autoremediator 0.16.0 → 0.18.0

package/dist/intelligence/index.d.ts

@@ -1,4 +1,4 @@
-export { lookupCveOsv, fetchOsvVuln, parseOsvVuln } from "./sources/osv.js";
+export { lookupCveOsv, fetchOsvVuln, parseOsvVuln, queryOsvPackage } from "./sources/osv.js";
 export { lookupCveGitHub, fetchGhAdvisories, parseGhAdvisories, mergeGhDataIntoCveDetails, } from "./sources/github-advisory.js";
 export { enrichWithNvd, fetchNvdCvss } from "./sources/nvd.js";
 export { enrichWithCisaKev, fetchCisaKevFeed, findKevEntry } from "./sources/cisa-kev.js";

package/dist/intelligence/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/intelligence/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC5E,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAC1F,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAC/F,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/intelligence/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC7F,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC1F,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAC1F,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAC/F,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/intelligence/sources/github-advisory.d.ts

@@ -1,3 +1,11 @@
+/**
+ * GitHub Advisory Database API client
+ *
+ * Used as a secondary source to enrich CVE data with `first_patched_version`.
+ * Unauthenticated access works; set GITHUB_TOKEN env var for higher rate limits.
+ *
+ * Uses shared HTTP client for all API communication.
+ */
 import type { AffectedPackage, CveDetails } from "../../platform/types.js";
 interface GhVulnerability {
     package: {

package/dist/intelligence/sources/github-advisory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"github-advisory.d.ts","sourceRoot":"","sources":["../../../src/intelligence/sources/github-advisory.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAO3E,UAAU,eAAe;IACvB,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,wBAAwB,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AAED,UAAU,UAAU;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,KAAK,GAAG,UAAU,GAAG,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC/D,eAAe,EAAE,eAAe,EAAE,CAAC;IACnC,IAAI,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IAChD,UAAU,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpC;AAcD;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAwB5E;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,UAAU,EAAE,GAAG,eAAe,EAAE,CAkB7E;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,UAAU,EACnB,UAAU,EAAE,eAAe,EAAE,GAC5B,UAAU,CAkBZ;AAED,yEAAyE;AACzE,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAG/E"}
+{"version":3,"file":"github-advisory.d.ts","sourceRoot":"","sources":["../../../src/intelligence/sources/github-advisory.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAQ3E,UAAU,eAAe;IACvB,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,MAAM,CAAC;KACd,CAAC;IACF,wBAAwB,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AAED,UAAU,UAAU;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,KAAK,GAAG,UAAU,GAAG,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAC/D,eAAe,EAAE,eAAe,EAAE,CAAC;IACnC,IAAI,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IAChD,UAAU,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpC;AAQD;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAyD5E;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,UAAU,EAAE,GAAG,eAAe,EAAE,CAkB7E;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,UAAU,EACnB,UAAU,EAAE,eAAe,EAAE,GAC5B,UAAU,CAkBZ;AAED,yEAAyE;AACzE,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAG/E"}

package/dist/intelligence/sources/osv.d.ts

@@ -51,6 +51,10 @@ interface OsvVulnerability {
  * Returns null if the CVE is not found in OSV.
  */
 export declare function fetchOsvVuln(cveId: string): Promise<OsvVulnerability | null>;
+/**
+ * Query OSV for all vulnerabilities affecting a specific npm package and optional version.
+ */
+export declare function queryOsvPackage(packageName: string, version?: string): Promise<OsvVulnerability[]>;
 /**
  * Parse an OSV vulnerability into autoremediator's CveDetails shape,
  * filtering affected entries to npm ecosystem only.

package/dist/intelligence/sources/osv.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"osv.d.ts","sourceRoot":"","sources":["../../../src/intelligence/sources/osv.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAmB,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAS3E,UAAU,cAAc;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,UAAU,QAAQ;IAChB,IAAI,EAAE,QAAQ,GAAG,KAAK,GAAG,WAAW,CAAC;IACrC,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,UAAU,WAAW;IACnB,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9C;AAED,UAAU,gBAAgB;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,KAAK,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;KACf,CAAC,CAAC;IACH,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAC;IACzB,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD;;;GAGG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAmBlF;AA0BD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,UAAU,CAoC/D;AAqBD,4CAA4C;AAC5C,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAI5E"}
+{"version":3,"file":"osv.d.ts","sourceRoot":"","sources":["../../../src/intelligence/sources/osv.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,EAAmB,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAS3E,UAAU,cAAc;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,UAAU,QAAQ;IAChB,IAAI,EAAE,QAAQ,GAAG,KAAK,GAAG,WAAW,CAAC;IACrC,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,UAAU,WAAW;IACnB,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC9C;AAED,UAAU,gBAAgB;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,KAAK,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;KACf,CAAC,CAAC;IACH,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAC;IACzB,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD;;;GAGG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAmBlF;AAED;;GAEG;AACH,wBAAsB,eAAe,CACnC,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAiC7B;AA0BD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,gBAAgB,GAAG,UAAU,CAoC/D;AAqBD,4CAA4C;AAC5C,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAI5E"}

