autoremediator 0.18.0 → 0.20.0

package/README.md

@@ -29,33 +29,34 @@ The result is a closed-loop remediation workflow rather than an ever-growing tri
 
 ## Exploitability-informed prioritization
 
-Severity scores alone are poor remediation signals. Autoremediator enriches each CVE with corroborating signals before any fix is attempted:
+Severity scores alone are poor remediation signals. Autoremediator enriches each CVE with corroborating signals before attempting a fix:
 
 - **CISA KEV** — confirms whether a vulnerability is actively exploited in the wild
 - **EPSS** — quantifies exploit probability as a continuous percentile score
 - **Advisory consensus** — cross-references OSV, GitHub Advisory Database, and NVD to validate affected ranges and fixed versions
+- **AST reachability** — analyzes import and call graphs to verify whether vulnerable functions are actually invoked in source code
 
-This enrichment drives prioritization and disposition decisions, so high-risk, actively exploited vulnerabilities are handled with higher urgency than theoretical severities would suggest.
+This enrichment drives prioritization and disposition decisions, so high-risk, actively exploited vulnerabilities are handled with higher urgency than theoretical severities suggest.
 
 ## Multi-strategy remediation
 
 Autoremediator selects the safest applicable fix strategy for each vulnerability:
 
-- **Direct version upgrade** — the preferred path when a safe fixed version exists in the direct dependency graph
-- **Transitive override** — applied when exposure is in a transitive dependency and a direct upgrade is not feasible
-- **Controlled patch generation** — a confidence-scored fallback when no safe fixed version exists; produces auditable patch artifacts tracked through their full lifecycle with synthesized reproduction tests
-- **Upstream patch reconciliation** — detects when upstream package releases supersede local patch files and safely retires them (`patches reconcile`)
+- **Direct version upgrade** — the preferred path for direct dependencies; automatically refactors consumer call sites if the upgrade introduces breaking changes
+- **Transitive override** — applied via package manager overrides or resolutions when exposure is in a transitive dependency
+- **Controlled patch generation** — confidence-scored fallback when no safe fixed version exists, validated against dual-stage exploit reproduction gates
+- **Upstream patch reconciliation** — detects when upstream package releases supersede local patch files and safely retires them
 
-Unresolved findings are never silently dropped. Each one is classified with an explicit reason and treated as an escalation input for downstream security workflows.
+Unresolved findings are never silently dropped. Each is classified with an explicit reason and treated as an escalation input for downstream security workflows.
 
 ## Policy-governed automation
 
-Autoremediator is designed to operate autonomously without sacrificing control. Remediation behavior is governed by a policy layer that determines disposition for every finding:
+Remediation behavior is governed by a policy layer (`.github/autoremediator.yml`) that determines disposition for each finding:
 
-- **Auto-apply** for high-confidence remediations within acceptable risk thresholds
-- **Simulation** for preview and dry-run validation before mutations are committed
-- **Hold for approval** when human review is warranted before applying a fix
-- **Escalation** for findings that exceed risk tolerance, with configurable follow-on actions such as issue creation, channel notification, or draft PR
+- **Auto-apply** — applies high-confidence remediations within acceptable risk thresholds
+- **Simulate** — previews planned mutations and validation results without modifying files
+- **Hold for approval** — pauses execution for manual review when confidence or policy warrants
+- **Escalate** — flags findings that exceed risk tolerance to block unsafe mutations and trigger follow-on workflows
 
 Portfolio-scale campaigns apply risk ranking to prioritize remediation order across large target sets.
 
