autoremediator 0.21.2 → 0.22.0

package/dist/api/incident/markdown.js

@@ -0,0 +1,208 @@
+import { stripControl } from "./text.js";
+/** Strip control characters, so one untrusted string cannot become several lines of markdown. */
+const flat = (value) => stripControl(value).trim();
+/** Inline code. Backticks inside become quotes, and pipes are escaped so a table cell cannot be split. */
+export const code = (value) => `\`${flat(value)
+    .replaceAll("`", "'")
+    .replaceAll("|", String.raw `\|`)}\``;
+/** Plain prose from an untrusted source: no markup, no HTML. */
+export const prose = (value) => flat(value).replaceAll(/[\\`*_{}[\]<>#|]/g, (char) => `\\${char}`);
+const short = (sha) => sha.slice(0, 10);
+const day = (iso) => iso.slice(0, 10);
+const commitText = (commit) => `${code(short(commit.sha))} (${day(commit.date)})`;
+const list = (values, limit = 12) => values.length === 0
+    ? "none"
+    : `${values
+        .slice(0, limit)
+        .map((value) => code(value))
+        .join(", ")}${values.length > limit ? `, and ${values.length - limit} more` : ""}`;
+const refs = (set) => [
+    set.branches.length > 0 ? `branches ${list(set.branches)}` : "",
+    set.tags.length > 0 ? `tags ${list(set.tags)}` : "",
+]
+    .filter((part) => part !== "")
+    .join("; ") || "none";
+function occurrenceRow(name, occurrence) {
+    const kind = occurrence.direct
+        ? `direct (${occurrence.workspaces.map((ws) => code(ws)).join(", ")})`
+        : "transitive";
+    const via = occurrence.via.length > 0
+        ? occurrence.via.map((hop) => code(hop)).join(" → ")
+        : "nothing the manifests ask for leads here";
+    const scripts = occurrence.installScript === "unknown"
+        ? "unknown"
+        : occurrence.installScript
+            ? "**yes**"
+            : "no";
+    return `| ${code(`${name}@${occurrence.version}`)} | ${occurrence.scope} | ${kind} | ${via} | ${scripts} | ${code(occurrence.lockfile)} |`;
+}
+function windowLines(window) {
+    const entered = window.entered.length > 0
+        ? window.entered.map((commit) => commitText(commit)).join(", ")
+        : "before the history that was read";
+    const left = window.left.length > 0
+        ? window.left.map((commit) => commitText(commit)).join(", ")
+        : window.presentAtHead
+            ? "**still present at HEAD**"
+            : "not found leaving";
+    return [
+        `- ${code(window.version)} in ${code(window.lockfile)}`,
+        `  - entered: ${entered}`,
+        `  - left: ${left}`,
+        ...(window.previousVersions.length > 0
+            ? [`  - the lockfile had ${list(window.previousVersions, 3)} just before`]
+            : []),
+        `  - a build of these as they are now installs it: ${refs(window.atTip)}`,
+        `  - history passes through the entering commit, but their tip no longer has it: ${refs(window.passedThrough)}`,
+    ];
+}
+/** The incident report as markdown, safe to commit or paste into a ticket. */
+export function renderIncidentMarkdown(report) {
+    const out = [];
+    const { target, exposure } = report;
+    const out_ = (...lines) => void out.push(...lines);
+    out_(`# Incident report: ${code(target.input.length > 120 ? `${target.input.slice(0, 117)}...` : target.input)}`, "");
+    out_(`Generated ${report.generatedAt} for ${code(report.cwd)}.`, "");
+    if (target.advisory) {
+        out_(`**${prose(target.advisory.id)}** (${target.advisory.source}): ${prose(target.advisory.summary)}`, "");
+    }
+    out_("Affected: " +
+        target.affected.map((entry) => `${code(entry.name)} ${code(entry.range)}`).join("; "), "");
+    const everPresent = report.history?.packages.some((entry) => entry.windows.length > 0) ?? false;
+    out_("## Summary", "");
+    out_(exposure.exposed
+        ? "- **An affected version is locked or installed in this project now.**"
+        : everPresent
+            ? "- No affected version is locked now, but one was in this repository's history (see History)."
+            : "- No affected version is locked here, and none was found in the lockfile history that was read.", "");
+    out_("## 1. Exposure now", "");
+    const anyOccurrence = exposure.packages.some((entry) => entry.occurrences.length > 0);
+    if (anyOccurrence) {
+        out_("| Package | Scope | How | Parent chain | Install scripts | Lockfile |", "| --- | --- | --- | --- | --- | --- |");
+        for (const entry of exposure.packages) {
+            for (const occurrence of entry.occurrences)
+                out_(occurrenceRow(entry.packageName, occurrence));
+        }
+        out_("");
+    }
+    else {
+        out_("No affected version is in the lockfiles.", "");
+    }
+    for (const entry of exposure.packages) {
+        if (entry.declared)
+            out_(`- ${code(entry.packageName)} is declared in package.json as ${code(entry.declared)}.`);
+        if (entry.installed && entry.installed.length > 0) {
+            out_(`- Installed in node_modules: ${entry.installed.map((copy) => code(`${entry.packageName}@${copy.version}`)).join(", ")}.`);
+        }
+    }
+    for (const note of exposure.notes)
+        out_(`- ${prose(note)}`);
+    out_("");
+    out_("## 2. History", "");
+    if (!report.history) {
+        out_("History was not read (turned off).", "");
+    }
+    else if (!report.history.available) {
+        out_(`Not available: ${prose(report.history.reason ?? "no history")}.`, "");
+    }
+    else {
