autoremediator 0.2.2 → 0.4.0

package/dist/{chunk-DQKT2CUG.js → chunk-GBOD3DV6.js}

@@ -1,7 +1,7 @@
 // src/remediation/pipeline.ts
 import { generateText as generateText2 } from "ai";
 import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 import semver4 from "semver";
 
 // src/platform/config.ts
@@ -64,6 +64,19 @@ function getNvdConfig() {
 function getGitHubToken() {
   return process.env.GITHUB_TOKEN;
 }
+function getIntelligenceSourceConfig() {
+  return {
+    gitLabAdvisoryApi: process.env.AUTOREMEDIATOR_GITLAB_ADVISORY_API ?? "https://advisories.gitlab.com/api/v1/advisories",
+    certCcSearchUrl: process.env.AUTOREMEDIATOR_CERTCC_SEARCH_URL ?? "https://www.kb.cert.org/vuls/search",
+    epssApi: process.env.AUTOREMEDIATOR_EPSS_API ?? "https://api.first.org/data/v1/epss",
+    cveServicesApi: process.env.AUTOREMEDIATOR_CVE_SERVICES_API ?? "https://cveawg.mitre.org/api/cve",
+    depsDevApi: process.env.AUTOREMEDIATOR_DEPSDEV_API ?? "https://api.deps.dev/v3",
+    scorecardApi: process.env.AUTOREMEDIATOR_SCORECARD_API ?? "https://api.securityscorecards.dev",
+    vendorAdvisoryFeeds: (process.env.AUTOREMEDIATOR_VENDOR_ADVISORY_FEEDS ?? "").split(",").map((v) => v.trim()).filter(Boolean),
+    commercialFeeds: (process.env.AUTOREMEDIATOR_COMMERCIAL_FEEDS ?? "").split(",").map((v) => v.trim()).filter(Boolean),
+    commercialFeedToken: process.env.AUTOREMEDIATOR_COMMERCIAL_FEED_TOKEN
+  };
+}
 
 // src/platform/package-manager.ts
 import { existsSync } from "fs";
@@ -343,6 +356,288 @@ async function enrichWithNvd(details) {
   return details;
 }
 
+// src/intelligence/sources/cisa-kev.ts
+var CISA_KEV_URL = "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json";
+async function fetchCisaKevFeed() {
+  try {
+    const res = await fetch(CISA_KEV_URL, {
+      headers: { Accept: "application/json" }
+    });
+    if (!res.ok) return void 0;
+    return await res.json();
+  } catch {
+    return void 0;
+  }
+}
+function findKevEntry(feed, cveId) {
+  if (!feed?.vulnerabilities?.length) return void 0;
+  const normalized = cveId.toUpperCase();
+  return feed.vulnerabilities.find((v) => v.cveID.toUpperCase() === normalized);
+}
+async function enrichWithCisaKev(details) {
+  const feed = await fetchCisaKevFeed();
+  const entry = findKevEntry(feed, details.id);
+  if (!entry) return details;
+  details.kev = {
+    knownExploited: true,
+    dateAdded: entry.dateAdded,
+    dueDate: entry.dueDate,
+    requiredAction: entry.requiredAction,
+    knownRansomwareCampaignUse: entry.knownRansomwareCampaignUse
+  };
+  if (!details.references.includes(CISA_KEV_URL)) {
+    details.references.push(CISA_KEV_URL);
+  }
+  return details;
+}
+
+// src/intelligence/sources/epss.ts
+async function fetchEpss(cveId) {
+  const { epssApi } = getIntelligenceSourceConfig();
+  if (!epssApi) return void 0;
+  try {
+    const url = new URL(epssApi);
+    url.searchParams.set("cve", cveId);
+    const res = await fetch(url.toString(), {
+      headers: { Accept: "application/json" }
+    });
+    if (!res.ok) return void 0;
+    const body = await res.json();
+    return body.data?.[0];
+  } catch {
+    return void 0;
+  }
+}
+async function enrichWithEpss(details) {
+  const row = await fetchEpss(details.id);
+  if (!row) return details;
+  const score = Number.parseFloat(row.epss);
+  const percentile = Number.parseFloat(row.percentile);
+  if (!Number.isFinite(score) || !Number.isFinite(percentile)) {
+    return details;
+  }
+  details.epss = {
+    score,
+    percentile,
+    date: row.date
+  };
+  return details;
+}
+
+// src/intelligence/sources/cve-services.ts
+function pickEnglishDescription(container) {
+  if (!container?.descriptions?.length) return void 0;
+  const en = container.descriptions.find((d) => d.lang === "en" && d.value);
+  return (en?.value ?? container.descriptions[0]?.value)?.trim() || void 0;
+}
+function collectReferences(record) {
+  const refs = /* @__PURE__ */ new Set();
+  const cnaRefs = record.containers?.cna?.references ?? [];
+  const adpRefs = (record.containers?.adp ?? []).flatMap((c) => c.references ?? []);
+  for (const ref of [...cnaRefs, ...adpRefs]) {
+    if (ref.url) refs.add(ref.url);
+  }
+  return Array.from(refs);
+}
+async function fetchCveServicesRecord(cveId) {
+  const { cveServicesApi } = getIntelligenceSourceConfig();
+  if (!cveServicesApi) return void 0;
+  try {
+    const res = await fetch(`${cveServicesApi}/${encodeURIComponent(cveId)}`, {
+      headers: { Accept: "application/json" }
+    });
+    if (!res.ok) return void 0;
+    return await res.json();
+  } catch {
+    return void 0;
+  }
+}
+async function enrichWithCveServices(details) {
+  const record = await fetchCveServicesRecord(details.id);
+  if (!record) return details;
+  const summary = pickEnglishDescription(record.containers?.cna);
+  if (summary && (!details.summary || details.summary.includes("No summary available"))) {
+    details.summary = summary;
+  }
+  const refs = collectReferences(record);
+  if (refs.length > 0) {
+    const merged = /* @__PURE__ */ new Set([...details.references, ...refs]);
+    details.references = Array.from(merged);
+  }
+  details.intelligence = {
+    ...details.intelligence ?? {},
+    cveServicesEnriched: true
+  };
+  return details;
+}
+
+// src/intelligence/sources/gitlab-advisory.ts
+function advisoryMatchesCve(advisory, cveId) {
+  const normalized = cveId.toUpperCase();
+  return (advisory.identifiers ?? []).some(
+    (id) => id.type?.toUpperCase() === "CVE" && id.value?.toUpperCase() === normalized
+  );
+}
+async function fetchGitLabAdvisories(cveId) {
+  const { gitLabAdvisoryApi } = getIntelligenceSourceConfig();
+  if (!gitLabAdvisoryApi) return [];
+  try {
+    const url = new URL(gitLabAdvisoryApi);
+    url.searchParams.set("identifier", cveId);
+    url.searchParams.set("ecosystem", "npm");
+    const res = await fetch(url.toString(), {
+      headers: { Accept: "application/json" }
+    });
+    if (!res.ok) return [];
+    const body = await res.json();
+    return Array.isArray(body) ? body : [];
+  } catch {
+    return [];
+  }
+}
+async function enrichWithGitLabAdvisory(details) {
+  const advisories = await fetchGitLabAdvisories(details.id);
