@wrongstack/techstack 0.289.0

package/dist/service.d.ts

@@ -0,0 +1,110 @@
+/**
+ * TechStack — Public service API.
+ *
+ * Wires together inventory, online enrichment (registry + OSV + native audit),
+ * status classification, and persistence into a single async job flow.
+ *
+ * @see docs/specs/techstack-sdd.md §4.2
+ */
+import type { Snapshot, TechStackJob } from './types.js';
+import type { TechStackStore } from './store/sqlite.js';
+import type { TechStackResearcher } from './research/types.js';
+export interface EnrichOptions {
+    /** Skip network calls; use only cached/offline data. */
+    readonly online?: boolean | undefined;
+    /** Abort signal for cancellation. */
+    readonly signal?: AbortSignal | undefined;
+    /** Force re-fetch registry data (ignore cache). */
+    readonly forceRegistryRefresh?: boolean | undefined;
+}
+export interface AnalyzeOptions {
+    /** Where to start the analysis. */
+    readonly targetRoot: string;
+    /** Session ID for job tracking. */
+    readonly sessionId?: string | undefined;
+    /** Requesting entity. */
+    readonly requestedBy?: string | undefined;
+    /** Enable online enrichment (registry + advisory). */
+    readonly online?: boolean | undefined;
+    /** Auto-deliver report when complete. */
+    readonly autoDeliver?: boolean | undefined;
+    /** Optional caller-assigned id so HTTP/WS clients can track the job immediately. */
+    readonly jobId?: string | undefined;
+    /** Abort signal used by cancel endpoints. */
+    readonly signal?: AbortSignal | undefined;
+    /** Progress callback for WebSocket projection. */
+    readonly onProgress?: ((phase: string, completed: number, total: number) => void) | undefined;
+    /**
+     * LLM interpretation stage. Omit it and `analyze()` stays a purely
+     * deterministic tool — research is strictly additive enrichment.
+     *
+     * @see docs/specs/techstack-sdd.md §31
+     */
+    readonly researcher?: TechStackResearcher | undefined;
+    /** Cap on packages sent to research. Defaults to `DEFAULT_TRIAGE_LIMIT`. */
+    readonly researchLimit?: number | undefined;
+}
+export declare class TechStackEngine {
+    private store;
+    constructor(store: TechStackStore);
+    /**
+     * Run an offline inventory: discover workspaces and parse dependencies
+     * from manifests and lockfiles. No network calls.
+     *
+     * Returns a Snapshot with workspace and dependency data but no
+     * registry/advisory enrichment.
+     */
+    inventory(projectId: string, targetRoot: string, _jobId?: string, onProgress?: (phase: string, completed: number, total: number) => void): Promise<Snapshot>;
+    /**
+     * Enrich a snapshot with registry metadata and advisory data.
+     *
+     * This is the online pass: fetches latest versions, licenses, deprecation
+     * status from registries, and queries OSV for advisories.
+     *
+     * Key contracts:
+     * - 404/401 → status `private_or_unresolved` (never `dead` or `deprecated`)
+     * - Network failure → status `unknown` with evidence detail (never `current`)
+     */
+    enrich(snapshot: Snapshot, options?: EnrichOptions): Promise<Snapshot>;
+    /**
+     * Interpret an enriched snapshot with the LLM: triage the problem cases,
+     * research them, and append the resulting findings.
+     *
+     * Additive by construction. Two invariants hold here, and they are the whole
+     * reason this is a separate pass rather than part of `enrich()`:
+     *
+     * 1. **`snapshot.dependencies` is returned untouched.** Version facts come
+     *    only from registry evidence — the LLM cannot fabricate a `latestStable`
+     *    because `Finding` has nowhere to put one (SDD §472).
+     * 2. **Failure is not fatal.** No researcher, no candidates, a provider
+     *    outage, a dry web search — every one of them returns the input snapshot
+     *    unchanged. A deterministic report is the floor, never a casualty of the
+     *    optional stage above it.
+     *
+     * @see docs/specs/techstack-sdd.md §31, §472
+     */
+    research(snapshot: Snapshot, options?: {
+        researcher?: TechStackResearcher | undefined;
+        researchLimit?: number | undefined;
+        signal?: AbortSignal | undefined;
+        /** Only ever emits the two research phases — narrow so callers can feed
+         * `updateJob` without casting. */
+        onProgress?: ((phase: 'researching' | 'synthesizing', completed: number, total: number) => void) | undefined;
+    }): Promise<Snapshot>;
+    /**
+     * Run a full analysis: inventory + enrich + research + persist.
+     * This is the main entry point for the analyze job flow.
+     */
+    analyze(projectId: string, options: AnalyzeOptions): Promise<{
+        snapshot: Snapshot;
+        job: TechStackJob;
+    }>;
+    /**
+     * Generate a human-readable report from a snapshot.
+     *
+     * @param format 'md' for Markdown, 'json' for raw JSON.
+     * @returns The report as a string.
+     */
+    generateReport(snapshot: Snapshot, format?: 'md' | 'json'): string;
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAMV,QAAQ,EACR,YAAY,EAIb,MAAM,YAAY,CAAC;AAOpB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGxD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAI/D,MAAM,WAAW,aAAa;IAC5B,wDAAwD;IACxD,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACtC,qCAAqC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAC1C,mDAAmD;IACnD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACrD;AAED,MAAM,WAAW,cAAc;IAC7B,mCAAmC;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,mCAAmC;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,yBAAyB;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,sDAAsD;IACtD,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACtC,yCAAyC;IACzC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3C,oFAAoF;IACpF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,6CAA6C;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAC1C,kDAAkD;IAClD,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IAC9F;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACtD,4EAA4E;IAC5E,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C;AA2CD,qBAAa,eAAe;IAC1B,OAAO,CAAC,KAAK,CAAiB;IAE9B,YAAY,KAAK,EAAE,cAAc,EAEhC;IAID;;;;;;OAMG;IACG,SAAS,CACb,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,GACrE,OAAO,CAAC,QAAQ,CAAC,CAqEnB;IAID;;;;;;;;;OASG;IACG,MAAM,CACV,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,aAAkB,GAC1B,OAAO,CAAC,QAAQ,CAAC,CAwJnB;IAID;;;;;;;;;;;;;;;;OAgBG;IACG,QAAQ,CACZ,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE;QACP,UAAU,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;QAC7C,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACnC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;QACjC;0CACkC;QAClC,UAAU,CAAC,EACP,CAAC,CAAC,KAAK,EAAE,aAAa,GAAG,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC,GACnF,SAAS,CAAC;KACV,GACL,OAAO,CAAC,QAAQ,CAAC,CA8BnB;IAID;;;OAGG;IACG,OAAO,CACX,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC;QAAE,QAAQ,EAAE,QAAQ,CAAC;QAAC,GAAG,EAAE,YAAY,CAAA;KAAE,CAAC,CA0FpD;IAGD;;;;;OAKG;IACH,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,GAAE,IAAI,GAAG,MAAa,GAAG,MAAM,CAsEvE;CACF"}

