@wrongstack/techstack 0.292.1 → 0.295.0

package/dist/registry/client.d.ts

@@ -31,11 +31,32 @@ export interface HostConcurrency {
  * trip — it was untested, and drifted into flagging most of the ecosystem dead.
  */
 export declare function parseNpmPackument(json: Record<string, unknown>, name: string): RegistryEntry;
+export declare class RegistryNotFoundError extends Error {
+    readonly statusCode: number;
+    readonly packageName: string;
+    constructor(statusCode: number, packageName: string);
+}
+export declare class RegistryAuthError extends Error {
+    readonly statusCode: number;
+    readonly packageName: string;
+    constructor(statusCode: number, packageName: string);
+}
+export declare class RegistryRateLimitError extends Error {
+    readonly statusCode: number;
+    readonly host: string;
+    constructor(statusCode: number, host: string);
+}
+export declare class RegistryNetworkError extends Error {
+    readonly cause?: Error | undefined;
+    constructor(message: string, cause?: Error | undefined);
+}
 export interface RegistryLookupOptions {
     /** Abort signal for cancellation. */
     readonly signal?: AbortSignal | undefined;
     /** Bypass cache and force a fresh lookup. */
     readonly force?: boolean | undefined;
+    /** Throw classified 401/403/404 errors instead of the compatibility `undefined`. */
+    readonly strictErrors?: boolean | undefined;
 }
 /**
  * Look up registry metadata for a package in a given ecosystem.
@@ -58,4 +79,6 @@ export declare function supportedRegistryEcosystems(): string[];
  * Useful for testing and when force-refreshing.
  */
 export declare function clearRegistryCache(): void;
+/** Invalidate one ecosystem batch without evicting unrelated registry data. */
+export declare function invalidateRegistryCache(ecosystem: string, names?: readonly string[]): number;
 //# sourceMappingURL=client.d.ts.map

package/dist/registry/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/registry/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;CACnC;AA8JD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,CA0B5F;AAgKD,MAAM,WAAW,qBAAqB;IACpC,qCAAqC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAC1C,6CAA6C;IAC7C,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACtC;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAiFpC;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,GAAG,SAAS,CAAC,CAAC,CAoBjD;AAED;;GAEG;AACH,wBAAgB,2BAA2B,IAAI,MAAM,EAAE,CAEtD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAGzC"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/registry/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;CACnC;AAmFD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,CA0B5F;AAgKD,qBAAa,qBAAsB,SAAQ,KAAK;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM;IAAE,QAAQ,CAAC,WAAW,EAAE,MAAM;IAArE,YAAqB,UAAU,EAAE,MAAM,EAAW,WAAW,EAAE,MAAM,EAGpE;CACF;AAED,qBAAa,iBAAkB,SAAQ,KAAK;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM;IAAE,QAAQ,CAAC,WAAW,EAAE,MAAM;IAArE,YAAqB,UAAU,EAAE,MAAM,EAAW,WAAW,EAAE,MAAM,EAGpE;CACF;AAED,qBAAa,sBAAuB,SAAQ,KAAK;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM;IAA9D,YAAqB,UAAU,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM,EAG7D;CACF;AAED,qBAAa,oBAAqB,SAAQ,KAAK;aACE,KAAK,CAAC,EAAE,KAAK,GAAG,SAAS;IAAxE,YAAY,OAAO,EAAE,MAAM,EAAoB,KAAK,CAAC,EAAE,KAAK,GAAG,SAAS,EAGvE;CACF;AAED,MAAM,WAAW,qBAAqB;IACpC,qCAAqC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAC1C,6CAA6C;IAC7C,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACrC,oFAAoF;IACpF,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC7C;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAyEpC;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,GAAG,SAAS,CAAC,CAAC,CAoBjD;AAED;;GAEG;AACH,wBAAgB,2BAA2B,IAAI,MAAM,EAAE,CAEtD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAGzC;AAED,+EAA+E;AAC/E,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAW5F"}

package/dist/registry/http-fetch.d.ts

@@ -0,0 +1,22 @@
+/** Shared dependency-service HTTP transport with cancellation and bounded retry. */
+import type { IncomingHttpHeaders } from 'node:http';
+export interface HttpResponse {
+    readonly statusCode: number;
+    readonly headers: IncomingHttpHeaders;
+    readonly body: string;
+}
+export interface HttpRequestOptions {
+    readonly hostname: string;
+    readonly path: string;
+    readonly method?: 'GET' | 'POST' | undefined;
+    readonly headers?: Readonly<Record<string, string>> | undefined;
+    readonly body?: string | undefined;
+    readonly signal?: AbortSignal | undefined;
+    readonly timeoutMs?: number | undefined;
+    readonly maxAttempts?: number | undefined;
+    readonly baseBackoffMs?: number | undefined;
+}
+export declare function retryAfterMs(headers: IncomingHttpHeaders, now?: number): number | undefined;
+export declare function requestWithRetry(options: HttpRequestOptions): Promise<HttpResponse>;
+export declare function parseJsonResponse<T>(response: HttpResponse, source: string): T;
+//# sourceMappingURL=http-fetch.d.ts.map

