autoremediator 0.21.2 → 0.22.0

package/dist/catalog/api-deps.js

@@ -0,0 +1,60 @@
+import { abandonAttempt, bisectLockfile, getAutonomy, analyzeDependencies, removeUnusedDependencies, applyPlan, applyRecipe, assessUpgrade, checkReachability, evaluatePackage, finalizeAttempt, findVulnerableSymbols, getRun, guardPackage, init, installHooks, incident, inspectPatchArtifact, listPatchArtifacts, listRecipes, listRuns, planRemediation, pollJob, premortem, proposePatch, radar, reconcilePatchArtifacts, remediate, remediateFromScan, remediatePortfolio, resumeRun, rollbackRun, scanDelta, startAttempt, submitPortfolioJob, submitRemediateJob, submitScanJob, toCycloneDxVex, updateOutdated, validatePatchArtifact, verifyAttempt, verifyRun, compilePolicy, explainPolicy, maintain, readMaintainerVex, generateProofOfFix, freshnessReport, planFreshnessStep, acceptMemory, addMemory, listMemory, pruneMemory, removeMemory, buildEvidencePack, } from "../api/index.js";
+export const defaultApiDeps = {
+    remediateFn: remediate,
+    planRemediationFn: planRemediation,
+    remediateFromScanFn: remediateFromScan,
+    remediatePortfolioFn: remediatePortfolio,
+    updateOutdatedFn: updateOutdated,
+    checkReachabilityFn: checkReachability,
+    evaluatePackageFn: evaluatePackage,
+    scanDeltaFn: scanDelta,
+    initFn: init,
+    installHooksFn: installHooks,
+    guardPackageFn: guardPackage,
+    healthFn: async () => ({ status: "ok" }),
+    listPatchArtifactsFn: listPatchArtifacts,
+    inspectPatchArtifactFn: inspectPatchArtifact,
+    validatePatchArtifactFn: validatePatchArtifact,
+    reconcilePatchArtifactsFn: reconcilePatchArtifacts,
+    toVexFn: toCycloneDxVex,
+    submitRemediateJobFn: submitRemediateJob,
+    submitScanJobFn: submitScanJob,
+    submitPortfolioJobFn: submitPortfolioJob,
+    pollJobFn: pollJob,
+    applyPlanFn: applyPlan,
+    resumeRunFn: resumeRun,
+    rollbackRunFn: rollbackRun,
+    getRunFn: getRun,
+    listRunsFn: listRuns,
+    verifyRunFn: verifyRun,
+    startAttemptFn: startAttempt,
+    proposePatchFn: proposePatch,
+    verifyAttemptFn: verifyAttempt,
+    finalizeAttemptFn: finalizeAttempt,
+    abandonAttemptFn: abandonAttempt,
+    listRecipesFn: listRecipes,
+    applyRecipeFn: applyRecipe,
+    bisectLockfileFn: bisectLockfile,
+    getAutonomyFn: getAutonomy,
+    analyzeDependenciesFn: analyzeDependencies,
+    removeUnusedDependenciesFn: removeUnusedDependencies,
+    assessUpgradeFn: assessUpgrade,
+    findVulnerableSymbolsFn: findVulnerableSymbols,
+    incidentFn: incident,
+    premortemFn: premortem,
+    compilePolicyFn: compilePolicy,
+    explainPolicyFn: explainPolicy,
+    maintainFn: maintain,
+    readMaintainerVexFn: readMaintainerVex,
+    generateProofOfFixFn: generateProofOfFix,
+    radarFn: radar,
+    freshnessReportFn: freshnessReport,
+    planFreshnessStepFn: planFreshnessStep,
+    listMemoryFn: listMemory,
+    addMemoryFn: addMemory,
+    acceptMemoryFn: acceptMemory,
+    removeMemoryFn: removeMemory,
+    pruneMemoryFn: pruneMemory,
+    buildEvidencePackFn: buildEvidencePack,
+};
+//# sourceMappingURL=api-deps.js.map