package/dist/snapshot-diff.d.ts

@@ -0,0 +1,27 @@
+/**
+ * TechStack — Snapshot diff utility.
+ *
+ * Compares two snapshots to identify added, removed, and changed dependencies.
+ *
+ * @see docs/specs/techstack-sdd.md §9
+ */
+import type { DependencyObservation, Snapshot } from './types.js';
+export interface SnapshotDiff {
+    added: DependencyObservation[];
+    removed: DependencyObservation[];
+    changed: Array<{
+        name: string;
+        ecosystem: string;
+        field: string;
+        from: string;
+        to: string;
+    }>;
+}
+/**
+ * Compare two snapshots by dependency name + ecosystem.
+ *
+ * Returns added (in new but not old), removed (in old but not new), and
+ * changed (version/status differences for matching dependencies).
+ */
+export declare function diffSnapshots(oldSnapshot: Snapshot, newSnapshot: Snapshot): SnapshotDiff;
+//# sourceMappingURL=snapshot-diff.d.ts.map

package/dist/snapshot-diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"snapshot-diff.d.ts","sourceRoot":"","sources":["../src/snapshot-diff.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAElE,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,qBAAqB,EAAE,CAAC;IAC/B,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACjC,OAAO,EAAE,KAAK,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC,CAAC;CACJ;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,GAAG,YAAY,CAgDxF"}

