autoremediator 0.2.2 → 0.4.0

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/cli.ts"],"sourcesContent":["#!/usr/bin/env node\n\nimport { Command } from \"commander\";\nimport { ciExitCode, remediate, remediateFromScan, toCiSummary } from \"./api.js\";\nimport { existsSync, writeFileSync } from \"node:fs\";\n\ntype ScanFormat = \"auto\" | \"npm-audit\" | \"yarn-audit\" | \"sarif\";\n\ninterface CommandOptions {\n  cwd: string;\n  packageManager?: \"npm\" | \"pnpm\" | \"yarn\";\n  dryRun: boolean;\n  runTests: boolean;\n  json: boolean;\n  llmProvider?: \"openai\" | \"anthropic\" | \"local\";\n  input?: string;\n  format: ScanFormat;\n  policy?: string;\n  evidence: boolean;\n  ci: boolean;\n  summaryFile?: string;\n}\n\nfunction logJson(value: unknown): void {\n  process.stdout.write(`${JSON.stringify(value, null, 2)}\\n`);\n}\n\nfunction isCveId(value: string): boolean {\n  return /^CVE-\\d{4}-\\d+$/i.test(value);\n}\n\nasync function runSingleCve(cveId: string, opts: CommandOptions): Promise<void> {\n  const report = await remediate(cveId, {\n    cwd: opts.cwd,\n    packageManager: opts.packageManager,\n    dryRun: opts.dryRun,\n    skipTests: !opts.runTests,\n    policyPath: opts.policy,\n    llmProvider: opts.llmProvider,\n  });\n\n  if (opts.json) {\n    logJson(report);\n    return;\n  }\n\n  process.stdout.write(`${report.summary}\\n`);\n  process.stdout.write(`Results: ${report.results.length}\\n`);\n}\n\nasync function runScanInput(inputPath: string, opts: CommandOptions): Promise<void> {\n  const report = await remediateFromScan(inputPath, {\n    cwd: opts.cwd,\n    packageManager: opts.packageManager,\n    format: opts.format,\n    policyPath: opts.policy,\n    dryRun: opts.dryRun,\n    skipTests: !opts.runTests,\n    llmProvider: opts.llmProvider,\n    writeEvidence: opts.evidence,\n  });\n\n  if (opts.summaryFile) {\n    const summary = toCiSummary(report);\n    writeFileSync(opts.summaryFile, JSON.stringify(summary, null, 2) + \"\\n\", \"utf8\");\n  }\n\n  if (opts.json) {\n    logJson(report);\n    if (opts.ci) {\n      process.exitCode = ciExitCode(toCiSummary(report));\n    }\n    return;\n  }\n\n  process.stdout.write(`CVEs found: ${report.cveIds.length}\\n`);\n  process.stdout.write(`Remediation reports: ${report.reports.length}\\n`);\n  process.stdout.write(`Successful remediations: ${report.successCount}\\n`);\n  process.stdout.write(`Failed remediations: ${report.failedCount}\\n`);\n  if (report.evidenceFile) {\n    process.stdout.write(`Evidence: ${report.evidenceFile}\\n`);\n  }\n\n  if (report.errors.length > 0) {\n    for (const error of report.errors) {\n      process.stdout.write(`Error ${error.cveId}: ${error.message}\\n`);\n    }\n  }\n\n  if (opts.ci) {\n    process.exitCode = ciExitCode(toCiSummary(report));\n  }\n}\n\nasync function main(): Promise<void> {\n  const program = new Command();\n\n  program\n    .name(\"autoremediator\")\n    .description(\"Scanner-first Node.js vulnerability auto-remediation tool\")\n    .version(\"0.1.2\")\n    .showHelpAfterError();\n\n  program\n    .command(\"cve\")\n    .description(\"Remediate a single CVE ID\")\n    .argument(\"<cveId>\", \"CVE ID, e.g. CVE-2021-23337\")\n    .option(\"--cwd <path>\", \"Target project directory\", process.cwd())\n    .option(\"--package-manager <name>\", \"Package manager: npm|pnpm|yarn\")\n    .option(\"--dry-run\", \"Plan changes only without mutating files\", false)\n    .option(\"--run-tests\", \"Run package-manager test validation after apply\", false)\n    .option(\"--llm-provider <provider>\", \"LLM provider: openai|anthropic|local\")\n    .option(\"--json\", \"Print JSON output\", false)\n    .action(async (cveId: string, opts: CommandOptions) => {\n      await runSingleCve(cveId, opts);\n    });\n\n  program\n    .command(\"scan\")\n    .description(\"Remediate vulnerabilities from scanner output (npm/pnpm/yarn audit JSON or SARIF)\")\n    .requiredOption(\"--input <path>\", \"Path to scanner output file\")\n    .option(\"--format <type>\", \"Input format: auto|npm-audit|yarn-audit|sarif\", \"auto\")\n    .option(\"--cwd <path>\", \"Target project directory\", process.cwd())\n    .option(\"--package-manager <name>\", \"Package manager: npm|pnpm|yarn\")\n    .option(\"--policy <path>\", \"Path to policy file (.autoremediator.json)\")\n    .option(\"--dry-run\", \"Plan changes only without mutating files\", false)\n    .option(\"--run-tests\", \"Run package-manager test validation after apply\", false)\n    .option(\"--llm-provider <provider>\", \"LLM