# Reproduce the ApexCharts 4.7.0 source inventory

This public script emits an aggregate module CSV and a safe JSON report. Its output omits per-file records for target-only paths, including separately distributed commercial modules. It never includes source text. To reproduce, you need a local WestCoast Charts source checkout containing the recorded 1.1.1 commit; access to that checkout may be restricted. The public Core export does not contain the complete source tree used by the inventory; the public report therefore exposes provenance, hashes, aggregate results, and method, but not restricted source files. The published Core source export is linked from the report page.

Requires Python 3.9+, Git, and npm. First obtain and verify the official npm artifact:

```sh
mkdir -p baseline
npm view apexcharts@4.7.0 dist.tarball dist.integrity dist.shasum --json
npm pack apexcharts@4.7.0 --pack-destination baseline
```

Then fetch the two public Apex source anchors. The registry's `gitHead` is different from the `v4.7.0` tag, so both are checked:

```sh
git init apex-upstream
git -C apex-upstream fetch --depth=1 --no-tags https://github.com/apexcharts/apexcharts.js.git refs/tags/v4.7.0
git -C apex-upstream fetch --depth=1 --no-tags https://github.com/apexcharts/apexcharts.js.git 2c72f8299dba81dddbb50d2b8178163efbde2305
```

Run the script with a local checkout pinned to the recorded source commit:

```sh
python3 audit_lineage.py \
  --repo /path/to/west-coast-charts-source \
  --commit 56a7708437f1932ceea3b742db7268a6857133cf \
  --apex-tgz baseline/apexcharts-4.7.0.tgz \
  --upstream-git-dir apex-upstream \
  --out output
```

The script verifies the exact tarball SRI and SHA-1 published by npm, package name/version, the target commit/tree, and both Git source anchors. It compares tracked `src/**` paths only. It calculates file identity, source line counts and per-module raw Git Myers additions/deletions, plus a separately labeled line-block similarity estimate. That estimate is sensitive to formatting and repeated lines; it does not claim authorship, semantic identity, license compatibility, bundle weight, quality, or security risk.