+        out_(`Read ${report.history.scannedCommits} commit(s) that changed ${list(report.history.lockfiles)}.`, "Commits and dates are what the repository records. Which builds or deploys actually ran, and what they installed, is not known from git: check your CI and deployment logs for builds of the commits and refs below.", "");
+        for (const entry of report.history.packages) {
+            out_(`### ${code(entry.packageName)}`, "");
+            if (entry.windows.length === 0)
+                out_("No affected version appears in the lockfile history.", "");
+            for (const window of entry.windows)
+                out_(...windowLines(window));
+            if (entry.windows.length > 0)
+                out_("");
+            if (entry.manifestChanges.length > 0) {
+                out_("package.json declared range changes:");
+                for (const change of entry.manifestChanges.slice(0, 10)) {
+                    out_(`- ${commitText(change.commit)}: ${change.from ? code(change.from) : "(not listed)"} → ${change.to ? code(change.to) : "(removed)"}`);
+                }
+                out_("");
+            }
+        }
+        for (const note of report.history.notes)
+            out_(`- ${prose(note)}`);
+        if (report.history.unreadable > 0)
+            out_(`- ${report.history.unreadable} lockfile version(s) could not be read and are not counted.`);
+        out_("");
+    }
+    out_("## 3. Roll back to the last safe version", "");
+    if (report.rollback.proposals.length === 0) {
+        out_("Nothing to roll back: no affected version is locked.", "");
+    }
+    else {
+        out_("| Package | From | To | How | Basis |", "| --- | --- | --- | --- | --- |");
+        for (const proposal of report.rollback.proposals) {
+            out_(`| ${code(proposal.packageName)} | ${code(proposal.fromVersion)} | ${proposal.toVersion ? code(proposal.toVersion) : "**none known**"} | ${proposal.strategy === "version-bump"
+                ? "exact pin in package.json"
+                : "package-manager override"} | ${proposal.basis ?? prose(proposal.reason ?? "")} |`);
+        }
+        out_("");
+        for (const proposal of report.rollback.proposals) {
+            if (proposal.newerUnaffected) {
+                out_(`- A newer version outside the affected range exists for ${code(proposal.packageName)}: ${code(proposal.newerUnaffected)}. Moving forward is a separate decision.`);
+            }
+        }
+        if (report.rollback.plan) {
+            out_("", `Recorded as plan ${code(report.rollback.plan.planId)} (run ${code(report.rollback.plan.runId)}). Nothing has been changed. Review it, then apply it:`, "", "```sh", `autoremediator runs show ${report.rollback.plan.runId}`, `autoremediator runs apply ${report.rollback.plan.runId}`, "```");
+        }
+        else {
+            out_("", "Not recorded. Run with `--plan` to record this as a plan that `autoremediator runs apply` can carry out after review.");
+        }
+        out_("");
+    }
+    for (const note of report.rollback.notes)
+        out_(`- ${prose(note)}`);
+    if (report.rollback.notes.length > 0)
+        out_("");
+    if (report.secrets) {
+        const secrets = report.secrets;
+        out_("## 4. Rotation checklist", "", `> ${secrets.disclaimer}`, "");
+        out_("Any build or developer machine that ran an install while an affected version was locked had that environment in reach of the package's install scripts and code.", "");
+        if (secrets.secretNames.length > 0) {
+            out_("Secret and credential names referenced (names only, no values were read):", "");
+            for (const entry of secrets.secretNames) {
+                out_(`- [ ] ${code(entry.name)}${entry.inInstallScope ? " (in reach of an install)" : ""} in ${list(entry.files, 4)}`);
+            }
+            out_("");
+        }
+        for (const file of secrets.ci) {
+            if (file.installs || file.installJobs.length > 0) {
+                out_(`- CI ${code(file.file)} installs dependencies${file.installJobs.length > 0 ? ` in job(s) ${list(file.installJobs)}` : ""}.`);
+                for (const note of file.notes)
+                    out_(`  - ${prose(note)}`);
+            }
+        }
+        for (const file of secrets.containers) {
+            if (file.installs)
+                out_(`- ${code(file.file)} installs dependencies while building an image.`);
+        }
+        for (const file of secrets.npmrc) {
+            out_(`- ${code(file.file)}: ${file.envNames.length > 0 ? `reads ${list(file.envNames)}` : "no token variable"}${file.literalCredential ? "; **a credential is written into the file itself**" : ""}.`);
+        }
+        for (const file of secrets.lifecycle)
+            out_(`- ${code(file.file)} defines install-time scripts: ${list(file.scripts)}.`);
+        out_("");
+        out_("Generic steps:", "");
+        for (const item of secrets.guidance)
+            out_(`- [ ] ${item.text}`);
+        out_("");
+        for (const note of secrets.notes)
+            out_(`- ${prose(note)}`);
+        out_("");
+    }
+    else {
+        out_("## 4. Rotation checklist", "", "Not generated: the package was not found in this project's lockfiles or history.", "");
+    }
+    if (report.notes.length > 0) {
+        out_("## Notes", "");
+        for (const note of report.notes)
+            out_(`- ${prose(note)}`);
+        out_("");
+    }
+    return `${out.join("\n").trimEnd()}\n`;
+}
+//# sourceMappingURL=markdown.js.map

