autoremediator 0.21.2 → 0.22.0

package/dist/api/policy-nl/request-match.js

@@ -0,0 +1,94 @@
+import { normalizeForMatch } from "./sanitize.js";
+/** Normalised words of a text: lower-case, punctuation and spacing folded away, package names kept whole. */
+export const tokensOf = (text) => normalizeForMatch(text)
+    .split(" ")
+    .map((token) => token.replaceAll(/^[.\-/]+|[.\-/]+$/g, ""))
+    .filter(Boolean);
+/** Split a request into rules: by line, semicolon or sentence end. */
+export function clausesOf(request) {
+    return request
+        .split(/[;\n]+|\.(?=\s|$)/)
+        .map((clause) => clause.trim())
+        .filter((clause) => tokensOf(clause).length > 0);
+}
+export function indexRequest(request) {
+    const tokens = [];
+    const clause = [];
+    for (const [number, text] of clausesOf(request).entries()) {
+        for (const token of tokensOf(text)) {
+            tokens.push(token);
+            clause.push(number);
+        }
+    }
+    return { tokens, clause };
+}
+/** Start positions where `phrase` occurs in the request as a run of consecutive words, in order. */
+export function findPhrase(index, phrase) {
+    const words = tokensOf(phrase);
+    if (words.length === 0)
+        return [];
+    const starts = [];
+    for (let start = 0; start + words.length <= index.tokens.length; start += 1) {
+        if (words.every((word, offset) => index.tokens[start + offset] === word))
+            starts.push(start);
+    }
+    return starts;
+}
+const NEGATION_WORDS = new Set([
+    "never",
+    "not",
+    "no",
+    "without",
+    "cannot",
+    "nor",
+    "neither",
+    "dont",
+    "doesnt",
+    "cant",
+    "wont",
+    "shouldnt",
+    "mustnt",
+    "isnt",
+    "arent",
+]);
+/** Stems of `don't`, `can't` and the like, which normalisation splits into the stem and `t`. */
+const NEGATION_STEMS = new Set([
+    "don",
+    "doesn",
+    "didn",
+    "can",
+    "won",
+    "shouldn",
+    "mustn",
+    "isn",
+    "aren",
+    "wouldn",
+    "couldn",
+]);
+/** How many words before a phrase a negation still governs it. */
+const NEGATION_REACH = 4;
+/** Whether the word at `position` negates what follows it (`no longer` does not). */
+function negatesAt(tokens, position) {
+    const token = tokens[position] ?? "";
+    if (token === "no")
+        return tokens[position + 1] !== "longer";
+    if (token === "t")
+        return NEGATION_STEMS.has(tokens[position - 1] ?? "");
+    return NEGATION_WORDS.has(token);
+}
+/**
+ * Whether a negation (never, not, don't, without, no...) governs the run of words that starts at
+ * `start`: inside it, or in the few words before it within the same rule. A model that quotes
+ * "allow major bumps" out of "Never allow major bumps" is quoting words that say the opposite.
+ */
+export function isNegated(index, start, length) {
+    const ruleStart = index.clause[start];
+    for (let position = Math.max(0, start - NEGATION_REACH); position < start + length && position < index.tokens.length; position += 1) {
+        if (position < start && index.clause[position] !== ruleStart)
+            continue;
+        if (negatesAt(index.tokens, position))
+            return true;
+    }
+    return false;
+}
+//# sourceMappingURL=request-match.js.map

package/dist/api/policy-nl/request-match.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-match.js","sourceRoot":"","sources":["../../../src/api/policy-nl/request-match.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AASlD,6GAA6G;AAC7G,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAY,EAAE,CACjD,iBAAiB,CAAC,IAAI,CAAC;KACpB,KAAK,CAAC,GAAG,CAAC;KACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;KAC1D,MAAM,CAAC,OAAO,CAAC,CAAC;AAErB,sEAAsE;AACtE,MAAM,UAAU,SAAS,CAAC,OAAe;IACvC,OAAO,OAAO;SACX,KAAK,CAAC,mBAAmB,CAAC;SAC1B,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;SAC9B,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1D,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC5B,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,UAAU,CAAC,KAAmB,EAAE,MAAc;IAC5D,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5E,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,OAAO;IACP,KAAK;IACL,IAAI;IACJ,SAAS;IACT,QAAQ;IACR,KAAK;IACL,SAAS;IACT,MAAM;IACN,QAAQ;IACR,MAAM;IACN,MAAM;IACN,UAAU;IACV,QAAQ;IACR,MAAM;IACN,OAAO;CACR,CAAC,CAAC;AACH,gGAAgG;AAChG,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,KAAK;IACL,OAAO;IACP,MAAM;IACN,KAAK;IACL,KAAK;IACL,SAAS;IACT,OAAO;IACP,KAAK;IACL,MAAM;IACN,QAAQ;IACR,QAAQ;CACT,CAAC,CAAC;AACH,kEAAkE;AAClE,MAAM,cAAc,GAAG,CAAC,CAAC;AAEzB,qFAAqF;AACrF,SAAS,SAAS,CAAC,MAAyB,EAAE,QAAgB;IAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,KAAK,QAAQ,CAAC;IAC7D,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACzE,OAAO,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,KAAmB,EAAE,KAAa,EAAE,MAAc;IAC1E,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtC,KACE,IAAI,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,cAAc,CAAC,EAClD,QAAQ,GAAG,KAAK,GAAG,MAAM,IAAI,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,EAC3D,QAAQ,IAAI,CAAC,EACb,CAAC;QACD,IAAI,QAAQ,GAAG,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,SAAS;YAAE,SAAS;QACvE,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;IACrD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/api/policy-nl/sanitize.d.ts