@@ -82,22 +83,13 @@ Exploitability and trust enrichment:
 
 Autoremediator is designed to meet security operations where they already run:
 
-- **CLI** — direct invocation in developer workflows and CI/CD pipeline jobs
-- **SDK** — programmatic integration for platforms, internal tooling, and security automation
-- **GitHub Actions** — reusable workflow and Marketplace action for scan-to-remediation CI pipelines
-- **MCP server** — native tool integration for AI agents, LLM orchestrators, and copilot surfaces
-- **OpenAPI server** — HTTP-accessible remediation endpoint for centralized or service-based deployments
-- **VS Code extension** — editor-side vulnerability scanning and fix actions
-
-```yaml
-jobs:
-  gate:
-    uses: rawlings/autoremediator/.github/workflows/reusable-remediate-from-audit.yml@v1
-    with:
-      audit: true
-      dry-run: true
-      ci: true
-```
+- **CLI** — direct invocation in local developer workflows and CI/CD pipelines
+- **SDK** — programmatic integration for security automation and internal platforms
+- **GitHub Actions** — reusable workflows and Marketplace actions for scan-to-remediation pipelines
+- **GitHub App** — webhook-driven remediation with PR lifecycle management and automated healing
+- **MCP server** — native tool integration for AI agents and LLM orchestrators
+- **OpenAPI server** — HTTP endpoints for centralized or service-based remediation deployments
+- **VS Code extension** — editor diagnostics, reachability checks, and one-click fixes
 
 For configuration reference, workflow variants, and MCP host setup, see the [Integrations](https://rawlings.github.io/autoremediator/docs/integrations) and [Agent Ecosystems](https://rawlings.github.io/autoremediator/docs/agent-ecosystems) guides.
 

package/dist/api/change-request/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/change-request/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,yBAAyB,CAAC;AAsDjC,wBAAgB,YAAY,CAC1B,OAAO,EAAE,iBAAiB,EAAE,EAC5B,QAAQ,EAAE,qBAAqB,GAC9B,iBAAiB,EAAE,EAAE,CAgDvB;AA8FD,wBAAsB,8BAA8B,CAAC,MAAM,EAAE;IAC3D,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,oBAAoB,CAAC;IAC9B,OAAO,EAAE,iBAAiB,EAAE,CAAC;CAC9B,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CA+GjC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/change-request/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,yBAAyB,CAAC;AAsDjC,wBAAgB,YAAY,CAC1B,OAAO,EAAE,iBAAiB,EAAE,EAC5B,QAAQ,EAAE,qBAAqB,GAC9B,iBAAiB,EAAE,EAAE,CAgDvB;AA0JD,wBAAsB,8BAA8B,CAAC,MAAM,EAAE;IAC3D,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,oBAAoB,CAAC;IAC9B,OAAO,EAAE,iBAAiB,EAAE,CAAC;CAC9B,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAgKjC"}

package/dist/api/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/api/context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB,EACvB,MAAM,sBAAsB,CAAC;AAO9B,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,gBAAgB,GACxB,QAAQ,CAAC,IAAI,CAAC,kBAAkB,EAAE,WAAW,CAAC,CAAC,GAAG,kBAAkB,CAMtE;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,gBAAgB,GAAG,iBAAiB,CAKrF;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,GAAG,sBAAsB,CAiBjG"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/api/context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,sBAAsB,EACvB,MAAM,sBAAsB,CAAC;AAO9B,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,gBAAgB,GACxB,QAAQ,CAAC,IAAI,CAAC,kBAAkB,EAAE,WAAW,CAAC,CAAC,GAAG,kBAAkB,CAMtE;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,gBAAgB,GAAG,iBAAiB,CAKrF;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,GAAG,sBAAsB,CA8BjG"}

