autoremediator 0.21.2 → 0.22.0

package/dist/openapi/spec/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/openapi/spec/index.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,YAAY;aACvB,OAAO,EAAE,OAAO;aAChB,IAAI;iBACF,KAAK,EAAE,gBAAgB;iBACvB,OAAO;iBACP,WAAW,EAAE,yDAAyD;;aAExE,OAAO;iBAEH,GAAG,EAAE,uBAAuB;iBAC5B,WAAW,EAAE,0BAA0B;;aAG3C,oBAAoB;aACpB,mBAAmB,YACjB,wBAAwB,EACxB,kCAAkC,EAClC,4BAA4B;aAE9B,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CACG,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/openapi/spec/index.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,YAAY;sBACd,OAAO;;iBAEd,KAAK,EAAE,gBAAgB;iBACvB,OAAO;iBACP,WAAW,EAAE,yDAAyD;;;iBAIpE,GAAG,EAAE,uBAAuB;iBAC5B,WAAW,EAAE,0BAA0B;;;4CAKzC,wBAAwB,EACxB,kCAAkC,EAClC,4BAA4B;;;qBAM1B,GAAG;yBACD,WAAW,EAAE,cAAc;yBAC3B,OAAO,EAAE,gBAAgB;yBACzB,WAAW,EACT,qGAAqG;yBACvG,SAAS;6BACP,KAAK;iCACH,WAAW,EAAE,gBAAgB;iCAC7B,OAAO;qCAAI,kBAAkB;yCAAI,MAAM;6CAAI,IAAI,EAAE,QAAQ;;;;;;;;;qBAM/D,IAAI;yBACF,WAAW,EAAE,YAAY;yBACzB,OAAO,EAAE,8CAA8C;yBACvD,WAAW,EACT,8LAA8L;yBAChM,WAAW;6BACT,QAAQ;6BACR,OAAO;iCAAI,kBAAkB;qCAAI,MAAM;yCAAI,IAAI,EAAE,QAAQ;;;;;yBAE3D,SAAS;6BACP,KAAK;iCACH,WAAW,EAAE,yBAAyB;iCACtC,OAAO;qCAAI,kBAAkB;yCAAI,MAAM;6CAAI,IAAI,EAAE,QAAQ;;;;;;;;;CAM3D,CAAC"}

package/dist/openapi/spec/index.js

@@ -1,5 +1,6 @@
+import { A2A_ENDPOINT_PATH, AGENT_CARD_PATH } from "../../a2a/index.js";
+import { toOpenApiPaths } from "../../catalog/index.js";
 import { PACKAGE_VERSION } from "../../version.js";
-import { createOpenApiPaths } from "./paths.js";
 export const OPENAPI_SPEC = {
     openapi: "3.1.0",
     info: {
@@ -19,6 +20,39 @@ export const OPENAPI_SPEC = {
         "scanner-driven batch remediation",
         "patch lifecycle validation",
     ],
-    paths: createOpenApiPaths(),
+    // Generated from the operation catalog, so it cannot drift from what the server accepts.
+    paths: {
+        ...toOpenApiPaths(),
+        [AGENT_CARD_PATH]: {
+            get: {
+                operationId: "a2aAgentCard",
+                summary: "A2A Agent Card",
+                description: "Public Agent2Agent discovery document (A2A 1.0). Signed when AUTOREMEDIATOR_A2A_SIGNING_KEY is set.",
+                responses: {
+                    "200": {
+                        description: "The Agent Card",
+                        content: { "application/json": { schema: { type: "object" } } },
+                    },
+                },
+            },
+        },
+        [A2A_ENDPOINT_PATH]: {
+            post: {
+                operationId: "a2aJsonRpc",
+                summary: "A2A JSON-RPC endpoint (SendMessage, GetTask)",
+                description: "Agent2Agent 1.0 JSON-RPC binding. SendMessage runs the catalog operation named in a data part and returns a completed or failed task; GetTask returns a task again. Requires a bearer token.",
+                requestBody: {
+                    required: true,
+                    content: { "application/json": { schema: { type: "object" } } },
+                },
+                responses: {
+                    "200": {
+                        description: "A JSON-RPC 2.0 response",
+                        content: { "application/json": { schema: { type: "object" } } },
+                    },
+                },
+            },
+        },
+    },
 };
 //# sourceMappingURL=index.js.map

