@wrongstack/techstack 0.306.3 → 0.307.0

package/dist/index.d.ts

@@ -42,8 +42,10 @@ export { createAuditRunner, isNativeAuditAvailable, runNativeAudit, runNpmAudit,
 export type { AuditCommandResult, AuditCommandRunner, ConfiguredAuditRunner, NativeAdvisory, NativeAuditResult, } from './advisory/native-audit.js';
 export { classifyStatus, compareVersions, failedLookupStatus, privateOrUnresolvedStatus, } from './policy/status.js';
 export type { AdvisoryStatusData, RegistryStatusData } from './policy/status.js';
+export { assessLicense, createLicenseFinding, normalizeLicenseId, type LicenseCategory, type LicenseRiskAssessment, } from './policy/license.js';
+export { detectWorkspaceMisalignments, type VersionMisalignment, } from './policy/misalignment.js';
 export { TechStackEngine } from './service.js';
-export type { AnalyzeOptions, EnrichOptions } from './service.js';
+export type { AnalyzeOptions, EnrichOptions, ReportFormat } from './service.js';
 export { clusterCandidates, createProviderLlm, createResearcher, createToolSearch, parseResearchJson, triageCandidates, DEFAULT_TRIAGE_LIMIT, } from './research/index.js';
 export type { CreateResearcherOptions, LlmAccessor, ResearchCluster, ResearchLlm, ResearchLlmRequest, ResearchOptions, ResearchSearch, ResearchSearchResult, SearchToolOptions, TechStackResearcher, TriageCandidate, TriageOptions, } from './research/index.js';
 export { TechStackStore } from './store/sqlite.js';

package/dist/index.js

@@ -2274,7 +2274,11 @@ function toSpdx(snapshot) {
       SPDXID: `SPDXRef-Package-${index}`,
       versionInfo: dep.locked ?? dep.requested,
       downloadLocation: dep.purl ? `https://purl.io/${dep.purl}` : "NOASSERTION",
-      licenseConcluded: dep.license ?? "NOASSERTION"
+      filesAnalyzed: false,
+      licenseConcluded: dep.license ?? "NOASSERTION",
+      licenseDeclared: dep.license ?? "NOASSERTION",
+      supplier: "NOASSERTION",
+      copyrightText: "NOASSERTION"
     }))
   };
 }
@@ -3585,6 +3589,229 @@ function failedLookupStatus(source, error) {
   };
 }
 