package/dist/store/schema.d.ts

@@ -0,0 +1,20 @@
+/**
+ * TechStack — SQLite schema (DDL) and migration helpers.
+ *
+ * Defines the tables for snapshots, jobs, and the delivery outbox.
+ * Uses `node:sqlite` (built-in since Node 22.5+).
+ *
+ * Tables:
+ *   - snapshots:     persisted inventory snapshots
+ *   - jobs:          async inventory/analyze job state
+ *   - outbox:        idle-delivery tracking
+ *
+ * @see docs/specs/techstack-sdd.md §3.2, §4.1
+ */
+export declare const SCHEMA_VERSION = 1;
+export declare const DDL = "\nCREATE TABLE IF NOT EXISTS techstack_schema_version (\n  version INTEGER NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS snapshots (\n  id TEXT PRIMARY KEY,\n  project_id TEXT NOT NULL,\n  target_root TEXT NOT NULL,\n  fingerprint TEXT NOT NULL,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  raw_json TEXT NOT NULL,\n  adapter_version TEXT NOT NULL DEFAULT ''\n);\n\nCREATE INDEX IF NOT EXISTS idx_snapshots_project_id ON snapshots(project_id);\nCREATE INDEX IF NOT EXISTS idx_snapshots_created_at ON snapshots(created_at DESC);\n\nCREATE TABLE IF NOT EXISTS jobs (\n  id TEXT PRIMARY KEY,\n  project_id TEXT NOT NULL,\n  target_root TEXT NOT NULL,\n  kind TEXT NOT NULL CHECK(kind IN ('inventory', 'analyze')),\n  status TEXT NOT NULL DEFAULT 'queued'\n    CHECK(status IN ('queued','discovering','inventorying','enriching','researching','synthesizing','completed','failed','cancelled')),\n  fingerprint TEXT NOT NULL DEFAULT '',\n  requested_by TEXT NOT NULL DEFAULT '',\n  session_id TEXT,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  completed_at TEXT,\n  error TEXT,\n  progress_json TEXT\n);\n\nCREATE INDEX IF NOT EXISTS idx_jobs_project_id ON jobs(project_id);\nCREATE INDEX IF NOT EXISTS idx_jobs_status ON jobs(status);\n\nCREATE TABLE IF NOT EXISTS outbox (\n  delivery_id TEXT PRIMARY KEY,\n  report_id TEXT NOT NULL,\n  session_id TEXT NOT NULL,\n  status TEXT NOT NULL DEFAULT 'pending'\n    CHECK(status IN ('pending', 'claimed', 'delivered', 'failed')),\n  attempts INTEGER NOT NULL DEFAULT 0,\n  claimed_at TEXT,\n  delivered_at TEXT\n);\n\nCREATE INDEX IF NOT EXISTS idx_outbox_status ON outbox(status);\n";
+/**
+ * Run the schema DDL and check/migrate version.
+ */
+export declare function applySchema(db: import('node:sqlite').DatabaseSync): void;
+//# sourceMappingURL=schema.d.ts.map

package/dist/store/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/store/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,eAAO,MAAM,cAAc,IAAI,CAAC;AAEhC,eAAO,MAAM,GAAG,knDAiDf,CAAC;AAEF;;GAEG;AACH,wBAAgB,WAAW,CAAC,EAAE,EAAE,OAAO,aAAa,EAAE,YAAY,GAAG,IAAI,CAoBxE"}

package/dist/store/sqlite.d.ts

@@ -0,0 +1,57 @@
+/**
+ * TechStack — SQLite-backed store.
+ *
+ * Provides persistence for snapshots, jobs, and the delivery outbox
+ * using Node 22.5+'s built-in `node:sqlite` module.
+ *
+ * Store path: ~/.wrongstack/projects/<slug>/techstack/techstack.db
+ *
+ * @see docs/specs/techstack-sdd.md §3.2, §4.1
+ */
+import type { DeliveryOutbox, DeliveryStatus, Snapshot, TechStackJob, TechStackJobStatus, TechStackJobProgress } from '../types.js';
+export interface StoreOptions {
+    /** Project slug used for the store directory path. */
+    readonly projectSlug: string;
+    /** Optional explicit dbPath override (for testing). */
+    readonly dbPath?: string;
+}
+export declare class TechStackStore {
+    private db;
+    private dbPath;
+    constructor(options: StoreOptions);
+    /** Close the database connection. Idempotent. */
+    close(): void;
+    /** Get the database path (useful for tests). */
+    get path(): string;
+    /** Persist a snapshot. */
+    saveSnapshot(snapshot: Snapshot): void;
+    /** Get a snapshot by project ID (latest). */
+    getSnapshot(projectId: string): Snapshot | undefined;
+    /** Get a snapshot by ID. */
+    getSnapshotById(id: string): Snapshot | undefined;
+    /** List all snapshots for a project (newest first). */
+    listSnapshots(projectId: string, limit?: number): Snapshot[];
+    /** Delete snapshots older than a given timestamp. */
+    deleteSnapshotsBefore(projectId: string, before: string): number;
+    /** Persist a job. */
+    saveJob(job: TechStackJob): void;
+    /** Get a job by ID. */
+    getJob(id: string): TechStackJob | undefined;
+    /** Update job status and optional progress. */
+    updateJobStatus(id: string, status: TechStackJobStatus, progress?: TechStackJobProgress): void;
+    /** List jobs for a project (newest first). */
+    listJobs(projectId: string, limit?: number): TechStackJob[];
+    /** Create an outbox entry. */
+    createOutbox(deliveryId: string, reportId: string, sessionId: string): void;
+    /** Claim an outbox entry (atomic CAS). */
+    claimOutbox(deliveryId: string, sessionId: string): boolean;
+    /** Mark an outbox entry as delivered. */
+    deliverOutbox(deliveryId: string): void;
+    /** Mark an outbox entry as failed. */
+    failOutbox(deliveryId: string): void;
+    /** List outbox entries by status. */
+    listOutboxByStatus(status: DeliveryStatus): DeliveryOutbox[];
+    private rowToJob;
+    private rowToOutbox;
+}
+//# sourceMappingURL=sqlite.d.ts.map