provider: openai|anthropic|local\")\n    .option(\"--no-evidence\", \"Disable evidence file output\")\n    .option(\"--ci\", \"Enable CI behavior (non-zero exit on failed remediations)\", false)\n    .option(\"--summary-file <path>\", \"Write machine-readable scan summary JSON to path\")\n    .option(\"--json\", \"Print JSON output\", false)\n    .action(async (opts: CommandOptions) => {\n      await runScanInput(opts.input!, opts);\n    });\n\n  // Scanner-first top-level mode (default):\n  //   autoremediator --input audit.json\n  //   autoremediator audit.json\n  program\n    .argument(\"[target]\", \"Scanner output file path (or CVE ID fallback)\")\n    .option(\"--cwd <path>\", \"Target project directory\", process.cwd())\n    .option(\"--package-manager <name>\", \"Package manager: npm|pnpm|yarn\")\n    .option(\"--dry-run\", \"Plan changes only without mutating files\", false)\n    .option(\"--run-tests\", \"Run package-manager test validation after apply\", false)\n    .option(\"--llm-provider <provider>\", \"LLM provider: openai|anthropic|local\")\n    .option(\"--input <path>\", \"Path to scanner output file (scanner-first mode)\")\n    .option(\"--format <type>\", \"Input format: auto|npm-audit|yarn-audit|sarif\", \"auto\")\n    .option(\"--policy <path>\", \"Path to policy file (.autoremediator.json)\")\n    .option(\"--no-evidence\", \"Disable evidence file output\")\n    .option(\"--ci\", \"Enable CI behavior (non-zero exit on failed remediations)\", false)\n    .option(\"--summary-file <path>\", \"Write machine-readable scan summary JSON to path\")\n    .option(\"--json\", \"Print JSON output\", false)\n    .action(async (target: string | undefined, opts: CommandOptions) => {\n      if (opts.input) {\n        await runScanInput(opts.input, opts);\n        return;\n      }\n\n      if (!target) {\n        program.outputHelp();\n        return;\n      }\n\n      if (isCveId(target)) {\n        await runSingleCve(target, opts);\n        return;\n      }\n\n      if (existsSync(target)) {\n        await runScanInput(target, opts);\n        return;\n      }\n\n      throw new Error(\n        `Target \"${target}\" is neither a valid CVE ID nor an existing scan file path.`\n      );\n    });\n\n  await program.parseAsync(process.argv);\n}\n\nmain().catch((error) => {\n  const message = error instanceof Error ? error.message : String(error);\n  process.stderr.write(`[autoremediator] ${message}\\n`);\n  process.exit(1);\n});\n"],"mappings":";;;;;;;;;AAEA,SAAS,eAAe;AAExB,SAAS,YAAY,qBAAqB;AAmB1C,SAAS,QAAQ,OAAsB;AACrC,UAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA,CAAI;AAC5D;AAEA,SAAS,QAAQ,OAAwB;AACvC,SAAO,mBAAmB,KAAK,KAAK;AACtC;AAEA,eAAe,aAAa,OAAe,MAAqC;AAC9E,QAAM,SAAS,MAAM,UAAU,OAAO;AAAA,IACpC,KAAK,KAAK;AAAA,IACV,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK;AAAA,IACb,WAAW,CAAC,KAAK;AAAA,IACjB,YAAY,KAAK;AAAA,IACjB,aAAa,KAAK;AAAA,EACpB,CAAC;AAED,MAAI,KAAK,MAAM;AACb,YAAQ,MAAM;AACd;AAAA,EACF;AAEA,UAAQ,OAAO,MAAM,GAAG,OAAO,OAAO;AAAA,CAAI;AAC1C,UAAQ,OAAO,MAAM,YAAY,OAAO,QAAQ,MAAM;AAAA,CAAI;AAC5D;AAEA,eAAe,aAAa,WAAmB,MAAqC;AAClF,QAAM,SAAS,MAAM,kBAAkB,WAAW;AAAA,IAChD,KAAK,KAAK;AAAA,IACV,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK;AAAA,IACb,YAAY,KAAK;AAAA,IACjB,QAAQ,KAAK;AAAA,IACb,WAAW,CAAC,KAAK;AAAA,IACjB,aAAa,KAAK;AAAA,IAClB,eAAe,KAAK;AAAA,EACtB,CAAC;AAED,MAAI,KAAK,aAAa;AACpB,UAAM,UAAU,YAAY,MAAM;AAClC,kBAAc,KAAK,aAAa,KAAK,UAAU,SAAS,MAAM,CAAC,IAAI,MAAM,MAAM;AAAA,EACjF;AAEA,MAAI,KAAK,MAAM;AACb,YAAQ,MAAM;AACd,QAAI,KAAK,IAAI;AACX,cAAQ,WAAW,WAAW,YAAY,MAAM,CAAC;AAAA,IACnD;AACA;AAAA,EACF;AAEA,UAAQ,OAAO,MAAM,eAAe,OAAO,OAAO,MAAM;AAAA,CAAI;AAC5D,UAAQ,OAAO,MAAM,wBAAwB,OAAO,QAAQ,MAAM;AAAA,CAAI;AACtE,UAAQ,OAAO,MAAM,4BAA4B,OAAO,YAAY;AAAA,CAAI;AACxE,UAAQ,OAAO,MAAM,wBAAwB,OAAO,WAAW;AAAA,CAAI;AACnE,MAAI,OAAO,cAAc;AACvB,YAAQ,OAAO,MAAM,aAAa,OAAO,YAAY;AAAA,CAAI;AAAA,EAC3D;AAEA,MAAI,OAAO,OAAO,SAAS,GAAG;AAC5B,eAAW,SAAS,OAAO,QAAQ;AACjC,cAAQ,OAAO,MAAM,SAAS,MAAM,KAAK,KAAK,MAAM,OAAO;AAAA,CAAI;AAAA,IACjE;AAAA,EACF;AAEA,MAAI,KAAK,IAAI;AACX,YAAQ,WAAW,WAAW,YAAY,MAAM,CAAC;AAAA,EACnD;AACF;AAEA,eAAe,OAAsB;AACnC,QAAM,UAAU,IAAI,QAAQ;AAE5B,UACG,KAAK,gBAAgB,EACrB,YAAY,2DAA2D,EACvE,QAAQ,OAAO,EACf,mBAAmB;AAEtB,UACG,QAAQ,KAAK,EACb,YAAY,2BAA2B,EACvC,SAAS,WAAW,6BAA6B,EACjD,OAAO,gBAAgB,4BAA4B,QAAQ,IAAI,CAAC,EAChE,OAAO,4BAA4B,gCAAgC,EACnE,OAAO,aAAa,4CAA4C,KAAK,EACrE,OAAO,eAAe,mDAAmD,KAAK,EAC9E,OAAO,6BAA6B,sCAAsC,EAC1E,OAAO,UAAU,qBAAqB,KAAK,EAC3C,OAAO,OAAO,OAAe,SAAyB;AACrD,UAAM,aAAa,OAAO,IAAI;AAAA,EAChC,CAAC;AAEH,UACG,QAAQ,MAAM,EACd,YAAY,mFAAmF,EAC/F,eAAe,kBAAkB,6BAA6B,EAC9D,OAAO,mBAAmB,iDAAiD,MAAM,EACjF,OAAO,gBAAgB,4BAA4B,QAAQ,IAAI,CAAC,EAChE,OAAO,4BAA4B,gCAAgC,EACnE,OAAO,mBAAmB,4CAA4C,EACtE,OAAO,aAAa,4CAA4C,KAAK,EACrE,OAAO,eAAe,mDAAmD,KAAK,EAC9E,OAAO,6BAA6B,sCAAsC,EAC1E,OAAO,iBAAiB,8BAA8B,EACtD,OAAO,QAAQ,6DAA6D,KAAK,EACjF,OAAO,yBAAyB,kDAAkD,EAClF,OAAO,UAAU,qBAAqB,KAAK,EAC3C,OAAO,OAAO,SAAyB;AACtC,UAAM,aAAa,KAAK,OAAQ,IAAI;AAAA,EACtC,CAAC;AAKH,UACG,SAAS,YAAY,+CAA+C,EACpE,OAAO,gBAAgB,4BAA4B,QAAQ,IAAI,CAAC,EAChE,OAAO,4BAA4B,gCAAgC,EACnE,OAAO,aAAa,4CAA4C,KAAK,EACrE,OAAO,eAAe,mDAAmD,KAAK,EAC9E,OAAO,6BAA6B,sCAAsC,EAC1E,OAAO,kBAAkB,kDAAkD,EAC3E,OAAO,mBAAmB,iDAAiD,MAAM,EACjF,OAAO,mBAAmB,4CAA4C,EACtE,OAAO,iBAAiB,8BAA8B,EACtD,OAAO,QAAQ,6DAA6D,KAAK,EACjF,OAAO,yBAAyB,kDAAkD,EAClF,OAAO,UAAU,qBAAqB,KAAK,EAC3C,OAAO,OAAO,QAA4B,SAAyB;AAClE,QAAI,KAAK,OAAO;AACd,YAAM,aAAa,KAAK,OAAO,IAAI;AACnC;AAAA,IACF;AAEA,QAAI,CAAC,QAAQ;AACX,cAAQ,WAAW;AACnB;AAAA,IACF;AAEA,QAAI,QAAQ,MAAM,GAAG;AACnB,YAAM,aAAa,QAAQ,IAAI;AAC/B;AAAA,IACF;AAEA,QAAI,WAAW,MAAM,GAAG;AACtB,YAAM,aAAa,QAAQ,IAAI;AAC/B;AAAA,IACF;AAEA,UAAM,IAAI;AAAA,MACR,WAAW,MAAM;AAAA,IACnB;AAAA,EACF,CAAC;AAEH,QAAM,QAAQ,WAAW,QAAQ,IAAI;AACvC;AAEA,KAAK,EAAE,MAAM,CAAC,UAAU;AACtB,QAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,UAAQ,OAAO,MAAM,oBAAoB,OAAO;AAAA,CAAI;AACpD,UAAQ,KAAK,CAAC;AAChB,CAAC;","names":[]}
+{"version":3,"sources":["../src/cli.ts"],"sourcesContent":["#!/usr/bin/env node\n\nimport { Command } from \"commander\";\nimport { ciExitCode, remediate, remediateFromScan, toCiSummary } from \"./api.js\";\nimport { existsSync, writeFileSync } from \"node:fs\";\nimport { fileURLToPath } from \"node:url\";\n\ntype ScanFormat = \"auto\" | \"npm-audit\" | \"yarn-audit\" | \"sarif\";\n\ninterface CommandOptions {\n  cwd: string;\n  packageManager?: \"npm\" | \"pnpm\" | \"yarn\";\n  dryRun: boolean;\n  preview: boolean;\n  runTests: boolean;\n  json: boolean;\n  llmProvider?: \"openai\" | \"anthropic\" | \"local\";\n  requestId?: string;\n  sessionId?: string;\n  parentRunId?: string;\n  idempotencyKey?: string;\n  resume: boolean;\n  actor?: string;\n  source?: \"cli\" | \"sdk\" | \"mcp\" | \"openapi\" | \"unknown\";\n  directDependenciesOnly: boolean;\n  preferVersionBump: boolean;\n  input?: string;\n  format: ScanFormat;\n  policy?: string;\n  evidence: boolean;\n  ci: boolean;\n  summaryFile?: string;\n}\n\nfunction logJson(value: unknown): void {\n  process.stdout.write(`${JSON.stringify(value, null, 2)}\\n`);\n}\n\nfunction isCveId(value: string): boolean {\n  return /^CVE-\\d{4}-\\d+$/i.test(value);\n}\n\nasync function runSingleCve(cveId: string, opts: CommandOptions): Promise<void> {\n  const report = await remediate(cveId, {\n    cwd: opts.cwd,\n    packageManager: opts.packageManager,\n    dryRun: opts.dryRun,\n    preview: opts.preview,\n    runTests: opts.runTests,\n    policy: opts.policy,\n    llmProvider: opts.llmProvider,\n    requestId: opts.requestId,\n    sessionId: opts.sessionId,\n    parentRunId: opts.parentRunId,\n    idempotencyKey: opts.idempotencyKey,\n    resume: opts.resume,\n    actor: opts.actor,\n    source: opts.source ?? \"cli\",\n    constraints: {\n      directDependenciesOnly: opts.directDependenciesOnly,\n      preferVersionBump: opts.preferVersionBump,\n    },\n  });\n\n  if (opts.json) {\n    logJson(report);\n    return;\n  }\n\n  process.stdout.write(`${report.summary}\\n`);\n  process.stdout.write(`Results: ${report.results.length}\\n`);\n}\n\nasync function runScanInput(inputPath: string, opts: CommandOptions): Promise<void> {\n  const report = await remediateFromScan(inputPath, {\n    cwd: opts.cwd,\n    packageManager: opts.packageManager,\n    format: opts.format,\n    policy: opts.policy,\n    dryRun: opts.dryRun,\n    preview: opts.preview,\n    runTests: opts.runTests,\n    llmProvider: opts.llmProvider,\n    evidence: opts.evidence,\n    requestId: opts.requestId,\n    sessionId: opts.sessionId,\n    parentRunId: opts.parentRunId,\n    idempotencyKey: opts.idempotencyKey,\n    resume: opts.resume,\n    actor: opts.actor,\n    source: opts.source ?? \"cli\",\n    constraints: {\n      directDependenciesOnly: opts.directDependenciesOnly,\n      preferVersionBump: opts.preferVersionBump,\n    },\n  });\n\n  if (opts.summaryFile) {\n    const summary = toCiSummary(report);\n    writeFileSync(opts.summaryFile, JSON.stringify(summary, null, 2) + \"\\n\", \"utf8\");\n  }\n\n  if (opts.json) {\n    logJson(report);\n    if (opts.ci) {\n      process.exitCode = ciExitCode(toCiSummary(report));\n    }\n    return;\n  }\n\n  process.stdout.write(`CVEs found: ${report.cveIds.length}\\n`);\n  