autoremediator 0.21.2 → 0.22.0

package/dist/remediation/verify/changes.js

@@ -0,0 +1,204 @@
+import { existsSync, readFileSync } from "node:fs";
+import { basename, join } from "node:path";
+import { parseGitPorcelainLine, parsePorcelainLines } from "../../platform/rollback.js";
+import { safeExeca } from "../../platform/safe-exec.js";
+/** Files that a dependency change legitimately rewrites. */
+const LOCKFILES = new Set([
+    "package-lock.json",
+    "npm-shrinkwrap.json",
+    "pnpm-lock.yaml",
+    "yarn.lock",
+    "bun.lock",
+    "bun.lockb",
+    "deno.lock",
+]);
+const SOURCE_EXTENSIONS = /\.(?:[cm]?[jt]sx?)$/;
+/** Which kind of file a changed path is. Forbidden paths are never acceptable to change. */
+export function classifyPath(path) {
+    const normal = path.replaceAll("\\", "/");
+    const name = basename(normal);
+    if (normal.startsWith(".git/") || normal.includes("/.git/"))
+        return "forbidden";
+    if (normal.startsWith("node_modules/") || normal.includes("/node_modules/"))
+        return "forbidden";
+    if (normal.startsWith(".github/workflows/"))
+        return "forbidden";
+    if (/^\.github\/autoremediator\.ya?ml$/.test(normal))
+        return "forbidden";
+    if (normal.startsWith(".autoremediator/"))
+        return "forbidden";
+    if (name === "package.json" || name === "deno.json" || name === "deno.jsonc")
+        return "manifest";
+    if (LOCKFILES.has(name))
+        return "lockfile";
+    if (normal.endsWith(".patch"))
+        return "patch";
+    if (normal.startsWith(".yarn/") || /^\.pnp\.[cm]?js$/.test(name))
+        return "install-state";
+    if (SOURCE_EXTENSIONS.test(name))
+        return "source";
+    return "other";
+}
+/** Paths that changed since `statusBefore`, from `git status`. Undefined outside a git repository. */
+export async function changedFilesSince(cwd, statusBefore, 
+/** Paths (relative to `cwd`) to leave out, such as bookkeeping the tool itself writes. */
+ignore = []) {
+    if (statusBefore === undefined)
+        return undefined;
+    let stdout;
+    let root;
+    try {
+        stdout = (await safeExeca("git", ["status", "--porcelain=v1", "-uall"], { cwd, stdio: "pipe" }))
+            .stdout;
+        root = (await safeExeca("git", ["rev-parse", "--show-prefix"], { cwd, stdio: "pipe" })).stdout.trim();
+    }
+    catch {
+        return undefined;
+    }
+    const before = new Set(statusBefore);
+    const paths = [];
+    for (const line of parsePorcelainLines(stdout)) {
+        if (before.has(line))
+            continue;
+        const parsed = parseGitPorcelainLine(line);
+        if (!parsed)
+            continue;
+        // Porcelain paths are relative to the repository root; report them relative to `cwd`.
+        paths.push(root && parsed.filePath.startsWith(root)
+            ? parsed.filePath.slice(root.length)
+            : parsed.filePath);
+    }
+    return paths.filter((path) => !ignore.includes(path) && !isRunState(path)).toSorted();
+}
+/**
+ * Files the tool itself writes while it works. Whether or not the project ignores `.autoremediator/`
+ * (only `init` adds the entry), these are not changes to the project.
+ */
+const RUN_STATE_PREFIXES = [
+    ".autoremediator/runs/",
+    ".autoremediator/locks/",
+    ".autoremediator/evidence/",
+    ".autoremediator/state/",
+];
+export function isRunState(path) {
+    const normal = path.replaceAll("\\", "/");
+    return RUN_STATE_PREFIXES.some((prefix) => normal.startsWith(prefix));
+}
+const DEPENDENCY_SECTIONS = [
+    "dependencies",
+    "devDependencies",
+    "optionalDependencies",
+    "peerDependencies",
+];
+/** `parent>child`, `child@<2.0.0` and `@scope/child@1` all name `child`. */
+export function overrideTarget(selector) {
+    const last = selector.split(">").at(-1)?.trim() ?? selector;
+    const at = last.lastIndexOf("@");
+    return at > 0 ? last.slice(0, at) : last;
+}
+function addOverrides(into, overrides) {
+    if (!overrides || typeof overrides !== "object")
+        return;
+    for (const [selector, value] of Object.entries(overrides)) {
+        if (typeof value === "string") {
+            into.push({ kind: "override", name: overrideTarget(selector), spec: `${selector}=${value}` });
+        }
+        else if (value && typeof value === "object") {
+            // npm nests overrides: { parent: { child: "1.0.0" } }
+            for (const [child, nested] of Object.entries(value)) {
+                if (typeof nested === "string") {
+                    into.push({
+                        kind: "override",
+                        name: overrideTarget(child),
+                        spec: `${selector}>${child}=${nested}`,
+                    });
+                }
+            }
+        }
+    }
+}
+/** Every dependency and override a manifest declares, as comparable entries. */
+export function readDeclarations(manifestText) {
+    if (manifestText === null)
+        return [];
+    let manifest;
+    try {
+        manifest = JSON.parse(manifestText);
+    }
+    catch {
+        return [];
+    }
+    const declarations = [];
+    for (const section of DEPENDENCY_SECTIONS) {
+        const entries = manifest[section];
+        if (!entries || typeof entries !== "object")
+            continue;
+        for (const [name, spec] of Object.entries(entries)) {
+            if (typeof spec === "string")
+                declarations.push({ kind: "dependency", name, spec });
+        }
+    }
+    addOverrides(declarations, manifest["overrides"]);
+    addOverrides(declarations, manifest["resolutions"]);
+    addOverrides(declarations, manifest["pnpm"]?.overrides);
+    return declarations;
+}
+/** What identifies a declaration across versions of a manifest: its name, and for overrides its selector. */
+const keyOf = (declaration) => declaration.kind === "override"
+    ? `override\0${declaration.name}\0${declaration.spec.split("=")[0]}`
+    : `dependency\0${declaration.name}`;
+const valueOf = (declaration) => declaration.kind === "override" && declaration.spec.includes("=")
+    ? declaration.spec.slice(declaration.spec.indexOf("=") + 1)
+    : declaration.spec;
+/** What changed between two manifests' declarations. */
+export function diffDeclarations(file, before, after) {
+    const previous = new Map(readDeclarations(before).map((declaration) => [keyOf(declaration), declaration]));
+    const current = new Map(readDeclarations(after).map((declaration) => [keyOf(declaration), declaration]));
+    const changes = [];
+    for (const [key, declaration] of current) {
+        const old = previous.get(key);
+        if (old === undefined) {
+            changes.push({
+                kind: declaration.kind,
+                name: declaration.name,
+                to: valueOf(declaration),
+                file,
+            });
+        }
+        else if (valueOf(old) !== valueOf(declaration)) {
+            changes.push({
+                kind: declaration.kind,
+                name: declaration.name,
+                from: valueOf(old),
+                to: valueOf(declaration),
+                file,
+            });
+        }
+    }
+    for (const [key, declaration] of previous) {
+        if (!current.has(key)) {
+            changes.push({
+                kind: declaration.kind,
+                name: declaration.name,
+                from: valueOf(declaration),
+                file,
+            });
+        }
+    }
+    return changes;
+}
+/** Declaration changes across every manifest the base snapshot knows, against the files now on disk. */
+export function manifestChanges(cwd, baseFiles) {
+    const changes = [];
+    for (const [file, before] of baseFiles) {
+        if (classifyPath(file) !== "manifest" || basename(file) !== "package.json")
+            continue;
+        const path = join(cwd, file);
+        const after = existsSync(path) ? readFileSync(path, "latin1") : null;
+        if (after === before)
+            continue;
+        changes.push(...diffDeclarations(file, before, after));
+    }
+    return changes;
+}
+//# sourceMappingURL=changes.js.map

