autoremediator 0.17.0 → 0.19.0

package/dist/index.js

@@ -65,7 +65,10 @@ var OPTION_DESCRIPTIONS = {
   campaignMode: "Enable portfolio campaign mode to risk-rank targets before execution",
   escalationGraph: "Optional mapping from unresolved reasons to intended escalation actions",
   offlineIntelligence: "Skip all network calls to intelligence sources. Only local inventory and npm-registry version resolution proceed.",
-  intelligenceSnapshotPath: "Path to a local JSON snapshot of pre-fetched CVE intelligence (keyed by CVE ID) used when offline mode is active."
+  intelligenceSnapshotPath: "Path to a local JSON snapshot of pre-fetched CVE intelligence (keyed by CVE ID) used when offline mode is active.",
+  proofOfFix: "If true, enforce dual-stage exploit reproduction proof-of-fix verification (assert failure pre-patch, assert pass post-patch)",
+  requireProofOfFix: "If true, reject patches and roll back if proof-of-fix verification fails",
+  breakingChangeRefactor: "If true, attempt agentic call-site refactoring when major version upgrades introduce breaking API changes"
 };
 function createConstraintSchemaProperties() {
   return {
@@ -87,7 +90,12 @@ function createConstraintSchemaProperties() {
       type: "boolean",
       description: OPTION_DESCRIPTIONS.enforceFrozenLockfile
     },
-    workspace: { type: "string", description: OPTION_DESCRIPTIONS.workspace }
+    workspace: { type: "string", description: OPTION_DESCRIPTIONS.workspace },
+    requireProofOfFix: { type: "boolean", description: OPTION_DESCRIPTIONS.requireProofOfFix },
+    enableBreakingChangeRefactor: {
+      type: "boolean",
+      description: OPTION_DESCRIPTIONS.breakingChangeRefactor
+    }
   };
 }
 function createRemediateOptionSchemaProperties(options) {
@@ -306,6 +314,14 @@ function createRemediateOptionSchemaProperties(options) {
         "validation-failed": {
           type: "string",
           enum: ["open-issue", "notify-channel", "create-draft-pr", "hold-branch", "none"]
+        },
+        "proof-of-fix-failed": {
+          type: "string",
+          enum: ["open-issue", "notify-channel", "create-draft-pr", "hold-branch", "none"]
+        },
+        "breaking-change-unresolved": {
+          type: "string",
+          enum: ["open-issue", "notify-channel", "create-draft-pr", "hold-branch", "none"]
         }
       },
       additionalProperties: false
@@ -314,6 +330,12 @@ function createRemediateOptionSchemaProperties(options) {
     intelligenceSnapshotPath: {
       type: "string",
       description: OPTION_DESCRIPTIONS.intelligenceSnapshotPath
+    },
+    proofOfFix: { type: "boolean", description: OPTION_DESCRIPTIONS.proofOfFix },
+    requireProofOfFix: { type: "boolean", description: OPTION_DESCRIPTIONS.requireProofOfFix },
+    breakingChangeRefactor: {
+      type: "boolean",
+      description: OPTION_DESCRIPTIONS.breakingChangeRefactor
     }
   };
 }
@@ -887,12 +909,12 @@ import { readdir, readFile as readFile2, stat } from "fs/promises";
 import { join as join5 } from "path";
 
 // src/remediation/strategies/patch-utils.ts
-import { existsSync as existsSync3, mkdirSync, writeFileSync, readFileSync as readFileSync2 } from "fs";
+import { existsSync as existsSync3, mkdirSync, writeFileSync, readFileSync as readFileSync3 } from "fs";
 import { join as join4 } from "path";
 import { execa as execa2 } from "execa";
 
 // src/platform/package-manager/index.ts
-import { existsSync as existsSync2 } from "fs";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
 import { join as join3 } from "path";
 import { execa } from "execa";
 
@@ -1085,6 +1107,32 @@ function resolveTestCommand(pm, constraints) {
   const base = pm === "pnpm" ? ["pnpm", "test"] : pm === "yarn" ? ["yarn", "test"] : pm === "bun" ? ["bun", "test"] : pm === "deno" ? ["deno", "test"] : ["npm", "test"];
   return withWorkspace(base, pm, constraints?.workspace);
 }
+function resolveTypecheckCommand(pm, constraints, cwd = process.cwd()) {
+  const pkgJsonPath = join3(cwd, "package.json");
+  let hasTypecheckScript = false;
+  const hasTsConfig = existsSync2(join3(cwd, "tsconfig.json"));
+  if (existsSync2(pkgJsonPath)) {
+    try {
+      const pkg = JSON.parse(readFileSync2(pkgJsonPath, "utf8"));
+      if (pkg.scripts?.typecheck) {
+        hasTypecheckScript = true;
+      }
+    } catch {
+    }
+  }
+  if (hasTypecheckScript) {
+    const base = [pm, "run", "typecheck"];
+    return withWorkspace(base, pm, constraints?.workspace);
+  }
+  if (hasTsConfig) {
+    if (pm === "deno") {
+      return withWorkspace(["deno", "check"], pm, constraints?.workspace);
+    }
+    const base = ["npx", "tsc", "--noEmit"];
+    return withWorkspace(base, pm, constraints?.workspace);
+  }
+  return [];
+}
 function resolveAuditCommand(pm, constraints) {
   if (pm === "deno") {
     throw new Error(
@@ -1329,12 +1377,12 @@ function defineTool(config) {
 
 // src/remediation/tools/check-inventory.ts
 import { z } from "zod";
-import { readFileSync as readFileSync4 } from "fs";
-import { join as join7 } from "path";
+import { readFileSync as readFileSync6 } from "fs";
+import { join as join8 } from "path";
 import { execa as execa3 } from "execa";
 
 // src/platform/policy.ts
-import { existsSync as existsSync6, readFileSync as readFileSync3 } from "fs";
+import { existsSync as existsSync6, readFileSync as readFileSync4 } from "fs";
 import { join as join6 } from "path";
 import { parse as yamlParse } from "yaml";
 var DEFAULT_POLICY = {
@@ -1369,7 +1417,7 @@ function loadPolicy(cwd, explicitPath) {
   const candidate = explicitPath ?? join6(cwd, ".github", "autoremediator.yml");
   if (!existsSync6(candidate)) return DEFAULT_POLICY;
   try {
-    const parsed = yamlParse(readFileSync3(candidate, "utf8"));
+    const parsed = yamlParse(readFileSync4(candidate, "utf8"));
     return {
       allowMajorBumps: parsed.allowMajorBumps ?? DEFAULT_POLICY.allowMajorBumps,
       denyPackages: parsed.denyPackages ?? DEFAULT_POLICY.denyPackages,
@@ -1430,7 +1478,7 @@ function isActiveSuppression(suppression) {
 }
 function loadSuppressionsFile(filePath) {
   try {
-    const content = readFileSync3(filePath, "utf8");
+    const content = readFileSync4(filePath, "utf8");
     const parsed = yamlParse(content);
     return Array.isArray(parsed?.suppressions) ? parsed.suppressions : [];
   } catch {
@@ -1456,6 +1504,140 @@ function checkSlaBreach(cveId, severity, publishedAt, slaPolicy) {
   };
 }
 
+// src/platform/workspace.ts
+import { existsSync as existsSync7, readdirSync, readFileSync as readFileSync5, statSync } from "fs";
+import { join as join7, resolve as resolve2, relative } from "path";
+import yaml from "yaml";
+function findWorkspaceRoot(startDir) {
+  let curr = resolve2(startDir);
+  while (true) {
+    if (existsSync7(join7(curr, "pnpm-workspace.yaml"))) return curr;
+    const pkgPath = join7(curr, "package.json");
+    if (existsSync7(pkgPath)) {
+      try {
+        const parsed = JSON.parse(readFileSync5(pkgPath, "utf8"));
+        if (parsed.workspaces) return curr;
+      } catch {
+      }
+    }
+    const parent = resolve2(curr, "..");
+    if (parent === curr) break;
+    curr = parent;
+  }
+  return null;
+}
+function findWorkspacePackages(cwd) {
+  const rootCwd = findWorkspaceRoot(cwd) ?? resolve2(cwd);
+  const packages = [];
+  const packageGlobs = [];
+  const pnpmWorkspaceFile = join7(rootCwd, "pnpm-workspace.yaml");
+  if (existsSync7(pnpmWorkspaceFile)) {
+    try {
+      const content = readFileSync5(pnpmWorkspaceFile, "utf8");
+      const parsed = yaml.parse(content);
+      if (Array.isArray(parsed?.packages)) {
+        packageGlobs.push(...parsed.packages);
+      }
+    } catch {
+    }
+  }
+  const rootPkgFile = join7(rootCwd, "package.json");
+  if (existsSync7(rootPkgFile)) {
+    try {
+      const rootPkg = JSON.parse(readFileSync5(rootPkgFile, "utf8"));
+      if (Array.isArray(rootPkg.workspaces)) {
+        packageGlobs.push(...rootPkg.workspaces);
+      } else if (Array.isArray(rootPkg.workspaces?.packages)) {
+        packageGlobs.push(...rootPkg.workspaces.packages);
+      }
+    } catch {
+    }
+  }
+  const denoJsonFile = join7(rootCwd, "deno.json");
+  if (existsSync7(denoJsonFile)) {
+    try {
+      const denoJson = JSON.parse(readFileSync5(denoJsonFile, "utf8"));
+      if (Array.isArray(denoJson.workspace)) {
+        packageGlobs.push(...denoJson.workspace);
+      }
+    } catch {
+    }
+  }
+  if (packageGlobs.length === 0) {
+    return packages;
+  }
+  const seenDirs = /* @__PURE__ */ new Set();
+  for (const glob of packageGlobs) {
+    const cleanGlob = glob.trim().replace(/\/+$/, "");
+    if (!cleanGlob || cleanGlob.startsWith("!")) continue;
+    if (cleanGlob.endsWith("/*")) {
+      const parentDir = join7(rootCwd, cleanGlob.slice(0, -2));
+      if (!existsSync7(parentDir)) continue;
+      try {
+        const entries = readdirSync(parentDir);
+        for (const entry of entries) {
+          if (entry.startsWith(".") || entry === "node_modules") continue;
+          const subDir = join7(parentDir, entry);
+          try {
+            if (statSync(subDir).isDirectory()) {
+              addWorkspacePackage(rootCwd, subDir, packages, seenDirs);
+            }
+          } catch {
+          }
+        }
+      } catch {
+      }
+    } else {
+      const directDir = join7(rootCwd, cleanGlob);
+      if (existsSync7(directDir)) {
+        try {
+          if (statSync(directDir).isDirectory()) {
+            addWorkspacePackage(rootCwd, directDir, packages, seenDirs);
+          }
+        } catch {
+        }
+      }
+    }
+  }
+  return packages;
+}
+function addWorkspacePackage(rootCwd, dir, out, seen) {
+  const norm = resolve2(dir);
+  if (seen.has(norm)) return;
+  seen.add(norm);
+  const manifestPath = join7(dir, "package.json");
+  if (!existsSync7(manifestPath)) return;
+  try {
+    const content = readFileSync5(manifestPath, "utf8");
+    const manifest = JSON.parse(content);
+    out.push({
+      name: manifest.name ?? relative(rootCwd, dir),
+      relativeDir: relative(rootCwd, dir),
+      absoluteDir: norm,
+      manifestPath,
+      manifest
+    });
+  } catch {
+  }
+}
+function findDeclaringWorkspacePackage(cwd, dependencyName, filterWorkspace) {
+  const workspaces = findWorkspacePackages(cwd);
+  if (workspaces.length === 0) return null;
+  const matchesFilter = (wp) => {
+    if (!filterWorkspace) return true;
+    const filter = filterWorkspace.trim();
+    return wp.name === filter || wp.relativeDir === filter || wp.relativeDir.replace(/\\/g, "/") === filter.replace(/\\/g, "/");
+  };
+  for (const wp of workspaces) {
+    if (!matchesFilter(wp)) continue;
+    const isDeclared = Boolean(wp.manifest.dependencies?.[dependencyName]) || Boolean(wp.manifest.devDependencies?.[dependencyName]) || Boolean(wp.manifest.peerDependencies?.[dependencyName]);
+    if (isDeclared) {
+      return wp;
+    }
+  }
+  return null;
+}
+
 // src/remediation/tools/check-inventory.ts
 var checkInventoryTool = defineTool({
   description: "Read the project's package.json and installed dependencies to list packages and exact versions. Must be called before checking version matches.",
@@ -1473,7 +1655,7 @@ var checkInventoryTool = defineTool({
   }) => {
     let pkgJson;
     try {
-      pkgJson = JSON.parse(readFileSync4(join7(cwd, "package.json"), "utf8"));
+      pkgJson = JSON.parse(readFileSync6(join8(cwd, "package.json"), "utf8"));
     } catch {
       return {
         packages: [],
@@ -1505,7 +1687,8 @@ var checkInventoryTool = defineTool({
     }
     const packages = [];
     for (const [name, version] of installedVersions.entries()) {
-      const isDirect = Boolean(pkgJson.dependencies?.[name]) || Boolean(pkgJson.devDependencies?.[name]) || Boolean(pkgJson.peerDependencies?.[name]);
+      const declaringWorkspace = findDeclaringWorkspacePackage(cwd, name, workspace);
+      const isDirect = Boolean(pkgJson.dependencies?.[name]) || Boolean(pkgJson.devDependencies?.[name]) || Boolean(pkgJson.peerDependencies?.[name]) || Boolean(declaringWorkspace);
       packages.push({
         name,
         version,
@@ -1628,173 +1811,14 @@ async function validatePatchArtifact(patchFilePath, options = {}) {
   };
 }
 
-// src/platform/config.ts
-function resolveProvider(options = {}) {
-  const raw = options.llmProvider ?? process.env.AUTOREMEDIATOR_LLM_PROVIDER ?? "remote";
-  if (raw !== "remote" && raw !== "local") {
-    throw new Error(
-      `Unsupported LLM provider "${raw}". Set AUTOREMEDIATOR_LLM_PROVIDER to "remote" or "local".`
-    );
-  }
-  return raw;
-}
-function resolveModelName(provider, options = {}, routing = {}) {
-  if (options.model) return options.model;
-  if (process.env.AUTOREMEDIATOR_MODEL) return process.env.AUTOREMEDIATOR_MODEL;
-  const cwd = options.cwd ?? process.cwd();
-  const policy = loadPolicy(cwd, options.policy);
-  const providerEnvModel = provider === "remote" ? process.env.AUTOREMEDIATOR_MODEL_REMOTE : process.env.AUTOREMEDIATOR_MODEL_LOCAL;
-  if (providerEnvModel) return providerEnvModel;
-  const policyPinnedModel = provider === "remote" ? policy.modelDefaults?.remote : policy.modelDefaults?.local;
-  if (policyPinnedModel) return policyPinnedModel;
-  const defaults = {
-    remote: "remote-default",
-    local: "local"
-  };
-  const routingEnabled = options.dynamicModelRouting ?? policy.dynamicModelRouting ?? false;
-  const threshold = options.dynamicRoutingThresholdChars ?? policy.dynamicRoutingThresholdChars ?? 18e3;
-  if (provider === "remote" && routingEnabled && typeof routing.inputChars === "number" && routing.inputChars >= threshold) {
-    return process.env.AUTOREMEDIATOR_MODEL_REMOTE_LARGE ?? "remote-large";
-  }
-  return defaults[provider];
-}
-async function loadRemoteFactory() {
-  const moduleName = process.env.AUTOREMEDIATOR_REMOTE_CLIENT_MODULE;
-  const exportName = process.env.AUTOREMEDIATOR_REMOTE_CLIENT_FACTORY ?? "createRemoteClient";
-  if (!moduleName) {
-    throw new Error(
-      "AUTOREMEDIATOR_REMOTE_CLIENT_MODULE is required for remote provider model loading."
-    );
-  }
-  if (moduleName.startsWith("./") || moduleName.startsWith("../") || moduleName.startsWith("/") || moduleName.startsWith("file:")) {
-    throw new Error(
-      `AUTOREMEDIATOR_REMOTE_CLIENT_MODULE must be a package name, not a file path: ${moduleName}`
-    );
-  }
-  const loaded = await import(moduleName);
-  const factory = loaded[exportName];
-  if (typeof factory !== "function") {
-    throw new Error(
-      `Remote client factory "${exportName}" was not found in module "${moduleName}".`
-    );
-  }
-  return factory;
-}
-async function createModel(options = {}, routing = {}) {
-  const provider = resolveProvider(options);
-  if (provider === "local") {
-    throw new Error(
-      "Local provider does not create a language model. Use the deterministic pipeline path instead."
-    );
-  }
-  const apiKey = process.env.AUTOREMEDIATOR_REMOTE_API_KEY;
-  if (!apiKey) {
-    throw new Error(
-      "AUTOREMEDIATOR_REMOTE_API_KEY environment variable is required for remote provider."
-    );
-  }
-  const modelName = resolveModelName(provider, options, routing);
-  const createRemoteClient = await loadRemoteFactory();
-  const remoteClient = createRemoteClient({ apiKey });
-  return remoteClient(modelName);
-}
-function getPatchConfidenceThreshold(provider, safetyProfile = "relaxed", riskLevel = "medium", overrides) {
-  const relaxed = {
-    remote: { low: 0.65, medium: 0.7, high: 0.8 },
-    local: { low: 0.65, medium: 0.7, high: 0.8 }
-  };
-  const strict = {
-    remote: { low: 0.8, medium: 0.85, high: 0.9 },
-    local: { low: 0.8, medium: 0.85, high: 0.9 }
-  };
-  const baseThreshold = safetyProfile === "strict" ? strict[provider][riskLevel] : relaxed[provider][riskLevel];
-  const override = overrides?.[riskLevel];
-  if (typeof override === "number" && Number.isFinite(override)) {
-    return Math.max(0, Math.min(1, override));
-  }
-  return baseThreshold;
-}
-function estimateModelCostUsd(params) {
-  const inputTokens = params.promptChars / 4;
-  const outputTokens = params.completionChars / 4;
-  const pricePerThousand = params.provider === "remote" ? { input: 6e-3, output: 0.02 } : { input: 0, output: 0 };
-  return inputTokens / 1e3 * pricePerThousand.input + outputTokens / 1e3 * pricePerThousand.output;
-}
-function getNvdConfig() {
-  return {
-    apiKey: process.env.AUTOREMEDIATOR_NVD_API_KEY
-  };
-}
-function getGitHubToken() {
-  return process.env.GITHUB_TOKEN;
-}
-function getIntelligenceSourceConfig() {
-  return {
-    gitLabAdvisoryApi: process.env.AUTOREMEDIATOR_GITLAB_ADVISORY_API ?? "https://advisories.gitlab.com/api/v1/advisories",
-    certCcSearchUrl: process.env.AUTOREMEDIATOR_CERTCC_SEARCH_URL ?? "https://www.kb.cert.org/vuls/search",
-    epssApi: process.env.AUTOREMEDIATOR_EPSS_API ?? "https://api.first.org/data/v1/epss",
-    cveServicesApi: process.env.AUTOREMEDIATOR_CVE_SERVICES_API ?? "https://cveawg.mitre.org/api/cve",
-    depsDevApi: process.env.AUTOREMEDIATOR_DEPSDEV_API ?? "https://api.deps.dev/v3",
-    scorecardApi: process.env.AUTOREMEDIATOR_SCORECARD_API ?? "https://api.securityscorecards.dev",
-    vendorAdvisoryFeeds: (process.env.AUTOREMEDIATOR_VENDOR_ADVISORY_FEEDS ?? "").split(",").map((v) => v.trim()).filter(Boolean),
-    commercialFeeds: (process.env.AUTOREMEDIATOR_COMMERCIAL_FEEDS ?? "").split(",").map((v) => v.trim()).filter(Boolean),
-    commercialFeedToken: process.env.AUTOREMEDIATOR_COMMERCIAL_FEED_TOKEN
-  };
-}
-
-// src/platform/idempotency.ts
-import { existsSync as existsSync7, mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "fs";
-import { join as join8 } from "path";
-var DEFAULT_INDEX = {
-  schemaVersion: "1.0",
-  entries: {}
-};
-function indexFilePath(cwd) {
-  return join8(cwd, ".autoremediator", "state", "idempotency.json");
-}
-function entryKey(idempotencyKey, cveId) {
-  return `${idempotencyKey}::${cveId.toUpperCase()}`;
-}
-function loadIndex(cwd) {
-  const filePath = indexFilePath(cwd);
-  if (!existsSync7(filePath)) return DEFAULT_INDEX;
-  try {
-    const parsed = JSON.parse(readFileSync5(filePath, "utf8"));
-    if (parsed && parsed.schemaVersion === "1.0" && parsed.entries) {
-      return parsed;
-    }
-    return DEFAULT_INDEX;
-  } catch {
-    return DEFAULT_INDEX;
-  }
-}
-function saveIndex(cwd, index) {
-  const filePath = indexFilePath(cwd);
-  mkdirSync2(join8(cwd, ".autoremediator", "state"), { recursive: true });
-  writeFileSync2(filePath, JSON.stringify(index, null, 2) + "\n", "utf8");
-}
-function readIdempotentReport(cwd, idempotencyKey, cveId) {
-  const index = loadIndex(cwd);
-  const key = entryKey(idempotencyKey, cveId);
-  return index.entries[key]?.report;
-}
-function storeIdempotentReport(cwd, idempotencyKey, cveId, report) {
-  const index = loadIndex(cwd);
-  const key = entryKey(idempotencyKey, cveId);
-  index.entries[key] = {
-    key: idempotencyKey,
-    cveId: cveId.toUpperCase(),
-    report,
-    savedAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  saveIndex(cwd, index);
-}
-
-// src/remediation/pipeline.ts
-import { generateText as generateText2 } from "ai";
+// src/api/patches/reconcile.ts
+import { existsSync as existsSync8 } from "fs";
+import { readFile as readFile3, rm, writeFile } from "fs/promises";
+import { join as join10 } from "path";
+import { execa as execa5 } from "execa";
 
-// src/remediation/local/run.ts
-import semver5 from "semver";
+// src/remediation/evaluate-package.ts
+import semver2 from "semver";
 
 // src/platform/http-client.ts
 var DEFAULT_TIMEOUT_MS = 1e4;
@@ -1976,22 +2000,746 @@ async function lookupCveOsv(cveId) {
   return parseOsvVuln(vuln);
 }
 
