projscan 4.3.1 → 4.5.0

package/dist/types/dependencyHealth.d.ts

@@ -0,0 +1,73 @@
+export type SemverDrift = 'patch' | 'minor' | 'major' | 'same' | 'unknown';
+export interface OutdatedPackage {
+    name: string;
+    declared: string;
+    installed: string | null;
+    latest: string | null;
+    drift: SemverDrift;
+    scope: 'dependency' | 'devDependency';
+    /** Workspace package this dep was declared in. Empty/undefined when not a monorepo. */
+    workspace?: string;
+}
+export interface OutdatedReport {
+    available: boolean;
+    reason?: string;
+    totalPackages: number;
+    packages: OutdatedPackage[];
+    /** Per-workspace breakdown when scanning a monorepo. Empty for single-package repos. */
+    byWorkspace?: Array<{
+        workspace: string;
+        relativePath: string;
+        total: number;
+    }>;
+}
+export type AuditSeverity = 'critical' | 'high' | 'moderate' | 'low' | 'info';
+export interface AuditFinding {
+    name: string;
+    severity: AuditSeverity;
+    title: string;
+    url?: string;
+    cve?: string[];
+    via: string[];
+    range?: string;
+    fixAvailable: boolean;
+}
+export interface AuditReport {
+    available: boolean;
+    reason?: string;
+    summary: Record<AuditSeverity, number>;
+    findings: AuditFinding[];
+}
+export interface UpgradePreview {
+    available: boolean;
+    reason?: string;
+    name: string;
+    /** Package ecosystem used for this preview. Absent on older/npm-only callers. */
+    ecosystem?: 'npm' | 'python';
+    declared: string | null;
+    installed: string | null;
+    latest: string | null;
+    drift: SemverDrift;
+    breakingMarkers: string[];
+    changelogExcerpt?: string;
+    importers: string[];
+    /** Manifest file that declared the dependency, when known. */
+    declaredSource?: string;
+    /** 1-based line in the manifest that declared the dependency, when known. */
+    declaredLine?: number;
+    /** Manifest scope for the dependency, when known. */
+    declaredScope?: 'dependency' | 'devDependency' | 'peerDependency' | 'main' | 'dev';
+    /** Lockfile or pinned requirements file that supplied the installed/current version, when known. */
+    installedSource?: string;
+    /** 1-based line in installedSource that supplied the installed/current version, when known. */
+    installedLine?: number;
+    /**
+     * 1.3+ — set when `previewUpgrade` was called with `checkRegistry: true`.
+     * "registry" if the latest came from npm; "installed" if we fell back to
+     * the locally-installed version (either offline mode or a registry fetch
+     * that failed). Absent when no registry attempt was made.
+     */
+    latestSource?: 'registry' | 'installed';
+    /** 1.3+ — set when a registry fetch was attempted and failed. */
+    registryError?: string;
+}

package/dist/types/dependencyHealth.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=dependencyHealth.js.map

package/dist/types/dependencyHealth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependencyHealth.js","sourceRoot":"","sources":["../../src/types/dependencyHealth.ts"],"names":[],"mappings":""}

