autoremediator 0.21.2 → 0.22.0

package/dist/api/prove/agent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent.js","sourceRoot":"","sources":["../../../src/api/prove/agent.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EAGZ,WAAW,EACX,IAAI,GAEL,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAWxB,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,MAAM,QAAQ,GAAG,GAAG,CAAC;AACrB,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAC/B,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAE/B,MAAM,aAAa,GAAG;;;;;;;;;;;;;sIAagH,CAAC;AAEvI,SAAS,SAAS,CAAC,IAAsB;IACvC,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAC1B,MAAM,KAAK,GAAG;QACZ,YAAY,IAAI,CAAC,WAAW,yBAAyB,IAAI,CAAC,iBAAiB,oBAAoB,IAAI,CAAC,YAAY,GAAG;QACnH,YAAY,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,EAAE;KAC3E,CAAC;IACF,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,aAAa,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClF,IAAI,QAAQ,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC/F,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,EAAE,GAAG,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CACR,EAAE,EACF,2FAA2F,EAC3F,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAC9C,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,YAAY,IAAI,CAAC,SAAS,wBAAwB,CAAC,CAAC;IACnE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,KAAa,EAAE,GAA0B,EAAY,EAAE,CAC1E,GAAG;IACD,CAAC,CAAC;QACE,GAAG,KAAK,KAAK,GAAG,CAAC,OAAO,UAAU,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,GAAG;QAC/I,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACrF;IACH,CAAC,CAAC,EAAE,CAAC;AAET,MAAM,UAAU,aAAa,CAAC,MAAmB;IAC/C,OAAO;QACL,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW;QAC3C,MAAM,CAAC,MAAM;QACb,GAAG,WAAW,CAAC,gBAAgB,EAAE,MAAM,CAAC,aAAa,CAAC;QACtD,GAAG,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC;KAC7C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAQD,SAAS,WAAW,CAAC,IAAsB,EAAE,GAAoB,EAAE,KAAiB;IAClF,MAAM,MAAM,GAAG,CAAC,OAA+B,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEzE,OAAO;QACL,SAAS,EAAE,IAAI,CAAC;YACd,WAAW,EACT,qGAAqG;YACvG,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;gBACpB,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;gBACxC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;aACxE,CAAC;YACF,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;gBACrC,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;qBAC5C,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;qBAC3D,QAAQ,EAAE,CAAC;gBACd,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;gBACvC,OAAO,CACL,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE;oBACpG,UAAU,CACX,CAAC;YACJ,CAAC;SACF,CAAC;QACF,UAAU,EAAE,IAAI,CAAC;YACf,WAAW,EACT,mJAAmJ;YACrJ,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;gBACpB,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;gBACxC,IAAI,EAAE,CAAC;qBACJ,MAAM,EAAE;qBACR,QAAQ,CAAC,iEAAiE,CAAC;gBAC9E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;gBACjD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;aAChD,CAAC;YACF,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE;gBACvD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC7C,IAAI,IAAI,KAAK,SAAS;oBACpB,OAAO,mBAAmB,IAAI,YAAY,OAAO,0BAA0B,CAAC;gBAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,IAAI,CAAC,CAAC,CAAC;gBACzC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CACjB,KAAK,CAAC,MAAM,EACZ,OAAO,IAAI,IAAI,GAAG,cAAc,GAAG,CAAC,EACpC,IAAI,GAAG,cAAc,GAAG,CAAC,CAC1B,CAAC;gBACF,IAAI,KAAK,GAAG,KAAK;qBACd,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;qBACnB,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,KAAK,KAAK,IAAI,EAAE,CAAC;qBAChD,IAAI,CAAC,IAAI,CAAC,CAAC;gBACd,IAAI,KAAK,CAAC,MAAM,GAAG,cAAc;oBAAE,KAAK,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,eAAe,CAAC;gBAC5F,OAAO,GAAG,OAAO,IAAI,IAAI,WAAW,IAAI,IAAI,EAAE,OAAO,KAAK,CAAC,MAAM,MAAM,KAAK,EAAE,CAAC;YACjF,CAAC;SACF,CAAC;QACF,SAAS,EAAE,IAAI,CAAC;YACd,WAAW,EACT,0MAA0M;YAC5M,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,4BAA4B,CAAC,EAAE,CAAC;YACpF,OAAO,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;gBAC5B,IAAI,KAAK,CAAC,QAAQ;oBAAE,OAAO,2CAA2C,CAAC;gBACvE,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;oBACnC,OAAO,sCAAsC,CAAC;gBAChD,CAAC;gBACD,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;gBAClB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBACvC,IAAI,MAAM,CAAC,QAAQ;oBAAE,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;gBAC3C,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,MAAM,cAAc,CAAC;YACnF,CAAC;SACF,CAAC;QACF,MAAM,EAAE,IAAI,CAAC;YACX,WAAW,EACT,wGAAwG;YAC1G,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7C,OAAO,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;gBAC5B,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;gBACtB,OAAO,WAAW,CAAC;YACrB,CAAC;SACF,CAAC;KACH,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,IAAyB,EACzB,KAAa;IAEb,MAAM,OAAO,GAA0C,EAAE,CAAC;IAC1D,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3F,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9F,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACjF,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,KAAK;YACX,IAAI,EAAE,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,QAAQ,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SAChG,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,KAAoB,EAAU,EAAE,CACjD,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;AAEpD;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,KAAoB;IACjE,OAAO;QACL,EAAE,EAAE,WAAW,SAAS,CAAC,KAAK,CAAC,EAAE;QAEjC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG;YACrB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAe,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;YACzD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YAEjF,IAAI,KAAK,GAAuC,EAAE,CAAC;YACnD,IAAI,OAA2B,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;oBAChC,KAAK;oBACL,MAAM,EAAE,aAAa;oBACrB,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC;oBACvB,KAAK,EAAE,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC;oBACpC,WAAW,EAAE,CAAC;oBACd,WAAW,EAAE,MAAM;oBACnB,QAAQ,EAAE;wBACR,WAAW,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,GAAG,CAAC,CAAC;wBACnC,GAAG,EAAE,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;qBACnD;iBACF,CAAC,CAAC;gBACH,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;YACvB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO;oBAC1B,CAAC,CAAC,WAAW;oBACb,CAAC,CAAC,MAAM,CAAC,OAAO;wBACd,CAAC,CAAC,4BAA4B;wBAC9B,CAAC,CAAC,0BAA0B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3F,CAAC;YAED,MAAM,KAAK,GAAG;gBACZ;oBACE,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC;oBACvB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;oBAC/B,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;oBAChF,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;iBACnF;aACF,CAAC;YACF,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;YAEjF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;YACrE,CAAC;YACD,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACnB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,+BAA+B,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;YAC9F,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC/B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;YAC3E,CAAC;YACD,OAAO;gBACL,MAAM,EAAE,kBAAkB;gBAC1B,SAAS,EAAE,8DAA8D;gBACzE,KAAK;gBACL,UAAU;aACX,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/api/prove/evidence.d.ts

@@ -0,0 +1,108 @@
+/**
+ * The evidence record that goes next to a kept reproduction script, its optional signature, and
+ * the reading side (verify a signature, list evidence for the VEX output).
