autoremediator 0.21.2 → 0.22.0

package/dist/remediation/local/select-target.js

@@ -0,0 +1,74 @@
+import { queryOsvPackage } from "../../intelligence/sources/osv.js";
+import { resolveSafeUpgradeVersion } from "../../intelligence/sources/registry.js";
+import { verifyPackageTrust } from "../../platform/supply-chain.js";
+/** Candidates examined per package; each one can cost a trust-gate and an advisory request. */
+const MAX_CANDIDATES_CHECKED = 5;
+const defaultDeps = {
+    resolve: resolveSafeUpgradeVersion,
+    verifyTrust: verifyPackageTrust,
+    queryAdvisories: queryOsvPackage,
+};
+/**
+ * Choose the version to move to. Walks the fixed versions best-first and takes the first that
+ * passes the supply-chain trust gate and has no known advisories of its own. A fixed version that
+ * is itself vulnerable is only used when no clean one is available, because moving onto another
+ * advisory is still progress. An advisory lookup that fails never blocks the choice.
+ */
+export async function selectUpgradeTarget(params, deps = defaultDeps) {
+    const resolution = await deps.resolve(params.packageName, params.installedVersion, params.firstPatchedVersion, params.vulnerableRange, params.registry);
+    if (resolution.ordered.length === 0)
+        return { status: "no-safe-version" };
+    const skipped = [];
+    let firstBlocked;
+    let withAdvisories;
+    // Versions memory says were rejected are passed over, and do not use up the candidates examined.
+    const remembered = resolution.ordered.filter((version) => params.rejected?.has(version));
+    for (const version of remembered) {
+        skipped.push({ version, reason: params.rejected.get(version) });
+    }
+    const candidates = resolution.ordered.filter((version) => !params.rejected?.has(version));
+    if (candidates.length === 0 && remembered.length > 0) {
+        const [first] = remembered;
+        return { status: "memory-blocked", version: first, reason: params.rejected.get(first) };
+    }
+    for (const version of candidates.slice(0, MAX_CANDIDATES_CHECKED)) {
+        const trust = await deps.verifyTrust(params.packageName, version, params.supplyChainPolicy, params.registry);
+        if (!trust.trusted) {
+            firstBlocked ??= { version, reason: trust.reason };
+            skipped.push({ version, reason: `supply-chain trust gate: ${trust.reason ?? "rejected"}` });
+            continue;
+        }
+        if (params.offline)
+            return { status: "selected", version, skipped };
+        let count;
+        try {
+            count = (await deps.queryAdvisories(params.packageName, version)).length;
+        }
+        catch {
+            count = undefined;
+        }
+        if (count === undefined || count === 0) {
+            return { status: "selected", version, knownAdvisories: count, skipped };
+        }
+        withAdvisories ??= { version, count };
+        skipped.push({ version, reason: `${count} known advisories` });
+    }
+    if (withAdvisories) {
+        return {
+            status: "selected",
+            version: withAdvisories.version,
+            knownAdvisories: withAdvisories.count,
+            skipped: skipped.filter((entry) => entry.version !== withAdvisories.version),
+        };
+    }
+    if (firstBlocked)
+        return { status: "trust-blocked", ...firstBlocked };
+    return { status: "no-safe-version" };
+}
+/** Suffix for result messages naming candidates passed over on the way to the chosen version. */
+export function describeSkipped(skipped) {
+    if (skipped.length === 0)
+        return "";
+    return ` Skipped ${skipped.map((entry) => `${entry.version} (${entry.reason})`).join(", ")}.`;
+}
+//# sourceMappingURL=select-target.js.map

package/dist/remediation/local/select-target.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"select-target.js","sourceRoot":"","sources":["../../../src/remediation/local/select-target.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACpE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wCAAwC,CAAC;AAEnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AAGpE,+FAA+F;AAC/F,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAiCjC,MAAM,WAAW,GAAqB;IACpC,OAAO,EAAE,yBAAyB;IAClC,WAAW,EAAE,kBAAkB;IAC/B,eAAe,EAAE,eAAe;CACjC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAA0B,EAC1B,IAAI,GAAqB,WAAW;IAEpC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CACnC,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,gBAAgB,EACvB,MAAM,CAAC,mBAAmB,EAC1B,MAAM,CAAC,eAAe,EACtB,MAAM,CAAC,QAAQ,CAChB,CAAC;IACF,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAE1E,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