autoremediator 0.21.2 → 0.22.0

package/dist/remediation/local/primary-strategy.js

@@ -1,11 +1,27 @@
-import { resolveSafeUpgradeVersion } from "../../intelligence/sources/registry.js";
-import { verifyPackageTrust } from "../../platform/supply-chain.js";
+import { readCooldown, withCooldown } from "../../platform/cooldown.js";
+import { loadRegistryConfig } from "../../platform/registry-config.js";
 import { applyPackageOverrideTool } from "../tools/apply-package-override/index.js";
 import { applyVersionBumpTool } from "../tools/apply-version-bump.js";
+import { describeSkipped, selectUpgradeTarget } from "./select-target.js";
+/** Every fixed version was rejected in an earlier run: nothing to propose until a person says otherwise. */
+function memoryBlocked(pkg, target, dryRun, vulnerable) {
+    return {
+        packageName: pkg.name,
+        strategy: "none",
+        fromVersion: pkg.version,
+        applied: false,
+        dryRun,
+        unresolvedReason: "constraint-blocked",
+        vulnerableRange: vulnerable.affected.vulnerableRange,
+        message: `Remediation memory blocks every fixed version of "${pkg.name}": ${target.reason}. Remove the entry with \`autoremediator memory remove\`, or pass --ignore-memory.`,
+    };
+}
 export async function resolvePrimaryResult(params) {
-    const { vulnerable, cwd, packageManager, dryRun, policy, runTests, constraints, proofOfFix, requireProofOfFix = constraints.requireProofOfFix, reproductionTest, patchesDir, } = params;
+    const { vulnerable, cwd, packageManager, dryRun, policy, runTests, constraints, proofOfFix, requireProofOfFix = constraints.requireProofOfFix, reproductionTest, patchesDir, offlineIntelligence, rejectedVersions, } = params;
     const pkg = vulnerable.installed;
     const firstPatchedVersion = vulnerable.affected.firstPatchedVersion;
+    const registry = loadRegistryConfig(cwd);
+    const cooldown = readCooldown(cwd, packageManager);
     if (pkg.type === "transitive") {
         if (constraints.directDependenciesOnly) {
             return {
@@ -47,8 +63,19 @@ export async function resolvePrimaryResult(params) {
                 },
             };
         }
-        const safeUpgrade = await resolveSafeUpgradeVersion(pkg.name, pkg.version, firstPatchedVersion, vulnerable.affected.vulnerableRange);
-        if (!safeUpgrade.safeVersion) {
+        const target = await selectUpgradeTarget({
+            packageName: pkg.name,
+            installedVersion: pkg.version,
+            firstPatchedVersion,
+            vulnerableRange: vulnerable.affected.vulnerableRange,
+            registry,
+            supplyChainPolicy: withCooldown(constraints.supplyChainPolicy, cooldown, pkg.name),
+            offline: offlineIntelligence,
+            rejected: rejectedVersions,
+        });
+        if (target.status === "memory-blocked")
+            return { result: memoryBlocked(pkg, target, dryRun, vulnerable) };
+        if (target.status === "no-safe-version") {
             return {
                 result: {
                     packageName: pkg.name,
@@ -62,8 +89,7 @@ export async function resolvePrimaryResult(params) {
                 },
             };
         }
-        const trust = await verifyPackageTrust(pkg.name, safeUpgrade.safeVersion, constraints.supplyChainPolicy);
-        if (!trust.trusted) {
+        if (target.status === "trust-blocked") {
             return {
                 result: {
                     packageName: pkg.name,
@@ -73,7 +99,7 @@ export async function resolvePrimaryResult(params) {
                     dryRun,
                     unresolvedReason: "policy-blocked",
                     vulnerableRange: vulnerable.affected.vulnerableRange,
-                    message: `Supply chain trust gate blocked "${pkg.name}@${safeUpgrade.safeVersion}": ${trust.reason}`,
+                    message: `Supply chain trust gate blocked "${pkg.name}@${target.version}": ${target.reason}`,
                 },
             };
         }
@@ -82,7 +108,7 @@ export async function resolvePrimaryResult(params) {
             packageManager,
             packageName: pkg.name,
             fromVersion: pkg.version,
-            toVersion: safeUpgrade.safeVersion,
+            toVersion: target.version,
             dryRun,
             policy,
             runTests,
@@ -96,7 +122,11 @@ export async function resolvePrimaryResult(params) {
             patchesDir,
         });
         return {
-            result: { ...overrideResult, vulnerableRange: vulnerable.affected.vulnerableRange },
+            result: {
+                ...overrideResult,
+                vulnerableRange: vulnerable.affected.vulnerableRange,
+                message: `${overrideResult.message}${describeSkipped(target.skipped)}`,
+            },
         };
     }
     if (!firstPatchedVersion) {
@@ -113,8 +143,19 @@ export async function resolvePrimaryResult(params) {
             },
         };
     }
-    const safeUpgrade = await resolveSafeUpgradeVersion(pkg.name, pkg.version, firstPatchedVersion, vulnerable.affected.vulnerableRange);
-    if (!safeUpgrade.safeVersion) {
+    const target = await selectUpgradeTarget({
+        packageName: pkg.name,
+        installedVersion: pkg.version,
+        firstPatchedVersion,
+        vulnerableRange: vulnerable.affected.vulnerableRange,
+        registry,
+        supplyChainPolicy: withCooldown(constraints.supplyChainPolicy, cooldown, pkg.name),
+        offline: offlineIntelligence,
+        rejected: rejectedVersions,
+    });
+    if (target.status === "memory-blocked")
+        return { result: memoryBlocked(pkg, target, dryRun, vulnerable) };
+    if (target.status === "no-safe-version") {
         return {
             result: {
                 packageName: pkg.name,
@@ -128,8 +169,7 @@ export async function resolvePrimaryResult(params) {
             },
         };
     }
-    const trust = await verifyPackageTrust(pkg.name, safeUpgrade.safeVersion, constraints.supplyChainPolicy);
-    if (!trust.trusted) {
+    if (target.status === "trust-blocked") {
         return {
             result: {
                 packageName: pkg.name,
@@ -139,7 +179,7 @@ export async function resolvePrimaryResult(params) {
                 dryRun,
                 unresolvedReason: "policy-blocked",
                 vulnerableRange: vulnerable.affected.vulnerableRange,
-                message: `Supply chain trust gate blocked "${pkg.name}@${safeUpgrade.safeVersion}": ${trust.reason}`,
+                message: `Supply chain trust gate blocked "${pkg.name}@${target.version}": ${target.reason}`,
             },
         };
     }
@@ -148,7 +188,7 @@ export async function resolvePrimaryResult(params) {
         packageManager,
         packageName: pkg.name,
         fromVersion: pkg.version,
-        toVersion: safeUpgrade.safeVersion,
+        toVersion: target.version,
         dryRun,
         policy,
         runTests,
@@ -164,7 +204,11 @@ export async function resolvePrimaryResult(params) {
         patchesDir,
     });
     return {
-        result: { ...applyResult, vulnerableRange: vulnerable.affected.vulnerableRange },
+        result: {
+            ...applyResult,
+            vulnerableRange: vulnerable.affected.vulnerableRange,
+            message: `${applyResult.message}${describeSkipped(target.skipped)}`,
+        },
     };
 }
 //# sourceMappingURL=primary-strategy.js.map

