autoremediator 0.21.0 → 0.21.2

package/dist/api/patches/inspection.js

@@ -0,0 +1,66 @@
+import { existsSync } from "node:fs";
+import { readdir, readFile, stat } from "node:fs/promises";
+import { join } from "node:path";
+import { validatePatchDiff } from "../../remediation/strategies/patch-utils.js";
+import { readManifest, resolveArtifactPath, resolvePatchesDir, toSummary, derivePatchMetadata, } from "./helpers.js";
+export async function listPatchArtifacts(options = {}) {
+    const cwd = options.cwd ?? process.cwd();
+    const patchesDirPath = resolvePatchesDir(cwd, options.patchesDir);
+    if (!existsSync(patchesDirPath)) {
+        return [];
+    }
+    const entries = await readdir(patchesDirPath, { withFileTypes: true });
+    const patchFiles = entries
+        .filter((entry) => entry.isFile() && entry.name.endsWith(".patch"))
+        .map((entry) => join(patchesDirPath, entry.name))
+        .toSorted((left, right) => left.localeCompare(right));
+    const summaries = await Promise.all(patchFiles.map(async (patchFilePath) => {
+        const inspection = await inspectPatchArtifact(patchFilePath, options);
+        return toSummary(inspection);
+    }));
+    return summaries;
+}
+export async function inspectPatchArtifact(patchFilePath, options = {}) {
+    const cwd = options.cwd ?? process.cwd();
+    const resolvedPatchPath = resolveArtifactPath(cwd, patchFilePath);
+    const patchFileName = resolvedPatchPath.split("/").pop() ?? resolvedPatchPath;
+    const manifestFilePath = `${resolvedPatchPath}.json`;
+    if (!existsSync(resolvedPatchPath)) {
+        return {
+            patchFilePath: resolvedPatchPath,
+            manifestFilePath: existsSync(manifestFilePath) ? manifestFilePath : undefined,
+            patchFileName,
+            exists: false,
+            diffValid: false,
+            formatError: "Patch file does not exist.",
+        };
+    }
+    const [patchContent, fileStats, manifest] = await Promise.all([
+        readFile(resolvedPatchPath, "utf8"),
+        stat(resolvedPatchPath),
+        readManifest(manifestFilePath),
+    ]);
+    const format = validatePatchDiff(patchContent);
+    const derived = derivePatchMetadata(patchContent);
+    return {
+        patchFilePath: resolvedPatchPath,
+        manifestFilePath: manifest ? manifestFilePath : undefined,
+        patchFileName,
+        cveId: manifest?.cveId,
+        packageName: manifest?.packageName,
+        vulnerableVersion: manifest?.vulnerableVersion,
+        patchMode: manifest?.patchMode,
+        confidence: manifest?.confidence,
+        riskLevel: manifest?.riskLevel,
+        generatedAt: manifest?.generatedAt,
+        files: manifest?.files ?? derived.files,
+        hunkCount: manifest?.hunkCount ?? derived.hunkCount,
+        exists: true,
+        diffValid: format.valid,
+        formatError: format.error,
+        patchSizeBytes: fileStats.size,
+        lineCount: patchContent.split(/\r?\n/).length,
+        manifest,
+    };
+}
+//# sourceMappingURL=inspection.js.map

package/dist/api/patches/inspection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inspection.js","sourceRoot":"","sources":["../../../src/api/patches/inspection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAOjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,6CAA6C,CAAC;AAChF,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,iBAAiB,EACjB,SAAS,EACT,mBAAmB,GACpB,MAAM,cAAc,CAAC;AAEtB,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAO,GAA8B,EAAE;IAEvC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,MAAM,cAAc,GAAG,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAElE,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,cAAc,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACvE,MAAM,UAAU,GAAG,OAAO;SACvB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;SAClE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;SAChD,QAAQ,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAExD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CACjC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE;QACrC,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QACtE,OAAO,SAAS,CAAC,UAAU,CAAC,CAAC;IAC/B,CAAC,CAAC,CACH,CAAC;IAEF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,aAAqB,EACrB,OAAO,GAA8B,EAAE;IAEvC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;IAClE,MAAM,aAAa,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,iBAAiB,CAAC;IAC9E,MAAM,gBAAgB,GAAG,GAAG,iBAAiB,OAAO,CAAC;IAErD,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACnC,OAAO;YACL,aAAa,EAAE,iBAAiB;YAChC,gBAAgB,EAAE,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;YAC7E,aAAa;YACb,MAAM,EAAE,KAAK;YACb,SAAS,EAAE,KAAK;YAChB,WAAW,EAAE,4BAA4B;SAC1C,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC5D,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;QACnC,IAAI,CAAC,iBAAiB,CAAC;QACvB,YAAY,CAAC,gBAAgB,CAAC;KAC/B,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,mBAAmB,CAAC,YAAY,CAAC,CAAC;IAElD,OAAO;QACL,aAAa,EAAE,iBAAiB;QAChC,gBAAgB,EAAE,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;QACzD,aAAa;QACb,KAAK,EAAE,QAAQ,EAAE,KAAK;QACtB,WAAW,EAAE,QAAQ,EAAE,WAAW;QAClC,iBAAiB,EAAE,QAAQ,EAAE,iBAAiB;QAC9C,SAAS,EAAE,QAAQ,EAAE,SAAS;QAC9B,UAAU,EAAE,QAAQ,EAAE,UAAU;QAChC,SAAS,EAAE,QAAQ,EAAE,SAAS;QAC9B,WAAW,EAAE,QAAQ,EAAE,WAAW;QAClC,KAAK,EAAE,QAAQ,EAAE,KAAK,IAAI,OAAO,CAAC,KAAK;QACvC,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,OAAO,CAAC,SAAS;QACnD,MAAM,EAAE,IAAI;QACZ,SAAS,EAAE,MAAM,CAAC,KAAK;QACvB,WAAW,EAAE,MAAM,CAAC,KAAK;QACzB,cAAc,EAAE,SAAS,CAAC,IAAI;QAC9B,SAAS,EAAE,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM;QAC7C,QAAQ;KACT,CAAC;AACJ,CAAC"}