,IAAI,YAA8D,CAAC;IACnE,IAAI,cAA8D,CAAC;IAEnE,iGAAiG;IACjG,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IACzF,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,QAAS,CAAC,GAAG,CAAC,OAAO,CAAE,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1F,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,KAAM,EAAE,MAAM,EAAE,MAAM,CAAC,QAAS,CAAC,GAAG,CAAC,KAAM,CAAE,EAAE,CAAC;IAC9F,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,sBAAsB,CAAC,EAAE,CAAC;QAClE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAClC,MAAM,CAAC,WAAW,EAClB,OAAO,EACP,MAAM,CAAC,iBAAiB,EACxB,MAAM,CAAC,QAAQ,CAChB,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,YAAY,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YACnD,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,4BAA4B,KAAK,CAAC,MAAM,IAAI,UAAU,EAAE,EAAE,CAAC,CAAC;YAC5F,SAAS;QACX,CAAC;QAED,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QAEpE,IAAI,KAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3E,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,GAAG,SAAS,CAAC;QACpB,CAAC;QACD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YACvC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAC1E,CAAC;QACD,cAAc,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,mBAAmB,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO;YACL,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,cAAc,CAAC,OAAO;YAC/B,eAAe,EAAE,cAAc,CAAC,KAAK;YACrC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,cAAc,CAAC,OAAO,CAAC;SAC7E,CAAC;IACJ,CAAC;IACD,IAAI,YAAY;QAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,YAAY,EAAE,CAAC;IACtE,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;AACvC,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,eAAe,CAAC,OAA2B;IACzD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,OAAO,YAAY,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AAChG,CAAC"}

package/dist/remediation/patch/llm-generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"llm-generator.d.ts","sourceRoot":"","sources":["../../../src/remediation/patch/llm-generator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,aAAa,EAAE,MAAM,IAAI,CAAC;AAGxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAkBxE,mGAAmG;AACnG,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,aAAa,GAAG,cAAc,CAuB5E"}
+{"version":3,"file":"llm-generator.d.ts","sourceRoot":"","sources":["../../../src/remediation/patch/llm-generator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,IAAI,CAAC;AAG9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAkBxE,mGAAmG;AACnG,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,aAAa,GAAG,cAAc,CAuB5E"}

package/dist/remediation/patch/llm-generator.js

@@ -1,4 +1,4 @@
-import { generateObject } from "ai";
+import { generateText, Output } from "ai";
 import { z } from "zod";
 import { buildPatchPrompt, PATCH_SYSTEM_PROMPT } from "./prompt.js";
 const proposalSchema = z.object({
@@ -19,15 +19,15 @@ export function createLlmPatchGenerator(model) {
     return {
         async propose(request) {
             const started = Date.now();
-            const { object, usage } = await generateObject({
+            const { output, usage } = await generateText({
                 model,
-                schema: proposalSchema,
+                output: Output.object({ schema: proposalSchema }),
                 system: PATCH_SYSTEM_PROMPT,
                 prompt: buildPatchPrompt(request),
                 temperature: 0,
             });
             return {
-                ...object,
+                ...output,
                 usage: {
                     model: modelName(model),
                     latencyMs: Date.now() - started,

package/dist/remediation/patch/llm-generator.js.map

@@ -1 +1 @@
-{"version":3,"file":"llm-generator.js","sourceRoot":"","sources":["../../../src/remediation/patch/llm-generator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAsB,MAAM,IAAI,CAAC;AACxD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEpE,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gEAAgE,CAAC;IAC/F,UAAU,EAAE,CAAC;SACV,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;SAC9B,QAAQ,CAAC,mFAAmF,CAAC;IAChG,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,6CAA6C,CAAC;IAC5F,SAAS,EAAE,CAAC;SACT,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;SAC/B,QAAQ,CAAC,gDAAgD,CAAC;CAC9D,CAAC,CAAC;AAEH,SAAS,SAAS,CAAC,KAAoB;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;AAC3D,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,uBAAuB,CAAC,KAAoB;IAC1D,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3B,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,cAAc,CAAC;gBAC7C,KAAK;gBACL,MAAM,EAAE,cAAc;gBACtB,MAAM,