package/dist/remediation/local/primary-strategy.js.map

@@ -1 +1 @@
-{"version":3,"file":"primary-strategy.js","sourceRoot":"","sources":["../../../src/remediation/local/primary-strategy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAOpE,OAAO,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAEtE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAY1C;IACC,MAAM,EACJ,UAAU,EACV,GAAG,EACH,cAAc,EACd,MAAM,EACN,MAAM,EACN,QAAQ,EACR,WAAW,EACX,UAAU,EACV,iBAAiB,GAAG,WAAW,CAAC,iBAAiB,EACjD,gBAAgB,EAChB,UAAU,GACX,GAAG,MAAM,CAAC;IACX,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC;IACjC,MAAM,mBAAmB,GAAG,UAAU,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IAEpE,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAC9B,IAAI,WAAW,CAAC,sBAAsB,EAAE,CAAC;YACvC,OAAO;gBACL,MAAM,EAAE;oBACN,WAAW,EAAE,GAAG,CAAC,IAAI;oBACrB,QAAQ,EAAE,MAAM;oBAChB,WAAW,EAAE,GAAG,CAAC,OAAO;oBACxB,OAAO,EAAE,KAAK;oBACd,MAAM;oBACN,gBAAgB,EAAE,oBAAoB;oBACtC,OAAO,EAAE,6DAA6D,GAAG,CAAC,IAAI,IAAI;iBACnF;aACF,CAAC;QACJ,CAAC;QAED,IAAI,WAAW,CAAC,iBAAiB,EAAE,CAAC;YAClC,OAAO;gBACL,MAAM,EAAE;oBACN,WAAW,EAAE,GAAG,CAAC,IAAI;oBACrB,QAAQ,EAAE,MAAM;oBAChB,WAAW,EAAE,GAAG,CAAC,OAAO;oBACxB,OAAO,EAAE,KAAK;oBACd,MAAM;oBACN,gBAAgB,EAAE,oBAAoB;oBACtC,OAAO,EAAE,0EAA0E,GAAG,CAAC,IAAI,IAAI;iBAChG;aACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,OAAO;gBACL,MAAM,EAAE;oBACN,WAAW,EAAE,GAAG,CAAC,IAAI;oBACrB,QAAQ,EAAE,MAAM;oBAChB,WAAW,EAAE,GAAG,CAAC,OAAO;oBACxB,OAAO,EAAE,KAAK;oBACd,MAAM;oBACN,gBAAgB,EAAE,iBAAiB;oBACnC,eAAe,EAAE,UAAU,CAAC,QAAQ,CAAC,eAAe;oBACpD,OAAO,EAAE,wCAAwC,GAAG,CAAC,IAAI,wDAAwD;iBAClH;aACF,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,yBAAyB,CACjD,GAAG,CAAC,IAAI,EACR,GAAG,CAAC,OAAO,EACX,mBAAmB,EACnB,UAAU,CAAC,QAAQ,CAAC,eAAe,CACpC,CAAC;QAEF,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;YAC7B,OAAO;gBACL,MAAM,EAAE;oBACN,WAAW,EAAE,GAAG,CAAC,IAAI;oBACrB,QAAQ,EAAE,MAAM;oBAChB,WAAW,EAAE,GAAG,CAAC,OAAO;oBACxB,OAAO,EAAE,KAAK;oBACd,MAAM;oBACN,gBAAgB,EAAE,iBAAiB;oBACnC,eAAe,EAAE,UAAU,CAAC,QAAQ,CAAC,eAAe;oBACpD,OAAO,EAAE,sCAAsC,GAAG,CAAC,IAAI,GAAG;iBAC3D;aACF,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,kBAAkB,CACpC,GAAG,CAAC,IAAI,EACR,WAAW,CAAC,WAAW,EACvB,WAAW,CAAC,iBAAiB,CAC9B,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO;gBACL,MAAM,EAAE;oBACN,WAAW,EAAE,GAAG,CAAC,IAAI;oBACrB,QAAQ,EAAE,MAAM;oBAChB,WAAW,EAAE,GAAG,CAAC,OAAO;oBACxB,OAAO,EAAE,KAAK;oBACd,MAAM;oBACN,gBAAgB,EAAE,gBAAgB;oBAClC,eAAe,EAAE,UAAU,CAAC,QAAQ,CAAC,eAAe;oBACpD,OAAO,EAAE,oCAAoC,GAAG,CAAC,IAAI,IAAI,WAAW,CAAC,WAAW,MAAM,KAAK,CAAC,MAAM,EAAE;iBACrG;aACF,CAAC;QACJ,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC;YAC5D,GAAG;YACH,cAAc;YACd,WAAW,EAAE,GAAG,CAAC,IAAI;YACrB,WAAW,EAAE,GAAG,CAAC,OAAO;YACxB,SAAS,EAAE,WAAW,CAAC,WAAW;YAClC,MAAM;YACN,MAAM;YACN,QAAQ;YACR,WAAW,EAAE,WAAW,CAAC,WAAW;YACpC,oBAAoB,EAAE,WAAW,CAAC,oBAAoB;YACtD,qBAAqB,EAAE,WAAW,CAAC,qBAAqB;YACxD,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,UAAU;YACV,iBAAiB;YACjB,gBAAgB;YAChB,UAAU;SACX,CAAC,CAAC;QAEH,OAAO;YACL,MAAM,EAAE,EAAE,GAAG,cAAc,EAAE,eAAe,EAAE,UAAU,CAAC,QAAQ,CAAC,eAAe,EAAE;SACpF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,OAAO;YACL,MAAM,EAAE;gBACN,WAAW,EAAE,GAAG,CAAC,IAAI;gBACrB,QAAQ,EAAE,MAAM;gBAChB,WAAW,EAAE,GAAG,CAAC,OAAO;gBACxB,OAAO,EAAE,KAAK;gBACd,MAAM;gBACN,gBAAgB,EAAE,iBAAiB;gBACnC,eAAe,EAAE,UAAU,CAAC,QAAQ,CAAC,eAAe;gBACpD,OAAO,EAAE,wCAAwC,GAAG,CAAC,IAAI,uDAAuD;aACjH;SACF,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,yBAAyB,CACjD,GAAG,CAAC,IAAI,EACR,GAAG,CAAC,OAAO,EACX,mBAAmB,EACnB,UAAU,CAAC,QAAQ,CAAC,eAAe,CACpC,CAAC;IAEF,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;QAC7B,OAAO;YACL,MAAM,EAAE;gBACN,WAAW,EAAE,GAAG,CAAC,IAAI;gBACrB,QAAQ,EAAE,MAAM;gBAChB,WAAW,EAAE,GAAG,CAAC,OAAO;gBACxB,OAAO,EAAE,KAAK;gBACd,MAAM;gBACN,gBAAgB,EAAE,iBAAiB;gBACnC,eAAe,EAAE,UAAU,CAAC,QAAQ,CAAC,eAAe;gBACpD,OAAO,EAAE,qCAAqC,GAAG,CAAC,IAAI,GAAG;aAC1D;SACF,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,kBAAkB,CACpC,GAAG,CAAC,IAAI,EACR,WAAW,CAAC,WAAW,EACvB,WAAW,CAAC,iBAAiB,CAC9B,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO;YACL,MAAM,EAAE;gBACN,WAAW,EAAE,GAAG,CAAC,IAAI;gBACrB,QAAQ,EAAE,MAAM;gBAChB,WAAW,EAAE,GAAG,CAAC,OAAO;gBACxB,OAAO,EAAE,KAAK;gBACd,MAAM;gBACN,gBAAgB,EAAE,gBAAgB;gBAClC,eAAe,EAAE,UAAU,CAAC,QAAQ,CAAC,eAAe;gBACpD,OAAO,EAAE,oCAAoC,GAAG,CAAC,IAAI,IAAI,WAAW,CAAC,WAAW,MAAM,KAAK,CAAC,MAAM,EAAE;aACrG;SACF,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC;QACrD,GAAG;QACH,cAAc;QACd,WAAW,EAAE,GAAG,CAAC,IAAI;QACrB,WAAW,EAAE,GAAG,CAAC,OAAO;QACxB,SAAS,EAAE,WAAW,CAAC,WAAW;QAClC,MAAM;QACN,MAAM;QACN,QAAQ;QACR,SAAS,EAAE,WAAW,CAAC,SAAS;QAChC,WAAW,EAAE,WAAW,CAAC,WAAW;QACpC,oBAAoB,EAAE,WAAW,CAAC,oBAAoB;QACtD,qBAAqB,EAAE,WAAW,CAAC,qBAAqB;QACxD,SAAS,EAAE,WAAW,CAAC,SAAS;QAChC,sBAAsB,EAAE,WAAW,CAAC,4BAA4B;QAChE,UAAU;QACV,iBAAiB;QACjB,gBAAgB;QAChB,UAAU;KACX,CAAC,CAAC;IAEH,OAAO;QACL,MAAM,EAAE,EAAE,GAAG,WAAW,EAAE,eAAe,EAAE,UAAU,CAAC,QAAQ,CAAC,eAAe,EAAE;KACjF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"primary-strategy.js","sourceRoot":"","sources":["../../../src/remediation/local/primary-strategy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAOvE,OAAO,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAC;AACpF,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAE1E,4GAA4G;AAC5G,SAAS,aAAa,CACpB,GAAmC,EACnC,MAA2C,EAC3C,MAAe,EACf,UAA6B;IAE7B,OAAO;QACL,WAAW,EAAE,GAAG,CAAC,IAAI;QACrB,QAAQ,EAAE,MAAM;QAChB,WAAW,EAAE,GAAG,CAAC,OAAO;QACxB,OAAO,EAAE,KAAK;QACd,MAAM;QACN,gBAAgB,EAAE,oBAAoB;QACtC,eAAe,EAAE,UAAU,CAAC,QAAQ,CAAC,eAAe;QACpD,OAAO,EAAE,qDAAqD,GAAG,CAAC,IAAI,MAAM,MAAM,CAAC,MAAM,oFAAoF;KAC9K,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAgB1C;IACC,MAAM,EACJ,UAAU,EACV,GAAG,EACH,cAAc,EACd,MAAM,EACN,MAAM,EACN,QAAQ,EACR,WAAW,EACX,UAAU,EACV,iBAAiB,GAAG,WAAW,CAAC,iBAAiB,EACjD,gBAAgB,EAChB,UAAU,EACV,mBAAmB,EACnB,gBAAgB,GACjB,GAAG,MAAM,CAAC;IACX,MAAM,GAAG,GAAG,UAAU,CAAC,SAAS,CAAC;IACjC,MAAM,mBAAmB,GAAG,UAAU,CAAC,QAAQ,CAAC,mBAAmB,CAAC;IACpE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAEnD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAC9B,IAAI,WAAW,CAAC,sBAAsB,EAAE,CAAC;YACvC,OAAO;gBACL,MAAM,EAAE;oBACN,WAAW,EAAE,GAAG,CAAC,IAAI;oBACrB,QAAQ,EAAE,MAAM;oBAChB,WAAW,EAAE,GAAG,CAAC,OAAO;oBACxB,OAAO,EAAE,KAAK;oBACd,MAAM;oBACN,gBAAgB,EAAE,oBAAoB;oBACtC,OAAO,EAAE,6DAA6D,GAAG,CAAC,IAAI,IAAI;iBACnF;aACF,CAAC;QACJ,CAAC;QAED,IAAI,WAAW,CAAC,iBAAiB,EAAE,CAAC;YAClC,OAAO;gBACL,MAAM,EAAE;oBACN,WAAW,EAAE,GAAG,CAAC,IAAI;oBACrB,QAAQ,EAAE,MAAM;oBAChB,WAAW,EAAE,GAAG,CAAC,OAAO;oBACxB,OAAO,EAAE,KAAK;oBACd,MAAM;oBACN,gBAAgB,EAAE,oBAAoB;oBACtC,OAAO,EAAE,0EAA0E,GAAG,CAAC,IAAI,IAAI;iBAChG;aACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,OAAO;gBACL,MAAM,EAAE;oBACN,WAAW,EAAE,GAAG,CAAC,IAAI;oBACrB,QAAQ,EAAE,MAAM;oBAChB,WAAW,EAAE,GAAG,CAAC,OAAO;oBACxB,OAAO,EAAE,KAAK;oBACd,MAAM;oBACN,gBAAgB,EAAE,iBAAiB;oBACnC,eAAe,EAAE,UAAU,CAAC,QAAQ,CAAC,eAAe;oBACpD,OAAO,EAAE,wCAAwC,GAAG,CAAC,IAAI,wDAAwD;iBAClH;aACF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;YACvC,WAAW,EAAE,GAAG,CAAC,IAAI;YACrB,gBAAgB,EAAE,GAAG,CAAC,OAAO;YAC7B,mBAAmB;YACnB,eAAe,EAAE,UAAU,CAAC,QAAQ,CAAC,eAAe;YACpD,QAAQ;YACR,iBAAiB,EAAE,YAAY,CAAC,WAAW,CAAC,iBAAiB,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC;YAClF,OAAO,EAAE,mBAAmB;YAC5B,QAAQ,EAAE,gBAAgB;SAC3B,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,MAAM,KAAK,gBAAgB;YACpC,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;QAEpE,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;YACxC,OAAO;gBACL,MAAM,EAAE;oBACN,WAAW,EAAE,GAAG,CAAC,IAAI;oBACrB,QAAQ,EAAE,MAAM;oBAChB,WAAW,EAAE,GAAG,CAAC,OAAO;oBACxB,OAAO,EAAE,KAAK;oBACd,MAAM;oBACN,gBAAgB,EAAE,iBAAiB;oBACnC,eAAe,EAAE,UAAU,CAAC,QAAQ,CAAC,eAAe;oBACpD,OAAO,EAAE,sCAAsC,GAAG,CAAC,IAAI,GAAG;iBAC3D;aACF,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YACtC,OAAO;gBACL,MAAM,EAAE;oBACN,WAAW,EAAE,GAAG,CAAC,IAAI;oBACrB,QAAQ,EAAE,MAAM;oBAChB,WAAW,EAAE,GAAG,CAAC,OAAO;oBACxB,OAAO,EAAE,KAAK;oBACd,MAAM;oBACN,gBAAgB,EAAE,gBAAgB;oBAClC,eAAe,EAAE,UAAU,CAAC,QAAQ,CAAC,eAAe;oBACpD,OAAO,EAAE,oCAAoC,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,MAAM,MAAM,CAAC,MAAM,EAAE;iBAC7F;aACF,CAAC;QACJ,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC;YAC5D,GAAG;YACH,cAAc;YACd,WAAW,EAAE,GAAG,CAAC,IAAI;YACrB,WAAW,EAAE,GAAG,CAAC,OAAO;YACxB,SAAS,EAAE,MAAM,CAAC,OAAO;YACzB,MAAM;YACN,MAAM;YACN,QAAQ;YACR,WAAW,EAAE,WAAW,CAAC,WAAW;YACpC,oBAAoB,EAAE,WAAW,CAAC,oBAAoB;YACtD,qBAAqB,EAAE,WAAW,CAAC,qBAAqB;YACxD,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,UAAU;YACV,iBAAiB;YACjB,gBAAgB;YAChB,UAAU;SACX,CAAC,CAAC;QAEH,OAAO;YACL,MAAM,EAAE;gBACN,GAAG,cAAc;gBACjB,eAAe,EAAE,UAAU,CAAC,QAAQ,CAAC,eAAe;gBACpD,OAAO,EAAE,GAAG,cAAc,CAAC,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;aACvE;SACF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,OAAO;YACL,MAAM,EAAE;gBACN,WAAW,EAAE,GAAG,CAAC,IAAI;gBACrB,QAAQ,EAAE,MAAM;gBAChB,WAAW,EAAE,GAAG,CAAC,OAAO;gBACxB,OAAO,EAAE,KAAK;gBACd,MAAM;gBACN,gBAAgB,EAAE,iBAAiB;gBACnC,eAAe,EAAE,UAAU,CAAC,QAAQ,CAAC,eAAe;gBACpD,OAAO,EAAE,wCAAwC,GAAG,CAAC,IAAI,uDAAuD;aACjH;SACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;QACvC,WAAW,EAAE,GAAG,CAAC,IAAI;QACrB,gBAAgB,EAAE,GAAG,CAAC,OAAO;QAC7B,mBAAmB;QACnB,eAAe,EAAE,UAAU,CAAC,QAAQ,CAAC,eAAe;QACpD,QAAQ;QACR,iBAAiB,EAAE,YAAY,CAAC,WAAW,CAAC,iBAAiB,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC;QAClF,OAAO,EAAE,mBAAmB;QAC5B,QAAQ,EAAE,gBAAgB;KAC3B,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,MAAM,KAAK,gBAAgB;QACpC,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;IAEpE,IAAI,MAAM,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;QACxC,OAAO;YACL,MAAM,EAAE;gBACN,WAAW,EAAE,GAAG,CAAC,IAAI;gBACrB,QAAQ,EAAE,MAAM;gBAChB,WAAW,EAAE,GAAG,CAAC,OAAO;gBACxB,OAAO,EAAE,KAAK;gBACd,MAAM;gBACN,gBAAgB,EAAE,iBAAiB;gBACnC,eAAe,EAAE,UAAU,CAAC,QAAQ,CAAC,eAAe;gBACpD,OAAO,EAAE,qCAAqC,GAAG,CAAC,IAAI,GAAG;aAC1D;SACF,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QACtC,OAAO;YACL,MAAM,EAAE;gBACN,WAAW,EAAE,GAAG,CAAC,IAAI;gBACrB,QAAQ,EAAE,MAAM;gBAChB,WAAW,EAAE,GAAG,CAAC,OAAO;gBACxB,OAAO,EAAE,KAAK;gBACd,MAAM;gBACN,gBAAgB,EAAE,gBAAgB;gBAClC,eAAe,EAAE,UAAU,CAAC,QAAQ,CAAC,eAAe;gBACpD,OAAO,EAAE,oCAAoC,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,MAAM,MAAM,CAAC,MAAM,EAAE;aAC7F;SACF,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC;QACrD,GAAG;QACH,cAAc;QACd,WAAW,EAAE,GAAG,CAAC,IAAI;QACrB,WAAW,EAAE,GAAG,CAAC,OAAO;QACxB,SAAS,EAAE,MAAM,CAAC,OAAO;QACzB,MAAM;QACN,MAAM;QACN,QAAQ;QACR,SAAS,EAAE,WAAW,CAAC,SAAS;QAChC,WAAW,EAAE,WAAW,CAAC,WAAW;QACpC,oBAAoB,EAAE,WAAW,CAAC,oBAAoB;QACtD,qBAAqB,EAAE,WAAW,CAAC,qBAAqB;QACxD,SAAS,EAAE,WAAW,CAAC,SAAS;QAChC,sBAAsB,EAAE,WAAW,CAAC,4BAA4B;QAChE,UAAU;QACV,iBAAiB;QACjB,gBAAgB;QAChB,UAAU;KACX,CAAC,CAAC;IAEH,OAAO;QACL,MAAM,EAAE;YACN,GAAG,WAAW;YACd,eAAe,EAAE,UAAU,CAAC,QAAQ,CAAC,eAAe;YACpD,OAAO,EAAE,GAAG,WAAW,CAAC,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE;SACpE;KACF,CAAC;AACJ,CAAC"}

