autoremediator 0.16.0 → 0.17.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (47) hide show
  1. package/dist/api/delta-scan/delta-scan.test.d.ts +2 -0
  2. package/dist/api/delta-scan/delta-scan.test.d.ts.map +1 -0
  3. package/dist/api/delta-scan/index.d.ts +5 -0
  4. package/dist/api/delta-scan/index.d.ts.map +1 -0
  5. package/dist/api/evaluate/evaluate.test.d.ts +2 -0
  6. package/dist/api/evaluate/evaluate.test.d.ts.map +1 -0
  7. package/dist/api/evaluate/index.d.ts +5 -0
  8. package/dist/api/evaluate/index.d.ts.map +1 -0
  9. package/dist/api/index.d.ts +4 -1
  10. package/dist/api/index.d.ts.map +1 -1
  11. package/dist/api/reachability/index.d.ts +3 -0
  12. package/dist/api/reachability/index.d.ts.map +1 -0
  13. package/dist/api/reachability/reachability.test.d.ts +2 -0
  14. package/dist/api/reachability/reachability.test.d.ts.map +1 -0
  15. package/dist/api/reporting.d.ts.map +1 -1
  16. package/dist/api/vex/index.d.ts +1 -1
  17. package/dist/api/vex/index.d.ts.map +1 -1
  18. package/dist/{chunk-CQXNIRHT.js → chunk-U4LIJIGD.js} +411 -20
  19. package/dist/cli/program.d.ts.map +1 -1
  20. package/dist/cli/runners.d.ts +17 -0
  21. package/dist/cli/runners.d.ts.map +1 -1
  22. package/dist/cli.js +146 -1
  23. package/dist/index.js +409 -18
  24. package/dist/index.js.map +1 -1
  25. package/dist/intelligence/index.d.ts +1 -1
  26. package/dist/intelligence/index.d.ts.map +1 -1
  27. package/dist/intelligence/sources/github-advisory.d.ts +8 -0
  28. package/dist/intelligence/sources/github-advisory.d.ts.map +1 -1
  29. package/dist/intelligence/sources/osv.d.ts +4 -0
  30. package/dist/intelligence/sources/osv.d.ts.map +1 -1
  31. package/dist/mcp/server.d.ts +106 -1
  32. package/dist/mcp/server.d.ts.map +1 -1
  33. package/dist/mcp/server.js +100 -1
  34. package/dist/openapi/rbac.d.ts +2 -2
  35. package/dist/openapi/rbac.d.ts.map +1 -1
  36. package/dist/openapi/server.d.ts.map +1 -1
  37. package/dist/openapi/server.js +13 -6
  38. package/dist/platform/types.d.ts +84 -1
  39. package/dist/platform/types.d.ts.map +1 -1
  40. package/dist/remediation/evaluate-package.d.ts +3 -0
  41. package/dist/remediation/evaluate-package.d.ts.map +1 -0
  42. package/dist/remediation/runtime-tools.d.ts +1 -1
  43. package/dist/remediation/runtime-tools.d.ts.map +1 -1
  44. package/dist/remediation/tools/apply-patch-file/helpers.d.ts.map +1 -1
  45. package/dist/scanner/delta-scan.d.ts +3 -0
  46. package/dist/scanner/delta-scan.d.ts.map +1 -0
  47. package/package.json +7 -9
@@ -0,0 +1,2 @@
1
+ export {};
2
+ //# sourceMappingURL=delta-scan.test.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"delta-scan.test.d.ts","sourceRoot":"","sources":["../../../src/api/delta-scan/delta-scan.test.ts"],"names":[],"mappings":""}
@@ -0,0 +1,5 @@
1
+ /**
2
+ * Public SDK API: scanDelta
3
+ */
4
+ export { scanDelta } from "../../scanner/delta-scan.js";
5
+ //# sourceMappingURL=index.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/delta-scan/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC"}
@@ -0,0 +1,2 @@
1
+ export {};
2
+ //# sourceMappingURL=evaluate.test.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"evaluate.test.d.ts","sourceRoot":"","sources":["../../../src/api/evaluate/evaluate.test.ts"],"names":[],"mappings":""}
@@ -0,0 +1,5 @@
1
+ /**
2
+ * Public SDK API: evaluatePackage
3
+ */
4
+ export { evaluatePackage } from "../../remediation/evaluate-package.js";
5
+ //# sourceMappingURL=index.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/evaluate/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC"}
@@ -5,7 +5,7 @@
5
5
  * import { remediate } from 'autoremediator';
6
6
  * const report = await remediate('CVE-2021-23337', { cwd: '/my/project' });
7
7
  */
8
- export type { CorrelationContext, CveSeverity, LlmUsageMetrics, ModelPersonality, RemediationConstraints, ProvenanceContext, ProgressEvent, ProviderSafetyProfile, RemediateOptions, RemediationReport, ResultSimulation, CveDetails, AffectedPackage, InventoryPackage, VulnerablePackage, PatchResult, PatchStrategy, PatchStrategyCounts, DependencyScope, DependencyScopeCounts, PatchArtifact, PatchArtifactInspection, PatchArtifactQueryOptions, PatchArtifactSummary, PatchArtifactValidationReport, PatchMode, PatchRiskLevel, PatchConfidenceThresholds, UnresolvedReason, UnresolvedReasonCounts, EscalationAction, EscalationGraph, EscalationCounts, Disposition, DispositionPolicy, DispositionSignals, DispositionCounts, PatchValidationPhase, PatchValidationPhaseName, PortfolioReport, PortfolioTarget, PortfolioTargetResult, OutdatedPackage, UpdateOutdatedOptions, UpdateOutdatedReport, ExploitSignalOverridePolicy, VexJustification, VexSuppression, SlaPolicy, SlaBreach, SlaBreachEntry, SlaBreachSummary, ReachabilityAssessment, ReachabilityEvidence, SbomEntry, SbomStatus, SimulationMutation, SimulationMutationTarget, SimulationRebuttalCode, SimulationRebuttalFinding, SimulationSummary, } from "../platform/types.js";