EAAE,mBAAmB;gBAC3B,MAAM,EAAE,gBAAgB,CAAC,OAAO,CAAC;gBACjC,WAAW,EAAE,CAAC;aACf,CAAC,CAAC;YAEH,OAAO;gBACL,GAAG,MAAM;gBACT,KAAK,EAAE;oBACL,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC;oBACvB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;oBAC/B,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;iBACjC;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"llm-generator.js","sourceRoot":"","sources":["../../../src/remediation/patch/llm-generator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,EAAsB,MAAM,IAAI,CAAC;AAC9D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEpE,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gEAAgE,CAAC;IAC/F,UAAU,EAAE,CAAC;SACV,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;SAC9B,QAAQ,CAAC,mFAAmF,CAAC;IAChG,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,6CAA6C,CAAC;IAC5F,SAAS,EAAE,CAAC;SACT,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;SAC/B,QAAQ,CAAC,gDAAgD,CAAC;CAC9D,CAAC,CAAC;AAEH,SAAS,SAAS,CAAC,KAAoB;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;AAC3D,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,uBAAuB,CAAC,KAAoB;IAC1D,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3B,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,YAAY,CAAC;gBAC3C,KAAK;gBACL,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;gBACjD,MAAM,EAAE,mBAAmB;gBAC3B,MAAM,EAAE,gBAAgB,CAAC,OAAO,CAAC;gBACjC,WAAW,EAAE,CAAC;aACf,CAAC,CAAC;YAEH,OAAO;gBACL,GAAG,MAAM;gBACT,KAAK,EAAE;oBACL,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC;oBACvB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO;oBAC/B,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;iBACjC;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/remediation/radar/changelog.d.ts

@@ -0,0 +1,38 @@
+import { type RadarFlag } from "./types.js";
+export interface ClassifiedLine {
+    /** 1-based line within the document the text came from. */
+    line: number;
+    text: string;
+    points: number;
+    terms: string[];
+}
+/** Score one line of release text with the fixed vocabulary. Zero when nothing relevant, or all negated. */
+export declare function classifyLine(text: string): {
+    points: number;
+    terms: string[];
+};
+export interface ChangelogSection {
+    version: string;
+    /** 1-based line of the heading. */
+    startLine: number;
+    lines: Array<{
+        line: number;
+        text: string;
+    }>;
+}
+/** Split release history into one section per version found in its headings. */
+export declare function parseChangelog(text: string): ChangelogSection[];
+/** Lines of a section that look security-relevant, best first. */
+export declare function classifySection(section: ChangelogSection): ClassifiedLine[];
+export interface ChangelogSignalInput {
+    /** Document name for locations, e.g. `CHANGELOG.md` or `GitHub release`. */
+    source: string;
+    sections: ChangelogSection[];
+    from: string;
+    to: string;
+}
+/** Flags for the releases in `(from, to]`: the best few lines of each release that scored at all. */
+export declare function changelogFlags(input: ChangelogSignalInput): RadarFlag[];
+/** Whether any text mentions security with a strong or medium term, un-negated. Used for deprecation notices. */
+export declare function mentionsSecurity(text: string): boolean;
+//# sourceMappingURL=changelog.d.ts.map

package/dist/remediation/radar/changelog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"changelog.d.ts","sourceRoot":"","sources":["../../../src/remediation/radar/changelog.ts"],"names":[],"mappings":"AASA,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,YAAY,CAAC;AAiI1D,MAAM,WAAW,cAAc;IAC7B,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AA2ED,4GAA4G;AAC5G,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAkB9E;AAMD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9C;AA0BD,gFAAgF;AAChF,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAiB/D;AAmBD,kEAAkE;AAClE,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,cAAc,EAAE,CAsB3E;AAED,MAAM,WAAW,oBAAoB;IACnC,4EAA4E;IAC5E,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,qGAAqG;AACrG,wBAAgB,cAAc,CAAC,KAAK,EAAE,oBAAoB,GAAG,SAAS,EAAE,CAsBvE;AAED,iHAAiH;AACjH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtD"}

package/dist/remediation/radar/changelog.js

@@ -0,0 +1,311 @@
+/**
+ * Changelog and release-note signals: split release history into per-version sections, then score
+ * each line with a fixed vocabulary of security terms. Matching is by word boundary, negation is
+ * understood ("no security issues", "not a vulnerability"), and the text only ever contributes by
+ * which fixed terms it contains, never by what it asks for.
