project-athena 0.3.0 → 0.4.0

package/dist/{chunk-PANVPNYF.js → chunk-MPG3IEGB.js}

@@ -16,6 +16,13 @@ import {
 import {
   gitInfo
 } from "./chunk-OLPSEQS5.js";
+import {
+  ProjectModel,
+  detected,
+  emptyModel,
+  fact,
+  inferred
+} from "./chunk-QCC4VJUH.js";
 import {
   ephemeralFingerprint,
   isSecretLikeName,
@@ -122,213 +129,6 @@ var envDetector = {
 import path5 from "path";
 import { promises as fs5 } from "fs";
 
-// src/core/model/project-model.ts
-import { z as z2 } from "zod";
-
-// src/core/model/fact.ts
-import { z } from "zod";
-var FactStatus = z.enum(["FACT", "DETECTED", "INFERRED", "UNKNOWN"]);
-var Confidence = z.enum(["high", "medium", "low"]);
-var FactSource = z.enum(["code", "config", "filesystem", "git", "developer", "ai"]);
-var Evidence = z.object({
-  /** Repo-relative POSIX path. */
-  file: z.string(),
-  line: z.number().int().positive().optional(),
-  detail: z.string().optional()
-});
-var Provenance = z.object({
-  status: FactStatus,
-  confidence: Confidence,
-  source: FactSource,
-  evidence: z.array(Evidence)
-});
-function detected(source, evidence, confidence = "high") {
-  return { status: "DETECTED", confidence, source, evidence };
-}
-function inferred(source, evidence, confidence = "medium") {
-  return { status: "INFERRED", confidence, source, evidence };
-}
-function fact(source, evidence) {
-  return { status: "FACT", confidence: "high", source, evidence };
-}
-
-// src/core/model/project-model.ts
-var Named = z2.object({ name: z2.string(), provenance: Provenance });
-var Language = z2.object({
-  name: z2.string(),
-  files: z2.number().int(),
-  bytes: z2.number().int()
-});
-var Framework = Named.extend({
-  category: z2.enum(["frontend", "backend", "fullstack", "mobile", "desktop", "orm", "testing", "other"]),
-  version: z2.string().optional(),
-  /** Workspace package root (repo-relative) this belongs to; "." for root. */
-  root: z2.string()
-});
-var Manifest = z2.object({
-  path: z2.string(),
-  ecosystem: z2.string(),
-  name: z2.string().optional(),
-  version: z2.string().optional(),
-  dependencies: z2.array(z2.string()),
-  devDependencies: z2.array(z2.string())
-});
-var WorkspacePackage = z2.object({
-  name: z2.string(),
-  path: z2.string(),
-  kind: z2.enum(["app", "package", "root", "unknown"]),
-  ecosystem: z2.string(),
-  /** Names of other workspace packages this one depends on. */
-  internalDependencies: z2.array(z2.string())
-});
-var Command = z2.object({
-  name: z2.string(),
-  command: z2.string(),
-  source: z2.string(),
-  purpose: z2.enum(["dev", "build", "test", "lint", "format", "start", "migrate", "deploy", "other"])
-});
-var Route = z2.object({
-  method: z2.string(),
-  path: z2.string(),
-  framework: z2.string(),
-  file: z2.string(),
-  line: z2.number().int().optional(),
-  provenance: Provenance
-});
-var DbEntity = z2.object({
-  name: z2.string(),
-  kind: z2.enum(["table", "model", "collection"]),
-  fields: z2.array(z2.object({ name: z2.string(), type: z2.string().optional(), attributes: z2.array(z2.string()) })),
-  indexes: z2.array(z2.string()),
-  relations: z2.array(z2.string()),
-  file: z2.string(),
-  provenance: Provenance
-});
-var Database = Named.extend({ kind: z2.enum(["engine", "orm", "driver", "service"]) });
-var EnvVar = z2.object({
-  name: z2.string(),
-  /** Where the name was seen. Values are NEVER recorded. */
-  references: z2.array(z2.string()),
-  secretLike: z2.boolean()
-});
-var SecretFinding = z2.object({
-  type: z2.string(),
-  file: z2.string(),
-  line: z2.number().int(),
-  /**
-   * Keyed fingerprint (HMAC with the machine-local salt in .athena/local.json, or a
-   * per-process key) — allows dedup without storing the secret. Never a plain hash
-   * of the value, and never written to committed files.
-   */
-  fingerprint: z2.string()
-});
-var CiJob = z2.object({ system: z2.string(), file: z2.string(), name: z2.string(), commands: z2.array(z2.string()) });
-var ContainerService = z2.object({
-  name: z2.string(),
