@wrongstack/techstack 0.319.0 → 0.319.1

package/dist/index.js

@@ -66,8 +66,8 @@ function parsePurl(purl) {
       const eqIdx = pair.indexOf("=");
       if (eqIdx > 0) {
         qualifiers.set(
-          decodeURIComponent(pair.slice(0, eqIdx)),
-          decodeURIComponent(pair.slice(eqIdx + 1))
+          decodePurlSegment(pair.slice(0, eqIdx)),
+          decodePurlSegment(pair.slice(eqIdx + 1))
         );
       }
     }
@@ -2224,7 +2224,13 @@ var TrendStore = class {
         active.add(key);
         const vulnerable = dependency.status === "vulnerable";
         const history = versionHistory.get(key) ?? [];
-        history.push({ at, version: dependency.locked ?? dependency.installed ?? dependency.requested, vulnerable, name: dependency.name, ecosystem: dependency.ecosystem });
+        history.push({
+          at,
+          version: dependency.locked ?? dependency.installed ?? dependency.requested,
+          vulnerable,
+          name: dependency.name,
+          ecosystem: dependency.ecosystem
+        });
         versionHistory.set(key, history);
         if (vulnerable && !openVulnerabilities.has(key)) openVulnerabilities.set(key, at);
         if (!vulnerable && openVulnerabilities.has(key)) {
@@ -2281,7 +2287,9 @@ var TrendStore = class {
         snapshotId: snapshot.id,
         createdAt: snapshot.createdAt,
         dependencies: snapshot.dependencies.length,
-        outdated: snapshot.dependencies.filter((dependency) => dependency.status.startsWith("update_available")).length,
+        outdated: snapshot.dependencies.filter(
+          (dependency) => dependency.status.startsWith("update_available")
+        ).length,
         vulnerable: snapshot.dependencies.filter((dependency) => dependency.status === "vulnerable").length
       }))
     };
@@ -2289,10 +2297,19 @@ var TrendStore = class {
 };
 function renderTrendMarkdown(report) {
   const lines = ["# TechStack Trend", "", `**Snapshots:** ${report.snapshots}`];
-  if (report.vulnerabilityHalfLifeMs !== void 0) lines.push(`**Vulnerability half-life:** ${(report.vulnerabilityHalfLifeMs / 864e5).toFixed(1)} days`);
-  lines.push("", "| Dependency | Version | Age (days) | Changes | Velocity/day |", "|---|---|---:|---:|---:|");
+  if (report.vulnerabilityHalfLifeMs !== void 0)
+    lines.push(
+      `**Vulnerability half-life:** ${(report.vulnerabilityHalfLifeMs / 864e5).toFixed(1)} days`
+    );
+  lines.push(
+    "",
+    "| Dependency | Version | Age (days) | Changes | Velocity/day |",
+    "|---|---|---:|---:|---:|"
+  );
   for (const dependency of report.dependencies) {
-    lines.push(`| ${dependency.ecosystem}:${dependency.name} | ${dependency.currentVersion ?? "\u2014"} | ${(dependency.lockedVersionAgeMs / 864e5).toFixed(1)} | ${dependency.versionChanges} | ${dependency.upgradeVelocityPerDay.toFixed(3)} |`);
+    lines.push(
+      `| ${dependency.ecosystem}:${dependency.name} | ${dependency.currentVersion ?? "\u2014"} | ${(dependency.lockedVersionAgeMs / 864e5).toFixed(1)} | ${dependency.versionChanges} | ${dependency.upgradeVelocityPerDay.toFixed(3)} |`
+    );
   }
   return lines.join("\n");
 }
@@ -2601,11 +2618,14 @@ function requestOnce(options) {
           );
         }
       });
-      response.on("end", () => resolve3({
-        statusCode: response.statusCode ?? 0,
-        headers: response.headers,
-        body
-      }));
+      response.on(
+        "end",
+        () => resolve3({
+          statusCode: response.statusCode ?? 0,
+          headers: response.headers,
+          body
+        })
+      );
     };
     const request = method === "GET" ? (isHttp ? httpGet : httpsGet)(requestOptions, callback) : (isHttp ? httpRequest : httpsRequest)(requestOptions, callback);
     request.on("error", reject);
@@ -2629,7 +2649,8 @@ async function requestWithRetry(options) {
       const exponential = (options.baseBackoffMs ?? 1e3) * 2 ** attempt;
       await delay(serverDelay ?? exponential, options.signal);
     } catch (error) {
-      if (options.signal?.aborted || error instanceof DOMException && error.name === "AbortError") throw error;
+      if (options.signal?.aborted || error instanceof DOMException && error.name === "AbortError")
+        throw error;