package/dist/catalog/api-deps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-deps.js","sourceRoot":"","sources":["../../src/catalog/api-deps.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,cAAc,EACd,WAAW,EACX,mBAAmB,EACnB,wBAAwB,EACxB,SAAS,EACT,WAAW,EACX,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,MAAM,EACN,YAAY,EACZ,IAAI,EACJ,YAAY,EACZ,QAAQ,EACR,oBAAoB,EACpB,kBAAkB,EAClB,WAAW,EACX,QAAQ,EACR,eAAe,EACf,OAAO,EACP,SAAS,EACT,YAAY,EACZ,KAAK,EACL,uBAAuB,EACvB,SAAS,EACT,iBAAiB,EACjB,kBAAkB,EAClB,SAAS,EACT,WAAW,EACX,SAAS,EACT,YAAY,EACZ,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,cAAc,EACd,qBAAqB,EACrB,aAAa,EACb,SAAS,EACT,aAAa,EACb,aAAa,EACb,QAAQ,EACR,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,YAAY,EACZ,SAAS,EACT,UAAU,EACV,WAAW,EACX,YAAY,EACZ,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AA8DzB,MAAM,CAAC,MAAM,cAAc,GAAY;IACrC,WAAW,EAAE,SAAS;IACtB,iBAAiB,EAAE,eAAe;IAClC,mBAAmB,EAAE,iBAAiB;IACtC,oBAAoB,EAAE,kBAAkB;IACxC,gBAAgB,EAAE,cAAc;IAChC,mBAAmB,EAAE,iBAAiB;IACtC,iBAAiB,EAAE,eAAe;IAClC,WAAW,EAAE,SAAS;IACtB,MAAM,EAAE,IAAI;IACZ,cAAc,EAAE,YAAY;IAC5B,cAAc,EAAE,YAAY;IAC5B,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACxC,oBAAoB,EAAE,kBAAkB;IACxC,sBAAsB,EAAE,oBAAoB;IAC5C,uBAAuB,EAAE,qBAAqB;IAC9C,yBAAyB,EAAE,uBAAuB;IAClD,OAAO,EAAE,cAAc;IACvB,oBAAoB,EAAE,kBAAkB;IACxC,eAAe,EAAE,aAAa;IAC9B,oBAAoB,EAAE,kBAAkB;IACxC,SAAS,EAAE,OAAO;IAClB,WAAW,EAAE,SAAS;IACtB,WAAW,EAAE,SAAS;IACtB,aAAa,EAAE,WAAW;IAC1B,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,QAAQ;IACpB,WAAW,EAAE,SAAS;IACtB,cAAc,EAAE,YAAY;IAC5B,cAAc,EAAE,YAAY;IAC5B,eAAe,EAAE,aAAa;IAC9B,iBAAiB,EAAE,eAAe;IAClC,gBAAgB,EAAE,cAAc;IAChC,aAAa,EAAE,WAAW;IAC1B,aAAa,EAAE,WAAW;IAC1B,gBAAgB,EAAE,cAAc;IAChC,aAAa,EAAE,WAAW;IAC1B,qBAAqB,EAAE,mBAAmB;IAC1C,0BAA0B,EAAE,wBAAwB;IACpD,eAAe,EAAE,aAAa;IAC9B,uBAAuB,EAAE,qBAAqB;IAC9C,UAAU,EAAE,QAAQ;IACpB,WAAW,EAAE,SAAS;IACtB,eAAe,EAAE,aAAa;IAC9B,eAAe,EAAE,aAAa;IAC9B,UAAU,EAAE,QAAQ;IACpB,mBAAmB,EAAE,iBAAiB;IACtC,oBAAoB,EAAE,kBAAkB;IACxC,OAAO,EAAE,KAAK;IACd,iBAAiB,EAAE,eAAe;IAClC,mBAAmB,EAAE,iBAAiB;IACtC,YAAY,EAAE,UAAU;IACxB,WAAW,EAAE,SAAS;IACtB,cAAc,EAAE,YAAY;IAC5B,cAAc,EAAE,YAAY;IAC5B,aAAa,EAAE,WAAW;IAC1B,mBAAmB,EAAE,iBAAiB;CACvC,CAAC"}

package/dist/catalog/define-operation.d.ts

@@ -0,0 +1,59 @@
+import type { z } from "zod";
+import type { ApiDeps } from "./api-deps.js";
+import type { ResponseSpec } from "./responses.js";
+export type OperationSource = "cli" | "sdk" | "mcp" | "openapi";
+/** Behaviour hints a host uses to decide whether a call needs approval (MCP tool annotations). */
+export interface OperationAnnotations {
+    /** The operation changes nothing in the project or its environment. */
+    readOnlyHint: boolean;
+    /** The operation may modify or remove existing files. */
+    destructiveHint: boolean;
+    /** Repeating the call with the same input has no further effect. */
+    idempotentHint: boolean;
+    /** The operation talks to external services. */
+    openWorldHint: boolean;
+}
+/** Where an operation is (or is meant to be) reachable over HTTP. */
+export interface HttpBinding {
+    method: "GET" | "POST";
+    path: string;
+    /** Body fields that sit at the top level; every other input field nests under `options`. */
+    positional?: readonly string[];
+    /** `GET` only: input field carried in the path as `:name`. */
+    pathParam?: string;
+    status?: 200 | 202;
+}
+export interface OperationContext {
+    /** The SDK functions the operation calls; replaceable for tests and embedding. */
+    api: ApiDeps;
+    /** Which surface the call arrived on; recorded as provenance. */
+    source: OperationSource;
+    /** Names of every operation reachable on the calling surface. */
+    operationNames: readonly string[];
+}
+/**
+ * One capability, defined once. MCP tools, HTTP routes, CLI commands and SDK entry points are
+ * generated from these definitions, so their names, inputs and descriptions cannot drift apart.
+ */
+export interface Operation {
+    /** Canonical camelCase name, e.g. `planRemediation`. */
+    name: string;
+    title: string;
+    description: string;
+    /** Flat input object. HTTP nests everything outside `http.positional` under `options`. */
+    input: z.ZodObject;
+    annotations: OperationAnnotations;
+    /** What a successful call returns, as the OpenAPI document describes it. */
+    response: ResponseSpec;
+    /** Expose as an MCP tool. */
+    mcp: boolean;
+    http?: HttpBinding;
+    handler(input: Record<string, unknown>, context: OperationContext): unknown;
+}
+export interface OperationDefinition<I extends z.ZodObject> extends Omit<Operation, "input" | "handler"> {
+    input: I;
+    handler(input: z.output<I>, context: OperationContext): unknown;
+}
+/** Define an operation with a handler typed by its own input schema. */
+export declare function defineOperation<I extends z.ZodObject>(definition: OperationDefinition<I>): Operation;
+//# sourceMappingURL=define-operation.d.ts.map