+ */
+import semver from "semver";
+import { evidenceLine, sanitizeEvidence } from "./sanitize.js";
+import { RADAR_POINTS } from "./types.js";
+const TERMS = [
+    { id: "cve", pattern: /\bCVE-\d{4}-\d{4,}\b/gi, strength: "strong" },
+    { id: "ghsa", pattern: /\bGHSA(?:-[23456789cfghjmpqrvwx]{4}){3}\b/gi, strength: "strong" },
+    { id: "prototype-pollution", pattern: /\bprototype[- ]pollution\b/gi, strength: "strong" },
+    { id: "redos", pattern: /\bredos\b/gi, strength: "strong" },
+    {
+        id: "regex-dos",
+        pattern: /\b(?:regex(?:p)?|regular expression)s? denial[- ]of[- ]service\b/gi,
+        strength: "strong",
+    },
+    { id: "backtracking", pattern: /\bcatastrophic backtracking\b/gi, strength: "strong" },
+    { id: "path-traversal", pattern: /\b(?:path|directory) traversal\b/gi, strength: "strong" },
+    { id: "ssrf", pattern: /\bssrf\b/gi, strength: "strong" },
+    {
+        id: "xss",
+        pattern: /\bxss\b|\bcross[- ]site[- ]scripting\b/gi,
+        strength: "strong",
+        bare: true,
+    },
+    {
+        id: "injection",
+        pattern: /\b(?:command|code|sql|shell|template|html|script|header|argument|os command) injection\b/gi,
+        strength: "strong",
+    },
+    { id: "rce", pattern: /\bremote code execution\b|\bRCE\b/g, strength: "strong" },
+    {
+        id: "arbitrary",
+        pattern: /\barbitrary (?:code|command|file|script)s?\b/gi,
+        strength: "strong",
+    },
+    { id: "xxe", pattern: /\bxxe\b|\bxml external entit(?:y|ies)\b/gi, strength: "strong" },
+    { id: "open-redirect", pattern: /\bopen redirect\b/gi, strength: "strong" },
+    {
+        id: "security-fix",
+        pattern: /\bsecurity[- ](?:fix(?:es)?|patch(?:es)?|vulnerabilit(?:y|ies)|advisor(?:y|ies)|issues?|bugs?|holes?|updates?|releases?)\b/gi,
+        strength: "strong",
+    },
+    { id: "vulnerability", pattern: /\bvulnerab(?:le|ility|ilities)\b/gi, strength: "medium" },
+    { id: "security", pattern: /\bsecurity\b/gi, strength: "medium", bare: true },
+    { id: "exploit", pattern: /\bexploit(?:s|ed|able|ation)?\b/gi, strength: "medium" },
+    { id: "dos", pattern: /\bdenial[- ]of[- ]service\b|\bDoS\b/g, strength: "medium" },
+    { id: "csrf", pattern: /\bcsrf\b/gi, strength: "medium" },
+    { id: "timing", pattern: /\btiming (?:attacks?|side[- ]channels?)\b/gi, strength: "medium" },
+    {
+        id: "overflow",
+        pattern: /\bbuffer (?:over(?:flow|run)|over-read)\b|\bout[- ]of[- ]bounds\b/gi,
+        strength: "medium",
+    },
+    {
+        id: "disclosure",
+        pattern: /\binformation (?:disclosure|leak)\b|\b(?:secret|token|credential|password)s? leak/gi,
+        strength: "medium",
+    },
+    {
+        id: "escalation",
+        pattern: /\bprivilege escalation\b|\bsandbox escape\b/gi,
+        strength: "medium",
+    },
+    { id: "insecure", pattern: /\binsecure(?:ly)?\b/gi, strength: "medium", participle: true },
+    { id: "sanitize", pattern: /\bsaniti[sz]\w*/gi, strength: "mild", bare: true, participle: true },
+    {
+        id: "escape",
+        pattern: /\bescap(?:e|es|ed|ing)\b/gi,
+        strength: "mild",
+        bare: true,
+        participle: true,
+    },
+    { id: "unsafe", pattern: /\bunsafe(?:ly)?\b/gi, strength: "mild", bare: true, participle: true },
