autoremediator 0.21.2 → 0.22.0

package/dist/cli/incident-commands.js

@@ -0,0 +1,131 @@
+import { readFileSync } from "node:fs";
+import { incident, incidentExitCode, OPTION_DESCRIPTIONS, premortem, renderIncidentMarkdown, } from "../api/index.js";
+import { logJson } from "./output.js";
+import { validateOutputFormat } from "./validators.js";
+export async function runIncident(target, opts) {
+    const report = await incident(target, {
+        cwd: opts.cwd,
+        source: "cli",
+        ...(opts.plan ? { plan: true } : {}),
+        ...(opts.offline ? { offline: true } : {}),
+        ...(opts.intelligenceSnapshot ? { intelligenceSnapshotPath: opts.intelligenceSnapshot } : {}),
+        ...(opts.policy ? { policy: opts.policy } : {}),
+        ...(opts.history === false ? { history: false } : {}),
+        ...(opts.maxCommits ? { maxCommits: opts.maxCommits } : {}),
+        ...(opts.outputDir ? { outputDir: opts.outputDir } : {}),
+    });
+    if (opts.outputFormat === "json")
+        logJson(report);
+    else {
+        process.stdout.write(renderIncidentMarkdown(report));
+        if (report.files)
+            process.stdout.write(`\nWrote ${report.files.markdown} and ${report.files.json}\n`);
+    }
+    // 0 clear, 3 it was in history but is not locked now, 4 it is locked or installed now.
+    process.exitCode = incidentExitCode(report);
+}
+function readTargets(path) {
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch (error) {
+        throw new Error(`Could not read targets file at "${path}": ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+    }
+    if (!Array.isArray(parsed))
+        throw new Error("Targets file must be a JSON array, as for `portfolio`.");
+    const targets = [];
+    for (const [index, entry] of parsed.entries()) {
+        const record = typeof entry === "object" && entry !== null ? entry : {};
+        if (typeof record["cwd"] !== "string" || record["cwd"] === "") {
+            throw new Error(`Invalid target at index ${index}: cwd is required.`);
+        }
+        const target = { cwd: record["cwd"] };
+        if (typeof record["label"] === "string")
+            target.label = record["label"];
+        targets.push(target);
+    }
+    return targets;
+}
+function describePremortem(report) {
+    const lines = [
+        `Assessed ${report.packages.length} package(s) across ${report.repos.length} repositor${report.repos.length === 1 ? "y" : "ies"}.`,
+    ];
+    for (const entry of report.packages) {
+        lines.push(`  ${entry.packageName}: ${entry.repoCount} repo(s), ${entry.dependentCount} dependent(s), install scripts ${String(entry.installScript)}${entry.reposWithCiSecrets.length > 0
+            ? `, CI installs with secrets in ${entry.reposWithCiSecrets.join(", ")}`
+            : ""}`);
+    }
+    for (const note of report.notes)
+        lines.push(`  note: ${note}`);
+    if (report.files)
+        lines.push(`Wrote ${report.files.length} file(s):`, ...report.files.map((file) => `  ${file}`));
+    else
+        lines.push("Pass --output-dir to write the playbooks.");
+    return `${lines.join("\n")}\n`;
+}
+export async function runPremortem(opts) {
+    if (!opts.targetsFile && !opts.root)
+        throw new Error("Give --targets-file <json> or --root <dir>.");
+    const report = await premortem({
+        ...(opts.targetsFile ? { targets: readTargets(opts.targetsFile) } : {}),
+        ...(opts.root ? { root: opts.root } : {}),
+        ...(opts.packages
+            ? {
+                packages: opts.packages
+                    .split(",")
+                    .map((name) => name.trim())
+                    .filter((name) => name !== ""),
+            }
+            : {}),
+        ...(opts.top ? { top: opts.top } : {}),
+        ...(opts.rankBy ? { rankBy: opts.rankBy } : {}),
+        ...(opts.playbooks ? { playbooks: opts.playbooks } : {}),
+        ...(opts.outputDir ? { outputDir: opts.outputDir } : {}),
+    });
+    if (opts.outputFormat === "json")
+        logJson(report);
+    else
+        process.stdout.write(describePremortem(report));
+}
+/** Register `incident` and `premortem`. */
+export function registerIncidentCommands(program) {
+    program
+        .command("incident <target>")
+        .description("A package was compromised: is it here, when did it enter and leave git history, roll back to the last safe version, and which secrets to rotate. Target is an advisory id (MAL-, GHSA-, CVE-) or package@range. Exits 0 clear, 3 in history only, 4 locked now")
+        .option("--cwd <path>", OPTION_DESCRIPTIONS.cwd, process.cwd())
+        .option("--plan", "Record the rollback as a plan (never applied); review it with `runs show` and apply with `runs apply`")
+        .option("--offline", "No network: no advisory lookup and no registry (an id then needs --intelligence-snapshot)")
+        .option("--intelligence-snapshot <path>", OPTION_DESCRIPTIONS.intelligenceSnapshotPath)
+        .option("--policy <path>", OPTION_DESCRIPTIONS.policy)
+        .option("--no-history", "Do not read git history")
+        .option("--max-commits <n>", "Most lockfile commits to read from history, newest first (default 500)", (value) => Number.parseInt(value, 10))
+        .option("--output-dir <dir>", "Write incident-report.md and incident-report.json into this directory")
+        .option("--output-format <format>", "Output format: text|json", "text")
+        .action(async (target, opts) => {
+        validateOutputFormat(opts.outputFormat, ["text", "json"], "incident");
+        await runIncident(target, opts);
+    });
+    program
+        .command("premortem")
+        .description("What if a package is compromised tomorrow? Across repositories: who locks it, which versions, install scripts, CI installs with secrets in reach. With --output-dir, writes playbooks with the commands to run on the day")
+        .option("--targets-file <path>", "Repositories as a JSON array of { cwd, label? }, the portfolio targets format")
+        .option("--root <dir>", "Find the repositories (a .git next to a package.json) under this directory")
+        .option("--packages <list>", "Packages to assess, comma-separated (default: the most depended-upon ones)")
+        .option("--top <n>", "With no --packages: how many to pick (default 10)", (value) => Number.parseInt(value, 10))
+        .option("--rank-by <how>", "depended-upon (default) or privileged (packages with install scripts first)")
+        .option("--playbooks <kind>", "One playbook per repo (default) or per package")
+        .option("--output-dir <dir>", "Write premortem.md, premortem.json and the playbooks into this directory; commit them")
+        .option("--output-format <format>", "Output format: text|json", "text")
+        .action(async (opts) => {
+        validateOutputFormat(opts.outputFormat, ["text", "json"], "premortem");
+        if (opts.rankBy && !["depended-upon", "privileged"].includes(opts.rankBy)) {
+            throw new Error(`--rank-by must be depended-upon or privileged, not "${opts.rankBy}".`);
+        }
+        if (opts.playbooks && !["repo", "package"].includes(opts.playbooks)) {
+            throw new Error(`--playbooks must be repo or package, not "${opts.playbooks}".`);
+        }
+        await runPremortem(opts);
+    });
+}
+//# sourceMappingURL=incident-commands.js.map