+// src/policy/license.ts
+var PERMISSIVE_LICENSES = /* @__PURE__ */ new Set([
+  "mit",
+  "apache-2.0",
+  "bsd-2-clause",
+  "bsd-3-clause",
+  "isc",
+  "unlicense",
+  "cc0-1.0",
+  "0bsd",
+  "zlib",
+  "wtfpl"
+]);
+var WEAK_COPYLEFT_LICENSES = /* @__PURE__ */ new Set([
+  "lgpl-2.0",
+  "lgpl-2.1",
+  "lgpl-3.0",
+  "mpl-2.0",
+  "cddl-1.0",
+  "epl-1.0",
+  "epl-2.0"
+]);
+var STRONG_COPYLEFT_LICENSES = /* @__PURE__ */ new Set([
+  "gpl-2.0",
+  "gpl-2.0-only",
+  "gpl-2.0-or-later",
+  "gpl-3.0",
+  "gpl-3.0-only",
+  "gpl-3.0-or-later",
+  "eupl-1.1",
+  "eupl-1.2",
+  "osl-3.0"
+]);
+var NETWORK_COPYLEFT_LICENSES = /* @__PURE__ */ new Set([
+  "agpl-3.0",
+  "agpl-3.0-only",
+  "agpl-3.0-or-later",
+  "sspl-1.0"
+]);
+var RESTRICTIVE_LICENSES = /* @__PURE__ */ new Set([
+  "bsl-1.1",
+  "busl-1.1",
+  "cc-by-nc-4.0",
+  "cc-by-nc-sa-4.0",
+  "commons-clause"
+]);
+function normalizeLicenseId(rawLicense) {
+  if (!rawLicense) return "";
+  return rawLicense.trim().toLowerCase().replace(/[()]/g, "").replace(/\s+or\s+/g, "/").replace(/\s+and\s+/g, "+");
+}
+function assessLicense(rawLicense) {
+  if (!rawLicense || rawLicense.trim() === "") {
+    return {
+      license: rawLicense ?? "None",
+      category: "unknown",
+      severity: "low",
+      isCopyleft: false,
+      isCommercialSafe: false,
+      rationale: "No license declared. Default copyright restrictions apply."
+    };
+  }
+  const normalized = normalizeLicenseId(rawLicense);
+  if (normalized === "unlicensed" || normalized === "proprietary") {
+    return {
+      license: rawLicense,
+      category: "unlicensed",
+      severity: "medium",
+      isCopyleft: false,
+      isCommercialSafe: false,
+      rationale: "Unlicensed or proprietary dependency. May require explicit vendor permission."
+    };
+  }
+  if (NETWORK_COPYLEFT_LICENSES.has(normalized)) {
+    return {
+      license: rawLicense,
+      category: "network_copyleft",
+      severity: "high",
+      isCopyleft: true,
+      isCommercialSafe: false,
+      rationale: `${rawLicense} carries strict network copyleft terms. Network access may trigger source disclosure requirements.`
+    };
+  }
+  if (STRONG_COPYLEFT_LICENSES.has(normalized)) {
+    return {
+      license: rawLicense,
+      category: "strong_copyleft",
+      severity: "high",
+      isCopyleft: true,
+      isCommercialSafe: false,
+      rationale: `${rawLicense} is viral copyleft. Distributing software including this package may require open sourcing the entire codebase under GPL.`
+    };
+  }
+  if (RESTRICTIVE_LICENSES.has(normalized)) {
+    return {
+      license: rawLicense,
+      category: "restrictive",
+      severity: "high",
+      isCopyleft: false,
+      isCommercialSafe: false,
+      rationale: `${rawLicense} contains non-commercial or source-available restrictions. Check commercial eligibility.`
+    };
+  }
+  if (WEAK_COPYLEFT_LICENSES.has(normalized)) {
+    return {
+      license: rawLicense,
+      category: "weak_copyleft",
+      severity: "info",
+      isCopyleft: true,
+      isCommercialSafe: true,
+      rationale: `${rawLicense} is weak copyleft (file/module level). Safe for proprietary projects when dynamically linked.`
+    };
+  }
+  if (PERMISSIVE_LICENSES.has(normalized)) {
+    return {
+      license: rawLicense,
+      category: "permissive",
+      severity: "info",
+      isCopyleft: false,
+      isCommercialSafe: true,
+      rationale: `${rawLicense} is a standard permissive license. Safe for commercial and closed-source use.`
+    };
+  }
+  if (normalized.includes("gpl") || normalized.includes("agpl")) {
+    return {
+      license: rawLicense,
+      category: "strong_copyleft",
+      severity: "medium",
+      isCopyleft: true,
+      isCommercialSafe: false,
+      rationale: `License expression "${rawLicense}" appears to reference GPL/AGPL terms. Review compliance obligations.`
+    };
+  }
+  return {
+    license: rawLicense,
+    category: "unknown",
+    severity: "info",
+    isCopyleft: false,
+    isCommercialSafe: true,
+    rationale: `Custom or non-standard license string "${rawLicense}". Verify terms if distributing binary releases.`
+  };
+}
+function createLicenseFinding(dependencyId, dependencyName, rawLicense) {
+  const assessment = assessLicense(rawLicense);
+  if (assessment.category === "permissive" || assessment.category === "weak_copyleft") {
+    return null;
+  }