8
+ export type { CorrelationContext, CveSeverity, LlmUsageMetrics, ModelPersonality, RemediationConstraints, ProvenanceContext, ProgressEvent, ProviderSafetyProfile, RemediateOptions, RemediationReport, ResultSimulation, CveDetails, AffectedPackage, InventoryPackage, VulnerablePackage, PatchResult, PatchStrategy, PatchStrategyCounts, DependencyScope, DependencyScopeCounts, PatchArtifact, PatchArtifactInspection, PatchArtifactQueryOptions, PatchArtifactSummary, PatchArtifactValidationReport, PatchMode, PatchRiskLevel, PatchConfidenceThresholds, UnresolvedReason, UnresolvedReasonCounts, EscalationAction, EscalationGraph, EscalationCounts, Disposition, DispositionPolicy, DispositionSignals, DispositionCounts, PatchValidationPhase, PatchValidationPhaseName, PortfolioReport, PortfolioTarget, PortfolioTargetResult, OutdatedPackage, UpdateOutdatedOptions, UpdateOutdatedReport, ExploitSignalOverridePolicy, VexJustification, VexSuppression, SlaPolicy, SlaBreach, SlaBreachEntry, SlaBreachSummary, ReachabilityAssessment, ReachabilityEvidence, SbomEntry, SbomStatus, SimulationMutation, SimulationMutationTarget, SimulationRebuttalCode, SimulationRebuttalFinding, SimulationSummary, CheckReachabilityOptions, EvaluatePackageOptions, PackageEvaluationReport, VulnerabilityEvaluationEntry, DeltaDependencyChange, DeltaFinding, DeltaScanOptions, DeltaScanReport, } from "../platform/types.js";
9
9
  export type { ScanInputFormat } from "../scanner/index.js";
10
10
  export type { ScanOptions, ScanReport, CiSummary } from "./contracts.js";
11
11
  export { PACKAGE_MANAGER_VALUES, LLM_PROVIDER_VALUES, PROVENANCE_SOURCE_VALUES, OPTION_DESCRIPTIONS, createConstraintSchemaProperties, createRemediateOptionSchemaProperties, createScanOptionSchemaProperties, createScanReportSchemaProperties, createUpdateOutdatedOptionSchemaProperties, } from "./options-schema.js";
@@ -17,5 +17,8 @@ export { remediatePortfolio } from "./portfolio/index.js";
17
17
  export { remediate, planRemediation } from "./remediate/index.js";
18
18
  export { remediateFromScan } from "./remediate-from-scan/index.js";
19
19
  export { updateOutdated } from "./update-outdated/index.js";
20
+ export { checkReachability } from "./reachability/index.js";
21
+ export { evaluatePackage } from "./evaluate/index.js";
22
+ export { scanDelta } from "./delta-scan/index.js";
20
23
  export { submitRemediateJob, submitScanJob, submitPortfolioJob, pollJob, type JobHandle, type AsyncRemediationJob, type TypedAsyncRemediationJob, } from "./jobs/index.js";
21
24
  //# sourceMappingURL=index.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,YAAY,EACV,kBAAkB,EAClB,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,sBAAsB,EACtB,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,aAAa,EACb,uBAAuB,EACvB,yBAAyB,EACzB,oBAAoB,EACpB,6BAA6B,EAC7B,SAAS,EACT,cAAc,EACd,yBAAyB,EACzB,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,wBAAwB,EACxB,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,2BAA2B,EAC3B,gBAAgB,EAChB,cAAc,EACd,SAAS,EACT,SAAS,EACT,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,SAAS,EACT,UAAU,EACV,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEzE,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,EACnB,gCAAgC,EAChC,qCAAqC,EACrC,gCAAgC,EAChC,gCAAgC,EAChC,0CAA0C,GAC3C,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,WAAW,EACX,UAAU,EACV,qBAAqB,EACrB,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EACL,cAAc,EACd,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,iCAAiC,EACtC,KAAK,qBAAqB,GAC3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,OAAO,EACP,KAAK,SAAS,EACd,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,iBAAiB,CAAC"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,YAAY,EACV,kBAAkB,EAClB,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,sBAAsB,EACtB,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,aAAa,EACb,uBAAuB,EACvB,yBAAyB,EACzB,oBAAoB,EACpB,6BAA6B,EAC7B,SAAS,EACT,cAAc,EACd,yBAAyB,EACzB,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,wBAAwB,EACxB,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,2BAA2B,EAC3B,gBAAgB,EAChB,cAAc,EACd,SAAS,EACT,SAAS,EACT,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,SAAS,EACT,UAAU,EACV,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,EACjB,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,4BAA4B,EAC5B,qBAAqB,EACrB,YAAY,EACZ,gBAAgB,EAChB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEzE,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,EACnB,gCAAgC,EAChC,qCAAqC,EACrC,gCAAgC,EAChC,gCAAgC,EAChC,0CAA0C,GAC3C,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,WAAW,EACX,UAAU,EACV,qBAAqB,EACrB,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EACL,cAAc,EACd,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,iCAAiC,EACtC,KAAK,qBAAqB,GAC3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,OAAO,EACP,KAAK,SAAS,EACd,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,iBAAiB,CAAC"}
