_VERSION
+    };
+    this.store.saveSnapshot(snapshot);
+    return snapshot;
+  }
+  // ── Enrichment ─────────────────────────────────────────────────────────
+  /**
+   * Enrich a snapshot with registry metadata and advisory data.
+   *
+   * This is the online pass: fetches latest versions, licenses, deprecation
+   * status from registries, and queries OSV for advisories.
+   *
+   * Key contracts:
+   * - 404/401 → status `private_or_unresolved` (never `dead` or `deprecated`)
+   * - Network failure → status `unknown` with evidence detail (never `current`)
+   */
+  async enrich(snapshot, options = {}) {
+    const isOnline = options.online !== false;
+    if (!isOnline || options.signal?.aborted) {
+      return snapshot;
+    }
+    const byEcosystem = /* @__PURE__ */ new Map();
+    for (const dep of snapshot.dependencies) {
+      if (dep.sourceType === "path" || dep.sourceType === "git") continue;
+      if (!dep.purl) continue;
+      const list = byEcosystem.get(dep.ecosystem);
+      if (list) {
+        list.push(dep);
+      } else {
+        byEcosystem.set(dep.ecosystem, [dep]);
+      }
+    }
+    const enrichedDeps = /* @__PURE__ */ new Map();
+    const allFindings = [...snapshot.findings];
+    for (const [ecosystem, deps] of byEcosystem) {
+      const names = [...new Set(deps.map((d) => d.name))];
+      for (const name of names) {
+        const lookupOpts = {};
+        if (options.signal) lookupOpts.signal = options.signal;
+        if (options.forceRegistryRefresh) lookupOpts.force = true;
+        let registryEntry;
+        let registryStatus;
+        try {
+          registryEntry = await lookupRegistry(ecosystem, name, lookupOpts);
+          if (registryEntry) {
+            registryStatus = {
+              latestStable: registryEntry.latestStable,
+              deprecated: registryEntry.deprecated,
+              yanked: registryEntry.yanked,
+              evidence: [
+                {
+                  kind: "registry",
+                  source: registryEntry.source,
+                  retrievedAt: registryEntry.retrievedAt,
+                  detail: `latestStable: ${registryEntry.latestStable ?? "N/A"}, license: ${registryEntry.license ?? "N/A"}`
+                }
+              ]
+            };
+          } else {
+            registryStatus = {
+              privateOrUnresolved: true,
+              evidence: [
+                {
+                  kind: "registry",
+                  source: `${ecosystem} registry for ${name}`,
+                  retrievedAt: (/* @__PURE__ */ new Date()).toISOString(),
+                  detail: "Package returned 404/401 \u2014 private or unresolved"
+                }
+              ]
+            };
+          }
+        } catch (err) {
+          registryStatus = {
+            lookupFailed: true,
+            evidence: [
+              {
+                kind: "registry",
+                source: `${ecosystem} registry for ${name}`,
+                retrievedAt: (/* @__PURE__ */ new Date()).toISOString(),
+                detail: err instanceof Error ? err.message : "Registry lookup failed"
+              }
+            ]
+          };
+        }
+        let advisoryStatus;
+        try {
+          const depList = deps.filter((d) => d.name === name);
+          const purls = depList.map((d) => d.purl).filter((p) => !!p);
+          if (purls.length > 0) {
+            const osvResult = await queryOsvBatch(purls, { signal: options.signal });
+            const hasAdvisory = [...osvResult.advisories.values()].some(
+              (advisories) => advisories.length > 0
+            );
+            if (hasAdvisory) {
+              advisoryStatus = {
+                hasAdvisory: true
+              };
+            }
+          }
+        } catch {
+        }
+        for (const dep of deps) {
+          if (dep.name !== name) continue;
+          const newStatus = classifyStatus(dep, registryStatus, advisoryStatus);
+          const newEvidence = [
+            ...dep.evidence,
+            ...registryStatus?.evidence ?? [],
+            ...advisoryStatus?.evidence ?? []
+          ];
+          enrichedDeps.set(dep.id, {
+            ...dep,
+            latestStable: registryEntry?.latestStable ?? dep.latestStable,
+            license: registryEntry?.license ?? dep.license,
+            deprecated: registryEntry?.deprecated ?? dep.deprecated,
+            yanked: registryEntry?.yanked ?? dep.yanked,
+            status: newStatus,
+            evidence: newEvidence
+          });
+          if (newStatus !== "current" && newStatus !== "local_path" && newStatus !== "git_dependency") {
+            allFindings.push(
+              createFindingForStatus(dep.id, newStatus, registryEntry?.license)
+            );
+          }
+        }
+      }
+    }
+    const finalDependencies = snapshot.dependencies.map(
+      (dep) => enrichedDeps.get(dep.id) ?? dep
+    );
+    return {
+      ...snapshot,
+      dependencies: finalDependencies,
+      findings: allFindings
+    };
+  }
+  // ── Research ───────────────────────────────────────────────────────────
+  /**
+   * Interpret an enriched snapshot with the LLM: triage the problem cases,
+   * research them, and append the resulting findings.
+   *
+   * Additive by construction. Two invariants hold here, and they are the whole
+   * reason this is a separate pass rather than part of `enrich()`:
+   *
+   * 1. **`snapshot.dependencies` is returned untouched.** Version facts come
+   *    only from registry evidence — the LLM cannot fabricate a `latestStable`
+   *    because `Finding` has nowhere to put one (SDD §472).