package/dist/openapi/spec/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/openapi/spec/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,OAAO,EAAE,OAAO;IAChB,IAAI,EAAE;QACJ,KAAK,EAAE,gBAAgB;QACvB,OAAO,EAAE,eAAe;QACxB,WAAW,EAAE,yDAAyD;KACvE;IACD,OAAO,EAAE;QACP;YACE,GAAG,EAAE,uBAAuB;YAC5B,WAAW,EAAE,0BAA0B;SACxC;KACF;IACD,oBAAoB,EAAE,IAAI;IAC1B,mBAAmB,EAAE;QACnB,wBAAwB;QACxB,kCAAkC;QAClC,4BAA4B;KAC7B;IACD,KAAK,EAAE,kBAAkB,EAAE;CACnB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/openapi/spec/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,OAAO,EAAE,OAAO;IAChB,IAAI,EAAE;QACJ,KAAK,EAAE,gBAAgB;QACvB,OAAO,EAAE,eAAe;QACxB,WAAW,EAAE,yDAAyD;KACvE;IACD,OAAO,EAAE;QACP;YACE,GAAG,EAAE,uBAAuB;YAC5B,WAAW,EAAE,0BAA0B;SACxC;KACF;IACD,oBAAoB,EAAE,IAAI;IAC1B,mBAAmB,EAAE;QACnB,wBAAwB;QACxB,kCAAkC;QAClC,4BAA4B;KAC7B;IACD,yFAAyF;IACzF,KAAK,EAAE;QACL,GAAG,cAAc,EAAE;QACnB,CAAC,eAAe,CAAC,EAAE;YACjB,GAAG,EAAE;gBACH,WAAW,EAAE,cAAc;gBAC3B,OAAO,EAAE,gBAAgB;gBACzB,WAAW,EACT,qGAAqG;gBACvG,SAAS,EAAE;oBACT,KAAK,EAAE;wBACL,WAAW,EAAE,gBAAgB;wBAC7B,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;qBAChE;iBACF;aACF;SACF;QACD,CAAC,iBAAiB,CAAC,EAAE;YACnB,IAAI,EAAE;gBACJ,WAAW,EAAE,YAAY;gBACzB,OAAO,EAAE,8CAA8C;gBACvD,WAAW,EACT,8LAA8L;gBAChM,WAAW,EAAE;oBACX,QAAQ,EAAE,IAAI;oBACd,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;iBAChE;gBACD,SAAS,EAAE;oBACT,KAAK,EAAE;wBACL,WAAW,EAAE,yBAAyB;wBACtC,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE;qBAChE;iBACF;aACF;SACF;KACF;CACO,CAAC"}

package/dist/platform/cooldown.d.ts

@@ -0,0 +1,15 @@
+import type { PackageManager, SupplyChainPolicy } from "./types.js";
+export interface Cooldown {
+    hours: number;
+    /** Package names or `*` globs the package manager exempts from the cooldown. */
+    exclude: string[];
+    /** Human-readable origin of the setting, e.g. "pnpm minimumReleaseAge". */
+    source: string;
+}
+export declare function readCooldown(cwd: string, packageManager: PackageManager, env?: NodeJS.ProcessEnv): Cooldown | undefined;
+/**
+ * The supply-chain policy to enforce for one package: the stricter of the policy file's minimum
+ * age and the package manager's cooldown (unless the package manager exempts this package).
+ */
+export declare function withCooldown(policy: SupplyChainPolicy | undefined, cooldown: Cooldown | undefined, packageName: string): SupplyChainPolicy | undefined;
+//# sourceMappingURL=cooldown.d.ts.map

package/dist/platform/cooldown.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cooldown.d.ts","sourceRoot":"","sources":["../../src/platform/cooldown.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpE,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,gFAAgF;IAChF,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAC;CAChB;AAuHD,wBAAgB,YAAY,CAC1B,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,cAAc,EAC9B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,QAAQ,GAAG,SAAS,CAEtB;AASD;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,iBAAiB,GAAG,SAAS,EACrC,QAAQ,EAAE,QAAQ,GAAG,SAAS,EAC9B,WAAW,EAAE,MAAM,GAClB,iBAAiB,GAAG,SAAS,CAK/B"}

