@wrongstack/techstack 0.293.0 → 0.295.1

package/dist/index.js

@@ -81,7 +81,7 @@ function parsePurl(purl) {
   const slashIdx = main.indexOf("/");
   if (slashIdx < 0) return void 0;
   const type = main.slice(0, slashIdx);
-  let remainder = main.slice(slashIdx + 1);
+  const remainder = main.slice(slashIdx + 1);
   let namespace;
   let name;
   const nsSlashIdx = remainder.indexOf("/");
@@ -265,10 +265,12 @@ function coverageForEcosystem(ecosystem) {
 }
 
 // src/adapters/npm.ts
-import { existsSync, readFileSync } from "node:fs";
+import { access as access2, readFile } from "node:fs/promises";
 import { dirname, join, relative, resolve as resolve2 } from "node:path";
 
 // src/adapters/paths.ts
+import { existsSync } from "node:fs";
+import { access } from "node:fs/promises";
 import { resolve } from "node:path";
 function workspaceRoot(workspace, options) {
   const relative2 = workspace.relativeRoot || ".";
@@ -277,9 +279,26 @@ function workspaceRoot(workspace, options) {
 function resolveIn(root, candidate) {
   return resolve(root, candidate);
 }
+function manifestEvidence(path) {
+  return { kind: "manifest", source: path, retrievedAt: (/* @__PURE__ */ new Date()).toISOString() };
+}
+function lockfileEvidence(path) {
+  return { kind: "lockfile", source: path, retrievedAt: (/* @__PURE__ */ new Date()).toISOString() };
+}
+function fileExists(filePath) {
+  return existsSync(filePath);
+}
+async function fileExistsAsync(filePath) {
+  try {
+    await access(filePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
 
 // src/adapters/npm.ts
-function detectLockfile(workspaceDir, stopAt) {
+async function detectLockfile(workspaceDir, stopAt) {
   const candidates = [
     { file: "pnpm-lock.yaml", kind: "pnpm" },
     { file: "package-lock.json", kind: "npm" },
@@ -291,7 +310,11 @@ function detectLockfile(workspaceDir, stopAt) {
   for (; ; ) {
     for (const c of candidates) {
       const candidate = join(dir, c.file);
-      if (existsSync(candidate)) return { kind: c.kind, path: candidate };
+      try {
+        await access2(candidate);
+        return { kind: c.kind, path: candidate };
+      } catch {
+      }
     }
     if (ceiling && dir === ceiling) break;
     const parent = dirname(dir);
@@ -379,19 +402,29 @@ function parseNpmLockVersions(lockContent) {
   }
   return versions;
 }
-function manifestEvidence(path) {
-  return {
-    kind: "manifest",
-    source: path,
-    retrievedAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-}
-function lockfileEvidence(path) {
-  return {
-    kind: "lockfile",
-    source: path,
-    retrievedAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
+function parsePnpmAllVersions(lockContent) {
+  const versions = /* @__PURE__ */ new Map();
+  let inPackages = false;
+  for (const raw of lockContent.split(/\r?\n/)) {
+    if (!/^\s/.test(raw)) {
+      inPackages = raw.startsWith("packages:") || raw.startsWith("snapshots:");
+      continue;
+    }
+    if (!inPackages) continue;
+    const indent = raw.length - raw.trimStart().length;
+    if (indent !== 2) continue;
+    const trimmed = raw.trim();
+    const separator = trimmed.indexOf(":");
+    if (separator < 0) continue;
+    const key = unquote(trimmed.slice(0, separator));
+    const clean = stripPeerSuffix(key);
+    const splitAt = clean.lastIndexOf("@");
+    if (splitAt <= 0) continue;
+    const name = clean.slice(0, splitAt);
+    const version = clean.slice(splitAt + 1);
+    if (name && /^\d/.test(version) && !versions.has(name)) versions.set(name, version);
+  }
+  return versions;
 }
 function scopeForSection(section) {
   switch (section) {
@@ -431,29 +464,32 @@ var NpmAdapter = class {
     let pkg;
     let manifestContent;
     try {
-      manifestContent = readFileSync(manifestPath, "utf-8");
+      manifestContent = await readFile(manifestPath, "utf-8");
       pkg = JSON.parse(manifestContent);
     } catch {
       return [];
     }
     const manifestEv = manifestEvidence(manifestPath);
-    const lockInfo = detectLockfile(root, options.projectRoot);
+    const lockInfo = await detectLockfile(root, options.projectRoot);
     const resolvedVersions = /* @__PURE__ */ new Map();
+    const allLockVersions = /* @__PURE__ */ new Map();
     let lockEv;
     if (lockInfo.kind === "pnpm") {
       try {
-        const lockContent = readFileSync(lockInfo.path, "utf-8");
+        const lockContent = await readFile(lockInfo.path, "utf-8");
         const importerPath = relative(dirname(lockInfo.path), root).split(/[/\\]/).filter(Boolean).join("/") || ".";
         const parsed = parsePnpmImporterVersions(lockContent, importerPath);
         for (const [k, v] of parsed) resolvedVersions.set(k, v);
+        for (const [k, v] of parsePnpmAllVersions(lockContent)) allLockVersions.set(k, v);
         if (parsed.size > 0) lockEv = lockfileEvidence(lockInfo.path);
       } catch {
       }
     } else if (lockInfo.kind === "npm") {
       try {
-        const lockContent = readFileSync(lockInfo.path, "utf-8");
+        const lockContent = await readFile(lockInfo.path, "utf-8");
         const parsed = parseNpmLockVersions(lockContent);
         for (const [k, v] of parsed) resolvedVersions.set(k, v);
+        for (const [k, v] of parsed) allLockVersions.set(k, v);
         lockEv = lockfileEvidence(lockInfo.path);
       } catch {
       }
@@ -494,20 +530,80 @@ var NpmAdapter = class {
         });
       }
     }
+    if (options.includeTransitive && lockEv) {
+      for (const [name, locked] of allLockVersions) {
+        if (seen.has(name)) continue;
+        seen.add(name);
+        observations.push({
+          id: `dep-${workspace.id}-${name}`,
+          workspaceId: workspace.id,
+          purl: buildPurl({ type: "npm", name, version: locked }),
+          ecosystem: "npm",
+          name,
+          sourceType: "registry",
+          direct: false,
+          scope: "transitive",
+          locked,
+          status: "current",
+          evidence: [lockEv]
+        });
+      }
+    }
     return observations;
   }
 };
 var npmAdapter = new NpmAdapter();
 
 // src/adapters/python.ts
-import { readFileSync as readFileSync2 } from "node:fs";
+import { readFile as readFile2 } from "node:fs/promises";
 import { join as join2 } from "node:path";
-function manifestEvidence2(path) {
-  return { kind: "manifest", source: path, retrievedAt: (/* @__PURE__ */ new Date()).toISOString() };
+
+// src/adapters/parse-utils.ts
+function stripInlineComment(line, marker = "#") {
+  let quote;
+  let escaped = false;
+  for (let index = 0; index < line.length; index++) {
+    const character = line.charAt(index);
+    if (escaped) {
+      escaped = false;
+      continue;
+    }
+    if (character === "\\" && quote === '"') {
+      escaped = true;
+      continue;
+    }
+    if (character === '"' || character === "'") {
+      quote = quote === character ? void 0 : quote ?? character;
+      continue;
+    }
+    if (!quote && line.startsWith(marker, index)) return line.slice(0, index).trimEnd();
+  }
+  return line;
 }
-function lockfileEvidence2(path) {
-  return { kind: "lockfile", source: path, retrievedAt: (/* @__PURE__ */ new Date()).toISOString() };
+function parseTomlKeyValue(line) {
+  const cleaned = stripInlineComment(line).trim();
+  const match = /^(?:"([^"]+)"|'([^']+)'|([A-Za-z0-9_.-]+))\s*=\s*(.+)$/.exec(cleaned);
+  if (!match) return void 0;
+  const key = match[1] ?? match[2] ?? match[3];
+  const value = match[4];
+  return key && value ? { key, value: value.trim() } : void 0;
 }
+function parseXmlAttributes(source) {
+  const attributes = /* @__PURE__ */ new Map();
+  const regex = /([A-Za-z_:][\w:.-]*)\s*=\s*(["'])(.*?)\2/g;
+  for (const match of source.matchAll(regex)) {
+    const key = match[1];
+    const value = match[3];
+    if (key !== void 0 && value !== void 0) attributes.set(key, value);
+  }
+  return attributes;
+}
+function xmlTagValue(source, tag) {
+  const escaped = tag.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(`<${escaped}(?:\\s[^>]*)?>\\s*([^<]+?)\\s*</${escaped}>`, "i").exec(source)?.[1]?.trim();
+}
+
+// src/adapters/python.ts
 function parseTomlSections(content) {
   const sections = [];
   let currentSection = "__header__";
@@ -595,6 +691,19 @@ function parsePyprojectDeps(content) {
         }
       }
     }
+    if (section.name === "tool.poetry.dependencies" || section.name.startsWith("tool.poetry.group.")) {
+      const scope = section.name === "tool.poetry.dependencies" ? "runtime" : "development";
+      for (const raw of section.lines) {
+        const entry = parseTomlKeyValue(raw);
+        if (!entry) continue;
+        const name = entry.key;
+        if (!name || name.toLowerCase() === "python") continue;
+        const rawValue = entry.value;
+        const inlineVersion = rawValue.match(/\bversion\s*=\s*["']([^"']+)["']/)?.[1];
+        const stringVersion = rawValue.match(/^["']([^"']+)["']/)?.[1];
+        deps.push({ name, constraint: inlineVersion ?? stringVersion, scope });
+      }
+    }
   }
   return deps;
 }
@@ -631,26 +740,60 @@ function parseRequirementsLockVersions(content) {
     const line = raw.trim();
     if (!line || line.startsWith("#") || line.startsWith("-")) continue;
     const match = line.match(/^([a-zA-Z0-9][a-zA-Z0-9._-]*)\s*==\s*([^\s;]+)/);
-    if (match) versions.set(match[1], match[2]);
+    if (match?.[1] && match[2]) versions.set(normalizePkgName(match[1]), match[2]);
+  }
+  return versions;
+}
+function parsePipfileLock(content) {
+  const versions = /* @__PURE__ */ new Map();
+  try {
+    const json = JSON.parse(content);
+    for (const section of ["default", "develop"]) {
+      for (const [name, entry] of Object.entries(json[section] ?? {})) {
+        if (entry.version?.startsWith("==")) versions.set(normalizePkgName(name), entry.version.slice(2));
+      }
+    }
+  } catch {
+  }
+  return versions;
+}
+function parsePoetryLock(content) {
+  const versions = /* @__PURE__ */ new Map();
+  let currentName;
+  for (const raw of content.split("\n")) {
+    const line = raw.trim();
+    const nameMatch = line.match(/^name\s*=\s*"([^"]+)"/);
+    if (nameMatch) {
+      currentName = nameMatch[1];
+      continue;
+    }
+    const versionMatch = line.match(/^version\s*=\s*"([^"]+)"/);
+    if (versionMatch && currentName) {
+      versions.set(normalizePkgName(currentName), versionMatch[1]);
+      currentName = void 0;
+    }
   }
   return versions;
 }
+function normalizePkgName(name) {
+  return name.toLowerCase().replace(/_/g, "-");
+}
 var PythonAdapter = class {
   ecosystem = "python";
   async inventory(workspace, options) {
     const observations = [];
     const root = workspaceRoot(workspace, options);
     const seen = /* @__PURE__ */ new Set();
-    const hasPyproject = workspace.manifests.some((m) => m.includes("pyproject.toml")) || this.fileExists(join2(root, "pyproject.toml"));
-    const hasRequirements = workspace.manifests.some((m) => m.includes("requirements.txt")) || this.fileExists(join2(root, "requirements.txt"));
-    const hasPipfile = workspace.manifests.some((m) => m.includes("Pipfile")) || this.fileExists(join2(root, "Pipfile"));
-    const lockfilePath = this.detectLockfile(root);
-    let allDeps = [];
+    const hasPyproject = workspace.manifests.some((m) => m.includes("pyproject.toml")) || await fileExistsAsync(join2(root, "pyproject.toml"));
+    const hasRequirements = workspace.manifests.some((m) => m.includes("requirements.txt")) || await fileExistsAsync(join2(root, "requirements.txt"));
+    const hasPipfile = workspace.manifests.some((m) => m.includes("Pipfile")) || await fileExistsAsync(join2(root, "Pipfile"));
+    const lockfilePath = await this.detectLockfile(root);
+    const allDeps = [];
     let pyprojectEv;
     if (hasPyproject) {
       try {
-        const content = readFileSync2(join2(root, "pyproject.toml"), "utf-8");
-        pyprojectEv = manifestEvidence2(join2(root, "pyproject.toml"));
+        const content = await readFile2(join2(root, "pyproject.toml"), "utf-8");
+        pyprojectEv = manifestEvidence(join2(root, "pyproject.toml"));
         const parsed = parsePyprojectDeps(content);
         for (const d of parsed) allDeps.push({ ...d, source: "pyproject.toml" });
       } catch {
@@ -660,8 +803,8 @@ var PythonAdapter = class {
     let requirementsEv;
     if (hasRequirements) {
       try {
-        const content = readFileSync2(join2(root, "requirements.txt"), "utf-8");
-        requirementsEv = manifestEvidence2(join2(root, "requirements.txt"));
+        const content = await readFile2(join2(root, "requirements.txt"), "utf-8");
+        requirementsEv = manifestEvidence(join2(root, "requirements.txt"));
         const parsed = parseRequirementsTxt(content);
         for (const d of parsed) {
           if (!allDeps.some((existing) => existing.name === d.name)) {
@@ -674,8 +817,8 @@ var PythonAdapter = class {
     }
     if (hasPipfile) {
       try {
-        const content = readFileSync2(join2(root, "Pipfile"), "utf-8");
-        if (!pyprojectEv) pyprojectEv = manifestEvidence2(join2(root, "Pipfile"));
+        const content = await readFile2(join2(root, "Pipfile"), "utf-8");
+        if (!pyprojectEv) pyprojectEv = manifestEvidence(join2(root, "Pipfile"));
         const parsed = parsePipfileDeps(content);
         for (const d of parsed) {
           if (!allDeps.some((existing) => existing.name === d.name)) {
@@ -686,10 +829,13 @@ var PythonAdapter = class {
       }
     }
     let lockEv;
+    const lockVersions = new Map(reqLockVersions);
     if (lockfilePath) {
       try {
-        readFileSync2(lockfilePath, "utf-8");
-        lockEv = lockfileEvidence2(lockfilePath);
+        const lockContent = await readFile2(lockfilePath, "utf-8");
+        const parsed = lockfilePath.endsWith("poetry.lock") || lockfilePath.endsWith("uv.lock") ? parsePoetryLock(lockContent) : parsePipfileLock(lockContent);
+        for (const [name, version] of parsed) lockVersions.set(name, version);
+        lockEv = lockfileEvidence(lockfilePath);
       } catch {
       }
     }
@@ -697,7 +843,7 @@ var PythonAdapter = class {
     for (const dep of allDeps) {
       if (seen.has(dep.name)) continue;
       seen.add(dep.name);
-      const locked = reqLockVersions.get(dep.name) || void 0;
+      const locked = lockVersions.get(normalizePkgName(dep.name));
       const isRegistry = !dep.constraint || !dep.constraint.startsWith("file:") && !dep.constraint.startsWith("git+") && !dep.constraint.startsWith("-e");
       const purl = isRegistry && locked ? buildPurl({ type: "python", name: dep.name, version: locked }) : isRegistry ? buildPurl({ type: "python", name: dep.name }) : void 0;
       const evidence = [];
@@ -722,23 +868,31 @@ var PythonAdapter = class {
         evidence
       });
     }
-    return observations;
-  }
-  fileExists(filePath) {
-    try {
-      readFileSync2(filePath, "utf-8");
-      return true;
-    } catch {
-      return false;
+    if (options.includeTransitive && lockEv) {
+      for (const [name, locked] of lockVersions) {
+        if (seen.has(name)) continue;
+        seen.add(name);
+        observations.push({
+          id: `dep-${workspace.id}-${name}`,
+          workspaceId: workspace.id,
+          purl: buildPurl({ type: "python", name, version: locked }),
+          ecosystem: "python",
+          name,
+          sourceType: "registry",
+          direct: false,
+          scope: "transitive",
+          locked,
+          status: "current",
+          evidence: [lockEv]
+        });
+      }
     }
+    return observations;
   }
-  detectLockfile(workspaceRoot2) {
+  async detectLockfile(workspaceRoot2) {
     for (const file of ["Pipfile.lock", "poetry.lock", "uv.lock"]) {
-      try {
-        readFileSync2(join2(workspaceRoot2, file), "utf-8");
-        return join2(workspaceRoot2, file);
-      } catch {
-      }
+      const candidate = join2(workspaceRoot2, file);
+      if (await fileExistsAsync(candidate)) return candidate;
     }
     return void 0;
   }
@@ -746,13 +900,7 @@ var PythonAdapter = class {
 var pythonAdapter = new PythonAdapter();
 