@@ -0,0 +1,3 @@
1
+ import type { CheckReachabilityOptions, ReachabilityAssessment } from "../../platform/types.js";
2
+ export declare function checkReachability(options: CheckReachabilityOptions): Promise<ReachabilityAssessment>;
3
+ //# sourceMappingURL=index.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/reachability/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEhG,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,sBAAsB,CAAC,CAGjC"}
@@ -0,0 +1,2 @@
1
+ export {};
2
+ //# sourceMappingURL=reachability.test.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"reachability.test.d.ts","sourceRoot":"","sources":["../../../src/api/reachability/reachability.test.ts"],"names":[],"mappings":""}
@@ -1 +1 @@
1
- {"version":3,"file":"reporting.d.ts","sourceRoot":"","sources":["../../src/api/reporting.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,qBAAqB,EACrB,iBAAiB,EAEjB,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EACX,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,EAKhB,iBAAiB,EAEjB,gBAAgB,EAChB,sBAAsB,EACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AA4C5D,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,GAAG,SAAS,GAAG,gBAAgB,CAAC,GACvE,IAAI,CAQN;AAyJD,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,iBAAiB,EACzB,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,gBAAgB,CAAC,GACpF,gBAAgB,GAAG,SAAS,CAuB9B;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,iBAAiB,EAAE,GAC3B,iBAAiB,GAAG,SAAS,CA+C/B;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,iBAAiB,EACzB,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,gBAAgB,CAAC,GACpF,iBAAiB,CAkBnB;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,mBAAmB,GAAG,SAAS,CAUjG;AAMD,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,iBAAiB,EAAE,GAC3B,qBAAqB,GAAG,SAAS,CAsBnC;AAED,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,iBAAiB,EAAE,GAC3B,sBAAsB,GAAG,SAAS,CAWpC;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,iBAAiB,EAAE,GAC3B,iBAAiB,GAAG,SAAS,CAW/B;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,gBAAgB,GAAG,SAAS,CAS1F;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,gBAAgB,GAAG,SAAS,CAuBhG;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAuCzD;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,SAAS,GAAG,MAAM,CAErD"}
1
+ {"version":3,"file":"reporting.d.ts","sourceRoot":"","sources":["../../src/api/reporting.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,qBAAqB,EACrB,iBAAiB,EAEjB,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EACX,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,EAKhB,iBAAiB,EAEjB,gBAAgB,EAChB,sBAAsB,EACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AA4C5D,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,GAAG,SAAS,GAAG,gBAAgB,CAAC,GACvE,IAAI,CAQN;AAyJD,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,iBAAiB,EACzB,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,gBAAgB,CAAC,GACpF,gBAAgB,GAAG,SAAS,CAiC9B;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,iBAAiB,EAAE,GAC3B,iBAAiB,GAAG,SAAS,CA+C/B;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,iBAAiB,EACzB,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,gBAAgB,CAAC,GACpF,iBAAiB,CAkBnB;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,mBAAmB,GAAG,SAAS,CAUjG;AAMD,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,iBAAiB,EAAE,GAC3B,qBAAqB,GAAG,SAAS,CAsBnC;AAED,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,iBAAiB,EAAE,GAC3B,sBAAsB,GAAG,SAAS,CAWpC;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,iBAAiB,EAAE,GAC3B,iBAAiB,GAAG,SAAS,CAW/B;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,gBAAgB,GAAG,SAAS,CAS1F;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,gBAAgB,GAAG,SAAS,CAuBhG;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAuCzD;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,SAAS,GAAG,MAAM,CAErD"}
@@ -2,7 +2,7 @@ import type { RemediationReport } from "../../platform/types.js";
2
2
  import type { ScanReport } from "../contracts.js";
3
3
  export interface CycloneDxVexVulnerabilityAnalysis {
4
4
  state: "resolved" | "not_affected" | "in_triage";
5
- justification?: "code_not_in_execute_path" | "code_not_reachable" | string;
5
+ justification?: "code_not_in_execute_path" | "code_not_reachable" | (string & {});
6
6
  detail?: string;
7
7
  response?: ("update" | "workaround_available")[];
8
8
  }