package/dist/mcp/server.d.ts

@@ -8,13 +8,16 @@
  * Start: autoremediator-mcp   (stdio transport)
  */
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
-import { inspectPatchArtifact, listPatchArtifacts, planRemediation, pollJob, remediate, remediatePortfolio, remediateFromScan, submitPortfolioJob, submitRemediateJob, submitScanJob, toCycloneDxVex, updateOutdated, validatePatchArtifact } from "../api/index.js";
+import { checkReachability, evaluatePackage, inspectPatchArtifact, listPatchArtifacts, planRemediation, pollJob, remediate, remediatePortfolio, remediateFromScan, scanDelta, submitPortfolioJob, submitRemediateJob, submitScanJob, toCycloneDxVex, updateOutdated, validatePatchArtifact } from "../api/index.js";
 interface McpApiDeps {
     remediateFn: typeof remediate;
     planRemediationFn: typeof planRemediation;
     remediateFromScanFn: typeof remediateFromScan;
     remediatePortfolioFn: typeof remediatePortfolio;
     updateOutdatedFn: typeof updateOutdated;
+    checkReachabilityFn: typeof checkReachability;
+    evaluatePackageFn: typeof evaluatePackage;
+    scanDeltaFn: typeof scanDelta;
     healthFn: () => Promise<{
         status: "ok";
     }>;
@@ -41,6 +44,12 @@ export declare const TOOLS: ({
             report?: undefined;
             toolVersion?: undefined;
             jobId?: undefined;
+            cwd?: undefined;
+            symbol?: undefined;
+            packageName?: undefined;
+            version?: undefined;
+            packageManager?: undefined;
+            enrichIntelligence?: undefined;
         };
     };
 } | {
@@ -57,6 +66,12 @@ export declare const TOOLS: ({
             report?: undefined;
             toolVersion?: undefined;
             jobId?: undefined;
+            cwd?: undefined;
+            symbol?: undefined;
+            packageName?: undefined;
+            version?: undefined;
+            packageManager?: undefined;
+            enrichIntelligence?: undefined;
         };
     };
 } | {
@@ -101,6 +116,12 @@ export declare const TOOLS: ({
             report?: undefined;
             toolVersion?: undefined;
             jobId?: undefined;
+            cwd?: undefined;
+            symbol?: undefined;
+            packageName?: undefined;
+            version?: undefined;
+            packageManager?: undefined;
+            enrichIntelligence?: undefined;
         };
     };
 } | {
@@ -125,6 +146,10 @@ export declare const TOOLS: ({
             report?: undefined;
             toolVersion?: undefined;
             jobId?: undefined;
+            symbol?: undefined;
+            packageName?: undefined;
+            version?: undefined;
+            enrichIntelligence?: undefined;
         };
         required?: undefined;
     };
@@ -155,6 +180,10 @@ export declare const TOOLS: ({
             report?: undefined;
             toolVersion?: undefined;
             jobId?: undefined;
+            symbol?: undefined;
+            packageName?: undefined;
+            version?: undefined;
+            enrichIntelligence?: undefined;
         };
     };
 } | {
@@ -181,6 +210,12 @@ export declare const TOOLS: ({
                 description: string;
             };
             jobId?: undefined;
+            cwd?: undefined;
+            symbol?: undefined;
+            packageName?: undefined;
+            version?: undefined;
+            packageManager?: undefined;
+            enrichIntelligence?: undefined;
         };
     };
 } | {
@@ -219,6 +254,12 @@ export declare const TOOLS: ({
                 };
             };
             jobId?: undefined;
+            cwd?: undefined;
+            symbol?: undefined;
+            packageName?: undefined;
+            version?: undefined;
+            packageManager?: undefined;
+            enrichIntelligence?: undefined;
         };
     };
 } | {
@@ -234,6 +275,70 @@ export declare const TOOLS: ({
                 type: string;
                 description: string;
             };
+            cwd?: undefined;
+            symbol?: undefined;
+            packageName?: undefined;
+            version?: undefined;
+            packageManager?: undefined;
+            enrichIntelligence?: undefined;
+        };
+    };
+} | {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        required: string[];
+        properties: {
+            report?: undefined;
+            toolVersion?: undefined;
+            jobId?: undefined;
+            packageName: {
+                type: string;
+                description: string;
+            };
+            cwd: {
+                type: string;
+                description: "Absolute path to the project root (default: process.cwd())";
+            };
+            symbol: {
+                type: string;
+                description: string;
+            };
+            version?: undefined;
+            packageManager?: undefined;
+            enrichIntelligence?: undefined;
+        };
+    };
+} | {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        required: string[];
+        properties: {
+            report?: undefined;
+            toolVersion?: undefined;
+            jobId?: undefined;
+            cwd?: undefined;
+            symbol?: undefined;
+            packageName: {
+                type: string;
+                description: string;
+            };
+            version: {
+                type: string;
+                description: string;
+            };
+            packageManager: {
+                type: string;
+                enum: string[];
+                description: "Package manager override (auto-detected by default)";
+            };
+            enrichIntelligence: {
+                type: string;
+                description: string;
+            };
         };
     };
 })[];