package/dist/remediation/verify/changes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"changes.js","sourceRoot":"","sources":["../../../src/remediation/verify/changes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE3C,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACxF,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAExD,4DAA4D;AAC5D,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,mBAAmB;IACnB,qBAAqB;IACrB,gBAAgB;IAChB,WAAW;IACX,UAAU;IACV,WAAW;IACX,WAAW;CACZ,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,qBAAqB,CAAC;AAWhD,4FAA4F;AAC5F,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE9B,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,WAAW,CAAC;IAChF,IAAI,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAAE,OAAO,WAAW,CAAC;IAChG,IAAI,MAAM,CAAC,UAAU,CAAC,oBAAoB,CAAC;QAAE,OAAO,WAAW,CAAC;IAChE,IAAI,mCAAmC,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,WAAW,CAAC;IACzE,IAAI,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC;QAAE,OAAO,WAAW,CAAC;IAE9D,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,YAAY;QAAE,OAAO,UAAU,CAAC;IAChG,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,UAAU,CAAC;IAC3C,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,OAAO,CAAC;IAC9C,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,eAAe,CAAC;IACzF,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAClD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAW,EACX,YAA2C;AAC3C,0FAA0F;AAC1F,MAAM,GAAsB,EAAE;IAE9B,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACjD,IAAI,MAAc,CAAC;IACnB,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;aAC7F,MAAM,CAAC;QACV,IAAI,GAAG,CACL,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,eAAe,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAC/E,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACrC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,IAAI,IAAI,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/C,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAC/B,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,sFAAsF;QACtF,KAAK,CAAC,IAAI,CACR,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;YACtC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;YACpC,CAAC,CAAC,MAAM,CAAC,QAAQ,CACpB,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AACxF,CAAC;AAED;;;GAGG;AACH,MAAM,kBAAkB,GAAG;IACzB,uBAAuB;IACvB,wBAAwB;IACxB,2BAA2B;IAC3B,wBAAwB;CACzB,CAAC;AACF,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1C,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACxE,CAAC;AAeD,MAAM,mBAAmB,GAAG;IAC1B,cAAc;IACd,iBAAiB;IACjB,sBAAsB;IACtB,kBAAkB;CACnB,CAAC;AAEF,4EAA4E;AAC5E,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC;IAC5D,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3C,CAAC;AAED,SAAS,YAAY,CAAC,IAAmB,EAAE,SAAkB;IAC3D,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO;IACxD,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAoC,CAAC,EAAE,CAAC;QACrF,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,GAAG,QAAQ,IAAI,KAAK,EAAE,EAAE,CAAC,CAAC;QAChG,CAAC;aAAM,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9C,sDAAsD;YACtD,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;gBAC/E,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC/B,IAAI,CAAC,IAAI,CAAC;wBACR,IAAI,EAAE,UAAU;wBAChB,IAAI,EAAE,cAAc,CAAC,KAAK,CAAC;wBAC3B,IAAI,EAAE,GAAG,QAAQ,IAAI,KAAK,IAAI,MAAM,EAAE;qBACvC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,gBAAgB,CAAC,YAA2B;IAC1D,IAAI,YAAY,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACrC,IAAI,QAAiC,CAAC;IACtC,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAA4B,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,YAAY,GAAkB,EAAE,CAAC;IACvC,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,SAAS;QACtD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAkC,CAAC,EAAE,CAAC;YAC9E,IAAI,OAAO,IAAI,KAAK,QAAQ;gBAAE,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IACD,YAAY,CAAC,YAAY,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IAClD,YAAY,CAAC,YAAY,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;IACpD,YAAY,CAAC,YAAY,EAAG,QAAQ,CAAC,MAAM,CAAyC,EAAE,SAAS,CAAC,CAAC;IACjG,OAAO,YAAY,CAAC;AACtB,CAAC;AAYD,6GAA6G;AAC7G,MAAM,KAAK,GAAG,CAAC,WAAwB,EAAE,EAAE,CACzC,WAAW,CAAC,IAAI,KAAK,UAAU;IAC7B,CAAC,CAAC,aAAa,WAAW,CAAC,IAAI,KAAK,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;IACpE,CAAC,CAAC,eAAe,WAAW,CAAC,IAAI,EAAE,CAAC;AACxC,MAAM,OAAO,GAAG,CAAC,WAAwB,EAAE,EAAE,CAC3C,WAAW,CAAC,IAAI,KAAK,UAAU,IAAI,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;IAC/D,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC3D,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC;AAEvB,wDAAwD;AACxD,MAAM,UAAU,gBAAgB,CAC9B,IAAY,EACZ,MAAqB,EACrB,KAAoB;IAEpB,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,gBAAgB,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,CAAC,CACjF,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,gBAAgB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC,CAAC,CAChF,CAAC;IACF,MAAM,OAAO,GAAwB,EAAE,CAAC;IAExC,KAAK,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,OAAO,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,EAAE,EAAE,OAAO,CAAC,WAAW,CAAC;gBACxB,IAAI;aACL,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YACjD,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;gBAClB,EAAE,EAAE,OAAO,CAAC,WAAW,CAAC;gBACxB,IAAI;aACL,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,QAAQ,EAAE,CAAC;QAC1C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC;gBAC1B,IAAI;aACL,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,eAAe,CAC7B,GAAW,EACX,SAA6C;IAE7C,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QACvC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,UAAU,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,cAAc;YAAE,SAAS;QACrF,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACrE,IAAI,KAAK,KAAK,MAAM;YAAE,SAAS;QAC/B,OAAO,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/remediation/verify/checks.d.ts