package/dist/store/sqlite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite.d.ts","sourceRoot":"","sources":["../../src/store/sqlite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,OAAO,KAAK,EACV,cAAc,EACd,cAAc,EACd,QAAQ,EACR,YAAY,EACZ,kBAAkB,EAClB,oBAAoB,EACrB,MAAM,aAAa,CAAC;AAIrB,MAAM,WAAW,YAAY;IAC3B,sDAAsD;IACtD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,uDAAuD;IACvD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAID,qBAAa,cAAc;IACzB,OAAO,CAAC,EAAE,CAAe;IACzB,OAAO,CAAC,MAAM,CAAS;IAEvB,YAAY,OAAO,EAAE,YAAY,EAsBhC;IAID,iDAAiD;IACjD,KAAK,IAAI,IAAI,CAMZ;IAED,gDAAgD;IAChD,IAAI,IAAI,IAAI,MAAM,CAEjB;IAID,0BAA0B;IAC1B,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAcrC;IAED,6CAA6C;IAC7C,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAcnD;IAED,4BAA4B;IAC5B,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAWhD;IAED,uDAAuD;IACvD,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,SAAK,GAAG,QAAQ,EAAE,CAiBvD;IAED,qDAAqD;IACrD,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAM/D;IAID,qBAAqB;IACrB,OAAO,CAAC,GAAG,EAAE,YAAY,GAAG,IAAI,CAoB/B;IAED,uBAAuB;IACvB,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAO3C;IAED,+CAA+C;IAC/C,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,QAAQ,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAY7F;IAED,8CAA8C;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,SAAK,GAAG,YAAY,EAAE,CAMtD;IAID,8BAA8B;IAC9B,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAM1E;IAED,0CAA0C;IAC1C,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAQ1D;IAED,yCAAyC;IACzC,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAMtC;IAED,sCAAsC;IACtC,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAKnC;IAED,qCAAqC;IACrC,kBAAkB,CAAC,MAAM,EAAE,cAAc,GAAG,cAAc,EAAE,CAM3D;IAID,OAAO,CAAC,QAAQ;IA0BhB,OAAO,CAAC,WAAW;CAWpB"}

