autoremediator 0.21.0 → 0.21.2

package/dist/remediation/tools/check-inventory.js

@@ -0,0 +1,132 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import semver from "semver";
+import { z } from "zod";
+import { detectPackageManager, parseListOutput, resolveListCommand, } from "../../platform/package-manager/index.js";
+import { resolveDenoInventory } from "../../platform/package-manager/list-parser.js";
+import { loadPolicy } from "../../platform/policy.js";
+import { safeExeca } from "../../platform/safe-exec.js";
+import { findDeclaringWorkspacePackage } from "../../platform/workspace.js";
+/**
+ * Tool: check-inventory
+ *
+ * Reads the consumer's package.json and installed dependency tree to produce
+ * a flat list of installed packages and their resolved versions.
+ */
+import { defineTool } from "./tool-compat.js";
+export function resolveInventoryVersion(rawVersion) {
+    const trimmed = rawVersion.trim();
+    if (semver.valid(trimmed)) {
+        return semver.clean(trimmed) ?? trimmed;
+    }
+    let spec = trimmed;
+    if (spec.startsWith("npm:") && spec.includes("@")) {
+        spec = spec.slice(spec.lastIndexOf("@") + 1);
+    }
+    if (spec.startsWith("workspace:")) {
+        spec = spec.slice("workspace:".length).trim();
+    }
+    if (semver.valid(spec)) {
+        return semver.clean(spec) ?? spec;
+    }
+    try {
+        const min = semver.minVersion(spec);
+        if (min?.version && semver.valid(min.version)) {
+            return min.version;
+        }
+    }
+    catch {
+        // Invalid semver range syntax
+    }
+    try {
+        const coerced = semver.coerce(spec);
+        if (coerced?.version && semver.valid(coerced.version)) {
+            return coerced.version;
+        }
+    }
+    catch {
+        // Coercion failure
+    }
+    return semver.clean(trimmed) ?? trimmed;
+}
+export const checkInventoryTool = defineTool({
+    description: "Read the project's package.json and installed dependencies to list packages and exact versions. Must be called before checking version matches.",
+    inputSchema: z.object({
+        cwd: z.string().describe("Absolute path to the consumer project's root directory"),
+        packageManager: z
+            .enum(["npm", "pnpm", "yarn", "bun", "deno"])
+            .optional()
+            .describe("Package manager used by the target project (auto-detected if omitted)"),
+        policy: z
+            .string()
+            .optional()
+            .describe("Optional path to .github/autoremediator.yml policy file"),
+        workspace: z.string().optional().describe("Optional workspace/package selector for monorepos"),
+    }),
+    execute: async ({ cwd, packageManager, policy, workspace, }) => {
+        let pkgJson;
+        try {
+            pkgJson = JSON.parse(readFileSync(join(cwd, "package.json"), "utf8"));
+        }
+        catch {
+            return {
+                packages: [],
+                error: `Could not read package.json in "${cwd}". Is this a Node.js project?`,
+            };
+        }
+        const pm = packageManager ?? detectPackageManager(cwd);
+        const loadedPolicy = loadPolicy(cwd, policy);
+        const listCommand = resolveListCommand(pm, {
+            ...loadedPolicy.constraints,
+            workspace: workspace ?? loadedPolicy.constraints?.workspace,
+        });
+        let installedVersions = new Map();
+        if (pm === "deno") {
+            // Deno inventory is built from deno.lock directly, not a shell command.
+            installedVersions = resolveDenoInventory(cwd);
+        }
+        else {
+            try {
+                const [cmd, ...args] = listCommand;
+                if (cmd) {
+                    const listResult = await safeExeca(cmd, args, {
+                        cwd,
+                        stdio: "pipe",
+                        reject: false,
+                    });
+                    installedVersions = parseListOutput(pm, listResult.stdout || "");
+                }
+            }
+            catch {
+                // Fallback to package.json-only view when list command fails.