@@ -0,0 +1,30 @@
+import type { AutoremediatorPolicy } from "../../platform/policy.js";
+import type { InventoryPackage, PackageManager } from "../../platform/types.js";
+import { type DeclarationChange } from "./changes.js";
+import type { CheckName, CheckStatus, VerifyOptions, VerifyRequest } from "./types.js";
+export interface CheckOutcome {
+    status: CheckStatus;
+    message: string;
+    details?: string[];
+    command?: string[];
+}
+/** Shared, lazily computed facts about the change, so checks do not repeat the work. */
+export interface CheckContext {
+    request: VerifyRequest;
+    options: VerifyOptions;
+    packageManager: PackageManager;
+    policy: AutoremediatorPolicy;
+    /** Set when the policy file exists but could not be read; the `policy` check fails on it. */
+    policyError?: string;
+    changedFiles: () => Promise<string[] | undefined>;
+    changes: () => DeclarationChange[];
+    inventory: () => Promise<{
+        packages: InventoryPackage[];
+    } | {
+        error: string;
+    }>;
+}
+export type CheckFn = (context: CheckContext) => Promise<CheckOutcome>;
+export declare function createCheckContext(request: VerifyRequest): CheckContext;
+export declare const CHECKS: Record<CheckName, CheckFn>;
+//# sourceMappingURL=checks.d.ts.map

package/dist/remediation/verify/checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../../../src/remediation/verify/checks.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAIrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAIhF,OAAO,EAGL,KAAK,iBAAiB,EAEvB,MAAM,cAAc,CAAC;AAEtB,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEvF,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,wFAAwF;AACxF,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,aAAa,CAAC;IACvB,OAAO,EAAE,aAAa,CAAC;IACvB,cAAc,EAAE,cAAc,CAAC;IAC/B,MAAM,EAAE,oBAAoB,CAAC;IAC7B,6FAA6F;IAC7F,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IAClD,OAAO,EAAE,MAAM,iBAAiB,EAAE,CAAC;IACnC,SAAS,EAAE,MAAM,OAAO,CAAC;QAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAA;KAAE,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChF;AAED,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;AAcvE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,aAAa,GAAG,YAAY,CA0CvE;AAsMD,eAAO,MAAM,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,CAS7C,CAAC"}