+ *
+ * Files, under the project's patches directory (the same place the proof-of-fix check looks):
+ *   <name>+<vulnerable-version>.test.cjs     the script
+ *   <name>+<vulnerable-version>.proof.json   the evidence record
+ *   <name>+<vulnerable-version>.proof.json.sig   optional detached signature
+ *
+ * The signature is DSSE (https://github.com/secure-systems-lab/dsse): Ed25519 over the
+ * pre-authentication encoding of the payload type and the exact bytes of the record file. It is
+ * detached, so the record stays plain JSON a person can read and diff. Keys are local PEM files; there is no
+ * key service and no certificate: whoever holds the public key checks that the record was
+ * signed by the matching private key and has not changed since.
+ */
+import { type KeyObject } from "node:crypto";
+import type { SandboxReport } from "./sandbox.js";
+import type { JudgedRun } from "./types.js";
+export declare const PAYLOAD_TYPE = "application/vnd.autoremediator.proof-of-fix+json";
+export declare const EVIDENCE_SUFFIX = ".proof.json";
+export declare const SIGNATURE_SUFFIX = ".sig";
+export interface ProofEvidence {
+    schemaVersion: "1.0";
+    kind: "proof-of-fix-evidence";
+    advisoryId: string;
+    /** Other ids the advisory source gave the same record (for example the GHSA id of a CVE). */
+    aliases?: string[];
+    package: string;
+    vulnerableVersion: string;
+    fixedVersion: string;
+    /** What the harness established, and what it did not. */
+    claim: string;
+    script: {
+        /** Relative to the project directory, with forward slashes. */
+        path: string;
+        sha256: string;
+    };
+    vulnerableRun: JudgedRun;
+    fixedRun: JudgedRun;
+    /** How many times the vulnerable/fixed pair held. */
+    confirmedRuns: number;
+    tarballs: {
+        vulnerable: {
+            url: string;
+            integrity: string;
+        };
+        fixed: {
+            url: string;
+            integrity: string;
+        };
+    };
+    sandbox: SandboxReport & {
+        env: string[];
+        timeoutMs: number;
+        maxOutputBytes: number;
+    };
+    nodeVersion: string;
+    timestamp: string;
+    /** The model that proposed the script, or null when it was supplied. */
+    model: string | null;
+    /** The agent that proposed it (`builtin:<model>`, or the id of an injected agent). */
+    agent: string;
+    /** How many candidate scripts the harness judged, including the kept one. */
+    trials: number;
+}
+export declare const CLAIM = "The script fails on the vulnerable version and passes on the fixed version, repeatably, in the sandbox described here. It shows the two versions behave differently through the package's public API; whether that difference is the advisory's vulnerability is for the reviewer of the script to confirm.";
+/** `<name>+<version>` in the form the existing proof-of-fix lookup uses. */
+export declare function baseName(packageName: string, vulnerableVersion: string): string;
+export declare const scriptFileName: (packageName: string, vulnerableVersion: string) => string;
+export declare const evidenceFileName: (packageName: string, vulnerableVersion: string) => string;
+export declare const toPosix: (path: string) => string;
+export declare const relativeTo: (root: string, path: string) => string;
+/** DSSE pre-authentication encoding. */
+export declare function pae(payloadType: string, payload: Uint8Array): Buffer;
+export interface DetachedSignature {
+    payloadType: string;
+    algorithm: "ed25519";
+    /** `sha256:` and the hex digest of the public key's SPKI DER encoding. */
+    keyid: string;
+    /** Base64 signature. */
+    sig: string;
+}
+export declare function loadSigningKey(path: string): KeyObject;
+/** Sign the exact bytes of an evidence record. */
+export declare function signRecord(record: Uint8Array, privateKey: KeyObject): DetachedSignature;
+export interface SignatureCheck {
+    valid: boolean;
+    keyid?: string;
+    reason?: string;
+}
+/**
+ * Check a detached signature over the record's bytes. `keyPath` is a PEM public key, or the
+ * private key it belongs to.