+  const matched = advisories.filter((a) => advisoryMatchesCve(a, details.id));
+  if (matched.length === 0) return details;
+  const refs = matched.flatMap((m) => m.references ?? []);
+  if (refs.length > 0) {
+    const merged = /* @__PURE__ */ new Set([...details.references, ...refs]);
+    details.references = Array.from(merged);
+  }
+  details.intelligence = {
+    ...details.intelligence ?? {},
+    gitlabAdvisoryMatched: true
+  };
+  return details;
+}
+
+// src/intelligence/sources/certcc.ts
+var CERTCC_HOME = "https://www.kb.cert.org/vuls/";
+async function findCertCcReference(cveId) {
+  const { certCcSearchUrl } = getIntelligenceSourceConfig();
+  if (!certCcSearchUrl) return void 0;
+  try {
+    const url = new URL(certCcSearchUrl);
+    url.searchParams.set("query", cveId);
+    const res = await fetch(url.toString(), {
+      headers: { Accept: "text/html" }
+    });
+    if (!res.ok) return void 0;
+    const html = await res.text();
+    const match = html.match(/https:\/\/www\.kb\.cert\.org\/vuls\/id\/\d+/i);
+    return match?.[0] ?? void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function enrichWithCertCc(details) {
+  const ref = await findCertCcReference(details.id);
+  if (!ref) return details;
+  if (!details.references.includes(ref)) {
+    details.references.push(ref);
+  }
+  details.intelligence = {
+    ...details.intelligence ?? {},
+    certCcMatched: true
+  };
+  if (!details.references.includes(CERTCC_HOME)) {
+    details.references.push(CERTCC_HOME);
+  }
+  return details;
+}
+
+// src/intelligence/sources/deps-dev.ts
+async function fetchDepsDevPackage(name) {
+  const { depsDevApi } = getIntelligenceSourceConfig();
+  if (!depsDevApi) return false;
+  try {
+    const url = `${depsDevApi}/systems/npm/packages/${encodeURIComponent(name)}`;
+    const res = await fetch(url, { headers: { Accept: "application/json" } });
+    return res.ok;
+  } catch {
+    return false;
+  }
+}
+async function enrichWithDepsDev(details) {
+  const names = Array.from(new Set(details.affectedPackages.map((p) => p.name))).slice(0, 20);
+  if (names.length === 0) return details;
+  const checks = await Promise.all(names.map((name) => fetchDepsDevPackage(name)));
+  const matched = checks.filter(Boolean).length;
+  if (matched === 0) return details;
+  details.intelligence = {
+    ...details.intelligence ?? {},
+    depsDevEnrichedPackages: matched
+  };
+  return details;
+}
+
+// src/intelligence/sources/ossf-scorecard.ts
+async function checkProject(project) {
+  const { scorecardApi } = getIntelligenceSourceConfig();
+  if (!scorecardApi) return false;
+  try {
+    const url = new URL(`${scorecardApi}/projects`);
+    url.searchParams.set("project", project);
+    const res = await fetch(url.toString(), {
+      headers: { Accept: "application/json" }
+    });
+    return res.ok;
+  } catch {
+    return false;
+  }
+}
+async function enrichWithOssfScorecard(details) {
+  const projects = Array.from(
+    new Set(details.affectedPackages.map((p) => `github.com/${p.name}/${p.name}`))
+  ).slice(0, 10);
+  if (projects.length === 0) return details;
+  const checks = await Promise.all(projects.map((project) => checkProject(project)));
+  const matched = checks.filter(Boolean).length;
+  if (matched === 0) return details;
+  details.intelligence = {
+    ...details.intelligence ?? {},
+    scorecardProjects: matched
+  };
+  return details;
+}
+
+// src/intelligence/sources/external-feeds.ts
+async function probeFeed(url, cveId, token) {
+  try {
+    const feedUrl = new URL(url);
+    feedUrl.searchParams.set("cve", cveId);
+    const headers = { Accept: "application/json" };
+    if (token) headers.Authorization = `Bearer ${token}`;
+    const res = await fetch(feedUrl.toString(), { headers });
+    if (!res.ok) return void 0;
+    return feedUrl.toString();
+  } catch {
+    return void 0;
+  }
+}
+async function enrichWithExternalFeeds(details) {
+  const {
+    vendorAdvisoryFeeds,
+    commercialFeeds,
+    commercialFeedToken
+  } = getIntelligenceSourceConfig();
+  const vendorHits = (await Promise.all(vendorAdvisoryFeeds.map((url) => probeFeed(url, details.id)))).filter((v) => Boolean(v));
+  const commercialHits = (await Promise.all(
+    commercialFeeds.map((url) => probeFeed(url, details.id, commercialFeedToken))
+  )).filter((v) => Boolean(v));
+  if (vendorHits.length === 0 && commercialHits.length === 0) {
+    return details;
+  }
+  details.intelligence = {
+    ...details.intelligence ?? {},
+    vendorAdvisories: vendorHits.length > 0 ? vendorHits : details.intelligence?.vendorAdvisories,
+    commercialFeeds: commercialHits.length > 0 ? commercialHits : details.intelligence?.commercialFeeds
+  };
+  const mergedRefs = /* @__PURE__ */ new Set([...details.references, ...vendorHits, ...commercialHits]);
+  details.references = Array.from(mergedRefs);
+  return details;
+}
+
 // src/remediation/tools/lookup-cve.ts
 var lookupCveTool = tool({
   description: "Look up a CVE ID and return the list of affected npm packages, their vulnerable version ranges, and the first patched version. Always call this first.",
@@ -371,7 +666,37 @@ var lookupCveTool = tool({
     if (ghPackages.length > 0) {
       details = mergeGhDataIntoCveDetails(details, ghPackages);
     }
-    details = await enrichWithNvd(details);
+    const sourceHealth = {};
+    const applyEnricher = async (sourceName, enricher) => {
+      const before = JSON.stringify(details);
+      try {
+        details = await enricher(details);
+        const after = JSON.stringify(details);
+        sourceHealth[sourceName] = {
+          attempted: true,
+          changed: before !== after
+        };
+      } catch (error) {
+        sourceHealth[sourceName] = {
+          attempted: true,
+          changed: false,
+          error: error instanceof Error ? error.message : String(error)
+        };
+      }
+    };
+    await applyEnricher("nvd", enrichWithNvd);
+    await applyEnricher("cisa-kev", enrichWithCisaKev);
+    await applyEnricher("epss", enrichWithEpss);
+    await applyEnricher("cve-services", enrichWithCveServices);
+    await applyEnricher("gitlab-advisory", enrichWithGitLabAdvisory);
+    await applyEnricher("certcc", enrichWithCertCc);
+    await applyEnricher("deps-dev", enrichWithDepsDev);