package/dist/platform/cooldown.js

@@ -0,0 +1,136 @@
+/**
+ * Release cooldown ("minimum release age") that the project's own package manager enforces.
+ *
+ * Installing a version younger than the cooldown fails, so choosing one would only end in a failed
+ * install. This reads the setting from the project's configuration and folds it into the
+ * supply-chain policy as a minimum publish age.
+ *
+ * Sources and units:
+ *   npm   `min-release-age` in `.npmrc` / `npm_config_min_release_age`   (days)
+ *   pnpm  `minimumReleaseAge` in `pnpm-workspace.yaml`, or `minimum-release-age` in `.npmrc` (minutes);
+ *         pnpm 11+ defaults to 1440 minutes when unset (version from the `packageManager` field)
+ *   yarn  `npmMinimalAgeGate` in `.yarnrc.yml`                           (minutes)
+ *   bun   `minimumReleaseAge` under `[install]` in `bunfig.toml`         (seconds)
+ * Values that are not plain numbers are ignored rather than guessed at.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { parse as parseYaml } from "yaml";
+import { readNpmrcChain } from "./registry-config.js";
+const PNPM_DEFAULT_MINUTES = 1440;
+const MAX_PARENT_LOOKUPS = 8;
+function readText(path) {
+    try {
+        return readFileSync(path, "utf8");
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Nearest `file` in `cwd` or an ancestor (monorepo roots hold the shared config). */
+function findUp(file, cwd) {
+    let dir = cwd;
+    for (let depth = 0; depth <= MAX_PARENT_LOOKUPS; depth++) {
+        const candidate = join(dir, file);
+        if (existsSync(candidate))
+            return candidate;
+        const parent = dirname(dir);
+        if (parent === dir)
+            return undefined;
+        dir = parent;
+    }
+    return undefined;
+}
+/** A non-negative finite number from a config value; anything else is "not set". */
+function toNumber(value) {
+    const parsed = typeof value === "number"
+        ? value
+        : typeof value === "string"
+            ? Number(value.trim())
+            : Number.NaN;
+    return Number.isFinite(parsed) && parsed >= 0 ? parsed : undefined;
+}
+function toStringList(value) {
+    return Array.isArray(value)
+        ? value.filter((item) => typeof item === "string")
+        : [];
+}
+function readYamlFile(path) {
+    const text = path ? readText(path) : undefined;
+    if (!text)
+        return {};
+    try {
+        const parsed = parseYaml(text);
+        return parsed && typeof parsed === "object" ? parsed : {};
+    }
+    catch {
+        return {};
+    }
+}
+function pnpmMajor(cwd) {
+    const manifest = findUp("package.json", cwd);
+    const text = manifest ? readText(manifest) : undefined;
+    if (!text)
+        return undefined;
+    try {
+        const field = JSON.parse(text).packageManager ?? "";
+        const match = /^pnpm@(\d+)\./.exec(field);
+        return match?.[1] ? Number(match[1]) : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+const toCooldown = (hours, exclude, source) => hours !== undefined && hours > 0 ? { hours, exclude, source } : undefined;
+const readers = {
+    npm(cwd, env) {
+        const npmrc = readNpmrcChain(cwd, env);
+        const days = toNumber(env["npm_config_min_release_age"] ?? npmrc.get("min-release-age"));
+        return toCooldown(days === undefined ? undefined : days * 24, [], "npm min-release-age");
+    },
+    pnpm(cwd, env) {
+        const workspace = readYamlFile(findUp("pnpm-workspace.yaml", cwd));
+        const npmrc = readNpmrcChain(cwd, env);
+        const minutes = toNumber(workspace["minimumReleaseAge"]) ?? toNumber(npmrc.get("minimum-release-age"));
+        const effective = minutes ?? ((pnpmMajor(cwd) ?? 0) >= 11 ? PNPM_DEFAULT_MINUTES : undefined);
+        return toCooldown(effective === undefined ? undefined : effective / 60, toStringList(workspace["minimumReleaseAgeExclude"]), minutes === undefined ? "pnpm 11 default minimumReleaseAge" : "pnpm minimumReleaseAge");
+    },
+    yarn(cwd) {
+        const minutes = toNumber(readYamlFile(findUp(".yarnrc.yml", cwd))["npmMinimalAgeGate"]);
+        return toCooldown(minutes === undefined ? undefined : minutes / 60, [], "yarn npmMinimalAgeGate");
+    },
+    bun(cwd) {
+        const file = findUp("bunfig.toml", cwd);
+        const content = file ? readText(file) : undefined;
+        if (!content)
+            return undefined;
+        const seconds = toNumber(/^\s*minimumReleaseAge\s*=\s*(\d+)\s*$/m.exec(content)?.[1]);
+        const excludes = /^\s*minimumReleaseAgeExcludes\s*=\s*\[([^\]]*)]/m.exec(content)?.[1];
+        const exclude = [...(excludes?.matchAll(/["']([^"']+)["']/g) ?? [])].map((m) => m[1] ?? "");
+        return toCooldown(seconds === undefined ? undefined : seconds / 3600, exclude.filter(Boolean), "bun minimumReleaseAge");
+    },
+    // Deno has no release-age setting.
+    deno: () => undefined,
+};
+export function readCooldown(cwd, packageManager, env = process.env) {
+    return readers[packageManager](cwd, env);
+}
+function matchesExclude(packageName, patterns) {
+    return patterns.some((pattern) => {
+        const source = pattern.replaceAll(/[$()+.?[\\\]^{|}]/g, String.raw `\$&`).replaceAll("*", ".*");
+        return new RegExp(`^${source}$`).test(packageName);
+    });
+}
+/**
+ * The supply-chain policy to enforce for one package: the stricter of the policy file's minimum
+ * age and the package manager's cooldown (unless the package manager exempts this package).
+ */
+export function withCooldown(policy, cooldown, packageName) {
+    if (!cooldown || matchesExclude(packageName, cooldown.exclude))
+        return policy;
+    const current = policy?.minPublishAgeHours ?? 0;
+    if (current >= cooldown.hours)
+        return policy;
+    return { ...policy, minPublishAgeHours: cooldown.hours, minPublishAgeSource: cooldown.source };
+}
+//# sourceMappingURL=cooldown.js.map