+   * 2. **Failure is not fatal.** No researcher, no candidates, a provider
+   *    outage, a dry web search — every one of them returns the input snapshot
+   *    unchanged. A deterministic report is the floor, never a casualty of the
+   *    optional stage above it.
+   *
+   * @see docs/specs/techstack-sdd.md §31, §472
+   */
+  async research(snapshot, options = {}) {
+    if (!options.researcher || options.signal?.aborted) return snapshot;
+    const candidates = triageCandidates(snapshot.dependencies, {
+      limit: options.researchLimit
+    });
+    if (candidates.length === 0) return snapshot;
+    options.onProgress?.("researching", 0, candidates.length);
+    let findings;
+    try {
+      findings = await options.researcher.research(candidates, {
+        signal: options.signal,
+        onProgress: (completed, total) => {
+          options.onProgress?.("researching", completed, total);
+        }
+      });
+    } catch {
+      return snapshot;
+    }
+    options.onProgress?.("synthesizing", 1, 1);
+    if (findings.length === 0) return snapshot;
+    return { ...snapshot, findings: [...snapshot.findings, ...findings] };
+  }
+  // ── Analyze ───────────────────────────────────────────────────────────
+  /**
+   * Run a full analysis: inventory + enrich + research + persist.
+   * This is the main entry point for the analyze job flow.
+   */
+  async analyze(projectId, options) {
+    const jobId = options.jobId ?? randomUUID();
+    const requestedBy = options.requestedBy ?? "system";
+    const job = {
+      id: jobId,
+      projectId,
+      targetRoot: options.targetRoot,
+      kind: "analyze",
+      status: "queued",
+      fingerprint: "",
+      requestedBy,
+      sessionId: options.sessionId,
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      progress: { phase: "queued", completed: 0, total: 0 }
+    };
+    this.store.saveJob(job);
+    const updateJob = (status, progress) => {
+      this.store.updateJobStatus(jobId, status, progress);
+      if (progress) options.onProgress?.(progress.phase, progress.completed, progress.total);
+    };
+    const throwIfAborted = () => {
+      if (options.signal?.aborted) throw new DOMException("TechStack job cancelled", "AbortError");
+    };
+    try {
+      throwIfAborted();
+      updateJob("discovering", { phase: "discovering", completed: 0, total: 1 });
+      const snapshot = await this.inventory(
+        projectId,
+        options.targetRoot,
+        jobId,
+        (phase, completed, total) => {
+          throwIfAborted();
+          updateJob(phase, { phase, completed, total });
+        }
+      );
+      throwIfAborted();
+      const isOnline = options.online !== false;
+      if (isOnline) {
+        updateJob("enriching", { phase: "enriching", completed: 0, total: 1 });
+        const enriched = await this.enrich(snapshot, {
+          online: true,
+          signal: options.signal
+        });
+        throwIfAborted();
+        const researched = await this.research(enriched, {
+          researcher: options.researcher,
+          researchLimit: options.researchLimit,
+          signal: options.signal,
+          onProgress: (phase, completed, total) => {
+            updateJob(phase, { phase, completed, total });
+          }
+        });
+        throwIfAborted();
+        this.store.saveSnapshot(researched);
+        updateJob("completed", { phase: "completed", completed: 1, total: 1 });
+        return {
+          snapshot: researched,
+          job: { ...job, status: "completed", completedAt: (/* @__PURE__ */ new Date()).toISOString() }
+        };
+      }
+      this.store.saveSnapshot(snapshot);
+      updateJob("completed", { phase: "completed", completed: 1, total: 1 });
+      return {
+        snapshot,
+        job: { ...job, status: "completed", completedAt: (/* @__PURE__ */ new Date()).toISOString() }
+      };
+    } catch (err) {
+      if (options.signal?.aborted || err instanceof DOMException && err.name === "AbortError") {
+        updateJob("cancelled");
+      } else {
+        updateJob("failed");
+      }
+      throw err;
+    }
+  }
+  // ── Report generation ─────────────────────────────────────────────────
+  /**
+   * Generate a human-readable report from a snapshot.
+   *
+   * @param format 'md' for Markdown, 'json' for raw JSON.
+   * @returns The report as a string.