+            }
+        }
+        const packages = [];
+        for (const [name, version] of installedVersions.entries()) {
+            const declaringWorkspace = findDeclaringWorkspacePackage(cwd, name, workspace);
+            const isDirect = Boolean(pkgJson.dependencies?.[name]) ||
+                Boolean(pkgJson.devDependencies?.[name]) ||
+                Boolean(pkgJson.peerDependencies?.[name]) ||
+                Boolean(declaringWorkspace);
+            packages.push({
+                name,
+                version,
+                type: isDirect ? "direct" : "transitive",
+            });
+        }
+        if (packages.length === 0) {
+            // Fallback: direct deps from package.json (best-effort versions)
+            const allDeps = {
+                ...pkgJson.dependencies,
+                ...pkgJson.devDependencies,
+                ...pkgJson.peerDependencies,
+            };
+            for (const [name, rawVersion] of Object.entries(allDeps)) {
+                const version = resolveInventoryVersion(rawVersion);
+                packages.push({ name, version, type: "direct" });
+            }
+        }
+        return { packages };
+    },
+});
+//# sourceMappingURL=check-inventory.js.map

package/dist/remediation/tools/check-inventory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-inventory.js","sourceRoot":"","sources":["../../../src/remediation/tools/check-inventory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,kBAAkB,GACnB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,+CAA+C,CAAC;AACrF,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAExD,OAAO,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAC5E;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAQ9C,MAAM,UAAU,uBAAuB,CAAC,UAAkB;IACxD,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC;IAC1C,CAAC;IAED,IAAI,IAAI,GAAG,OAAO,CAAC;IACnB,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAClC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IACpC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9C,OAAO,GAAG,CAAC,OAAO,CAAC;QACrB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,8BAA8B;IAChC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,OAAO,EAAE,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,OAAO,OAAO,CAAC,OAAO,CAAC;QACzB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,mBAAmB;IACrB,CAAC;IAED,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,UAAU,CAAC;IAC3C,WAAW,EACT,iJAAiJ;IACnJ,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,wDAAwD,CAAC;QAClF,cAAc,EAAE,CAAC;aACd,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;aAC5C,QAAQ,EAAE;aACV,QAAQ,CAAC,uEAAuE,CAAC;QACpF,MAAM,EAAE,CAAC;aACN,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CAAC,yDAAyD,CAAC;QACtE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mDAAmD,CAAC;KAC/F,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,EACd,GAAG,EACH,cAAc,EACd,MAAM,EACN,SAAS,GACV,EAA6D,EAAE;QAC9D,IAAI,OAAoB,CAAC;QAEzB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAgB,CAAC;QACvF,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,QAAQ,EAAE,EAAE;gBACZ,KAAK,EAAE,mCAAmC,GAAG,+BAA+B;aAC7E,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,GAAG,cAAc,IAAI,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACvD,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,kBAAkB,CAAC,EAAE,EAAE;YACzC,GAAG,YAAY,CAAC,WAAW;YAC3B,SAAS,EAAE,SAAS,IAAI,YAAY,CAAC,WAAW,EAAE,SAAS;SAC5D,CAAC,CAAC;QACH,IAAI,iBAAiB,GAAG,IAAI,GAAG,EAAkB,CAAC;QAElD,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YAClB,wEAAwE;YACxE,iBAAiB,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,WAAW,CAAC;gBACnC,IAAI,GAAG,EAAE,CAAC;oBACR,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE;wBAC5C,GAAG;wBACH,KAAK,EAAE,MAAM;wBACb,MAAM,EAAE,KAAK;qBACd,CAAC,CAAC;oBACH,iBAAiB,GAAG,eAAe,CAAC,EAAE,EAAE,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;gBACnE,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,8DAA8D;YAChE,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAuB,EAAE,CAAC;QAExC,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,iBAAiB,CAAC,OAAO,EAAE,EAAE,CAAC;YAC1D,MAAM,kBAAkB,GAAG,6BAA6B,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;YAC/E,MAAM,QAAQ,GACZ,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC;gBACrC,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC;gBACxC,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,CAAC;gBACzC,OAAO,CAAC,kBAAkB,CAAC,CAAC;YAE9B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI;gBACJ,OAAO;gBACP,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;aACzC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,iEAAiE;YACjE,MAAM,OAAO,GAAG;gBACd,GAAG,OAAO,CAAC,YAAY;gBACvB,GAAG,OAAO,CAAC,eAAe;gBAC1B,GAAG,OAAO,CAAC,gBAAgB;aAC5B,CAAC;YACF,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzD,MAAM,OAAO,GAAG,uBAAuB,CAAC,UAAU,CAAC,CAAC;gBACpD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtB,CAAC;CACF,CAAC,CAAC"}

package/dist/remediation/tools/check-reachability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"check-reachability.d.ts","sourceRoot":"","sources":["../../../src/remediation/tools/check-reachability.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAc5F,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACjC;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,CAqB9E;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,mBAAmB,GAC3B,MAAM,GAAG,SAAS,CAmBpB;AAiED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAC7C,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,mBAAmB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAM9D;AAED,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,EACrB,sBAAsB,EAAE,GAAG,CAAC,MAAM,CAAC,GAClC;IAAE,gBAAgB,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAmBvD;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,mBAAmB,EAC9B,yBAAyB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GACtC,kBAAkB,EAAE,CAkItB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,mBAAmB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EACxC,YAAY,CAAC,EAAE,MAAM,GACpB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CA6DzC;AAED,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,MAAM,GACpB,sBAAsB,CAoIxB;AAED,eAAO,MAAM,qBAAqB;;;;0CAchC,CAAC"}
+{"version":3,"file":"check-reachability.d.ts","sourceRoot":"","sources":["../../../src/remediation/tools/check-reachability.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAe5F,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACjC;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,CAqB9E;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,mBAAmB,GAC3B,MAAM,GAAG,SAAS,CAmBpB;AAiED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,oBAAoB,CAAC,WAAW,CAAC,CAAC;IAC7C,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,mBAAmB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAM9D;AAED,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,EACrB,sBAAsB,EAAE,GAAG,CAAC,MAAM,CAAC,GAClC;IAAE,gBAAgB,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAmBvD;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,mBAAmB,EAC9B,yBAAyB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GACtC,kBAAkB,EAAE,CAkItB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,mBAAmB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EACxC,YAAY,CAAC,EAAE,MAAM,GACpB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CA6DzC;AAED,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,MAAM,GACpB,sBAAsB,CAoIxB;AAED,eAAO,MAAM,qBAAqB;;;;0CAchC,CAAC"}

package/dist/remediation/tools/check-reachability.js

@@ -0,0 +1,464 @@
+/**
+ * Tool: check-reachability (Pillar 3.1)
+ *
+ * Uses the high-performance Oxc (Oxidation Compiler) AST parser to scan project
+ * source files for static imports, dynamic imports, CommonJS require calls,
+ * and re-exports. Performs interprocedural AST call-graph tracing for target symbols
+ * and resolves tsconfig/jsconfig path aliases.