+    await applyEnricher("ossf-scorecard", enrichWithOssfScorecard);
+    await applyEnricher("external-feeds", enrichWithExternalFeeds);
+    details.intelligence = {
+      ...details.intelligence ?? {},
+      sourceHealth
+    };
     if (details.affectedPackages.length === 0) {
       return {
         success: false,
@@ -574,7 +899,7 @@ var findFixedVersionTool = tool4({
 // src/remediation/tools/apply-version-bump.ts
 import { tool as tool5 } from "ai";
 import { z as z5 } from "zod";
-import { join as join4 } from "path";
+import { join as join5 } from "path";
 import { readFileSync as readFileSync3, writeFileSync } from "fs";
 import { execa as execa2 } from "execa";
 import semver3 from "semver";
@@ -585,7 +910,11 @@ import { join as join3 } from "path";
 var DEFAULT_POLICY = {
   allowMajorBumps: false,
   denyPackages: [],
-  allowPackages: []
+  allowPackages: [],
+  constraints: {
+    directDependenciesOnly: false,
+    preferVersionBump: false
+  }
 };
 function loadPolicy(cwd, explicitPath) {
   const candidate = explicitPath ?? join3(cwd, ".autoremediator.json");
@@ -595,7 +924,11 @@ function loadPolicy(cwd, explicitPath) {
     return {
       allowMajorBumps: parsed.allowMajorBumps ?? DEFAULT_POLICY.allowMajorBumps,
       denyPackages: parsed.denyPackages ?? DEFAULT_POLICY.denyPackages,
-      allowPackages: parsed.allowPackages ?? DEFAULT_POLICY.allowPackages
+      allowPackages: parsed.allowPackages ?? DEFAULT_POLICY.allowPackages,
+      constraints: {
+        directDependenciesOnly: parsed.constraints?.directDependenciesOnly ?? DEFAULT_POLICY.constraints?.directDependenciesOnly ?? false,
+        preferVersionBump: parsed.constraints?.preferVersionBump ?? DEFAULT_POLICY.constraints?.preferVersionBump ?? false
+      }
     };
   } catch {
     return DEFAULT_POLICY;
@@ -609,6 +942,45 @@ function isPackageAllowed(policy, packageName) {
   return true;
 }
 
+// src/platform/repo-lock.ts
+import { mkdir, rm } from "fs/promises";
+import { join as join4 } from "path";
+async function sleep(ms) {
+  await new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function acquireRepoLock(cwd, options = {}) {
+  const timeoutMs = options.timeoutMs ?? 15e3;
+  const retryDelayMs = options.retryDelayMs ?? 125;
+  const lockRoot = join4(cwd, ".autoremediator", "locks");
+  const lockPath = join4(cwd, ".autoremediator", "locks", "remediation.lock");
+  const startedAt = Date.now();
+  await mkdir(lockRoot, { recursive: true });
+  while (true) {
+    try {
+      await mkdir(lockPath, { recursive: false });
+      return {
+        lockPath,
+        release: async () => {
+          await rm(lockPath, { recursive: true, force: true });
+        }
+      };
+    } catch {
+      if (Date.now() - startedAt > timeoutMs) {
+        throw new Error(`Timed out waiting for repository lock at ${lockPath}.`);
+      }
+      await sleep(retryDelayMs);
+    }
+  }
+}
+async function withRepoLock(cwd, fn, options) {
+  const lock = await acquireRepoLock(cwd, options);
+  try {
+    return await fn();
+  } finally {
+    await lock.release();
+  }
+}
+
 // src/remediation/tools/apply-version-bump.ts
 var applyVersionBumpTool = tool5({
   description: "Update package.json to use the safe version of a vulnerable package and run the project's package manager install. In dry-run mode, only reports what would change.",
@@ -619,8 +991,8 @@ var applyVersionBumpTool = tool5({
     fromVersion: z5.string().describe("The currently installed vulnerable version"),
     toVersion: z5.string().describe("The safe target version to upgrade to"),
     dryRun: z5.boolean().default(false).describe("If true, report changes but do not write"),
-    policyPath: z5.string().optional().describe("Optional path to .autoremediator policy file"),
-    skipTests: z5.boolean().default(true).describe("If true, skip test validation after applying the fix")
+    policy: z5.string().optional().describe("Optional path to .autoremediator policy file"),
+    runTests: z5.boolean().default(false).describe("If true, run test validation after applying the fix")
   }),
   execute: async ({
     cwd,
@@ -629,14 +1001,14 @@ var applyVersionBumpTool = tool5({
     fromVersion,
     toVersion,
     dryRun,
-    policyPath,
-    skipTests
+    policy,
+    runTests
   }) => {
     const pm = packageManager ?? detectPackageManager(cwd);
     const commands = getPackageManagerCommands(pm);
-    const pkgPath = join4(cwd, "package.json");
-    const policy = loadPolicy(cwd, policyPath);
-    if (!isPackageAllowed(policy, packageName)) {
+    const pkgPath = join5(cwd, "package.json");
+    const loadedPolicy = loadPolicy(cwd, policy);
+    if (!isPackageAllowed(loadedPolicy, packageName)) {
       return {
         packageName,
         strategy: "none",
@@ -648,7 +1020,7 @@ var applyVersionBumpTool = tool5({
       };
     }
     const isMajorBump = semver3.valid(fromVersion) && semver3.valid(toVersion) && semver3.major(toVersion) > semver3.major(fromVersion);
-    if (isMajorBump && !policy.allowMajorBumps) {
+    if (isMajorBump && !loadedPolicy.allowMajorBumps) {
       return {
         packageName,
         strategy: "none",
@@ -699,49 +1071,21 @@ var applyVersionBumpTool = tool5({
         toVersion,
         applied: false,
         dryRun: true,
-        message: `[DRY RUN] Would update ${depField}.${packageName}: "${currentRange}" \u2192 "${newRange}", then run ${installCmd}${skipTests ? "" : ` and ${testCmd}`}.`
+        message: `[DRY RUN] Would update ${depField}.${packageName}: "${currentRange}" -> "${newRange}", then run ${installCmd}${runTests ? ` and ${testCmd}` : ""}.`
       };
     }
-    pkgJson[depField][packageName] = newRange;
-    writeFileSync(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
-    try {
-      const [installCmd, ...installArgs] = commands.installPreferOffline;
-      await execa2(installCmd, installArgs, {
-        cwd,
-        stdio: "pipe"
-      });
-    } catch (err) {
-      pkgJson[depField][packageName] = currentRange;
+    return withRepoLock(cwd, async () => {
+      pkgJson[depField][packageName] = newRange;
       writeFileSync(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