package/dist/registry/http-fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-fetch.d.ts","sourceRoot":"","sources":["../../src/registry/http-fetch.ts"],"names":[],"mappings":"AAAA,oFAAoF;AAGpF,OAAO,KAAK,EAAE,mBAAmB,EAAmC,MAAM,WAAW,CAAC;AAGtF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC;IAChE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,mBAAmB,EAAE,GAAG,SAAa,GAAG,MAAM,GAAG,SAAS,CAO/F;AAgDD,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,YAAY,CAAC,CAoBzF;AAED,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC,CAM9E"}

package/dist/remediation.d.ts

@@ -7,6 +7,7 @@
  *
  * @see docs/specs/techstack-sdd.md §2 (R25), §9
  */
+import type { LanguagePackageInput } from '@wrongstack/tools';
 import type { Finding, Snapshot } from './types.js';
 export interface UpgradePlanItem {
     readonly dependencyName: string;
@@ -36,6 +37,35 @@ export interface UpgradePlan {
     };
     readonly warning: string;
 }
+export interface PackageOperation {
+    readonly ecosystem: string;
+    readonly workspaceId: string;
+    readonly dependencyName: string;
+    readonly action: UpgradePlanItem['action'];
+    readonly targetVersion?: string | undefined;
+}
+/** Convert a remediation item into the structured safe package-tool input. */
+export declare function toLanguagePackageInput(operation: PackageOperation, workspace?: string): LanguagePackageInput;
+export type PackageOperationExecutor = (operation: PackageOperation) => Promise<{
+    readonly detail?: string | undefined;
+} | void>;
+export interface ApplyPlanOptions {
+    /** Defaults to true. Set false only after explicit user approval. */
+    readonly dryRun?: boolean | undefined;
+    /** Permission gate evaluated independently for every plan item. */
+    readonly approve?: ((item: UpgradePlanItem, index: number) => boolean | Promise<boolean>) | undefined;
+    /** Structured language-package executor; shell command strings are never run here. */
+    readonly execute?: PackageOperationExecutor | undefined;
+    readonly signal?: AbortSignal | undefined;
+}
+export interface ApplyPlanResult {
+    readonly dryRun: boolean;
+    readonly items: ReadonlyArray<{
+        readonly dependencyName: string;
+        readonly status: 'planned' | 'skipped' | 'applied' | 'failed';
+        readonly detail?: string | undefined;
+    }>;
+}
 /**
  * Generate a dry-run upgrade plan from a snapshot.
  *
@@ -51,4 +81,9 @@ export declare function generateUpgradePlan(snapshot: Snapshot): UpgradePlan;
  * Render an upgrade plan as Markdown for the report endpoint or CLI display.
  */
 export declare function renderPlanMarkdown(plan: UpgradePlan): string;
+/**
+ * Apply explicitly approved remediation items through a structured,
+ * permission-gated package executor. The safe default is a dry run.
+ */
+export declare function applyPlan(plan: UpgradePlan, options?: ApplyPlanOptions): Promise<ApplyPlanResult>;
 //# sourceMappingURL=remediation.d.ts.map

package/dist/remediation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remediation.d.ts","sourceRoot":"","sources":["../src/remediation.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAyB,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,qEAAqE;IACrE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/C;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,SAAS,eAAe,EAAE,CAAC;IAC3C,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B,CAAC;IACF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAsCD;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,GAAG,WAAW,CA4DnE;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAoD5D"}
+{"version":3,"file":"remediation.d.ts","sourceRoot":"","sources":["../src/remediation.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAqB,MAAM,mBAAmB,CAAC;AACjF,OAAO,KAAK,EAAyB,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IACvC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,qEAAqE;IACrE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/C;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,SAAS,eAAe,EAAE,CAAC;IAC3C,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B,CAAC;IACF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC3C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C;AAyBD,8EAA8E;AAC9E,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,gBAAgB,EAC3B,SAAS,CAAC,EAAE,MAAM,GACjB,oBAAoB,CAoBtB;AAED,MAAM,MAAM,wBAAwB,GAAG,CACrC,SAAS,EAAE,gBAAgB,KACxB,OAAO,CAAC;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GAAG,IAAI,CAAC,CAAC;AAE9D,MAAM,WAAW,gBAAgB;IAC/B,qEAAqE;IACrE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACtC,mEAAmE;IACnE,QAAQ,CAAC,OAAO,CAAC,EACb,CAAC,CAAC,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,GACtE,SAAS,CAAC;IACd,sFAAsF;IACtF,QAAQ,CAAC,OAAO,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IACxD,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;CAC3C;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;QAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QAChC,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;QAC9D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;KACtC,CAAC,CAAC;CACJ;AAsCD;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,GAAG,WAAW,CA4DnE;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAyD5D;AAED;;;GAGG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,WAAW,EACjB,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,eAAe,CAAC,CA2C1B"}