+   */
+  generateReport(snapshot, format = "md") {
+    if (format === "json") return JSON.stringify(snapshot, null, 2);
+    const lines = [
+      "# TechStack Report",
+      "",
+      `**Generated:** ${snapshot.createdAt}`,
+      `**Target:** ${snapshot.targetRoot}`,
+      `**Fingerprint:** ${snapshot.fingerprint}`,
+      `**Workspaces:** ${snapshot.workspaces.length}`,
+      `**Dependencies:** ${snapshot.dependencies.length}`,
+      `**Findings:** ${snapshot.findings.length}`,
+      `**Coverage:** ${snapshot.coverage}`,
+      ""
+    ];
+    if (snapshot.workspaces.length > 0) {
+      lines.push("## Workspaces", "");
+      lines.push("| Workspace | Ecosystem | Coverage | Deps |");
+      lines.push("|---|---|---|---|");
+      for (const ws of snapshot.workspaces) {
+        const depCount = snapshot.dependencies.filter((d) => d.workspaceId === ws.id).length;
+        lines.push(`| ${ws.relativeRoot} | ${ws.ecosystem} | ${ws.coverage} | ${depCount} |`);
+      }
+      lines.push("");
+    }
+    const findings = snapshot.findings;
+    if (findings.length > 0) {
+      lines.push("## Findings", "");
+      const bySeverity = /* @__PURE__ */ new Map();
+      for (const f of findings) {
+        const list = bySeverity.get(f.severity) ?? [];
+        list.push(f);
+        bySeverity.set(f.severity, list);
+      }
+      for (const sev of ["critical", "high", "medium", "low", "info"]) {
+        const items = bySeverity.get(sev);
+        if (!items || items.length === 0) continue;
+        lines.push(`### ${sev.charAt(0).toUpperCase() + sev.slice(1)} (${items.length})`, "");
+        for (const f of items) {
+          const dep = snapshot.dependencies.find((d) => d.id === f.dependencyId);
+          lines.push(`- **${dep?.name ?? f.dependencyId}** \u2014 ${f.type} \u2014 ${f.rationale}`);
+        }
+        lines.push("");
+      }
+    }
+    if (snapshot.dependencies.length > 0) {
+      lines.push("## Dependencies", "");
+      lines.push("| Name | Ecosystem | Status | Locked | Latest |");
+      lines.push("|---|---|---|---|---|");
+      for (const dep of snapshot.dependencies) {
+        lines.push(
+          `| ${dep.name} | ${dep.ecosystem} | ${dep.status} | ${dep.locked ?? "\u2014"} | ${dep.latestStable ?? "\u2014"} |`
+        );
+      }
+    }
+    return lines.join("\n");
+  }
+};
+function computeFingerprint(dependencies) {
+  const parts = dependencies.map((d) => `${d.name}@${d.locked ?? d.requested ?? "unknown"}`).sort().join(",");
+  let hash = 0;
+  for (let i = 0; i < parts.length; i++) {
+    const char = parts.charCodeAt(i);
+    hash = (hash << 5) - hash + char;
+    hash |= 0;
+  }
+  return `ts-${Math.abs(hash).toString(36)}`;
+}
+function createFindingForStatus(dependencyId, status, _license) {
+  switch (status) {
+    case "vulnerable":
+      return {
+        id: `finding-${dependencyId}-vuln`,
+        dependencyId,
+        type: "vulnerability",
+        severity: "high",
+        action: "upgrade_patch",
+        confidence: 1,
+        rationale: "Known security advisory found for this package",
+        evidence: []
+      };
+    case "deprecated":
+      return {
+        id: `finding-${dependencyId}-dep`,
+        dependencyId,
+        type: "deprecated",
+        severity: "medium",
+        action: "replace",
+        confidence: 1,
+        rationale: "Package is deprecated in the registry",
+        evidence: []
+      };
+    case "yanked":
+      return {
+        id: `finding-${dependencyId}-yank`,
+        dependencyId,
+        type: "deprecated",
+        severity: "high",
+        action: "replace",
+        confidence: 1,
+        rationale: "Package version has been yanked from the registry",
+        evidence: []
+      };
+    case "update_available_safe":
+      return {
+        id: `finding-${dependencyId}-update`,
+        dependencyId,
+        type: "upgrade",
+        severity: "info",
+        action: "upgrade_minor",
+        confidence: 1,
+        rationale: "A newer compatible version is available",
+        evidence: []
+      };
+    case "update_available_breaking":
+      return {
+        id: `finding-${dependencyId}-major`,
+        dependencyId,
+        type: "upgrade",
+        severity: "low",
+        action: "upgrade_major",
+        confidence: 1,
+        rationale: "A newer version is available that may require breaking changes",
+        evidence: []
+      };
+    default:
+      return {
+        id: `finding-${dependencyId}-investigate`,
+        dependencyId,
+        type: "investigate",
+        severity: "info",
+        action: "investigate",
+        confidence: 0.5,
+        rationale: `Package status is "${status}" \u2014 may need investigation`,
+        evidence: []
+      };
+  }
+}
+
+// src/research/llm.ts
+var DEFAULT_TIMEOUT_MS = 45e3;
+function createProviderLlm(accessor, options = {}) {
+  if (!accessor()) return void 0;
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  return async (req) => {
+    const llm = accessor();
+    if (!llm) throw new Error("TechStack research: no provider available");
+    const request = {
+      model: llm.model,
+      system: [{ type: "text", text: req.system }],
+      messages: [{ role: "user", content: req.prompt }],
+      maxTokens: req.maxTokens
+    };
+    if (llm.provider.capabilities.structuredOutput) {
+      request.responseFormat = {
+        type: "json_schema",
+        jsonSchema: { name: req.schemaName, strict: false, schema: req.schema }
+      };
+    } else if (llm.provider.capabilities.jsonMode) {
+      request.responseFormat = { type: "json_object" };
+    }
+    const timer = new AbortController();
+    const onAbort = () => {
+      timer.abort(new Error("TechStack research: cancelled"));
+    };
+    req.signal?.addEventListener("abort", onAbort, { once: true });
+    const to = setTimeout(() => {
+      timer.abort(new Error("TechStack research: LLM timeout"));
+    }, timeoutMs);
+    to.unref?.();
+    try {
+      const res = await llm.provider.complete(request, { signal: timer.signal });
+      return res.content.filter((block) => block.type === "text").map((block) => block.text).join("\n").trim();
+    } finally {
+      req.signal?.removeEventListener("abort", onAbort);
+      clearTimeout(to);
+      timer.abort();
+    }
+  };
+}
+function stripOuterFence(text) {
+  const trimmed = text.trim();
+  const match = trimmed.match(/^```(?:[a-z0-9_-]+)?\s*\r?\n([\s\S]*?)\r?\n```$/i);
+  return (match?.[1] ?? trimmed).trim();
+}
+function extractJsonObject(text) {
+  const trimmed = stripOuterFence(text);
+  if (trimmed.startsWith("{")) return trimmed;
+  const start = trimmed.indexOf("{");