-      const message = err instanceof Error ? err.message : String(err);
-      return {
-        packageName,
-        strategy: "version-bump",
-        fromVersion,
-        toVersion,
-        applied: false,
-        dryRun: false,
-        message: `${commands.installPreferOffline.join(" ")} failed after updating "${packageName}" to ${toVersion}. Reverted. Error: ${message}`
-      };
-    }
-    if (!skipTests) {
       try {
-        const [testCmd, ...testArgs] = commands.test;
-        await execa2(testCmd, testArgs, {
+        const [installCmd, ...installArgs] = commands.installPreferOffline;
+        await execa2(installCmd, installArgs, {
           cwd,
           stdio: "pipe"
         });
       } catch (err) {
         pkgJson[depField][packageName] = currentRange;
         writeFileSync(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
-        try {
-          const [rollbackCmd, ...rollbackArgs] = commands.installPreferOffline;
-          await execa2(rollbackCmd, rollbackArgs, {
-            cwd,
-            stdio: "pipe"
-          });
-        } catch {
-        }
         const message = err instanceof Error ? err.message : String(err);
         return {
           packageName,
@@ -750,27 +1094,57 @@ var applyVersionBumpTool = tool5({
           toVersion,
           applied: false,
           dryRun: false,
-          message: `${commands.test.join(" ")} failed after upgrading "${packageName}" to ${toVersion}. Rolled back to ${currentRange}. Error: ${message}`
+          message: `${commands.installPreferOffline.join(" ")} failed after updating "${packageName}" to ${toVersion}. Reverted. Error: ${message}`
         };
       }
-    }
-    return {
-      packageName,
-      strategy: "version-bump",
-      fromVersion,
-      toVersion,
-      applied: true,
-      dryRun: false,
-      message: `Successfully upgraded "${packageName}" from ${fromVersion} to ${toVersion}, ran ${commands.installPreferOffline.join(" ")}${skipTests ? "" : `, and passed ${commands.test.join(" ")}`}.`
-    };
+      if (runTests) {
+        try {
+          const [testCmd, ...testArgs] = commands.test;
+          await execa2(testCmd, testArgs, {
+            cwd,
+            stdio: "pipe"
+          });
+        } catch (err) {
+          pkgJson[depField][packageName] = currentRange;
+          writeFileSync(pkgPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
+          try {
+            const [rollbackCmd, ...rollbackArgs] = commands.installPreferOffline;
+            await execa2(rollbackCmd, rollbackArgs, {
+              cwd,
+              stdio: "pipe"
+            });
+          } catch {
+          }
+          const message = err instanceof Error ? err.message : String(err);
+          return {
+            packageName,
+            strategy: "version-bump",
+            fromVersion,
+            toVersion,
+            applied: false,
+            dryRun: false,
+            message: `${commands.test.join(" ")} failed after upgrading "${packageName}" to ${toVersion}. Rolled back to ${currentRange}. Error: ${message}`
+          };
+        }
+      }
+      return {
+        packageName,
+        strategy: "version-bump",
+        fromVersion,
+        toVersion,
+        applied: true,
+        dryRun: false,
+        message: `Successfully upgraded "${packageName}" from ${fromVersion} to ${toVersion}, ran ${commands.installPreferOffline.join(" ")}${runTests ? `, and passed ${commands.test.join(" ")}` : ""}.`
+      };
+    });
   }
 });
 
 // src/remediation/tools/fetch-package-source.ts
 import { tool as tool6 } from "ai";
 import { z as z6 } from "zod";
-import { mkdir, readdir, readFile, rm } from "fs/promises";
-import { join as join5 } from "path";
+import { mkdir as mkdir2, readdir, readFile, rm as rm2 } from "fs/promises";
+import { join as join6 } from "path";
 import { execa as execa3 } from "execa";
 var fetchPackageSourceTool = tool6({
   description: "Download package tarball from npm and extract source files for CVE analysis. Supports custom file patterns (default: *.js, *.ts).",
@@ -787,23 +1161,23 @@ var fetchPackageSourceTool = tool6({
     filePatterns
   }) => {
     const tempBaseDir = `/tmp/autoremediator-pkg-${Date.now()}`;
-    const extractDir = join5(tempBaseDir, "out");
+    const extractDir = join6(tempBaseDir, "out");
     try {
       const npmUrl = `https://registry.npmjs.org/${packageName}/-/${packageName.split("/").pop()}-${version}.tgz`;
-      await mkdir(tempBaseDir, { recursive: true });
-      const tarballPath = join5(tempBaseDir, "package.tgz");
+      await mkdir2(tempBaseDir, { recursive: true });
+      const tarballPath = join6(tempBaseDir, "package.tgz");
       await execa3("curl", ["-L", "-o", tarballPath, npmUrl]);
-      await mkdir(extractDir, { recursive: true });
+      await mkdir2(extractDir, { recursive: true });
       await execa3("tar", ["-xzf", tarballPath, "-C", extractDir]);
       const extractedContents = await readdir(extractDir);
-      const packageRootDir = extractedContents.includes("package") ? join5(extractDir, "package") : extractDir;
+      const packageRootDir = extractedContents.includes("package") ? join6(extractDir, "package") : extractDir;
       const sourceCode = {};
       async function walkDir(dir, relativeBase) {
         try {
           const files = await readdir(dir, { withFileTypes: true });
           for (const file of files) {
-            const fullPath = join5(dir, file.name);
-            const relPath = join5(relativeBase, file.name);
+            const fullPath = join6(dir, file.name);
+            const relPath = join6(relativeBase, file.name);
             if (file.isDirectory()) {
               if (![
                 "node_modules",
@@ -860,7 +1234,7 @@ var fetchPackageSourceTool = tool6({
         error: `Failed to fetch and extract package ${packageName}@${version}: ${message}`
       };
     } finally {
-      await rm(tempBaseDir, { recursive: true, force: true });
+      await rm2(tempBaseDir, { recursive: true, force: true });
     }
   }
 });
@@ -1076,9 +1450,9 @@ function generateUnifiedDiff(original, fixed, filePath) {
 import { tool as tool8 } from "ai";
 import { z as z8 } from "zod";
 import { existsSync as existsSync3 } from "fs";