package/dist/remediation/local/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../src/remediation/local/run.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAIV,gBAAgB,EAChB,iBAAiB,EAElB,MAAM,yBAAyB,CAAC;AAajC,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,iBAAiB,CAAC,CA4P5B"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../src/remediation/local/run.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAIV,gBAAgB,EAChB,iBAAiB,EAElB,MAAM,yBAAyB,CAAC;AAajC,wBAAsB,2BAA2B,CAC/C,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,gBAAqB,GAC7B,OAAO,CAAC,iBAAiB,CAAC,CA4V5B"}

package/dist/remediation/local/run.js

@@ -5,6 +5,8 @@ import { enrichWithNvd } from "../../intelligence/sources/nvd.js";
 import { lookupCveOsv } from "../../intelligence/sources/osv.js";
 import { loadIntelligenceSnapshot, lookupSnapshotCve, } from "../../intelligence/sources/snapshot.js";
 import { computeEscalationAction } from "../../platform/escalation.js";
+import { findMaintainerVex, readInstalledMaintainerVex, } from "../../platform/maintainer-vex/index.js";
+import { loadMemoryConstraints, pinnedMessage, rejectedMessage, } from "../../platform/memory/consume.js";
 import { isPackageAllowed, loadPolicy } from "../../platform/policy.js";
 import { createProjectSnapshot } from "../../platform/rollback.js";
 import { resolvePatchGenerator } from "../patch/resolve.js";
@@ -14,7 +16,7 @@ import { applyDispositionAndContainment } from "./disposition.js";
 import { shouldAttemptPatchFallback, tryPatchFallback } from "./fallback.js";
 import { resolveLocalRunOptions } from "./options.js";
 import { resolvePrimaryResult } from "./primary-strategy.js";
-import { buildSbom } from "./sbom.js";
+import { buildSbom, sbomKey } from "./sbom.js";
 import { runSecOpsPreflight } from "./secops-preflight.js";
 import { buildLocalSummary } from "./summary.js";
 import { findVulnerablePackages } from "./vulnerability-match.js";
@@ -79,12 +81,39 @@ export async function runLocalRemediationPipeline(cveId, options = {}) {
     }
     const preflight = await runSecOpsPreflight(normalizedId, cveDetails, resolved);
     if (preflight.suppressed) {
+        // Nothing is modified for a suppressed CVE, but the report still names the installed copies it
+        // covers so VEX can assert not_affected and the SBOM can mark them suppressed.
+        const suppressedInventory = cveDetails.affectedPackages.length > 0
+            ? await checkInventoryTool.execute({
+                cwd,
+                packageManager,
+                policy: options.policy,
+                workspace: constraints.workspace,
+            })
+            : { packages: [] };
+        const suppressedInstalled = suppressedInventory.error ? [] : suppressedInventory.packages;
+        const suppressedPackages = findVulnerablePackages(cveDetails, suppressedInstalled);
+        const suppressedBy = {
+            justification: preflight.suppression.justification,
+            ...(preflight.suppression.notes ? { notes: preflight.suppression.notes } : {}),
+        };
+        const suppressedResults = suppressedPackages.map((vulnerable) => ({
+            packageName: vulnerable.installed.name,
+            fromVersion: vulnerable.installed.version,
+            strategy: "none",
+            applied: false,
+            dryRun,
+            dependencyScope: vulnerable.installed.type === "direct" ? "direct" : "transitive",
+            suppressedBy,
+            message: preflight.summary,
+        }));
         return {
             cveId,
             cveDetails,
-            vulnerablePackages: [],
-            results: [],
+            vulnerablePackages: suppressedPackages,
+            results: suppressedResults,
             summary: preflight.summary,
+            sbom: buildSbom(suppressedInstalled, new Set(suppressedPackages.map((v) => sbomKey(v.installed.name, v.installed.version))), suppressedResults),
             correlation,
         };
     }
@@ -124,8 +153,19 @@ export async function runLocalRemediationPipeline(cveId, options = {}) {
     const effectivePolicy = loadPolicy(cwd, options.policy);
     const containmentMode = options.containmentMode ?? effectivePolicy.containmentMode ?? false;
     const dispositionPolicy = options.dispositionPolicy ?? effectivePolicy.dispositionPolicy;
+    // What earlier runs and people recorded: pinned packages and upgrades that were tried and rejected.
+    const memory = resolved.ignoreMemory ? undefined : loadMemoryConstraints(cwd);
+    // Read the VEX documents installed packages ship once, and only when something is vulnerable.
+    let shippedVex;
     for (const vulnerable of vulnerablePackages) {
         const snapshot = await createProjectSnapshot(cwd);
+        shippedVex ??= readInstalledMaintainerVex(cwd);
+        const maintainerVex = findMaintainerVex(shippedVex, normalizedId, vulnerable.installed);
+        const withMaintainerVex = (result) => ({
+            ...result,
+            ...(maintainerVex.evidence.length > 0 ? { maintainerVex: maintainerVex.evidence } : {}),
+            ...(maintainerVex.ignored.length > 0 ? { maintainerVexIgnored: maintainerVex.ignored } : {}),
+        });
         const finalizePatchResult = (result) => {
             const withDisposition = applyDispositionAndContainment(result, {
                 exploitSignalTriggered,
@@ -139,7 +179,7 @@ export async function runLocalRemediationPipeline(cveId, options = {}) {
             if (withDisposition.unresolvedReason) {
                 withDisposition.escalationAction = computeEscalationAction(withDisposition.unresolvedReason, resolved.escalationGraph);
             }
-            return withDisposition;
+            return withMaintainerVex(withDisposition);
         };
         if (!isPackageAllowed(effectivePolicy, vulnerable.installed.name)) {
             collectedResults.push(finalizePatchResult({
@@ -153,6 +193,40 @@ export async function runLocalRemediationPipeline(cveId, options = {}) {
             }));
             continue;
         }
+        // A person's pin comes first: the package is left alone whatever else says.
+        const pinned = memory?.pinned.get(vulnerable.installed.name);
+        if (pinned) {
+            collectedResults.push(finalizePatchResult({
+                packageName: vulnerable.installed.name,
+                fromVersion: vulnerable.installed.version,
+                strategy: "none",
+                applied: false,
+                dryRun,
+                unresolvedReason: "constraint-blocked",
+                message: pinnedMessage(pinned),
+            }));
+            continue;
+        }
+        // Opt-in only: by default the maintainer's verdict is evidence and remediation goes ahead.
+        const maintainerClaim = maintainerVex.evidence[0];
+        if (resolved.trustMaintainerVex && maintainerClaim) {
+            const { maintainer } = maintainerClaim;
+            collectedResults.push(withMaintainerVex({
+                packageName: vulnerable.installed.name,
+                fromVersion: vulnerable.installed.version,
+                strategy: "none",
+                applied: false,
+                dryRun,
+                dependencyScope: vulnerable.installed.type === "direct" ? "direct" : "transitive",
+                suppressedBy: {
+                    justification: "not_affected",
+                    source: "maintainer-vex",
+                    notes: `${maintainer.name}@${maintainer.version} (${maintainerClaim.author}): ${maintainerClaim.justification}${maintainerClaim.impactStatement ? `. ${maintainerClaim.impactStatement}` : ""}`,
+                },
+                message: `Suppressed by maintainer VEX: ${maintainer.name}@${maintainer.version} (author ${maintainerClaim.author}) declares not_affected (${maintainerClaim.justification}) for ${normalizedId}.`,
+            }));
+            continue;
+        }
         if (resolved.skipUnreachable) {
             const reach = assessPackageReachability(cwd, vulnerable.installed.name);
             if (reach.status === "not-reachable") {
@@ -180,6 +254,11 @@ export async function runLocalRemediationPipeline(cveId, options = {}) {
             requireProofOfFix: resolved.requireProofOfFix,
             reproductionTest: options.reproductionTest,
             patchesDir: resolved.patchesDir,
+            offlineIntelligence: resolved.offlineIntelligence,
+            rejectedVersions: new Map([...(memory?.rejected.get(vulnerable.installed.name) ?? [])].map(([version, entry]) => [
+                version,
+                rejectedMessage(entry),
+            ])),
         });
         if (shouldAttemptPatchFallback(primary.result, constraints.preferVersionBump ?? false)) {
             const fallback = await tryPatchFallback({
@@ -216,8 +295,8 @@ export async function runLocalRemediationPipeline(cveId, options = {}) {
         };
         collectedResults.push(finalizePatchResult(primaryResult));
     }
-    const vulnerableNames = new Set(vulnerablePackages.map((v) => v.installed.name));
-    const sbom = buildSbom(installedPackages, vulnerableNames, collectedResults);
+    const vulnerableKeys = new Set(vulnerablePackages.map((v) => sbomKey(v.installed.name, v.installed.version)));
+    const sbom = buildSbom(installedPackages, vulnerableKeys, collectedResults);
     return {
         cveId,
         cveDetails,