package/dist/catalog/define-operation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"define-operation.d.ts","sourceRoot":"","sources":["../../src/catalog/define-operation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAEnD,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,SAAS,CAAC;AAEhE,kGAAkG;AAClG,MAAM,WAAW,oBAAoB;IACnC,uEAAuE;IACvE,YAAY,EAAE,OAAO,CAAC;IACtB,yDAAyD;IACzD,eAAe,EAAE,OAAO,CAAC;IACzB,oEAAoE;IACpE,cAAc,EAAE,OAAO,CAAC;IACxB,gDAAgD;IAChD,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,4FAA4F;IAC5F,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,kFAAkF;IAClF,GAAG,EAAE,OAAO,CAAC;IACb,iEAAiE;IACjE,MAAM,EAAE,eAAe,CAAC;IACxB,iEAAiE;IACjE,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,0FAA0F;IAC1F,KAAK,EAAE,CAAC,CAAC,SAAS,CAAC;IACnB,WAAW,EAAE,oBAAoB,CAAC;IAClC,4EAA4E;IAC5E,QAAQ,EAAE,YAAY,CAAC;IACvB,6BAA6B;IAC7B,GAAG,EAAE,OAAO,CAAC;IACb,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC;CAC7E;AAED,MAAM,WAAW,mBAAmB,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,CAAE,SAAQ,IAAI,CACtE,SAAS,EACT,OAAO,GAAG,SAAS,CACpB;IACC,KAAK,EAAE,CAAC,CAAC;IACT,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC;CACjE;AAED,wEAAwE;AACxE,wBAAgB,eAAe,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,EACnD,UAAU,EAAE,mBAAmB,CAAC,CAAC,CAAC,GACjC,SAAS,CAMX"}

package/dist/catalog/define-operation.js

@@ -0,0 +1,9 @@
+/** Define an operation with a handler typed by its own input schema. */
+export function defineOperation(definition) {
+    return {
+        ...definition,
+        // Input is validated against `definition.input` before any handler runs.
+        handler: (input, context) => definition.handler(input, context),
+    };
+}
+//# sourceMappingURL=define-operation.js.map

package/dist/catalog/define-operation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"define-operation.js","sourceRoot":"","sources":["../../src/catalog/define-operation.ts"],"names":[],"mappings":"AAmEA,wEAAwE;AACxE,MAAM,UAAU,eAAe,CAC7B,UAAkC;IAElC,OAAO;QACL,GAAG,UAAU;QACb,yEAAyE;QACzE,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,KAAoB,EAAE,OAAO,CAAC;KAC/E,CAAC;AACJ,CAAC"}

package/dist/catalog/evidence-pack-operations.d.ts

@@ -0,0 +1,3 @@
+import { type Operation } from "./define-operation.js";
+export declare const EVIDENCE_PACK_OPERATIONS: readonly Operation[];
+//# sourceMappingURL=evidence-pack-operations.d.ts.map

package/dist/catalog/evidence-pack-operations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence-pack-operations.d.ts","sourceRoot":"","sources":["../../src/catalog/evidence-pack-operations.ts"],"names":[],"mappings":"AAGA,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAiExE,eAAO,MAAM,wBAAwB,EAAE,SAAS,SAAS,EA0CxD,CAAC"}