-// src/intelligence/sources/github-advisory.ts
-var GITHUB_API_BASE = "https://api.github.com/advisories";
-async function fetchGhAdvisories(cveId) {
-  const token = getGitHubToken();
-  const headers = {
-    "X-GitHub-Api-Version": "2022-11-28",
-    "User-Agent": "autoremediator"
-  };
-  if (token) {
-    headers["Authorization"] = `token ${token}`;
-  }
-  const url = new URL(GITHUB_API_BASE);
-  url.searchParams.set("cve_id", cveId);
-  url.searchParams.set("ecosystem", "npm");
-  url.searchParams.set("type", "reviewed");
-  url.searchParams.set("per_page", "10");
+// src/platform/config.ts
+function resolveProvider(options = {}) {
+  const raw = options.llmProvider ?? process.env.AUTOREMEDIATOR_LLM_PROVIDER ?? "remote";
+  if (raw !== "remote" && raw !== "local") {
+    throw new Error(
+      `Unsupported LLM provider "${raw}". Set AUTOREMEDIATOR_LLM_PROVIDER to "remote" or "local".`
+    );
+  }
+  return raw;
+}
+function resolveModelName(provider, options = {}, routing = {}) {
+  if (options.model) return options.model;
+  if (process.env.AUTOREMEDIATOR_MODEL) return process.env.AUTOREMEDIATOR_MODEL;
+  const cwd = options.cwd ?? process.cwd();
+  const policy = loadPolicy(cwd, options.policy);
+  const providerEnvModel = provider === "remote" ? process.env.AUTOREMEDIATOR_MODEL_REMOTE : process.env.AUTOREMEDIATOR_MODEL_LOCAL;
+  if (providerEnvModel) return providerEnvModel;
+  const policyPinnedModel = provider === "remote" ? policy.modelDefaults?.remote : policy.modelDefaults?.local;
+  if (policyPinnedModel) return policyPinnedModel;
+  const defaults = {
+    remote: "remote-default",
+    local: "local"
+  };
+  const routingEnabled = options.dynamicModelRouting ?? policy.dynamicModelRouting ?? false;
+  const threshold = options.dynamicRoutingThresholdChars ?? policy.dynamicRoutingThresholdChars ?? 18e3;
+  if (provider === "remote" && routingEnabled && typeof routing.inputChars === "number" && routing.inputChars >= threshold) {
+    return process.env.AUTOREMEDIATOR_MODEL_REMOTE_LARGE ?? "remote-large";
+  }
+  return defaults[provider];
+}
+async function loadRemoteFactory() {
+  const moduleName = process.env.AUTOREMEDIATOR_REMOTE_CLIENT_MODULE;
+  const exportName = process.env.AUTOREMEDIATOR_REMOTE_CLIENT_FACTORY ?? "createRemoteClient";
+  if (!moduleName) {
+    throw new Error(
+      "AUTOREMEDIATOR_REMOTE_CLIENT_MODULE is required for remote provider model loading."
+    );
+  }
+  if (moduleName.startsWith("./") || moduleName.startsWith("../") || moduleName.startsWith("/") || moduleName.startsWith("file:")) {
+    throw new Error(
+      `AUTOREMEDIATOR_REMOTE_CLIENT_MODULE must be a package name, not a file path: ${moduleName}`
+    );
+  }
+  const loaded = await import(moduleName);
+  const factory = loaded[exportName];
+  if (typeof factory !== "function") {
+    throw new Error(
+      `Remote client factory "${exportName}" was not found in module "${moduleName}".`
+    );
+  }
+  return factory;
+}
+async function createModel(options = {}, routing = {}) {
+  const provider = resolveProvider(options);
+  if (provider === "local") {
+    throw new Error(
+      "Local provider does not create a language model. Use the deterministic pipeline path instead."
+    );
+  }
+  const apiKey = process.env.AUTOREMEDIATOR_REMOTE_API_KEY;
+  if (!apiKey) {
+    throw new Error(
+      "AUTOREMEDIATOR_REMOTE_API_KEY environment variable is required for remote provider."
+    );
+  }
+  const modelName = resolveModelName(provider, options, routing);
+  const createRemoteClient = await loadRemoteFactory();
+  const remoteClient = createRemoteClient({ apiKey });
+  return remoteClient(modelName);
+}
+function getPatchConfidenceThreshold(provider, safetyProfile = "relaxed", riskLevel = "medium", overrides) {
+  const relaxed = {
+    remote: { low: 0.65, medium: 0.7, high: 0.8 },
+    local: { low: 0.65, medium: 0.7, high: 0.8 }
+  };
+  const strict = {
+    remote: { low: 0.8, medium: 0.85, high: 0.9 },
+    local: { low: 0.8, medium: 0.85, high: 0.9 }
+  };
+  const baseThreshold = safetyProfile === "strict" ? strict[provider][riskLevel] : relaxed[provider][riskLevel];
+  const override = overrides?.[riskLevel];
+  if (typeof override === "number" && Number.isFinite(override)) {
+    return Math.max(0, Math.min(1, override));
+  }
+  return baseThreshold;
+}
+function estimateModelCostUsd(params) {
+  const inputTokens = params.promptChars / 4;
+  const outputTokens = params.completionChars / 4;
+  const pricePerThousand = params.provider === "remote" ? { input: 6e-3, output: 0.02 } : { input: 0, output: 0 };
+  return inputTokens / 1e3 * pricePerThousand.input + outputTokens / 1e3 * pricePerThousand.output;
+}
+function getNvdConfig() {
+  return {
+    apiKey: process.env.AUTOREMEDIATOR_NVD_API_KEY
+  };
+}
+function getGitHubToken() {
+  return process.env.GITHUB_TOKEN;
+}
+function getIntelligenceSourceConfig() {
+  return {
+    gitLabAdvisoryApi: process.env.AUTOREMEDIATOR_GITLAB_ADVISORY_API ?? "https://advisories.gitlab.com/api/v1/advisories",
+    certCcSearchUrl: process.env.AUTOREMEDIATOR_CERTCC_SEARCH_URL ?? "https://www.kb.cert.org/vuls/search",
+    epssApi: process.env.AUTOREMEDIATOR_EPSS_API ?? "https://api.first.org/data/v1/epss",
+    cveServicesApi: process.env.AUTOREMEDIATOR_CVE_SERVICES_API ?? "https://cveawg.mitre.org/api/cve",
+    depsDevApi: process.env.AUTOREMEDIATOR_DEPSDEV_API ?? "https://api.deps.dev/v3",
+    scorecardApi: process.env.AUTOREMEDIATOR_SCORECARD_API ?? "https://api.securityscorecards.dev",
+    vendorAdvisoryFeeds: (process.env.AUTOREMEDIATOR_VENDOR_ADVISORY_FEEDS ?? "").split(",").map((v) => v.trim()).filter(Boolean),
+    commercialFeeds: (process.env.AUTOREMEDIATOR_COMMERCIAL_FEEDS ?? "").split(",").map((v) => v.trim()).filter(Boolean),
+    commercialFeedToken: process.env.AUTOREMEDIATOR_COMMERCIAL_FEED_TOKEN
+  };
+}
+
+// src/intelligence/sources/epss.ts
+async function fetchEpss(cveId) {
+  const { epssApi } = getIntelligenceSourceConfig();
+  if (!epssApi) return void 0;
+  try {
+    const url = new URL(epssApi);
+    url.searchParams.set("cve", cveId);
+    const res = await httpClient({ url: url.toString() });
+    if (!res.ok) return void 0;
+    const body = res.data;
+    return body.data?.[0];
+  } catch {
+    return void 0;
+  }
+}
+async function enrichWithEpss(details) {
+  const row = await fetchEpss(details.id);
+  if (!row) return details;
+  const score = Number.parseFloat(row.epss);
+  const percentile = Number.parseFloat(row.percentile);
+  if (!Number.isFinite(score) || !Number.isFinite(percentile)) {
+    return details;
+  }
+  details.epss = {
+    score,
+    percentile,
+    date: row.date
+  };
+  return details;
+}
+
+// src/intelligence/sources/cisa-kev.ts
+var CISA_KEV_URL = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json";
+async function fetchCisaKevFeed() {
+  try {
+    const res = await httpClient({ url: CISA_KEV_URL });
+    if (!res.ok) return void 0;
+    return res.data;
+  } catch {
+    return void 0;
+  }
+}
+function findKevEntry(feed, cveId) {
+  if (!feed?.vulnerabilities?.length) return void 0;
+  const normalized = cveId.toUpperCase();
+  return feed.vulnerabilities.find((v) => v.cveID.toUpperCase() === normalized);
+}
+async function enrichWithCisaKev(details) {
+  const feed = await fetchCisaKevFeed();
+  const entry = findKevEntry(feed, details.id);
+  if (!entry) return details;
+  details.kev = {
+    knownExploited: true,
+    dateAdded: entry.dateAdded,
+    dueDate: entry.dueDate,
+    requiredAction: entry.requiredAction,
+    knownRansomwareCampaignUse: entry.knownRansomwareCampaignUse
+  };
+  if (!details.references.includes(CISA_KEV_URL)) {
+    details.references.push(CISA_KEV_URL);
+  }
+  return details;
+}
+
+// src/intelligence/sources/registry.ts
+import { readFileSync as readFileSync7 } from "fs";
+import { join as join9 } from "path";
+import { execa as execa4 } from "execa";
+import semver from "semver";
+var NPM_REGISTRY = "https://registry.npmjs.org";
+async function fetchPackageVersions(packageName) {
+  const url = `${NPM_REGISTRY}/${encodeURIComponent(packageName)}`;
+  try {
+    const res = await httpClient({ url });
+    if (res.status === 404) return [];
+    if (!res.ok) {
+      throw new Error(`npm registry error ${res.status} for "${packageName}": ${res.text}`);
+    }
+    const data = res.data;
+    return Object.keys(data.versions);
+  } catch (err) {
+    if (err instanceof Error && err.message.includes("registry error")) {
+      throw err;
+    }
+    return [];
+  }
+}
+async function findSafeUpgradeVersion(packageName, installedVersion, firstPatchedVersion, vulnerableRange) {
+  const resolution = await resolveSafeUpgradeVersion(
+    packageName,
+    installedVersion,
+    firstPatchedVersion,
+    vulnerableRange
+  );
+  return resolution.safeVersion;
+}
+async function resolveSafeUpgradeVersion(packageName, installedVersion, firstPatchedVersion, vulnerableRange) {
+  const versions = await fetchPackageVersions(packageName);
+  if (!versions.length) {
+    return {
+      candidates: {},
+      majorOnlyFixAvailable: false
+    };
+  }
+  const installed = semver.parse(installedVersion);
+  const candidates = versions.filter((v) => semver.valid(v) && semver.gte(v, firstPatchedVersion)).filter((v) => {
+    if (!vulnerableRange) return true;
+    try {
+      return !semver.satisfies(v, vulnerableRange, { includePrerelease: false });
+    } catch {
+      return true;
+    }
+  }).sort(semver.compare);
+  if (!candidates.length) {
+    return {
+      candidates: {},
+      majorOnlyFixAvailable: false
+    };
+  }
+  const categorizedCandidates = {};
+  for (const candidate of candidates) {
+    const level = classifyUpgradeLevel(installedVersion, candidate);
+    if (!level) continue;
+    if (!categorizedCandidates[level]) {
+      categorizedCandidates[level] = candidate;
+    }
+  }
+  const safeVersion = categorizedCandidates.patch ?? categorizedCandidates.minor ?? categorizedCandidates.major;
+  if (!safeVersion) {
+    return {
+      candidates: categorizedCandidates,
+      majorOnlyFixAvailable: false
+    };
+  }
+  const upgradeLevel = classifyUpgradeLevel(installedVersion, safeVersion);
+  const majorOnlyFixAvailable = !categorizedCandidates.patch && !categorizedCandidates.minor && Boolean(categorizedCandidates.major);
+  if (!installed || !upgradeLevel) {
+    return {
+      safeVersion,
+      upgradeLevel,
+      candidates: categorizedCandidates,
+      majorOnlyFixAvailable
+    };
+  }
+  return {
+    safeVersion,
+    upgradeLevel,
+    candidates: categorizedCandidates,
+    majorOnlyFixAvailable
+  };
+}
+function classifyUpgradeLevel(installedVersion, candidateVersion) {
+  const installed = semver.parse(installedVersion);
+  const candidate = semver.parse(candidateVersion);
+  if (!installed || !candidate) return void 0;
+  if (candidate.major > installed.major) return "major";
+  if (candidate.minor > installed.minor) return "minor";
+  if (candidate.patch > installed.patch || candidate.version === installed.version) {
+    return "patch";
+  }
+  return void 0;
+}
+async function queryOutdatedPackages(cwd, options = {}) {
+  const pm = options.packageManager ?? detectPackageManager(cwd);
+  let stdout;
+  try {
+    const args = pm === "pnpm" ? ["outdated", "--json"] : ["outdated", "--json"];
+    const yarnArgs = pm === "yarn" ? ["outdated", "--json"] : void 0;
+    const finalArgs = yarnArgs ?? args;
+    const result2 = await execa4(pm, finalArgs, {
+      cwd,
+      reject: false,
+      stdio: "pipe"
+    });
+    if (result2.exitCode !== 0 && result2.exitCode !== 1) {
+      const stderr = typeof result2.stderr === "string" ? result2.stderr : "";
+      if (!result2.stdout) {
+        throw new Error(
+          `${pm} outdated --json failed (exit ${result2.exitCode}): ${stderr.slice(0, 500)}`
+        );
+      }
+    }
+    stdout = typeof result2.stdout === "string" ? result2.stdout : "";
+  } catch (err) {
+    if (err instanceof Error && !err.message.includes("outdated --json failed")) {
+      throw new Error(`Failed to query outdated packages: ${err.message}`);
+    }
+    throw err;
+  }
+  if (!stdout.trim()) {
+    return /* @__PURE__ */ new Map();
+  }
+  const rawEntries = {};
+  if (pm === "yarn") {
+    for (const line of stdout.split("\n")) {
+      const trimmed = line.trim();
+      if (!trimmed) continue;
+      try {
+        const parsed = JSON.parse(trimmed);
+        if (parsed.type === "table" && parsed.data) {
+          const tableData = parsed.data;
+          const head = tableData.head ?? [];
+          const currentIdx = head.indexOf("Current");
+          const wantedIdx = head.indexOf("Wanted");
+          const latestIdx = head.indexOf("Latest");
+          for (const row of tableData.body ?? []) {
+            const name = row[0];
+            if (!name) continue;
+            rawEntries[name] = {
+              current: row[currentIdx] ?? "",
+              wanted: row[wantedIdx] ?? "",
+              latest: row[latestIdx] ?? "",
+              type: row[head.indexOf("Package Type")] ?? "dependencies"
+            };
+          }
+        }
+      } catch {
+      }
+    }
+  } else {
+    try {
+      const parsed = JSON.parse(stdout);
+      if (Array.isArray(parsed)) {
+        for (const entry of parsed) {
+          const name = entry.name ?? entry.packageName;
+          if (!name) continue;
+          rawEntries[name] = {
+            current: entry.current,
+            wanted: entry.wanted,
+            latest: entry.latest,
+            type: entry.dependencyType
+          };
+        }
+      } else {
+        Object.assign(rawEntries, parsed);
+      }
+    } catch {
+      throw new Error(`Could not parse ${pm} outdated --json output.`);
+    }
+  }
+  let directDeps;
+  try {
+    const pkgRaw = JSON.parse(readFileSync7(join9(cwd, "package.json"), "utf8"));
+    directDeps = /* @__PURE__ */ new Set([
+      ...Object.keys(pkgRaw.dependencies ?? {}),
+      ...Object.keys(pkgRaw.devDependencies ?? {})
+    ]);
+  } catch {
+    directDeps = /* @__PURE__ */ new Set();
+  }
+  const result = /* @__PURE__ */ new Map();
+  for (const [name, entry] of Object.entries(rawEntries)) {
+    const currentVersion = entry.current ?? "";
+    const wantedVersion = entry.wanted ?? currentVersion;
+    const latestVersion = entry.latest ?? currentVersion;
+    if (!currentVersion || !latestVersion) continue;
+    const dependencyScope = directDeps.has(name) ? "direct" : "transitive";
+    if (!options.includeTransitive && dependencyScope === "transitive") continue;
+    const isMajorBump = semver.valid(currentVersion) !== null && semver.valid(latestVersion) !== null && semver.major(latestVersion) > semver.major(currentVersion);
+    result.set(name, {
+      currentVersion,
+      wantedVersion,
+      latestVersion,
+      isMajorBump,
+      dependencyScope
+    });
+  }
+  return result;
+}
+
+// src/remediation/evaluate-package.ts
+async function evaluatePackage(packageName, options = {}) {
+  const version = options.version?.trim();
+  const enrich = options.enrichIntelligence !== false;
+  let versions = [];
+  let latestVersion;
+  try {
+    versions = await fetchPackageVersions(packageName);
+    if (versions.length > 0) {
+      const valid = versions.filter((v) => semver2.valid(v)).sort((a, b) => semver2.compare(a, b));
+      latestVersion = valid[valid.length - 1];
+    }
+  } catch {
+  }
+  let rawVulns = [];
+  try {
+    rawVulns = await queryOsvPackage(packageName, version);
+  } catch {
+    rawVulns = [];
+  }
+  let kevFeed = null;
+  if (enrich) {
+    try {
+      kevFeed = await fetchCisaKevFeed();
+    } catch {
+      kevFeed = null;
+    }
+  }
+  const entries = [];
+  for (const raw of rawVulns) {
+    const cveDetails = parseOsvVuln(raw);
+    const affected = cveDetails.affectedPackages.find(
+      (p) => p.name.toLowerCase() === packageName.toLowerCase()
+    );
+    if (version && affected?.vulnerableRange) {
+      const cleanVer = semver2.clean(version) || version;
+      if (semver2.valid(cleanVer) && !semver2.satisfies(cleanVer, affected.vulnerableRange)) {
+        continue;
+      }
+    }
+    let inCisaKev = false;
+    let epssScore;
+    let epssPercentile;
+    if (enrich && cveDetails.id.startsWith("CVE-")) {
+      if (kevFeed) {
+        inCisaKev = Boolean(findKevEntry(kevFeed, cveDetails.id));
+      }
+      try {
+        const epss = await fetchEpss(cveDetails.id);
+        if (epss) {
+          epssScore = Number.parseFloat(epss.epss);
+          epssPercentile = Number.parseFloat(epss.percentile);
+        }
+      } catch {
+      }
+    }
+    let safeUpgradeVersion;
+    if (affected?.firstPatchedVersion) {
+      try {
+        const safe = await findSafeUpgradeVersion(
+          packageName,
+          version || "0.0.0",
+          affected.firstPatchedVersion
+        );
+        safeUpgradeVersion = safe ?? affected.firstPatchedVersion;
+      } catch {
+        safeUpgradeVersion = affected.firstPatchedVersion;
+      }
+    }
+    entries.push({
+      cveId: cveDetails.id,
+      severity: cveDetails.severity,
+      summary: cveDetails.summary,
+      vulnerableRange: affected?.vulnerableRange,
+      firstPatchedVersion: affected?.firstPatchedVersion,
+      safeUpgradeVersion,
+      epssScore,
+      epssPercentile,
+      inCisaKev,
+      references: cveDetails.references
+    });
+  }
+  const isVulnerable = entries.length > 0;
+  let verdict = "safe";
+  if (isVulnerable) {
+    const hasKevOrHighEpss = entries.some((e) => e.inCisaKev || e.epssScore && e.epssScore > 0.5);
+    const hasHighOrCritical = entries.some(
+      (e) => e.severity === "CRITICAL" || e.severity === "HIGH"
+    );
+    if (hasKevOrHighEpss) {
+      verdict = "actively-exploited";
+    } else if (hasHighOrCritical) {
+      verdict = "vulnerable";
+    } else {
+      verdict = "caution";
+    }
+  }
+  let recommendedVersion;
+  if (isVulnerable) {
+    const upgradeCandidates = entries.map((e) => e.safeUpgradeVersion).filter((v) => Boolean(v && semver2.valid(v))).sort((a, b) => semver2.compare(a, b));
+    recommendedVersion = upgradeCandidates[upgradeCandidates.length - 1] || latestVersion;
+  } else {
+    recommendedVersion = version || latestVersion;
+  }
+  const summary = isVulnerable ? `Package "${packageName}${version ? `@${version}` : ""}" has ${entries.length} known vulnerability(ies) (verdict: ${verdict}). Recommended safe version: ${recommendedVersion || "none"}.` : `Package "${packageName}${version ? `@${version}` : ""}" has no known vulnerabilities. Safe to install.`;
+  return {
+    schemaVersion: "1.0",
+    packageName,
+    evaluatedVersion: version,
+    isVulnerable,
+    verdict,
+    summary,
+    vulnerabilities: entries,
+    recommendedVersion,
+    latestVersion,
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+
+// src/api/patches/reconcile.ts
+async function reconcilePatchArtifacts(options = {}) {
+  const cwd = options.cwd ?? process.cwd();
+  const pm = options.packageManager ?? detectPackageManager(cwd);
+  const summaries = await listPatchArtifacts(options);
+  const results = [];
+  for (const summary of summaries) {
+    const inspection = await inspectPatchArtifact(summary.patchFilePath, options);
+    let packageName = inspection.packageName;
+    let vulnerableVersion = inspection.vulnerableVersion;
+    const cveId = inspection.cveId;
+    if (!packageName && summary.patchFileName) {
+      const basename = summary.patchFileName.replace(/\.patch$/, "");
+      const plusIdx = basename.lastIndexOf("+");
+      if (plusIdx > 0) {
+        let rawPkg = basename.slice(0, plusIdx);
+        vulnerableVersion = basename.slice(plusIdx + 1);
+        if (rawPkg.includes("+")) {
+          rawPkg = "@" + rawPkg.replace("+", "/");
+        }
+        packageName = rawPkg;
+      } else {
+        packageName = basename;
+      }
+    }
+    if (!packageName) {
+      results.push({
+        patchFilePath: summary.patchFilePath,
+        packageName: "unknown",
+        cveId,
+        status: "patch-retained",
+        reason: "Cannot determine package name from patch artifact."
+      });
+      continue;
+    }
+    let safeUpgradeVersion;
+    try {
+      const evaluation = await evaluatePackage(packageName, {
+        version: vulnerableVersion,
+        enrichIntelligence: false
+      });
+      if (cveId) {
+        const vuln = evaluation.vulnerabilities.find(
+          (v) => v.cveId.toLowerCase() === cveId.toLowerCase()
+        );
+        if (vuln?.safeUpgradeVersion) {
+          safeUpgradeVersion = vuln.safeUpgradeVersion;
+        }
+      } else {
+        safeUpgradeVersion = evaluation.vulnerabilities.find(
+          (v) => v.safeUpgradeVersion
+        )?.safeUpgradeVersion;
+      }
+    } catch {
+    }
+    if (!safeUpgradeVersion) {
+      results.push({
+        patchFilePath: summary.patchFilePath,
+        packageName,
+        cveId,
+        installedVersion: vulnerableVersion,
+        status: "patch-retained",
+        reason: "No safe upstream release exists yet; patch remains necessary."
+      });
+      continue;
+    }
+    if (!options.autoApply) {
+      results.push({
+        patchFilePath: summary.patchFilePath,
+        packageName,
+        cveId,
+        installedVersion: vulnerableVersion,
+        safeUpstreamVersion: safeUpgradeVersion,
+        status: "safe-version-available",
+        reason: `Safe upstream version ${safeUpgradeVersion} is available. Re-run with autoApply: true or --auto-apply to upgrade.`
+      });
+      continue;
+    }
+    try {
+      const pkgJsonPath = join10(cwd, "package.json");
+      if (existsSync8(pkgJsonPath)) {
+        const pkgJson = JSON.parse(await readFile3(pkgJsonPath, "utf8"));
+        let updated = false;
+        const depSections = [
+          "dependencies",
+          "devDependencies",
+          "peerDependencies",
+          "optionalDependencies"
+        ];
+        for (const depSection of depSections) {
+          if (pkgJson[depSection] && pkgJson[depSection][packageName]) {
+            pkgJson[depSection][packageName] = `^${safeUpgradeVersion}`;
+            updated = true;
+          }
+        }
+        if (pkgJson.pnpm?.patchedDependencies) {
+          for (const key of Object.keys(pkgJson.pnpm.patchedDependencies)) {
+            if (key.startsWith(`${packageName}@`)) {
+              delete pkgJson.pnpm.patchedDependencies[key];
+              updated = true;
+            }
+          }
+        }
+        if (updated) {
+          await writeFile(pkgJsonPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
+        }
+      }
+      await rm(summary.patchFilePath, { force: true });
+      if (inspection.manifestFilePath) {
+        await rm(inspection.manifestFilePath, { force: true });
+      }
+      const installCmd = resolveInstallCommand(pm);
+      await execa5(installCmd[0], installCmd.slice(1), { cwd, reject: false });
+      if (options.runTests) {
+        const testCmd = resolveTestCommand(pm);
+        await execa5(testCmd[0], testCmd.slice(1), { cwd, reject: false });
+      }
+      results.push({
+        patchFilePath: summary.patchFilePath,
+        packageName,
+        cveId,
+        installedVersion: vulnerableVersion,
+        safeUpstreamVersion: safeUpgradeVersion,
+        status: "upgraded",
+        reason: `Successfully upgraded to ${safeUpgradeVersion} and retired patch artifact.`
+      });
+    } catch (err) {
+      results.push({
+        patchFilePath: summary.patchFilePath,
+        packageName,
+        cveId,
+        installedVersion: vulnerableVersion,
+        safeUpstreamVersion: safeUpgradeVersion,
+        status: "error",
+        reason: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  const reconciledCount = results.filter((r) => r.status === "upgraded").length;
+  const retainedCount = results.filter(
+    (r) => r.status === "patch-retained" || r.status === "safe-version-available"
+  ).length;
+  return {
+    reconciled: results,
+    reconciledCount,
+    retainedCount
+  };
+}
+
+// src/platform/idempotency.ts
+import { existsSync as existsSync9, mkdirSync as mkdirSync2, readFileSync as readFileSync8, writeFileSync as writeFileSync2 } from "fs";
+import { join as join11 } from "path";
+var DEFAULT_INDEX = {
+  schemaVersion: "1.0",
+  entries: {}
+};
+function indexFilePath(cwd) {
+  return join11(cwd, ".autoremediator", "state", "idempotency.json");
+}
+function entryKey(idempotencyKey, cveId) {
+  return `${idempotencyKey}::${cveId.toUpperCase()}`;
+}
+function loadIndex(cwd) {
+  const filePath = indexFilePath(cwd);
+  if (!existsSync9(filePath)) return DEFAULT_INDEX;
+  try {
+    const parsed = JSON.parse(readFileSync8(filePath, "utf8"));
+    if (parsed && parsed.schemaVersion === "1.0" && parsed.entries) {
+      return parsed;
+    }
+    return DEFAULT_INDEX;
+  } catch {
+    return DEFAULT_INDEX;
+  }
+}
+function saveIndex(cwd, index) {
+  const filePath = indexFilePath(cwd);
+  mkdirSync2(join11(cwd, ".autoremediator", "state"), { recursive: true });
+  writeFileSync2(filePath, JSON.stringify(index, null, 2) + "\n", "utf8");
+}
+function readIdempotentReport(cwd, idempotencyKey, cveId) {
+  const index = loadIndex(cwd);
+  const key = entryKey(idempotencyKey, cveId);
+  return index.entries[key]?.report;
+}
+function storeIdempotentReport(cwd, idempotencyKey, cveId, report) {
+  const index = loadIndex(cwd);
+  const key = entryKey(idempotencyKey, cveId);
+  index.entries[key] = {
+    key: idempotencyKey,
+    cveId: cveId.toUpperCase(),
+    report,
+    savedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  saveIndex(cwd, index);
+}
+
+// src/remediation/pipeline.ts
+import { generateText as generateText2 } from "ai";
+
+// src/remediation/local/run.ts
+import semver6 from "semver";
+
+// src/intelligence/sources/github-advisory.ts
+var GITHUB_API_BASE = "https://api.github.com/advisories";
+async function fetchGhAdvisories(cveId) {
+  const token = getGitHubToken();
+  const headers = {
+    "X-GitHub-Api-Version": "2022-11-28",
+    "User-Agent": "autoremediator"
+  };
+  if (token) {
+    headers["Authorization"] = `token ${token}`;
+  }
+  const normalized = cveId.trim();
+  if (normalized.toUpperCase().startsWith("GHSA-")) {
+    const url2 = `${GITHUB_API_BASE}/${encodeURIComponent(normalized)}`;
+    try {
+      const res = await httpClient({ url: url2, headers });
+      if (!res.ok) {
+        if (res.status === 404) return [];
+        throw new Error(`HTTP ${res.status}: ${res.text}`);
+      }
+      return res.data ? [res.data] : [];
+    } catch (err) {
+      const errorMsg = err instanceof Error ? err.message : String(err);
+      console.warn(
+        `[autoremediator] GitHub Advisory API error for ${cveId}: ${errorMsg} \u2014 skipping.`
+      );
+      return [];
+    }
+  }
+  const url = new URL(GITHUB_API_BASE);
+  url.searchParams.set("cve_id", cveId);
+  url.searchParams.set("ecosystem", "npm");
+  url.searchParams.set("type", "reviewed");
+  url.searchParams.set("per_page", "10");
   try {
     const res = await httpClient({
       url: url.toString(),
@@ -2095,9 +2843,9 @@ async function enrichWithNvd(details) {
 }
 