package/dist/platform/cooldown.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cooldown.js","sourceRoot":"","sources":["../../src/platform/cooldown.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAWtD,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAClC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAE7B,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,SAAS,MAAM,CAAC,IAAY,EAAE,GAAW;IACvC,IAAI,GAAG,GAAG,GAAG,CAAC;IACd,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,kBAAkB,EAAE,KAAK,EAAE,EAAE,CAAC;QACzD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,SAAS,CAAC;QACrC,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,oFAAoF;AACpF,SAAS,QAAQ,CAAC,KAAc;IAC9B,MAAM,MAAM,GACV,OAAO,KAAK,KAAK,QAAQ;QACvB,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ;YACzB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACtB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IACnB,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACrE,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;QAClE,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,SAAS,YAAY,CAAC,IAAwB;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/C,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,SAAS,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAkC,CAAC,CAAC,CAAC,EAAE,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,KAAK,GAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAiC,CAAC,cAAc,IAAI,EAAE,CAAC;QACrF,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,GAAG,CACjB,KAAyB,EACzB,OAAiB,EACjB,MAAc,EACQ,EAAE,CACxB,KAAK,KAAK,SAAS,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAI5E,MAAM,OAAO,GAA2C;IACtD,GAAG,CAAC,GAAG,EAAE,GAAG;QACV,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,4BAA4B,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACzF,OAAO,UAAU,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,GAAG;QACX,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACvC,MAAM,OAAO,GACX,QAAQ,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC;QACzF,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC9F,OAAO,UAAU,CACf,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,EAAE,EACpD,YAAY,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC,EACnD,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,wBAAwB,CACvF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG;QACN,MAAM,OAAO,GAAG,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC;QACxF,OAAO,UAAU,CACf,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE,EAChD,EAAE,EACF,wBAAwB,CACzB,CAAC;IACJ,CAAC;IACD,GAAG,CAAC,GAAG;QACL,MAAM,IAAI,GAAG,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClD,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC/B,MAAM,OAAO,GAAG,QAAQ,CAAC,wCAAwC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACtF,MAAM,QAAQ,GAAG,kDAAkD,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACvF,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5F,OAAO,UAAU,CACf,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,GAAG,IAAI,EAClD,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EACvB,uBAAuB,CACxB,CAAC;IACJ,CAAC;IACD,mCAAmC;IACnC,IAAI,EAAE,GAAG,EAAE,CAAC,SAAS;CACtB,CAAC;AAEF,MAAM,UAAU,YAAY,CAC1B,GAAW,EACX,cAA8B,EAC9B,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,OAAO,OAAO,CAAC,cAAc,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,cAAc,CAAC,WAAmB,EAAE,QAAkB;IAC7D,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,oBAAoB,EAAE,MAAM,CAAC,GAAG,CAAA,KAAK,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC/F,OAAO,IAAI,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAqC,EACrC,QAA8B,EAC9B,WAAmB;IAEnB,IAAI,CAAC,QAAQ,IAAI,cAAc,CAAC,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,MAAM,CAAC;IAC9E,MAAM,OAAO,GAAG,MAAM,EAAE,kBAAkB,IAAI,CAAC,CAAC;IAChD,IAAI,OAAO,IAAI,QAAQ,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC;IAC7C,OAAO,EAAE,GAAG,MAAM,EAAE,kBAAkB,EAAE,QAAQ,CAAC,KAAK,EAAE,mBAAmB,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;AACjG,CAAC"}

package/dist/platform/freshness-policy.d.ts

@@ -0,0 +1,25 @@
+import { z } from "zod";
+/**
+ * How far behind the latest release a direct dependency may fall before `autoremediator freshness`
+ * plans a climb. Every limit is optional, but at least one must be set: a `freshness` key that
+ * limits nothing is a mistake, not a policy.
+ */
+export interface FreshnessPolicy {
+    /** Most major versions a dependency may trail the latest release by (0 = always on the latest major). */
+    maxMajorsBehind?: number;
+    /** Most minor versions it may trail by, counted only when it is on the latest major. */
+    maxMinorsBehind?: number;
+    /** Oldest the installed version may be, in days since it was published, while a newer one exists. */
+    maxAgeDays?: number;
+    /** Packages left alone: an exact name, `@scope/*`, or a `prefix*`. They do not count in the score. */
+    ignore: string[];
+}
+export declare const freshnessPolicySchema: z.ZodObject<{
+    maxMajorsBehind: z.ZodOptional<z.ZodNumber>;
+    maxMinorsBehind: z.ZodOptional<z.ZodNumber>;
+    maxAgeDays: z.ZodOptional<z.ZodNumber>;
+    ignore: z.ZodDefault<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+/** Whether `name` is matched by an `ignore` entry. */
+export declare function isIgnoredPackage(ignore: readonly string[], name: string): boolean;
+//# sourceMappingURL=freshness-policy.d.ts.map

