autoremediator 0.16.0 → 0.18.0

package/dist/{chunk-CQXNIRHT.js → chunk-FXOUJDQ3.js}

@@ -463,12 +463,12 @@ import { readdir, readFile as readFile2, stat } from "fs/promises";
 import { join as join5 } from "path";
 
 // src/remediation/strategies/patch-utils.ts
-import { existsSync as existsSync3, mkdirSync, writeFileSync, readFileSync as readFileSync2 } from "fs";
+import { existsSync as existsSync3, mkdirSync, writeFileSync, readFileSync as readFileSync3 } from "fs";
 import { join as join4 } from "path";
 import { execa as execa2 } from "execa";
 
 // src/platform/package-manager/index.ts
-import { existsSync as existsSync2 } from "fs";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
 import { join as join3 } from "path";
 import { execa } from "execa";
 
@@ -661,6 +661,32 @@ function resolveTestCommand(pm, constraints) {
   const base = pm === "pnpm" ? ["pnpm", "test"] : pm === "yarn" ? ["yarn", "test"] : pm === "bun" ? ["bun", "test"] : pm === "deno" ? ["deno", "test"] : ["npm", "test"];
   return withWorkspace(base, pm, constraints?.workspace);
 }
+function resolveTypecheckCommand(pm, constraints, cwd = process.cwd()) {
+  const pkgJsonPath = join3(cwd, "package.json");
+  let hasTypecheckScript = false;
+  const hasTsConfig = existsSync2(join3(cwd, "tsconfig.json"));
+  if (existsSync2(pkgJsonPath)) {
+    try {
+      const pkg = JSON.parse(readFileSync2(pkgJsonPath, "utf8"));
+      if (pkg.scripts?.typecheck) {
+        hasTypecheckScript = true;
+      }
+    } catch {
+    }
+  }
+  if (hasTypecheckScript) {
+    const base = [pm, "run", "typecheck"];
+    return withWorkspace(base, pm, constraints?.workspace);
+  }
+  if (hasTsConfig) {
+    if (pm === "deno") {
+      return withWorkspace(["deno", "check"], pm, constraints?.workspace);
+    }
+    const base = ["npx", "tsc", "--noEmit"];
+    return withWorkspace(base, pm, constraints?.workspace);
+  }
+  return [];
+}
 function resolveAuditCommand(pm, constraints) {
   if (pm === "deno") {
     throw new Error(
@@ -905,12 +931,12 @@ function defineTool(config) {
 
 // src/remediation/tools/check-inventory.ts
 import { z } from "zod";
-import { readFileSync as readFileSync4 } from "fs";
-import { join as join7 } from "path";
+import { readFileSync as readFileSync6 } from "fs";
+import { join as join8 } from "path";
 import { execa as execa3 } from "execa";
 
 // src/platform/policy.ts
-import { existsSync as existsSync6, readFileSync as readFileSync3 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync4 } from "fs";
 import { join as join6 } from "path";
 import { parse as yamlParse } from "yaml";
 var DEFAULT_POLICY = {
@@ -945,7 +971,7 @@ function loadPolicy(cwd, explicitPath) {
   const candidate = explicitPath ?? join6(cwd, ".github", "autoremediator.yml");
   if (!existsSync6(candidate)) return DEFAULT_POLICY;
   try {
-    const parsed = yamlParse(readFileSync3(candidate, "utf8"));
+    const parsed = yamlParse(readFileSync4(candidate, "utf8"));
     return {
       allowMajorBumps: parsed.allowMajorBumps ?? DEFAULT_POLICY.allowMajorBumps,
       denyPackages: parsed.denyPackages ?? DEFAULT_POLICY.denyPackages,
@@ -1006,7 +1032,7 @@ function isActiveSuppression(suppression) {
 }
 function loadSuppressionsFile(filePath) {
   try {
-    const content = readFileSync3(filePath, "utf8");
+    const content = readFileSync4(filePath, "utf8");
     const parsed = yamlParse(content);
     return Array.isArray(parsed?.suppressions) ? parsed.suppressions : [];
   } catch {
@@ -1032,6 +1058,140 @@ function checkSlaBreach(cveId, severity, publishedAt, slaPolicy) {
   };
 }
 
+// src/platform/workspace.ts
+import { existsSync as existsSync7, readdirSync, readFileSync as readFileSync5, statSync } from "fs";
+import { join as join7, resolve as resolve2, relative } from "path";
+import yaml from "yaml";
+function findWorkspaceRoot(startDir) {
+  let curr = resolve2(startDir);
+  while (true) {
+    if (existsSync7(join7(curr, "pnpm-workspace.yaml"))) return curr;
+    const pkgPath = join7(curr, "package.json");
+    if (existsSync7(pkgPath)) {
+      try {
+        const parsed = JSON.parse(readFileSync5(pkgPath, "utf8"));
+        if (parsed.workspaces) return curr;
+      } catch {
+      }
+    }
+    const parent = resolve2(curr, "..");
+    if (parent === curr) break;
+    curr = parent;
+  }
+  return null;
+}
+function findWorkspacePackages(cwd) {
+  const rootCwd = findWorkspaceRoot(cwd) ?? resolve2(cwd);
+  const packages = [];
+  const packageGlobs = [];
+  const pnpmWorkspaceFile = join7(rootCwd, "pnpm-workspace.yaml");
+  if (existsSync7(pnpmWorkspaceFile)) {
+    try {
+      const content = readFileSync5(pnpmWorkspaceFile, "utf8");
+      const parsed = yaml.parse(content);
+      if (Array.isArray(parsed?.packages)) {
+        packageGlobs.push(...parsed.packages);
+      }
+    } catch {
+    }
+  }
+  const rootPkgFile = join7(rootCwd, "package.json");
+  if (existsSync7(rootPkgFile)) {
+    try {
+      const rootPkg = JSON.parse(readFileSync5(rootPkgFile, "utf8"));
+      if (Array.isArray(rootPkg.workspaces)) {
+        packageGlobs.push(...rootPkg.workspaces);
+      } else if (Array.isArray(rootPkg.workspaces?.packages)) {
+        packageGlobs.push(...rootPkg.workspaces.packages);
+      }
+    } catch {
+    }
+  }
+  const denoJsonFile = join7(rootCwd, "deno.json");
+  if (existsSync7(denoJsonFile)) {
+    try {
+      const denoJson = JSON.parse(readFileSync5(denoJsonFile, "utf8"));
+      if (Array.isArray(denoJson.workspace)) {
+        packageGlobs.push(...denoJson.workspace);
+      }
+    } catch {
+    }
+  }
+  if (packageGlobs.length === 0) {
+    return packages;
+  }
+  const seenDirs = /* @__PURE__ */ new Set();
+  for (const glob of packageGlobs) {
+    const cleanGlob = glob.trim().replace(/\/+$/, "");
+    if (!cleanGlob || cleanGlob.startsWith("!")) continue;
+    if (cleanGlob.endsWith("/*")) {
+      const parentDir = join7(rootCwd, cleanGlob.slice(0, -2));
+      if (!existsSync7(parentDir)) continue;
+      try {
+        const entries = readdirSync(parentDir);
+        for (const entry of entries) {
+          if (entry.startsWith(".") || entry === "node_modules") continue;
+          const subDir = join7(parentDir, entry);
+          try {
+            if (statSync(subDir).isDirectory()) {
+              addWorkspacePackage(rootCwd, subDir, packages, seenDirs);
+            }
+          } catch {
+          }
+        }
+      } catch {
+      }
+    } else {
+      const directDir = join7(rootCwd, cleanGlob);
+      if (existsSync7(directDir)) {
+        try {
+          if (statSync(directDir).isDirectory()) {
+            addWorkspacePackage(rootCwd, directDir, packages, seenDirs);
+          }
+        } catch {
+        }
+      }
+    }
+  }
+  return packages;
+}
+function addWorkspacePackage(rootCwd, dir, out, seen) {
+  const norm = resolve2(dir);
+  if (seen.has(norm)) return;
+  seen.add(norm);
+  const manifestPath = join7(dir, "package.json");
+  if (!existsSync7(manifestPath)) return;
+  try {
+    const content = readFileSync5(manifestPath, "utf8");
+    const manifest = JSON.parse(content);
+    out.push({
+      name: manifest.name ?? relative(rootCwd, dir),
+      relativeDir: relative(rootCwd, dir),
+      absoluteDir: norm,
+      manifestPath,
+      manifest
+    });
+  } catch {
+  }
+}
+function findDeclaringWorkspacePackage(cwd, dependencyName, filterWorkspace) {
+  const workspaces = findWorkspacePackages(cwd);
+  if (workspaces.length === 0) return null;
+  const matchesFilter = (wp) => {
+    if (!filterWorkspace) return true;
+    const filter = filterWorkspace.trim();
+    return wp.name === filter || wp.relativeDir === filter || wp.relativeDir.replace(/\\/g, "/") === filter.replace(/\\/g, "/");
+  };
+  for (const wp of workspaces) {
+    if (!matchesFilter(wp)) continue;
+    const isDeclared = Boolean(wp.manifest.dependencies?.[dependencyName]) || Boolean(wp.manifest.devDependencies?.[dependencyName]) || Boolean(wp.manifest.peerDependencies?.[dependencyName]);
+    if (isDeclared) {
+      return wp;
+    }
+  }
+  return null;
+}
+
 // src/remediation/tools/check-inventory.ts
 var checkInventoryTool = defineTool({
   description: "Read the project's package.json and installed dependencies to list packages and exact versions. Must be called before checking version matches.",
@@ -1049,7 +1209,7 @@ var checkInventoryTool = defineTool({
   }) => {
     let pkgJson;
     try {
-      pkgJson = JSON.parse(readFileSync4(join7(cwd, "package.json"), "utf8"));
+      pkgJson = JSON.parse(readFileSync6(join8(cwd, "package.json"), "utf8"));
     } catch {
       return {
         packages: [],
@@ -1081,7 +1241,8 @@ var checkInventoryTool = defineTool({
     }
     const packages = [];
     for (const [name, version] of installedVersions.entries()) {
-      const isDirect = Boolean(pkgJson.dependencies?.[name]) || Boolean(pkgJson.devDependencies?.[name]) || Boolean(pkgJson.peerDependencies?.[name]);
+      const declaringWorkspace = findDeclaringWorkspacePackage(cwd, name, workspace);
+      const isDirect = Boolean(pkgJson.dependencies?.[name]) || Boolean(pkgJson.devDependencies?.[name]) || Boolean(pkgJson.peerDependencies?.[name]) || Boolean(declaringWorkspace);
       packages.push({
         name,
         version,
@@ -1204,173 +1365,8 @@ async function validatePatchArtifact(patchFilePath, options = {}) {
   };
 }
 
-// src/platform/config.ts
-function resolveProvider(options = {}) {
-  const raw = options.llmProvider ?? process.env.AUTOREMEDIATOR_LLM_PROVIDER ?? "remote";
-  if (raw !== "remote" && raw !== "local") {
-    throw new Error(
-      `Unsupported LLM provider "${raw}". Set AUTOREMEDIATOR_LLM_PROVIDER to "remote" or "local".`
-    );
-  }
-  return raw;
-}
-function resolveModelName(provider, options = {}, routing = {}) {
-  if (options.model) return options.model;
-  if (process.env.AUTOREMEDIATOR_MODEL) return process.env.AUTOREMEDIATOR_MODEL;
-  const cwd = options.cwd ?? process.cwd();
-  const policy = loadPolicy(cwd, options.policy);
-  const providerEnvModel = provider === "remote" ? process.env.AUTOREMEDIATOR_MODEL_REMOTE : process.env.AUTOREMEDIATOR_MODEL_LOCAL;
-  if (providerEnvModel) return providerEnvModel;
-  const policyPinnedModel = provider === "remote" ? policy.modelDefaults?.remote : policy.modelDefaults?.local;
-  if (policyPinnedModel) return policyPinnedModel;
-  const defaults = {
-    remote: "remote-default",
-    local: "local"
-  };
-  const routingEnabled = options.dynamicModelRouting ?? policy.dynamicModelRouting ?? false;
-  const threshold = options.dynamicRoutingThresholdChars ?? policy.dynamicRoutingThresholdChars ?? 18e3;
-  if (provider === "remote" && routingEnabled && typeof routing.inputChars === "number" && routing.inputChars >= threshold) {
-    return process.env.AUTOREMEDIATOR_MODEL_REMOTE_LARGE ?? "remote-large";
-  }
-  return defaults[provider];
-}
-async function loadRemoteFactory() {
-  const moduleName = process.env.AUTOREMEDIATOR_REMOTE_CLIENT_MODULE;
-  const exportName = process.env.AUTOREMEDIATOR_REMOTE_CLIENT_FACTORY ?? "createRemoteClient";
-  if (!moduleName) {
-    throw new Error(
-      "AUTOREMEDIATOR_REMOTE_CLIENT_MODULE is required for remote provider model loading."
-    );
-  }
-  if (moduleName.startsWith("./") || moduleName.startsWith("../") || moduleName.startsWith("/") || moduleName.startsWith("file:")) {
-    throw new Error(
-      `AUTOREMEDIATOR_REMOTE_CLIENT_MODULE must be a package name, not a file path: ${moduleName}`
-    );
-  }
-  const loaded = await import(moduleName);
-  const factory = loaded[exportName];
-  if (typeof factory !== "function") {
-    throw new Error(
-      `Remote client factory "${exportName}" was not found in module "${moduleName}".`
-    );
-  }
-  return factory;
-}
-async function createModel(options = {}, routing = {}) {
-  const provider = resolveProvider(options);
-  if (provider === "local") {
-    throw new Error(
-      "Local provider does not create a language model. Use the deterministic pipeline path instead."
-    );
-  }
-  const apiKey = process.env.AUTOREMEDIATOR_REMOTE_API_KEY;
-  if (!apiKey) {
-    throw new Error(
-      "AUTOREMEDIATOR_REMOTE_API_KEY environment variable is required for remote provider."
-    );
-  }
-  const modelName = resolveModelName(provider, options, routing);
-  const createRemoteClient = await loadRemoteFactory();
-  const remoteClient = createRemoteClient({ apiKey });
-  return remoteClient(modelName);
-}
-function getPatchConfidenceThreshold(provider, safetyProfile = "relaxed", riskLevel = "medium", overrides) {
-  const relaxed = {
-    remote: { low: 0.65, medium: 0.7, high: 0.8 },
-    local: { low: 0.65, medium: 0.7, high: 0.8 }
-  };
-  const strict = {
-    remote: { low: 0.8, medium: 0.85, high: 0.9 },
-    local: { low: 0.8, medium: 0.85, high: 0.9 }
-  };
-  const baseThreshold = safetyProfile === "strict" ? strict[provider][riskLevel] : relaxed[provider][riskLevel];
-  const override = overrides?.[riskLevel];
-  if (typeof override === "number" && Number.isFinite(override)) {
-    return Math.max(0, Math.min(1, override));
-  }
-  return baseThreshold;
-}
-function estimateModelCostUsd(params) {
-  const inputTokens = params.promptChars / 4;
-  const outputTokens = params.completionChars / 4;
-  const pricePerThousand = params.provider === "remote" ? { input: 6e-3, output: 0.02 } : { input: 0, output: 0 };
-  return inputTokens / 1e3 * pricePerThousand.input + outputTokens / 1e3 * pricePerThousand.output;
-}
-function getNvdConfig() {
-  return {
-    apiKey: process.env.AUTOREMEDIATOR_NVD_API_KEY
-  };
-}
-function getGitHubToken() {
-  return process.env.GITHUB_TOKEN;
-}
-function getIntelligenceSourceConfig() {
-  return {
-    gitLabAdvisoryApi: process.env.AUTOREMEDIATOR_GITLAB_ADVISORY_API ?? "https://advisories.gitlab.com/api/v1/advisories",
-    certCcSearchUrl: process.env.AUTOREMEDIATOR_CERTCC_SEARCH_URL ?? "https://www.kb.cert.org/vuls/search",
-    epssApi: process.env.AUTOREMEDIATOR_EPSS_API ?? "https://api.first.org/data/v1/epss",
-    cveServicesApi: process.env.AUTOREMEDIATOR_CVE_SERVICES_API ?? "https://cveawg.mitre.org/api/cve",
-    depsDevApi: process.env.AUTOREMEDIATOR_DEPSDEV_API ?? "https://api.deps.dev/v3",
-    scorecardApi: process.env.AUTOREMEDIATOR_SCORECARD_API ?? "https://api.securityscorecards.dev",
-    vendorAdvisoryFeeds: (process.env.AUTOREMEDIATOR_VENDOR_ADVISORY_FEEDS ?? "").split(",").map((v) => v.trim()).filter(Boolean),
-    commercialFeeds: (process.env.AUTOREMEDIATOR_COMMERCIAL_FEEDS ?? "").split(",").map((v) => v.trim()).filter(Boolean),
-    commercialFeedToken: process.env.AUTOREMEDIATOR_COMMERCIAL_FEED_TOKEN
-  };
-}
-
-// src/platform/idempotency.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "fs";
-import { join as join8 } from "path";
-var DEFAULT_INDEX = {
-  schemaVersion: "1.0",
-  entries: {}
-};
-function indexFilePath(cwd) {
-  return join8(cwd, ".autoremediator", "state", "idempotency.json");
-}
-function entryKey(idempotencyKey, cveId) {
-  return `${idempotencyKey}::${cveId.toUpperCase()}`;
-}
-function loadIndex(cwd) {
-  const filePath = indexFilePath(cwd);
-  if (!existsSync7(filePath)) return DEFAULT_INDEX;
-  try {
-    const parsed = JSON.parse(readFileSync5(filePath, "utf8"));
-    if (parsed && parsed.schemaVersion === "1.0" && parsed.entries) {
-      return parsed;
-    }
-    return DEFAULT_INDEX;
-  } catch {
-    return DEFAULT_INDEX;
-  }
-}
-function saveIndex(cwd, index) {
-  const filePath = indexFilePath(cwd);
-  mkdirSync2(join8(cwd, ".autoremediator", "state"), { recursive: true });
-  writeFileSync2(filePath, JSON.stringify(index, null, 2) + "\n", "utf8");
-}
-function readIdempotentReport(cwd, idempotencyKey, cveId) {
-  const index = loadIndex(cwd);
-  const key = entryKey(idempotencyKey, cveId);
-  return index.entries[key]?.report;
-}
-function storeIdempotentReport(cwd, idempotencyKey, cveId, report) {
-  const index = loadIndex(cwd);
-  const key = entryKey(idempotencyKey, cveId);
-  index.entries[key] = {
-    key: idempotencyKey,
-    cveId: cveId.toUpperCase(),
-    report,
-    savedAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  saveIndex(cwd, index);
-}
-
-// src/remediation/pipeline.ts
-import { generateText as generateText2 } from "ai";
-
-// src/remediation/local/run.ts
-import semver5 from "semver";
+// src/remediation/evaluate-package.ts
+import semver2 from "semver";
 