package/dist/catalog/evidence-pack-operations.js

@@ -0,0 +1,93 @@
+import { z } from "zod";
+import { OPTION_DESCRIPTIONS, pathField } from "../platform/option-schemas.js";
+import { defineOperation } from "./define-operation.js";
+const timestamp = (what) => z
+    .string()
+    .min(1)
+    .max(64)
+    .describe(`${what} ISO 8601 with a time zone (Z or an offset), e.g. 2026-11-10T14:30:00Z.`);
+const buildEvidencePackInput = z
+    .object({
+    outDir: pathField("Directory to write the evidence pack into (created if needed). Must be empty, absent, or hold an earlier pack; nothing outside it is written."),
+    cwd: pathField(OPTION_DESCRIPTIONS.cwd).optional(),
+    runIds: z
+        .array(z.string().min(1).max(100))
+        .max(500)
+        .optional()
+        .describe("Recorded runs to include. Default: every run under .autoremediator/runs/."),
+    policy: pathField("Policy file whose suppressions become VEX statements. Default: .github/autoremediator.yml.").optional(),
+    productName: z
+        .string()
+        .min(1)
+        .max(200)
+        .optional()
+        .describe("Product name. Default: name from package.json."),
+    productVersion: z
+        .string()
+        .min(1)
+        .max(100)
+        .optional()
+        .describe("Product version. Default: version from package.json."),
+    manufacturer: z
+        .string()
+        .min(1)
+        .max(200)
+        .optional()
+        .describe("Manufacturer name for the SBOM metadata, the OpenVEX author and the reporting drafts."),
+    author: z
+        .string()
+        .min(1)
+        .max(200)
+        .optional()
+        .describe("OpenVEX document author. Default: a marked, unreviewed draft."),
+    awarenessAt: timestamp("When the manufacturer became aware that an advisory is being actively exploited. Starts the 24 hour and 72 hour clocks in the reporting drafts; without it they state the rules and no dates.").optional(),
+    awarenessByCve: z
+        .record(z.string().min(1).max(100), timestamp("Awareness time for that advisory."))
+        .optional()
+        .describe("Awareness time per advisory id, when it differs from awarenessAt."),
+    correctiveMeasureAt: timestamp("When a corrective or mitigating measure became available to users. Starts the 14 day final report clock.").optional(),
+    signingKeyPath: pathField("PEM private key file (Ed25519 or ECDSA P-256/P-384) to sign the attestations with. A path only: key material is never accepted. Without it the attestations are unsigned (signed: false). The CLI and SDK also read AUTOREMEDIATOR_EVIDENCE_SIGNING_KEY; MCP and HTTP callers must pass this.").optional(),
+})
+    .strict();
+export const EVIDENCE_PACK_OPERATIONS = [
+    defineOperation({
+        name: "buildEvidencePack",
+        title: "Build an EU Cyber Resilience Act evidence pack",
+        description: "Assemble a reviewable evidence bundle from local data, for a manufacturer to hand to an auditor. Writes, under outDir only: a CycloneDX 1.6 SBOM of the lockfile (purls, hashes, licenses, dependency graph); VEX as CycloneDX 1.6 (with affects) and OpenVEX 0.2.0, from policy suppressions and recorded runs read against the lockfile; DRAFT Article 14 early-warning, notification and final-report texts for advisories recorded as CISA-KEV-listed and affecting the product, with deadlines computed from awarenessAt; DSSE/in-toto attestations of each recorded run's hash-chained ledger, signed only when signingKeyPath is given (otherwise signed: false); and a manifest of sha256 digests. This is evidence assembly, not legal advice or a compliance claim, and nothing is submitted anywhere. Reads the project and run records; no network. Changes nothing outside outDir.",
+        input: buildEvidencePackInput,
+        // Replaces an earlier pack in outDir (only the files that pack listed, and only if unchanged).
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: true,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
+        response: {
+            description: "EvidencePackResult",
+            schema: {
+                type: "object",
+                properties: {
+                    schemaVersion: { type: "string" },
+                    outDir: { type: "string" },
+                    generatedAt: { type: "string" },
+                    disclaimer: { type: "string" },
+                    signed: { type: "boolean" },
+                    signingKeyId: { type: "string" },
+                    files: { type: "array", items: { type: "object" } },
+                    manifest: { type: "object" },
+                    packAttestation: { type: "object" },
+                    sbom: { type: "object" },
+                    vex: { type: "object" },
+                    craReports: { type: "array", items: { type: "object" } },
+                    attestations: { type: "array", items: { type: "object" } },
+                    skippedRuns: { type: "array", items: { type: "object" } },
+                    notes: { type: "array", items: { type: "string" } },
+                },
+            },
+        },
+        mcp: true,
+        http: { method: "POST", path: "/evidence-pack", positional: [] },
+        handler: (options, context) => context.api.buildEvidencePackFn({ ...options, source: context.source }),
+    }),
+];
+//# sourceMappingURL=evidence-pack-operations.js.map

package/dist/catalog/evidence-pack-operations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence-pack-operations.js","sourceRoot":"","sources":["../../src/catalog/evidence-pack-operations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAkB,MAAM,uBAAuB,CAAC;AAExE,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE,CACjC,CAAC;KACE,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;KACP,QAAQ,CAAC,GAAG,IAAI,yEAAyE,CAAC,CAAC;AAEhG,MAAM,sBAAsB,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,MAAM,EAAE,SAAS,CACf,+IAA+I,CAChJ;IACD,GAAG,EAAE,SAAS,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAClD,MAAM,EAAE,CAAC;SACN,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;SACjC,GAAG,CAAC,GAAG,CAAC;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,2EAA2E,CAAC;IACxF,MAAM,EAAE,SAAS,CACf,4FAA4F,CAC7F,CAAC,QAAQ,EAAE;IACZ,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,gDAAgD,CAAC;IAC7D,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,sDAAsD,CAAC;IACnE,YAAY,EAAE,CAAC;SACZ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,uFAAuF,CACxF;IACH,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,+DAA+D,CAAC;IAC5E,WAAW,EAAE,SAAS,CACpB,+LAA+L,CAChM,CAAC,QAAQ,EAAE;IACZ,cAAc,EAAE,CAAC;SACd,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,mCAAmC,CAAC,CAAC;SAClF,QAAQ,EAAE;SACV,QAAQ,CAAC,mEAAmE,CAAC;IAChF,mBAAmB,EAAE,SAAS,CAC5B,0GAA0G,CAC3G,CAAC,QAAQ,EAAE;IACZ,cAAc,EAAE,SAAS,CACvB,+RAA+R,CAChS,CAAC,QAAQ,EAAE;CACb,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,wBAAwB,GAAyB;IAC5D,eAAe,CAAC;QACd,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE,gDAAgD;QACvD,WAAW,EACT,i2BAAi2B;QACn2B,KAAK,EAAE,sBAAsB;QAC7B,+FAA+F;QAC/F,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,KAAK;SACrB;QACD,QAAQ,EAAE;YACR,WAAW,EAAE,oBAAoB;YACjC,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACjC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC1B,WAAW,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC/B,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC9B,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;oBAC3B,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAChC,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;oBACnD,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC5B,eAAe,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACnC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACxB,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBACvB,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;oBACxD,YAAY,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;oBAC1D,WAAW,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;oBACzD,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;iBACpD;aACF;SACF;QACD,GAAG,EAAE,IAAI;QACT,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,EAAE,EAAE;QAChE,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAC5B,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;KAC1E,CAAC;CACH,CAAC"}