package/dist/research/llm.d.ts

@@ -9,7 +9,7 @@
  *
  * @see docs/specs/techstack-sdd.md §4.2
  */
-import type { Provider } from '@wrongstack/core';
+import type { Provider } from '@wrongstack/core/types';
 import type { ResearchLlm } from './types.js';
 /** How the caller reaches a live provider. A getter, not a captured value —
  * the user can switch model or rotate credentials mid-session, and a snapshot

package/dist/research/llm.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"llm.d.ts","sourceRoot":"","sources":["../../src/research/llm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAW,MAAM,kBAAkB,CAAC;AAC1D,OAAO,KAAK,EAAE,WAAW,EAAsB,MAAM,YAAY,CAAC;AAElE;;8CAE8C;AAC9C,MAAM,MAAM,WAAW,GAAG,MAAM;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC;AAIlF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,WAAW,EACrB,OAAO,GAAE;IAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAO,GACxD,WAAW,GAAG,SAAS,CAgDzB;AA2BD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAU9E"}
+{"version":3,"file":"llm.d.ts","sourceRoot":"","sources":["../../src/research/llm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAW,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,WAAW,EAAsB,MAAM,YAAY,CAAC;AAElE;;8CAE8C;AAC9C,MAAM,MAAM,WAAW,GAAG,MAAM;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC;AAIlF;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,WAAW,EACrB,OAAO,GAAE;IAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAO,GACxD,WAAW,GAAG,SAAS,CAgDzB;AA2BD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAU9E"}

package/dist/research/triage.d.ts

@@ -1,13 +1,7 @@
 /**
  * TechStack — Deterministic research triage.
  *
- * Decides *which* dependencies are worth an LLM call. No LLM, no network.
- *
- * This is the stage that makes research affordable: a monorepo resolves
- * thousands of dependencies, the overwhelming majority of which are `current`
- * and need no interpretation at all. Only statuses where the registry has
- * already told us something is wrong — but not what to do about it — earn a
- * research slot.
+ * Decides which dependencies are worth an LLM call. No LLM, no network.
  *
  * @see docs/specs/techstack-sdd.md §31, §557
  */
@@ -19,14 +13,7 @@ export interface TriageOptions {
     /** Max candidates returned. Defaults to {@link DEFAULT_TRIAGE_LIMIT}. */
     readonly limit?: number | undefined;
 }
-/**
- * Select and rank the dependencies worth researching.
- *
- * Ordering is fully deterministic — priority, then name, then version — so the
- * same snapshot always triages identically. Ties resolve by name rather than
- * by input order because adapter output order is not itself guaranteed stable
- * across platforms, and a wobbling triage would make the cap non-reproducible.
- */
+/** Select and rank the dependencies worth researching. */
 export declare function triageCandidates(dependencies: readonly DependencyObservation[], options?: TriageOptions): readonly TriageCandidate[];
 /** Group triaged candidates by cluster, preserving triage order within each. */
 export declare function clusterCandidates(candidates: readonly TriageCandidate[]): ReadonlyMap<ResearchCluster, readonly TriageCandidate[]>;

package/dist/research/triage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"triage.d.ts","sourceRoot":"","sources":["../../src/research/triage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAoB,MAAM,aAAa,CAAC;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEnE,wEAAwE;AACxE,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAsDvC,MAAM,WAAW,aAAa;IAC5B,yEAAyE;IACzE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,SAAS,qBAAqB,EAAE,EAC9C,OAAO,GAAE,aAAkB,GAC1B,SAAS,eAAe,EAAE,CAoC5B;AAED,gFAAgF;AAChF,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,SAAS,eAAe,EAAE,GACrC,WAAW,CAAC,eAAe,EAAE,SAAS,eAAe,EAAE,CAAC,CAQ1D"}
+{"version":3,"file":"triage.d.ts","sourceRoot":"","sources":["../../src/research/triage.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAoB,MAAM,aAAa,CAAC;AAC3E,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEnE,wEAAwE;AACxE,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAqCvC,MAAM,WAAW,aAAa;IAC5B,yEAAyE;IACzE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED,0DAA0D;AAC1D,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,SAAS,qBAAqB,EAAE,EAC9C,OAAO,GAAE,aAAkB,GAC1B,SAAS,eAAe,EAAE,CAgC5B;AAED,gFAAgF;AAChF,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,SAAS,eAAe,EAAE,GACrC,WAAW,CAAC,eAAe,EAAE,SAAS,eAAe,EAAE,CAAC,CAQ1D"}