@@ -0,0 +1,21 @@
+/** Longest plain-language request accepted. Rules are short; a longer text is not a rule list. */
+export declare const MAX_REQUEST_LENGTH = 2000;
+/** Longest suppression note written to a policy file. */
+export declare const MAX_NOTE_LENGTH = 200;
+/** Thrown for input that is refused before any model is called. */
+export declare class PolicyRequestError extends Error {
+    readonly name = "PolicyRequestError";
+}
+/** Remove the characters {@link isInvisible} names. Exported for tests that check output is clean. */
+export declare function stripInvisible(text: string): string;
+/**
+ * Clean the user's request. It is untrusted: it is capped, stripped of control and invisible
+ * characters, and has its line breaks kept (they separate rules) but its runs of blank space
+ * collapsed. Nothing here makes text safe to follow; the model's answer is validated separately.
+ */
+export declare function sanitizeRequest(raw: string): string;
+/** A suppression note: one line, no control characters, capped. The only free text a policy may get. */
+export declare function sanitizeNote(raw: string): string;
+/** Lower-case, collapse punctuation and blank space, so a phrase can be found in the request. */
+export declare function normalizeForMatch(text: string): string;
+//# sourceMappingURL=sanitize.d.ts.map

package/dist/api/policy-nl/sanitize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../../src/api/policy-nl/sanitize.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,eAAO,MAAM,kBAAkB,OAAO,CAAC;AACvC,yDAAyD;AACzD,eAAO,MAAM,eAAe,MAAM,CAAC;AAEnC,mEAAmE;AACnE,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,SAAkB,IAAI,wBAAwB;CAC/C;AAkBD,sGAAsG;AACtG,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAMnD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAmBnD;AAED,wGAAwG;AACxG,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,iGAAiG;AACjG,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKtD"}

package/dist/api/policy-nl/sanitize.js

@@ -0,0 +1,65 @@
+/** Longest plain-language request accepted. Rules are short; a longer text is not a rule list. */
+export const MAX_REQUEST_LENGTH = 2000;
+/** Longest suppression note written to a policy file. */
+export const MAX_NOTE_LENGTH = 200;
+/** Thrown for input that is refused before any model is called. */
+export class PolicyRequestError extends Error {
+    name = "PolicyRequestError";
+}
+/**
+ * Control characters (other than newline and tab, which are handled separately), DEL and C1; zero-width
+ * and bidirectional formatting characters that can hide or reorder text; and the byte-order mark.
+ */
+function isInvisible(code) {
+    return ((code <= 0x1f && code !== 0x09 && code !== 0x0a) ||
+        (code >= 0x7f && code <= 0x9f) ||
+        (code >= 0x20_0b && code <= 0x20_0f) ||
+        (code >= 0x20_2a && code <= 0x20_2e) ||
+        (code >= 0x20_60 && code <= 0x20_64) ||
+        (code >= 0x20_66 && code <= 0x20_69) ||
+        code === 0xfe_ff);
+}
+/** Remove the characters {@link isInvisible} names. Exported for tests that check output is clean. */
+export function stripInvisible(text) {
+    let kept = "";
+    for (const char of text) {
+        if (!isInvisible(char.codePointAt(0) ?? 0))
+            kept += char;
+    }
+    return kept;
+}
+/**
+ * Clean the user's request. It is untrusted: it is capped, stripped of control and invisible
+ * characters, and has its line breaks kept (they separate rules) but its runs of blank space
+ * collapsed. Nothing here makes text safe to follow; the model's answer is validated separately.
+ */
+export function sanitizeRequest(raw) {
+    if (typeof raw !== "string")
+        throw new PolicyRequestError("The request must be text.");
+    if (raw.length > MAX_REQUEST_LENGTH * 2) {
+        throw new PolicyRequestError(`The request is too long (limit ${MAX_REQUEST_LENGTH} characters).`);
+    }
+    const text = stripInvisible(raw.replaceAll(/\r\n?/g, "\n"))
+        .replaceAll(/[^\S\n]+/g, " ")
+        .replaceAll(/ ?\n ?/g, "\n")
+        .replaceAll(/\n{3,}/g, "\n\n")
+        .trim();
+    if (text === "")
+        throw new PolicyRequestError("The request is empty.");
+    if (text.length > MAX_REQUEST_LENGTH) {
+        throw new PolicyRequestError(`The request is too long (limit ${MAX_REQUEST_LENGTH} characters).`);
+    }
+    return text;
+}
+/** A suppression note: one line, no control characters, capped. The only free text a policy may get. */
+export function sanitizeNote(raw) {
+    return stripInvisible(raw).replaceAll(/\s+/gu, " ").trim().slice(0, MAX_NOTE_LENGTH);
+}
+/** Lower-case, collapse punctuation and blank space, so a phrase can be found in the request. */
+export function normalizeForMatch(text) {
+    return text
+        .toLowerCase()
+        .replaceAll(/[^\p{L}\p{N}@/*.-]+/gu, " ")
+        .trim();
+}
+//# sourceMappingURL=sanitize.js.map