package/dist/types/dogfood.d.ts

@@ -0,0 +1,185 @@
+import type { EvidencePackVerdict } from './evidencePack.js';
+import type { PreflightSuggestedAction } from './preflight.js';
+export type DogfoodRepoStatus = 'pass' | 'warn' | 'fail';
+export interface DogfoodFeedbackResponse {
+    repo?: string;
+    pr?: string;
+    reviewer?: string;
+    useful?: boolean;
+    minutesSaved?: number;
+    preventedBadEdit?: boolean;
+    ownerRoutingClear?: boolean;
+    nextCommandClear?: boolean;
+    falsePositiveRules?: string[];
+    missingSignals?: string[];
+    noisyFindings?: string[];
+    note?: string;
+}
+export interface DogfoodFeedbackInput {
+    schemaVersion?: 1;
+    questions?: string[];
+    responses: DogfoodFeedbackResponse[];
+}
+export interface FeedbackTemplateResult extends DogfoodFeedbackInput {
+    schemaVersion: 1;
+    path: string;
+    createdAt: string;
+    instructions: string[];
+}
+export interface FeedbackSummaryReport {
+    schemaVersion: 1;
+    path: string;
+    responses: number;
+    usefulResponses: number;
+    distinctRepos: number;
+    distinctPrs: number;
+    minutesSaved: {
+        total: number;
+        average: number;
+        max: number;
+    };
+    preventedBadEdits: number;
+    ownerRoutingClear: number;
+    nextCommandClear: number;
+    repeatUse: {
+        distinctPrs: number;
+        repeatedRepos: number;
+        requiredDistinctPrs: number;
+        requiredRepeatedRepos: number;
+        ready: boolean;
+    };
+    falsePositive: {
+        totalReports: number;
+        noisyRules: Array<{
+            rule: string;
+            count: number;
+        }>;
+        missingSignals: Array<{
+            signal: string;
+            count: number;
+        }>;
+        noisyFindings: Array<{
+            finding: string;
+            count: number;
+        }>;
+    };
+    nextDogfoodCommand: string;
+}
+export interface DogfoodRepoValidation {
+    feedbackResponses: number;
+    usefulResponses: number;
+    prRefs: string[];
+    minutesSaved: number;
+    preventedBadEdits: number;
+    ownerRoutingClear: number;
+    nextCommandClear: number;
+    falsePositiveRules: string[];
+    missingSignals: string[];
+    noisyFindings: string[];
+}
+export interface DogfoodWebsiteProof {
+    headline: string;
+    metrics: string[];
+    bullets: string[];
+    markdown: string;
+}
+export interface DogfoodMarketValidation {
+    status: 'proven' | 'needs_feedback' | 'needs_more_repos' | 'needs_tuning';
+    summary: string;
+    proofGates: Array<{
+        id: 'repo-coverage' | 'reviewer-feedback' | 'useful-feedback' | 'repeat-use' | 'measured-value' | 'false-positive-balance';
+        status: 'pass' | 'fail';
+        summary: string;
+        command: string;
+    }>;
+    nextProofStep: string;
+    repoCoverage: {
+        target: number;
+        evaluated: number;
+        targetMet: boolean;
+    };
+    feedback: {
+        responses: number;
+        usefulResponses: number;
+        usefulnessRate: number;
+        preventedBadEdits: number;
+        ownerRoutingClear: number;
+        nextCommandClear: number;
+        minutesSaved: {
+            total: number;
+            average: number;
+            max: number;
+        };
+    };
+    falsePositive: {
+        totalReports: number;
+        noisyRules: Array<{
+            rule: string;
+            count: number;
+        }>;
+        missingSignals: Array<{
+            signal: string;
+            count: number;
+        }>;
+        noisyFindings: Array<{
+            finding: string;
+            count: number;
+        }>;
+    };
+    firstPr: {
+        readyRepos: number;
+        repeatUseReadyRepos: number;
+        requiredFeedbackQuestions: string[];
+    };
+    value: {
+        averageMinutesSaved: number;
+        requiredAverageMinutesSaved: number;
+        preventedBadEdits: number;
+        ready: boolean;
+    };
+    repeatUse: {
+        distinctPrs: number;
+        repeatedRepos: number;
+        requiredDistinctPrs: number;
+        requiredRepeatedRepos: number;
+        ready: boolean;
+    };
+    websiteProof: DogfoodWebsiteProof;
+}
+export interface DogfoodRepoResult {
+    path: string;
+    name: string;
+    status: DogfoodRepoStatus;
+    healthScore: number;
+    mcpReady: boolean;
+    prCommentReady: boolean;
+    repeatUseReady: boolean;
+    verdict: EvidencePackVerdict;
+    gaps: string[];
+    feedbackQuestions: string[];
+    validation: DogfoodRepoValidation;
+    nextCommands: string[];
+}
+export interface DogfoodReport {
+    schemaVersion: 1;
+    readOnly: true;
+    rootPath: string;
+    targetRepoCount: number;
+    summary: string;
+    repos: DogfoodRepoResult[];
+    totals: {
+        reposEvaluated: number;
+        passingRepos: number;
+        warningRepos: number;
+        failingRepos: number;
+        prCommentReady: number;
+        repeatUseReady: number;
+        mcpReady: number;
+        usefulFeedback: number;
+        minutesSaved: number;
+        preventedBadEdits: number;
+        falsePositiveReports: number;
+    };
+    marketValidation: DogfoodMarketValidation;
+    suggestedNextActions: PreflightSuggestedAction[];
+}

package/dist/types/dogfood.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=dogfood.js.map

package/dist/types/dogfood.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dogfood.js","sourceRoot":"","sources":["../../src/types/dogfood.ts"],"names":[],"mappings":""}