package/dist/api/patches/reconcile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reconcile.d.ts","sourceRoot":"","sources":["../../../src/api/patches/reconcile.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EACV,qBAAqB,EACrB,oBAAoB,EAErB,MAAM,yBAAyB,CAAC;AAGjC;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,oBAAoB,CAAC,CA+P/B"}
+{"version":3,"file":"reconcile.d.ts","sourceRoot":"","sources":["../../../src/api/patches/reconcile.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EACV,qBAAqB,EACrB,oBAAoB,EAErB,MAAM,yBAAyB,CAAC;AASjC;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,oBAAoB,CAAC,CA+P/B"}

package/dist/api/patches/reconcile.js

@@ -0,0 +1,245 @@
+import { existsSync } from "node:fs";
+import { readFile, rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { detectPackageManager, resolveInstallCommand, resolveTestCommand, } from "../../platform/package-manager/index.js";
+import { safeExecaCommand } from "../../platform/safe-exec-command.js";
+import { LONG_RUNNING_TIMEOUT_MS } from "../../platform/timeouts.js";
+import { evaluatePackage } from "../../remediation/evaluate-package.js";
+import { getOverrideValue, setOverrideValue, } from "../../remediation/tools/apply-package-override/helpers.js";
+import { inspectPatchArtifact, listPatchArtifacts } from "./inspection.js";
+/**
+ * Reconciles active patch artifacts in patchesDir against upstream registries.
+ * If safe upstream releases have been published, the patches can be retired and packages upgraded.
+ */
+export async function reconcilePatchArtifacts(options = {}) {
+    const cwd = options.cwd ?? process.cwd();
+    const pm = options.packageManager ?? detectPackageManager(cwd);
+    const summaries = await listPatchArtifacts(options);
+    const results = [];
+    for (const summary of summaries) {
+        const inspection = await inspectPatchArtifact(summary.patchFilePath, options);
+        let packageName = inspection.packageName;
+        let vulnerableVersion = inspection.vulnerableVersion;
+        const cveId = inspection.cveId;
+        if (!packageName && summary.patchFileName) {
+            const basename = summary.patchFileName.replace(/\.patch$/, "");
+            const plusIdx = basename.lastIndexOf("+");
+            if (plusIdx > 0) {
+                let rawPkg = basename.slice(0, plusIdx);
+                vulnerableVersion = basename.slice(plusIdx + 1);
+                if (rawPkg.includes("+")) {
+                    rawPkg = "@" + rawPkg.replace("+", "/");
+                }
+                packageName = rawPkg;
+            }
+            else {
+                packageName = basename;
+            }
+        }
+        if (!packageName) {
+            results.push({
+                patchFilePath: summary.patchFilePath,
+                packageName: "unknown",
+                cveId,
+                status: "patch-retained",
+                reason: "Cannot determine package name from patch artifact.",
+            });
+            continue;
+        }
+        let safeUpgradeVersion;
+        try {
+            const evaluation = await evaluatePackage(packageName, {
+                version: vulnerableVersion,
+                enrichIntelligence: false,
+            });
+            if (cveId) {
+                const vuln = evaluation.vulnerabilities.find((v) => v.cveId.toLowerCase() === cveId.toLowerCase());
+                if (vuln?.safeUpgradeVersion) {
+                    safeUpgradeVersion = vuln.safeUpgradeVersion;
+                }
+            }
+            else {
+                safeUpgradeVersion = evaluation.vulnerabilities.find((v) => v.safeUpgradeVersion)?.safeUpgradeVersion;
+            }
+        }
+        catch {
+            // Evaluation query failed or offline; fall through to the unresolved-result path below.
+        }
+        if (!safeUpgradeVersion) {
+            results.push({
+                patchFilePath: summary.patchFilePath,
+                packageName,
+                cveId,
+                installedVersion: vulnerableVersion,
+                status: "patch-retained",
+                reason: "No safe upstream release exists yet; patch remains necessary.",
+            });
+            continue;
+        }
+        if (!options.autoApply) {
+            results.push({
+                patchFilePath: summary.patchFilePath,
+                packageName,
+                cveId,
+                installedVersion: vulnerableVersion,
+                safeUpstreamVersion: safeUpgradeVersion,
+                status: "safe-version-available",
+                reason: `Safe upstream version ${safeUpgradeVersion} is available. Re-run with autoApply: true or --auto-apply to upgrade.`,
+            });
+            continue;
+        }
+        // Snapshot pre-mutation state for truthful rollback on command failure
+        const pkgJsonPath = join(cwd, "package.json");
+        const manifestPath = inspection.manifestFilePath ?? `${summary.patchFilePath}.json`;
+        let originalPkgJsonContent;
+        let originalPatchContent;
+        let originalManifestContent;
+        try {
+            if (existsSync(pkgJsonPath)) {
+                originalPkgJsonContent = await readFile(pkgJsonPath, "utf8");
+            }
+            if (existsSync(summary.patchFilePath)) {
+                originalPatchContent = await readFile(summary.patchFilePath, "utf8");
+            }
+            if (existsSync(manifestPath)) {
+                originalManifestContent = await readFile(manifestPath, "utf8");
+            }
+            if (originalPkgJsonContent) {
+                const pkgJson = JSON.parse(originalPkgJsonContent);
+                let updated = false;
+                const depSections = [
+                    "dependencies",
+                    "devDependencies",
+                    "peerDependencies",
+                    "optionalDependencies",
+                ];
+                let foundInDirectDeps = false;