package/dist/api/incident/markdown.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown.js","sourceRoot":"","sources":["../../../src/api/incident/markdown.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAGzC,iGAAiG;AACjG,MAAM,IAAI,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AAEnE,0GAA0G;AAC1G,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,KAAa,EAAU,EAAE,CAC5C,KAAK,IAAI,CAAC,KAAK,CAAC;KACb,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;KACpB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAA,IAAI,CAAC,IAAI,CAAC;AAEzC,gEAAgE;AAChE,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,KAAa,EAAU,EAAE,CAC7C,IAAI,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,mBAAmB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;AAErE,MAAM,KAAK,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACxD,MAAM,GAAG,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtD,MAAM,UAAU,GAAG,CAAC,MAAqC,EAAU,EAAE,CACnE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;AACrD,MAAM,IAAI,GAAG,CAAC,MAAgB,EAAE,KAAK,GAAG,EAAE,EAAU,EAAE,CACpD,MAAM,CAAC,MAAM,KAAK,CAAC;IACjB,CAAC,CAAC,MAAM;IACR,CAAC,CAAC,GAAG,MAAM;SACN,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC;SACf,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC3B,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAC3F,MAAM,IAAI,GAAG,CAAC,GAAW,EAAU,EAAE,CACnC;IACE,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;IAC/D,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;CACpD;KACE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;KAC7B,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC;AAE1B,SAAS,aAAa,CAAC,IAAY,EAAE,UAAsB;IACzD,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM;QAC5B,CAAC,CAAC,WAAW,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QACtE,CAAC,CAAC,YAAY,CAAC;IACjB,MAAM,GAAG,GACP,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;QACvB,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;QACpD,CAAC,CAAC,0CAA0C,CAAC;IACjD,MAAM,OAAO,GACX,UAAU,CAAC,aAAa,KAAK,SAAS;QACpC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,UAAU,CAAC,aAAa;YACxB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC;IACb,OAAO,KAAK,IAAI,CAAC,GAAG,IAAI,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC,MAAM,UAAU,CAAC,KAAK,MAAM,IAAI,MAAM,GAAG,MAAM,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;AAC7I,CAAC;AAED,SAAS,WAAW,CAAC,MAAqB;IACxC,MAAM,OAAO,GACX,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QACvB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC/D,CAAC,CAAC,kCAAkC,CAAC;IACzC,MAAM,IAAI,GACR,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QACpB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC5D,CAAC,CAAC,MAAM,CAAC,aAAa;YACpB,CAAC,CAAC,2BAA2B;YAC7B,CAAC,CAAC,mBAAmB,CAAC;IAC5B,OAAO;QACL,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE;QACvD,gBAAgB,OAAO,EAAE;QACzB,aAAa,IAAI,EAAE;QACnB,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC;YACpC,CAAC,CAAC,CAAC,wBAAwB,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC,cAAc,CAAC;YAC1E,CAAC,CAAC,EAAE,CAAC;QACP,qDAAqD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;QACzE,mFAAmF,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE;KAChH,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,sBAAsB,CAAC,MAAsB;IAC3D,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IACpC,MAAM,IAAI,GAAG,CAAC,GAAG,KAAe,EAAQ,EAAE,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;IAEnE,IAAI,CACF,sBAAsB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC3G,EAAE,CACH,CAAC;IACF,IAAI,CAAC,aAAa,MAAM,CAAC,WAAW,QAAQ,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,IAAI,CACF,KAAK,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,MAAM,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EACjG,EAAE,CACH,CAAC;IACJ,CAAC;IACD,IAAI,CACF,YAAY;QACV,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EACvF,EAAE,CACH,CAAC;IAEF,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC;IAChG,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACvB,IAAI,CACF,QAAQ,CAAC,OAAO;QACd,CAAC,CAAC,uEAAuE;QACzE,CAAC,CAAC,WAAW;YACX,CAAC,CAAC,8FAA8F;YAChG,CAAC,CAAC,iGAAiG,EACvG,EAAE,CACH,CAAC;IAEF,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;IAC/B,MAAM,aAAa,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACtF,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CACF,uEAAuE,EACvE,uCAAuC,CACxC,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtC,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,WAAW;gBACxC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,0CAA0C,EAAE,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,QAAQ;YAChB,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,mCAAmC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC/F,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,IAAI,CACF,gCAAgC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC1H,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK;QAAE,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,EAAE,CAAC,CAAC;IAET,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IAC1B,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,IAAI,CAAC,oCAAoC,EAAE,EAAE,CAAC,CAAC;IACjD,CAAC;SAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACrC,IAAI,CAAC,kBAAkB,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC9E,CAAC;SAAM,CAAC;QACN,IAAI,CACF,QAAQ,MAAM,CAAC,OAAO,CAAC,cAAc,2BAA2B,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,EACjG,sNAAsN,EACtN,EAAE,CACH,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC5C,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;gBAC5B,IAAI,CAAC,sDAAsD,EAAE,EAAE,CAAC,CAAC;YACnE,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO;gBAAE,IAAI,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;YACjE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;gBAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YACvC,IAAI,KAAK,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrC,IAAI,CAAC,sCAAsC,CAAC,CAAC;gBAC7C,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;oBACxD,IAAI,CACF,KAAK,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,MAAM,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CACrI,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,EAAE,CAAC,CAAC;YACX,CAAC;QACH,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK;YAAE,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClE,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,GAAG,CAAC;YAC/B,IAAI,CACF,KAAK,MAAM,CAAC,OAAO,CAAC,UAAU,6DAA6D,CAC5F,CAAC;QACJ,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC;IAED,IAAI,CAAC,0CAA0C,EAAE,EAAE,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC,sDAAsD,EAAE,EAAE,CAAC,CAAC;IACnE,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,uCAAuC,EAAE,iCAAiC,CAAC,CAAC;QACjF,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;YACjD,IAAI,CACF,KAAK,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,gBAAgB,MACnI,QAAQ,CAAC,QAAQ,KAAK,cAAc;gBAClC,CAAC,CAAC,2BAA2B;gBAC7B,CAAC,CAAC,0BACN,MAAM,QAAQ,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,IAAI,CACzD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,CAAC;QACT,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;YACjD,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;gBAC7B,IAAI,CACF,2DAA2D,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,0CAA0C,CACnK,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACzB,IAAI,CACF,EAAE,EACF,oBAAoB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,wDAAwD,EACtJ,EAAE,EACF,OAAO,EACP,4BAA4B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,EACxD,6BAA6B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,EACzD,KAAK,CACN,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,IAAI,CACF,EAAE,EACF,uHAAuH,CACxH,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK;QAAE,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnE,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAE/C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,0BAA0B,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;QACpE,IAAI,CACF,kKAAkK,EAClK,EAAE,CACH,CAAC;QACF,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,2EAA2E,EAAE,EAAE,CAAC,CAAC;YACtF,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;gBACxC,IAAI,CACF,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CACjH,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,EAAE,CAAC,CAAC;QACX,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACjD,IAAI,CACF,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,yBAAyB,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAC7H,CAAC;gBACF,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK;oBAAE,IAAI,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACtC,IAAI,IAAI,CAAC,QAAQ;gBACf,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;QAChF,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACjC,IAAI,CACF,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,oDAAoD,CAAC,CAAC,CAAC,EAAE,GAAG,CACjM,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,SAAS;YAClC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,kCAAkC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpF,IAAI,CAAC,EAAE,CAAC,CAAC;QACT,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;QAC3B,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,QAAQ;YAAE,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,EAAE,CAAC,CAAC;QACT,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK;YAAE,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC;SAAM,CAAC;QACN,IAAI,CACF,0BAA0B,EAC1B,EAAE,EACF,kFAAkF,EAClF,EAAE,CACH,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QACrB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK;YAAE,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC,EAAE,CAAC,CAAC;IACX,CAAC;IACD,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC;AACzC,CAAC"}