process.stdout.write(`Remediation reports: ${report.reports.length}\\n`);\n  process.stdout.write(`Successful remediations: ${report.successCount}\\n`);\n  process.stdout.write(`Failed remediations: ${report.failedCount}\\n`);\n  if (report.evidenceFile) {\n    process.stdout.write(`Evidence: ${report.evidenceFile}\\n`);\n  }\n\n  if (report.errors.length > 0) {\n    for (const error of report.errors) {\n      process.stdout.write(`Error ${error.cveId}: ${error.message}\\n`);\n    }\n  }\n\n  if (opts.ci) {\n    process.exitCode = ciExitCode(toCiSummary(report));\n  }\n}\n\nexport function createProgram(): Command {\n  const program = new Command();\n\n  program\n    .name(\"autoremediator\")\n    .description(\"Scanner-first Node.js vulnerability auto-remediation tool\")\n    .version(\"0.1.2\")\n    .showHelpAfterError();\n\n  program\n    .command(\"cve\")\n    .description(\"Remediate a single CVE ID\")\n    .argument(\"<cveId>\", \"CVE ID, e.g. CVE-2021-23337\")\n    .option(\"--cwd <path>\", \"Target project directory\", process.cwd())\n    .option(\"--package-manager <name>\", \"Package manager: npm|pnpm|yarn\")\n    .option(\"--dry-run\", \"Plan changes only without mutating files\", false)\n    .option(\"--preview\", \"Run non-mutating remediation preview mode\", false)\n    .option(\"--run-tests\", \"Run package-manager test validation after apply\", false)\n    .option(\"--llm-provider <provider>\", \"LLM provider: openai|anthropic|local\")\n    .option(\"--request-id <id>\", \"Request correlation ID\")\n    .option(\"--session-id <id>\", \"Session correlation ID\")\n    .option(\"--parent-run-id <id>\", \"Parent run correlation ID\")\n    .option(\"--idempotency-key <key>\", \"Idempotency key for replay-safe execution\")\n    .option(\"--resume\", \"Resume by returning cached result for matching idempotency key\", false)\n    .option(\"--actor <name>\", \"Actor identity for evidence provenance\")\n    .option(\"--source <src>\", \"Source system: cli|sdk|mcp|openapi|unknown\")\n    .option(\"--direct-dependencies-only\", \"Enforce direct-dependency-only remediation constraint\", false)\n    .option(\"--prefer-version-bump\", \"Reject patch-file outcomes when version-bump is preferred\", false)\n    .option(\"--json\", \"Print JSON output\", false)\n    .action(async (cveId: string, opts: CommandOptions) => {\n      await runSingleCve(cveId, opts);\n    });\n\n  program\n    .command(\"scan\")\n    .description(\"Remediate vulnerabilities from scanner output (npm/pnpm/yarn audit JSON or SARIF)\")\n    .requiredOption(\"--input <path>\", \"Path to scanner output file\")\n    .option(\"--format <type>\", \"Input format: auto|npm-audit|yarn-audit|sarif\", \"auto\")\n    .option(\"--cwd <path>\", \"Target project directory\", process.cwd())\n    .option(\"--package-manager <name>\", \"Package manager: npm|pnpm|yarn\")\n    .option(\"--policy <path>\", \"Path to policy file (.autoremediator.json)\")\n    .option(\"--dry-run\", \"Plan changes only without mutating files\", false)\n    .option(\"--preview\", \"Run non-mutating remediation preview mode\", false)\n    .option(\"--run-tests\", \"Run package-manager test validation after apply\", false)\n    .option(\"--llm-provider <provider>\", \"LLM provider: openai|anthropic|local\")\n    .option(\"--request-id <id>\", \"Request correlation ID\")\n    .option(\"--session-id <id>\", \"Session correlation ID\")\n    .option(\"--parent-run-id <id>\", \"Parent run correlation ID\")\n    .option(\"--idempotency-key <key>\", \"Idempotency key for replay-safe execution\")\n    .option(\"--resume\", \"Resume by returning cached result for matching idempotency key\", false)\n    .option(\"--actor <name>\", \"Actor identity for evidence provenance\")\n    .option(\"--source <src>\", \"Source system: cli|sdk|mcp|openapi|unknown\")\n    .option(\"--direct-dependencies-only\", \"Enforce direct-dependency-only remediation constraint\", false)\n    .option(\"--prefer-version-bump\", \"Reject patch-file outcomes when version-bump is preferred\", false)\n    .option(\"--evidence\", \"Enable evidence file output\", true)\n    .option(\"--no-evidence\", \"Disable evidence file output\")\n    .option(\"--ci\", \"Enable CI behavior (non-zero exit on failed remediations)\", false)\n    .option(\"--summary-file <path>\", \"Write machine-readable scan summary JSON to path\")\n    .option(\"--json\", \"Print JSON output\", false)\n    .action(async (opts: CommandOptions) => {\n      await runScanInput(opts.input!, opts);\n    });\n\n  // Scanner-first top-level mode (default):\n  //   autoremediator --input audit.json\n  //   autoremediator audit.json\n  program\n    .argument(\"[target]\", \"Scanner output file path (or CVE ID fallback)\")\n    .option(\"--cwd <path>\", \"Target project directory\", process.cwd())\n    .option(\"--package-manager <name>\", \"Package manager: npm|pnpm|yarn\")\n    .option(\"--dry-run\", \"Plan changes only without mutating files\", false)\n    .option(\"--preview\", \"Run non-mutating remediation preview mode\", false)\n    .option(\"--run-tests\", \"Run package-manager test validation after apply\", false)\n    .option(\"--llm-provider <provider>\", \"LLM provider: openai|anthropic|local\")\n    .option(\"--request-id <id>\", \"Request correlation ID\")\n    .option(\"--session-id <id>\", \"Session correlation ID\")\n    .option(\"--parent-run-id <id>\", \"Parent run correlation ID\")\n    .option(\"--idempotency-key <key>\", \"Idempotency key for replay-safe execution\")\n    .option(\"--resume\", \"Resume by returning cached result for matching idempotency key\", false)\n    .option(\"--actor <name>\", \"Actor identity for evidence provenance\")\n    .option(\"--source <src>\", \"Source system: cli|sdk|mcp|openapi|unknown\")\n    .option(\"--direct-dependencies-only\", \"Enforce direct-dependency-only remediation constraint\", false)\n    .option(\"--prefer-version-bump\", \"Reject patch-file outcomes when version-bump is preferred\", false)\n    .option(\"--input <path>\", \"Path to scanner output file (scanner-first mode)\")\n    .option(\"--format <type>\", \"Input format: auto|npm-audit|yarn-audit|sarif\", \"auto\")\n    .option(\"--policy <path>\", \"Path to policy file (.autoremediator.json)\")\n    .option(\"--evidence\", \"Enable evidence file output\", true)\n    .option(\"--no-evidence\", \"Disable evidence file output\")\n    .option(\"--ci\", \"Enable CI behavior (non-zero exit on failed remediations)\", false)\n    .option(\"--summary-file <path>\", \"Write machine-readable scan summary JSON to path\")\n    .option(\"--json\", \"Print JSON output\", false)\n    .action(async (target: string | undefined, opts: CommandOptions) => {\n      if (opts.input) {\n        await runScanInput(opts.input, opts);\n        return;\n      }\n\n      if (!target) {\n        program.outputHelp();\n        return;\n      }\n\n      if (isCveId(target)) {\n        await runSingleCve(target, opts);\n        return;\n      }\n\n      if (existsSync(target)) {\n        await runScanInput(target, opts);\n        return;\n      }\n\n      throw new Error(\n        `Target \"${target}\" is neither a valid CVE ID nor an existing scan file path.`\n      );\n    });\n\n  return program;\n}\n\nasync function main(argv = process.argv): Promise<void> {\n  const program = createProgram();\n  await program.parseAsync(argv);\n}\n\nfunction isMainModule(): boolean {\n  if (!process.argv[1]) return false;\n  return fileURLToPath(import.meta.url) === process.argv[1];\n}\n\nif (isMainModule()) {\n  main().catch((error) => {\n    const message = error instanceof Error ? error.message : String(error);\n    process.stderr.write(`[autoremediator] ${message}\\n`);\n    process.exit(1);\n  });\n}\n"],"mappings":";;;;;;;;;AAEA,SAAS,eAAe;AAExB,SAAS,YAAY,qBAAqB;AAC1C,SAAS,qBAAqB;AA6B9B,SAAS,QAAQ,OAAsB;AACrC,UAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA,CAAI;AAC5D;AAEA,SAAS,QAAQ,OAAwB;AACvC,SAAO,mBAAmB,KAAK,KAAK;AACtC;AAEA,eAAe,aAAa,OAAe,MAAqC;AAC9E,QAAM,SAAS,MAAM,UAAU,OAAO;AAAA,IACpC,KAAK,KAAK;AAAA,IACV,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK;AAAA,IACb,SAAS,KAAK;AAAA,IACd,UAAU,KAAK;AAAA,IACf,QAAQ,KAAK;AAAA,IACb,aAAa,KAAK;AAAA,IAClB,WAAW,KAAK;AAAA,IAChB,WAAW,KAAK;AAAA,IAChB,aAAa,KAAK;AAAA,IAClB,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK;AAAA,IACb,OAAO,KAAK;AAAA,IACZ,QAAQ,KAAK,UAAU;AAAA,IACvB,aAAa;AAAA,MACX,wBAAwB,KAAK;AAAA,MAC7B,mBAAmB,KAAK;AAAA,IAC1B;AAAA,EACF,CAAC;AAED,MAAI,KAAK,MAAM;AACb,YAAQ,MAAM;AACd;AAAA,EACF;AAEA,UAAQ,OAAO,MAAM,GAAG,OAAO,OAAO;AAAA,CAAI;AAC1C,UAAQ,OAAO,MAAM,YAAY,OAAO,QAAQ,MAAM;AAAA,CAAI;AAC5D;AAEA,eAAe,aAAa,WAAmB,MAAqC;AAClF,QAAM,SAAS,MAAM,kBAAkB,WAAW;AAAA,IAChD,KAAK,KAAK;AAAA,IACV,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK;AAAA,IACb,QAAQ,KAAK;AAAA,IACb,QAAQ,KAAK;AAAA,IACb,SAAS,KAAK;AAAA,IACd,UAAU,KAAK;AAAA,IACf,aAAa,KAAK;AAAA,IAClB,UAAU,KAAK;AAAA,IACf,WAAW,KAAK;AAAA,IAChB,WAAW,KAAK;AAAA,IAChB,aAAa,KAAK;AAAA,IAClB,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK;AAAA,IACb,OAAO,KAAK;AAAA,IACZ,QAAQ,KAAK,UAAU;AAAA,IACvB,aAAa;AAAA,MACX,wBAAwB,KAAK;AAAA,MAC7B,mBAAmB,KAAK;AAAA,IAC1B;AAAA,EACF,CAAC;AAED,MAAI,KAAK,aAAa;AACpB,UAAM,UAAU,YAAY,MAAM;AAClC,kBAAc,KAAK,aAAa,KAAK,UAAU,SAAS,MAAM,CAAC,IAAI,MAAM,MAAM;AAAA,EACjF;AAEA,MAAI,KAAK,MAAM;AACb,YAAQ,MAAM;AACd,QAAI,KAAK,IAAI;AACX,cAAQ,WAAW,WAAW,YAAY,MAAM,CAAC;AAAA,IACnD;AACA;AAAA,EACF;AAEA,UAAQ,OAAO,MAAM,eAAe,OAAO,OAAO,MAAM;AAAA,CAAI;AAC5D,UAAQ,OAAO,MAAM,wBAAwB,OAAO,QAAQ,MAAM;AAAA,CAAI;AACtE,UAAQ,OAAO,MAAM,4BAA4B,OAAO,YAAY;AAAA,CAAI;AACxE,UAAQ,OAAO,MAAM,wBAAwB,OAAO,WAAW;AAAA,CAAI;AACnE,MAAI,OAAO,cAAc;AACvB,YAAQ,OAAO,MAAM,aAAa,OAAO,YAAY;AAAA,CAAI;AAAA,EAC3D;AAEA,MAAI,OAAO,OAAO,SAAS,GAAG;AAC5B,eAAW,SAAS,OAAO,QAAQ;AACjC,cAAQ,OAAO,MAAM,SAAS,MAAM,KAAK,KAAK,MAAM,OAAO;AAAA,CAAI;AAAA,IACjE;AAAA,EACF;AAEA,MAAI,KAAK,IAAI;AACX,YAAQ,WAAW,WAAW,YAAY,MAAM,CAAC;AAAA,EACnD;AACF;AAEO,SAAS,gBAAyB;AACvC,QAAM,UAAU,IAAI,QAAQ;AAE5B,UACG,KAAK,gBAAgB,EACrB,YAAY,2DAA2D,EACvE,QAAQ,OAAO,EACf,mBAAmB;AAEtB,UACG,QAAQ,KAAK,EACb,YAAY,2BAA2B,EACvC,SAAS,WAAW,6BAA6B,EACjD,OAAO,gBAAgB,4BAA4B,QAAQ,IAAI,CAAC,EAChE,OAAO,4BAA4B,gCAAgC,EACnE,OAAO,aAAa,4CAA4C,KAAK,EACrE,OAAO,aAAa,6CAA6C,KAAK,EACtE,OAAO,eAAe,mDAAmD,KAAK,EAC9E,OAAO,6BAA6B,sCAAsC,EAC1E,OAAO,qBAAqB,wBAAwB,EACpD,OAAO,qBAAqB,wBAAwB,EACpD,OAAO,wBAAwB,2BAA2B,EAC1D,OAAO,2BAA2B,2CAA2C,EAC7E,OAAO,YAAY,kEAAkE,KAAK,EAC1F,OAAO,kBAAkB,wCAAwC,EACjE,OAAO,kBAAkB,4CAA4C,EACrE,OAAO,8BAA8B,yDAAyD,KAAK,EACnG,OAAO,yBAAyB,6DAA6D,KAAK,EAClG,OAAO,UAAU,qBAAqB,KAAK,EAC3C,OAAO,OAAO,OAAe,SAAyB;AACrD,UAAM,aAAa,OAAO,IAAI;AAAA,EAChC,CAAC;AAEH,UACG,QAAQ,MAAM,EACd,YAAY,mFAAmF,EAC/F,eAAe,kBAAkB,6BAA6B,EAC9D,OAAO,mBAAmB,iDAAiD,MAAM,EACjF,OAAO,gBAAgB,4BAA4B,QAAQ,IAAI,CAAC,EAChE,OAAO,4BAA4B,gCAAgC,EACnE,OAAO,mBAAmB,4CAA4C,EACtE,OAAO,aAAa,4CAA4C,KAAK,EACrE,OAAO,aAAa,6CAA6C,KAAK,EACtE,OAAO,eAAe,mDAAmD,KAAK,EAC9E,OAAO,6BAA6B,sCAAsC,EAC1E,OAAO,qBAAqB,wBAAwB,EACpD,OAAO,qBAAqB,wBAAwB,EACpD,OAAO,wBAAwB,2BAA2B,EAC1D,OAAO,2BAA2B,2CAA2C,EAC7E,OAAO,YAAY,kEAAkE,KAAK,EAC1F,OAAO,kBAAkB,wCAAwC,EACjE,OAAO,kBAAkB,4CAA4C,EACrE,OAAO,8BAA8B,yDAAyD,KAAK,EACnG,OAAO,yBAAyB,6DAA6D,KAAK,EAClG,OAAO,cAAc,+BAA+B,IAAI,EACxD,OAAO,iBAAiB,8BAA8B,EACtD,OAAO,QAAQ,6DAA6D,KAAK,EACjF,OAAO,yBAAyB,kDAAkD,EAClF,OAAO,UAAU,qBAAqB,KAAK,EAC3C,OAAO,OAAO,SAAyB;AACtC,UAAM,aAAa,KAAK,OAAQ,IAAI;AAAA,EACtC,CAAC;AAKH,UACG,SAAS,YAAY,+CAA+C,EACpE,OAAO,gBAAgB,4BAA4B,QAAQ,IAAI,CAAC,EAChE,OAAO,4BAA4B,gCAAgC,EACnE,OAAO,aAAa,4CAA4C,KAAK,EACrE,OAAO,aAAa,6CAA6C,KAAK,EACtE,OAAO,eAAe,mDAAmD,KAAK,EAC9E,OAAO,6BAA6B,sCAAsC,EAC1E,OAAO,qBAAqB,wBAAwB,EACpD,OAAO,qBAAqB,wBAAwB,EACpD,OAAO,wBAAwB,2BAA2B,EAC1D,OAAO,2BAA2B,2CAA2C,EAC7E,OAAO,YAAY,kEAAkE,KAAK,EAC1F,OAAO,kBAAkB,wCAAwC,EACjE,OAAO,kBAAkB,4CAA4C,EACrE,OAAO,8BAA8B,yDAAyD,KAAK,EACnG,OAAO,yBAAyB,6DAA6D,KAAK,EAClG,OAAO,kBAAkB,kDAAkD,EAC3E,OAAO,mBAAmB,iDAAiD,MAAM,EACjF,OAAO,mBAAmB,4CAA4C,EACtE,OAAO,cAAc,+BAA+B,IAAI,EACxD,OAAO,iBAAiB,8BAA8B,EACtD,OAAO,QAAQ,6DAA6D,KAAK,EACjF,OAAO,yBAAyB,kDAAkD,EAClF,OAAO,UAAU,qBAAqB,KAAK,EAC3C,OAAO,OAAO,QAA4B,SAAyB;AAClE,QAAI,KAAK,OAAO;AACd,YAAM,aAAa,KAAK,OAAO,IAAI;AACnC;AAAA,IACF;AAEA,QAAI,CAAC,QAAQ;AACX,cAAQ,WAAW;AACnB;AAAA,IACF;AAEA,QAAI,QAAQ,MAAM,GAAG;AACnB,YAAM,aAAa,QAAQ,IAAI;AAC/B;AAAA,IACF;AAEA,QAAI,WAAW,MAAM,GAAG;AACtB,YAAM,aAAa,QAAQ,IAAI;AAC/B;AAAA,IACF;AAEA,UAAM,IAAI;AAAA,MACR,WAAW,MAAM;AAAA,IACnB;AAAA,EACF,CAAC;AAEH,SAAO;AACT;AAEA,eAAe,KAAK,OAAO,QAAQ,MAAqB;AACtD,QAAM,UAAU,cAAc;AAC9B,QAAM,QAAQ,WAAW,IAAI;AAC/B;AAEA,SAAS,eAAwB;AAC/B,MAAI,CAAC,QAAQ,KAAK,CAAC,EAAG,QAAO;AAC7B,SAAO,cAAc,YAAY,GAAG,MAAM,QAAQ,KAAK,CAAC;AAC1D;AAEA,IAAI,aAAa,GAAG;AAClB,OAAK,EAAE,MAAM,CAAC,UAAU;AACtB,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,YAAQ,OAAO,MAAM,oBAAoB,OAAO;AAAA,CAAI;AACpD,YAAQ,KAAK,CAAC;AAAA,EAChB,CAAC;AACH;","names":[]}

package/dist/index.d.ts

@@ -4,6 +4,32 @@ interface CveDetails {
     summary: string;
     severity: "LOW" | "MEDIUM" | "HIGH" | "CRITICAL" | "UNKNOWN";
     cvssScore?: number;
+    epss?: {
+        score: number;
+        percentile: number;
+        date?: string;
+    };
+    kev?: {
+        knownExploited: boolean;
+        dateAdded?: string;
+        dueDate?: string;
+        requiredAction?: string;
+        knownRansomwareCampaignUse?: string;
+    };
+    intelligence?: {
+        cveServicesEnriched?: boolean;
+        gitlabAdvisoryMatched?: boolean;
+        certCcMatched?: boolean;
+        depsDevEnrichedPackages?: number;
+        scorecardProjects?: number;
+        vendorAdvisories?: string[];
+        commercialFeeds?: string[];
+        sourceHealth?: Record<string, {
+            attempted: boolean;
+            changed: boolean;
+            error?: string;
+        }>;
+    };
     references: string[];