 // src/platform/http-client.ts
 var DEFAULT_TIMEOUT_MS = 1e4;
@@ -1458,6 +1454,37 @@ async function fetchOsvVuln(cveId) {
     throw err;
   }
 }
+async function queryOsvPackage(packageName, version) {
+  const url = `${OSV_BASE}/query`;
+  const body = {
+    package: {
+      name: packageName,
+      ecosystem: "npm"
+    }
+  };
+  if (version) {
+    body.version = version;
+  }
+  try {
+    const res = await httpClient({
+      url,
+      method: "POST",
+      body,
+      headers: { "Content-Type": "application/json" }
+    });
+    if (res.status === 404) return [];
+    if (!res.ok) {
+      throw new Error(`OSV API error ${res.status} for query "${packageName}": ${res.text}`);
+    }
+    const data = res.data;
+    return data.vulns ?? [];
+  } catch (err) {
+    if (err instanceof Error) {
+      throw new Error(`OSV API error for query "${packageName}": ${err.message}`);
+    }
+    throw err;
+  }
+}
 function osvEventsToSemverRange(events) {
   const parts = [];
   for (const event of events) {
@@ -1521,27 +1548,762 @@ async function lookupCveOsv(cveId) {
   return parseOsvVuln(vuln);
 }
 
-// src/intelligence/sources/github-advisory.ts
-import { Octokit } from "@octokit/rest";
-function createOctokitClient() {
-  const token = getGitHubToken();
-  return new Octokit(token ? { auth: `token ${token}` } : {});
-}
-async function fetchGhAdvisories(cveId) {
-  const octokit = createOctokitClient();
-  try {
-    const response = await octokit.request("GET /advisories", {
-      cve_id: cveId,
-      ecosystem: "npm",
-      type: "reviewed",
-      per_page: 10,
-      headers: {
-        "X-GitHub-Api-Version": "2022-11-28"
-      }
-    });
-    return response.data;
-  } catch (err) {
-    const errorMsg = err instanceof Error ? err.message : String(err);
+// src/platform/config.ts
+function resolveProvider(options = {}) {
+  const raw = options.llmProvider ?? process.env.AUTOREMEDIATOR_LLM_PROVIDER ?? "remote";
+  if (raw !== "remote" && raw !== "local") {
+    throw new Error(
+      `Unsupported LLM provider "${raw}". Set AUTOREMEDIATOR_LLM_PROVIDER to "remote" or "local".`
+    );
+  }
+  return raw;
+}
+function resolveModelName(provider, options = {}, routing = {}) {
+  if (options.model) return options.model;
+  if (process.env.AUTOREMEDIATOR_MODEL) return process.env.AUTOREMEDIATOR_MODEL;
+  const cwd = options.cwd ?? process.cwd();
+  const policy = loadPolicy(cwd, options.policy);
+  const providerEnvModel = provider === "remote" ? process.env.AUTOREMEDIATOR_MODEL_REMOTE : process.env.AUTOREMEDIATOR_MODEL_LOCAL;
+  if (providerEnvModel) return providerEnvModel;
+  const policyPinnedModel = provider === "remote" ? policy.modelDefaults?.remote : policy.modelDefaults?.local;
+  if (policyPinnedModel) return policyPinnedModel;
+  const defaults = {
+    remote: "remote-default",
+    local: "local"
+  };
+  const routingEnabled = options.dynamicModelRouting ?? policy.dynamicModelRouting ?? false;
+  const threshold = options.dynamicRoutingThresholdChars ?? policy.dynamicRoutingThresholdChars ?? 18e3;
+  if (provider === "remote" && routingEnabled && typeof routing.inputChars === "number" && routing.inputChars >= threshold) {
+    return process.env.AUTOREMEDIATOR_MODEL_REMOTE_LARGE ?? "remote-large";
+  }
+  return defaults[provider];
+}
+async function loadRemoteFactory() {
+  const moduleName = process.env.AUTOREMEDIATOR_REMOTE_CLIENT_MODULE;
+  const exportName = process.env.AUTOREMEDIATOR_REMOTE_CLIENT_FACTORY ?? "createRemoteClient";
+  if (!moduleName) {
+    throw new Error(
+      "AUTOREMEDIATOR_REMOTE_CLIENT_MODULE is required for remote provider model loading."
+    );
+  }
+  if (moduleName.startsWith("./") || moduleName.startsWith("../") || moduleName.startsWith("/") || moduleName.startsWith("file:")) {
+    throw new Error(
+      `AUTOREMEDIATOR_REMOTE_CLIENT_MODULE must be a package name, not a file path: ${moduleName}`
+    );
+  }
+  const loaded = await import(moduleName);
+  const factory = loaded[exportName];
+  if (typeof factory !== "function") {
+    throw new Error(
+      `Remote client factory "${exportName}" was not found in module "${moduleName}".`
+    );
+  }
+  return factory;
+}
+async function createModel(options = {}, routing = {}) {
+  const provider = resolveProvider(options);
+  if (provider === "local") {
+    throw new Error(
+      "Local provider does not create a language model. Use the deterministic pipeline path instead."
+    );
+  }
+  const apiKey = process.env.AUTOREMEDIATOR_REMOTE_API_KEY;
+  if (!apiKey) {
+    throw new Error(
+      "AUTOREMEDIATOR_REMOTE_API_KEY environment variable is required for remote provider."
+    );
+  }
+  const modelName = resolveModelName(provider, options, routing);
+  const createRemoteClient = await loadRemoteFactory();
+  const remoteClient = createRemoteClient({ apiKey });
+  return remoteClient(modelName);
+}
+function getPatchConfidenceThreshold(provider, safetyProfile = "relaxed", riskLevel = "medium", overrides) {
+  const relaxed = {
+    remote: { low: 0.65, medium: 0.7, high: 0.8 },
+    local: { low: 0.65, medium: 0.7, high: 0.8 }
+  };
+  const strict = {
+    remote: { low: 0.8, medium: 0.85, high: 0.9 },
+    local: { low: 0.8, medium: 0.85, high: 0.9 }
+  };
+  const baseThreshold = safetyProfile === "strict" ? strict[provider][riskLevel] : relaxed[provider][riskLevel];
+  const override = overrides?.[riskLevel];
+  if (typeof override === "number" && Number.isFinite(override)) {
+    return Math.max(0, Math.min(1, override));
+  }
+  return baseThreshold;
+}
+function estimateModelCostUsd(params) {
+  const inputTokens = params.promptChars / 4;
+  const outputTokens = params.completionChars / 4;
+  const pricePerThousand = params.provider === "remote" ? { input: 6e-3, output: 0.02 } : { input: 0, output: 0 };
+  return inputTokens / 1e3 * pricePerThousand.input + outputTokens / 1e3 * pricePerThousand.output;
+}
+function getNvdConfig() {
+  return {
+    apiKey: process.env.AUTOREMEDIATOR_NVD_API_KEY
+  };
+}
+function getGitHubToken() {
+  return process.env.GITHUB_TOKEN;
+}
+function getIntelligenceSourceConfig() {
+  return {
+    gitLabAdvisoryApi: process.env.AUTOREMEDIATOR_GITLAB_ADVISORY_API ?? "https://advisories.gitlab.com/api/v1/advisories",
+    certCcSearchUrl: process.env.AUTOREMEDIATOR_CERTCC_SEARCH_URL ?? "https://www.kb.cert.org/vuls/search",
+    epssApi: process.env.AUTOREMEDIATOR_EPSS_API ?? "https://api.first.org/data/v1/epss",
+    cveServicesApi: process.env.AUTOREMEDIATOR_CVE_SERVICES_API ?? "https://cveawg.mitre.org/api/cve",
+    depsDevApi: process.env.AUTOREMEDIATOR_DEPSDEV_API ?? "https://api.deps.dev/v3",
+    scorecardApi: process.env.AUTOREMEDIATOR_SCORECARD_API ?? "https://api.securityscorecards.dev",
+    vendorAdvisoryFeeds: (process.env.AUTOREMEDIATOR_VENDOR_ADVISORY_FEEDS ?? "").split(",").map((v) => v.trim()).filter(Boolean),
+    commercialFeeds: (process.env.AUTOREMEDIATOR_COMMERCIAL_FEEDS ?? "").split(",").map((v) => v.trim()).filter(Boolean),
+    commercialFeedToken: process.env.AUTOREMEDIATOR_COMMERCIAL_FEED_TOKEN
+  };
+}
+
+// src/intelligence/sources/epss.ts
+async function fetchEpss(cveId) {
+  const { epssApi } = getIntelligenceSourceConfig();
+  if (!epssApi) return void 0;
+  try {
+    const url = new URL(epssApi);
+    url.searchParams.set("cve", cveId);
+    const res = await httpClient({ url: url.toString() });
+    if (!res.ok) return void 0;
+    const body = res.data;
+    return body.data?.[0];
+  } catch {
+    return void 0;
+  }
+}
+async function enrichWithEpss(details) {
+  const row = await fetchEpss(details.id);
+  if (!row) return details;
+  const score = Number.parseFloat(row.epss);
+  const percentile = Number.parseFloat(row.percentile);
+  if (!Number.isFinite(score) || !Number.isFinite(percentile)) {
+    return details;
+  }
+  details.epss = {
+    score,
+    percentile,
+    date: row.date
+  };
+  return details;
+}
+
+// src/intelligence/sources/cisa-kev.ts
+var CISA_KEV_URL = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json";
+async function fetchCisaKevFeed() {
+  try {
+    const res = await httpClient({ url: CISA_KEV_URL });
+    if (!res.ok) return void 0;
+    return res.data;
+  } catch {
+    return void 0;
+  }
+}
+function findKevEntry(feed, cveId) {
+  if (!feed?.vulnerabilities?.length) return void 0;
+  const normalized = cveId.toUpperCase();
+  return feed.vulnerabilities.find((v) => v.cveID.toUpperCase() === normalized);
+}
+async function enrichWithCisaKev(details) {
+  const feed = await fetchCisaKevFeed();
+  const entry = findKevEntry(feed, details.id);
+  if (!entry) return details;
+  details.kev = {
+    knownExploited: true,
+    dateAdded: entry.dateAdded,
+    dueDate: entry.dueDate,
+    requiredAction: entry.requiredAction,
+    knownRansomwareCampaignUse: entry.knownRansomwareCampaignUse
+  };
+  if (!details.references.includes(CISA_KEV_URL)) {
+    details.references.push(CISA_KEV_URL);
+  }
+  return details;
+}
+
+// src/intelligence/sources/registry.ts
+import { readFileSync as readFileSync7 } from "fs";
+import { join as join9 } from "path";
+import { execa as execa4 } from "execa";
+import semver from "semver";
+var NPM_REGISTRY = "https://registry.npmjs.org";
+async function fetchPackageVersions(packageName) {
+  const url = `${NPM_REGISTRY}/${encodeURIComponent(packageName)}`;
+  try {
+    const res = await httpClient({ url });
+    if (res.status === 404) return [];
+    if (!res.ok) {
+      throw new Error(`npm registry error ${res.status} for "${packageName}": ${res.text}`);
+    }
+    const data = res.data;
+    return Object.keys(data.versions);
+  } catch (err) {
+    if (err instanceof Error && err.message.includes("registry error")) {
+      throw err;
+    }
+    return [];
+  }
+}
+async function findSafeUpgradeVersion(packageName, installedVersion, firstPatchedVersion, vulnerableRange) {
+  const resolution = await resolveSafeUpgradeVersion(
+    packageName,
+    installedVersion,
+    firstPatchedVersion,
+    vulnerableRange
+  );
+  return resolution.safeVersion;
+}
+async function resolveSafeUpgradeVersion(packageName, installedVersion, firstPatchedVersion, vulnerableRange) {
+  const versions = await fetchPackageVersions(packageName);
+  if (!versions.length) {
+    return {
+      candidates: {},
+      majorOnlyFixAvailable: false
+    };
+  }
+  const installed = semver.parse(installedVersion);
+  const candidates = versions.filter((v) => semver.valid(v) && semver.gte(v, firstPatchedVersion)).filter((v) => {
+    if (!vulnerableRange) return true;
+    try {
+      return !semver.satisfies(v, vulnerableRange, { includePrerelease: false });
+    } catch {
+      return true;
+    }
+  }).sort(semver.compare);
+  if (!candidates.length) {
+    return {
+      candidates: {},
+      majorOnlyFixAvailable: false
+    };
+  }
+  const categorizedCandidates = {};
+  for (const candidate of candidates) {
+    const level = classifyUpgradeLevel(installedVersion, candidate);
+    if (!level) continue;
+    if (!categorizedCandidates[level]) {
+      categorizedCandidates[level] = candidate;
+    }
+  }
+  const safeVersion = categorizedCandidates.patch ?? categorizedCandidates.minor ?? categorizedCandidates.major;
+  if (!safeVersion) {
+    return {
+      candidates: categorizedCandidates,
+      majorOnlyFixAvailable: false
+    };
+  }
+  const upgradeLevel = classifyUpgradeLevel(installedVersion, safeVersion);
+  const majorOnlyFixAvailable = !categorizedCandidates.patch && !categorizedCandidates.minor && Boolean(categorizedCandidates.major);
+  if (!installed || !upgradeLevel) {
+    return {
+      safeVersion,
+      upgradeLevel,
+      candidates: categorizedCandidates,
+      majorOnlyFixAvailable
+    };
+  }
+  return {
+    safeVersion,
+    upgradeLevel,
+    candidates: categorizedCandidates,
+    majorOnlyFixAvailable
+  };
+}
+function classifyUpgradeLevel(installedVersion, candidateVersion) {
+  const installed = semver.parse(installedVersion);
+  const candidate = semver.parse(candidateVersion);
+  if (!installed || !candidate) return void 0;
+  if (candidate.major > installed.major) return "major";
+  if (candidate.minor > installed.minor) return "minor";
+  if (candidate.patch > installed.patch || candidate.version === installed.version) {
+    return "patch";
+  }
+  return void 0;
+}
+async function queryOutdatedPackages(cwd, options = {}) {
+  const pm = options.packageManager ?? detectPackageManager(cwd);
+  let stdout;
+  try {
+    const args = pm === "pnpm" ? ["outdated", "--json"] : ["outdated", "--json"];
+    const yarnArgs = pm === "yarn" ? ["outdated", "--json"] : void 0;
+    const finalArgs = yarnArgs ?? args;
+    const result2 = await execa4(pm, finalArgs, {
+      cwd,
+      reject: false,
+      stdio: "pipe"
+    });
+    if (result2.exitCode !== 0 && result2.exitCode !== 1) {
+      const stderr = typeof result2.stderr === "string" ? result2.stderr : "";
+      if (!result2.stdout) {
+        throw new Error(
+          `${pm} outdated --json failed (exit ${result2.exitCode}): ${stderr.slice(0, 500)}`
+        );
+      }
+    }
+    stdout = typeof result2.stdout === "string" ? result2.stdout : "";
+  } catch (err) {
+    if (err instanceof Error && !err.message.includes("outdated --json failed")) {
+      throw new Error(`Failed to query outdated packages: ${err.message}`);
+    }
+    throw err;
+  }
+  if (!stdout.trim()) {
+    return /* @__PURE__ */ new Map();
+  }
+  const rawEntries = {};
+  if (pm === "yarn") {
+    for (const line of stdout.split("\n")) {
+      const trimmed = line.trim();
+      if (!trimmed) continue;
+      try {
+        const parsed = JSON.parse(trimmed);
+        if (parsed.type === "table" && parsed.data) {
+          const tableData = parsed.data;
+          const head = tableData.head ?? [];
+          const currentIdx = head.indexOf("Current");
+          const wantedIdx = head.indexOf("Wanted");
+          const latestIdx = head.indexOf("Latest");
+          for (const row of tableData.body ?? []) {
+            const name = row[0];
+            if (!name) continue;
+            rawEntries[name] = {
+              current: row[currentIdx] ?? "",
+              wanted: row[wantedIdx] ?? "",
+              latest: row[latestIdx] ?? "",
+              type: row[head.indexOf("Package Type")] ?? "dependencies"
+            };
+          }
+        }
+      } catch {
+      }
+    }
+  } else {
+    try {
+      const parsed = JSON.parse(stdout);
+      if (Array.isArray(parsed)) {
+        for (const entry of parsed) {