 // src/adapters/rust.ts
-import { readFileSync as readFileSync3 } from "node:fs";
-function manifestEvidence3(path) {
-  return { kind: "manifest", source: path, retrievedAt: (/* @__PURE__ */ new Date()).toISOString() };
-}
-function lockfileEvidence3(path) {
-  return { kind: "lockfile", source: path, retrievedAt: (/* @__PURE__ */ new Date()).toISOString() };
-}
+import { readFileSync } from "node:fs";
 function parseTomlSections2(content) {
   const sections = [];
   let currentSection = "__header__";
@@ -772,33 +920,29 @@ function parseTomlSections2(content) {
   if (currentLines.length > 0) sections.push({ name: currentSection, lines: currentLines });
   return sections;
 }
-function parseTomlKeyValue(line) {
-  const trimmed = line.trim();
-  if (trimmed.startsWith("#")) return void 0;
-  const match = trimmed.match(/^([a-zA-Z0-9_-]+)\s*=\s*(.+)$/);
-  if (!match) return void 0;
-  return { key: match[1], value: match[2].trim() };
-}
 function extractTomlDeps(sectionLines) {
   const deps = [];
   for (const raw of sectionLines) {
     const line = raw.trim();
     if (line.startsWith("#") || line === "") continue;
-    const tableMatch = line.match(/^([a-zA-Z0-9_-]+)\s*=\s*\{\s*(.*?)\s*\}$/);
+    const entry = parseTomlKeyValue(line);
+    if (!entry) continue;
+    const tableMatch = entry.value.match(/^\{\s*(.*?)\s*\}$/);
     if (tableMatch) {
-      const name = tableMatch[1];
-      const inner = tableMatch[2];
+      const name = entry.key;
+      const inner = tableMatch[1];
+      if (inner === void 0) continue;
       const versionMatch = inner.match(/version\s*=\s*"([^"]+)"/);
-      deps.push({ name, version: versionMatch ? versionMatch[1] : void 0 });
+      const sourceType = /\bgit\s*=/.test(inner) ? "git" : /\bpath\s*=/.test(inner) ? "path" : "registry";
+      deps.push({ name, version: versionMatch?.[1], sourceType });
       continue;
     }
-    const simpleMatch = line.match(/^([a-zA-Z0-9_-]+)\s*=\s*"([^"]*)"$/);
+    const simpleMatch = entry.value.match(/^"([^"]*)"$/);
     if (simpleMatch) {
-      deps.push({ name: simpleMatch[1], version: simpleMatch[2] || void 0 });
+      deps.push({ name: entry.key, version: simpleMatch[1] || void 0, sourceType: "registry" });
       continue;
     }
-    const partialMatch = parseTomlKeyValue(line);
-    if (partialMatch && !partialMatch.value.startsWith("{") && !partialMatch.value.startsWith('"')) {
+    if (!entry.value.startsWith("{") && !entry.value.startsWith('"')) {
     }
   }
   return deps;
@@ -854,23 +998,23 @@ var RustAdapter = class {
     const observations = [];
     const root = workspaceRoot(workspace, options);
     const seen = /* @__PURE__ */ new Set();
-    const cargoTomlPath = workspace.manifests.find((m) => m.includes("Cargo.toml")) || (this.fileExists(resolveIn(root, "Cargo.toml")) ? "Cargo.toml" : void 0);
+    const cargoTomlPath = workspace.manifests.find((m) => m.includes("Cargo.toml")) || (fileExists(resolveIn(root, "Cargo.toml")) ? "Cargo.toml" : void 0);
     if (!cargoTomlPath) return [];
     const fullManifestPath = resolveIn(root, cargoTomlPath);
     let cargoContent;
     try {
-      cargoContent = readFileSync3(fullManifestPath, "utf-8");
+      cargoContent = readFileSync(fullManifestPath, "utf-8");
     } catch {
       return [];
     }
-    const manifestEv = manifestEvidence3(fullManifestPath);
+    const manifestEv = manifestEvidence(fullManifestPath);
     const cargoLockPath = resolveIn(root, "Cargo.lock");
     let lockVersions = /* @__PURE__ */ new Map();
     let lockEv;
     try {
-      const lockContent = readFileSync3(cargoLockPath, "utf-8");
+      const lockContent = readFileSync(cargoLockPath, "utf-8");
       lockVersions = parseCargoLock(lockContent);
-      lockEv = lockfileEvidence3(cargoLockPath);
+      lockEv = lockfileEvidence(cargoLockPath);
     } catch {
     }
     const sections = parseTomlSections2(cargoContent);
@@ -891,18 +1035,18 @@ var RustAdapter = class {
         if (seen.has(dep.name)) continue;
         seen.add(dep.name);
         const locked = lockVersions.get(dep.name) || dep.version;
-        const isRegistry = !dep.version || !dep.version.startsWith("path=") && !dep.version.startsWith("git=") && !dep.version.startsWith("../");
+        const isRegistry = dep.sourceType === "registry";
         const purl = isRegistry && locked ? buildPurl({ type: "rust", name: dep.name, version: locked }) : isRegistry ? buildPurl({ type: "rust", name: dep.name }) : void 0;
         const evidence = [manifestEv];
         if (lockEv && locked && lockVersions.has(dep.name)) evidence.push(lockEv);
-        const status = dep.version && (dep.version.startsWith("path=") || dep.version.startsWith("git=")) ? dep.version.startsWith("git=") ? "git_dependency" : "local_path" : "current";
+        const status = dep.sourceType === "git" ? "git_dependency" : dep.sourceType === "path" ? "local_path" : "current";
         observations.push({
           id: `dep-${workspace.id}-${dep.name}`,
           workspaceId: workspace.id,
           ...purl ? { purl } : {},
           ecosystem: "rust",
           name: dep.name,
-          sourceType: isRegistry ? "registry" : status === "local_path" ? "path" : "git",
+          sourceType: dep.sourceType,
           direct: true,
           scope,
           ...dep.version ? { requested: dep.version } : {},
@@ -912,27 +1056,32 @@ var RustAdapter = class {
         });
       }
     }
-    return observations;
-  }
-  fileExists(filePath) {
-    try {
-      readFileSync3(filePath, "utf-8");
-      return true;
-    } catch {
-      return false;
+    if (options.includeTransitive && lockEv) {
+      for (const [name, locked] of lockVersions) {
+        if (seen.has(name)) continue;
+        seen.add(name);
+        observations.push({
+          id: `dep-${workspace.id}-${name}`,
+          workspaceId: workspace.id,
+          purl: buildPurl({ type: "rust", name, version: locked }),
+          ecosystem: "rust",
+          name,
+          sourceType: "registry",
+          direct: false,
+          scope: "transitive",
+          locked,
+          status: "current",
+          evidence: [lockEv]
+        });
+      }
     }
+    return observations;
   }
 };
 var rustAdapter = new RustAdapter();
 
 // src/adapters/go.ts
-import { readFileSync as readFileSync4 } from "node:fs";
-function manifestEvidence4(path) {
-  return { kind: "manifest", source: path, retrievedAt: (/* @__PURE__ */ new Date()).toISOString() };
-}
-function lockfileEvidence4(path) {
-  return { kind: "lockfile", source: path, retrievedAt: (/* @__PURE__ */ new Date()).toISOString() };
-}
+import { readFileSync as readFileSync2 } from "node:fs";
 function cleanGoVersion(v) {
   return v.replace(/^v/i, "");
 }
@@ -968,11 +1117,34 @@ function parseGoMod(content) {
       continue;
     }
     if (line.startsWith("exclude") || line.startsWith("replace") || line.startsWith("retract")) {
-      continue;
     }
   }
   return deps;
 }
+function parseGoReplacements(content) {
+  const replacements = /* @__PURE__ */ new Map();
+  let inBlock = false;
+  for (const raw of content.split("\n")) {
+    const line = raw.trim();
+    if (line === "replace (") {
+      inBlock = true;
+      continue;
+    }
+    if (inBlock && line === ")") {
+      inBlock = false;
+      continue;
+    }
+    const candidate = inBlock ? line : line.startsWith("replace ") ? line.slice(8).trim() : "";
+    const match = candidate.match(/^(\S+)(?:\s+v\S+)?\s+=>\s+(\S+)/);
+    if (!match) continue;
+    const modulePath = match[1];
+    const target = match[2];
+    if (!modulePath || !target) continue;
+    const local = target.startsWith(".") || target.startsWith("/") || /^[A-Za-z]:[\\/]/.test(target);
+    replacements.set(modulePath, local ? "path" : "git");
+  }
+  return replacements;
+}
 function parseGoSum(content) {
   const versions = /* @__PURE__ */ new Map();
   for (const raw of content.split("\n")) {
@@ -1003,25 +1175,26 @@ var GoAdapter = class {
     const observations = [];
     const root = workspaceRoot(workspace, options);
     const seen = /* @__PURE__ */ new Set();
-    const goModPath = workspace.manifests.find((m) => m.includes("go.mod")) || (this.fileExists(resolveIn(root, "go.mod")) ? "go.mod" : void 0);
+    const goModPath = workspace.manifests.find((m) => m.includes("go.mod")) || (fileExists(resolveIn(root, "go.mod")) ? "go.mod" : void 0);
     if (!goModPath) return [];
     const fullManifestPath = resolveIn(root, goModPath);
     let goModContent;
     try {
-      goModContent = readFileSync4(fullManifestPath, "utf-8");
+      goModContent = readFileSync2(fullManifestPath, "utf-8");
     } catch {
       return [];
     }
-    const manifestEv = manifestEvidence4(fullManifestPath);
+    const manifestEv = manifestEvidence(fullManifestPath);
     const requires = parseGoMod(goModContent);
+    const replacements = parseGoReplacements(goModContent);
     const modName = parseGoModuleName(goModContent);
     const goSumPath = resolveIn(root, "go.sum");
     let lockVersions = /* @__PURE__ */ new Map();
     let lockEv;
     try {
-      const sumContent = readFileSync4(goSumPath, "utf-8");
+      const sumContent = readFileSync2(goSumPath, "utf-8");
       lockVersions = parseGoSum(sumContent);
-      lockEv = lockfileEvidence4(goSumPath);
+      lockEv = lockfileEvidence(goSumPath);
     } catch {
     }
     for (const req of requires) {
@@ -1031,53 +1204,43 @@ var GoAdapter = class {
       const scope = req.indirect ? "transitive" : "runtime";
       const direct = !req.indirect;
       const locked = lockVersions.get(req.modulePath) || req.version;
-      const purl = buildPurl({ type: "go", name: req.modulePath, version: locked });
+      const replacement = replacements.get(req.modulePath);
+      const purl = replacement ? void 0 : buildPurl({ type: "go", name: req.modulePath, version: locked });
       const evidence = [manifestEv];
       if (lockEv && lockVersions.has(req.modulePath)) evidence.push(lockEv);
       observations.push({
         id: `dep-${workspace.id}-${req.modulePath}`,
         workspaceId: workspace.id,
-        purl,
+        ...purl ? { purl } : {},
         ecosystem: "go",
         name: req.modulePath,
-        sourceType: "registry",
+        sourceType: replacement ?? "registry",
         direct,
         scope,
         requested: req.version,
         ...locked ? { locked } : {},
-        status: "current",
+        status: replacement === "path" ? "local_path" : replacement === "git" ? "git_dependency" : "current",
         evidence
       });
     }
     return observations;
   }
-  fileExists(filePath) {
-    try {
-      readFileSync4(filePath, "utf-8");
-      return true;
-    } catch {
-      return false;
-    }
-  }
 };
 var goAdapter = new GoAdapter();
 
 // src/adapters/dotnet.ts
-import { readFileSync as readFileSync5, readdirSync } from "node:fs";
+import { readFile as readFile3, readdir } from "node:fs/promises";
 import { join as join3 } from "node:path";
-function manifestEvidence5(path) {
-  return { kind: "manifest", source: path, retrievedAt: (/* @__PURE__ */ new Date()).toISOString() };
-}
-function lockfileEvidence5(path) {
-  return { kind: "lockfile", source: path, retrievedAt: (/* @__PURE__ */ new Date()).toISOString() };
-}
 function parseCsproj(content) {
   const refs = [];
-  const regex = /<PackageReference\s+Include\s*=\s*"([^"]+)"\s*(?:Version\s*=\s*"([^"]*)")?\s*\/?\s*>/g;
-  let match;
-  while ((match = regex.exec(content)) !== null) {
-    const name = match[1];
-    const version = match[2] || void 0;
+  const regex = /<PackageReference\b([^>]*?)(?:\/>|>([\s\S]*?)<\/PackageReference>)/gi;
+  for (const match of content.matchAll(regex)) {
+    const attributes = match[1] ?? "";
+    const body = match[2] ?? "";
+    const parsedAttributes = parseXmlAttributes(attributes);
+    const name = parsedAttributes.get("Include");
+    if (!name) continue;
+    const version = parsedAttributes.get("Version") ?? xmlTagValue(body, "Version");
     refs.push({ name, version });
   }
   return refs;
@@ -1110,7 +1273,7 @@ var DotNetAdapter = class {
     const seen = /* @__PURE__ */ new Set();
     let csprojPath;
     try {
-      const files = readdirSync(root);
+      const files = await readdir(root);
       const csproj = files.find((f) => f.endsWith(".csproj"));
       if (csproj) csprojPath = join3(root, csproj);
     } catch {
@@ -1118,19 +1281,19 @@ var DotNetAdapter = class {
     if (!csprojPath) return [];
     let csprojContent;
     try {
-      csprojContent = readFileSync5(csprojPath, "utf-8");
+      csprojContent = await readFile3(csprojPath, "utf-8");
     } catch {
       return [];
     }
-    const manifestEv = manifestEvidence5(csprojPath);
+    const manifestEv = manifestEvidence(csprojPath);
     const refs = parseCsproj(csprojContent);
     const assetsPath = join3(root, "project.assets.json");
     let lockVersions = /* @__PURE__ */ new Map();
     let lockEv;
     try {
-      const assetsContent = readFileSync5(assetsPath, "utf-8");
+      const assetsContent = await readFile3(assetsPath, "utf-8");
       lockVersions = parseProjectAssetsJson(assetsContent);
-      lockEv = lockfileEvidence5(assetsPath);
+      lockEv = lockfileEvidence(assetsPath);
     } catch {
     }
     for (const ref of refs) {
@@ -1161,14 +1324,8 @@ var DotNetAdapter = class {
 var dotNetAdapter = new DotNetAdapter();
 
 // src/adapters/php.ts
-import { readFileSync as readFileSync6 } from "node:fs";
+import { readFileSync as readFileSync3 } from "node:fs";
 import { join as join4 } from "node:path";
-function manifestEvidence6(path) {
-  return { kind: "manifest", source: path, retrievedAt: (/* @__PURE__ */ new Date()).toISOString() };
-}
-function lockfileEvidence6(path) {
-  return { kind: "lockfile", source: path, retrievedAt: (/* @__PURE__ */ new Date()).toISOString() };
-}
 function parseComposerLock(content) {
   const versions = /* @__PURE__ */ new Map();
   try {
@@ -1196,15 +1353,15 @@ var PhpAdapter = class {
     const observations = [];
     const root = workspaceRoot(workspace, options);
     const seen = /* @__PURE__ */ new Set();
-    const composerJsonPath = workspace.manifests.find((m) => m.includes("composer.json")) || (this.fileExists(join4(root, "composer.json")) ? join4(root, "composer.json") : void 0);
+    const composerJsonPath = workspace.manifests.find((m) => m.includes("composer.json")) || (fileExists(join4(root, "composer.json")) ? join4(root, "composer.json") : void 0);
     if (!composerJsonPath) return [];
     let content;
     try {
-      content = readFileSync6(composerJsonPath, "utf-8");
+      content = readFileSync3(composerJsonPath, "utf-8");
     } catch {
       return [];
     }
-    const manifestEv = manifestEvidence6(composerJsonPath);
+    const manifestEv = manifestEvidence(composerJsonPath);
     let composerJson;
     try {
       composerJson = JSON.parse(content);
@@ -1215,9 +1372,9 @@ var PhpAdapter = class {
     let lockVersions = /* @__PURE__ */ new Map();
     let lockEv;
     try {
-      const lockContent = readFileSync6(lockPath, "utf-8");
+      const lockContent = readFileSync3(lockPath, "utf-8");
       lockVersions = parseComposerLock(lockContent);
-      lockEv = lockfileEvidence6(lockPath);
+      lockEv = lockfileEvidence(lockPath);
     } catch {
     }
     const sections = [
@@ -1254,26 +1411,12 @@ var PhpAdapter = class {
     }
     return observations;
   }
-  fileExists(filePath) {
-    try {
-      readFileSync6(filePath, "utf-8");
-      return true;
-    } catch {
-      return false;
-    }
-  }
 };
 var phpAdapter = new PhpAdapter();
 