package/dist/api/policy-nl/sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../../../src/api/policy-nl/sanitize.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AACvC,yDAAyD;AACzD,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,CAAC;AAEnC,mEAAmE;AACnE,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IACzB,IAAI,GAAG,oBAAoB,CAAC;CAC/C;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,CACL,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,CAAC;QAChD,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC;QAC9B,CAAC,IAAI,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,CAAC;QACpC,CAAC,IAAI,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,CAAC;QACpC,CAAC,IAAI,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,CAAC;QACpC,CAAC,IAAI,IAAI,OAAO,IAAI,IAAI,IAAI,OAAO,CAAC;QACpC,IAAI,KAAK,OAAO,CACjB,CAAC;AACJ,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAAE,IAAI,IAAI,IAAI,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,kBAAkB,CAAC,2BAA2B,CAAC,CAAC;IACvF,IAAI,GAAG,CAAC,MAAM,GAAG,kBAAkB,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,kBAAkB,CAC1B,kCAAkC,kBAAkB,eAAe,CACpE,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;SACxD,UAAU,CAAC,WAAW,EAAE,GAAG,CAAC;SAC5B,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC;SAC3B,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC;SAC7B,IAAI,EAAE,CAAC;IACV,IAAI,IAAI,KAAK,EAAE;QAAE,MAAM,IAAI,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACvE,IAAI,IAAI,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACrC,MAAM,IAAI,kBAAkB,CAC1B,kCAAkC,kBAAkB,eAAe,CACpE,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;AACvF,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,IAAI;SACR,WAAW,EAAE;SACb,UAAU,CAAC,uBAAuB,EAAE,GAAG,CAAC;SACxC,IAAI,EAAE,CAAC;AACZ,CAAC"}

package/dist/api/policy-nl/vocabulary.d.ts

@@ -0,0 +1,9 @@
+/** Whether `path` has any vocabulary at all (every key a model may touch must). */
+export declare const hasVocabulary: (path: string) => boolean;
+/**
+ * Whether the words of `text` are about the policy key `path` (`related`) or ask for it to be loosened
+ * (`loosen`), on whole words. The key's own name also counts, so a request that says `denyPackages`
+ * is understood.
+ */
+export declare function mentionsKey(path: string, kind: "related" | "loosen", text: string): boolean;
+//# sourceMappingURL=vocabulary.d.ts.map

package/dist/api/policy-nl/vocabulary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vocabulary.d.ts","sourceRoot":"","sources":["../../../src/api/policy-nl/vocabulary.ts"],"names":[],"mappings":"AAmJA,mFAAmF;AACnF,eAAO,MAAM,aAAa,SAAU,MAAM,KAAG,OAAsC,CAAC;AAEpF;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAS3F"}