+  return {
+    id: `finding-${dependencyId}-license`,
+    dependencyId,
+    type: "license",
+    severity: assessment.severity,
+    action: assessment.isCopyleft ? "investigate" : "none",
+    confidence: 1,
+    rationale: `[${assessment.license}] ${dependencyName} \u2014 ${assessment.rationale}`,
+    evidence: [
+      {
+        kind: "registry",
+        source: "license-classifier",
+        retrievedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        detail: `Category: ${assessment.category}, Commercial-Safe: ${assessment.isCommercialSafe}`
+      }
+    ]
+  };
+}
+
+// src/policy/misalignment.ts
+function detectWorkspaceMisalignments(dependencies, workspaces) {
+  if (workspaces.length <= 1 || dependencies.length === 0) {
+    return [];
+  }
+  const workspaceRootById = /* @__PURE__ */ new Map();
+  for (const ws of workspaces) {
+    workspaceRootById.set(ws.id, ws.relativeRoot || ".");
+  }
+  const byPackage = /* @__PURE__ */ new Map();
+  for (const dep of dependencies) {
+    if (dep.sourceType === "path" || dep.sourceType === "git") continue;
+    const key = `${dep.ecosystem}:${dep.name}`;
+    const list = byPackage.get(key) ?? [];
+    list.push(dep);
+    byPackage.set(key, list);
+  }
+  const findings = [];
+  for (const [_key, deps] of byPackage) {
+    if (deps.length <= 1) continue;
+    const versionByWs = /* @__PURE__ */ new Map();
+    for (const dep of deps) {
+      const version = dep.locked ?? dep.requested ?? "unknown";
+      versionByWs.set(dep.workspaceId, version);
+    }
+    const uniqueVersions = new Set(versionByWs.values());
+    if (uniqueVersions.size <= 1) continue;
+    const summaryParts = [];
+    for (const [wsId, ver] of versionByWs) {
+      const root = workspaceRootById.get(wsId) ?? wsId;
+      summaryParts.push(`${root} (${ver})`);
+    }
+    const versionSummary = summaryParts.join(", ");
+    for (const dep of deps) {
+      const currentVer = dep.locked ?? dep.requested ?? "unknown";
+      const root = workspaceRootById.get(dep.workspaceId) ?? dep.workspaceId;
+      findings.push({
+        id: `finding-${dep.id}-misalignment`,
+        dependencyId: dep.id,
+        type: "investigate",
+        severity: "info",
+        action: "investigate",
+        confidence: 1,
+        rationale: `Version mismatch across workspaces: ${root} uses ${currentVer} while other packages differ [${versionSummary}]`,
+        evidence: [
+          {
+            kind: "manifest",
+            source: "monorepo-alignment",
+            retrievedAt: (/* @__PURE__ */ new Date()).toISOString(),
+            detail: `Workspace distribution: ${versionSummary}`
+          }
+        ]
+      });
+    }
+  }
+  return findings;
+}
+
 // src/service/techstack-engine.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 
@@ -3668,20 +3895,26 @@ async function runEnrichPhase(snapshot, options = {}) {
         if (dependency.name !== name) continue;
         const status = classifyStatus(dependency, registryStatus, advisoryStatus);
         const evidence = [...dependency.evidence, ...registryStatus?.evidence ?? [], ...advisoryStatus?.evidence ?? []];
+        const license = registryEntry?.license ?? dependency.license;
         enriched.set(dependency.id, {
           ...dependency,
           latestStable: registryEntry?.latestStable ?? dependency.latestStable,
-          license: registryEntry?.license ?? dependency.license,
+          license,
           deprecated: registryEntry?.deprecated ?? dependency.deprecated,
           yanked: registryEntry?.yanked ?? dependency.yanked,
           status,
           evidence
         });
         if (status !== "current" && status !== "local_path" && status !== "git_dependency") findings.push(createFindingForStatus(dependency.id, status));
+        const licenseFinding = createLicenseFinding(dependency.id, dependency.name, license);
+        if (licenseFinding) findings.push(licenseFinding);
       }
     }
   }
-  return { ...snapshot, dependencies: snapshot.dependencies.map((dependency) => enriched.get(dependency.id) ?? dependency), findings };
+  const enrichedDeps = snapshot.dependencies.map((dependency) => enriched.get(dependency.id) ?? dependency);
+  const misalignmentFindings = detectWorkspaceMisalignments(enrichedDeps, snapshot.workspaces);
+  findings.push(...misalignmentFindings);
+  return { ...snapshot, dependencies: enrichedDeps, findings };
 }
 