 // src/adapters/dart.ts
-import { readFileSync as readFileSync7 } from "node:fs";
+import { readFileSync as readFileSync4 } from "node:fs";
 import { join as join5 } from "node:path";
-function manifestEvidence7(path) {
-  return { kind: "manifest", source: path, retrievedAt: (/* @__PURE__ */ new Date()).toISOString() };
-}
-function lockfileEvidence7(path) {
-  return { kind: "lockfile", source: path, retrievedAt: (/* @__PURE__ */ new Date()).toISOString() };
-}
 function parsePubspecYaml(content) {
   const sections = /* @__PURE__ */ new Map();
   let currentSection;
@@ -1301,6 +1444,14 @@ function parsePubspecYaml(content) {
       }
       const sec = sections.get(currentSection);
       sec.set(currentName, constraint);
+      continue;
+    }
+    if (currentName && line.startsWith("    ")) {
+      const sec = sections.get(currentSection);
+      if (!sec) continue;
+      if (/^sdk:\s*flutter\b/.test(trimmed)) sec.set(currentName, "sdk:flutter");
+      else if (/^git:\s*/.test(trimmed)) sec.set(currentName, `git:${trimmed.slice(4).trim()}`);
+      else if (/^path:\s*/.test(trimmed)) sec.set(currentName, `path:${trimmed.slice(5).trim()}`);
     }
   }
   return sections;
@@ -1339,23 +1490,23 @@ var DartAdapter = class {
     const observations = [];
     const root = workspaceRoot(workspace, options);
     const seen = /* @__PURE__ */ new Set();
-    const pubspecPath = workspace.manifests.find((m) => m.includes("pubspec.yaml")) || (this.fileExists(join5(root, "pubspec.yaml")) ? join5(root, "pubspec.yaml") : void 0);
+    const pubspecPath = workspace.manifests.find((m) => m.includes("pubspec.yaml")) || (fileExists(join5(root, "pubspec.yaml")) ? join5(root, "pubspec.yaml") : void 0);
     if (!pubspecPath) return [];
     let content;
     try {
-      content = readFileSync7(pubspecPath, "utf-8");
+      content = readFileSync4(pubspecPath, "utf-8");
     } catch {
       return [];
     }
-    const manifestEv = manifestEvidence7(pubspecPath);
+    const manifestEv = manifestEvidence(pubspecPath);
     const sections = parsePubspecYaml(content);
     const lockPath = join5(root, "pubspec.lock");
     let lockVersions = /* @__PURE__ */ new Map();
     let lockEv;
     try {
-      const lockContent = readFileSync7(lockPath, "utf-8");
+      const lockContent = readFileSync4(lockPath, "utf-8");
       lockVersions = parsePubspecLock(lockContent);
-      lockEv = lockfileEvidence7(lockPath);
+      lockEv = lockfileEvidence(lockPath);
     } catch {
     }
     const sectionMapping = [
@@ -1369,7 +1520,7 @@ var DartAdapter = class {
       for (const [name, constraint] of deps) {
         if (seen.has(name)) continue;
         seen.add(name);
-        if (constraint === "*" || constraint.startsWith("{")) continue;
+        if (constraint === "*" || constraint === "sdk:flutter" || constraint.startsWith("{")) continue;
         const locked = lockVersions.get(name);
         let status = "current";
         let sourceType = "registry";
@@ -1405,32 +1556,54 @@ var DartAdapter = class {
     }
     return observations;
   }
-  fileExists(filePath) {
-    try {
-      readFileSync7(filePath, "utf-8");
-      return true;
-    } catch {
-      return false;
-    }
-  }
 };
 var dartAdapter = new DartAdapter();
 
 // src/adapters/maven.ts
-import { readFileSync as readFileSync8 } from "node:fs";
-function manifestEvidence8(path) {
-  return { kind: "manifest", source: path, retrievedAt: (/* @__PURE__ */ new Date()).toISOString() };
-}
+import { readFileSync as readFileSync5 } from "node:fs";
 function parsePomDependencies(xml) {
   const deps = [];
+  const properties = /* @__PURE__ */ new Map();
+  const propertiesBlock = /<properties>([\s\S]*?)<\/properties>/.exec(xml)?.[1] ?? "";
+  const propertyRegex = /<([A-Za-z0-9_.-]+)>\s*([^<]+?)\s*<\/\1>/g;
+  for (const propertyMatch of propertiesBlock.matchAll(propertyRegex)) {
+    const key = propertyMatch[1];
+    const value = propertyMatch[2];
+    if (key && value) properties.set(key, value.trim());
+  }
+  const parentBlock = /<parent>([\s\S]*?)<\/parent>/.exec(xml)?.[1];
+  if (parentBlock) {
+    const parentVersion = xmlTagValue(parentBlock, "version");
+    const parentGroup = xmlTagValue(parentBlock, "groupId");
+    if (parentVersion) {
+      properties.set("parent.version", parentVersion);
+      properties.set("project.parent.version", parentVersion);
+    }
+    if (parentGroup) {
+      properties.set("parent.groupId", parentGroup);
+      properties.set("project.parent.groupId", parentGroup);
+    }
+  }
+  const managed = /* @__PURE__ */ new Map();
+  const managementBlock = /<dependencyManagement>([\s\S]*?)<\/dependencyManagement>/.exec(xml)?.[1] ?? "";
+  const managementRegex = /<dependency>\s*([\s\S]*?)<\/dependency>/g;
+  for (const managementMatch of managementBlock.matchAll(managementRegex)) {
+    const block = managementMatch[1];
+    if (!block) continue;
+    const groupId = xmlTagValue(block, "groupId");
+    const artifactId = xmlTagValue(block, "artifactId");
+    const version = xmlTagValue(block, "version");
+    if (groupId && artifactId && version) managed.set(`${groupId}:${artifactId}`, version);
+  }
+  const directXml = xml.replace(/<dependencyManagement>[\s\S]*?<\/dependencyManagement>/g, "");
   const depRegex = /<dependency>\s*([\s\S]*?)<\/dependency>/g;
-  let match;
-  while ((match = depRegex.exec(xml)) !== null) {
+  for (const match of directXml.matchAll(depRegex)) {
     const block = match[1];
-    const groupId = block.match(/<groupId>([^<]+)<\/groupId>/)?.[1]?.trim();
-    const artifactId = block.match(/<artifactId>([^<]+)<\/artifactId>/)?.[1]?.trim();
-    const version = block.match(/<version>([^<]+)<\/version>/)?.[1]?.trim();
-    const scope = block.match(/<scope>([^<]+)<\/scope>/)?.[1]?.trim();
+    const groupId = xmlTagValue(block, "groupId");
+    const artifactId = xmlTagValue(block, "artifactId");
+    const rawVersion = xmlTagValue(block, "version") ?? (groupId && artifactId ? managed.get(`${groupId}:${artifactId}`) : void 0);
+    const version = rawVersion?.replace(/\$\{([^}]+)\}/g, (_whole, key) => properties.get(key) ?? `\${${key}}`);
+    const scope = xmlTagValue(block, "scope");
     if (groupId && artifactId) {
       deps.push({ groupId, artifactId, version, scope });
     }
@@ -1459,11 +1632,11 @@ var MavenAdapter = class {
     if (!pomPath) return [];
     let content;
     try {
-      content = readFileSync8(pomPath, "utf-8");
+      content = readFileSync5(pomPath, "utf-8");
     } catch {
       return [];
     }
-    const manifestEv = manifestEvidence8(pomPath);
+    const manifestEv = manifestEvidence(pomPath);
     const deps = parsePomDependencies(content);
     const seen = /* @__PURE__ */ new Set();
     for (const dep of deps) {
@@ -1490,22 +1663,139 @@ var MavenAdapter = class {
 };
 var mavenAdapter = new MavenAdapter();
 
-// src/adapters/ruby.ts
-import { readFileSync as readFileSync9 } from "node:fs";
-function manifestEvidence9(path) {
-  return { kind: "manifest", source: path, retrievedAt: (/* @__PURE__ */ new Date()).toISOString() };
+// src/adapters/gradle.ts
+import { readFile as readFile4 } from "node:fs/promises";
+import { join as join6 } from "node:path";
+function scopeForConfiguration(configuration) {
+  if (/test/i.test(configuration)) return "development";
+  if (/compileOnly|annotationProcessor/i.test(configuration)) return "build";
+  if (/runtimeOnly/i.test(configuration)) return "runtime";
+  return "runtime";
 }
-function lockfileEvidence8(path) {
-  return { kind: "lockfile", source: path, retrievedAt: (/* @__PURE__ */ new Date()).toISOString() };
+function parseVersionCatalog(content) {
+  const versions = /* @__PURE__ */ new Map();
+  const libraries = /* @__PURE__ */ new Map();
+  let section = "";
+  for (const raw of content.split("\n")) {
+    const line = raw.replace(/#.*$/, "").trim();
+    const header = /^\[([^\]]+)\]$/.exec(line);
+    if (header) {
+      section = header[1] ?? "";
+      continue;
+    }
+    const entry = /^(?:"([^"]+)"|([\w.-]+))\s*=\s*(.+)$/.exec(line);
+    if (!entry) continue;
+    const key = entry[1] ?? entry[2];
+    const value = entry[3];
+    if (!key || !value) continue;
+    if (section === "versions") {
+      const version = /^["']([^"']+)["']/.exec(value)?.[1];
+      if (version) versions.set(key, version);
+    } else if (section === "libraries") {
+      const module = /\bmodule\s*=\s*["']([^"']+)["']/.exec(value)?.[1] ?? (() => {
+        const group = /\bgroup\s*=\s*["']([^"']+)["']/.exec(value)?.[1];
+        const name = /\bname\s*=\s*["']([^"']+)["']/.exec(value)?.[1];
+        return group && name ? `${group}:${name}` : void 0;
+      })();
+      if (!module) continue;
+      const version = /\bversion\s*=\s*["']([^"']+)["']/.exec(value)?.[1];
+      const ref = /\bversion\.ref\s*=\s*["']([^"']+)["']/.exec(value)?.[1];
+      libraries.set(key.replace(/-/g, "."), `${module}:${version ?? (ref ? versions.get(ref) ?? "" : "")}`.replace(/:$/, ""));
+    }
+  }
+  return libraries;
+}
+function parseGradleManifest(content, catalog) {
+  const deps = [];
+  const coordinateRegex = /\b(implementation|api|compileOnly|runtimeOnly|testImplementation|testRuntimeOnly|annotationProcessor)\s*(?:\(|\s)\s*["']([^"']+)["']/g;
+  for (const match of content.matchAll(coordinateRegex)) {
+    const configuration = match[1];
+    const value = match[2];
+    if (!configuration || !value) continue;
+    const [group, artifact, version] = value.split(":");
+    if (!group || !artifact) continue;
+    deps.push({ name: `${group}:${artifact}`, requested: version, scope: scopeForConfiguration(configuration) });
+  }
+  const aliasRegex = /\b(implementation|api|compileOnly|runtimeOnly|testImplementation|testRuntimeOnly)\s*\(\s*libs\.([\w.]+)\s*\)/g;
+  for (const match of content.matchAll(aliasRegex)) {
+    const configuration = match[1];
+    const alias = match[2];
+    if (!configuration || !alias) continue;
+    const coordinate = catalog.get(alias);
+    if (!coordinate) continue;
+    const [group, artifact, version] = coordinate.split(":");
+    if (!group || !artifact) continue;
+    deps.push({ name: `${group}:${artifact}`, requested: version, scope: scopeForConfiguration(configuration) });
+  }
+  return deps;
+}
+function parseGradleLock(content) {
+  const locked = /* @__PURE__ */ new Map();
+  for (const raw of content.split("\n")) {
+    const line = raw.replace(/#.*/, "").trim();
+    const coordinate = /^([^:\s=]+):([^:\s=]+):([^=\s]+)(?:=.*)?$/.exec(line);
+    if (coordinate?.[1] && coordinate[2] && coordinate[3]) locked.set(`${coordinate[1]}:${coordinate[2]}`, coordinate[3]);
+  }
+  return locked;
 }
+var GradleAdapter = class {
+  ecosystem = "gradle";
+  async inventory(workspace, options) {
+    const root = workspaceRoot(workspace, options);
+    const manifestPath = workspace.manifests.find((path) => /build\.gradle(?:\.kts)?$/.test(path)) ?? (await fileExistsAsync(join6(root, "build.gradle.kts")) ? join6(root, "build.gradle.kts") : join6(root, "build.gradle"));
+    if (!await fileExistsAsync(resolveIn(root, manifestPath))) return [];
+    const catalogPath = join6(root, "gradle", "libs.versions.toml");
+    const catalog = await fileExistsAsync(catalogPath) ? parseVersionCatalog(await readFile4(catalogPath, "utf8")) : /* @__PURE__ */ new Map();
+    const direct = parseGradleManifest(await readFile4(resolveIn(root, manifestPath), "utf8"), catalog);
+    const lockPath = workspace.lockfiles.find((path) => path.endsWith("gradle.lockfile")) ?? join6(root, "gradle.lockfile");
+    const locked = await fileExistsAsync(resolveIn(root, lockPath)) ? parseGradleLock(await readFile4(resolveIn(root, lockPath), "utf8")) : /* @__PURE__ */ new Map();
+    const manifestEv = manifestEvidence(resolveIn(root, manifestPath));
+    const lockEv = locked.size > 0 ? lockfileEvidence(resolveIn(root, lockPath)) : void 0;
+    const observations = [];
+    const seen = /* @__PURE__ */ new Set();
+    const add = (name, requested, scope, isDirect) => {
+      if (seen.has(name)) return;
+      seen.add(name);
+      const version = locked.get(name) ?? requested;
+      const lockedVersion = locked.get(name);
+      const evidence = isDirect ? [manifestEv] : [];
+      if (lockEv && locked.has(name)) evidence.push(lockEv);
+      observations.push({
+        id: `dep-${workspace.id}-${name}`,
+        workspaceId: workspace.id,
+        purl: buildPurl({ type: "maven", name, ...version ? { version } : {} }),
+        ecosystem: "gradle",
+        name,
+        sourceType: "registry",
+        direct: isDirect,
+        scope: isDirect ? scope : "transitive",
+        ...requested ? { requested } : {},
+        ...lockedVersion ? { locked: lockedVersion } : {},
+        status: "current",
+        evidence
+      });
+    };
+    for (const dep of direct) add(dep.name, dep.requested, dep.scope, true);
+    if (options.includeTransitive) {
+      for (const [name] of locked) add(name, void 0, "transitive", false);
+    }
+    return observations;
+  }
+};
+var gradleAdapter = new GradleAdapter();
+
+// src/adapters/ruby.ts
+import { readFileSync as readFileSync6 } from "node:fs";
 function parseGemfile(content) {
   const gems = [];
-  const gemRegex = /gem\s+['"]([^'"]+)['"](?:\s*,\s*['"]([^'"]+)['"])?/g;
-  let match;
-  while ((match = gemRegex.exec(content)) !== null) {
+  const gemRegex = /gem\s+['"]([^'"]+)['"]([^\n]*)/g;
+  for (const match of content.matchAll(gemRegex)) {
     const name = match[1];
     if (name === "rails" || name === "ruby") continue;
-    gems.push({ name, version: match[2] });
+    const tail = match[2] ?? "";
+    const version = /^\s*,\s*['"]([^'"]+)['"]/.exec(tail)?.[1];
+    const sourceType = /\b(?:git|github):/.test(tail) ? "git" : /\bpath:/.test(tail) ? "path" : "registry";
+    gems.push({ name, version, sourceType });
   }
   return gems;
 }
@@ -1514,7 +1804,11 @@ function parseGemfileLock(content) {
   const lines = content.split("\n");
   let inSpecs = false;
   for (const line of lines) {
-    if (line.startsWith("GEM")) {
+    if (/^(?:GEM|GIT|PATH)$/.test(line.trim())) {
+      inSpecs = false;
+      continue;
+    }
+    if (/^\s{2}specs:\s*$/.test(line)) {
       inSpecs = true;
       continue;
     }
@@ -1539,11 +1833,11 @@ var RubyAdapter = class {
     if (!gemfilePath) return [];
     let content;
     try {
-      content = readFileSync9(gemfilePath, "utf-8");
+      content = readFileSync6(gemfilePath, "utf-8");
     } catch {
       return [];
     }
-    const manifestEv = manifestEvidence9(gemfilePath);
+    const manifestEv = manifestEvidence(gemfilePath);
     const gems = parseGemfile(content);
     const seen = /* @__PURE__ */ new Set();
     const lockfilePath = workspace.lockfiles.find((l) => l.includes("Gemfile.lock"));
@@ -1551,9 +1845,9 @@ var RubyAdapter = class {
     let lockEv;
     if (lockfilePath) {
       try {
-        const lockContent = readFileSync9(lockfilePath, "utf-8");
+        const lockContent = readFileSync6(lockfilePath, "utf-8");
         lockVersions = parseGemfileLock(lockContent);
-        lockEv = lockfileEvidence8(lockfilePath);
+        lockEv = lockfileEvidence(lockfilePath);
       } catch {
       }
     }
@@ -1562,21 +1856,21 @@ var RubyAdapter = class {
       seen.add(gem.name);
       const locked = lockVersions.get(gem.name);
       const version = locked ?? gem.version;
-      const purl = version ? buildPurl({ type: "gem", name: gem.name, version }) : buildPurl({ type: "gem", name: gem.name });
+      const purl = gem.sourceType === "registry" && version ? buildPurl({ type: "gem", name: gem.name, version }) : gem.sourceType === "registry" ? buildPurl({ type: "gem", name: gem.name }) : void 0;
       const evidence = [manifestEv];
       if (lockEv && locked) evidence.push(lockEv);
       observations.push({
         id: `dep-${workspace.id}-${gem.name}`,
         workspaceId: workspace.id,
-        purl,
+        ...purl ? { purl } : {},
         ecosystem: "ruby",
         name: gem.name,
-        sourceType: "registry",
+        sourceType: gem.sourceType,
         direct: true,
         scope: "runtime",
         ...gem.version ? { requested: gem.version } : {},
         ...locked ? { locked } : {},
-        status: "current",
+        status: gem.sourceType === "git" ? "git_dependency" : gem.sourceType === "path" ? "local_path" : "current",
         evidence
       });
     }
@@ -1585,28 +1879,101 @@ var RubyAdapter = class {
 };
 var rubyAdapter = new RubyAdapter();
 
