autoremediator 0.16.0 → 0.18.0

package/README.md

@@ -43,7 +43,8 @@ Autoremediator selects the safest applicable fix strategy for each vulnerability
 
 - **Direct version upgrade** — the preferred path when a safe fixed version exists in the direct dependency graph
 - **Transitive override** — applied when exposure is in a transitive dependency and a direct upgrade is not feasible
-- **Controlled patch generation** — a confidence-scored fallback when no safe fixed version exists; produces auditable patch artifacts tracked through their full lifecycle
+- **Controlled patch generation** — a confidence-scored fallback when no safe fixed version exists; produces auditable patch artifacts tracked through their full lifecycle with synthesized reproduction tests
+- **Upstream patch reconciliation** — detects when upstream package releases supersede local patch files and safely retires them (`patches reconcile`)
 
 Unresolved findings are never silently dropped. Each one is classified with an explicit reason and treated as an escalation input for downstream security workflows.
 

package/dist/api/change-request/index.d.ts

@@ -1,4 +1,5 @@
-import type { ChangeRequestOptions, ChangeRequestResult, RemediationReport } from "../../platform/types.js";
+import type { ChangeRequestGrouping, ChangeRequestOptions, ChangeRequestResult, RemediationReport } from "../../platform/types.js";
+export declare function groupReports(reports: RemediationReport[], grouping: ChangeRequestGrouping): RemediationReport[][];
 export declare function createChangeRequestsForReports(params: {
     cwd: string;
     options: ChangeRequestOptions;

package/dist/api/change-request/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/change-request/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,yBAAyB,CAAC;AAgJjC,wBAAsB,8BAA8B,CAAC,MAAM,EAAE;IAC3D,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,oBAAoB,CAAC;IAC9B,OAAO,EAAE,iBAAiB,EAAE,CAAC;CAC9B,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAmGjC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/change-request/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,yBAAyB,CAAC;AAsDjC,wBAAgB,YAAY,CAC1B,OAAO,EAAE,iBAAiB,EAAE,EAC5B,QAAQ,EAAE,qBAAqB,GAC9B,iBAAiB,EAAE,EAAE,CAgDvB;AA8FD,wBAAsB,8BAA8B,CAAC,MAAM,EAAE;IAC3D,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,oBAAoB,CAAC;IAC9B,OAAO,EAAE,iBAAiB,EAAE,CAAC;CAC9B,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CA+GjC"}

package/dist/api/delta-scan/delta-scan.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=delta-scan.test.d.ts.map

package/dist/api/delta-scan/delta-scan.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delta-scan.test.d.ts","sourceRoot":"","sources":["../../../src/api/delta-scan/delta-scan.test.ts"],"names":[],"mappings":""}

package/dist/api/delta-scan/index.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Public SDK API: scanDelta
+ */
+export { scanDelta } from "../../scanner/delta-scan.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/api/delta-scan/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/delta-scan/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC"}

package/dist/api/evaluate/evaluate.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=evaluate.test.d.ts.map

package/dist/api/evaluate/evaluate.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluate.test.d.ts","sourceRoot":"","sources":["../../../src/api/evaluate/evaluate.test.ts"],"names":[],"mappings":""}

package/dist/api/evaluate/index.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Public SDK API: evaluatePackage
+ */
+export { evaluatePackage } from "../../remediation/evaluate-package.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/api/evaluate/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/evaluate/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC"}