+                for (const depSection of depSections) {
+                    if (pkgJson[depSection]?.[packageName]) {
+                        pkgJson[depSection][packageName] = `^${safeUpgradeVersion}`;
+                        updated = true;
+                        foundInDirectDeps = true;
+                    }
+                }
+                // Handle existing or newly needed transitive overrides
+                const existingOverride = getOverrideValue(pkgJson, pm, packageName);
+                if (existingOverride || !foundInDirectDeps) {
+                    setOverrideValue(pkgJson, pm, packageName, safeUpgradeVersion);
+                    updated = true;
+                }
+                // Remove from pnpm patchedDependencies if present
+                if (pkgJson.pnpm?.patchedDependencies) {
+                    const patched = pkgJson.pnpm.patchedDependencies;
+                    for (const key of Object.keys(patched)) {
+                        if (key.startsWith(`${packageName}@`)) {
+                            delete patched[key];
+                            updated = true;
+                        }
+                    }
+                }
+                if (updated) {
+                    await writeFile(pkgJsonPath, JSON.stringify(pkgJson, null, 2) + "\n", "utf8");
+                }
+            }
+            // Remove patch artifacts
+            await rm(summary.patchFilePath, { force: true });
+            if (existsSync(manifestPath)) {
+                await rm(manifestPath, { force: true });
+            }
+            // Execute package installation truthfully
+            const installCmd = resolveInstallCommand(pm);
+            try {
+                await safeExecaCommand(installCmd, {
+                    timeoutMs: LONG_RUNNING_TIMEOUT_MS,
+                    cwd,
+                    stdio: "pipe",
+                });
+            }
+            catch (installErr) {
+                // Rollback state on install failure
+                if (originalPkgJsonContent) {
+                    await writeFile(pkgJsonPath, originalPkgJsonContent, "utf8");
+                }
+                if (originalPatchContent) {
+                    await writeFile(summary.patchFilePath, originalPatchContent, "utf8");
+                }
+                if (originalManifestContent) {
+                    await writeFile(manifestPath, originalManifestContent, "utf8");
+                }
+                const msg = installErr instanceof Error ? installErr.message : String(installErr);
+                results.push({
+                    patchFilePath: summary.patchFilePath,
+                    packageName,
+                    cveId,
+                    installedVersion: vulnerableVersion,
+                    safeUpstreamVersion: safeUpgradeVersion,
+                    status: "error",
+                    reason: `Package manager installation failed (${installCmd.join(" ")}): ${msg}. Restored original package.json and patch artifacts.`,
+                });
+                continue;
+            }
+            // Execute tests truthfully if requested
+            if (options.runTests) {
+                const testCmd = resolveTestCommand(pm);
+                try {
+                    await safeExecaCommand(testCmd, {
+                        timeoutMs: LONG_RUNNING_TIMEOUT_MS,
+                        cwd,
+                        stdio: "pipe",
+                    });
+                }
+                catch (testErr) {
+                    // Rollback state on test failure
+                    if (originalPkgJsonContent) {
+                        await writeFile(pkgJsonPath, originalPkgJsonContent, "utf8");
+                    }
+                    if (originalPatchContent) {
+                        await writeFile(summary.patchFilePath, originalPatchContent, "utf8");
+                    }
+                    if (originalManifestContent) {
+                        await writeFile(manifestPath, originalManifestContent, "utf8");
+                    }
+                    const msg = testErr instanceof Error ? testErr.message : String(testErr);
+                    results.push({
+                        patchFilePath: summary.patchFilePath,
+                        packageName,
+                        cveId,
+                        installedVersion: vulnerableVersion,
+                        safeUpstreamVersion: safeUpgradeVersion,
+                        status: "error",
+                        reason: `Validation tests failed post-upgrade (${testCmd.join(" ")}): ${msg}. Restored original package.json and patch artifacts.`,
+                    });
+                    continue;
+                }
+            }
+            results.push({
+                patchFilePath: summary.patchFilePath,
+                packageName,
+                cveId,
+                installedVersion: vulnerableVersion,
+                safeUpstreamVersion: safeUpgradeVersion,
+                status: "upgraded",
+                reason: `Successfully upgraded to ${safeUpgradeVersion} and retired patch artifact.`,
+            });
+        }
+        catch (err) {
+            results.push({
+                patchFilePath: summary.patchFilePath,
+                packageName,
+                cveId,
+                installedVersion: vulnerableVersion,
+                safeUpstreamVersion: safeUpgradeVersion,
+                status: "error",
+                reason: err instanceof Error ? err.message : String(err),
+            });
+        }
+    }
+    const reconciledCount = results.filter((r) => r.status === "upgraded").length;
+    const retainedCount = results.filter((r) => r.status === "patch-retained" || r.status === "safe-version-available").length;
+    return {
+        reconciled: results,
+        reconciledCount,
+        retainedCount,
+    };
+}
+//# sourceMappingURL=reconcile.js.map