-// src/adapters/elixir.ts
-import { readFileSync as readFileSync10 } from "node:fs";
-function manifestEvidence10(path) {
-  return { kind: "manifest", source: path, retrievedAt: (/* @__PURE__ */ new Date()).toISOString() };
+// src/adapters/swift.ts
+import { readFileSync as readFileSync7 } from "node:fs";
+import { basename, join as join7 } from "node:path";
+function identityFromLocation(location) {
+  return basename(location.replace(/[\\/]$/, "")).replace(/\.git$/i, "").toLowerCase();
 }
-function lockfileEvidence9(path) {
-  return { kind: "lockfile", source: path, retrievedAt: (/* @__PURE__ */ new Date()).toISOString() };
+function parsePackageSwift(content) {
+  const deps = [];
+  const packageRegex = /\.package\s*\(\s*(?:name:\s*["'][^"']+["'],\s*)?(url|path):\s*["']([^"']+)["']\s*(?:,\s*(?:from|exact|branch|revision):\s*["']([^"']+)["'])?\s*\)/g;
+  for (const match of content.matchAll(packageRegex)) {
+    const location = match[2];
+    if (!location) continue;
+    deps.push({
+      identity: identityFromLocation(location),
+      requested: match[3],
+      sourceType: match[1] === "path" ? "path" : "git"
+    });
+  }
+  return deps;
+}
+function parsePackageResolved(content) {
+  const pins = /* @__PURE__ */ new Map();
+  try {
+    const json = JSON.parse(content);
+    for (const pin of json.pins ?? json.object?.pins ?? []) {
+      const identity = (pin.identity ?? pin.package ?? (pin.location ? identityFromLocation(pin.location) : void 0) ?? (pin.repositoryURL ? identityFromLocation(pin.repositoryURL) : void 0))?.toLowerCase();
+      if (identity) pins.set(identity, { ...pin.state?.version ? { version: pin.state.version } : {}, ...pin.state?.revision ? { revision: pin.state.revision } : {} });
+    }
+  } catch {
+  }
+  return pins;
 }
+var SwiftAdapter = class {
+  ecosystem = "swift";
+  async inventory(workspace, options) {
+    const root = workspaceRoot(workspace, options);
+    const manifestPath = workspace.manifests.find((path) => path.endsWith("Package.swift")) ?? join7(root, "Package.swift");
+    if (!fileExists(manifestPath)) return [];
+    const direct = parsePackageSwift(readFileSync7(manifestPath, "utf8"));
+    const resolvedPath = workspace.lockfiles.find((path) => path.endsWith("Package.resolved")) ?? join7(root, "Package.resolved");
+    const pins = fileExists(resolvedPath) ? parsePackageResolved(readFileSync7(resolvedPath, "utf8")) : /* @__PURE__ */ new Map();
+    const manifestEv = manifestEvidence(manifestPath);
+    const lockEv = pins.size > 0 ? lockfileEvidence(resolvedPath) : void 0;
+    const observations = [];
+    const seen = /* @__PURE__ */ new Set();
+    const add = (identity, requested, sourceType, isDirect) => {
+      if (seen.has(identity)) return;
+      seen.add(identity);
+      const pin = pins.get(identity);
+      const version = pin?.version ?? pin?.revision ?? requested;
+      const evidence = isDirect ? [manifestEv] : [];
+      if (lockEv && pin) evidence.push(lockEv);
+      observations.push({
+        id: `dep-${workspace.id}-${identity}`,
+        workspaceId: workspace.id,
+        ...sourceType === "git" ? { purl: buildPurl({ type: "swift", name: identity, ...version ? { version } : {} }) } : {},
+        ecosystem: "swift",
+        name: identity,
+        sourceType,
+        direct: isDirect,
+        scope: isDirect ? "runtime" : "transitive",
+        ...requested ? { requested } : {},
+        ...pin?.version ? { locked: pin.version } : pin?.revision ? { locked: pin.revision } : {},
+        status: sourceType === "path" ? "local_path" : "git_dependency",
+        evidence
+      });
+    };
+    for (const dep of direct) add(dep.identity, dep.requested, dep.sourceType, true);
+    if (options.includeTransitive) {
+      for (const [identity] of pins) add(identity, void 0, "git", false);
+    }
+    return observations;
+  }
+};
+var swiftAdapter = new SwiftAdapter();
+
+// src/adapters/elixir.ts
+import { readFileSync as readFileSync8 } from "node:fs";
 function parseMixExsDeps(content) {
   const deps = [];
-  const depRegex = /\{:(\w+),\s*["']([^"']+)["']\}/g;
-  let match;
-  while ((match = depRegex.exec(content)) !== null) {
-    deps.push({ name: match[1], version: match[2] });
+  const depRegex = /\{:(\w+),\s*([^}]+)\}/g;
+  for (const match of content.matchAll(depRegex)) {
+    const name = match[1];
+    const value = match[2];
+    if (!name || !value) continue;
+    const version = /^\s*["']([^"']+)["']/.exec(value)?.[1];
+    const sourceType = /\bgit:/.test(value) ? "git" : /\bpath:/.test(value) ? "path" : "registry";
+    deps.push({ name, version, sourceType });
   }
   return deps;
 }
 function parseMixLock(content) {
   const versions = /* @__PURE__ */ new Map();
-  const lockRegex = /\{:"(\w+)",\s*hex: "[^"]*",\s*"([^"]+)"/g;
-  let match;
-  while ((match = lockRegex.exec(content)) !== null) {
+  const lockRegex = /["']([\w-]+)["']\s*=>\s*\{:hex,\s*:[\w-]+,\s*["']([^"']+)["']/g;
+  for (const match of content.matchAll(lockRegex)) {
     versions.set(match[1], match[2]);
   }
   return versions;
@@ -1619,11 +1986,11 @@ var ElixirAdapter = class {
     if (!mixExsPath) return [];
     let content;
     try {
-      content = readFileSync10(mixExsPath, "utf-8");
+      content = readFileSync8(mixExsPath, "utf-8");
     } catch {
       return [];
     }
-    const manifestEv = manifestEvidence10(mixExsPath);
+    const manifestEv = manifestEvidence(mixExsPath);
     const deps = parseMixExsDeps(content);
     const seen = /* @__PURE__ */ new Set();
     const lockfilePath = workspace.lockfiles.find((l) => l.includes("mix.lock"));
@@ -1631,9 +1998,9 @@ var ElixirAdapter = class {
     let lockEv;
     if (lockfilePath) {
       try {
-        const lockContent = readFileSync10(lockfilePath, "utf-8");
+        const lockContent = readFileSync8(lockfilePath, "utf-8");
         lockVersions = parseMixLock(lockContent);
-        lockEv = lockfileEvidence9(lockfilePath);
+        lockEv = lockfileEvidence(lockfilePath);
       } catch {
       }
     }
@@ -1642,21 +2009,21 @@ var ElixirAdapter = class {
       seen.add(dep.name);
       const locked = lockVersions.get(dep.name);
       const version = locked ?? dep.version;
-      const purl = version ? buildPurl({ type: "hex", name: dep.name, version }) : buildPurl({ type: "hex", name: dep.name });
+      const purl = dep.sourceType === "registry" && version ? buildPurl({ type: "hex", name: dep.name, version }) : dep.sourceType === "registry" ? buildPurl({ type: "hex", name: dep.name }) : void 0;
       const evidence = [manifestEv];
       if (lockEv && locked) evidence.push(lockEv);
       observations.push({
         id: `dep-${workspace.id}-${dep.name}`,
         workspaceId: workspace.id,
-        purl,
+        ...purl ? { purl } : {},
         ecosystem: "elixir",
         name: dep.name,
-        sourceType: "registry",
+        sourceType: dep.sourceType,
         direct: true,
         scope: "runtime",
         ...dep.version ? { requested: dep.version } : {},
         ...locked ? { locked } : {},
-        status: "current",
+        status: dep.sourceType === "git" ? "git_dependency" : dep.sourceType === "path" ? "local_path" : "current",
         evidence
       });
     }
@@ -1666,10 +2033,7 @@ var ElixirAdapter = class {
 var elixirAdapter = new ElixirAdapter();
 
 // src/adapters/cpp.ts
-import { readFileSync as readFileSync11 } from "node:fs";
-function manifestEvidence11(path) {
-  return { kind: "manifest", source: path, retrievedAt: (/* @__PURE__ */ new Date()).toISOString() };
-}
+import { readFileSync as readFileSync9 } from "node:fs";
 function parseConanTxt(content) {
   const deps = [];
   const requiresMatch = /\[requires\]\s*\n([\s\S]*?)(?:\[|$)/;
@@ -1710,11 +2074,11 @@ var CppAdapter = class {
     for (const manifestPath of workspace.manifests) {
       let content;
       try {
-        content = readFileSync11(manifestPath, "utf-8");
+        content = readFileSync9(manifestPath, "utf-8");
       } catch {
         continue;
       }
-      const manifestEv = manifestEvidence11(manifestPath);
+      const manifestEv = manifestEvidence(manifestPath);
       let deps = [];
       if (manifestPath.includes("conanfile")) {
         deps = parseConanTxt(content);
@@ -1790,6 +2154,108 @@ function diffSnapshots(oldSnapshot, newSnapshot) {
   return { added, removed, changed };
 }
 
+// src/trend.ts
+function median(values) {
+  if (!values.length) return void 0;
+  const sorted = [...values].sort((a, b) => a - b);
+  const middle = Math.floor(sorted.length / 2);
+  const upper = sorted[middle];
+  if (upper === void 0) return void 0;
+  if (sorted.length % 2) return upper;
+  const lower = sorted[middle - 1];
+  return lower === void 0 ? upper : (lower + upper) / 2;
+}
+var TrendStore = class {
+  constructor(source) {
+    this.source = source;
+  }
+  source;
+  analyze(projectId, limit = 100) {
+    const snapshots = this.source.listSnapshots(projectId, limit).sort((a, b) => Date.parse(a.createdAt) - Date.parse(b.createdAt));
+    const versionHistory = /* @__PURE__ */ new Map();
+    const vulnerabilityDurations = [];
+    const openVulnerabilities = /* @__PURE__ */ new Map();
+    for (const snapshot of snapshots) {
+      const at = Date.parse(snapshot.createdAt);
+      const active = /* @__PURE__ */ new Set();
+      for (const dependency of snapshot.dependencies) {
+        const key = `${dependency.ecosystem}:${dependency.name}`;
+        active.add(key);
+        const vulnerable = dependency.status === "vulnerable";
+        const history = versionHistory.get(key) ?? [];
+        history.push({ at, version: dependency.locked ?? dependency.installed ?? dependency.requested, vulnerable, name: dependency.name, ecosystem: dependency.ecosystem });
+        versionHistory.set(key, history);
+        if (vulnerable && !openVulnerabilities.has(key)) openVulnerabilities.set(key, at);
+        if (!vulnerable && openVulnerabilities.has(key)) {
+          const openedAt = openVulnerabilities.get(key);
+          if (openedAt !== void 0) vulnerabilityDurations.push(Math.max(0, at - openedAt));
+          openVulnerabilities.delete(key);
+        }
+      }
+      for (const key of openVulnerabilities.keys()) {
+        if (!active.has(key)) {
+          const openedAt = openVulnerabilities.get(key);
+          if (openedAt !== void 0) vulnerabilityDurations.push(Math.max(0, at - openedAt));
+          openVulnerabilities.delete(key);
+        }
+      }
+    }
+    const dependencies = [];
+    for (const [key, history] of versionHistory) {
+      const first = history[0];
+      const latest = history.at(-1);
+      if (!first || !latest) continue;
+      let versionChanges = 0;
+      let sameVersionSince = first.at;
+      for (let index = 1; index < history.length; index++) {
+        const current = history[index];
+        const previous = history[index - 1];
+        if (current && previous && current.version !== previous.version) {
+          versionChanges++;
+          sameVersionSince = current.at;
+        }
+      }
+      const spanDays = Math.max(1, (latest.at - first.at) / 864e5);
+      dependencies.push({
+        key,
+        name: latest.name,
+        ecosystem: latest.ecosystem,
+        ...latest.version ? { currentVersion: latest.version } : {},
+        lockedVersionAgeMs: Math.max(0, latest.at - sameVersionSince),
+        versionChanges,
+        upgradeVelocityPerDay: versionChanges / spanDays
+      });
+    }
+    dependencies.sort((a, b) => a.key.localeCompare(b.key));
+    const halfLife = median(vulnerabilityDurations);
+    const firstSnapshot = snapshots[0];
+    const lastSnapshot = snapshots.at(-1);
+    return {
+      projectId,
+      ...firstSnapshot && lastSnapshot ? { from: firstSnapshot.createdAt, to: lastSnapshot.createdAt } : {},
+      snapshots: snapshots.length,
+      dependencies,
+      ...halfLife !== void 0 ? { vulnerabilityHalfLifeMs: halfLife } : {},
+      points: snapshots.map((snapshot) => ({
+        snapshotId: snapshot.id,
+        createdAt: snapshot.createdAt,
+        dependencies: snapshot.dependencies.length,
+        outdated: snapshot.dependencies.filter((dependency) => dependency.status.startsWith("update_available")).length,
+        vulnerable: snapshot.dependencies.filter((dependency) => dependency.status === "vulnerable").length
+      }))
+    };
+  }
+};
+function renderTrendMarkdown(report) {
+  const lines = ["# TechStack Trend", "", `**Snapshots:** ${report.snapshots}`];
+  if (report.vulnerabilityHalfLifeMs !== void 0) lines.push(`**Vulnerability half-life:** ${(report.vulnerabilityHalfLifeMs / 864e5).toFixed(1)} days`);
+  lines.push("", "| Dependency | Version | Age (days) | Changes | Velocity/day |", "|---|---|---:|---:|---:|");
+  for (const dependency of report.dependencies) {
+    lines.push(`| ${dependency.ecosystem}:${dependency.name} | ${dependency.currentVersion ?? "\u2014"} | ${(dependency.lockedVersionAgeMs / 864e5).toFixed(1)} | ${dependency.versionChanges} | ${dependency.upgradeVelocityPerDay.toFixed(3)} |`);
+  }
+  return lines.join("\n");
+}
+
 // src/sbom.ts
 function toSpdx(snapshot) {
   const created = snapshot.createdAt;
@@ -1832,6 +2298,47 @@ function toCycloneDX(snapshot) {
 }
 