 // src/intelligence/sources/snapshot.ts
-import { readFileSync as readFileSync6 } from "fs";
+import { readFileSync as readFileSync9 } from "fs";
 function loadIntelligenceSnapshot(filePath) {
-  const raw = readFileSync6(filePath, "utf8");
+  const raw = readFileSync9(filePath, "utf8");
   const parsed = JSON.parse(raw);
   if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
     throw new Error(`Intelligence snapshot at ${filePath} must be a JSON object keyed by CVE ID.`);
@@ -2109,8 +2857,8 @@ function lookupSnapshotCve(snapshot, cveId) {
 }
 
 // src/remediation/tools/check-reachability.ts
-import { existsSync as existsSync8, readdirSync, readFileSync as readFileSync7, statSync } from "fs";
-import { isAbsolute as isAbsolute2, join as join9, resolve as resolve2 } from "path";
+import { existsSync as existsSync10, readdirSync as readdirSync2, readFileSync as readFileSync10, statSync as statSync2 } from "fs";
+import { isAbsolute as isAbsolute2, join as join12, resolve as resolve3 } from "path";
 import { parseSync } from "oxc-parser";
 import { z as z2 } from "zod";
 var SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".mts", ".cts"]);
@@ -2126,16 +2874,16 @@ var IGNORED_DIRS = /* @__PURE__ */ new Set([
 ]);
 function loadTsconfigPaths(cwd) {
   for (const configName of ["tsconfig.json", "jsconfig.json"]) {
-    const fullPath = join9(cwd, configName);
-    if (!existsSync8(fullPath)) continue;
+    const fullPath = join12(cwd, configName);
+    if (!existsSync10(fullPath)) continue;
     try {
-      const raw = readFileSync7(fullPath, "utf8");
+      const raw = readFileSync10(fullPath, "utf8");
       const cleaned = raw.replace(/\/\*[\s\S]*?\*\/|\/\/.*/g, "");
       const parsed = JSON.parse(cleaned);
       const compilerOptions = parsed.compilerOptions;
       if (compilerOptions?.paths) {
         return {
-          baseUrl: compilerOptions.baseUrl ? resolve2(cwd, compilerOptions.baseUrl) : cwd,
+          baseUrl: compilerOptions.baseUrl ? resolve3(cwd, compilerOptions.baseUrl) : cwd,
           paths: compilerOptions.paths
         };
       }
@@ -2150,14 +2898,14 @@ function resolveAliasedPath(importSource, config) {
   }
   for (const [pattern, replacements] of Object.entries(config.paths)) {
     if (pattern === importSource && replacements[0]) {
-      return resolve2(config.baseUrl, replacements[0]);
+      return resolve3(config.baseUrl, replacements[0]);
     }
     if (pattern.endsWith("/*")) {
       const prefix = pattern.slice(0, -2);
       if (importSource.startsWith(prefix)) {
         const suffix = importSource.slice(prefix.length);
         const replacement = replacements[0]?.slice(0, -2) ?? "";
-        return resolve2(config.baseUrl, replacement + suffix);
+        return resolve3(config.baseUrl, replacement + suffix);
       }
     }
   }
@@ -2166,16 +2914,16 @@ function resolveAliasedPath(importSource, config) {
 function* walkSourceFiles(dir) {
   let entries;
   try {
-    entries = readdirSync(dir);
+    entries = readdirSync2(dir);
   } catch {
     return;
   }
   for (const entry of entries) {
     if (IGNORED_DIRS.has(entry)) continue;
-    const full = join9(dir, entry);
+    const full = join12(dir, entry);
     let stat2;
     try {
-      stat2 = statSync(full);
+      stat2 = statSync2(full);
     } catch {
       continue;
     }
@@ -2213,7 +2961,31 @@ function walkAst(node, visitor) {
     }
   }
 }
-function extractPackageReferences(filename, content, packageName, tsconfig) {
+function toRootPackageName(importSource) {
+  if (importSource.startsWith("@")) {
+    const parts = importSource.split("/");
+    return parts.slice(0, 2).join("/");
+  }
+  return importSource.split("/")[0] ?? importSource;
+}
+function findTransitiveDependencyPath(cwd, targetPackage, importedDirectPackages) {
+  for (const directPkg of importedDirectPackages) {
+    const manifestPath = join12(cwd, "node_modules", directPkg, "package.json");
+    if (!existsSync10(manifestPath)) continue;
+    try {
+      const manifest = JSON.parse(readFileSync10(manifestPath, "utf8"));
+      if (manifest.dependencies && manifest.dependencies[targetPackage]) {
+        return {
+          directDependency: directPkg,
+          version: manifest.dependencies[targetPackage]
+        };
+      }
+    } catch {
+    }
+  }
+  return null;
+}
+function extractPackageReferences(filename, content, packageName, tsconfig, outImportedDirectPackages) {
   const results = [];
   let parseResult;
   try {
@@ -2225,6 +2997,9 @@ function extractPackageReferences(filename, content, packageName, tsconfig) {
   walkAst(parseResult.program, (node) => {
     if (node.type === "ImportDeclaration") {
       const source = node.source;
+      if (source?.value && !source.value.startsWith(".") && !isAbsolute2(source.value)) {
+        outImportedDirectPackages?.add(toRootPackageName(source.value));
+      }
       if (source?.value && matchesPackage(source.value, packageName, tsconfig)) {
         const symbols = [];
         const importedIdentifiers = /* @__PURE__ */ new Map();
@@ -2259,6 +3034,9 @@ function extractPackageReferences(filename, content, packageName, tsconfig) {
     }
     if (node.type === "ImportExpression") {
       const source = node.source;
+      if (source?.value && !source.value.startsWith(".") && !isAbsolute2(source.value)) {
+        outImportedDirectPackages?.add(toRootPackageName(source.value));
+      }
       if (source?.value && matchesPackage(source.value, packageName, tsconfig)) {
         results.push({
           matchType: "dynamic-import",
@@ -2270,6 +3048,9 @@ function extractPackageReferences(filename, content, packageName, tsconfig) {
     }
     if (node.type === "CallExpression" && node.callee?.name === "require" && Array.isArray(node.arguments) && node.arguments.length > 0) {
       const firstArg = node.arguments[0];
+      if (firstArg?.value && typeof firstArg.value === "string" && !firstArg.value.startsWith(".") && !isAbsolute2(firstArg.value)) {
+        outImportedDirectPackages?.add(toRootPackageName(firstArg.value));
+      }
       if (firstArg?.value && typeof firstArg.value === "string" && matchesPackage(firstArg.value, packageName, tsconfig)) {
         results.push({
           matchType: "require",
@@ -2281,6 +3062,9 @@ function extractPackageReferences(filename, content, packageName, tsconfig) {
     }
     if (node.type === "ExportNamedDeclaration" || node.type === "ExportAllDeclaration") {
       const source = node.source;
+      if (source?.value && !source.value.startsWith(".") && !isAbsolute2(source.value)) {
+        outImportedDirectPackages?.add(toRootPackageName(source.value));
+      }
       if (source?.value && matchesPackage(source.value, packageName, tsconfig)) {
         const symbols = [];
         if (node.type === "ExportAllDeclaration") {
@@ -2357,15 +3141,22 @@ function assessPackageReachability(cwd, packageName, targetSymbol) {
   let hasReExport = false;
   let totalInvocations = 0;
   let hasPackageImport = false;
+  const importedDirectPackages = /* @__PURE__ */ new Set();
   for (const filePath of walkSourceFiles(cwd)) {
     scanned++;
     let content;
     try {
-      content = readFileSync7(filePath, "utf8");
+      content = readFileSync10(filePath, "utf8");
     } catch {
       continue;
     }
-    const refs = extractPackageReferences(filePath, content, packageName, tsconfig);
+    const refs = extractPackageReferences(
+      filePath,
+      content,
+      packageName,
+      tsconfig,
+      importedDirectPackages
+    );
     if (refs.length > 0) {
       hasPackageImport = true;
     }
@@ -2408,6 +3199,16 @@ function assessPackageReachability(cwd, packageName, targetSymbol) {
     };
   }
   if (!hasPackageImport) {
+    const transitivePath = findTransitiveDependencyPath(cwd, packageName, importedDirectPackages);
+    if (transitivePath) {
+      return {
+        packageName,
+        status: "reachable",
+        reason: `Package '${packageName}' is a transitive dependency of imported package '${transitivePath.directDependency}'`,
+        reachabilityBasis: "transitive-path-found",
+        evidence: []
+      };
+    }
     return {
       packageName,
       status: "not-reachable",
@@ -2552,254 +3353,48 @@ async function runSecOpsPreflight(normalizedId, cveDetails, opts) {
       opts.slaPolicy
     );
     if (breach) {
-      slaBreaches = [breach];
-    }
-  }
-  return { suppressed: false, exploitSignalTriggered, slaBreaches };
-}
-
-// src/remediation/local/sbom.ts
-function buildSbom(packages, vulnerableNames, results) {
-  const statusByPackage = /* @__PURE__ */ new Map();
-  for (const result of results) {
-    if (!vulnerableNames.has(result.packageName)) continue;
-    if (result.suppressedBy) {
-      statusByPackage.set(result.packageName, "suppressed");
-    } else if (!result.applied && result.strategy === "none") {
-      statusByPackage.set(result.packageName, "skipped");
-    } else if (result.applied) {
-      statusByPackage.set(result.packageName, "patched");
-    } else {
-      statusByPackage.set(result.packageName, "unpatched");
-    }
-  }
-  return packages.map((pkg) => {
-    const isVulnerable = vulnerableNames.has(pkg.name);
-    const entry = {
-      name: pkg.name,
-      version: pkg.version,
-      scope: pkg.type === "direct" ? "direct" : "transitive"
-    };
-    if (isVulnerable) {
-      entry.status = statusByPackage.get(pkg.name) ?? "unpatched";
-    }
-    return entry;
-  });
-}
-
-// src/intelligence/sources/registry.ts
-import { readFileSync as readFileSync8 } from "fs";
-import { join as join10 } from "path";
-import { execa as execa4 } from "execa";
-import semver from "semver";
-var NPM_REGISTRY = "https://registry.npmjs.org";
-async function fetchPackageVersions(packageName) {
-  const url = `${NPM_REGISTRY}/${encodeURIComponent(packageName)}`;
-  try {
-    const res = await httpClient({ url });
-    if (res.status === 404) return [];
-    if (!res.ok) {
-      throw new Error(`npm registry error ${res.status} for "${packageName}": ${res.text}`);
-    }
-    const data = res.data;
-    return Object.keys(data.versions);
-  } catch (err) {
-    if (err instanceof Error && err.message.includes("registry error")) {
-      throw err;
-    }
-    return [];
-  }
-}
-async function findSafeUpgradeVersion(packageName, installedVersion, firstPatchedVersion, vulnerableRange) {
-  const resolution = await resolveSafeUpgradeVersion(
-    packageName,
-    installedVersion,
-    firstPatchedVersion,
-    vulnerableRange
-  );
-  return resolution.safeVersion;
-}
-async function resolveSafeUpgradeVersion(packageName, installedVersion, firstPatchedVersion, vulnerableRange) {
-  const versions = await fetchPackageVersions(packageName);
-  if (!versions.length) {
-    return {
-      candidates: {},
-      majorOnlyFixAvailable: false
-    };
-  }
-  const installed = semver.parse(installedVersion);
-  const candidates = versions.filter((v) => semver.valid(v) && semver.gte(v, firstPatchedVersion)).filter((v) => {
-    if (!vulnerableRange) return true;
-    try {
-      return !semver.satisfies(v, vulnerableRange, { includePrerelease: false });
-    } catch {
-      return true;
-    }
-  }).sort(semver.compare);
-  if (!candidates.length) {
-    return {
-      candidates: {},
-      majorOnlyFixAvailable: false
-    };
-  }
-  const categorizedCandidates = {};
-  for (const candidate of candidates) {
-    const level = classifyUpgradeLevel(installedVersion, candidate);
-    if (!level) continue;
-    if (!categorizedCandidates[level]) {
-      categorizedCandidates[level] = candidate;
-    }
-  }
-  const safeVersion = categorizedCandidates.patch ?? categorizedCandidates.minor ?? categorizedCandidates.major;
-  if (!safeVersion) {
-    return {
-      candidates: categorizedCandidates,
-      majorOnlyFixAvailable: false
-    };
-  }
-  const upgradeLevel = classifyUpgradeLevel(installedVersion, safeVersion);
-  const majorOnlyFixAvailable = !categorizedCandidates.patch && !categorizedCandidates.minor && Boolean(categorizedCandidates.major);
-  if (!installed || !upgradeLevel) {
-    return {
-      safeVersion,
-      upgradeLevel,
-      candidates: categorizedCandidates,
-      majorOnlyFixAvailable
-    };
-  }
-  return {
-    safeVersion,
-    upgradeLevel,
-    candidates: categorizedCandidates,
-    majorOnlyFixAvailable
-  };
-}
-function classifyUpgradeLevel(installedVersion, candidateVersion) {
-  const installed = semver.parse(installedVersion);
-  const candidate = semver.parse(candidateVersion);
-  if (!installed || !candidate) return void 0;
-  if (candidate.major > installed.major) return "major";
-  if (candidate.minor > installed.minor) return "minor";
-  if (candidate.patch > installed.patch || candidate.version === installed.version) {
-    return "patch";
-  }
-  return void 0;
-}
-async function queryOutdatedPackages(cwd, options = {}) {
-  const pm = options.packageManager ?? detectPackageManager(cwd);
-  let stdout;
-  try {
-    const args = pm === "pnpm" ? ["outdated", "--json"] : ["outdated", "--json"];
-    const yarnArgs = pm === "yarn" ? ["outdated", "--json"] : void 0;
-    const finalArgs = yarnArgs ?? args;
-    const result2 = await execa4(pm, finalArgs, {
-      cwd,
-      reject: false,
-      stdio: "pipe"
-    });
-    if (result2.exitCode !== 0 && result2.exitCode !== 1) {
-      const stderr = typeof result2.stderr === "string" ? result2.stderr : "";
-      if (!result2.stdout) {
-        throw new Error(
-          `${pm} outdated --json failed (exit ${result2.exitCode}): ${stderr.slice(0, 500)}`
-        );
-      }
-    }
-    stdout = typeof result2.stdout === "string" ? result2.stdout : "";
-  } catch (err) {
-    if (err instanceof Error && !err.message.includes("outdated --json failed")) {
-      throw new Error(`Failed to query outdated packages: ${err.message}`);
-    }
-    throw err;
-  }
-  if (!stdout.trim()) {
-    return /* @__PURE__ */ new Map();
-  }
-  const rawEntries = {};
-  if (pm === "yarn") {
-    for (const line of stdout.split("\n")) {
-      const trimmed = line.trim();
-      if (!trimmed) continue;
-      try {
-        const parsed = JSON.parse(trimmed);
-        if (parsed.type === "table" && parsed.data) {
-          const tableData = parsed.data;
-          const head = tableData.head ?? [];
-          const currentIdx = head.indexOf("Current");
-          const wantedIdx = head.indexOf("Wanted");
-          const latestIdx = head.indexOf("Latest");
-          for (const row of tableData.body ?? []) {
-            const name = row[0];
-            if (!name) continue;
-            rawEntries[name] = {
-              current: row[currentIdx] ?? "",
-              wanted: row[wantedIdx] ?? "",
-              latest: row[latestIdx] ?? "",
-              type: row[head.indexOf("Package Type")] ?? "dependencies"
-            };
-          }
-        }
-      } catch {
-      }
-    }
-  } else {
-    try {
-      const parsed = JSON.parse(stdout);
-      if (Array.isArray(parsed)) {
-        for (const entry of parsed) {
-          const name = entry.name ?? entry.packageName;
-          if (!name) continue;
-          rawEntries[name] = {
-            current: entry.current,
-            wanted: entry.wanted,
-            latest: entry.latest,
-            type: entry.dependencyType
-          };
-        }
-      } else {
-        Object.assign(rawEntries, parsed);
-      }
-    } catch {
-      throw new Error(`Could not parse ${pm} outdated --json output.`);
+      slaBreaches = [breach];
     }
   }
-  let directDeps;
-  try {
-    const pkgRaw = JSON.parse(readFileSync8(join10(cwd, "package.json"), "utf8"));
-    directDeps = /* @__PURE__ */ new Set([
-      ...Object.keys(pkgRaw.dependencies ?? {}),
-      ...Object.keys(pkgRaw.devDependencies ?? {})
-    ]);
-  } catch {
-    directDeps = /* @__PURE__ */ new Set();
-  }
-  const result = /* @__PURE__ */ new Map();
-  for (const [name, entry] of Object.entries(rawEntries)) {
-    const currentVersion = entry.current ?? "";
-    const wantedVersion = entry.wanted ?? currentVersion;
-    const latestVersion = entry.latest ?? currentVersion;
-    if (!currentVersion || !latestVersion) continue;
-    const dependencyScope = directDeps.has(name) ? "direct" : "transitive";
-    if (!options.includeTransitive && dependencyScope === "transitive") continue;
-    const isMajorBump = semver.valid(currentVersion) !== null && semver.valid(latestVersion) !== null && semver.major(latestVersion) > semver.major(currentVersion);
-    result.set(name, {
-      currentVersion,
-      wantedVersion,
-      latestVersion,
-      isMajorBump,
-      dependencyScope
-    });
+  return { suppressed: false, exploitSignalTriggered, slaBreaches };
+}
+
+// src/remediation/local/sbom.ts
+function buildSbom(packages, vulnerableNames, results) {
+  const statusByPackage = /* @__PURE__ */ new Map();
+  for (const result of results) {
+    if (!vulnerableNames.has(result.packageName)) continue;
+    if (result.suppressedBy) {
+      statusByPackage.set(result.packageName, "suppressed");
+    } else if (!result.applied && result.strategy === "none") {
+      statusByPackage.set(result.packageName, "skipped");
+    } else if (result.applied) {
+      statusByPackage.set(result.packageName, "patched");
+    } else {
+      statusByPackage.set(result.packageName, "unpatched");
+    }
   }
-  return result;
+  return packages.map((pkg) => {
+    const isVulnerable = vulnerableNames.has(pkg.name);
+    const entry = {
+      name: pkg.name,
+      version: pkg.version,
+      scope: pkg.type === "direct" ? "direct" : "transitive"
+    };
+    if (isVulnerable) {
+      entry.status = statusByPackage.get(pkg.name) ?? "unpatched";
+    }
+    return entry;
+  });
 }
 