package/dist/cli/incident-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"incident-commands.js","sourceRoot":"","sources":["../../src/cli/incident-commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAIvC,OAAO,EACL,QAAQ,EACR,gBAAgB,EAChB,mBAAmB,EACnB,SAAS,EACT,sBAAsB,GAGvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AA0BvD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAc,EAAE,IAAwB;IACxE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE;QACpC,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,MAAM,EAAE,KAAK;QACb,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,IAAI,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC,CAAC;IAEH,IAAI,IAAI,CAAC,YAAY,KAAK,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,CAAC;SAC7C,CAAC;QACJ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,KAAK;YACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,MAAM,CAAC,KAAK,CAAC,QAAQ,QAAQ,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;IACxF,CAAC;IACD,uFAAuF;IACvF,OAAO,CAAC,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,mCAAmC,IAAI,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EACrG,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9C,MAAM,MAAM,GACV,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,IAAI,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,oBAAoB,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,MAAM,GAAoB,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,IAAI,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,QAAQ;YAAE,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QACxE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAuB;IAChD,MAAM,KAAK,GAAG;QACZ,YAAY,MAAM,CAAC,QAAQ,CAAC,MAAM,sBAAsB,MAAM,CAAC,KAAK,CAAC,MAAM,aAAa,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG;KACnI,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CACR,KAAK,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,SAAS,aAAa,KAAK,CAAC,cAAc,kCAAkC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,GACtI,KAAK,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC;YACjC,CAAC,CAAC,iCAAiC,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACxE,CAAC,CAAC,EACN,EAAE,CACH,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAC/D,IAAI,MAAM,CAAC,KAAK;QACd,KAAK,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,KAAK,CAAC,MAAM,WAAW,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;;QAC7F,KAAK,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;IAC7D,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAyB;IAC1D,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,IAAI;QACjC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,QAAQ;YACf,CAAC,CAAC;gBACE,QAAQ,EAAE,IAAI,CAAC,QAAQ;qBACpB,KAAK,CAAC,GAAG,CAAC;qBACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;qBAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;aACjC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,YAAY,KAAK,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,CAAC;;QAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,OAAO;SACJ,OAAO,CAAC,mBAAmB,CAAC;SAC5B,WAAW,CACV,gQAAgQ,CACjQ;SACA,MAAM,CAAC,cAAc,EAAE,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SAC9D,MAAM,CACL,QAAQ,EACR,uGAAuG,CACxG;SACA,MAAM,CACL,WAAW,EACX,2FAA2F,CAC5F;SACA,MAAM,CAAC,gCAAgC,EAAE,mBAAmB,CAAC,wBAAwB,CAAC;SACtF,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,MAAM,CAAC;SACrD,MAAM,CAAC,cAAc,EAAE,yBAAyB,CAAC;SACjD,MAAM,CACL,mBAAmB,EACnB,wEAAwE,EACxE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAC9C;SACA,MAAM,CACL,oBAAoB,EACpB,uEAAuE,CACxE;SACA,MAAM,CAAC,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,CAAC;SACtE,MAAM,CAAC,KAAK,EAAE,MAAc,EAAE,IAAwB,EAAE,EAAE;QACzD,oBAAoB,CAAC,IAAI,CAAC,YAA+B,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC;QACzF,MAAM,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CACV,2NAA2N,CAC5N;SACA,MAAM,CACL,uBAAuB,EACvB,+EAA+E,CAChF;SACA,MAAM,CACL,cAAc,EACd,4EAA4E,CAC7E;SACA,MAAM,CACL,mBAAmB,EACnB,4EAA4E,CAC7E;SACA,MAAM,CAAC,WAAW,EAAE,mDAAmD,EAAE,CAAC,KAAa,EAAE,EAAE,CAC1F,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAC3B;SACA,MAAM,CACL,iBAAiB,EACjB,6EAA6E,CAC9E;SACA,MAAM,CAAC,oBAAoB,EAAE,gDAAgD,CAAC;SAC9E,MAAM,CACL,oBAAoB,EACpB,uFAAuF,CACxF;SACA,MAAM,CAAC,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,CAAC;SACtE,MAAM,CAAC,KAAK,EAAE,IAAyB,EAAE,EAAE;QAC1C,oBAAoB,CAAC,IAAI,CAAC,YAA+B,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,CAAC,CAAC;QAC1F,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CAAC,uDAAuD,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,KAAK,CAAC,6CAA6C,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/cli/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKzC,wBAAgB,aAAa,IAAI,OAAO,CAEvC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAOzC,wBAAgB,aAAa,IAAI,OAAO,CAEvC"}