 // src/service/inventory-phase.ts
@@ -3742,6 +3975,8 @@ async function runInventoryPhase(store, projectId, targetRoot, options = {}) {
 // src/service/report-generator.ts
 function generateReport(snapshot, format = "md") {
   if (format === "json") return JSON.stringify(snapshot, null, 2);
+  if (format === "spdx") return JSON.stringify(toSpdx(snapshot), null, 2);
+  if (format === "cyclonedx") return JSON.stringify(toCycloneDX(snapshot), null, 2);
   const lines = [
     "# TechStack Report",
     "",
@@ -4353,6 +4588,15 @@ CREATE TABLE IF NOT EXISTS outbox (
 );
 
 CREATE INDEX IF NOT EXISTS idx_outbox_status ON outbox(status);
+
+CREATE TABLE IF NOT EXISTS research_cache (
+  cache_key TEXT PRIMARY KEY,
+  findings_json TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  expires_at TEXT NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_research_cache_expires_at ON research_cache(expires_at);
 `;
 function applySchema(db) {
   for (const statement of DDL.split(";")) {
@@ -4600,6 +4844,54 @@ var TechStackStore = class {
     const rows = stmt.all(status);
     return rows.map((r) => this.rowToOutbox(r));
   }
+  // ── Research Cache Operations ───────────────────────────────────────────
+  /** Get cached research findings by cache key (returns null if missing or expired). */
+  getCachedResearch(cacheKey) {
+    const stmt = this.stmt(`
+      SELECT findings_json, expires_at FROM research_cache
+      WHERE cache_key = ?
+    `);
+    const row = stmt.get(cacheKey);
+    if (!row) return null;
+    if (new Date(row.expires_at).getTime() <= Date.now()) {
+      this.deleteCachedResearch(cacheKey);
+      return null;
+    }
+    try {
+      return JSON.parse(row.findings_json);
+    } catch {
+      return null;
+    }
+  }
+  /** Store research findings in cache with a TTL (defaults to 7 days). */
+  setCachedResearch(cacheKey, findings, ttlMs = 7 * 24 * 60 * 60 * 1e3) {
+    const expiresAt = new Date(Date.now() + ttlMs).toISOString();
+    const findingsJson = JSON.stringify(findings);
+    const stmt = this.stmt(`
+      INSERT INTO research_cache (cache_key, findings_json, created_at, expires_at)
+      VALUES (?, ?, datetime('now'), ?)
+      ON CONFLICT(cache_key) DO UPDATE SET
+        findings_json = excluded.findings_json,
+        created_at = datetime('now'),
+        expires_at = excluded.expires_at
+    `);
+    stmt.run(cacheKey, findingsJson, expiresAt);
+  }
+  /** Delete a specific cached research entry. */
+  deleteCachedResearch(cacheKey) {
+    const stmt = this.stmt(`
+      DELETE FROM research_cache WHERE cache_key = ?
+    `);
+    stmt.run(cacheKey);
+  }
+  /** Prune all expired research cache entries. */
+  pruneExpiredResearchCache() {
+    const nowIso = (/* @__PURE__ */ new Date()).toISOString();
+    const stmt = this.stmt(`
+      DELETE FROM research_cache WHERE expires_at <= ?
+    `);
+    stmt.run(nowIso);
+  }
   // ── Row mapping helpers ─────────────────────────────────────────────────
   rowToJob(row) {
     let progress;
@@ -4718,6 +5010,7 @@ export {
   TrendStore,
   applyPlan,
   applySchema,
+  assessLicense,
   attemptDelivery,
   buildPurl,
   classifyStatus,
@@ -4728,10 +5021,12 @@ export {
   coverageForEcosystem,
   cppAdapter,
   createAuditRunner,
+  createLicenseFinding,
   createProviderLlm,
   createResearcher,
   createToolSearch,
   dartAdapter,
+  detectWorkspaceMisalignments,
   diffSnapshots,
   discoverWorkspaces,
   dotNetAdapter,
@@ -4748,6 +5043,7 @@ export {
   lookupRegistryBatch,
   mapDetectedWorkspace,
   mavenAdapter,
+  normalizeLicenseId,
   npmAdapter,
   parsePurl,
   parsePurlEcosystem,