-  image: z2.string().optional(),
-  ports: z2.array(z2.string()),
-  dependsOn: z2.array(z2.string()),
-  file: z2.string()
-});
-var TestInfo = z2.object({
-  frameworks: z2.array(Named),
-  testFileCount: z2.number().int(),
-  testDirs: z2.array(z2.string()),
-  coverageConfigs: z2.array(z2.string()),
-  /** Workspace packages that contain source files but zero detected test files (structural, not coverage). */
-  packagesWithoutTests: z2.array(z2.string())
-});
-var GitInfo = z2.object({
-  available: z2.boolean(),
-  isRepo: z2.boolean(),
-  branch: z2.string().optional(),
-  head: z2.string().optional(),
-  lastCommitDate: z2.string().optional(),
-  contributorCount: z2.number().int().optional(),
-  hotspots: z2.array(z2.object({ path: z2.string(), commits: z2.number().int() }))
-});
-var ProjectModel = z2.object({
-  schemaVersion: z2.literal(1),
-  name: z2.string(),
-  description: z2.string().optional(),
-  root: z2.string(),
-  stats: z2.object({
-    filesScanned: z2.number().int(),
-    skippedBinary: z2.number().int(),
-    skippedLarge: z2.number().int(),
-    skippedUnreadable: z2.number().int()
-  }),
-  topLevelDirs: z2.array(z2.string()),
-  languages: z2.array(Language),
-  manifests: z2.array(Manifest),
-  packageManagers: z2.array(Named),
-  buildSystems: z2.array(Named),
-  workspace: z2.object({
-    isMonorepo: z2.boolean(),
-    tool: z2.string().optional(),
-    packages: z2.array(WorkspacePackage)
-  }),
-  frameworks: z2.array(Framework),
-  entryPoints: z2.array(z2.object({ path: z2.string(), provenance: Provenance })),
-  commands: z2.array(Command),
-  databases: z2.array(Database),
-  dbEntities: z2.array(DbEntity),
-  migrations: z2.array(z2.object({ path: z2.string(), tool: z2.string(), count: z2.number().int() })),
-  routes: z2.array(Route),
-  apiSpecs: z2.array(z2.object({ path: z2.string(), kind: z2.enum(["openapi", "graphql", "grpc"]) })),
-  auth: z2.array(Named.extend({ kind: z2.enum(["library", "provider", "hashing", "middleware", "token"]) })),
-  containers: z2.object({ dockerfiles: z2.array(z2.object({ path: z2.string(), baseImages: z2.array(z2.string()), exposedPorts: z2.array(z2.string()) })), services: z2.array(ContainerService) }),
-  infrastructure: z2.array(Named.extend({ kind: z2.string(), file: z2.string() })),
-  ci: z2.array(CiJob),
-  tests: TestInfo,
-  env: z2.object({ vars: z2.array(EnvVar), envFilesPresent: z2.array(z2.string()) }),
-  security: z2.object({
-    secrets: z2.array(SecretFinding),
-    tooling: z2.array(Named),
-    /** Libraries/middleware relevant to web security controls (helmet, cors, csrf...). */
-    controls: z2.array(Named)
-  }),
-  caching: z2.array(Named),
-  queues: z2.array(Named),
-  observability: z2.array(Named),
-  git: GitInfo,
-  warnings: z2.array(z2.string())
-});
-function emptyModel(name, root) {
-  return {
-    schemaVersion: 1,
-    name,
-    root,
-    stats: { filesScanned: 0, skippedBinary: 0, skippedLarge: 0, skippedUnreadable: 0 },
-    topLevelDirs: [],
-    languages: [],
-    manifests: [],
-    packageManagers: [],
-    buildSystems: [],
-    workspace: { isMonorepo: false, packages: [] },
-    frameworks: [],
-    entryPoints: [],
-    commands: [],
-    databases: [],
-    dbEntities: [],
-    migrations: [],
-    routes: [],
-    apiSpecs: [],
-    auth: [],
-    containers: { dockerfiles: [], services: [] },
-    infrastructure: [],
-    ci: [],
-    tests: { frameworks: [], testFileCount: 0, testDirs: [], coverageConfigs: [], packagesWithoutTests: [] },
-    env: { vars: [], envFilesPresent: [] },
-    security: { secrets: [], tooling: [], controls: [] },
-    caching: [],
-    queues: [],
-    observability: [],
-    git: { available: false, isRepo: false, hotspots: [] },
-    warnings: []
-  };
-}
-
 // src/core/analyzer/context.ts
 function createContext(root, config, files, model, source, signal) {
   const byPath = new Map(files.map((f) => [f.path, f]));
@@ -2790,54 +2590,54 @@ function redactDeep(value, memo = /* @__PURE__ */ new Map()) {
 }
 