package/dist/api/incident/project.d.ts

@@ -0,0 +1,28 @@
+import { type LockGraph, type ManifestDeps } from "../../scanner/lock-graph/index.js";
+import type { Occurrence } from "./types.js";
+export interface ProjectLock {
+    /** File name, relative to the project directory. */
+    path: string;
+    graph: LockGraph;
+}
+export interface ProjectLocks {
+    manifest: (ManifestDeps & {
+        scripts?: Record<string, unknown>;
+    }) | undefined;
+    locks: ProjectLock[];
+    notes: string[];
+}
+/** Read `package.json` and every lockfile at the root of `cwd`; unreadable ones become notes, not errors. */
+export declare function loadProjectLocks(cwd: string): ProjectLocks;
+/**
+ * Does installing this version run scripts? The lockfile says when its format records it; else the
+ * installed copy's own `package.json` (an install script, or a `binding.gyp` that npm builds
+ * implicitly); else it is not known.
+ */
+export declare function installScriptOf(cwd: string, name: string, version: string, fromLock: boolean | undefined): boolean | "unknown";
+export declare function declaredRange(manifest: ProjectLocks["manifest"], name: string): string | undefined;
+/** Occurrences of the packages `matches` accepts, over every lockfile of the project. */
+export declare function occurrencesIn(cwd: string, locks: ProjectLock[], matches: (name: string, version: string) => boolean): Array<Occurrence & {
+    name: string;
+}>;
+//# sourceMappingURL=project.d.ts.map

package/dist/api/incident/project.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project.d.ts","sourceRoot":"","sources":["../../../src/api/incident/project.ts"],"names":[],"mappings":"AAGA,OAAO,EAIL,KAAK,SAAS,EACd,KAAK,YAAY,EAElB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAI7C,MAAM,WAAW,WAAW;IAC1B,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,SAAS,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,CAAC,YAAY,GAAG;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,GAAG,SAAS,CAAC;IAC7E,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,6GAA6G;AAC7G,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,CAgD1D;AAmCD;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,OAAO,GAAG,SAAS,GAC5B,OAAO,GAAG,SAAS,CAerB;AAED,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,YAAY,CAAC,UAAU,CAAC,EAClC,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,SAAS,CAMpB;AAED,yFAAyF;AACzF,wBAAgB,aAAa,CAC3B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,WAAW,EAAE,EACpB,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,GAClD,KAAK,CAAC,UAAU,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CActC"}