package/dist/cli/index.js

@@ -1,5 +1,7 @@
 #!/usr/bin/env node
+import { EXIT_CODES } from "../api/reporting.js";
 import { isEntrypoint } from "../platform/entrypoint.js";
+import { formatCliError, wantsJson } from "./errors.js";
 import { createProgram as createCliProgram } from "./program.js";
 export function createProgram() {
     return createCliProgram();
@@ -10,9 +12,8 @@ async function main(argv = process.argv) {
 }
 if (isEntrypoint(import.meta.url)) {
     main().catch((error) => {
-        const message = error instanceof Error ? error.message : String(error);
-        process.stderr.write(`[autoremediator] ${message}\n`);
-        process.exit(1);
+        process.stderr.write(formatCliError(error, wantsJson(process.argv)));
+        process.exit(EXIT_CODES.failed);
     });
 }
 //# sourceMappingURL=index.js.map

package/dist/cli/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AAIA,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,aAAa,IAAI,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEjE,MAAM,UAAU,aAAa;IAC3B,OAAO,gBAAgB,EAAE,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI;IACrC,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC;IAChC,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,IAAI,YAAY,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAClC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC9B,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,OAAO,IAAI,CAAC,CAAC;QACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AAIA,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,aAAa,IAAI,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEjE,MAAM,UAAU,aAAa;IAC3B,OAAO,gBAAgB,EAAE,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI;IACrC,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC;IAChC,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,IAAI,YAAY,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAClC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/maintain-commands.d.ts

@@ -0,0 +1,22 @@
+import type { Command } from "commander";
+import { type MaintainOptions, type MaintainResult, type MaintainerVexReport } from "../api/index.js";
+interface MaintainCliOptions {
+    cwd: string;
+    advisories?: string;
+    assertNotAffected?: boolean;
+    traceFile?: string;
+    policy?: string;
+    packageManager?: MaintainOptions["packageManager"];
+    offline?: boolean;
+    intelligenceSnapshot?: string;
+    nextVersion?: string;
+    yes?: boolean;
+    outputFormat: string;
+}
+export declare function describeMaintain(result: MaintainResult): string;
+export declare function runMaintain(opts: MaintainCliOptions): Promise<void>;
+export declare function describeVexShow(report: MaintainerVexReport): string;
+/** Register `maintain` and `vex show`. */
+export declare function registerMaintainCommands(program: Command): void;
+export {};
+//# sourceMappingURL=maintain-commands.d.ts.map

package/dist/cli/maintain-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"maintain-commands.d.ts","sourceRoot":"","sources":["../../src/cli/maintain-commands.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAKL,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACzB,MAAM,iBAAiB,CAAC;AAIzB,UAAU,kBAAkB;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,eAAe,CAAC,gBAAgB,CAAC,CAAC;IACnD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;CACtB;AASD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CA4B/D;AAWD,wBAAsB,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0DzE;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,CAgCnE;AAED,0CAA0C;AAC1C,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAqD/D"}

