autoremediator 0.17.0 → 0.18.0

package/README.md

@@ -43,7 +43,8 @@ Autoremediator selects the safest applicable fix strategy for each vulnerability
 
 - **Direct version upgrade** — the preferred path when a safe fixed version exists in the direct dependency graph
 - **Transitive override** — applied when exposure is in a transitive dependency and a direct upgrade is not feasible
-- **Controlled patch generation** — a confidence-scored fallback when no safe fixed version exists; produces auditable patch artifacts tracked through their full lifecycle
+- **Controlled patch generation** — a confidence-scored fallback when no safe fixed version exists; produces auditable patch artifacts tracked through their full lifecycle with synthesized reproduction tests
+- **Upstream patch reconciliation** — detects when upstream package releases supersede local patch files and safely retires them (`patches reconcile`)
 
 Unresolved findings are never silently dropped. Each one is classified with an explicit reason and treated as an escalation input for downstream security workflows.
 

package/dist/api/change-request/index.d.ts

@@ -1,4 +1,5 @@
-import type { ChangeRequestOptions, ChangeRequestResult, RemediationReport } from "../../platform/types.js";
+import type { ChangeRequestGrouping, ChangeRequestOptions, ChangeRequestResult, RemediationReport } from "../../platform/types.js";
+export declare function groupReports(reports: RemediationReport[], grouping: ChangeRequestGrouping): RemediationReport[][];
 export declare function createChangeRequestsForReports(params: {
     cwd: string;
     options: ChangeRequestOptions;

package/dist/api/change-request/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/change-request/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,yBAAyB,CAAC;AAgJjC,wBAAsB,8BAA8B,CAAC,MAAM,EAAE;IAC3D,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,oBAAoB,CAAC;IAC9B,OAAO,EAAE,iBAAiB,EAAE,CAAC;CAC9B,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAmGjC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/change-request/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,yBAAyB,CAAC;AAsDjC,wBAAgB,YAAY,CAC1B,OAAO,EAAE,iBAAiB,EAAE,EAC5B,QAAQ,EAAE,qBAAqB,GAC9B,iBAAiB,EAAE,EAAE,CAgDvB;AA8FD,wBAAsB,8BAA8B,CAAC,MAAM,EAAE;IAC3D,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,oBAAoB,CAAC;IAC9B,OAAO,EAAE,iBAAiB,EAAE,CAAC;CAC9B,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CA+GjC"}