package/dist/policy/license.d.ts

@@ -0,0 +1,26 @@
+/**
+ * TechStack — License Risk & Compliance Classification.
+ *
+ * Categorizes open source software licenses by risk profile (Permissive,
+ * Weak Copyleft, Strong Viral Copyleft, Restrictive/Commercial, Unknown)
+ * and generates deterministic compliance findings.
+ *
+ * @see docs/specs/techstack-sdd.md §4.1, §7
+ */
+import type { Finding } from '../types.js';
+export type LicenseCategory = 'permissive' | 'weak_copyleft' | 'strong_copyleft' | 'network_copyleft' | 'restrictive' | 'unlicensed' | 'unknown';
+export interface LicenseRiskAssessment {
+    readonly license: string;
+    readonly category: LicenseCategory;
+    readonly severity: 'info' | 'low' | 'medium' | 'high' | 'critical';
+    readonly isCopyleft: boolean;
+    readonly isCommercialSafe: boolean;
+    readonly rationale: string;
+}
+/** Normalize raw license identifier string for SPDX lookup. */
+export declare function normalizeLicenseId(rawLicense: string | undefined): string;
+/** Assess the compliance and legal risk of a license. */
+export declare function assessLicense(rawLicense: string | undefined): LicenseRiskAssessment;
+/** Generate a License Compliance Finding if the license represents notable risk. */
+export declare function createLicenseFinding(dependencyId: string, dependencyName: string, rawLicense: string | undefined): Finding | null;
+//# sourceMappingURL=license.d.ts.map

package/dist/policy/misalignment.d.ts

@@ -0,0 +1,26 @@
+/**
+ * TechStack — Cross-Workspace Version Drift & Misalignment Detector.
+ *
+ * In monorepo projects, different workspaces (packages/apps) may declare
+ * or resolve different versions of the same dependency, leading to bundle
+ * bloat, runtime inconsistencies, and duplicate lockfile resolutions.
+ *
+ * @see docs/specs/techstack-sdd.md §4.1, §7
+ */
+import type { DependencyObservation, Finding, Workspace } from '../types.js';
+export interface VersionMisalignment {
+    readonly ecosystem: string;
+    readonly name: string;
+    readonly distinctVersions: readonly string[];
+    readonly occurrences: ReadonlyArray<{
+        readonly dependencyId: string;
+        readonly workspaceId: string;
+        readonly workspaceRoot: string;
+        readonly version: string;
+    }>;
+}
+/**
+ * Detects third-party dependency version mismatches across multiple workspaces.
+ */
+export declare function detectWorkspaceMisalignments(dependencies: readonly DependencyObservation[], workspaces: readonly Workspace[]): readonly Finding[];
+//# sourceMappingURL=misalignment.d.ts.map

package/dist/sbom.d.ts

@@ -21,7 +21,11 @@ export interface SpdxDocument {
         SPDXID: string;
         versionInfo?: string | undefined;
         downloadLocation?: string | undefined;
+        filesAnalyzed: boolean;
         licenseConcluded?: string | undefined;
+        licenseDeclared?: string | undefined;
+        supplier: string;
+        copyrightText: string;
     }>;
 }
 export declare function toSpdx(snapshot: Snapshot): SpdxDocument;

package/dist/service/report-generator.d.ts

@@ -1,3 +1,4 @@
 import type { Snapshot } from '../types.js';
-export declare function generateReport(snapshot: Snapshot, format?: 'md' | 'json'): string;
+export type ReportFormat = 'md' | 'json' | 'spdx' | 'cyclonedx';
+export declare function generateReport(snapshot: Snapshot, format?: ReportFormat): string;
 //# sourceMappingURL=report-generator.d.ts.map

package/dist/service/techstack-engine.d.ts

@@ -3,8 +3,10 @@ import type { TechStackResearcher } from '../research/types.js';
 import type { TechStackStore } from '../store/sqlite.js';
 import type { Snapshot, TechStackJob } from '../types.js';
 import { type EnrichOptions } from './enrich-phase.js';
+import { type ReportFormat } from './report-generator.js';
 import { type ResearchPhaseOptions } from './research-phase.js';
 export type { EnrichOptions } from './enrich-phase.js';
+export type { ReportFormat } from './report-generator.js';
 export interface AnalyzeOptions {
     readonly targetRoot: string;
     readonly sessionId?: string | undefined;
@@ -24,7 +26,7 @@ export declare class TechStackEngine {
     inventory(projectId: string, targetRoot: string, _jobId?: string, onProgress?: (phase: string, completed: number, total: number) => void, options?: InventoryOptions): Promise<Snapshot>;
     enrich(snapshot: Snapshot, options?: EnrichOptions): Promise<Snapshot>;
     research(snapshot: Snapshot, options?: ResearchPhaseOptions): Promise<Snapshot>;
-    generateReport(snapshot: Snapshot, format?: 'md' | 'json'): string;
+    generateReport(snapshot: Snapshot, format?: ReportFormat): string;
     analyze(projectId: string, options: AnalyzeOptions): Promise<{
         snapshot: Snapshot;
         job: TechStackJob;