package/dist/api/patches/reconcile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile.js","sourceRoot":"","sources":["../../../src/api/patches/reconcile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAMrE,OAAO,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AACxE,OAAO,EACL,gBAAgB,EAChB,gBAAgB,GAEjB,MAAM,2DAA2D,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAE3E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAO,GAA0B,EAAE;IAEnC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,IAAI,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAE/D,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,OAAO,GAA2B,EAAE,CAAC;IAE3C,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;QAChC,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAC9E,IAAI,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;QACzC,IAAI,iBAAiB,GAAG,UAAU,CAAC,iBAAiB,CAAC;QACrD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC;QAE/B,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YAC/D,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;gBAChB,IAAI,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;gBACxC,iBAAiB,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;gBAChD,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBACzB,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC1C,CAAC;gBACD,WAAW,GAAG,MAAM,CAAC;YACvB,CAAC;iBAAM,CAAC;gBACN,WAAW,GAAG,QAAQ,CAAC;YACzB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC;gBACX,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,WAAW,EAAE,SAAS;gBACtB,KAAK;gBACL,MAAM,EAAE,gBAAgB;gBACxB,MAAM,EAAE,oDAAoD;aAC7D,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,IAAI,kBAAsC,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,WAAW,EAAE;gBACpD,OAAO,EAAE,iBAAiB;gBAC1B,kBAAkB,EAAE,KAAK;aAC1B,CAAC,CAAC;YAEH,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,IAAI,GAAG,UAAU,CAAC,eAAe,CAAC,IAAI,CAC1C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE,CACrD,CAAC;gBACF,IAAI,IAAI,EAAE,kBAAkB,EAAE,CAAC;oBAC7B,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC;gBAC/C,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,kBAAkB,GAAG,UAAU,CAAC,eAAe,CAAC,IAAI,CAClD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAC5B,EAAE,kBAAkB,CAAC;YACxB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wFAAwF;QAC1F,CAAC;QAED,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC;gBACX,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,WAAW;gBACX,KAAK;gBACL,gBAAgB,EAAE,iBAAiB;gBACnC,MAAM,EAAE,gBAAgB;gBACxB,MAAM,EAAE,+DAA+D;aACxE,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC;gBACX,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,WAAW;gBACX,KAAK;gBACL,gBAAgB,EAAE,iBAAiB;gBACnC,mBAAmB,EAAE,kBAAkB;gBACvC,MAAM,EAAE,wBAAwB;gBAChC,MAAM,EAAE,yBAAyB,kBAAkB,wEAAwE;aAC5H,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,uEAAuE;QACvE,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC9C,MAAM,YAAY,GAAG,UAAU,CAAC,gBAAgB,IAAI,GAAG,OAAO,CAAC,aAAa,OAAO,CAAC;QACpF,IAAI,sBAA0C,CAAC;QAC/C,IAAI,oBAAwC,CAAC;QAC7C,IAAI,uBAA2C,CAAC;QAEhD,IAAI,CAAC;YACH,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC5B,sBAAsB,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YAC/D,CAAC;YACD,IAAI,UAAU,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;gBACtC,oBAAoB,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;YACvE,CAAC;YACD,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC7B,uBAAuB,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YACjE,CAAC;YAED,IAAI,sBAAsB,EAAE,CAAC;gBAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,sBAAsB,CACG,CAAC;gBACrD,IAAI,OAAO,GAAG,KAAK,CAAC;gBAEpB,MAAM,WAAW,GAAG;oBAClB,cAAc;oBACd,iBAAiB;oBACjB,kBAAkB;oBAClB,sBAAsB;iBACvB,CAAC;gBAEF,IAAI,iBAAiB,GAAG,KAAK,CAAC;gBAC9B,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;oBACrC,IAAI,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;wBACvC,OAAO,CAAC,UAAU,CAAC,CAAC,WAAW,CAAC,GAAG,IAAI,kBAAkB,EAAE,CAAC;wBAC5D,OAAO,GAAG,IAAI,CAAC;wBACf,iBAAiB,GAAG,IAAI,CAAC;oBAC3B,CAAC;gBACH,CAAC;gBAED,uDAAuD;gBACvD,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,OAAO,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;gBACpE,IAAI,gBAAgB,IAAI,CAAC,iBAAiB,EAAE,CAAC;oBAC3C,gBAAgB,CAAC,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;oBAC/D,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;gBAED,kDAAkD;gBAClD,IAAI,OAAO,CAAC,IAAI,EAAE,mBAAmB,EAAE,CAAC;oBACtC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,mBAA6C,CAAC;oBAC3E,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;wBACvC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,WAAW,GAAG,CAAC,EAAE,CAAC;4BACtC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;4BACpB,OAAO,GAAG,IAAI,CAAC;wBACjB,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;gBAChF,CAAC;YACH,CAAC;YAED,yBAAyB;YACzB,MAAM,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACjD,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC7B,MAAM,EAAE,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1C,CAAC;YAED,0CAA0C;YAC1C,MAAM,UAAU,GAAG,qBAAqB,CAAC,EAAE,CAAC,CAAC;YAC7C,IAAI,CAAC;gBACH,MAAM,gBAAgB,CAAC,UAAU,EAAE;oBACjC,SAAS,EAAE,uBAAuB;oBAClC,GAAG;oBACH,KAAK,EAAE,MAAM;iBACd,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,UAAU,EAAE,CAAC;gBACpB,oCAAoC;gBACpC,IAAI,sBAAsB,EAAE,CAAC;oBAC3B,MAAM,SAAS,CAAC,WAAW,EAAE,sBAAsB,EAAE,MAAM,CAAC,CAAC;gBAC/D,CAAC;gBACD,IAAI,oBAAoB,EAAE,CAAC;oBACzB,MAAM,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,oBAAoB,EAAE,MAAM,CAAC,CAAC;gBACvE,CAAC;gBACD,IAAI,uBAAuB,EAAE,CAAC;oBAC5B,MAAM,SAAS,CAAC,YAAY,EAAE,uBAAuB,EAAE,MAAM,CAAC,CAAC;gBACjE,CAAC;gBAED,MAAM,GAAG,GAAG,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBAClF,OAAO,CAAC,IAAI,CAAC;oBACX,aAAa,EAAE,OAAO,CAAC,aAAa;oBACpC,WAAW;oBACX,KAAK;oBACL,gBAAgB,EAAE,iBAAiB;oBACnC,mBAAmB,EAAE,kBAAkB;oBACvC,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,wCAAwC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,uDAAuD;iBACrI,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,wCAAwC;YACxC,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACrB,MAAM,OAAO,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;gBACvC,IAAI,CAAC;oBACH,MAAM,gBAAgB,CAAC,OAAO,EAAE;wBAC9B,SAAS,EAAE,uBAAuB;wBAClC,GAAG;wBACH,KAAK,EAAE,MAAM;qBACd,CAAC,CAAC;gBACL,CAAC;gBAAC,OAAO,OAAO,EAAE,CAAC;oBACjB,iCAAiC;oBACjC,IAAI,sBAAsB,EAAE,CAAC;wBAC3B,MAAM,SAAS,CAAC,WAAW,EAAE,sBAAsB,EAAE,MAAM,CAAC,CAAC;oBAC/D,CAAC;oBACD,IAAI,oBAAoB,EAAE,CAAC;wBACzB,MAAM,SAAS,CAAC,OAAO,CAAC,aAAa,EAAE,oBAAoB,EAAE,MAAM,CAAC,CAAC;oBACvE,CAAC;oBACD,IAAI,uBAAuB,EAAE,CAAC;wBAC5B,MAAM,SAAS,CAAC,YAAY,EAAE,uBAAuB,EAAE,MAAM,CAAC,CAAC;oBACjE,CAAC;oBAED,MAAM,GAAG,GAAG,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;oBACzE,OAAO,CAAC,IAAI,CAAC;wBACX,aAAa,EAAE,OAAO,CAAC,aAAa;wBACpC,WAAW;wBACX,KAAK;wBACL,gBAAgB,EAAE,iBAAiB;wBACnC,mBAAmB,EAAE,kBAAkB;wBACvC,MAAM,EAAE,OAAO;wBACf,MAAM,EAAE,yCAAyC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,uDAAuD;qBACnI,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;YACH,CAAC;YAED,OAAO,CAAC,IAAI,CAAC;gBACX,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,WAAW;gBACX,KAAK;gBACL,gBAAgB,EAAE,iBAAiB;gBACnC,mBAAmB,EAAE,kBAAkB;gBACvC,MAAM,EAAE,UAAU;gBAClB,MAAM,EAAE,4BAA4B,kBAAkB,8BAA8B;aACrF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC;gBACX,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,WAAW;gBACX,KAAK;gBACL,gBAAgB,EAAE,iBAAiB;gBACnC,mBAAmB,EAAE,kBAAkB;gBACvC,MAAM,EAAE,OAAO;gBACf,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACzD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;IAC9E,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAClC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,gBAAgB,IAAI,CAAC,CAAC,MAAM,KAAK,wBAAwB,CAC9E,CAAC,MAAM,CAAC;IAET,OAAO;QACL,UAAU,EAAE,OAAO;QACnB,eAAe;QACf,aAAa;KACd,CAAC;AACJ,CAAC"}