package/dist/remediation/local/run.js.map

@@ -1 +1 @@
-{"version":3,"file":"run.js","sourceRoot":"","sources":["../../../src/remediation/local/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACpE,OAAO,EACL,eAAe,EACf,yBAAyB,GAC1B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EACL,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AASnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAElE,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAAa,EACb,OAAO,GAAqB,EAAE;IAE9B,MAAM,QAAQ,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,QAAQ,CAAC;IAE9D,MAAM,WAAW,GAAG;QAClB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC;IAEF,IAAI,gBAAiE,CAAC;IACtE,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,CAAC,gBAAgB,KAAK,qBAAqB,CAAC;QAC1C,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,KAAK,EAAE,QAAQ,CAAC,KAAK;KACtB,CAAC,CAAC,CAAC;IAEN,MAAM,gBAAgB,GAAkB,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,IAAI,kBAAkB,GAAwB,EAAE,CAAC;IACjD,IAAI,UAAU,GAAsB,IAAI,CAAC;IAEzC,MAAM,YAAY,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,UAAU,GAA6C,IAAI,CAAC;IAChE,IAAI,UAAU,GAAgD,EAAE,CAAC;IAEjE,IAAI,QAAQ,CAAC,mBAAmB,EAAE,CAAC;QACjC,IAAI,QAAQ,CAAC,wBAAwB,EAAE,CAAC;YACtC,UAAU,GAAG,iBAAiB,CAC5B,wBAAwB,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EAC3D,YAAY,CACb,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,CAAC,UAAU,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC3C,YAAY,CAAC,YAAY,CAAC;YAC1B,eAAe,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3C,OAAO;YACL,KAAK;YACL,UAAU,EAAE,IAAI;YAChB,kBAAkB;YAClB,OAAO,EAAE,gBAAgB;YACzB,OAAO,EAAE,QAAQ,CAAC,mBAAmB;gBACnC,CAAC,CAAC,iBAAiB,YAAY,sCAAsC;gBACrE,CAAC,CAAC,oCAAoC,YAAY,4CAA4C;YAChG,WAAW;SACZ,CAAC;IACJ,CAAC;IAED,UAAU,GAAG,UAAU,IAAI;QACzB,EAAE,EAAE,YAAY;QAChB,OAAO,EAAE,gDAAgD;QACzD,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,EAAE;QACd,gBAAgB,EAAE,EAAE;KACrB,CAAC;IAEF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,UAAU,GAAG,yBAAyB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,CAAC;QAClC,UAAU,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,CAAC;QAC7C,mGAAmG;QACnG,UAAU,GAAG,MAAM,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACjD,UAAU,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IAE/E,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;QACzB,OAAO;YACL,KAAK;YACL,UAAU;YACV,kBAAkB,EAAE,EAAE;YACtB,OAAO,EAAE,EAAE;YACX,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,WAAW;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,sBAAsB,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;IAE1D,IAAI,UAAU,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,OAAO;YACL,KAAK;YACL,UAAU;YACV,kBAAkB;YAClB,OAAO,EAAE,gBAAgB;YACzB,OAAO,EAAE,2EAA2E,YAAY,GAAG;YACnG,sBAAsB;YACtB,WAAW;YACX,WAAW;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC;QACjD,GAAG;QACH,cAAc;QACd,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,WAAW,CAAC,SAAS;KACjC,CAAC,CAAC;IAEH,IAAI,SAAS,EAAE,KAAK,EAAE,CAAC;QACrB,OAAO;YACL,KAAK;YACL,UAAU;YACV,kBAAkB;YAClB,OAAO,EAAE,gBAAgB;YACzB,OAAO,EAAE,yCAAyC,SAAS,CAAC,KAAK,EAAE;YACnE,sBAAsB;YACtB,WAAW;YACX,WAAW;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAG,CAAC,SAAS,CAAC,QAAQ,IAAI,EAAE,CAIjD,CAAC;IAEH,kBAAkB,GAAG,sBAAsB,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;IAE3E,MAAM,eAAe,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,eAAe,CAAC,eAAe,IAAI,KAAK,CAAC;IAC5F,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,eAAe,CAAC,iBAAiB,CAAC;IAEzF,KAAK,MAAM,UAAU,IAAI,kBAAkB,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAElD,MAAM,mBAAmB,GAAG,CAAC,MAAmB,EAAe,EAAE;YAC/D,MAAM,eAAe,GAAG,8BAA8B,CAAC,MAAM,EAAE;gBAC7D,sBAAsB;gBACtB,WAAW;gBACX,QAAQ,EAAE,UAAU,EAAE,QAAQ;gBAC9B,MAAM,EAAE,iBAAiB;gBACzB,eAAe;gBACf,GAAG;gBACH,QAAQ;aACT,CAAC,CAAC;YACH,IAAI,eAAe,CAAC,gBAAgB,EAAE,CAAC;gBACrC,eAAe,CAAC,gBAAgB,GAAG,uBAAuB,CACxD,eAAe,CAAC,gBAAgB,EAChC,QAAQ,CAAC,eAAe,CACzB,CAAC;YACJ,CAAC;YACD,OAAO,eAAe,CAAC;QACzB,CAAC,CAAC;QAEF,IAAI,CAAC,gBAAgB,CAAC,eAAe,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YAClE,gBAAgB,CAAC,IAAI,CACnB,mBAAmB,CAAC;gBAClB,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI;gBACtC,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,OAAO;gBACzC,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,KAAK;gBACd,MAAM;gBACN,gBAAgB,EAAE,gBAAgB;gBAClC,OAAO,EAAE,oDAAoD,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI;aAC3F,CAAC,CACH,CAAC;YACF,SAAS;QACX,CAAC;QAED,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,yBAAyB,CAAC,GAAG,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACxE,IAAI,KAAK,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;gBACrC,gBAAgB,CAAC,IAAI,CACnB,mBAAmB,CAAC;oBAClB,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI;oBACtC,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,OAAO;oBACzC,QAAQ,EAAE,MAAM;oBAChB,OAAO,EAAE,KAAK;oBACd,MAAM;oBACN,OAAO,EAAE,aAAa,UAAU,CAAC,SAAS,CAAC,IAAI,sCAAsC;oBACrF,YAAY,EAAE,KAAK;iBACpB,CAAC,CACH,CAAC;gBACF,SAAS;YACX,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC;YACzC,UAAU;YACV,GAAG;YACH,cAAc;YACd,MAAM;YACN,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,WAAW;YACX,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;YAC7C,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,UAAU,EAAE,QAAQ,CAAC,UAAU;SAChC,CAAC,CAAC;QAEH,IAAI,0BAA0B,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,iBAAiB,IAAI,KAAK,CAAC,EAAE,CAAC;YACvF,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC;gBACtC,GAAG;gBACH,cAAc;gBACd,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI;gBACtC,iBAAiB,EAAE,UAAU,CAAC,SAAS,CAAC,OAAO;gBAC/C,KAAK,EAAE,YAAY;gBACnB,UAAU,EAAE,UAAU,EAAE,OAAO,IAAI,YAAY;gBAC/C,eAAe,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;gBACjF,MAAM;gBACN,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,YAAY;gBACZ,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,yBAAyB,EAAE,QAAQ,CAAC,yBAAyB;gBAC7D,WAAW,EAAE,WAAW,CAAC,WAAW;gBACpC,oBAAoB,EAAE,WAAW,CAAC,oBAAoB;gBACtD,qBAAqB,EAAE,WAAW,CAAC,qBAAqB;gBACxD,SAAS,EAAE,WAAW,CAAC,SAAS;gBAChC,eAAe,EAAE,UAAU,CAAC,QAAQ,CAAC,eAAe;gBACpD,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;aAC9C,CAAC,CAAC;YACH,gBAAgB,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5D,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACnB,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;YACnC,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,aAAa,GAAgB;YACjC,GAAG,OAAO,CAAC,MAAM;YACjB,eAAe,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;SAClF,CAAC;QAEF,gBAAgB,CAAC,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACjF,MAAM,IAAI,GAAG,SAAS,CAAC,iBAAiB,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAC;IAE7E,OAAO;QACL,KAAK;QACL,UAAU;QACV,kBAAkB;QAClB,OAAO,EAAE,gBAAgB;QACzB,OAAO,EAAE,iBAAiB,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;QAChE,QAAQ,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;QACpD,sBAAsB;QACtB,WAAW;QACX,IAAI;QACJ,WAAW;KACZ,CAAC;AACJ,CAAC"}
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../../src/remediation/local/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACpE,OAAO,EACL,eAAe,EACf,yBAAyB,GAC1B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EACL,wBAAwB,EACxB,iBAAiB,GAClB,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EACL,iBAAiB,EACjB,0BAA0B,GAE3B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,qBAAqB,EACrB,aAAa,EACb,eAAe,GAChB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AASnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAElE,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAAa,EACb,OAAO,GAAqB,EAAE;IAE9B,MAAM,QAAQ,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,QAAQ,CAAC;IAE9D,MAAM,WAAW,GAAG;QAClB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC;IAEF,IAAI,gBAAiE,CAAC;IACtE,MAAM,YAAY,GAAG,GAAG,EAAE,CACxB,CAAC,gBAAgB,KAAK,qBAAqB,CAAC;QAC1C,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,KAAK,EAAE,QAAQ,CAAC,KAAK;KACtB,CAAC,CAAC,CAAC;IAEN,MAAM,gBAAgB,GAAkB,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,IAAI,kBAAkB,GAAwB,EAAE,CAAC;IACjD,IAAI,UAAU,GAAsB,IAAI,CAAC;IAEzC,MAAM,YAAY,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,UAAU,GAA6C,IAAI,CAAC;IAChE,IAAI,UAAU,GAAgD,EAAE,CAAC;IAEjE,IAAI,QAAQ,CAAC,mBAAmB,EAAE,CAAC;QACjC,IAAI,QAAQ,CAAC,wBAAwB,EAAE,CAAC;YACtC,UAAU,GAAG,iBAAiB,CAC5B,wBAAwB,CAAC,QAAQ,CAAC,wBAAwB,CAAC,EAC3D,YAAY,CACb,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,CAAC,UAAU,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC3C,YAAY,CAAC,YAAY,CAAC;YAC1B,eAAe,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3C,OAAO;YACL,KAAK;YACL,UAAU,EAAE,IAAI;YAChB,kBAAkB;YAClB,OAAO,EAAE,gBAAgB;YACzB,OAAO,EAAE,QAAQ,CAAC,mBAAmB;gBACnC,CAAC,CAAC,iBAAiB,YAAY,sCAAsC;gBACrE,CAAC,CAAC,oCAAoC,YAAY,4CAA4C;YAChG,WAAW;SACZ,CAAC;IACJ,CAAC;IAED,UAAU,GAAG,UAAU,IAAI;QACzB,EAAE,EAAE,YAAY;QAChB,OAAO,EAAE,gDAAgD;QACzD,QAAQ,EAAE,SAAS;QACnB,UAAU,EAAE,EAAE;QACd,gBAAgB,EAAE,EAAE;KACrB,CAAC;IAEF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,UAAU,GAAG,yBAAyB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,mBAAmB,EAAE,CAAC;QAClC,UAAU,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,CAAC;QAC7C,mGAAmG;QACnG,UAAU,GAAG,MAAM,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACjD,UAAU,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IAE/E,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;QACzB,+FAA+F;QAC/F,+EAA+E;QAC/E,MAAM,mBAAmB,GACvB,UAAU,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC;YACpC,CAAC,CAAC,MAAM,kBAAkB,CAAC,OAAO,CAAC;gBAC/B,GAAG;gBACH,cAAc;gBACd,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,SAAS,EAAE,WAAW,CAAC,SAAS;aACjC,CAAC;YACJ,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACvB,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC;QAC1F,MAAM,kBAAkB,GAAG,sBAAsB,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;QACnF,MAAM,YAAY,GAAG;YACnB,aAAa,EAAE,SAAS,CAAC,WAAW,CAAC,aAAa;YAClD,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/E,CAAC;QAEF,MAAM,iBAAiB,GAAkB,kBAAkB,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YAC/E,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI;YACtC,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,OAAO;YACzC,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,KAAK;YACd,MAAM;YACN,eAAe,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;YACjF,YAAY;YACZ,OAAO,EAAE,SAAS,CAAC,OAAO;SAC3B,CAAC,CAAC,CAAC;QAEJ,OAAO;YACL,KAAK;YACL,UAAU;YACV,kBAAkB,EAAE,kBAAkB;YACtC,OAAO,EAAE,iBAAiB;YAC1B,OAAO,EAAE,SAAS,CAAC,OAAO;YAC1B,IAAI,EAAE,SAAS,CACb,mBAAmB,EACnB,IAAI,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EACtF,iBAAiB,CAClB;YACD,WAAW;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,sBAAsB,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;IAE1D,IAAI,UAAU,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,OAAO;YACL,KAAK;YACL,UAAU;YACV,kBAAkB;YAClB,OAAO,EAAE,gBAAgB;YACzB,OAAO,EAAE,2EAA2E,YAAY,GAAG;YACnG,sBAAsB;YACtB,WAAW;YACX,WAAW;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC;QACjD,GAAG;QACH,cAAc;QACd,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,WAAW,CAAC,SAAS;KACjC,CAAC,CAAC;IAEH,IAAI,SAAS,EAAE,KAAK,EAAE,CAAC;QACrB,OAAO;YACL,KAAK;YACL,UAAU;YACV,kBAAkB;YAClB,OAAO,EAAE,gBAAgB;YACzB,OAAO,EAAE,yCAAyC,SAAS,CAAC,KAAK,EAAE;YACnE,sBAAsB;YACtB,WAAW;YACX,WAAW;SACZ,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAG,CAAC,SAAS,CAAC,QAAQ,IAAI,EAAE,CAIjD,CAAC;IAEH,kBAAkB,GAAG,sBAAsB,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;IAE3E,MAAM,eAAe,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,eAAe,CAAC,eAAe,IAAI,KAAK,CAAC;IAC5F,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,eAAe,CAAC,iBAAiB,CAAC;IACzF,oGAAoG;IACpG,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAE9E,8FAA8F;IAC9F,IAAI,UAA0C,CAAC;IAE/C,KAAK,MAAM,UAAU,IAAI,kBAAkB,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAElD,UAAU,KAAK,0BAA0B,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,aAAa,GAAG,iBAAiB,CAAC,UAAU,EAAE,YAAY,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;QACxF,MAAM,iBAAiB,GAAG,CAAC,MAAmB,EAAe,EAAE,CAAC,CAAC;YAC/D,GAAG,MAAM;YACT,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvF,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7F,CAAC,CAAC;QAEH,MAAM,mBAAmB,GAAG,CAAC,MAAmB,EAAe,EAAE;YAC/D,MAAM,eAAe,GAAG,8BAA8B,CAAC,MAAM,EAAE;gBAC7D,sBAAsB;gBACtB,WAAW;gBACX,QAAQ,EAAE,UAAU,EAAE,QAAQ;gBAC9B,MAAM,EAAE,iBAAiB;gBACzB,eAAe;gBACf,GAAG;gBACH,QAAQ;aACT,CAAC,CAAC;YACH,IAAI,eAAe,CAAC,gBAAgB,EAAE,CAAC;gBACrC,eAAe,CAAC,gBAAgB,GAAG,uBAAuB,CACxD,eAAe,CAAC,gBAAgB,EAChC,QAAQ,CAAC,eAAe,CACzB,CAAC;YACJ,CAAC;YACD,OAAO,iBAAiB,CAAC,eAAe,CAAC,CAAC;QAC5C,CAAC,CAAC;QAEF,IAAI,CAAC,gBAAgB,CAAC,eAAe,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YAClE,gBAAgB,CAAC,IAAI,CACnB,mBAAmB,CAAC;gBAClB,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI;gBACtC,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,OAAO;gBACzC,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,KAAK;gBACd,MAAM;gBACN,gBAAgB,EAAE,gBAAgB;gBAClC,OAAO,EAAE,oDAAoD,UAAU,CAAC,SAAS,CAAC,IAAI,IAAI;aAC3F,CAAC,CACH,CAAC;YACF,SAAS;QACX,CAAC;QAED,4EAA4E;QAC5E,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7D,IAAI,MAAM,EAAE,CAAC;YACX,gBAAgB,CAAC,IAAI,CACnB,mBAAmB,CAAC;gBAClB,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI;gBACtC,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,OAAO;gBACzC,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,KAAK;gBACd,MAAM;gBACN,gBAAgB,EAAE,oBAAoB;gBACtC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC;aAC/B,CAAC,CACH,CAAC;YACF,SAAS;QACX,CAAC;QAED,2FAA2F;QAC3F,MAAM,eAAe,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAClD,IAAI,QAAQ,CAAC,kBAAkB,IAAI,eAAe,EAAE,CAAC;YACnD,MAAM,EAAE,UAAU,EAAE,GAAG,eAAe,CAAC;YACvC,gBAAgB,CAAC,IAAI,CACnB,iBAAiB,CAAC;gBAChB,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI;gBACtC,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,OAAO;gBACzC,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,KAAK;gBACd,MAAM;gBACN,eAAe,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;gBACjF,YAAY,EAAE;oBACZ,aAAa,EAAE,cAAc;oBAC7B,MAAM,EAAE,gBAAgB;oBACxB,KAAK,EAAE,GAAG,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,KAAK,eAAe,CAAC,MAAM,MAAM,eAAe,CAAC,aAAa,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,eAAe,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;iBAChM;gBACD,OAAO,EAAE,iCAAiC,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,OAAO,YAAY,eAAe,CAAC,MAAM,4BAA4B,eAAe,CAAC,aAAa,SAAS,YAAY,GAAG;aACnM,CAAC,CACH,CAAC;YACF,SAAS;QACX,CAAC;QAED,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,yBAAyB,CAAC,GAAG,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACxE,IAAI,KAAK,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;gBACrC,gBAAgB,CAAC,IAAI,CACnB,mBAAmB,CAAC;oBAClB,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI;oBACtC,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,OAAO;oBACzC,QAAQ,EAAE,MAAM;oBAChB,OAAO,EAAE,KAAK;oBACd,MAAM;oBACN,OAAO,EAAE,aAAa,UAAU,CAAC,SAAS,CAAC,IAAI,sCAAsC;oBACrF,YAAY,EAAE,KAAK;iBACpB,CAAC,CACH,CAAC;gBACF,SAAS;YACX,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC;YACzC,UAAU;YACV,GAAG;YACH,cAAc;YACd,MAAM;YACN,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,WAAW;YACX,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;YAC7C,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;YACjD,gBAAgB,EAAE,IAAI,GAAG,CACvB,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;gBACrF,OAAO;gBACP,eAAe,CAAC,KAAK,CAAC;aACvB,CAAC,CACH;SACF,CAAC,CAAC;QAEH,IAAI,0BAA0B,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,iBAAiB,IAAI,KAAK,CAAC,EAAE,CAAC;YACvF,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC;gBACtC,GAAG;gBACH,cAAc;gBACd,WAAW,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI;gBACtC,iBAAiB,EAAE,UAAU,CAAC,SAAS,CAAC,OAAO;gBAC/C,KAAK,EAAE,YAAY;gBACnB,UAAU,EAAE,UAAU,EAAE,OAAO,IAAI,YAAY;gBAC/C,eAAe,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;gBACjF,MAAM;gBACN,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,YAAY;gBACZ,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,yBAAyB,EAAE,QAAQ,CAAC,yBAAyB;gBAC7D,WAAW,EAAE,WAAW,CAAC,WAAW;gBACpC,oBAAoB,EAAE,WAAW,CAAC,oBAAoB;gBACtD,qBAAqB,EAAE,WAAW,CAAC,qBAAqB;gBACxD,SAAS,EAAE,WAAW,CAAC,SAAS;gBAChC,eAAe,EAAE,UAAU,CAAC,QAAQ,CAAC,eAAe;gBACpD,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;aAC9C,CAAC,CAAC;YACH,gBAAgB,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5D,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACnB,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;YACnC,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,aAAa,GAAgB;YACjC,GAAG,OAAO,CAAC,MAAM;YACjB,eAAe,EAAE,UAAU,CAAC,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;SAClF,CAAC;QAEF,gBAAgB,CAAC,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAC9E,CAAC;IACF,MAAM,IAAI,GAAG,SAAS,CAAC,iBAAiB,EAAE,cAAc,EAAE,gBAAgB,CAAC,CAAC;IAE5E,OAAO;QACL,KAAK;QACL,UAAU;QACV,kBAAkB;QAClB,OAAO,EAAE,gBAAgB;QACzB,OAAO,EAAE,iBAAiB,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;QAChE,QAAQ,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;QACpD,sBAAsB;QACtB,WAAW;QACX,IAAI;QACJ,WAAW;KACZ,CAAC;AACJ,CAAC"}