package/dist/types.d.ts

@@ -0,0 +1,123 @@
+/**
+ * TechStack — Core domain types.
+ *
+ * These types define the entire data contract for the TechStack feature:
+ * workspace discovery, dependency inventory, registry/advisory enrichment,
+ * findings, snapshots, jobs, and the idle-delivery outbox.
+ *
+ * @see docs/specs/techstack-sdd.md §4.1
+ */
+export type EcosystemId = 'npm' | 'python' | 'rust' | 'go' | 'dotnet' | 'php' | 'dart' | 'maven' | 'gradle' | 'ruby' | 'swift' | 'elixir' | 'cpp';
+export type SourceType = 'registry' | 'workspace' | 'path' | 'git' | 'system' | 'unknown';
+export type DependencyScope = 'runtime' | 'development' | 'peer' | 'build' | 'optional' | 'transitive';
+export type DependencyStatus = 'current' | 'update_available_safe' | 'update_available_breaking' | 'blocked_by_constraints' | 'vulnerable' | 'deprecated' | 'yanked' | 'unmaintained_suspected' | 'private_or_unresolved' | 'local_path' | 'git_dependency' | 'unsupported' | 'unknown';
+export type Coverage = 'full' | 'partial' | 'unsupported';
+export interface Evidence {
+    /** What kind of source produced this evidence. */
+    readonly kind: 'manifest' | 'lockfile' | 'registry' | 'audit' | 'osv' | 'agent' | 'command';
+    /** URL, file path, or command that produced the evidence. */
+    readonly source: string;
+    /** ISO 8601 timestamp of when the evidence was retrieved. */
+    readonly retrievedAt: string;
+    /** Additional human-readable context. */
+    readonly detail?: string | undefined;
+}
+export interface Workspace {
+    readonly id: string;
+    /** Path relative to the project root. */
+    readonly relativeRoot: string;
+    readonly ecosystem: EcosystemId;
+    readonly packageManager?: string | undefined;
+    readonly manifests: readonly string[];
+    readonly lockfiles: readonly string[];
+    /** Detection confidence 0..1. */
+    readonly confidence: number;
+    readonly coverage: Coverage;
+}
+export interface DependencyObservation {
+    readonly id: string;
+    readonly workspaceId: string;
+    /** Package URL (PURL) if resolvable; undefined for path/git/system deps. */
+    readonly purl?: string | undefined;
+    readonly ecosystem: EcosystemId;
+    readonly name: string;
+    readonly sourceType: SourceType;
+    readonly direct: boolean;
+    readonly scope: DependencyScope;
+    /** Constraint from the manifest (e.g. "^4.18.0", ">=1.0 <2.0"). */
+    readonly requested?: string | undefined;
+    /** Exact version from the lockfile. */
+    readonly locked?: string | undefined;
+    /** Observed version from the environment (pip inspect, cargo metadata, etc.). */
+    readonly installed?: string | undefined;
+    /** Latest version within the current constraint (npm "wanted"). */
+    readonly wanted?: string | undefined;
+    /** Latest version considering all constraints (npm "resolvable"). */
+    readonly resolvable?: string | undefined;
+    /** Latest stable version from the registry. */
+    readonly latestStable?: string | undefined;
+    /** SPDX identifier or license name from the registry. */
+    readonly license?: string | undefined;
+    readonly deprecated?: boolean | undefined;
+    readonly yanked?: boolean | undefined;
+    readonly status: DependencyStatus;
+    readonly evidence: readonly Evidence[];
+}
+export interface Finding {
+    readonly id: string;
+    readonly dependencyId: string;
+    readonly type: 'upgrade' | 'vulnerability' | 'deprecated' | 'license' | 'replacement' | 'unsupported' | 'investigate';
+    readonly severity: 'info' | 'low' | 'medium' | 'high' | 'critical';
+    readonly action: 'none' | 'upgrade_patch' | 'upgrade_minor' | 'upgrade_major' | 'replace' | 'remove' | 'investigate';
+    /** Confidence 0..1 — deterministic findings are 1.0; agent-derived <1.0. */
+    readonly confidence: number;
+    readonly rationale: string;
+    readonly breakingRisk?: string | undefined;
+    readonly evidence: readonly Evidence[];
+}
+export interface Snapshot {
+    readonly id: string;
+    readonly projectId: string;
+    readonly targetRoot: string;
+    /** Hash of manifest+lockfile contents + adapter version — used for dedup. */
+    readonly fingerprint: string;
+    readonly createdAt: string;
+    readonly workspaces: readonly Workspace[];
+    readonly dependencies: readonly DependencyObservation[];
+    readonly findings: readonly Finding[];
+    readonly coverage: Coverage;
+    /** Version of the adapter set that produced this snapshot. */
+    readonly adapterVersion: string;
+}
+export type TechStackJobKind = 'inventory' | 'analyze';
+export type TechStackJobStatus = 'queued' | 'discovering' | 'inventorying' | 'enriching' | 'researching' | 'synthesizing' | 'completed' | 'failed' | 'cancelled';
+export interface TechStackJobProgress {
+    readonly phase: string;
+    readonly completed: number;