-import { mkdir as mkdir2, mkdtemp, readFile as readFile2, rm as rm2, writeFile } from "fs/promises";
+import { mkdir as mkdir3, mkdtemp, readFile as readFile2, rm as rm3, writeFile } from "fs/promises";
 import { tmpdir } from "os";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 import { execa as execa4 } from "execa";
 var applyPatchFileTool = tool8({
   description: "Write generated patch file and apply it using package-manager-native patch flow when available, falling back to patch-package when needed.",
@@ -1126,7 +1500,7 @@ var applyPatchFileTool = tool8({
         };
       }
       const patchFileName = buildPatchFileName(packageName, vulnerableVersion);
-      const patchFilePath = join6(cwd, patchesDir, patchFileName);
+      const patchFilePath = join7(cwd, patchesDir, patchFileName);
       if (dryRun) {
         return {
           success: true,
@@ -1139,66 +1513,68 @@ var applyPatchFileTool = tool8({
           patchPath: patchFilePath
         };
       }
-      const patchesDirPath = join6(cwd, patchesDir);
-      await mkdir2(patchesDirPath, { recursive: true });
-      await writeFile(patchFilePath, selectedPatch, "utf8");
-      let validationResult;
-      const patchMode = await resolvePatchMode(pm, cwd);
-      const applyResult = patchMode === "patch-package" ? await configurePatchPackagePostinstall(cwd, pm) : await applyNativePatch({
-        cwd,
-        packageName,
-        vulnerableVersion,
-        patchContent: selectedPatch,
-        patchMode
-      });
-      if (!applyResult.success) {
-        return {
-          success: false,
+      return withRepoLock(cwd, async () => {
+        const patchesDirPath = join7(cwd, patchesDir);
+        await mkdir3(patchesDirPath, { recursive: true });
+        await writeFile(patchFilePath, selectedPatch, "utf8");
+        let validationResult;
+        const patchMode = await resolvePatchMode(pm, cwd);
+        const applyResult = patchMode === "patch-package" ? await configurePatchPackagePostinstall(cwd, pm) : await applyNativePatch({
+          cwd,
           packageName,
           vulnerableVersion,
-          applied: false,
-          dryRun: false,
-          message: applyResult.error,
-          patchFilePath,
-          patchPath: patchFilePath,
-          patchMode,
-          postinstallConfigured: patchMode === "patch-package" ? false : void 0,
-          error: applyResult.error
-        };
-      }
-      if (validateWithTests) {
-        validationResult = await validatePatchWithTests(cwd, pm);
-        if (!validationResult.passed) {
-          const validationError = "Patch validation failed after apply; patch marked unresolved.";
+          patchContent: selectedPatch,
+          patchMode
+        });
+        if (!applyResult.success) {
           return {
             success: false,
             packageName,
             vulnerableVersion,
             applied: false,
             dryRun: false,
-            message: validationError,
+            message: applyResult.error,
             patchFilePath,
             patchPath: patchFilePath,
             patchMode,
-            postinstallConfigured: patchMode === "patch-package",
-            validation: validationResult,
-            error: validationError
+            postinstallConfigured: patchMode === "patch-package" ? false : void 0,
+            error: applyResult.error
           };
         }
-      }
-      return {
-        success: true,
-        packageName,
-        vulnerableVersion,
-        applied: true,
-        dryRun: false,
-        message: `Patch applied successfully for ${packageName}@${vulnerableVersion}.`,
-        patchFilePath,
-        patchPath: patchFilePath,
-        patchMode,
-        postinstallConfigured: patchMode === "patch-package",
-        validation: validationResult
-      };
+        if (validateWithTests) {
+          validationResult = await validatePatchWithTests(cwd, pm);
+          if (!validationResult.passed) {
+            const validationError = "Patch validation failed after apply; patch marked unresolved.";
+            return {
+              success: false,
+              packageName,
+              vulnerableVersion,
+              applied: false,
+              dryRun: false,
+              message: validationError,
+              patchFilePath,
+              patchPath: patchFilePath,
+              patchMode,
+              postinstallConfigured: patchMode === "patch-package",
+              validation: validationResult,
+              error: validationError
+            };
+          }
+        }
+        return {
+          success: true,
+          packageName,
+          vulnerableVersion,
+          applied: true,
+          dryRun: false,
+          message: `Patch applied successfully for ${packageName}@${vulnerableVersion}.`,
+          patchFilePath,
+          patchPath: patchFilePath,
+          patchMode,
+          postinstallConfigured: patchMode === "patch-package",
+          validation: validationResult
+        };
+      });
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
       return {
@@ -1233,7 +1609,7 @@ function buildPatchFileName(packageName, vulnerableVersion) {
   return `${safeName}+${vulnerableVersion}.patch`;
 }
 async function configurePatchPackagePostinstall(cwd, packageManager) {
-  const pkgJsonPath = join6(cwd, "package.json");
+  const pkgJsonPath = join7(cwd, "package.json");
   let pkgJson;
   try {
     pkgJson = JSON.parse(await readFile2(pkgJsonPath, "utf8"));
@@ -1297,8 +1673,8 @@ ${createResult.stderr}`);
       error: `Could not determine native patch directory for ${packageSpec}.`
     };
   }
-  const tempPatchDir = await mkdtemp(join6(tmpdir(), "autoremediator-native-patch-"));
-  const tempPatchFile = join6(tempPatchDir, "change.patch");
+  const tempPatchDir = await mkdtemp(join7(tmpdir(), "autoremediator-native-patch-"));
+  const tempPatchFile = join7(tempPatchDir, "change.patch");
   try {
     await writeFile(tempPatchFile, patchContent, "utf8");
     await execa4("patch", ["-p1", "-i", tempPatchFile], {
@@ -1317,7 +1693,7 @@ ${createResult.stderr}`);
       error: `Failed to apply native patch for ${packageSpec}: ${err instanceof Error ? err.message : String(err)}`
     };
   } finally {