package/dist/api/incident/project.js

@@ -0,0 +1,111 @@
+import { existsSync, lstatSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { findOccurrences, LOCKFILE_NAMES, parseLockGraph, } from "../../scanner/lock-graph/index.js";
+const MAX_LOCKFILE_BYTES = 200 * 1024 * 1024;
+/** Read `package.json` and every lockfile at the root of `cwd`; unreadable ones become notes, not errors. */
+export function loadProjectLocks(cwd) {
+    const notes = [];
+    let manifest;
+    try {
+        manifest = JSON.parse(readFileSync(join(cwd, "package.json"), "utf8"));
+    }
+    catch {
+        notes.push("package.json could not be read; direct and development dependencies cannot be told apart for yarn and bun lockfiles.");
+    }
+    const locks = [];
+    for (const name of LOCKFILE_NAMES) {
+        const path = join(cwd, name);
+        let size;
+        try {
+            const stat = lstatSync(path);
+            if (!stat.isFile())
+                continue;
+            size = stat.size;
+        }
+        catch {
+            continue;
+        }
+        if (size > MAX_LOCKFILE_BYTES) {
+            notes.push(`${name} is larger than ${MAX_LOCKFILE_BYTES / 1024 / 1024} MB and was not read.`);
+            continue;
+        }
+        try {
+            const graph = parseLockGraph(name, readFileSync(path, "utf8"), manifest);
+            if (graph)
+                locks.push({ path: name, graph });
+        }
+        catch (error) {
+            notes.push(`${name} could not be parsed (${error instanceof Error ? error.message.slice(0, 120) : "unknown error"}); it is not included.`);
+        }
+    }
+    if (existsSync(join(cwd, "bun.lockb"))) {
+        notes.push("bun.lockb (the binary bun lockfile) cannot be read. Run `bun install --save-text-lockfile` to produce a bun.lock this tool can analyse.");
+    }
+    if (locks.length === 0 && notes.length === 0) {
+        notes.push("No lockfile was found in the project directory, so what is locked could not be read. Commit the lockfile, or check node_modules.");
+    }
+    return { manifest, locks, notes };
+}
+const PACKAGE_NAME = /^(?:@[a-z0-9~-][a-z0-9._~-]*\/)?[a-z0-9~-][a-z0-9._~-]*$/;
+/** `package.json` of an installed copy, from npm's or pnpm's layout, when it is exactly this version. */
+function installedManifest(cwd, name, version) {
+    // The name may come from a lockfile; it must not be able to walk out of node_modules.
+    if (!PACKAGE_NAME.test(name) || /[\\/]/.test(version))
+        return undefined;
+    const candidates = [
+        join(cwd, "node_modules", name, "package.json"),
+        join(cwd, "node_modules", ".pnpm", `${name.replace("/", "+")}@${version}`, "node_modules", name, "package.json"),
+    ];
+    for (const candidate of candidates) {
+        try {
+            const parsed = JSON.parse(readFileSync(candidate, "utf8"));
+            if (parsed["version"] === version)
+                return parsed;
+        }
+        catch {
+            // Not installed there; try the next layout.
+        }
+    }
+    return undefined;
+}
+/**
+ * Does installing this version run scripts? The lockfile says when its format records it; else the
+ * installed copy's own `package.json` (an install script, or a `binding.gyp` that npm builds
+ * implicitly); else it is not known.
+ */
+export function installScriptOf(cwd, name, version, fromLock) {
+    if (fromLock === true)
+        return true;
+    const manifest = installedManifest(cwd, name, version);
+    if (manifest) {
+        const scripts = typeof manifest["scripts"] === "object" && manifest["scripts"] !== null
+            ? manifest["scripts"]
+            : {};
+        if (["preinstall", "install", "postinstall"].some((hook) => typeof scripts[hook] === "string"))
+            return true;
+        if (manifest["gypfile"] === true || existsSync(join(cwd, "node_modules", name, "binding.gyp")))
+            return true;
+        return false;
+    }
+    return fromLock ?? "unknown";
+}
+export function declaredRange(manifest, name) {
+    return (manifest?.dependencies?.[name] ??
+        manifest?.devDependencies?.[name] ??
+        manifest?.optionalDependencies?.[name]);
+}
+/** Occurrences of the packages `matches` accepts, over every lockfile of the project. */
+export function occurrencesIn(cwd, locks, matches) {
+    return locks.flatMap(({ path, graph }) => findOccurrences(graph, matches).map((found) => ({
+        name: found.name,
+        version: found.version,
+        lockfile: path,
+        direct: found.direct,
+        scope: found.scope,
+        workspaces: found.workspaces,
+        via: found.via,
+        dependents: found.dependents,
+        installScript: installScriptOf(cwd, found.name, found.version, found.installScript),
+    })));
+}
+//# sourceMappingURL=project.js.map