package/dist/cli/maintain-commands.js

@@ -0,0 +1,161 @@
+import { createInterface } from "node:readline/promises";
+import { EXIT_CODES, maintain, OPTION_DESCRIPTIONS, readMaintainerVex, } from "../api/index.js";
+import { logJson } from "./output.js";
+import { validateOutputFormat } from "./validators.js";
+export function describeMaintain(result) {
+    const lines = [
+        `Maintaining ${result.package.name}@${result.package.version}${result.nextVersion ? ` (next release ${result.nextVersion})` : ""}`,
+    ];
+    if (result.advisories.length === 0)
+        lines.push("No advisories found for this project's dependencies.");
+    for (const advisory of result.advisories) {
+        lines.push(`  ${advisory.id}${advisory.severity ? ` [${advisory.severity}]` : ""}: ${advisory.decision}`, `    ${advisory.reason}`);
+        for (const entry of advisory.packages) {
+            lines.push(`    - ${entry.name}@${entry.version} (${entry.scope})${entry.reachability ? `, ${entry.reachability}` : ""}`);
+        }
+        if (advisory.plan) {
+            lines.push(advisory.plan.items.length > 0
+                ? `    bump plan: ${advisory.plan.items.map((item) => `${item.packageName} ${item.fromVersion} -> ${item.toVersion}`).join(", ")}${advisory.plan.runId ? ` (run ${advisory.plan.runId}; review with \`runs show\`, apply with \`runs apply\`)` : " (not recorded; --yes records it)"}`
+                : "    bump plan: no version change available");
+        }
+    }
+    for (const change of result.changes)
+        lines.push(`  ${change.action.padEnd(9)} ${change.path}: ${change.reason}`);
+    for (const note of result.notes)
+        lines.push(`  note: ${note}`);
+    return lines.join("\n");
+}
+async function confirm(question) {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        return /^y(es)?$/i.test((await rl.question(question)).trim());
+    }
+    finally {
+        rl.close();
+    }
+}
+export async function runMaintain(opts) {
+    const base = {
+        cwd: opts.cwd,
+        source: "cli",
+        ...(opts.advisories
+            ? {
+                advisories: opts.advisories
+                    .split(",")
+                    .map((id) => id.trim())
+                    .filter((id) => id !== ""),
+            }
+            : {}),
+        ...(opts.assertNotAffected ? { assertNotAffected: true } : {}),
+        ...(opts.traceFile ? { traceFile: opts.traceFile } : {}),
+        ...(opts.policy ? { policy: opts.policy } : {}),
+        ...(opts.packageManager ? { packageManager: opts.packageManager } : {}),
+        ...(opts.offline ? { offlineIntelligence: true } : {}),
+        ...(opts.intelligenceSnapshot ? { intelligenceSnapshotPath: opts.intelligenceSnapshot } : {}),
+        ...(opts.nextVersion ? { nextVersion: opts.nextVersion } : {}),
+    };
+    let result = await maintain({ ...base, yes: opts.yes });
+    const json = opts.outputFormat === "json";
+    const interactive = !json && !opts.yes && process.stdin.isTTY && process.stdout.isTTY;
+    if (!json) {
+        process.stdout.write(`${describeMaintain(result)}\n`);
+        if (!result.applied) {
+            for (const change of result.changes) {
+                if (change.diff)
+                    process.stdout.write(`\n${change.diff}\n`);
+            }
+        }
+    }
+    if (interactive && result.drift) {
+        if (await confirm(`\nWrite ${result.changes.filter((change) => change.diff).length} file(s)? [y/N] `)) {
+            result = await maintain({ ...base, yes: true });
+            process.stdout.write("Written. Nothing was published or pushed: review, commit and release as usual.\n");
+        }
+        return;
+    }
+    if (json)
+        logJson(result);
+    else if (result.applied) {
+        process.stdout.write("\nWritten. Nothing was published or pushed: review, commit and release as usual.\n");
+    }
+    else if (result.drift)
+        process.stdout.write("\nNothing written. Run again with --yes to apply.\n");
+    else
+        process.stdout.write("\nNothing to change.\n");
+    if (result.conflicts.length > 0)
+        process.exitCode = EXIT_CODES.failed;
+    else if (!result.applied && result.drift)
+        process.exitCode = EXIT_CODES.needsApproval;
+}
+export function describeVexShow(report) {
+    const lines = [
+        `Read ${report.scanned} installed package(s): ${report.packages.length} ship usable VEX, ${report.rejected.length} declaration(s) rejected.`,
+    ];
+    for (const entry of report.packages) {
+        lines.push(`${entry.name}@${entry.version}  ${entry.file}  (author ${entry.author}, ${entry.timestamp})`);
+        for (const statement of entry.statements) {
+            const about = statement.subcomponents.length > 0 ? ` about ${statement.subcomponents.join(", ")}` : "";
+            lines.push(`  ${statement.vulnerability}${about}: ${statement.status}${statement.justification ? ` (${statement.justification})` : ""}`);
+            if (statement.impactStatement)
+                lines.push(`    ${statement.impactStatement}`);
+            if (statement.statusNotes)
+                lines.push(`    ${statement.statusNotes}`);
+        }
+    }
+    for (const entry of report.rejected) {
+        lines.push(`rejected ${entry.package}${entry.version ? `@${entry.version}` : ""}: ${entry.reason}`);
+    }
+    if (report.own.declared) {
+        lines.push(`This project: package.json#vex -> ${report.own.file ?? "(invalid)"}: ${report.own.status}${report.own.statements === undefined ? "" : `, ${report.own.statements} statement(s)`}${report.own.reason ? `. ${report.own.reason}` : ""}`);
+    }
+    else {
+        lines.push("This project declares no package.json#vex.");
+    }
+    for (const note of report.notes)
+        lines.push(`note: ${note}`);
+    return lines.join("\n");
+}
+/** Register `maintain` and `vex show`. */
+export function registerMaintainCommands(program) {
+    program
+        .command("maintain")
+        .description("For package authors: assess advisories in your dependencies against your own code and prepare (never publish or push) a bump plan, a changeset and an OpenVEX statement shipped in the package. Shows a diff; writes only with --yes or after you confirm")
+        .option("--cwd <path>", OPTION_DESCRIPTIONS.cwd, process.cwd())
+        .option("--advisories <list>", "CVE or GHSA ids to assess, comma-separated (default: the package manager's audit)")
+        .option("--assert-not-affected", "Vouch for the static scan: unreachable dependencies are written as not_affected instead of under_investigation")
+        .option("--trace-file <path>", "A runtime trace from `trace run`, added to the static evidence")
+        .option("--policy <path>", OPTION_DESCRIPTIONS.policy)
+        .option("--package-manager <name>", OPTION_DESCRIPTIONS.packageManager)
+        .option("--offline", "No network: needs --advisories and --intelligence-snapshot")
+        .option("--intelligence-snapshot <path>", OPTION_DESCRIPTIONS.intelligenceSnapshotPath)
+        .option("--next-version <version>", "The exact version the next release will have (default: derived from pending changesets, else the next patch)")
+        .option("--yes", "Write the changes without asking")
+        .option("--output-format <format>", "Output format: text|json", "text")
+        .action(async (opts) => {
+        validateOutputFormat(opts.outputFormat, ["text", "json"], "maintain");
+        await runMaintain(opts);
+    });
+    const vex = program
+        .command("vex")
+        .description("Inspect the OpenVEX documents that packages ship (package.json#vex)");
+    vex
+        .command("show")
+        .description("List the VEX documents shipped by installed packages (validated, untrusted input) and check this project's own")
+        .option("--cwd <path>", OPTION_DESCRIPTIONS.cwd, process.cwd())
+        .option("--advisory <id>", "Only statements that name this CVE or GHSA id")
+        .option("--package <name>", "Only the document shipped by this package")
+        .option("--output-format <format>", "Output format: text|json", "text")
+        .action((opts) => {
+        validateOutputFormat(opts.outputFormat, ["text", "json"], "vex show");
+        const report = readMaintainerVex({
+            cwd: opts.cwd,
+            ...(opts.advisory ? { advisory: opts.advisory } : {}),
+            ...(opts.package ? { packageName: opts.package } : {}),
+        });
+        if (opts.outputFormat === "json")
+            logJson(report);
+        else
+            process.stdout.write(`${describeVexShow(report)}\n`);
+    });
+}
+//# sourceMappingURL=maintain-commands.js.map