 // src/remediation/tools/apply-version-bump.ts
 import { z as z4 } from "zod";
-import { join as join12 } from "path";
-import { readFileSync as readFileSync9, writeFileSync as writeFileSync3 } from "fs";
+import { join as join15 } from "path";
+import { readFileSync as readFileSync13, writeFileSync as writeFileSync4 } from "fs";
 
 // src/platform/safe-exec.ts
-import { execa as execa5 } from "execa";
+import { execa as execa6 } from "execa";
 var DANGEROUS_ENV_VARS = /* @__PURE__ */ new Set([
   "NODE_OPTIONS",
   "NODE_PATH",
@@ -2848,7 +3443,7 @@ function safeExeca(file, args = [], options = {}) {
     options.env ?? process.env,
     options.allowNodeOptions
   );
-  return execa5(file, args, {
+  return execa6(file, args, {
     ...options,
     timeout,
     env: sanitizedEnv
@@ -2856,19 +3451,19 @@ function safeExeca(file, args = [], options = {}) {
 }
 
 // src/remediation/tools/apply-version-bump.ts
-import semver2 from "semver";
+import semver3 from "semver";
 
 // src/platform/repo-lock.ts
-import { mkdir, rm } from "fs/promises";
-import { join as join11 } from "path";
+import { mkdir, rm as rm2 } from "fs/promises";
+import { join as join13 } from "path";
 async function sleep(ms) {
-  await new Promise((resolve4) => setTimeout(resolve4, ms));
+  await new Promise((resolve6) => setTimeout(resolve6, ms));
 }
 async function acquireRepoLock(cwd, options = {}) {
   const timeoutMs = options.timeoutMs ?? 15e3;
   const retryDelayMs = options.retryDelayMs ?? 125;
-  const lockRoot = join11(cwd, ".autoremediator", "locks");
-  const lockPath = join11(cwd, ".autoremediator", "locks", "remediation.lock");
+  const lockRoot = join13(cwd, ".autoremediator", "locks");
+  const lockPath = join13(cwd, ".autoremediator", "locks", "remediation.lock");
   const startedAt = Date.now();
   await mkdir(lockRoot, { recursive: true });
   while (true) {
@@ -2877,7 +3472,7 @@ async function acquireRepoLock(cwd, options = {}) {
       return {
         lockPath,
         release: async () => {
-          await rm(lockPath, { recursive: true, force: true });
+          await rm2(lockPath, { recursive: true, force: true });
         }
       };
     } catch {
@@ -2897,6 +3492,380 @@ async function withRepoLock(cwd, fn, options) {
   }
 }
 
+// src/remediation/refactor/call-site-finder.ts
+import { readdirSync as readdirSync3, readFileSync as readFileSync11, statSync as statSync3 } from "fs";
+import { join as join14 } from "path";
+import { parseSync as parseSync2 } from "oxc-parser";
+var SOURCE_EXTENSIONS2 = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".mts", ".cts"]);
+var IGNORED_DIRS2 = /* @__PURE__ */ new Set([
+  "node_modules",
+  ".git",
+  "dist",
+  "build",
+  "coverage",
+  ".next",
+  ".turbo",
+  ".pnpm-store"
+]);
+function* walkFiles(dir) {
+  let entries;
+  try {
+    entries = readdirSync3(dir);
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (IGNORED_DIRS2.has(entry)) continue;
+    const full = join14(dir, entry);
+    let stat2;
+    try {
+      stat2 = statSync3(full);
+    } catch {
+      continue;
+    }
+    if (stat2.isDirectory()) {
+      yield* walkFiles(full);
+    } else {
+      const ext = full.slice(full.lastIndexOf("."));
+      if (SOURCE_EXTENSIONS2.has(ext)) {
+        yield full;
+      }
+    }
+  }
+}
+function findPackageCallSites(cwd, packageName) {
+  const callSites = [];
+  for (const filePath of walkFiles(cwd)) {
+    let content;
+    try {
+      content = readFileSync11(filePath, "utf8");
+    } catch {
+      continue;
+    }
+    if (!content.includes(packageName)) {
+      continue;
+    }
+    try {
+      const parseResult = parseSync2(filePath, content);
+      if (!parseResult.program) continue;
+      const program = parseResult.program;
+      const imports = [];
+      const importSources = [];
+      const localNames = /* @__PURE__ */ new Set();
+      for (const statement of program.body) {
+        if (statement.type === "ImportDeclaration" && statement.source?.value) {
+          const importSource = statement.source.value;
+          if (importSource === packageName || importSource.startsWith(`${packageName}/`)) {
+            importSources.push(importSource);
+            for (const spec of statement.specifiers || []) {
+              const localName = spec.local?.name || "";
+              if (!localName) continue;
+              localNames.add(localName);
+              if (spec.type === "ImportDefaultSpecifier") {
+                imports.push({
+                  localName,
+                  importedName: "default",
+                  isDefault: true,
+                  isNamespace: false
+                });
+              } else if (spec.type === "ImportNamespaceSpecifier") {
+                imports.push({
+                  localName,
+                  importedName: "*",
+                  isDefault: false,
+                  isNamespace: true
+                });
+              } else if (spec.type === "ImportSpecifier") {
+                imports.push({
+                  localName,
+                  importedName: spec.imported?.name || localName,
+                  isDefault: false,
+                  isNamespace: false
+                });
+              }
+            }
+          }
+        }
+      }
+      if (imports.length > 0 || importSources.length > 0) {
+        const lines = content.split("\n");
+        const referencedLines = [];
+        lines.forEach((line, index) => {
+          for (const local of localNames) {
+            const regex = new RegExp(`\\b${local}\\b`);
+            if (regex.test(line)) {
+              referencedLines.push(index + 1);
+              break;
+            }
+          }
+        });
+        callSites.push({
+          filePath,
+          sourceContent: content,
+          importSources,
+          imports,
+          referencedLines
+        });
+      }
+    } catch {
+    }
+  }
+  return callSites;
+}
+
+// src/remediation/refactor/refactor-agent.ts
+import { readFileSync as readFileSync12, writeFileSync as writeFileSync3 } from "fs";
+function parseCompilerDiagnostics(diagnosticError) {
+  const diagnostics = [];
+  const lines = diagnosticError.split("\n");
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    const match = trimmed.match(
+      /(?:([^\s:(]+)[:(](\d+)[:,](\d+)\)?:?\s*(?:-\s*)?(?:error\s+)?(TS\d+)?:?\s*(.*))/i
+    );
+    if (match) {
+      const [, filePath, lineStr, colStr, code, message] = match;
+      const diag = {
+        filePath,
+        line: lineStr ? parseInt(lineStr, 10) : void 0,
+        column: colStr ? parseInt(colStr, 10) : void 0,
+        code,
+        message: message || trimmed
+      };
+      const suggestionMatch = diag.message.match(/Did you mean ['"]([a-zA-Z0-9_$]+)['"]\?/i);
+      if (suggestionMatch) {
+        diag.suggestedSymbol = suggestionMatch[1];
+      }
+      const missingMatch = diag.message.match(/has no exported member ['"]([a-zA-Z0-9_$]+)['"]/i) || diag.message.match(/Property ['"]([a-zA-Z0-9_$]+)['"] does not exist/i);
+      if (missingMatch) {
+        diag.missingMember = missingMatch[1];
+      }
+      diagnostics.push(diag);
+    }
+  }
+  return diagnostics;
+}
+function revertRefactorSnapshots(snapshots) {
+  for (const [filePath, content] of Object.entries(snapshots)) {
+    try {
+      writeFileSync3(filePath, content, "utf8");
+    } catch {
+    }
+  }
+}
+var KNOWN_MIGRATIONS = {
+  rimraf: [
+    {
+      detect: (content, diag) => diag.includes("sync") && content.includes("rimraf.sync("),
+      transform: (content) => {
+        let res = content.replace(/import\s+rimraf\s+from\s+['"]rimraf['"];?/g, "");
+        res = `import { rimrafSync } from "rimraf";
+` + res;
+        return res.replace(/rimraf\.sync\(/g, "rimrafSync(");
+      }
+    }
+  ],
+  uuid: [
+    {
+      detect: (content, diag) => diag.includes("v4") && content.includes("uuid.v4("),
+      transform: (content) => {
+        let res = content.replace(/import\s+uuid\s+from\s+['"]uuid['"];?/g, "");
+        res = `import { v4 as uuidv4 } from "uuid";
+` + res;
+        return res.replace(/uuid\.v4\(/g, "uuidv4(");
+      }
+    },
+    {
+      // Subpath import migration: `import v4 from "uuid/v4"` -> `import { v4 } from "uuid"`
+      detect: (content) => /from\s+['"]uuid\/v4['"]/.test(content),
+      transform: (content) => content.replace(
+        /import\s+([a-zA-Z0-9_$]+)\s+from\s+['"]uuid\/v4['"];?/g,
+        `import { v4 as $1 } from "uuid";`
+      )
+    }
+  ],
+  glob: [
+    {
+      detect: (content, diag) => diag.includes("sync") && content.includes("glob.sync("),
+      transform: (content) => {
+        let res = content.replace(/import\s+glob\s+from\s+['"]glob['"];?/g, "");
+        res = `import { globSync } from "glob";
+` + res;
+        return res.replace(/glob\.sync\(/g, "globSync(");
+      }
+    }
+  ],
+  mkdirp: [
+    {
+      detect: (content, diag) => diag.includes("sync") && content.includes("mkdirp.sync("),
+      transform: (content) => {
+        let res = content.replace(/import\s+mkdirp\s+from\s+['"]mkdirp['"];?/g, "");
+        res = `import { mkdirpSync } from "mkdirp";
+` + res;
+        return res.replace(/mkdirp\.sync\(/g, "mkdirpSync(");
+      }
+    }
+  ]
+};
+function escapeRegex(str) {
+  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function transformFileContent(content, packageName, diagnosticError, filePath) {
+  let modified = false;
+  let newContent = content;
+  const migrations = KNOWN_MIGRATIONS[packageName];
+  if (migrations) {
+    for (const mig of migrations) {
+      if (mig.detect(newContent, diagnosticError)) {
+        const transformed = mig.transform(newContent);
+        if (transformed !== newContent) {
+          newContent = transformed;
+          modified = true;
+        }
+      }
+    }
+  }
+  if (diagnosticError.includes("no default export") || diagnosticError.includes("has no exported member 'default'") || diagnosticError.includes("has no exported member default") || diagnosticError.includes("TS2614") || diagnosticError.includes("TS1192")) {
+    const defaultImportRegex = new RegExp(
+      `import\\s+([a-zA-Z0-9_$]+)\\s+from\\s+['"]${escapeRegex(packageName)}['"]`,
+      "g"
+    );
+    if (defaultImportRegex.test(newContent)) {
+      newContent = newContent.replace(
+        defaultImportRegex,
+        `import * as $1 from "${packageName}"`
+      );
+      modified = true;
+    }
+  }
+  if (diagnosticError.includes("can only be used with a default import") || diagnosticError.includes("only be used with a default import") || diagnosticError.includes("TS1259")) {
+    const starImportRegex = new RegExp(
+      `import\\s+\\*\\s+as\\s+([a-zA-Z0-9_$]+)\\s+from\\s+['"]${escapeRegex(packageName)}['"]`,
+      "g"
+    );
+    if (starImportRegex.test(newContent)) {
+      newContent = newContent.replace(
+        starImportRegex,
+        `import $1 from "${packageName}"`
+      );
+      modified = true;
+    }
+  }
+  const diagnostics = parseCompilerDiagnostics(diagnosticError);
+  for (const diag of diagnostics) {
+    if (diag.missingMember && diag.suggestedSymbol) {
+      const missingMember = diag.missingMember;
+      const suggestedSymbol = diag.suggestedSymbol;
+      if (filePath && diag.filePath && filePath.endsWith(diag.filePath) && diag.line && diag.line > 0) {
+        const fileLines = newContent.split("\n");
+        const idx = diag.line - 1;
+        if (idx >= 0 && idx < fileLines.length) {
+          const line = fileLines[idx];
+          const replaced = line.replace(new RegExp(`\\.${escapeRegex(missingMember)}\\b`, "g"), `.${suggestedSymbol}`).replace(new RegExp(`\\b${escapeRegex(missingMember)}\\b`, "g"), suggestedSymbol);
+          if (replaced !== line) {
+            fileLines[idx] = replaced;
+            newContent = fileLines.join("\n");
+            modified = true;
+          }
+        }
+      } else {
+        const memberRegex = new RegExp(`\\.${escapeRegex(missingMember)}\\b`, "g");
+        if (memberRegex.test(newContent)) {
+          newContent = newContent.replace(memberRegex, `.${suggestedSymbol}`);
+          modified = true;
+        }
+        const importPattern = new RegExp(
+          `import\\s*\\{[^}]*\\b${escapeRegex(missingMember)}\\b[^}]*\\}\\s*from\\s*['"]${escapeRegex(packageName)}['"]`,
+          "g"
+        );
+        if (importPattern.test(newContent)) {
+          newContent = newContent.replace(
+            importPattern,
+            (match) => match.replace(new RegExp(`\\b${escapeRegex(missingMember)}\\b`, "g"), suggestedSymbol)
+          );
+          modified = true;
+        }
+      }
+    }
+  }
+  const lineDiags = diagnostics.filter(
+    (d) => Boolean(filePath && d.filePath && filePath.endsWith(d.filePath) && typeof d.line === "number" && d.line > 0)
+  ).sort((a, b) => b.line - a.line);
+  const processedLines = /* @__PURE__ */ new Set();
+  for (const diag of lineDiags) {
+    if (processedLines.has(diag.line)) continue;
+    processedLines.add(diag.line);
+    const fileLines = newContent.split("\n");
+    const targetLineIdx = diag.line - 1;
+    if (targetLineIdx >= 0 && targetLineIdx < fileLines.length) {
+      const prevLine = targetLineIdx > 0 ? fileLines[targetLineIdx - 1] : "";
+      if (!prevLine?.includes("@ts-expect-error") && !fileLines[targetLineIdx]?.includes("@ts-expect-error")) {
+        const indent = fileLines[targetLineIdx]?.match(/^\s*/)?.[0] || "";
+        fileLines.splice(
+          targetLineIdx,
+          0,
+          `${indent}// @ts-expect-error [autoremediator-refactor]: breaking change in ${packageName}`
+        );
+        newContent = fileLines.join("\n");
+        modified = true;
+      }
+    }
+  }
+  return { modified, newContent };
+}
+async function refactorConsumerCallSites(params) {
+  const { packageName, diagnosticError, callSites } = params;
+  if (callSites.length === 0) {
+    return {
+      applied: false,
+      refactoredFiles: [],
+      snapshots: {},
+      error: `No consumer call sites found for "${packageName}".`
+    };
+  }
+  const snapshots = {};
+  const refactoredFiles = [];
+  try {
+    for (const site of callSites) {
+      const originalContent = site.sourceContent || readFileSync12(site.filePath, "utf8");
+      snapshots[site.filePath] = originalContent;
+      const { modified, newContent } = transformFileContent(
+        originalContent,
+        packageName,
+        diagnosticError,
+        site.filePath
+      );
+      if (modified && newContent !== originalContent) {
+        writeFileSync3(site.filePath, newContent, "utf8");
+        refactoredFiles.push(site.filePath);
+      }
+    }
+    if (refactoredFiles.length === 0) {
+      return {
+        applied: false,
+        refactoredFiles: [],
+        snapshots,
+        error: "No automated codemod pattern matched the diagnostic error."
+      };
+    }
+    return {
+      applied: true,
+      refactoredFiles,
+      snapshots
+    };
+  } catch (err) {
+    revertRefactorSnapshots(snapshots);
+    const message = err instanceof Error ? err.message : String(err);
+    return {
+      applied: false,
+      refactoredFiles: [],
+      snapshots: {},
+      error: `Failed to apply breaking change refactoring: ${message}`
+    };
+  }
+}
+
 // src/remediation/tools/apply-version-bump.ts
 var applyVersionBumpTool = defineTool({
   description: "Update package.json to use the safe version of a vulnerable package and run the project's package manager install. In dry-run mode, only reports what would change.",
@@ -2909,10 +3878,12 @@ var applyVersionBumpTool = defineTool({
     dryRun: z4.boolean().default(false).describe("If true, report changes but do not write"),
     policy: z4.string().optional().describe("Optional path to .autoremediator policy file"),
     runTests: z4.boolean().default(false).describe("If true, run test validation after applying the fix"),
+    typecheck: z4.boolean().default(false).describe("If true, run typecheck validation after applying the fix"),
     installMode: z4.enum(["standard", "prefer-offline", "deterministic"]).optional(),
     installPreferOffline: z4.boolean().optional(),
     enforceFrozenLockfile: z4.boolean().optional(),
-    workspace: z4.string().optional()
+    workspace: z4.string().optional(),
+    breakingChangeRefactor: z4.boolean().optional().describe("If true, attempt agentic call-site refactoring when validation fails after major upgrade")
   }),
   execute: async ({
     cwd,
@@ -2923,13 +3894,15 @@ var applyVersionBumpTool = defineTool({
     dryRun,
     policy,
     runTests,
+    typecheck,
     installMode,
     installPreferOffline,
     enforceFrozenLockfile,
-    workspace
+    workspace,
+    breakingChangeRefactor
   }) => {
     const pm = packageManager ?? detectPackageManager(cwd);
-    const pkgPath = join12(cwd, "package.json");
+    let pkgPath = join15(cwd, "package.json");
     const loadedPolicy = loadPolicy(cwd, policy);
     const commandConstraints = {
       ...loadedPolicy.constraints,
@@ -2939,9 +3912,6 @@ var applyVersionBumpTool = defineTool({
       workspace: workspace ?? loadedPolicy.constraints?.workspace
     };
     const yarnMajor = pm === "yarn" ? await getYarnMajorVersion(cwd) : void 0;
-    const installCommand = resolveInstallCommand(pm, commandConstraints, yarnMajor);
-    const testCommand = resolveTestCommand(pm, commandConstraints);
-    const dedupeCommand = resolveDedupeCommand(pm, commandConstraints);
     if (!isPackageAllowed(loadedPolicy, packageName)) {
       return {
         packageName,
@@ -2954,7 +3924,7 @@ var applyVersionBumpTool = defineTool({
         message: `Policy blocked changes for package "${packageName}".`
       };
     }
-    const isMajorBump = semver2.valid(fromVersion) && semver2.valid(toVersion) && semver2.major(toVersion) > semver2.major(fromVersion);
+    const isMajorBump = semver3.valid(fromVersion) && semver3.valid(toVersion) && semver3.major(toVersion) > semver3.major(fromVersion);
     if (isMajorBump && !loadedPolicy.allowMajorBumps) {
       return {
         packageName,
@@ -2967,9 +3937,10 @@ var applyVersionBumpTool = defineTool({
         message: `Policy blocked major bump for "${packageName}" (${fromVersion} -> ${toVersion}).`
       };
     }
+    pkgPath = join15(cwd, "package.json");
     let pkgJson;
     try {
-      pkgJson = JSON.parse(readFileSync9(pkgPath, "utf8"));
+      pkgJson = JSON.parse(readFileSync13(pkgPath, "utf8"));
     } catch {
       return {
         packageName,
@@ -2981,9 +3952,20 @@ var applyVersionBumpTool = defineTool({
         message: `Could not read package.json at "${pkgPath}".`
       };
     }
-    const depField = ["dependencies", "devDependencies", "peerDependencies"].find(
+    let depField = ["dependencies", "devDependencies", "peerDependencies"].find(
       (f) => pkgJson[f]?.[packageName] !== void 0
     );
+    if (!depField) {
+      const declaringWorkspace = findDeclaringWorkspacePackage(cwd, packageName, workspace);
+      if (declaringWorkspace) {
+        pkgPath = declaringWorkspace.manifestPath;
+        pkgJson = declaringWorkspace.manifest;
+        depField = ["dependencies", "devDependencies", "peerDependencies"].find(
+          (f) => pkgJson[f]?.[packageName] !== void 0
+        );
+        commandConstraints.workspace = workspace ?? declaringWorkspace.name;
+      }
+    }
     if (!depField) {
       return {
         packageName,
@@ -2999,9 +3981,14 @@ var applyVersionBumpTool = defineTool({
     const prefixMatch = currentRange.match(/^([~^]?)/);
     const prefix = prefixMatch?.[1] ?? "";
     const newRange = `${prefix}${toVersion}`;
+    const effectiveInstallCommand = resolveInstallCommand(pm, commandConstraints, yarnMajor);
+    const effectiveTestCommand = resolveTestCommand(pm, commandConstraints);
+    const effectiveTypecheckCommand = resolveTypecheckCommand(pm, commandConstraints, cwd);
+    const effectiveDedupeCommand = resolveDedupeCommand(pm, commandConstraints);
+    const shouldTypecheck = typecheck || Boolean(commandConstraints.typecheck);
     if (dryRun) {
-      const installCmd = installCommand.join(" ");
-      const testCmd = testCommand.join(" ");
+      const installCmd = effectiveInstallCommand.join(" ");
+      const testCmd = effectiveTestCommand.join(" ");
       return {
         packageName,
         strategy: "version-bump",
@@ -3009,21 +3996,21 @@ var applyVersionBumpTool = defineTool({
         toVersion,
         applied: false,
         dryRun: true,
-        message: `[DRY RUN] Would update ${depField}.${packageName}: "${currentRange}" -> "${newRange}", then run ${installCmd}${runTests ? ` and ${testCmd}` : ""}${dedupeCommand.length > 0 ? ` and ${dedupeCommand.join(" ")} (best-effort)` : ""}.`
+        message: `[DRY RUN] Would update ${depField}.${packageName}: "${currentRange}" -> "${newRange}", then run ${installCmd}${runTests ? ` and ${testCmd}` : ""}${effectiveDedupeCommand.length > 0 ? ` and ${effectiveDedupeCommand.join(" ")} (best-effort)` : ""}.`
       };
     }
     return withRepoLock(cwd, async () => {
       pkgJson[depField][packageName] = newRange;
-      writeFileSync3(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
+      writeFileSync4(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
       try {
-        const [installCmd, ...installArgs] = installCommand;
+        const [installCmd, ...installArgs] = effectiveInstallCommand;
         await safeExeca(installCmd, installArgs, {
           cwd,
           stdio: "pipe"
         });
       } catch (err) {
         pkgJson[depField][packageName] = currentRange;
-        writeFileSync3(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
+        writeFileSync4(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
         const message = err instanceof Error ? err.message : String(err);
         return {
           packageName,
@@ -3032,52 +4019,116 @@ var applyVersionBumpTool = defineTool({
           toVersion,
           applied: false,
           dryRun: false,
-          unresolvedReason: "install-failed",
-          message: `${installCommand.join(" ")} failed after updating "${packageName}" to ${toVersion}. Reverted. Error: ${message}`
+          unresolvedReason: "install-failed",
+          message: `${effectiveInstallCommand.join(" ")} failed after updating "${packageName}" to ${toVersion}. Reverted. Error: ${message}`
+        };
+      }
+      const shouldAttemptRefactor = Boolean(
+        breakingChangeRefactor ?? loadedPolicy.constraints?.enableBreakingChangeRefactor
+      );
+      async function runValidationSteps() {
+        if (runTests) {
+          try {
+            const [testCmd, ...testArgs] = effectiveTestCommand;
+            await safeExeca(testCmd, testArgs, { cwd, stdio: "pipe" });
+          } catch (err) {
+            const execErr = err;
+            const fullOutput = [execErr.stdout, execErr.stderr, execErr.message].filter(Boolean).join("\n");
+            return {
+              passed: false,
+              error: fullOutput || (err instanceof Error ? err.message : String(err))
+            };
+          }
+        }
+        if (shouldTypecheck && effectiveTypecheckCommand.length > 0) {
+          try {
+            const [tcCmd, ...tcArgs] = effectiveTypecheckCommand;
+            await safeExeca(tcCmd, tcArgs, { cwd, stdio: "pipe" });
+          } catch (err) {
+            const execErr = err;
+            const fullOutput = [execErr.stdout, execErr.stderr, execErr.message].filter(Boolean).join("\n");
+            return {
+              passed: false,
+              isTypecheck: true,
+              error: fullOutput || (err instanceof Error ? err.message : String(err))
+            };
+          }
+        }
+        return { passed: true };
+      }
+      let validationResult = await runValidationSteps();
+      let refactoredFilesList;
+      if (!validationResult.passed && shouldAttemptRefactor) {
+        const callSites = findPackageCallSites(cwd, packageName);
+        if (callSites.length > 0) {
+          const refactorAttempt = await refactorConsumerCallSites({
+            cwd,
+            packageName,
+            fromVersion,
+            toVersion,
+            diagnosticError: validationResult.error || "",
+            callSites
+          });
+          if (refactorAttempt.applied) {
+            const postRefactorValidation = await runValidationSteps();
+            if (postRefactorValidation.passed) {
+              validationResult = { passed: true };
+              refactoredFilesList = refactorAttempt.refactoredFiles;
+            } else {
+              revertRefactorSnapshots(refactorAttempt.snapshots);
+            }
+          }
+        }
+      }
+      if (!validationResult.passed) {
+        pkgJson[depField][packageName] = currentRange;
+        writeFileSync4(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
+        try {
+          const [rollbackCmd, ...rollbackArgs] = effectiveInstallCommand;
+          await safeExeca(rollbackCmd, rollbackArgs, {
+            cwd,
+            stdio: "pipe"
+          });
+        } catch {
+        }
+        const failureMessage = validationResult.error || "Unknown validation error";
+        const prefix2 = validationResult.isTypecheck ? `TypeCheck validation failed (${effectiveTypecheckCommand.join(" ")})` : `${effectiveTestCommand.join(" ")} failed`;
+        return {
+          packageName,
+          strategy: "version-bump",
+          fromVersion,
+          toVersion,
+          applied: false,
+          dryRun: false,
+          unresolvedReason: shouldAttemptRefactor ? "breaking-change-unresolved" : "validation-failed",
+          message: `${prefix2} after upgrading "${packageName}" to ${toVersion}. Rolled back to ${currentRange}. Error: ${failureMessage}`
+        };
+      }
+      if (refactoredFilesList && refactoredFilesList.length > 0) {
+        return {
+          packageName,
+          strategy: "breaking-change-refactor",
+          fromVersion,
+          toVersion,
+          applied: true,
+          dryRun: false,
+          refactoredFiles: refactoredFilesList,
+          message: `Upgraded "${packageName}" from ${fromVersion} to ${toVersion} and refactored ${refactoredFilesList.length} call-site file(s) across breaking API changes.`
         };
       }
-      if (runTests) {
+      let dedupeNote = "";
+      if (effectiveDedupeCommand.length > 0) {
         try {
-          const [testCmd, ...testArgs] = testCommand;
-          await safeExeca(testCmd, testArgs, {
+          const [dedupeCmd, ...dedupeArgs] = effectiveDedupeCommand;
+          await safeExeca(dedupeCmd, dedupeArgs, {
             cwd,
             stdio: "pipe"
           });
         } catch (err) {
-          pkgJson[depField][packageName] = currentRange;
-          writeFileSync3(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
-          try {
-            const [rollbackCmd, ...rollbackArgs] = installCommand;
-            await safeExeca(rollbackCmd, rollbackArgs, {
-              cwd,
-              stdio: "pipe"
-            });
-          } catch {
-          }
           const message = err instanceof Error ? err.message : String(err);
-          return {
-            packageName,
-            strategy: "version-bump",
-            fromVersion,
-            toVersion,
-            applied: false,
-            dryRun: false,
-            unresolvedReason: "validation-failed",
-            message: `${testCommand.join(" ")} failed after upgrading "${packageName}" to ${toVersion}. Rolled back to ${currentRange}. Error: ${message}`
-          };
+          dedupeNote = ` Dedupe warning: ${effectiveDedupeCommand.join(" ")} failed (${message}).`;
         }
       }
-      let dedupeNote = "";
-      try {
-        const [dedupeCmd, ...dedupeArgs] = dedupeCommand;
-        await safeExeca(dedupeCmd, dedupeArgs, {
-          cwd,
-          stdio: "pipe"
-        });
-      } catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        dedupeNote = ` Dedupe warning: ${dedupeCommand.join(" ")} failed (${message}).`;
-      }
       return {
         packageName,
         strategy: "version-bump",
@@ -3085,7 +4136,7 @@ var applyVersionBumpTool = defineTool({
         toVersion,
         applied: true,
         dryRun: false,
-        message: `Successfully upgraded "${packageName}" from ${fromVersion} to ${toVersion}, ran ${installCommand.join(" ")}${runTests ? `, and passed ${testCommand.join(" ")}` : ""}.${dedupeNote}`
+        message: `Successfully upgraded "${packageName}" from ${fromVersion} to ${toVersion} in ${depField}, then ran ${effectiveInstallCommand.join(" ")}${runTests ? ` and passed ${effectiveTestCommand.join(" ")}` : ""}.${dedupeNote}`
       };
     });
   }
@@ -3093,9 +4144,9 @@ var applyVersionBumpTool = defineTool({
 