+ */
+export declare function verifyRecordSignature(record: Uint8Array, signatureJson: string, keyPath: string): SignatureCheck;
+/** An evidence record found on disk. */
+export interface FoundEvidence {
+    recordPath: string;
+    record: ProofEvidence;
+    signaturePath?: string;
+    /** The script file exists and still has the hash the record names. */
+    scriptCurrent: boolean;
+}
+/** Evidence records in a patches directory. Unreadable or foreign JSON files are skipped. */
+export declare function findEvidence(cwd: string, patchesDir: string): FoundEvidence[];
+/** Verify the signature of a record on disk against a public (or private) PEM key. */
+export declare function verifyProofEvidence(recordPath: string, keyPath: string): SignatureCheck;
+//# sourceMappingURL=evidence.d.ts.map

package/dist/api/prove/evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../../../src/api/prove/evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAML,KAAK,SAAS,EACf,MAAM,aAAa,CAAC;AAIrB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,eAAO,MAAM,YAAY,qDAAqD,CAAC;AAC/E,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAC7C,eAAO,MAAM,gBAAgB,SAAS,CAAC;AAEvC,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,KAAK,CAAC;IACrB,IAAI,EAAE,uBAAuB,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,6FAA6F;IAC7F,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,yDAAyD;IACzD,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE;QACN,+DAA+D;QAC/D,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,aAAa,EAAE,SAAS,CAAC;IACzB,QAAQ,EAAE,SAAS,CAAC;IACpB,qDAAqD;IACrD,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE;QACR,UAAU,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC;QAC/C,KAAK,EAAE;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC;KAC3C,CAAC;IACF,OAAO,EAAE,aAAa,GAAG;QAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,CAAC;IACtF,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,sFAAsF;IACtF,KAAK,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,KAAK,gTAC6R,CAAC;AAIhT,4EAA4E;AAC5E,wBAAgB,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,GAAG,MAAM,CAE/E;AAED,eAAO,MAAM,cAAc,gBAAiB,MAAM,qBAAqB,MAAM,KAAG,MACxB,CAAC;AACzD,eAAO,MAAM,gBAAgB,gBAAiB,MAAM,qBAAqB,MAAM,KAAG,MACjB,CAAC;AAElE,eAAO,MAAM,OAAO,SAAU,MAAM,KAAG,MAAoC,CAAC;AAE5E,eAAO,MAAM,UAAU,SAAU,MAAM,QAAQ,MAAM,KAAG,MACP,CAAC;AAElD,wCAAwC;AACxC,wBAAgB,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,MAAM,CAQpE;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,SAAS,CAAC;IACrB,0EAA0E;IAC1E,KAAK,EAAE,MAAM,CAAC;IACd,wBAAwB;IACxB,GAAG,EAAE,MAAM,CAAC;CACb;AAOD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAgBtD;AAED,kDAAkD;AAClD,wBAAgB,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,GAAG,iBAAiB,CAQvF;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,UAAU,EAClB,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,GACd,cAAc,CA6ChB;AAED,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,aAAa,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sEAAsE;IACtE,aAAa,EAAE,OAAO,CAAC;CACxB;AAoBD,6FAA6F;AAC7F,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,aAAa,EAAE,CAgC7E;AAED,sFAAsF;AACtF,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,cAAc,CAQvF"}

package/dist/api/prove/evidence.js

@@ -0,0 +1,176 @@
+/**
+ * The evidence record that goes next to a kept reproduction script, its optional signature, and
+ * the reading side (verify a signature, list evidence for the VEX output).
+ *
+ * Files, under the project's patches directory (the same place the proof-of-fix check looks):
+ *   <name>+<vulnerable-version>.test.cjs     the script
+ *   <name>+<vulnerable-version>.proof.json   the evidence record
+ *   <name>+<vulnerable-version>.proof.json.sig   optional detached signature
+ *
+ * The signature is DSSE (https://github.com/secure-systems-lab/dsse): Ed25519 over the
+ * pre-authentication encoding of the payload type and the exact bytes of the record file. It is
+ * detached, so the record stays plain JSON a person can read and diff. Keys are local PEM files; there is no
+ * key service and no certificate: whoever holds the public key checks that the record was
+ * signed by the matching private key and has not changed since.
+ */
+import { createHash, createPrivateKey, createPublicKey, sign as cryptoSign, verify as cryptoVerify, } from "node:crypto";
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join, relative, resolve } from "node:path";
+export const PAYLOAD_TYPE = "application/vnd.autoremediator.proof-of-fix+json";
+export const EVIDENCE_SUFFIX = ".proof.json";
+export const SIGNATURE_SUFFIX = ".sig";
+export const CLAIM = "The script fails on the vulnerable version and passes on the fixed version, repeatably, in the sandbox described here. It shows the two versions behave differently through the package's public API; whether that difference is the advisory's vulnerability is for the reviewer of the script to confirm.";
+const safeName = (name) => name.replace(/^@/, "").replaceAll("/", "+");
+/** `<name>+<version>` in the form the existing proof-of-fix lookup uses. */
+export function baseName(packageName, vulnerableVersion) {
+    return `${safeName(packageName)}+${vulnerableVersion}`;
+}
+export const scriptFileName = (packageName, vulnerableVersion) => `${baseName(packageName, vulnerableVersion)}.test.cjs`;
+export const evidenceFileName = (packageName, vulnerableVersion) => `${baseName(packageName, vulnerableVersion)}${EVIDENCE_SUFFIX}`;
+export const toPosix = (path) => path.split("\\").join("/");
+export const relativeTo = (root, path) => toPosix(relative(resolve(root), resolve(path)));
+/** DSSE pre-authentication encoding. */
+export function pae(payloadType, payload) {
+    const type = Buffer.from(payloadType, "utf8");
+    return Buffer.concat([
+        Buffer.from(`DSSEv1 ${type.length} `, "utf8"),
+        type,
+        Buffer.from(` ${payload.length} `, "utf8"),
+        Buffer.from(payload),
+    ]);
+}
+function keyIdOf(publicKey) {
+    const der = publicKey.export({ type: "spki", format: "der" });
+    return `sha256:${createHash("sha256").update(der).digest("hex")}`;
+}
+export function loadSigningKey(path) {
+    let key;
+    try {
+        key = createPrivateKey(readFileSync(path));
+    }
+    catch (cause) {
+        throw new Error(`Could not read an Ed25519 private key (PEM) from "${path}". Create one with: openssl genpkey -algorithm ed25519 -out key.pem`, { cause });
+    }
+    if (key.asymmetricKeyType !== "ed25519") {
+        throw new Error(`The signing key at "${path}" is ${String(key.asymmetricKeyType)}, not Ed25519. Create one with: openssl genpkey -algorithm ed25519 -out key.pem`);
+    }
+    return key;
+}
+/** Sign the exact bytes of an evidence record. */
+export function signRecord(record, privateKey) {
+    const signature = cryptoSign(null, pae(PAYLOAD_TYPE, record), privateKey);
+    return {
+        payloadType: PAYLOAD_TYPE,
+        algorithm: "ed25519",
+        keyid: keyIdOf(createPublicKey(privateKey)),
+        sig: signature.toString("base64"),
+    };
+}
+/**
+ * Check a detached signature over the record's bytes. `keyPath` is a PEM public key, or the
+ * private key it belongs to.