 // src/core/model/security-scan.ts
-import { z as z3 } from "zod";
+import { z } from "zod";
 import path6 from "path";
 var SCAN_FILE = "security-scan.json";
 var SEVERITIES = ["critical", "high", "moderate", "low", "unrated"];
 var SEVERITY_ORDER = [...SEVERITIES];
 var RATED_SEVERITIES = ["critical", "high", "moderate", "low"];
 var legacySeverity = (v) => v === "unknown" ? "unrated" : v;
-var Severity = z3.preprocess(legacySeverity, z3.enum(SEVERITIES));
-var Vulnerability = z3.object({
-  package: z3.string(),
+var Severity = z.preprocess(legacySeverity, z.enum(SEVERITIES));
+var Vulnerability = z.object({
+  package: z.string(),
   severity: Severity,
-  title: z3.string(),
-  id: z3.string().optional(),
-  url: z3.string().optional(),
-  vulnerableRange: z3.string().optional(),
-  fixAvailable: z3.boolean().optional()
+  title: z.string(),
+  id: z.string().optional(),
+  url: z.string().optional(),
+  vulnerableRange: z.string().optional(),
+  fixAvailable: z.boolean().optional()
 });
-var ToolResult = z3.object({
-  tool: z3.string(),
-  ecosystem: z3.string(),
+var ToolResult = z.object({
+  tool: z.string(),
+  ecosystem: z.string(),
   /** What was audited when a tool runs once per input (e.g. a requirements file). */
-  target: z3.string().optional(),
+  target: z.string().optional(),
   /** ok: ran and produced results · unavailable: not installed / nothing to audit · failed/timeout: ran but no usable output */
-  status: z3.enum(["ok", "unavailable", "failed", "timeout"]),
-  message: z3.string().optional(),
-  durationMs: z3.number(),
-  findings: z3.array(Vulnerability)
+  status: z.enum(["ok", "unavailable", "failed", "timeout"]),
+  message: z.string().optional(),
+  durationMs: z.number(),
+  findings: z.array(Vulnerability)
 });
-var Counts = z3.preprocess(
+var Counts = z.preprocess(
   (v) => {
     if (!v || typeof v !== "object") return v;
     const { unknown, ...rest } = v;
     return { critical: 0, high: 0, moderate: 0, low: 0, unrated: 0, ...rest, ...typeof unknown === "number" ? { unrated: (rest.unrated ?? 0) + unknown } : {} };
   },
-  z3.object({ critical: z3.number(), high: z3.number(), moderate: z3.number(), low: z3.number(), unrated: z3.number() })
+  z.object({ critical: z.number(), high: z.number(), moderate: z.number(), low: z.number(), unrated: z.number() })
 );
-var SecurityScan = z3.object({
-  schemaVersion: z3.literal(1),
-  scannedAt: z3.string(),
-  durationMs: z3.number(),
-  tools: z3.array(ToolResult),
+var SecurityScan = z.object({
+  schemaVersion: z.literal(1),
+  scannedAt: z.string(),
+  durationMs: z.number(),
+  tools: z.array(ToolResult),
   counts: Counts,
-  secrets: z3.object({
-    count: z3.number(),
-    files: z3.array(z3.string()),
+  secrets: z.object({
+    count: z.number(),
+    files: z.array(z.string()),
     /** Lines longer than 4096 chars on which generic keyword patterns were not applied. */
-    skippedLongLines: z3.number().optional(),
-    truncated: z3.boolean().optional()
+    skippedLongLines: z.number().optional(),
+    truncated: z.boolean().optional()
   })
 });
 var loadScan = (root) => loadScanFromDir(athenaDir(root));
@@ -2870,7 +2670,6 @@ function meetsThreshold(scan, level, opts = {}) {
 }
 