package/dist/api/policy-nl/vocabulary.js

@@ -0,0 +1,118 @@
+import { UNRESOLVED_REASON_VALUES } from "../../platform/option-schemas.js";
+import { tokensOf } from "./request-match.js";
+const words = (source) => new RegExp(source, "u");
+/** `\bstem\w*` for each stem, as one alternation. */
+const stems = (...list) => list.map((stem) => `\\b${stem}\\w*`).join("|");
+const EXPLOIT = stems("exploit");
+const SEVERITY = String.raw `\bcritical\b|\bhigh\b|\bmedium\b|\blow\b|\bseverit(?:y|ies)\b`;
+const REASONS = UNRESOLVED_REASON_VALUES.map((reason) => `\\b${reason.replaceAll("-", "[- ]")}\\b`).join("|");
+/** One entry per key a model may touch (and the sub-keys that have their own words). */
+const TABLE = {
+    allowMajorBumps: { related: words(String.raw `\bmajors?\b|\bbreaking\b|\bsemver\b`) },
+    denyPackages: {
+        related: words(`\\bden(?:y|ies|ied|ylist)\\b|${stems("block", "unblock", "exclud", "touch", "chang", "modif", "upgrad", "updat", "bump", "allow", "permit", "remov", "lift", "clear", "packag", "dependenc")}|\\bban(?:s|ned)?\\b|\\bunban(?:s|ned)?\\b|\\bdrop(?:s|ped)?\\b|\\bpin(?:s|ned)?\\b|\\bleave\\b|\\balone\\b|\\breset\\b|\\bnever\\b`),
+        loosen: words(`${stems("allow", "permit", "unblock", "remov", "lift", "clear", "touch", "exclud", "upgrad", "updat", "enabl")}|\\bunban(?:s|ned)?\\b|\\bdrop(?:s|ped)?\\b|\\breset\\b|\\bno longer\\b|\\bstop(?:s|ped)? (?:blocking|denying|banning|excluding)\\b|\\bmay\\b|\\bcan\\b|\\bfree\\b|\\bbump\\b`),
+    },
+    allowPackages: {
+        related: words(`${stems("allow", "permit", "whitelist", "includ", "restrict", "limit", "packag", "touch", "chang", "modif", "updat", "upgrad", "remov", "lift", "clear", "widen", "extend")}|\\bonly\\b|\\badd\\b|\\balso\\b|\\bdrop(?:s|ped)?\\b`),
+        loosen: words(`${stems("allow", "permit", "whitelist", "includ", "touch", "remov", "lift", "clear", "widen", "extend")}|\\badd\\b|\\balso\\b|\\bdrop(?:s|ped)?\\b`),
+    },
+    constraints: { related: words(String.raw `\bconstraints?\b`) },
+    "constraints.directDependenciesOnly": {
+        related: words(String.raw `\bdirect\b|\btransitive\b|\bindirect\b|\bdependenc(?:y|ies)\b|\btop-level\b|\bnested\b`),
+    },
+    "constraints.preferVersionBump": {
+        related: words(`${stems("bump", "overrid", "prefer", "upgrad")}|\\bversion bumps?\\b|\\bpatch(?:es|ing)?\\b`),
+    },
+    "constraints.installMode": {
+        related: words(`${stems("install", "cache")}|\\boffline\\b|\\bdeterministic\\b`),
+    },
+    "constraints.installPreferOffline": {
+        related: words(`${stems("install", "cache")}|\\boffline\\b`),
+    },
+    "constraints.enforceFrozenLockfile": {
+        related: words(String.raw `\bfrozen\b|\block[- ]?files?\b`),
+    },
+    "constraints.workspace": { related: words(String.raw `\bworkspaces?\b|\bmonorepo\b`) },
+    "constraints.typecheck": {
+        related: words(String.raw `\btype-?check\w*|\btypes?\b|\btsc\b|\btypescript\b`),
+    },
+    "constraints.requireProofOfFix": {
+        related: words(`${stems("proof", "prove", "verif", "reproduc")}|\\bregression\\b`),
+    },
+    "constraints.enableBreakingChangeRefactor": {
+        related: words(`${stems("refactor", "rewrit")}|\\bcodemods?\\b|\\bbreaking\\b`),
+    },
+    "constraints.supplyChainPolicy": { related: words(String.raw `\bsupply[- ]chain\b`) },
+    "constraints.supplyChainPolicy.minPublishAgeHours": {
+        related: words(`${stems("publish", "fresh", "wait")}|\\bage\\b|\\baged\\b|\\bhours?\\b|\\bdays?\\b|\\bnewly\\b|\\bnew (?:versions?|releases?)\\b|\\bcool-?off\\b|\\bolder\\b|\\bat least\\b`),
+    },
+    "constraints.supplyChainPolicy.blockInstallScripts": {
+        related: words(String.raw `\binstall[- ]?scripts?\b|\blifecycle\b|\bpostinstall\b|\bpreinstall\b|\bscripts?\b`),
+    },
+    "constraints.supplyChainPolicy.requireProvenance": {
+        related: words(String.raw `\bprovenance\b|\battestations?\b|\bsigned\b|\bsigstore\b`),
+    },
+    exploitSignalOverride: { related: words(`${EXPLOIT}|\\bsignals?\\b`) },
+    "exploitSignalOverride.kev": {
+        related: words(String.raw `\bkev\b|\bknown[- ]exploited\b|\bcisa\b|\bexploited\b`),
+    },
+    "exploitSignalOverride.epss": {
+        related: words(`\\bepss\\b|${EXPLOIT}|\\blikelihood\\b|\\bprobab\\w*`),
+    },
+    suppressions: {
+        related: words(`${stems("suppress", "ignor", "dismiss", "silenc", "mitigat", "waiv", "exempt", "snooze", "defer")}|\\bnot affected\\b|\\bfalse positives?\\b|\\bexceptions?\\b|\\bvex\\b|\\baccept(?:ed)? (?:the )?risk\\b|\\bcve-\\d{4}-\\d{4,}\\b|\\bghsa(?:-[a-z0-9]{4}){3}\\b`),
+    },
+    // A deadline needs a time or the word for one; a severity alone does not say how long.
+    sla: {
+        related: words(String.raw `\bsla\b|\bdeadlines?\b|\bhours?\b|\bdays?\b|\bweeks?\b|\b\d+ ?(?:h|hrs?|d|w)\b|\btime limit\b|\bservice level\b|\bturnaround\b|\bwithin\b`),
+    },
+    dispositionPolicy: { related: words(String.raw `\bdisposition\b`) },
+    "dispositionPolicy.minConfidenceForAutoApply": {
+        related: words(stems("confiden", "auto-?appl", "automatic", "certain")),
+    },
+    "dispositionPolicy.holdForTransitive": {
+        related: words(`${stems("hold", "approv")}|\\btransitive\\b|\\bindirect\\b`),
+    },
+    "dispositionPolicy.escalateOnKev": {
+        related: words(`${stems("escalat")}|\\bkev\\b|\\bknown[- ]exploited\\b`),
+    },
+    "dispositionPolicy.escalateOnSlaBreachSeverities": {
+        related: words(`${stems("escalat", "breach")}|\\bsla\\b|\\boverdue\\b|${SEVERITY}`),
+    },
+    containmentMode: {
+        related: words(`${stems("contain", "revert", "hold", "approv", "quarantin")}|\\broll(?:ed|ing)?[- ]?back\\b|\\bundo\\b`),
+    },
+    escalationGraph: {
+        related: words(`${stems("escalat", "notif", "alert", "unresolved", "fail", "block")}|\\bissues?\\b|\\bdraft\\b|\\bpull requests?\\b|\\bprs?\\b|\\bhold\\b|\\bbranch\\b|\\bfollow-?up\\b|\\bnothing\\b|\\bpage\\b|\\bslack\\b|\\bno safe version\\b|${REASONS}`),
+    },
+    autonomy: {
+        related: words(`${stems("autonom", "auto-?merg", "observ", "suggest", "merg", "trust")}|\\bceiling\\b|\\bl[0-4]\\b|\\bpull requests?\\b|\\bprs?\\b|\\blevel\\b|\\bunattended\\b`),
+    },
+};
+/** The entries that speak for `path`: its own and its descendants'; failing that, the nearest ancestor's. */
+function entriesFor(path) {
+    const own = Object.entries(TABLE).filter(([key]) => key === path || key.startsWith(`${path}.`));
+    if (own.length > 0)
+        return own.map(([, entry]) => entry);
+    const parent = path.includes(".") ? path.slice(0, path.lastIndexOf(".")) : "";
+    return parent === "" ? [] : entriesFor(parent);
+}
+/** Whether `path` has any vocabulary at all (every key a model may touch must). */
+export const hasVocabulary = (path) => entriesFor(path).length > 0;
+/**
+ * Whether the words of `text` are about the policy key `path` (`related`) or ask for it to be loosened
+ * (`loosen`), on whole words. The key's own name also counts, so a request that says `denyPackages`
+ * is understood.
+ */
+export function mentionsKey(path, kind, text) {
+    const normalised = tokensOf(text).join(" ");
+    const entries = entriesFor(path);
+    if (entries.length === 0)
+        return false;
+    const name = (path.split(".").pop() ?? "").toLowerCase().replaceAll("-", "[- ]");
+    if (new RegExp(`\\b${name}\\b`, "u").test(normalised))
+        return true;
+    return entries.some((entry) => (kind === "loosen" ? (entry.loosen ?? entry.related) : entry.related).test(normalised));
+}
+//# sourceMappingURL=vocabulary.js.map