package/dist/mcp/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":";AACA;;;;;;;GAOG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAInE,OAAO,EAIL,oBAAoB,EACpB,kBAAkB,EAElB,eAAe,EACf,OAAO,EACP,SAAS,EACT,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,cAAc,EACd,qBAAqB,EACtB,MAAM,iBAAiB,CAAC;AAazB,UAAU,UAAU;IAClB,WAAW,EAAE,OAAO,SAAS,CAAC;IAC9B,iBAAiB,EAAE,OAAO,eAAe,CAAC;IAC1C,mBAAmB,EAAE,OAAO,iBAAiB,CAAC;IAC9C,oBAAoB,EAAE,OAAO,kBAAkB,CAAC;IAChD,gBAAgB,EAAE,OAAO,cAAc,CAAC;IACxC,QAAQ,EAAE,MAAM,OAAO,CAAC;QAAE,MAAM,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IAC1C,oBAAoB,EAAE,OAAO,kBAAkB,CAAC;IAChD,sBAAsB,EAAE,OAAO,oBAAoB,CAAC;IACpD,uBAAuB,EAAE,OAAO,qBAAqB,CAAC;IACtD,OAAO,EAAE,OAAO,cAAc,CAAC;IAC/B,oBAAoB,EAAE,OAAO,kBAAkB,CAAC;IAChD,eAAe,EAAE,OAAO,aAAa,CAAC;IACtC,oBAAoB,EAAE,OAAO,kBAAkB,CAAC;IAChD,SAAS,EAAE,OAAO,OAAO,CAAC;CAC3B;AA8BD,eAAO,MAAM,KAAK;;;;;;;;gBAkBD,IAAI;gBAAY,WAAW;;;;;;;;;;;;;;;gBA8BvB,IAAI;gBAAY,WAAW;;;;;;;;;;;;;;;gBActC,IAAI;gBACJ,KAAK;oBACH,IAAI;oBACJ,QAAQ;oBACR,UAAU;wBACR,GAAG;4BAAI,IAAI;4BAAY,WAAW;;wBAClC,KAAK;4BAAI,IAAI;;wBACb,KAAK;4BAAI,IAAI;4BAAY,WAAW;;wBACpC,SAAS;4BAAI,IAAI;4BAAY,WAAW;;wBACxC,MAAM;4BAAI,IAAI;4BAAY,IAAI;;wBAC9B,KAAK;4BAAI,IAAI;4BAAa,WAAW;;;;;;;;;;;;;;;;;yBA9H1C,IAAI,EAAE,QAAQ;yBAAE,WAAW;;;yBACpB,IAAI,EAAE,QAAQ;yBAAE,WAAW;;;yBAEvC,IAAI,EAAE,QAAQ;yBACd,IAAI,YAAG,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;yBAC3C,WAAW;;;;;;;;;;;;;;;;yBALN,IAAI,EAAE,QAAQ;yBAAE,WAAW;;;yBACpB,IAAI,EAAE,QAAQ;yBAAE,WAAW;;;yBAEvC,IAAI,EAAE,QAAQ;yBACd,IAAI,YAAG,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;yBAC3C,WAAW;;;gBAmJU,IAAI;gBAAY,WAAW;;;;;;;;;;;;;;;;;;;;;;;gBAoC1C,IAAI;gBACJ,WAAW;;;gBAIX,IAAI;gBACJ,WAAW;;;;;;;;;;;;;;;;;;;;;;;4BA6CA,IAAI;4BAAY,WAAW;;;4BACzB,IAAI;;;4BACJ,IAAI;4BAAY,WAAW;;;4BACvB,IAAI;4BAAY,WAAW;;;;;;;;;;;;;;;;;;gBAiB5C,IAAI;gBACJ,WAAW;;;;IAMpB,CAAC;AAEF,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EAClC,IAAI,GAAE,UAAwB,GAC7B,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAwJhF;AAED,wBAAgB,eAAe,IAAI,MAAM,CAWxC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":";AACA;;;;;;;GAOG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAInE,OAAO,EACL,iBAAiB,EAIjB,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EAElB,eAAe,EACf,OAAO,EACP,SAAS,EACT,