package/dist/service.d.ts

@@ -5,5 +5,5 @@
  * `service/`; existing imports from `service.js` remain stable.
  */
 export { TechStackEngine } from './service/techstack-engine.js';
-export type { AnalyzeOptions, EnrichOptions } from './service/techstack-engine.js';
+export type { AnalyzeOptions, EnrichOptions, ReportFormat } from './service/techstack-engine.js';
 //# sourceMappingURL=service.d.ts.map

package/dist/store/schema.d.ts

@@ -12,7 +12,7 @@
  * @see docs/specs/techstack-sdd.md §3.2, §4.1
  */
 export declare const SCHEMA_VERSION = 1;
-export declare const DDL = "\nCREATE TABLE IF NOT EXISTS techstack_schema_version (\n  version INTEGER NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS snapshots (\n  id TEXT PRIMARY KEY,\n  project_id TEXT NOT NULL,\n  target_root TEXT NOT NULL,\n  fingerprint TEXT NOT NULL,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  raw_json TEXT NOT NULL,\n  adapter_version TEXT NOT NULL DEFAULT ''\n);\n\nCREATE INDEX IF NOT EXISTS idx_snapshots_project_id ON snapshots(project_id);\nCREATE INDEX IF NOT EXISTS idx_snapshots_created_at ON snapshots(created_at DESC);\n\nCREATE TABLE IF NOT EXISTS jobs (\n  id TEXT PRIMARY KEY,\n  project_id TEXT NOT NULL,\n  target_root TEXT NOT NULL,\n  kind TEXT NOT NULL CHECK(kind IN ('inventory', 'analyze')),\n  status TEXT NOT NULL DEFAULT 'queued'\n    CHECK(status IN ('queued','discovering','inventorying','enriching','researching','synthesizing','completed','failed','cancelled')),\n  fingerprint TEXT NOT NULL DEFAULT '',\n  requested_by TEXT NOT NULL DEFAULT '',\n  session_id TEXT,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  completed_at TEXT,\n  error TEXT,\n  progress_json TEXT\n);\n\nCREATE INDEX IF NOT EXISTS idx_jobs_project_id ON jobs(project_id);\nCREATE INDEX IF NOT EXISTS idx_jobs_status ON jobs(status);\n\nCREATE TABLE IF NOT EXISTS outbox (\n  delivery_id TEXT PRIMARY KEY,\n  report_id TEXT NOT NULL,\n  session_id TEXT NOT NULL,\n  status TEXT NOT NULL DEFAULT 'pending'\n    CHECK(status IN ('pending', 'claimed', 'delivered', 'failed')),\n  attempts INTEGER NOT NULL DEFAULT 0,\n  claimed_at TEXT,\n  delivered_at TEXT\n);\n\nCREATE INDEX IF NOT EXISTS idx_outbox_status ON outbox(status);\n";
+export declare const DDL = "\nCREATE TABLE IF NOT EXISTS techstack_schema_version (\n  version INTEGER NOT NULL\n);\n\nCREATE TABLE IF NOT EXISTS snapshots (\n  id TEXT PRIMARY KEY,\n  project_id TEXT NOT NULL,\n  target_root TEXT NOT NULL,\n  fingerprint TEXT NOT NULL,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  raw_json TEXT NOT NULL,\n  adapter_version TEXT NOT NULL DEFAULT ''\n);\n\nCREATE INDEX IF NOT EXISTS idx_snapshots_project_id ON snapshots(project_id);\nCREATE INDEX IF NOT EXISTS idx_snapshots_created_at ON snapshots(created_at DESC);\n\nCREATE TABLE IF NOT EXISTS jobs (\n  id TEXT PRIMARY KEY,\n  project_id TEXT NOT NULL,\n  target_root TEXT NOT NULL,\n  kind TEXT NOT NULL CHECK(kind IN ('inventory', 'analyze')),\n  status TEXT NOT NULL DEFAULT 'queued'\n    CHECK(status IN ('queued','discovering','inventorying','enriching','researching','synthesizing','completed','failed','cancelled')),\n  fingerprint TEXT NOT NULL DEFAULT '',\n  requested_by TEXT NOT NULL DEFAULT '',\n  session_id TEXT,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  completed_at TEXT,\n  error TEXT,\n  progress_json TEXT\n);\n\nCREATE INDEX IF NOT EXISTS idx_jobs_project_id ON jobs(project_id);\nCREATE INDEX IF NOT EXISTS idx_jobs_status ON jobs(status);\n\nCREATE TABLE IF NOT EXISTS outbox (\n  delivery_id TEXT PRIMARY KEY,\n  report_id TEXT NOT NULL,\n  session_id TEXT NOT NULL,\n  status TEXT NOT NULL DEFAULT 'pending'\n    CHECK(status IN ('pending', 'claimed', 'delivered', 'failed')),\n  attempts INTEGER NOT NULL DEFAULT 0,\n  claimed_at TEXT,\n  delivered_at TEXT\n);\n\nCREATE INDEX IF NOT EXISTS idx_outbox_status ON outbox(status);\n\nCREATE TABLE IF NOT EXISTS research_cache (\n  cache_key TEXT PRIMARY KEY,\n  findings_json TEXT NOT NULL,\n  created_at TEXT NOT NULL DEFAULT (datetime('now')),\n  expires_at TEXT NOT NULL\n);\n\nCREATE INDEX IF NOT EXISTS idx_research_cache_expires_at ON research_cache(expires_at);\n";
 /**
  * Run the schema DDL and check/migrate version.
  */