package/dist/api/index.d.ts

@@ -5,17 +5,20 @@
  *   import { remediate } from 'autoremediator';
  *   const report = await remediate('CVE-2021-23337', { cwd: '/my/project' });
  */
-export type { CorrelationContext, CveSeverity, LlmUsageMetrics, ModelPersonality, RemediationConstraints, ProvenanceContext, ProgressEvent, ProviderSafetyProfile, RemediateOptions, RemediationReport, ResultSimulation, CveDetails, AffectedPackage, InventoryPackage, VulnerablePackage, PatchResult, PatchStrategy, PatchStrategyCounts, DependencyScope, DependencyScopeCounts, PatchArtifact, PatchArtifactInspection, PatchArtifactQueryOptions, PatchArtifactSummary, PatchArtifactValidationReport, PatchMode, PatchRiskLevel, PatchConfidenceThresholds, UnresolvedReason, UnresolvedReasonCounts, EscalationAction, EscalationGraph, EscalationCounts, Disposition, DispositionPolicy, DispositionSignals, DispositionCounts, PatchValidationPhase, PatchValidationPhaseName, PortfolioReport, PortfolioTarget, PortfolioTargetResult, OutdatedPackage, UpdateOutdatedOptions, UpdateOutdatedReport, ExploitSignalOverridePolicy, VexJustification, VexSuppression, SlaPolicy, SlaBreach, SlaBreachEntry, SlaBreachSummary, ReachabilityAssessment, ReachabilityEvidence, SbomEntry, SbomStatus, SimulationMutation, SimulationMutationTarget, SimulationRebuttalCode, SimulationRebuttalFinding, SimulationSummary, } from "../platform/types.js";
+export type { CorrelationContext, CveSeverity, LlmUsageMetrics, ModelPersonality, RemediationConstraints, ProvenanceContext, ProgressEvent, ProviderSafetyProfile, RemediateOptions, RemediationReport, ResultSimulation, CveDetails, AffectedPackage, InventoryPackage, VulnerablePackage, PatchResult, PatchStrategy, PatchStrategyCounts, DependencyScope, DependencyScopeCounts, PatchArtifact, PatchArtifactInspection, PatchArtifactQueryOptions, PatchArtifactSummary, PatchArtifactValidationReport, PatchReconcileOptions, PatchReconcileResult, PatchReconcileReport, PatchMode, PatchRiskLevel, PatchConfidenceThresholds, UnresolvedReason, UnresolvedReasonCounts, EscalationAction, EscalationGraph, EscalationCounts, Disposition, DispositionPolicy, DispositionSignals, DispositionCounts, PatchValidationPhase, PatchValidationPhaseName, PortfolioReport, PortfolioTarget, PortfolioTargetResult, OutdatedPackage, UpdateOutdatedOptions, UpdateOutdatedReport, ExploitSignalOverridePolicy, VexJustification, VexSuppression, SlaPolicy, SlaBreach, SlaBreachEntry, SlaBreachSummary, ReachabilityAssessment, ReachabilityEvidence, SbomEntry, SbomStatus, SimulationMutation, SimulationMutationTarget, SimulationRebuttalCode, SimulationRebuttalFinding, SimulationSummary, CheckReachabilityOptions, EvaluatePackageOptions, PackageEvaluationReport, VulnerabilityEvaluationEntry, DeltaDependencyChange, DeltaFinding, DeltaScanOptions, DeltaScanReport, } from "../platform/types.js";
 export type { ScanInputFormat } from "../scanner/index.js";
 export type { ScanOptions, ScanReport, CiSummary } from "./contracts.js";
 export { PACKAGE_MANAGER_VALUES, LLM_PROVIDER_VALUES, PROVENANCE_SOURCE_VALUES, OPTION_DESCRIPTIONS, createConstraintSchemaProperties, createRemediateOptionSchemaProperties, createScanOptionSchemaProperties, createScanReportSchemaProperties, createUpdateOutdatedOptionSchemaProperties, } from "./options-schema.js";
 export { toCiSummary, ciExitCode, buildSlaBreachSummary, buildStrategyCounts, buildDependencyScopeCounts, } from "./reporting.js";
 export { toSarifOutput, type SarifOutput } from "./sarif.js";
 export { toCycloneDxVex, type CycloneDxVexDocument, type CycloneDxVexVulnerability, type CycloneDxVexVulnerabilityAnalysis, type ToCycloneDxVexOptions, } from "./vex/index.js";
-export { inspectPatchArtifact, listPatchArtifacts, validatePatchArtifact, } from "./patches/index.js";
+export { inspectPatchArtifact, listPatchArtifacts, validatePatchArtifact, reconcilePatchArtifacts, } from "./patches/index.js";
 export { remediatePortfolio } from "./portfolio/index.js";
 export { remediate, planRemediation } from "./remediate/index.js";
 export { remediateFromScan } from "./remediate-from-scan/index.js";
 export { updateOutdated } from "./update-outdated/index.js";
+export { checkReachability } from "./reachability/index.js";
+export { evaluatePackage } from "./evaluate/index.js";
+export { scanDelta } from "./delta-scan/index.js";
 export { submitRemediateJob, submitScanJob, submitPortfolioJob, pollJob, type JobHandle, type AsyncRemediationJob, type TypedAsyncRemediationJob, } from "./jobs/index.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/api/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,YAAY,EACV,kBAAkB,EAClB,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,sBAAsB,EACtB,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,aAAa,EACb,uBAAuB,EACvB,yBAAyB,EACzB,oBAAoB,EACpB,6BAA6B,EAC7B,SAAS,EACT,cAAc,EACd,yBAAyB,EACzB,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,wBAAwB,EACxB,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,2BAA2B,EAC3B,gBAAgB,EAChB,cAAc,EACd,SAAS,EACT,SAAS,EACT,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,SAAS,EACT,UAAU,EACV,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEzE,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,EACnB,gCAAgC,EAChC,qCAAqC,EACrC,gCAAgC,EAChC,gCAAgC,EAChC,0CAA0C,GAC3C,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,WAAW,EACX,UAAU,EACV,qBAAqB,EACrB,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EACL,cAAc,EACd,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,iCAAiC,EACtC,KAAK,qBAAqB,GAC3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,OAAO,EACP,KAAK,SAAS,EACd,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,YAAY,EACV,kBAAkB,EAClB,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,sBAAsB,EACtB,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,aAAa,EACb,uBAAuB,EACvB,yBAAyB,EACzB,oBAAoB,EACpB,6BAA6B,EAC7B,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,SAAS,EACT,cAAc,EACd,yBAAyB,EACzB,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,wBAAwB,EACxB,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,2BAA2B,EAC3B,gBAAgB,EAChB,cAAc,EACd,SAAS,EACT,SAAS,EACT,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,SAAS,EACT,UAAU,EACV,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,EACjB,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,4BAA4B,EAC5B,qBAAqB,EACrB,YAAY,EACZ,gBAAgB,EAChB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEzE,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,EACnB,gCAAgC,EAChC,qCAAqC,EACrC,gCAAgC,EAChC,gCAAgC,EAChC,0CAA0C,GAC3C,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,WAAW,EACX,UAAU,EACV,qBAAqB,EACrB,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EACL,cAAc,EACd,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,iCAAiC,EACtC,KAAK,qBAAqB,GAC3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,OAAO,EACP,KAAK,SAAS,EACd,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,iBAAiB,CAAC"}