+ */
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { isAbsolute, join, resolve } from "node:path";
+import { parseSync } from "oxc-parser";
+import { z } from "zod";
+import { defineTool } from "./tool-compat.js";
+const SOURCE_EXTENSIONS = new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".mts", ".cts"]);
+const IGNORED_DIRS = new Set([
+    "node_modules",
+    ".git",
+    "dist",
+    "build",
+    "coverage",
+    ".next",
+    ".turbo",
+    ".pnpm-store",
+]);
+/**
+ * Loads compilerOptions.baseUrl and compilerOptions.paths from tsconfig.json or jsconfig.json
+ */
+export function loadTsconfigPaths(cwd) {
+    for (const configName of ["tsconfig.json", "jsconfig.json"]) {
+        const fullPath = join(cwd, configName);
+        if (!existsSync(fullPath))
+            continue;
+        try {
+            const raw = readFileSync(fullPath, "utf8");
+            // Remove trailing commas / comments if any for robust parsing
+            const cleaned = raw.replaceAll(/\/\*[\s\S]*?\*\/|\/\/.*/g, "");
+            const parsed = JSON.parse(cleaned);
+            const compilerOptions = parsed.compilerOptions;
+            if (compilerOptions?.paths) {
+                return {
+                    baseUrl: compilerOptions.baseUrl ? resolve(cwd, compilerOptions.baseUrl) : cwd,
+                    paths: compilerOptions.paths,
+                };
+            }
+        }
+        catch {
+            // Ignore invalid config
+        }
+    }
+    return undefined;
+}
+/**
+ * Resolves an aliased import path according to tsconfig paths mapping
+ */
+export function resolveAliasedPath(importSource, config) {
+    if (!config?.paths || isAbsolute(importSource) || importSource.startsWith(".")) {
+        return undefined;
+    }
+    for (const [pattern, replacements] of Object.entries(config.paths)) {
+        if (pattern === importSource && replacements[0]) {
+            return resolve(config.baseUrl, replacements[0]);
+        }
+        if (pattern.endsWith("/*")) {
+            const prefix = pattern.slice(0, -2);
+            if (importSource.startsWith(prefix)) {
+                const suffix = importSource.slice(prefix.length);
+                const replacement = replacements[0]?.slice(0, -2) ?? "";
+                return resolve(config.baseUrl, replacement + suffix);
+            }
+        }
+    }
+    return undefined;
+}
+function* walkSourceFiles(dir) {
+    let entries;
+    try {
+        entries = readdirSync(dir);
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        if (IGNORED_DIRS.has(entry))
+            continue;
+        const full = join(dir, entry);
+        let stat;
+        try {
+            stat = statSync(full);
+        }
+        catch {
+            continue;
+        }
+        if (stat.isDirectory()) {
+            yield* walkSourceFiles(full);
+        }
+        else if (SOURCE_EXTENSIONS.has(full.slice(full.lastIndexOf(".")))) {
+            yield full;
+        }
+    }
+}
+function matchesPackage(sourceValue, packageName, tsconfig) {
+    if (sourceValue === packageName || sourceValue.startsWith(`${packageName}/`)) {
+        return true;
+    }
+    const resolved = resolveAliasedPath(sourceValue, tsconfig);
+    if (resolved && (resolved.includes(`/${packageName}/`) || resolved.endsWith(`/${packageName}`))) {
+        return true;
+    }
+    return false;
+}
+function walkAst(node, visitor) {
+    if (!node || typeof node !== "object")
+        return;
+    visitor(node);
+    for (const key of Object.keys(node)) {
+        if (key === "parent" || key === "start" || key === "end")
+            continue;
+        const value = node[key];
+        if (Array.isArray(value)) {
+            for (const child of value) {
+                if (child && typeof child === "object" && "type" in child) {
+                    walkAst(child, visitor);
+                }
+            }
+        }
+        else if (value && typeof value === "object" && "type" in value) {
+            walkAst(value, visitor);
+        }
+    }
+}
+export function toRootPackageName(importSource) {
+    if (importSource.startsWith("@")) {
+        const parts = importSource.split("/");
+        return parts.slice(0, 2).join("/");
+    }
+    return importSource.split("/")[0] ?? importSource;
+}
+export function findTransitiveDependencyPath(cwd, targetPackage, importedDirectPackages) {
+    for (const directPkg of importedDirectPackages) {
+        const manifestPath = join(cwd, "node_modules", directPkg, "package.json");
+        if (!existsSync(manifestPath))
+            continue;
+        try {
+            const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+            if (manifest.dependencies?.[targetPackage]) {
+                return {
+                    directDependency: directPkg,
+                    version: manifest.dependencies[targetPackage],
+                };
+            }
+        }
+        catch {
+            // Ignore read errors
+        }
+    }
+    return null;
+}
+/**
+ * Extracts package references and imported symbols using the Oxc AST parser.