package/dist/api/incident/project.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project.js","sourceRoot":"","sources":["../../../src/api/incident/project.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EACL,eAAe,EACf,cAAc,EACd,cAAc,GAIf,MAAM,mCAAmC,CAAC;AAG3C,MAAM,kBAAkB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAc7C,6GAA6G;AAC7G,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,QAAkC,CAAC;IACvC,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CACnB,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CACpB,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,CAAC,IAAI,CACR,sHAAsH,CACvH,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAkB,EAAE,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;gBAAE,SAAS;YAC7B,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,IAAI,GAAG,kBAAkB,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,mBAAmB,kBAAkB,GAAG,IAAI,GAAG,IAAI,uBAAuB,CAAC,CAAC;YAC9F,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC,CAAC;YACzE,IAAI,KAAK;gBAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,IAAI,CACR,GAAG,IAAI,yBAAyB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,wBAAwB,CAC/H,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;QACvC,KAAK,CAAC,IAAI,CACR,yIAAyI,CAC1I,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CACR,kIAAkI,CACnI,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,YAAY,GAAG,0DAA0D,CAAC;AAEhF,yGAAyG;AACzG,SAAS,iBAAiB,CACxB,GAAW,EACX,IAAY,EACZ,OAAe;IAEf,sFAAsF;IACtF,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACxE,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,CAAC;QAC/C,IAAI,CACF,GAAG,EACH,cAAc,EACd,OAAO,EACP,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,OAAO,EAAE,EACtC,cAAc,EACd,IAAI,EACJ,cAAc,CACf;KACF,CAAC;IACF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAA4B,CAAC;YACtF,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,OAAO;gBAAE,OAAO,MAAM,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,4CAA4C;QAC9C,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAW,EACX,IAAY,EACZ,OAAe,EACf,QAA6B;IAE7B,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,OAAO,GACX,OAAO,QAAQ,CAAC,SAAS,CAAC,KAAK,QAAQ,IAAI,QAAQ,CAAC,SAAS,CAAC,KAAK,IAAI;YACrE,CAAC,CAAE,QAAQ,CAAC,SAAS,CAA6B;YAClD,CAAC,CAAC,EAAE,CAAC;QACT,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC;YAC5F,OAAO,IAAI,CAAC;QACd,IAAI,QAAQ,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;YAC5F,OAAO,IAAI,CAAC;QACd,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,QAAQ,IAAI,SAAS,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,QAAkC,EAClC,IAAY;IAEZ,OAAO,CACL,QAAQ,EAAE,YAAY,EAAE,CAAC,IAAI,CAAC;QAC9B,QAAQ,EAAE,eAAe,EAAE,CAAC,IAAI,CAAC;QACjC,QAAQ,EAAE,oBAAoB,EAAE,CAAC,IAAI,CAAC,CACvC,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,aAAa,CAC3B,GAAW,EACX,KAAoB,EACpB,OAAmD;IAEnD,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CACvC,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,KAAwB,EAAE,EAAE,CAAC,CAAC;QACjE,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,aAAa,EAAE,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC;KACpF,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC"}

package/dist/api/incident/rollback.d.ts

@@ -0,0 +1,50 @@
+import type { RemediationReport } from "../../platform/types.js";
+import type { PackageHistory } from "./history.js";
+import type { PackageExposure, RollbackProposal } from "./types.js";
+export interface RollbackChoice {
+    toVersion?: string;
+    basis?: RollbackProposal["basis"];
+    lastUsedBefore?: string;
+    newerUnaffected?: string;
+}
+/**
+ * The version to go back to for one installed copy.
+ *
+ * Candidates are versions outside the affected range and older than the installed copy; a
+ * prerelease is only considered when the installed copy is one. With the registry consulted, the
+ * newest candidate published (or seen in the project's lockfile history) wins ("newest-unaffected").
+ * Without it, the newest candidate the project's own lockfile history shows it has run wins
+ * ("last-used-before"): the version the project is known to have worked with.
+ */
+export declare function chooseRollbackTarget(input: {
+    range: string;
+    installed: string;
+    /** Versions the registry lists, if it was consulted. */
+    published?: string[];
+    /** Versions the lockfile had just before the affected one first arrived. */
+    previousVersions: string[];
+    /** Every version of the package seen in the lockfile history. */
+    seenVersions: string[];
+}): RollbackChoice;
+/** One proposal per installed affected copy. */
+export declare function proposeRollbacks(input: {
+    exposures: PackageExposure[];
+    histories: PackageHistory[];
+    published: Map<string, string[] | undefined>;
+}): RollbackProposal[];
+/**
+ * The preview report `persistPlan` turns into a plan. Every item is held for approval: an
+ * incident rollback is never applied by itself.
+ */
+export declare function rollbackReport(input: {
+    id: string;
+    summary: string;
+    advisorySummary: string;
+    affected: Array<{
+        name: string;
+        range: string;
+        source: "osv" | "github-advisory" | "offline-snapshot" | "user-supplied";
+    }>;
+    proposals: RollbackProposal[];
+}): RemediationReport;
+//# sourceMappingURL=rollback.d.ts.map

package/dist/api/incident/rollback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rollback.d.ts","sourceRoot":"","sources":["../../../src/api/incident/rollback.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAe,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC9E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEpE,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAClC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAKD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,4EAA4E;IAC5E,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,iEAAiE;IACjE,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB,GAAG,cAAc,CA0BjB;AAED,gDAAgD;AAChD,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACtC,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;CAC9C,GAAG,gBAAgB,EAAE,CA8CrB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,KAAK,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,KAAK,GAAG,iBAAiB,GAAG,kBAAkB,GAAG,eAAe,CAAC;KAC1E,CAAC,CAAC;IACH,SAAS,EAAE,gBAAgB,EAAE,CAAC;CAC/B,GAAG,iBAAiB,CAiDpB"}