 // src/remediation.ts
+var LANGUAGE_BY_ECOSYSTEM = {
+  python: "python",
+  rust: "rust",
+  go: "go",
+  php: "php",
+  dotnet: "csharp"
+};
+var EXECUTABLE_ECOSYSTEMS = /* @__PURE__ */ new Set(["npm", ...Object.keys(LANGUAGE_BY_ECOSYSTEM)]);
+function versionedPackageName(operation) {
+  const version = operation.targetVersion;
+  if (!version) return operation.dependencyName;
+  switch (operation.ecosystem) {
+    case "python":
+      return `${operation.dependencyName}==${version}`;
+    case "php":
+      return `${operation.dependencyName}:${version}`;
+    default:
+      return `${operation.dependencyName}@${version}`;
+  }
+}
+function toLanguagePackageInput(operation, workspace) {
+  if (operation.action === "replace" || operation.action === "investigate") {
+    throw new Error(`${operation.action} requires a manual package choice`);
+  }
+  if (!EXECUTABLE_ECOSYSTEMS.has(operation.ecosystem)) {
+    throw new Error(`Automated remediation is not supported for ${operation.ecosystem}`);
+  }
+  const language = LANGUAGE_BY_ECOSYSTEM[operation.ecosystem];
+  const base = {
+    ...workspace ? { workspace } : {},
+    ...language ? { language } : {},
+    allowScripts: false
+  };
+  if (operation.action === "remove") {
+    if (operation.ecosystem === "go") {
+      return { ...base, operation: "add", names: [`${operation.dependencyName}@none`] };
+    }
+    return { ...base, operation: "remove", names: [operation.dependencyName] };
+  }
+  return { ...base, operation: "add", names: [versionedPackageName(operation)] };
+}
 function suggestCommand(ecosystem, name, action, targetVersion) {
   const ver = targetVersion ? `@${targetVersion}` : "@latest";
   switch (ecosystem) {
@@ -1951,14 +2458,152 @@ function renderPlanMarkdown(plan) {
   }
   return lines.join("\n");
 }
+async function applyPlan(plan, options = {}) {
+  const dryRun = options.dryRun !== false;
+  const execute = options.execute;
+  if (!dryRun && !execute) throw new Error("An execute strategy is required when dryRun is false");
+  const results = [];
+  for (const [index, item] of plan.items.entries()) {
+    if (options.signal?.aborted) throw new DOMException("Remediation cancelled", "AbortError");
+    if (dryRun) {
+      results.push({ dependencyName: item.dependencyName, status: "planned" });
+      continue;
+    }
+    const approved = options.approve ? await options.approve(item, index) : false;
+    if (!approved) {
+      results.push({
+        dependencyName: item.dependencyName,
+        status: "skipped",
+        detail: "Not approved"
+      });
+      continue;
+    }
+    try {
+      if (!execute) throw new Error("An execute strategy is required when dryRun is false");
+      const response = await execute({
+        ecosystem: item.ecosystem,
+        workspaceId: item.workspaceId,
+        dependencyName: item.dependencyName,
+        action: item.action,
+        ...item.targetVersion ? { targetVersion: item.targetVersion } : {}
+      });
+      results.push({
+        dependencyName: item.dependencyName,
+        status: "applied",
+        ...response?.detail ? { detail: response.detail } : {}
+      });
+    } catch (error) {
+      results.push({
+        dependencyName: item.dependencyName,
+        status: "failed",
+        detail: error instanceof Error ? error.message : String(error)
+      });
+    }
+  }
+  return { dryRun, items: results };
+}
+
+// src/registry/http-fetch.ts
+import { get as httpGet, request as httpRequest } from "node:http";
+import { get as httpsGet, request as httpsRequest } from "node:https";
+var DEFAULT_MAX_BODY_BYTES = 64 * 1024 * 1024;
+function retryAfterMs(headers, now = Date.now()) {
+  const value = Array.isArray(headers["retry-after"]) ? headers["retry-after"][0] : headers["retry-after"];
+  if (!value) return void 0;
+  const seconds = Number(value);
+  if (Number.isFinite(seconds) && seconds >= 0) return seconds * 1e3;
+  const date = Date.parse(value);
+  return Number.isFinite(date) ? Math.max(0, date - now) : void 0;
+}
+function delay(ms, signal) {
+  if (signal?.aborted) return Promise.reject(new DOMException("Request aborted", "AbortError"));
+  return new Promise((resolve3, reject) => {
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(new DOMException("Request aborted", "AbortError"));
+    };
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve3();
+    }, ms);
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+function requestOnce(options) {
+  return new Promise((resolve3, reject) => {
+    const method = options.method ?? "GET";
+    const requestOptions = {
+      hostname: options.hostname,
+      path: options.path,
+      method,
+      headers: options.headers,
+      signal: options.signal,
+      timeout: options.timeoutMs ?? 15e3
+    };
+    const isHttp = options.hostname === "localhost" || options.hostname === "127.0.0.1";
+    const maxBodyBytes = options.maxBodyBytes ?? DEFAULT_MAX_BODY_BYTES;
+    const callback = (response) => {
+      let body = "";
+      response.setEncoding?.("utf8");
+      response.on("data", (chunk) => {
+        body += chunk.toString();
+        if (body.length > maxBodyBytes) {
+          response.destroy();
+          reject(
+            new Error(
+              `Response body exceeded ${maxBodyBytes} bytes for ${options.hostname}${options.path}`
+            )
+          );
+        }
+      });
+      response.on("end", () => resolve3({
+        statusCode: response.statusCode ?? 0,
+        headers: response.headers,
+        body
+      }));
+    };
+    const request = method === "GET" ? (isHttp ? httpGet : httpsGet)(requestOptions, callback) : (isHttp ? httpRequest : httpsRequest)(requestOptions, callback);
+    request.on("error", reject);
+    request.on("timeout", () => {
+      request.destroy();
+      reject(new Error(`Request timeout for ${options.hostname}${options.path}`));
+    });
+    if (options.body) request.write(options.body);
+    request.end();
+  });
+}
+async function requestWithRetry(options) {
+  const maxAttempts = Math.max(1, options.maxAttempts ?? 3);
+  let lastError;
+  for (let attempt = 0; attempt < maxAttempts; attempt++) {
+    try {
+      const response = await requestOnce(options);
+      const retryable = response.statusCode === 429 || response.statusCode >= 500;
+      if (!retryable || attempt === maxAttempts - 1) return response;
+      const serverDelay = retryAfterMs(response.headers);
+      const exponential = (options.baseBackoffMs ?? 1e3) * 2 ** attempt;
+      await delay(serverDelay ?? exponential, options.signal);
+    } catch (error) {
+      if (options.signal?.aborted || error instanceof DOMException && error.name === "AbortError") throw error;
+      lastError = error instanceof Error ? error : new Error(String(error));
+      if (attempt < maxAttempts - 1) {
+        await delay((options.baseBackoffMs ?? 1e3) * 2 ** attempt, options.signal);
+      }
+    }
+  }
+  throw lastError ?? new Error(`Request failed for ${options.hostname}${options.path}`);
+}
+function parseJsonResponse(response, source) {
+  try {
+    return JSON.parse(response.body);
+  } catch {
+    throw new Error(`Invalid JSON response from ${source}`);
+  }
+}
 
 // src/registry/client.ts
-import { get as httpsGet } from "node:https";
-import { get as httpGet } from "node:http";
 var DEFAULT_TTL_MS = 10 * 60 * 1e3;
 var MAX_CONCURRENCY_PER_HOST = 3;
-var MAX_RETRIES = 3;
-var BASE_BACKOFF_MS = 1e3;
 var registryCache = /* @__PURE__ */ new Map();
 var hostConcurrency = /* @__PURE__ */ new Map();
 function getCacheKey(host, path) {
@@ -2006,54 +2651,6 @@ function releaseHostSlot(host) {
     }
   }
 }
-function sleep(ms) {
-  return new Promise((resolve3) => setTimeout(resolve3, ms));
-}
-function computeBackoff(attempt, statusCode) {
-  const base = statusCode === 429 ? BASE_BACKOFF_MS * 2 : BASE_BACKOFF_MS;
-  return base * Math.pow(2, attempt) + Math.random() * 500;
-}
-function httpsFetch(hostname, path, etag, signal) {
-  return new Promise((resolve3, reject) => {
-    const options = {
-      hostname,
-      path,
-      method: "GET",
-      headers: {
-        Accept: "application/json",
-        "User-Agent": "WrongStack-TechStack/1.0",
-        ...etag ? { "If-None-Match": etag } : {}
-      },
-      signal,
-      timeout: 15e3
-    };
-    const mod = hostname === "localhost" || hostname === "127.0.0.1" ? httpGet : httpsGet;
-    const req = mod(options, (res) => {
-      const statusCode = res.statusCode ?? 0;
-      const responseHeaders = res.headers;
-      let body = "";
-      res.on("data", (chunk) => {
-        body += chunk;
-      });
-      res.on("end", () => {
-        resolve3({
-          statusCode,
-          headers: responseHeaders,
-          body,
-          isFromCache: false
-        });
-      });
-    });
-    req.on("error", (err) => {
-      reject(err);
-    });
-    req.on("timeout", () => {
-      req.destroy();
-      reject(new Error(`Request timeout for ${hostname}${path}`));
-    });
-    req.end();
-  });
-}
 function parseNpmPackument(json, name) {
   const latestVersion = json["dist-tags"]?.["latest"];
   let deprecated;
@@ -2208,6 +2805,44 @@ var ECOSYSTEM_FETCHERS = {
     }
   }
 };
+var RegistryNotFoundError = class extends Error {
+  constructor(statusCode, packageName) {
+    super(`Registry package not found or inaccessible (${statusCode}): ${packageName}`);
+    this.statusCode = statusCode;
+    this.packageName = packageName;
+    this.name = "RegistryNotFoundError";
+  }
+  statusCode;
+  packageName;
+};
+var RegistryAuthError = class extends Error {
+  constructor(statusCode, packageName) {
+    super(`Registry authorization failed (${statusCode}): ${packageName}`);
+    this.statusCode = statusCode;
+    this.packageName = packageName;
+    this.name = "RegistryAuthError";
+  }
+  statusCode;
+  packageName;
+};
+var RegistryRateLimitError = class extends Error {
+  constructor(statusCode, host) {
+    super(`Registry ${host} returned ${statusCode} after 3 attempts`);
+    this.statusCode = statusCode;
+    this.host = host;
+    this.name = "RegistryRateLimitError";
+  }
+  statusCode;
+  host;
+};
+var RegistryNetworkError = class extends Error {
+  constructor(message, cause) {
+    super(message);
+    this.cause = cause;
+    this.name = "RegistryNetworkError";
+  }
+  cause;
+};
 async function lookupRegistry(ecosystem, name, options = {}) {
   const fetcher = ECOSYSTEM_FETCHERS[ecosystem];
   if (!fetcher) {
@@ -2223,48 +2858,52 @@ async function lookupRegistry(ecosystem, name, options = {}) {
   try {
     const existingEntry = registryCache.get(cacheKey);
     const etag = existingEntry?.etag;
-    let lastError;
-    for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
-      try {
-        const response = await httpsFetch(fetcher.host, path, etag, options.signal);
-        if (response.statusCode === 304 && existingEntry) {
-          setCache(cacheKey, existingEntry.data, existingEntry.etag, DEFAULT_TTL_MS);
-          return existingEntry.data;
-        }
-        if (response.statusCode === 401 || response.statusCode === 403 || response.statusCode === 404) {
-          return void 0;
-        }
-        if (response.statusCode === 429 || response.statusCode >= 500) {
-          if (attempt < MAX_RETRIES - 1) {
-            const backoff = computeBackoff(attempt, response.statusCode);
-            await sleep(backoff);
-            continue;
-          }
-          throw new Error(`Registry ${fetcher.host} returned ${response.statusCode} after ${MAX_RETRIES} attempts`);
-        }
-        let json;
-        try {
-          json = JSON.parse(response.body);
-        } catch {
-          throw new Error(`Invalid JSON response from ${fetcher.host}${path}`);
-        }
-        const parsed = fetcher.parser(json, name, ecosystem);
-        if (!parsed) {
-          return void 0;
-        }
-        const responseEtag = response.headers["etag"];
-        setCache(cacheKey, parsed, responseEtag, DEFAULT_TTL_MS);
-        return parsed;
-      } catch (err) {
-        lastError = err instanceof Error ? err : new Error(String(err));
-        if (attempt < MAX_RETRIES - 1) {
-          const isRateLimit = err instanceof Error && err.message.includes("429");
-          const backoff = computeBackoff(attempt, isRateLimit ? 429 : 500);
-          await sleep(backoff);
-        }
-      }
+    let response;
+    try {
+      response = await requestWithRetry({
+        hostname: fetcher.host,
+        path,
+        headers: {
+          Accept: "application/json",
+          "User-Agent": "WrongStack-TechStack/1.0",
+          ...etag ? { "If-None-Match": etag } : {}
+        },
+        signal: options.signal,
+        timeoutMs: 15e3,
+        maxAttempts: 3
+      });
+    } catch (error) {
+      if (options.signal?.aborted) throw error;
+      const cause = error instanceof Error ? error : new Error(String(error));
+      throw new RegistryNetworkError(cause.message, cause);
+    }
+    if (response.statusCode === 304 && existingEntry) {
+      setCache(cacheKey, existingEntry.data, existingEntry.etag, DEFAULT_TTL_MS);
+      return existingEntry.data;
     }
-    throw lastError ?? new Error(`Failed to look up ${ecosystem}:${name}`);
+    if (response.statusCode === 401 || response.statusCode === 404) {
+      if (options.strictErrors) throw new RegistryNotFoundError(response.statusCode, name);
+      return void 0;
+    }
+    if (response.statusCode === 403) {
+      if (options.strictErrors) throw new RegistryAuthError(response.statusCode, name);
+      return void 0;
+    }
+    if (response.statusCode === 429) {
+      throw new RegistryRateLimitError(response.statusCode, fetcher.host);
+    }
+    if (response.statusCode >= 500) {
+      throw new RegistryNetworkError(`Registry ${fetcher.host} returned ${response.statusCode} after 3 attempts`);
+    }
+    if (response.statusCode < 200 || response.statusCode >= 300) {
+      throw new RegistryNetworkError(`Unexpected registry response ${response.statusCode} from ${fetcher.host}`);
+    }
+    const json = parseJsonResponse(response, `${fetcher.host}${path}`);
+    const parsed = fetcher.parser(json, name, ecosystem);
+    if (!parsed) return void 0;
+    const responseEtag = Array.isArray(response.headers.etag) ? response.headers.etag[0] : response.headers.etag;
+    setCache(cacheKey, parsed, responseEtag, DEFAULT_TTL_MS);
+    return parsed;
   } finally {
     releaseHostSlot(fetcher.host);
   }
@@ -2293,14 +2932,21 @@ function clearRegistryCache() {
   registryCache.clear();
   hostConcurrency.clear();
 }
+function invalidateRegistryCache(ecosystem, names) {
+  const fetcher = ECOSYSTEM_FETCHERS[ecosystem];
+  if (!fetcher) return 0;
+  const keys = names ? names.map((name) => getCacheKey(fetcher.host, fetcher.path(name))) : [...registryCache.keys()].filter((key) => key.startsWith(fetcher.host));
+  let removed = 0;
+  for (const key of keys) {
+    if (registryCache.delete(key)) removed++;
+  }
+  return removed;
+}
 
 // src/advisory/osv.ts
-import { get as httpsGet2 } from "node:https";
 var OSV_API_BASE = "api.osv.dev";
 var OSV_QUERY_BATCH_PATH = "/v1/querybatch";
 var MAX_BATCH_SIZE = 500;
-var MAX_RETRIES2 = 3;
-var BASE_BACKOFF_MS2 = 1e3;
 function mapSeverity(osvSeverity, databaseSeverity) {
   if (osvSeverity && osvSeverity.length > 0) {
     for (const s of osvSeverity) {
@@ -2322,44 +2968,6 @@ function mapSeverity(osvSeverity, databaseSeverity) {
   }
   return "info";
 }
-function osvPostRequest(body, signal) {
-  return new Promise((resolve3, reject) => {
-    const options = {
-      hostname: OSV_API_BASE,
-      path: OSV_QUERY_BATCH_PATH,
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        "Content-Length": Buffer.byteLength(body).toString(),
-        "User-Agent": "WrongStack-TechStack/1.0"
-      },
-      signal,
-      timeout: 3e4
-    };
-    const req = httpsGet2(options, (res) => {
-      const statusCode = res.statusCode ?? 0;
-      let responseBody = "";
-      res.on("data", (chunk) => {
-        responseBody += chunk;
-      });
-      res.on("end", () => {
-        resolve3({ statusCode, body: responseBody });
-      });
-    });
-    req.on("error", (err) => {
-      reject(err);
-    });
-    req.on("timeout", () => {
-      req.destroy();
-      reject(new Error("OSV API request timeout"));
-    });
-    req.write(body);
-    req.end();
-  });
-}
-function sleep2(ms) {
-  return new Promise((resolve3) => setTimeout(resolve3, ms));
-}
 async function queryOsvBatch(purls, options = {}) {
   const advisories = /* @__PURE__ */ new Map();
   for (const purl of purls) {
@@ -2369,7 +2977,6 @@ async function queryOsvBatch(purls, options = {}) {
   for (let i = 0; i < purls.length; i += MAX_BATCH_SIZE) {
     batches.push(purls.slice(i, i + MAX_BATCH_SIZE));
   }
-  let lastError;
   for (const batch of batches) {
     const requestBody = {
       queries: batch.map((purl) => ({
@@ -2377,54 +2984,38 @@ async function queryOsvBatch(purls, options = {}) {
       }))
     };
     const jsonBody = JSON.stringify(requestBody);
-    let success = false;
-    for (let attempt = 0; attempt < MAX_RETRIES2 && !success; attempt++) {
-      try {
-        const response = await osvPostRequest(jsonBody, options.signal);
-        if (response.statusCode === 200) {
-          const result = JSON.parse(response.body);
-          if (result.results && Array.isArray(result.results)) {
-            for (let i = 0; i < result.results.length; i++) {
-              const purl = batch[i];
-              if (!purl) continue;
-              const vulns = result.results[i]?.vulns;
-              if (!vulns || vulns.length === 0) continue;
-              const parsed = [];
-              for (const vuln of vulns) {
-                const dbSpecific = vuln.database_specific;
-                const affectedDbSpecific = vuln.affected?.[0]?.database_specific;
-                const severitySource = dbSpecific?.severity ?? affectedDbSpecific?.severity;
-                parsed.push({
-                  id: vuln.id,
-                  summary: vuln.summary ?? vuln.details ?? "No summary available",
-                  severity: mapSeverity(vuln.severity, severitySource),
-                  aliases: vuln.aliases ?? []
-                });
-              }
-              advisories.set(purl, parsed);
-            }
-          }
-          success = true;
-        } else if (response.statusCode === 429 || response.statusCode >= 500) {
-          if (attempt < MAX_RETRIES2 - 1) {
-            const backoff = BASE_BACKOFF_MS2 * Math.pow(2, attempt) + Math.random() * 500;
-            await sleep2(backoff);
-          } else {
-            throw new Error(`OSV API returned ${response.statusCode} after ${MAX_RETRIES2} attempts: ${response.body}`);
-          }
-        } else {
-          throw new Error(`OSV API returned ${response.statusCode}: ${response.body}`);
-        }
-      } catch (err) {
-        lastError = err instanceof Error ? err : new Error(String(err));
-        if (attempt < MAX_RETRIES2 - 1) {
-          const backoff = BASE_BACKOFF_MS2 * Math.pow(2, attempt) + Math.random() * 500;
-          await sleep2(backoff);
-        }
-      }
-    }
-    if (!success && lastError) {
-      throw lastError;
+    const response = await requestWithRetry({
+      hostname: OSV_API_BASE,
+      path: OSV_QUERY_BATCH_PATH,
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "Content-Length": Buffer.byteLength(jsonBody).toString(),
+        "User-Agent": "WrongStack-TechStack/1.0"
+      },
+      body: jsonBody,
+      signal: options.signal,
+      timeoutMs: 3e4,
+      maxAttempts: 3
+    });
+    if (response.statusCode !== 200) {
+      throw new Error(`OSV API returned ${response.statusCode}: ${response.body}`);
+    }
+    const result = parseJsonResponse(response, "api.osv.dev/v1/querybatch");
+    for (let i = 0; i < result.results.length; i++) {
+      const purl = batch[i];
+      if (!purl) continue;
+      const vulns = result.results[i]?.vulns;
+      if (!vulns || vulns.length === 0) continue;
+      advisories.set(purl, vulns.map((vuln) => ({
+        id: vuln.id,
+        summary: vuln.summary ?? vuln.details ?? "No summary available",
+        severity: mapSeverity(
+          vuln.severity,
+          vuln.database_specific?.severity ?? vuln.affected?.[0]?.database_specific?.severity
+        ),
+        aliases: vuln.aliases ?? []
+      })));
     }
   }
   const evidence = {
@@ -2441,9 +3032,9 @@ async function queryOsvSingle(purl, options = {}) {
 }
 