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/vex/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,MAAM,WAAW,iCAAiC;IAChD,KAAK,EAAE,UAAU,GAAG,cAAc,GAAG,WAAW,CAAC;IACjD,aAAa,CAAC,EAAE,0BAA0B,GAAG,oBAAoB,GAAG,MAAM,CAAC;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,CAAC,QAAQ,GAAG,sBAAsB,CAAC,EAAE,CAAC;CAClD;AAED,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,iCAAiC,CAAC;CAC7C;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,WAAW,CAAC;IACvB,WAAW,EAAE,KAAK,CAAC;IACnB,OAAO,EAAE,CAAC,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE;QACR,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACjD,CAAC;IACF,eAAe,EAAE,yBAAyB,EAAE,CAAC;CAC9C;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AA4DD,wBAAgB,cAAc,CAC5B,MAAM,EAAE,UAAU,GAAG,iBAAiB,EACtC,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CA2BtB"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/vex/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,MAAM,WAAW,iCAAiC;IAChD,KAAK,EAAE,UAAU,GAAG,cAAc,GAAG,WAAW,CAAC;IACjD,aAAa,CAAC,EAAE,0BAA0B,GAAG,oBAAoB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,CAAC,QAAQ,GAAG,sBAAsB,CAAC,EAAE,CAAC;CAClD;AAED,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,iCAAiC,CAAC;CAC7C;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,WAAW,CAAC;IACvB,WAAW,EAAE,KAAK,CAAC;IACnB,OAAO,EAAE,CAAC,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE;QACR,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACjD,CAAC;IACF,eAAe,EAAE,yBAAyB,EAAE,CAAC;CAC9C;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AA4DD,wBAAgB,cAAc,CAC5B,MAAM,EAAE,UAAU,GAAG,iBAAiB,EACtC,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CA2BtB"}
@@ -1458,6 +1458,37 @@ async function fetchOsvVuln(cveId) {
1458
1458
  throw err;
1459
1459
  }
1460
1460
  }
1461
+ async function queryOsvPackage(packageName, version) {
1462
+ const url = `${OSV_BASE}/query`;
1463
+ const body = {
1464
+ package: {
1465
+ name: packageName,
1466
+ ecosystem: "npm"
1467
+ }
1468
+ };
1469
+ if (version) {
1470
+ body.version = version;
1471
+ }
1472
+ try {
1473
+ const res = await httpClient({
1474
+ url,
1475
+ method: "POST",
1476
+ body,
1477
+ headers: { "Content-Type": "application/json" }
1478
+ });
1479
+ if (res.status === 404) return [];
1480
+ if (!res.ok) {
1481
+ throw new Error(`OSV API error ${res.status} for query "${packageName}": ${res.text}`);
1482
+ }
1483
+ const data = res.data;
1484
+ return data.vulns ?? [];
1485
+ } catch (err) {
1486
+ if (err instanceof Error) {
1487
+ throw new Error(`OSV API error for query "${packageName}": ${err.message}`);
1488
+ }
1489
+ throw err;
1490
+ }
1491
+ }
1461
1492
  function osvEventsToSemverRange(events) {
1462
1493
  const parts = [];
1463
1494
  for (const event of events) {
@@ -1522,24 +1553,31 @@ async function lookupCveOsv(cveId) {
1522
1553
  }
1523
1554
 
1524
1555
  // src/intelligence/sources/github-advisory.ts
1525
- import { Octokit } from "@octokit/rest";
1526
- function createOctokitClient() {
1527
- const token = getGitHubToken();
1528
- return new Octokit(token ? { auth: `token ${token}` } : {});
1529
- }
1556
+ var GITHUB_API_BASE = "https://api.github.com/advisories";
1530
1557
  async function fetchGhAdvisories(cveId) {
1531
- const octokit = createOctokitClient();
1558
+ const token = getGitHubToken();
1559
+ const headers = {
1560
+ "X-GitHub-Api-Version": "2022-11-28",
1561
+ "User-Agent": "autoremediator"
1562
+ };
1563
+ if (token) {
1564
+ headers["Authorization"] = `token ${token}`;
1565
+ }
1566
+ const url = new URL(GITHUB_API_BASE);
1567
+ url.searchParams.set("cve_id", cveId);
1568
+ url.searchParams.set("ecosystem", "npm");
1569
+ url.searchParams.set("type", "reviewed");
1570
+ url.searchParams.set("per_page", "10");
1532
1571
  try {
1533
- const response = await octokit.request("GET /advisories", {
1534
- cve_id: cveId,
1535
- ecosystem: "npm",
1536
- type: "reviewed",
1537
- per_page: 10,
1538
- headers: {
1539
- "X-GitHub-Api-Version": "2022-11-28"
1540
- }
1572
+ const res = await httpClient({
1573
+ url: url.toString(),
1574
+ headers
1541
1575
  });
1542
- return response.data;
1576
+ if (!res.ok) {
1577
+ if (res.status === 404) return [];
1578
+ throw new Error(`HTTP ${res.status}: ${res.text}`);
1579
+ }
1580
+ return Array.isArray(res.data) ? res.data : [];
1543
1581
  } catch (err) {
1544
1582
  const errorMsg = err instanceof Error ? err.message : String(err);
1545
1583
  console.warn(
@@ -2148,6 +2186,15 @@ async function fetchPackageVersions(packageName) {
2148
2186
  return [];
2149
2187
  }
2150
2188
  }
2189
+ async function findSafeUpgradeVersion(packageName, installedVersion, firstPatchedVersion, vulnerableRange) {
2190
+ const resolution = await resolveSafeUpgradeVersion(
2191
+ packageName,
2192
+ installedVersion,
2193
+ firstPatchedVersion,
2194
+ vulnerableRange
2195
+ );
2196
+ return resolution.safeVersion;
2197
+ }
2151
2198
  async function resolveSafeUpgradeVersion(packageName, installedVersion, firstPatchedVersion, vulnerableRange) {