+          const name = entry.name ?? entry.packageName;
+          if (!name) continue;
+          rawEntries[name] = {
+            current: entry.current,
+            wanted: entry.wanted,
+            latest: entry.latest,
+            type: entry.dependencyType
+          };
+        }
+      } else {
+        Object.assign(rawEntries, parsed);
+      }
+    } catch {
+      throw new Error(`Could not parse ${pm} outdated --json output.`);
+    }
+  }
+  let directDeps;
+  try {
+    const pkgRaw = JSON.parse(readFileSync7(join9(cwd, "package.json"), "utf8"));
+    directDeps = /* @__PURE__ */ new Set([
+      ...Object.keys(pkgRaw.dependencies ?? {}),
+      ...Object.keys(pkgRaw.devDependencies ?? {})
+    ]);
+  } catch {
+    directDeps = /* @__PURE__ */ new Set();
+  }
+  const result = /* @__PURE__ */ new Map();
+  for (const [name, entry] of Object.entries(rawEntries)) {
+    const currentVersion = entry.current ?? "";
+    const wantedVersion = entry.wanted ?? currentVersion;
+    const latestVersion = entry.latest ?? currentVersion;
+    if (!currentVersion || !latestVersion) continue;
+    const dependencyScope = directDeps.has(name) ? "direct" : "transitive";
+    if (!options.includeTransitive && dependencyScope === "transitive") continue;
+    const isMajorBump = semver.valid(currentVersion) !== null && semver.valid(latestVersion) !== null && semver.major(latestVersion) > semver.major(currentVersion);
+    result.set(name, {
+      currentVersion,
+      wantedVersion,
+      latestVersion,
+      isMajorBump,
+      dependencyScope
+    });
+  }
+  return result;
+}
+
+// src/remediation/evaluate-package.ts
+async function evaluatePackage(packageName, options = {}) {
+  const version = options.version?.trim();
+  const enrich = options.enrichIntelligence !== false;
+  let versions = [];
+  let latestVersion;
+  try {
+    versions = await fetchPackageVersions(packageName);
+    if (versions.length > 0) {
+      const valid = versions.filter((v) => semver2.valid(v)).sort((a, b) => semver2.compare(a, b));
+      latestVersion = valid[valid.length - 1];
+    }
+  } catch {
+  }
+  let rawVulns = [];
+  try {
+    rawVulns = await queryOsvPackage(packageName, version);
+  } catch {
+    rawVulns = [];
+  }
+  let kevFeed = null;
+  if (enrich) {
+    try {
+      kevFeed = await fetchCisaKevFeed();
+    } catch {
+      kevFeed = null;
+    }
+  }
+  const entries = [];
+  for (const raw of rawVulns) {
+    const cveDetails = parseOsvVuln(raw);
+    const affected = cveDetails.affectedPackages.find(
+      (p) => p.name.toLowerCase() === packageName.toLowerCase()
+    );
+    if (version && affected?.vulnerableRange) {
+      const cleanVer = semver2.clean(version) || version;
+      if (semver2.valid(cleanVer) && !semver2.satisfies(cleanVer, affected.vulnerableRange)) {
+        continue;
+      }
+    }
+    let inCisaKev = false;
+    let epssScore;
+    let epssPercentile;
+    if (enrich && cveDetails.id.startsWith("CVE-")) {
+      if (kevFeed) {
+        inCisaKev = Boolean(findKevEntry(kevFeed, cveDetails.id));
+      }
+      try {
+        const epss = await fetchEpss(cveDetails.id);
+        if (epss) {
+          epssScore = Number.parseFloat(epss.epss);
+          epssPercentile = Number.parseFloat(epss.percentile);
+        }
+      } catch {
+      }
+    }
+    let safeUpgradeVersion;
+    if (affected?.firstPatchedVersion) {
+      try {
+        const safe = await findSafeUpgradeVersion(
+          packageName,
+          version || "0.0.0",
+          affected.firstPatchedVersion
+        );
+        safeUpgradeVersion = safe ?? affected.firstPatchedVersion;
+      } catch {
+        safeUpgradeVersion = affected.firstPatchedVersion;
+      }
+    }
+    entries.push({
+      cveId: cveDetails.id,
+      severity: cveDetails.severity,
+      summary: cveDetails.summary,
+      vulnerableRange: affected?.vulnerableRange,
+      firstPatchedVersion: affected?.firstPatchedVersion,
+      safeUpgradeVersion,
+      epssScore,
+      epssPercentile,
+      inCisaKev,
+      references: cveDetails.references
+    });
+  }
+  const isVulnerable = entries.length > 0;
+  let verdict = "safe";
+  if (isVulnerable) {
+    const hasKevOrHighEpss = entries.some((e) => e.inCisaKev || e.epssScore && e.epssScore > 0.5);
+    const hasHighOrCritical = entries.some(
+      (e) => e.severity === "CRITICAL" || e.severity === "HIGH"
+    );
+    if (hasKevOrHighEpss) {
+      verdict = "actively-exploited";
+    } else if (hasHighOrCritical) {
+      verdict = "vulnerable";
+    } else {
+      verdict = "caution";
+    }
+  }
+  let recommendedVersion;
+  if (isVulnerable) {
+    const upgradeCandidates = entries.map((e) => e.safeUpgradeVersion).filter((v) => Boolean(v && semver2.valid(v))).sort((a, b) => semver2.compare(a, b));
+    recommendedVersion = upgradeCandidates[upgradeCandidates.length - 1] || latestVersion;
+  } else {
+    recommendedVersion = version || latestVersion;
+  }
+  const summary = isVulnerable ? `Package "${packageName}${version ? `@${version}` : ""}" has ${entries.length} known vulnerability(ies) (verdict: ${verdict}). Recommended safe version: ${recommendedVersion || "none"}.` : `Package "${packageName}${version ? `@${version}` : ""}" has no known vulnerabilities. Safe to install.`;
+  return {
+    schemaVersion: "1.0",
+    packageName,
+    evaluatedVersion: version,
+    isVulnerable,
+    verdict,
+    summary,
+    vulnerabilities: entries,
+    recommendedVersion,
+    latestVersion,
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+
+// src/api/patches/reconcile.ts
+import { existsSync as existsSync8 } from "fs";
+import { readFile as readFile3, rm, writeFile } from "fs/promises";
+import { join as join10 } from "path";
+import { execa as execa5 } from "execa";
+async function reconcilePatchArtifacts(options = {}) {
+  const cwd = options.cwd ?? process.cwd();
+  const pm = options.packageManager ?? detectPackageManager(cwd);
+  const summaries = await listPatchArtifacts(options);
+  const results = [];
+  for (const summary of summaries) {
+    const inspection = await inspectPatchArtifact(summary.patchFilePath, options);
+    let packageName = inspection.packageName;
+    let vulnerableVersion = inspection.vulnerableVersion;
+    const cveId = inspection.cveId;
+    if (!packageName && summary.patchFileName) {
+      const basename = summary.patchFileName.replace(/\.patch$/, "");
+      const plusIdx = basename.lastIndexOf("+");
+      if (plusIdx > 0) {
+        let rawPkg = basename.slice(0, plusIdx);
+        vulnerableVersion = basename.slice(plusIdx + 1);
+        if (rawPkg.includes("+")) {
+          rawPkg = "@" + rawPkg.replace("+", "/");
+        }
+        packageName = rawPkg;
+      } else {
+        packageName = basename;
+      }
+    }
+    if (!packageName) {
+      results.push({
+        patchFilePath: summary.patchFilePath,
+        packageName: "unknown",
+        cveId,
+        status: "patch-retained",
+        reason: "Cannot determine package name from patch artifact."
+      });
+      continue;
+    }
+    let safeUpgradeVersion;
+    try {
+      const evaluation = await evaluatePackage(packageName, {
+        version: vulnerableVersion,
+        enrichIntelligence: false
+      });
+      if (cveId) {
+        const vuln = evaluation.vulnerabilities.find(
+          (v) => v.cveId.toLowerCase() === cveId.toLowerCase()
+        );
+        if (vuln?.safeUpgradeVersion) {
+          safeUpgradeVersion = vuln.safeUpgradeVersion;
+        }
+      } else {
+        safeUpgradeVersion = evaluation.vulnerabilities.find(
+          (v) => v.safeUpgradeVersion
+        )?.safeUpgradeVersion;
+      }
+    } catch {
+    }
+    if (!safeUpgradeVersion) {
+      results.push({
+        patchFilePath: summary.patchFilePath,
+        packageName,
+        cveId,
+        installedVersion: vulnerableVersion,
+        status: "patch-retained",
+        reason: "No safe upstream release exists yet; patch remains necessary."
+      });
+      continue;
+    }
+    if (!options.autoApply) {
+      results.push({
+        patchFilePath: summary.patchFilePath,
+        packageName,
+        cveId,
+        installedVersion: vulnerableVersion,
+        safeUpstreamVersion: safeUpgradeVersion,
+        status: "safe-version-available",
+        reason: `Safe upstream version ${safeUpgradeVersion} is available. Re-run with autoApply: true or --auto-apply to upgrade.`
+      });
+      continue;
+    }
+    try {
+      const pkgJsonPath = join10(cwd, "package.json");
+      if (existsSync8(pkgJsonPath)) {
+        const pkgJson = JSON.parse(await readFile3(pkgJsonPath, "utf8"));
+        let updated = false;
+        const depSections = [
+          "dependencies",
+          "devDependencies",
+          "peerDependencies",
+          "optionalDependencies"
+        ];
+        for (const depSection of depSections) {
+          if (pkgJson[depSection] && pkgJson[depSection][packageName]) {
+            pkgJson[depSection][packageName] = `^${safeUpgradeVersion}`;
+            updated = true;
+          }
+        }
+        if (pkgJson.pnpm?.patchedDependencies) {
+          for (const key of Object.keys(pkgJson.pnpm.patchedDependencies)) {
+            if (key.startsWith(`${packageName}@`)) {
+              delete pkgJson.pnpm.patchedDependencies[key];
+              updated = true;
+            }
+          }
+        }
+        if (updated) {
+          await writeFile(pkgJsonPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
+        }
+      }
+      await rm(summary.patchFilePath, { force: true });
+      if (inspection.manifestFilePath) {
+        await rm(inspection.manifestFilePath, { force: true });
+      }
+      const installCmd = resolveInstallCommand(pm);
+      await execa5(installCmd[0], installCmd.slice(1), { cwd, reject: false });
+      if (options.runTests) {
+        const testCmd = resolveTestCommand(pm);
+        await execa5(testCmd[0], testCmd.slice(1), { cwd, reject: false });
+      }
+      results.push({
+        patchFilePath: summary.patchFilePath,
+        packageName,
+        cveId,
+        installedVersion: vulnerableVersion,
+        safeUpstreamVersion: safeUpgradeVersion,
+        status: "upgraded",
+        reason: `Successfully upgraded to ${safeUpgradeVersion} and retired patch artifact.`
+      });
+    } catch (err) {
+      results.push({
+        patchFilePath: summary.patchFilePath,
+        packageName,
+        cveId,
+        installedVersion: vulnerableVersion,
+        safeUpstreamVersion: safeUpgradeVersion,
+        status: "error",
+        reason: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  const reconciledCount = results.filter((r) => r.status === "upgraded").length;
+  const retainedCount = results.filter(
+    (r) => r.status === "patch-retained" || r.status === "safe-version-available"
+  ).length;
+  return {
+    reconciled: results,
+    reconciledCount,
+    retainedCount
+  };
+}
+
+// src/platform/idempotency.ts
+import { existsSync as existsSync9, mkdirSync as mkdirSync2, readFileSync as readFileSync8, writeFileSync as writeFileSync2 } from "fs";
+import { join as join11 } from "path";
+var DEFAULT_INDEX = {
+  schemaVersion: "1.0",
+  entries: {}
+};
+function indexFilePath(cwd) {
+  return join11(cwd, ".autoremediator", "state", "idempotency.json");
+}
+function entryKey(idempotencyKey, cveId) {
+  return `${idempotencyKey}::${cveId.toUpperCase()}`;
+}
+function loadIndex(cwd) {
+  const filePath = indexFilePath(cwd);
+  if (!existsSync9(filePath)) return DEFAULT_INDEX;
+  try {
+    const parsed = JSON.parse(readFileSync8(filePath, "utf8"));
+    if (parsed && parsed.schemaVersion === "1.0" && parsed.entries) {
+      return parsed;
+    }
+    return DEFAULT_INDEX;
+  } catch {
+    return DEFAULT_INDEX;
+  }
+}
+function saveIndex(cwd, index) {
+  const filePath = indexFilePath(cwd);
+  mkdirSync2(join11(cwd, ".autoremediator", "state"), { recursive: true });
+  writeFileSync2(filePath, JSON.stringify(index, null, 2) + "\n", "utf8");
+}
+function readIdempotentReport(cwd, idempotencyKey, cveId) {
+  const index = loadIndex(cwd);
+  const key = entryKey(idempotencyKey, cveId);
+  return index.entries[key]?.report;
+}
+function storeIdempotentReport(cwd, idempotencyKey, cveId, report) {
+  const index = loadIndex(cwd);
+  const key = entryKey(idempotencyKey, cveId);
+  index.entries[key] = {
+    key: idempotencyKey,
+    cveId: cveId.toUpperCase(),
+    report,
+    savedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  saveIndex(cwd, index);
+}
+
+// src/remediation/pipeline.ts
+import { generateText as generateText2 } from "ai";
+
+// src/remediation/local/run.ts
+import semver6 from "semver";
+
+// src/intelligence/sources/github-advisory.ts
+var GITHUB_API_BASE = "https://api.github.com/advisories";
+async function fetchGhAdvisories(cveId) {
+  const token = getGitHubToken();
+  const headers = {
+    "X-GitHub-Api-Version": "2022-11-28",
+    "User-Agent": "autoremediator"
+  };
+  if (token) {
+    headers["Authorization"] = `token ${token}`;
+  }
+  const normalized = cveId.trim();
+  if (normalized.toUpperCase().startsWith("GHSA-")) {
+    const url2 = `${GITHUB_API_BASE}/${encodeURIComponent(normalized)}`;
+    try {
+      const res = await httpClient({ url: url2, headers });
+      if (!res.ok) {
+        if (res.status === 404) return [];
+        throw new Error(`HTTP ${res.status}: ${res.text}`);
+      }
+      return res.data ? [res.data] : [];
+    } catch (err) {
+      const errorMsg = err instanceof Error ? err.message : String(err);
+      console.warn(
+        `[autoremediator] GitHub Advisory API error for ${cveId}: ${errorMsg} \u2014 skipping.`
+      );
+      return [];
+    }
+  }
+  const url = new URL(GITHUB_API_BASE);
+  url.searchParams.set("cve_id", cveId);
+  url.searchParams.set("ecosystem", "npm");
+  url.searchParams.set("type", "reviewed");
+  url.searchParams.set("per_page", "10");
+  try {
+    const res = await httpClient({
+      url: url.toString(),
+      headers
+    });
+    if (!res.ok) {
+      if (res.status === 404) return [];
+      throw new Error(`HTTP ${res.status}: ${res.text}`);
+    }
+    return Array.isArray(res.data) ? res.data : [];
+  } catch (err) {
+    const errorMsg = err instanceof Error ? err.message : String(err);
     console.warn(
       `[autoremediator] GitHub Advisory API error for ${cveId}: ${errorMsg} \u2014 skipping.`
     );
@@ -1633,9 +2395,9 @@ async function enrichWithNvd(details) {
 }
 