     affectedPackages: AffectedPackage[];
 }
@@ -48,24 +74,48 @@ interface PatchResult {
         error?: string;
     };
 }
+interface CorrelationContext {
+    requestId?: string;
+    sessionId?: string;
+    parentRunId?: string;
+}
+interface RemediationConstraints {
+    directDependenciesOnly?: boolean;
+    preferVersionBump?: boolean;
+}
+interface ProvenanceContext {
+    actor?: string;
+    source?: "cli" | "sdk" | "mcp" | "openapi" | "unknown";
+}
 /** Top-level options for the remediate() API and CLI */
-interface RemediateOptions {
+interface RemediateOptions extends CorrelationContext {
     /** Working directory of the consumer's project (defaults to process.cwd()) */
     cwd?: string;
     /** Package manager to use (defaults to auto-detect from lockfile) */
     packageManager?: "npm" | "pnpm" | "yarn";
     /** If true, plan and report changes but do not write anything */
     dryRun?: boolean;
-    /** If true, skip running npm test after patching */
-    skipTests?: boolean;
+    /** If true, run package-manager tests after patching */
+    runTests?: boolean;
     /** Override the LLM provider (falls back to env AUTOREMEDIATOR_LLM_PROVIDER) */
     llmProvider?: "openai" | "anthropic" | "local";
     /** Override the model name */
     model?: string;
     /** Optional path to a policy file (.autoremediator.json) */
-    policyPath?: string;
+    policy?: string;
     /** Directory to write .patch files (default: ./patches) */
     patchesDir?: string;
+    /** If true, run a non-mutating remediation preview (forces dryRun behavior for mutation tools). */
+    preview?: boolean;
+    /** Optional deterministic idempotency key for request replay handling. */
+    idempotencyKey?: string;
+    /** If true, return cached report for matching idempotency key + CVE when available. */
+    resume?: boolean;
+    /** Optional caller provenance fields for evidence and reporting. */
+    actor?: string;
+    source?: "cli" | "sdk" | "mcp" | "openapi" | "unknown";
+    /** Optional orchestration constraints for result enforcement. */
+    constraints?: RemediationConstraints;
 }
 /** Final report returned by the remediation pipeline */
 interface RemediationReport {
@@ -75,6 +125,10 @@ interface RemediationReport {
     results: PatchResult[];
     agentSteps: number;
     summary: string;
+    correlation?: CorrelationContext;
+    provenance?: ProvenanceContext;
+    constraints?: RemediationConstraints;
+    resumedFromCache?: boolean;
 }
 
 type ScanInputFormat = "npm-audit" | "yarn-audit" | "sarif" | "auto";
@@ -83,8 +137,8 @@ declare function runRemediationPipeline(cveId: string, options?: RemediateOption
 
 interface ScanOptions extends RemediateOptions {
     format?: ScanInputFormat;
-    policyPath?: string;
-    writeEvidence?: boolean;
+    policy?: string;
+    evidence?: boolean;
 }
 interface ScanReport {
     schemaVersion: "1.0";
@@ -99,13 +153,17 @@ interface ScanReport {
         message: string;
     }>;
     evidenceFile?: string;
-    patchFileCount: number;
+    patchCount: number;
     patchValidationFailures?: Array<{
         packageName: string;
         cveId: string;
         error: string;
     }>;
-    patchStorageDir?: string;
+    patchesDir?: string;
+    correlation?: CorrelationContext;
+    provenance?: ProvenanceContext;
+    constraints?: RemediationConstraints;
+    idempotencyKey?: string;
 }
 interface CiSummary {
     schemaVersion: "1.0";
@@ -120,13 +178,17 @@ interface CiSummary {
         message: string;
     }>;
     evidenceFile?: string;
-    patchFileCount?: number;
+    patchCount?: number;
     patchValidationFailures?: Array<{
         packageName: string;
         cveId: string;
         error: string;
     }>;
-    patchStorageDir?: string;
+    patchesDir?: string;
+    correlation?: CorrelationContext;
+    provenance?: ProvenanceContext;
+    constraints?: RemediationConstraints;
+    idempotencyKey?: string;
 }
 /**
  * Main entry point for programmatic use.
@@ -136,6 +198,10 @@ interface CiSummary {
  * @returns       A RemediationReport describing what was found and done
  */
 declare function remediate(cveId: string, options?: RemediateOptions): Promise<RemediationReport>;
+/**
+ * Non-mutating preview entrypoint for planning and orchestration.
+ */
+declare function planRemediation(cveId: string, options?: RemediateOptions): Promise<RemediationReport>;
 /**
  * Scanner-first entrypoint: parse a scanner output file (npm audit JSON or SARIF),
  * extract CVEs, and run remediations one-by-one.