package/dist/api/policy-nl/vocabulary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vocabulary.js","sourceRoot":"","sources":["../../../src/api/policy-nl/vocabulary.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAiB9C,MAAM,KAAK,GAAG,CAAC,MAAc,EAAU,EAAE,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAClE,qDAAqD;AACrD,MAAM,KAAK,GAAG,CAAC,GAAG,IAAc,EAAU,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE5F,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;AACjC,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAA,+DAA+D,CAAC;AAC3F,MAAM,OAAO,GAAG,wBAAwB,CAAC,GAAG,CAC1C,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CACtD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEZ,wFAAwF;AACxF,MAAM,KAAK,GAAoC;IAC7C,eAAe,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAA,qCAAqC,CAAC,EAAE;IACpF,YAAY,EAAE;QACZ,OAAO,EAAE,KAAK,CACZ,gCAAgC,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,qIAAqI,CACnU;QACD,MAAM,EAAE,KAAK,CACX,GAAG,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,+KAA+K,CAC/R;KACF;IACD,aAAa,EAAE;QACb,OAAO,EAAE,KAAK,CACZ,GAAG,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,uDAAuD,CACpO;QACD,MAAM,EAAE,KAAK,CACX,GAAG,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,4CAA4C,CACrJ;KACF;IACD,WAAW,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAA,kBAAkB,CAAC,EAAE;IAC7D,oCAAoC,EAAE;QACpC,OAAO,EAAE,KAAK,CACZ,MAAM,CAAC,GAAG,CAAA,wFAAwF,CACnG;KACF;IACD,+BAA+B,EAAE;QAC/B,OAAO,EAAE,KAAK,CACZ,GAAG,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,8CAA8C,CAC9F;KACF;IACD,yBAAyB,EAAE;QACzB,OAAO,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,oCAAoC,CAAC;KACjF;IACD,kCAAkC,EAAE;QAClC,OAAO,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,gBAAgB,CAAC;KAC7D;IACD,mCAAmC,EAAE;QACnC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAA,gCAAgC,CAAC;KAC3D;IACD,uBAAuB,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAA,8BAA8B,CAAC,EAAE;IACrF,uBAAuB,EAAE;QACvB,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAA,oDAAoD,CAAC;KAC/E;IACD,+BAA+B,EAAE;QAC/B,OAAO,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,mBAAmB,CAAC;KACnF;IACD,0CAA0C,EAAE;QAC1C,OAAO,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,iCAAiC,CAAC;KAChF;IACD,+BAA+B,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAA,qBAAqB,CAAC,EAAE;IACpF,kDAAkD,EAAE;QAClD,OAAO,EAAE,KAAK,CACZ,GAAG,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,yIAAyI,CAC9K;KACF;IACD,mDAAmD,EAAE;QACnD,OAAO,EAAE,KAAK,CACZ,MAAM,CAAC,GAAG,CAAA,oFAAoF,CAC/F;KACF;IACD,iDAAiD,EAAE;QACjD,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAA,0DAA0D,CAAC;KACrF;IACD,qBAAqB,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,OAAO,iBAAiB,CAAC,EAAE;IACtE,2BAA2B,EAAE;QAC3B,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAA,uDAAuD,CAAC;KAClF;IACD,4BAA4B,EAAE;QAC5B,OAAO,EAAE,KAAK,CAAC,cAAc,OAAO,iCAAiC,CAAC;KACvE;IACD,YAAY,EAAE;QACZ,OAAO,EAAE,KAAK,CACZ,GAAG,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,iKAAiK,CACpQ;KACF;IACD,uFAAuF;IACvF,GAAG,EAAE;QACH,OAAO,EAAE,KAAK,CACZ,MAAM,CAAC,GAAG,CAAA,2IAA2I,CACtJ;KACF;IACD,iBAAiB,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAA,iBAAiB,CAAC,EAAE;IAClE,6CAA6C,EAAE;QAC7C,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;KACxE;IACD,qCAAqC,EAAE;QACrC,OAAO,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,kCAAkC,CAAC;KAC7E;IACD,iCAAiC,EAAE;QACjC,OAAO,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,qCAAqC,CAAC;KACzE;IACD,iDAAiD,EAAE;QACjD,OAAO,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,SAAS,EAAE,QAAQ,CAAC,4BAA4B,QAAQ,EAAE,CAAC;KACpF;IACD,eAAe,EAAE;QACf,OAAO,EAAE,KAAK,CACZ,GAAG,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,4CAA4C,CACzG;KACF;IACD,eAAe,EAAE;QACf,OAAO,EAAE,KAAK,CACZ,GAAG,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,kKAAkK,OAAO,EAAE,CAChP;KACF;IACD,QAAQ,EAAE;QACR,OAAO,EAAE,KAAK,CACZ,GAAG,KAAK,CAAC,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,0FAA0F,CAClK;KACF;CACF,CAAC;AAEF,6GAA6G;AAC7G,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;IAChG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,OAAO,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACjD,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAEpF;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,IAA0B,EAAE,IAAY;IAChF,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACjF,IAAI,IAAI,MAAM,CAAC,MAAM,IAAI,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAC5B,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CACvF,CAAC;AACJ,CAAC"}