package/dist/remediation/verify/checks.js

@@ -0,0 +1,239 @@
+import semver from "semver";
+import { readCooldown, withCooldown } from "../../platform/cooldown.js";
+import { MEMORY_PATH } from "../../platform/memory/path.js";
+import { detectPackageManager, getYarnMajorVersion, resolveInstallCommand, resolveTestCommand, resolveTypecheckCommand, } from "../../platform/package-manager/index.js";
+import { DEFAULT_POLICY, isPackageAllowed, loadPolicy } from "../../platform/policy.js";
+import { loadRegistryConfig } from "../../platform/registry-config.js";
+import { verifyPackageTrust } from "../../platform/supply-chain.js";
+import { TRACK_RECORD_PATH } from "../../platform/track-record-path.js";
+import { findVulnerablePackages } from "../local/vulnerability-match.js";
+import { prepareReproductionTestFile, runProofOfFixPhase } from "../proof-of-fix/runner.js";
+import { checkInventoryTool } from "../tools/check-inventory.js";
+import { changedFilesSince, classifyPath, manifestChanges, } from "./changes.js";
+import { runCommandCheck, tail } from "./command-check.js";
+const pass = (message, details) => ({
+    status: "passed",
+    message,
+    ...(details ? { details } : {}),
+});
+const fail = (message, details) => ({
+    status: "failed",
+    message,
+    ...(details ? { details } : {}),
+});
+const skip = (message) => ({ status: "skipped", message });
+export function createCheckContext(request) {
+    const options = request.options ?? {};
+    const packageManager = request.packageManager ?? detectPackageManager(request.cwd);
+    let policy = DEFAULT_POLICY;
+    let policyError;
+    try {
+        policy = loadPolicy(request.cwd, request.policy);
+    }
+    catch (error) {
+        policyError = error instanceof Error ? error.message : String(error);
+    }
+    let files;
+    let changes;
+    let inventory;
+    return {
+        request,
+        options,
+        packageManager,
+        policy,
+        ...(policyError ? { policyError } : {}),
+        changedFiles: () => (files ??= changedFilesSince(request.cwd, request.statusBefore, options.ignoreTrackRecord ? [TRACK_RECORD_PATH, MEMORY_PATH] : [])),
+        changes: () => (changes ??= manifestChanges(request.cwd, request.baseFiles)),
+        inventory: () => (inventory ??= checkInventoryTool
+            .execute({
+            cwd: request.cwd,
+            packageManager,
+            policy: request.policy,
+            workspace: options.constraints?.workspace ?? policy.constraints?.workspace,
+        })
+            .then((result) => (result.error ? { error: result.error } : { packages: result.packages }))
+            .catch((error) => ({
+            error: error instanceof Error ? error.message : String(error),
+        }))),
+    };
+}
+/** Merge the run's constraints over the policy's. */
+const constraintsOf = (context) => ({
+    ...context.policy.constraints,
+    ...context.options.constraints,
+});
+/** Only the files a dependency change may touch (plus the project's source, if allowed) changed. */
+const scope = async (context) => {
+    const files = await context.changedFiles();
+    if (files === undefined)
+        return skip("not a git repository, so the changed files cannot be listed");
+    const violations = [];
+    for (const file of files) {
+        const kind = classifyPath(file);
+        if (kind === "forbidden")
+            violations.push(`${file}: never changed by remediation`);
+        else if (kind === "source" && !context.options.allowSourceEdits) {
+            violations.push(`${file}: project source, but this change may only touch dependency files`);
+        }
+        else if (kind === "other")
+            violations.push(`${file}: not a dependency file`);
+    }
+    return violations.length > 0
+        ? fail(`${violations.length} change(s) outside the allowed scope`, violations)
+        : pass(`${files.length} changed file(s), all within scope`);
+};
+const versionOf = (spec) => {
+    try {
+        return semver.minVersion(spec)?.version;
+    }
+    catch {
+        return undefined;
+    }
+};
+/** The change respects the policy: allow/deny lists, major bumps and the strategy constraints. */
+const policyCheck = async (context) => {
+    if (context.policyError)
+        return fail("the policy could not be loaded", [context.policyError]);
+    const constraints = constraintsOf(context);
+    const violations = [];
+    for (const change of context.changes()) {
+        if (change.to === undefined)
+            continue;
+        const label = `${change.name} ${change.from ?? "(new)"} -> ${change.to}`;
+        if (!isPackageAllowed(context.policy, change.name)) {
+            violations.push(`${label}: blocked by allowPackages/denyPackages`);
+        }
+        if (change.kind === "override" && constraints.directDependenciesOnly) {
+            violations.push(`${label}: an override changes a transitive dependency, but directDependenciesOnly is set`);
+        }
+        if (change.kind === "override" && constraints.preferVersionBump) {
+            violations.push(`${label}: an override, but preferVersionBump rejects overrides`);
+        }
+        const from = change.from === undefined ? undefined : versionOf(change.from.split("=").at(-1));
+        const to = versionOf(change.to.split("=").at(-1));
+        if (from && to && semver.major(to) > semver.major(from) && !context.policy.allowMajorBumps) {
+            violations.push(`${label}: a major bump, but allowMajorBumps is off`);
+        }
+    }
+    return violations.length > 0
+        ? fail(`${violations.length} change(s) the policy does not allow`, violations)
+        : pass(`${context.changes().length} dependency change(s) allowed by policy`);