package/dist/service/enrich-phase.d.ts

@@ -0,0 +1,8 @@
+import type { Snapshot } from '../types.js';
+export interface EnrichOptions {
+    readonly online?: boolean | undefined;
+    readonly signal?: AbortSignal | undefined;
+    readonly forceRegistryRefresh?: boolean | undefined;
+}
+export declare function runEnrichPhase(snapshot: Snapshot, options?: EnrichOptions): Promise<Snapshot>;
+//# sourceMappingURL=enrich-phase.d.ts.map

package/dist/service/enrich-phase.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enrich-phase.d.ts","sourceRoot":"","sources":["../../src/service/enrich-phase.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAyD,QAAQ,EAAE,MAAM,aAAa,CAAC;AAGnG,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACrD;AAED,wBAAsB,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAkEvG"}

package/dist/service/finding-factory.d.ts

@@ -0,0 +1,4 @@
+import type { DependencyObservation, Finding } from '../types.js';
+export declare function computeDependencyFingerprint(dependencies: readonly DependencyObservation[]): string;
+export declare function createFindingForStatus(dependencyId: string, status: string): Finding;
+//# sourceMappingURL=finding-factory.d.ts.map

package/dist/service/finding-factory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"finding-factory.d.ts","sourceRoot":"","sources":["../../src/service/finding-factory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAElE,wBAAgB,4BAA4B,CAAC,YAAY,EAAE,SAAS,qBAAqB,EAAE,GAAG,MAAM,CAWnG;AAED,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAUpF"}

package/dist/service/inventory-phase.d.ts

@@ -0,0 +1,9 @@
+import type { InventoryOptions } from '../adapters/interface.js';
+import type { TechStackStore } from '../store/sqlite.js';
+import type { Snapshot } from '../types.js';
+export declare const ADAPTER_VERSION = "0.1.0";
+export interface InventoryPhaseOptions extends InventoryOptions {
+    readonly onProgress?: ((phase: string, completed: number, total: number) => void) | undefined;
+}
+export declare function runInventoryPhase(store: TechStackStore, projectId: string, targetRoot: string, options?: InventoryPhaseOptions): Promise<Snapshot>;
+//# sourceMappingURL=inventory-phase.d.ts.map

package/dist/service/inventory-phase.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inventory-phase.d.ts","sourceRoot":"","sources":["../../src/service/inventory-phase.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAoB,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAenF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAgD,QAAQ,EAAE,MAAM,aAAa,CAAC;AAG1F,eAAO,MAAM,eAAe,UAAU,CAAC;AAQvC,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC7D,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CAC/F;AAED,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,cAAc,EACrB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,QAAQ,CAAC,CA6BnB"}

package/dist/service/report-generator.d.ts

@@ -0,0 +1,3 @@
+import type { Snapshot } from '../types.js';
+export declare function generateReport(snapshot: Snapshot, format?: 'md' | 'json'): string;
+//# sourceMappingURL=report-generator.d.ts.map

package/dist/service/report-generator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"report-generator.d.ts","sourceRoot":"","sources":["../../src/service/report-generator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAE5C,wBAAgB,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,GAAE,IAAI,GAAG,MAAa,GAAG,MAAM,CAsCvF"}

package/dist/service/research-phase.d.ts

@@ -0,0 +1,10 @@
+import type { TechStackResearcher } from '../research/types.js';
+import type { Snapshot } from '../types.js';
+export interface ResearchPhaseOptions {
+    readonly researcher?: TechStackResearcher | undefined;
+    readonly researchLimit?: number | undefined;
+    readonly signal?: AbortSignal | undefined;
+    readonly onProgress?: ((phase: 'researching' | 'synthesizing', completed: number, total: number) => void) | undefined;
+}
+export declare function runResearchPhase(snapshot: Snapshot, options?: ResearchPhaseOptions): Promise<Snapshot>;
+//# sourceMappingURL=research-phase.d.ts.map