package/dist/api/incident/rollback.js

@@ -0,0 +1,132 @@
+import semver from "semver";
+const inAffected = (version, range) => semver.satisfies(version, range, { includePrerelease: true });
+/**
+ * The version to go back to for one installed copy.
+ *
+ * Candidates are versions outside the affected range and older than the installed copy; a
+ * prerelease is only considered when the installed copy is one. With the registry consulted, the
+ * newest candidate published (or seen in the project's lockfile history) wins ("newest-unaffected").
+ * Without it, the newest candidate the project's own lockfile history shows it has run wins
+ * ("last-used-before"): the version the project is known to have worked with.
+ */
+export function chooseRollbackTarget(input) {
+    const allowPrerelease = semver.prerelease(input.installed) !== null;
+    const usable = (version) => semver.valid(version) !== null &&
+        !inAffected(version, input.range) &&
+        (allowPrerelease || semver.prerelease(version) === null);
+    const olderOf = (versions) => [...new Set(versions)]
+        .filter((version) => usable(version) && semver.lt(version, input.installed))
+        .toSorted(semver.rcompare);
+    const usedBefore = olderOf([...input.seenVersions, ...input.previousVersions])[0];
+    const newerUnaffected = [...new Set([...(input.published ?? []), ...input.seenVersions])]
+        .filter((version) => usable(version) && semver.gt(version, input.installed))
+        .toSorted(semver.rcompare)[0];
+    const common = {
+        ...(usedBefore ? { lastUsedBefore: usedBefore } : {}),
+        ...(newerUnaffected ? { newerUnaffected } : {}),
+    };
+    if (input.published) {
+        const newest = olderOf([...input.published, ...input.seenVersions])[0];
+        if (newest)
+            return { toVersion: newest, basis: "newest-unaffected", ...common };
+    }
+    if (usedBefore)
+        return { toVersion: usedBefore, basis: "last-used-before", ...common };
+    return common;
+}
+/** One proposal per installed affected copy. */
+export function proposeRollbacks(input) {
+    const proposals = [];
+    const done = new Set();
+    for (const exposure of input.exposures) {
+        const history = input.histories.find((candidate) => candidate.packageName === exposure.packageName);
+        const seen = history?.versionsSeen.map((entry) => entry.version) ?? [];
+        for (const occurrence of exposure.occurrences) {
+            const key = `${exposure.packageName}@${occurrence.version}`;
+            if (done.has(key))
+                continue;
+            done.add(key);
+            const previous = history?.windows
+                .filter((window) => window.version === occurrence.version)
+                .flatMap((window) => window.previousVersions)
+                .toSorted((a, b) => (semver.valid(a) && semver.valid(b) ? semver.rcompare(a, b) : 0));
+            const published = input.published.get(exposure.packageName);
+            const choice = chooseRollbackTarget({
+                range: exposure.range,
+                installed: occurrence.version,
+                ...(published ? { published } : {}),
+                previousVersions: previous ?? [],
+                seenVersions: seen,
+            });
+            const direct = occurrence.direct;
+            proposals.push({
+                packageName: exposure.packageName,
+                fromVersion: occurrence.version,
+                ...(choice.toVersion ? { toVersion: choice.toVersion } : {}),
+                strategy: direct ? "version-bump" : "override",
+                dependencyScope: direct ? "direct" : "transitive",
+                ...(choice.basis ? { basis: choice.basis } : {}),
+                ...(choice.lastUsedBefore ? { lastUsedBefore: choice.lastUsedBefore } : {}),
+                ...(choice.newerUnaffected ? { newerUnaffected: choice.newerUnaffected } : {}),
+                ...(choice.toVersion
+                    ? {}
+                    : {
+                        reason: `No known version of ${exposure.packageName} older than ${occurrence.version} is outside the affected range ${exposure.range}${published ? "" : " (the registry was not consulted)"}. If every version is affected, remove or replace the dependency.`,
+                    }),
+            });
+        }
+    }
+    return proposals;
+}
+/**
+ * The preview report `persistPlan` turns into a plan. Every item is held for approval: an
+ * incident rollback is never applied by itself.
+ */
+export function rollbackReport(input) {
+    const results = input.proposals.map((proposal) => {
+        const base = {
+            packageName: proposal.packageName,
+            fromVersion: proposal.fromVersion,
+            applied: false,
+            dryRun: true,
+            dependencyScope: proposal.dependencyScope,
+        };
+        if (!proposal.toVersion) {
+            return {
+                ...base,
+                strategy: "none",
+                unresolvedReason: "no-safe-version",
+                message: proposal.reason ?? "No version to roll back to is known.",
+            };
+        }
+        return {
+            ...base,
+            strategy: proposal.strategy,
+            toVersion: proposal.toVersion,
+            disposition: "hold-for-approval",
+            dispositionReason: "Incident rollback: review before applying; it is never applied automatically.",
+            message: `Roll ${proposal.packageName} back from ${proposal.fromVersion} to ${proposal.toVersion} (${proposal.strategy === "version-bump"
+                ? "exact pin in package.json"
+                : "package-manager override"}).`,
+        };
+    });
+    return {
+        cveId: input.id,
+        cveDetails: {
+            id: input.id,
+            summary: input.advisorySummary,
+            severity: "UNKNOWN",
+            references: [],
+            affectedPackages: input.affected.map((entry) => ({
+                name: entry.name,
+                ecosystem: "npm",
+                vulnerableRange: entry.range,
+                source: entry.source,
+            })),
+        },
+        vulnerablePackages: [],
+        results,
+        summary: input.summary,
+    };
+}
+//# sourceMappingURL=rollback.js.map