+};
+/** Every version the change introduces passes the supply-chain gate (age, scripts, provenance). */
+const supplyChain = async (context) => {
+    if (context.options.offline)
+        return skip("offline: the registry is not consulted");
+    const constraints = constraintsOf(context);
+    const cooldown = readCooldown(context.request.cwd, context.packageManager);
+    const registry = loadRegistryConfig(context.request.cwd);
+    const problems = [];
+    let checked = 0;
+    for (const change of context.changes()) {
+        if (change.to === undefined)
+            continue;
+        const version = versionOf(change.to.split("=").at(-1));
+        if (!version)
+            continue;
+        const policy = withCooldown(constraints.supplyChainPolicy, cooldown, change.name);
+        const verdict = await verifyPackageTrust(change.name, version, policy, registry);
+        checked += 1;
+        if (!verdict.trusted)
+            problems.push(`${change.name}@${version}: ${verdict.reason}`);
+    }
+    return problems.length > 0
+        ? fail(`${problems.length} version(s) fail the supply-chain gate`, problems)
+        : pass(checked === 0
+            ? "no new versions to check"
+            : `${checked} new version(s) pass the supply-chain gate`);
+};
+/** A frozen install succeeds: the lockfile agrees with the manifests the change left behind. */
+const install = async (context) => {
+    const yarnMajor = context.packageManager === "yarn" ? await getYarnMajorVersion(context.request.cwd) : undefined;
+    const command = resolveInstallCommand(context.packageManager, { ...constraintsOf(context), enforceFrozenLockfile: true }, yarnMajor);
+    const outcome = await runCommandCheck(command, context.request.cwd);
+    return outcome.passed
+        ? pass(`${command.join(" ")} succeeded`)
+        : fail(`${command.join(" ")} failed: the lockfile does not match the manifests`, tail(outcome.output));
+};
+/** None of the advisories still matches an installed package, except the ones knowingly left. */
+const vulnGone = async (context) => {
+    if (context.request.advisories.length === 0)
+        return skip("no advisory to check against");
+    const inventory = await context.inventory();
+    if ("error" in inventory)
+        return fail("the installed packages could not be listed", [inventory.error]);
+    const allowed = new Set(context.request.expectedRemaining ?? []);
+    const remaining = [];
+    for (const advisory of context.request.advisories) {
+        for (const vulnerable of findVulnerablePackages(advisory, inventory.packages)) {
+            if (allowed.has(vulnerable.installed.name))
+                continue;
+            remaining.push(`${vulnerable.installed.name}@${vulnerable.installed.version} is still in ${vulnerable.affected.vulnerableRange} (${advisory.id})`);
+        }
+    }
+    return remaining.length > 0
+        ? fail(`${remaining.length} vulnerable package(s) remain`, remaining)
+        : pass(`no vulnerable copy of the ${context.request.advisories.length} advisory package(s) remains`);
+};
+const typecheck = async (context) => {
+    const requested = context.options.typecheck ?? constraintsOf(context).typecheck;
+    if (!requested)
+        return skip("not requested");
+    const command = resolveTypecheckCommand(context.packageManager, constraintsOf(context), context.request.cwd);
+    if (command.length === 0)
+        return skip("no typecheck script or tsconfig found");
+    const outcome = await runCommandCheck(command, context.request.cwd);
+    return outcome.passed
+        ? pass(`${command.join(" ")} succeeded`)
+        : fail(`${command.join(" ")} failed`, tail(outcome.output));
+};
+const tests = async (context) => {
+    if (!context.options.runTests)
+        return skip("not requested");
+    const command = resolveTestCommand(context.packageManager, constraintsOf(context), context.request.cwd);
+    const outcome = await runCommandCheck(command, context.request.cwd);
+    return outcome.passed
+        ? { ...pass(`${command.join(" ")} passed`), command }
+        : fail(`${command.join(" ")} failed`, tail(outcome.output));
+};
+/** The reproduction test, run now, passes. (That it failed before is established when it is written.) */
+const proofOfFix = async (context) => {
+    const { proofOfFix: proof, reproductionTest, requireProofOfFix, patchesDir } = context.options;
+    const required = requireProofOfFix ?? constraintsOf(context).requireProofOfFix;
+    if (!proof && !reproductionTest) {
+        return required
+            ? fail("proof of fix is required, but no reproduction test was supplied")
+            : skip("no reproduction test supplied");
+    }
+    const prepared = await prepareReproductionTestFile({
+        cwd: context.request.cwd,
+        packageName: "verify",
+        vulnerableVersion: "0.0.0",
+        patchesDir,
+        proofOfFix: proof,
+        reproductionTest,
+    });
+    if (!prepared.testFilePath)
+        return required
+            ? fail("the reproduction test could not be found")
+            : skip("no reproduction test found");
+    const phase = await runProofOfFixPhase({
+        stage: "positive",
+        testFilePath: prepared.testFilePath,
+        cwd: context.request.cwd,
+    });
+    return phase.passed
+        ? pass("the reproduction test passes")
+        : fail("the reproduction test still fails", phase.error ? [phase.error] : undefined);
+};
+export const CHECKS = {
+    scope,
+    policy: policyCheck,
+    "supply-chain": supplyChain,
+    install,
+    "vuln-gone": vulnGone,
+    typecheck,
+    tests,
+    "proof-of-fix": proofOfFix,
+};
+//# sourceMappingURL=checks.js.map