+  const end = trimmed.lastIndexOf("}");
+  if (start !== -1 && end > start) return trimmed.slice(start, end + 1);
+  return trimmed;
+}
+function parseResearchJson(text) {
+  if (!text.trim()) return null;
+  try {
+    const parsed = JSON.parse(extractJsonObject(text));
+    return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
+// src/research/researcher.ts
+var SEARCH_CONCURRENCY = 4;
+var MAX_SNIPPET_CHARS = 320;
+var MAX_TOKENS_PER_CLUSTER = 2e3;
+var MAX_LLM_CONFIDENCE = 0.95;
+var MIN_LLM_CONFIDENCE = 0.1;
+var DEFAULT_LLM_CONFIDENCE = 0.5;
+var FINDING_TYPE_BY_CLUSTER = {
+  breaking_change: "upgrade",
+  replacement: "replacement",
+  vulnerability: "vulnerability"
+};
+var VALID_SEVERITIES = /* @__PURE__ */ new Set([
+  "info",
+  "low",
+  "medium",
+  "high",
+  "critical"
+]);
+var VALID_ACTIONS = /* @__PURE__ */ new Set([
+  "none",
+  "upgrade_patch",
+  "upgrade_minor",
+  "upgrade_major",
+  "replace",
+  "remove",
+  "investigate"
+]);
+var SHARED_RULES = [
+  "Return only JSON. No markdown, prose, or code fences.",
+  "Only reason about the packages listed in the input. Never introduce a package that is not listed.",
+  "Never state or guess version numbers other than the ones given to you; the version facts are already established.",
+  "If the provided sources do not support a conclusion, say so in the rationale and lower the confidence.",
+  "Be concrete and short. The reader is an engineer deciding what to do this afternoon."
+].join("\n");
+var SYSTEM_BY_CLUSTER = {
+  breaking_change: [
+    "You assess upgrade risk for software dependencies.",
+    "For each package, judge how disruptive moving to the latest version would be for a typical consumer,",
+    "and what the migration actually involves.",
+    SHARED_RULES
+  ].join("\n"),
+  replacement: [
+    "You advise on deprecated, yanked, and unmaintained software dependencies.",
+    "For each package, say whether it should be replaced, what the community has moved to, and how urgent it is.",
+    "Prefer platform-native or well-maintained successors. If the package is fine to keep, say so plainly.",
+    SHARED_RULES
+  ].join("\n"),
+  vulnerability: [
+    "You triage security advisories for software dependencies.",
+    "For each package, judge how exploitable the known advisory is in practice and what the fix is.",
+    "Distinguish advisories that require unusual usage from ones that affect every consumer.",
+    SHARED_RULES
+  ].join("\n")
+};
+var QUESTION_BY_CLUSTER = {
+  breaking_change: "How breaking is this upgrade, and what does the migration involve?",
+  replacement: "Should this be replaced, and with what?",
+  vulnerability: "Does this advisory realistically affect a consumer, and what is the fix?"
+};
+var RESEARCH_JSON_SCHEMA = {
+  type: "object",
+  additionalProperties: false,
+  properties: {
+    findings: {
+      type: "array",
+      items: {
+        type: "object",
+        additionalProperties: false,
+        properties: {
+          package: { type: "string", description: "Exact package name from the input list." },
+          severity: { type: "string", enum: ["info", "low", "medium", "high", "critical"] },
+          action: {
+            type: "string",
+            enum: [
+              "none",
+              "upgrade_patch",
+              "upgrade_minor",
+              "upgrade_major",
+              "replace",
+              "remove",
+              "investigate"
+            ]
+          },
+          confidence: { type: "number", minimum: 0, maximum: 1 },
+          rationale: { type: "string" },
+          breakingRisk: { type: "string" },
+          sources: { type: "array", items: { type: "string" } }
+        },
+        required: ["package", "severity", "action", "confidence", "rationale"]
+      }
+    }
+  },
+  required: ["findings"]
+};
+function searchQuery(candidate) {
+  const dep = candidate.dependency;
+  const from = dep.locked ?? dep.requested ?? "";
+  const to = dep.latestStable ?? "";
+  switch (candidate.cluster) {
+    case "breaking_change":
+      return `${dep.name} ${from} to ${to} migration guide breaking changes`;
+    case "replacement":
+      return `${dep.name} ${dep.ecosystem} deprecated recommended alternative replacement`;
+    case "vulnerability":
+      return `${dep.name} ${from} security advisory CVE affected versions`;
+  }
+}
+async function mapLimit(items, limit, task) {
+  const out = new Array(items.length);
+  let cursor = 0;
+  const workers = Array.from({ length: Math.min(limit, items.length) }, async () => {
+    for (; ; ) {
+      const index = cursor++;
+      if (index >= items.length) return;
+      out[index] = await task(items[index], index);
+    }
+  });
+  await Promise.all(workers);
+  return out;
+}
+function describeDependency(dep) {
+  const bits = [
+    `ecosystem: ${dep.ecosystem}`,
+    `installed: ${dep.locked ?? dep.installed ?? dep.requested ?? "unknown"}`
+  ];
+  if (dep.latestStable) bits.push(`latest stable: ${dep.latestStable}`);
+  if (dep.requested) bits.push(`constraint: ${dep.requested}`);
+  bits.push(dep.direct ? "direct dependency" : "transitive dependency");
+  bits.push(`scope: ${dep.scope}`);
+  if (dep.license) bits.push(`license: ${dep.license}`);
+  if (dep.deprecated) bits.push("registry flag: deprecated");
+  if (dep.yanked) bits.push("registry flag: yanked");
+  bits.push(`status: ${dep.status}`);
+  return bits.join(", ");
+}
+function renderSources(results) {
+  if (results.length === 0) return "  (no sources found \u2014 say so and lower confidence)";
+  return results.map((r) => `  - ${r.title}
+    ${r.url}
+    ${truncate(r.snippet, MAX_SNIPPET_CHARS)}`).join("\n");
+}
+function truncate(value, max) {
+  const clean = value.replace(/\s+/g, " ").trim();
+  return clean.length <= max ? clean : `${clean.slice(0, max)}\u2026`;
+}
+function buildPrompt(cluster, entries) {
+  const blocks = entries.map(
+    ({ candidate, sources }, i) => [
+      `${i + 1}. ${candidate.dependency.name}`,
+      `   ${describeDependency(candidate.dependency)}`,
+      "   Web search results:",
+      renderSources(sources)
+    ].join("\n")
+  );
+  return [
+    `Question for every package below: ${QUESTION_BY_CLUSTER[cluster]}`,
+    "",
+    "Packages:",
+    ...blocks,
+    "",
+    "Return JSON shaped exactly as:",
+    '{"findings":[{"package":"exact-name-from-the-list","severity":"medium","action":"upgrade_major","confidence":0.7,"rationale":"one or two sentences","breakingRisk":"optional short note","sources":["https://\u2026"]}]}',
+    "",
+    "Emit one entry per package you can say something useful about. Omit packages you cannot."