+    { id: "malicious", pattern: /\bmalicious(?:ly)?\b/gi, strength: "mild" },
+    { id: "untrusted", pattern: /\buntrusted\b/gi, strength: "mild" },
+    { id: "attacker", pattern: /\battack(?:er|ers|s)?\b/gi, strength: "mild", bare: true },
+    { id: "harden", pattern: /\bharden(?:ed|ing)?\b/gi, strength: "mild" },
+    {
+        id: "validate",
+        pattern: /\bvalidat(?:e|es|ed|ing|ion)\b/gi,
+        strength: "mild",
+        bare: true,
+        participle: true,
+    },
+];
+/** Phrases that look like a term but are not security: matched ranges are removed before matching. */
+const NOT_SECURITY = /\bmemory[- ]leaks?\b|\bsecurity[- ]?(?:conscious)\b|\bnon-?security\b/gi;
+const NEGATORS = /\b(?:no|not|non|without|never|nothing|none|neither|nor|cannot|n\/a|unrelated|irrelevant)(?![-\w])|\b\w+n't\b|\bfree of\b|\black(?:s|ing)? of\b/i;
+const POST_NEGATION = /^\W*(?:\w+\W+){0,2}?(?:none|n\/a|nil|not (?:affected|applicable|relevant|related|a concern)|unaffected)\b/i;
+const NO_LONGER = /\bno longer\s+(?:\w+\s+){0,2}$/i;
+const NOT_PARTICIPLE = /\b(?:not|never|n't)\s+(?:\w+\s+){0,2}$/i;
+/** "not only fixes XSS" adds to a statement; it does not negate it. */
+const NOT_ONLY = /\bnot\s+(?:only|just|merely|simply)\b/i;
+/** "do not allow path traversal": the negator governs a verb that prevents the term, so this is a fix. */
+const PREVENTION = /(?:\b\w+n't|\bnot|\bnever|\bcannot|\bwithout|\bno longer)\s+(?:\w+\s+){0,2}?(?:allow|permit|let|accept|expose|enable|trust|follow|execut|leak|reveal|serve|render|reflect|honou?r|process|run|pass|forward|resolve)\w*\b(?:\s+\w+){0,3}\s*$/i;
+/** Longest line the parser reads. Release text is untrusted; nothing past this is scored. */
+const MAX_LINE_CHARS = 1000;
+/** Most lines of one document the parser reads. */
+const MAX_DOCUMENT_LINES = 50_000;
+/** How far back from a term the negation check looks, in characters. */
+const CLAUSE_WINDOW = 120;
+const WEIGHTS = RADAR_POINTS.changelog;
+const STRENGTH_POINTS = {
+    strong: WEIGHTS.strongTerm,
+    medium: WEIGHTS.mediumTerm,
+    mild: WEIGHTS.mildTerm,
+};
+function blankOut(text, pattern) {
+    return text.replaceAll(pattern, (match) => " ".repeat(match.length));
+}
+function buildContext(text) {
+    const ticks = [0];
+    let count = 0;
+    for (let position = 0; position < text.length; position++) {
+        if (text[position] === "`")
+            count++;
+        ticks.push(count);
+    }
+    const breaks = [];
+    for (const match of text.matchAll(CLAUSE_BREAK))
+        breaks.push(match.index + match[0].length);
+    return { ticks, breaks };
+}
+function inCodeSpan(context, index) {
+    return (context.ticks[index] ?? 0) % 2 === 1;
+}
+function joinedToName(text, start, end) {
+    const before = text[start - 1];
+    const after = text[end];
+    if (before === "@" || before === "/" || after === "/" || before === "_" || after === "_")
+        return true;
+    const wordChar = /[a-z0-9]/i;
+    if (before === "-" && wordChar.test(text[start - 2] ?? ""))
+        return true;
+    if (after === "-" && wordChar.test(text[end + 1] ?? ""))
+        return true;
+    return false;
+}
+const CLAUSE_BREAK = /[.;!?,:()\u2014]|\bbut\b|\bhowever\b| - /gi;
+function clauseBefore(text, context, index) {
+    // The last break that ends at or before `index`.