package/dist/catalog/freshness-operations.d.ts

@@ -0,0 +1,3 @@
+import { type Operation } from "./define-operation.js";
+export declare const FRESHNESS_OPERATIONS: readonly Operation[];
+//# sourceMappingURL=freshness-operations.d.ts.map

package/dist/catalog/freshness-operations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"freshness-operations.d.ts","sourceRoot":"","sources":["../../src/catalog/freshness-operations.ts"],"names":[],"mappings":"AAQA,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AA2BxE,eAAO,MAAM,oBAAoB,EAAE,SAAS,SAAS,EAwEpD,CAAC"}

package/dist/catalog/freshness-operations.js

@@ -0,0 +1,91 @@
+import { z } from "zod";
+import { OPTION_DESCRIPTIONS, PACKAGE_MANAGER_VALUES, packageNameSchema, pathField, } from "../platform/option-schemas.js";
+import { defineOperation } from "./define-operation.js";
+const response = (description, properties) => ({
+    description,
+    schema: { type: "object", properties },
+});
+const freshnessInput = {
+    cwd: pathField(OPTION_DESCRIPTIONS.cwd).optional(),
+    policy: pathField(OPTION_DESCRIPTIONS.policy).optional(),
+    packageManager: z
+        .enum(PACKAGE_MANAGER_VALUES)
+        .optional()
+        .describe(OPTION_DESCRIPTIONS.packageManager),
+    packages: z
+        .array(packageNameSchema)
+        .max(200)
+        .optional()
+        .describe("Only these direct dependencies. Default: all of them."),
+    allowHigh: z
+        .boolean()
+        .optional()
+        .describe("Take steps assessUpgrade rates High. They are held otherwise, and a held step is reported, never planned."),
+};
+export const FRESHNESS_OPERATIONS = [
+    defineOperation({
+        name: "freshnessReport",
+        title: "Dependency freshness report",
+        description: "How far behind the latest release each direct dependency is (major, minor and patch distance, stable releases behind, age of the installed version from the registry's publish times), a 0-100 project freshness score, and, for dependencies past the policy's `freshness` limits (maxMajorsBehind, maxMinorsBehind, maxAgeDays, ignore), the climb back: one package, one jump at a time, the catch-up to the newest release on the installed major first and then one major per step. With assess, the first step of each climb is rated with assessUpgrade and the climbs are ordered safest first; High ones are held. Needs the dependencies installed. Changes nothing.",
+        input: z
+            .object({
+            ...freshnessInput,
+            assess: z
+                .boolean()
+                .optional()
+                .describe("Rate the first step of each climb with assessUpgrade (downloads two tarballs per package). Default false."),
+        })
+            .strict(),
+        annotations: {
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: true,
+        },
+        response: response("FreshnessReport", {
+            schemaVersion: { type: "string" },
+            score: { type: "number" },
+            policy: { type: "object", nullable: true },
+            counts: { type: "object" },
+            packages: { type: "array", items: { type: "object" } },
+            climbs: { type: "array", items: { type: "object" } },
+            unplanned: { type: "array", items: { type: "object" } },
+            notes: { type: "array", items: { type: "string" } },
+        }),
+        mcp: true,
+        http: { method: "POST", path: "/freshness", positional: [] },
+        handler: (options, context) => context.api.freshnessReportFn(options),
+    }),
+    defineOperation({
+        name: "planFreshnessStep",
+        title: "Plan the next freshness step",
+        description: "Record the next dependency freshness step as a plan, to be carried out with applyPlan after review: the first step of the safest climb that is not held (every step is rated with assessUpgrade; High ones are held unless allowHigh, major bumps need allowMajorBumps in the policy). One package, one jump. Only one plan is recorded, because applying it changes the manifests any other plan was made against; call this again after applyPlan for the next one. Apply it with applyPlan, verify with verifyRun, undo with rollbackRun: every step is its own run. At autonomy L0 no plan is recorded. Changes nothing in the project.",
+        input: z
+            .object({
+            ...freshnessInput,
+            assess: z
+                .boolean()
+                .optional()
+                .describe("Rate steps with assessUpgrade (default true); false orders by step size only."),
+            runTests: z.boolean().optional().describe(OPTION_DESCRIPTIONS.runTests),
+            typecheck: z.boolean().optional().describe(OPTION_DESCRIPTIONS.typecheck),
+        })
+            .strict(),
+        annotations: {
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: false,
+            openWorldHint: true,
+        },
+        response: response("FreshnessPlanResult", {
+            planned: { type: "object" },
+            reason: { type: "string" },
+            held: { type: "array", items: { type: "object" } },
+            report: { type: "object" },
+        }),
+        mcp: true,
+        http: { method: "POST", path: "/freshness/plan", positional: [] },
+        handler: (options, context) => context.api.planFreshnessStepFn({ ...options, source: context.source }),
+    }),
+];
+//# sourceMappingURL=freshness-operations.js.map