2152
2199
  const versions = await fetchPackageVersions(packageName);
2153
2200
  if (!versions.length) {
@@ -3830,7 +3877,8 @@ async function validatePatchWithTests(cwd, testCommand) {
3830
3877
  output: result.stdout
3831
3878
  };
3832
3879
  } catch (err) {
3833
- const errorOutput = typeof err === "object" && err !== null && "stdout" in err ? String(err.stdout ?? "") : "";
3880
+ const stdoutVal = typeof err === "object" && err !== null && "stdout" in err ? err.stdout : "";
3881
+ const errorOutput = typeof stdoutVal === "string" ? stdoutVal : Buffer.isBuffer(stdoutVal) ? stdoutVal.toString("utf8") : "";
3834
3882
  const failedTests = extractFailedTests(errorOutput);
3835
3883
  return {
3836
3884
  passed: false,
@@ -6268,6 +6316,24 @@ function buildResultSimulation(report, result, options) {
6268
6316
  const dependencyScope = result.dependencyScope ?? dependencyScopeLookup.get(result.packageName);
6269
6317
  const plannedMutations = buildPlannedMutations(result, options.runTests === true);
6270
6318
  const wouldMutate = plannedMutations.length > 0;
6319
+ let unifiedDiff;
6320
+ if (result.patchArtifact?.patchFilePath) {
6321
+ unifiedDiff = `--- ${result.patchArtifact.patchFilePath}
6322
+ +++ ${result.patchArtifact.patchFilePath}`;
6323
+ } else if (result.strategy === "version-bump" && result.toVersion) {
6324
+ unifiedDiff = `--- package.json
6325
+ +++ package.json
6326
+ @@ -1,3 +1,3 @@
6327
+ - "${result.packageName}": "${result.fromVersion}"
6328
+ + "${result.packageName}": "^${result.toVersion}"`;
6329
+ } else if (result.strategy === "override" && result.toVersion) {
6330
+ unifiedDiff = `--- package.json
6331
+ +++ package.json
6332
+ @@ -1,3 +1,3 @@
6333
+ + "overrides": {
6334
+ + "${result.packageName}": "${result.toVersion}"
6335
+ + }`;
6336
+ }
6271
6337
  return {
6272
6338
  mode,
6273
6339
  wouldMutate,
@@ -6278,7 +6344,8 @@ function buildResultSimulation(report, result, options) {
6278
6344
  dependencyScope,
6279
6345
  wouldMutate,
6280
6346
  runTests: options.runTests === true
6281
- })
6347
+ }),
6348
+ unifiedDiff
6282
6349
  };
6283
6350
  }
6284
6351
  function buildSimulationSummary(reports) {
@@ -6706,7 +6773,7 @@ function parseScanInput(filePath, format) {
6706
6773
  if (resolved === "sarif") {
6707
6774
  return parseSarifFile(resolvedPath);
6708
6775
  }
6709
- throw new Error(`Unsupported input format: ${resolved}`);
6776
+ throw new Error(`Unsupported input format: ${String(resolved)}`);
6710
6777
  }
6711
6778
  async function parseScanInputFromAudit(params) {
6712
6779
  const pm = params.packageManager ?? detectPackageManager(params.cwd);
@@ -7428,6 +7495,327 @@ async function updateOutdated(options = {}) {
7428
7495
  };
7429
7496
  }
7430
7497
 
7498
+ // src/api/reachability/index.ts
7499
+ async function checkReachability(options) {
7500
+ const cwd = options.cwd ?? process.cwd();
7501
+ return assessPackageReachability(cwd, options.packageName, options.symbol);
7502
+ }
7503
+
7504
+ // src/remediation/evaluate-package.ts
7505
+ import semver7 from "semver";
7506
+ async function evaluatePackage(packageName, options = {}) {
7507
+ const version = options.version?.trim();
7508
+ const enrich = options.enrichIntelligence !== false;
7509
+ let versions = [];
7510
+ let latestVersion;
7511
+ try {
7512
+ versions = await fetchPackageVersions(packageName);
7513
+ if (versions.length > 0) {
7514
+ const valid = versions.filter((v) => semver7.valid(v)).sort((a, b) => semver7.compare(a, b));
7515
+ latestVersion = valid[valid.length - 1];
7516
+ }
7517
+ } catch {
7518
+ }
7519
+ let rawVulns = [];
7520
+ try {
7521
+ rawVulns = await queryOsvPackage(packageName, version);
7522
+ } catch {
7523
+ rawVulns = [];
7524
+ }
7525
+ let kevFeed = null;
7526
+ if (enrich) {
7527
+ try {
7528
+ kevFeed = await fetchCisaKevFeed();
7529
+ } catch {
7530
+ kevFeed = null;
7531
+ }
7532
+ }
7533
+ const entries = [];
7534
+ for (const raw of rawVulns) {
7535
+ const cveDetails = parseOsvVuln(raw);
7536
+ const affected = cveDetails.affectedPackages.find(
7537
+ (p) => p.name.toLowerCase() === packageName.toLowerCase()
7538
+ );
7539
+ if (version && affected?.vulnerableRange) {
7540
+ const cleanVer = semver7.clean(version) || version;
7541
+ if (semver7.valid(cleanVer) && !semver7.satisfies(cleanVer, affected.vulnerableRange)) {
7542
+ continue;
7543
+ }
7544
+ }
7545
+ let inCisaKev = false;
7546
+ let epssScore;
7547
+ let epssPercentile;
7548
+ if (enrich && cveDetails.id.startsWith("CVE-")) {
7549
+ if (kevFeed) {
7550
+ inCisaKev = Boolean(findKevEntry(kevFeed, cveDetails.id));
7551
+ }
7552
+ try {
7553
+ const epss = await fetchEpss(cveDetails.id);
7554
+ if (epss) {
7555
+ epssScore = Number.parseFloat(epss.epss);
7556
