project-athena 0.3.0 → 0.5.0

package/dist/{chunk-PR53DT7I.js → chunk-L2EHJCH4.js}

@@ -1,17 +1,17 @@
 #!/usr/bin/env node
 import {
   committedAiWarning
-} from "./chunk-RXNRMIZP.js";
+} from "./chunk-WUIC65QO.js";
 import {
   whichExecutable
-} from "./chunk-VSYBC3VY.js";
+} from "./chunk-UMWX4UTK.js";
+import {
+  readRecentEvents
+} from "./chunk-P4TRQMES.js";
 import {
   listRules,
   parseRules
 } from "./chunk-3IS2X2Z7.js";
-import {
-  readRecentEvents
-} from "./chunk-65TSRDQ3.js";
 import {
   findProjectRoot
 } from "./chunk-KBO7XRBW.js";
@@ -21,10 +21,10 @@ import {
 import {
   gitAvailable,
   isGitRepo
-} from "./chunk-OLPSEQS5.js";
+} from "./chunk-AKOI4VTD.js";
 import {
   ADAPTERS
-} from "./chunk-2RS6TA3D.js";
+} from "./chunk-YRIS7ZS6.js";
 import {
   hookCommand
 } from "./chunk-GHFRQAYT.js";
@@ -176,4 +176,4 @@ export {
   findRunningInstance,
   runDoctor
 };
-//# sourceMappingURL=chunk-PR53DT7I.js.map
+//# sourceMappingURL=chunk-L2EHJCH4.js.map

package/dist/{chunk-65TSRDQ3.js → chunk-P4TRQMES.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   redact
-} from "./chunk-JCGDR4UV.js";
+} from "./chunk-WWQ5NKEC.js";
 import {
   toPosix
 } from "./chunk-XW3MLHI2.js";
@@ -121,4 +121,4 @@ export {
   readRecentEvents,
   summarizeSessions
 };
-//# sourceMappingURL=chunk-65TSRDQ3.js.map
+//# sourceMappingURL=chunk-P4TRQMES.js.map

package/dist/{chunk-TGJUUB44.js → chunk-PZPMWCXS.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   projectSession
-} from "./chunk-PDFQ5BFG.js";
+} from "./chunk-GU3ZX2J7.js";
 import {
   impactOf
 } from "./chunk-GR4DL2VM.js";
@@ -11,13 +11,13 @@ import {
   indexWithIntegrations,
   planKnowledge,
   writePlannedKnowledge
-} from "./chunk-SJOOXO34.js";
+} from "./chunk-4FETKOY3.js";
 import {
   analyzeProject
-} from "./chunk-PANVPNYF.js";
+} from "./chunk-44EGCEB2.js";
 import {
   headMovement
-} from "./chunk-OLPSEQS5.js";
+} from "./chunk-AKOI4VTD.js";
 import {
   KNOWLEDGE_DOCS
 } from "./chunk-FQEGEVLY.js";
@@ -396,4 +396,4 @@ export {
   HISTORY_SECTIONS,
   staleForCheck
 };
-//# sourceMappingURL=chunk-TGJUUB44.js.map
+//# sourceMappingURL=chunk-PZPMWCXS.js.map