 // src/intelligence/sources/snapshot.ts
-import { readFileSync as readFileSync6 } from "fs";
+import { readFileSync as readFileSync9 } from "fs";
 function loadIntelligenceSnapshot(filePath) {
-  const raw = readFileSync6(filePath, "utf8");
+  const raw = readFileSync9(filePath, "utf8");
   const parsed = JSON.parse(raw);
   if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
     throw new Error(`Intelligence snapshot at ${filePath} must be a JSON object keyed by CVE ID.`);
@@ -1647,8 +2409,8 @@ function lookupSnapshotCve(snapshot, cveId) {
 }
 
 // src/remediation/tools/check-reachability.ts
-import { existsSync as existsSync8, readdirSync, readFileSync as readFileSync7, statSync } from "fs";
-import { isAbsolute as isAbsolute2, join as join9, resolve as resolve2 } from "path";
+import { existsSync as existsSync10, readdirSync as readdirSync2, readFileSync as readFileSync10, statSync as statSync2 } from "fs";
+import { isAbsolute as isAbsolute2, join as join12, resolve as resolve3 } from "path";
 import { parseSync } from "oxc-parser";
 import { z as z2 } from "zod";
 var SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".mts", ".cts"]);
@@ -1664,16 +2426,16 @@ var IGNORED_DIRS = /* @__PURE__ */ new Set([
 ]);
 function loadTsconfigPaths(cwd) {
   for (const configName of ["tsconfig.json", "jsconfig.json"]) {
-    const fullPath = join9(cwd, configName);
-    if (!existsSync8(fullPath)) continue;
+    const fullPath = join12(cwd, configName);
+    if (!existsSync10(fullPath)) continue;
     try {
-      const raw = readFileSync7(fullPath, "utf8");
+      const raw = readFileSync10(fullPath, "utf8");
       const cleaned = raw.replace(/\/\*[\s\S]*?\*\/|\/\/.*/g, "");
       const parsed = JSON.parse(cleaned);
       const compilerOptions = parsed.compilerOptions;
       if (compilerOptions?.paths) {
         return {
-          baseUrl: compilerOptions.baseUrl ? resolve2(cwd, compilerOptions.baseUrl) : cwd,
+          baseUrl: compilerOptions.baseUrl ? resolve3(cwd, compilerOptions.baseUrl) : cwd,
           paths: compilerOptions.paths
         };
       }
@@ -1688,14 +2450,14 @@ function resolveAliasedPath(importSource, config) {
   }
   for (const [pattern, replacements] of Object.entries(config.paths)) {
     if (pattern === importSource && replacements[0]) {
-      return resolve2(config.baseUrl, replacements[0]);
+      return resolve3(config.baseUrl, replacements[0]);
     }
     if (pattern.endsWith("/*")) {
       const prefix = pattern.slice(0, -2);
       if (importSource.startsWith(prefix)) {
         const suffix = importSource.slice(prefix.length);
         const replacement = replacements[0]?.slice(0, -2) ?? "";
-        return resolve2(config.baseUrl, replacement + suffix);
+        return resolve3(config.baseUrl, replacement + suffix);
       }
     }
   }
@@ -1704,16 +2466,16 @@ function resolveAliasedPath(importSource, config) {
 function* walkSourceFiles(dir) {
   let entries;
   try {
-    entries = readdirSync(dir);
+    entries = readdirSync2(dir);
   } catch {
     return;
   }
   for (const entry of entries) {
     if (IGNORED_DIRS.has(entry)) continue;
-    const full = join9(dir, entry);
+    const full = join12(dir, entry);
     let stat2;
     try {
-      stat2 = statSync(full);
+      stat2 = statSync2(full);
     } catch {
       continue;
     }
@@ -1746,12 +2508,36 @@ function walkAst(node, visitor) {
           walkAst(child, visitor);
         }
       }
-    } else if (value && typeof value === "object" && "type" in value) {
-      walkAst(value, visitor);
+    } else if (value && typeof value === "object" && "type" in value) {
+      walkAst(value, visitor);
+    }
+  }
+}
+function toRootPackageName(importSource) {
+  if (importSource.startsWith("@")) {
+    const parts = importSource.split("/");
+    return parts.slice(0, 2).join("/");
+  }
+  return importSource.split("/")[0] ?? importSource;
+}
+function findTransitiveDependencyPath(cwd, targetPackage, importedDirectPackages) {
+  for (const directPkg of importedDirectPackages) {
+    const manifestPath = join12(cwd, "node_modules", directPkg, "package.json");
+    if (!existsSync10(manifestPath)) continue;
+    try {
+      const manifest = JSON.parse(readFileSync10(manifestPath, "utf8"));
+      if (manifest.dependencies && manifest.dependencies[targetPackage]) {
+        return {
+          directDependency: directPkg,
+          version: manifest.dependencies[targetPackage]
+        };
+      }
+    } catch {
     }
   }
+  return null;
 }
-function extractPackageReferences(filename, content, packageName, tsconfig) {
+function extractPackageReferences(filename, content, packageName, tsconfig, outImportedDirectPackages) {
   const results = [];
   let parseResult;
   try {
@@ -1763,6 +2549,9 @@ function extractPackageReferences(filename, content, packageName, tsconfig) {
   walkAst(parseResult.program, (node) => {
     if (node.type === "ImportDeclaration") {
       const source = node.source;
+      if (source?.value && !source.value.startsWith(".") && !isAbsolute2(source.value)) {
+        outImportedDirectPackages?.add(toRootPackageName(source.value));
+      }
       if (source?.value && matchesPackage(source.value, packageName, tsconfig)) {
         const symbols = [];
         const importedIdentifiers = /* @__PURE__ */ new Map();
@@ -1797,6 +2586,9 @@ function extractPackageReferences(filename, content, packageName, tsconfig) {
     }
     if (node.type === "ImportExpression") {
       const source = node.source;
+      if (source?.value && !source.value.startsWith(".") && !isAbsolute2(source.value)) {
+        outImportedDirectPackages?.add(toRootPackageName(source.value));
+      }
       if (source?.value && matchesPackage(source.value, packageName, tsconfig)) {
         results.push({
           matchType: "dynamic-import",
@@ -1808,6 +2600,9 @@ function extractPackageReferences(filename, content, packageName, tsconfig) {
     }
     if (node.type === "CallExpression" && node.callee?.name === "require" && Array.isArray(node.arguments) && node.arguments.length > 0) {
       const firstArg = node.arguments[0];
+      if (firstArg?.value && typeof firstArg.value === "string" && !firstArg.value.startsWith(".") && !isAbsolute2(firstArg.value)) {
+        outImportedDirectPackages?.add(toRootPackageName(firstArg.value));
+      }
       if (firstArg?.value && typeof firstArg.value === "string" && matchesPackage(firstArg.value, packageName, tsconfig)) {
         results.push({
           matchType: "require",
@@ -1819,6 +2614,9 @@ function extractPackageReferences(filename, content, packageName, tsconfig) {
     }
     if (node.type === "ExportNamedDeclaration" || node.type === "ExportAllDeclaration") {
       const source = node.source;
+      if (source?.value && !source.value.startsWith(".") && !isAbsolute2(source.value)) {
+        outImportedDirectPackages?.add(toRootPackageName(source.value));
+      }
       if (source?.value && matchesPackage(source.value, packageName, tsconfig)) {
         const symbols = [];
         if (node.type === "ExportAllDeclaration") {
@@ -1895,15 +2693,16 @@ function assessPackageReachability(cwd, packageName, targetSymbol) {
   let hasReExport = false;
   let totalInvocations = 0;
   let hasPackageImport = false;
+  const importedDirectPackages = /* @__PURE__ */ new Set();
   for (const filePath of walkSourceFiles(cwd)) {
     scanned++;
     let content;
     try {
-      content = readFileSync7(filePath, "utf8");
+      content = readFileSync10(filePath, "utf8");
     } catch {
       continue;
     }
-    const refs = extractPackageReferences(filePath, content, packageName, tsconfig);
+    const refs = extractPackageReferences(filePath, content, packageName, tsconfig, importedDirectPackages);
     if (refs.length > 0) {
       hasPackageImport = true;
     }
@@ -1946,6 +2745,16 @@ function assessPackageReachability(cwd, packageName, targetSymbol) {
     };
   }
   if (!hasPackageImport) {
+    const transitivePath = findTransitiveDependencyPath(cwd, packageName, importedDirectPackages);
+    if (transitivePath) {
+      return {
+        packageName,
+        status: "reachable",
+        reason: `Package '${packageName}' is a transitive dependency of imported package '${transitivePath.directDependency}'`,
+        reachabilityBasis: "transitive-path-found",
+        evidence: []
+      };
+    }
     return {
       packageName,
       status: "not-reachable",
@@ -2074,261 +2883,64 @@ async function runSecOpsPreflight(normalizedId, cveDetails, opts) {
         id: cveDetails.id,
         kev: cveDetails.kev,
         epss: cveDetails.epss
-      },
-      policy: { exploitSignalOverride: opts.exploitSignalOverride }
-    });
-    if (result.exploitSignalTriggered) {
-      exploitSignalTriggered = true;
-    }
-  }
-  let slaBreaches;
-  if (opts.slaCheck && opts.slaPolicy && cveDetails.publishedAt) {
-    const breach = checkSlaBreach(
-      normalizedId,
-      cveDetails.severity,
-      cveDetails.publishedAt,
-      opts.slaPolicy
-    );
-    if (breach) {
-      slaBreaches = [breach];
-    }
-  }
-  return { suppressed: false, exploitSignalTriggered, slaBreaches };
-}
-
-// src/remediation/local/sbom.ts
-function buildSbom(packages, vulnerableNames, results) {
-  const statusByPackage = /* @__PURE__ */ new Map();
-  for (const result of results) {
-    if (!vulnerableNames.has(result.packageName)) continue;
-    if (result.suppressedBy) {
-      statusByPackage.set(result.packageName, "suppressed");
-    } else if (!result.applied && result.strategy === "none") {
-      statusByPackage.set(result.packageName, "skipped");
-    } else if (result.applied) {
-      statusByPackage.set(result.packageName, "patched");
-    } else {
-      statusByPackage.set(result.packageName, "unpatched");
-    }
-  }
-  return packages.map((pkg) => {
-    const isVulnerable = vulnerableNames.has(pkg.name);
-    const entry = {
-      name: pkg.name,
-      version: pkg.version,
-      scope: pkg.type === "direct" ? "direct" : "transitive"
-    };
-    if (isVulnerable) {
-      entry.status = statusByPackage.get(pkg.name) ?? "unpatched";
-    }
-    return entry;
-  });
-}
-
-// src/intelligence/sources/registry.ts
-import { readFileSync as readFileSync8 } from "fs";
-import { join as join10 } from "path";
-import { execa as execa4 } from "execa";
-import semver from "semver";
-var NPM_REGISTRY = "https://registry.npmjs.org";
-async function fetchPackageVersions(packageName) {
-  const url = `${NPM_REGISTRY}/${encodeURIComponent(packageName)}`;
-  try {
-    const res = await httpClient({ url });
-    if (res.status === 404) return [];
-    if (!res.ok) {
-      throw new Error(`npm registry error ${res.status} for "${packageName}": ${res.text}`);
-    }
-    const data = res.data;
-    return Object.keys(data.versions);
-  } catch (err) {
-    if (err instanceof Error && err.message.includes("registry error")) {
-      throw err;
-    }
-    return [];
-  }
-}
-async function resolveSafeUpgradeVersion(packageName, installedVersion, firstPatchedVersion, vulnerableRange) {
-  const versions = await fetchPackageVersions(packageName);
-  if (!versions.length) {
-    return {
-      candidates: {},
-      majorOnlyFixAvailable: false
-    };
-  }
-  const installed = semver.parse(installedVersion);
-  const candidates = versions.filter((v) => semver.valid(v) && semver.gte(v, firstPatchedVersion)).filter((v) => {
-    if (!vulnerableRange) return true;
-    try {
-      return !semver.satisfies(v, vulnerableRange, { includePrerelease: false });
-    } catch {
-      return true;
-    }
-  }).sort(semver.compare);
-  if (!candidates.length) {
-    return {
-      candidates: {},
-      majorOnlyFixAvailable: false
-    };
-  }
-  const categorizedCandidates = {};
-  for (const candidate of candidates) {
-    const level = classifyUpgradeLevel(installedVersion, candidate);
-    if (!level) continue;
-    if (!categorizedCandidates[level]) {
-      categorizedCandidates[level] = candidate;
-    }
-  }
-  const safeVersion = categorizedCandidates.patch ?? categorizedCandidates.minor ?? categorizedCandidates.major;
-  if (!safeVersion) {
-    return {
-      candidates: categorizedCandidates,
-      majorOnlyFixAvailable: false
-    };
-  }
-  const upgradeLevel = classifyUpgradeLevel(installedVersion, safeVersion);
-  const majorOnlyFixAvailable = !categorizedCandidates.patch && !categorizedCandidates.minor && Boolean(categorizedCandidates.major);
-  if (!installed || !upgradeLevel) {
-    return {
-      safeVersion,
-      upgradeLevel,
-      candidates: categorizedCandidates,
-      majorOnlyFixAvailable
-    };
-  }
-  return {
-    safeVersion,
-    upgradeLevel,
-    candidates: categorizedCandidates,
-    majorOnlyFixAvailable
-  };
-}
-function classifyUpgradeLevel(installedVersion, candidateVersion) {
-  const installed = semver.parse(installedVersion);
-  const candidate = semver.parse(candidateVersion);
-  if (!installed || !candidate) return void 0;
-  if (candidate.major > installed.major) return "major";
-  if (candidate.minor > installed.minor) return "minor";
-  if (candidate.patch > installed.patch || candidate.version === installed.version) {
-    return "patch";
-  }
-  return void 0;
-}
-async function queryOutdatedPackages(cwd, options = {}) {
-  const pm = options.packageManager ?? detectPackageManager(cwd);
-  let stdout;
-  try {
-    const args = pm === "pnpm" ? ["outdated", "--json"] : ["outdated", "--json"];
-    const yarnArgs = pm === "yarn" ? ["outdated", "--json"] : void 0;
-    const finalArgs = yarnArgs ?? args;
-    const result2 = await execa4(pm, finalArgs, {
-      cwd,
-      reject: false,
-      stdio: "pipe"
-    });
-    if (result2.exitCode !== 0 && result2.exitCode !== 1) {
-      const stderr = typeof result2.stderr === "string" ? result2.stderr : "";
-      if (!result2.stdout) {
-        throw new Error(
-          `${pm} outdated --json failed (exit ${result2.exitCode}): ${stderr.slice(0, 500)}`
-        );
-      }
-    }
-    stdout = typeof result2.stdout === "string" ? result2.stdout : "";
-  } catch (err) {
-    if (err instanceof Error && !err.message.includes("outdated --json failed")) {
-      throw new Error(`Failed to query outdated packages: ${err.message}`);
-    }
-    throw err;
-  }
-  if (!stdout.trim()) {
-    return /* @__PURE__ */ new Map();
-  }
-  const rawEntries = {};
-  if (pm === "yarn") {
-    for (const line of stdout.split("\n")) {
-      const trimmed = line.trim();
-      if (!trimmed) continue;
-      try {
-        const parsed = JSON.parse(trimmed);
-        if (parsed.type === "table" && parsed.data) {
-          const tableData = parsed.data;
-          const head = tableData.head ?? [];
-          const currentIdx = head.indexOf("Current");
-          const wantedIdx = head.indexOf("Wanted");
-          const latestIdx = head.indexOf("Latest");
-          for (const row of tableData.body ?? []) {
-            const name = row[0];
-            if (!name) continue;
-            rawEntries[name] = {
-              current: row[currentIdx] ?? "",
-              wanted: row[wantedIdx] ?? "",
-              latest: row[latestIdx] ?? "",
-              type: row[head.indexOf("Package Type")] ?? "dependencies"
-            };
-          }
-        }
-      } catch {
-      }
-    }
-  } else {
-    try {
-      const parsed = JSON.parse(stdout);
-      if (Array.isArray(parsed)) {
-        for (const entry of parsed) {
-          const name = entry.name ?? entry.packageName;
-          if (!name) continue;
-          rawEntries[name] = {
-            current: entry.current,
-            wanted: entry.wanted,
-            latest: entry.latest,
-            type: entry.dependencyType
-          };
-        }
-      } else {
-        Object.assign(rawEntries, parsed);
-      }
-    } catch {
-      throw new Error(`Could not parse ${pm} outdated --json output.`);
-    }
-  }
-  let directDeps;
-  try {
-    const pkgRaw = JSON.parse(readFileSync8(join10(cwd, "package.json"), "utf8"));
-    directDeps = /* @__PURE__ */ new Set([
-      ...Object.keys(pkgRaw.dependencies ?? {}),
-      ...Object.keys(pkgRaw.devDependencies ?? {})
-    ]);
-  } catch {
-    directDeps = /* @__PURE__ */ new Set();
-  }
-  const result = /* @__PURE__ */ new Map();
-  for (const [name, entry] of Object.entries(rawEntries)) {
-    const currentVersion = entry.current ?? "";
-    const wantedVersion = entry.wanted ?? currentVersion;
-    const latestVersion = entry.latest ?? currentVersion;
-    if (!currentVersion || !latestVersion) continue;
-    const dependencyScope = directDeps.has(name) ? "direct" : "transitive";
-    if (!options.includeTransitive && dependencyScope === "transitive") continue;
-    const isMajorBump = semver.valid(currentVersion) !== null && semver.valid(latestVersion) !== null && semver.major(latestVersion) > semver.major(currentVersion);
-    result.set(name, {
-      currentVersion,
-      wantedVersion,
-      latestVersion,
-      isMajorBump,
-      dependencyScope
+      },
+      policy: { exploitSignalOverride: opts.exploitSignalOverride }
     });
+    if (result.exploitSignalTriggered) {
+      exploitSignalTriggered = true;
+    }
   }
-  return result;
+  let slaBreaches;
+  if (opts.slaCheck && opts.slaPolicy && cveDetails.publishedAt) {
+    const breach = checkSlaBreach(
+      normalizedId,
+      cveDetails.severity,
+      cveDetails.publishedAt,
+      opts.slaPolicy
+    );
+    if (breach) {
+      slaBreaches = [breach];
+    }
+  }
+  return { suppressed: false, exploitSignalTriggered, slaBreaches };
+}
+
+// src/remediation/local/sbom.ts
+function buildSbom(packages, vulnerableNames, results) {
+  const statusByPackage = /* @__PURE__ */ new Map();
+  for (const result of results) {
+    if (!vulnerableNames.has(result.packageName)) continue;
+    if (result.suppressedBy) {
+      statusByPackage.set(result.packageName, "suppressed");
+    } else if (!result.applied && result.strategy === "none") {
+      statusByPackage.set(result.packageName, "skipped");
+    } else if (result.applied) {
+      statusByPackage.set(result.packageName, "patched");
+    } else {
+      statusByPackage.set(result.packageName, "unpatched");
+    }
+  }
+  return packages.map((pkg) => {
+    const isVulnerable = vulnerableNames.has(pkg.name);
+    const entry = {
+      name: pkg.name,
+      version: pkg.version,
+      scope: pkg.type === "direct" ? "direct" : "transitive"
+    };
+    if (isVulnerable) {
+      entry.status = statusByPackage.get(pkg.name) ?? "unpatched";
+    }
+    return entry;
+  });
 }
 
 // src/remediation/tools/apply-version-bump.ts
 import { z as z4 } from "zod";
-import { join as join12 } from "path";
-import { readFileSync as readFileSync9, writeFileSync as writeFileSync3 } from "fs";
+import { join as join14 } from "path";
+import { readFileSync as readFileSync11, writeFileSync as writeFileSync3 } from "fs";
 
 // src/platform/safe-exec.ts
-import { execa as execa5 } from "execa";
+import { execa as execa6 } from "execa";
 var DANGEROUS_ENV_VARS = /* @__PURE__ */ new Set([
   "NODE_OPTIONS",
   "NODE_PATH",
@@ -2377,7 +2989,7 @@ function safeExeca(file, args = [], options = {}) {
     options.env ?? process.env,
     options.allowNodeOptions
   );
-  return execa5(file, args, {
+  return execa6(file, args, {
     ...options,
     timeout,
     env: sanitizedEnv
@@ -2385,19 +2997,19 @@ function safeExeca(file, args = [], options = {}) {
 }
 
 // src/remediation/tools/apply-version-bump.ts
-import semver2 from "semver";
+import semver3 from "semver";
 