+  ].join("\n");
+}
+function optionalString(value) {
+  return typeof value === "string" && value.trim() ? value.trim() : void 0;
+}
+function clampConfidence(value) {
+  if (typeof value !== "number" || !Number.isFinite(value)) return DEFAULT_LLM_CONFIDENCE;
+  return Math.min(MAX_LLM_CONFIDENCE, Math.max(MIN_LLM_CONFIDENCE, value));
+}
+function sourceEvidence(raw, sources, retrievedAt) {
+  const known = new Set(sources.map((s) => s.url));
+  const cited = Array.isArray(raw) ? raw.filter((u) => typeof u === "string" && known.has(u)) : [];
+  const urls = cited.length > 0 ? cited : sources.map((s) => s.url);
+  return urls.map((url) => ({
+    kind: "agent",
+    source: url,
+    retrievedAt,
+    detail: sources.find((s) => s.url === url)?.title
+  }));
+}
+function toFinding(raw, cluster, byName, retrievedAt) {
+  const name = optionalString(raw.package);
+  if (!name) return null;
+  const entry = byName.get(name);
+  if (!entry) return null;
+  const rationale = optionalString(raw.rationale);
+  if (!rationale) return null;
+  const severity = VALID_SEVERITIES.has(raw.severity) ? raw.severity : "info";
+  const action = VALID_ACTIONS.has(raw.action) ? raw.action : "investigate";
+  const breakingRisk = optionalString(raw.breakingRisk);
+  return {
+    id: `research-${entry.candidate.dependency.id}-${cluster}`,
+    dependencyId: entry.candidate.dependency.id,
+    type: FINDING_TYPE_BY_CLUSTER[cluster],
+    severity,
+    action,
+    confidence: clampConfidence(raw.confidence),
+    rationale,
+    ...breakingRisk ? { breakingRisk } : {},
+    evidence: sourceEvidence(raw.sources, entry.sources, retrievedAt)
+  };
+}
+function parseFindings(parsed, cluster, byName, retrievedAt) {
+  if (!parsed || !Array.isArray(parsed.findings)) return [];
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const raw of parsed.findings) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) continue;
+    const finding = toFinding(raw, cluster, byName, retrievedAt);
+    if (!finding || seen.has(finding.id)) continue;
+    seen.add(finding.id);
+    out.push(finding);
+  }
+  return out;
+}
+function createResearcher(options) {
+  const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  return {
+    async research(candidates, opts = {}) {
+      if (candidates.length === 0) return [];
+      const clusters = [...clusterCandidates(candidates).entries()];
+      const findings = [];
+      let completed = 0;
+      opts.onProgress?.(0, clusters.length);
+      for (const [cluster, members] of clusters) {
+        if (opts.signal?.aborted) break;
+        try {
+          const sources = await mapLimit(
+            members,
+            SEARCH_CONCURRENCY,
+            (candidate) => options.search(searchQuery(candidate), { signal: opts.signal })
+          );
+          if (opts.signal?.aborted) break;
+          const entries = members.map((candidate, i) => ({
+            candidate,
+            sources: sources[i] ?? []
+          }));
+          const byName = new Map(entries.map((entry) => [entry.candidate.dependency.name, entry]));
+          const text = await options.llm({
+            system: SYSTEM_BY_CLUSTER[cluster],
+            prompt: buildPrompt(cluster, entries),
+            schema: RESEARCH_JSON_SCHEMA,
+            schemaName: `techstack_${cluster}_findings`,
+            maxTokens: MAX_TOKENS_PER_CLUSTER,
+            signal: opts.signal
+          });
+          findings.push(
+            ...parseFindings(parseResearchJson(text), cluster, byName, now().toISOString())
+          );
+        } catch {
+        }
+        completed++;
+        opts.onProgress?.(completed, clusters.length);
+      }
+      return findings;
+    }
+  };
+}
+
+// src/research/search.ts
+import { searchTool } from "@wrongstack/tools";
+var DEFAULT_NUM_RESULTS = 5;
+var NO_CONTEXT = void 0;
+function createToolSearch(options = {}) {
+  const numResults = options.numResults ?? DEFAULT_NUM_RESULTS;
+  return async (query, opts) => {
+    if (opts.signal?.aborted) return [];
+    try {
+      const out = await searchTool.execute(
+        {
+          query,
+          num_results: numResults,
+          ...options.source ? { source: options.source } : {}
+        },
+        NO_CONTEXT,
+        { signal: opts.signal ?? new AbortController().signal }