+ */
+export function verifyRecordSignature(record, signatureJson, keyPath) {
+    let signature;
+    try {
+        signature = JSON.parse(signatureJson);
+    }
+    catch {
+        return { valid: false, reason: "the signature file is not JSON" };
+    }
+    if (typeof signature !== "object" || signature === null) {
+        return {
+            valid: false,
+            reason: "the signature file is not an autoremediator proof-of-fix signature",
+        };
+    }
+    if (signature.payloadType !== PAYLOAD_TYPE ||
+        signature.algorithm !== "ed25519" ||
+        typeof signature.sig !== "string") {
+        return {
+            valid: false,
+            reason: "the signature file is not an autoremediator proof-of-fix signature",
+        };
+    }
+    let publicKey;
+    try {
+        const pem = readFileSync(keyPath);
+        publicKey = pem.includes("PRIVATE KEY")
+            ? createPublicKey(createPrivateKey(pem))
+            : createPublicKey(pem);
+    }
+    catch {
+        return { valid: false, reason: `could not read a PEM key from "${keyPath}"` };
+    }
+    const keyid = keyIdOf(publicKey);
+    if (keyid !== signature.keyid) {
+        return { valid: false, keyid, reason: "the signature was made with a different key" };
+    }
+    const ok = cryptoVerify(null, pae(PAYLOAD_TYPE, record), publicKey, Buffer.from(signature.sig, "base64"));
+    return ok
+        ? { valid: true, keyid }
+        : { valid: false, keyid, reason: "the signature does not match the record" };
+}
+const isEvidence = (value) => {
+    if (typeof value !== "object" || value === null)
+        return false;
+    const candidate = value;
+    return (candidate.kind === "proof-of-fix-evidence" &&
+        candidate.schemaVersion === "1.0" &&
+        typeof candidate.advisoryId === "string" &&
+        typeof candidate.package === "string" &&
+        typeof candidate.vulnerableVersion === "string" &&
+        typeof candidate.fixedVersion === "string" &&
+        (candidate.aliases === undefined ||
+            (Array.isArray(candidate.aliases) &&
+                candidate.aliases.every((alias) => typeof alias === "string"))) &&
+        typeof candidate.script?.path === "string" &&
+        typeof candidate.script.sha256 === "string");
+};
+/** Evidence records in a patches directory. Unreadable or foreign JSON files are skipped. */
+export function findEvidence(cwd, patchesDir) {
+    const dir = resolve(cwd, patchesDir);
+    if (!existsSync(dir))
+        return [];
+    const found = [];
+    for (const name of readdirSync(dir).toSorted()) {
+        if (!name.endsWith(EVIDENCE_SUFFIX))
+            continue;
+        const recordPath = join(dir, name);
+        let parsed;
+        try {
+            parsed = JSON.parse(readFileSync(recordPath, "utf8"));
+        }
+        catch {
+            continue;
+        }
+        if (!isEvidence(parsed))
+            continue;
+        const scriptPath = resolve(cwd, parsed.script.path);
+        let scriptCurrent = false;
+        try {
+            scriptCurrent =
+                createHash("sha256").update(readFileSync(scriptPath)).digest("hex") ===
+                    parsed.script.sha256;
+        }
+        catch {
+            scriptCurrent = false;
+        }
+        const signaturePath = `${recordPath}${SIGNATURE_SUFFIX}`;
+        found.push({
+            recordPath,
+            record: parsed,
+            ...(existsSync(signaturePath) ? { signaturePath } : {}),
+            scriptCurrent,
+        });
+    }
+    return found;
+}
+/** Verify the signature of a record on disk against a public (or private) PEM key. */
+export function verifyProofEvidence(recordPath, keyPath) {
+    const signaturePath = `${recordPath}${SIGNATURE_SUFFIX}`;
+    if (!existsSync(signaturePath))
+        return { valid: false, reason: "there is no signature file" };
+    return verifyRecordSignature(readFileSync(recordPath), readFileSync(signaturePath, "utf8"), keyPath);
+}
+//# sourceMappingURL=evidence.js.map

package/dist/api/prove/evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.js","sourceRoot":"","sources":["../../../src/api/prove/evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,IAAI,IAAI,UAAU,EAClB,MAAM,IAAI,YAAY,GAEvB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpD,MAAM,CAAC,MAAM,YAAY,GAAG,kDAAkD,CAAC;AAC/E,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAC;AAC7C,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAqCvC,MAAM,CAAC,MAAM,KAAK,GAChB,6SAA6S,CAAC;AAEhT,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAEvF,4EAA4E;AAC5E,MAAM,UAAU,QAAQ,CAAC,WAAmB,EAAE,iBAAyB;IACrE,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,iBAAiB,EAAE,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,WAAmB,EAAE,iBAAyB,EAAU,EAAE,CACvF,GAAG,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC,WAAW,CAAC;AACzD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,WAAmB,EAAE,iBAAyB,EAAU,EAAE,CACzF,GAAG,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC,GAAG,eAAe,EAAE,CAAC;AAElE,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE5E,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,IAAY,EAAU,EAAE,CAC/D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAElD,wCAAwC;AACxC,MAAM,UAAU,GAAG,CAAC,WAAmB,EAAE,OAAmB;IAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC9C,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,GAAG,EAAE,MAAM,CAAC;QAC7C,IAAI;QACJ,MAAM,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE,MAAM,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;KACrB,CAAC,CAAC;AACL,CAAC;AAWD,SAAS,OAAO,CAAC,SAAoB;IACnC,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,GAAc,CAAC;IACnB,IAAI,CAAC;QACH,GAAG,GAAG,gBAAgB,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,qDAAqD,IAAI,qEAAqE,EAC9H,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,uBAAuB,IAAI,QAAQ,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,iFAAiF,CAClJ,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