 // src/platform/repo-lock.ts
-import { mkdir, rm } from "fs/promises";
-import { join as join11 } from "path";
+import { mkdir, rm as rm2 } from "fs/promises";
+import { join as join13 } from "path";
 async function sleep(ms) {
-  await new Promise((resolve4) => setTimeout(resolve4, ms));
+  await new Promise((resolve5) => setTimeout(resolve5, ms));
 }
 async function acquireRepoLock(cwd, options = {}) {
   const timeoutMs = options.timeoutMs ?? 15e3;
   const retryDelayMs = options.retryDelayMs ?? 125;
-  const lockRoot = join11(cwd, ".autoremediator", "locks");
-  const lockPath = join11(cwd, ".autoremediator", "locks", "remediation.lock");
+  const lockRoot = join13(cwd, ".autoremediator", "locks");
+  const lockPath = join13(cwd, ".autoremediator", "locks", "remediation.lock");
   const startedAt = Date.now();
   await mkdir(lockRoot, { recursive: true });
   while (true) {
@@ -2406,7 +3018,7 @@ async function acquireRepoLock(cwd, options = {}) {
       return {
         lockPath,
         release: async () => {
-          await rm(lockPath, { recursive: true, force: true });
+          await rm2(lockPath, { recursive: true, force: true });
         }
       };
     } catch {
@@ -2438,6 +3050,7 @@ var applyVersionBumpTool = defineTool({
     dryRun: z4.boolean().default(false).describe("If true, report changes but do not write"),
     policy: z4.string().optional().describe("Optional path to .autoremediator policy file"),
     runTests: z4.boolean().default(false).describe("If true, run test validation after applying the fix"),
+    typecheck: z4.boolean().default(false).describe("If true, run typecheck validation after applying the fix"),
     installMode: z4.enum(["standard", "prefer-offline", "deterministic"]).optional(),
     installPreferOffline: z4.boolean().optional(),
     enforceFrozenLockfile: z4.boolean().optional(),
@@ -2452,13 +3065,14 @@ var applyVersionBumpTool = defineTool({
     dryRun,
     policy,
     runTests,
+    typecheck,
     installMode,
     installPreferOffline,
     enforceFrozenLockfile,
     workspace
   }) => {
     const pm = packageManager ?? detectPackageManager(cwd);
-    const pkgPath = join12(cwd, "package.json");
+    let pkgPath = join14(cwd, "package.json");
     const loadedPolicy = loadPolicy(cwd, policy);
     const commandConstraints = {
       ...loadedPolicy.constraints,
@@ -2468,9 +3082,6 @@ var applyVersionBumpTool = defineTool({
       workspace: workspace ?? loadedPolicy.constraints?.workspace
     };
     const yarnMajor = pm === "yarn" ? await getYarnMajorVersion(cwd) : void 0;
-    const installCommand = resolveInstallCommand(pm, commandConstraints, yarnMajor);
-    const testCommand = resolveTestCommand(pm, commandConstraints);
-    const dedupeCommand = resolveDedupeCommand(pm, commandConstraints);
     if (!isPackageAllowed(loadedPolicy, packageName)) {
       return {
         packageName,
@@ -2483,7 +3094,7 @@ var applyVersionBumpTool = defineTool({
         message: `Policy blocked changes for package "${packageName}".`
       };
     }
-    const isMajorBump = semver2.valid(fromVersion) && semver2.valid(toVersion) && semver2.major(toVersion) > semver2.major(fromVersion);
+    const isMajorBump = semver3.valid(fromVersion) && semver3.valid(toVersion) && semver3.major(toVersion) > semver3.major(fromVersion);
     if (isMajorBump && !loadedPolicy.allowMajorBumps) {
       return {
         packageName,
@@ -2496,9 +3107,10 @@ var applyVersionBumpTool = defineTool({
         message: `Policy blocked major bump for "${packageName}" (${fromVersion} -> ${toVersion}).`
       };
     }
+    pkgPath = join14(cwd, "package.json");
     let pkgJson;
     try {
-      pkgJson = JSON.parse(readFileSync9(pkgPath, "utf8"));
+      pkgJson = JSON.parse(readFileSync11(pkgPath, "utf8"));
     } catch {
       return {
         packageName,
@@ -2510,9 +3122,20 @@ var applyVersionBumpTool = defineTool({
         message: `Could not read package.json at "${pkgPath}".`
       };
     }
-    const depField = ["dependencies", "devDependencies", "peerDependencies"].find(
+    let depField = ["dependencies", "devDependencies", "peerDependencies"].find(
       (f) => pkgJson[f]?.[packageName] !== void 0
     );
+    if (!depField) {
+      const declaringWorkspace = findDeclaringWorkspacePackage(cwd, packageName, workspace);
+      if (declaringWorkspace) {
+        pkgPath = declaringWorkspace.manifestPath;
+        pkgJson = declaringWorkspace.manifest;
+        depField = ["dependencies", "devDependencies", "peerDependencies"].find(
+          (f) => pkgJson[f]?.[packageName] !== void 0
+        );
+        commandConstraints.workspace = workspace ?? declaringWorkspace.name;
+      }
+    }
     if (!depField) {
       return {
         packageName,
@@ -2528,9 +3151,14 @@ var applyVersionBumpTool = defineTool({
     const prefixMatch = currentRange.match(/^([~^]?)/);
     const prefix = prefixMatch?.[1] ?? "";
     const newRange = `${prefix}${toVersion}`;
+    const effectiveInstallCommand = resolveInstallCommand(pm, commandConstraints, yarnMajor);
+    const effectiveTestCommand = resolveTestCommand(pm, commandConstraints);
+    const effectiveTypecheckCommand = resolveTypecheckCommand(pm, commandConstraints, cwd);
+    const effectiveDedupeCommand = resolveDedupeCommand(pm, commandConstraints);
+    const shouldTypecheck = typecheck || Boolean(commandConstraints.typecheck);
     if (dryRun) {
-      const installCmd = installCommand.join(" ");
-      const testCmd = testCommand.join(" ");
+      const installCmd = effectiveInstallCommand.join(" ");
+      const testCmd = effectiveTestCommand.join(" ");
       return {
         packageName,
         strategy: "version-bump",
@@ -2538,14 +3166,14 @@ var applyVersionBumpTool = defineTool({
         toVersion,
         applied: false,
         dryRun: true,
-        message: `[DRY RUN] Would update ${depField}.${packageName}: "${currentRange}" -> "${newRange}", then run ${installCmd}${runTests ? ` and ${testCmd}` : ""}${dedupeCommand.length > 0 ? ` and ${dedupeCommand.join(" ")} (best-effort)` : ""}.`
+        message: `[DRY RUN] Would update ${depField}.${packageName}: "${currentRange}" -> "${newRange}", then run ${installCmd}${runTests ? ` and ${testCmd}` : ""}${effectiveDedupeCommand.length > 0 ? ` and ${effectiveDedupeCommand.join(" ")} (best-effort)` : ""}.`
       };
     }
     return withRepoLock(cwd, async () => {
       pkgJson[depField][packageName] = newRange;
       writeFileSync3(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
       try {
-        const [installCmd, ...installArgs] = installCommand;
+        const [installCmd, ...installArgs] = effectiveInstallCommand;
         await safeExeca(installCmd, installArgs, {
           cwd,
           stdio: "pipe"
@@ -2562,12 +3190,12 @@ var applyVersionBumpTool = defineTool({
           applied: false,
           dryRun: false,
           unresolvedReason: "install-failed",
-          message: `${installCommand.join(" ")} failed after updating "${packageName}" to ${toVersion}. Reverted. Error: ${message}`
+          message: `${effectiveInstallCommand.join(" ")} failed after updating "${packageName}" to ${toVersion}. Reverted. Error: ${message}`
         };
       }
       if (runTests) {
         try {
-          const [testCmd, ...testArgs] = testCommand;
+          const [testCmd, ...testArgs] = effectiveTestCommand;
           await safeExeca(testCmd, testArgs, {
             cwd,
             stdio: "pipe"
@@ -2576,7 +3204,38 @@ var applyVersionBumpTool = defineTool({
           pkgJson[depField][packageName] = currentRange;
           writeFileSync3(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
           try {
-            const [rollbackCmd, ...rollbackArgs] = installCommand;
+            const [rollbackCmd, ...rollbackArgs] = effectiveInstallCommand;
+            await safeExeca(rollbackCmd, rollbackArgs, {
+              cwd,
+              stdio: "pipe"
+            });
+          } catch {
+          }
+          const message = err instanceof Error ? err.message : String(err);
+          return {
+            packageName,
+            strategy: "version-bump",
+            fromVersion,
+            toVersion,
+            applied: false,
+            dryRun: false,
+            unresolvedReason: "validation-failed",
+            message: `${effectiveTestCommand.join(" ")} failed after upgrading "${packageName}" to ${toVersion}. Rolled back to ${currentRange}. Error: ${message}`
+          };
+        }
+      }
+      if (shouldTypecheck && effectiveTypecheckCommand.length > 0) {
+        try {
+          const [tcCmd, ...tcArgs] = effectiveTypecheckCommand;
+          await safeExeca(tcCmd, tcArgs, {
+            cwd,
+            stdio: "pipe"
+          });
+        } catch (err) {
+          pkgJson[depField][packageName] = currentRange;
+          writeFileSync3(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
+          try {
+            const [rollbackCmd, ...rollbackArgs] = effectiveInstallCommand;
             await safeExeca(rollbackCmd, rollbackArgs, {
               cwd,
               stdio: "pipe"
@@ -2592,20 +3251,22 @@ var applyVersionBumpTool = defineTool({
             applied: false,
             dryRun: false,
             unresolvedReason: "validation-failed",
-            message: `${testCommand.join(" ")} failed after upgrading "${packageName}" to ${toVersion}. Rolled back to ${currentRange}. Error: ${message}`
+            message: `TypeCheck validation failed (${effectiveTypecheckCommand.join(" ")}) after upgrading "${packageName}" to ${toVersion}. Rolled back to ${currentRange}. Error: ${message}`
           };
         }
       }
       let dedupeNote = "";
-      try {
-        const [dedupeCmd, ...dedupeArgs] = dedupeCommand;
-        await safeExeca(dedupeCmd, dedupeArgs, {
-          cwd,
-          stdio: "pipe"
-        });
-      } catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        dedupeNote = ` Dedupe warning: ${dedupeCommand.join(" ")} failed (${message}).`;
+      if (effectiveDedupeCommand.length > 0) {
+        try {
+          const [dedupeCmd, ...dedupeArgs] = effectiveDedupeCommand;
+          await safeExeca(dedupeCmd, dedupeArgs, {
+            cwd,
+            stdio: "pipe"
+          });
+        } catch (err) {
+          const message = err instanceof Error ? err.message : String(err);
+          dedupeNote = ` Dedupe warning: ${effectiveDedupeCommand.join(" ")} failed (${message}).`;
+        }
       }
       return {
         packageName,
@@ -2614,7 +3275,7 @@ var applyVersionBumpTool = defineTool({
         toVersion,
         applied: true,
         dryRun: false,
-        message: `Successfully upgraded "${packageName}" from ${fromVersion} to ${toVersion}, ran ${installCommand.join(" ")}${runTests ? `, and passed ${testCommand.join(" ")}` : ""}.${dedupeNote}`
+        message: `Successfully upgraded "${packageName}" from ${fromVersion} to ${toVersion} in ${depField}, then ran ${effectiveInstallCommand.join(" ")}${runTests ? ` and passed ${effectiveTestCommand.join(" ")}` : ""}.${dedupeNote}`
       };
     });
   }
@@ -2622,9 +3283,9 @@ var applyVersionBumpTool = defineTool({
 
 // src/remediation/tools/apply-package-override/index.ts
 import { z as z5 } from "zod";
-import { join as join13 } from "path";
-import { existsSync as existsSync9, readFileSync as readFileSync10, writeFileSync as writeFileSync4 } from "fs";
-import semver3 from "semver";
+import { join as join15 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync12, writeFileSync as writeFileSync4 } from "fs";
+import semver4 from "semver";
 
 // src/remediation/tools/apply-package-override/helpers.ts
 async function collectDependencyTrace(cwd, pm, packageName, constraints) {
@@ -2766,9 +3427,9 @@ var applyPackageOverrideTool = defineTool({
     workspace
   }) => {
     const pm = packageManager ?? detectPackageManager(cwd);
-    const pkgPath = join13(cwd, "package.json");
-    const denoJsonPath = join13(cwd, "deno.json");
-    const isDenoNative = pm === "deno" && !existsSync9(pkgPath);
+    const pkgPath = join15(cwd, "package.json");
+    const denoJsonPath = join15(cwd, "deno.json");
+    const isDenoNative = pm === "deno" && !existsSync11(pkgPath);
     const loadedPolicy = loadPolicy(cwd, policy);
     const commandConstraints = {
       ...loadedPolicy.constraints,
@@ -2794,7 +3455,7 @@ var applyPackageOverrideTool = defineTool({
         message: `Policy blocked changes for package "${packageName}".`
       };
     }
-    const isMajorBump = semver3.valid(fromVersion) && semver3.valid(toVersion) && semver3.major(toVersion) > semver3.major(fromVersion);
+    const isMajorBump = semver4.valid(fromVersion) && semver4.valid(toVersion) && semver4.major(toVersion) > semver4.major(fromVersion);
     if (isMajorBump && !loadedPolicy.allowMajorBumps) {
       return {
         packageName,
@@ -2810,7 +3471,7 @@ var applyPackageOverrideTool = defineTool({
     if (isDenoNative) {
       let denoJson;
       try {
-        denoJson = JSON.parse(readFileSync10(denoJsonPath, "utf8"));
+        denoJson = JSON.parse(readFileSync12(denoJsonPath, "utf8"));
       } catch {
         return {
           packageName,
@@ -2913,7 +3574,7 @@ var applyPackageOverrideTool = defineTool({
     }
     let pkgJson;
     try {
-      pkgJson = JSON.parse(readFileSync10(pkgPath, "utf8"));
+      pkgJson = JSON.parse(readFileSync12(pkgPath, "utf8"));
     } catch {
       return {
         packageName,
@@ -3010,6 +3671,76 @@ var applyPackageOverrideTool = defineTool({
   }
 });
 
+// src/platform/supply-chain.ts
+async function verifyPackageTrust(packageName, targetVersion, policy) {
+  if (!policy || !policy.minPublishAgeHours && !policy.blockInstallScripts && !policy.requireProvenance) {
+    return { trusted: true };
+  }
+  const url = `https://registry.npmjs.org/${encodeURIComponent(packageName)}`;
+  let packument = null;
+  try {
+    const res = await httpClient({
+      url,
+      headers: { Accept: "application/vnd.npm.install-v1+json; q=1.0, application/json; q=0.8" }
+    });
+    if (res.ok && res.data) {
+      packument = res.data;
+    }
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return {
+      trusted: false,
+      reason: `Could not verify supply-chain trust for "${packageName}@${targetVersion}": ${msg}`
+    };
+  }
+  if (!packument) {
+    return {
+      trusted: false,
+      reason: `Package packument for "${packageName}" not found on registry.`
+    };
+  }
+  let publishAgeHours;
+  if (packument.time?.[targetVersion]) {
+    const publishedAt = new Date(packument.time[targetVersion]).getTime();
+    publishAgeHours = Math.max(0, (Date.now() - publishedAt) / (1e3 * 60 * 60));
+    if (policy.minPublishAgeHours && publishAgeHours < policy.minPublishAgeHours) {
+      return {
+        trusted: false,
+        publishAgeHours,
+        reason: `Target release "${packageName}@${targetVersion}" was published only ${publishAgeHours.toFixed(1)}h ago (minimum required age is ${policy.minPublishAgeHours}h).`
+      };
+    }
+  }
+  const versionData = packument.versions?.[targetVersion];
+  const scripts = versionData?.scripts ?? {};
+  const installScriptKeys = ["preinstall", "install", "postinstall"].filter((k) => Boolean(scripts[k]));
+  const hasInstallScripts = installScriptKeys.length > 0;
+  if (policy.blockInstallScripts && hasInstallScripts) {
+    return {
+      trusted: false,
+      publishAgeHours,
+      hasInstallScripts: true,
+      reason: `Target release "${packageName}@${targetVersion}" defines risky lifecycle scripts (${installScriptKeys.join(", ")}).`
+    };
+  }
+  const hasProvenance = Boolean(versionData?.dist?.attestations?.provenance || versionData?.dist?.attestations?.url);
+  if (policy.requireProvenance && !hasProvenance) {
+    return {
+      trusted: false,
+      publishAgeHours,
+      hasInstallScripts,
+      hasProvenance: false,
+      reason: `Target release "${packageName}@${targetVersion}" does not have cryptographic build provenance attestations.`
+    };
+  }
+  return {
+    trusted: true,
+    publishAgeHours,
+    hasInstallScripts,
+    hasProvenance
+  };
+}
+
 // src/remediation/local/primary-strategy.ts
 async function resolvePrimaryResult(params) {
   const { vulnerable, cwd, packageManager, dryRun, policy, runTests, constraints } = params;
@@ -3080,6 +3811,22 @@ async function resolvePrimaryResult(params) {
         }
       };
     }
+    const trust2 = await verifyPackageTrust(pkg.name, safeUpgrade2.safeVersion, constraints.supplyChainPolicy);
+    if (!trust2.trusted) {
+      return {
+        steps: 1,
+        result: {
+          packageName: pkg.name,
+          strategy: "none",
+          fromVersion: pkg.version,
+          applied: false,
+          dryRun,
+          unresolvedReason: "policy-blocked",
+          vulnerableRange: vulnerable.affected.vulnerableRange,
+          message: `Supply chain trust gate blocked "${pkg.name}@${safeUpgrade2.safeVersion}": ${trust2.reason}`
+        }
+      };
+    }
     const overrideResult = await applyPackageOverrideTool.execute({
       cwd,
       packageManager,
@@ -3135,6 +3882,22 @@ async function resolvePrimaryResult(params) {
       }
     };
   }
+  const trust = await verifyPackageTrust(pkg.name, safeUpgrade.safeVersion, constraints.supplyChainPolicy);
+  if (!trust.trusted) {
+    return {
+      steps: 1,
+      result: {
+        packageName: pkg.name,
+        strategy: "none",
+        fromVersion: pkg.version,
+        applied: false,
+        dryRun,
+        unresolvedReason: "policy-blocked",
+        vulnerableRange: vulnerable.affected.vulnerableRange,
+        message: `Supply chain trust gate blocked "${pkg.name}@${safeUpgrade.safeVersion}": ${trust.reason}`
+      }
+    };
+  }
   const applyResult = await applyVersionBumpTool.execute({
     cwd,
     packageManager,
@@ -3144,6 +3907,7 @@ async function resolvePrimaryResult(params) {
     dryRun,
     policy,
     runTests,
+    typecheck: constraints.typecheck,
     installMode: constraints.installMode,
     installPreferOffline: constraints.installPreferOffline,
     enforceFrozenLockfile: constraints.enforceFrozenLockfile,
@@ -3157,10 +3921,10 @@ async function resolvePrimaryResult(params) {
 
 // src/remediation/tools/fetch-package-source.ts
 import { z as z6 } from "zod";
-import { mkdir as mkdir2, mkdtemp, readdir as readdir2, readFile as readFile3, rm as rm2 } from "fs/promises";
-import { join as join14 } from "path";
+import { mkdir as mkdir2, mkdtemp, readdir as readdir2, readFile as readFile4, rm as rm3 } from "fs/promises";
+import { join as join16 } from "path";
 import { tmpdir } from "os";
-import { execa as execa6 } from "execa";
+import { execa as execa7 } from "execa";
 var fetchPackageSourceTool = defineTool({
   description: "Download package tarball from npm and extract source files for CVE analysis. Supports custom file patterns (default: *.js, *.ts).",
   parameters: z6.object({
@@ -3178,25 +3942,25 @@ var fetchPackageSourceTool = defineTool({
     if (safePatterns.length === 0) {
       return { success: false, error: "No valid file patterns provided." };
     }
-    const tempBaseDir = await mkdtemp(join14(tmpdir(), "autoremediator-pkg-"));
-    const extractDir = join14(tempBaseDir, "out");
+    const tempBaseDir = await mkdtemp(join16(tmpdir(), "autoremediator-pkg-"));
+    const extractDir = join16(tempBaseDir, "out");
     try {
       const scopedName = packageName.split("/").pop();
       const npmUrl = `https://registry.npmjs.org/${packageName}/-/${scopedName}-${version}.tgz`;
       await mkdir2(tempBaseDir, { recursive: true });
-      const tarballPath = join14(tempBaseDir, "package.tgz");
-      await execa6("curl", ["-L", "-o", tarballPath, npmUrl]);
+      const tarballPath = join16(tempBaseDir, "package.tgz");
+      await execa7("curl", ["-L", "-o", tarballPath, npmUrl]);
       await mkdir2(extractDir, { recursive: true });
-      await execa6("tar", ["-xzf", tarballPath, "-C", extractDir]);
+      await execa7("tar", ["-xzf", tarballPath, "-C", extractDir]);
       const extractedContents = await readdir2(extractDir);
-      const packageRootDir = extractedContents.includes("package") ? join14(extractDir, "package") : extractDir;
+      const packageRootDir = extractedContents.includes("package") ? join16(extractDir, "package") : extractDir;
       const sourceCode = {};
       async function walkDir(dir, relativeBase) {
         try {
           const files = await readdir2(dir, { withFileTypes: true });
           for (const file of files) {
-            const fullPath = join14(dir, file.name);
-            const relPath = join14(relativeBase, file.name);
+            const fullPath = join16(dir, file.name);
+            const relPath = join16(relativeBase, file.name);
             if (file.isDirectory()) {
               if (!["node_modules", ".git", "dist", "build", "coverage", ".next", "out"].includes(
                 file.name
@@ -3210,7 +3974,7 @@ var fetchPackageSourceTool = defineTool({
               });
               if (matches) {
                 try {
-                  const content = await readFile3(fullPath, "utf8");
+                  const content = await readFile4(fullPath, "utf8");
                   sourceCode[relPath] = content;
                 } catch {
                 }
@@ -3245,7 +4009,7 @@ var fetchPackageSourceTool = defineTool({
         error: `Failed to fetch and extract package ${packageName}@${version}: ${message}`
       };
     } finally {
-      await rm2(tempBaseDir, { recursive: true, force: true });
+      await rm3(tempBaseDir, { recursive: true, force: true });
     }
   }
 });
@@ -3303,6 +4067,7 @@ Analyze the source code to:
 2. Explain the root cause of the security issue
 3. Propose a secure fix that addresses the vulnerability
 4. Provide the complete fixed version of affected files
+5. Optionally provide a standalone Node.js reproduction/regression test script
 
 ## Response Format
 Respond ONLY with valid JSON (no markdown, no extra text):
@@ -3313,7 +4078,8 @@ Respond ONLY with valid JSON (no markdown, no extra text):
     "path/to/other.ts": "Complete fixed source code for this file"
   },
   "confidence": 0.95,
-  "riskLevel": "medium"
+  "riskLevel": "medium",
+  "reproductionTest": "// Node.js script asserting the patch resolves the exploit/regression"
 }
 
 Important:
@@ -3593,6 +4359,7 @@ var generatePatchTool = defineTool({
         success: true,
         patches,
         patchContent: patches[0]?.unifiedDiff,
+        reproductionTest: analysis.reproductionTest,
         llmProvider: provider,
         llmModel: modelName,
         latencyMs,
@@ -3617,17 +4384,17 @@ var generatePatchTool = defineTool({
 
 // src/remediation/tools/apply-patch-file/index.ts
 import { z as z8 } from "zod";
-import { mkdir as mkdir3, writeFile as writeFile2 } from "fs/promises";
-import { join as join16 } from "path";
-import { execa as execa8 } from "execa";
+import { mkdir as mkdir3, writeFile as writeFile3 } from "fs/promises";
+import { join as join18 } from "path";
+import { execa as execa9 } from "execa";
 