+    readonly total: number;
+}
+export interface TechStackJob {
+    readonly id: string;
+    readonly projectId: string;
+    readonly targetRoot: string;
+    readonly kind: TechStackJobKind;
+    readonly status: TechStackJobStatus;
+    readonly fingerprint: string;
+    readonly requestedBy: string;
+    readonly sessionId?: string | undefined;
+    readonly createdAt: string;
+    readonly completedAt?: string | undefined;
+    readonly error?: string | undefined;
+    readonly progress?: TechStackJobProgress | undefined;
+}
+export type DeliveryStatus = 'pending' | 'claimed' | 'delivered' | 'failed';
+export interface DeliveryOutbox {
+    readonly deliveryId: string;
+    readonly reportId: string;
+    readonly sessionId: string;
+    readonly status: DeliveryStatus;
+    readonly attempts: number;
+    readonly claimedAt?: string | undefined;
+    readonly deliveredAt?: string | undefined;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,MAAM,MAAM,WAAW,GACnB,KAAK,GACL,QAAQ,GACR,MAAM,GACN,IAAI,GACJ,QAAQ,GACR,KAAK,GACL,MAAM,GACN,OAAO,GACP,QAAQ,GACR,MAAM,GACN,OAAO,GACP,QAAQ,GACR,KAAK,CAAC;AAEV,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE1F,MAAM,MAAM,eAAe,GACvB,SAAS,GACT,aAAa,GACb,MAAM,GACN,OAAO,GACP,UAAU,GACV,YAAY,CAAC;AAEjB,MAAM,MAAM,gBAAgB,GACxB,SAAS,GACT,uBAAuB,GACvB,2BAA2B,GAC3B,wBAAwB,GACxB,YAAY,GACZ,YAAY,GACZ,QAAQ,GACR,wBAAwB,GACxB,uBAAuB,GACvB,YAAY,GACZ,gBAAgB,GAChB,aAAa,GACb,SAAS,CAAC;AAEd,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,aAAa,CAAC;AAI1D,MAAM,WAAW,QAAQ;IACvB,kDAAkD;IAClD,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,OAAO,GAAG,KAAK,GAAG,OAAO,GAAG,SAAS,CAAC;IAC5F,6DAA6D;IAC7D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,6DAA6D;IAC7D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yCAAyC;IACzC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAID,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,yCAAyC;IACzC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC;IAChC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,iCAAiC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;CAC7B;AAID,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,4EAA4E;IAC5E,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,mEAAmE;IACnE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,uCAAuC;IACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,iFAAiF;IACjF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,mEAAmE;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,qEAAqE;IACrE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,+CAA+C;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,yDAAyD;IACzD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,SAAS,QAAQ,EAAE,CAAC;CACxC;AAID,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,EACT,SAAS,GACT,eAAe,GACf,YAAY,GACZ,SAAS,GACT,aAAa,GACb,aAAa,GACb,aAAa,CAAC;IAClB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IACnE,QAAQ,CAAC,MAAM,EACX,MAAM,GACN,eAAe,GACf,eAAe,GACf,eAAe,GACf,SAAS,GACT,QAAQ,GACR,aAAa,CAAC;IAClB,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,SAAS,QAAQ,EAAE,CAAC;CACxC;AAID,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,6EAA6E;IAC7E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,CAAC;IAC1C,QAAQ,CAAC,YAAY,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACxD,QAAQ,CAAC,QAAQ,EAAE,SAAS,OAAO,EAAE,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,8DAA8D;IAC9D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAID,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,SAAS,CAAC;AAEvD,MAAM,MAAM,kBAAkB,GAC1B,QAAQ,GACR,aAAa,GACb,cAAc,GACd,WAAW,GACX,aAAa,GACb,cAAc,GACd,WAAW,GACX,QAAQ,GACR,WAAW,CAAC;AAEhB,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,QAAQ,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;CACtD;AAID,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;AAE5E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C"}

package/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "@wrongstack/techstack",
+  "version": "0.289.0",
+  "license": "MIT",
+  "description": "WrongStack TechStack — cross-language dependency intelligence for the active target project: discover, inventory, enrich, analyze, and report.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/WrongStack/WrongStack.git",
+    "directory": "packages/techstack"
+  },
+  "homepage": "https://github.com/WrongStack/WrongStack#readme",
+  "bugs": "https://github.com/WrongStack/WrongStack/issues",
+  "author": "ECOSTACK TECHNOLOGY OÜ",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "@wrongstack/core": "0.289.0",
+    "@wrongstack/tools": "0.289.0"
+  },
+  "devDependencies": {
+    "@types/node": "^26.0.1",
+    "typescript": "^7.0.2"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "scripts": {
+    "build": "node ../../scripts/build-package.mjs",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\""
+  }
+}