,UAAU,CAAC,MAAkB,EAAE,UAAqB;IAClE,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC;IAC1E,OAAO;QACL,WAAW,EAAE,YAAY;QACzB,SAAS,EAAE,SAAS;QACpB,KAAK,EAAE,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QAC3C,GAAG,EAAE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;KAClC,CAAC;AACJ,CAAC;AAQD;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAkB,EAClB,aAAqB,EACrB,OAAe;IAEf,IAAI,SAA4B,CAAC;IACjC,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAsB,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC;IACpE,CAAC;IACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACxD,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,oEAAoE;SAC7E,CAAC;IACJ,CAAC;IACD,IACE,SAAS,CAAC,WAAW,KAAK,YAAY;QACtC,SAAS,CAAC,SAAS,KAAK,SAAS;QACjC,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ,EACjC,CAAC;QACD,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,oEAAoE;SAC7E,CAAC;IACJ,CAAC;IACD,IAAI,SAAoB,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;QAClC,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC;YACrC,CAAC,CAAC,eAAe,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACxC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,OAAO,GAAG,EAAE,CAAC;IAChF,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACjC,IAAI,KAAK,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC;IACxF,CAAC;IACD,MAAM,EAAE,GAAG,YAAY,CACrB,IAAI,EACJ,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,EACzB,SAAS,EACT,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,QAAQ,CAAC,CACrC,CAAC;IACF,OAAO,EAAE;QACP,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE;QACxB,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,yCAAyC,EAAE,CAAC;AACjF,CAAC;AAWD,MAAM,UAAU,GAAG,CAAC,KAAc,EAA0B,EAAE;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,SAAS,GAAG,KAA+B,CAAC;IAClD,OAAO,CACL,SAAS,CAAC,IAAI,KAAK,uBAAuB;QAC1C,SAAS,CAAC,aAAa,KAAK,KAAK;QACjC,OAAO,SAAS,CAAC,UAAU,KAAK,QAAQ;QACxC,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ;QACrC,OAAO,SAAS,CAAC,iBAAiB,KAAK,QAAQ;QAC/C,OAAO,SAAS,CAAC,YAAY,KAAK,QAAQ;QAC1C,CAAC,SAAS,CAAC,OAAO,KAAK,SAAS;YAC9B,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC;gBAC/B,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC;QACnE,OAAO,SAAS,CAAC,MAAM,EAAE,IAAI,KAAK,QAAQ;QAC1C,OAAO,SAAS,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAC5C,CAAC;AACJ,CAAC,CAAC;AAEF,6FAA6F;AAC7F,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,UAAkB;IAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACrC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAChC,MAAM,KAAK,GAAoB,EAAE,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC;YAAE,SAAS;QAC9C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,SAAS;QAClC,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,CAAC;YACH,aAAa;gBACX,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;oBACnE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,aAAa,GAAG,KAAK,CAAC;QACxB,CAAC;QACD,MAAM,aAAa,GAAG,GAAG,UAAU,GAAG,gBAAgB,EAAE,CAAC;QACzD,KAAK,CAAC,IAAI,CAAC;YACT,UAAU;YACV,MAAM,EAAE,MAAM;YACd,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,aAAa;SACd,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,mBAAmB,CAAC,UAAkB,EAAE,OAAe;IACrE,MAAM,aAAa,GAAG,GAAG,UAAU,GAAG,gBAAgB,EAAE,CAAC;IACzD,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAC9F,OAAO,qBAAqB,CAC1B,YAAY,CAAC,UAAU,CAAC,EACxB,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,EACnC,OAAO,CACR,CAAC;AACJ,CAAC"}

package/dist/api/prove/harness.d.ts

@@ -0,0 +1,27 @@
+import { type SandboxOptions, type SandboxResult } from "./sandbox.js";
+import type { TrialResult } from "./types.js";
+export declare const SCRIPT_FILE = "repro.cjs";
+/** How many times the vulnerable/fixed pair must hold. */
+export declare const CONFIRM_RUNS = 2;
+export interface HarnessOptions {
+    packageName: string;
+    vulnerableVersion: string;
+    fixedVersion: string;
+    /** Directory with the vulnerable version installed under node_modules. */
+    vulnerableDir: string;
+    /** Directory with the fixed version installed under node_modules. */
+    fixedDir: string;
+    /** Wall-clock limit of one run. */
+    timeoutMs: number;
+    maxOutputBytes: number;
+    /** How many times the pair must hold. At least 1; default `CONFIRM_RUNS`. */
+    confirmRuns?: number;
+    /** Replaceable for tests. */
+    run?: (options: SandboxOptions) => Promise<SandboxResult>;
+}
+export interface Harness {
+    prove(script: string): Promise<TrialResult>;
+}
+export declare const sha256: (text: string) => string;
+export declare function createHarness(options: HarnessOptions): Harness;
+//# sourceMappingURL=harness.d.ts.map

package/dist/api/prove/harness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness.d.ts","sourceRoot":"","sources":["../../../src/api/prove/harness.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAgB,KAAK,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAErF,OAAO,KAAK,EAAwB,WAAW,EAAE,MAAM,YAAY,CAAC;AAEpE,eAAO,MAAM,WAAW,cAAc,CAAC;AACvC,0DAA0D;AAC1D,eAAO,MAAM,YAAY,IAAI,CAAC;AAG9B,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,0EAA0E;IAC1E,aAAa,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;IACjB,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6BAA6B;IAC7B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;CAC3D;AAED,MAAM,WAAW,OAAO;IACtB,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CAC7C;AAED,eAAO,MAAM,MAAM,SAAU,MAAM,KAAG,MAAyD,CAAC;AA2DhG,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAkF9D"}

package/dist/api/prove/harness.js

@@ -0,0 +1,148 @@
+/**
+ * The deterministic judge. A reproduction script is accepted only if, in the sandbox, it
+ *   - fails on the vulnerable version the way the existing proof-of-fix check expects (exit code 1
+ *     with an assertion failure or an explicit EXPLOIT_REPRODUCED line, not a crash), and
+ *   - exits 0 on the fixed version,
+ * and does the same again on a second run. What a model said about its own script is never an input.