 export {
-  ProjectModel,
   readExclude,
   manifestDependencyNames,
   REAL_ENV_NAMES,
@@ -2889,4 +2688,4 @@ export {
   unratedFindings,
   meetsThreshold
 };
-//# sourceMappingURL=chunk-PANVPNYF.js.map
+//# sourceMappingURL=chunk-MPG3IEGB.js.map

package/dist/chunk-QCC4VJUH.js

@@ -0,0 +1,217 @@
+#!/usr/bin/env node
+
+// src/core/model/project-model.ts
+import { z as z2 } from "zod";
+
+// src/core/model/fact.ts
+import { z } from "zod";
+var FactStatus = z.enum(["FACT", "DETECTED", "INFERRED", "UNKNOWN"]);
+var Confidence = z.enum(["high", "medium", "low"]);
+var FactSource = z.enum(["code", "config", "filesystem", "git", "developer", "ai"]);
+var Evidence = z.object({
+  /** Repo-relative POSIX path. */
+  file: z.string(),
+  line: z.number().int().positive().optional(),
+  detail: z.string().optional()
+});
+var Provenance = z.object({
+  status: FactStatus,
+  confidence: Confidence,
+  source: FactSource,
+  evidence: z.array(Evidence)
+});
+function detected(source, evidence, confidence = "high") {
+  return { status: "DETECTED", confidence, source, evidence };
+}
+function inferred(source, evidence, confidence = "medium") {
+  return { status: "INFERRED", confidence, source, evidence };
+}
+function fact(source, evidence) {
+  return { status: "FACT", confidence: "high", source, evidence };
+}
+
+// src/core/model/project-model.ts
+var Named = z2.object({ name: z2.string(), provenance: Provenance });
+var Language = z2.object({
+  name: z2.string(),
+  files: z2.number().int(),
+  bytes: z2.number().int()
+});
+var Framework = Named.extend({
+  category: z2.enum(["frontend", "backend", "fullstack", "mobile", "desktop", "orm", "testing", "other"]),
+  version: z2.string().optional(),
+  /** Workspace package root (repo-relative) this belongs to; "." for root. */
+  root: z2.string()
+});
+var Manifest = z2.object({
+  path: z2.string(),
+  ecosystem: z2.string(),
+  name: z2.string().optional(),
+  version: z2.string().optional(),
+  dependencies: z2.array(z2.string()),
+  devDependencies: z2.array(z2.string())
+});
+var WorkspacePackage = z2.object({
+  name: z2.string(),
+  path: z2.string(),
+  kind: z2.enum(["app", "package", "root", "unknown"]),
+  ecosystem: z2.string(),
+  /** Names of other workspace packages this one depends on. */
+  internalDependencies: z2.array(z2.string())
+});
+var Command = z2.object({
+  name: z2.string(),
+  command: z2.string(),
+  source: z2.string(),
+  purpose: z2.enum(["dev", "build", "test", "lint", "format", "start", "migrate", "deploy", "other"])
+});
+var Route = z2.object({
+  method: z2.string(),
+  path: z2.string(),
+  framework: z2.string(),
+  file: z2.string(),
+  line: z2.number().int().optional(),
+  provenance: Provenance
+});
+var DbEntity = z2.object({
+  name: z2.string(),
+  kind: z2.enum(["table", "model", "collection"]),
+  fields: z2.array(z2.object({ name: z2.string(), type: z2.string().optional(), attributes: z2.array(z2.string()) })),
+  indexes: z2.array(z2.string()),
+  relations: z2.array(z2.string()),
+  file: z2.string(),
+  provenance: Provenance
+});
+var Database = Named.extend({ kind: z2.enum(["engine", "orm", "driver", "service"]) });
+var EnvVar = z2.object({
+  name: z2.string(),
+  /** Where the name was seen. Values are NEVER recorded. */
+  references: z2.array(z2.string()),
+  secretLike: z2.boolean()
+});
+var SecretFinding = z2.object({
+  type: z2.string(),
+  file: z2.string(),
+  line: z2.number().int(),
+  /**
+   * Keyed fingerprint (HMAC with the machine-local salt in .athena/local.json, or a
+   * per-process key) — allows dedup without storing the secret. Never a plain hash
+   * of the value, and never written to committed files.
+   */
+  fingerprint: z2.string()
+});
+var CiJob = z2.object({ system: z2.string(), file: z2.string(), name: z2.string(), commands: z2.array(z2.string()) });
+var ContainerService = z2.object({
+  name: z2.string(),