package/dist/catalog/freshness-operations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"freshness-operations.js","sourceRoot":"","sources":["../../src/catalog/freshness-operations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,iBAAiB,EACjB,SAAS,GACV,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,eAAe,EAAkB,MAAM,uBAAuB,CAAC;AAExE,MAAM,QAAQ,GAAG,CAAC,WAAmB,EAAE,UAAmC,EAAE,EAAE,CAAC,CAAC;IAC9E,WAAW;IACX,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE;CACvC,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG;IACrB,GAAG,EAAE,SAAS,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAClD,MAAM,EAAE,SAAS,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;IACxD,cAAc,EAAE,CAAC;SACd,IAAI,CAAC,sBAAsB,CAAC;SAC5B,QAAQ,EAAE;SACV,QAAQ,CAAC,mBAAmB,CAAC,cAAc,CAAC;IAC/C,QAAQ,EAAE,CAAC;SACR,KAAK,CAAC,iBAAiB,CAAC;SACxB,GAAG,CAAC,GAAG,CAAC;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,uDAAuD,CAAC;IACpE,SAAS,EAAE,CAAC;SACT,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,2GAA2G,CAC5G;CACJ,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAyB;IACxD,eAAe,CAAC;QACd,IAAI,EAAE,iBAAiB;QACvB,KAAK,EAAE,6BAA6B;QACpC,WAAW,EACT,gpBAAgpB;QAClpB,KAAK,EAAE,CAAC;aACL,MAAM,CAAC;YACN,GAAG,cAAc;YACjB,MAAM,EAAE,CAAC;iBACN,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,QAAQ,CACP,2GAA2G,CAC5G;SACJ,CAAC;aACD,MAAM,EAAE;QACX,WAAW,EAAE;YACX,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;QACD,QAAQ,EAAE,QAAQ,CAAC,iBAAiB,EAAE;YACpC,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACjC,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC1C,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;YACtD,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;YACpD,SAAS,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;YACvD,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;SACpD,CAAC;QACF,GAAG,EAAE,IAAI;QACT,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,EAAE;QAC5D,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC;KACtE,CAAC;IACF,eAAe,CAAC;QACd,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE,8BAA8B;QACrC,WAAW,EACT,6mBAA6mB;QAC/mB,KAAK,EAAE,CAAC;aACL,MAAM,CAAC;YACN,GAAG,cAAc;YACjB,MAAM,EAAE,CAAC;iBACN,OAAO,EAAE;iBACT,QAAQ,EAAE;iBACV,QAAQ,CACP,+EAA+E,CAChF;YACH,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC,QAAQ,CAAC;YACvE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mBAAmB,CAAC,SAAS,CAAC;SAC1E,CAAC;aACD,MAAM,EAAE;QACX,WAAW,EAAE;YACX,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,KAAK;YACrB,aAAa,EAAE,IAAI;SACpB;QACD,QAAQ,EAAE,QAAQ,CAAC,qBAAqB,EAAE;YACxC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC3B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;YAClD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;SAC3B,CAAC;QACF,GAAG,EAAE,IAAI;QACT,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,UAAU,EAAE,EAAE,EAAE;QACjE,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAC5B,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;KAC1E,CAAC;CACH,CAAC"}

package/dist/catalog/incident-operations.d.ts

@@ -0,0 +1,3 @@
+import { type Operation } from "./define-operation.js";
+export declare const INCIDENT_OPERATIONS: readonly Operation[];
+//# sourceMappingURL=incident-operations.d.ts.map

package/dist/catalog/incident-operations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"incident-operations.d.ts","sourceRoot":"","sources":["../../src/catalog/incident-operations.ts"],"names":[],"mappings":"AAGA,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AA4GxE,eAAO,MAAM,mBAAmB,EAAE,SAAS,SAAS,EAwCnD,CAAC"}