+ *
+ * What this establishes is that the script tells the two versions apart through the package's API
+ * and that it is repeatable. It cannot establish that the difference it finds IS the advisory's
+ * vulnerability; that is for the person who reviews the kept script.
+ */
+import { createHash } from "node:crypto";
+import { realpathSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { isAssertionFailure, sanitizePathLeakage, stripStackTraceFrames, } from "../../remediation/proof-of-fix/runner.js";
+import { runSandboxed } from "./sandbox.js";
+import { screenScript } from "./screen.js";
+export const SCRIPT_FILE = "repro.cjs";
+/** How many times the vulnerable/fixed pair must hold. */
+export const CONFIRM_RUNS = 2;
+const TAIL_CHARS = 2000;
+export const sha256 = (text) => createHash("sha256").update(text).digest("hex");
+function record(result, dirs) {
+    const combined = [result.stderr, result.stdout].filter((part) => part.trim() !== "").join("\n");
+    const shown = sanitizePathLeakage(combined, dirs);
+    return {
+        exitCode: result.exitCode,
+        signal: result.signal,
+        timedOut: result.timedOut,
+        outputLimitExceeded: result.outputLimitExceeded,
+        durationMs: result.durationMs,
+        outputTail: shown.slice(-TAIL_CHARS),
+    };
+}
+function outputOf(result, dirs) {
+    return sanitizePathLeakage(stripStackTraceFrames(`${result.stderr}\n${result.stdout}`), dirs);
+}
+function judgeVulnerable(result, dirs) {
+    if (result.timedOut)
+        return "timeout";
+    if (result.outputLimitExceeded)
+        return "output-limit";
+    const output = outputOf(result, dirs);
+    if (output.includes("ERR_ACCESS_DENIED"))
+        return "sandbox-violation";
+    if (result.exitCode === 0)
+        return "no-reproduction";
+    return isAssertionFailure(output, result.exitCode ?? undefined) ? "reproduced" : "crashed";
+}
+function judgeFixed(result, dirs) {
+    if (result.timedOut)
+        return "timeout";
+    if (result.outputLimitExceeded)
+        return "output-limit";
+    if (outputOf(result, dirs).includes("ERR_ACCESS_DENIED"))
+        return "sandbox-violation";
+    if (result.exitCode === 0)
+        return "clean";
+    return result.exitCode === 1 && isAssertionFailure(outputOf(result, dirs), 1)
+        ? "still-failing"
+        : "crashed";
+}
+const VULNERABLE_PROBLEM = {
+    "no-reproduction": "The script exits 0 on the vulnerable version, so it does not detect the vulnerability. It must fail there with an assertion error or an `EXPLOIT_REPRODUCED:` line and exit code 1.",
+    crashed: "The script crashes on the vulnerable version instead of failing an assertion (a TypeError, a missing module, a syntax error or a non-1 exit). Fix the script so the vulnerable behaviour is asserted, not tripped over.",
+    timeout: "The script ran past the time limit on the vulnerable version and was killed.",
+    "output-limit": "The script produced too much output on the vulnerable version and was killed.",
+    "sandbox-violation": "The script tried something the sandbox forbids (network, files outside its directory, processes, signals) on the vulnerable version.",
+};
+const FIXED_PROBLEM = {
+    "still-failing": "The script also fails on the fixed version, so it does not tell the two versions apart. It must exit 0 there.",
+    crashed: "The script crashes on the fixed version (not an assertion failure). It must run cleanly there and exit 0.",
+    timeout: "The script ran past the time limit on the fixed version and was killed.",
+    "output-limit": "The script produced too much output on the fixed version and was killed.",
+    "sandbox-violation": "The script tried something the sandbox forbids on the fixed version.",
+};
+export function createHarness(options) {
+    const run = options.run ?? runSandboxed;
+    const confirmRuns = Math.max(1, options.confirmRuns ?? CONFIRM_RUNS);
+    const dirs = [
+        ...new Set([options.vulnerableDir, options.fixedDir].flatMap((dir) => [dir, realpathSync(dir)])),
+    ];
+    const execute = async (dir, judge) => {
+        const result = await run({
+            dir,
+            script: SCRIPT_FILE,
+            timeoutMs: options.timeoutMs,
+            maxOutputBytes: options.maxOutputBytes,
+        });
+        return { ...record(result, dirs), verdict: judge(result, dirs) };
+    };
+    return {
+        async prove(script) {
+            const scriptSha256 = sha256(script);
+            const screened = screenScript(script, {
+                packageName: options.packageName,
+                versions: [options.vulnerableVersion, options.fixedVersion],
+            });
+            if (!screened.ok) {
+                return {
+                    accepted: false,
+                    stage: "screen",
+                    scriptSha256,
+                    reason: `The script was refused before it ran: ${screened.violations.join("; ")}.`,
+                };
+            }
+            writeFileSync(join(options.vulnerableDir, SCRIPT_FILE), script, "utf8");
+            writeFileSync(join(options.fixedDir, SCRIPT_FILE), script, "utf8");
+            let first;
+            for (let round = 1; round <= confirmRuns; round++) {
+                const stage = round === 1 ? "vulnerable" : "confirmed";
+                const suffix = round === 1 ? "" : ` (run ${round} of ${confirmRuns}: the result must be repeatable)`;
+                const vulnerableRun = await execute(options.vulnerableDir, judgeVulnerable);
+                if (vulnerableRun.verdict !== "reproduced") {
+                    return {
+                        accepted: false,
+                        stage,
+                        scriptSha256,
+                        vulnerableRun,
+                        ...(first ? { fixedRun: first.fixed } : {}),
+                        reason: `${VULNERABLE_PROBLEM[vulnerableRun.verdict] ?? "Unexpected result on the vulnerable version."}${suffix}`,
+                    };
+                }
+                const fixedRun = await execute(options.fixedDir, judgeFixed);
+                if (fixedRun.verdict !== "clean") {
+                    return {