 // src/advisory/native-audit.ts
-import { spawnSync } from "node:child_process";
-import { existsSync as existsSync2 } from "node:fs";
-import { join as join6 } from "node:path";
+import { execFile } from "node:child_process";
+import { access as access3 } from "node:fs/promises";
+import { join as join8 } from "node:path";
 function npmSeverity(s) {
   switch (s.toLowerCase()) {
     case "critical":
@@ -2473,8 +3064,8 @@ function cargoSeverity(s) {
       return "info";
   }
 }
-function runNpmAudit(workspaceRoot2) {
-  const result = runAuditCommand("npm", ["audit", "--json"], workspaceRoot2);
+async function runNpmAudit(workspaceRoot2, runner = defaultAuditCommandRunner) {
+  const result = await runner("npm", ["audit", "--json"], workspaceRoot2);
   const advisories = [];
   let detailLines = [];
   if (result.status === 0 || result.status === 1) {
@@ -2523,20 +3114,22 @@ function runNpmAudit(workspaceRoot2) {
   };
   return { advisories, evidence };
 }
-function runPipAudit(workspaceRoot2) {
+async function runPipAudit(workspaceRoot2, runner = defaultAuditCommandRunner) {
   const reqFiles = ["requirements.txt", "requirements-dev.txt"];
   let reqFlag = "";
   for (const f of reqFiles) {
-    if (existsSync2(join6(workspaceRoot2, f))) {
+    try {
+      await access3(join8(workspaceRoot2, f));
       reqFlag = `--requirement ${f}`;
       break;
+    } catch {
     }
   }
   const args = ["audit", "--format", "json"];
   if (reqFlag) {
     args.push(...reqFlag.split(" "));
   }
-  const result = runAuditCommand("pip-audit" in process.env ? "pip-audit" : "pip-audit", args, workspaceRoot2);
+  const result = await runner("pip-audit", args, workspaceRoot2);
   return parsePipAuditOutput(result);
 }
 function parsePipAuditOutput(result) {
@@ -2570,8 +3163,8 @@ function parsePipAuditOutput(result) {
   };
   return { advisories, evidence };
 }
-function runCargoAudit(workspaceRoot2) {
-  const result = runAuditCommand("cargo", ["audit", "--json"], workspaceRoot2);
+async function runCargoAudit(workspaceRoot2, runner = defaultAuditCommandRunner) {
+  const result = await runner("cargo", ["audit", "--json"], workspaceRoot2);
   return parseCargoAuditOutput(result);
 }
 function parseCargoAuditOutput(result) {
@@ -2612,8 +3205,8 @@ function parseCargoAuditOutput(result) {
   };
   return { advisories, evidence };
 }
-function runGoVulncheck(workspaceRoot2) {
-  const result = runAuditCommand("govulncheck", ["-json"], workspaceRoot2);
+async function runGoVulncheck(workspaceRoot2, runner = defaultAuditCommandRunner) {
+  const result = await runner("govulncheck", ["-json"], workspaceRoot2);
   const advisories = [];
   let detailLines = [];
   if (result.status === 0 || result.status === 3) {
@@ -2651,8 +3244,8 @@ function runGoVulncheck(workspaceRoot2) {
   };
   return { advisories, evidence };
 }
-function runComposerAudit(workspaceRoot2) {
-  const result = runAuditCommand("composer", ["audit", "--format=json"], workspaceRoot2);
+async function runComposerAudit(workspaceRoot2, runner = defaultAuditCommandRunner) {
+  const result = await runner("composer", ["audit", "--format=json"], workspaceRoot2);
   const advisories = [];
   let detailLines = [];
   if (result.status === 0) {
@@ -2688,8 +3281,8 @@ function runComposerAudit(workspaceRoot2) {
   };
   return { advisories, evidence };
 }
-function runDotnetAudit(workspaceRoot2) {
-  const result = runAuditCommand("dotnet", ["package", "audit", "--format", "json"], workspaceRoot2);
+async function runDotnetAudit(workspaceRoot2, runner = defaultAuditCommandRunner) {
+  const result = await runner("dotnet", ["package", "audit", "--format", "json"], workspaceRoot2);
   const advisories = [];
   let detailLines = [];
   if (result.status === 0) {
@@ -2739,44 +3332,50 @@ function runDotnetAudit(workspaceRoot2) {
   };
   return { advisories, evidence };
 }
-function runAuditCommand(command, args, cwd) {
-  try {
-    const options = {
+var defaultAuditCommandRunner = (command, args, cwd) => new Promise((resolve3) => {
+  execFile(
+    command,
+    [...args],
+    {
       cwd,
-      encoding: "utf-8",
+      encoding: "utf8",
       timeout: 6e4,
       maxBuffer: 10 * 1024 * 1024,
-      // 10MB
-      windowsHide: true
-    };
-    const result = spawnSync(command, args, options);
-    return {
-      status: result.status,
-      stdout: result.stdout?.toString() ?? "",
-      stderr: result.stderr?.toString() ?? ""
-    };
-  } catch (err) {
-    return {
-      status: null,
-      stdout: "",
-      stderr: err instanceof Error ? err.message : String(err)
-    };
-  }
-}
-function runNativeAudit(ecosystem, workspaceRoot2) {
+      windowsHide: true,
+      // On Windows the audit tools are batch shims — `npm`/`composer` resolve
+      // to npm.cmd/composer.cmd, which execFile cannot launch without a shell
+      // (it ignores PATHEXT), so it fails ENOENT and every Windows audit
+      // silently reports "exited with code null" with zero advisories. Route
+      // through the shell there. Safe because every command and argument here
+      // is a static literal (conventional filenames only) — no user input
+      // reaches the command line; the dynamic workspace path is passed as cwd.
+      shell: process.platform === "win32"
+    },
+    (error, stdout, stderr) => {
+      const exitCode = error?.code;
+      const status = error ? typeof exitCode === "number" ? exitCode : null : 0;
+      resolve3({
+        status,
+        stdout,
+        stderr: stderr || (status === null && error ? error.message : "")
+      });
+    }
+  );
+});
+async function runNativeAudit(ecosystem, workspaceRoot2, runner = defaultAuditCommandRunner) {
   switch (ecosystem) {
     case "npm":
-      return runNpmAudit(workspaceRoot2);
+      return runNpmAudit(workspaceRoot2, runner);
     case "python":
-      return runPipAudit(workspaceRoot2);
+      return runPipAudit(workspaceRoot2, runner);
     case "rust":
-      return runCargoAudit(workspaceRoot2);
+      return runCargoAudit(workspaceRoot2, runner);
     case "go":
-      return runGoVulncheck(workspaceRoot2);
+      return runGoVulncheck(workspaceRoot2, runner);
     case "php":
-      return runComposerAudit(workspaceRoot2);
+      return runComposerAudit(workspaceRoot2, runner);
     case "dotnet":
-      return runDotnetAudit(workspaceRoot2);
+      return runDotnetAudit(workspaceRoot2, runner);
     // dart/pub doesn't have a standard audit command — use OSV instead
     default:
       return {
@@ -2790,14 +3389,41 @@ function runNativeAudit(ecosystem, workspaceRoot2) {
       };
   }
 }
-function isNativeAuditAvailable(ecosystem) {
-  const result = runAuditCommand(
+async function isNativeAuditAvailable(ecosystem, runner = defaultAuditCommandRunner) {
+  const result = await runner(
     ecosystem === "npm" ? "npm" : ecosystem === "python" ? "pip-audit" : ecosystem === "rust" ? "cargo" : ecosystem === "go" ? "govulncheck" : ecosystem === "php" ? "composer" : ecosystem === "dotnet" ? "dotnet" : "",
     ["--version"],
     process.cwd()
   );
   return result.status === 0;
 }
+function createAuditRunner(commandRunner = defaultAuditCommandRunner) {
+  const commandFor = (ecosystem) => {
+    switch (ecosystem) {
+      case "npm":
+        return "npm";
+      case "python":
+        return "pip-audit";
+      case "rust":
+        return "cargo";
+      case "go":
+        return "govulncheck";
+      case "php":
+        return "composer";
+      case "dotnet":
+        return "dotnet";
+      default:
+        return void 0;
+    }
+  };
+  return {
+    run: (ecosystem, workspaceRoot2) => runNativeAudit(ecosystem, workspaceRoot2, commandRunner),
+    isAvailable: async (ecosystem, cwd = process.cwd()) => {
+      const command = commandFor(ecosystem);
+      return command ? (await commandRunner(command, ["--version"], cwd)).status === 0 : false;
+    }
+  };
+}
 
 // src/policy/status.ts
 function isValidSemver(version) {
@@ -2940,8 +3566,206 @@ function failedLookupStatus(source, error) {
   };
 }
 
-// src/service.ts
+// src/service/techstack-engine.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+
+// src/service/finding-factory.ts
+function computeDependencyFingerprint(dependencies) {
+  const parts = dependencies.map((dependency) => `${dependency.name}@${dependency.locked ?? dependency.requested ?? "unknown"}`).sort().join(",");
+  let hash = 0;
+  for (let index = 0; index < parts.length; index++) {
+    hash = (hash << 5) - hash + parts.charCodeAt(index);
+    hash |= 0;
+  }
+  return `ts-${Math.abs(hash).toString(36)}`;
+}
+function createFindingForStatus(dependencyId, status) {
+  const common = { dependencyId, confidence: 1, evidence: [] };
+  switch (status) {
+    case "vulnerable":
+      return { ...common, id: `finding-${dependencyId}-vuln`, type: "vulnerability", severity: "high", action: "upgrade_patch", rationale: "Known security advisory found for this package" };
+    case "deprecated":
+      return { ...common, id: `finding-${dependencyId}-dep`, type: "deprecated", severity: "medium", action: "replace", rationale: "Package is deprecated in the registry" };
+    case "yanked":
+      return { ...common, id: `finding-${dependencyId}-yank`, type: "deprecated", severity: "high", action: "replace", rationale: "Package version has been yanked from the registry" };
+    case "update_available_safe":
+      return { ...common, id: `finding-${dependencyId}-update`, type: "upgrade", severity: "info", action: "upgrade_minor", rationale: "A newer compatible version is available" };
+    case "update_available_breaking":
+      return { ...common, id: `finding-${dependencyId}-major`, type: "upgrade", severity: "low", action: "upgrade_major", rationale: "A newer version is available that may require breaking changes" };
+    default:
+      return { ...common, confidence: 0.5, id: `finding-${dependencyId}-investigate`, type: "investigate", severity: "info", action: "investigate", rationale: `Package status is "${status}" \u2014 may need investigation` };
+  }
+}
+
+// src/service/enrich-phase.ts
+async function runEnrichPhase(snapshot, options = {}) {
+  if (options.online === false || options.signal?.aborted) return snapshot;
+  const grouped = /* @__PURE__ */ new Map();
+  for (const dependency of snapshot.dependencies) {
+    if (!dependency.purl || dependency.sourceType === "path" || dependency.sourceType === "git") continue;
+    grouped.set(dependency.ecosystem, [...grouped.get(dependency.ecosystem) ?? [], dependency]);
+  }
+  const enriched = /* @__PURE__ */ new Map();
+  const findings = [...snapshot.findings];
+  for (const [ecosystem, dependencies] of grouped) {
+    for (const name of new Set(dependencies.map((dependency) => dependency.name))) {
+      if (options.signal?.aborted) throw new DOMException("TechStack job cancelled", "AbortError");
+      let registryEntry;
+      let registryStatus;
+      try {
+        registryEntry = await lookupRegistry(ecosystem, name, {
+          signal: options.signal,
+          force: options.forceRegistryRefresh,
+          strictErrors: true
+        });
+        registryStatus = registryEntry ? {
+          latestStable: registryEntry.latestStable,
+          deprecated: registryEntry.deprecated,
+          yanked: registryEntry.yanked,
+          evidence: [{ kind: "registry", source: registryEntry.source, retrievedAt: registryEntry.retrievedAt, detail: `latestStable: ${registryEntry.latestStable ?? "N/A"}, license: ${registryEntry.license ?? "N/A"}` }]
+        } : { privateOrUnresolved: true };
+      } catch (error) {
+        const unresolved = error instanceof RegistryNotFoundError || error instanceof RegistryAuthError;
+        registryStatus = unresolved ? {
+          privateOrUnresolved: true,
+          evidence: [{ kind: "registry", source: `${ecosystem} registry for ${name}`, retrievedAt: (/* @__PURE__ */ new Date()).toISOString(), detail: error.message }]
+        } : {
+          lookupFailed: true,
+          evidence: [{ kind: "registry", source: `${ecosystem} registry for ${name}`, retrievedAt: (/* @__PURE__ */ new Date()).toISOString(), detail: error instanceof Error ? error.message : "Registry lookup failed" }]
+        };
+      }
+      let advisoryStatus;
+      try {
+        const purls = dependencies.filter((dependency) => dependency.name === name).flatMap((dependency) => dependency.purl ? [dependency.purl] : []);
+        if (purls.length > 0) {
+          const result = await queryOsvBatch(purls, { signal: options.signal });
+          if ([...result.advisories.values()].some((items) => items.length > 0)) {
+            advisoryStatus = { hasAdvisory: true, evidence: [result.evidence] };
+          }
+        }
+      } catch {
+      }
+      for (const dependency of dependencies) {
+        if (dependency.name !== name) continue;
+        const status = classifyStatus(dependency, registryStatus, advisoryStatus);
+        const evidence = [...dependency.evidence, ...registryStatus?.evidence ?? [], ...advisoryStatus?.evidence ?? []];
+        enriched.set(dependency.id, {
+          ...dependency,
+          latestStable: registryEntry?.latestStable ?? dependency.latestStable,
+          license: registryEntry?.license ?? dependency.license,
+          deprecated: registryEntry?.deprecated ?? dependency.deprecated,
+          yanked: registryEntry?.yanked ?? dependency.yanked,
+          status,
+          evidence
+        });
+        if (status !== "current" && status !== "local_path" && status !== "git_dependency") findings.push(createFindingForStatus(dependency.id, status));
+      }
+    }
+  }
+  return { ...snapshot, dependencies: snapshot.dependencies.map((dependency) => enriched.get(dependency.id) ?? dependency), findings };
+}
+
+// src/service/inventory-phase.ts
 import { randomUUID } from "node:crypto";
+var ADAPTER_VERSION = "0.1.0";
+var ADAPTERS = {
+  npm: npmAdapter,
+  python: pythonAdapter,
+  rust: rustAdapter,
+  go: goAdapter,
+  dotnet: dotNetAdapter,
+  php: phpAdapter,
+  dart: dartAdapter,
+  maven: mavenAdapter,
+  gradle: gradleAdapter,
+  ruby: rubyAdapter,
+  swift: swiftAdapter,
+  elixir: elixirAdapter,
+  cpp: cppAdapter
+};
+async function runInventoryPhase(store, projectId, targetRoot, options = {}) {
+  options.onProgress?.("discovering", 0, 1);
+  const workspaces = await discoverWorkspaces(targetRoot, { signal: options.signal });
+  options.onProgress?.("inventorying", 0, workspaces.length);
+  const dependencies = [];
+  let coverage = "full";
+  let completed = 0;
+  for (const workspace of workspaces) {
+    if (options.signal?.aborted) throw new DOMException("TechStack job cancelled", "AbortError");
+    try {
+      dependencies.push(...await ADAPTERS[workspace.ecosystem].inventory(workspace, {
+        projectRoot: targetRoot,
+        includeTransitive: options.includeTransitive,
+        signal: options.signal
+      }));
+    } catch {
+    }
+    if (workspace.coverage === "unsupported") coverage = "partial";
+    completed++;
+    options.onProgress?.("inventorying", completed, workspaces.length);
+  }
+  const snapshot = {
+    id: randomUUID(),
+    projectId,
+    targetRoot,
+    fingerprint: computeDependencyFingerprint(dependencies),
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    workspaces,
+    dependencies,
+    findings: [],
+    coverage,
+    adapterVersion: ADAPTER_VERSION
+  };
+  store.saveSnapshot(snapshot);
+  return snapshot;
+}
+
+// src/service/report-generator.ts
+function generateReport(snapshot, format = "md") {
+  if (format === "json") return JSON.stringify(snapshot, null, 2);
+  const lines = [
+    "# TechStack Report",
+    "",
+    `**Generated:** ${snapshot.createdAt}`,
+    `**Target:** ${snapshot.targetRoot}`,
+    `**Fingerprint:** ${snapshot.fingerprint}`,
+    `**Workspaces:** ${snapshot.workspaces.length}`,
+    `**Dependencies:** ${snapshot.dependencies.length}`,
+    `**Findings:** ${snapshot.findings.length}`,
+    `**Coverage:** ${snapshot.coverage}`,
+    ""
+  ];
+  if (snapshot.workspaces.length > 0) {
+    lines.push("## Workspaces", "", "| Workspace | Ecosystem | Coverage | Deps |", "|---|---|---|---|");
+    for (const workspace of snapshot.workspaces) {
+      const count = snapshot.dependencies.filter((dependency) => dependency.workspaceId === workspace.id).length;
+      lines.push(`| ${workspace.relativeRoot} | ${workspace.ecosystem} | ${workspace.coverage} | ${count} |`);
+    }
+    lines.push("");
+  }
+  if (snapshot.findings.length > 0) {
+    lines.push("## Findings", "");
+    const bySeverity = /* @__PURE__ */ new Map();
+    for (const finding of snapshot.findings) bySeverity.set(finding.severity, [...bySeverity.get(finding.severity) ?? [], finding]);
+    for (const severity of ["critical", "high", "medium", "low", "info"]) {
+      const findings = bySeverity.get(severity);
+      if (!findings?.length) continue;
+      lines.push(`### ${severity.charAt(0).toUpperCase() + severity.slice(1)} (${findings.length})`, "");
+      for (const finding of findings) {
+        const dependency = snapshot.dependencies.find((candidate) => candidate.id === finding.dependencyId);
+        lines.push(`- **${dependency?.name ?? finding.dependencyId}** \u2014 ${finding.type} \u2014 ${finding.rationale}`);
+      }
+      lines.push("");
+    }
+  }
+  if (snapshot.dependencies.length > 0) {
+    lines.push("## Dependencies", "", "| Name | Ecosystem | Status | Locked | Latest |", "|---|---|---|---|---|");
+    for (const dependency of snapshot.dependencies) {
+      lines.push(`| ${dependency.name} | ${dependency.ecosystem} | ${dependency.status} | ${dependency.locked ?? "\u2014"} | ${dependency.latestStable ?? "\u2014"} |`);
+    }
+  }
+  return lines.join("\n");
+}
 