+ */
+export function extractPackageReferences(filename, content, packageName, tsconfig, outImportedDirectPackages) {
+    const results = [];
+    let parseResult;
+    try {
+        parseResult = parseSync(filename, content);
+    }
+    catch {
+        return results;
+    }
+    if (!parseResult?.program)
+        return results;
+    walkAst(parseResult.program, (node) => {
+        // 1. Static Import Declarations: import ... from 'pkg'
+        if (node.type === "ImportDeclaration") {
+            const source = node.source;
+            if (source?.value && !source.value.startsWith(".") && !isAbsolute(source.value)) {
+                outImportedDirectPackages?.add(toRootPackageName(source.value));
+            }
+            if (source?.value && matchesPackage(source.value, packageName, tsconfig)) {
+                const symbols = [];
+                const importedIdentifiers = new Map();
+                const specifiers = (node.specifiers ?? []);
+                for (const spec of specifiers) {
+                    if (spec.type === "ImportSpecifier") {
+                        const imported = spec.imported;
+                        const local = spec.local;
+                        const importedName = imported?.name ?? imported?.value ?? local?.name;
+                        const localName = local?.name ?? importedName;
+                        if (importedName && localName) {
+                            symbols.push(importedName);
+                            importedIdentifiers.set(localName, importedName);
+                        }
+                    }
+                    else if (spec.type === "ImportDefaultSpecifier") {
+                        const local = spec.local;
+                        symbols.push("default");
+                        if (local?.name)
+                            importedIdentifiers.set(local.name, "default");
+                    }
+                    else if (spec.type === "ImportNamespaceSpecifier") {
+                        const local = spec.local;
+                        symbols.push("*");
+                        if (local?.name)
+                            importedIdentifiers.set(local.name, "*");
+                    }
+                }
+                results.push({
+                    matchType: "import",
+                    symbols: symbols.length > 0 ? symbols : ["*"],
+                    importedIdentifiers,
+                    isReExported: false,
+                });
+            }
+        }
+        // 2. Dynamic Import Expressions: import('pkg')
+        if (node.type === "ImportExpression") {
+            const source = node.source;
+            if (source?.value && !source.value.startsWith(".") && !isAbsolute(source.value)) {
+                outImportedDirectPackages?.add(toRootPackageName(source.value));
+            }
+            if (source?.value && matchesPackage(source.value, packageName, tsconfig)) {
+                results.push({
+                    matchType: "dynamic-import",
+                    symbols: ["*"],
+                    importedIdentifiers: new Map(),
+                    isReExported: false,
+                });
+            }
+        }
+        // 3. CommonJS Require Calls: require('pkg')
+        if (node.type === "CallExpression" &&
+            node.callee?.name === "require" &&
+            Array.isArray(node.arguments) &&
+            node.arguments.length > 0) {
+            const firstArg = node.arguments[0];
+            if (firstArg?.value &&
+                typeof firstArg.value === "string" &&
+                !firstArg.value.startsWith(".") &&
+                !isAbsolute(firstArg.value)) {
+                outImportedDirectPackages?.add(toRootPackageName(firstArg.value));
+            }
+            if (firstArg?.value &&
+                typeof firstArg.value === "string" &&
+                matchesPackage(firstArg.value, packageName, tsconfig)) {
+                results.push({
+                    matchType: "require",
+                    symbols: ["*"],
+                    importedIdentifiers: new Map(),
+                    isReExported: false,
+                });
+            }
+        }
+        // 4. Re-export Declarations: export ... from 'pkg'
+        if (node.type === "ExportNamedDeclaration" || node.type === "ExportAllDeclaration") {
+            const source = node.source;
+            if (source?.value && !source.value.startsWith(".") && !isAbsolute(source.value)) {
+                outImportedDirectPackages?.add(toRootPackageName(source.value));
+            }
+            if (source?.value && matchesPackage(source.value, packageName, tsconfig)) {
+                const symbols = [];
+                if (node.type === "ExportAllDeclaration") {
+                    symbols.push("*");
+                }
+                else {
+                    const specifiers = (node.specifiers ?? []);
+                    for (const spec of specifiers) {
+                        const local = spec.local;
+                        const exported = spec.exported;
+                        const name = exported?.name ?? exported?.value ?? local?.name ?? local?.value;
+                        if (name)
+                            symbols.push(name);
+                    }
+                }
+                results.push({
+                    matchType: "re-export",
+                    symbols: symbols.length > 0 ? symbols : ["*"],
+                    importedIdentifiers: new Map(),
+                    isReExported: true,
+                });
+            }
+        }
+    });
+    return results;
+}
+/**
+ * Traces AST call expressions to see if the vulnerable symbol is actually invoked.