package/dist/chunk-QCC4VJUH.js

@@ -0,0 +1,217 @@
+#!/usr/bin/env node
+
+// src/core/model/project-model.ts
+import { z as z2 } from "zod";
+
+// src/core/model/fact.ts
+import { z } from "zod";
+var FactStatus = z.enum(["FACT", "DETECTED", "INFERRED", "UNKNOWN"]);
+var Confidence = z.enum(["high", "medium", "low"]);
+var FactSource = z.enum(["code", "config", "filesystem", "git", "developer", "ai"]);
+var Evidence = z.object({
+  /** Repo-relative POSIX path. */
+  file: z.string(),
+  line: z.number().int().positive().optional(),
+  detail: z.string().optional()
+});
+var Provenance = z.object({
+  status: FactStatus,
+  confidence: Confidence,
+  source: FactSource,
+  evidence: z.array(Evidence)
+});
+function detected(source, evidence, confidence = "high") {
+  return { status: "DETECTED", confidence, source, evidence };
+}
+function inferred(source, evidence, confidence = "medium") {
+  return { status: "INFERRED", confidence, source, evidence };
+}
+function fact(source, evidence) {
+  return { status: "FACT", confidence: "high", source, evidence };
+}
+
+// src/core/model/project-model.ts
+var Named = z2.object({ name: z2.string(), provenance: Provenance });
+var Language = z2.object({
+  name: z2.string(),
+  files: z2.number().int(),
+  bytes: z2.number().int()
+});
+var Framework = Named.extend({
+  category: z2.enum(["frontend", "backend", "fullstack", "mobile", "desktop", "orm", "testing", "other"]),
+  version: z2.string().optional(),
+  /** Workspace package root (repo-relative) this belongs to; "." for root. */
+  root: z2.string()
+});
+var Manifest = z2.object({
+  path: z2.string(),
+  ecosystem: z2.string(),
+  name: z2.string().optional(),
+  version: z2.string().optional(),
+  dependencies: z2.array(z2.string()),
+  devDependencies: z2.array(z2.string())
+});
+var WorkspacePackage = z2.object({
+  name: z2.string(),
+  path: z2.string(),
+  kind: z2.enum(["app", "package", "root", "unknown"]),
+  ecosystem: z2.string(),
+  /** Names of other workspace packages this one depends on. */
+  internalDependencies: z2.array(z2.string())
+});
+var Command = z2.object({
+  name: z2.string(),
+  command: z2.string(),
+  source: z2.string(),
+  purpose: z2.enum(["dev", "build", "test", "lint", "format", "start", "migrate", "deploy", "other"])
+});
+var Route = z2.object({
+  method: z2.string(),
+  path: z2.string(),
+  framework: z2.string(),
+  file: z2.string(),
+  line: z2.number().int().optional(),
+  provenance: Provenance
+});
+var DbEntity = z2.object({
+  name: z2.string(),
+  kind: z2.enum(["table", "model", "collection"]),
+  fields: z2.array(z2.object({ name: z2.string(), type: z2.string().optional(), attributes: z2.array(z2.string()) })),
+  indexes: z2.array(z2.string()),
+  relations: z2.array(z2.string()),
+  file: z2.string(),
+  provenance: Provenance
+});
+var Database = Named.extend({ kind: z2.enum(["engine", "orm", "driver", "service"]) });
+var EnvVar = z2.object({
+  name: z2.string(),
+  /** Where the name was seen. Values are NEVER recorded. */
+  references: z2.array(z2.string()),
+  secretLike: z2.boolean()
+});
+var SecretFinding = z2.object({
+  type: z2.string(),
+  file: z2.string(),
+  line: z2.number().int(),
+  /**
+   * Keyed fingerprint (HMAC with the machine-local salt in .athena/local.json, or a
+   * per-process key) — allows dedup without storing the secret. Never a plain hash
+   * of the value, and never written to committed files.
+   */
+  fingerprint: z2.string()
+});
+var CiJob = z2.object({ system: z2.string(), file: z2.string(), name: z2.string(), commands: z2.array(z2.string()) });
+var ContainerService = z2.object({
+  name: z2.string(),
+  image: z2.string().optional(),
+  ports: z2.array(z2.string()),
+  dependsOn: z2.array(z2.string()),
+  file: z2.string()
+});
+var TestInfo = z2.object({
+  frameworks: z2.array(Named),
+  testFileCount: z2.number().int(),
+  testDirs: z2.array(z2.string()),
+  coverageConfigs: z2.array(z2.string()),
+  /** Workspace packages that contain source files but zero detected test files (structural, not coverage). */
+  packagesWithoutTests: z2.array(z2.string())
+});
+var GitInfo = z2.object({
+  available: z2.boolean(),
+  isRepo: z2.boolean(),
+  branch: z2.string().optional(),
+  head: z2.string().optional(),
+  lastCommitDate: z2.string().optional(),
+  contributorCount: z2.number().int().optional(),
+  hotspots: z2.array(z2.object({ path: z2.string(), commits: z2.number().int() }))
+});
+var ProjectModel = z2.object({
+  schemaVersion: z2.literal(1),
+  name: z2.string(),
+  description: z2.string().optional(),
+  root: z2.string(),
+  stats: z2.object({
+    filesScanned: z2.number().int(),
+    skippedBinary: z2.number().int(),
+    skippedLarge: z2.number().int(),
+    skippedUnreadable: z2.number().int()
+  }),
+  topLevelDirs: z2.array(z2.string()),
+  languages: z2.array(Language),
+  manifests: z2.array(Manifest),
+  packageManagers: z2.array(Named),
+  buildSystems: z2.array(Named),
+  workspace: z2.object({
+    isMonorepo: z2.boolean(),
+    tool: z2.string().optional(),
+    packages: z2.array(WorkspacePackage)
+  }),
+  frameworks: z2.array(Framework),
+  entryPoints: z2.array(z2.object({ path: z2.string(), provenance: Provenance })),
+  commands: z2.array(Command),
+  databases: z2.array(Database),
+  dbEntities: z2.array(DbEntity),
+  migrations: z2.array(z2.object({ path: z2.string(), tool: z2.string(), count: z2.number().int() })),
+  routes: z2.array(Route),
+  apiSpecs: z2.array(z2.object({ path: z2.string(), kind: z2.enum(["openapi", "graphql", "grpc"]) })),
+  auth: z2.array(Named.extend({ kind: z2.enum(["library", "provider", "hashing", "middleware", "token"]) })),
+  containers: z2.object({ dockerfiles: z2.array(z2.object({ path: z2.string(), baseImages: z2.array(z2.string()), exposedPorts: z2.array(z2.string()) })), services: z2.array(ContainerService) }),
+  infrastructure: z2.array(Named.extend({ kind: z2.string(), file: z2.string() })),
+  ci: z2.array(CiJob),
+  tests: TestInfo,
+  env: z2.object({ vars: z2.array(EnvVar), envFilesPresent: z2.array(z2.string()) }),
+  security: z2.object({
+    secrets: z2.array(SecretFinding),
+    tooling: z2.array(Named),
+    /** Libraries/middleware relevant to web security controls (helmet, cors, csrf...). */
+    controls: z2.array(Named)
+  }),
+  caching: z2.array(Named),
+  queues: z2.array(Named),
+  observability: z2.array(Named),
+  git: GitInfo,
+  warnings: z2.array(z2.string())
+});
+function emptyModel(name, root) {
+  return {
+    schemaVersion: 1,
+    name,
+    root,
+    stats: { filesScanned: 0, skippedBinary: 0, skippedLarge: 0, skippedUnreadable: 0 },
+    topLevelDirs: [],
+    languages: [],
+    manifests: [],
+    packageManagers: [],
+    buildSystems: [],
+    workspace: { isMonorepo: false, packages: [] },
+    frameworks: [],
+    entryPoints: [],
+    commands: [],
+    databases: [],
+    dbEntities: [],
+    migrations: [],
+    routes: [],
+    apiSpecs: [],
+    auth: [],
+    containers: { dockerfiles: [], services: [] },
+    infrastructure: [],
+    ci: [],
+    tests: { frameworks: [], testFileCount: 0, testDirs: [], coverageConfigs: [], packagesWithoutTests: [] },
+    env: { vars: [], envFilesPresent: [] },
+    security: { secrets: [], tooling: [], controls: [] },
+    caching: [],
+    queues: [],
+    observability: [],
+    git: { available: false, isRepo: false, hotspots: [] },
+    warnings: []
+  };
+}
+
+export {
+  detected,
+  inferred,
+  fact,
+  ProjectModel,
+  emptyModel
+};
+//# sourceMappingURL=chunk-QCC4VJUH.js.map