 // src/remediation/tools/apply-patch-file/helpers.ts
-import { existsSync as existsSync10 } from "fs";
-import { mkdtemp as mkdtemp2, readFile as readFile4, rm as rm3, writeFile } from "fs/promises";
+import { existsSync as existsSync12 } from "fs";
+import { mkdtemp as mkdtemp2, readFile as readFile5, rm as rm4, writeFile as writeFile2 } from "fs/promises";
 import { createHash } from "crypto";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join15 } from "path";
-import { execa as execa7 } from "execa";
+import { join as join17 } from "path";
+import { execa as execa8 } from "execa";
 async function resolvePatchMode(packageManager, cwd) {
   if (packageManager === "npm" || packageManager === "bun" || packageManager === "deno")
     return "patch-package";
@@ -3658,13 +4425,13 @@ function computePatchIntegrity(patchContent) {
   return `sha256:${hex}`;
 }
 async function writePatchManifest(manifestFilePath, artifact) {
-  await writeFile(manifestFilePath, JSON.stringify(artifact, null, 2) + "\n", "utf8");
+  await writeFile2(manifestFilePath, JSON.stringify(artifact, null, 2) + "\n", "utf8");
 }
 async function configurePatchPackagePostinstall(cwd, packageManager) {
-  const pkgJsonPath = join15(cwd, "package.json");
+  const pkgJsonPath = join17(cwd, "package.json");
   let pkgJson;
   try {
-    pkgJson = JSON.parse(await readFile4(pkgJsonPath, "utf8"));
+    pkgJson = JSON.parse(await readFile5(pkgJsonPath, "utf8"));
   } catch {
     return {
       success: false,
@@ -3676,7 +4443,7 @@ async function configurePatchPackagePostinstall(cwd, packageManager) {
     try {
       const commands = getPackageManagerCommands(packageManager);
       const [cmd, ...args] = commands.installDev("patch-package");
-      await execa7(cmd, args, {
+      await execa8(cmd, args, {
         cwd,
         stdio: "pipe"
       });
@@ -3697,13 +4464,13 @@ async function configurePatchPackagePostinstall(cwd, packageManager) {
   } else if (!currentPostinstall) {
     pkgJson.scripts.postinstall = patchApplyCmd;
   }
-  await writeFile(pkgJsonPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
+  await writeFile2(pkgJsonPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
   return { success: true };
 }
 async function capturePackageJsonSnapshot(cwd) {
-  const path = join15(cwd, "package.json");
+  const path = join17(cwd, "package.json");
   try {
-    const content = await readFile4(path, "utf8");
+    const content = await readFile5(path, "utf8");
     return { path, content };
   } catch {
     return void 0;
@@ -3719,19 +4486,19 @@ async function cleanupPatchArtifacts(params) {
     installCommand,
     rerunInstall
   } = params;
-  await rm3(patchFilePath, { force: true }).catch(() => void 0);
+  await rm4(patchFilePath, { force: true }).catch(() => void 0);
   if (manifestFilePath) {
-    await rm3(manifestFilePath, { force: true }).catch(() => void 0);
+    await rm4(manifestFilePath, { force: true }).catch(() => void 0);
   }
   if (patchMode === "patch-package" && packageJsonSnapshot) {
-    await writeFile(packageJsonSnapshot.path, packageJsonSnapshot.content, "utf8").catch(
+    await writeFile2(packageJsonSnapshot.path, packageJsonSnapshot.content, "utf8").catch(
       () => void 0
     );
   }
   if (!rerunInstall) return;
   try {
     const [installCmd, ...installArgs] = installCommand;
-    await execa7(installCmd, installArgs, {
+    await execa8(installCmd, installArgs, {
       cwd,
       stdio: "pipe"
     });
@@ -3745,7 +4512,7 @@ async function applyNativePatch(params) {
   const createArgs = ["patch", packageSpec];
   let patchDir;
   try {
-    const createResult = await execa7(createCommand, createArgs, {
+    const createResult = await execa8(createCommand, createArgs, {
       cwd,
       stdio: "pipe"
     });
@@ -3773,17 +4540,17 @@ ${createResult.stderr}`);
       error: `Could not determine native patch directory for ${packageSpec}.`
     };
   }
-  const tempPatchDir = await mkdtemp2(join15(tmpdir2(), "autoremediator-native-patch-"));
-  const tempPatchFile = join15(tempPatchDir, "change.patch");
+  const tempPatchDir = await mkdtemp2(join17(tmpdir2(), "autoremediator-native-patch-"));
+  const tempPatchFile = join17(tempPatchDir, "change.patch");
   try {
-    await writeFile(tempPatchFile, patchContent, "utf8");
-    await execa7("patch", ["-p1", "-i", tempPatchFile], {
+    await writeFile2(tempPatchFile, patchContent, "utf8");
+    await execa8("patch", ["-p1", "-i", tempPatchFile], {
       cwd: patchDir,
       stdio: "pipe"
     });
     const commitCommand = patchMode === "native-pnpm" ? "pnpm" : "yarn";
     const commitArgs = patchMode === "native-pnpm" ? ["patch-commit", patchDir] : ["patch-commit", "-s", patchDir];
-    await execa7(commitCommand, commitArgs, {
+    await execa8(commitCommand, commitArgs, {
       cwd,
       stdio: "pipe"
     });
@@ -3798,19 +4565,19 @@ ${createResult.stderr}`);
       error: `Failed to apply native patch for ${packageSpec}: ${err instanceof Error ? err.message : String(err)}`
     };
   } finally {
-    await rm3(tempPatchDir, { recursive: true, force: true });
+    await rm4(tempPatchDir, { recursive: true, force: true });
   }
   return { success: true };
 }
 function extractPatchDirectory(output) {
   const lines = output.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
   for (const line of lines) {
-    if (existsSync10(line)) {
+    if (existsSync12(line)) {
       return line;
     }
     const tokens = line.split(/\s+/).map((token) => token.replace(/^['"]|['"]$/g, ""));
     for (const token of tokens) {
-      if (token.startsWith("/") && existsSync10(token)) {
+      if (token.startsWith("/") && existsSync12(token)) {
         return token;
       }
     }
@@ -3820,7 +4587,7 @@ function extractPatchDirectory(output) {
 async function validatePatchWithTests(cwd, testCommand) {
   try {
     const [cmd, ...args] = testCommand;
-    const result = await execa7(cmd, args, {
+    const result = await execa8(cmd, args, {
       cwd,
       timeout: 6e4,
       stdio: "pipe"
@@ -3830,7 +4597,8 @@ async function validatePatchWithTests(cwd, testCommand) {
       output: result.stdout
     };
   } catch (err) {
-    const errorOutput = typeof err === "object" && err !== null && "stdout" in err ? String(err.stdout ?? "") : "";
+    const stdoutVal = typeof err === "object" && err !== null && "stdout" in err ? err.stdout : "";
+    const errorOutput = typeof stdoutVal === "string" ? stdoutVal : Buffer.isBuffer(stdoutVal) ? stdoutVal.toString("utf8") : "";
     const failedTests = extractFailedTests(errorOutput);
     return {
       passed: false,
@@ -3879,6 +4647,7 @@ var applyPatchFileTool = defineTool({
     enforceFrozenLockfile: z8.boolean().optional(),
     workspace: z8.string().optional(),
     validateWithTests: z8.boolean().optional().default(true).describe("Run package manager test command to validate patch doesn't break anything"),
+    reproductionTest: z8.string().optional().describe("Optional synthesized reproduction test script verifying fix"),
     dryRun: z8.boolean().optional().default(false).describe("If true, report but do not mutate files")
   }).refine((value) => Boolean(value.patchContent || value.patches && value.patches.length > 0), {
     message: "Either patchContent or patches must be provided"
@@ -3900,6 +4669,7 @@ var applyPatchFileTool = defineTool({
     workspace,
     riskLevel,
     validateWithTests,
+    reproductionTest,
     dryRun
   }) => {
     try {
@@ -3950,7 +4720,7 @@ var applyPatchFileTool = defineTool({
         };
       }
       const patchFileName = buildPatchFileName(packageName, vulnerableVersion);
-      const patchFilePath = join16(cwd, patchesDir, patchFileName);
+      const patchFilePath = join18(cwd, patchesDir, patchFileName);
       const manifestFilePath = `${patchFilePath}.json`;
       const generatedAt = (/* @__PURE__ */ new Date()).toISOString();
       const baseArtifact = {
@@ -3989,9 +4759,9 @@ var applyPatchFileTool = defineTool({
       }
       return withRepoLock(cwd, async () => {
         const packageJsonSnapshot = patchModeRequiresPackageJsonSnapshot(pm) ? await capturePackageJsonSnapshot(cwd) : void 0;
-        const patchesDirPath = join16(cwd, patchesDir);
+        const patchesDirPath = join18(cwd, patchesDir);
         await mkdir3(patchesDirPath, { recursive: true });
-        await writeFile2(patchFilePath, selectedPatch, "utf8");
+        await writeFile3(patchFilePath, selectedPatch, "utf8");
         validationPhases.push({
           phase: "patch-write",
           passed: true,
@@ -4059,7 +4829,7 @@ var applyPatchFileTool = defineTool({
         if (patchMode === "patch-package") {
           try {
             const [installCmd, ...installArgs] = installCommand;
-            await execa8(installCmd, installArgs, {
+            await execa9(installCmd, installArgs, {
               cwd,
               stdio: "pipe"
             });
@@ -4152,10 +4922,33 @@ var applyPatchFileTool = defineTool({
             message: "Patch validation tests passed."
           });
         }
+        let reproductionTestPath;
+        if (reproductionTest) {
+          const safeName = packageName.replace(/^@/, "").replace(/\//g, "+");
+          reproductionTestPath = join18(patchesDirPath, `${safeName}+${vulnerableVersion}.test.cjs`);
+          await writeFile3(reproductionTestPath, reproductionTest, "utf8");
+          try {
+            const reproRun = await execa9("node", [reproductionTestPath], { cwd, stdio: "pipe" });
+            validationPhases.push({
+              phase: "reproduction-test",
+              passed: reproRun.exitCode === 0,
+              message: "Reproduction test verified fix successfully."
+            });
+          } catch (err) {
+            const reproErr = err instanceof Error ? err.message : String(err);
+            validationPhases.push({
+              phase: "reproduction-test",
+              passed: false,
+              error: `Reproduction test failed: ${reproErr}`
+            });
+          }
+        }
         const finalArtifact = {
           ...artifact,
           applied: true,
           dryRun: false,
+          reproductionTest,
+          reproductionTestPath,
           validationPhases
         };
         await writePatchManifest(manifestFilePath, finalArtifact);
@@ -4465,7 +5258,11 @@ function resolveLocalRunOptions(options) {
   const runTests = options.runTests ?? false;
   const policy = options.policy ?? "";
   const patchesDir = options.patchesDir || "./patches";
-  const constraints = options.constraints ?? {};
+  const constraints = {
+    ...options.constraints,
+    typecheck: options.typecheck ?? options.constraints?.typecheck,
+    supplyChainPolicy: options.supplyChainPolicy ?? options.constraints?.supplyChainPolicy
+  };
   const loadedPolicy = loadPolicy(cwd, options.policy);
   const llmProvider = resolveProvider(options);
   return {
@@ -4502,7 +5299,7 @@ function resolveLocalRunOptions(options) {
 }
 
 // src/remediation/local/vulnerability-match.ts
-import semver4 from "semver";
+import semver5 from "semver";
 function findVulnerablePackages(cveDetails, installedPackages) {
   const vulnerablePackages = [];
   for (const affected of cveDetails.affectedPackages) {
@@ -4511,10 +5308,10 @@ function findVulnerablePackages(cveDetails, installedPackages) {
     if (affected.ecosystem !== "npm") continue;
     const matches = installedPackages.filter((pkg) => pkg.name === affected.name);
     for (const installed of matches) {
-      if (!semver4.valid(installed.version)) continue;
+      if (!semver5.valid(installed.version)) continue;
       let isVulnerable = false;
       try {
-        isVulnerable = semver4.satisfies(installed.version, affected.vulnerableRange, {
+        isVulnerable = semver5.satisfies(installed.version, affected.vulnerableRange, {
           includePrerelease: false
         });
       } catch {
@@ -4857,7 +5654,7 @@ async function runLocalRemediationPipeline(cveId, options = {}) {
     };
     if (regressionCheck && primaryResult.applied && !dryRun && primaryResult.toVersion) {
       try {
-        if (semver5.satisfies(primaryResult.toVersion, vulnerable.affected.vulnerableRange, {
+        if (semver6.satisfies(primaryResult.toVersion, vulnerable.affected.vulnerableRange, {
           includePrerelease: false
         })) {
           primaryResult.regressionDetected = true;
@@ -4948,8 +5745,8 @@ function accumulateStepResults(params) {
 }
 
 // src/remediation/orchestration-prompt.ts
-import { existsSync as existsSync11, readFileSync as readFileSync11 } from "fs";
-import { join as join17 } from "path";
+import { existsSync as existsSync13, readFileSync as readFileSync13 } from "fs";
+import { join as join19 } from "path";
 function buildProviderAddendum(provider, personality = "balanced") {
   const personalityDirective = personality === "analytical" ? "Use concise, explicit rationale for tool decisions and unresolved outcomes." : personality === "pragmatic" ? "Prefer the smallest safe remediation path while preserving policy and validation gates." : "Balance concise execution with brief rationale for risky or unresolved outcomes.";
   const providerDirective = provider === "remote" ? "Use strict structured output and deterministic reporting fields." : "Use deterministic-first behavior and only rely on remote model fallback when required by patch generation.";
@@ -4960,13 +5757,13 @@ Provider profile:
 - ${personalityDirective}`;
 }
 function loadOrchestrationPrompt(ctx) {
-  const promptPath = join17(
+  const promptPath = join19(
     process.cwd(),
     ".github",
     "instructions",
     "orchestration.instructions.md"
   );
-  if (!existsSync11(promptPath)) {
+  if (!existsSync13(promptPath)) {
     return `You are autoremediator, an agentic security remediation system for Node.js package dependencies.
 Working directory: ${ctx.cwd}
   Package manager: ${ctx.packageManager}
@@ -4979,107 +5776,43 @@ Prefer version bump: ${String(ctx.constraints.preferVersionBump ?? false)}
 
 Required sequence:
 1. lookup-cve
-2. check-inventory
-3. check-version-match
-4. find-fixed-version
-5. apply-version-bump
-6. apply-package-override
-
-Fallback sequence (when neither version bump nor override can be applied):
-1. fetch-package-source
-2. generate-patch
-3. apply-patch-file
-
-Always respect dryRun and policy constraints.`;
-  }
-  const template = readFileSync11(promptPath, "utf8");
-  return template.replaceAll("{{cveId}}", ctx.cveId).replaceAll("{{cwd}}", ctx.cwd).replaceAll("{{packageManager}}", ctx.packageManager).replaceAll("{{dryRun}}", String(ctx.dryRun)).replaceAll("{{runTests}}", String(ctx.runTests)).replaceAll("{{policy}}", ctx.policy || "undefined").replaceAll("{{patchesDir}}", ctx.patchesDir).replaceAll(
-    "{{directDependenciesOnly}}",
-    String(ctx.constraints.directDependenciesOnly ?? false)
-  ).replaceAll("{{preferVersionBump}}", String(ctx.constraints.preferVersionBump ?? false)) + buildProviderAddendum(ctx.llmProvider, ctx.modelPersonality);
-}
-
-// src/remediation/pipeline-runtime/progress.ts
-function createProgressEmitter(options) {
-  return (stage, detail, extra) => {
-    if (!options.onProgress) return;
-    options.onProgress({
-      stage,
-      detail,
-      at: (/* @__PURE__ */ new Date()).toISOString(),
-      provider: extra?.provider,
-      model: extra?.model
-    });
-  };
-}
-
-// src/remediation/tools/lookup-cve.ts
-import { z as z9 } from "zod";
-
-// src/intelligence/sources/cisa-kev.ts
-var CISA_KEV_URL = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json";
-async function fetchCisaKevFeed() {
-  try {
-    const res = await httpClient({ url: CISA_KEV_URL });
-    if (!res.ok) return void 0;
-    return res.data;
-  } catch {
-    return void 0;
-  }
-}
-function findKevEntry(feed, cveId) {
-  if (!feed?.vulnerabilities?.length) return void 0;
-  const normalized = cveId.toUpperCase();
-  return feed.vulnerabilities.find((v) => v.cveID.toUpperCase() === normalized);
-}
-async function enrichWithCisaKev(details) {
-  const feed = await fetchCisaKevFeed();
-  const entry = findKevEntry(feed, details.id);
-  if (!entry) return details;
-  details.kev = {
-    knownExploited: true,
-    dateAdded: entry.dateAdded,
-    dueDate: entry.dueDate,
-    requiredAction: entry.requiredAction,
-    knownRansomwareCampaignUse: entry.knownRansomwareCampaignUse
-  };
-  if (!details.references.includes(CISA_KEV_URL)) {
-    details.references.push(CISA_KEV_URL);
-  }
-  return details;
-}
+2. check-inventory
+3. check-version-match
+4. find-fixed-version
+5. apply-version-bump
+6. apply-package-override
 
-// src/intelligence/sources/epss.ts
-async function fetchEpss(cveId) {
-  const { epssApi } = getIntelligenceSourceConfig();
-  if (!epssApi) return void 0;
-  try {
-    const url = new URL(epssApi);
-    url.searchParams.set("cve", cveId);
-    const res = await httpClient({ url: url.toString() });
-    if (!res.ok) return void 0;
-    const body = res.data;
-    return body.data?.[0];
-  } catch {
-    return void 0;
+Fallback sequence (when neither version bump nor override can be applied):
+1. fetch-package-source
+2. generate-patch
+3. apply-patch-file
+
+Always respect dryRun and policy constraints.`;
   }
+  const template = readFileSync13(promptPath, "utf8");
+  return template.replaceAll("{{cveId}}", ctx.cveId).replaceAll("{{cwd}}", ctx.cwd).replaceAll("{{packageManager}}", ctx.packageManager).replaceAll("{{dryRun}}", String(ctx.dryRun)).replaceAll("{{runTests}}", String(ctx.runTests)).replaceAll("{{policy}}", ctx.policy || "undefined").replaceAll("{{patchesDir}}", ctx.patchesDir).replaceAll(
+    "{{directDependenciesOnly}}",
+    String(ctx.constraints.directDependenciesOnly ?? false)
+  ).replaceAll("{{preferVersionBump}}", String(ctx.constraints.preferVersionBump ?? false)) + buildProviderAddendum(ctx.llmProvider, ctx.modelPersonality);
 }
-async function enrichWithEpss(details) {
-  const row = await fetchEpss(details.id);
-  if (!row) return details;
-  const score = Number.parseFloat(row.epss);
-  const percentile = Number.parseFloat(row.percentile);
-  if (!Number.isFinite(score) || !Number.isFinite(percentile)) {
-    return details;
-  }
-  details.epss = {
-    score,
-    percentile,
-    date: row.date
+
+// src/remediation/pipeline-runtime/progress.ts
+function createProgressEmitter(options) {
+  return (stage, detail, extra) => {
+    if (!options.onProgress) return;
+    options.onProgress({
+      stage,
+      detail,
+      at: (/* @__PURE__ */ new Date()).toISOString(),
+      provider: extra?.provider,
+      model: extra?.model
+    });
   };
-  return details;
 }
 
+// src/remediation/tools/lookup-cve.ts
+import { z as z9 } from "zod";
+
 // src/intelligence/sources/cve-services.ts
 function pickEnglishDescription(container) {
   if (!container?.descriptions?.length) return void 0;
@@ -5363,7 +6096,7 @@ var lookupCveTool = defineTool({
 