package/dist/api/index.d.ts

@@ -5,14 +5,14 @@
  *   import { remediate } from 'autoremediator';
  *   const report = await remediate('CVE-2021-23337', { cwd: '/my/project' });
  */
-export type { CorrelationContext, CveSeverity, LlmUsageMetrics, ModelPersonality, RemediationConstraints, ProvenanceContext, ProgressEvent, ProviderSafetyProfile, RemediateOptions, RemediationReport, ResultSimulation, CveDetails, AffectedPackage, InventoryPackage, VulnerablePackage, PatchResult, PatchStrategy, PatchStrategyCounts, DependencyScope, DependencyScopeCounts, PatchArtifact, PatchArtifactInspection, PatchArtifactQueryOptions, PatchArtifactSummary, PatchArtifactValidationReport, PatchMode, PatchRiskLevel, PatchConfidenceThresholds, UnresolvedReason, UnresolvedReasonCounts, EscalationAction, EscalationGraph, EscalationCounts, Disposition, DispositionPolicy, DispositionSignals, DispositionCounts, PatchValidationPhase, PatchValidationPhaseName, PortfolioReport, PortfolioTarget, PortfolioTargetResult, OutdatedPackage, UpdateOutdatedOptions, UpdateOutdatedReport, ExploitSignalOverridePolicy, VexJustification, VexSuppression, SlaPolicy, SlaBreach, SlaBreachEntry, SlaBreachSummary, ReachabilityAssessment, ReachabilityEvidence, SbomEntry, SbomStatus, SimulationMutation, SimulationMutationTarget, SimulationRebuttalCode, SimulationRebuttalFinding, SimulationSummary, CheckReachabilityOptions, EvaluatePackageOptions, PackageEvaluationReport, VulnerabilityEvaluationEntry, DeltaDependencyChange, DeltaFinding, DeltaScanOptions, DeltaScanReport, } from "../platform/types.js";
+export type { CorrelationContext, CveSeverity, LlmUsageMetrics, ModelPersonality, RemediationConstraints, ProvenanceContext, ProgressEvent, ProviderSafetyProfile, RemediateOptions, RemediationReport, ResultSimulation, CveDetails, AffectedPackage, InventoryPackage, VulnerablePackage, PatchResult, PatchStrategy, PatchStrategyCounts, DependencyScope, DependencyScopeCounts, PatchArtifact, PatchArtifactInspection, PatchArtifactQueryOptions, PatchArtifactSummary, PatchArtifactValidationReport, PatchReconcileOptions, PatchReconcileResult, PatchReconcileReport, PatchMode, PatchRiskLevel, PatchConfidenceThresholds, UnresolvedReason, UnresolvedReasonCounts, EscalationAction, EscalationGraph, EscalationCounts, Disposition, DispositionPolicy, DispositionSignals, DispositionCounts, PatchValidationPhase, PatchValidationPhaseName, PortfolioReport, PortfolioTarget, PortfolioTargetResult, OutdatedPackage, UpdateOutdatedOptions, UpdateOutdatedReport, ExploitSignalOverridePolicy, VexJustification, VexSuppression, SlaPolicy, SlaBreach, SlaBreachEntry, SlaBreachSummary, ReachabilityAssessment, ReachabilityEvidence, SbomEntry, SbomStatus, SimulationMutation, SimulationMutationTarget, SimulationRebuttalCode, SimulationRebuttalFinding, SimulationSummary, CheckReachabilityOptions, EvaluatePackageOptions, PackageEvaluationReport, VulnerabilityEvaluationEntry, DeltaDependencyChange, DeltaFinding, DeltaScanOptions, DeltaScanReport, } from "../platform/types.js";
 export type { ScanInputFormat } from "../scanner/index.js";
 export type { ScanOptions, ScanReport, CiSummary } from "./contracts.js";
 export { PACKAGE_MANAGER_VALUES, LLM_PROVIDER_VALUES, PROVENANCE_SOURCE_VALUES, OPTION_DESCRIPTIONS, createConstraintSchemaProperties, createRemediateOptionSchemaProperties, createScanOptionSchemaProperties, createScanReportSchemaProperties, createUpdateOutdatedOptionSchemaProperties, } from "./options-schema.js";
 export { toCiSummary, ciExitCode, buildSlaBreachSummary, buildStrategyCounts, buildDependencyScopeCounts, } from "./reporting.js";
 export { toSarifOutput, type SarifOutput } from "./sarif.js";
 export { toCycloneDxVex, type CycloneDxVexDocument, type CycloneDxVexVulnerability, type CycloneDxVexVulnerabilityAnalysis, type ToCycloneDxVexOptions, } from "./vex/index.js";
-export { inspectPatchArtifact, listPatchArtifacts, validatePatchArtifact, } from "./patches/index.js";
+export { inspectPatchArtifact, listPatchArtifacts, validatePatchArtifact, reconcilePatchArtifacts, } from "./patches/index.js";
 export { remediatePortfolio } from "./portfolio/index.js";
 export { remediate, planRemediation } from "./remediate/index.js";
 export { remediateFromScan } from "./remediate-from-scan/index.js";