 // src/remediation/tools/apply-package-override/index.ts
 import { z as z5 } from "zod";
-import { join as join13 } from "path";
-import { existsSync as existsSync9, readFileSync as readFileSync10, writeFileSync as writeFileSync4 } from "fs";
-import semver3 from "semver";
+import { join as join16 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync14, writeFileSync as writeFileSync5 } from "fs";
+import semver4 from "semver";
 
 // src/remediation/tools/apply-package-override/helpers.ts
 async function collectDependencyTrace(cwd, pm, packageName, constraints) {
@@ -3237,9 +4288,9 @@ var applyPackageOverrideTool = defineTool({
     workspace
   }) => {
     const pm = packageManager ?? detectPackageManager(cwd);
-    const pkgPath = join13(cwd, "package.json");
-    const denoJsonPath = join13(cwd, "deno.json");
-    const isDenoNative = pm === "deno" && !existsSync9(pkgPath);
+    const pkgPath = join16(cwd, "package.json");
+    const denoJsonPath = join16(cwd, "deno.json");
+    const isDenoNative = pm === "deno" && !existsSync12(pkgPath);
     const loadedPolicy = loadPolicy(cwd, policy);
     const commandConstraints = {
       ...loadedPolicy.constraints,
@@ -3265,7 +4316,7 @@ var applyPackageOverrideTool = defineTool({
         message: `Policy blocked changes for package "${packageName}".`
       };
     }
-    const isMajorBump = semver3.valid(fromVersion) && semver3.valid(toVersion) && semver3.major(toVersion) > semver3.major(fromVersion);
+    const isMajorBump = semver4.valid(fromVersion) && semver4.valid(toVersion) && semver4.major(toVersion) > semver4.major(fromVersion);
     if (isMajorBump && !loadedPolicy.allowMajorBumps) {
       return {
         packageName,
@@ -3281,7 +4332,7 @@ var applyPackageOverrideTool = defineTool({
     if (isDenoNative) {
       let denoJson;
       try {
-        denoJson = JSON.parse(readFileSync10(denoJsonPath, "utf8"));
+        denoJson = JSON.parse(readFileSync14(denoJsonPath, "utf8"));
       } catch {
         return {
           packageName,
@@ -3327,13 +4378,13 @@ var applyPackageOverrideTool = defineTool({
       }
       return withRepoLock(cwd, async () => {
         setDenoJsonImportValue(denoJson, overrideSelector, toVersion);
-        writeFileSync4(denoJsonPath, JSON.stringify(denoJson, null, 2) + "\n", "utf8");
+        writeFileSync5(denoJsonPath, JSON.stringify(denoJson, null, 2) + "\n", "utf8");
         try {
           const [installCmd, ...installArgs] = installCommand;
           await safeExeca(installCmd, installArgs, { cwd, stdio: "pipe" });
         } catch (err) {
           restoreDenoJsonImportValue(denoJson, overrideSelector, existingEntry);
-          writeFileSync4(denoJsonPath, JSON.stringify(denoJson, null, 2) + "\n", "utf8");
+          writeFileSync5(denoJsonPath, JSON.stringify(denoJson, null, 2) + "\n", "utf8");
           const message = err instanceof Error ? err.message : String(err);
           return {
             packageName,
@@ -3352,7 +4403,7 @@ var applyPackageOverrideTool = defineTool({
             await safeExeca(testCmd, testArgs, { cwd, stdio: "pipe" });
           } catch (err) {
             restoreDenoJsonImportValue(denoJson, overrideSelector, existingEntry);
-            writeFileSync4(denoJsonPath, JSON.stringify(denoJson, null, 2) + "\n", "utf8");
+            writeFileSync5(denoJsonPath, JSON.stringify(denoJson, null, 2) + "\n", "utf8");
             try {
               const [rollbackCmd, ...rollbackArgs] = installCommand;
               await safeExeca(rollbackCmd, rollbackArgs, { cwd, stdio: "pipe" });
@@ -3384,7 +4435,7 @@ var applyPackageOverrideTool = defineTool({
     }
     let pkgJson;
     try {
-      pkgJson = JSON.parse(readFileSync10(pkgPath, "utf8"));
+      pkgJson = JSON.parse(readFileSync14(pkgPath, "utf8"));
     } catch {
       return {
         packageName,
@@ -3414,13 +4465,13 @@ var applyPackageOverrideTool = defineTool({
     }
     return withRepoLock(cwd, async () => {
       setOverrideValue(pkgJson, pm, overrideSelector, toVersion);
-      writeFileSync4(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
+      writeFileSync5(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
       try {
         const [installCmd, ...installArgs] = installCommand;
         await safeExeca(installCmd, installArgs, { cwd, stdio: "pipe" });
       } catch (err) {
         restoreOverrideValue(pkgJson, pm, overrideSelector, previousValue);
-        writeFileSync4(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
+        writeFileSync5(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
         const message = err instanceof Error ? err.message : String(err);
         return {
           packageName,
@@ -3439,7 +4490,7 @@ var applyPackageOverrideTool = defineTool({
           await safeExeca(testCmd, testArgs, { cwd, stdio: "pipe" });
         } catch (err) {
           restoreOverrideValue(pkgJson, pm, overrideSelector, previousValue);
-          writeFileSync4(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
+          writeFileSync5(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
           try {
             const [rollbackCmd, ...rollbackArgs] = installCommand;
             await safeExeca(rollbackCmd, rollbackArgs, { cwd, stdio: "pipe" });
@@ -3481,6 +4532,80 @@ var applyPackageOverrideTool = defineTool({
   }
 });
 
+// src/platform/supply-chain.ts
+async function verifyPackageTrust(packageName, targetVersion, policy) {
+  if (!policy || !policy.minPublishAgeHours && !policy.blockInstallScripts && !policy.requireProvenance) {
+    return { trusted: true };
+  }
+  const url = `https://registry.npmjs.org/${encodeURIComponent(packageName)}`;
+  let packument = null;
+  try {
+    const res = await httpClient({
+      url,
+      headers: { Accept: "application/vnd.npm.install-v1+json; q=1.0, application/json; q=0.8" }
+    });
+    if (res.ok && res.data) {
+      packument = res.data;
+    }
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return {
+      trusted: false,
+      reason: `Could not verify supply-chain trust for "${packageName}@${targetVersion}": ${msg}`
+    };
+  }
+  if (!packument) {
+    return {
+      trusted: false,
+      reason: `Package packument for "${packageName}" not found on registry.`
+    };
+  }
+  let publishAgeHours;
+  if (packument.time?.[targetVersion]) {
+    const publishedAt = new Date(packument.time[targetVersion]).getTime();
+    publishAgeHours = Math.max(0, (Date.now() - publishedAt) / (1e3 * 60 * 60));
+    if (policy.minPublishAgeHours && publishAgeHours < policy.minPublishAgeHours) {
+      return {
+        trusted: false,
+        publishAgeHours,
+        reason: `Target release "${packageName}@${targetVersion}" was published only ${publishAgeHours.toFixed(1)}h ago (minimum required age is ${policy.minPublishAgeHours}h).`
+      };
+    }
+  }
+  const versionData = packument.versions?.[targetVersion];
+  const scripts = versionData?.scripts ?? {};
+  const installScriptKeys = ["preinstall", "install", "postinstall"].filter(
+    (k) => Boolean(scripts[k])
+  );
+  const hasInstallScripts = installScriptKeys.length > 0;
+  if (policy.blockInstallScripts && hasInstallScripts) {
+    return {
+      trusted: false,
+      publishAgeHours,
+      hasInstallScripts: true,
+      reason: `Target release "${packageName}@${targetVersion}" defines risky lifecycle scripts (${installScriptKeys.join(", ")}).`
+    };
+  }
+  const hasProvenance = Boolean(
+    versionData?.dist?.attestations?.provenance || versionData?.dist?.attestations?.url
+  );
+  if (policy.requireProvenance && !hasProvenance) {
+    return {
+      trusted: false,
+      publishAgeHours,
+      hasInstallScripts,
+      hasProvenance: false,
+      reason: `Target release "${packageName}@${targetVersion}" does not have cryptographic build provenance attestations.`
+    };
+  }
+  return {
+    trusted: true,
+    publishAgeHours,
+    hasInstallScripts,
+    hasProvenance
+  };
+}
+
 // src/remediation/local/primary-strategy.ts
 async function resolvePrimaryResult(params) {
   const { vulnerable, cwd, packageManager, dryRun, policy, runTests, constraints } = params;
@@ -3551,6 +4676,26 @@ async function resolvePrimaryResult(params) {
         }
       };
     }
+    const trust2 = await verifyPackageTrust(
+      pkg.name,
+      safeUpgrade2.safeVersion,
+      constraints.supplyChainPolicy
+    );
+    if (!trust2.trusted) {
+      return {
+        steps: 1,
+        result: {
+          packageName: pkg.name,
+          strategy: "none",
+          fromVersion: pkg.version,
+          applied: false,
+          dryRun,
+          unresolvedReason: "policy-blocked",
+          vulnerableRange: vulnerable.affected.vulnerableRange,
+          message: `Supply chain trust gate blocked "${pkg.name}@${safeUpgrade2.safeVersion}": ${trust2.reason}`
+        }
+      };
+    }
     const overrideResult = await applyPackageOverrideTool.execute({
       cwd,
       packageManager,
@@ -3606,6 +4751,26 @@ async function resolvePrimaryResult(params) {
       }
     };
   }
+  const trust = await verifyPackageTrust(
+    pkg.name,
+    safeUpgrade.safeVersion,
+    constraints.supplyChainPolicy
+  );
+  if (!trust.trusted) {
+    return {
+      steps: 1,
+      result: {
+        packageName: pkg.name,
+        strategy: "none",
+        fromVersion: pkg.version,
+        applied: false,
+        dryRun,
+        unresolvedReason: "policy-blocked",
+        vulnerableRange: vulnerable.affected.vulnerableRange,
+        message: `Supply chain trust gate blocked "${pkg.name}@${safeUpgrade.safeVersion}": ${trust.reason}`
+      }
+    };
+  }
   const applyResult = await applyVersionBumpTool.execute({
     cwd,
     packageManager,
@@ -3615,10 +4780,12 @@ async function resolvePrimaryResult(params) {
     dryRun,
     policy,
     runTests,
+    typecheck: constraints.typecheck,
     installMode: constraints.installMode,
     installPreferOffline: constraints.installPreferOffline,
     enforceFrozenLockfile: constraints.enforceFrozenLockfile,
-    workspace: constraints.workspace
+    workspace: constraints.workspace,
+    breakingChangeRefactor: constraints.enableBreakingChangeRefactor
   });
   return {
     steps: 2,
@@ -3628,10 +4795,10 @@ async function resolvePrimaryResult(params) {
 
 // src/remediation/tools/fetch-package-source.ts
 import { z as z6 } from "zod";
-import { mkdir as mkdir2, mkdtemp, readdir as readdir2, readFile as readFile3, rm as rm2 } from "fs/promises";
-import { join as join14 } from "path";
+import { mkdir as mkdir2, mkdtemp, readdir as readdir2, readFile as readFile4, rm as rm3 } from "fs/promises";
+import { join as join17 } from "path";
 import { tmpdir } from "os";
-import { execa as execa6 } from "execa";
+import { execa as execa7 } from "execa";
 var fetchPackageSourceTool = defineTool({
   description: "Download package tarball from npm and extract source files for CVE analysis. Supports custom file patterns (default: *.js, *.ts).",
   parameters: z6.object({
@@ -3649,25 +4816,25 @@ var fetchPackageSourceTool = defineTool({
     if (safePatterns.length === 0) {
       return { success: false, error: "No valid file patterns provided." };
     }
-    const tempBaseDir = await mkdtemp(join14(tmpdir(), "autoremediator-pkg-"));
-    const extractDir = join14(tempBaseDir, "out");
+    const tempBaseDir = await mkdtemp(join17(tmpdir(), "autoremediator-pkg-"));
+    const extractDir = join17(tempBaseDir, "out");
     try {
       const scopedName = packageName.split("/").pop();
       const npmUrl = `https://registry.npmjs.org/${packageName}/-/${scopedName}-${version}.tgz`;
       await mkdir2(tempBaseDir, { recursive: true });
-      const tarballPath = join14(tempBaseDir, "package.tgz");
-      await execa6("curl", ["-L", "-o", tarballPath, npmUrl]);
+      const tarballPath = join17(tempBaseDir, "package.tgz");
+      await execa7("curl", ["-L", "-o", tarballPath, npmUrl]);
       await mkdir2(extractDir, { recursive: true });
-      await execa6("tar", ["-xzf", tarballPath, "-C", extractDir]);
+      await execa7("tar", ["-xzf", tarballPath, "-C", extractDir]);
       const extractedContents = await readdir2(extractDir);
-      const packageRootDir = extractedContents.includes("package") ? join14(extractDir, "package") : extractDir;
+      const packageRootDir = extractedContents.includes("package") ? join17(extractDir, "package") : extractDir;
       const sourceCode = {};
       async function walkDir(dir, relativeBase) {
         try {
           const files = await readdir2(dir, { withFileTypes: true });
           for (const file of files) {
-            const fullPath = join14(dir, file.name);
-            const relPath = join14(relativeBase, file.name);
+            const fullPath = join17(dir, file.name);
+            const relPath = join17(relativeBase, file.name);
             if (file.isDirectory()) {
               if (!["node_modules", ".git", "dist", "build", "coverage", ".next", "out"].includes(
                 file.name
@@ -3681,7 +4848,7 @@ var fetchPackageSourceTool = defineTool({
               });
               if (matches) {
                 try {
-                  const content = await readFile3(fullPath, "utf8");
+                  const content = await readFile4(fullPath, "utf8");
                   sourceCode[relPath] = content;
                 } catch {
                 }
@@ -3716,7 +4883,7 @@ var fetchPackageSourceTool = defineTool({
         error: `Failed to fetch and extract package ${packageName}@${version}: ${message}`
       };
     } finally {
-      await rm2(tempBaseDir, { recursive: true, force: true });
+      await rm3(tempBaseDir, { recursive: true, force: true });
     }
   }
 });
@@ -3774,6 +4941,7 @@ Analyze the source code to:
 2. Explain the root cause of the security issue
 3. Propose a secure fix that addresses the vulnerability
 4. Provide the complete fixed version of affected files
+5. Optionally provide a standalone Node.js reproduction/regression test script
 
 ## Response Format
 Respond ONLY with valid JSON (no markdown, no extra text):
@@ -3784,7 +4952,8 @@ Respond ONLY with valid JSON (no markdown, no extra text):
     "path/to/other.ts": "Complete fixed source code for this file"
   },
   "confidence": 0.95,
-  "riskLevel": "medium"
+  "riskLevel": "medium",
+  "reproductionTest": "// Node.js script asserting the patch resolves the exploit/regression"
 }
 
 Important:
@@ -3795,7 +4964,7 @@ Important:
 }
 
 // src/remediation/tools/generate-patch/helpers.ts
-import { parseSync as parseSync2 } from "oxc-parser";
+import { parseSync as parseSync3 } from "oxc-parser";
 import YAML from "yaml";
 function parseLlmAnalysisResponse(text) {
   try {
@@ -3818,7 +4987,7 @@ function validatePatchedCodeSyntax(filePath, code) {
   const lowerPath = filePath.toLowerCase();
   if (/\.[cm]?[jt]sx?$/i.test(lowerPath)) {
     try {
-      const res = parseSync2(filePath, code);
+      const res = parseSync3(filePath, code);
       if (res.errors && res.errors.length > 0) {
         const errorMsg = res.errors.map((e) => e.message).join("; ");
         return {
@@ -4064,6 +5233,7 @@ var generatePatchTool = defineTool({
         success: true,
         patches,
         patchContent: patches[0]?.unifiedDiff,
+        reproductionTest: analysis.reproductionTest,
         llmProvider: provider,
         llmModel: modelName,
         latencyMs,
@@ -4088,17 +5258,126 @@ var generatePatchTool = defineTool({
 