+ epssPercentile = Number.parseFloat(epss.percentile);
7557
+ }
7558
+ } catch {
7559
+ }
7560
+ }
7561
+ let safeUpgradeVersion;
7562
+ if (affected?.firstPatchedVersion) {
7563
+ try {
7564
+ const safe = await findSafeUpgradeVersion(
7565
+ packageName,
7566
+ version || "0.0.0",
7567
+ affected.firstPatchedVersion
7568
+ );
7569
+ safeUpgradeVersion = safe ?? affected.firstPatchedVersion;
7570
+ } catch {
7571
+ safeUpgradeVersion = affected.firstPatchedVersion;
7572
+ }
7573
+ }
7574
+ entries.push({
7575
+ cveId: cveDetails.id,
7576
+ severity: cveDetails.severity,
7577
+ summary: cveDetails.summary,
7578
+ vulnerableRange: affected?.vulnerableRange,
7579
+ firstPatchedVersion: affected?.firstPatchedVersion,
7580
+ safeUpgradeVersion,
7581
+ epssScore,
7582
+ epssPercentile,
7583
+ inCisaKev,
7584
+ references: cveDetails.references
7585
+ });
7586
+ }
7587
+ const isVulnerable = entries.length > 0;
7588
+ let verdict = "safe";
7589
+ if (isVulnerable) {
7590
+ const hasKevOrHighEpss = entries.some((e) => e.inCisaKev || e.epssScore && e.epssScore > 0.5);
7591
+ const hasHighOrCritical = entries.some(
7592
+ (e) => e.severity === "CRITICAL" || e.severity === "HIGH"
7593
+ );
7594
+ if (hasKevOrHighEpss) {
7595
+ verdict = "actively-exploited";
7596
+ } else if (hasHighOrCritical) {
7597
+ verdict = "vulnerable";
7598
+ } else {
7599
+ verdict = "caution";
7600
+ }
7601
+ }
7602
+ let recommendedVersion;
7603
+ if (isVulnerable) {
7604
+ const upgradeCandidates = entries.map((e) => e.safeUpgradeVersion).filter((v) => Boolean(v && semver7.valid(v))).sort((a, b) => semver7.compare(a, b));
7605
+ recommendedVersion = upgradeCandidates[upgradeCandidates.length - 1] || latestVersion;
7606
+ } else {
7607
+ recommendedVersion = version || latestVersion;
7608
+ }
7609
+ const summary = isVulnerable ? `Package "${packageName}${version ? `@${version}` : ""}" has ${entries.length} known vulnerability(ies) (verdict: ${verdict}). Recommended safe version: ${recommendedVersion || "none"}.` : `Package "${packageName}${version ? `@${version}` : ""}" has no known vulnerabilities. Safe to install.`;
7610
+ return {
7611
+ schemaVersion: "1.0",
7612
+ packageName,
7613
+ evaluatedVersion: version,
7614
+ isVulnerable,
7615
+ verdict,
7616
+ summary,
7617
+ vulnerabilities: entries,
7618
+ recommendedVersion,
7619
+ latestVersion,
7620
+ generatedAt: (/* @__PURE__ */ new Date()).toISOString()
7621
+ };
7622
+ }
7623
+
7624
+ // src/scanner/delta-scan.ts
7625
+ import { existsSync as existsSync12, readFileSync as readFileSync17 } from "fs";
7626
+ import { join as join20 } from "path";
7627
+ import { execa as execa12 } from "execa";
7628
+ import semver8 from "semver";
7629
+ var DEP_SECTIONS = [
7630
+ "dependencies",
7631
+ "devDependencies",
7632
+ "peerDependencies",
7633
+ "optionalDependencies"
7634
+ ];
7635
+ async function getChangedManifestPaths(cwd, baseRef) {
7636
+ const manifests = /* @__PURE__ */ new Set();
7637
+ try {
7638
+ const { stdout: diffFiles } = await execa12(
7639
+ "git",
7640
+ ["diff", "--name-only", baseRef, "--", "package.json", "**/package.json"],
7641
+ { cwd, reject: false }
7642
+ );
7643
+ for (const f of diffFiles.split("\n")) {
7644
+ const trimmed = f.trim();
7645
+ if (trimmed && trimmed.endsWith("package.json") && !trimmed.includes("node_modules")) {
7646
+ manifests.add(trimmed);
7647
+ }
7648
+ }
7649
+ const { stdout: untrackedFiles } = await execa12(
7650
+ "git",
7651
+ ["ls-files", "--others", "--exclude-standard", "--", "package.json", "**/package.json"],
7652
+ { cwd, reject: false }
7653
+ );
7654
+ for (const f of untrackedFiles.split("\n")) {
7655
+ const trimmed = f.trim();
7656
+ if (trimmed && trimmed.endsWith("package.json") && !trimmed.includes("node_modules")) {
7657
+ manifests.add(trimmed);
7658
+ }
7659
+ }
7660
+ } catch {
7661
+ if (existsSync12(join20(cwd, "package.json"))) {
7662
+ manifests.add("package.json");
7663
+ }
7664
+ }
7665
+ return Array.from(manifests);
7666
+ }
7667
+ async function getOldManifestContent(cwd, baseRef, relPath) {
7668
+ try {
7669
+ const { stdout } = await execa12("git", ["show", `${baseRef}:${relPath}`], {
7670
+ cwd,
7671
+ reject: false
7672
+ });
7673
+ if (!stdout || !stdout.trim()) return null;
7674
+ return JSON.parse(stdout);
7675
+ } catch {
7676
+ return null;
7677
+ }
7678
+ }
7679
+ function getNewManifestContent(cwd, relPath) {
7680
+ const fullPath = join20(cwd, relPath);
7681
+ if (!existsSync12(fullPath)) return null;
7682
+ try {
7683
+ return JSON.parse(readFileSync17(fullPath, "utf8"));
7684
+ } catch {
7685
+ return null;
7686
+ }
7687
+ }
7688
+ function computeDependencyDiff(relPath, oldPkg, newPkg) {
7689
+ const changes = [];
7690
+ for (const section of DEP_SECTIONS) {
7691
+ const oldDeps = oldPkg?.[section] ?? {};
7692