       lastError = error instanceof Error ? error : new Error(String(error));
       if (attempt < maxAttempts - 1) {
         await delay((options.baseBackoffMs ?? 1e3) * 2 ** attempt, options.signal);
@@ -2955,10 +2976,14 @@ async function lookupRegistry(ecosystem, name, options = {}) {
       throw new RegistryRateLimitError(response.statusCode, fetcher.host);
     }
     if (response.statusCode >= 500) {
-      throw new RegistryNetworkError(`Registry ${fetcher.host} returned ${response.statusCode} after 3 attempts`);
+      throw new RegistryNetworkError(
+        `Registry ${fetcher.host} returned ${response.statusCode} after 3 attempts`
+      );
     }
     if (response.statusCode < 200 || response.statusCode >= 300) {
-      throw new RegistryNetworkError(`Unexpected registry response ${response.statusCode} from ${fetcher.host}`);
+      throw new RegistryNetworkError(
+        `Unexpected registry response ${response.statusCode} from ${fetcher.host}`
+      );
     }
     const json = parseJsonResponse(response, `${fetcher.host}${path}`);
     const parsed = fetcher.parser(json, name, ecosystem);
@@ -3071,15 +3096,18 @@ async function queryOsvBatch(purls, options = {}) {
       if (!purl) continue;
       const vulns = result.results[i]?.vulns;
       if (!vulns || vulns.length === 0) continue;
-      advisories.set(purl, vulns.map((vuln) => ({
-        id: vuln.id,
-        summary: vuln.summary ?? vuln.details ?? "No summary available",
-        severity: mapSeverity(
-          vuln.severity,
-          vuln.database_specific?.severity ?? vuln.affected?.[0]?.database_specific?.severity
-        ),
-        aliases: vuln.aliases ?? []
-      })));
+      advisories.set(
+        purl,
+        vulns.map((vuln) => ({
+          id: vuln.id,
+          summary: vuln.summary ?? vuln.details ?? "No summary available",
+          severity: mapSeverity(
+            vuln.severity,
+            vuln.database_specific?.severity ?? vuln.affected?.[0]?.database_specific?.severity
+          ),
+          aliases: vuln.aliases ?? []
+        }))
+      );
     }
   }
   const evidence = {
@@ -3149,7 +3177,7 @@ async function runNpmAudit(workspaceRoot2, runner = defaultAuditCommandRunner) {
               id: advisory.cve ?? advisory.ghsa ?? `npm-${pkg}-${name ?? "unknown"}`,
               packageName: pkg,
               severity: npmSeverity(info.severity ?? "info"),
-              summary: advisory.title ?? (name ?? "No summary"),
+              summary: advisory.title ?? name ?? "No summary",
               fixVersion: info.fixAvailable ?? void 0,
               url: advisory.url ?? void 0,
               aliases: advisory.cve ? [advisory.cve] : []
@@ -3858,7 +3886,9 @@ import { randomUUID as randomUUID2 } from "node:crypto";
 
 // src/service/finding-factory.ts
 function computeDependencyFingerprint(dependencies) {
-  const parts = dependencies.map((dependency) => `${dependency.name}@${dependency.locked ?? dependency.requested ?? "unknown"}`).sort().join(",");
+  const parts = dependencies.map(
+    (dependency) => `${dependency.name}@${dependency.locked ?? dependency.requested ?? "unknown"}`
+  ).sort().join(",");
   let hash = 0;
   for (let index = 0; index < parts.length; index++) {
     hash = (hash << 5) - hash + parts.charCodeAt(index);
@@ -3870,17 +3900,60 @@ function createFindingForStatus(dependencyId, status) {
   const common = { dependencyId, confidence: 1, evidence: [] };
   switch (status) {
     case "vulnerable":
-      return { ...common, id: `finding-${dependencyId}-vuln`, type: "vulnerability", severity: "high", action: "upgrade_patch", rationale: "Known security advisory found for this package" };
+      return {
+        ...common,
+        id: `finding-${dependencyId}-vuln`,
+        type: "vulnerability",
+        severity: "high",
+        action: "upgrade_patch",
+        rationale: "Known security advisory found for this package"
+      };
     case "deprecated":
-      return { ...common, id: `finding-${dependencyId}-dep`, type: "deprecated", severity: "medium", action: "replace", rationale: "Package is deprecated in the registry" };
+      return {
+        ...common,
+        id: `finding-${dependencyId}-dep`,
+        type: "deprecated",
+        severity: "medium",
+        action: "replace",