package/dist/cli/maintain-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"maintain-commands.js","sourceRoot":"","sources":["../../src/cli/maintain-commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAIzD,OAAO,EACL,UAAU,EACV,QAAQ,EACR,mBAAmB,EACnB,iBAAiB,GAIlB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAuBvD,MAAM,UAAU,gBAAgB,CAAC,MAAsB;IACrD,MAAM,KAAK,GAAG;QACZ,eAAe,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,kBAAkB,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;KACnI,CAAC;IACF,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;IACrE,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACzC,KAAK,CAAC,IAAI,CACR,KAAK,QAAQ,CAAC,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,QAAQ,EAAE,EAC7F,OAAO,QAAQ,CAAC,MAAM,EAAE,CACzB,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtC,KAAK,CAAC,IAAI,CACR,SAAS,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAC9G,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,CAAC,IAAI,CACR,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;gBAC5B,CAAC,CAAC,kBAAkB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,QAAQ,CAAC,IAAI,CAAC,KAAK,yDAAyD,CAAC,CAAC,CAAC,mCAAmC,EAAE;gBACtR,CAAC,CAAC,4CAA4C,CACjD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO;QACjC,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9E,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,QAAgB;IACrC,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAwB;IACxD,MAAM,IAAI,GAAoB;QAC5B,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,MAAM,EAAE,KAAK;QACb,GAAG,CAAC,IAAI,CAAC,UAAU;YACjB,CAAC,CAAC;gBACE,UAAU,EAAE,IAAI,CAAC,UAAU;qBACxB,KAAK,CAAC,GAAG,CAAC;qBACV,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;qBACtB,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;aAC7B;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,wBAAwB,EAAE,IAAI,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;IACF,IAAI,MAAM,GAAG,MAAM,QAAQ,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,KAAK,MAAM,CAAC;IAC1C,MAAM,WAAW,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;IAEtF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpC,IAAI,MAAM,CAAC,IAAI;oBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,WAAW,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,IACE,MAAM,OAAO,CACX,WAAW,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,kBAAkB,CACnF,EACD,CAAC;YACD,MAAM,GAAG,MAAM,QAAQ,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kFAAkF,CACnF,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IAED,IAAI,IAAI;QAAE,OAAO,CAAC,MAAM,CAAC,CAAC;SACrB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oFAAoF,CACrF,CAAC;IACJ,CAAC;SAAM,IAAI,MAAM,CAAC,KAAK;QACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;;QACzE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAEpD,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC;SACjE,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK;QAAE,OAAO,CAAC,QAAQ,GAAG,UAAU,CAAC,aAAa,CAAC;AACxF,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAA2B;IACzD,MAAM,KAAK,GAAG;QACZ,QAAQ,MAAM,CAAC,OAAO,0BAA0B,MAAM,CAAC,QAAQ,CAAC,MAAM,qBAAqB,MAAM,CAAC,QAAQ,CAAC,MAAM,2BAA2B;KAC7I,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CACR,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,IAAI,aAAa,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,SAAS,GAAG,CAC9F,CAAC;QACF,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;YACzC,MAAM,KAAK,GACT,SAAS,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,KAAK,CAAC,IAAI,CACR,KAAK,SAAS,CAAC,aAAa,GAAG,KAAK,KAAK,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7H,CAAC;YACF,IAAI,SAAS,CAAC,eAAe;gBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,SAAS,CAAC,eAAe,EAAE,CAAC,CAAC;YAC9E,IAAI,SAAS,CAAC,WAAW;gBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CACR,YAAY,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,MAAM,EAAE,CACxF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CACR,qCAAqC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,WAAW,KAAK,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,UAAU,eAAe,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACvO,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IAC3D,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAC7D,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,OAAO;SACJ,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CACV,2PAA2P,CAC5P;SACA,MAAM,CAAC,cAAc,EAAE,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SAC9D,MAAM,CACL,qBAAqB,EACrB,mFAAmF,CACpF;SACA,MAAM,CACL,uBAAuB,EACvB,gHAAgH,CACjH;SACA,MAAM,CAAC,qBAAqB,EAAE,gEAAgE,CAAC;SAC/F,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,MAAM,CAAC;SACrD,MAAM,CAAC,0BAA0B,EAAE,mBAAmB,CAAC,cAAc,CAAC;SACtE,MAAM,CAAC,WAAW,EAAE,4DAA4D,CAAC;SACjF,MAAM,CAAC,gCAAgC,EAAE,mBAAmB,CAAC,wBAAwB,CAAC;SACtF,MAAM,CACL,0BAA0B,EAC1B,8GAA8G,CAC/G;SACA,MAAM,CAAC,OAAO,EAAE,kCAAkC,CAAC;SACnD,MAAM,CAAC,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,CAAC;SACtE,MAAM,CAAC,KAAK,EAAE,IAAwB,EAAE,EAAE;QACzC,oBAAoB,CAAC,IAAI,CAAC,YAA+B,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC;QACzF,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEL,MAAM,GAAG,GAAG,OAAO;SAChB,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,qEAAqE,CAAC,CAAC;IACtF,GAAG;SACA,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CACV,gHAAgH,CACjH;SACA,MAAM,CAAC,cAAc,EAAE,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SAC9D,MAAM,CAAC,iBAAiB,EAAE,+CAA+C,CAAC;SAC1E,MAAM,CAAC,kBAAkB,EAAE,2CAA2C,CAAC;SACvE,MAAM,CAAC,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,CAAC;SACtE,MAAM,CAAC,CAAC,IAAuB,EAAE,EAAE;QAClC,oBAAoB,CAAC,IAAI,CAAC,YAA+B,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC;QACzF,MAAM,MAAM,GAAG,iBAAiB,CAAC;YAC/B,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvD,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,YAAY,KAAK,MAAM;YAAE,OAAO,CAAC,MAAM,CAAC,CAAC;;YAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/cli/memory-commands.d.ts