-    await rm2(tempPatchDir, { recursive: true, force: true });
+    await rm3(tempPatchDir, { recursive: true, force: true });
   }
   return { success: true };
 }
@@ -1389,17 +1765,18 @@ async function runRemediationPipeline(cveId, options = {}) {
   }
   const cwd = options.cwd ?? process.cwd();
   const packageManager = options.packageManager ?? detectPackageManager(cwd);
-  const dryRun = options.dryRun ?? false;
-  const skipTests = options.skipTests ?? true;
-  const policyPath = options.policyPath ?? "";
+  const preview = options.preview ?? false;
+  const dryRun = (options.dryRun ?? false) || preview;
+  const runTests = options.runTests ?? false;
+  const policy = options.policy ?? "";
   const patchesDir = options.patchesDir || "./patches";
   const model = await createModel(options);
   const systemPrompt = loadOrchestrationPrompt({
     cveId,
     cwd,
     dryRun,
-    skipTests,
-    policyPath,
+    runTests,
+    policy,
     patchesDir,
     packageManager
   });
@@ -1408,6 +1785,14 @@ async function runRemediationPipeline(cveId, options = {}) {
   const vulnerablePackages = [];
   let cveDetails = null;
   let agentSteps = 0;
+  const applyVersionBumpToolForRun = preview ? {
+    ...applyVersionBumpTool,
+    execute: async (input) => applyVersionBumpTool.execute({ ...input, dryRun: true })
+  } : applyVersionBumpTool;
+  const applyPatchFileToolForRun = preview ? {
+    ...applyPatchFileTool,
+    execute: async (input) => applyPatchFileTool.execute({ ...input, dryRun: true })
+  } : applyPatchFileTool;
   const result = await generateText2({
     model,
     system: systemPrompt,
@@ -1417,10 +1802,10 @@ async function runRemediationPipeline(cveId, options = {}) {
       "check-inventory": checkInventoryTool,
       "check-version-match": checkVersionMatchTool,
       "find-fixed-version": findFixedVersionTool,
-      "apply-version-bump": applyVersionBumpTool,
+      "apply-version-bump": applyVersionBumpToolForRun,
       "fetch-package-source": fetchPackageSourceTool,
       "generate-patch": generatePatchTool,
-      "apply-patch-file": applyPatchFileTool
+      "apply-patch-file": applyPatchFileToolForRun
     },
     maxSteps: 25,
     onStepFinish(stepResult) {
@@ -1463,15 +1848,21 @@ async function runRemediationPipeline(cveId, options = {}) {
     vulnerablePackages,
     results: collectedResults,
     agentSteps,
-    summary: result.text
+    summary: result.text,
+    correlation: {
+      requestId: options.requestId,
+      sessionId: options.sessionId,
+      parentRunId: options.parentRunId
+    }
   };
 }
 async function runLocalRemediationPipeline(cveId, options = {}) {
   const cwd = options.cwd ?? process.cwd();
   const packageManager = options.packageManager ?? detectPackageManager(cwd);
-  const dryRun = options.dryRun ?? false;
-  const skipTests = options.skipTests ?? true;
-  const policyPath = options.policyPath ?? "";
+  const preview = options.preview ?? false;
+  const dryRun = (options.dryRun ?? false) || preview;
+  const runTests = options.runTests ?? false;
+  const policy = options.policy ?? "";
   const collectedResults = [];
   const vulnerablePackages = [];
   let cveDetails = null;
@@ -1489,7 +1880,12 @@ async function runLocalRemediationPipeline(cveId, options = {}) {
       vulnerablePackages,
       results: collectedResults,
       agentSteps,
-      summary: `Local mode failed at lookup-cve: ${normalizedId} not found in OSV or GitHub advisory data.`
+      summary: `Local mode failed at lookup-cve: ${normalizedId} not found in OSV or GitHub advisory data.`,
+      correlation: {
+        requestId: options.requestId,
+        sessionId: options.sessionId,
+        parentRunId: options.parentRunId
+      }
     };
   }
   cveDetails = osvDetails ?? {
@@ -1510,7 +1906,12 @@ async function runLocalRemediationPipeline(cveId, options = {}) {
       vulnerablePackages,
       results: collectedResults,
       agentSteps,
-      summary: `Local mode lookup succeeded but no npm affected packages were found for ${normalizedId}.`
+      summary: `Local mode lookup succeeded but no npm affected packages were found for ${normalizedId}.`,
+      correlation: {
+        requestId: options.requestId,
+        sessionId: options.sessionId,
+        parentRunId: options.parentRunId
+      }
     };
   }
   const inventory = await checkInventoryTool.execute({ cwd, packageManager });
@@ -1522,7 +1923,12 @@ async function runLocalRemediationPipeline(cveId, options = {}) {
       vulnerablePackages,
       results: collectedResults,
       agentSteps,
-      summary: `Local mode failed at check-inventory: ${inventory.error}`
+      summary: `Local mode failed at check-inventory: ${inventory.error}`,
+      correlation: {
+        requestId: options.requestId,
+        sessionId: options.sessionId,
+        parentRunId: options.parentRunId
+      }
     };
   }
   const installedPackages = inventory.packages ?? [];
@@ -1597,8 +2003,8 @@ async function runLocalRemediationPipeline(cveId, options = {}) {
       fromVersion: pkg.version,
       toVersion: safeVersion,
       dryRun,
-      policyPath,
-      skipTests
+      policy,
+      runTests
     });
     agentSteps += 1;
     collectedResults.push(applyResult);
@@ -1612,18 +2018,23 @@ async function runLocalRemediationPipeline(cveId, options = {}) {
     vulnerablePackages,
     results: collectedResults,
     agentSteps,
-    summary: `Local mode completed: vulnerable=${vulnerablePackages.length}, applied=${appliedCount}, dryRun=${dryRunCount}, unresolved=${unresolvedCount}`
+    summary: `Local mode completed: vulnerable=${vulnerablePackages.length}, applied=${appliedCount}, dryRun=${dryRunCount}, unresolved=${unresolvedCount}`,
+    correlation: {
+      requestId: options.requestId,
+      sessionId: options.sessionId,
+      parentRunId: options.parentRunId
+    }
   };
 }
 function loadOrchestrationPrompt(ctx) {
-  const promptPath = join7(process.cwd(), ".github", "instructions", "orchestration.instructions.md");
+  const promptPath = join8(process.cwd(), ".github", "instructions", "orchestration.instructions.md");
   if (!existsSync4(promptPath)) {
     return `You are autoremediator, an agentic security remediation system for Node.js package dependencies.