+        rationale: "Package is deprecated in the registry"
+      };
     case "yanked":
-      return { ...common, id: `finding-${dependencyId}-yank`, type: "deprecated", severity: "high", action: "replace", rationale: "Package version has been yanked from the registry" };
+      return {
+        ...common,
+        id: `finding-${dependencyId}-yank`,
+        type: "deprecated",
+        severity: "high",
+        action: "replace",
+        rationale: "Package version has been yanked from the registry"
+      };
     case "update_available_safe":
-      return { ...common, id: `finding-${dependencyId}-update`, type: "upgrade", severity: "info", action: "upgrade_minor", rationale: "A newer compatible version is available" };
+      return {
+        ...common,
+        id: `finding-${dependencyId}-update`,
+        type: "upgrade",
+        severity: "info",
+        action: "upgrade_minor",
+        rationale: "A newer compatible version is available"
+      };
     case "update_available_breaking":
-      return { ...common, id: `finding-${dependencyId}-major`, type: "upgrade", severity: "low", action: "upgrade_major", rationale: "A newer version is available that may require breaking changes" };
+      return {
+        ...common,
+        id: `finding-${dependencyId}-major`,
+        type: "upgrade",
+        severity: "low",
+        action: "upgrade_major",
+        rationale: "A newer version is available that may require breaking changes"
+      };
     default:
-      return { ...common, confidence: 0.5, id: `finding-${dependencyId}-investigate`, type: "investigate", severity: "info", action: "investigate", rationale: `Package status is "${status}" \u2014 may need investigation` };
+      return {
+        ...common,
+        confidence: 0.5,
+        id: `finding-${dependencyId}-investigate`,
+        type: "investigate",
+        severity: "info",
+        action: "investigate",
+        rationale: `Package status is "${status}" \u2014 may need investigation`
+      };
   }
 }
 
@@ -3889,7 +3962,8 @@ async function runEnrichPhase(snapshot, options = {}) {
   if (options.online === false || options.signal?.aborted) return snapshot;
   const grouped = /* @__PURE__ */ new Map();
   for (const dependency of snapshot.dependencies) {
-    if (!dependency.purl || dependency.sourceType === "path" || dependency.sourceType === "git") continue;
+    if (!dependency.purl || dependency.sourceType === "path" || dependency.sourceType === "git")
+      continue;
     grouped.set(dependency.ecosystem, [...grouped.get(dependency.ecosystem) ?? [], dependency]);
   }
   const enriched = /* @__PURE__ */ new Map();
@@ -3909,16 +3983,37 @@ async function runEnrichPhase(snapshot, options = {}) {
           latestStable: registryEntry.latestStable,
           deprecated: registryEntry.deprecated,
           yanked: registryEntry.yanked,
-          evidence: [{ kind: "registry", source: registryEntry.source, retrievedAt: registryEntry.retrievedAt, detail: `latestStable: ${registryEntry.latestStable ?? "N/A"}, license: ${registryEntry.license ?? "N/A"}` }]
+          evidence: [
+            {
+              kind: "registry",
+              source: registryEntry.source,
+              retrievedAt: registryEntry.retrievedAt,
+              detail: `latestStable: ${registryEntry.latestStable ?? "N/A"}, license: ${registryEntry.license ?? "N/A"}`
+            }
+          ]
         } : { privateOrUnresolved: true };
       } catch (error) {
         const unresolved = error instanceof RegistryNotFoundError || error instanceof RegistryAuthError;
         registryStatus = unresolved ? {
           privateOrUnresolved: true,
-          evidence: [{ kind: "registry", source: `${ecosystem} registry for ${name}`, retrievedAt: (/* @__PURE__ */ new Date()).toISOString(), detail: error.message }]
+          evidence: [
+            {
+              kind: "registry",
+              source: `${ecosystem} registry for ${name}`,
+              retrievedAt: (/* @__PURE__ */ new Date()).toISOString(),
+              detail: error.message
+            }
+          ]
         } : {
           lookupFailed: true,
-          evidence: [{ kind: "registry", source: `${ecosystem} registry for ${name}`, retrievedAt: (/* @__PURE__ */ new Date()).toISOString(), detail: error instanceof Error ? error.message : "Registry lookup failed" }]