package/dist/platform/freshness-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"freshness-policy.d.ts","sourceRoot":"","sources":["../../src/platform/freshness-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,yGAAyG;IACzG,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,wFAAwF;IACxF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qGAAqG;IACrG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sGAAsG;IACtG,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAID,eAAO,MAAM,qBAAqB;;;;;kBAc/B,CAAC;AAEJ,sDAAsD;AACtD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAOjF"}

package/dist/platform/freshness-policy.js

@@ -0,0 +1,25 @@
+import { z } from "zod";
+const limit = z.number().int().min(0);
+export const freshnessPolicySchema = z
+    .object({
+    maxMajorsBehind: limit.optional(),
+    maxMinorsBehind: limit.optional(),
+    maxAgeDays: z.number().positive().optional(),
+    ignore: z.array(z.string().trim().min(1)).default([]),
+})
+    .strict()
+    .refine((value) => value.maxMajorsBehind !== undefined ||
+    value.maxMinorsBehind !== undefined ||
+    value.maxAgeDays !== undefined, { message: "set at least one of maxMajorsBehind, maxMinorsBehind or maxAgeDays" });
+/** Whether `name` is matched by an `ignore` entry. */
+export function isIgnoredPackage(ignore, name) {
+    return ignore.some((pattern) => {
+        const entry = pattern.trim();
+        if (entry === "*")
+            return true;
+        if (entry.endsWith("*"))
+            return name.startsWith(entry.slice(0, -1));
+        return entry === name;
+    });
+}
+//# sourceMappingURL=freshness-policy.js.map

package/dist/platform/freshness-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"freshness-policy.js","sourceRoot":"","sources":["../../src/platform/freshness-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAkBxB,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAEtC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,eAAe,EAAE,KAAK,CAAC,QAAQ,EAAE;IACjC,eAAe,EAAE,KAAK,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACtD,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CACL,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,eAAe,KAAK,SAAS;IACnC,KAAK,CAAC,eAAe,KAAK,SAAS;IACnC,KAAK,CAAC,UAAU,KAAK,SAAS,EAChC,EAAE,OAAO,EAAE,oEAAoE,EAAE,CAClF,CAAC;AAEJ,sDAAsD;AACtD,MAAM,UAAU,gBAAgB,CAAC,MAAyB,EAAE,IAAY;IACtE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,KAAK,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC/B,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,OAAO,KAAK,KAAK,IAAI,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/platform/git-ref.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Refuse a caller-supplied git ref that git could read as an option (`--output=...`, `-p`) or that
+ * carries control characters. Every ref that reaches git from outside must pass this first.
+ */
+export declare function assertSafeGitRef(name: string, value: string): void;
+/** The commit a caller-supplied ref names. Throws for an unsafe or unresolvable ref. */
+export declare function resolveGitCommit(cwd: string, name: string, ref: string): Promise<string>;
+//# sourceMappingURL=git-ref.d.ts.map

package/dist/platform/git-ref.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-ref.d.ts","sourceRoot":"","sources":["../../src/platform/git-ref.ts"],"names":[],"mappings":"AAUA;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAKlE;AAED,wFAAwF;AACxF,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAkB9F"}

package/dist/platform/git-ref.js

@@ -0,0 +1,35 @@
+import { safeExeca } from "./safe-exec.js";
+function hasControlCharacter(value) {
+    for (let index = 0; index < value.length; index++) {
+        const code = value.codePointAt(index) ?? 0;
+        if (code < 32 || code === 127)
+            return true;
+    }
+    return false;
+}
+/**
+ * Refuse a caller-supplied git ref that git could read as an option (`--output=...`, `-p`) or that
+ * carries control characters. Every ref that reaches git from outside must pass this first.
+ */
+export function assertSafeGitRef(name, value) {
+    if (!value.trim())
+        throw new Error(`${name} is required: a git ref (commit, tag or branch).`);
+    if (value.startsWith("-") || hasControlCharacter(value)) {
+        throw new Error(`${name} is not a valid git ref: ${JSON.stringify(value)}.`);
+    }
+}
+/** The commit a caller-supplied ref names. Throws for an unsafe or unresolvable ref. */
+export async function resolveGitCommit(cwd, name, ref) {
+    assertSafeGitRef(name, ref);
+    const result = await safeExeca("git", ["rev-parse", "--verify", "--quiet", "--end-of-options", `${ref}^{commit}`], {
+        cwd,
+        stdio: "pipe",
+        reject: false,
+    });
+    const sha = result.exitCode === 0 ? result.stdout.trim() : "";
+    if (!sha) {
+        throw new Error(`${name} ${JSON.stringify(ref)} is not a commit in this repository (is ${cwd} a git checkout, and does the ref exist?)`);
+    }
+    return sha;
+}
+//# sourceMappingURL=git-ref.js.map

package/dist/platform/git-ref.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-ref.js","sourceRoot":"","sources":["../../src/platform/git-ref.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,SAAS,mBAAmB,CAAC,KAAa;IACxC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,IAAI,GAAG,EAAE,IAAI,IAAI,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;IAC7C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAa;IAC1D,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,kDAAkD,CAAC,CAAC;IAC9F,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,4BAA4B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW,EAAE,IAAY,EAAE,GAAW;IAC3E,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5B,MAAM,MAAM,GAAG,MAAM,SAAS,CAC5B,KAAK,EACL,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,kBAAkB,EAAE,GAAG,GAAG,WAAW,CAAC,EAC3E;QACE,GAAG;QACH,KAAK,EAAE,MAAM;QACb,MAAM,EAAE,KAAK;KACd,CACF,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,2CAA2C,GAAG,2CAA2C,CACxH,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/platform/http-auth.d.ts