kBAAkB,EAClB,iBAAiB,EACjB,SAAS,EACT,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,cAAc,EACd,qBAAqB,EACtB,MAAM,iBAAiB,CAAC;AAazB,UAAU,UAAU;IAClB,WAAW,EAAE,OAAO,SAAS,CAAC;IAC9B,iBAAiB,EAAE,OAAO,eAAe,CAAC;IAC1C,mBAAmB,EAAE,OAAO,iBAAiB,CAAC;IAC9C,oBAAoB,EAAE,OAAO,kBAAkB,CAAC;IAChD,gBAAgB,EAAE,OAAO,cAAc,CAAC;IACxC,mBAAmB,EAAE,OAAO,iBAAiB,CAAC;IAC9C,iBAAiB,EAAE,OAAO,eAAe,CAAC;IAC1C,WAAW,EAAE,OAAO,SAAS,CAAC;IAC9B,QAAQ,EAAE,MAAM,OAAO,CAAC;QAAE,MAAM,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IAC1C,oBAAoB,EAAE,OAAO,kBAAkB,CAAC;IAChD,sBAAsB,EAAE,OAAO,oBAAoB,CAAC;IACpD,uBAAuB,EAAE,OAAO,qBAAqB,CAAC;IACtD,OAAO,EAAE,OAAO,cAAc,CAAC;IAC/B,oBAAoB,EAAE,OAAO,kBAAkB,CAAC;IAChD,eAAe,EAAE,OAAO,aAAa,CAAC;IACtC,oBAAoB,EAAE,OAAO,kBAAkB,CAAC;IAChD,SAAS,EAAE,OAAO,OAAO,CAAC;CAC3B;AAiCD,eAAO,MAAM,KAAK;;;;;;;;gBAkBD,IAAI;gBAAY,WAAW;;;;;;;;;;;;;;;;;;;;;gBA8BvB,IAAI;gBAAY,WAAW;;;;;;;;;;;;;;;;;;;;;gBActC,IAAI;gBACJ,KAAK;oBACH,IAAI;oBACJ,QAAQ;oBACR,UAAU;wBACR,GAAG;4BAAI,IAAI;4BAAY,WAAW;;wBAClC,KAAK;4BAAI,IAAI;;wBACb,KAAK;4BAAI,IAAI;4BAAY,WAAW;;wBACpC,SAAS;4BAAI,IAAI;4BAAY,WAAW;;wBACxC,MAAM;4BAAI,IAAI;4BAAY,IAAI;;wBAC9B,KAAK;4BAAI,IAAI;4BAAa,WAAW;;;;;;;;;;;;;;;;;;;;;;;yBApI1C,IAAI,EAAE,QAAQ;yBAAE,WAAW;;;yBACpB,IAAI,EAAE,QAAQ;yBAAE,WAAW;;;yBAEvC,IAAI,EAAE,QAAQ;yBACd,IAAI,YAAG,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;yBAC3C,WAAW;;;;;;;;;;;;;;;;;;;;yBALN,IAAI,EAAE,QAAQ;yBAAE,WAAW;;;yBACpB,IAAI,EAAE,QAAQ;yBAAE,WAAW;;;yBAEvC,IAAI,EAAE,QAAQ;yBACd,IAAI,YAAG,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;yBAC3C,WAAW;;;gBAyJU,IAAI;gBAAY,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;gBAoC1C,IAAI;gBACJ,WAAW;;;gBAIX,IAAI;gBACJ,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BA6CA,IAAI;4BAAY,WAAW;;;4BACzB,IAAI;;;4BACJ,IAAI;4BAAY,WAAW;;;4BACvB,IAAI;4BAAY,WAAW;;;;;;;;;;;;;;;;;;;;;;;;gBAiB5C,IAAI;gBACJ,WAAW;;;;;;;;;;;;;;;;;;;;;gBAeX,IAAI;gBACJ,WAAW;;;gBAEN,IAAI;gBAAY,WAAW;;;gBAEhC,IAAI;gBACJ,WAAW;;;;;;;;;;;;;;;;;;;;gBAcE,IAAI;gBAAY,WAAW;;;gBAC/B,IAAI;gBAAY,WAAW;;;gBAEpC,IAAI;gBACJ,IAAI;gBACJ,WAAW;;;gBAGX,IAAI;gBACJ,WAAW;;;;IA0BpB,CAAC;AAEF,wBAAsB,cAAc,CAClC,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EAClC,IAAI,GAAE,UAAwB,GAC7B,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAoMhF;AAED,wBAAgB,eAAe,IAAI,MAAM,CAWxC"}