package/dist/types/evidencePack.d.ts

@@ -0,0 +1,76 @@
+import type { BaselineTrend } from './baseline.js';
+import type { PreflightSuggestedAction } from './preflight.js';
+import type { ReleaseTrainReport } from './releaseTrain.js';
+import type { FixFirstRecommendation, WorkplanPriority } from './workplan.js';
+export type EvidencePackVerdict = 'ready' | 'caution' | 'blocked';
+export type EvidencePackArtifactStatus = 'ready' | 'caution' | 'blocked';
+export interface EvidencePackArtifact {
+    id: string;
+    title: string;
+    status: EvidencePackArtifactStatus;
+    summary: string;
+    evidence: string[];
+    commands: string[];
+}
+export interface EvidencePackTopRisk {
+    priority: WorkplanPriority;
+    title: string;
+    files: string[];
+    owner?: string;
+    command: string;
+}
+export interface EvidencePackTeamRoute {
+    owner: string;
+    files: string[];
+    reason: string;
+}
+export interface EvidencePackTrustCalibration {
+    verdict: 'clean' | 'manual_review' | 'actual_defect';
+    summary: string;
+    concreteBlockers: string[];
+    manualReviewSignals: string[];
+    watchSignals: string[];
+}
+export interface EvidencePackPrSummary {
+    verdictLabel: string;
+    decision: string;
+    trust: EvidencePackTrustCalibration;
+    topRisks: EvidencePackTopRisk[];
+    teamRoutes: EvidencePackTeamRoute[];
+    ownershipSuggestion?: string;
+    fixFirst?: FixFirstRecommendation;
+    nextCommands: string[];
+    baselineTrend?: BaselineTrend;
+}
+export interface EvidencePackPrCommentValidationCheck {
+    id: string;
+    status: 'pass' | 'warn' | 'fail';
+    summary: string;
+}
+export interface EvidencePackPrCommentValidation {
+    status: 'pass' | 'warn' | 'fail';
+    checks: EvidencePackPrCommentValidationCheck[];
+}
+export interface EvidencePackReport {
+    schemaVersion: 1;
+    currentVersion: string | null;
+    readOnly: true;
+    verdict: EvidencePackVerdict;
+    summary: string;
+    train: {
+        lines: string[];
+        readiness: ReleaseTrainReport['readiness'];
+    };
+    approval: {
+        required: true;
+        recommendation: string;
+        blockingReasons: string[];
+    };
+    artifacts: EvidencePackArtifact[];
+    changelogEntries: string[];
+    websitePrompt?: string;
+    prComment?: string;
+    prCommentValidation?: EvidencePackPrCommentValidation;
+    prSummary?: EvidencePackPrSummary;
+    suggestedNextActions: PreflightSuggestedAction[];
+}

package/dist/types/evidencePack.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=evidencePack.js.map

package/dist/types/evidencePack.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidencePack.js","sourceRoot":"","sources":["../../src/types/evidencePack.ts"],"names":[],"mappings":""}

package/dist/types/fixes.d.ts

@@ -0,0 +1,77 @@
+import type { IssueLocation, IssueSeverity } from './common.js';
+/**
+ * Structured action prompt the agent can paste into its plan. Returned by
+ * projscan_fix_suggest. projscan does not run an LLM - this is rule-driven
+ * guidance with the issue, the location, and a one-paragraph instruction
+ * the agent (LLM) is expected to act on.
+ */
+export interface FixSuggestion {
+    /** Echoes the input issue id when matched. */
+    issueId: string;
+    /** Severity level passed through from the source issue. */
+    severity: IssueSeverity;
+    /** Issue category passed through. */
+    category: string;
+    /** One-line "what is wrong". */
+    headline: string;
+    /** 2-4 sentences of why this matters. Severity-anchored. */
+    why: string;
+    /** Affected locations (mirrors Issue.locations when known). */
+    where: IssueLocation[];
+    /** One-paragraph instruction for the driving agent. */
+    instruction: string;
+    /** Optional "verify the fix by..." note. */
+    suggestedTest?: string;
+    /** Optional related files (importers, peer rules) for context. */
+    relatedFiles?: string[];
+    /** Optional documentation links. */
+    references?: string[];
+}
+/**
+ * Markdown-rendered deep dive for a single issue. Returned by
+ * projscan_explain_issue. Includes the surrounding code excerpt and any
+ * git-log evidence of similar fixes already merged in this repo.
+ */
+export interface IssueExplanation {
+    issueId: string;
+    title: string;
+    severity: IssueSeverity;
+    category: string;
+    headline: string;
+    /** Source-code excerpt around the primary location. Empty when no location. */
+    excerpt: {
+        file: string;
+        startLine: number;
+        endLine: number;
+        lines: string[];
+    } | null;
+    /** Other open issues touching the same file (id + title pairs). */
+    relatedIssues: Array<{
+        id: string;
+        title: string;
+    }>;
+    /**
+     * Git log references where this issue id (or its rule prefix) appears in a
+     * commit message - hints at how teammates have addressed it before.
+     * Empty when none found or git history unavailable.
+     */
+    similarFixes: Array<{
+        sha: string;
+        subject: string;
+        date: string;
+    }>;
+    /** The full FixSuggestion if a template matched; null otherwise. */
+    fix: FixSuggestion | null;
+}
+export interface Fix {
+    id: string;
+    title: string;
+    description: string;
+    issueId: string;
+    apply: (rootPath: string) => Promise<void>;
+}
+export interface FixResult {
+    fix: Fix;
+    success: boolean;
+    error?: string;
+}