package/dist/api/options-schema.d.ts

@@ -66,6 +66,9 @@ export declare const OPTION_DESCRIPTIONS: {
     readonly escalationGraph: "Optional mapping from unresolved reasons to intended escalation actions";
     readonly offlineIntelligence: "Skip all network calls to intelligence sources. Only local inventory and npm-registry version resolution proceed.";
     readonly intelligenceSnapshotPath: "Path to a local JSON snapshot of pre-fetched CVE intelligence (keyed by CVE ID) used when offline mode is active.";
+    readonly proofOfFix: "If true, enforce dual-stage exploit reproduction proof-of-fix verification (assert failure pre-patch, assert pass post-patch)";
+    readonly requireProofOfFix: "If true, reject patches and roll back if proof-of-fix verification fails";
+    readonly breakingChangeRefactor: "If true, attempt agentic call-site refactoring when major version upgrades introduce breaking API changes";
 };
 export declare function createConstraintSchemaProperties(): Record<string, JsonSchemaProperty>;
 export declare function createRemediateOptionSchemaProperties(options?: {

package/dist/api/options-schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"options-schema.d.ts","sourceRoot":"","sources":["../../src/api/options-schema.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEzD,eAAO,MAAM,sBAAsB,YAAI,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAU,CAAC;AACtF,eAAO,MAAM,mBAAmB,YAAI,QAAQ,EAAE,OAAO,CAAU,CAAC;AAChE,eAAO,MAAM,wBAAwB,YAAI,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAU,CAAC;AAE7F,eAAO,MAAM,mBAAmB;aAC9B,KAAK,EAAE,6BAA6B;aACpC,SAAS,EAAE,0CAA0C;aACrD,GAAG,EAAE,4DAA4D;aACjE,cAAc,EAAE,qDAAqD;aACrE,MAAM,EAAE,yCAAyC;aACjD,OAAO,EAAE,4CAA4C;aACrD,cAAc,EACZ,iGAAiG;aACnG,QAAQ,EAAE,qDAAqD;aAC/D,WAAW,EAAE,sCAAsC;aACnD,KAAK,EAAE,oBAAoB;aAC3B,gBAAgB,EAAE,wDAAwD;aAC1E,qBAAqB,EAAE,6DAA6D;aACpF,2BAA2B,EAAE,mEAAmE;aAChG,iBAAiB,EAAE,uEAAuE;aAC1F,cAAc,EAAE,qDAAqD;aACrE,2BAA2B,EAAE,mEAAmE;aAChG,8BAA8B,EAC5B,sEAAsE;aACxE,4BAA4B,EAC1B,oEAAoE;aACtE,mBAAmB,EAAE,8CAA8C;aACnE,4BAA4B,EAAE,oDAAoD;aAClF,UAAU,EAAE,sDAAsD;aAClE,MAAM,EAAE,yDAAyD;aACjE,SAAS,EAAE,wBAAwB;aACnC,SAAS,EAAE,wBAAwB;aACnC,WAAW,EAAE,2BAA2B;aACxC,cAAc,EAAE,2CAA2C;aAC3D,MAAM,EAAE,kEAAkE;aAC1E,KAAK,EAAE,wCAAwC;aAC/C,MAAM,EAAE,8BAA8B;aACtC,MAAM,EAAE,gCAAgC;aACxC,KAAK,EAAE,yEAAyE;aAChF,QAAQ,EAAE,kEAAkE;aAC5E,sBAAsB,EAAE,kDAAkD;aAC1E,iBAAiB,EACf,iFAAiF;aACnF,WAAW,EAAE,iEAAiE;aAC9E,oBAAoB,EAAE,4DAA4D;aAClF,qBAAqB,EAAE,wDAAwD;aAC/E,SAAS,EAAE,gEAAgE;aAC3E,mBAAmB,EAAE,0EAA0E;aAC/F,qBAAqB,EAAE,yCAAyC;aAChE,qBAAqB,EAAE,iEAAiE;aACxF,uBAAuB,EAAE,sDAAsD;aAC/E,uBAAuB,EAAE,+CAA+C;aACxE,yBAAyB,EAAE,qDAAqD;aAChF,wBAAwB,EAAE,4CAA4C;aACtE,iBAAiB,EAAE,wEAAwE;aAC3F,cAAc,EACZ,sFAAsF;aACxF,YAAY,EACV,kGAAkG;aACpG,aAAa,EACX,oGAAoG;aACtG,gBAAgB,EACd,4GAA4G;aAC9G,QAAQ,EACN,8GAA8G;aAChH,eAAe,EACb,yIAAyI;aAC3I,eAAe,EACb,iIAAiI;aACnI,iBAAiB,EACf,2FAA2F;aAC7F,0CAA0C,EACxC,oEAAoE;aACtE,kCAAkC,EAChC,4EAA4E;aAC9E,8CAA8C,EAC5C,gEAAgE;aAClE,8BAA8B,EAAE,2DAA2D;aAC3F,eAAe,EACb,4FAA4F;aAC9F,YAAY,EAAE,sEAAsE;aACpF,eAAe,EAAE,yEAAyE;aAC1F,mBAAmB,EACjB,mHAAmH;aACrH,wBAAwB,EACtB,mHAAmH;CAC7G,CAAC;AAEX,wBAAgB,gCAAgC,IAAI,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAsBrF;AAED,wBAAgB,qCAAqC,CAAC,OAAO,CAAC,EAAE;IAC9D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CA2OrC;AAED,wBAAgB,gCAAgC,IAAI,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAWrF;AAED,wBAAgB,gCAAgC,IAAI,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAwCrF;AAED,wBAAgB,0CAA0C,IAAI,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAQ/F"}
+{"version":3,"file":"options-schema.d.ts","sourceRoot":"","sources":["../../src/api/options-schema.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEzD,eAAO,MAAM,sBAAsB,YAAI,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAU,CAAC;AACtF,eAAO,MAAM,mBAAmB,YAAI,QAAQ,EAAE,OAAO,CAAU,CAAC;AAChE,eAAO,MAAM,wBAAwB,YAAI,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,CAAU,CAAC;AAE7F,eAAO,MAAM,mBAAmB;aAC9B,KAAK,EAAE,6BAA6B;aACpC,SAAS,EAAE,0CAA0C;aACrD,GAAG,EAAE,4DAA4D;aACjE,cAAc,EAAE,qDAAqD;aACrE,MAAM,EAAE,yCAAyC;aACjD,OAAO,EAAE,4CAA4C;aACrD,cAAc,EACZ,iGAAiG;aACnG,QAAQ,EAAE,qDAAqD;aAC/D,WAAW,EAAE,sCAAsC;aACnD,KAAK,EAAE,oBAAoB;aAC3B,gBAAgB,EAAE,wDAAwD;aAC1E,qBAAqB,EAAE,6DAA6D;aACpF,2BAA2B,EAAE,mEAAmE;aAChG,iBAAiB,EAAE,uEAAuE;aAC1F,cAAc,EAAE,qDAAqD;aACrE,2BAA2B,EAAE,mEAAmE;aAChG,8BAA8B,EAC5B,sEAAsE;aACxE,4BAA4B,EAC1B,oEAAoE;aACtE,mBAAmB,EAAE,8CAA8C;aACnE,4BAA4B,EAAE,oDAAoD;aAClF,UAAU,EAAE,sDAAsD;aAClE,MAAM,EAAE,yDAAyD;aACjE,SAAS,EAAE,wBAAwB;aACnC,SAAS,EAAE,wBAAwB;aACnC,WAAW,EAAE,2BAA2B;aACxC,cAAc,EAAE,2CAA2C;aAC3D,MAAM,EAAE,kEAAkE;aAC1E,KAAK,EAAE,wCAAwC;aAC/C,MAAM,EAAE,8BAA8B;aACtC,MAAM,EAAE,gCAAgC;aACxC,KAAK,EAAE,yEAAyE;aAChF,QAAQ,EAAE,kEAAkE;aAC5E,sBAAsB,EAAE,kDAAkD;aAC1E,iBAAiB,EACf,iFAAiF;aACnF,WAAW,EAAE,iEAAiE;aAC9E,oBAAoB,EAAE,4DAA4D;aAClF,qBAAqB,EAAE,wDAAwD;aAC/E,SAAS,EAAE,gEAAgE;aAC3E,mBAAmB,EAAE,0EAA0E;aAC/F,qBAAqB,EAAE,yCAAyC;aAChE,qBAAqB,EAAE,iEAAiE;aACxF,uBAAuB,EAAE,sDAAsD;aAC/E,uBAAuB,EAAE,+CAA+C;aACxE,yBAAyB,EAAE,qDAAqD;aAChF,wBAAwB,EAAE,4CAA4C;aACtE,iBAAiB,EAAE,wEAAwE;aAC3F,cAAc,EACZ,sFAAsF;aACxF,YAAY,EACV,kGAAkG;aACpG,aAAa,EACX,oGAAoG;aACtG,gBAAgB,EACd,4GAA4G;aAC9G,QAAQ,EACN,8GAA8G;aAChH,eAAe,EACb,yIAAyI;aAC3I,eAAe,EACb,iIAAiI;aACnI,iBAAiB,EACf,2FAA2F;aAC7F,0CAA0C,EACxC,oEAAoE;aACtE,kCAAkC,EAChC,4EAA4E;aAC9E,8CAA8C,EAC5C,gEAAgE;aAClE,8BAA8B,EAAE,2DAA2D;aAC3F,eAAe,EACb,4FAA4F;aAC9F,YAAY,EAAE,sEAAsE;aACpF,eAAe,EAAE,yEAAyE;aAC1F,mBAAmB,EACjB,mHAAmH;aACrH,wBAAwB,EACtB,mHAAmH;aACrH,UAAU,EACR,+HAA+H;aACjI,iBAAiB,EAAE,0EAA0E;aAC7F,sBAAsB,EACpB,2GAA2G;CACrG,CAAC;AAEX,wBAAgB,gCAAgC,IAAI,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CA2BrF;AAED,wBAAgB,qCAAqC,CAAC,OAAO,CAAC,EAAE;IAC9D,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,GAAG,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAyPrC;AAED,wBAAgB,gCAAgC,IAAI,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAWrF;AAED,wBAAgB,gCAAgC,IAAI,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAwCrF;AAED,wBAAgB,0CAA0C,IAAI,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAQ/F"}