package/dist/mcp/server.js

@@ -2,9 +2,11 @@
 import {
   OPTION_DESCRIPTIONS,
   PACKAGE_VERSION,
+  checkReachability,
   createRemediateOptionSchemaProperties,
   createScanOptionSchemaProperties,
   createUpdateOutdatedOptionSchemaProperties,
+  evaluatePackage,
   inspectPatchArtifact,
   listPatchArtifacts,
   planRemediation,
@@ -12,13 +14,14 @@ import {
   remediate,
   remediateFromScan,
   remediatePortfolio,
+  scanDelta,
   submitPortfolioJob,
   submitRemediateJob,
   submitScanJob,
   toCycloneDxVex,
   updateOutdated,
   validatePatchArtifact
-} from "../chunk-CQXNIRHT.js";
+} from "../chunk-FXOUJDQ3.js";
 
 // src/mcp/server.ts
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
@@ -40,6 +43,9 @@ var defaultDeps = {
   remediateFromScanFn: remediateFromScan,
   remediatePortfolioFn: remediatePortfolio,
   updateOutdatedFn: updateOutdated,
+  checkReachabilityFn: checkReachability,
+  evaluatePackageFn: evaluatePackage,
+  scanDeltaFn: scanDelta,
   healthFn: async () => ({ status: "ok" }),
   listPatchArtifactsFn: listPatchArtifacts,
   inspectPatchArtifactFn: inspectPatchArtifact,
@@ -252,6 +258,65 @@ var TOOLS = [
         }
       }
     }
+  },
+  {
+    name: "checkReachability",
+    description: "Scan project source files using oxc-parser AST call-graph tracing to check if a package or vulnerable symbol is reachable and invoked.",
+    inputSchema: {
+      type: "object",
+      required: ["packageName"],
+      properties: {
+        packageName: {
+          type: "string",
+          description: "Target package name to trace in project source files."
+        },
+        cwd: { type: "string", description: OPTION_DESCRIPTIONS.cwd },
+        symbol: {
+          type: "string",
+          description: "Optional specific vulnerable function or export symbol to verify in call graph."
+        }
+      }
+    }
+  },
+  {
+    name: "evaluatePackage",
+    description: "Pre-flight security evaluator for npm packages. Queries OSV, CISA KEV, and FIRST EPSS telemetry before installation.",
+    inputSchema: {
+      type: "object",
+      required: ["packageName"],
+      properties: {
+        packageName: { type: "string", description: "Package name to evaluate." },
+        version: { type: "string", description: "Optional specific package version." },
+        packageManager: {
+          type: "string",
+          enum: ["npm", "pnpm", "yarn", "bun", "deno"],
+          description: OPTION_DESCRIPTIONS.packageManager
+        },
+        enrichIntelligence: {
+          type: "boolean",
+          description: "Enrich with live CISA KEV and EPSS intelligence feeds."
+        }
+      }
+    }
+  },
+  {
+    name: "scanDelta",
+    description: "Git-aware delta vulnerability scanner. Identifies new CVEs introduced by uncommitted edits (vs HEAD) or branch differences (vs base branch).",
+    inputSchema: {
+      type: "object",
+      properties: {
+        cwd: { type: "string", description: OPTION_DESCRIPTIONS.cwd },
+        baseRef: {
+          type: "string",
+          description: "Git base reference to compare against (e.g. 'HEAD', 'origin/main'). Defaults to 'HEAD'."
+        },
+        packageManager: {
+          type: "string",
+          enum: ["npm", "pnpm", "yarn", "bun", "deno"],
+          description: OPTION_DESCRIPTIONS.packageManager
+        }
+      }
+    }
   }
 ];
 async function handleToolCall(name, args = {}, deps = defaultDeps) {
@@ -359,6 +424,40 @@ async function handleToolCall(name, args = {}, deps = defaultDeps) {
       const job = deps.pollJobFn(jobId);
       return { content: [{ type: "text", text: JSON.stringify(job, null, 2) }] };
     }
+    if (name === "checkReachability") {
+      const { packageName, cwd, symbol } = args;
+      if (!packageName || typeof packageName !== "string") {
+        return {
+          content: [
+            { type: "text", text: JSON.stringify({ error: "packageName is required (string)" }) }
+          ],
+          isError: true
+        };
+      }
+      const assessment = await deps.checkReachabilityFn({ packageName, cwd, symbol });
+      return { content: [{ type: "text", text: JSON.stringify(assessment, null, 2) }] };
+    }
+    if (name === "evaluatePackage") {
+      const { packageName, ...options } = args;
+      if (!packageName || typeof packageName !== "string") {
+        return {
+          content: [
+            { type: "text", text: JSON.stringify({ error: "packageName is required (string)" }) }
+          ],
+          isError: true
+        };
+      }
+      const report = await deps.evaluatePackageFn(
+        packageName,
+        options
+      );
+      return { content: [{ type: "text", text: JSON.stringify(report, null, 2) }] };
+    }
+    if (name === "scanDelta") {
+      const options = args;
+      const report = await deps.scanDeltaFn(options);
+      return { content: [{ type: "text", text: JSON.stringify(report, null, 2) }] };
+    }
     if (name === "toVex") {
       const { report, toolVersion } = args;
       if (!report || typeof report !== "object") {