package/dist/remediation/verify/checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checks.js","sourceRoot":"","sources":["../../../src/remediation/verify/checks.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAExF,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAExE,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC5F,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EACL,iBAAiB,EACjB,YAAY,EAEZ,eAAe,GAChB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAyB3D,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,OAAkB,EAAgB,EAAE,CAAC,CAAC;IACnE,MAAM,EAAE,QAAQ;IAChB,OAAO;IACP,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CAChC,CAAC,CAAC;AACH,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,OAAkB,EAAgB,EAAE,CAAC,CAAC;IACnE,MAAM,EAAE,QAAQ;IAChB,OAAO;IACP,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CAChC,CAAC,CAAC;AACH,MAAM,IAAI,GAAG,CAAC,OAAe,EAAgB,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;AAEjF,MAAM,UAAU,kBAAkB,CAAC,OAAsB;IACvD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;IACtC,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEnF,IAAI,MAAM,GAAyB,cAAc,CAAC;IAClD,IAAI,WAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,WAAW,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,KAAgD,CAAC;IACrD,IAAI,OAAwC,CAAC;IAC7C,IAAI,SAAoF,CAAC;IAEzF,OAAO;QACL,OAAO;QACP,OAAO;QACP,cAAc;QACd,MAAM;QACN,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,YAAY,EAAE,GAAG,EAAE,CACjB,CAAC,KAAK,KAAK,iBAAiB,CAC1B,OAAO,CAAC,GAAG,EACX,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAClE,CAAC;QACJ,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,KAAK,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5E,SAAS,EAAE,GAAG,EAAE,CACd,CAAC,SAAS,KAAK,kBAAkB;aAC9B,OAAO,CAAC;YACP,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,cAAc;YACd,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,SAAS,IAAI,MAAM,CAAC,WAAW,EAAE,SAAS;SAC3E,CAAC;aACD,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;aAC1F,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,CAAC;YAC1B,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC,CAAC;KACT,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,MAAM,aAAa,GAAG,CAAC,OAAqB,EAAE,EAAE,CAAC,CAAC;IAChD,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW;IAC7B,GAAG,OAAO,CAAC,OAAO,CAAC,WAAW;CAC/B,CAAC,CAAC;AAEH,oGAAoG;AACpG,MAAM,KAAK,GAAY,KAAK,EAAE,OAAO,EAAE,EAAE;IACvC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;IAC3C,IAAI,KAAK,KAAK,SAAS;QACrB,OAAO,IAAI,CAAC,6DAA6D,CAAC,CAAC;IAE7E,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,IAAI,KAAK,WAAW;YAAE,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,gCAAgC,CAAC,CAAC;aAC9E,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAChE,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,mEAAmE,CAAC,CAAC;QAC9F,CAAC;aAAM,IAAI,IAAI,KAAK,OAAO;YAAE,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,yBAAyB,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC;QAC1B,CAAC,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,MAAM,sCAAsC,EAAE,UAAU,CAAC;QAC9E,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,oCAAoC,CAAC,CAAC;AAChE,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,IAAY,EAAsB,EAAE;IACrD,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC;AAEF,kGAAkG;AAClG,MAAM,WAAW,GAAY,KAAK,EAAE,OAAO,EAAE,EAAE;IAC7C,IAAI,OAAO,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC,gCAAgC,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IAE9F,MAAM,WAAW,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACvC,IAAI,MAAM,CAAC,EAAE,KAAK,SAAS;YAAE,SAAS;QACtC,MAAM,KAAK,GAAG,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,IAAI,OAAO,OAAO,MAAM,CAAC,EAAE,EAAE,CAAC;QAEzE,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACnD,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,yCAAyC,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,WAAW,CAAC,sBAAsB,EAAE,CAAC;YACrE,UAAU,CAAC,IAAI,CACb,GAAG,KAAK,kFAAkF,CAC3F,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,WAAW,CAAC,iBAAiB,EAAE,CAAC;YAChE,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,wDAAwD,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;QAC/F,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;QACnD,IAAI,IAAI,IAAI,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;YAC3F,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,4CAA4C,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC;QAC1B,CAAC,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,MAAM,sCAAsC,EAAE,UAAU,CAAC;QAC9E,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,yCAAyC,CAAC,CAAC;AACjF,CAAC,CAAC;AAEF,mGAAmG;AACnG,MAAM,WAAW,GAAY,KAAK,EAAE,OAAO,EAAE,EAAE;IAC7C,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACnF,MAAM,WAAW,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEzD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QACvC,IAAI,MAAM,CAAC,EAAE,KAAK,SAAS;YAAE,SAAS;QACtC,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,CAAC,iBAAiB,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAClF,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACjF,OAAO,IAAI,CAAC,CAAC;QACb,IAAI,CAAC,OAAO,CAAC,OAAO;YAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,OAAO,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC;QACxB,CAAC,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,wCAAwC,EAAE,QAAQ,CAAC;QAC5E,CAAC,CAAC,IAAI,CACF,OAAO,KAAK,CAAC;YACX,CAAC,CAAC,0BAA0B;YAC5B,CAAC,CAAC,GAAG,OAAO,4CAA4C,CAC3D,CAAC;AACR,CAAC,CAAC;AAEF,gGAAgG;AAChG,MAAM,OAAO,GAAY,KAAK,EAAE,OAAO,EAAE,EAAE;IACzC,MAAM,SAAS,GACb,OAAO,CAAC,cAAc,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjG,MAAM,OAAO,GAAG,qBAAqB,CACnC,OAAO,CAAC,cAAc,EACtB,EAAE,GAAG,aAAa,CAAC,OAAO,CAAC,EAAE,qBAAqB,EAAE,IAAI,EAAE,EAC1D,SAAS,CACV,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpE,OAAO,OAAO,CAAC,MAAM;QACnB,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;QACxC,CAAC,CAAC,IAAI,CACF,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,oDAAoD,EACxE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CACrB,CAAC;AACR,CAAC,CAAC;AAEF,iGAAiG;AACjG,MAAM,QAAQ,GAAY,KAAK,EAAE,OAAO,EAAE,EAAE;IAC1C,IAAI,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAEzF,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC;IAC5C,IAAI,OAAO,IAAI,SAAS;QACtB,OAAO,IAAI,CAAC,4CAA4C,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IAE/E,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;IACjE,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QAClD,KAAK,MAAM,UAAU,IAAI,sBAAsB,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9E,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC;gBAAE,SAAS;YACrD,SAAS,CAAC,IAAI,CACZ,GAAG,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI,UAAU,CAAC,SAAS,CAAC,OAAO,gBAAgB,UAAU,CAAC,QAAQ,CAAC,eAAe,KAAK,QAAQ,CAAC,EAAE,GAAG,CACnI,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC;QACzB,CAAC,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,MAAM,+BAA+B,EAAE,SAAS,CAAC;QACrE,CAAC,CAAC,IAAI,CACF,6BAA6B,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,8BAA8B,CAC7F,CAAC;AACR,CAAC,CAAC;AAEF,MAAM,SAAS,GAAY,KAAK,EAAE,OAAO,EAAE,EAAE;IAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC;IAChF,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,uBAAuB,CACrC,OAAO,CAAC,cAAc,EACtB,aAAa,CAAC,OAAO,CAAC,EACtB,OAAO,CAAC,OAAO,CAAC,GAAG,CACpB,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,uCAAuC,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpE,OAAO,OAAO,CAAC,MAAM;QACnB,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;QACxC,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;AAChE,CAAC,CAAC;AAEF,MAAM,KAAK,GAAY,KAAK,EAAE,OAAO,EAAE,EAAE;IACvC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,kBAAkB,CAChC,OAAO,CAAC,cAAc,EACtB,aAAa,CAAC,OAAO,CAAC,EACtB,OAAO,CAAC,OAAO,CAAC,GAAG,CACpB,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpE,OAAO,OAAO,CAAC,MAAM;QACnB,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE;QACrD,CAAC,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;AAChE,CAAC,CAAC;AAEF,yGAAyG;AACzG,MAAM,UAAU,GAAY,KAAK,EAAE,OAAO,EAAE,EAAE;IAC5C,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAC/F,MAAM,QAAQ,GAAG,iBAAiB,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC,iBAAiB,CAAC;IAC/E,IAAI,CAAC,KAAK,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAChC,OAAO,QAAQ;YACb,CAAC,CAAC,IAAI,CAAC,iEAAiE,CAAC;YACzE,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC;QACjD,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG;QACxB,WAAW,EAAE,QAAQ;QACrB,iBAAiB,EAAE,OAAO;QAC1B,UAAU;QACV,UAAU,EAAE,KAAK;QACjB,gBAAgB;KACjB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,YAAY;QACxB,OAAO,QAAQ;YACb,CAAC,CAAC,IAAI,CAAC,0CAA0C,CAAC;YAClD,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAEzC,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC;QACrC,KAAK,EAAE,UAAU;QACjB,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG;KACzB,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,MAAM;QACjB,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC;QACtC,CAAC,CAAC,IAAI,CAAC,mCAAmC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACzF,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,MAAM,GAA+B;IAChD,KAAK;IACL,MAAM,EAAE,WAAW;IACnB,cAAc,EAAE,WAAW;IAC3B,OAAO;IACP,WAAW,EAAE,QAAQ;IACrB,SAAS;IACT,KAAK;IACL,cAAc,EAAE,UAAU;CAC3B,CAAC"}