@@ -0,0 +1,42 @@
+import type http from "node:http";
+export type Role = "admin" | "operator" | "reader";
+export interface JwtPayload {
+    sub?: string;
+    role?: Role | (string & {});
+    roles?: Array<Role | (string & {})>;
+    scope?: string;
+    exp?: number;
+    [key: string]: unknown;
+}
+/**
+ * Creates an HMAC-SHA256 signed JWT string for testing or token issuance.
+ */
+export declare function createSignedJwt(payload: JwtPayload, secret: string): string;
+/**
+ * Verifies an HMAC-SHA256 signed JWT and extracts the role.
+ */
+export declare function verifyJwtRole(token: string, secret: string): Role | undefined;
+/**
+ * Parses configured tokens from environment or explicit map (JWT or static pre-shared key).
+ */
+export declare function getRoleForToken(token: string, envTokens?: string | undefined, jwtSecret?: string | undefined): Role | undefined;
+/**
+ * Who a request comes from, for binding stored results to their caller: the `sub` of a verified JWT
+ * (so a refreshed token is the same caller), otherwise a digest of the bearer token. Never the token
+ * itself. Requests without a token (only possible with authentication switched off) share one identity.
+ */
+export declare function callerIdentity(req: http.IncomingMessage, env?: NodeJS.ProcessEnv): string;
+export type AuthDecision = {
+    ok: true;
+} | {
+    ok: false;
+    status: 401 | 403 | 503;
+    error: string;
+};
+/**
+ * Whether a request may use something that needs `requiredRole`, from its Bearer token. With no
+ * tokens or JWT secret configured every request is refused, unless
+ * `AUTOREMEDIATOR_INSECURE_NO_AUTH` is set (local development only).
+ */
+export declare function authorizeRole(req: http.IncomingMessage, requiredRole: Role, label: string, env?: NodeJS.ProcessEnv): AuthDecision;
+//# sourceMappingURL=http-auth.d.ts.map

package/dist/platform/http-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-auth.d.ts","sourceRoot":"","sources":["../../src/platform/http-auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,MAAM,MAAM,IAAI,GAAG,OAAO,GAAG,UAAU,GAAG,QAAQ,CAAC;AAQnD,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC5B,KAAK,CAAC,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;IACpC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAK3E;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAyC7E;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,EACb,SAAS,qBAAwC,EACjD,SAAS,qBAAwC,GAChD,IAAI,GAAG,SAAS,CA8BlB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,CAiBR;AAMD,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhG;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,YAAY,EAAE,IAAI,EAClB,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,YAAY,CA8Bd"}