+    let low = 0;
+    let high = context.breaks.length;
+    while (low < high) {
+        const mid = (low + high) >>> 1;
+        if ((context.breaks[mid] ?? 0) <= index)
+            low = mid + 1;
+        else
+            high = mid;
+    }
+    const boundary = low > 0 ? (context.breaks[low - 1] ?? 0) : 0;
+    const from = Math.max(boundary, index - CLAUSE_WINDOW);
+    // Only the last few words matter: "no" at the start of a long sentence is not about this term.
+    return text.slice(from, index).split(/\s+/).slice(-6).join(" ");
+}
+function isNegated(text, context, term, start, end) {
+    const before = clauseBefore(text, context, start);
+    if (NO_LONGER.test(before) || NOT_ONLY.test(before) || PREVENTION.test(before))
+        return false;
+    if (!NEGATORS.test(before) && !POST_NEGATION.test(text.slice(end)))
+        return false;
+    // "values were not escaped" describes the defect that was fixed.
+    if (term.participle && NOT_PARTICIPLE.test(before) && /(?:ed|d)$/i.test(text.slice(start, end))) {
+        return false;
+    }
+    return true;
+}
+/** Score one line of release text with the fixed vocabulary. Zero when nothing relevant, or all negated. */
+export function classifyLine(text) {
+    const scrubbed = blankOut(text.slice(0, MAX_LINE_CHARS), NOT_SECURITY);
+    const context = buildContext(scrubbed);
+    const found = new Map();
+    for (const term of TERMS) {
+        for (const match of scrubbed.matchAll(term.pattern)) {
+            const start = match.index;
+            const end = start + match[0].length;
+            if (term.bare && (inCodeSpan(context, start) || joinedToName(scrubbed, start, end)))
+                continue;
+            if (isNegated(scrubbed, context, term, start, end))
+                continue;
+            found.set(term.id, STRENGTH_POINTS[term.strength]);
+            break;
+        }
+    }
+    if (found.size === 0)
+        return { points: 0, terms: [] };
+    const weights = [...found.values()].toSorted((a, b) => b - a);
+    const extra = Math.min(2, weights.length - 1) * WEIGHTS.extraTermOnLine;
+    return { points: (weights[0] ?? 0) + extra, terms: [...found.keys()].toSorted() };
+}
+const VERSION_AT_START = /^\[?(?:v|version\s+|release\s+)?(\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)\]?/i;
+const DATE_TAIL = /^\s*(?:[-–—/:|,(]\s*)?(?:\(?\[?\d{4}[-/.]\d{1,2}[-/.]\d{1,2}\]?\)?|\(?[A-Za-z]+\.? \d{1,2}(?:st|nd|rd|th)?,? \d{4}\)?|\(?\d{1,2} [A-Za-z]+\.? \d{4}\)?|\(.*\)|\[.*\])?\s*$/;
+function headerVersion(line, next) {
+    const trimmed = line.trim();
+    if (trimmed === "" || trimmed.length > 140)
+        return undefined;
+    const isMarkdownHeading = /^#{1,6}\s/.test(trimmed);
+    const body = trimmed
+        .replace(/^#{1,6}\s+/, "")
+        .replace(/^[*_]{1,3}/, "")
+        .replaceAll(/<a\b[^>]*>\s*<\/a>/gi, "")
+        .replace(/^<a\b[^>]*>/i, "")
+        .trim();
+    const match = VERSION_AT_START.exec(body);
+    const version = match?.[1];
+    if (!version || !semver.valid(version))
+        return undefined;
+    if (isMarkdownHeading)
+        return version;
+    // Without a `#`, only a line that is nothing but a version and a date, or is underlined, is a header.