package/dist/api/patches/index.d.ts

@@ -1,3 +1,4 @@
 export { listPatchArtifacts, inspectPatchArtifact } from "./inspection.js";
 export { validatePatchArtifact } from "./validation.js";
+export { reconcilePatchArtifacts } from "./reconcile.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/api/patches/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/patches/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/patches/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/api/patches/reconcile.d.ts

@@ -0,0 +1,7 @@
+import type { PatchReconcileOptions, PatchReconcileReport } from "../../platform/types.js";
+/**
+ * Reconciles active patch artifacts in patchesDir against upstream registries.
+ * If safe upstream releases have been published, the patches can be retired and packages upgraded.
+ */
+export declare function reconcilePatchArtifacts(options?: PatchReconcileOptions): Promise<PatchReconcileReport>;
+//# sourceMappingURL=reconcile.d.ts.map

package/dist/api/patches/reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile.d.ts","sourceRoot":"","sources":["../../../src/api/patches/reconcile.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,qBAAqB,EACrB,oBAAoB,EAErB,MAAM,yBAAyB,CAAC;AAGjC;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,oBAAoB,CAAC,CAqK/B"}

package/dist/api/patches/reconcile.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=reconcile.test.d.ts.map

package/dist/api/patches/reconcile.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile.test.d.ts","sourceRoot":"","sources":["../../../src/api/patches/reconcile.test.ts"],"names":[],"mappings":""}

package/dist/api/reachability/index.d.ts

@@ -0,0 +1,3 @@
+import type { CheckReachabilityOptions, ReachabilityAssessment } from "../../platform/types.js";
+export declare function checkReachability(options: CheckReachabilityOptions): Promise<ReachabilityAssessment>;
+//# sourceMappingURL=index.d.ts.map

package/dist/api/reachability/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/reachability/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEhG,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,sBAAsB,CAAC,CAGjC"}

package/dist/api/reachability/reachability.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=reachability.test.d.ts.map

package/dist/api/reachability/reachability.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reachability.test.d.ts","sourceRoot":"","sources":["../../../src/api/reachability/reachability.test.ts"],"names":[],"mappings":""}

package/dist/api/remediate/validators.d.ts

@@ -1,2 +1,5 @@
+export declare const CVE_ID_REGEX: RegExp;
+export declare const GHSA_ID_REGEX: RegExp;
+export declare function isVulnerabilityId(id: string): boolean;
 export declare function assertValidCveId(cveId: string): void;
 //# sourceMappingURL=validators.d.ts.map

package/dist/api/remediate/validators.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validators.d.ts","sourceRoot":"","sources":["../../../src/api/remediate/validators.ts"],"names":[],"mappings":"AAAA,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAMpD"}
+{"version":3,"file":"validators.d.ts","sourceRoot":"","sources":["../../../src/api/remediate/validators.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,YAAY,QAAyB,CAAC;AACnD,eAAO,MAAM,aAAa,QAAgD,CAAC;AAE3E,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAErD;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAMpD"}