+ const newDeps = newPkg?.[section] ?? {};
7693
+ for (const [pkgName, newVer] of Object.entries(newDeps)) {
7694
+ const oldVer = oldDeps[pkgName];
7695
+ if (!oldVer) {
7696
+ changes.push({
7697
+ packageName: pkgName,
7698
+ changeType: "added",
7699
+ newVersion: newVer,
7700
+ dependencyType: section,
7701
+ manifestPath: relPath
7702
+ });
7703
+ } else if (oldVer !== newVer) {
7704
+ const cleanOld = semver8.clean(oldVer) || semver8.coerce(oldVer)?.version;
7705
+ const cleanNew = semver8.clean(newVer) || semver8.coerce(newVer)?.version;
7706
+ const isUpgrade = cleanOld && cleanNew && semver8.valid(cleanOld) && semver8.valid(cleanNew) ? semver8.gt(cleanNew, cleanOld) : true;
7707
+ changes.push({
7708
+ packageName: pkgName,
7709
+ changeType: isUpgrade ? "upgraded" : "downgraded",
7710
+ oldVersion: oldVer,
7711
+ newVersion: newVer,
7712
+ dependencyType: section,
7713
+ manifestPath: relPath
7714
+ });
7715
+ }
7716
+ }
7717
+ for (const [pkgName, oldVer] of Object.entries(oldDeps)) {
7718
+ if (!(pkgName in newDeps)) {
7719
+ changes.push({
7720
+ packageName: pkgName,
7721
+ changeType: "removed",
7722
+ oldVersion: oldVer,
7723
+ dependencyType: section,
7724
+ manifestPath: relPath
7725
+ });
7726
+ }
7727
+ }
7728
+ }
7729
+ return changes;
7730
+ }
7731
+ async function scanDelta(options = {}) {
7732
+ const cwd = options.cwd ?? process.cwd();
7733
+ const baseRef = options.baseRef ?? "HEAD";
7734
+ const changedManifests = await getChangedManifestPaths(cwd, baseRef);
7735
+ const dependencyChanges = [];
7736
+ for (const manifestRel of changedManifests) {
7737
+ const oldPkg = await getOldManifestContent(cwd, baseRef, manifestRel);
7738
+ const newPkg = getNewManifestContent(cwd, manifestRel);
7739
+ const diffs = computeDependencyDiff(manifestRel, oldPkg, newPkg);
7740
+ dependencyChanges.push(...diffs);
7741
+ }
7742
+ const introducedFindings = [];
7743
+ const resolvedFindings = [];
7744
+ for (const change of dependencyChanges) {
7745
+ if (change.changeType === "added" || change.changeType === "upgraded" || change.changeType === "downgraded") {
7746
+ const cleanVer = semver8.coerce(change.newVersion)?.version ?? change.newVersion;
7747
+ const evaluation = await evaluatePackage(change.packageName, {
7748
+ version: cleanVer,
7749
+ enrichIntelligence: true
7750
+ });
7751
+ for (const vuln of evaluation.vulnerabilities) {
7752
+ introducedFindings.push({
7753
+ packageName: change.packageName,
7754
+ cveId: vuln.cveId,
7755
+ severity: vuln.severity,
7756
+ summary: vuln.summary,
7757
+ deltaType: "introduced",
7758
+ installedVersion: change.newVersion,
7759
+ safeUpgradeVersion: vuln.safeUpgradeVersion,
7760
+ inCisaKev: vuln.inCisaKev,
7761
+ epssScore: vuln.epssScore
7762
+ });
7763
+ }
7764
+ }
7765
+ if (change.oldVersion && (change.changeType === "upgraded" || change.changeType === "removed")) {
7766
+ const cleanOldVer = semver8.coerce(change.oldVersion)?.version ?? change.oldVersion;
7767
+ const oldEval = await evaluatePackage(change.packageName, {
7768
+ version: cleanOldVer,
7769
+ enrichIntelligence: true
7770
+ });
7771
+ const cleanNewVer = change.newVersion ? semver8.coerce(change.newVersion)?.version ?? change.newVersion : void 0;
7772
+ const newEval = cleanNewVer ? await evaluatePackage(change.packageName, {
7773
+ version: cleanNewVer,
7774
+ enrichIntelligence: false
7775
+ }) : { vulnerabilities: [] };
7776
+ const newCveSet = new Set(newEval.vulnerabilities.map((v) => v.cveId));
7777
+ for (const oldVuln of oldEval.vulnerabilities) {
7778
+ if (!newCveSet.has(oldVuln.cveId)) {
7779
+ resolvedFindings.push({
7780
+ packageName: change.packageName,
7781
+ cveId: oldVuln.cveId,
7782
+ severity: oldVuln.severity,
7783
+ summary: oldVuln.summary,
7784
+ deltaType: "resolved",
7785
+ installedVersion: change.oldVersion,
7786
+ safeUpgradeVersion: oldVuln.safeUpgradeVersion,
7787
+ inCisaKev: oldVuln.inCisaKev,
7788
+ epssScore: oldVuln.epssScore
7789
+ });
7790
+ }
7791
+ }
7792
+ }
7793
+ }
7794
+ let netRiskVerdict = "neutral";
7795
+ let status = "ok";
7796
+ if (introducedFindings.length > 0) {
7797
+ netRiskVerdict = "degraded";
7798
+ status = "degraded";
7799
+ } else if (resolvedFindings.length > 0) {
7800
+ netRiskVerdict = "improved";
7801
+ status = "improved";
7802
+ }
7803
+ const summary = introducedFindings.length > 0 ? `Delta scan against ${baseRef} found ${introducedFindings.length} newly introduced vulnerability(ies) across ${dependencyChanges.length} dependency change(s) (net risk: degraded).` : resolvedFindings.length > 0 ? `Delta scan against ${baseRef} resolved ${resolvedFindings.length} vulnerability(ies) across ${dependencyChanges.length} dependency change(s) (net risk: improved).` : `Delta scan against ${baseRef} found 0 new vulnerabilities across ${dependencyChanges.length} dependency change(s) (net risk: neutral).`;