+ */
+export function traceSymbolInvocations(content, filename, importedIdentifiers, targetSymbol) {
+    if (!targetSymbol) {
+        return { invoked: true, callCount: 1 };
+    }
+    let parseResult;
+    try {
+        parseResult = parseSync(filename, content);
+    }
+    catch {
+        return { invoked: true, callCount: 1 };
+    }
+    if (!parseResult?.program) {
+        return { invoked: true, callCount: 1 };
+    }
+    let callCount = 0;
+    walkAst(parseResult.program, (node) => {
+        // Check direct function calls: func() or new Func()
+        if (node.type === "CallExpression" || node.type === "NewExpression") {
+            const callee = node.callee;
+            if (!callee)
+                return;
+            // 1. Direct identifier invocation: template()
+            if (callee.type === "Identifier") {
+                const name = callee.name;
+                if (name) {
+                    const importedName = importedIdentifiers.get(name);
+                    if (importedName === targetSymbol || name === targetSymbol) {
+                        callCount++;
+                    }
+                }
+            }
+            // 2. Member expression invocation: _.template() or lodash.template()
+            if (callee.type === "MemberExpression") {
+                const object = callee.object;
+                const property = callee.property;
+                const propName = property?.name ?? property?.value;
+                if (object?.name && propName) {
+                    const importedName = importedIdentifiers.get(object.name);
+                    if ((importedName === "*" ||
+                        importedName === "default" ||
+                        object.name === "lodash" ||
+                        object.name === "_") &&
+                        propName === targetSymbol) {
+                        callCount++;
+                    }
+                }
+            }
+        }
+    });
+    return {
+        invoked: callCount > 0,
+        callCount,
+    };
+}
+export function assessPackageReachability(cwd, packageName, targetSymbol) {
+    const tsconfig = loadTsconfigPaths(cwd);
+    const evidence = [];
+    let scanned = 0;
+    let hasReExport = false;
+    let totalInvocations = 0;
+    let hasPackageImport = false;
+    const importedDirectPackages = new Set();
+    for (const filePath of walkSourceFiles(cwd)) {
+        scanned++;
+        let content;
+        try {
+            content = readFileSync(filePath, "utf8");
+        }
+        catch {
+            continue;
+        }
+        const refs = extractPackageReferences(filePath, content, packageName, tsconfig, importedDirectPackages);
+        if (refs.length > 0) {
+            hasPackageImport = true;
+        }
+        for (const ref of refs) {
+            if (ref.isReExported) {
+                hasReExport = true;
+            }
+            const matchesSymbol = !targetSymbol ||
+                ref.symbols.includes("*") ||
+                ref.symbols.includes("default") ||
+                ref.symbols.includes(targetSymbol);
+            if (matchesSymbol) {
+                let invoked = true;
+                let callCount = 1;
+                if (targetSymbol && !ref.isReExported) {
+                    const trace = traceSymbolInvocations(content, filePath, ref.importedIdentifiers, targetSymbol);
+                    invoked = trace.invoked;
+                    callCount = trace.callCount;
+                    totalInvocations += callCount;
+                }
+                evidence.push({
+                    filePath,
+                    matchType: ref.matchType,
+                    importedSymbols: ref.symbols,
+                    symbol: targetSymbol,
+                    invoked,
+                    callCount,
+                });
+            }
+        }
+    }
+    if (scanned === 0) {
+        return {
+            packageName,
+            status: "unknown",
+            reason: `No source files found under ${cwd}`,
+            reachabilityBasis: "unknown",
+        };
+    }
+    if (!hasPackageImport) {
+        const transitivePath = findTransitiveDependencyPath(cwd, packageName, importedDirectPackages);
+        if (transitivePath) {
+            return {
+                packageName,
+                status: "reachable",
+                reason: `Package '${packageName}' is a transitive dependency of imported package '${transitivePath.directDependency}'`,
+                reachabilityBasis: "transitive-path-found",
+                evidence: [],
+            };
+        }
+        return {
+            packageName,
+            status: "not-reachable",
+            reason: `No source files reference '${packageName}'`,
+            reachabilityBasis: "import-present",
+            justification: "code_not_in_execute_path",
+            evidence: [],
+        };
+    }
+    // If targetSymbol was specified
+    if (targetSymbol) {
+        const isReachable = hasReExport || totalInvocations > 0;
+        if (isReachable) {
+            return {
+                packageName,
+                status: "reachable",
+                reason: hasReExport
+                    ? `Package '${packageName}' re-exports symbols to external consumers`