package/dist/api/reporting.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reporting.d.ts","sourceRoot":"","sources":["../../src/api/reporting.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,qBAAqB,EACrB,iBAAiB,EAEjB,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EACX,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,EAKhB,iBAAiB,EAEjB,gBAAgB,EAChB,sBAAsB,EACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AA4C5D,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,GAAG,SAAS,GAAG,gBAAgB,CAAC,GACvE,IAAI,CAQN;AAyJD,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,iBAAiB,EACzB,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,gBAAgB,CAAC,GACpF,gBAAgB,GAAG,SAAS,CAuB9B;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,iBAAiB,EAAE,GAC3B,iBAAiB,GAAG,SAAS,CA+C/B;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,iBAAiB,EACzB,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,gBAAgB,CAAC,GACpF,iBAAiB,CAkBnB;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,mBAAmB,GAAG,SAAS,CAUjG;AAMD,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,iBAAiB,EAAE,GAC3B,qBAAqB,GAAG,SAAS,CAsBnC;AAED,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,iBAAiB,EAAE,GAC3B,sBAAsB,GAAG,SAAS,CAWpC;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,iBAAiB,EAAE,GAC3B,iBAAiB,GAAG,SAAS,CAW/B;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,gBAAgB,GAAG,SAAS,CAS1F;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,gBAAgB,GAAG,SAAS,CAuBhG;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAuCzD;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,SAAS,GAAG,MAAM,CAErD"}
+{"version":3,"file":"reporting.d.ts","sourceRoot":"","sources":["../../src/api/reporting.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,qBAAqB,EACrB,iBAAiB,EAEjB,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EACX,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,EAKhB,iBAAiB,EAEjB,gBAAgB,EAChB,sBAAsB,EACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AA4C5D,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,GAAG,SAAS,GAAG,gBAAgB,CAAC,GACvE,IAAI,CAQN;AAyJD,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,iBAAiB,EACzB,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,gBAAgB,CAAC,GACpF,gBAAgB,GAAG,SAAS,CAiC9B;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,iBAAiB,EAAE,GAC3B,iBAAiB,GAAG,SAAS,CA+C/B;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,iBAAiB,EACzB,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,gBAAgB,CAAC,GACpF,iBAAiB,CAkBnB;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,mBAAmB,GAAG,SAAS,CAUjG;AAMD,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,iBAAiB,EAAE,GAC3B,qBAAqB,GAAG,SAAS,CAsBnC;AAED,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,iBAAiB,EAAE,GAC3B,sBAAsB,GAAG,SAAS,CAWpC;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,iBAAiB,EAAE,GAC3B,iBAAiB,GAAG,SAAS,CAW/B;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,gBAAgB,GAAG,SAAS,CAS1F;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,gBAAgB,GAAG,SAAS,CAuBhG;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAuCzD;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,SAAS,GAAG,MAAM,CAErD"}

package/dist/api/vex/index.d.ts

@@ -2,7 +2,7 @@ import type { RemediationReport } from "../../platform/types.js";
 import type { ScanReport } from "../contracts.js";
 export interface CycloneDxVexVulnerabilityAnalysis {
     state: "resolved" | "not_affected" | "in_triage";
-    justification?: "code_not_in_execute_path" | "code_not_reachable" | string;
+    justification?: "code_not_in_execute_path" | "code_not_reachable" | (string & {});
     detail?: string;
     response?: ("update" | "workaround_available")[];
 }

package/dist/api/vex/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/vex/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,MAAM,WAAW,iCAAiC;IAChD,KAAK,EAAE,UAAU,GAAG,cAAc,GAAG,WAAW,CAAC;IACjD,aAAa,CAAC,EAAE,0BAA0B,GAAG,oBAAoB,GAAG,MAAM,CAAC;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,CAAC,QAAQ,GAAG,sBAAsB,CAAC,EAAE,CAAC;CAClD;AAED,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,iCAAiC,CAAC;CAC7C;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,WAAW,CAAC;IACvB,WAAW,EAAE,KAAK,CAAC;IACnB,OAAO,EAAE,CAAC,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE;QACR,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACjD,CAAC;IACF,eAAe,EAAE,yBAAyB,EAAE,CAAC;CAC9C;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AA4DD,wBAAgB,cAAc,CAC5B,MAAM,EAAE,UAAU,GAAG,iBAAiB,EACtC,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CA2BtB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/vex/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,MAAM,WAAW,iCAAiC;IAChD,KAAK,EAAE,UAAU,GAAG,cAAc,GAAG,WAAW,CAAC;IACjD,aAAa,CAAC,EAAE,0BAA0B,GAAG,oBAAoB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,CAAC,QAAQ,GAAG,sBAAsB,CAAC,EAAE,CAAC;CAClD;AAED,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,iCAAiC,CAAC;CAC7C;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,WAAW,CAAC;IACvB,WAAW,EAAE,KAAK,CAAC;IACnB,OAAO,EAAE,CAAC,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE;QACR,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACjD,CAAC;IACF,eAAe,EAAE,yBAAyB,EAAE,CAAC;CAC9C;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AA4DD,wBAAgB,cAAc,CAC5B,MAAM,EAAE,UAAU,GAAG,iBAAiB,EACtC,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CA2BtB"}