package/dist/api/premortem/index.d.ts

@@ -0,0 +1,16 @@
+import type { PremortemOptions, PremortemReport, PremortemTarget } from "./types.js";
+export type { PackageBlastRadius, PlaybookKind, PremortemOptions, PremortemReport, PremortemRepo, PremortemTarget, PremortemUsage, } from "./types.js";
+/** Repositories under `root`: a directory with `.git` and `package.json`. Symlinks are not followed. */
+export declare function discoverRepos(root: string, options?: {
+    maxDepth?: number;
+    max?: number;
+}): PremortemTarget[];
+/**
+ * "What if this package is compromised tomorrow?" across several repositories: which of them lock
+ * it, directly or not, in which versions, whether it runs install scripts, and whether CI installs
+ * run with secrets in reach. Reads checkouts only (lockfiles, CI files, installed manifests); no
+ * network. With `outputDir`, writes a playbook per repository or per package with the exact
+ * commands to run on the day, which is meant to be committed.
+ */
+export declare function premortem(options: PremortemOptions): Promise<PremortemReport>;
+//# sourceMappingURL=index.d.ts.map

package/dist/api/premortem/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/premortem/index.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAEV,gBAAgB,EAChB,eAAe,EAEf,eAAe,EAEhB,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,kBAAkB,EAClB,YAAY,EACZ,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,YAAY,CAAC;AAEpB,wGAAwG;AACxG,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAChD,eAAe,EAAE,CA6BnB;AAwGD;;;;;;GAMG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAwJnF"}