 // src/remediation/tools/apply-patch-file/index.ts
 import { z as z8 } from "zod";
-import { mkdir as mkdir3, writeFile as writeFile2 } from "fs/promises";
-import { join as join16 } from "path";
-import { execa as execa8 } from "execa";
+import { mkdir as mkdir3, writeFile as writeFile3 } from "fs/promises";
+import { existsSync as existsSync14 } from "fs";
+import { isAbsolute as isAbsolute4, join as join19 } from "path";
+import { execa as execa9 } from "execa";
+
+// src/remediation/proof-of-fix/runner.ts
+async function runProofOfFixPhase(options) {
+  const { stage, testFilePath, cwd, timeoutMs = 15e3 } = options;
+  const started = Date.now();
+  const isTs = testFilePath.endsWith(".ts");
+  const nodeArgs = isTs ? ["--experimental-strip-types", testFilePath] : [testFilePath];
+  try {
+    const result = await safeExeca("node", nodeArgs, {
+      cwd,
+      timeoutMs,
+      stdio: "pipe"
+    });
+    const durationMs = Date.now() - started;
+    const output = `${result.stdout || ""}
+${result.stderr || ""}`.trim();
+    if (stage === "negative") {
+      return {
+        executed: true,
+        passed: false,
+        exitCode: 0,
+        output,
+        durationMs,
+        error: "Exploit reproduction test passed on vulnerable target (failed to reproduce vulnerability)."
+      };
+    }
+    return {
+      executed: true,
+      passed: true,
+      exitCode: 0,
+      output,
+      durationMs
+    };
+  } catch (err) {
+    const durationMs = Date.now() - started;
+    const execaErr = err;
+    const exitCode = typeof execaErr.exitCode === "number" ? execaErr.exitCode : 1;
+    const errorMsg = execaErr.message || String(err);
+    const output = [execaErr.stdout, execaErr.stderr, errorMsg].filter(Boolean).join("\n").trim();
+    if (stage === "negative") {
+      if (execaErr.timedOut || errorMsg.includes("timed out")) {
+        return {
+          executed: true,
+          passed: false,
+          exitCode,
+          output,
+          durationMs,
+          error: "Exploit reproduction test timed out (execution hung)."
+        };
+      }
+      const isHarnessFailure = exitCode === 127 || errorMsg.includes("ENOENT") || output.includes("bad option:") || output.includes("Cannot find module") && output.includes(testFilePath);
+      if (isHarnessFailure) {
+        return {
+          executed: false,
+          passed: false,
+          exitCode,
+          output,
+          durationMs,
+          error: `Reproduction test failed to execute (harness error): ${errorMsg}`
+        };
+      }
+      return {
+        executed: true,
+        passed: true,
+        exitCode,
+        output,
+        durationMs
+      };
+    }
+    return {
+      executed: true,
+      passed: false,
+      exitCode,
+      output,
+      durationMs,
+      error: `Reproduction test failed on patched target: ${errorMsg}`
+    };
+  }
+}
+function assembleProofOfFixVerification(params) {
+  const { reproductionTestPath, negativePhase, positivePhase, regressionPhase } = params;
+  const regPhase = regressionPhase ?? {
+    executed: false,
+    passed: true
+  };
+  let status = "verified";
+  let failureReason;
+  if (!negativePhase.passed) {
+    status = "failed";
+    failureReason = negativePhase.error || "negative-phase-failed";
+  } else if (!positivePhase.passed) {
+    status = "failed";
+    failureReason = positivePhase.error || "positive-phase-failed";
+  } else if (regPhase.executed && !regPhase.passed) {
+    status = "failed";
+    failureReason = regPhase.error || "regression-phase-failed";
+  }
+  const durationMs = (negativePhase.durationMs || 0) + (positivePhase.durationMs || 0) + (regPhase.durationMs || 0);
+  return {
+    status,
+    reproductionTestPath,
+    negativePhase,
+    positivePhase,
+    regressionPhase: regPhase,
+    durationMs,
+    failureReason
+  };
+}
 
 // src/remediation/tools/apply-patch-file/helpers.ts
-import { existsSync as existsSync10 } from "fs";
-import { mkdtemp as mkdtemp2, readFile as readFile4, rm as rm3, writeFile } from "fs/promises";
+import { existsSync as existsSync13 } from "fs";
+import { mkdtemp as mkdtemp2, readFile as readFile5, rm as rm4, writeFile as writeFile2 } from "fs/promises";
 import { createHash } from "crypto";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join15 } from "path";
-import { execa as execa7 } from "execa";
+import { join as join18 } from "path";
+import { execa as execa8 } from "execa";
 async function resolvePatchMode(packageManager, cwd) {
   if (packageManager === "npm" || packageManager === "bun" || packageManager === "deno")
     return "patch-package";
@@ -4129,13 +5408,13 @@ function computePatchIntegrity(patchContent) {
   return `sha256:${hex}`;
 }
 async function writePatchManifest(manifestFilePath, artifact) {
-  await writeFile(manifestFilePath, JSON.stringify(artifact, null, 2) + "\n", "utf8");
+  await writeFile2(manifestFilePath, JSON.stringify(artifact, null, 2) + "\n", "utf8");
 }
 async function configurePatchPackagePostinstall(cwd, packageManager) {
-  const pkgJsonPath = join15(cwd, "package.json");
+  const pkgJsonPath = join18(cwd, "package.json");
   let pkgJson;
   try {
-    pkgJson = JSON.parse(await readFile4(pkgJsonPath, "utf8"));
+    pkgJson = JSON.parse(await readFile5(pkgJsonPath, "utf8"));
   } catch {
     return {
       success: false,
@@ -4147,7 +5426,7 @@ async function configurePatchPackagePostinstall(cwd, packageManager) {
     try {
       const commands = getPackageManagerCommands(packageManager);
       const [cmd, ...args] = commands.installDev("patch-package");
-      await execa7(cmd, args, {
+      await execa8(cmd, args, {
         cwd,
         stdio: "pipe"
       });
@@ -4168,13 +5447,13 @@ async function configurePatchPackagePostinstall(cwd, packageManager) {
   } else if (!currentPostinstall) {
     pkgJson.scripts.postinstall = patchApplyCmd;
   }
-  await writeFile(pkgJsonPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
+  await writeFile2(pkgJsonPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
   return { success: true };
 }
 async function capturePackageJsonSnapshot(cwd) {
-  const path = join15(cwd, "package.json");
+  const path = join18(cwd, "package.json");
   try {
-    const content = await readFile4(path, "utf8");
+    const content = await readFile5(path, "utf8");
     return { path, content };
   } catch {
     return void 0;
@@ -4190,19 +5469,19 @@ async function cleanupPatchArtifacts(params) {
     installCommand,
     rerunInstall
   } = params;
-  await rm3(patchFilePath, { force: true }).catch(() => void 0);
+  await rm4(patchFilePath, { force: true }).catch(() => void 0);
   if (manifestFilePath) {
-    await rm3(manifestFilePath, { force: true }).catch(() => void 0);
+    await rm4(manifestFilePath, { force: true }).catch(() => void 0);
   }
   if (patchMode === "patch-package" && packageJsonSnapshot) {
-    await writeFile(packageJsonSnapshot.path, packageJsonSnapshot.content, "utf8").catch(
+    await writeFile2(packageJsonSnapshot.path, packageJsonSnapshot.content, "utf8").catch(
       () => void 0
     );
   }
   if (!rerunInstall) return;
   try {
     const [installCmd, ...installArgs] = installCommand;
-    await execa7(installCmd, installArgs, {
+    await execa8(installCmd, installArgs, {
       cwd,
       stdio: "pipe"
     });
@@ -4216,7 +5495,7 @@ async function applyNativePatch(params) {
   const createArgs = ["patch", packageSpec];
   let patchDir;
   try {
-    const createResult = await execa7(createCommand, createArgs, {
+    const createResult = await execa8(createCommand, createArgs, {
       cwd,
       stdio: "pipe"
     });
@@ -4244,17 +5523,17 @@ ${createResult.stderr}`);
       error: `Could not determine native patch directory for ${packageSpec}.`
     };
   }
-  const tempPatchDir = await mkdtemp2(join15(tmpdir2(), "autoremediator-native-patch-"));
-  const tempPatchFile = join15(tempPatchDir, "change.patch");
+  const tempPatchDir = await mkdtemp2(join18(tmpdir2(), "autoremediator-native-patch-"));
+  const tempPatchFile = join18(tempPatchDir, "change.patch");
   try {
-    await writeFile(tempPatchFile, patchContent, "utf8");
-    await execa7("patch", ["-p1", "-i", tempPatchFile], {
+    await writeFile2(tempPatchFile, patchContent, "utf8");
+    await execa8("patch", ["-p1", "-i", tempPatchFile], {
       cwd: patchDir,
       stdio: "pipe"
     });
     const commitCommand = patchMode === "native-pnpm" ? "pnpm" : "yarn";
     const commitArgs = patchMode === "native-pnpm" ? ["patch-commit", patchDir] : ["patch-commit", "-s", patchDir];
-    await execa7(commitCommand, commitArgs, {
+    await execa8(commitCommand, commitArgs, {
       cwd,
       stdio: "pipe"
     });
@@ -4269,19 +5548,19 @@ ${createResult.stderr}`);
       error: `Failed to apply native patch for ${packageSpec}: ${err instanceof Error ? err.message : String(err)}`
     };
   } finally {
-    await rm3(tempPatchDir, { recursive: true, force: true });
+    await rm4(tempPatchDir, { recursive: true, force: true });
   }
   return { success: true };
 }
 function extractPatchDirectory(output) {
   const lines = output.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
   for (const line of lines) {
-    if (existsSync10(line)) {
+    if (existsSync13(line)) {
       return line;
     }
     const tokens = line.split(/\s+/).map((token) => token.replace(/^['"]|['"]$/g, ""));
     for (const token of tokens) {
-      if (token.startsWith("/") && existsSync10(token)) {
+      if (token.startsWith("/") && existsSync13(token)) {
         return token;
       }
     }
@@ -4291,7 +5570,7 @@ function extractPatchDirectory(output) {
 async function validatePatchWithTests(cwd, testCommand) {
   try {
     const [cmd, ...args] = testCommand;
-    const result = await execa7(cmd, args, {
+    const result = await execa8(cmd, args, {
       cwd,
       timeout: 6e4,
       stdio: "pipe"
@@ -4351,6 +5630,11 @@ var applyPatchFileTool = defineTool({
     enforceFrozenLockfile: z8.boolean().optional(),
     workspace: z8.string().optional(),
     validateWithTests: z8.boolean().optional().default(true).describe("Run package manager test command to validate patch doesn't break anything"),
+    reproductionTest: z8.string().optional().describe("Optional synthesized reproduction test script verifying fix"),
+    proofOfFix: z8.union([z8.boolean(), z8.string()]).optional().describe(
+      "If true or script path/content, enforce dual-stage exploit reproduction (assert failure pre-patch, assert pass post-patch)"
+    ),
+    requireProofOfFix: z8.boolean().optional().describe("If true, fail and roll back patch if proof-of-fix verification fails"),
     dryRun: z8.boolean().optional().default(false).describe("If true, report but do not mutate files")
   }).refine((value) => Boolean(value.patchContent || value.patches && value.patches.length > 0), {
     message: "Either patchContent or patches must be provided"
@@ -4372,6 +5656,9 @@ var applyPatchFileTool = defineTool({
     workspace,
     riskLevel,
     validateWithTests,
+    reproductionTest,
+    proofOfFix,
+    requireProofOfFix,
     dryRun
   }) => {
     try {
@@ -4422,7 +5709,7 @@ var applyPatchFileTool = defineTool({
         };
       }
       const patchFileName = buildPatchFileName(packageName, vulnerableVersion);
-      const patchFilePath = join16(cwd, patchesDir, patchFileName);
+      const patchFilePath = join19(cwd, patchesDir, patchFileName);
       const manifestFilePath = `${patchFilePath}.json`;
       const generatedAt = (/* @__PURE__ */ new Date()).toISOString();
       const baseArtifact = {
@@ -4461,9 +5748,9 @@ var applyPatchFileTool = defineTool({
       }
       return withRepoLock(cwd, async () => {
         const packageJsonSnapshot = patchModeRequiresPackageJsonSnapshot(pm) ? await capturePackageJsonSnapshot(cwd) : void 0;
-        const patchesDirPath = join16(cwd, patchesDir);
+        const patchesDirPath = join19(cwd, patchesDir);
         await mkdir3(patchesDirPath, { recursive: true });
-        await writeFile2(patchFilePath, selectedPatch, "utf8");
+        await writeFile3(patchFilePath, selectedPatch, "utf8");
         validationPhases.push({
           phase: "patch-write",
           passed: true,
@@ -4484,6 +5771,101 @@ var applyPatchFileTool = defineTool({
         });
         artifact.validationPhases = validationPhases;
         await writePatchManifest(manifestFilePath, artifact);
+        let reproductionTestPath;
+        let negativePhaseResult;
+        if (typeof proofOfFix === "string" && proofOfFix.trim().length > 0) {
+          const resolvedPath = isAbsolute4(proofOfFix) ? proofOfFix : join19(cwd, proofOfFix);
+          if (existsSync14(resolvedPath)) {
+            reproductionTestPath = resolvedPath;
+          } else {
+            const safeName = packageName.replace(/^@/, "").replace(/\//g, "+");
+            reproductionTestPath = join19(patchesDirPath, `${safeName}+${vulnerableVersion}.test.cjs`);
+            await writeFile3(reproductionTestPath, proofOfFix, "utf8");
+          }
+        } else if (reproductionTest) {
+          const safeName = packageName.replace(/^@/, "").replace(/\//g, "+");
+          reproductionTestPath = join19(patchesDirPath, `${safeName}+${vulnerableVersion}.test.cjs`);
+          await writeFile3(reproductionTestPath, reproductionTest, "utf8");
+        }
+        const isProofOfFixActive = Boolean(proofOfFix || requireProofOfFix);
+        if (isProofOfFixActive) {
+          if (!reproductionTestPath) {
+            if (requireProofOfFix) {
+              await cleanupPatchArtifacts({
+                cwd,
+                patchFilePath,
+                manifestFilePath,
+                patchMode,
+                packageJsonSnapshot,
+                installCommand,
+                rerunInstall: false
+              });
+              return {
+                success: false,
+                packageName,
+                vulnerableVersion,
+                applied: false,
+                dryRun: false,
+                message: "Proof-of-fix verification required, but no reproduction test or script was supplied.",
+                patchFilePath,
+                manifestFilePath,
+                patchPath: patchFilePath,
+                patchMode,
+                postinstallConfigured: false,
+                patchArtifact: {
+                  ...artifact,
+                  applied: false,
+                  validationPhases
+                },
+                validationPhases,
+                error: "Proof-of-fix verification required, but no reproduction test or script was supplied."
+              };
+            }
+          } else {
+            negativePhaseResult = await runProofOfFixPhase({
+              stage: "negative",
+              testFilePath: reproductionTestPath,
+              cwd
+            });
+            validationPhases.push({
+              phase: "proof-of-fix-negative",
+              passed: negativePhaseResult.passed,
+              message: negativePhaseResult.passed ? "Reproduction test reproduced vulnerability on unpatched code." : void 0,
+              error: negativePhaseResult.passed ? void 0 : negativePhaseResult.error
+            });
+            if (!negativePhaseResult.passed && requireProofOfFix) {
+              await cleanupPatchArtifacts({
+                cwd,
+                patchFilePath,
+                manifestFilePath,
+                patchMode,
+                packageJsonSnapshot,
+                installCommand,
+                rerunInstall: false
+              });
+              return {
+                success: false,
+                packageName,
+                vulnerableVersion,
+                applied: false,
+                dryRun: false,
+                message: `Proof-of-fix negative phase failed: ${negativePhaseResult.error}`,
+                patchFilePath,
+                manifestFilePath,
+                patchPath: patchFilePath,
+                patchMode,
+                postinstallConfigured: false,
+                patchArtifact: {
+                  ...artifact,
+                  applied: false,
+                  validationPhases
+                },
+                validationPhases,
+                error: `Proof-of-fix negative phase failed: ${negativePhaseResult.error}`
+              };
+            }
+          }
+        }
         const applyResult = patchMode === "patch-package" ? await configurePatchPackagePostinstall(cwd, pm) : await applyNativePatch({
           cwd,
           packageName,
@@ -4531,7 +5913,7 @@ var applyPatchFileTool = defineTool({
         if (patchMode === "patch-package") {
           try {
             const [installCmd, ...installArgs] = installCommand;
-            await execa8(installCmd, installArgs, {
+            await execa9(installCmd, installArgs, {
               cwd,
               stdio: "pipe"
             });
@@ -4624,11 +6006,90 @@ var applyPatchFileTool = defineTool({
             message: "Patch validation tests passed."
           });
         }
+        let positivePhaseResult;
+        if (reproductionTestPath) {
+          if (isProofOfFixActive) {
+            positivePhaseResult = await runProofOfFixPhase({
+              stage: "positive",
+              testFilePath: reproductionTestPath,
+              cwd
+            });
+            validationPhases.push({
+              phase: "proof-of-fix-positive",
+              passed: positivePhaseResult.passed,
+              message: positivePhaseResult.passed ? "Reproduction test passed on patched code (vulnerability mitigated)." : void 0,
+              error: positivePhaseResult.passed ? void 0 : positivePhaseResult.error
+            });
+            if (!positivePhaseResult.passed && (requireProofOfFix || validateWithTests)) {
+              await cleanupPatchArtifacts({
+                cwd,
+                patchFilePath,
+                manifestFilePath,
+                patchMode,
+                packageJsonSnapshot,
+                installCommand,
+                rerunInstall: patchMode === "patch-package"
+              });
+              return {
+                success: false,
+                packageName,
+                vulnerableVersion,
+                applied: false,
+                dryRun: false,
+                message: `Proof-of-fix positive phase failed: ${positivePhaseResult.error}`,
+                patchFilePath,
+                manifestFilePath,
+                patchPath: patchFilePath,
+                patchMode,
+                postinstallConfigured: false,
+                patchArtifact: {
+                  ...artifact,
+                  applied: false,
+                  validationPhases
+                },
+                validationPhases,
+                error: `Proof-of-fix positive phase failed: ${positivePhaseResult.error}`
+              };
+            }
+          } else {
+            try {
+              const reproRun = await execa9("node", [reproductionTestPath], { cwd, stdio: "pipe" });
+              validationPhases.push({
+                phase: "reproduction-test",
+                passed: reproRun.exitCode === 0,
+                message: "Reproduction test verified fix successfully."
+              });
+            } catch (err) {
+              const reproErr = err instanceof Error ? err.message : String(err);
+              validationPhases.push({
+                phase: "reproduction-test",
+                passed: false,
+                error: `Reproduction test failed: ${reproErr}`
+              });
+            }
+          }
+        }
+        let proofOfFixVerification;
+        if (negativePhaseResult && positivePhaseResult) {
+          proofOfFixVerification = assembleProofOfFixVerification({
+            reproductionTestPath,
+            negativePhase: negativePhaseResult,
+            positivePhase: positivePhaseResult,
+            regressionPhase: validationResult ? {
+              executed: true,
+              passed: validationResult.passed,
+              error: validationResult.error
+            } : void 0
+          });
+        }
         const finalArtifact = {
           ...artifact,
           applied: true,
           dryRun: false,
-          validationPhases
+          reproductionTest,
+          reproductionTestPath,
+          validationPhases,
+          proofOfFix: proofOfFixVerification
         };
         await writePatchManifest(manifestFilePath, finalArtifact);
         return {
@@ -4645,7 +6106,8 @@ var applyPatchFileTool = defineTool({
           postinstallConfigured: patchMode === "patch-package",
           patchArtifact: finalArtifact,
           validation: validationResult,
-          validationPhases
+          validationPhases,
+          proofOfFix: proofOfFixVerification
         };
       });
     } catch (err) {
@@ -4889,6 +6351,9 @@ async function tryLocalPatchFallback(params) {
     workspace: params.workspace,
     riskLevel: patchResult.riskLevel,
     validateWithTests: params.runTests,
+    reproductionTest: patchResult.reproductionTest,
+    proofOfFix: params.proofOfFix,
+    requireProofOfFix: params.requireProofOfFix,
     dryRun: params.dryRun
   });
   steps += 1;
@@ -4937,8 +6402,14 @@ function resolveLocalRunOptions(options) {
   const runTests = options.runTests ?? false;
   const policy = options.policy ?? "";
   const patchesDir = options.patchesDir || "./patches";
-  const constraints = options.constraints ?? {};
   const loadedPolicy = loadPolicy(cwd, options.policy);
+  const constraints = {
+    ...options.constraints,
+    typecheck: options.typecheck ?? options.constraints?.typecheck ?? loadedPolicy.constraints?.typecheck,
+    supplyChainPolicy: options.supplyChainPolicy ?? options.constraints?.supplyChainPolicy ?? loadedPolicy.constraints?.supplyChainPolicy,
+    enableBreakingChangeRefactor: options.breakingChangeRefactor ?? options.constraints?.enableBreakingChangeRefactor ?? loadedPolicy.constraints?.enableBreakingChangeRefactor,
+    requireProofOfFix: options.requireProofOfFix ?? options.constraints?.requireProofOfFix ?? loadedPolicy.constraints?.requireProofOfFix
+  };
   const llmProvider = resolveProvider(options);
   return {
     cwd,
@@ -4969,12 +6440,15 @@ function resolveLocalRunOptions(options) {
     regressionCheck: options.regressionCheck ?? false,
     escalationGraph: options.escalationGraph ?? loadedPolicy.escalationGraph,
     offlineIntelligence: options.offlineIntelligence ?? false,
-    intelligenceSnapshotPath: options.intelligenceSnapshotPath
+    intelligenceSnapshotPath: options.intelligenceSnapshotPath,
+    proofOfFix: options.proofOfFix,
+    requireProofOfFix: options.requireProofOfFix ?? constraints.requireProofOfFix,
+    breakingChangeRefactor: options.breakingChangeRefactor ?? constraints.enableBreakingChangeRefactor
   };
 }
 
 // src/remediation/local/vulnerability-match.ts
-import semver4 from "semver";
+import semver5 from "semver";
 function findVulnerablePackages(cveDetails, installedPackages) {
   const vulnerablePackages = [];
   for (const affected of cveDetails.affectedPackages) {
@@ -4983,10 +6457,10 @@ function findVulnerablePackages(cveDetails, installedPackages) {
     if (affected.ecosystem !== "npm") continue;
     const matches = installedPackages.filter((pkg) => pkg.name === affected.name);
     for (const installed of matches) {
-      if (!semver4.valid(installed.version)) continue;
+      if (!semver5.valid(installed.version)) continue;
       let isVulnerable = false;
       try {
-        isVulnerable = semver4.satisfies(installed.version, affected.vulnerableRange, {
+        isVulnerable = semver5.satisfies(installed.version, affected.vulnerableRange, {
           includePrerelease: false
         });
       } catch {
@@ -5137,7 +6611,9 @@ async function runLocalRemediationPipeline(cveId, options = {}) {
     regressionCheck,
     escalationGraph,
     offlineIntelligence,
-    intelligenceSnapshotPath
+    intelligenceSnapshotPath,
+    proofOfFix,
+    requireProofOfFix
   } = resolved;
   const correlation = {
     requestId: options.requestId,
@@ -5314,7 +6790,9 @@ async function runLocalRemediationPipeline(cveId, options = {}) {
         installPreferOffline: constraints.installPreferOffline,
         enforceFrozenLockfile: constraints.enforceFrozenLockfile,
         workspace: constraints.workspace,
-        vulnerableRange: vulnerable.affected.vulnerableRange
+        vulnerableRange: vulnerable.affected.vulnerableRange,
+        proofOfFix,
+        requireProofOfFix
       });
       agentSteps += fallback.steps;
       collectedResults.push(finalizePatchResult(fallback.result));
@@ -5329,7 +6807,7 @@ async function runLocalRemediationPipeline(cveId, options = {}) {
     };
     if (regressionCheck && primaryResult.applied && !dryRun && primaryResult.toVersion) {
       try {
-        if (semver5.satisfies(primaryResult.toVersion, vulnerable.affected.vulnerableRange, {
+        if (semver6.satisfies(primaryResult.toVersion, vulnerable.affected.vulnerableRange, {
           includePrerelease: false
         })) {
           primaryResult.regressionDetected = true;
@@ -5420,8 +6898,8 @@ function accumulateStepResults(params) {
 }
 