package/dist/platform/http-auth.js

@@ -0,0 +1,151 @@
+import { createHash, createHmac, timingSafeEqual } from "node:crypto";
+const ROLE_HIERARCHY = {
+    reader: 1,
+    operator: 2,
+    admin: 3,
+};
+/**
+ * Creates an HMAC-SHA256 signed JWT string for testing or token issuance.
+ */
+export function createSignedJwt(payload, secret) {
+    const header = Buffer.from(JSON.stringify({ alg: "HS256", typ: "JWT" })).toString("base64url");
+    const body = Buffer.from(JSON.stringify(payload)).toString("base64url");
+    const signature = createHmac("sha256", secret).update(`${header}.${body}`).digest("base64url");
+    return `${header}.${body}.${signature}`;
+}
+/**
+ * Verifies an HMAC-SHA256 signed JWT and extracts the role.
+ */
+export function verifyJwtRole(token, secret) {
+    const parts = token.split(".");
+    if (parts.length !== 3)
+        return undefined;
+    const [headerB64, bodyB64, signatureB64] = parts;
+    try {
+        const expectedSig = createHmac("sha256", secret)
+            .update(`${headerB64}.${bodyB64}`)
+            .digest("base64url");
+        const sigBuf = Buffer.from(signatureB64);
+        const expBuf = Buffer.from(expectedSig);
+        if (sigBuf.length !== expBuf.length || !timingSafeEqual(sigBuf, expBuf)) {
+            return undefined;
+        }
+        const payload = JSON.parse(Buffer.from(bodyB64, "base64url").toString("utf8"));
+        if (typeof payload.exp === "number") {
+            const nowSeconds = Math.floor(Date.now() / 1000);
+            if (nowSeconds >= payload.exp) {
+                return undefined; // Expired
+            }
+        }
+        // Role resolution from claims
+        const possibleRoles = [];
+        if (typeof payload.role === "string")
+            possibleRoles.push(payload.role);
+        if (Array.isArray(payload.roles))
+            possibleRoles.push(...payload.roles.filter((r) => typeof r === "string"));
+        if (typeof payload.scope === "string")
+            possibleRoles.push(...payload.scope.split(" "));
+        if (possibleRoles.includes("admin"))
+            return "admin";
+        if (possibleRoles.includes("operator"))
+            return "operator";
+        if (possibleRoles.includes("reader"))
+            return "reader";
+    }
+    catch {
+        return undefined;
+    }
+    return undefined;
+}
+/**
+ * Parses configured tokens from environment or explicit map (JWT or static pre-shared key).
+ */
+export function getRoleForToken(token, envTokens = process.env.AUTOREMEDIATOR_API_TOKENS, jwtSecret = process.env.AUTOREMEDIATOR_JWT_SECRET) {
+    // 1. Try JWT verification if secret is configured
+    if (jwtSecret && token.includes(".")) {
+        const jwtRole = verifyJwtRole(token, jwtSecret);
+        if (jwtRole)
+            return jwtRole;
+    }
+    // 2. Try static pre-shared key lookup
+    if (envTokens) {
+        const pairs = envTokens
+            .split(",")
+            .map((s) => s.trim())
+            .filter(Boolean);
+        for (const pair of pairs) {
+            const [role, secret] = pair.split(":");
+            if (secret &&
+                secret === token &&
+                (role === "admin" || role === "operator" || role === "reader")) {
+                return role;
+            }
+        }
+    }
+    if (!envTokens && !jwtSecret) {
+        return "admin"; // Default dev mode
+    }
+    return undefined;
+}
+/**
+ * Who a request comes from, for binding stored results to their caller: the `sub` of a verified JWT
+ * (so a refreshed token is the same caller), otherwise a digest of the bearer token. Never the token
+ * itself. Requests without a token (only possible with authentication switched off) share one identity.
+ */
+export function callerIdentity(req, env = process.env) {
+    const header = req.headers.authorization;
+    const token = header?.startsWith("Bearer ") ? header.slice("Bearer ".length).trim() : undefined;
+    if (!token)
+        return "anonymous";
+    const secret = env["AUTOREMEDIATOR_JWT_SECRET"];
+    if (secret && token.includes(".") && verifyJwtRole(token, secret)) {
+        try {
+            const body = token.split(".")[1] ?? "";
+            const payload = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
+            if (typeof payload.sub === "string" && payload.sub !== "") {
+                return `sub:${createHash("sha256").update(payload.sub).digest("hex")}`;
+            }
+        }
+        catch {
+            // Verified a moment ago, so this cannot normally happen; fall back to the token digest.
+        }
+    }
+    return `token:${createHash("sha256").update(token).digest("hex")}`;
+}
+function isTruthy(value) {
+    return value === "1" || value?.toLowerCase() === "true";
+}
+/**
+ * Whether a request may use something that needs `requiredRole`, from its Bearer token. With no
+ * tokens or JWT secret configured every request is refused, unless
+ * `AUTOREMEDIATOR_INSECURE_NO_AUTH` is set (local development only).
+ */
+export function authorizeRole(req, requiredRole, label, env = process.env) {
+    if (!env["AUTOREMEDIATOR_API_TOKENS"] && !env["AUTOREMEDIATOR_JWT_SECRET"]) {
+        // Anything served can mutate the filesystem, so unauthenticated access is opt-in only.
+        if (isTruthy(env["AUTOREMEDIATOR_INSECURE_NO_AUTH"]))
+            return { ok: true };
+        return {
+            ok: false,
+            status: 503,
+            error: "Authentication is not configured. Set AUTOREMEDIATOR_API_TOKENS or AUTOREMEDIATOR_JWT_SECRET, " +
+                "or set AUTOREMEDIATOR_INSECURE_NO_AUTH=1 to explicitly run without authentication (local development only).",
+        };
+    }
+    const authHeader = req.headers.authorization;
+    if (!authHeader || !authHeader.startsWith("Bearer ")) {
+        return { ok: false, status: 401, error: "Unauthorized: Missing or invalid Bearer token" };
+    }
+    const userRole = getRoleForToken(authHeader.slice("Bearer ".length).trim());
+    if (!userRole)
+        return { ok: false, status: 401, error: "Unauthorized: Invalid or expired API token" };
+    if (ROLE_HIERARCHY[userRole] < ROLE_HIERARCHY[requiredRole]) {
+        return {
+            ok: false,
+            status: 403,
+            error: `Forbidden: Role '${userRole}' has insufficient permissions for ${label} (requires '${requiredRole}')`,
+        };
+    }
+    return { ok: true };
+}
+//# sourceMappingURL=http-auth.js.map