package/dist/api/patches/validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../src/api/patches/validation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,yBAAyB,EACzB,6BAA6B,EAE9B,MAAM,yBAAyB,CAAC;AAKjC,wBAAsB,qBAAqB,CACzC,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,6BAA6B,CAAC,CAwHxC"}
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../src/api/patches/validation.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,yBAAyB,EACzB,6BAA6B,EAE9B,MAAM,yBAAyB,CAAC;AAIjC,wBAAsB,qBAAqB,CACzC,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE,yBAA8B,GACtC,OAAO,CAAC,6BAA6B,CAAC,CAkHxC"}

package/dist/api/patches/validation.js

@@ -0,0 +1,105 @@
+import { detectPackageManager } from "../../platform/package-manager/index.js";
+import { checkInventoryTool } from "../../remediation/tools/check-inventory.js";
+import { inspectPatchArtifact } from "./inspection.js";
+export async function validatePatchArtifact(patchFilePath, options = {}) {
+    const inspection = await inspectPatchArtifact(patchFilePath, options);
+    const validationPhases = [
+        {
+            phase: "diff-format",
+            passed: inspection.diffValid,
+            error: inspection.diffValid ? undefined : inspection.formatError,
+            message: inspection.diffValid ? "Patch content is a valid unified diff." : undefined,
+        },
+    ];
+    if (!inspection.exists) {
+        return {
+            patchFilePath: inspection.patchFilePath,
+            manifestFilePath: inspection.manifestFilePath,
+            exists: false,
+            manifestFound: false,
+            diffValid: false,
+            formatError: inspection.formatError,
+            driftDetected: false,
+            validationPhases,
+        };
+    }
+    const manifest = inspection.manifest;
+    const manifestFound = Boolean(manifest);
+    if (!manifest) {
+        validationPhases.push({
+            phase: "manifest-write",
+            passed: false,
+            error: "No patch manifest found for this patch artifact.",
+        });
+        return {
+            patchFilePath: inspection.patchFilePath,
+            manifestFilePath: inspection.manifestFilePath,
+            exists: true,
+            manifestFound,
+            diffValid: inspection.diffValid,
+            formatError: inspection.formatError,
+            driftDetected: false,
+            validationPhases,
+        };
+    }
+    validationPhases.push({
+        phase: "manifest-write",
+        passed: true,
+        message: "Patch manifest is present.",
+    });
+    const cwd = options.cwd ?? process.cwd();
+    const packageManager = options.packageManager ?? detectPackageManager(cwd);
+    const inventory = await checkInventoryTool.execute({ cwd, packageManager });
+    if (inventory.error) {
+        validationPhases.push({
+            phase: "drift",
+            passed: false,
+            error: inventory.error,
+        });
+        return {
+            patchFilePath: inspection.patchFilePath,
+            manifestFilePath: inspection.manifestFilePath,
+            exists: true,
+            manifestFound,
+            diffValid: inspection.diffValid,
+            formatError: inspection.formatError,
+            driftDetected: false,
+            cveId: manifest.cveId,
+            packageName: manifest.packageName,
+            vulnerableVersion: manifest.vulnerableVersion,
+            validationPhases,
+        };
+    }
+    const matchingPackages = (inventory.packages ?? []).filter((pkg) => pkg.name === manifest.packageName);
+    const installedVersion = matchingPackages[0]?.version;
+    const inventoryMatch = matchingPackages.some((pkg) => pkg.version === manifest.vulnerableVersion);
+    const driftDetected = matchingPackages.length > 0 && !inventoryMatch;
+    validationPhases.push({
+        phase: "drift",
+        passed: !driftDetected,
+        message: matchingPackages.length === 0
+            ? `Package ${manifest.packageName} is not currently installed.`
+            : inventoryMatch
+                ? `Installed version matches manifest target ${manifest.vulnerableVersion}.`
+                : `Installed version ${installedVersion} does not match manifest target ${manifest.vulnerableVersion}.`,
+        error: driftDetected
+            ? "Patch manifest does not match the installed dependency version."
+            : undefined,
+    });
+    return {
+        patchFilePath: inspection.patchFilePath,
+        manifestFilePath: inspection.manifestFilePath,
+        exists: true,
+        manifestFound,
+        diffValid: inspection.diffValid,
+        formatError: inspection.formatError,
+        driftDetected,
+        cveId: manifest.cveId,
+        packageName: manifest.packageName,
+        vulnerableVersion: manifest.vulnerableVersion,
+        installedVersion,
+        inventoryMatch,
+        validationPhases,
+    };
+}
+//# sourceMappingURL=validation.js.map

package/dist/api/patches/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../../src/api/patches/validation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAM/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEvD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,aAAqB,EACrB,OAAO,GAA8B,EAAE;IAEvC,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACtE,MAAM,gBAAgB,GAA2B;QAC/C;YACE,KAAK,EAAE,aAAa;YACpB,MAAM,EAAE,UAAU,CAAC,SAAS;YAC5B,KAAK,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW;YAChE,OAAO,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC,SAAS;SACrF;KACF,CAAC;IAEF,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QACvB,OAAO;YACL,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;YAC7C,MAAM,EAAE,KAAK;YACb,aAAa,EAAE,KAAK;YACpB,SAAS,EAAE,KAAK;YAChB,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,aAAa,EAAE,KAAK;YACpB,gBAAgB;SACjB,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,CAAC;IACrC,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAExC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,gBAAgB,CAAC,IAAI,CAAC;YACpB,KAAK,EAAE,gBAAgB;YACvB,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,kDAAkD;SAC1D,CAAC,CAAC;QAEH,OAAO;YACL,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;YAC7C,MAAM,EAAE,IAAI;YACZ,aAAa;YACb,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,aAAa,EAAE,KAAK;YACpB,gBAAgB;SACjB,CAAC;IACJ,CAAC;IAED,gBAAgB,CAAC,IAAI,CAAC;QACpB,KAAK,EAAE,gBAAgB;QACvB,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,4BAA4B;KACtC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC3E,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,CAAC;IAE5E,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;QACpB,gBAAgB,CAAC,IAAI,CAAC;YACpB,KAAK,EAAE,OAAO;YACd,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,SAAS,CAAC,KAAK;SACvB,CAAC,CAAC;QAEH,OAAO;YACL,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;YAC7C,MAAM,EAAE,IAAI;YACZ,aAAa;YACb,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,aAAa,EAAE,KAAK;YACpB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;YAC7C,gBAAgB;SACjB,CAAC;IACJ,CAAC;IAED,MAAM,gBAAgB,GAAG,CAAC,SAAS,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CACxD,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,WAAW,CAC3C,CAAC;IACF,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;IACtD,MAAM,cAAc,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAClG,MAAM,aAAa,GAAG,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC;IAErE,gBAAgB,CAAC,IAAI,CAAC;QACpB,KAAK,EAAE,OAAO;QACd,MAAM,EAAE,CAAC,aAAa;QACtB,OAAO,EACL,gBAAgB,CAAC,MAAM,KAAK,CAAC;YAC3B,CAAC,CAAC,WAAW,QAAQ,CAAC,WAAW,8BAA8B;YAC/D,CAAC,CAAC,cAAc;gBACd,CAAC,CAAC,6CAA6C,QAAQ,CAAC,iBAAiB,GAAG;gBAC5E,CAAC,CAAC,qBAAqB,gBAAgB,mCAAmC,QAAQ,CAAC,iBAAiB,GAAG;QAC7G,KAAK,EAAE,aAAa;YAClB,CAAC,CAAC,iEAAiE;YACnE,CAAC,CAAC,SAAS;KACd,CAAC,CAAC;IAEH,OAAO;QACL,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;QAC7C,MAAM,EAAE,IAAI;QACZ,aAAa;QACb,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,aAAa;QACb,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;QAC7C,gBAAgB;QAChB,cAAc;QACd,gBAAgB;KACjB,CAAC;AACJ,CAAC"}