 Working directory: ${ctx.cwd}
   Package manager: ${ctx.packageManager}
 Dry run: ${ctx.dryRun}
-Skip tests: ${ctx.skipTests}
-Policy path: ${ctx.policyPath || "undefined"}
+Run tests: ${ctx.runTests}
+Policy: ${ctx.policy || "undefined"}
 Patches dir: ${ctx.patchesDir}
 
 Required sequence:
@@ -1641,7 +2052,7 @@ Fallback sequence (when strategy="none"):
 Always respect dryRun and policy constraints.`;
   }
   const template = readFileSync4(promptPath, "utf8");
-  return template.replaceAll("{{cveId}}", ctx.cveId).replaceAll("{{cwd}}", ctx.cwd).replaceAll("{{packageManager}}", ctx.packageManager).replaceAll("{{dryRun}}", String(ctx.dryRun)).replaceAll("{{skipTests}}", String(ctx.skipTests)).replaceAll("{{policyPath}}", ctx.policyPath || "undefined").replaceAll("{{patchesDir}}", ctx.patchesDir);
+  return template.replaceAll("{{cveId}}", ctx.cveId).replaceAll("{{cwd}}", ctx.cwd).replaceAll("{{packageManager}}", ctx.packageManager).replaceAll("{{dryRun}}", String(ctx.dryRun)).replaceAll("{{runTests}}", String(ctx.runTests)).replaceAll("{{policy}}", ctx.policy || "undefined").replaceAll("{{patchesDir}}", ctx.patchesDir);
 }
 
 // src/scanner/index.ts
@@ -1810,10 +2221,16 @@ function uniqueCveIds(findings) {
 
 // src/platform/evidence.ts
 import { mkdirSync, writeFileSync as writeFileSync2 } from "fs";
-import { join as join8 } from "path";
-function createEvidenceLog(cwd, cveIds) {
+import { join as join9 } from "path";
+function createEvidenceLog(cwd, cveIds, context = {}) {
   return {
-    runId: `${Date.now()}`,
+    runId: `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`,
+    requestId: context.requestId,
+    sessionId: context.sessionId,
+    parentRunId: context.parentRunId,
+    actor: context.actor,
+    source: context.source,
+    idempotencyKey: context.idempotencyKey,
     cveIds,
     cwd,
     startedAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -1834,21 +2251,163 @@ function finalizeEvidence(log) {
   return log;
 }
 function writeEvidenceLog(cwd, log) {
-  const dir = join8(cwd, ".autoremediator", "evidence");
+  const dir = join9(cwd, ".autoremediator", "evidence");
   mkdirSync(dir, { recursive: true });
-  const filePath = join8(dir, `${log.runId}.json`);
+  const filePath = join9(dir, `${log.runId}.json`);
   writeFileSync2(filePath, JSON.stringify(log, null, 2) + "\n", "utf8");
   return filePath;
 }
 
+// src/platform/idempotency.ts
+import { existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync9, writeFileSync as writeFileSync3 } from "fs";
+import { join as join10 } from "path";
+var DEFAULT_INDEX = {
+  schemaVersion: "1.0",
+  entries: {}
+};
+function indexFilePath(cwd) {
+  return join10(cwd, ".autoremediator", "state", "idempotency.json");
+}
+function entryKey(idempotencyKey, cveId) {
+  return `${idempotencyKey}::${cveId.toUpperCase()}`;
+}
+function loadIndex(cwd) {
+  const filePath = indexFilePath(cwd);
+  if (!existsSync5(filePath)) return DEFAULT_INDEX;
+  try {
+    const parsed = JSON.parse(readFileSync9(filePath, "utf8"));
+    if (parsed && parsed.schemaVersion === "1.0" && parsed.entries) {
+      return parsed;
+    }
+    return DEFAULT_INDEX;
+  } catch {
+    return DEFAULT_INDEX;
+  }
+}
+function saveIndex(cwd, index) {
+  const filePath = indexFilePath(cwd);
+  mkdirSync2(join10(cwd, ".autoremediator", "state"), { recursive: true });
+  writeFileSync3(filePath, JSON.stringify(index, null, 2) + "\n", "utf8");
+}
+function readIdempotentReport(cwd, idempotencyKey, cveId) {
+  const index = loadIndex(cwd);
+  const key = entryKey(idempotencyKey, cveId);
+  return index.entries[key]?.report;
+}
+function storeIdempotentReport(cwd, idempotencyKey, cveId, report) {
+  const index = loadIndex(cwd);
+  const key = entryKey(idempotencyKey, cveId);
+  index.entries[key] = {
+    key: idempotencyKey,
+    cveId: cveId.toUpperCase(),
+    report,
+    savedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  saveIndex(cwd, index);
+}
+
 // src/api.ts
+function buildRequestId() {
+  return `req-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+}
+function resolveCorrelationContext(options) {
+  return {
+    requestId: options.requestId ?? buildRequestId(),
+    sessionId: options.sessionId,
+    parentRunId: options.parentRunId
+  };
+}
+function resolveProvenanceContext(options) {
+  return {
+    actor: options.actor,
+    source: options.source ?? "sdk"
+  };
+}
+function resolveConstraints(options, cwd) {
+  const policy = loadPolicy(cwd, options.policy);
+  return {
+    directDependenciesOnly: options.constraints?.directDependenciesOnly ?? policy.constraints?.directDependenciesOnly ?? false,
+    preferVersionBump: options.constraints?.preferVersionBump ?? policy.constraints?.preferVersionBump ?? false
+  };
+}
+function enforceConstraints(report, constraints) {
+  const indirectPackages = new Set(
+    report.vulnerablePackages.filter((vp) => vp.installed.type === "indirect").map((vp) => vp.installed.name)
+  );
+  const nextResults = report.results.map((result) => {
+    if (constraints.directDependenciesOnly && indirectPackages.has(result.packageName)) {
+      return {
+        ...result,
+        strategy: "none",
+        applied: false,
+        message: `Constraint blocked remediation for indirect dependency "${result.packageName}".`
+      };
+    }
+    if (constraints.preferVersionBump && result.strategy === "patch-file") {
+      return {
+        ...result,
+        strategy: "none",