package/dist/types/fixes.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=fixes.js.map

package/dist/types/fixes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fixes.js","sourceRoot":"","sources":["../../src/types/fixes.ts"],"names":[],"mappings":""}

package/dist/types/graph.d.ts

@@ -0,0 +1,80 @@
+export interface GraphEvidenceSummary {
+    schemaVersion: 1;
+    changedFiles?: number;
+    changedFunctions?: number;
+    totalFunctions: number;
+    totalPackages: number;
+    totalCallEdges: number;
+    dataflowRisks: number;
+    topPackages: string[];
+}
+export type SemanticGraphNodeKind = 'file' | 'function' | 'package' | 'symbol';
+export interface SemanticGraphNode {
+    id: string;
+    kind: SemanticGraphNodeKind;
+    label: string;
+    file?: string;
+    line?: number;
+    endLine?: number;
+    adapterId?: string;
+    metrics?: {
+        lineCount?: number;
+        cyclomaticComplexity?: number;
+        fanIn?: number;
+        fanOut?: number;
+    };
+}
+export type SemanticGraphEdgeKind = 'defines' | 'imports' | 'imports_package' | 'exports' | 'calls';
+export interface SemanticGraphEdge {
+    from: string;
+    to: string;
+    kind: SemanticGraphEdgeKind;
+    label?: string;
+}
+export interface SemanticGraphReport {
+    schemaVersion: 3;
+    nodes: SemanticGraphNode[];
+    edges: SemanticGraphEdge[];
+    metrics: {
+        totalFiles: number;
+        totalFunctions: number;
+        totalPackages: number;
+        totalSymbols: number;
+        totalEdges: number;
+    };
+    truncated: boolean;
+    limits: {
+        maxNodes: number;
+        maxEdges: number;
+    };
+}
+export type DataflowRiskKind = 'direct' | 'propagated' | 'bridge';
+export type DataflowRiskSeverity = 'warning' | 'error';
+export type DataflowRiskConfidence = 'low' | 'medium' | 'high';
+export interface DataflowRisk {
+    key: string;
+    kind: DataflowRiskKind;
+    severity: DataflowRiskSeverity;
+    confidence: DataflowRiskConfidence;
+    sourceFn: string;
+    sinkFn: string;
+    bridgeFn?: string;
+    source: string;
+    sink: string;
+    path: string[];
+    sourcePath?: string[];
+    sinkPath?: string[];
+    pathLength: number;
+    files: string[];
+}
+export interface DataflowReport {
+    available: boolean;
+    reason?: string;
+    riskCount: number;
+    risks: DataflowRisk[];
+    effectiveSources: string[];
+    effectiveSinks: string[];
+    truncated?: boolean;
+    truncatedSources?: string[];
+    maxDepth?: number;
+}

package/dist/types/graph.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=graph.js.map

package/dist/types/graph.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graph.js","sourceRoot":"","sources":["../../src/types/graph.ts"],"names":[],"mappings":""}

package/dist/types/graphCorpus.d.ts

@@ -0,0 +1,16 @@
+export interface GraphCorpusFixtureMetrics {
+    name: string;
+    fixture: string;
+    files: number;
+    functions: number;
+    packages: number;
+    symbols: number;
+    importEdges: number;
+    callEdges: number;
+    dataflowRisks: number;
+}
+export interface GraphCorpusReport {
+    schemaVersion: 1;
+    fixtures: GraphCorpusFixtureMetrics[];
+    totals: Omit<GraphCorpusFixtureMetrics, 'name' | 'fixture'>;
+}