package/dist/openapi/rbac.d.ts

@@ -2,8 +2,8 @@ import type http from "node:http";
 export type Role = "admin" | "operator" | "reader";
 export interface JwtPayload {
     sub?: string;
-    role?: Role | string;
-    roles?: Array<Role | string>;
+    role?: Role | (string & {});
+    roles?: Array<Role | (string & {})>;
     scope?: string;
     exp?: number;
     [key: string]: unknown;

package/dist/openapi/rbac.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rbac.d.ts","sourceRoot":"","sources":["../../src/openapi/rbac.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,MAAM,MAAM,IAAI,GAAG,OAAO,GAAG,UAAU,GAAG,QAAQ,CAAC;AA0BnD,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAK3E;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAyC7E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,EACb,SAAS,qBAAwC,EACjD,SAAS,qBAAwC,GAChD,IAAI,GAAG,SAAS,CA8BlB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,QAAQ,EAAE,MAAM,GACf,OAAO,CAiCT"}
+{"version":3,"file":"rbac.d.ts","sourceRoot":"","sources":["../../src/openapi/rbac.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAGlC,MAAM,MAAM,IAAI,GAAG,OAAO,GAAG,UAAU,GAAG,QAAQ,CAAC;AA0BnD,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC5B,KAAK,CAAC,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;IACpC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAK3E;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAyC7E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,EACb,SAAS,qBAAwC,EACjD,SAAS,qBAAwC,GAChD,IAAI,GAAG,SAAS,CA8BlB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,QAAQ,EAAE,MAAM,GACf,OAAO,CAiCT"}