+        applied: false,
+        message: `Constraint prefers version-bump and rejected patch-file remediation for "${result.packageName}".`
+      };
+    }
+    return result;
+  });
+  return {
+    ...report,
+    results: nextResults,
+    constraints
+  };
+}
 async function remediate(cveId, options = {}) {
   if (!/^CVE-\d{4}-\d+$/i.test(cveId)) {
     throw new Error(
       `Invalid CVE ID: "${cveId}". Expected format: CVE-YYYY-NNNNN (e.g. CVE-2021-23337).`
     );
   }
-  return runRemediationPipeline(cveId.toUpperCase(), options);
+  const cwd = options.cwd ?? process.cwd();
+  const constraints = resolveConstraints(options, cwd);
+  const provenance = resolveProvenanceContext(options);
+  const correlation = resolveCorrelationContext(options);
+  if (options.resume && options.idempotencyKey) {
+    const cached = readIdempotentReport(cwd, options.idempotencyKey, cveId.toUpperCase());
+    if (cached) {
+      return {
+        ...cached,
+        summary: `${cached.summary} (resumed from idempotency cache)`,
+        correlation,
+        provenance,
+        constraints,
+        resumedFromCache: true
+      };
+    }
+  }
+  const report = await runRemediationPipeline(cveId.toUpperCase(), {
+    ...options,
+    ...correlation,
+    constraints
+  });
+  const constrainedReport = enforceConstraints(report, constraints);
+  const finalReport = {
+    ...constrainedReport,
+    correlation,
+    provenance,
+    constraints,
+    resumedFromCache: false
+  };
+  if (options.idempotencyKey && !options.dryRun && !options.preview) {
+    storeIdempotentReport(cwd, options.idempotencyKey, cveId.toUpperCase(), finalReport);
+  }
+  return {
+    ...finalReport
+  };
+}
+async function planRemediation(cveId, options = {}) {
+  return remediate(cveId, {
+    ...options,
+    preview: true,
+    dryRun: true
+  });
 }
 async function remediateFromScan(inputPath, options = {}) {
   const cwd = options.cwd ?? process.cwd();
@@ -1856,24 +2415,36 @@ async function remediateFromScan(inputPath, options = {}) {
   const patchesDir = options.patchesDir ?? "./patches";
   const findings = parseScanInput(inputPath, format);
   const cveIds = uniqueCveIds(findings);
-  const policy = loadPolicy(cwd, options.policyPath);
-  const evidence = createEvidenceLog(cwd, cveIds);
+  const policy = loadPolicy(cwd, options.policy);
+  const correlation = resolveCorrelationContext(options);
+  const provenance = resolveProvenanceContext(options);
+  const constraints = resolveConstraints(options, cwd);
+  const evidence = createEvidenceLog(cwd, cveIds, {
+    ...correlation,
+    actor: provenance.actor,
+    source: provenance.source,
+    idempotencyKey: options.idempotencyKey
+  });
   addEvidenceStep(evidence, "scan.parse", { inputPath, format }, { findingCount: findings.length, cveCount: cveIds.length });
   const reports = [];
   const errors = [];
   const patchValidationFailures = [];
-  let patchFileCount = 0;
+  let patchCount = 0;
   for (const cveId of cveIds) {
     try {
       addEvidenceStep(evidence, "remediate.start", { cveId });
       const report = await remediate(cveId, {
         ...options,
-        patchesDir
+        patchesDir,
+        ...correlation,
+        actor: provenance.actor,
+        source: provenance.source,
+        constraints
       });
       report.results = report.results.filter((r) => isPackageAllowed(policy, r.packageName));
       for (const result of report.results) {
         if (result.strategy === "patch-file") {
-          patchFileCount += 1;
+          patchCount += 1;
         }
         if (result.validation?.passed === false && result.validation?.error) {
           patchValidationFailures.push({
@@ -1910,7 +2481,7 @@ async function remediateFromScan(inputPath, options = {}) {
     status = "failed";
   }
   finalizeEvidence(evidence);
-  const evidenceFile = options.writeEvidence === false ? void 0 : writeEvidenceLog(cwd, evidence);
+  const evidenceFile = options.evidence === false ? void 0 : writeEvidenceLog(cwd, evidence);
   return {
     schemaVersion: "1.0",
     status,
@@ -1921,9 +2492,13 @@ async function remediateFromScan(inputPath, options = {}) {
     failedCount,
     errors,
     evidenceFile,
-    patchFileCount,
+    patchCount,
     patchValidationFailures: patchValidationFailures.length > 0 ? patchValidationFailures : void 0,
-    patchStorageDir: patchFileCount > 0 ? patchesDir : void 0
+    patchesDir: patchCount > 0 ? patchesDir : void 0,
+    correlation,
+    provenance,
+    constraints,
+    idempotencyKey: options.idempotencyKey
   };
 }
 function toCiSummary(report) {
@@ -1941,9 +2516,13 @@ function toCiSummary(report) {
     failedCount: report.failedCount,
     errors: report.errors,
     evidenceFile: report.evidenceFile,
-    patchFileCount: report.patchFileCount || 0,
+    patchCount: report.patchCount || 0,
     patchValidationFailures: report.patchValidationFailures,
-    patchStorageDir: report.patchStorageDir
+    patchesDir: report.patchesDir,
+    correlation: report.correlation,
+    provenance: report.provenance,
+    constraints: report.constraints,
+    idempotencyKey: report.idempotencyKey
   };
 }
 function ciExitCode(summary) {
@@ -1953,8 +2532,9 @@ function ciExitCode(summary) {
 export {
   runRemediationPipeline,
   remediate,
+  planRemediation,
   remediateFromScan,
   toCiSummary,
   ciExitCode
 };
-//# sourceMappingURL=chunk-DQKT2CUG.js.map
+//# sourceMappingURL=chunk-GBOD3DV6.js.map