+    const rest = body.slice(match[0].length).replace(/[*_]+$/, "");
+    const underlined = next !== undefined && /^\s*(?:={3,}|-{3,})\s*$/.test(next);
+    return underlined || DATE_TAIL.test(rest) ? version : undefined;
+}
+/** Split release history into one section per version found in its headings. */
+export function parseChangelog(text) {
+    const lines = text
+        .split(/\r?\n/, MAX_DOCUMENT_LINES)
+        .map((line) => (line.length > MAX_LINE_CHARS ? line.slice(0, MAX_LINE_CHARS) : line));
+    const sections = [];
+    let current;
+    for (const [index, raw] of lines.entries()) {
+        const version = headerVersion(raw, lines[index + 1]);
+        if (version) {
+            current = { version, startLine: index + 1, lines: [] };
+            sections.push(current);
+            continue;
+        }
+        // A heading with no version ends the section only when it is a top-level one (`# Changelog`).
+        if (current && raw.trim() !== "")
+            current.lines.push({ line: index + 1, text: raw });
+    }
+    return sections;
+}
+// Tokens are separated by at most one `\s*` each and the line is trimmed first, so matching is linear.
+const SECURITY_HEADING = /^(?:#{1,6}\s*)?(?:[*_]{1,2}\s*)?security(?:\s+(?:fix(?:es)?|updates?|notes?))?(?:\s*[*_]{1,2})?\s*:?$/i;
+const ANY_HEADING = /^\s{0,3}(?:#{1,6}\s+\S|[*_]{2}[^*_]+[*_]{2}\s*:?\s*$)/;
+const NOTHING = /^\W*(?:none|n\/a|nil|nothing|no\b.*|not applicable)\W*$/i;
+function stripBullet(line) {
+    return line.replace(/^\s*(?:[-*+]|\d+[.)])\s+/, "").trim();
+}
+function isSecurityHeading(text) {
+    const line = text.slice(0, MAX_LINE_CHARS);
+    // At most three spaces of indentation, as in Markdown.
+    if (line.length - line.trimStart().length > 3)
+        return false;
+    return SECURITY_HEADING.test(line.trim());
+}
+/** Lines of a section that look security-relevant, best first. */
+export function classifySection(section) {
+    const hits = [];
+    let underSecurity = false;
+    for (const { line, text: rawText } of section.lines) {
+        const text = rawText.slice(0, MAX_LINE_CHARS);
+        if (isSecurityHeading(text)) {
+            underSecurity = true;
+            continue;
+        }
+        if (ANY_HEADING.test(text))
+            underSecurity = false;
+        const body = stripBullet(text);
+        if (body === "")
+            continue;
+        const classified = classifyLine(body);
+        let points = classified.points;
+        const terms = [...classified.terms];
+        if (underSecurity && !NOTHING.test(body)) {
+            if (points < WEIGHTS.securityHeading)
+                points = WEIGHTS.securityHeading;
+            terms.push("security-heading");
+        }
+        if (points > 0)
+            hits.push({ line, text: body, points, terms: terms.toSorted() });
+    }
+    return hits.toSorted((a, b) => b.points - a.points || a.line - b.line);
+}
+/** Flags for the releases in `(from, to]`: the best few lines of each release that scored at all. */
+export function changelogFlags(input) {
+    const flags = [];
+    const seen = new Set();
+    for (const section of input.sections) {
+        if (!semver.gt(section.version, input.from) || !semver.lte(section.version, input.to))
+            continue;
+        // The same version listed twice (a duplicated heading) is read once.