+                        accepted: false,
+                        stage: round === 1 ? "fixed" : "confirmed",
+                        scriptSha256,
+                        vulnerableRun,
+                        fixedRun,
+                        reason: `${FIXED_PROBLEM[fixedRun.verdict] ?? "Unexpected result on the fixed version."}${suffix}`,
+                    };
+                }
+                first ??= { vulnerable: vulnerableRun, fixed: fixedRun };
+            }
+            return {
+                accepted: true,
+                stage: "confirmed",
+                scriptSha256,
+                vulnerableRun: first.vulnerable,
+                fixedRun: first.fixed,
+                reason: `Fails on ${options.packageName}@${options.vulnerableVersion} and passes on ${options.packageName}@${options.fixedVersion}, ${confirmRuns} times each.`,
+            };
+        },
+    };
+}
+//# sourceMappingURL=harness.js.map

package/dist/api/prove/harness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness.js","sourceRoot":"","sources":["../../../src/api/prove/harness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,YAAY,EAA2C,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,MAAM,CAAC,MAAM,WAAW,GAAG,WAAW,CAAC;AACvC,0DAA0D;AAC1D,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC;AAC9B,MAAM,UAAU,GAAG,IAAI,CAAC;AAuBxB,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAEhG,SAAS,MAAM,CAAC,MAAqB,EAAE,IAAc;IACnD,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChG,MAAM,KAAK,GAAG,mBAAmB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAClD,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;QAC/C,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC;KACrC,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,MAAqB,EAAE,IAAc;IACrD,OAAO,mBAAmB,CAAC,qBAAqB,CAAC,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;AAChG,CAAC;AAED,SAAS,eAAe,CAAC,MAAqB,EAAE,IAAc;IAC5D,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,MAAM,CAAC,mBAAmB;QAAE,OAAO,cAAc,CAAC;IACtD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QAAE,OAAO,mBAAmB,CAAC;IACrE,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;QAAE,OAAO,iBAAiB,CAAC;IACpD,OAAO,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7F,CAAC;AAED,SAAS,UAAU,CAAC,MAAqB,EAAE,IAAc;IACvD,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,MAAM,CAAC,mBAAmB;QAAE,OAAO,cAAc,CAAC;IACtD,IAAI,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QAAE,OAAO,mBAAmB,CAAC;IACrF,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IAC1C,OAAO,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,kBAAkB,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3E,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,MAAM,kBAAkB,GAAkD;IACxE,iBAAiB,EACf,qLAAqL;IACvL,OAAO,EACL,yNAAyN;IAC3N,OAAO,EAAE,8EAA8E;IACvF,cAAc,EAAE,+EAA+E;IAC/F,mBAAmB,EACjB,sIAAsI;CACzI,CAAC;AAEF,MAAM,aAAa,GAAkD;IACnE,eAAe,EACb,+GAA+G;IACjH,OAAO,EACL,2GAA2G;IAC7G,OAAO,EAAE,yEAAyE;IAClF,cAAc,EAAE,0EAA0E;IAC1F,mBAAmB,EAAE,sEAAsE;CAC5F,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,OAAuB;IACnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,YAAY,CAAC;IACxC,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,WAAW,IAAI,YAAY,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG;QACX,GAAG,IAAI,GAAG,CACR,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CACrF;KACF,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,EACnB,GAAW,EACX,KAAsE,EAClD,EAAE;QACtB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC;YACvB,GAAG;YACH,MAAM,EAAE,WAAW;YACnB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,cAAc,EAAE,OAAO,CAAC,cAAc;SACvC,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;IACnE,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,MAAM;YAChB,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,EAAE;gBACpC,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,QAAQ,EAAE,CAAC,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC,YAAY,CAAC;aAC5D,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO;oBACL,QAAQ,EAAE,KAAK;oBACf,KAAK,EAAE,QAAQ;oBACf,YAAY;oBACZ,MAAM,EAAE,yCAAyC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;iBACnF,CAAC;YACJ,CAAC;YAED,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YACxE,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAEnE,IAAI,KAA8D,CAAC;YACnE,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,WAAW,EAAE,KAAK,EAAE,EAAE,CAAC;gBAClD,MAAM,KAAK,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAE,YAAsB,CAAC,CAAC,CAAE,WAAqB,CAAC;gBAC7E,MAAM,MAAM,GACV,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,OAAO,WAAW,kCAAkC,CAAC;gBAExF,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;gBAC5E,IAAI,aAAa,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;oBAC3C,OAAO;wBACL,QAAQ,EAAE,KAAK;wBACf,KAAK;wBACL,YAAY;wBACZ,aAAa;wBACb,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC3C,MAAM,EAAE,GAAG,kBAAkB,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,8CAA8C,GAAG,MAAM,EAAE;qBAClH,CAAC;gBACJ,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;gBAC7D,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;oBACjC,OAAO;wBACL,QAAQ,EAAE,KAAK;wBACf,KAAK,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW;wBAC1C,YAAY;wBACZ,aAAa;wBACb,QAAQ;wBACR,MAAM,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,yCAAyC,GAAG,MAAM,EAAE;qBACnG,CAAC;gBACJ,CAAC;gBACD,KAAK,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;YAC3D,CAAC;YAED,OAAO;gBACL,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,WAAW;gBAClB,YAAY;gBACZ,aAAa,EAAE,KAAM,CAAC,UAAU;gBAChC,QAAQ,EAAE,KAAM,CAAC,KAAK;gBACtB,MAAM,EAAE,YAAY,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,iBAAiB,kBAAkB,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,YAAY,KAAK,WAAW,cAAc;aAChK,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/api/prove/index.d.ts

@@ -0,0 +1,84 @@
+import type { ProofEvidenceRef } from "../vex/index.js";
+import { type ProofEvidence } from "./evidence.js";
+import { type SandboxReport } from "./sandbox.js";
+import type { AdvisoryLookup, FetchedPackage, ModelResolver, ReproductionAgent, ReproductionUsage, TrialResult } from "./types.js";
+export type { ProofEvidenceRef } from "../vex/index.js";