7804
+ return {
7805
+ schemaVersion: "1.0",
7806
+ status,
7807
+ baseRef,
7808
+ targetRef: "working-tree",
7809
+ changedManifests,
7810
+ dependencyChanges,
7811
+ introducedFindings,
7812
+ resolvedFindings,
7813
+ netRiskVerdict,
7814
+ summary,
7815
+ generatedAt: (/* @__PURE__ */ new Date()).toISOString()
7816
+ };
7817
+ }
7818
+
7431
7819
  // src/api/jobs/index.ts
7432
7820
  import { randomUUID as randomUUID2 } from "crypto";
7433
7821
 
@@ -7543,9 +7931,9 @@ function toSarifOutput(report) {
7543
7931
  }
7544
7932
 
7545
7933
  // src/version.ts
7546
- import { readFileSync as readFileSync17 } from "fs";
7934
+ import { readFileSync as readFileSync18 } from "fs";
7547
7935
  function readPackageVersion() {
7548
- const raw = readFileSync17(new URL("../package.json", import.meta.url), "utf8");
7936
+ const raw = readFileSync18(new URL("../package.json", import.meta.url), "utf8");
7549
7937
  const metadata = JSON.parse(raw);
7550
7938
  if (!metadata.version) {
7551
7939
  throw new Error("packages/core/package.json is missing a version field.");
@@ -7575,6 +7963,9 @@ export {
7575
7963
  remediateFromScan,
7576
7964
  remediatePortfolio,
7577
7965
  updateOutdated,
7966
+ checkReachability,
7967
+ evaluatePackage,
7968
+ scanDelta,
7578
7969
  submitRemediateJob,
7579
7970
  submitScanJob,
7580
7971
  submitPortfolioJob,
@@ -1 +1 @@
1
- {"version":3,"file":"program.d.ts","sourceRoot":"","sources":["../../src/cli/program.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAmIpC,wBAAgB,aAAa,IAAI,OAAO,CAsMvC"}
1
+ {"version":3,"file":"program.d.ts","sourceRoot":"","sources":["../../src/cli/program.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAsIpC,wBAAgB,aAAa,IAAI,OAAO,CAyQvC"}
@@ -6,4 +6,21 @@ export declare function runInspectPatch(patchPath: string, opts: Pick<CommandOpt
6
6
  export declare function runValidatePatch(patchPath: string, opts: Pick<CommandOptions, "cwd" | "patchesDir" | "packageManager" | "outputFormat">): Promise<void>;
7
7
  export declare function runUpdateOutdated(opts: CommandOptions): Promise<void>;
8
8
  export declare function runPortfolio(targetsFilePath: string, opts: CommandOptions): Promise<void>;
9
+ export declare function runReachability(opts: {
10
+ cwd?: string;
11
+ package: string;
12
+ symbol?: string;
13
+ outputFormat?: string;
14
+ }): Promise<void>;
15
+ export declare function runEvaluate(packageName: string, opts: {
16
+ cwd?: string;
17
+ version?: string;
18
+ outputFormat?: string;
19
+ }): Promise<void>;
20
+ export declare function runDiffAudit(opts: {
21
+ cwd?: string;
22
+ base?: string;
23
+ outputFormat?: string;
24
+ ci?: boolean;
25
+ }): Promise<void>;
9
26
  //# sourceMappingURL=runners.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"runners.d.ts","sourceRoot":"","sources":["../../src/cli/runners.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAkFjD,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA4IrF;AAED,wBAAsB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAqKzF;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,YAAY,GAAG,cAAc,CAAC,GAChE,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAED,wBAAsB,eAAe,CACnC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,YAAY,GAAG,cAAc,CAAC,GAChE,OAAO,CAAC,IAAI,CAAC,CA4Bf;AAED,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,YAAY,GAAG,gBAAgB,GAAG,cAAc,CAAC,GACnF,OAAO,CAAC,IAAI,CAAC,CAgCf;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA+C3E;AAED,wBAAsB,YAAY,CAAC,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA6F/F"}
1
+ {"version":3,"file":"runners.d.ts","sourceRoot":"","sources":["../../src/cli/runners.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAkFjD,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA4IrF;AAED,wBAAsB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAqKzF;AAED,wBAAsB,cAAc,CAClC,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,YAAY,GAAG,cAAc,CAAC,GAChE,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAED,wBAAsB,eAAe,CACnC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,YAAY,GAAG,cAAc,CAAC,GAChE,OAAO,CAAC,IAAI,CAAC,CA4Bf;AAED,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,YAAY,GAAG,gBAAgB,GAAG,cAAc,CAAC,GACnF,OAAO,CAAC,IAAI,CAAC,CAgCf;AAED,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA+C3E;AAED,wBAAsB,YAAY,CAAC,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CA6F/F;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE;IAC1C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBhB;AAED,wBAAsB,WAAW,CAC/B,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;IACJ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GACA,OAAO,CAAC,IAAI,CAAC,CA6Bf;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,EAAE,CAAC,EAAE,OAAO,CAAC;CACd,GAAG,OAAO,CAAC,IAAI,CAAC,CAiChB"}