 // src/research/triage.ts
 var DEFAULT_TRIAGE_LIMIT = 40;
@@ -3003,285 +3827,45 @@ function clusterCandidates(candidates) {
   return out;
 }
 
-// src/service.ts
-function getAdapter(ecosystem) {
-  switch (ecosystem) {
-    case "npm":
-      return npmAdapter;
-    case "python":
-      return pythonAdapter;
-    case "rust":
-      return rustAdapter;
-    case "go":
-      return goAdapter;
-    case "dotnet":
-      return dotNetAdapter;
-    case "php":
-      return phpAdapter;
-    case "dart":
-      return dartAdapter;
-    // Tier B — partial support
-    case "maven":
-      return mavenAdapter;
-    case "gradle":
-      return mavenAdapter;
-    // reuse Maven adapter (same manifest family)
-    case "ruby":
-      return rubyAdapter;
-    case "swift":
-      return void 0;
-    // no adapter yet
-    case "elixir":
-      return elixirAdapter;
-    // Tier C — best-effort
-    case "cpp":
-      return cppAdapter;
-    default:
-      return void 0;
+// src/service/research-phase.ts
+async function runResearchPhase(snapshot, options = {}) {
+  if (!options.researcher || options.signal?.aborted) return snapshot;
+  const candidates = triageCandidates(snapshot.dependencies, { limit: options.researchLimit });
+  if (candidates.length === 0) return snapshot;
+  options.onProgress?.("researching", 0, candidates.length);
+  let findings;
+  try {
+    findings = await options.researcher.research(candidates, {
+      signal: options.signal,
+      onProgress: (completed, total) => options.onProgress?.("researching", completed, total)
+    });
+  } catch {
+    return snapshot;
   }
+  options.onProgress?.("synthesizing", 1, 1);
+  return findings.length ? { ...snapshot, findings: [...snapshot.findings, ...findings] } : snapshot;
 }
-var ADAPTER_VERSION = "0.1.0";
+
+// src/service/techstack-engine.ts
 var TechStackEngine = class {
-  store;
   constructor(store) {
     this.store = store;
   }
-  // ── Inventory ─────────────────────────────────────────────────────────
-  /**
-   * Run an offline inventory: discover workspaces and parse dependencies
-   * from manifests and lockfiles. No network calls.
-   *
-   * Returns a Snapshot with workspace and dependency data but no
-   * registry/advisory enrichment.
-   */
-  async inventory(projectId, targetRoot, _jobId, onProgress) {
-    const snapshotId = randomUUID();
-    onProgress?.("discovering", 0, 1);
-    const rawWorkspaces = await discoverWorkspaces(targetRoot);
-    const workspaces = rawWorkspaces.map((w) => ({
-      id: w.id,
-      relativeRoot: w.relativeRoot,
-      ecosystem: w.ecosystem,
-      packageManager: w.packageManager,
-      manifests: [...w.manifests],
-      lockfiles: [...w.lockfiles],
-      confidence: w.confidence,
-      coverage: w.coverage
-    }));
-    onProgress?.("inventorying", 0, workspaces.length);
-    const allDependencies = [];
-    let totalCoverage = "full";
-    for (let i = 0; i < workspaces.length; i++) {
-      const ws = workspaces[i];
-      const adapter = getAdapter(ws.ecosystem);
-      let deps = [];
-      if (adapter) {
-        try {
-          deps = await adapter.inventory(ws, { projectRoot: targetRoot });
-        } catch {
-          deps = [];
-        }
-      }
-      if (ws.coverage === "unsupported") {
-        totalCoverage = "partial";
-      }
-      allDependencies.push(...deps);
-      onProgress?.("inventorying", i + 1, workspaces.length);
-    }
-    const fingerprint = computeFingerprint(allDependencies);
-    const snapshot = {
-      id: snapshotId,
-      projectId,
-      targetRoot,
-      fingerprint,
-      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-      workspaces,
-      dependencies: allDependencies,
-      findings: [],
-      coverage: totalCoverage,
-      adapterVersion: ADAPTER_VERSION
-    };
-    this.store.saveSnapshot(snapshot);
-    return snapshot;
+  store;
+  inventory(projectId, targetRoot, _jobId, onProgress, options = {}) {
+    return runInventoryPhase(this.store, projectId, targetRoot, { ...options, onProgress });
   }
-  // ── Enrichment ─────────────────────────────────────────────────────────
-  /**
-   * Enrich a snapshot with registry metadata and advisory data.
-   *
-   * This is the online pass: fetches latest versions, licenses, deprecation
-   * status from registries, and queries OSV for advisories.
-   *
-   * Key contracts:
-   * - 404/401 → status `private_or_unresolved` (never `dead` or `deprecated`)
-   * - Network failure → status `unknown` with evidence detail (never `current`)
-   */
-  async enrich(snapshot, options = {}) {
-    const isOnline = options.online !== false;
-    if (!isOnline || options.signal?.aborted) {
-      return snapshot;
-    }
-    const byEcosystem = /* @__PURE__ */ new Map();
-    for (const dep of snapshot.dependencies) {
-      if (dep.sourceType === "path" || dep.sourceType === "git") continue;
-      if (!dep.purl) continue;
-      const list = byEcosystem.get(dep.ecosystem);
-      if (list) {
-        list.push(dep);
-      } else {
-        byEcosystem.set(dep.ecosystem, [dep]);
-      }
-    }
-    const enrichedDeps = /* @__PURE__ */ new Map();
-    const allFindings = [...snapshot.findings];
-    for (const [ecosystem, deps] of byEcosystem) {
-      const names = [...new Set(deps.map((d) => d.name))];
-      for (const name of names) {
-        const lookupOpts = {};
-        if (options.signal) lookupOpts.signal = options.signal;
-        if (options.forceRegistryRefresh) lookupOpts.force = true;
-        let registryEntry;
-        let registryStatus;
-        try {
-          registryEntry = await lookupRegistry(ecosystem, name, lookupOpts);
-          if (registryEntry) {
-            registryStatus = {
-              latestStable: registryEntry.latestStable,
-              deprecated: registryEntry.deprecated,
-              yanked: registryEntry.yanked,
-              evidence: [
-                {
-                  kind: "registry",
-                  source: registryEntry.source,
-                  retrievedAt: registryEntry.retrievedAt,
-                  detail: `latestStable: ${registryEntry.latestStable ?? "N/A"}, license: ${registryEntry.license ?? "N/A"}`
-                }
-              ]
-            };
-          } else {
-            registryStatus = {
-              privateOrUnresolved: true,
-              evidence: [
-                {
-                  kind: "registry",
-                  source: `${ecosystem} registry for ${name}`,
-                  retrievedAt: (/* @__PURE__ */ new Date()).toISOString(),
-                  detail: "Package returned 404/401 \u2014 private or unresolved"
-                }
-              ]
-            };
-          }
-        } catch (err) {
-          registryStatus = {
-            lookupFailed: true,
-            evidence: [
-              {
-                kind: "registry",
-                source: `${ecosystem} registry for ${name}`,
-                retrievedAt: (/* @__PURE__ */ new Date()).toISOString(),
-                detail: err instanceof Error ? err.message : "Registry lookup failed"
-              }
-            ]
-          };
-        }
-        let advisoryStatus;
-        try {
-          const depList = deps.filter((d) => d.name === name);
-          const purls = depList.map((d) => d.purl).filter((p) => !!p);
-          if (purls.length > 0) {
-            const osvResult = await queryOsvBatch(purls, { signal: options.signal });
-            const hasAdvisory = [...osvResult.advisories.values()].some(
-              (advisories) => advisories.length > 0
-            );
-            if (hasAdvisory) {
-              advisoryStatus = {
-                hasAdvisory: true
-              };
-            }
-          }
-        } catch {
-        }
-        for (const dep of deps) {
-          if (dep.name !== name) continue;
-          const newStatus = classifyStatus(dep, registryStatus, advisoryStatus);
-          const newEvidence = [
-            ...dep.evidence,
-            ...registryStatus?.evidence ?? [],
-            ...advisoryStatus?.evidence ?? []
-          ];
-          enrichedDeps.set(dep.id, {
-            ...dep,
-            latestStable: registryEntry?.latestStable ?? dep.latestStable,
-            license: registryEntry?.license ?? dep.license,
-            deprecated: registryEntry?.deprecated ?? dep.deprecated,
-            yanked: registryEntry?.yanked ?? dep.yanked,
-            status: newStatus,
-            evidence: newEvidence
-          });
-          if (newStatus !== "current" && newStatus !== "local_path" && newStatus !== "git_dependency") {
-            allFindings.push(
-              createFindingForStatus(dep.id, newStatus, registryEntry?.license)
-            );
-          }
-        }
-      }
-    }
-    const finalDependencies = snapshot.dependencies.map(
-      (dep) => enrichedDeps.get(dep.id) ?? dep
-    );
-    return {
-      ...snapshot,
-      dependencies: finalDependencies,
-      findings: allFindings
-    };
+  enrich(snapshot, options = {}) {
+    return runEnrichPhase(snapshot, options);
   }
-  // ── Research ───────────────────────────────────────────────────────────
-  /**
-   * Interpret an enriched snapshot with the LLM: triage the problem cases,
-   * research them, and append the resulting findings.
-   *
-   * Additive by construction. Two invariants hold here, and they are the whole
-   * reason this is a separate pass rather than part of `enrich()`:
-   *
-   * 1. **`snapshot.dependencies` is returned untouched.** Version facts come
-   *    only from registry evidence — the LLM cannot fabricate a `latestStable`
-   *    because `Finding` has nowhere to put one (SDD §472).
-   * 2. **Failure is not fatal.** No researcher, no candidates, a provider
-   *    outage, a dry web search — every one of them returns the input snapshot
-   *    unchanged. A deterministic report is the floor, never a casualty of the
-   *    optional stage above it.
-   *
-   * @see docs/specs/techstack-sdd.md §31, §472
-   */
-  async research(snapshot, options = {}) {
-    if (!options.researcher || options.signal?.aborted) return snapshot;
-    const candidates = triageCandidates(snapshot.dependencies, {
-      limit: options.researchLimit
-    });
-    if (candidates.length === 0) return snapshot;
-    options.onProgress?.("researching", 0, candidates.length);
-    let findings;
-    try {
-      findings = await options.researcher.research(candidates, {
-        signal: options.signal,
-        onProgress: (completed, total) => {
-          options.onProgress?.("researching", completed, total);
-        }
-      });
-    } catch {
-      return snapshot;
-    }
-    options.onProgress?.("synthesizing", 1, 1);
-    if (findings.length === 0) return snapshot;
-    return { ...snapshot, findings: [...snapshot.findings, ...findings] };
+  research(snapshot, options = {}) {
+    return runResearchPhase(snapshot, options);
+  }
+  generateReport(snapshot, format = "md") {
+    return generateReport(snapshot, format);
   }
-  // ── Analyze ───────────────────────────────────────────────────────────
-  /**
-   * Run a full analysis: inventory + enrich + research + persist.
-   * This is the main entry point for the analyze job flow.
-   */
   async analyze(projectId, options) {
-    const jobId = options.jobId ?? randomUUID();
-    const requestedBy = options.requestedBy ?? "system";
+    const jobId = options.jobId ?? randomUUID2();
     const job = {
       id: jobId,
       projectId,
@@ -3289,7 +3873,7 @@ var TechStackEngine = class {
       kind: "analyze",
       status: "queued",
       fingerprint: "",
-      requestedBy,
+      requestedBy: options.requestedBy ?? "system",
       sessionId: options.sessionId,
       createdAt: (/* @__PURE__ */ new Date()).toISOString(),
       progress: { phase: "queued", completed: 0, total: 0 }
@@ -3305,199 +3889,32 @@ var TechStackEngine = class {
     try {
       throwIfAborted();
       updateJob("discovering", { phase: "discovering", completed: 0, total: 1 });
-      const snapshot = await this.inventory(
-        projectId,
-        options.targetRoot,
-        jobId,
-        (phase, completed, total) => {
-          throwIfAborted();
-          updateJob(phase, { phase, completed, total });
-        }
-      );
+      let snapshot = await this.inventory(projectId, options.targetRoot, jobId, (phase, completed, total) => {
+        throwIfAborted();
+        updateJob(phase, { phase, completed, total });
+      }, { includeTransitive: options.includeTransitive, signal: options.signal });
       throwIfAborted();
-      const isOnline = options.online !== false;
-      if (isOnline) {
+      if (options.online !== false) {
         updateJob("enriching", { phase: "enriching", completed: 0, total: 1 });
-        const enriched = await this.enrich(snapshot, {
-          online: true,
-          signal: options.signal
-        });
+        snapshot = await this.enrich(snapshot, { online: true, signal: options.signal });
         throwIfAborted();
-        const researched = await this.research(enriched, {
+        snapshot = await this.research(snapshot, {
           researcher: options.researcher,
           researchLimit: options.researchLimit,
           signal: options.signal,
-          onProgress: (phase, completed, total) => {
-            updateJob(phase, { phase, completed, total });
-          }
+          onProgress: (phase, completed, total) => updateJob(phase, { phase, completed, total })
         });
         throwIfAborted();
-        this.store.saveSnapshot(researched);
-        updateJob("completed", { phase: "completed", completed: 1, total: 1 });
-        return {
-          snapshot: researched,
-          job: { ...job, status: "completed", completedAt: (/* @__PURE__ */ new Date()).toISOString() }
-        };
       }
       this.store.saveSnapshot(snapshot);
       updateJob("completed", { phase: "completed", completed: 1, total: 1 });
-      return {
-        snapshot,
-        job: { ...job, status: "completed", completedAt: (/* @__PURE__ */ new Date()).toISOString() }
-      };
-    } catch (err) {
-      if (options.signal?.aborted || err instanceof DOMException && err.name === "AbortError") {
-        updateJob("cancelled");
-      } else {
-        updateJob("failed");
-      }
-      throw err;
+      return { snapshot, job: { ...job, status: "completed", completedAt: (/* @__PURE__ */ new Date()).toISOString() } };
+    } catch (error) {
+      updateJob(options.signal?.aborted || error instanceof DOMException && error.name === "AbortError" ? "cancelled" : "failed");
+      throw error;
     }
   }
-  // ── Report generation ─────────────────────────────────────────────────
-  /**
-   * Generate a human-readable report from a snapshot.
-   *
-   * @param format 'md' for Markdown, 'json' for raw JSON.
-   * @returns The report as a string.
-   */
-  generateReport(snapshot, format = "md") {
-    if (format === "json") return JSON.stringify(snapshot, null, 2);
-    const lines = [
-      "# TechStack Report",
-      "",
-      `**Generated:** ${snapshot.createdAt}`,
-      `**Target:** ${snapshot.targetRoot}`,
-      `**Fingerprint:** ${snapshot.fingerprint}`,
-      `**Workspaces:** ${snapshot.workspaces.length}`,
-      `**Dependencies:** ${snapshot.dependencies.length}`,
-      `**Findings:** ${snapshot.findings.length}`,
-      `**Coverage:** ${snapshot.coverage}`,
-      ""
-    ];
-    if (snapshot.workspaces.length > 0) {
-      lines.push("## Workspaces", "");
-      lines.push("| Workspace | Ecosystem | Coverage | Deps |");
-      lines.push("|---|---|---|---|");
-      for (const ws of snapshot.workspaces) {
-        const depCount = snapshot.dependencies.filter((d) => d.workspaceId === ws.id).length;
-        lines.push(`| ${ws.relativeRoot} | ${ws.ecosystem} | ${ws.coverage} | ${depCount} |`);
-      }
-      lines.push("");
-    }
-    const findings = snapshot.findings;
-    if (findings.length > 0) {
-      lines.push("## Findings", "");
-      const bySeverity = /* @__PURE__ */ new Map();
-      for (const f of findings) {
-        const list = bySeverity.get(f.severity) ?? [];
-        list.push(f);
-        bySeverity.set(f.severity, list);
-      }
-      for (const sev of ["critical", "high", "medium", "low", "info"]) {
-        const items = bySeverity.get(sev);
-        if (!items || items.length === 0) continue;
-        lines.push(`### ${sev.charAt(0).toUpperCase() + sev.slice(1)} (${items.length})`, "");
-        for (const f of items) {
-          const dep = snapshot.dependencies.find((d) => d.id === f.dependencyId);
-          lines.push(`- **${dep?.name ?? f.dependencyId}** \u2014 ${f.type} \u2014 ${f.rationale}`);
-        }
-        lines.push("");
-      }
-    }
-    if (snapshot.dependencies.length > 0) {
-      lines.push("## Dependencies", "");
-      lines.push("| Name | Ecosystem | Status | Locked | Latest |");
-      lines.push("|---|---|---|---|---|");
-      for (const dep of snapshot.dependencies) {
-        lines.push(
-          `| ${dep.name} | ${dep.ecosystem} | ${dep.status} | ${dep.locked ?? "\u2014"} | ${dep.latestStable ?? "\u2014"} |`
-        );
-      }
-    }
-    return lines.join("\n");
-  }
 };
-function computeFingerprint(dependencies) {
-  const parts = dependencies.map((d) => `${d.name}@${d.locked ?? d.requested ?? "unknown"}`).sort().join(",");
-  let hash = 0;
-  for (let i = 0; i < parts.length; i++) {
-    const char = parts.charCodeAt(i);
-    hash = (hash << 5) - hash + char;
-    hash |= 0;
-  }
-  return `ts-${Math.abs(hash).toString(36)}`;
-}
-function createFindingForStatus(dependencyId, status, _license) {
-  switch (status) {
-    case "vulnerable":
-      return {
-        id: `finding-${dependencyId}-vuln`,
-        dependencyId,
-        type: "vulnerability",
-        severity: "high",
-        action: "upgrade_patch",
-        confidence: 1,
-        rationale: "Known security advisory found for this package",
-        evidence: []
-      };
-    case "deprecated":
-      return {
-        id: `finding-${dependencyId}-dep`,
-        dependencyId,
-        type: "deprecated",
-        severity: "medium",
-        action: "replace",
-        confidence: 1,
-        rationale: "Package is deprecated in the registry",
-        evidence: []
-      };
-    case "yanked":
-      return {
-        id: `finding-${dependencyId}-yank`,
-        dependencyId,
-        type: "deprecated",
-        severity: "high",
-        action: "replace",
-        confidence: 1,
-        rationale: "Package version has been yanked from the registry",
-        evidence: []
-      };
-    case "update_available_safe":
-      return {
-        id: `finding-${dependencyId}-update`,
-        dependencyId,
-        type: "upgrade",
-        severity: "info",
-        action: "upgrade_minor",
-        confidence: 1,
-        rationale: "A newer compatible version is available",
-        evidence: []
-      };
-    case "update_available_breaking":
-      return {
-        id: `finding-${dependencyId}-major`,
-        dependencyId,
-        type: "upgrade",
-        severity: "low",
-        action: "upgrade_major",
-        confidence: 1,
-        rationale: "A newer version is available that may require breaking changes",
-        evidence: []
-      };
-    default:
-      return {
-        id: `finding-${dependencyId}-investigate`,
-        dependencyId,
-        type: "investigate",
-        severity: "info",
-        action: "investigate",
-        confidence: 0.5,
-        rationale: `Package status is "${status}" \u2014 may need investigation`,
-        evidence: []
-      };
-  }
-}
 