 // src/remediation/orchestration-prompt.ts
-import { existsSync as existsSync11, readFileSync as readFileSync11 } from "fs";
-import { join as join17 } from "path";
+import { existsSync as existsSync15, readFileSync as readFileSync15 } from "fs";
+import { join as join20 } from "path";
 function buildProviderAddendum(provider, personality = "balanced") {
   const personalityDirective = personality === "analytical" ? "Use concise, explicit rationale for tool decisions and unresolved outcomes." : personality === "pragmatic" ? "Prefer the smallest safe remediation path while preserving policy and validation gates." : "Balance concise execution with brief rationale for risky or unresolved outcomes.";
   const providerDirective = provider === "remote" ? "Use strict structured output and deterministic reporting fields." : "Use deterministic-first behavior and only rely on remote model fallback when required by patch generation.";
@@ -5432,13 +6910,13 @@ Provider profile:
 - ${personalityDirective}`;
 }
 function loadOrchestrationPrompt(ctx) {
-  const promptPath = join17(
+  const promptPath = join20(
     process.cwd(),
     ".github",
     "instructions",
     "orchestration.instructions.md"
   );
-  if (!existsSync11(promptPath)) {
+  if (!existsSync15(promptPath)) {
     return `You are autoremediator, an agentic security remediation system for Node.js package dependencies.
 Working directory: ${ctx.cwd}
   Package manager: ${ctx.packageManager}
@@ -5464,7 +6942,7 @@ Fallback sequence (when neither version bump nor override can be applied):
 
 Always respect dryRun and policy constraints.`;
   }
-  const template = readFileSync11(promptPath, "utf8");
+  const template = readFileSync15(promptPath, "utf8");
   return template.replaceAll("{{cveId}}", ctx.cveId).replaceAll("{{cwd}}", ctx.cwd).replaceAll("{{packageManager}}", ctx.packageManager).replaceAll("{{dryRun}}", String(ctx.dryRun)).replaceAll("{{runTests}}", String(ctx.runTests)).replaceAll("{{policy}}", ctx.policy || "undefined").replaceAll("{{patchesDir}}", ctx.patchesDir).replaceAll(
     "{{directDependenciesOnly}}",
     String(ctx.constraints.directDependenciesOnly ?? false)
@@ -5473,85 +6951,21 @@ Always respect dryRun and policy constraints.`;
 
 // src/remediation/pipeline-runtime/progress.ts
 function createProgressEmitter(options) {
-  return (stage, detail, extra) => {
-    if (!options.onProgress) return;
-    options.onProgress({
-      stage,
-      detail,
-      at: (/* @__PURE__ */ new Date()).toISOString(),
-      provider: extra?.provider,
-      model: extra?.model
-    });
-  };
-}
-
-// src/remediation/tools/lookup-cve.ts
-import { z as z9 } from "zod";
-
-// src/intelligence/sources/cisa-kev.ts
-var CISA_KEV_URL = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json";
-async function fetchCisaKevFeed() {
-  try {
-    const res = await httpClient({ url: CISA_KEV_URL });
-    if (!res.ok) return void 0;
-    return res.data;
-  } catch {
-    return void 0;
-  }
-}
-function findKevEntry(feed, cveId) {
-  if (!feed?.vulnerabilities?.length) return void 0;
-  const normalized = cveId.toUpperCase();
-  return feed.vulnerabilities.find((v) => v.cveID.toUpperCase() === normalized);
-}
-async function enrichWithCisaKev(details) {
-  const feed = await fetchCisaKevFeed();
-  const entry = findKevEntry(feed, details.id);
-  if (!entry) return details;
-  details.kev = {
-    knownExploited: true,
-    dateAdded: entry.dateAdded,
-    dueDate: entry.dueDate,
-    requiredAction: entry.requiredAction,
-    knownRansomwareCampaignUse: entry.knownRansomwareCampaignUse
-  };
-  if (!details.references.includes(CISA_KEV_URL)) {
-    details.references.push(CISA_KEV_URL);
-  }
-  return details;
-}
-
-// src/intelligence/sources/epss.ts
-async function fetchEpss(cveId) {
-  const { epssApi } = getIntelligenceSourceConfig();
-  if (!epssApi) return void 0;
-  try {
-    const url = new URL(epssApi);
-    url.searchParams.set("cve", cveId);
-    const res = await httpClient({ url: url.toString() });
-    if (!res.ok) return void 0;
-    const body = res.data;
-    return body.data?.[0];
-  } catch {
-    return void 0;
-  }
-}
-async function enrichWithEpss(details) {
-  const row = await fetchEpss(details.id);
-  if (!row) return details;
-  const score = Number.parseFloat(row.epss);
-  const percentile = Number.parseFloat(row.percentile);
-  if (!Number.isFinite(score) || !Number.isFinite(percentile)) {
-    return details;
-  }
-  details.epss = {
-    score,
-    percentile,
-    date: row.date
+  return (stage, detail, extra) => {
+    if (!options.onProgress) return;
+    options.onProgress({
+      stage,
+      detail,
+      at: (/* @__PURE__ */ new Date()).toISOString(),
+      provider: extra?.provider,
+      model: extra?.model
+    });
   };
-  return details;
 }
 
+// src/remediation/tools/lookup-cve.ts
+import { z as z9 } from "zod";
+
 // src/intelligence/sources/cve-services.ts
 function pickEnglishDescription(container) {
   if (!container?.descriptions?.length) return void 0;
@@ -5835,7 +7249,7 @@ var lookupCveTool = defineTool({
 
 // src/remediation/tools/check-version-match.ts
 import { z as z10 } from "zod";
-import semver6 from "semver";
+import semver7 from "semver";
 var affectedPackageSchema = z10.object({
   name: z10.string(),
   ecosystem: z10.literal("npm"),
@@ -5864,10 +7278,10 @@ var checkVersionMatchTool = defineTool({
         (p) => p.name === affected.name
       );
       for (const installed of matches) {
-        if (!semver6.valid(installed.version)) continue;
+        if (!semver7.valid(installed.version)) continue;
         let isVulnerable = false;
         try {
-          isVulnerable = semver6.satisfies(installed.version, affected.vulnerableRange, {
+          isVulnerable = semver7.satisfies(installed.version, affected.vulnerableRange, {
             includePrerelease: false
           });
         } catch {
@@ -6007,6 +7421,8 @@ function createRuntimeToolsForRun(options) {
       installPreferOffline: constraints.installPreferOffline,
       enforceFrozenLockfile: constraints.enforceFrozenLockfile,
       workspace: constraints.workspace,
+      typecheck: input.typecheck ?? options.typecheck ?? constraints.typecheck,
+      breakingChangeRefactor: input.breakingChangeRefactor ?? options.breakingChangeRefactor ?? constraints.enableBreakingChangeRefactor,
       dryRun: preview ? true : input.dryRun
     })
   };
@@ -6031,6 +7447,8 @@ function createRuntimeToolsForRun(options) {
       installPreferOffline: constraints.installPreferOffline,
       enforceFrozenLockfile: constraints.enforceFrozenLockfile,
       workspace: constraints.workspace,
+      proofOfFix: input.proofOfFix ?? options.proofOfFix,
+      requireProofOfFix: input.requireProofOfFix ?? options.requireProofOfFix ?? constraints.requireProofOfFix,
       dryRun: preview ? true : input.dryRun
     })
   };
@@ -6185,7 +7603,7 @@ async function runRemediationPipeline(cveId, options = {}) {
 }
 
 // src/api/change-request/index.ts
-import { execa as execa9 } from "execa";
+import { execa as execa10 } from "execa";
 import { randomBytes } from "crypto";
 function sanitizeBranchToken(value) {
   return value.toLowerCase().replace(/[^a-z0-9._/-]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 80);
@@ -6214,22 +7632,68 @@ function resolveProvider2(options) {
   return options.provider ?? "github";
 }
 function resolveGrouping(options) {
-  if (options.grouping && options.grouping !== "all") {
+  const allowed = ["all", "per-cve", "per-package", "by-severity"];
+  if (options.grouping && !allowed.includes(options.grouping)) {
     throw new Error(
-      "changeRequest.grouping currently supports only 'all' for deterministic branch creation."
+      `Unsupported changeRequest.grouping: "${options.grouping}". Supported values: ${allowed.join(", ")}`
     );
   }
-  return "all";
+  return options.grouping ?? "all";
+}
+function groupReports(reports, grouping) {
+  if (reports.length === 0) return [];
+  if (grouping === "all") {
+    return [reports];
+  }
+  if (grouping === "per-cve") {
+    const map = /* @__PURE__ */ new Map();
+    for (const report of reports) {
+      const key = report.cveId.toUpperCase();
+      const list = map.get(key) ?? [];
+      list.push(report);
+      map.set(key, list);
+    }
+    return Array.from(map.values());
+  }
+  if (grouping === "per-package") {
+    const map = /* @__PURE__ */ new Map();
+    for (const report of reports) {
+      const pkgs = new Set(report.results.map((r) => r.packageName));
+      if (pkgs.size === 0) {
+        const list = map.get("misc") ?? [];
+        list.push(report);
+        map.set("misc", list);
+      } else {
+        for (const pkg of pkgs) {
+          const list = map.get(pkg) ?? [];
+          list.push(report);
+          map.set(pkg, list);
+        }
+      }
+    }
+    return Array.from(map.values());
+  }
+  if (grouping === "by-severity") {
+    const map = /* @__PURE__ */ new Map();
+    for (const report of reports) {
+      const sev = report.cveDetails?.severity ?? "UNKNOWN";
+      const list = map.get(sev) ?? [];
+      list.push(report);
+      map.set(sev, list);
+    }
+    return Array.from(map.values());
+  }
+  return [reports];
 }
 async function detectCurrentBranch(cwd) {
-  const result = await execa9("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+  const result = await execa10("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
     cwd,
     stdio: "pipe"
   });
   return result.stdout.trim();
 }
 async function ensureRepoHasChanges(cwd) {
-  const diff = await execa9("git", ["status", "--porcelain"], {
+  const diff = await execa10("git", ["status", "--porcelain"], {
     cwd,
     stdio: "pipe"
   });
@@ -6258,7 +7722,7 @@ async function createGitHubRequest(params) {
   if (params.draft) {
     args.push("--draft");
   }
-  const result = await execa9("gh", args, {
+  const result = await execa10("gh", args, {
     cwd: params.cwd,
     stdio: "pipe"
   });
@@ -6283,7 +7747,7 @@ async function createGitLabRequest(params) {
   if (params.draft) {
     args.push("--draft");
   }
-  const result = await execa9("glab", args, {
+  const result = await execa10("glab", args, {
     cwd: params.cwd,
     stdio: "pipe"
   });
@@ -6293,64 +7757,68 @@ async function createChangeRequestsForReports(params) {
   const { cwd, options, reports } = params;
   const provider = resolveProvider2(options);
   const grouping = resolveGrouping(options);
-  const plan = buildPlan(reports);
-  const titlePrefix = options.titlePrefix?.trim().slice(0, 200);
-  const bodyFooter = options.bodyFooter ? options.bodyFooter.slice(0, 2e3) : void 0;
-  const title = titlePrefix ? `${titlePrefix} ${plan.title}` : plan.title;
-  const body = bodyFooter ? `${plan.body}
+  const groups = groupReports(reports, grouping);
+  if (groups.length === 0) {
+    return [];
+  }
+  const results = [];
+  const hasChanges = await ensureRepoHasChanges(cwd).catch(() => false);
+  const baseBranch = options.baseBranch ?? await detectCurrentBranch(cwd).catch(() => "main");
+  const branchPrefix = options.branchPrefix ?? "autoremediator";
+  const pushRemote = options.pushRemote ?? "origin";
+  if (options.pushRemote && !/^[a-zA-Z0-9._-]+$/.test(options.pushRemote)) {
+    throw new Error(`Invalid pushRemote value: ${options.pushRemote}`);
+  }
+  if (options.repository && !/^[a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+$/.test(options.repository)) {
+    throw new Error(`Invalid repository format: ${options.repository}`);
+  }
+  for (const group of groups) {
+    const plan = buildPlan(group);
+    const titlePrefix = options.titlePrefix?.trim().slice(0, 200);
+    const bodyFooter = options.bodyFooter ? options.bodyFooter.slice(0, 2e3) : void 0;
+    const title = titlePrefix ? `${titlePrefix} ${plan.title}` : plan.title;
+    const body = bodyFooter ? `${plan.body}
 
 ${bodyFooter}` : plan.body;
-  try {
-    const hasChanges = await ensureRepoHasChanges(cwd);
     if (!hasChanges) {
-      return [
-        {
-          provider,
-          grouping,
-          repository: options.repository,
-          branchName: "",
-          title,
-          body,
-          created: false,
-          cveIds: plan.cveIds,
-          packageNames: plan.packageNames,
-          error: "No repository changes to include in change request."
-        }
-      ];
+      results.push({
+        provider,
+        grouping,
+        repository: options.repository,
+        branchName: "",
+        title,
+        body,
+        created: false,
+        cveIds: plan.cveIds,
+        packageNames: plan.packageNames,
+        error: "No repository changes to include in change request."
+      });
+      continue;
     }
-    const baseBranch = options.baseBranch ?? await detectCurrentBranch(cwd);
-    const branchPrefix = options.branchPrefix ?? "autoremediator";
     const branchName = toBranchName(branchPrefix, plan.cveIds);
-    const pushRemote = options.pushRemote ?? "origin";
-    if (options.pushRemote && !/^[a-zA-Z0-9._-]+$/.test(options.pushRemote)) {
-      throw new Error(`Invalid pushRemote value: ${options.pushRemote}`);
-    }
-    if (options.repository && !/^[a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+$/.test(options.repository)) {
-      throw new Error(`Invalid repository format: ${options.repository}`);
-    }
-    await execa9("git", ["checkout", "-b", branchName], { cwd, stdio: "pipe" });
-    await execa9("git", ["add", "-A"], { cwd, stdio: "pipe" });
-    await execa9("git", ["commit", "-m", title], { cwd, stdio: "pipe" });
-    await execa9("git", ["push", "-u", pushRemote, branchName], { cwd, stdio: "pipe" });
-    const url = provider === "github" ? await createGitHubRequest({
-      cwd,
-      repository: options.repository,
-      head: branchName,
-      base: baseBranch,
-      title,
-      body,
-      draft: options.draft
-    }) : await createGitLabRequest({
-      cwd,
-      repository: options.repository,
-      source: branchName,
-      target: baseBranch,
-      title,
-      body,
-      draft: options.draft
-    });
-    return [
-      {
+    try {
+      await execa10("git", ["checkout", "-b", branchName], { cwd, stdio: "pipe" });
+      await execa10("git", ["add", "-A"], { cwd, stdio: "pipe" });
+      await execa10("git", ["commit", "-m", title], { cwd, stdio: "pipe" });
+      await execa10("git", ["push", "-u", pushRemote, branchName], { cwd, stdio: "pipe" });
+      const url = provider === "github" ? await createGitHubRequest({
+        cwd,
+        repository: options.repository,
+        head: branchName,
+        base: baseBranch,
+        title,
+        body,
+        draft: options.draft
+      }) : await createGitLabRequest({
+        cwd,
+        repository: options.repository,
+        source: branchName,
+        target: baseBranch,
+        title,
+        body,
+        draft: options.draft
+      });
+      results.push({
         provider,
         grouping,
         repository: options.repository,
@@ -6362,11 +7830,13 @@ ${bodyFooter}` : plan.body;
         url,
         cveIds: plan.cveIds,
         packageNames: plan.packageNames
+      });
+      if (groups.length > 1) {
+        await execa10("git", ["checkout", baseBranch], { cwd, stdio: "pipe" }).catch(() => {
+        });
       }
-    ];
-  } catch (error) {
-    return [
-      {
+    } catch (error) {
+      results.push({
         provider,
         grouping,
         repository: options.repository,
@@ -6378,9 +7848,10 @@ ${bodyFooter}` : plan.body;
         cveIds: plan.cveIds,
         packageNames: plan.packageNames,
         error: error instanceof Error ? error.message : String(error)
-      }
-    ];
+      });
+    }
   }
+  return results;
 }
 
 // src/api/context.ts
@@ -6408,13 +7879,17 @@ function resolveConstraints(options, cwd) {
     installMode: options.constraints?.installMode ?? policy.constraints?.installMode ?? "deterministic",
     installPreferOffline: options.constraints?.installPreferOffline ?? policy.constraints?.installPreferOffline,
     enforceFrozenLockfile: options.constraints?.enforceFrozenLockfile ?? policy.constraints?.enforceFrozenLockfile,
-    workspace: options.constraints?.workspace ?? policy.constraints?.workspace
+    workspace: options.constraints?.workspace ?? policy.constraints?.workspace,
+    typecheck: options.typecheck ?? options.constraints?.typecheck ?? policy.constraints?.typecheck,
+    requireProofOfFix: options.requireProofOfFix ?? options.constraints?.requireProofOfFix ?? policy.constraints?.requireProofOfFix,
+    enableBreakingChangeRefactor: options.breakingChangeRefactor ?? options.constraints?.enableBreakingChangeRefactor ?? policy.constraints?.enableBreakingChangeRefactor,
+    supplyChainPolicy: options.supplyChainPolicy ?? options.constraints?.supplyChainPolicy ?? policy.constraints?.supplyChainPolicy
   };
 }
 
 // src/platform/evidence.ts
-import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync5 } from "fs";
-import { join as join18 } from "path";
+import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync6 } from "fs";
+import { join as join21 } from "path";
 function createEvidenceLog(cwd, cveIds, context = {}) {
   return {
     runId: `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`,
@@ -6446,10 +7921,10 @@ function finalizeEvidence(log) {
   return log;
 }
 function writeEvidenceLog(cwd, log) {
-  const dir = join18(cwd, ".autoremediator", "evidence");
+  const dir = join21(cwd, ".autoremediator", "evidence");
   mkdirSync3(dir, { recursive: true });
-  const filePath = join18(dir, `${log.runId}.json`);
-  writeFileSync5(filePath, JSON.stringify(log, null, 2) + "\n", "utf8");
+  const filePath = join21(dir, `${log.runId}.json`);
+  writeFileSync6(filePath, JSON.stringify(log, null, 2) + "\n", "utf8");
   return filePath;
 }
 
@@ -6587,10 +8062,15 @@ function writeRemediateEvidence(cwd, evidence) {
 }
 
 // src/api/remediate/validators.ts
+var CVE_ID_REGEX = /^CVE-\d{4}-\d{1,7}$/i;
+var GHSA_ID_REGEX = /^GHSA-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}$/i;
+function isVulnerabilityId(id) {
+  return CVE_ID_REGEX.test(id) || GHSA_ID_REGEX.test(id);
+}
 function assertValidCveId(cveId) {
-  if (!/^CVE-\d{4}-\d+$/i.test(cveId)) {
+  if (!isVulnerabilityId(cveId)) {
     throw new Error(
-      `Invalid CVE ID: "${cveId}". Expected format: CVE-YYYY-NNNNN (e.g. CVE-2021-23337).`
+      `Invalid vulnerability ID: "${cveId}". Expected format: CVE-YYYY-NNNNN (e.g. CVE-2021-23337) or GHSA-xxxx-xxxx-xxxx.`
     );
   }
 }
@@ -6686,13 +8166,14 @@ async function planRemediation(cveId, options = {}) {
 }
 
 // src/scanner/parse-input.ts
-import { extname, resolve as resolve3 } from "path";
-import { readFileSync as readFileSync15 } from "fs";
-import { execa as execa10 } from "execa";
+import { extname, resolve as resolve5 } from "path";
+import { readFileSync as readFileSync19 } from "fs";
+import { execa as execa11 } from "execa";
 
 // src/scanner/adapters/npm-audit.ts
-import { readFileSync as readFileSync12 } from "fs";
+import { readFileSync as readFileSync16 } from "fs";
 var CVE_REGEX = /CVE-\d{4}-\d{1,7}/gi;
+var GHSA_REGEX = /GHSA-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}/gi;
 function normalizeSeverity(raw) {
   if (!raw) return "UNKNOWN";
   const up = raw.toUpperCase();
@@ -6707,7 +8188,8 @@ function parseNpmAuditJsonFromString(content) {
   for (const vuln of Object.values(report.vulnerabilities ?? {})) {
     for (const viaEntry of vuln.via ?? []) {
       const text = typeof viaEntry === "string" ? viaEntry : `${viaEntry.url ?? ""} ${viaEntry.name ?? ""}`;
-      const matches = text.match(CVE_REGEX) ?? [];
+      const cveMatches = text.match(CVE_REGEX) ?? [];
+      const matches = cveMatches.length > 0 ? cveMatches : text.match(GHSA_REGEX) ?? [];
       for (const match of matches) {
         const cveId = match.toUpperCase();
         const key = `${cveId}:${vuln.name}`;
@@ -6725,13 +8207,14 @@ function parseNpmAuditJsonFromString(content) {
   return findings;
 }
 function parseNpmAuditJsonFile(filePath) {
-  const content = readFileSync12(filePath, "utf8");
+  const content = readFileSync16(filePath, "utf8");
   return parseNpmAuditJsonFromString(content);
 }
 
 // src/scanner/adapters/yarn-audit.ts
-import { readFileSync as readFileSync13 } from "fs";
+import { readFileSync as readFileSync17 } from "fs";
 var CVE_REGEX2 = /CVE-\d{4}-\d{1,7}/gi;
+var GHSA_REGEX2 = /GHSA-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4}/gi;
 function normalizeSeverity2(raw) {
   if (!raw) return "UNKNOWN";
   const up = raw.toUpperCase();
@@ -6756,7 +8239,8 @@ function parseYarnAuditJsonFromString(content) {
     const packageName = advisory?.module_name;
     const severity = normalizeSeverity2(advisory?.severity);
     const text = `${advisory?.url ?? ""} ${(advisory?.cves ?? []).join(" ")}`;
-    const matches = text.match(CVE_REGEX2) ?? [];
+    const cveMatches = text.match(CVE_REGEX2) ?? [];
+    const matches = cveMatches.length > 0 ? cveMatches : text.match(GHSA_REGEX2) ?? [];
     for (const match of matches) {
       const cveId = match.toUpperCase();
       const key = `${cveId}:${packageName ?? ""}`;
@@ -6773,12 +8257,12 @@ function parseYarnAuditJsonFromString(content) {
   return findings;
 }
 function parseYarnAuditJsonFile(filePath) {
-  const content = readFileSync13(filePath, "utf8");
+  const content = readFileSync17(filePath, "utf8");
   return parseYarnAuditJsonFromString(content);
 }
 