package/dist/api/portfolio/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/portfolio/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EAEf,gBAAgB,EAEjB,MAAM,yBAAyB,CAAC;AAyCjC,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,eAAe,EAAE,EAC1B,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,eAAe,CAAC,CA4G1B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/portfolio/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EAEf,gBAAgB,EAEjB,MAAM,yBAAyB,CAAC;AAyCjC,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,eAAe,EAAE,EAC1B,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,eAAe,CAAC,CA8G1B"}

package/dist/api/portfolio/index.js

@@ -0,0 +1,127 @@
+import { remediateFromScan } from "../remediate-from-scan/index.js";
+import { remediate } from "../remediate/index.js";
+import { assertValidSimulationMode, buildSlaBreachSummary } from "../reporting.js";
+import { rankPortfolioTargets } from "./risk-score.js";
+function toTargetStatusFromRemediation(report) {
+    const failed = report.results.some((result) => !result.applied && !result.dryRun);
+    const succeeded = report.results.some((result) => result.applied || result.dryRun);
+    if (!failed)
+        return "ok";
+    return succeeded ? "partial" : "failed";
+}
+function normalizeTargetInput(target) {
+    return {
+        cveId: target.cveId?.trim() || undefined,
+        inputPath: target.inputPath?.trim() || undefined,
+        audit: target.audit ?? false,
+    };
+}
+function validateTarget(target, index) {
+    if (!target.cwd || typeof target.cwd !== "string") {
+        throw new Error(`Invalid portfolio target at index ${index}: cwd is required.`);
+    }
+    const { cveId, inputPath, audit } = normalizeTargetInput(target);
+    const hasScanInput = Boolean(inputPath) || audit;
+    if (Boolean(cveId) === hasScanInput) {
+        throw new Error(`Invalid portfolio target at index ${index}: provide exactly one mode (cveId OR inputPath/audit).`);
+    }
+}
+export async function remediatePortfolio(targets, options = {}) {
+    assertValidSimulationMode(options);
+    const normalizedTargets = Array.isArray(targets) ? targets : [];
+    if (normalizedTargets.length === 0) {
+        throw new Error("Portfolio requires at least one target.");
+    }
+    for (const [index, target] of normalizedTargets.entries()) {
+        validateTarget(target, index);
+    }
+    const executionTargets = options.campaignMode === true
+        ? rankPortfolioTargets(normalizedTargets)
+        : normalizedTargets.map((target) => ({ target, rank: undefined }));
+    const results = [];
+    const changeRequests = [];
+    let successCount = 0;
+    let failedCount = 0;
+    for (const executionTarget of executionTargets) {
+        const target = executionTarget.target;
+        const threatRank = options.campaignMode === true ? executionTarget.rank : undefined;
+        const { cveId, inputPath, audit } = normalizeTargetInput(target);
+        try {
+            if (cveId) {
+                const remediationReport = await remediate(cveId, {
+                    ...options,
+                    cwd: target.cwd,
+                    source: options.source,
+                });
+                const status = toTargetStatusFromRemediation(remediationReport);
+                results.push({
+                    target,
+                    status,
+                    ...(threatRank !== undefined ? { threatRank } : {}),
+                    remediationReport,
+                    changeRequests: remediationReport.changeRequests,
+                });
+                if (remediationReport.changeRequests?.length) {
+                    changeRequests.push(...remediationReport.changeRequests);
+                }
+                if (status === "failed") {
+                    failedCount += 1;
+                }
+                else {
+                    successCount += 1;
+                }
+                continue;
+            }
+            const scanReport = await remediateFromScan(inputPath ?? "", {
+                ...options,
+                cwd: target.cwd,
+                audit,
+                format: target.format,
+                source: options.source,
+            });
+            results.push({
+                target,
+                status: scanReport.status,
+                ...(threatRank !== undefined ? { threatRank } : {}),
+                scanReport,
+                changeRequests: scanReport.changeRequests,
+            });
+            if (scanReport.changeRequests?.length) {
+                changeRequests.push(...scanReport.changeRequests);
+            }
+            if (scanReport.status === "failed") {
+                failedCount += 1;
+            }
+            else {
+                successCount += 1;
+            }
+        }
+        catch (error) {
+            results.push({
+                target,
+                status: "failed",
+                ...(threatRank !== undefined ? { threatRank } : {}),
+                error: error instanceof Error ? error.message : String(error),
+            });
+            failedCount += 1;
+        }
+    }
+    const overallStatus = failedCount === 0 ? "ok" : successCount > 0 ? "partial" : "failed";
+    const allRemediationReports = results.flatMap((r) => {
+        if (r.remediationReport)
+            return [r.remediationReport];
+        const scan = r.scanReport;
+        return scan?.reports ?? [];
+    });
+    return {
+        schemaVersion: "1.0",
+        status: overallStatus,
+        generatedAt: new Date().toISOString(),
+        targets: results,
+        successCount,
+        failedCount,
+        changeRequests: changeRequests.length > 0 ? changeRequests : undefined,
+        slaBreachSummary: buildSlaBreachSummary(allRemediationReports),
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/api/portfolio/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/api/portfolio/index.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEvD,SAAS,6BAA6B,CAAC,MAAyB;IAC9D,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClF,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IACnF,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC1C,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAuB;IAKnD,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,SAAS;QACxC,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,SAAS;QAChD,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,KAAK;KAC7B,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,MAAuB,EAAE,KAAa;IAC5D,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,qCAAqC,KAAK,oBAAoB,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC;IAEjD,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,YAAY,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,qCAAqC,KAAK,wDAAwD,CACnG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAA0B,EAC1B,OAAO,GAAqB,EAAE;IAE9B,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAEhE,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,iBAAiB,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1D,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,MAAM,gBAAgB,GACpB,OAAO,CAAC,YAAY,KAAK,IAAI;QAC3B,CAAC,CAAC,oBAAoB,CAAC,iBAAiB,CAAC;QACzC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAEvE,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,MAAM,cAAc,GAAG,EAAoD,CAAC;IAC5E,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,WAAW,GAAG,CAAC,CAAC;IAEpB,KAAK,MAAM,eAAe,IAAI,gBAAgB,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC;QACtC,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACpF,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAEjE,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,iBAAiB,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE;oBAC/C,GAAG,OAAO;oBACV,GAAG,EAAE,MAAM,CAAC,GAAG;oBACf,MAAM,EAAE,OAAO,CAAC,MAAM;iBACvB,CAAC,CAAC;gBAEH,MAAM,MAAM,GAAG,6BAA6B,CAAC,iBAAiB,CAAC,CAAC;gBAChE,OAAO,CAAC,IAAI,CAAC;oBACX,MAAM;oBACN,MAAM;oBACN,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnD,iBAAiB;oBACjB,cAAc,EAAE,iBAAiB,CAAC,cAAc;iBACjD,CAAC,CAAC;gBAEH,IAAI,iBAAiB,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC;oBAC7C,cAAc,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,cAAc,CAAC,CAAC;gBAC3D,CAAC;gBAED,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;oBACxB,WAAW,IAAI,CAAC,CAAC;gBACnB,CAAC;qBAAM,CAAC;oBACN,YAAY,IAAI,CAAC,CAAC;gBACpB,CAAC;gBACD,SAAS;YACX,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,SAAS,IAAI,EAAE,EAAE;gBAC1D,GAAG,OAAO;gBACV,GAAG,EAAE,MAAM,CAAC,GAAG;gBACf,KAAK;gBACL,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;YAEH,OAAO,CAAC,IAAI,CAAC;gBACX,MAAM;gBACN,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnD,UAAU;gBACV,cAAc,EAAE,UAAU,CAAC,cAAc;aAC1C,CAAC,CAAC;YAEH,IAAI,UAAU,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC;gBACtC,cAAc,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC;YACpD,CAAC;YAED,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACnC,WAAW,IAAI,CAAC,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACN,YAAY,IAAI,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC;gBACX,MAAM;gBACN,MAAM,EAAE,QAAQ;gBAChB,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnD,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,WAAW,IAAI,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;IAEzF,MAAM,qBAAqB,GAAwB,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;QACvE,IAAI,CAAC,CAAC,iBAAiB;YAAE,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,CAAC,CAAC,UAAoC,CAAC;QACpD,OAAO,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,aAAa,EAAE,KAAK;QACpB,MAAM,EAAE,aAAa;QACrB,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACrC,OAAO,EAAE,OAAO;QAChB,YAAY;QACZ,WAAW;QACX,cAAc,EAAE,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;QACtE,gBAAgB,EAAE,qBAAqB,CAAC,qBAAqB,CAAC;KAC/D,CAAC;AACJ,CAAC"}