+  image: z2.string().optional(),
+  ports: z2.array(z2.string()),
+  dependsOn: z2.array(z2.string()),
+  file: z2.string()
+});
+var TestInfo = z2.object({
+  frameworks: z2.array(Named),
+  testFileCount: z2.number().int(),
+  testDirs: z2.array(z2.string()),
+  coverageConfigs: z2.array(z2.string()),
+  /** Workspace packages that contain source files but zero detected test files (structural, not coverage). */
+  packagesWithoutTests: z2.array(z2.string())
+});
+var GitInfo = z2.object({
+  available: z2.boolean(),
+  isRepo: z2.boolean(),
+  branch: z2.string().optional(),
+  head: z2.string().optional(),
+  lastCommitDate: z2.string().optional(),
+  contributorCount: z2.number().int().optional(),
+  hotspots: z2.array(z2.object({ path: z2.string(), commits: z2.number().int() }))
+});
+var ProjectModel = z2.object({
+  schemaVersion: z2.literal(1),
+  name: z2.string(),
+  description: z2.string().optional(),
+  root: z2.string(),
+  stats: z2.object({
+    filesScanned: z2.number().int(),
+    skippedBinary: z2.number().int(),
+    skippedLarge: z2.number().int(),
+    skippedUnreadable: z2.number().int()
+  }),
+  topLevelDirs: z2.array(z2.string()),
+  languages: z2.array(Language),
+  manifests: z2.array(Manifest),
+  packageManagers: z2.array(Named),
+  buildSystems: z2.array(Named),
+  workspace: z2.object({
+    isMonorepo: z2.boolean(),
+    tool: z2.string().optional(),
+    packages: z2.array(WorkspacePackage)
+  }),
+  frameworks: z2.array(Framework),
+  entryPoints: z2.array(z2.object({ path: z2.string(), provenance: Provenance })),
+  commands: z2.array(Command),
+  databases: z2.array(Database),
+  dbEntities: z2.array(DbEntity),
+  migrations: z2.array(z2.object({ path: z2.string(), tool: z2.string(), count: z2.number().int() })),
+  routes: z2.array(Route),
+  apiSpecs: z2.array(z2.object({ path: z2.string(), kind: z2.enum(["openapi", "graphql", "grpc"]) })),
+  auth: z2.array(Named.extend({ kind: z2.enum(["library", "provider", "hashing", "middleware", "token"]) })),
+  containers: z2.object({ dockerfiles: z2.array(z2.object({ path: z2.string(), baseImages: z2.array(z2.string()), exposedPorts: z2.array(z2.string()) })), services: z2.array(ContainerService) }),
+  infrastructure: z2.array(Named.extend({ kind: z2.string(), file: z2.string() })),
+  ci: z2.array(CiJob),
+  tests: TestInfo,
+  env: z2.object({ vars: z2.array(EnvVar), envFilesPresent: z2.array(z2.string()) }),
+  security: z2.object({
+    secrets: z2.array(SecretFinding),
+    tooling: z2.array(Named),
+    /** Libraries/middleware relevant to web security controls (helmet, cors, csrf...). */
+    controls: z2.array(Named)
+  }),
+  caching: z2.array(Named),
+  queues: z2.array(Named),
+  observability: z2.array(Named),
+  git: GitInfo,
+  warnings: z2.array(z2.string())
+});
+function emptyModel(name, root) {
+  return {
+    schemaVersion: 1,
+    name,
+    root,
+    stats: { filesScanned: 0, skippedBinary: 0, skippedLarge: 0, skippedUnreadable: 0 },
+    topLevelDirs: [],
+    languages: [],
+    manifests: [],
+    packageManagers: [],
+    buildSystems: [],
+    workspace: { isMonorepo: false, packages: [] },
+    frameworks: [],
+    entryPoints: [],
+    commands: [],
+    databases: [],
+    dbEntities: [],
+    migrations: [],
+    routes: [],
+    apiSpecs: [],
+    auth: [],
+    containers: { dockerfiles: [], services: [] },
+    infrastructure: [],
+    ci: [],
+    tests: { frameworks: [], testFileCount: 0, testDirs: [], coverageConfigs: [], packagesWithoutTests: [] },
+    env: { vars: [], envFilesPresent: [] },
+    security: { secrets: [], tooling: [], controls: [] },
+    caching: [],
+    queues: [],
+    observability: [],
+    git: { available: false, isRepo: false, hotspots: [] },
+    warnings: []
+  };
+}
+
+export {
+  detected,
+  inferred,
+  fact,
+  ProjectModel,
+  emptyModel
+};
+//# sourceMappingURL=chunk-QCC4VJUH.js.map