+          evidence: [
+            {
+              kind: "registry",
+              source: `${ecosystem} registry for ${name}`,
+              retrievedAt: (/* @__PURE__ */ new Date()).toISOString(),
+              detail: error instanceof Error ? error.message : "Registry lookup failed"
+            }
+          ]
         };
       }
       let advisoryStatus;
@@ -3935,7 +4030,11 @@ async function runEnrichPhase(snapshot, options = {}) {
       for (const dependency of dependencies) {
         if (dependency.name !== name) continue;
         const status = classifyStatus(dependency, registryStatus, advisoryStatus);
-        const evidence = [...dependency.evidence, ...registryStatus?.evidence ?? [], ...advisoryStatus?.evidence ?? []];
+        const evidence = [
+          ...dependency.evidence,
+          ...registryStatus?.evidence ?? [],
+          ...advisoryStatus?.evidence ?? []
+        ];
         const license = registryEntry?.license ?? dependency.license;
         enriched.set(dependency.id, {
           ...dependency,
@@ -3946,13 +4045,16 @@ async function runEnrichPhase(snapshot, options = {}) {
           status,
           evidence
         });
-        if (status !== "current" && status !== "local_path" && status !== "git_dependency") findings.push(createFindingForStatus(dependency.id, status));
+        if (status !== "current" && status !== "local_path" && status !== "git_dependency")
+          findings.push(createFindingForStatus(dependency.id, status));
         const licenseFinding = createLicenseFinding(dependency.id, dependency.name, license);
         if (licenseFinding) findings.push(licenseFinding);
       }
     }
   }
-  const enrichedDeps = snapshot.dependencies.map((dependency) => enriched.get(dependency.id) ?? dependency);
+  const enrichedDeps = snapshot.dependencies.map(
+    (dependency) => enriched.get(dependency.id) ?? dependency
+  );
   const misalignmentFindings = detectWorkspaceMisalignments(enrichedDeps, snapshot.workspaces);
   findings.push(...misalignmentFindings);
   return { ...snapshot, dependencies: enrichedDeps, findings };
@@ -3986,11 +4088,13 @@ async function runInventoryPhase(store, projectId, targetRoot, options = {}) {
   for (const workspace of workspaces) {
     if (options.signal?.aborted) throw new DOMException("TechStack job cancelled", "AbortError");
     try {
-      dependencies.push(...await ADAPTERS[workspace.ecosystem].inventory(workspace, {
-        projectRoot: targetRoot,
-        includeTransitive: options.includeTransitive,
-        signal: options.signal
-      }));
+      dependencies.push(
+        ...await ADAPTERS[workspace.ecosystem].inventory(workspace, {
+          projectRoot: targetRoot,
+          includeTransitive: options.includeTransitive,
+          signal: options.signal
+        })
+      );
     } catch {
     }
     if (workspace.coverage === "unsupported") coverage = "partial";
@@ -4031,32 +4135,56 @@ function generateReport(snapshot, format = "md") {
     ""
   ];
   if (snapshot.workspaces.length > 0) {
-    lines.push("## Workspaces", "", "| Workspace | Ecosystem | Coverage | Deps |", "|---|---|---|---|");
+    lines.push(
+      "## Workspaces",
+      "",
+      "| Workspace | Ecosystem | Coverage | Deps |",
+      "|---|---|---|---|"
+    );
     for (const workspace of snapshot.workspaces) {
-      const count = snapshot.dependencies.filter((dependency) => dependency.workspaceId === workspace.id).length;
-      lines.push(`| ${workspace.relativeRoot} | ${workspace.ecosystem} | ${workspace.coverage} | ${count} |`);
+      const count = snapshot.dependencies.filter(
+        (dependency) => dependency.workspaceId === workspace.id
+      ).length;
+      lines.push(
+        `| ${workspace.relativeRoot} | ${workspace.ecosystem} | ${workspace.coverage} | ${count} |`
+      );
     }
     lines.push("");
   }
   if (snapshot.findings.length > 0) {
     lines.push("## Findings", "");
     const bySeverity = /* @__PURE__ */ new Map();
-    for (const finding of snapshot.findings) bySeverity.set(finding.severity, [...bySeverity.get(finding.severity) ?? [], finding]);
+    for (const finding of snapshot.findings)