+      );
+      return out.results.map((result) => ({
+        title: result.title,
+        url: result.url,
+        snippet: result.snippet
+      }));
+    } catch {
+      return [];
+    }
+  };
+}
+
+// src/store/sqlite.ts
+import { DatabaseSync } from "node:sqlite";
+import { mkdirSync, existsSync as existsSync3 } from "node:fs";
+import { join as join7 } from "node:path";
+import { homedir } from "node:os";
+
+// src/store/schema.ts
+var SCHEMA_VERSION = 1;
+var DDL = `
+CREATE TABLE IF NOT EXISTS techstack_schema_version (
+  version INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS snapshots (
+  id TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL,
+  target_root TEXT NOT NULL,
+  fingerprint TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  raw_json TEXT NOT NULL,
+  adapter_version TEXT NOT NULL DEFAULT ''
+);
+
+CREATE INDEX IF NOT EXISTS idx_snapshots_project_id ON snapshots(project_id);
+CREATE INDEX IF NOT EXISTS idx_snapshots_created_at ON snapshots(created_at DESC);
+
+CREATE TABLE IF NOT EXISTS jobs (
+  id TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL,
+  target_root TEXT NOT NULL,
+  kind TEXT NOT NULL CHECK(kind IN ('inventory', 'analyze')),
+  status TEXT NOT NULL DEFAULT 'queued'
+    CHECK(status IN ('queued','discovering','inventorying','enriching','researching','synthesizing','completed','failed','cancelled')),
+  fingerprint TEXT NOT NULL DEFAULT '',
+  requested_by TEXT NOT NULL DEFAULT '',
+  session_id TEXT,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  completed_at TEXT,
+  error TEXT,
+  progress_json TEXT
+);
+
+CREATE INDEX IF NOT EXISTS idx_jobs_project_id ON jobs(project_id);
+CREATE INDEX IF NOT EXISTS idx_jobs_status ON jobs(status);
+
+CREATE TABLE IF NOT EXISTS outbox (
+  delivery_id TEXT PRIMARY KEY,
+  report_id TEXT NOT NULL,
+  session_id TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'pending'
+    CHECK(status IN ('pending', 'claimed', 'delivered', 'failed')),
+  attempts INTEGER NOT NULL DEFAULT 0,
+  claimed_at TEXT,
+  delivered_at TEXT
+);
+
+CREATE INDEX IF NOT EXISTS idx_outbox_status ON outbox(status);
+`;
+function applySchema(db) {
+  for (const statement of DDL.split(";")) {
+    const trimmed = statement.trim();
+    if (trimmed) {
+      db.exec(trimmed);
+    }
+  }
+  const row = db.prepare("SELECT version FROM techstack_schema_version").get();
+  if (!row) {
+    db.prepare("INSERT INTO techstack_schema_version (version) VALUES (?)").run(SCHEMA_VERSION);
+  } else if (row.version < SCHEMA_VERSION) {
+    db.prepare("UPDATE techstack_schema_version SET version = ?").run(SCHEMA_VERSION);
+  }
+}
+
+// src/store/sqlite.ts
+var TechStackStore = class {
+  db;
+  dbPath;
+  constructor(options) {
+    this.dbPath = options.dbPath ?? join7(
+      homedir(),
+      ".wrongstack",
+      "projects",
+      options.projectSlug,
+      "techstack",
+      "techstack.db"
+    );
+    const dir = this.dbPath.slice(0, this.dbPath.lastIndexOf("\\"));
+    if (!existsSync3(dir)) {
+      mkdirSync(dir, { recursive: true });
+    }
+    this.db = new DatabaseSync(this.dbPath);
+    this.db.exec("PRAGMA journal_mode = WAL;");
+    this.db.exec("PRAGMA foreign_keys = ON;");
+    applySchema(this.db);
+  }
+  // ── Lifecycle ───────────────────────────────────────────────────────────
+  /** Close the database connection. Idempotent. */
+  close() {
+    try {
+      this.db.close();
+    } catch {
+    }
+  }
+  /** Get the database path (useful for tests). */
+  get path() {
+    return this.dbPath;
+  }
+  // ── Snapshots ───────────────────────────────────────────────────────────
+  /** Persist a snapshot. */
+  saveSnapshot(snapshot) {
+    const stmt = this.db.prepare(`
+      INSERT OR REPLACE INTO snapshots (id, project_id, target_root, fingerprint, created_at, raw_json, adapter_version)
+      VALUES (?, ?, ?, ?, ?, ?, ?)
+    `);
+    stmt.run(
+      snapshot.id,
+      snapshot.projectId,
+      snapshot.targetRoot,
+      snapshot.fingerprint,
+      snapshot.createdAt,
+      JSON.stringify(snapshot),
+      snapshot.adapterVersion
+    );
+  }
+  /** Get a snapshot by project ID (latest). */
+  getSnapshot(projectId) {
+    const stmt = this.db.prepare(`
+      SELECT raw_json FROM snapshots
+      WHERE project_id = ?