package/dist/api/premortem/index.js

@@ -0,0 +1,274 @@
+import { createHash } from "node:crypto";
+import { existsSync, lstatSync, mkdirSync, readdirSync, statSync, writeFileSync } from "node:fs";
+import { basename, join, relative, resolve } from "node:path";
+import { findOccurrences } from "../../scanner/lock-graph/index.js";
+import { scanSecrets } from "../incident/ci-secrets.js";
+import { installScriptOf, loadProjectLocks } from "../incident/project.js";
+import { renderPlaybook, renderPremortemSummary } from "./playbook.js";
+/** Repositories under `root`: a directory with `.git` and `package.json`. Symlinks are not followed. */
+export function discoverRepos(root, options = {}) {
+    const maxDepth = options.maxDepth ?? 3;
+    const max = options.max ?? 200;
+    const found = [];
+    const visit = (dir, depth) => {
+        if (found.length >= max)
+            return;
+        if (existsSync(join(dir, ".git")) && existsSync(join(dir, "package.json"))) {
+            found.push({ cwd: dir, label: relative(root, dir) || basename(dir) });
+            return;
+        }
+        if (depth >= maxDepth)
+            return;
+        let names;
+        try {
+            names = readdirSync(dir);
+        }
+        catch {
+            return;
+        }
+        for (const name of names.toSorted()) {
+            if (name === "node_modules" || name.startsWith("."))
+                continue;
+            const child = join(dir, name);
+            try {
+                if (lstatSync(child).isDirectory())
+                    visit(child, depth + 1);
+            }
+            catch {
+                // Unreadable entries are skipped.
+            }
+        }
+    };
+    visit(root, 0);
+    return found;
+}
+function scanRepo(target) {
+    const cwd = resolve(target.cwd);
+    const { locks, notes } = loadProjectLocks(cwd);
+    const secrets = scanSecrets(cwd);
+    const installing = secrets.ci.filter((file) => file.installs || file.installJobs.length > 0);
+    const containers = secrets.containers.filter((file) => file.installs);
+    const secretNames = [
+        ...installing.flatMap((file) => [...file.secretNames, ...file.envNames]),
+        ...containers.flatMap((file) => [...file.names, ...file.secretMounts]),
+        ...secrets.npmrc.flatMap((file) => file.envNames),
+    ];
+    const biggest = Math.max(0, ...locks.map((lock) => lock.graph.nodes.size));
+    return {
+        locks,
+        secrets,
+        repo: {
+            label: target.label ?? basename(cwd),
+            cwd,
+            lockfiles: locks.map((lock) => lock.path),
+            packageCount: biggest,
+            ci: {
+                installs: installing.length > 0 || containers.length > 0,
+                secretNames: [...new Set(secretNames)].toSorted(),
+                files: [
+                    ...installing.map((file) => file.file),
+                    ...containers.map((file) => file.file),
+                ].toSorted(),
+            },
+            notes: locks.length === 0
+                ? ["no lockfile could be read, so nothing could be assessed here", ...notes]
+                : notes,
+        },
+    };
+}
+function aggregate(scans, rankBy) {
+    const byName = new Map();
+    for (const scan of scans) {
+        for (const { graph } of scan.locks) {
+            const parents = reverseEdges(graph);
+            for (const node of graph.nodes.values()) {
+                const entry = byName.get(node.name) ?? {
+                    repos: new Set(),
+                    dependents: new Set(),
+                    privileged: false,
+                };
+                entry.repos.add(scan.repo.label);
+                for (const parent of parents.get(node.id) ?? [])
+                    entry.dependents.add(graph.nodes.get(parent)?.name ?? parent);
+                if (node.installScript)
+                    entry.privileged = true;
+                else if (rankBy === "privileged" &&
+                    !graph.recordsInstallScripts &&
+                    installScriptOf(scan.repo.cwd, node.name, node.version, undefined) === true) {
+                    entry.privileged = true;
+                }
+                byName.set(node.name, entry);
+            }
+        }
+    }
+    return byName;
+}
+function reverseEdges(graph) {
+    const parents = new Map();
+    for (const node of graph.nodes.values()) {
+        for (const dep of node.deps) {
+            const list = parents.get(dep) ?? [];
+            list.push(node.id);
+            parents.set(dep, list);
+        }
+    }
+    return parents;
+}
+const slug = (value) => {
+    const clean = value
+        .toLowerCase()
+        .replaceAll(/[^a-z0-9._-]+/g, "-")
+        .replaceAll(/^-+|-+$/g, "")
+        .slice(0, 60) || "item";
+    return `${clean}-${createHash("sha256").update(value).digest("hex").slice(0, 6)}`;
+};
+/**
+ * "What if this package is compromised tomorrow?" across several repositories: which of them lock
+ * it, directly or not, in which versions, whether it runs install scripts, and whether CI installs
+ * run with secrets in reach. Reads checkouts only (lockfiles, CI files, installed manifests); no
+ * network. With `outputDir`, writes a playbook per repository or per package with the exact
+ * commands to run on the day, which is meant to be committed.
+ */
+export async function premortem(options) {
+    const notes = [];
+    let targets = options.targets ?? [];
+    if (options.root)
+        targets = [...targets, ...discoverRepos(resolve(options.root))];
+    if (targets.length === 0) {
+        throw new Error(options.root
+            ? `No repository (a .git next to a package.json) found under ${options.root}.`
+            : "Name the repositories: targets, or a root to search.");