+                    : `Found ${totalInvocations} call-site(s) invoking vulnerable symbol '${targetSymbol}' across ${evidence.filter((e) => e.invoked).length} file(s)`,
+                reachabilityBasis: "call-path-found",
+                evidence,
+            };
+        }
+        return {
+            packageName,
+            status: "not-reachable",
+            reason: `Package '${packageName}' is imported but vulnerable symbol '${targetSymbol}' is never invoked in any execution path`,
+            reachabilityBasis: "call-graph-uninvoked",
+            justification: "code_not_in_execute_path",
+            evidence,
+        };
+    }
+    return {
+        packageName,
+        status: "reachable",
+        reason: `Found ${evidence.length} source file(s) referencing '${packageName}'`,
+        reachabilityBasis: "import-present",
+        evidence,
+    };
+}
+export const checkReachabilityTool = defineTool({
+    description: "Scan project source files for import/require/export references and perform AST call-graph reachability analysis for a package and vulnerable symbols using Oxc AST parser. Returns reachability status: reachable, not-reachable, or unknown.",
+    inputSchema: z.object({
+        cwd: z.string().describe("Project root directory to scan"),
+        packageName: z.string().describe("Package name to search for (e.g. 'lodash' or '@babel/core')"),
+        symbol: z
+            .string()
+            .optional()
+            .describe("Optional vulnerable function/symbol name to check specifically in call graph"),
+    }),
+    execute({ cwd, packageName, symbol }) {
+        return assessPackageReachability(cwd, packageName, symbol);
+    },
+});
+//# sourceMappingURL=check-reachability.js.map

package/dist/remediation/tools/check-reachability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-reachability.js","sourceRoot":"","sources":["../../../src/remediation/tools/check-reachability.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,SAAS,EAAoB,MAAM,YAAY,CAAC;AACzD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAClG,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,cAAc;IACd,MAAM;IACN,MAAM;IACN,OAAO;IACP,UAAU;IACV,OAAO;IACP,QAAQ;IACR,aAAa;CACd,CAAC,CAAC;AAOH;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,KAAK,MAAM,UAAU,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC,EAAE,CAAC;QAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;QACvC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,SAAS;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC3C,8DAA8D;YAC9D,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC,0BAA0B,EAAE,EAAE,CAAC,CAAC;YAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnC,MAAM,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;YAC/C,IAAI,eAAe,EAAE,KAAK,EAAE,CAAC;gBAC3B,OAAO;oBACL,OAAO,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG;oBAC9E,KAAK,EAAE,eAAe,CAAC,KAAK;iBAC7B,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAChC,YAAoB,EACpB,MAA4B;IAE5B,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,UAAU,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/E,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,KAAK,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACnE,IAAI,OAAO,KAAK,YAAY,IAAI,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,OAAO,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACpC,IAAI,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACjD,MAAM,WAAW,GAAG,YAAY,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACxD,OAAO,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,QAAQ,CAAC,CAAC,eAAe,CAAC,GAAW;IACnC,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YACH,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YACvB,KAAK,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;aAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,CAAC;QACb,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CACrB,WAAmB,EACnB,WAAmB,EACnB,QAA8B;IAE9B,IAAI,WAAW,KAAK,WAAW,IAAI,WAAW,CAAC,UAAU,CAAC,GAAG,WAAW,GAAG,CAAC,EAAE,CAAC;QAC7E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC3D,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,WAAW,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;QAChG,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAOD,SAAS,OAAO,CAAC,IAAgC,EAAE,OAAgC;IACjF,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO;IAC9C,OAAO,CAAC,IAAI,CAAC,CAAC;IAEd,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,KAAK;YAAE,SAAS;QACnE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;gBAC1B,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;oBAC1D,OAAO,CAAC,KAAgB,EAAE,OAAO,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;YACjE,OAAO,CAAC,KAAgB,EAAE,OAAO,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;AACH,CAAC;AASD,MAAM,UAAU,iBAAiB,CAAC,YAAoB;IACpD,IAAI,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,GAAW,EACX,aAAqB,EACrB,sBAAmC;IAEnC,KAAK,MAAM,SAAS,IAAI,sBAAsB,EAAE,CAAC;QAC/C,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;YAAE,SAAS;QACxC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAE7D,CAAC;YACF,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC3C,OAAO;oBACL,gBAAgB,EAAE,SAAS;oBAC3B,OAAO,EAAE,QAAQ,CAAC,YAAY,CAAC,aAAa,CAAC;iBAC9C,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,qBAAqB;QACvB