+      ORDER BY created_at DESC
+      LIMIT 1
+    `);
+    const row = stmt.get(projectId);
+    if (!row) return void 0;
+    try {
+      return JSON.parse(row.raw_json);
+    } catch {
+      return void 0;
+    }
+  }
+  /** Get a snapshot by ID. */
+  getSnapshotById(id) {
+    const stmt = this.db.prepare(`
+      SELECT raw_json FROM snapshots WHERE id = ?
+    `);
+    const row = stmt.get(id);
+    if (!row) return void 0;
+    try {
+      return JSON.parse(row.raw_json);
+    } catch {
+      return void 0;
+    }
+  }
+  /** List all snapshots for a project (newest first). */
+  listSnapshots(projectId, limit = 20) {
+    const stmt = this.db.prepare(`
+      SELECT raw_json FROM snapshots
+      WHERE project_id = ?
+      ORDER BY created_at DESC
+      LIMIT ?
+    `);
+    const rows = stmt.all(projectId, limit);
+    return rows.map((r) => {
+      try {
+        return JSON.parse(r.raw_json);
+      } catch {
+        return void 0;
+      }
+    }).filter((s) => s !== void 0);
+  }
+  /** Delete snapshots older than a given timestamp. */
+  deleteSnapshotsBefore(projectId, before) {
+    const stmt = this.db.prepare(`
+      DELETE FROM snapshots WHERE project_id = ? AND created_at < ?
+    `);
+    const result = stmt.run(projectId, before);
+    return Number(result.changes);
+  }
+  // ── Jobs ────────────────────────────────────────────────────────────────
+  /** Persist a job. */
+  saveJob(job) {
+    const stmt = this.db.prepare(`
+      INSERT OR REPLACE INTO jobs
+        (id, project_id, target_root, kind, status, fingerprint, requested_by, session_id, created_at, completed_at, error, progress_json)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `);
+    stmt.run(
+      job.id,
+      job.projectId,
+      job.targetRoot,
+      job.kind,
+      job.status,
+      job.fingerprint,
+      job.requestedBy,
+      job.sessionId ?? null,
+      job.createdAt,
+      job.completedAt ?? null,
+      job.error ?? null,
+      job.progress ? JSON.stringify(job.progress) : null
+    );
+  }
+  /** Get a job by ID. */
+  getJob(id) {
+    const stmt = this.db.prepare(`
+      SELECT * FROM jobs WHERE id = ?
+    `);
+    const row = stmt.get(id);
+    if (!row) return void 0;
+    return this.rowToJob(row);
+  }
+  /** Update job status and optional progress. */
+  updateJobStatus(id, status, progress) {
+    const progressJson = progress ? JSON.stringify(progress) : null;
+    const completedAt = status === "completed" || status === "failed" || status === "cancelled" ? (/* @__PURE__ */ new Date()).toISOString() : null;
+    const stmt = this.db.prepare(`
+      UPDATE jobs
+      SET status = ?, progress_json = ?, completed_at = COALESCE(?, completed_at)
+      WHERE id = ?
+    `);
+    stmt.run(status, progressJson, completedAt, id);
+  }
+  /** List jobs for a project (newest first). */
+  listJobs(projectId, limit = 50) {
+    const stmt = this.db.prepare(`
+      SELECT * FROM jobs WHERE project_id = ? ORDER BY created_at DESC LIMIT ?
+    `);
+    const rows = stmt.all(projectId, limit);
+    return rows.map((r) => this.rowToJob(r));
+  }
+  // ── Outbox ──────────────────────────────────────────────────────────────
+  /** Create an outbox entry. */
+  createOutbox(deliveryId, reportId, sessionId) {
+    const stmt = this.db.prepare(`
+      INSERT OR IGNORE INTO outbox (delivery_id, report_id, session_id, status, attempts)
+      VALUES (?, ?, ?, 'pending', 0)
+    `);
+    stmt.run(deliveryId, reportId, sessionId);
+  }
+  /** Claim an outbox entry (atomic CAS). */
+  claimOutbox(deliveryId, sessionId) {
+    const stmt = this.db.prepare(`
+      UPDATE outbox
+      SET status = 'claimed', claimed_at = datetime('now'), attempts = attempts + 1
+      WHERE delivery_id = ? AND session_id = ? AND status = 'pending'
+    `);
+    const result = stmt.run(deliveryId, sessionId);
+    return result.changes > 0;
+  }
+  /** Mark an outbox entry as delivered. */
+  deliverOutbox(deliveryId) {
+    const stmt = this.db.prepare(`
+      UPDATE outbox SET status = 'delivered', delivered_at = datetime('now')
+      WHERE delivery_id = ?
+    `);
+    stmt.run(deliveryId);
+  }
+  /** Mark an outbox entry as failed. */
+  failOutbox(deliveryId) {
+    const stmt = this.db.prepare(`
+      UPDATE outbox SET status = 'failed' WHERE delivery_id = ?
+    `);
+    stmt.run(deliveryId);
+  }
+  /** List outbox entries by status. */
+  listOutboxByStatus(status) {
+    const stmt = this.db.prepare(`
+      SELECT * FROM outbox WHERE status = ?