package/dist/api/patches/reconcile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reconcile.d.ts","sourceRoot":"","sources":["../../../src/api/patches/reconcile.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,qBAAqB,EACrB,oBAAoB,EAErB,MAAM,yBAAyB,CAAC;AAGjC;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,oBAAoB,CAAC,CAqK/B"}
+{"version":3,"file":"reconcile.d.ts","sourceRoot":"","sources":["../../../src/api/patches/reconcile.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EACV,qBAAqB,EACrB,oBAAoB,EAErB,MAAM,yBAAyB,CAAC;AAGjC;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,oBAAoB,CAAC,CAuP/B"}

package/dist/api/scan-execution.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scan-execution.d.ts","sourceRoot":"","sources":["../../src/api/scan-execution.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAGlD,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,uBAAuB,EAAE,KAAK,CAAC;QAC7B,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;KACf,CAAC,CAAC;CACJ;AAED,wBAAsB,uBAAuB,CAAC,MAAM,EAAE;IACpD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,WAAW,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,oBAAoB,CAAC;IAC7B,WAAW,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7E,UAAU,EAAE,iBAAiB,CAAC;IAC9B,WAAW,EAAE;QAAE,sBAAsB,CAAC,EAAE,OAAO,CAAC;QAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC/E,QAAQ,EAAE,WAAW,CAAC;CACvB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA4D/B"}
+{"version":3,"file":"scan-execution.d.ts","sourceRoot":"","sources":["../../src/api/scan-execution.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAGlD,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,uBAAuB,EAAE,KAAK,CAAC;QAC7B,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;KACf,CAAC,CAAC;CACJ;AAED,wBAAsB,uBAAuB,CAAC,MAAM,EAAE;IACpD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,WAAW,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,oBAAoB,CAAC;IAC7B,WAAW,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7E,UAAU,EAAE,iBAAiB,CAAC;IAC9B,WAAW,EAAE;QAAE,sBAAsB,CAAC,EAAE,OAAO,CAAC;QAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC/E,QAAQ,EAAE,WAAW,CAAC;CACvB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAwD/B"}