 // src/remediation/tools/check-version-match.ts
 import { z as z10 } from "zod";
-import semver6 from "semver";
+import semver7 from "semver";
 var affectedPackageSchema = z10.object({
   name: z10.string(),
   ecosystem: z10.literal("npm"),
@@ -5392,10 +6125,10 @@ var checkVersionMatchTool = defineTool({
         (p) => p.name === affected.name
       );
       for (const installed of matches) {
-        if (!semver6.valid(installed.version)) continue;
+        if (!semver7.valid(installed.version)) continue;
         let isVulnerable = false;
         try {
-          isVulnerable = semver6.satisfies(installed.version, affected.vulnerableRange, {
+          isVulnerable = semver7.satisfies(installed.version, affected.vulnerableRange, {
             includePrerelease: false
           });
         } catch {
@@ -5713,7 +6446,7 @@ async function runRemediationPipeline(cveId, options = {}) {
 }
 
 // src/api/change-request/index.ts
-import { execa as execa9 } from "execa";
+import { execa as execa10 } from "execa";
 import { randomBytes } from "crypto";
 function sanitizeBranchToken(value) {
   return value.toLowerCase().replace(/[^a-z0-9._/-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 80);
@@ -5742,22 +6475,68 @@ function resolveProvider2(options) {
   return options.provider ?? "github";
 }
 function resolveGrouping(options) {
-  if (options.grouping && options.grouping !== "all") {
+  const allowed = ["all", "per-cve", "per-package", "by-severity"];
+  if (options.grouping && !allowed.includes(options.grouping)) {
     throw new Error(
-      "changeRequest.grouping currently supports only 'all' for deterministic branch creation."
+      `Unsupported changeRequest.grouping: "${options.grouping}". Supported values: ${allowed.join(", ")}`
     );
   }
-  return "all";
+  return options.grouping ?? "all";
+}
+function groupReports(reports, grouping) {
+  if (reports.length === 0) return [];
+  if (grouping === "all") {
+    return [reports];
+  }
+  if (grouping === "per-cve") {
+    const map = /* @__PURE__ */ new Map();
+    for (const report of reports) {
+      const key = report.cveId.toUpperCase();
+      const list = map.get(key) ?? [];
+      list.push(report);
+      map.set(key, list);
+    }
+    return Array.from(map.values());
+  }
+  if (grouping === "per-package") {
+    const map = /* @__PURE__ */ new Map();
+    for (const report of reports) {
+      const pkgs = new Set(report.results.map((r) => r.packageName));
+      if (pkgs.size === 0) {
+        const list = map.get("misc") ?? [];
+        list.push(report);
+        map.set("misc", list);
+      } else {
+        for (const pkg of pkgs) {
+          const list = map.get(pkg) ?? [];
+          list.push(report);
+          map.set(pkg, list);
+        }
+      }
+    }
+    return Array.from(map.values());
+  }
+  if (grouping === "by-severity") {
+    const map = /* @__PURE__ */ new Map();
+    for (const report of reports) {
+      const sev = report.cveDetails?.severity ?? "UNKNOWN";
+      const list = map.get(sev) ?? [];
+      list.push(report);
+      map.set(sev, list);
+    }
+    return Array.from(map.values());
+  }
+  return [reports];
 }
 async function detectCurrentBranch(cwd) {
-  const result = await execa9("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+  const result = await execa10("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
     cwd,
     stdio: "pipe"
   });
   return result.stdout.trim();
 }
 async function ensureRepoHasChanges(cwd) {
-  const diff = await execa9("git", ["status", "--porcelain"], {
+  const diff = await execa10("git", ["status", "--porcelain"], {
     cwd,
     stdio: "pipe"
   });
@@ -5786,7 +6565,7 @@ async function createGitHubRequest(params) {
   if (params.draft) {
     args.push("--draft");
   }
-  const result = await execa9("gh", args, {
+  const result = await execa10("gh", args, {
     cwd: params.cwd,
     stdio: "pipe"
   });
@@ -5811,7 +6590,7 @@ async function createGitLabRequest(params) {
   if (params.draft) {
     args.push("--draft");
   }
-  const result = await execa9("glab", args, {
+  const result = await execa10("glab", args, {
     cwd: params.cwd,
     stdio: "pipe"
   });
@@ -5821,64 +6600,68 @@ async function createChangeRequestsForReports(params) {
   const { cwd, options, reports } = params;
   const provider = resolveProvider2(options);
   const grouping = resolveGrouping(options);
-  const plan = buildPlan(reports);
-  const titlePrefix = options.titlePrefix?.trim().slice(0, 200);
-  const bodyFooter = options.bodyFooter ? options.bodyFooter.slice(0, 2e3) : void 0;
-  const title = titlePrefix ? `${titlePrefix} ${plan.title}` : plan.title;
-  const body = bodyFooter ? `${plan.body}
+  const groups = groupReports(reports, grouping);
+  if (groups.length === 0) {
+    return [];
+  }
+  const results = [];
+  const hasChanges = await ensureRepoHasChanges(cwd).catch(() => false);
+  const baseBranch = options.baseBranch ?? await detectCurrentBranch(cwd).catch(() => "main");
+  const branchPrefix = options.branchPrefix ?? "autoremediator";
+  const pushRemote = options.pushRemote ?? "origin";
+  if (options.pushRemote && !/^[a-zA-Z0-9._-]+$/.test(options.pushRemote)) {
+    throw new Error(`Invalid pushRemote value: ${options.pushRemote}`);
+  }
+  if (options.repository && !/^[a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+$/.test(options.repository)) {
+    throw new Error(`Invalid repository format: ${options.repository}`);
+  }
+  for (const group of groups) {
+    const plan = buildPlan(group);
+    const titlePrefix = options.titlePrefix?.trim().slice(0, 200);
+    const bodyFooter = options.bodyFooter ? options.bodyFooter.slice(0, 2e3) : void 0;
+    const title = titlePrefix ? `${titlePrefix} ${plan.title}` : plan.title;
+    const body = bodyFooter ? `${plan.body}
 
 ${bodyFooter}` : plan.body;
-  try {
-    const hasChanges = await ensureRepoHasChanges(cwd);
     if (!hasChanges) {
-      return [
-        {
-          provider,
-          grouping,
-          repository: options.repository,
-          branchName: "",
-          title,
-          body,
-          created: false,
-          cveIds: plan.cveIds,
-          packageNames: plan.packageNames,
-          error: "No repository changes to include in change request."
-        }
-      ];
+      results.push({
+        provider,
+        grouping,
+        repository: options.repository,
+        branchName: "",
+        title,
+        body,
+        created: false,
+        cveIds: plan.cveIds,
+        packageNames: plan.packageNames,
+        error: "No repository changes to include in change request."
+      });
+      continue;
     }
-    const baseBranch = options.baseBranch ?? await detectCurrentBranch(cwd);
-    const branchPrefix = options.branchPrefix ?? "autoremediator";
     const branchName = toBranchName(branchPrefix, plan.cveIds);
-    const pushRemote = options.pushRemote ?? "origin";
-    if (options.pushRemote && !/^[a-zA-Z0-9._-]+$/.test(options.pushRemote)) {
-      throw new Error(`Invalid pushRemote value: ${options.pushRemote}`);
-    }
-    if (options.repository && !/^[a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+$/.test(options.repository)) {
-      throw new Error(`Invalid repository format: ${options.repository}`);
-    }
-    await execa9("git", ["checkout", "-b", branchName], { cwd, stdio: "pipe" });
-    await execa9("git", ["add", "-A"], { cwd, stdio: "pipe" });
-    await execa9("git", ["commit", "-m", title], { cwd, stdio: "pipe" });
-    await execa9("git", ["push", "-u", pushRemote, branchName], { cwd, stdio: "pipe" });
-    const url = provider === "github" ? await createGitHubRequest({
-      cwd,
-      repository: options.repository,
-      head: branchName,
-      base: baseBranch,
-      title,
-      body,
-      draft: options.draft
-    }) : await createGitLabRequest({
-      cwd,
-      repository: options.repository,
-      source: branchName,
-      target: baseBranch,
-      title,
-      body,
-      draft: options.draft
-    });
-    return [
-      {
+    try {
+      await execa10("git", ["checkout", "-b", branchName], { cwd, stdio: "pipe" });
+      await execa10("git", ["add", "-A"], { cwd, stdio: "pipe" });
+      await execa10("git", ["commit", "-m", title], { cwd, stdio: "pipe" });
+      await execa10("git", ["push", "-u", pushRemote, branchName], { cwd, stdio: "pipe" });
+      const url = provider === "github" ? await createGitHubRequest({
+        cwd,
+        repository: options.repository,
+        head: branchName,
+        base: baseBranch,
+        title,
+        body,
+        draft: options.draft
+      }) : await createGitLabRequest({
+        cwd,
+        repository: options.repository,
+        source: branchName,
+        target: baseBranch,
+        title,
+        body,
+        draft: options.draft
+      });
+      results.push({
         provider,
         grouping,
         repository: options.repository,
@@ -5890,11 +6673,13 @@ ${bodyFooter}` : plan.body;
         url,
         cveIds: plan.cveIds,
         packageNames: plan.packageNames
+      });
+      if (groups.length > 1) {
+        await execa10("git", ["checkout", baseBranch], { cwd, stdio: "pipe" }).catch(() => {
+        });
       }
-    ];
-  } catch (error) {
-    return [
-      {
+    } catch (error) {
+      results.push({
         provider,
         grouping,
         repository: options.repository,
@@ -5906,9 +6691,10 @@ ${bodyFooter}` : plan.body;
         cveIds: plan.cveIds,
         packageNames: plan.packageNames,
         error: error instanceof Error ? error.message : String(error)
-      }
-    ];
+      });
+    }
   }
+  return results;
 }
 
 // src/api/context.ts
@@ -5942,7 +6728,7 @@ function resolveConstraints(options, cwd) {
 
 // src/platform/evidence.ts
 import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync5 } from "fs";
-import { join as join18 } from "path";
+import { join as join20 } from "path";
 function createEvidenceLog(cwd, cveIds, context = {}) {
   return {
     runId: `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`,
@@ -5974,9 +6760,9 @@ function finalizeEvidence(log) {
   return log;
 }
 function writeEvidenceLog(cwd, log) {
-  const dir = join18(cwd, ".autoremediator", "evidence");
+  const dir = join20(cwd, ".autoremediator", "evidence");
   mkdirSync3(dir, { recursive: true });
-  const filePath = join18(dir, `${log.runId}.json`);
+  const filePath = join20(dir, `${log.runId}.json`);
   writeFileSync5(filePath, JSON.stringify(log, null, 2) + "\n", "utf8");
   return filePath;
 }
@@ -6268,6 +7054,24 @@ function buildResultSimulation(report, result, options) {
   const dependencyScope = result.dependencyScope ?? dependencyScopeLookup.get(result.packageName);
   const plannedMutations = buildPlannedMutations(result, options.runTests === true);
   const wouldMutate = plannedMutations.length > 0;
+  let unifiedDiff;
+  if (result.patchArtifact?.patchFilePath) {
+    unifiedDiff = `--- ${result.patchArtifact.patchFilePath}
++++ ${result.patchArtifact.patchFilePath}`;
+  } else if (result.strategy === "version-bump" && result.toVersion) {
+    unifiedDiff = `--- package.json
++++ package.json
+@@ -1,3 +1,3 @@
+-    "${result.packageName}": "${result.fromVersion}"
++    "${result.packageName}": "^${result.toVersion}"`;
+  } else if (result.strategy === "override" && result.toVersion) {
+    unifiedDiff = `--- package.json
++++ package.json
+@@ -1,3 +1,3 @@
++  "overrides": {
++    "${result.packageName}": "${result.toVersion}"
++  }`;
+  }
   return {
     mode,
     wouldMutate,
@@ -6278,7 +7082,8 @@ function buildResultSimulation(report, result, options) {
       dependencyScope,
       wouldMutate,
       runTests: options.runTests === true
-    })
+    }),
+    unifiedDiff
   };
 }
 function buildSimulationSummary(reports) {
@@ -6457,10 +7262,15 @@ function ciExitCode(summary) {
 }
 
 // src/api/remediate/validators.ts
+var CVE_ID_REGEX = /^CVE-\d{4}-\d{1,7}$/i;
+var GHSA_ID_REGEX = /^GHSA-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}$/i;
+function isVulnerabilityId(id) {
+  return CVE_ID_REGEX.test(id) || GHSA_ID_REGEX.test(id);
+}
 function assertValidCveId(cveId) {
-  if (!/^CVE-\d{4}-\d+$/i.test(cveId)) {
+  if (!isVulnerabilityId(cveId)) {
     throw new Error(
-      `Invalid CVE ID: "${cveId}". Expected format: CVE-YYYY-NNNNN (e.g. CVE-2021-23337).`
+      `Invalid vulnerability ID: "${cveId}". Expected format: CVE-YYYY-NNNNN (e.g. CVE-2021-23337) or GHSA-xxxx-xxxx-xxxx.`
     );
   }
 }
@@ -6556,13 +7366,14 @@ async function planRemediation(cveId, options = {}) {
 }
 
 // src/scanner/parse-input.ts
-import { extname, resolve as resolve3 } from "path";
-import { readFileSync as readFileSync15 } from "fs";
-import { execa as execa10 } from "execa";
+import { extname, resolve as resolve4 } from "path";
+import { readFileSync as readFileSync17 } from "fs";
+import { execa as execa11 } from "execa";
 
 // src/scanner/adapters/npm-audit.ts
-import { readFileSync as readFileSync12 } from "fs";
+import { readFileSync as readFileSync14 } from "fs";
 var CVE_REGEX = /CVE-\d{4}-\d{1,7}/gi;
+var GHSA_REGEX = /GHSA-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}/gi;
 function normalizeSeverity(raw) {
   if (!raw) return "UNKNOWN";
   const up = raw.toUpperCase();
@@ -6577,7 +7388,8 @@ function parseNpmAuditJsonFromString(content) {
   for (const vuln of Object.values(report.vulnerabilities ?? {})) {
     for (const viaEntry of vuln.via ?? []) {
       const text = typeof viaEntry === "string" ? viaEntry : `${viaEntry.url ?? ""} ${viaEntry.name ?? ""}`;
-      const matches = text.match(CVE_REGEX) ?? [];
+      const cveMatches = text.match(CVE_REGEX) ?? [];
+      const matches = cveMatches.length > 0 ? cveMatches : text.match(GHSA_REGEX) ?? [];
       for (const match of matches) {
         const cveId = match.toUpperCase();
         const key = `${cveId}:${vuln.name}`;
@@ -6595,13 +7407,14 @@ function parseNpmAuditJsonFromString(content) {
   return findings;
 }
 function parseNpmAuditJsonFile(filePath) {
-  const content = readFileSync12(filePath, "utf8");
+  const content = readFileSync14(filePath, "utf8");
   return parseNpmAuditJsonFromString(content);
 }
 
 // src/scanner/adapters/yarn-audit.ts
-import { readFileSync as readFileSync13 } from "fs";
+import { readFileSync as readFileSync15 } from "fs";
 var CVE_REGEX2 = /CVE-\d{4}-\d{1,7}/gi;
+var GHSA_REGEX2 = /GHSA-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}/gi;
 function normalizeSeverity2(raw) {
   if (!raw) return "UNKNOWN";
   const up = raw.toUpperCase();
@@ -6626,7 +7439,8 @@ function parseYarnAuditJsonFromString(content) {
     const packageName = advisory?.module_name;
     const severity = normalizeSeverity2(advisory?.severity);
     const text = `${advisory?.url ?? ""} ${(advisory?.cves ?? []).join(" ")}`;
-    const matches = text.match(CVE_REGEX2) ?? [];
+    const cveMatches = text.match(CVE_REGEX2) ?? [];
+    const matches = cveMatches.length > 0 ? cveMatches : text.match(GHSA_REGEX2) ?? [];
     for (const match of matches) {
       const cveId = match.toUpperCase();
       const key = `${cveId}:${packageName ?? ""}`;
@@ -6643,12 +7457,12 @@ function parseYarnAuditJsonFromString(content) {
   return findings;
 }
 function parseYarnAuditJsonFile(filePath) {
-  const content = readFileSync13(filePath, "utf8");
+  const content = readFileSync15(filePath, "utf8");
   return parseYarnAuditJsonFromString(content);
 }
 
 // src/scanner/adapters/sarif.ts
-import { readFileSync as readFileSync14 } from "fs";
+import { readFileSync as readFileSync16 } from "fs";
 var CVE_REGEX3 = /CVE-\d{4}-\d{1,7}/gi;
 function extractPackageName(result) {
   const pkg = result.properties?.["packageName"];
@@ -6686,7 +7500,7 @@ function parseSarifFromString(content) {
   return findings;
 }
 function parseSarifFile(filePath) {
-  const content = readFileSync14(filePath, "utf8");
+  const content = readFileSync16(filePath, "utf8");
   return parseSarifFromString(content);
 }
 
@@ -6695,7 +7509,7 @@ function parseScanInput(filePath, format) {
   if (filePath.includes("\0")) {
     throw new Error("Invalid scan input path: path contains null bytes");
   }
-  const resolvedPath = resolve3(filePath);
+  const resolvedPath = resolve4(filePath);
   const resolved = format === "auto" ? inferFormat(resolvedPath) : format;
   if (resolved === "npm-audit") {
     return parseNpmAuditJsonFile(resolvedPath);
@@ -6706,7 +7520,7 @@ function parseScanInput(filePath, format) {
   if (resolved === "sarif") {
     return parseSarifFile(resolvedPath);
   }
-  throw new Error(`Unsupported input format: ${resolved}`);
+  throw new Error(`Unsupported input format: ${String(resolved)}`);
 }
 async function parseScanInputFromAudit(params) {
   const pm = params.packageManager ?? detectPackageManager(params.cwd);
@@ -6717,7 +7531,7 @@ async function parseScanInputFromAudit(params) {
   }
   const command = resolveAuditCommand(pm, { workspace: params.workspace });
   const [cmd, ...args] = command;
-  const result = await execa10(cmd, args, {
+  const result = await execa11(cmd, args, {
     cwd: params.cwd,
     stdio: "pipe",
     reject: false
@@ -6771,7 +7585,7 @@ function inferFormat(filePath) {
   const ext = extname(filePath).toLowerCase();
   if (ext === ".sarif") return "sarif";
   try {
-    const content = readFileSync15(filePath, "utf8");
+    const content = readFileSync17(filePath, "utf8");
     const firstLine = content.split("\n").find((line) => line.trim().startsWith("{"));
     if (firstLine) {
       const parsed = JSON.parse(firstLine);
@@ -7182,14 +7996,14 @@ async function remediatePortfolio(targets, options = {}) {
 }
 