package/dist/service/research-phase.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"research-phase.d.ts","sourceRoot":"","sources":["../../src/service/research-phase.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,KAAK,EAAW,QAAQ,EAAE,MAAM,aAAa,CAAC;AAErD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACtD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,aAAa,GAAG,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CACvH;AAED,wBAAsB,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAgBhH"}

package/dist/service/techstack-engine.d.ts

@@ -0,0 +1,33 @@
+import type { InventoryOptions } from '../adapters/interface.js';
+import type { TechStackResearcher } from '../research/types.js';
+import type { TechStackStore } from '../store/sqlite.js';
+import type { Snapshot, TechStackJob } from '../types.js';
+import { type EnrichOptions } from './enrich-phase.js';
+import { type ResearchPhaseOptions } from './research-phase.js';
+export type { EnrichOptions } from './enrich-phase.js';
+export interface AnalyzeOptions {
+    readonly targetRoot: string;
+    readonly sessionId?: string | undefined;
+    readonly requestedBy?: string | undefined;
+    readonly online?: boolean | undefined;
+    readonly autoDeliver?: boolean | undefined;
+    readonly jobId?: string | undefined;
+    readonly signal?: AbortSignal | undefined;
+    readonly onProgress?: ((phase: string, completed: number, total: number) => void) | undefined;
+    readonly researcher?: TechStackResearcher | undefined;
+    readonly researchLimit?: number | undefined;
+    readonly includeTransitive?: boolean | undefined;
+}
+export declare class TechStackEngine {
+    private readonly store;
+    constructor(store: TechStackStore);
+    inventory(projectId: string, targetRoot: string, _jobId?: string, onProgress?: (phase: string, completed: number, total: number) => void, options?: InventoryOptions): Promise<Snapshot>;
+    enrich(snapshot: Snapshot, options?: EnrichOptions): Promise<Snapshot>;
+    research(snapshot: Snapshot, options?: ResearchPhaseOptions): Promise<Snapshot>;
+    generateReport(snapshot: Snapshot, format?: 'md' | 'json'): string;
+    analyze(projectId: string, options: AnalyzeOptions): Promise<{
+        snapshot: Snapshot;
+        job: TechStackJob;
+    }>;
+}
+//# sourceMappingURL=techstack-engine.d.ts.map

package/dist/service/techstack-engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"techstack-engine.d.ts","sourceRoot":"","sources":["../../src/service/techstack-engine.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAA4C,MAAM,aAAa,CAAC;AACpG,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGvE,OAAO,EAAoB,KAAK,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAElF,YAAY,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IAC9F,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACtD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAClD;AAED,qBAAa,eAAe;IACd,OAAO,CAAC,QAAQ,CAAC,KAAK;IAAlC,YAA6B,KAAK,EAAE,cAAc,EAAI;IAEtD,SAAS,CACP,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,EACtE,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,QAAQ,CAAC,CAEnB;IAED,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAEzE;IAED,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,GAAE,oBAAyB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAElF;IAED,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,GAAE,IAAI,GAAG,MAAa,GAAG,MAAM,CAEvE;IAEK,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,QAAQ,CAAC;QAAC,GAAG,EAAE,YAAY,CAAA;KAAE,CAAC,CAwC5G;CACF"}