package/dist/store/sqlite.d.ts

@@ -8,7 +8,7 @@
  *
  * @see docs/specs/techstack-sdd.md §3.2, §4.1
  */
-import type { DeliveryOutbox, DeliveryStatus, Snapshot, TechStackJob, TechStackJobStatus, TechStackJobProgress } from '../types.js';
+import type { DeliveryOutbox, DeliveryStatus, Finding, Snapshot, TechStackJob, TechStackJobStatus, TechStackJobProgress } from '../types.js';
 export interface StoreOptions {
     /** Project slug used for the store directory path. */
     readonly projectSlug: string;
@@ -55,6 +55,14 @@ export declare class TechStackStore {
     failOutbox(deliveryId: string): void;
     /** List outbox entries by status. */
     listOutboxByStatus(status: DeliveryStatus): DeliveryOutbox[];
+    /** Get cached research findings by cache key (returns null if missing or expired). */
+    getCachedResearch(cacheKey: string): readonly Finding[] | null;
+    /** Store research findings in cache with a TTL (defaults to 7 days). */
+    setCachedResearch(cacheKey: string, findings: readonly Finding[], ttlMs?: number): void;
+    /** Delete a specific cached research entry. */
+    deleteCachedResearch(cacheKey: string): void;
+    /** Prune all expired research cache entries. */
+    pruneExpiredResearchCache(): void;
     private rowToJob;
     private rowToOutbox;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/techstack",
-  "version": "0.306.3",
+  "version": "0.307.0",
   "license": "MIT",
   "description": "WrongStack TechStack — cross-language dependency intelligence for the active target project: discover, inventory, enrich, analyze, and report.",
   "repository": {
@@ -26,11 +26,11 @@
     "!dist/**/*.map"
   ],
   "dependencies": {
-    "@wrongstack/tools": "0.306.3",
-    "@wrongstack/core": "0.306.3"
+    "@wrongstack/core": "0.307.0",
+    "@wrongstack/tools": "0.307.0"
   },
   "devDependencies": {
-    "@types/node": "^26.1.2",
+    "@types/node": "^26.2.0",
     "typescript": "^7.0.2"
   },
   "publishConfig": {

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 ECOSTACK TECHNOLOGY OÜ
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.