+      bySeverity.set(finding.severity, [...bySeverity.get(finding.severity) ?? [], finding]);
     for (const severity of ["critical", "high", "medium", "low", "info"]) {
       const findings = bySeverity.get(severity);
       if (!findings?.length) continue;
-      lines.push(`### ${severity.charAt(0).toUpperCase() + severity.slice(1)} (${findings.length})`, "");
+      lines.push(
+        `### ${severity.charAt(0).toUpperCase() + severity.slice(1)} (${findings.length})`,
+        ""
+      );
       for (const finding of findings) {
-        const dependency = snapshot.dependencies.find((candidate) => candidate.id === finding.dependencyId);
-        lines.push(`- **${dependency?.name ?? finding.dependencyId}** \u2014 ${finding.type} \u2014 ${finding.rationale}`);
+        const dependency = snapshot.dependencies.find(
+          (candidate) => candidate.id === finding.dependencyId
+        );
+        lines.push(
+          `- **${dependency?.name ?? finding.dependencyId}** \u2014 ${finding.type} \u2014 ${finding.rationale}`
+        );
       }
       lines.push("");
     }
   }
   if (snapshot.dependencies.length > 0) {
-    lines.push("## Dependencies", "", "| Name | Ecosystem | Status | Locked | Latest |", "|---|---|---|---|---|");
+    lines.push(
+      "## Dependencies",
+      "",
+      "| Name | Ecosystem | Status | Locked | Latest |",
+      "|---|---|---|---|---|"
+    );
     for (const dependency of snapshot.dependencies) {
-      lines.push(`| ${dependency.name} | ${dependency.ecosystem} | ${dependency.status} | ${dependency.locked ?? "\u2014"} | ${dependency.latestStable ?? "\u2014"} |`);
+      lines.push(
+        `| ${dependency.name} | ${dependency.ecosystem} | ${dependency.status} | ${dependency.locked ?? "\u2014"} | ${dependency.latestStable ?? "\u2014"} |`
+      );
     }
   }
   return lines.join("\n");
@@ -4184,10 +4312,16 @@ var TechStackEngine = class {
     try {
       throwIfAborted();
       updateJob("discovering", { phase: "discovering", completed: 0, total: 1 });
-      let snapshot = await this.inventory(projectId, options.targetRoot, jobId, (phase, completed, total) => {
-        throwIfAborted();
-        updateJob(phase, { phase, completed, total });
-      }, { includeTransitive: options.includeTransitive, signal: options.signal });
+      let snapshot = await this.inventory(
+        projectId,
+        options.targetRoot,
+        jobId,
+        (phase, completed, total) => {
+          throwIfAborted();
+          updateJob(phase, { phase, completed, total });
+        },
+        { includeTransitive: options.includeTransitive, signal: options.signal }
+      );
       throwIfAborted();
       if (options.online !== false) {
         updateJob("enriching", { phase: "enriching", completed: 0, total: 1 });
@@ -4203,9 +4337,14 @@ var TechStackEngine = class {
       }
       this.store.saveSnapshot(snapshot);
       updateJob("completed", { phase: "completed", completed: 1, total: 1 });
-      return { snapshot, job: { ...job, status: "completed", completedAt: (/* @__PURE__ */ new Date()).toISOString() } };
+      return {
+        snapshot,
+        job: { ...job, status: "completed", completedAt: (/* @__PURE__ */ new Date()).toISOString() }
+      };
     } catch (error) {
-      updateJob(options.signal?.aborted || error instanceof DOMException && error.name === "AbortError" ? "cancelled" : "failed");
+      updateJob(
+        options.signal?.aborted || error instanceof DOMException && error.name === "AbortError" ? "cancelled" : "failed"
+      );
       throw error;
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrongstack/techstack",
-  "version": "0.319.0",
+  "version": "0.319.1",
   "license": "MIT",
   "description": "WrongStack TechStack — cross-language dependency intelligence for the active target project: discover, inventory, enrich, analyze, and report.",
   "repository": {
@@ -26,9 +26,9 @@
     "!dist/**/*.map"
   ],
   "dependencies": {
-    "@wrongstack/core": "0.319.0",
-    "@wrongstack/persistence": "0.319.0",
-    "@wrongstack/tools": "0.319.0"
+    "@wrongstack/core": "0.319.1",
+    "@wrongstack/persistence": "0.319.1",
+    "@wrongstack/tools": "0.319.1"
   },
   "devDependencies": {
     "@types/node": "^26.2.0",