package/dist/remediation/local/sbom.d.ts

@@ -1,7 +1,9 @@
 import type { InventoryPackage, PatchResult, SbomEntry } from "../../platform/types.js";
+/** Identity of one installed copy; a package can be installed at several versions. */
+export declare function sbomKey(name: string, version: string): string;
 /**
  * Build a Software Bill of Materials from the installed package inventory,
  * cross-referencing each package against the vulnerable and remediated sets.
  */
-export declare function buildSbom(packages: InventoryPackage[], vulnerableNames: Set<string>, results: PatchResult[]): SbomEntry[];
+export declare function buildSbom(packages: InventoryPackage[], vulnerableKeys: Set<string>, results: PatchResult[]): SbomEntry[];
 //# sourceMappingURL=sbom.d.ts.map

package/dist/remediation/local/sbom.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sbom.d.ts","sourceRoot":"","sources":["../../../src/remediation/local/sbom.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,SAAS,EAAc,MAAM,yBAAyB,CAAC;AAEpG;;;GAGG;AACH,wBAAgB,SAAS,CACvB,QAAQ,EAAE,gBAAgB,EAAE,EAC5B,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,EAC5B,OAAO,EAAE,WAAW,EAAE,GACrB,SAAS,EAAE,CA2Bb"}
+{"version":3,"file":"sbom.d.ts","sourceRoot":"","sources":["../../../src/remediation/local/sbom.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,SAAS,EAAc,MAAM,yBAAyB,CAAC;AAEpG,sFAAsF;AACtF,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED;;;GAGG;AACH,wBAAgB,SAAS,CACvB,QAAQ,EAAE,gBAAgB,EAAE,EAC5B,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,EAC3B,OAAO,EAAE,WAAW,EAAE,GACrB,SAAS,EAAE,CA6Bb"}

package/dist/remediation/local/sbom.js

@@ -1,34 +1,40 @@
+/** Identity of one installed copy; a package can be installed at several versions. */
+export function sbomKey(name, version) {
+    return `${name}@${version}`;
+}
 /**
  * Build a Software Bill of Materials from the installed package inventory,
  * cross-referencing each package against the vulnerable and remediated sets.
  */
-export function buildSbom(packages, vulnerableNames, results) {
-    const statusByPackage = new Map();
+export function buildSbom(packages, vulnerableKeys, results) {
+    const statusByCopy = new Map();
     for (const result of results) {
-        if (!vulnerableNames.has(result.packageName))
+        const key = sbomKey(result.packageName, result.fromVersion);
+        if (!vulnerableKeys.has(key))
             continue;
         if (result.suppressedBy) {
-            statusByPackage.set(result.packageName, "suppressed");
+            statusByCopy.set(key, "suppressed");
         }
         else if (!result.applied && result.strategy === "none") {
-            statusByPackage.set(result.packageName, "skipped");
+            statusByCopy.set(key, "skipped");
         }
         else if (result.applied) {
-            statusByPackage.set(result.packageName, "patched");
+            statusByCopy.set(key, "patched");
         }
         else {
-            statusByPackage.set(result.packageName, "unpatched");
+            statusByCopy.set(key, "unpatched");
         }
     }
     return packages.map((pkg) => {
-        const isVulnerable = vulnerableNames.has(pkg.name);
+        const key = sbomKey(pkg.name, pkg.version);
+        const isVulnerable = vulnerableKeys.has(key);
         const entry = {
             name: pkg.name,
             version: pkg.version,
             scope: pkg.type === "direct" ? "direct" : "transitive",
         };
         if (isVulnerable) {
-            entry.status = statusByPackage.get(pkg.name) ?? "unpatched";
+            entry.status = statusByCopy.get(key) ?? "unpatched";
         }
         return entry;
     });

package/dist/remediation/local/sbom.js.map

@@ -1 +1 @@
-{"version":3,"file":"sbom.js","sourceRoot":"","sources":["../../../src/remediation/local/sbom.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,UAAU,SAAS,CACvB,QAA4B,EAC5B,eAA4B,EAC5B,OAAsB;IAEtB,MAAM,eAAe,GAAG,IAAI,GAAG,EAAsB,CAAC;IACtD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC;YAAE,SAAS;QACvD,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QACxD,CAAC;aAAM,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YACzD,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACrD,CAAC;aAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAC1B,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACrD,CAAC;aAAM,CAAC;YACN,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAC1B,MAAM,YAAY,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,KAAK,GAAc;YACvB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;SACvD,CAAC;QACF,IAAI,YAAY,EAAE,CAAC;YACjB,KAAK,CAAC,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC;QAC9D,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"sbom.js","sourceRoot":"","sources":["../../../src/remediation/local/sbom.ts"],"names":[],"mappings":"AAEA,sFAAsF;AACtF,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,OAAe;IACnD,OAAO,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CACvB,QAA4B,EAC5B,cAA2B,EAC3B,OAAsB;IAEtB,MAAM,YAAY,GAAG,IAAI,GAAG,EAAsB,CAAC;IACnD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QAC5D,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACvC,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QACtC,CAAC;aAAM,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YACzD,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACnC,CAAC;aAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAC1B,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,YAAY,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAc;YACvB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY;SACvD,CAAC;QACF,IAAI,YAAY,EAAE,CAAC;YACjB,KAAK,CAAC,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC;QACtD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/remediation/local/secops-preflight.d.ts

@@ -2,7 +2,7 @@
  * SecOps pre-flight checks for the local remediation pipeline.
  *
  * Runs before inventory and per-package remediation:
- *   1. VEX suppression — exits early if the CVE is actively suppressed
+ *   1. VEX suppression — stops remediation if the CVE is actively suppressed
  *   2. Exploit signal — KEV / EPSS override gate
  *   3. SLA breach — detects response-window violations
  */
@@ -17,6 +17,7 @@ export interface SecOpsPreflightOptions {
 export type SecOpsPreflightResult = {
     suppressed: true;
     summary: string;
+    suppression: VexSuppression;
 } | {
     suppressed: false;
     exploitSignalTriggered?: boolean;