package/dist/catalog/incident-operations.js

@@ -0,0 +1,125 @@
+import { z } from "zod";
+import { OPTION_DESCRIPTIONS, pathField } from "../platform/option-schemas.js";
+import { defineOperation } from "./define-operation.js";
+/**
+ * Analysis that reads the project and git history. Neither operation changes the project: `plan`
+ * records a plan (never applied) and `outputDir` writes report files, both only when asked for.
+ */
+const ANALYSIS = {
+    readOnlyHint: false,
+    destructiveHint: false,
+    idempotentHint: true,
+    openWorldHint: true,
+};
+const outputDir = (what) => pathField(`Directory to write ${what} into (created if needed). Nothing is written without it.`).optional();
+const incidentInput = z
+    .object({
+    target: z
+        .string("target is required (string)")
+        .min(1, "target is required (string)")
+        .max(300)
+        .describe('What was compromised: an advisory id (MAL-…, GHSA-…, CVE-…), or package@range such as lodash@4.17.21 or "left-pad@>=1.3.0 <1.3.2". package@range needs no lookup.'),
+    cwd: pathField(OPTION_DESCRIPTIONS.cwd).optional(),
+    plan: z
+        .boolean()
+        .optional()
+        .describe("Record the rollback to the last safe version as a plan that applyPlan can carry out after review. Never applied by this call."),
+    offline: z
+        .boolean()
+        .optional()
+        .describe("No network: no advisory lookup and no registry. An id then needs intelligenceSnapshotPath."),
+    intelligenceSnapshotPath: pathField(OPTION_DESCRIPTIONS.intelligenceSnapshotPath).optional(),
+    policy: pathField(OPTION_DESCRIPTIONS.policy).optional(),
+    history: z
+        .boolean()
+        .optional()
+        .describe("Read git history for when the versions came and went. Default true."),
+    maxCommits: z
+        .number()
+        .int()
+        .min(1)
+        .max(5000)
+        .optional()
+        .describe("Most lockfile commits to read from history, newest first. Default 500."),
+    outputDir: outputDir("incident-report.md and incident-report.json"),
+})
+    .strict();
+const premortemTarget = z
+    .object({
+    cwd: pathField(OPTION_DESCRIPTIONS.cwd),
+    label: z.string().max(100).optional().describe("Display name for this repository"),
+})
+    .strict();
+const premortemInput = z
+    .object({
+    targets: z
+        .array(premortemTarget)
+        .optional()
+        .describe("Repository checkouts to read, as in the portfolio targets file (only cwd and label are used)."),
+    root: pathField("Find the repositories (a .git next to a package.json) under this directory instead of listing them.").optional(),
+    packages: z
+        .array(z.string().min(1).max(214))
+        .max(100)
+        .optional()
+        .describe("Packages to assess. Default: the most depended-upon ones across the repositories."),
+    top: z
+        .number()
+        .int()
+        .min(1)
+        .max(100)
+        .optional()
+        .describe("With no packages: how many to pick. Default 10."),
+    rankBy: z
+        .enum(["depended-upon", "privileged"])
+        .optional()
+        .describe("How to pick them: most depended-upon (default), or most privileged (packages that run install scripts first)."),
+    playbooks: z
+        .enum(["repo", "package"])
+        .optional()
+        .describe("One playbook per repository (default) or per package."),
+    outputDir: outputDir("premortem.md, premortem.json and the playbooks (commit them)"),
+})
+    .strict();
+const response = (description, properties) => ({
+    description,
+    schema: { type: "object", properties },
+});
+export const INCIDENT_OPERATIONS = [
+    defineOperation({
+        name: "incident",
+        title: "Respond to a compromised package",
+        description: "Supply-chain incident mode. Given an advisory id (MAL-, GHSA-, CVE-) or package@range, report: whether it is in this project (direct or transitive, versions, parent chain, production or development, install scripts); when each affected version entered and left the lockfiles in git history and which branches and tags could have installed it; a rollback to the newest version outside the affected range (recorded as a plan with plan: true, never applied); and a checklist of the secret names CI, containers and env templates put in reach of an install (names only, never values; a checklist to review, not a finding of compromise). Changes nothing unless plan or outputDir is set. Works offline for package@range.",
+        input: incidentInput,
+        annotations: ANALYSIS,
+        response: response("IncidentReport", {
+            schemaVersion: { type: "string" },
+            target: { type: "object" },
+            exposure: { type: "object" },
+            history: { type: "object" },
+            rollback: { type: "object" },
+            secrets: { type: "object" },
+            files: { type: "object" },
+        }),
+        mcp: true,
+        http: { method: "POST", path: "/incident", positional: ["target"] },
+        handler: ({ target, ...options }, context) => context.api.incidentFn(target, { ...options, source: context.source }),
+    }),
+    defineOperation({
+        name: "premortem",
+        title: "Compromise pre-mortem",
+        description: "What if this package is compromised tomorrow? Across repository checkouts (a portfolio targets list, or every repository under a root), report for the given packages (or the most depended-upon or most privileged ones) which repositories lock them, directly or transitively, in which versions, whether they run install scripts, and whether CI installs run with secrets in reach. With outputDir, writes a playbook per repository or per package with the exact commands to run on the day, meant to be committed. Reads checkouts only; no network.",
+        input: premortemInput,
+        annotations: { ...ANALYSIS, openWorldHint: false },
+        response: response("PremortemReport", {
+            schemaVersion: { type: "string" },
+            repos: { type: "array", items: { type: "object" } },
+            packages: { type: "array", items: { type: "object" } },
+            selection: { type: "object" },
+            files: { type: "array", items: { type: "string" } },
+        }),
+        mcp: true,
+        http: { method: "POST", path: "/premortem", positional: [] },
+        handler: (options, context) => context.api.premortemFn(options),
+    }),
+];
+//# sourceMappingURL=incident-operations.js.map