package/dist/api/portfolio/risk-score.js

@@ -0,0 +1,32 @@
+const SEVERITY_WEIGHT = {
+    CRITICAL: 40,
+    HIGH: 30,
+    MEDIUM: 10,
+    LOW: 5,
+    UNKNOWN: 0,
+};
+export function scorePortfolioTarget(target) {
+    const severity = target.riskHint?.severity;
+    const severityWeight = severity ? (SEVERITY_WEIGHT[severity] ?? 0) : 0;
+    const exploitSignalBonus = target.riskHint?.exploitSignal === true ? 25 : 0;
+    const slaBreachBonus = target.riskHint?.slaBreached === true ? 20 : 0;
+    return severityWeight + exploitSignalBonus + slaBreachBonus;
+}
+export function rankPortfolioTargets(targets) {
+    const scoredTargets = targets.map((target, index) => ({
+        target,
+        index,
+        score: scorePortfolioTarget(target),
+    }));
+    scoredTargets.sort((left, right) => {
+        if (right.score !== left.score) {
+            return right.score - left.score;
+        }
+        return left.index - right.index;
+    });
+    return scoredTargets.map((entry, index) => ({
+        target: entry.target,
+        rank: index + 1,
+    }));
+}
+//# sourceMappingURL=risk-score.js.map

package/dist/api/portfolio/risk-score.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk-score.js","sourceRoot":"","sources":["../../../src/api/portfolio/risk-score.ts"],"names":[],"mappings":"AAEA,MAAM,eAAe,GAA2B;IAC9C,QAAQ,EAAE,EAAE;IACZ,IAAI,EAAE,EAAE;IACR,MAAM,EAAE,EAAE;IACV,GAAG,EAAE,CAAC;IACN,OAAO,EAAE,CAAC;CACX,CAAC;AAEF,MAAM,UAAU,oBAAoB,CAAC,MAAuB;IAC1D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC3C,MAAM,cAAc,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,kBAAkB,GAAG,MAAM,CAAC,QAAQ,EAAE,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,EAAE,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAEtE,OAAO,cAAc,GAAG,kBAAkB,GAAG,cAAc,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAA0B;IAE1B,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACpD,MAAM;QACN,KAAK;QACL,KAAK,EAAE,oBAAoB,CAAC,MAAM,CAAC;KACpC,CAAC,CAAC,CAAC;IAEJ,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACjC,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAClC,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC1C,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI,EAAE,KAAK,GAAG,CAAC;KAChB,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/api/reachability/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/reachability/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAEhG,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,sBAAsB,CAAC,CAGjC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/reachability/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAMhG,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,sBAAsB,CAAC,CAGjC"}