package/dist/{chunk-DOQMAZL5.js → chunk-R5AX7VST.js}

@@ -33,11 +33,11 @@ import {
 } from "./chunk-XFN7UZCS.js";
 import {
   runPipeline
-} from "./chunk-SJOOXO34.js";
+} from "./chunk-4FETKOY3.js";
 import {
   ADAPTERS,
   resolveAdapters
-} from "./chunk-2RS6TA3D.js";
+} from "./chunk-YRIS7ZS6.js";
 import {
   KNOWLEDGE_DOCS
 } from "./chunk-FQEGEVLY.js";
@@ -433,4 +433,4 @@ export {
   printSummary,
   summarize
 };
-//# sourceMappingURL=chunk-DOQMAZL5.js.map
+//# sourceMappingURL=chunk-R5AX7VST.js.map

package/dist/{chunk-JY6BFIJJ.js → chunk-RQKGT2EK.js}

@@ -2,12 +2,12 @@
 import {
   readRecentEvents,
   summarizeSessions
-} from "./chunk-65TSRDQ3.js";
+} from "./chunk-P4TRQMES.js";
 import {
   ADAPTERS,
   applyChanges,
   resolveAdapters
-} from "./chunk-2RS6TA3D.js";
+} from "./chunk-YRIS7ZS6.js";
 import {
   athenaDir,
   readState,
@@ -92,4 +92,4 @@ export {
   configureAgents,
   removeAgents
 };
-//# sourceMappingURL=chunk-JY6BFIJJ.js.map
+//# sourceMappingURL=chunk-RQKGT2EK.js.map