package/dist/catalog/incident-operations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"incident-operations.js","sourceRoot":"","sources":["../../src/catalog/incident-operations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAkB,MAAM,uBAAuB,CAAC;AAExE;;;GAGG;AACH,MAAM,QAAQ,GAAG;IACf,YAAY,EAAE,KAAK;IACnB,eAAe,EAAE,KAAK;IACtB,cAAc,EAAE,IAAI;IACpB,aAAa,EAAE,IAAI;CACX,CAAC;AAEX,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE,CACjC,SAAS,CACP,sBAAsB,IAAI,2DAA2D,CACtF,CAAC,QAAQ,EAAE,CAAC;AAEf,MAAM,aAAa,GAAG,CAAC;KACpB,MAAM,CAAC;IACN,MAAM,EAAE,CAAC;SACN,MAAM,CAAC,6BAA6B,CAAC;SACrC,GAAG,CAAC,CAAC,EAAE,6BAA6B,CAAC;SACrC,GAAG,CAAC,GAAG,CAAC;SACR,QAAQ,CACP,mKAAmK,CACpK;IACH,GAAG,EAAE,SAAS,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAClD,IAAI,EAAE,CAAC;SACJ,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,+HAA+H,CAChI;IACH,OAAO,EAAE,CAAC;SACP,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CACP,4FAA4F,CAC7F;IACH,wBAAwB,EAAE,SAAS,CAAC,mBAAmB,CAAC,wBAAwB,CAAC,CAAC,QAAQ,EAAE;IAC5F,MAAM,EAAE,SAAS,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;IACxD,OAAO,EAAE,CAAC;SACP,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,qEAAqE,CAAC;IAClF,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,IAAI,CAAC;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,wEAAwE,CAAC;IACrF,SAAS,EAAE,SAAS,CAAC,6CAA6C,CAAC;CACpE,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,eAAe,GAAG,CAAC;KACtB,MAAM,CAAC;IACN,GAAG,EAAE,SAAS,CAAC,mBAAmB,CAAC,GAAG,CAAC;IACvC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,kCAAkC,CAAC;CACnF,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,cAAc,GAAG,CAAC;KACrB,MAAM,CAAC;IACN,OAAO,EAAE,CAAC;SACP,KAAK,CAAC,eAAe,CAAC;SACtB,QAAQ,EAAE;SACV,QAAQ,CACP,+FAA+F,CAChG;IACH,IAAI,EAAE,SAAS,CACb,qGAAqG,CACtG,CAAC,QAAQ,EAAE;IACZ,QAAQ,EAAE,CAAC;SACR,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;SACjC,GAAG,CAAC,GAAG,CAAC;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,mFAAmF,CACpF;IACH,GAAG,EAAE,CAAC;SACH,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,iDAAiD,CAAC;IAC9D,MAAM,EAAE,CAAC;SACN,IAAI,CAAC,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;SACrC,QAAQ,EAAE;SACV,QAAQ,CACP,+GAA+G,CAChH;IACH,SAAS,EAAE,CAAC;SACT,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;SACzB,QAAQ,EAAE;SACV,QAAQ,CAAC,uDAAuD,CAAC;IACpE,SAAS,EAAE,SAAS,CAAC,8DAA8D,CAAC;CACrF,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,QAAQ,GAAG,CAAC,WAAmB,EAAE,UAAmC,EAAE,EAAE,CAAC,CAAC;IAC9E,WAAW;IACX,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE;CACvC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAyB;IACvD,eAAe,CAAC;QACd,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,kCAAkC;QACzC,WAAW,EACT,2sBAA2sB;QAC7sB,KAAK,EAAE,aAAa;QACpB,WAAW,EAAE,QAAQ;QACrB,QAAQ,EAAE,QAAQ,CAAC,gBAAgB,EAAE;YACnC,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACjC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC5B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC5B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC3B,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;SAC1B,CAAC;QACF,GAAG,EAAE,IAAI;QACT,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,QAAQ,CAAC,EAAE;QACnE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,CAC3C,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;KACzE,CAAC;IACF,eAAe,CAAC;QACd,IAAI,EAAE,WAAW;QACjB,KAAK,EAAE,uBAAuB;QAC9B,WAAW,EACT,+hBAA+hB;QACjiB,KAAK,EAAE,cAAc;QACrB,WAAW,EAAE,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAE;QAClD,QAAQ,EAAE,QAAQ,CAAC,iBAAiB,EAAE;YACpC,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACjC,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;YACnD,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;YACtD,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC7B,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;SACpD,CAAC;QACF,GAAG,EAAE,IAAI;QACT,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,EAAE,EAAE;QAC5D,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC;KAChE,CAAC;CACH,CAAC"}

package/dist/catalog/index.d.ts

@@ -0,0 +1,12 @@
+export type { ApiDeps } from "./api-deps.js";
+export { defaultApiDeps } from "./api-deps.js";
+export { callMcpOperation, changesProject, mcpOperations, toMcpTools } from "./adapters/mcp.js";
+export type { CallOptions } from "./adapters/mcp.js";
+export type { McpTool, McpToolResult } from "./adapters/mcp.js";
+export { defineOperation } from "./define-operation.js";
+export type { HttpBinding, Operation, OperationAnnotations, OperationContext, } from "./define-operation.js";
+export { getOperation, OPERATIONS } from "./operations.js";
+export { inputJsonSchema } from "./schema.js";
+export { httpOperations, mapRequestToInput, matchHttpRoute, roleFor, routeKey, toOpenApiPaths, } from "./adapters/http.js";
+export type { HttpRole, RequestMapping } from "./adapters/http.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/catalog/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/catalog/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAChG,YAAY,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,YAAY,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,YAAY,EACV,WAAW,EACX,SAAS,EACT,oBAAoB,EACpB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,OAAO,EACP,QAAQ,EACR,cAAc,GACf,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/catalog/index.js

@@ -0,0 +1,7 @@
+export { defaultApiDeps } from "./api-deps.js";
+export { callMcpOperation, changesProject, mcpOperations, toMcpTools } from "./adapters/mcp.js";
+export { defineOperation } from "./define-operation.js";
+export { getOperation, OPERATIONS } from "./operations.js";
+export { inputJsonSchema } from "./schema.js";
+export { httpOperations, mapRequestToInput, matchHttpRoute, roleFor, routeKey, toOpenApiPaths, } from "./adapters/http.js";
+//# sourceMappingURL=index.js.map

package/dist/catalog/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/catalog/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGhG,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAOxD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,OAAO,EACP,QAAQ,EACR,cAAc,GACf,MAAM,oBAAoB,CAAC"}

package/dist/catalog/maintainer-vex-operations.d.ts

@@ -0,0 +1,3 @@
+import { type Operation } from "./define-operation.js";
+export declare const MAINTAINER_VEX_OPERATIONS: readonly Operation[];
+//# sourceMappingURL=maintainer-vex-operations.d.ts.map

package/dist/catalog/maintainer-vex-operations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"maintainer-vex-operations.d.ts","sourceRoot":"","sources":["../../src/catalog/maintainer-vex-operations.ts"],"names":[],"mappings":"AAQA,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,uBAAuB,CAAC;AA4DxE,eAAO,MAAM,yBAAyB,EAAE,SAAS,SAAS,EA0DzD,CAAC"}