package/dist/api/vex/index.d.ts

@@ -1,4 +1,4 @@
-import type { RemediationReport } from "../../platform/types.js";
+import type { RemediationReport, VexSuppression } from "../../platform/types.js";
 import type { ScanReport } from "../contracts.js";
 export interface CycloneDxVexVulnerabilityAnalysis {
     state: "resolved" | "not_affected" | "in_triage";
@@ -13,7 +13,7 @@ export interface CycloneDxVexVulnerability {
 export interface CycloneDxVexDocument {
     bomFormat: "CycloneDX";
     specVersion: "1.5";
-    version: 1;
+    version: number;
     serialNumber: string;
     metadata: {
         timestamp: string;
@@ -28,4 +28,8 @@ export interface ToCycloneDxVexOptions {
     toolVersion?: string;
 }
 export declare function toCycloneDxVex(report: ScanReport | RemediationReport, options?: ToCycloneDxVexOptions): CycloneDxVexDocument;
+/**
+ * Persists or updates a CycloneDX 1.5 VEX document with a suppressed vulnerability entry.
+ */
+export declare function saveSuppressionToVexDocument(filePath: string, suppression: VexSuppression, toolVersion?: string): void;
 //# sourceMappingURL=index.d.ts.map

package/dist/api/vex/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/vex/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,MAAM,WAAW,iCAAiC;IAChD,KAAK,EAAE,UAAU,GAAG,cAAc,GAAG,WAAW,CAAC;IACjD,aAAa,CAAC,EAAE,0BAA0B,GAAG,oBAAoB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,CAAC,QAAQ,GAAG,sBAAsB,CAAC,EAAE,CAAC;CAClD;AAED,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,iCAAiC,CAAC;CAC7C;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,WAAW,CAAC;IACvB,WAAW,EAAE,KAAK,CAAC;IACnB,OAAO,EAAE,CAAC,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE;QACR,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACjD,CAAC;IACF,eAAe,EAAE,yBAAyB,EAAE,CAAC;CAC9C;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AA4DD,wBAAgB,cAAc,CAC5B,MAAM,EAAE,UAAU,GAAG,iBAAiB,EACtC,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CA2BtB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/vex/index.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,MAAM,WAAW,iCAAiC;IAChD,KAAK,EAAE,UAAU,GAAG,cAAc,GAAG,WAAW,CAAC;IACjD,aAAa,CAAC,EAAE,0BAA0B,GAAG,oBAAoB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,CAAC,QAAQ,GAAG,sBAAsB,CAAC,EAAE,CAAC;CAClD;AAED,MAAM,WAAW,yBAAyB;IACxC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,iCAAiC,CAAC;CAC7C;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,WAAW,CAAC;IACvB,WAAW,EAAE,KAAK,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE;QACR,SAAS,EAAE,MAAM,CAAC;QAClB,KAAK,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACjD,CAAC;IACF,eAAe,EAAE,yBAAyB,EAAE,CAAC;CAC9C;AAED,MAAM,WAAW,qBAAqB;IACpC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AA4DD,wBAAgB,cAAc,CAC5B,MAAM,EAAE,UAAU,GAAG,iBAAiB,EACtC,OAAO,GAAE,qBAA0B,GAClC,oBAAoB,CA2BtB;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,cAAc,EAC3B,WAAW,SAAY,GACtB,IAAI,CA4CN"}