package/dist/service.d.ts

@@ -1,110 +1,9 @@
 /**
- * TechStack — Public service API.
+ * Backward-compatible service entry point.
  *
- * Wires together inventory, online enrichment (registry + OSV + native audit),
- * status classification, and persistence into a single async job flow.
- *
- * @see docs/specs/techstack-sdd.md §4.2
+ * The engine implementation is split by pipeline responsibility under
+ * `service/`; existing imports from `service.js` remain stable.
  */
-import type { Snapshot, TechStackJob } from './types.js';
-import type { TechStackStore } from './store/sqlite.js';
-import type { TechStackResearcher } from './research/types.js';
-export interface EnrichOptions {
-    /** Skip network calls; use only cached/offline data. */
-    readonly online?: boolean | undefined;
-    /** Abort signal for cancellation. */
-    readonly signal?: AbortSignal | undefined;
-    /** Force re-fetch registry data (ignore cache). */
-    readonly forceRegistryRefresh?: boolean | undefined;
-}
-export interface AnalyzeOptions {
-    /** Where to start the analysis. */
-    readonly targetRoot: string;
-    /** Session ID for job tracking. */
-    readonly sessionId?: string | undefined;
-    /** Requesting entity. */
-    readonly requestedBy?: string | undefined;
-    /** Enable online enrichment (registry + advisory). */
-    readonly online?: boolean | undefined;
-    /** Auto-deliver report when complete. */
-    readonly autoDeliver?: boolean | undefined;
-    /** Optional caller-assigned id so HTTP/WS clients can track the job immediately. */
-    readonly jobId?: string | undefined;
-    /** Abort signal used by cancel endpoints. */
-    readonly signal?: AbortSignal | undefined;
-    /** Progress callback for WebSocket projection. */
-    readonly onProgress?: ((phase: string, completed: number, total: number) => void) | undefined;
-    /**
-     * LLM interpretation stage. Omit it and `analyze()` stays a purely
-     * deterministic tool — research is strictly additive enrichment.
-     *
-     * @see docs/specs/techstack-sdd.md §31
-     */
-    readonly researcher?: TechStackResearcher | undefined;
-    /** Cap on packages sent to research. Defaults to `DEFAULT_TRIAGE_LIMIT`. */
-    readonly researchLimit?: number | undefined;
-}
-export declare class TechStackEngine {
-    private store;
-    constructor(store: TechStackStore);
-    /**
-     * Run an offline inventory: discover workspaces and parse dependencies
-     * from manifests and lockfiles. No network calls.
-     *
-     * Returns a Snapshot with workspace and dependency data but no
-     * registry/advisory enrichment.
-     */
-    inventory(projectId: string, targetRoot: string, _jobId?: string, onProgress?: (phase: string, completed: number, total: number) => void): Promise<Snapshot>;
-    /**
-     * Enrich a snapshot with registry metadata and advisory data.
-     *
-     * This is the online pass: fetches latest versions, licenses, deprecation
-     * status from registries, and queries OSV for advisories.
-     *
-     * Key contracts:
-     * - 404/401 → status `private_or_unresolved` (never `dead` or `deprecated`)
-     * - Network failure → status `unknown` with evidence detail (never `current`)
-     */
-    enrich(snapshot: Snapshot, options?: EnrichOptions): Promise<Snapshot>;
-    /**
-     * Interpret an enriched snapshot with the LLM: triage the problem cases,
-     * research them, and append the resulting findings.
-     *
-     * Additive by construction. Two invariants hold here, and they are the whole
-     * reason this is a separate pass rather than part of `enrich()`:
-     *
-     * 1. **`snapshot.dependencies` is returned untouched.** Version facts come
-     *    only from registry evidence — the LLM cannot fabricate a `latestStable`
-     *    because `Finding` has nowhere to put one (SDD §472).
-     * 2. **Failure is not fatal.** No researcher, no candidates, a provider
-     *    outage, a dry web search — every one of them returns the input snapshot
-     *    unchanged. A deterministic report is the floor, never a casualty of the
-     *    optional stage above it.
-     *
-     * @see docs/specs/techstack-sdd.md §31, §472
-     */
-    research(snapshot: Snapshot, options?: {
-        researcher?: TechStackResearcher | undefined;
-        researchLimit?: number | undefined;
-        signal?: AbortSignal | undefined;
-        /** Only ever emits the two research phases — narrow so callers can feed
-         * `updateJob` without casting. */
-        onProgress?: ((phase: 'researching' | 'synthesizing', completed: number, total: number) => void) | undefined;
-    }): Promise<Snapshot>;
-    /**
-     * Run a full analysis: inventory + enrich + research + persist.
-     * This is the main entry point for the analyze job flow.
-     */
-    analyze(projectId: string, options: AnalyzeOptions): Promise<{
-        snapshot: Snapshot;
-        job: TechStackJob;
-    }>;
-    /**
-     * Generate a human-readable report from a snapshot.
-     *
-     * @param format 'md' for Markdown, 'json' for raw JSON.
-     * @returns The report as a string.
-     */
-    generateReport(snapshot: Snapshot, format?: 'md' | 'json'): string;
-}
+export { TechStackEngine } from './service/techstack-engine.js';
+export type { AnalyzeOptions, EnrichOptions } from './service/techstack-engine.js';
 //# sourceMappingURL=service.d.ts.map