package/dist/remediation/local/secops-preflight.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secops-preflight.d.ts","sourceRoot":"","sources":["../../../src/remediation/local/secops-preflight.ts"],"names":[],"mappings":"AAKA;;;;;;;GAOG;AACH,OAAO,KAAK,EACV,UAAU,EACV,2BAA2B,EAC3B,SAAS,EACT,SAAS,EACT,cAAc,EACf,MAAM,yBAAyB,CAAC;AAGjC,MAAM,WAAW,sBAAsB;IACrC,YAAY,EAAE,cAAc,EAAE,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qBAAqB,CAAC,EAAE,2BAA2B,CAAC;IACpD,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,UAAU,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACrC;IACE,UAAU,EAAE,KAAK,CAAC;IAClB,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,WAAW,CAAC,EAAE,SAAS,EAAE,CAAC;CAC3B,CAAC;AAEN,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,qBAAqB,CAAC,CA4ChC"}
+{"version":3,"file":"secops-preflight.d.ts","sourceRoot":"","sources":["../../../src/remediation/local/secops-preflight.ts"],"names":[],"mappings":"AAKA;;;;;;;GAOG;AACH,OAAO,KAAK,EACV,UAAU,EACV,2BAA2B,EAC3B,SAAS,EACT,SAAS,EACT,cAAc,EACf,MAAM,yBAAyB,CAAC;AAGjC,MAAM,WAAW,sBAAsB;IACrC,YAAY,EAAE,cAAc,EAAE,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qBAAqB,CAAC,EAAE,2BAA2B,CAAC;IACpD,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,UAAU,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,cAAc,CAAA;CAAE,GAClE;IACE,UAAU,EAAE,KAAK,CAAC;IAClB,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,WAAW,CAAC,EAAE,SAAS,EAAE,CAAC;CAC3B,CAAC;AAEN,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,qBAAqB,CAAC,CA6ChC"}

package/dist/remediation/local/secops-preflight.js

@@ -9,6 +9,7 @@ export async function runSecOpsPreflight(normalizedId, cveDetails, opts) {
         return {
             suppressed: true,
             summary: `CVE ${normalizedId} suppressed by VEX policy: ${activeSuppression.justification}${activeSuppression.notes ? ` — ${activeSuppression.notes}` : ""}`,
+            suppression: activeSuppression,
         };
     }
     let exploitSignalTriggered;

package/dist/remediation/local/secops-preflight.js.map

@@ -1 +1 @@
-{"version":3,"file":"secops-preflight.js","sourceRoot":"","sources":["../../../src/remediation/local/secops-preflight.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAgBlC,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAkB1E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,YAAoB,EACpB,UAAsB,EACtB,IAA4B;IAE5B,MAAM,eAAe,GAAG,IAAI,CAAC,gBAAgB;QAC3C,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,YAAY,EAAE,GAAG,oBAAoB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACxE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;IAEtB,MAAM,iBAAiB,GAAG,eAAe,CAAC,IAAI,CAC5C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,YAAY,IAAI,mBAAmB,CAAC,CAAC,CAAC,CAC1D,CAAC;IACF,IAAI,iBAAiB,EAAE,CAAC;QACtB,OAAO;YACL,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE,OAAO,YAAY,8BAA8B,iBAAiB,CAAC,aAAa,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;SAC7J,CAAC;IACJ,CAAC;IAED,IAAI,sBAA2C,CAAC;IAChD,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC;YAClD,UAAU,EAAE;gBACV,EAAE,EAAE,UAAU,CAAC,EAAE;gBACjB,GAAG,EAAE,UAAU,CAAC,GAAG;gBACnB,IAAI,EAAE,UAAU,CAAC,IAAI;aACtB;YACD,MAAM,EAAE,EAAE,qBAAqB,EAAE,IAAI,CAAC,qBAAqB,EAAE;SAC9D,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,sBAAsB,EAAE,CAAC;YAClC,sBAAsB,GAAG,IAAI,CAAC;QAChC,CAAC;IACH,CAAC;IAED,IAAI,WAAoC,CAAC;IACzC,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAG,cAAc,CAC3B,YAAY,EACZ,UAAU,CAAC,QAAQ,EACnB,UAAU,CAAC,WAAW,EACtB,IAAI,CAAC,SAAS,CACf,CAAC;QACF,IAAI,MAAM,EAAE,CAAC;YACX,WAAW,GAAG,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,sBAAsB,EAAE,WAAW,EAAE,CAAC;AACpE,CAAC"}
+{"version":3,"file":"secops-preflight.js","sourceRoot":"","sources":["../../../src/remediation/local/secops-preflight.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAgBlC,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAkB1E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,YAAoB,EACpB,UAAsB,EACtB,IAA4B;IAE5B,MAAM,eAAe,GAAG,IAAI,CAAC,gBAAgB;QAC3C,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,YAAY,EAAE,GAAG,oBAAoB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACxE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;IAEtB,MAAM,iBAAiB,GAAG,eAAe,CAAC,IAAI,CAC5C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,YAAY,IAAI,mBAAmB,CAAC,CAAC,CAAC,CAC1D,CAAC;IACF,IAAI,iBAAiB,EAAE,CAAC;QACtB,OAAO;YACL,UAAU,EAAE,IAAI;YAChB,OAAO,EAAE,OAAO,YAAY,8BAA8B,iBAAiB,CAAC,aAAa,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,iBAAiB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YAC5J,WAAW,EAAE,iBAAiB;SAC/B,CAAC;IACJ,CAAC;IAED,IAAI,sBAA2C,CAAC;IAChD,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC;YAClD,UAAU,EAAE;gBACV,EAAE,EAAE,UAAU,CAAC,EAAE;gBACjB,GAAG,EAAE,UAAU,CAAC,GAAG;gBACnB,IAAI,EAAE,UAAU,CAAC,IAAI;aACtB;YACD,MAAM,EAAE,EAAE,qBAAqB,EAAE,IAAI,CAAC,qBAAqB,EAAE;SAC9D,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,sBAAsB,EAAE,CAAC;YAClC,sBAAsB,GAAG,IAAI,CAAC;QAChC,CAAC;IACH,CAAC;IAED,IAAI,WAAoC,CAAC;IACzC,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAG,cAAc,CAC3B,YAAY,EACZ,UAAU,CAAC,QAAQ,EACnB,UAAU,CAAC,WAAW,EACtB,IAAI,CAAC,SAAS,CACf,CAAC;QACF,IAAI,MAAM,EAAE,CAAC;YACX,WAAW,GAAG,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,sBAAsB,EAAE,WAAW,EAAE,CAAC;AACpE,CAAC"}

package/dist/remediation/local/select-target.d.ts

@@ -0,0 +1,53 @@
+import { resolveSafeUpgradeVersion } from "../../intelligence/sources/registry.js";
+import type { RegistryConfig } from "../../platform/registry-config.js";
+import { verifyPackageTrust } from "../../platform/supply-chain.js";
+import type { SupplyChainPolicy } from "../../platform/types.js";
+export interface SkippedCandidate {
+    version: string;
+    reason: string;
+}
+export type TargetSelection = {
+    status: "selected";
+    version: string;
+    knownAdvisories?: number;
+    skipped: SkippedCandidate[];
+} | {
+    status: "no-safe-version";
+} | {
+    status: "trust-blocked";
+    version: string;
+    reason?: string;
+}
+/** Every fixed version was rejected earlier (see remediation memory). */
+ | {
+    status: "memory-blocked";
+    version: string;
+    reason: string;
+};
+export interface SelectTargetParams {
+    packageName: string;
+    installedVersion: string;
+    firstPatchedVersion: string;
+    vulnerableRange?: string;
+    registry?: RegistryConfig;
+    supplyChainPolicy?: SupplyChainPolicy;
+    /** Skip the advisory lookup on candidate versions (offline intelligence). */
+    offline?: boolean;
+    /** Versions of this package that remediation memory says were tried and rejected, with why. */
+    rejected?: ReadonlyMap<string, string>;
+}
+export interface SelectTargetDeps {
+    resolve: typeof resolveSafeUpgradeVersion;
+    verifyTrust: typeof verifyPackageTrust;
+    queryAdvisories: (packageName: string, version: string) => Promise<unknown[]>;
+}
+/**
+ * Choose the version to move to. Walks the fixed versions best-first and takes the first that
+ * passes the supply-chain trust gate and has no known advisories of its own. A fixed version that
+ * is itself vulnerable is only used when no clean one is available, because moving onto another
+ * advisory is still progress. An advisory lookup that fails never blocks the choice.
+ */
+export declare function selectUpgradeTarget(params: SelectTargetParams, deps?: SelectTargetDeps): Promise<TargetSelection>;
+/** Suffix for result messages naming candidates passed over on the way to the chosen version. */
+export declare function describeSkipped(skipped: SkippedCandidate[]): string;
+//# sourceMappingURL=select-target.d.ts.map

package/dist/remediation/local/select-target.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"select-target.d.ts","sourceRoot":"","sources":["../../../src/remediation/local/select-target.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,wCAAwC,CAAC;AACnF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAKjE,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,gBAAgB,EAAE,CAAA;CAAE,GAC9F;IAAE,MAAM,EAAE,iBAAiB,CAAA;CAAE,GAC7B;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;AAC/D,yEAAyE;GACvE;IAAE,MAAM,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElE,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,6EAA6E;IAC7E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,+FAA+F;IAC/F,QAAQ,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,yBAAyB,CAAC;IAC1C,WAAW,EAAE,OAAO,kBAAkB,CAAC;IACvC,eAAe,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;CAC/E;AAQD;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,kBAAkB,EAC1B,IAAI,GAAE,gBAA8B,GACnC,OAAO,CAAC,eAAe,CAAC,CA+D1B;AAED,iGAAiG;AACjG,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAGnE"}