package/dist/types/graphCorpus.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=graphCorpus.js.map

package/dist/types/graphCorpus.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"graphCorpus.js","sourceRoot":"","sources":["../../src/types/graphCorpus.ts"],"names":[],"mappings":""}

package/dist/types/hotspots.d.ts

@@ -0,0 +1,42 @@
+export interface AuthorShare {
+    author: string;
+    commits: number;
+    share: number;
+}
+export interface FileHotspot {
+    relativePath: string;
+    churn: number;
+    distinctAuthors: number;
+    daysSinceLastChange: number | null;
+    lineCount: number;
+    /** AST-derived McCabe complexity. null when no language adapter parsed this file. */
+    cyclomaticComplexity: number | null;
+    sizeBytes: number;
+    issueCount: number;
+    issueIds: string[];
+    riskScore: number;
+    reasons: string[];
+    primaryAuthor: string | null;
+    primaryAuthorShare: number;
+    busFactorOne: boolean;
+    topAuthors: AuthorShare[];
+    coverage?: number | null;
+    /**
+     * 1.5+ - true when Project Memory has marked this file as
+     * "accepted load-bearing debt" (top-K hotspot for >= 5 runs over
+     * >= 7 days without CC/churn improving). The reporter tags accepted
+     * rows so users aren't repeatedly pestered about debt they've
+     * implicitly opted into. Absent on older saves / fresh runs.
+     */
+    accepted?: boolean;
+}
+export interface HotspotReport {
+    available: boolean;
+    reason?: string;
+    window: {
+        since: string | null;
+        commitsScanned: number;
+    };
+    hotspots: FileHotspot[];
+    totalFilesRanked: number;
+}

package/dist/types/hotspots.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=hotspots.js.map

package/dist/types/hotspots.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hotspots.js","sourceRoot":"","sources":["../../src/types/hotspots.ts"],"names":[],"mappings":""}

package/dist/types/impact.d.ts

@@ -0,0 +1,62 @@
+/**
+ * One reachable file in an impact analysis. `distance` is BFS-hops from the
+ * input target (1 = direct dependent, 2 = dependent-of-dependent, etc).
+ * `target` itself is not included in the reachable list.
+ */
+export interface ImpactNode {
+    file: string;
+    distance: number;
+    /**
+     * 1.6+ - name of the registered repo that contains this file.
+     * Present only when `cross_repo: true` was passed and the file
+     * lives outside the source repo. Absent for in-repo entries.
+     */
+    repo?: string;
+}
+export interface ImpactBoundarySummary {
+    repo: string;
+    packageName: string;
+    owner: string;
+    files: string[];
+    reachableFiles: number;
+}
+export interface ImpactReport {
+    available: boolean;
+    reason?: string;
+    /** What was queried. */
+    target: {
+        kind: 'file' | 'symbol';
+        value: string;
+    };
+    /**
+     * For symbol mode: every file the graph claims defines the symbol. Empty
+     * for file mode. Useful when an agent needs to know whether a name is
+     * defined in multiple places before treating impact as authoritative.
+     */
+    definitionFiles: string[];
+    /**
+     * For symbol mode: files that directly call the symbol (their callSites
+     * contains the name). The reachable set is computed from these as roots.
+     * Empty for file mode.
+     */
+    directCallers: string[];
+    /** Sorted by distance asc, then file asc. */
+    reachable: ImpactNode[];
+    /** Convenience count of reachable files (== reachable.length). */
+    totalReachable: number;
+    /**
+     * 1.6+ - when cross-repo expansion ran, this is the per-repo
+     * breakdown of reachable file counts. Absent when `cross_repo`
+     * was false or the workspace had no siblings.
+     */
+    totalReachableByRepo?: Record<string, number>;
+    /** 3.5+ - cross-repo package/ownership boundaries that mention the target. */
+    boundarySummary?: ImpactBoundarySummary[];
+    /**
+     * True when traversal hit `maxDistance` before exhausting the graph.
+     * Items beyond the limit are omitted from `reachable`.
+     */
+    truncated: boolean;
+    /** The maxDistance value used for the traversal. */
+    maxDistance: number;
+}

package/dist/types/impact.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=impact.js.map

package/dist/types/impact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"impact.js","sourceRoot":"","sources":["../../src/types/impact.ts"],"names":[],"mappings":""}