 // src/api/update-outdated/index.ts
-import { join as join19 } from "path";
-import { readFileSync as readFileSync16, writeFileSync as writeFileSync6 } from "fs";
-import { execa as execa11 } from "execa";
+import { join as join21 } from "path";
+import { readFileSync as readFileSync18, writeFileSync as writeFileSync6 } from "fs";
+import { execa as execa12 } from "execa";
 async function applyBump(params) {
-  const pkgPath = join19(params.cwd, "package.json");
+  const pkgPath = join21(params.cwd, "package.json");
   let pkgJson;
   try {
-    pkgJson = JSON.parse(readFileSync16(pkgPath, "utf8"));
+    pkgJson = JSON.parse(readFileSync18(pkgPath, "utf8"));
   } catch {
     return {
       applied: false,
@@ -7214,7 +8028,7 @@ async function applyBump(params) {
     writeFileSync6(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
     try {
       const [installCmd, ...installArgs] = params.installCommand;
-      await execa11(installCmd, installArgs, { cwd: params.cwd, stdio: "pipe" });
+      await execa12(installCmd, installArgs, { cwd: params.cwd, stdio: "pipe" });
     } catch (err) {
       pkgJson[depField][params.packageName] = currentRange;
       writeFileSync6(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
@@ -7227,13 +8041,13 @@ async function applyBump(params) {
     if (params.runTests) {
       try {
         const [testCmd, ...testArgs] = params.testCommand;
-        await execa11(testCmd, testArgs, { cwd: params.cwd, stdio: "pipe" });
+        await execa12(testCmd, testArgs, { cwd: params.cwd, stdio: "pipe" });
       } catch (err) {
         pkgJson[depField][params.packageName] = currentRange;
         writeFileSync6(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
         try {
           const [rollbackCmd, ...rollbackArgs] = params.installCommand;
-          await execa11(rollbackCmd, rollbackArgs, { cwd: params.cwd, stdio: "pipe" });
+          await execa12(rollbackCmd, rollbackArgs, { cwd: params.cwd, stdio: "pipe" });
         } catch {
         }
         const message = err instanceof Error ? err.message : String(err);
@@ -7428,6 +8242,432 @@ async function updateOutdated(options = {}) {
   };
 }
 
+// src/api/reachability/index.ts
+async function checkReachability(options) {
+  const cwd = options.cwd ?? process.cwd();
+  return assessPackageReachability(cwd, options.packageName, options.symbol);
+}
+
+// src/scanner/delta-scan.ts
+import { existsSync as existsSync14, readFileSync as readFileSync19 } from "fs";
+import { join as join22 } from "path";
+import { execa as execa13 } from "execa";
+import semver9 from "semver";
+
+// src/scanner/lockfile-diff.ts
+import YAML2 from "yaml";
+import semver8 from "semver";
+function parseLockfileDependencies(filename, content) {
+  const result = /* @__PURE__ */ new Map();
+  const add = (name, ver) => {
+    if (!name || !ver) return;
+    const cleanVer = semver8.clean(ver) || semver8.coerce(ver)?.version || ver;
+    let set = result.get(name);
+    if (!set) {
+      set = /* @__PURE__ */ new Set();
+      result.set(name, set);
+    }
+    set.add(cleanVer);
+  };
+  if (filename.endsWith("package-lock.json")) {
+    try {
+      const data = JSON.parse(content);
+      if (data.packages && typeof data.packages === "object") {
+        for (const [key, pkg] of Object.entries(data.packages)) {
+          if (!key || key === "" || typeof pkg !== "object" || !pkg) continue;
+          const idx = key.lastIndexOf("node_modules/");
+          if (idx !== -1) {
+            const rawName = key.slice(idx + "node_modules/".length);
+            const ver = pkg.version;
+            add(rawName, ver);
+          }
+        }
+      }
+      if (data.dependencies && typeof data.dependencies === "object") {
+        const walkDeps = (deps) => {
+          for (const [name, info] of Object.entries(deps)) {
+            if (!info || typeof info !== "object") continue;
+            const depObj = info;
+            add(name, depObj.version);
+            if (depObj.dependencies && typeof depObj.dependencies === "object") {
+              walkDeps(depObj.dependencies);
+            }
+          }
+        };
+        walkDeps(data.dependencies);
+      }
+    } catch {
+    }
+  } else if (filename.endsWith("pnpm-lock.yaml")) {
+    try {
+      const data = YAML2.parse(content);
+      if (data?.packages && typeof data.packages === "object") {
+        for (const [key, val] of Object.entries(data.packages)) {
+          let rawKey = key.replace(/^\//, "");
+          const parenIdx = rawKey.indexOf("(");
+          if (parenIdx !== -1) {
+            rawKey = rawKey.slice(0, parenIdx);
+          }
+          const lastAt = rawKey.lastIndexOf("@");
+          if (lastAt > 0) {
+            const name = val?.name ?? rawKey.slice(0, lastAt);
+            const version = val?.version ?? rawKey.slice(lastAt + 1);
+            add(name, version);
+          }
+        }
+      }
+      if (data?.snapshots && typeof data.snapshots === "object") {
+        for (const key of Object.keys(data.snapshots)) {
+          let rawKey = key.replace(/^\//, "");
+          const parenIdx = rawKey.indexOf("(");
+          if (parenIdx !== -1) {
+            rawKey = rawKey.slice(0, parenIdx);
+          }
+          const lastAt = rawKey.lastIndexOf("@");
+          if (lastAt > 0) {
+            const name = rawKey.slice(0, lastAt);
+            const version = rawKey.slice(lastAt + 1);
+            add(name, version);
+          }
+        }
+      }
+    } catch {
+    }
+  } else if (filename.endsWith("yarn.lock")) {
+    const lines = content.split("\n");
+    let currentPackages = [];
+    for (const line of lines) {
+      if (line.startsWith("#") || line.trim() === "") continue;
+      if (!line.startsWith(" ")) {
+        currentPackages = [];
+        const parts = line.split(",").map((p) => p.trim().replace(/^"/, "").replace(/":?$/, ""));
+        for (const part of parts) {
+          const lastAt = part.lastIndexOf("@");
+          if (lastAt > 0) {
+            currentPackages.push(part.slice(0, lastAt));
+          }
+        }
+      } else {
+        const match = line.match(/^\s+version\s+"?([^"\s]+)"?/);
+        if (match && currentPackages.length > 0) {
+          const ver = match[1];
+          for (const pkg of currentPackages) {
+            add(pkg, ver);
+          }
+          currentPackages = [];
+        }
+      }
+    }
+  }
+  return result;
+}
+function computeLockfileDiff(filename, oldContent, newContent) {
+  const changes = [];
+  const oldDeps = oldContent ? parseLockfileDependencies(filename, oldContent) : /* @__PURE__ */ new Map();
+  const newDeps = newContent ? parseLockfileDependencies(filename, newContent) : /* @__PURE__ */ new Map();
+  const allPkgs = /* @__PURE__ */ new Set([...oldDeps.keys(), ...newDeps.keys()]);
+  for (const pkg of allPkgs) {
+    const oldVers = oldDeps.get(pkg) ?? /* @__PURE__ */ new Set();
+    const newVers = newDeps.get(pkg) ?? /* @__PURE__ */ new Set();
+    for (const nVer of newVers) {
+      if (!oldVers.has(nVer)) {
+        if (oldVers.size === 0) {
+          changes.push({
+            packageName: pkg,
+            changeType: "added",
+            newVersion: nVer,
+            dependencyType: "transitive",
+            manifestPath: filename
+          });
+        } else {
+          const [firstOld] = oldVers;
+          const cleanOld = semver8.clean(firstOld) || semver8.coerce(firstOld)?.version;
+          const cleanNew = semver8.clean(nVer) || semver8.coerce(nVer)?.version;
+          const isUpgrade = cleanOld && cleanNew && semver8.valid(cleanOld) && semver8.valid(cleanNew) ? semver8.gt(cleanNew, cleanOld) : true;
+          changes.push({
+            packageName: pkg,
+            changeType: isUpgrade ? "upgraded" : "downgraded",
+            oldVersion: firstOld,
+            newVersion: nVer,
+            dependencyType: "transitive",
+            manifestPath: filename
+          });
+        }
+      }
+    }
+    if (newVers.size === 0 && oldVers.size > 0) {
+      for (const oVer of oldVers) {
+        changes.push({
+          packageName: pkg,
+          changeType: "removed",
+          oldVersion: oVer,
+          dependencyType: "transitive",
+          manifestPath: filename
+        });
+      }
+    }
+  }
+  return changes;
+}
+
+// src/scanner/delta-scan.ts
+var DEP_SECTIONS = [
+  "dependencies",
+  "devDependencies",
+  "peerDependencies",
+  "optionalDependencies"
+];
+async function getChangedManifestPaths(cwd, baseRef) {
+  const manifests = /* @__PURE__ */ new Set();
+  try {
+    const { stdout: diffFiles } = await execa13(
+      "git",
+      ["diff", "--name-only", baseRef, "--", "package.json", "**/package.json"],
+      { cwd, reject: false }
+    );
+    for (const f of diffFiles.split("\n")) {
+      const trimmed = f.trim();
+      if (trimmed && trimmed.endsWith("package.json") && !trimmed.includes("node_modules")) {
+        manifests.add(trimmed);
+      }
+    }
+    const { stdout: untrackedFiles } = await execa13(
+      "git",
+      ["ls-files", "--others", "--exclude-standard", "--", "package.json", "**/package.json"],
+      { cwd, reject: false }
+    );
+    for (const f of untrackedFiles.split("\n")) {
+      const trimmed = f.trim();
+      if (trimmed && trimmed.endsWith("package.json") && !trimmed.includes("node_modules")) {
+        manifests.add(trimmed);
+      }
+    }
+  } catch {
+    if (existsSync14(join22(cwd, "package.json"))) {
+      manifests.add("package.json");
+    }
+  }
+  return Array.from(manifests);
+}
+async function getOldManifestContent(cwd, baseRef, relPath) {
+  try {
+    const { stdout } = await execa13("git", ["show", `${baseRef}:${relPath}`], {
+      cwd,
+      reject: false
+    });
+    if (!stdout || !stdout.trim()) return null;
+    return JSON.parse(stdout);
+  } catch {
+    return null;
+  }
+}
+function getNewManifestContent(cwd, relPath) {
+  const fullPath = join22(cwd, relPath);
+  if (!existsSync14(fullPath)) return null;
+  try {
+    return JSON.parse(readFileSync19(fullPath, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function computeDependencyDiff(relPath, oldPkg, newPkg) {
+  const changes = [];
+  for (const section of DEP_SECTIONS) {
+    const oldDeps = oldPkg?.[section] ?? {};
+    const newDeps = newPkg?.[section] ?? {};
+    for (const [pkgName, newVer] of Object.entries(newDeps)) {
+      const oldVer = oldDeps[pkgName];
+      if (!oldVer) {
+        changes.push({
+          packageName: pkgName,
+          changeType: "added",
+          newVersion: newVer,
+          dependencyType: section,
+          manifestPath: relPath
+        });
+      } else if (oldVer !== newVer) {
+        const cleanOld = semver9.clean(oldVer) || semver9.coerce(oldVer)?.version;
+        const cleanNew = semver9.clean(newVer) || semver9.coerce(newVer)?.version;
+        const isUpgrade = cleanOld && cleanNew && semver9.valid(cleanOld) && semver9.valid(cleanNew) ? semver9.gt(cleanNew, cleanOld) : true;
+        changes.push({
+          packageName: pkgName,
+          changeType: isUpgrade ? "upgraded" : "downgraded",
+          oldVersion: oldVer,
+          newVersion: newVer,
+          dependencyType: section,
+          manifestPath: relPath
+        });
+      }
+    }
+    for (const [pkgName, oldVer] of Object.entries(oldDeps)) {
+      if (!(pkgName in newDeps)) {
+        changes.push({
+          packageName: pkgName,
+          changeType: "removed",
+          oldVersion: oldVer,
+          dependencyType: section,
+          manifestPath: relPath
+        });
+      }
+    }
+  }
+  return changes;
+}
+var LOCKFILE_PATTERNS = [
+  "package-lock.json",
+  "**/package-lock.json",
+  "pnpm-lock.yaml",
+  "**/pnpm-lock.yaml",
+  "yarn.lock",
+  "**/yarn.lock"
+];
+async function getChangedLockfilePaths(cwd, baseRef) {
+  const lockfiles = /* @__PURE__ */ new Set();
+  try {
+    const { stdout: diffFiles } = await execa13(
+      "git",
+      ["diff", "--name-only", baseRef, "--", ...LOCKFILE_PATTERNS],
+      { cwd, reject: false }
+    );
+    for (const f of diffFiles.split("\n")) {
+      const trimmed = f.trim();
+      if (trimmed && !trimmed.includes("node_modules") && (trimmed.endsWith("package-lock.json") || trimmed.endsWith("pnpm-lock.yaml") || trimmed.endsWith("yarn.lock"))) {
+        lockfiles.add(trimmed);
+      }
+    }
+    const { stdout: untrackedFiles } = await execa13(
+      "git",
+      ["ls-files", "--others", "--exclude-standard", "--", ...LOCKFILE_PATTERNS],
+      { cwd, reject: false }
+    );
+    for (const f of untrackedFiles.split("\n")) {
+      const trimmed = f.trim();
+      if (trimmed && !trimmed.includes("node_modules") && (trimmed.endsWith("package-lock.json") || trimmed.endsWith("pnpm-lock.yaml") || trimmed.endsWith("yarn.lock"))) {
+        lockfiles.add(trimmed);
+      }
+    }
+  } catch {
+  }
+  return Array.from(lockfiles);
+}
+async function getFileContentAtRef(cwd, baseRef, relPath) {
+  try {
+    const { stdout } = await execa13("git", ["show", `${baseRef}:${relPath}`], {
+      cwd,
+      reject: false
+    });
+    return stdout || null;
+  } catch {
+    return null;
+  }
+}
+async function scanDelta(options = {}) {
+  const cwd = options.cwd ?? process.cwd();
+  const baseRef = options.baseRef ?? "HEAD";
+  const changedManifests = await getChangedManifestPaths(cwd, baseRef);
+  const changedLockfiles = await getChangedLockfilePaths(cwd, baseRef);
+  const dependencyChanges = [];
+  const directPkgs = /* @__PURE__ */ new Set();
+  for (const manifestRel of changedManifests) {
+    const oldPkg = await getOldManifestContent(cwd, baseRef, manifestRel);
+    const newPkg = getNewManifestContent(cwd, manifestRel);
+    const diffs = computeDependencyDiff(manifestRel, oldPkg, newPkg);
+    for (const d of diffs) {
+      directPkgs.add(d.packageName);
+    }
+    dependencyChanges.push(...diffs);
+  }
+  for (const lockfileRel of changedLockfiles) {
+    const oldContent = await getFileContentAtRef(cwd, baseRef, lockfileRel);
+    const fullPath = join22(cwd, lockfileRel);
+    const newContent = existsSync14(fullPath) ? readFileSync19(fullPath, "utf8") : null;
+    const lockDiffs = computeLockfileDiff(lockfileRel, oldContent, newContent);
+    for (const change of lockDiffs) {
+      if (!directPkgs.has(change.packageName)) {
+        dependencyChanges.push(change);
+      }
+    }
+    if (!changedManifests.includes(lockfileRel)) {
+      changedManifests.push(lockfileRel);
+    }
+  }
+  const introducedFindings = [];
+  const resolvedFindings = [];
+  for (const change of dependencyChanges) {
+    if (change.changeType === "added" || change.changeType === "upgraded" || change.changeType === "downgraded") {
+      const cleanVer = semver9.coerce(change.newVersion)?.version ?? change.newVersion;
+      const evaluation = await evaluatePackage(change.packageName, {
+        version: cleanVer,
+        enrichIntelligence: true
+      });
+      for (const vuln of evaluation.vulnerabilities) {
+        introducedFindings.push({
+          packageName: change.packageName,
+          cveId: vuln.cveId,
+          severity: vuln.severity,
+          summary: vuln.summary,
+          deltaType: "introduced",
+          installedVersion: change.newVersion,
+          safeUpgradeVersion: vuln.safeUpgradeVersion,
+          inCisaKev: vuln.inCisaKev,
+          epssScore: vuln.epssScore
+        });
+      }
+    }
+    if (change.oldVersion && (change.changeType === "upgraded" || change.changeType === "removed")) {
+      const cleanOldVer = semver9.coerce(change.oldVersion)?.version ?? change.oldVersion;
+      const oldEval = await evaluatePackage(change.packageName, {
+        version: cleanOldVer,
+        enrichIntelligence: true
+      });
+      const cleanNewVer = change.newVersion ? semver9.coerce(change.newVersion)?.version ?? change.newVersion : void 0;
+      const newEval = cleanNewVer ? await evaluatePackage(change.packageName, {
+        version: cleanNewVer,
+        enrichIntelligence: false
+      }) : { vulnerabilities: [] };
+      const newCveSet = new Set(newEval.vulnerabilities.map((v) => v.cveId));
+      for (const oldVuln of oldEval.vulnerabilities) {
+        if (!newCveSet.has(oldVuln.cveId)) {
+          resolvedFindings.push({
+            packageName: change.packageName,
+            cveId: oldVuln.cveId,
+            severity: oldVuln.severity,
+            summary: oldVuln.summary,
+            deltaType: "resolved",
+            installedVersion: change.oldVersion,
+            safeUpgradeVersion: oldVuln.safeUpgradeVersion,
+            inCisaKev: oldVuln.inCisaKev,
+            epssScore: oldVuln.epssScore
+          });
+        }
+      }
+    }
+  }
+  let netRiskVerdict = "neutral";
+  let status = "ok";
+  if (introducedFindings.length > 0) {
+    netRiskVerdict = "degraded";
+    status = "degraded";
+  } else if (resolvedFindings.length > 0) {
+    netRiskVerdict = "improved";
+    status = "improved";
+  }
+  const summary = introducedFindings.length > 0 ? `Delta scan against ${baseRef} found ${introducedFindings.length} newly introduced vulnerability(ies) across ${dependencyChanges.length} dependency change(s) (net risk: degraded).` : resolvedFindings.length > 0 ? `Delta scan against ${baseRef} resolved ${resolvedFindings.length} vulnerability(ies) across ${dependencyChanges.length} dependency change(s) (net risk: improved).` : `Delta scan against ${baseRef} found 0 new vulnerabilities across ${dependencyChanges.length} dependency change(s) (net risk: neutral).`;
+  return {
+    schemaVersion: "1.0",
+    status,
+    baseRef,
+    targetRef: "working-tree",
+    changedManifests,
+    dependencyChanges,
+    introducedFindings,
+    resolvedFindings,
+    netRiskVerdict,
+    summary,
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+
 // src/api/jobs/index.ts
 import { randomUUID as randomUUID2 } from "crypto";
 
@@ -7543,9 +8783,9 @@ function toSarifOutput(report) {
 }
 
 // src/version.ts
-import { readFileSync as readFileSync17 } from "fs";
+import { readFileSync as readFileSync20 } from "fs";
 function readPackageVersion() {
-  const raw = readFileSync17(new URL("../package.json", import.meta.url), "utf8");
+  const raw = readFileSync20(new URL("../package.json", import.meta.url), "utf8");
   const metadata = JSON.parse(raw);
   if (!metadata.version) {
     throw new Error("packages/core/package.json is missing a version field.");
@@ -7570,11 +8810,18 @@ export {
   listPatchArtifacts,
   inspectPatchArtifact,
   validatePatchArtifact,
+  evaluatePackage,
+  reconcilePatchArtifacts,
   remediate,
   planRemediation,
+  parseScanInput,
+  parseScanInputFromAudit,
+  uniqueCveIds,
   remediateFromScan,
   remediatePortfolio,
   updateOutdated,
+  checkReachability,
+  scanDelta,
   submitRemediateJob,
   submitScanJob,
   submitPortfolioJob,