package/dist/remediation/verify/command-check.d.ts

@@ -0,0 +1,11 @@
+export interface CommandOutcome {
+    passed: boolean;
+    /** Combined stdout, stderr and error message of a failed run. */
+    output: string;
+}
+/** What a failed command printed, so the failure is explainable. */
+export declare function describeCommandFailure(error: unknown): string;
+/** The last lines of command output; the start of a failing test run is rarely what matters. */
+export declare function tail(output: string, lines?: number): string[];
+export declare function runCommandCheck(command: readonly string[], cwd: string, timeoutMs?: number): Promise<CommandOutcome>;
+//# sourceMappingURL=command-check.d.ts.map

package/dist/remediation/verify/command-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-check.d.ts","sourceRoot":"","sources":["../../../src/remediation/verify/command-check.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,OAAO,CAAC;IAChB,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,oEAAoE;AACpE,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAI7D;AAED,gGAAgG;AAChG,wBAAgB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,SAAK,GAAG,MAAM,EAAE,CAMzD;AAED,wBAAsB,eAAe,CACnC,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,GAAG,EAAE,MAAM,EACX,SAAS,GAAE,MAAgC,GAC1C,OAAO,CAAC,cAAc,CAAC,CAOzB"}

package/dist/remediation/verify/command-check.js

@@ -0,0 +1,26 @@
+import { safeExecaCommand } from "../../platform/safe-exec-command.js";
+import { LONG_RUNNING_TIMEOUT_MS } from "../../platform/timeouts.js";
+/** What a failed command printed, so the failure is explainable. */
+export function describeCommandFailure(error) {
+    const failure = error;
+    const combined = [failure.stdout, failure.stderr, failure.message].filter(Boolean).join("\n");
+    return combined || (error instanceof Error ? error.message : String(error));
+}
+/** The last lines of command output; the start of a failing test run is rarely what matters. */
+export function tail(output, lines = 20) {
+    return output
+        .split("\n")
+        .map((line) => line.trimEnd())
+        .filter((line) => line.length > 0)
+        .slice(-lines);
+}
+export async function runCommandCheck(command, cwd, timeoutMs = LONG_RUNNING_TIMEOUT_MS) {
+    try {
+        await safeExecaCommand(command, { timeoutMs, cwd, stdio: "pipe" });
+        return { passed: true, output: "" };
+    }
+    catch (error) {
+        return { passed: false, output: describeCommandFailure(error) };
+    }
+}
+//# sourceMappingURL=command-check.js.map