+    `);
+    const rows = stmt.all(status);
+    return rows.map((r) => this.rowToOutbox(r));
+  }
+  // ── Row mapping helpers ─────────────────────────────────────────────────
+  rowToJob(row) {
+    let progress;
+    if (row.progress_json && typeof row.progress_json === "string") {
+      try {
+        progress = JSON.parse(row.progress_json);
+      } catch {
+      }
+    }
+    return {
+      id: String(row.id),
+      projectId: String(row.project_id),
+      targetRoot: String(row.target_root),
+      kind: row.kind,
+      status: row.status,
+      fingerprint: String(row.fingerprint ?? ""),
+      requestedBy: String(row.requested_by ?? ""),
+      sessionId: row.session_id ? String(row.session_id) : void 0,
+      createdAt: String(row.created_at),
+      completedAt: row.completed_at ? String(row.completed_at) : void 0,
+      error: row.error ? String(row.error) : void 0,
+      ...progress ? { progress } : {}
+    };
+  }
+  rowToOutbox(row) {
+    return {
+      deliveryId: String(row.delivery_id),
+      reportId: String(row.report_id),
+      sessionId: String(row.session_id),
+      status: row.status,
+      attempts: Number(row.attempts),
+      claimedAt: row.claimed_at ? String(row.claimed_at) : void 0,
+      deliveredAt: row.delivered_at ? String(row.delivered_at) : void 0
+    };
+  }
+};
+
+// src/delivery/coordinator.ts
+async function attemptDelivery(deliveryId, opts) {
+  const { store, isRunInProgress, deliverToSession, onDelivered } = opts;
+  if (isRunInProgress()) {
+    return { deliveryId, sessionId: "", delivered: false };
+  }
+  const pending = store.listOutboxByStatus("pending");
+  const entry = pending.find((e) => e.deliveryId === deliveryId);
+  if (!entry) {
+    return { deliveryId, sessionId: "", delivered: false };
+  }
+  const claimed = store.claimOutbox(deliveryId, entry.sessionId);
+  if (!claimed) {
+    return { deliveryId, sessionId: entry.sessionId, delivered: false };
+  }
+  const snapshot = store.getSnapshotById(entry.reportId);
+  const summary = snapshot ? buildSummary(snapshot) : `TechStack report ${entry.reportId} is ready.`;
+  const success = await deliverToSession(entry.sessionId, entry.reportId, summary);
+  if (success) {
+    store.deliverOutbox(deliveryId);
+    onDelivered?.(deliveryId, entry.sessionId);
+    return { deliveryId, sessionId: entry.sessionId, delivered: true };
+  }
+  store.failOutbox(deliveryId);
+  return { deliveryId, sessionId: entry.sessionId, delivered: false };
+}
+async function drainPendingDeliveries(sessionId, opts) {
+  const { store, isRunInProgress } = opts;
+  if (isRunInProgress()) return 0;
+  const pending = store.listOutboxByStatus("pending");
+  let delivered = 0;
+  for (const entry of pending) {
+    if (entry.sessionId !== sessionId) continue;
+    const result = await attemptDelivery(entry.deliveryId, opts);
+    if (result.delivered) delivered++;
+  }
+  return delivered;
+}
+function buildSummary(snapshot) {
+  const lines = [
+    `\u{1F4CA} **TechStack Report Ready**`,
+    "",
+    `**${snapshot.workspaces.length}** workspaces \xB7 **${snapshot.dependencies.length}** dependencies \xB7 **${snapshot.findings.length}** findings`
+  ];
+  const findings = snapshot.findings;
+  const critical = findings.filter((f) => f.severity === "critical" || f.severity === "high");
+  if (critical.length > 0) {
+    lines.push("", `**Top ${Math.min(5, critical.length)} urgent findings:**`);
+    for (const f of critical.slice(0, 5)) {
+      const dep = snapshot.dependencies.find((d) => d.id === f.dependencyId);
+      lines.push(`  \u2022 **${dep?.name ?? f.dependencyId}** \u2014 ${f.type}: ${f.rationale}`);
+    }
+  }
+  lines.push("", `_Open the TechStack view for the full report._`);
+  return lines.join("\n");
+}
+export {
+  CppAdapter,
+  DDL,
+  DEFAULT_TRIAGE_LIMIT,
+  DartAdapter,
+  DotNetAdapter,
+  ElixirAdapter,
+  GoAdapter,
+  MavenAdapter,
+  NpmAdapter,
+  PhpAdapter,
+  PythonAdapter,
+  RubyAdapter,
+  RustAdapter,
+  TechStackEngine,
+  TechStackStore,
+  applySchema,
+  attemptDelivery,
+  buildPurl,
+  classifyStatus,
+  clearRegistryCache,
+  clusterCandidates,
+  compareVersions,
+  constructPurl,
+  coverageForEcosystem,
+  cppAdapter,
+  createProviderLlm,
+  createResearcher,
+  createToolSearch,
+  dartAdapter,
+  diffSnapshots,
+  discoverWorkspaces,
+  dotNetAdapter,
+  drainPendingDeliveries,
+  ecosystemForPurlType,
+  elixirAdapter,
+  failedLookupStatus,
+  generateUpgradePlan,
+  goAdapter,
+  isNativeAuditAvailable,
+  lookupRegistry,
+  lookupRegistryBatch,
+  mapDetectedWorkspace,
+  mavenAdapter,
+  npmAdapter,
+  parsePurl,
+  parsePurlEcosystem,
+  parseResearchJson,
+  phpAdapter,
+  privateOrUnresolvedStatus,
+  purlTypeForEcosystem,
+  pythonAdapter,
+  queryOsvBatch,
+  queryOsvSingle,
+  renderPlanMarkdown,
+  rubyAdapter,
+  runNativeAudit,
+  runNpmAudit,
+  rustAdapter,
+  supportedRegistryEcosystems,
+  toCycloneDX,
+  toSpdx,
+  triageCandidates
+};
+//# sourceMappingURL=index.js.map