package/dist/{chunk-JY6BFIJJ.js → chunk-QLW657NT.js}

@@ -7,7 +7,7 @@ import {
   ADAPTERS,
   applyChanges,
   resolveAdapters
-} from "./chunk-2RS6TA3D.js";
+} from "./chunk-YRIS7ZS6.js";
 import {
   athenaDir,
   readState,
@@ -92,4 +92,4 @@ export {
   configureAgents,
   removeAgents
 };
-//# sourceMappingURL=chunk-JY6BFIJJ.js.map
+//# sourceMappingURL=chunk-QLW657NT.js.map

package/dist/{chunk-XB66PZ6Z.js → chunk-RVTNSNGK.js}

@@ -2,7 +2,7 @@
 import {
   planSnapshot,
   planSync
-} from "./chunk-TGJUUB44.js";
+} from "./chunk-KHMBNT66.js";
 
 // src/services/scheduler.ts
 var DEFAULT_FULL_WALK_EVERY_MS = 5 * 6e4;
@@ -179,4 +179,4 @@ var AnalysisScheduler = class {
 export {
   AnalysisScheduler
 };
-//# sourceMappingURL=chunk-XB66PZ6Z.js.map
+//# sourceMappingURL=chunk-RVTNSNGK.js.map

package/dist/{chunk-LMOFZNTQ.js → chunk-SJ4DQFIJ.js}

@@ -5,7 +5,7 @@ import {
 import {
   scanFilesForSecrets,
   secretFingerprinter
-} from "./chunk-PANVPNYF.js";
+} from "./chunk-MPG3IEGB.js";
 import {
   walkProject
 } from "./chunk-ELKFRTZT.js";
@@ -376,4 +376,4 @@ async function scanProjectSecrets(root, files, signal) {
 export {
   runSecurityScan
 };
-//# sourceMappingURL=chunk-LMOFZNTQ.js.map
+//# sourceMappingURL=chunk-SJ4DQFIJ.js.map