@@ -144,4 +210,4 @@ declare function remediateFromScan(inputPath: string, options?: ScanOptions): Pr
 declare function toCiSummary(report: ScanReport): CiSummary;
 declare function ciExitCode(summary: CiSummary): number;
 
-export { type AffectedPackage, type CiSummary, type CveDetails, type InventoryPackage, type PatchResult, type PatchStrategy, type RemediateOptions, type RemediationReport, type ScanInputFormat, type ScanOptions, type ScanReport, type VulnerablePackage, ciExitCode, remediate, remediateFromScan, runRemediationPipeline, toCiSummary };
+export { type AffectedPackage, type CiSummary, type CorrelationContext, type CveDetails, type InventoryPackage, type PatchResult, type PatchStrategy, type ProvenanceContext, type RemediateOptions, type RemediationConstraints, type RemediationReport, type ScanInputFormat, type ScanOptions, type ScanReport, type VulnerablePackage, ciExitCode, planRemediation, remediate, remediateFromScan, runRemediationPipeline, toCiSummary };

package/dist/index.js

@@ -1,12 +1,14 @@
 import {
   ciExitCode,
+  planRemediation,
   remediate,
   remediateFromScan,
   runRemediationPipeline,
   toCiSummary
-} from "./chunk-DQKT2CUG.js";
+} from "./chunk-GBOD3DV6.js";
 export {
   ciExitCode,
+  planRemediation,
   remediate,
   remediateFromScan,
   runRemediationPipeline,

package/dist/mcp/server.d.ts

@@ -1 +1,293 @@
 #!/usr/bin/env node
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { remediate, planRemediation, remediateFromScan } from '../index.js';
+
+/**
+ * autoremediator MCP server
+ *
+ * Exposes all autoremediator tools via the Model Context Protocol so LLM hosts
+ * (Claude Desktop, Cursor, Copilot, etc.) can invoke them directly.
+ *
+ * Start: autoremediator-mcp   (stdio transport)
+ */
+
+interface McpApiDeps {
+    remediateFn: typeof remediate;
+    planRemediationFn: typeof planRemediation;
+    remediateFromScanFn: typeof remediateFromScan;
+}
+declare const TOOLS: ({
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        required: string[];
+        properties: {
+            cveId: {
+                type: string;
+                description: string;
+            };
+            cwd: {
+                type: string;
+                description: string;
+            };
+            packageManager: {
+                type: string;
+                enum: string[];
+                description: string;
+            };
+            dryRun: {
+                type: string;
+                description: string;
+            };
+            preview: {
+                type: string;
+                description: string;
+            };
+            runTests: {
+                type: string;
+                description: string;
+            };
+            llmProvider: {
+                type: string;
+                enum: string[];
+                description: string;
+            };
+            patchesDir: {
+                type: string;
+                description: string;
+            };
+            policy: {
+                type: string;
+                description: string;
+            };
+            requestId: {
+                type: string;
+                description: string;
+            };
+            sessionId: {
+                type: string;
+                description: string;
+            };
+            parentRunId: {
+                type: string;
+                description: string;
+            };
+            idempotencyKey: {
+                type: string;
+                description: string;
+            };
+            resume: {
+                type: string;
+                description: string;
+            };
+            actor: {
+                type: string;
+                description: string;
+            };
+            source: {
+                type: string;
+                enum: string[];
+                description: string;
+            };
+            constraints: {
+                type: string;
+                properties: {
+                    directDependenciesOnly: {
+                        type: string;
+                    };
+                    preferVersionBump: {
+                        type: string;
+                    };
+                };
+            };
+            inputPath?: undefined;
+            format?: undefined;
+            evidence?: undefined;
+        };
+    };
+} | {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        required: string[];
+        properties: {
+            cveId: {
+                type: string;
+                description: string;
+            };
+            cwd: {
+                type: string;
+                description: string;
+            };
+            packageManager: {
+                type: string;
+                enum: string[];
+                description: string;
+            };
+            runTests: {
+                type: string;
+                description: string;
+            };
+            llmProvider: {
+                type: string;
+                enum: string[];
+                description: string;
+            };
+            patchesDir: {
+                type: string;
+                description: string;
+            };
+            policy: {
+                type: string;
+                description: string;
+            };
+            requestId: {
+                type: string;
+                description: string;
+            };
+            sessionId: {
+                type: string;
+                description: string;
+            };
+            parentRunId: {
+                type: string;
+                description: string;
+            };
+            idempotencyKey: {
+                type: string;
+                description: string;
+            };
+            resume: {
+                type: string;
+                description: string;
+            };
+            actor: {
+                type: string;
+                description: string;
+            };
+            source: {
+                type: string;
+                enum: string[];
+                description: string;
+            };
+            constraints: {
+                type: string;
+                properties: {
+                    directDependenciesOnly: {
+                        type: string;
+                    };
+                    preferVersionBump: {
+                        type: string;
+                    };
+                };
+            };
+            dryRun?: undefined;
+            preview?: undefined;
+            inputPath?: undefined;
+            format?: undefined;
+            evidence?: undefined;
+        };
+    };
+} | {
+    name: string;
+    description: string;
+    inputSchema: {
+        type: string;
+        required: string[];
+        properties: {
+            inputPath: {
+                type: string;
+                description: string;
+            };
+            cwd: {
+                type: string;
+                description: string;
+            };
+            packageManager: {
+                type: string;
+                enum: string[];
+                description: string;
+            };
+            format: {
+                type: string;
+                enum: string[];
+                description: string;
+            };
+            dryRun: {
+                type: string;
+                description: string;
+            };
+            preview: {
+                type: string;
+                description: string;
+            };
+            evidence: {
+                type: string;
+                description: string;
+            };
+            runTests: {
+                type: string;
+                description: string;
+            };
+            policy: {
+                type: string;
+                description: string;
+            };
+            requestId: {
+                type: string;
+                description: string;
+            };
+            sessionId: {
+                type: string;
+                description: string;
+            };
+            parentRunId: {
+                type: string;
+                description: string;
+            };
+            idempotencyKey: {
+                type: string;
+                description: string;
+            };
+            resume: {
+                type: string;
+                description: string;
+            };
+            actor: {
+                type: string;
+                description: string;
+            };
+            source: {
+                type: string;
+                enum: string[];
+                description: string;
+            };
+            constraints: {
+                type: string;
+                properties: {
+                    directDependenciesOnly: {
+                        type: string;
+                    };
+                    preferVersionBump: {
+                        type: string;
+                    };
+                };
+            };
+            cveId?: undefined;
+            llmProvider?: undefined;
+            patchesDir?: undefined;
+        };
+    };
+})[];
+declare function handleToolCall(name: string, args?: Record<string, unknown>, deps?: McpApiDeps): Promise<{
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+    isError?: boolean;
+}>;
+declare function createMcpServer(): Server;
+
+export { TOOLS, createMcpServer, handleToolCall };