package/dist/api/incident/rollback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rollback.js","sourceRoot":"","sources":["../../../src/api/incident/rollback.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAa5B,MAAM,UAAU,GAAG,CAAC,OAAe,EAAE,KAAa,EAAW,EAAE,CAC7D,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;AAEhE;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,KASpC;IACC,MAAM,eAAe,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC;IACpE,MAAM,MAAM,GAAG,CAAC,OAAe,EAAW,EAAE,CAC1C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI;QAC9B,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC;QACjC,CAAC,eAAe,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,CAAC,QAAkB,EAAY,EAAE,CAC/C,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;SACnB,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;SAC3E,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE/B,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,YAAY,EAAE,GAAG,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,MAAM,eAAe,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;SACtF,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;SAC3E,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC;IAEF,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,SAAS,EAAE,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvE,IAAI,MAAM;YAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,EAAE,GAAG,MAAM,EAAE,CAAC;IAClF,CAAC;IACD,IAAI,UAAU;QAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,kBAAkB,EAAE,GAAG,MAAM,EAAE,CAAC;IACvF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,gBAAgB,CAAC,KAIhC;IACC,MAAM,SAAS,GAAuB,EAAE,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAClC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CAC9D,CAAC;QACF,MAAM,IAAI,GAAG,OAAO,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACvE,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC9C,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,WAAW,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;YAC5D,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAEd,MAAM,QAAQ,GAAG,OAAO,EAAE,OAAO;iBAC9B,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,CAAC;iBACzD,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC;iBAC5C,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxF,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC5D,MAAM,MAAM,GAAG,oBAAoB,CAAC;gBAClC,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,SAAS,EAAE,UAAU,CAAC,OAAO;gBAC7B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnC,gBAAgB,EAAE,QAAQ,IAAI,EAAE;gBAChC,YAAY,EAAE,IAAI;aACnB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;YACjC,SAAS,CAAC,IAAI,CAAC;gBACb,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,WAAW,EAAE,UAAU,CAAC,OAAO;gBAC/B,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5D,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU;gBAC9C,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;gBACjD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChD,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3E,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9E,GAAG,CAAC,MAAM,CAAC,SAAS;oBAClB,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC;wBACE,MAAM,EAAE,uBAAuB,QAAQ,CAAC,WAAW,eAAe,UAAU,CAAC,OAAO,kCAAkC,QAAQ,CAAC,KAAK,GAClI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,mCACnB,mEAAmE;qBACpE,CAAC;aACP,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,KAU9B;IACC,MAAM,OAAO,GAAkB,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QAC9D,MAAM,IAAI,GAAG;YACX,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,IAAI;YACZ,eAAe,EAAE,QAAQ,CAAC,eAAe;SAC1C,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;YACxB,OAAO;gBACL,GAAG,IAAI;gBACP,QAAQ,EAAE,MAAe;gBACzB,gBAAgB,EAAE,iBAA0B;gBAC5C,OAAO,EAAE,QAAQ,CAAC,MAAM,IAAI,sCAAsC;aACnE,CAAC;QACJ,CAAC;QACD,OAAO;YACL,GAAG,IAAI;YACP,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,WAAW,EAAE,mBAA4B;YACzC,iBAAiB,EACf,+EAA+E;YACjF,OAAO,EAAE,QAAQ,QAAQ,CAAC,WAAW,cAAc,QAAQ,CAAC,WAAW,OAAO,QAAQ,CAAC,SAAS,KAC9F,QAAQ,CAAC,QAAQ,KAAK,cAAc;gBAClC,CAAC,CAAC,2BAA2B;gBAC7B,CAAC,CAAC,0BACN,IAAI;SACL,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,EAAE;QACf,UAAU,EAAE;YACV,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,OAAO,EAAE,KAAK,CAAC,eAAe;YAC9B,QAAQ,EAAE,SAAS;YACnB,UAAU,EAAE,EAAE;YACd,gBAAgB,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC/C,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,SAAS,EAAE,KAAc;gBACzB,eAAe,EAAE,KAAK,CAAC,KAAK;gBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;aACrB,CAAC,CAAC;SACJ;QACD,kBAAkB,EAAE,EAAE;QACtB,OAAO;QACP,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC"}

package/dist/api/incident/target.d.ts

@@ -0,0 +1,18 @@
+import { lookupCveGitHub } from "../../intelligence/sources/github-advisory.js";
+import type { CveDetails } from "../../platform/types.js";
+import type { IncidentTarget } from "./types.js";
+export declare const isAdvisoryId: (value: string) => boolean;
+/** Advisory feeds write ranges as `>= 1.0.0, < 1.2.0`; semver wants spaces. */
+export declare function normalizeRange(range: string): string | undefined;
+/** Lookups an advisory id needs; replaceable so tests and embedders need no network. */
+export interface TargetDeps {
+    lookupOsv(id: string): Promise<CveDetails | null>;
+    lookupGitHub: typeof lookupCveGitHub;
+}
+export declare const defaultTargetDeps: TargetDeps;
+/** Turn what the user typed into the packages and version ranges that are bad. */
+export declare function resolveTarget(input: string, options: {
+    offline?: boolean;
+    intelligenceSnapshotPath?: string;
+}, deps?: TargetDeps): Promise<IncidentTarget>;
+//# sourceMappingURL=target.d.ts.map

package/dist/api/incident/target.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"target.d.ts","sourceRoot":"","sources":["../../../src/api/incident/target.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,eAAe,EAEhB,MAAM,+CAA+C,CAAC;AAMvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAE1D,OAAO,KAAK,EAAiB,cAAc,EAAE,MAAM,YAAY,CAAC;AAMhE,eAAO,MAAM,YAAY,UAAW,MAAM,KAAG,OAAyC,CAAC;AAEvF,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGhE;AAED,wFAAwF;AACxF,MAAM,WAAW,UAAU;IACzB,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAClD,YAAY,EAAE,OAAO,eAAe,CAAC;CACtC;AAED,eAAO,MAAM,iBAAiB,EAAE,UAG/B,CAAC;AAOF,kFAAkF;AAClF,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,wBAAwB,CAAC,EAAE,MAAM,CAAA;CAAE,EACjE,IAAI,GAAE,UAA8B,GACnC,OAAO,CAAC,cAAc,CAAC,CAgGzB"}