package/dist/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAMV,QAAQ,EACR,YAAY,EAIb,MAAM,YAAY,CAAC;AAOpB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGxD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAI/D,MAAM,WAAW,aAAa;IAC5B,wDAAwD;IACxD,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACtC,qCAAqC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAC1C,mDAAmD;IACnD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACrD;AAED,MAAM,WAAW,cAAc;IAC7B,mCAAmC;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,mCAAmC;IACnC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,yBAAyB;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1C,sDAAsD;IACtD,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACtC,yCAAyC;IACzC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3C,oFAAoF;IACpF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,6CAA6C;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;IAC1C,kDAAkD;IAClD,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IAC9F;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACtD,4EAA4E;IAC5E,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C;AA2CD,qBAAa,eAAe;IAC1B,OAAO,CAAC,KAAK,CAAiB;IAE9B,YAAY,KAAK,EAAE,cAAc,EAEhC;IAID;;;;;;OAMG;IACG,SAAS,CACb,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,GACrE,OAAO,CAAC,QAAQ,CAAC,CAqEnB;IAID;;;;;;;;;OASG;IACG,MAAM,CACV,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,aAAkB,GAC1B,OAAO,CAAC,QAAQ,CAAC,CAwJnB;IAID;;;;;;;;;;;;;;;;OAgBG;IACG,QAAQ,CACZ,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE;QACP,UAAU,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;QAC7C,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QACnC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;QACjC;0CACkC;QAClC,UAAU,CAAC,EACP,CAAC,CAAC,KAAK,EAAE,aAAa,GAAG,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC,GACnF,SAAS,CAAC;KACV,GACL,OAAO,CAAC,QAAQ,CAAC,CA8BnB;IAID;;;OAGG;IACG,OAAO,CACX,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC;QAAE,QAAQ,EAAE,QAAQ,CAAC;QAAC,GAAG,EAAE,YAAY,CAAA;KAAE,CAAC,CA0FpD;IAGD;;;;;OAKG;IACH,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,GAAE,IAAI,GAAG,MAAa,GAAG,MAAM,CAsEvE;CACF"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../src/service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,YAAY,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC"}

package/dist/store/sqlite.d.ts

@@ -18,7 +18,11 @@ export interface StoreOptions {
 export declare class TechStackStore {
     private db;
     private dbPath;
+    /** Compile-once cache for fixed SQL used on hot job/snapshot paths. */
+    private readonly stmtCache;
     constructor(options: StoreOptions);
+    /** Prepare-once helper: compile `sql` on first use, reuse thereafter. */
+    private stmt;
     /** Close the database connection. Idempotent. */
     close(): void;
     /** Get the database path (useful for tests). */

package/dist/store/sqlite.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sqlite.d.ts","sourceRoot":"","sources":["../../src/store/sqlite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAOH,OAAO,KAAK,EACV,cAAc,EACd,cAAc,EACd,QAAQ,EACR,YAAY,EACZ,kBAAkB,EAClB,oBAAoB,EACrB,MAAM,aAAa,CAAC;AAIrB,MAAM,WAAW,YAAY;IAC3B,sDAAsD;IACtD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,uDAAuD;IACvD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAID,qBAAa,cAAc;IACzB,OAAO,CAAC,EAAE,CAAe;IACzB,OAAO,CAAC,MAAM,CAAS;IAEvB,YAAY,OAAO,EAAE,YAAY,EAsBhC;IAID,iDAAiD;IACjD,KAAK,IAAI,IAAI,CAMZ;IAED,gDAAgD;IAChD,IAAI,IAAI,IAAI,MAAM,CAEjB;IAID,0BAA0B;IAC1B,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAcrC;IAED,6CAA6C;IAC7C,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAcnD;IAED,4BAA4B;IAC5B,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAWhD;IAED,uDAAuD;IACvD,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,SAAK,GAAG,QAAQ,EAAE,CAiBvD;IAED,qDAAqD;IACrD,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAM/D;IAID,qBAAqB;IACrB,OAAO,CAAC,GAAG,EAAE,YAAY,GAAG,IAAI,CAoB/B;IAED,uBAAuB;IACvB,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAO3C;IAED,+CAA+C;IAC/C,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,QAAQ,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAY7F;IAED,8CAA8C;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,SAAK,GAAG,YAAY,EAAE,CAMtD;IAID,8BAA8B;IAC9B,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAM1E;IAED,0CAA0C;IAC1C,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAQ1D;IAED,yCAAyC;IACzC,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAMtC;IAED,sCAAsC;IACtC,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAKnC;IAED,qCAAqC;IACrC,kBAAkB,CAAC,MAAM,EAAE,cAAc,GAAG,cAAc,EAAE,CAM3D;IAID,OAAO,CAAC,QAAQ;IA0BhB,OAAO,CAAC,WAAW;CAWpB"}
+{"version":3,"file":"sqlite.d.ts","sourceRoot":"","sources":["../../src/store/sqlite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH,OAAO,KAAK,EACV,cAAc,EACd,cAAc,EACd,QAAQ,EACR,YAAY,EACZ,kBAAkB,EAClB,oBAAoB,EACrB,MAAM,aAAa,CAAC;AAuFrB,MAAM,WAAW,YAAY;IAC3B,sDAAsD;IACtD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,uDAAuD;IACvD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAID,qBAAa,cAAc;IACzB,OAAO,CAAC,EAAE,CAAe;IACzB,OAAO,CAAC,MAAM,CAAS;IACvB,uEAAuE;IACvE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA0D;IAEpF,YAAY,OAAO,EAAE,YAAY,EAqBhC;IAED,yEAAyE;IACzE,OAAO,CAAC,IAAI;IAWZ,iDAAiD;IACjD,KAAK,IAAI,IAAI,CAOZ;IAED,gDAAgD;IAChD,IAAI,IAAI,IAAI,MAAM,CAEjB;IAID,0BAA0B;IAC1B,YAAY,CAAC,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAcrC;IAED,6CAA6C;IAC7C,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAcnD;IAED,4BAA4B;IAC5B,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CAWhD;IAED,uDAAuD;IACvD,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,SAAK,GAAG,QAAQ,EAAE,CAiBvD;IAED,qDAAqD;IACrD,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAM/D;IAID,qBAAqB;IACrB,OAAO,CAAC,GAAG,EAAE,YAAY,GAAG,IAAI,CAoB/B;IAED,uBAAuB;IACvB,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAO3C;IAED,+CAA+C;IAC/C,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,QAAQ,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAY7F;IAED,8CAA8C;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,SAAK,GAAG,YAAY,EAAE,CAMtD;IAID,8BAA8B;IAC9B,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAM1E;IAED,0CAA0C;IAC1C,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAQ1D;IAED,yCAAyC;IACzC,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAMtC;IAED,sCAAsC;IACtC,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAKnC;IAED,qCAAqC;IACrC,kBAAkB,CAAC,MAAM,EAAE,cAAc,GAAG,cAAc,EAAE,CAM3D;IAID,OAAO,CAAC,QAAQ;IA0BhB,OAAO,CAAC,WAAW;CAWpB"}