@@ -0,0 +1,23 @@
+/** `autoremediator memory list | add | remove | accept | prune`. See docs/guides/memory.md. */
+import type { Command } from "commander";
+import { type MemoryEntry, type MemoryKind, type NewMemoryEntry } from "../api/index.js";
+interface MemoryCliOptions {
+    cwd: string;
+    outputFormat: "text" | "json";
+    kind?: string;
+    state?: string;
+    note?: string;
+    reason?: string;
+    from?: string;
+    to?: string;
+    by?: string;
+    expiresInDays?: number;
+}
+/** What an entry says, on one line. */
+export declare function describeEntry(entry: MemoryEntry): string;
+/** The entry `memory add <kind> <value>` describes. */
+export declare function entryFromArguments(kind: MemoryKind, value: string, opts: MemoryCliOptions): NewMemoryEntry;
+/** Register `memory`. */
+export declare function registerMemoryCommands(program: Command): void;
+export {};
+//# sourceMappingURL=memory-commands.d.ts.map

package/dist/cli/memory-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-commands.d.ts","sourceRoot":"","sources":["../../src/cli/memory-commands.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAIL,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,cAAc,EAIpB,MAAM,iBAAiB,CAAC;AAKzB,UAAU,gBAAgB;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AASD,uCAAuC;AACvC,wBAAgB,aAAa,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAsBxD;AAYD,uDAAuD;AACvD,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,UAAU,EAChB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,gBAAgB,GACrB,cAAc,CAoChB;AAED,yBAAyB;AACzB,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA+G7D"}

package/dist/cli/memory-commands.js

@@ -0,0 +1,172 @@
+import { acceptMemory, addMemory, listMemory, OPTION_DESCRIPTIONS, pruneMemory, removeMemory, } from "../api/index.js";
+import { MEMORY_KINDS, unreachable } from "../platform/memory/entries.js";
+import { logJson } from "./output.js";
+import { validateOutputFormat } from "./validators.js";
+const out = (text) => process.stdout.write(`${text}\n`);
+const common = (command) => command
+    .option("--cwd <path>", OPTION_DESCRIPTIONS.cwd, process.cwd())
+    .option("--output-format <format>", "Output format: text|json", "text");
+/** What an entry says, on one line. */
+export function describeEntry(entry) {
+    switch (entry.kind) {
+        case "test-command": {
+            return entry.command;
+        }
+        case "flaky-test": {
+            return entry.note ? `${entry.test} (${entry.note})` : entry.test;
+        }
+        case "pinned-package": {
+            return `${entry.package}: ${entry.reason}`;
+        }
+        case "rejected-upgrade": {
+            return `${entry.package} ${entry.fromVersion ? `${entry.fromVersion} -> ` : "-> "}${entry.toVersion}: ${entry.reason}`;
+        }
+        case "install-quirk":
+        case "note": {
+            return entry.text;
+        }
+        default: {
+            return unreachable(entry);
+        }
+    }
+}
+const day = (iso) => iso.slice(0, 10);
+function parseKind(value) {
+    if (value === undefined)
+        return undefined;
+    if (!MEMORY_KINDS.includes(value)) {
+        throw new Error(`Unknown kind "${value}". Use one of: ${MEMORY_KINDS.join(", ")}.`);
+    }
+    return value;
+}
+/** The entry `memory add <kind> <value>` describes. */
+export function entryFromArguments(kind, value, opts) {
+    const needs = (flag, given) => {
+        if (!given)
+            throw new Error(`${kind} needs ${flag}.`);
+        return given;
+    };
+    const source = opts.by ? `human:${opts.by}` : undefined;
+    const expires = opts.expiresInDays === undefined ? {} : { expiresInDays: opts.expiresInDays };
+    const envelope = { ...(source ? { source } : {}), ...expires };
+    switch (kind) {
+        case "test-command": {
+            return { kind, command: value, ...envelope };
+        }
+        case "flaky-test": {
+            return { kind, test: value, ...(opts.note ? { note: opts.note } : {}), ...envelope };
+        }
+        case "pinned-package": {
+            return { kind, package: value, reason: needs("--reason", opts.reason), ...envelope };
+        }
+        case "rejected-upgrade": {
+            return {
+                kind,
+                package: value,
+                toVersion: needs("--to <version>", opts.to),
+                reason: needs("--reason", opts.reason),
+                ...(opts.from ? { fromVersion: opts.from } : {}),
+                ...envelope,
+            };
+        }
+        case "install-quirk":
+        case "note": {
+            return { kind, text: value, ...envelope };
+        }
+        default: {
+            return unreachable(kind);
+        }
+    }
+}
+/** Register `memory`. */
+export function registerMemoryCommands(program) {
+    const memory = program
+        .command("memory")
+        .description("Remediation memory (.autoremediator/memory.md): what this repository has learned between runs, as short validated entries a person can review and edit");
+    common(memory
+        .command("list")
+        .description("List what the repository remembers, what is in force and what is only proposed")
+        .option("--kind <kind>", `Only this kind: ${MEMORY_KINDS.join("|")}`)
+        .option("--state <state>", "Only entries that are active, proposed or expired")).action((opts) => {
+        validateOutputFormat(opts.outputFormat, ["text", "json"], "memory list");
+        const kind = parseKind(opts.kind);
+        if (opts.state && !["active", "proposed", "expired"].includes(opts.state)) {
+            throw new Error(`--state must be active, proposed or expired, not "${opts.state}".`);
+        }
+        const listing = listMemory({
+            cwd: opts.cwd,
+            ...(kind ? { kind } : {}),
+            ...(opts.state ? { state: opts.state } : {}),
+        });
+        if (opts.outputFormat === "json") {
+            logJson(listing);
+            return;
+        }
+        out(`${listing.path}: ${listing.counts.active} active, ${listing.counts.proposed} proposed, ${listing.counts.expired} expired (room for ${listing.limits.maxEntries - listing.counts.total} more)`);
+        if (!listing.exists)
+            out("No memory file yet. `autoremediator memory add` creates it.");
+        for (const entry of listing.entries) {
+            const expiry = entry.expiresAt ? `, expires ${day(entry.expiresAt)}` : "";
+            out(`  ${entry.id}  ${entry.state.padEnd(8)} ${entry.kind.padEnd(16)} ${describeEntry(entry)}  [${entry.source}, ${day(entry.createdAt)}${expiry}]`);
+        }
+        if (listing.counts.proposed > 0) {
+            out("Proposed entries do nothing until accepted: `autoremediator memory accept <id>`.");
+        }
+        for (const problem of listing.problems)
+            out(`  problem: ${problem}`);
+    });
+    common(memory
+        .command("add <kind> <value>")
+        .description(`Record a fact. kind: ${MEMORY_KINDS.join(", ")}. value is the command, test, package name or text`)
+        .option("--reason <text>", "pinned-package and rejected-upgrade: why")
+        .option("--note <text>", "flaky-test: an optional note")
+        .option("--from <version>", "rejected-upgrade: the version the project was on")
+        .option("--to <version>", "rejected-upgrade: the rejected version, which the planner will not propose again")
+        .option("--by <name>", "Who is recording this (default: human)")
+        .option("--expires-in-days <n>", "Stop counting this entry after n days", (value) => Number.parseInt(value, 10))).action(async (kindArg, value, opts) => {
+        validateOutputFormat(opts.outputFormat, ["text", "json"], "memory add");
+        const kind = parseKind(kindArg);
+        const report = await addMemory({ cwd: opts.cwd, ...entryFromArguments(kind, value, opts) });
+        if (opts.outputFormat === "json") {
+            logJson(report);
+            return;
+        }
+        out(report.created
+            ? `Recorded ${report.entry.id}: ${describeEntry(report.entry)}`
+            : `Already recorded as ${report.entry.id}; remove it first to change it.`);
+        for (const id of report.evicted)
+            out(`Made room by dropping ${id}.`);
+    });
+    common(memory.command("remove <id>").description("Delete an entry")).action(async (id, opts) => {
+        validateOutputFormat(opts.outputFormat, ["text", "json"], "memory remove");
+        const { removed } = await removeMemory({ cwd: opts.cwd, id });
+        if (opts.outputFormat === "json")
+            logJson({ removed });
+        else
+            out(`Removed ${removed.id}: ${describeEntry(removed)}`);
+    });
+    common(memory
+        .command("accept <id>")
+        .description("Accept an entry an agent proposed, so it takes effect")).action(async (id, opts) => {
+        validateOutputFormat(opts.outputFormat, ["text", "json"], "memory accept");
+        const { accepted, alreadyActive } = await acceptMemory({ cwd: opts.cwd, id });
+        if (opts.outputFormat === "json")
+            logJson({ accepted, alreadyActive });
+        else
+            out(alreadyActive
+                ? `${accepted.id} was already in force.`
+                : `Accepted ${accepted.id}: ${describeEntry(accepted)}`);
+    });
+    common(memory.command("prune").description("Remove expired entries")).action(async (opts) => {
+        validateOutputFormat(opts.outputFormat, ["text", "json"], "memory prune");
+        const { removed } = await pruneMemory({ cwd: opts.cwd });
+        if (opts.outputFormat === "json")
+            logJson({ removed });
+        else if (removed.length === 0)
+            out("Nothing has expired.");
+        else
+            for (const entry of removed)
+                out(`Removed ${entry.id}: ${describeEntry(entry)}`);
+    });
+}
+//# sourceMappingURL=memory-commands.js.map