package/dist/remediation/verify/command-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-check.js","sourceRoot":"","sources":["../../../src/remediation/verify/command-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAQrE,oEAAoE;AACpE,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,MAAM,OAAO,GAAG,KAA+D,CAAC;IAChF,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9F,OAAO,QAAQ,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,IAAI,CAAC,MAAc,EAAE,KAAK,GAAG,EAAE;IAC7C,OAAO,MAAM;SACV,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;SAC7B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;SACjC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAA0B,EAC1B,GAAW,EACX,SAAS,GAAW,uBAAuB;IAE3C,IAAI,CAAC;QACH,MAAM,gBAAgB,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACnE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;IAClE,CAAC;AACH,CAAC"}

package/dist/remediation/verify/types.d.ts

@@ -0,0 +1,66 @@
+import type { CveDetails, PackageManager, RemediationConstraints } from "../../platform/types.js";
+/** In the order they run: cheap and static first, then anything that installs or executes code. */
+export declare const CHECK_NAMES: readonly ["scope", "policy", "supply-chain", "install", "vuln-gone", "typecheck", "tests", "proof-of-fix"];
+export type CheckName = (typeof CHECK_NAMES)[number];
+export type CheckStatus = "passed" | "failed" | "skipped";
+export interface CheckResult {
+    name: CheckName;
+    status: CheckStatus;
+    /** One line: what was checked, or why it failed or was skipped. */
+    message: string;
+    /** Specifics that make a failure actionable (files, packages, command output tail). */
+    details?: string[];
+    /** The command the check ran (`tests`), so a run can record how this project's tests run. */
+    command?: string[];
+    durationMs: number;
+}
+export interface VerificationResult {
+    /** Every check that ran passed. Skipped checks do not count against it. */
+    passed: boolean;
+    /** The first check that failed; later checks are reported as skipped. */
+    failedCheck?: CheckName;
+    checks: CheckResult[];
+    /** Files the change touched, when it could be determined. */
+    changedFiles?: string[];
+    durationMs: number;
+}
+export interface VerifyOptions {
+    runTests?: boolean;
+    typecheck?: boolean;
+    proofOfFix?: boolean | string;
+    requireProofOfFix?: boolean;
+    reproductionTest?: string;
+    patchesDir?: string;
+    constraints?: RemediationConstraints;
+    /** The change may edit the project's own source (breaking-change refactors, agent repairs). */
+    allowSourceEdits?: boolean;
+    /** Skip checks that need the network. */
+    offline?: boolean;
+    /**
+     * Leave the autonomy track record (a committed file Autoremediator itself appends to after each
+     * run) out of the scope check. Set only when judging the project itself, never a checkout an
+     * agent has been editing, so an agent cannot raise its own level.
+     */
+    ignoreTrackRecord?: boolean;
+}
+export interface VerifyRequest {
+    cwd: string;
+    packageManager?: PackageManager;
+    /** Policy file path or inline policy. */
+    policy?: string;
+    /** Manifest, lockfile and patch contents before the change by relative path; null = did not exist. */
+    baseFiles: ReadonlyMap<string, string | null>;
+    /**
+     * `git status --porcelain` lines before the change, so what changed can be told from what was
+     * already dirty. Undefined when the project is not a git repository, which skips the scope check.
+     */
+    statusBefore?: readonly string[];
+    /** Advisories the change is meant to have resolved. */
+    advisories: readonly CveDetails[];
+    /** Packages that are knowingly left vulnerable (not part of this change). */
+    expectedRemaining?: readonly string[];
+    options?: VerifyOptions;
+    /** Run only these checks (default: all, in canonical order). */
+    checks?: readonly CheckName[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/remediation/verify/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/remediation/verify/types.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAElG,mGAAmG;AACnG,eAAO,MAAM,WAAW,4GAAsB,CAAC;AAE/C,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAErD,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE1D,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,WAAW,CAAC;IACpB,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,uFAAuF;IACvF,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,6FAA6F;IAC7F,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,MAAM,EAAE,OAAO,CAAC;IAChB,yEAAyE;IACzE,WAAW,CAAC,EAAE,SAAS,CAAC;IACxB,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,sBAAsB,CAAC;IACrC,+FAA+F;IAC/F,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,yCAAyC;IACzC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sGAAsG;IACtG,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;IAC9C;;;OAGG;IACH,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,uDAAuD;IACvD,UAAU,EAAE,SAAS,UAAU,EAAE,CAAC;IAClC,6EAA6E;IAC7E,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,gEAAgE;IAChE,MAAM,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;CAC/B"}

package/dist/remediation/verify/types.js

@@ -0,0 +1,4 @@
+import { VERIFY_CHECK_VALUES } from "../../platform/option-schemas.js";
+/** In the order they run: cheap and static first, then anything that installs or executes code. */
+export const CHECK_NAMES = VERIFY_CHECK_VALUES;
+//# sourceMappingURL=types.js.map

package/dist/remediation/verify/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/remediation/verify/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAGvE,mGAAmG;AACnG,MAAM,CAAC,MAAM,WAAW,GAAG,mBAAmB,CAAC"}