package/dist/openapi/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/openapi/server.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,OAAO,EACP,SAAS,EACT,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,cAAc,EACd,qBAAqB,EACtB,MAAM,iBAAiB,CAAC;AAIzB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,OAAO,SAAS,CAAC;IAC9B,mBAAmB,EAAE,OAAO,iBAAiB,CAAC;IAC9C,oBAAoB,EAAE,OAAO,kBAAkB,CAAC;IAChD,iBAAiB,EAAE,OAAO,eAAe,CAAC;IAC1C,gBAAgB,EAAE,OAAO,cAAc,CAAC;IACxC,oBAAoB,EAAE,OAAO,kBAAkB,CAAC;IAChD,sBAAsB,EAAE,OAAO,oBAAoB,CAAC;IACpD,uBAAuB,EAAE,OAAO,qBAAqB,CAAC;IACtD,OAAO,EAAE,OAAO,cAAc,CAAC;IAC/B,oBAAoB,EAAE,OAAO,kBAAkB,CAAC;IAChD,eAAe,EAAE,OAAO,aAAa,CAAC;IACtC,oBAAoB,EAAE,OAAO,kBAAkB,CAAC;IAChD,SAAS,EAAE,OAAO,OAAO,CAAC;CAC3B;AAkBD,wBAAgB,mBAAmB,CAAC,IAAI,GAAE,iBAA+B,GAAG,IAAI,CAAC,MAAM,CAOtF"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/openapi/server.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,OAAO,EACP,SAAS,EACT,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,cAAc,EACd,qBAAqB,EACtB,MAAM,iBAAiB,CAAC;AAIzB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,OAAO,SAAS,CAAC;IAC9B,mBAAmB,EAAE,OAAO,iBAAiB,CAAC;IAC9C,oBAAoB,EAAE,OAAO,kBAAkB,CAAC;IAChD,iBAAiB,EAAE,OAAO,eAAe,CAAC;IAC1C,gBAAgB,EAAE,OAAO,cAAc,CAAC;IACxC,oBAAoB,EAAE,OAAO,kBAAkB,CAAC;IAChD,sBAAsB,EAAE,OAAO,oBAAoB,CAAC;IACpD,uBAAuB,EAAE,OAAO,qBAAqB,CAAC;IACtD,OAAO,EAAE,OAAO,cAAc,CAAC;IAC/B,oBAAoB,EAAE,OAAO,kBAAkB,CAAC;IAChD,eAAe,EAAE,OAAO,aAAa,CAAC;IACtC,oBAAoB,EAAE,OAAO,kBAAkB,CAAC;IAChD,SAAS,EAAE,OAAO,OAAO,CAAC;CAC3B;AAkBD,wBAAgB,mBAAmB,CAAC,IAAI,GAAE,iBAA+B,GAAG,IAAI,CAAC,MAAM,CActF"}

package/dist/openapi/server.js

@@ -18,7 +18,7 @@ import {
   toCycloneDxVex,
   updateOutdated,
   validatePatchArtifact
-} from "../chunk-CQXNIRHT.js";
+} from "../chunk-FXOUJDQ3.js";
 
 // src/openapi/server.ts
 import http from "http";
@@ -1102,11 +1102,18 @@ var defaultDeps = {
   pollJobFn: pollJob
 };
 function createOpenApiServer(deps = defaultDeps) {
-  return http.createServer(async (req, res) => {
-    if (await handleOpenApiRequest(req, res, deps)) {
-      return;
-    }
-    return sendJson(res, 404, { error: "Not found" });
+  return http.createServer((req, res) => {
+    void (async () => {
+      try {
+        if (await handleOpenApiRequest(req, res, deps)) {
+          return;
+        }
+        sendJson(res, 404, { error: "Not found" });
+      } catch (err) {
+        const message = err instanceof Error ? err.message : "Internal Server Error";
+        sendJson(res, 500, { error: message });
+      }
+    })();
   });
 }
 function isMainModule() {

package/dist/platform/package-manager/index.d.ts

@@ -20,6 +20,7 @@ export declare function detectPackageManager(cwd: string): PackageManager;
 export declare function resolveInstallCommand(pm: PackageManager, constraints?: RemediationConstraints, yarnMajor?: number): string[];
 export declare function resolveListCommand(pm: PackageManager, constraints?: RemediationConstraints): string[];
 export declare function resolveTestCommand(pm: PackageManager, constraints?: RemediationConstraints): string[];
+export declare function resolveTypecheckCommand(pm: PackageManager, constraints?: RemediationConstraints, cwd?: string): string[];
 export declare function resolveAuditCommand(pm: PackageManager, constraints?: RemediationConstraints): string[];
 export declare function resolveWhyCommand(pm: PackageManager, packageName: string, constraints?: RemediationConstraints): string[];
 export declare function resolveDedupeCommand(pm: PackageManager, constraints?: RemediationConstraints): string[];