 // src/research/llm.ts
 var DEFAULT_TIMEOUT_MS = 45e3;
@@ -3857,10 +4274,10 @@ function createToolSearch(options = {}) {
 }
 
 // src/store/sqlite.ts
-import { DatabaseSync } from "node:sqlite";
-import { mkdirSync, existsSync as existsSync3 } from "node:fs";
-import { join as join7 } from "node:path";
-import { homedir } from "node:os";
+import { createRequire } from "node:module";
+import { mkdirSync, existsSync as existsSync2 } from "node:fs";
+import { dirname as dirname2, join as join9 } from "node:path";
+import { wstackGlobalRoot } from "@wrongstack/core/utils";
 
 // src/store/schema.ts
 var SCHEMA_VERSION = 1;
@@ -3930,30 +4347,77 @@ function applySchema(db) {
 }
 
 // src/store/sqlite.ts
+var DatabaseSyncCtor;
+var SQLITE_EXPERIMENTAL_WARNING = "SQLite is an experimental feature and might change at any time";
+function loadDatabaseSync() {
+  if (DatabaseSyncCtor) return DatabaseSyncCtor;
+  const originalEmitWarning = process.emitWarning;
+  const forwardWarning = originalEmitWarning.bind(process);
+  process.emitWarning = ((warning, ...rest) => {
+    const message = typeof warning === "string" ? warning : warning instanceof Error ? warning.message : "";
+    const typeOrOptions = rest[0];
+    const warningType = typeof warning === "string" ? typeof typeOrOptions === "string" ? typeOrOptions : typeof typeOrOptions === "object" && typeOrOptions !== null && "type" in typeOrOptions && typeof typeOrOptions.type === "string" ? typeOrOptions.type : "" : warning instanceof Error ? warning.name : "";
+    const warningCode = typeof warning === "string" ? typeof typeOrOptions === "object" && typeOrOptions !== null && "code" in typeOrOptions && typeof typeOrOptions.code === "string" ? typeOrOptions.code : typeof rest[1] === "string" ? rest[1] : "" : warning instanceof Error && "code" in warning && typeof warning.code === "string" ? warning.code : "";
+    if (message === SQLITE_EXPERIMENTAL_WARNING && (warningType === "ExperimentalWarning" || warningCode === "ExperimentalWarning")) {
+      return;
+    }
+    forwardWarning(warning, ...rest);
+  });
+  try {
+    try {
+      const require2 = createRequire(import.meta.url);
+      const sqliteModule = require2("node:sqlite");
+      if (typeof sqliteModule !== "object" || sqliteModule === null || !("DatabaseSync" in sqliteModule) || typeof sqliteModule.DatabaseSync !== "function") {
+        throw new Error("node:sqlite DatabaseSync unavailable");
+      }
+      DatabaseSyncCtor = sqliteModule.DatabaseSync;
+      return DatabaseSyncCtor;
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      throw new Error(
+        `TechStack SQLite store needs Node's built-in SQLite (node:sqlite), available since Node 22.5. This runtime doesn't provide it: ${message}`,
+        { cause: error }
+      );
+    }
+  } finally {
+    process.emitWarning = originalEmitWarning;
+  }
+}
 var TechStackStore = class {
   db;
   dbPath;
+  /** Compile-once cache for fixed SQL used on hot job/snapshot paths. */
+  stmtCache = /* @__PURE__ */ new Map();
   constructor(options) {
-    this.dbPath = options.dbPath ?? join7(
-      homedir(),
-      ".wrongstack",
-      "projects",
-      options.projectSlug,
-      "techstack",
-      "techstack.db"
-    );
-    const dir = this.dbPath.slice(0, this.dbPath.lastIndexOf("\\"));
-    if (!existsSync3(dir)) {
+    this.dbPath = options.dbPath ?? join9(wstackGlobalRoot(), "projects", options.projectSlug, "techstack", "techstack.db");
+    const dir = dirname2(this.dbPath);
+    if (!existsSync2(dir)) {
       mkdirSync(dir, { recursive: true });
     }
-    this.db = new DatabaseSync(this.dbPath);
+    const Database = loadDatabaseSync();
+    this.db = new Database(this.dbPath);
     this.db.exec("PRAGMA journal_mode = WAL;");
+    this.db.exec("PRAGMA synchronous = NORMAL;");
+    this.db.exec("PRAGMA busy_timeout = 10000;");
+    this.db.exec("PRAGMA temp_store = MEMORY;");
+    this.db.exec("PRAGMA cache_size = -32768;");
+    this.db.exec("PRAGMA mmap_size = 134217728;");
     this.db.exec("PRAGMA foreign_keys = ON;");
     applySchema(this.db);
   }
+  /** Prepare-once helper: compile `sql` on first use, reuse thereafter. */
+  stmt(sql) {
+    let prepared = this.stmtCache.get(sql);
+    if (prepared === void 0) {
+      prepared = this.db.prepare(sql);
+      this.stmtCache.set(sql, prepared);
+    }
+    return prepared;
+  }
   // ── Lifecycle ───────────────────────────────────────────────────────────
   /** Close the database connection. Idempotent. */
   close() {
+    this.stmtCache.clear();
     try {
       this.db.close();
     } catch {
@@ -3966,7 +4430,7 @@ var TechStackStore = class {
   // ── Snapshots ───────────────────────────────────────────────────────────
   /** Persist a snapshot. */
   saveSnapshot(snapshot) {
-    const stmt = this.db.prepare(`
+    const stmt = this.stmt(`
       INSERT OR REPLACE INTO snapshots (id, project_id, target_root, fingerprint, created_at, raw_json, adapter_version)
       VALUES (?, ?, ?, ?, ?, ?, ?)
     `);
@@ -3982,7 +4446,7 @@ var TechStackStore = class {
   }
   /** Get a snapshot by project ID (latest). */
   getSnapshot(projectId) {
-    const stmt = this.db.prepare(`
+    const stmt = this.stmt(`
       SELECT raw_json FROM snapshots
       WHERE project_id = ?
       ORDER BY created_at DESC
@@ -3998,7 +4462,7 @@ var TechStackStore = class {
   }
   /** Get a snapshot by ID. */
   getSnapshotById(id) {
-    const stmt = this.db.prepare(`
+    const stmt = this.stmt(`
       SELECT raw_json FROM snapshots WHERE id = ?
     `);
     const row = stmt.get(id);
@@ -4011,7 +4475,7 @@ var TechStackStore = class {
   }
   /** List all snapshots for a project (newest first). */
   listSnapshots(projectId, limit = 20) {
-    const stmt = this.db.prepare(`
+    const stmt = this.stmt(`
       SELECT raw_json FROM snapshots
       WHERE project_id = ?
       ORDER BY created_at DESC
@@ -4028,7 +4492,7 @@ var TechStackStore = class {
   }
   /** Delete snapshots older than a given timestamp. */
   deleteSnapshotsBefore(projectId, before) {
-    const stmt = this.db.prepare(`
+    const stmt = this.stmt(`
       DELETE FROM snapshots WHERE project_id = ? AND created_at < ?
     `);
     const result = stmt.run(projectId, before);
@@ -4037,7 +4501,7 @@ var TechStackStore = class {
   // ── Jobs ────────────────────────────────────────────────────────────────
   /** Persist a job. */
   saveJob(job) {
-    const stmt = this.db.prepare(`
+    const stmt = this.stmt(`
       INSERT OR REPLACE INTO jobs
         (id, project_id, target_root, kind, status, fingerprint, requested_by, session_id, created_at, completed_at, error, progress_json)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
@@ -4059,7 +4523,7 @@ var TechStackStore = class {
   }
   /** Get a job by ID. */
   getJob(id) {
-    const stmt = this.db.prepare(`
+    const stmt = this.stmt(`
       SELECT * FROM jobs WHERE id = ?
     `);
     const row = stmt.get(id);
@@ -4070,7 +4534,7 @@ var TechStackStore = class {
   updateJobStatus(id, status, progress) {
     const progressJson = progress ? JSON.stringify(progress) : null;
     const completedAt = status === "completed" || status === "failed" || status === "cancelled" ? (/* @__PURE__ */ new Date()).toISOString() : null;
-    const stmt = this.db.prepare(`
+    const stmt = this.stmt(`
       UPDATE jobs
       SET status = ?, progress_json = ?, completed_at = COALESCE(?, completed_at)
       WHERE id = ?
@@ -4079,7 +4543,7 @@ var TechStackStore = class {
   }
   /** List jobs for a project (newest first). */
   listJobs(projectId, limit = 50) {
-    const stmt = this.db.prepare(`
+    const stmt = this.stmt(`
       SELECT * FROM jobs WHERE project_id = ? ORDER BY created_at DESC LIMIT ?
     `);
     const rows = stmt.all(projectId, limit);
@@ -4088,7 +4552,7 @@ var TechStackStore = class {
   // ── Outbox ──────────────────────────────────────────────────────────────
   /** Create an outbox entry. */
   createOutbox(deliveryId, reportId, sessionId) {
-    const stmt = this.db.prepare(`
+    const stmt = this.stmt(`
       INSERT OR IGNORE INTO outbox (delivery_id, report_id, session_id, status, attempts)
       VALUES (?, ?, ?, 'pending', 0)
     `);
@@ -4096,7 +4560,7 @@ var TechStackStore = class {
   }
   /** Claim an outbox entry (atomic CAS). */
   claimOutbox(deliveryId, sessionId) {
-    const stmt = this.db.prepare(`
+    const stmt = this.stmt(`
       UPDATE outbox
       SET status = 'claimed', claimed_at = datetime('now'), attempts = attempts + 1
       WHERE delivery_id = ? AND session_id = ? AND status = 'pending'
@@ -4106,7 +4570,7 @@ var TechStackStore = class {
   }
   /** Mark an outbox entry as delivered. */
   deliverOutbox(deliveryId) {
-    const stmt = this.db.prepare(`
+    const stmt = this.stmt(`
       UPDATE outbox SET status = 'delivered', delivered_at = datetime('now')
       WHERE delivery_id = ?
     `);
@@ -4114,14 +4578,14 @@ var TechStackStore = class {
   }
   /** Mark an outbox entry as failed. */
   failOutbox(deliveryId) {
-    const stmt = this.db.prepare(`
+    const stmt = this.stmt(`
       UPDATE outbox SET status = 'failed' WHERE delivery_id = ?
     `);
     stmt.run(deliveryId);
   }
   /** List outbox entries by status. */
   listOutboxByStatus(status) {
-    const stmt = this.db.prepare(`
+    const stmt = this.stmt(`
       SELECT * FROM outbox WHERE status = ?
     `);
     const rows = stmt.all(status);
@@ -4228,14 +4692,22 @@ export {
   DotNetAdapter,
   ElixirAdapter,
   GoAdapter,
+  GradleAdapter,
   MavenAdapter,
   NpmAdapter,
   PhpAdapter,
   PythonAdapter,
+  RegistryAuthError,
+  RegistryNetworkError,
+  RegistryNotFoundError,
+  RegistryRateLimitError,
   RubyAdapter,
   RustAdapter,
+  SwiftAdapter,
   TechStackEngine,
   TechStackStore,
+  TrendStore,
+  applyPlan,
   applySchema,
   attemptDelivery,
   buildPurl,
@@ -4246,6 +4718,7 @@ export {
   constructPurl,
   coverageForEcosystem,
   cppAdapter,
+  createAuditRunner,
   createProviderLlm,
   createResearcher,
   createToolSearch,
@@ -4259,6 +4732,8 @@ export {
   failedLookupStatus,
   generateUpgradePlan,
   goAdapter,
+  gradleAdapter,
+  invalidateRegistryCache,
   isNativeAuditAvailable,
   lookupRegistry,
   lookupRegistryBatch,
@@ -4275,12 +4750,15 @@ export {
   queryOsvBatch,
   queryOsvSingle,
   renderPlanMarkdown,
+  renderTrendMarkdown,
   rubyAdapter,
   runNativeAudit,
   runNpmAudit,
   rustAdapter,
   supportedRegistryEcosystems,
+  swiftAdapter,
   toCycloneDX,
+  toLanguagePackageInput,
   toSpdx,
   triageCandidates
 };