package/dist/{chunk-PDFQ5BFG.js → chunk-SVTEJYMS.js}

@@ -1,20 +1,11 @@
 #!/usr/bin/env node
 import {
-  ProjectModel,
-  SCAN_FILE,
-  SecurityScan
-} from "./chunk-PANVPNYF.js";
-import {
-  athenaDir,
-  readState
+  athenaDir
 } from "./chunk-2DY4PUR4.js";
 import {
   readTextIfExists,
   writeFileAtomic
 } from "./chunk-IQQBAWSM.js";
-import {
-  AthenaError
-} from "./chunk-AD4OZCU2.js";
 import {
   toPosix
 } from "./chunk-XW3MLHI2.js";
@@ -224,155 +215,13 @@ function expandFromFiles(graph, files, depth = 1, limit = 40) {
   return [...seen].map((id) => byId.get(id)).filter((n) => Boolean(n)).slice(0, limit);
 }
 
-// src/services/project-session.ts
-import { promises as fs } from "fs";
-import path2 from "path";
-var fileKey = (st) => `${st.ino}:${st.size}:${st.mtimeNs}`;
-var ProjectSession = class {
-  constructor(root) {
-    this.root = root;
-  }
-  root;
-  cache = /* @__PURE__ */ new Map();
-  inflight = /* @__PURE__ */ new Map();
-  stateEntry = null;
-  get dir() {
-    return athenaDir(this.root);
-  }
-  /** model.json, or why it can't be used. */
-  readModel() {
-    return this.read("model.json", ProjectModel);
-  }
-  /** The parsed model, or null when missing or unusable. */
-  async model() {
-    const r = await this.readModel();
-    return r.kind === "ok" ? r.value : null;
-  }
-  /** The parsed model; throws an AthenaError with a hint when it is missing or corrupted. */
-  async requireModel() {
-    const r = await this.readModel();
-    if (r.kind === "ok") return r.value;
-    if (r.kind === "missing") throw new AthenaError("model.json is missing.", "Run `athena analyze` (or re-analyze from the overview) first.");
-    throw new AthenaError(`model.json is corrupted (${r.reason}).`, "Run `athena analyze` to rebuild it.");
-  }
-  /** Cheap existence check (a stat, no parsing). */
-  async hasModel() {
-    return this.exists("model.json");
-  }
-  readGraph() {
-    return this.read(GRAPH_FILE, ProjectGraph);
-  }
-  async graph() {
-    const r = await this.readGraph();
-    return r.kind === "ok" ? r.value : null;
-  }
-  readScan() {
-    return this.read(SCAN_FILE, SecurityScan);
-  }
-  async scan() {
-    const r = await this.readScan();
-    return r.kind === "ok" ? r.value : null;
-  }
-  /** state.json via `readState`, memoized like the other artifacts. */
-  async state() {
-    const file = path2.join(this.dir, "state.json");
-    const st = await fs.stat(file, { bigint: true }).catch(() => null);
-    if (!st) return readState(this.dir);
-    const key = fileKey(st);
-    if (this.stateEntry?.key === key) return this.stateEntry.state;
-    const state = await readState(this.dir);
-    const after = await fs.stat(file, { bigint: true }).catch(() => null);
-    if (after && fileKey(after) === key) this.stateEntry = { key, state };
-    return state;
-  }
-  /**
-   * Record a value this process just wrote to `.athena/<name>`, so the next
-   * read doesn't parse it again. The file must already be on disk.
-   */
-  async remember(name, value) {
-    const st = await fs.stat(path2.join(this.dir, name), { bigint: true }).catch(() => null);
-    if (st) this.cache.set(name, { key: fileKey(st), result: { kind: "ok", value } });
-    else this.cache.delete(name);
-  }
-  /** Drop memoized results (all, or one file). */
-  invalidate(name) {
-    if (!name || name === "state.json") this.stateEntry = null;
-    if (name) this.cache.delete(name);
-    else this.cache.clear();
-  }
-  async exists(name) {
-    const st = await fs.stat(path2.join(this.dir, name)).catch(() => null);
-    return Boolean(st?.isFile());
-  }
-  read(name, schema) {
-    const running = this.inflight.get(name);
-    if (running) return running;
-    const p = this.load(name, schema).finally(() => this.inflight.delete(name));
-    this.inflight.set(name, p);
-    return p;
-  }
-  async load(name, schema) {
-    const file = path2.join(this.dir, name);
-    let st;
-    try {
-      st = await fs.stat(file, { bigint: true });
-    } catch (err) {
-      const code = err.code;
-      this.cache.delete(name);
-      if (code === "ENOENT" || code === "ENOTDIR") return { kind: "missing" };
-      return { kind: "corrupted", reason: `unreadable (${code})` };
-    }
-    const key = fileKey(st);
-    const hit = this.cache.get(name);
-    if (hit?.key === key) return hit.result;
-    let raw;
-    try {
-      raw = await fs.readFile(file, "utf8");
-    } catch (err) {
-      const code = err.code;
-      if (code === "ENOENT") return { kind: "missing" };
-      return { kind: "corrupted", reason: `unreadable (${code})` };
-    }
-    const result = parseArtifact(raw, schema);
-    const after = await fs.stat(file, { bigint: true }).catch(() => null);
-    if (after && fileKey(after) === key) this.cache.set(name, { key, result });
-    return result;
-  }
-};
-function parseArtifact(raw, schema) {
-  let json;
-  try {
-    json = JSON.parse(raw);
-  } catch {
-    return { kind: "corrupted", reason: "invalid JSON" };
-  }
-  const parsed = schema.safeParse(json);
-  if (parsed.success) return { kind: "ok", value: parsed.data };
-  const issue = parsed.error.issues[0];
-  return { kind: "corrupted", reason: `schema mismatch at ${issue?.path.map(String).join(".") || "(root)"}: ${issue?.message}` };
-}
-var sessions = /* @__PURE__ */ new Map();
-function projectSession(root) {
-  const key = path2.resolve(root);
-  let s = sessions.get(key);
-  if (!s) {
-    s = new ProjectSession(key);
-    sessions.set(key, s);
-  }
-  return s;
-}
-function releaseProjectSession(root) {
-  sessions.delete(path2.resolve(root));
-}
-
 export {
+  ProjectGraph,
   GRAPH_FILE,
   buildGraph,
   saveGraph,
   loadGraph,
   neighbors,
-  expandFromFiles,
-  projectSession,
-  releaseProjectSession
+  expandFromFiles
 };
-//# sourceMappingURL=chunk-PDFQ5BFG.js.map
+//# sourceMappingURL=chunk-SVTEJYMS.js.map