 // src/scanner/adapters/sarif.ts
-import { readFileSync as readFileSync14 } from "fs";
+import { readFileSync as readFileSync18 } from "fs";
 var CVE_REGEX3 = /CVE-\d{4}-\d{1,7}/gi;
 function extractPackageName(result) {
   const pkg = result.properties?.["packageName"];
@@ -6816,7 +8300,7 @@ function parseSarifFromString(content) {
   return findings;
 }
 function parseSarifFile(filePath) {
-  const content = readFileSync14(filePath, "utf8");
+  const content = readFileSync18(filePath, "utf8");
   return parseSarifFromString(content);
 }
 
@@ -6825,7 +8309,7 @@ function parseScanInput(filePath, format) {
   if (filePath.includes("\0")) {
     throw new Error("Invalid scan input path: path contains null bytes");
   }
-  const resolvedPath = resolve3(filePath);
+  const resolvedPath = resolve5(filePath);
   const resolved = format === "auto" ? inferFormat(resolvedPath) : format;
   if (resolved === "npm-audit") {
     return parseNpmAuditJsonFile(resolvedPath);
@@ -6847,7 +8331,7 @@ async function parseScanInputFromAudit(params) {
   }
   const command = resolveAuditCommand(pm, { workspace: params.workspace });
   const [cmd, ...args] = command;
-  const result = await execa10(cmd, args, {
+  const result = await execa11(cmd, args, {
     cwd: params.cwd,
     stdio: "pipe",
     reject: false
@@ -6901,7 +8385,7 @@ function inferFormat(filePath) {
   const ext = extname(filePath).toLowerCase();
   if (ext === ".sarif") return "sarif";
   try {
-    const content = readFileSync15(filePath, "utf8");
+    const content = readFileSync19(filePath, "utf8");
     const firstLine = content.split("\n").find((line) => line.trim().startsWith("{"));
     if (firstLine) {
       const parsed = JSON.parse(firstLine);
@@ -7312,14 +8796,14 @@ async function remediatePortfolio(targets, options = {}) {
 }
 
 // src/api/update-outdated/index.ts
-import { join as join19 } from "path";
-import { readFileSync as readFileSync16, writeFileSync as writeFileSync6 } from "fs";
-import { execa as execa11 } from "execa";
+import { join as join22 } from "path";
+import { readFileSync as readFileSync20, writeFileSync as writeFileSync7 } from "fs";
+import { execa as execa12 } from "execa";
 async function applyBump(params) {
-  const pkgPath = join19(params.cwd, "package.json");
+  const pkgPath = join22(params.cwd, "package.json");
   let pkgJson;
   try {
-    pkgJson = JSON.parse(readFileSync16(pkgPath, "utf8"));
+    pkgJson = JSON.parse(readFileSync20(pkgPath, "utf8"));
   } catch {
     return {
       applied: false,
@@ -7341,13 +8825,13 @@ async function applyBump(params) {
   const newRange = `${prefix}${params.toVersion}`;
   return withRepoLock(params.cwd, async () => {
     pkgJson[depField][params.packageName] = newRange;
-    writeFileSync6(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
+    writeFileSync7(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
     try {
       const [installCmd, ...installArgs] = params.installCommand;
-      await execa11(installCmd, installArgs, { cwd: params.cwd, stdio: "pipe" });
+      await execa12(installCmd, installArgs, { cwd: params.cwd, stdio: "pipe" });
     } catch (err) {
       pkgJson[depField][params.packageName] = currentRange;
-      writeFileSync6(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
+      writeFileSync7(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
       const message = err instanceof Error ? err.message : String(err);
       return {
         applied: false,
@@ -7357,13 +8841,13 @@ async function applyBump(params) {
     if (params.runTests) {
       try {
         const [testCmd, ...testArgs] = params.testCommand;
-        await execa11(testCmd, testArgs, { cwd: params.cwd, stdio: "pipe" });
+        await execa12(testCmd, testArgs, { cwd: params.cwd, stdio: "pipe" });
       } catch (err) {
         pkgJson[depField][params.packageName] = currentRange;
-        writeFileSync6(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
+        writeFileSync7(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
         try {
           const [rollbackCmd, ...rollbackArgs] = params.installCommand;
-          await execa11(rollbackCmd, rollbackArgs, { cwd: params.cwd, stdio: "pipe" });
+          await execa12(rollbackCmd, rollbackArgs, { cwd: params.cwd, stdio: "pipe" });
         } catch {
         }
         const message = err instanceof Error ? err.message : String(err);
@@ -7564,131 +9048,169 @@ async function checkReachability(options) {
   return assessPackageReachability(cwd, options.packageName, options.symbol);
 }
 
-// src/remediation/evaluate-package.ts
-import semver7 from "semver";
-async function evaluatePackage(packageName, options = {}) {
-  const version = options.version?.trim();
-  const enrich = options.enrichIntelligence !== false;
-  let versions = [];
-  let latestVersion;
-  try {
-    versions = await fetchPackageVersions(packageName);
-    if (versions.length > 0) {
-      const valid = versions.filter((v) => semver7.valid(v)).sort((a, b) => semver7.compare(a, b));
-      latestVersion = valid[valid.length - 1];
-    }
-  } catch {
-  }
-  let rawVulns = [];
-  try {
-    rawVulns = await queryOsvPackage(packageName, version);
-  } catch {
-    rawVulns = [];
-  }
-  let kevFeed = null;
-  if (enrich) {
+// src/scanner/delta-scan.ts
+import { existsSync as existsSync16, readFileSync as readFileSync21 } from "fs";
+import { join as join23 } from "path";
+import { execa as execa13 } from "execa";
+import semver9 from "semver";
+
+// src/scanner/lockfile-diff.ts
+import YAML2 from "yaml";
+import semver8 from "semver";
+function parseLockfileDependencies(filename, content) {
+  const result = /* @__PURE__ */ new Map();
+  const add = (name, ver) => {
+    if (!name || !ver) return;
+    const cleanVer = semver8.clean(ver) || semver8.coerce(ver)?.version || ver;
+    let set = result.get(name);
+    if (!set) {
+      set = /* @__PURE__ */ new Set();
+      result.set(name, set);
+    }
+    set.add(cleanVer);
+  };
+  if (filename.endsWith("package-lock.json")) {
     try {
-      kevFeed = await fetchCisaKevFeed();
-    } catch {
-      kevFeed = null;
-    }
-  }
-  const entries = [];
-  for (const raw of rawVulns) {
-    const cveDetails = parseOsvVuln(raw);
-    const affected = cveDetails.affectedPackages.find(
-      (p) => p.name.toLowerCase() === packageName.toLowerCase()
-    );
-    if (version && affected?.vulnerableRange) {
-      const cleanVer = semver7.clean(version) || version;
-      if (semver7.valid(cleanVer) && !semver7.satisfies(cleanVer, affected.vulnerableRange)) {
-        continue;
+      const data = JSON.parse(content);
+      if (data.packages && typeof data.packages === "object") {
+        for (const [key, pkg] of Object.entries(data.packages)) {
+          if (!key || key === "" || typeof pkg !== "object" || !pkg) continue;
+          const idx = key.lastIndexOf("node_modules/");
+          if (idx !== -1) {
+            const rawName = key.slice(idx + "node_modules/".length);
+            const ver = pkg.version;
+            add(rawName, ver);
+          }
+        }
+      }
+      if (data.dependencies && typeof data.dependencies === "object") {
+        const walkDeps = (deps) => {
+          for (const [name, info] of Object.entries(deps)) {
+            if (!info || typeof info !== "object") continue;
+            const depObj = info;
+            add(name, depObj.version);
+            if (depObj.dependencies && typeof depObj.dependencies === "object") {
+              walkDeps(depObj.dependencies);
+            }
+          }
+        };
+        walkDeps(data.dependencies);
       }
+    } catch {
     }
-    let inCisaKev = false;
-    let epssScore;
-    let epssPercentile;
-    if (enrich && cveDetails.id.startsWith("CVE-")) {
-      if (kevFeed) {
-        inCisaKev = Boolean(findKevEntry(kevFeed, cveDetails.id));
+  } else if (filename.endsWith("pnpm-lock.yaml")) {
+    try {
+      const data = YAML2.parse(content);
+      if (data?.packages && typeof data.packages === "object") {
+        for (const [key, val] of Object.entries(data.packages)) {
+          let rawKey = key.replace(/^\//, "");
+          const parenIdx = rawKey.indexOf("(");
+          if (parenIdx !== -1) {
+            rawKey = rawKey.slice(0, parenIdx);
+          }
+          const lastAt = rawKey.lastIndexOf("@");
+          if (lastAt > 0) {
+            const name = val?.name ?? rawKey.slice(0, lastAt);
+            const version = val?.version ?? rawKey.slice(lastAt + 1);
+            add(name, version);
+          }
+        }
       }
-      try {
-        const epss = await fetchEpss(cveDetails.id);
-        if (epss) {
-          epssScore = Number.parseFloat(epss.epss);
-          epssPercentile = Number.parseFloat(epss.percentile);
+      if (data?.snapshots && typeof data.snapshots === "object") {
+        for (const key of Object.keys(data.snapshots)) {
+          let rawKey = key.replace(/^\//, "");
+          const parenIdx = rawKey.indexOf("(");
+          if (parenIdx !== -1) {
+            rawKey = rawKey.slice(0, parenIdx);
+          }
+          const lastAt = rawKey.lastIndexOf("@");
+          if (lastAt > 0) {
+            const name = rawKey.slice(0, lastAt);
+            const version = rawKey.slice(lastAt + 1);
+            add(name, version);
+          }
         }
-      } catch {
       }
+    } catch {
     }
-    let safeUpgradeVersion;
-    if (affected?.firstPatchedVersion) {
-      try {
-        const safe = await findSafeUpgradeVersion(
-          packageName,
-          version || "0.0.0",
-          affected.firstPatchedVersion
-        );
-        safeUpgradeVersion = safe ?? affected.firstPatchedVersion;
-      } catch {
-        safeUpgradeVersion = affected.firstPatchedVersion;
+  } else if (filename.endsWith("yarn.lock")) {
+    const lines = content.split("\n");
+    let currentPackages = [];
+    for (const line of lines) {
+      if (line.startsWith("#") || line.trim() === "") continue;
+      if (!line.startsWith(" ")) {
+        currentPackages = [];
+        const parts = line.split(",").map((p) => p.trim().replace(/^"/, "").replace(/":?$/, ""));
+        for (const part of parts) {
+          const lastAt = part.lastIndexOf("@");
+          if (lastAt > 0) {
+            currentPackages.push(part.slice(0, lastAt));
+          }
+        }
+      } else {
+        const match = line.match(/^\s+version\s+"?([^"\s]+)"?/);
+        if (match && currentPackages.length > 0) {
+          const ver = match[1];
+          for (const pkg of currentPackages) {
+            add(pkg, ver);
+          }
+          currentPackages = [];
+        }
       }
     }
-    entries.push({
-      cveId: cveDetails.id,
-      severity: cveDetails.severity,
-      summary: cveDetails.summary,
-      vulnerableRange: affected?.vulnerableRange,
-      firstPatchedVersion: affected?.firstPatchedVersion,
-      safeUpgradeVersion,
-      epssScore,
-      epssPercentile,
-      inCisaKev,
-      references: cveDetails.references
-    });
   }
-  const isVulnerable = entries.length > 0;
-  let verdict = "safe";
-  if (isVulnerable) {
-    const hasKevOrHighEpss = entries.some((e) => e.inCisaKev || e.epssScore && e.epssScore > 0.5);
-    const hasHighOrCritical = entries.some(
-      (e) => e.severity === "CRITICAL" || e.severity === "HIGH"
-    );
-    if (hasKevOrHighEpss) {
-      verdict = "actively-exploited";
-    } else if (hasHighOrCritical) {
-      verdict = "vulnerable";
-    } else {
-      verdict = "caution";
+  return result;
+}
+function computeLockfileDiff(filename, oldContent, newContent) {
+  const changes = [];
+  const oldDeps = oldContent ? parseLockfileDependencies(filename, oldContent) : /* @__PURE__ */ new Map();
+  const newDeps = newContent ? parseLockfileDependencies(filename, newContent) : /* @__PURE__ */ new Map();
+  const allPkgs = /* @__PURE__ */ new Set([...oldDeps.keys(), ...newDeps.keys()]);
+  for (const pkg of allPkgs) {
+    const oldVers = oldDeps.get(pkg) ?? /* @__PURE__ */ new Set();
+    const newVers = newDeps.get(pkg) ?? /* @__PURE__ */ new Set();
+    for (const nVer of newVers) {
+      if (!oldVers.has(nVer)) {
+        if (oldVers.size === 0) {
+          changes.push({
+            packageName: pkg,
+            changeType: "added",
+            newVersion: nVer,
+            dependencyType: "transitive",
+            manifestPath: filename
+          });
+        } else {
+          const [firstOld] = oldVers;
+          const cleanOld = semver8.clean(firstOld) || semver8.coerce(firstOld)?.version;
+          const cleanNew = semver8.clean(nVer) || semver8.coerce(nVer)?.version;
+          const isUpgrade = cleanOld && cleanNew && semver8.valid(cleanOld) && semver8.valid(cleanNew) ? semver8.gt(cleanNew, cleanOld) : true;
+          changes.push({
+            packageName: pkg,
+            changeType: isUpgrade ? "upgraded" : "downgraded",
+            oldVersion: firstOld,
+            newVersion: nVer,
+            dependencyType: "transitive",
+            manifestPath: filename
+          });
+        }
+      }
+    }
+    if (newVers.size === 0 && oldVers.size > 0) {
+      for (const oVer of oldVers) {
+        changes.push({
+          packageName: pkg,
+          changeType: "removed",
+          oldVersion: oVer,
+          dependencyType: "transitive",
+          manifestPath: filename
+        });
+      }
     }
   }
-  let recommendedVersion;
-  if (isVulnerable) {
-    const upgradeCandidates = entries.map((e) => e.safeUpgradeVersion).filter((v) => Boolean(v && semver7.valid(v))).sort((a, b) => semver7.compare(a, b));
-    recommendedVersion = upgradeCandidates[upgradeCandidates.length - 1] || latestVersion;
-  } else {
-    recommendedVersion = version || latestVersion;
-  }
-  const summary = isVulnerable ? `Package "${packageName}${version ? `@${version}` : ""}" has ${entries.length} known vulnerability(ies) (verdict: ${verdict}). Recommended safe version: ${recommendedVersion || "none"}.` : `Package "${packageName}${version ? `@${version}` : ""}" has no known vulnerabilities. Safe to install.`;
-  return {
-    schemaVersion: "1.0",
-    packageName,
-    evaluatedVersion: version,
-    isVulnerable,
-    verdict,
-    summary,
-    vulnerabilities: entries,
-    recommendedVersion,
-    latestVersion,
-    generatedAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
+  return changes;
 }
 
 // src/scanner/delta-scan.ts
-import { existsSync as existsSync12, readFileSync as readFileSync17 } from "fs";
-import { join as join20 } from "path";
-import { execa as execa12 } from "execa";
-import semver8 from "semver";
 var DEP_SECTIONS = [
   "dependencies",
   "devDependencies",
@@ -7698,7 +9220,7 @@ var DEP_SECTIONS = [
 async function getChangedManifestPaths(cwd, baseRef) {
   const manifests = /* @__PURE__ */ new Set();
   try {
-    const { stdout: diffFiles } = await execa12(
+    const { stdout: diffFiles } = await execa13(
       "git",
       ["diff", "--name-only", baseRef, "--", "package.json", "**/package.json"],
       { cwd, reject: false }
@@ -7709,7 +9231,7 @@ async function getChangedManifestPaths(cwd, baseRef) {
         manifests.add(trimmed);
       }
     }
-    const { stdout: untrackedFiles } = await execa12(
+    const { stdout: untrackedFiles } = await execa13(
       "git",
       ["ls-files", "--others", "--exclude-standard", "--", "package.json", "**/package.json"],
       { cwd, reject: false }
@@ -7721,7 +9243,7 @@ async function getChangedManifestPaths(cwd, baseRef) {
       }
     }
   } catch {
-    if (existsSync12(join20(cwd, "package.json"))) {
+    if (existsSync16(join23(cwd, "package.json"))) {
       manifests.add("package.json");
     }
   }
@@ -7729,7 +9251,7 @@ async function getChangedManifestPaths(cwd, baseRef) {
 }
 async function getOldManifestContent(cwd, baseRef, relPath) {
   try {
-    const { stdout } = await execa12("git", ["show", `${baseRef}:${relPath}`], {
+    const { stdout } = await execa13("git", ["show", `${baseRef}:${relPath}`], {
       cwd,
       reject: false
     });
@@ -7740,10 +9262,10 @@ async function getOldManifestContent(cwd, baseRef, relPath) {
   }
 }
 function getNewManifestContent(cwd, relPath) {
-  const fullPath = join20(cwd, relPath);
-  if (!existsSync12(fullPath)) return null;
+  const fullPath = join23(cwd, relPath);
+  if (!existsSync16(fullPath)) return null;
   try {
-    return JSON.parse(readFileSync17(fullPath, "utf8"));
+    return JSON.parse(readFileSync21(fullPath, "utf8"));
   } catch {
     return null;
   }
@@ -7764,9 +9286,9 @@ function computeDependencyDiff(relPath, oldPkg, newPkg) {
           manifestPath: relPath
         });
       } else if (oldVer !== newVer) {
-        const cleanOld = semver8.clean(oldVer) || semver8.coerce(oldVer)?.version;
-        const cleanNew = semver8.clean(newVer) || semver8.coerce(newVer)?.version;
-        const isUpgrade = cleanOld && cleanNew && semver8.valid(cleanOld) && semver8.valid(cleanNew) ? semver8.gt(cleanNew, cleanOld) : true;
+        const cleanOld = semver9.clean(oldVer) || semver9.coerce(oldVer)?.version;
+        const cleanNew = semver9.clean(newVer) || semver9.coerce(newVer)?.version;
+        const isUpgrade = cleanOld && cleanNew && semver9.valid(cleanOld) && semver9.valid(cleanNew) ? semver9.gt(cleanNew, cleanOld) : true;
         changes.push({
           packageName: pkgName,
           changeType: isUpgrade ? "upgraded" : "downgraded",
@@ -7791,22 +9313,89 @@ function computeDependencyDiff(relPath, oldPkg, newPkg) {
   }
   return changes;
 }
+var LOCKFILE_PATTERNS = [
+  "package-lock.json",
+  "**/package-lock.json",
+  "pnpm-lock.yaml",
+  "**/pnpm-lock.yaml",
+  "yarn.lock",
+  "**/yarn.lock"
+];
+async function getChangedLockfilePaths(cwd, baseRef) {
+  const lockfiles = /* @__PURE__ */ new Set();
+  try {
+    const { stdout: diffFiles } = await execa13(
+      "git",
+      ["diff", "--name-only", baseRef, "--", ...LOCKFILE_PATTERNS],
+      { cwd, reject: false }
+    );
+    for (const f of diffFiles.split("\n")) {
+      const trimmed = f.trim();
+      if (trimmed && !trimmed.includes("node_modules") && (trimmed.endsWith("package-lock.json") || trimmed.endsWith("pnpm-lock.yaml") || trimmed.endsWith("yarn.lock"))) {
+        lockfiles.add(trimmed);
+      }
+    }
+    const { stdout: untrackedFiles } = await execa13(
+      "git",
+      ["ls-files", "--others", "--exclude-standard", "--", ...LOCKFILE_PATTERNS],
+      { cwd, reject: false }
+    );
+    for (const f of untrackedFiles.split("\n")) {
+      const trimmed = f.trim();
+      if (trimmed && !trimmed.includes("node_modules") && (trimmed.endsWith("package-lock.json") || trimmed.endsWith("pnpm-lock.yaml") || trimmed.endsWith("yarn.lock"))) {
+        lockfiles.add(trimmed);
+      }
+    }
+  } catch {
+  }
+  return Array.from(lockfiles);
+}
+async function getFileContentAtRef(cwd, baseRef, relPath) {
+  try {
+    const { stdout } = await execa13("git", ["show", `${baseRef}:${relPath}`], {
+      cwd,
+      reject: false
+    });
+    return stdout || null;
+  } catch {
+    return null;
+  }
+}
 async function scanDelta(options = {}) {
   const cwd = options.cwd ?? process.cwd();
   const baseRef = options.baseRef ?? "HEAD";
   const changedManifests = await getChangedManifestPaths(cwd, baseRef);
+  const changedLockfiles = await getChangedLockfilePaths(cwd, baseRef);
   const dependencyChanges = [];
+  const directPkgs = /* @__PURE__ */ new Set();
   for (const manifestRel of changedManifests) {
     const oldPkg = await getOldManifestContent(cwd, baseRef, manifestRel);
     const newPkg = getNewManifestContent(cwd, manifestRel);
     const diffs = computeDependencyDiff(manifestRel, oldPkg, newPkg);
+    for (const d of diffs) {
+      directPkgs.add(d.packageName);
+    }
     dependencyChanges.push(...diffs);
   }
+  for (const lockfileRel of changedLockfiles) {
+    const oldContent = await getFileContentAtRef(cwd, baseRef, lockfileRel);
+    const fullPath = join23(cwd, lockfileRel);
+    const newContent = existsSync16(fullPath) ? readFileSync21(fullPath, "utf8") : null;
+    const lockDiffs = computeLockfileDiff(lockfileRel, oldContent, newContent);
+    for (const change of lockDiffs) {
+      if (!directPkgs.has(change.packageName)) {
+        dependencyChanges.push(change);
+      }
+    }
+    if (!changedManifests.includes(lockfileRel)) {
+      changedManifests.push(lockfileRel);
+    }
+  }
   const introducedFindings = [];
   const resolvedFindings = [];
   for (const change of dependencyChanges) {
     if (change.changeType === "added" || change.changeType === "upgraded" || change.changeType === "downgraded") {
-      const cleanVer = semver8.coerce(change.newVersion)?.version ?? change.newVersion;
+      const cleanVer = semver9.coerce(change.newVersion)?.version ?? change.newVersion;
       const evaluation = await evaluatePackage(change.packageName, {
         version: cleanVer,
         enrichIntelligence: true
@@ -7826,12 +9415,12 @@ async function scanDelta(options = {}) {
       }
     }
     if (change.oldVersion && (change.changeType === "upgraded" || change.changeType === "removed")) {
-      const cleanOldVer = semver8.coerce(change.oldVersion)?.version ?? change.oldVersion;
+      const cleanOldVer = semver9.coerce(change.oldVersion)?.version ?? change.oldVersion;
       const oldEval = await evaluatePackage(change.packageName, {
         version: cleanOldVer,
         enrichIntelligence: true
       });
-      const cleanNewVer = change.newVersion ? semver8.coerce(change.newVersion)?.version ?? change.newVersion : void 0;
+      const cleanNewVer = change.newVersion ? semver9.coerce(change.newVersion)?.version ?? change.newVersion : void 0;
       const newEval = cleanNewVer ? await evaluatePackage(change.packageName, {
         version: cleanNewVer,
         enrichIntelligence: false
@@ -7949,6 +9538,7 @@ export {
   listPatchArtifacts,
   planRemediation,
   pollJob,
+  reconcilePatchArtifacts,
   remediate,
   remediateFromScan,
   remediatePortfolio,