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAAgB,EAChB,OAAe,EACf,WAAmB,EACnB,QAA8B,EAC9B,yBAAuC;IAEvC,MAAM,OAAO,GAAyB,EAAE,CAAC;IAEzC,IAAI,WAAoC,CAAC;IACzC,IAAI,CAAC;QACH,WAAW,GAAG,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,CAAC,WAAW,EAAE,OAAO;QAAE,OAAO,OAAO,CAAC;IAE1C,OAAO,CAAC,WAAW,CAAC,OAA6B,EAAE,CAAC,IAAI,EAAE,EAAE;QAC1D,uDAAuD;QACvD,IAAI,IAAI,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACtC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAwC,CAAC;YAC7D,IAAI,MAAM,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChF,yBAAyB,EAAE,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAClE,CAAC;YACD,IAAI,MAAM,EAAE,KAAK,IAAI,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACzE,MAAM,OAAO,GAAa,EAAE,CAAC;gBAC7B,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAkB,CAAC;gBACtD,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAc,CAAC;gBAExD,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;oBAC9B,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;wBACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAyD,CAAC;wBAChF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAsC,CAAC;wBAC1D,MAAM,YAAY,GAAG,QAAQ,EAAE,IAAI,IAAI,QAAQ,EAAE,KAAK,IAAI,KAAK,EAAE,IAAI,CAAC;wBACtE,MAAM,SAAS,GAAG,KAAK,EAAE,IAAI,IAAI,YAAY,CAAC;wBAC9C,IAAI,YAAY,IAAI,SAAS,EAAE,CAAC;4BAC9B,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;4BAC3B,mBAAmB,CAAC,GAAG,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;wBACnD,CAAC;oBACH,CAAC;yBAAM,IAAI,IAAI,CAAC,IAAI,KAAK,wBAAwB,EAAE,CAAC;wBAClD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAsC,CAAC;wBAC1D,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;wBACxB,IAAI,KAAK,EAAE,IAAI;4BAAE,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBAClE,CAAC;yBAAM,IAAI,IAAI,CAAC,IAAI,KAAK,0BAA0B,EAAE,CAAC;wBACpD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAsC,CAAC;wBAC1D,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;wBAClB,IAAI,KAAK,EAAE,IAAI;4BAAE,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;oBAC5D,CAAC;gBACH,CAAC;gBAED,OAAO,CAAC,IAAI,CAAC;oBACX,SAAS,EAAE,QAAQ;oBACnB,OAAO,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;oBAC7C,mBAAmB;oBACnB,YAAY,EAAE,KAAK;iBACpB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,+CAA+C;QAC/C,IAAI,IAAI,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAwC,CAAC;YAC7D,IAAI,MAAM,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChF,yBAAyB,EAAE,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAClE,CAAC;YACD,IAAI,MAAM,EAAE,KAAK,IAAI,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACzE,OAAO,CAAC,IAAI,CAAC;oBACX,SAAS,EAAE,gBAAgB;oBAC3B,OAAO,EAAE,CAAC,GAAG,CAAC;oBACd,mBAAmB,EAAE,IAAI,GAAG,EAAE;oBAC9B,YAAY,EAAE,KAAK;iBACpB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,4CAA4C;QAC5C,IACE,IAAI,CAAC,IAAI,KAAK,gBAAgB;YAC7B,IAAI,CAAC,MAA4B,EAAE,IAAI,KAAK,SAAS;YACtD,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;YAC7B,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EACzB,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAmC,CAAC;YACrE,IACE,QAAQ,EAAE,KAAK;gBACf,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ;gBAClC,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;gBAC/B,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC3B,CAAC;gBACD,yBAAyB,EAAE,GAAG,CAAC,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YACpE,CAAC;YACD,IACE,QAAQ,EAAE,KAAK;gBACf,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ;gBAClC,cAAc,CAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,EACrD,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC;oBACX,SAAS,EAAE,SAAS;oBACpB,OAAO,EAAE,CAAC,GAAG,CAAC;oBACd,mBAAmB,EAAE,IAAI,GAAG,EAAE;oBAC9B,YAAY,EAAE,KAAK;iBACpB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,mDAAmD;QACnD,IAAI,IAAI,CAAC,IAAI,KAAK,wBAAwB,IAAI,IAAI,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;YACnF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAwC,CAAC;YAC7D,IAAI,MAAM,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChF,yBAAyB,EAAE,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAClE,CAAC;YACD,IAAI,MAAM,EAAE,KAAK,IAAI,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACzE,MAAM,OAAO,GAAa,EAAE,CAAC;gBAC7B,IAAI,IAAI,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;oBACzC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACpB,CAAC;qBAAM,CAAC;oBACN,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAc,CAAC;oBACxD,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;wBAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAsD,CAAC;wBAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAyD,CAAC;wBAChF,MAAM,IAAI,GAAG,QAAQ,EAAE,IAAI,IAAI,QAAQ,EAAE,KAAK,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,EAAE,KAAK,CAAC;wBAC9E,IAAI,IAAI;4BAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC/B,CAAC;gBACH,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC;oBACX,SAAS,EAAE,WAAW;oBACtB,OAAO,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;oBAC7C,mBAAmB,EAAE,IAAI,GAAG,EAAE;oBAC9B,YAAY,EAAE,IAAI;iBACnB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAe,EACf,QAAgB,EAChB,mBAAwC,EACxC,YAAqB;IAErB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACzC,CAAC;IAED,IAAI,WAAoC,CAAC;IACzC,IAAI,CAAC;QACH,WAAW,GAAG,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACzC,CAAC;IAED,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACzC,CAAC;IAED,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,OAAO,CAAC,WAAW,CAAC,OAA6B,EAAE,CAAC,IAAI,EAAE,EAAE;QAC1D,oDAAoD;QACpD,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YACpE,MAAM,MAAM,GAAG,IAAI,CAAC,MAA6B,CAAC;YAClD,IAAI,CAAC,MAAM;gBAAE,OAAO;YAEpB,8CAA8C;YAC9C,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACjC,MAAM,IAAI,GAAI,MAA4B,CAAC,IAAI,CAAC;gBAChD,IAAI,IAAI,EAAE,CAAC;oBACT,MAAM,YAAY,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBACnD,IAAI,YAAY,KAAK,YAAY,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;wBAC3D,SAAS,EAAE,CAAC;oBACd,CAAC;gBACH,CAAC;YACH,CAAC;YAED,qEAAqE;YACrE,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;gBACvC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAuC,CAAC;gBAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAyD,CAAC;gBAClF,MAAM,QAAQ,GAAG,QAAQ,EAAE,IAAI,IAAI,QAAQ,EAAE,KAAK,CAAC;gBAEnD,IAAI,MAAM,EAAE,IAAI,IAAI,QAAQ,EAAE,CAAC;oBAC7B,MAAM,YAAY,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;oBAC1D,IACE,CAAC,YAAY,KAAK,GAAG;wBACnB,YAAY,KAAK,SAAS;wBAC1B,MAAM,CAAC,IAAI,KAAK,QAAQ;wBACxB,MAAM,CAAC,IAAI,KAAK,GAAG,CAAC;wBACtB,QAAQ,KAAK,YAAY,EACzB,CAAC;wBACD,SAAS,EAAE,CAAC;oBACd,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,OAAO,EAAE,SAAS,GAAG,CAAC;QACtB,SAAS;KACV,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,GAAW,EACX,WAAmB,EACnB,YAAqB;IAErB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAE7B,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAU,CAAC;IAEjD,KAAK,MAAM,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,CAAC;QACV,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,MAAM,IAAI,GAAG,wBAAwB,CACnC,QAAQ,EACR,OAAO,EACP,WAAW,EACX,QAAQ,EACR,sBAAsB,CACvB,CAAC;QACF,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,gBAAgB,GAAG,IAAI,CAAC;QAC1B,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;gBACrB,WAAW,GAAG,IAAI,CAAC;YACrB,CAAC;YAED,MAAM,aAAa,GACjB,CAAC,YAAY;gBACb,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;gBACzB,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAC/B,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YAErC,IAAI,aAAa,EAAE,CAAC;gBAClB,IAAI,OAAO,GAAG,IAAI,CAAC;gBACnB,IAAI,SAAS,GAAG,CAAC,CAAC;gBAElB,IAAI,YAAY,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;oBACtC,MAAM,KAAK,GAAG,sBAAsB,CAClC,OAAO,EACP,QAAQ,EACR,GAAG,CAAC,mBAAmB,EACvB,YAAY,CACb,CAAC;oBACF,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;oBACxB,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;oBAC5B,gBAAgB,IAAI,SAAS,CAAC;gBAChC,CAAC;gBAED,QAAQ,CAAC,IAAI,CAAC;oBACZ,QAAQ;oBACR,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,eAAe,EAAE,GAAG,CAAC,OAAO;oBAC5B,MAAM,EAAE,YAAY;oBACpB,OAAO;oBACP,SAAS;iBACV,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,OAAO;YACL,WAAW;YACX,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,+BAA+B,GAAG,EAAE;YAC5C,iBAAiB,EAAE,SAAS;SAC7B,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,cAAc,GAAG,4BAA4B,CAAC,GAAG,EAAE,WAAW,EAAE,sBAAsB,CAAC,CAAC;QAC9F,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO;gBACL,WAAW;gBACX,MAAM,EAAE,WAAW;gBACnB,MAAM,EAAE,YAAY,WAAW,qDAAqD,cAAc,CAAC,gBAAgB,GAAG;gBACtH,iBAAiB,EAAE,uBAAuB;gBAC1C,QAAQ,EAAE,EAAE;aACb,CAAC;QACJ,CAAC;QAED,OAAO;YACL,WAAW;YACX,MAAM,EAAE,eAAe;YACvB,MAAM,EAAE,8BAA8B,WAAW,GAAG;YACpD,iBAAiB,EAAE,gBAAgB;YACnC,aAAa,EAAE,0BAA0B;YACzC,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IAED,gCAAgC;IAChC,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,WAAW,GAAG,WAAW,IAAI,gBAAgB,GAAG,CAAC,CAAC;QACxD,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO;gBACL,WAAW;gBACX,MAAM,EAAE,WAAW;gBACnB,MAAM,EAAE,WAAW;oBACjB,CAAC,CAAC,YAAY,WAAW,4CAA4C;oBACrE,CAAC,CAAC,SAAS,gBAAgB,6CAA6C,YAAY,YAAY,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,UAAU;gBACpJ,iBAAiB,EAAE,iBAAiB;gBACpC,QAAQ;aACT,CAAC;QACJ,CAAC;QAED,OAAO;YACL,WAAW;YACX,MAAM,EAAE,eAAe;YACvB,MAAM,EAAE,YAAY,WAAW,wCAAwC,YAAY,0CAA0C;YAC7H,iBAAiB,EAAE,sBAAsB;YACzC,aAAa,EAAE,0BAA0B;YACzC,QAAQ;SACT,CAAC;IACJ,CAAC;IAED,OAAO;QACL,WAAW;QACX,MAAM,EAAE,WAAW;QACnB,MAAM,EAAE,SAAS,QAAQ,CAAC,MAAM,gCAAgC,WAAW,GAAG;QAC9E,iBAAiB,EAAE,gBAAgB;QACnC,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,UAAU,CAAC;IAC9C,WAAW,EACT,+OAA+O;IACjP,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;QACpB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;QAC1D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6DAA6D,CAAC;QAC/F,MAAM,EAAE,CAAC;aACN,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CAAC,8EAA8E,CAAC;KAC5F,CAAC;IACF,OAAO,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,EAAE;QAClC,OAAO,yBAAyB,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;IAC7D,CAAC;CACF,CAAC,CAAC"}

package/dist/remediation/tools/fetch-package-source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetch-package-source.d.ts","sourceRoot":"","sources":["../../../src/remediation/tools/fetch-package-source.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB;;GAEG;AACH,UAAU,wBAAwB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,sBAAsB;;;;4CA0IjC,CAAC"}
+{"version":3,"file":"fetch-package-source.d.ts","sourceRoot":"","sources":["../../../src/remediation/tools/fetch-package-source.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAWxB;;GAEG;AACH,UAAU,wBAAwB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,sBAAsB;;;;4CA0IjC,CAAC"}