package/dist/platform/package-manager/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/platform/package-manager/index.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAE1E,cAAc,aAAa,CAAC;AAE5B,YAAY,EAAE,cAAc,EAAE,CAAC;AAE/B,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;IACtC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQtE;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAMhE;AAkBD,wBAAgB,qBAAqB,CACnC,EAAE,EAAE,cAAc,EAClB,WAAW,CAAC,EAAE,sBAAsB,EACpC,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,EAAE,CAiDV;AAED,wBAAgB,kBAAkB,CAChC,EAAE,EAAE,cAAc,EAClB,WAAW,CAAC,EAAE,sBAAsB,GACnC,MAAM,EAAE,CAiBV;AAED,wBAAgB,kBAAkB,CAChC,EAAE,EAAE,cAAc,EAClB,WAAW,CAAC,EAAE,sBAAsB,GACnC,MAAM,EAAE,CAYV;AAED,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,cAAc,EAClB,WAAW,CAAC,EAAE,sBAAsB,GACnC,MAAM,EAAE,CAQV;AAED,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,cAAc,EAClB,WAAW,EAAE,MAAM,EACnB,WAAW,CAAC,EAAE,sBAAsB,GACnC,MAAM,EAAE,CAQV;AAED,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,cAAc,EAClB,WAAW,CAAC,EAAE,sBAAsB,GACnC,MAAM,EAAE,CAIV;AAED,wBAAgB,yBAAyB,CAAC,EAAE,EAAE,cAAc,GAAG,sBAAsB,CA0DpF;AAED,wBAAgB,eAAe,CAAC,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAEvF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/platform/package-manager/index.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAE1E,cAAc,aAAa,CAAC;AAE5B,YAAY,EAAE,cAAc,EAAE,CAAC;AAE/B,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;IACtC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQtE;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAMhE;AAkBD,wBAAgB,qBAAqB,CACnC,EAAE,EAAE,cAAc,EAClB,WAAW,CAAC,EAAE,sBAAsB,EACpC,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,EAAE,CAiDV;AAED,wBAAgB,kBAAkB,CAChC,EAAE,EAAE,cAAc,EAClB,WAAW,CAAC,EAAE,sBAAsB,GACnC,MAAM,EAAE,CAiBV;AAED,wBAAgB,kBAAkB,CAChC,EAAE,EAAE,cAAc,EAClB,WAAW,CAAC,EAAE,sBAAsB,GACnC,MAAM,EAAE,CAYV;AAED,wBAAgB,uBAAuB,CACrC,EAAE,EAAE,cAAc,EAClB,WAAW,CAAC,EAAE,sBAAsB,EACpC,GAAG,GAAE,MAAsB,GAC1B,MAAM,EAAE,CAgCV;AAGD,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,cAAc,EAClB,WAAW,CAAC,EAAE,sBAAsB,GACnC,MAAM,EAAE,CAQV;AAED,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,cAAc,EAClB,WAAW,EAAE,MAAM,EACnB,WAAW,CAAC,EAAE,sBAAsB,GACnC,MAAM,EAAE,CAQV;AAED,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,cAAc,EAClB,WAAW,CAAC,EAAE,sBAAsB,GACnC,MAAM,EAAE,CAIV;AAED,wBAAgB,yBAAyB,CAAC,EAAE,EAAE,cAAc,GAAG,sBAAsB,CA0DpF;AAED,wBAAgB,eAAe,CAAC,EAAE,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAEvF"}

package/dist/platform/supply-chain.d.ts

@@ -0,0 +1,10 @@
+import type { SupplyChainPolicy } from "./types.js";
+export interface PackageTrustVerdict {
+    trusted: boolean;
+    reason?: string;
+    publishAgeHours?: number;
+    hasInstallScripts?: boolean;
+    hasProvenance?: boolean;
+}
+export declare function verifyPackageTrust(packageName: string, targetVersion: string, policy?: SupplyChainPolicy): Promise<PackageTrustVerdict>;
+//# sourceMappingURL=supply-chain.d.ts.map

package/dist/platform/supply-chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supply-chain.d.ts","sourceRoot":"","sources":["../../src/platform/supply-chain.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAuBD,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,EACrB,MAAM,CAAC,EAAE,iBAAiB,GACzB,OAAO,CAAC,mBAAmB,CAAC,CAiF9B"}

package/dist/platform/supply-chain.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=supply-chain.test.d.ts.map

package/dist/platform/supply-chain.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"supply-chain.test.d.ts","sourceRoot":"","sources":["../../src/platform/supply-chain.test.ts"],"names":[],"mappings":""}