package/dist/cli/memory-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-commands.js","sourceRoot":"","sources":["../../src/cli/memory-commands.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,YAAY,EACZ,SAAS,EACT,UAAU,EAIV,mBAAmB,EACnB,WAAW,EACX,YAAY,GACb,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAevD,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;AAEhE,MAAM,MAAM,GAAG,CAAC,OAAgB,EAAW,EAAE,CAC3C,OAAO;KACJ,MAAM,CAAC,cAAc,EAAE,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;KAC9D,MAAM,CAAC,0BAA0B,EAAE,0BAA0B,EAAE,MAAM,CAAC,CAAC;AAE5E,uCAAuC;AACvC,MAAM,UAAU,aAAa,CAAC,KAAkB;IAC9C,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,cAAc,EAAE,CAAC;YACpB,OAAO,KAAK,CAAC,OAAO,CAAC;QACvB,CAAC;QACD,KAAK,YAAY,EAAE,CAAC;YAClB,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QACnE,CAAC;QACD,KAAK,gBAAgB,EAAE,CAAC;YACtB,OAAO,GAAG,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QAC7C,CAAC;QACD,KAAK,kBAAkB,EAAE,CAAC;YACxB,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,WAAW,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACzH,CAAC;QACD,KAAK,eAAe,CAAC;QACrB,KAAK,MAAM,EAAE,CAAC;YACZ,OAAO,KAAK,CAAC,IAAI,CAAC;QACpB,CAAC;QACD,SAAS,CAAC;YACR,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAEtD,SAAS,SAAS,CAAC,KAAyB;IAC1C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,CAAE,YAAkC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,iBAAiB,KAAK,kBAAkB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,KAAmB,CAAC;AAC7B,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,kBAAkB,CAChC,IAAgB,EAChB,KAAa,EACb,IAAsB;IAEtB,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,KAAyB,EAAU,EAAE;QAChE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,UAAU,IAAI,GAAG,CAAC,CAAC;QACtD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;IAC9F,MAAM,QAAQ,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC;IAC/D,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,cAAc,EAAE,CAAC;YACpB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC/C,CAAC;QACD,KAAK,YAAY,EAAE,CAAC;YAClB,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC;QACvF,CAAC;QACD,KAAK,gBAAgB,EAAE,CAAC;YACtB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC;QACvF,CAAC;QACD,KAAK,kBAAkB,EAAE,CAAC;YACxB,OAAO;gBACL,IAAI;gBACJ,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,KAAK,CAAC,gBAAgB,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC3C,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC;gBACtC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChD,GAAG,QAAQ;aACZ,CAAC;QACJ,CAAC;QACD,KAAK,eAAe,CAAC;QACrB,KAAK,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC5C,CAAC;QACD,SAAS,CAAC;YACR,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;AACH,CAAC;AAED,yBAAyB;AACzB,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,MAAM,MAAM,GAAG,OAAO;SACnB,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CACV,wJAAwJ,CACzJ,CAAC;IAEJ,MAAM,CACJ,MAAM;SACH,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,gFAAgF,CAAC;SAC7F,MAAM,CAAC,eAAe,EAAE,mBAAmB,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;SACpE,MAAM,CAAC,iBAAiB,EAAE,mDAAmD,CAAC,CAClF,CAAC,MAAM,CAAC,CAAC,IAAsB,EAAE,EAAE;QAClC,oBAAoB,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC;QACzE,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CAAC,qDAAqD,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC;YACzB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAA0C,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClF,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;YACjC,OAAO,CAAC,OAAO,CAAC,CAAC;YACjB,OAAO;QACT,CAAC;QACD,GAAG,CACD,GAAG,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,YAAY,OAAO,CAAC,MAAM,CAAC,QAAQ,cAAc,OAAO,CAAC,MAAM,CAAC,OAAO,sBAAsB,OAAO,CAAC,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,QAAQ,CAC/L,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,GAAG,CAAC,6DAA6D,CAAC,CAAC;QACxF,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,GAAG,CACD,KAAK,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,aAAa,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,MAAM,GAAG,CAChJ,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,kFAAkF,CAAC,CAAC;QAC1F,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ;YAAE,GAAG,CAAC,cAAc,OAAO,EAAE,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,MAAM,CACJ,MAAM;SACH,OAAO,CAAC,oBAAoB,CAAC;SAC7B,WAAW,CACV,wBAAwB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,oDAAoD,CACpG;SACA,MAAM,CAAC,iBAAiB,EAAE,0CAA0C,CAAC;SACrE,MAAM,CAAC,eAAe,EAAE,8BAA8B,CAAC;SACvD,MAAM,CAAC,kBAAkB,EAAE,kDAAkD,CAAC;SAC9E,MAAM,CACL,gBAAgB,EAChB,kFAAkF,CACnF;SACA,MAAM,CAAC,aAAa,EAAE,wCAAwC,CAAC;SAC/D,MAAM,CAAC,uBAAuB,EAAE,uCAAuC,EAAE,CAAC,KAAa,EAAE,EAAE,CAC1F,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAC3B,CACJ,CAAC,MAAM,CAAC,KAAK,EAAE,OAAe,EAAE,KAAa,EAAE,IAAsB,EAAE,EAAE;QACxE,oBAAoB,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,YAAY,CAAC,CAAC;QACxE,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5F,IAAI,IAAI,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;YACjC,OAAO,CAAC,MAAM,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QACD,GAAG,CACD,MAAM,CAAC,OAAO;YACZ,CAAC,CAAC,YAAY,MAAM,CAAC,KAAK,CAAC,EAAE,KAAK,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;YAC/D,CAAC,CAAC,uBAAuB,MAAM,CAAC,KAAK,CAAC,EAAE,iCAAiC,CAC5E,CAAC;QACF,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,OAAO;YAAE,GAAG,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CACzE,KAAK,EAAE,EAAU,EAAE,IAAsB,EAAE,EAAE;QAC3C,oBAAoB,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,eAAe,CAAC,CAAC;QAC3E,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,YAAY,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9D,IAAI,IAAI,CAAC,YAAY,KAAK,MAAM;YAAE,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;;YAClD,GAAG,CAAC,WAAW,OAAO,CAAC,EAAE,KAAK,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC,CACF,CAAC;IAEF,MAAM,CACJ,MAAM;SACH,OAAO,CAAC,aAAa,CAAC;SACtB,WAAW,CAAC,uDAAuD,CAAC,CACxE,CAAC,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,IAAsB,EAAE,EAAE;QACpD,oBAAoB,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,eAAe,CAAC,CAAC;QAC3E,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,MAAM,YAAY,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9E,IAAI,IAAI,CAAC,YAAY,KAAK,MAAM;YAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;;YAErE,GAAG,CACD,aAAa;gBACX,CAAC,CAAC,GAAG,QAAQ,CAAC,EAAE,wBAAwB;gBACxC,CAAC,CAAC,YAAY,QAAQ,CAAC,EAAE,KAAK,aAAa,CAAC,QAAQ,CAAC,EAAE,CAC1D,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,wBAAwB,CAAC,CAAC,CAAC,MAAM,CAC1E,KAAK,EAAE,IAAsB,EAAE,EAAE;QAC/B,oBAAoB,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,cAAc,CAAC,CAAC;QAC1E,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,WAAW,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACzD,IAAI,IAAI,CAAC,YAAY,KAAK,MAAM;YAAE,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;aAClD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,GAAG,CAAC,sBAAsB,CAAC,CAAC;;YACtD,KAAK,MAAM,KAAK,IAAI,OAAO;gBAAE,GAAG,CAAC,WAAW,KAAK,CAAC,EAAE,KAAK,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/cli/policy-commands.d.ts

@@ -0,0 +1,29 @@
+import type { Command } from "commander";
+import { type CompilePolicyOptions, type ExplainPolicyResult, type PolicyCompileResult } from "../api/index.js";
+export interface PolicyCompileCliOptions {
+    cwd: string;
+    policy?: string;
+    model?: string;
+    yes?: boolean;
+    allowLoosening?: boolean;
+    outputFormat: "text" | "json";
+    /** Test seam: where to read the confirmation from. */
+    confirm?: (question: string) => Promise<boolean>;
+    /** Test seam: replaces the model (SDK `proposer`). */
+    compileOptions?: Partial<CompilePolicyOptions>;
+    /** Test seam: whether a person is at a terminal. */
+    interactive?: boolean;
+}
+export interface PolicyExplainCliOptions {
+    cwd: string;
+    policy?: string;
+    outputFormat: "text" | "json";
+}
+/** The proposal as text for a reviewer: what changes, why, what was left out, what got looser. */
+export declare function describeCompile(result: PolicyCompileResult): string;
+export declare function describeExplain(result: ExplainPolicyResult): string;
+export declare function runPolicyCompile(words: string[], opts: PolicyCompileCliOptions): Promise<void>;
+export declare function runPolicyExplain(opts: PolicyExplainCliOptions): void;
+/** Register `policy compile` and `policy explain`. */
+export declare function registerPolicyCommands(program: Command): void;
+//# sourceMappingURL=policy-commands.d.ts.map