package/dist/trend.d.ts

@@ -0,0 +1,36 @@
+/** Cross-snapshot dependency health and remediation trend analysis. */
+import type { Snapshot } from './types.js';
+export interface SnapshotSource {
+    listSnapshots(projectId: string, limit?: number): Snapshot[];
+}
+export interface DependencyTrend {
+    readonly key: string;
+    readonly name: string;
+    readonly ecosystem: string;
+    readonly currentVersion?: string | undefined;
+    readonly lockedVersionAgeMs: number;
+    readonly versionChanges: number;
+    readonly upgradeVelocityPerDay: number;
+}
+export interface TrendReport {
+    readonly projectId: string;
+    readonly from?: string | undefined;
+    readonly to?: string | undefined;
+    readonly snapshots: number;
+    readonly dependencies: readonly DependencyTrend[];
+    readonly vulnerabilityHalfLifeMs?: number | undefined;
+    readonly points: ReadonlyArray<{
+        readonly snapshotId: string;
+        readonly createdAt: string;
+        readonly dependencies: number;
+        readonly outdated: number;
+        readonly vulnerable: number;
+    }>;
+}
+export declare class TrendStore {
+    private readonly source;
+    constructor(source: SnapshotSource);
+    analyze(projectId: string, limit?: number): TrendReport;
+}
+export declare function renderTrendMarkdown(report: TrendReport): string;
+//# sourceMappingURL=trend.d.ts.map

package/dist/trend.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trend.d.ts","sourceRoot":"","sources":["../src/trend.ts"],"names":[],"mappings":"AAAA,uEAAuE;AAEvE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,MAAM,WAAW,cAAc;IAC7B,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,QAAQ,EAAE,CAAC;CAC9D;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;CACxC;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,SAAS,eAAe,EAAE,CAAC;IAClD,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtD,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;QAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;KAC7B,CAAC,CAAC;CACJ;AAaD,qBAAa,UAAU;IACT,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAnC,YAA6B,MAAM,EAAE,cAAc,EAAI;IAEvD,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,SAAM,GAAG,WAAW,CAwEnD;CACF;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAQ/D"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/techstack",
-  "version": "0.292.1",
+  "version": "0.295.0",
   "license": "MIT",
   "description": "WrongStack TechStack — cross-language dependency intelligence for the active target project: discover, inventory, enrich, analyze, and report.",
   "repository": {
@@ -25,8 +25,8 @@
     "dist"
   ],
   "dependencies": {
-    "@wrongstack/core": "0.292.1",
-    "@wrongstack/tools": "0.292.1"
+    "@wrongstack/core": "0.295.0",
+    "@wrongstack/tools": "0.295.0"
   },
   "devDependencies": {
     "@types/node": "^26.1.1",