package/dist/{chunk-VSYBC3VY.js → chunk-UMWX4UTK.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-// src/services/which.ts
+// src/core/util/which.ts
 import { promises as fs } from "fs";
 import path from "path";
 async function whichExecutable(command) {
@@ -25,4 +25,4 @@ async function whichExecutable(command) {
 export {
   whichExecutable
 };
-//# sourceMappingURL=chunk-VSYBC3VY.js.map
+//# sourceMappingURL=chunk-UMWX4UTK.js.map

package/dist/{chunk-RXNRMIZP.js → chunk-WUIC65QO.js}

@@ -5,7 +5,7 @@ import {
 import {
   redact,
   scanText
-} from "./chunk-JCGDR4UV.js";
+} from "./chunk-WWQ5NKEC.js";
 import {
   KNOWLEDGE_DOCS
 } from "./chunk-FQEGEVLY.js";
@@ -387,4 +387,4 @@ export {
   buildEnrichPayload,
   enrich
 };
-//# sourceMappingURL=chunk-RXNRMIZP.js.map
+//# sourceMappingURL=chunk-WUIC65QO.js.map

package/dist/{chunk-JCGDR4UV.js → chunk-WWQ5NKEC.js}

@@ -174,9 +174,11 @@ function isSecretLikeName(name) {
 }
 
 export {
+  MAX_GENERIC_LINE,
+  SECRET_PATTERNS,
   ephemeralFingerprint,
   scanText,
   redact,
   isSecretLikeName
 };
-//# sourceMappingURL=chunk-JCGDR4UV.js.map
+//# sourceMappingURL=chunk-WWQ5NKEC.js.map

package/dist/{chunk-XB66PZ6Z.js → chunk-X7EYOAEX.js}

@@ -2,7 +2,7 @@
 import {
   planSnapshot,
   planSync
-} from "./chunk-TGJUUB44.js";
+} from "./chunk-PZPMWCXS.js";
 
 // src/services/scheduler.ts
 var DEFAULT_FULL_WALK_EVERY_MS = 5 * 6e4;
@@ -179,4 +179,4 @@ var AnalysisScheduler = class {
 export {
   AnalysisScheduler
 };
-//# sourceMappingURL=chunk-XB66PZ6Z.js.map
+//# sourceMappingURL=chunk-X7EYOAEX.js.map