package/dist/api/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,YAAY,EACV,kBAAkB,EAClB,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,sBAAsB,EACtB,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,aAAa,EACb,uBAAuB,EACvB,yBAAyB,EACzB,oBAAoB,EACpB,6BAA6B,EAC7B,SAAS,EACT,cAAc,EACd,yBAAyB,EACzB,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,wBAAwB,EACxB,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,2BAA2B,EAC3B,gBAAgB,EAChB,cAAc,EACd,SAAS,EACT,SAAS,EACT,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,SAAS,EACT,UAAU,EACV,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,EACjB,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,4BAA4B,EAC5B,qBAAqB,EACrB,YAAY,EACZ,gBAAgB,EAChB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEzE,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,EACnB,gCAAgC,EAChC,qCAAqC,EACrC,gCAAgC,EAChC,gCAAgC,EAChC,0CAA0C,GAC3C,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,WAAW,EACX,UAAU,EACV,qBAAqB,EACrB,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EACL,cAAc,EACd,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,iCAAiC,EACtC,KAAK,qBAAqB,GAC3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,OAAO,EACP,KAAK,SAAS,EACd,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,YAAY,EACV,kBAAkB,EAClB,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,sBAAsB,EACtB,iBAAiB,EACjB,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,aAAa,EACb,uBAAuB,EACvB,yBAAyB,EACzB,oBAAoB,EACpB,6BAA6B,EAC7B,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,SAAS,EACT,cAAc,EACd,yBAAyB,EACzB,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,wBAAwB,EACxB,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,2BAA2B,EAC3B,gBAAgB,EAChB,cAAc,EACd,SAAS,EACT,SAAS,EACT,cAAc,EACd,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,SAAS,EACT,UAAU,EACV,kBAAkB,EAClB,wBAAwB,EACxB,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,EACjB,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,4BAA4B,EAC5B,qBAAqB,EACrB,YAAY,EACZ,gBAAgB,EAChB,eAAe,GAChB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEzE,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,wBAAwB,EACxB,mBAAmB,EACnB,gCAAgC,EAChC,qCAAqC,EACrC,gCAAgC,EAChC,gCAAgC,EAChC,0CAA0C,GAC3C,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,WAAW,EACX,UAAU,EACV,qBAAqB,EACrB,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EACL,cAAc,EACd,KAAK,oBAAoB,EACzB,KAAK,yBAAyB,EAC9B,KAAK,iCAAiC,EACtC,KAAK,qBAAqB,GAC3B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,OAAO,EACP,KAAK,SAAS,EACd,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,iBAAiB,CAAC"}

package/dist/api/patches/index.d.ts

@@ -1,3 +1,4 @@
 export { listPatchArtifacts, inspectPatchArtifact } from "./inspection.js";
 export { validatePatchArtifact } from "./validation.js";
+export { reconcilePatchArtifacts } from "./reconcile.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/api/patches/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/patches/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/patches/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/api/patches/reconcile.d.ts

@@ -0,0 +1,7 @@
+import type { PatchReconcileOptions, PatchReconcileReport } from "../../platform/types.js";
+/**
+ * Reconciles active patch artifacts in patchesDir against upstream registries.
+ * If safe upstream releases have been published, the patches can be retired and packages upgraded.
+ */
+export declare function reconcilePatchArtifacts(options?: PatchReconcileOptions): Promise<PatchReconcileReport>;
+//# sourceMappingURL=reconcile.d.ts.map

package/dist/api/patches/reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile.d.ts","sourceRoot":"","sources":["../../../src/api/patches/reconcile.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,qBAAqB,EACrB,oBAAoB,EAErB,MAAM,yBAAyB,CAAC;AAGjC;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,oBAAoB,CAAC,CAqK/B"}

package/dist/api/patches/reconcile.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=reconcile.test.d.ts.map

package/dist/api/patches/reconcile.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile.test.d.ts","sourceRoot":"","sources":["../../../src/api/patches/reconcile.test.ts"],"names":[],"mappings":""}

package/dist/api/remediate/validators.d.ts

@@ -1,2 +1,5 @@
+export declare const CVE_ID_REGEX: RegExp;
+export declare const GHSA_ID_REGEX: RegExp;
+export declare function isVulnerabilityId(id: string): boolean;
 export declare function assertValidCveId(cveId: string): void;
 //# sourceMappingURL=validators.d.ts.map

package/dist/api/remediate/validators.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validators.d.ts","sourceRoot":"","sources":["../../../src/api/remediate/validators.ts"],"names":[],"mappings":"AAAA,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAMpD"}
+{"version":3,"file":"validators.d.ts","sourceRoot":"","sources":["../../../src/api/remediate/validators.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,YAAY,QAAyB,CAAC;AACnD,eAAO,MAAM,aAAa,QAAgD,CAAC;AAE3E,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAErD;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAMpD"}