+    }
+    for (const target of targets) {
+        if (!target.cwd || !existsSync(target.cwd) || !statSync(target.cwd).isDirectory()) {
+            throw new Error(`Target ${JSON.stringify(target.label ?? target.cwd)} is not a directory.`);
+        }
+    }
+    // The same checkout named twice would double its weight.
+    const paths = new Set();
+    const labels = new Set();
+    const labelled = [];
+    for (const target of targets) {
+        const path = resolve(target.cwd);
+        if (paths.has(path))
+            continue;
+        paths.add(path);
+        const wanted = target.label ?? basename(path);
+        let label = wanted;
+        for (let n = 2; labels.has(label); n += 1)
+            label = `${wanted}-${n}`;
+        labels.add(label);
+        labelled.push({ cwd: target.cwd, label });
+    }
+    const scans = labelled.map((target) => scanRepo(target));
+    const rankBy = options.rankBy ?? "depended-upon";
+    const stats = aggregate(scans, rankBy);
+    let names;
+    let selection;
+    if (options.packages && options.packages.length > 0) {
+        names = [...new Set(options.packages)];
+        selection = { mode: "given" };
+    }
+    else {
+        const top = options.top ?? 10;
+        names = [...stats.entries()]
+            .toSorted(([nameA, a], [nameB, b]) => {
+            const privilege = Number(b.privileged) - Number(a.privileged);
+            const reach = b.repos.size - a.repos.size || b.dependents.size - a.dependents.size;
+            return ((rankBy === "privileged" ? privilege || reach : reach || privilege) ||
+                nameA.localeCompare(nameB));
+        })
+            .slice(0, top)
+            .map(([name]) => name);
+        selection = { mode: "ranked", rankBy, top };
+    }
+    const packages = names.map((packageName) => {
+        const usage = [];
+        const dependents = new Set();
+        let privileged = false;
+        for (const scan of scans) {
+            const found = scan.locks.flatMap(({ graph }) => {
+                const hits = findOccurrences(graph, (name) => name === packageName);
+                const parents = reverseEdges(graph);
+                for (const occurrence of hits) {
+                    for (const parent of parents.get(occurrence.nodeId) ?? [])
+                        dependents.add(graph.nodes.get(parent)?.name ?? parent);
+                }
+                return hits;
+            });
+            if (found.length === 0)
+                continue;
+            const scripts = new Set(found.map((entry) => installScriptOf(scan.repo.cwd, entry.name, entry.version, entry.installScript)));
+            if (scripts.has(true))
+                privileged = true;
+            else if (scripts.has("unknown") && privileged === false)
+                privileged = "unknown";
+            const scopes = new Set(found.map((entry) => entry.scope));
+            usage.push({
+                repo: scan.repo.label,
+                versions: [...new Set(found.map((entry) => entry.version))].toSorted(),
+                direct: found.some((entry) => entry.direct),
+                scope: scopes.has("production")
+                    ? "production"
+                    : scopes.has("development")
+                        ? "development"
+                        : "unreferenced",
+                installScript: scripts.has(true) ? true : scripts.has("unknown") ? "unknown" : false,
+            });
+        }
+        return {
+            packageName,
+            repoCount: usage.length,
+            dependentCount: dependents.size,
+            installScript: privileged,
+            usage,
+            reposWithCiSecrets: usage
+                .map((entry) => entry.repo)
+                .filter((label) => {
+                const repo = scans.find((scan) => scan.repo.label === label)?.repo;
+                return Boolean(repo?.ci.installs && repo.ci.secretNames.length > 0);
+            }),
+        };
+    });
+    if (selection.mode === "given") {
+        for (const entry of packages.filter((candidate) => candidate.repoCount === 0)) {
+            notes.push(`${entry.packageName} is not locked in any of the ${scans.length} repositories read.`);
+        }
+    }
+    for (const scan of scans) {
+        for (const note of scan.repo.notes)
+            notes.push(`${scan.repo.label}: ${note}`);
+    }
+    const report = {
+        schemaVersion: "1.0",
+        generatedAt: new Date().toISOString(),
+        repos: scans.map((scan) => scan.repo),
+        packages,
+        selection,
+        notes,
+    };
+    if (options.outputDir) {
+        const dir = resolve(options.outputDir);
+        const playbookDir = join(dir, "playbooks");
+        mkdirSync(playbookDir, { recursive: true });
+        const files = [];
+        const write = (path, text) => {
+            writeFileSync(path, text, "utf8");
+            files.push(path);
+        };
+        const kind = options.playbooks ?? "repo";
+        const subjects = kind === "repo"
+            ? report.repos.map((repo) => repo.label)
+            : report.packages.map((entry) => entry.packageName);
+        for (const subject of subjects) {
+            write(join(playbookDir, `${slug(subject)}.md`), renderPlaybook(report, kind, subject));
+        }
+        write(join(dir, "premortem.md"), renderPremortemSummary(report, kind, (subject) => `playbooks/${slug(subject)}.md`));
+        write(join(dir, "premortem.json"), `${JSON.stringify(report, null, 2)}\n`);
+        report.files = files;
+        // The JSON on disk is written before `files` is known; rewrite it so it lists itself.
+        writeFileSync(join(dir, "premortem.json"), `${JSON.stringify(report, null, 2)}\n`, "utf8");
+    }
+    return report;
+}
+//# sourceMappingURL=index.js.map