+export { findEvidence, verifyProofEvidence, type DetachedSignature, type FoundEvidence, type ProofEvidence, type SignatureCheck, } from "./evidence.js";
+export { createBuiltinReproductionAgent } from "./agent.js";
+export { screenScript, type ScreenResult } from "./screen.js";
+export { runSandboxed, SandboxUnavailableError, verifySandbox, type SandboxReport, } from "./sandbox.js";
+export type { AdvisoryContext, JudgedRun, ReproductionAgent, ReproductionEnv, ReproductionOutcome, ReproductionTask, RunVerdict, TrialResult, } from "./types.js";
+export interface ProveOptions {
+    /** The npm package to prove against. Optional when the advisory affects exactly one. */
+    package?: string;
+    /** Exact version to prove the script fails on. Default: the newest vulnerable version below the fix. */
+    vulnerableVersion?: string;
+    /** Exact version to prove the script passes on. Default: the advisory's first patched version. */
+    fixedVersion?: string;
+    /** Advisory text to use instead of, or in addition to, what OSV says. */
+    advisoryText?: string;
+    /** `<provider>:<model-id>`. Falls back to AUTOREMEDIATOR_MODEL. */
+    model?: string;
+    cwd?: string;
+    patchesDir?: string;
+    /** Ed25519 private key (PEM) to sign the evidence record with. */
+    signingKeyPath?: string;
+    /** Candidate scripts the agent may try (1-10, default 4). */
+    maxTrials?: number;
+    /** Wall-clock limit of one sandboxed run in milliseconds (1000-60000, default 10000). */
+    timeoutMs?: number;
+    /** Replace a reproduction script that is already at the target path and was not made by this tool. */
+    overwrite?: boolean;
+    /** Agent that proposes scripts, instead of one built from `model`. SDK only. */
+    agent?: ReproductionAgent;
+}
+export interface TrialSummary {
+    attempt: number;
+    accepted: boolean;
+    stage: TrialResult["stage"];
+    reason: string;
+    scriptSha256: string;
+}
+export interface ProveResult {
+    schemaVersion: "1.0";
+    advisoryId: string;
+    package: string;
+    vulnerableVersion: string;
+    fixedVersion: string;
+    status: "kept" | "rejected";
+    /** Why it was kept, or why nothing was. */
+    reason: string;
+    trials: TrialSummary[];
+    agent: {
+        id: string;
+        status: string;
+        rationale: string;
+    };
+    usage: ReproductionUsage[];
+    /** Present when a script was kept; paths relative to `cwd`. */
+    files?: {
+        script: string;
+        evidence: string;
+        signature?: string;
+    };
+    evidence?: ProofEvidence;
+    /** What the sandbox self-test established on this machine. */
+    sandbox: SandboxReport;
+}
+/** What a proof run reads from outside the process; replaceable so tests need no network. */
+export interface ProveDeps {
+    lookupAdvisory(id: string): Promise<AdvisoryLookup | undefined>;
+    listVersions(name: string, cwd: string): Promise<string[]>;
+    fetchPackage(name: string, version: string, cwd: string): Promise<FetchedPackage>;
+    /** Lay a fetched package out as `<dir>/node_modules/<name>`. */
+    install(dir: string, fetched: FetchedPackage, cwd: string): Promise<void>;
+    resolveModel: ModelResolver;
+    now(): Date;
+}
+export declare const defaultProveDeps: ProveDeps;
+export declare function generateProofOfFix(cveId: string, options?: ProveOptions, deps?: ProveDeps): Promise<ProveResult>;
+/** OSV ids are case-sensitive: CVE-, OSV- and MAL- ids are upper case, and GHSA ids are `GHSA-` and lower case. */
+export declare function normalizeAdvisoryId(id: string): string;
+/** Kept evidence in a patches directory, as the VEX output cites it. Stale evidence (the script changed) is left out. */
+export declare function proofEvidenceRefs(cwd: string, patchesDir?: string): ProofEvidenceRef[];
+//# sourceMappingURL=index.d.ts.map

package/dist/api/prove/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/prove/index.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAGxD,OAAO,EAML,KAAK,aAAa,EAKnB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAe,KAAK,aAAa,EAAiB,MAAM,cAAc,CAAC;AAC9E,OAAO,KAAK,EAEV,cAAc,EACd,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,WAAW,EACZ,MAAM,YAAY,CAAC;AAEpB,YAAY,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,cAAc,GACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,8BAA8B,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EACL,YAAY,EACZ,uBAAuB,EACvB,aAAa,EACb,KAAK,aAAa,GACnB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,eAAe,EACf,SAAS,EACT,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,UAAU,EACV,WAAW,GACZ,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,YAAY;IAC3B,wFAAwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wGAAwG;IACxG,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kGAAkG;IAClG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yFAAyF;IACzF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sGAAsG;IACtG,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,gFAAgF;IAChF,KAAK,CAAC,EAAE,iBAAiB,CAAC;CAC3B;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,aAAa,EAAE,KAAK,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC;IAC5B,2CAA2C;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,KAAK,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACzD,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC3B,+DAA+D;IAC/D,KAAK,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACjE,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,8DAA8D;IAC9D,OAAO,EAAE,aAAa,CAAC;CACxB;AAED,6FAA6F;AAC7F,MAAM,WAAW,SAAS;IACxB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAChE,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3D,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAClF,gEAAgE;IAChE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1E,YAAY,EAAE,aAAa,CAAC;IAC5B,GAAG,IAAI,IAAI,CAAC;CACb;AAED,eAAO,MAAM,gBAAgB,EAAE,SAO9B,CAAC;AAkDF,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,YAAiB,EAC1B,IAAI,GAAE,SAA4B,GACjC,OAAO,CAAC,WAAW,CAAC,CAwMtB;AAED,mHAAmH;AACnH,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEtD;AAsCD,yHAAyH;AACzH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAYtF"}