package/dist/platform/http-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-auth.js","sourceRoot":"","sources":["../../src/platform/http-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAKtE,MAAM,cAAc,GAAyB;IAC3C,MAAM,EAAE,CAAC;IACT,QAAQ,EAAE,CAAC;IACX,KAAK,EAAE,CAAC;CACT,CAAC;AAWF;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,OAAmB,EAAE,MAAc;IACjE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/F,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC/F,OAAO,GAAG,MAAM,IAAI,IAAI,IAAI,SAAS,EAAE,CAAC;AAC1C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,MAAc;IACzD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAEzC,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,GAAG,KAAiC,CAAC;IAE7E,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;aAC7C,MAAM,CAAC,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC;aACjC,MAAM,CAAC,WAAW,CAAC,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAExC,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;YACxE,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAe,CAAC;QAE7F,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YACjD,IAAI,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;gBAC9B,OAAO,SAAS,CAAC,CAAC,UAAU;YAC9B,CAAC;QACH,CAAC;QAED,8BAA8B;QAC9B,MAAM,aAAa,GAAa,EAAE,CAAC;QACnC,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;YAAE,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvE,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;YAC9B,aAAa,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;QACzF,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ;YAAE,aAAa,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAEvF,IAAI,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,OAAO,CAAC;QACpD,IAAI,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,OAAO,UAAU,CAAC;QAC1D,IAAI,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,KAAa,EACb,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,EACjD,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB;IAEjD,kDAAkD;IAClD,IAAI,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAChD,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;IAC9B,CAAC;IAED,sCAAsC;IACtC,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,KAAK,GAAG,SAAS;aACpB,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC,CAAC;QACnB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACvC,IACE,MAAM;gBACN,MAAM,KAAK,KAAK;gBAChB,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,KAAK,QAAQ,CAAC,EAC9D,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAC,CAAC,mBAAmB;IACrC,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAyB,EACzB,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACzC,MAAM,KAAK,GAAG,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAChG,IAAI,CAAC,KAAK;QAAE,OAAO,WAAW,CAAC;IAC/B,MAAM,MAAM,GAAG,GAAG,CAAC,2BAA2B,CAAC,CAAC;IAChD,IAAI,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;QAClE,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAe,CAAC;YAC1F,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,KAAK,EAAE,EAAE,CAAC;gBAC1D,OAAO,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACzE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wFAAwF;QAC1F,CAAC;IACH,CAAC;IACD,OAAO,SAAS,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACrE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAyB;IACzC,OAAO,KAAK,KAAK,GAAG,IAAI,KAAK,EAAE,WAAW,EAAE,KAAK,MAAM,CAAC;AAC1D,CAAC;AAID;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAyB,EACzB,YAAkB,EAClB,KAAa,EACb,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,IAAI,CAAC,GAAG,CAAC,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,2BAA2B,CAAC,EAAE,CAAC;QAC3E,uFAAuF;QACvF,IAAI,QAAQ,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAC1E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,KAAK,EACH,gGAAgG;gBAChG,6GAA6G;SAChH,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7C,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAC;IAC5F,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5E,IAAI,CAAC,QAAQ;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC;IAEzF,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,YAAY,CAAC,EAAE,CAAC;QAC5D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,oBAAoB,QAAQ,sCAAsC,KAAK,eAAe,YAAY,IAAI;SAC9G,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/platform/http-security.d.ts

@@ -0,0 +1,25 @@
+import type http from "node:http";
+export declare class HttpError extends Error {
+    readonly status: number;
+    constructor(status: number, message: string);
+}
+/**
+ * Read and parse a JSON request body.
+ *
+ * Requires `Content-Type: application/json`: a browser cannot send that cross-origin without a
+ * CORS preflight (which this server never grants), so it blocks drive-by form/text POSTs.
+ */
+export declare function readBody(req: http.IncomingMessage): Promise<unknown>;
+/**
+ * The text of an error that is safe to hand to an HTTP caller: the first line of its message,
+ * capped in length. Never a stack trace, never the object's own string form (which can carry one).
+ */
+export declare function publicErrorMessage(error: unknown): string;
+export declare function sendJson(res: http.ServerResponse, status: number, body: unknown): void;
+/**
+ * Whether the request's Host header names this machine: the loopback names, plus any in
+ * `AUTOREMEDIATOR_ALLOWED_HOSTS`. Rejecting anything else stops a DNS-rebinding page from
+ * reaching a server that listens on loopback.
+ */
+export declare function isHostAllowed(req: http.IncomingMessage, env?: NodeJS.ProcessEnv): boolean;
+//# sourceMappingURL=http-security.d.ts.map

package/dist/platform/http-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-security.d.ts","sourceRoot":"","sources":["../../src/platform/http-security.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,qBAAa,SAAU,SAAQ,KAAK;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,YAAY,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAI1C;CACF;AASD;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CA2CpE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAMzD;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAQtF;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAYT"}