+        if (seen.has(section.version))
+            continue;
+        seen.add(section.version);
+        const best = classifySection(section).slice(0, WEIGHTS.linesPerRelease);
+        for (const line of best) {
+            flags.push({
+                category: "changelog",
+                signal: `changelog:${line.terms.join("+")}`,
+                release: section.version,
+                points: line.points,
+                location: sanitizeEvidence(`${input.source}:${line.line}`, 120),
+                evidence: evidenceLine(`${input.source}:${line.line}`, `"${line.text}"`),
+                occurrences: 1,
+            });
+        }
+    }
+    return flags;
+}
+/** Whether any text mentions security with a strong or medium term, un-negated. Used for deprecation notices. */
+export function mentionsSecurity(text) {
+    return classifyLine(text).points >= WEIGHTS.mediumTerm;
+}
+//# sourceMappingURL=changelog.js.map

package/dist/remediation/radar/changelog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"changelog.js","sourceRoot":"","sources":["../../../src/remediation/radar/changelog.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAkB,MAAM,YAAY,CAAC;AAiB1D,MAAM,KAAK,GAAoB;IAC7B,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,wBAAwB,EAAE,QAAQ,EAAE,QAAQ,EAAE;IACpE,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,6CAA6C,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC1F,EAAE,EAAE,EAAE,qBAAqB,EAAE,OAAO,EAAE,8BAA8B,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC1F,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC3D;QACE,EAAE,EAAE,WAAW;QACf,OAAO,EAAE,oEAAoE;QAC7E,QAAQ,EAAE,QAAQ;KACnB;IACD,EAAE,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE,iCAAiC,EAAE,QAAQ,EAAE,QAAQ,EAAE;IACtF,EAAE,EAAE,EAAE,gBAAgB,EAAE,OAAO,EAAE,oCAAoC,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC3F,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE;IACzD;QACE,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,0CAA0C;QACnD,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,IAAI;KACX;IACD;QACE,EAAE,EAAE,WAAW;QACf,OAAO,EACL,4FAA4F;QAC9F,QAAQ,EAAE,QAAQ;KACnB;IACD,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,oCAAoC,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAChF;QACE,EAAE,EAAE,WAAW;QACf,OAAO,EAAE,gDAAgD;QACzD,QAAQ,EAAE,QAAQ;KACnB;IACD,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,2CAA2C,EAAE,QAAQ,EAAE,QAAQ,EAAE;IACvF,EAAE,EAAE,EAAE,eAAe,EAAE,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC3E;QACE,EAAE,EAAE,cAAc;QAClB,OAAO,EACL,8HAA8H;QAChI,QAAQ,EAAE,QAAQ;KACnB;IACD,EAAE,EAAE,EAAE,eAAe,EAAE,OAAO,EAAE,oCAAoC,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC1F,EAAE,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE;IAC7E,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,mCAAmC,EAAE,QAAQ,EAAE,QAAQ,EAAE;IACnF,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,sCAAsC,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAClF,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE;IACzD,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,6CAA6C,EAAE,QAAQ,EAAE,QAAQ,EAAE;IAC5F;QACE,EAAE,EAAE,UAAU;QACd,OAAO,EAAE,qEAAqE;QAC9E,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,EAAE,EAAE,YAAY;QAChB,OAAO,EAAE,qFAAqF;QAC9F,QAAQ,EAAE,QAAQ;KACnB;IACD;QACE,EAAE,EAAE,YAAY;QAChB,OAAO,EAAE,+CAA+C;QACxD,QAAQ,EAAE,QAAQ;KACnB;IACD,EAAE,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,uBAAuB,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE;IAC1F,EAAE,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE;IAChG;QACE,EAAE,EAAE,QAAQ;QACZ,OAAO,EAAE,4BAA4B;QACrC,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,IAAI;QACV,UAAU,EAAE,IAAI;KACjB;IACD,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE;IAChG,EAAE,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,wBAAwB,EAAE,QAAQ,EAAE,MAAM,EAAE;IACxE,EAAE,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,EAAE;IACjE,EAAE,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,2BAA2B,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE;IACtF,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,yBAAyB,EAAE,QAAQ,EAAE,MAAM,EAAE;IACtE;QACE,EAAE,EAAE,UAAU;QACd,OAAO,EAAE,kCAAkC;QAC3C,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,IAAI;QACV,UAAU,EAAE,IAAI;KACjB;CACF,CAAC;AAEF,sGAAsG;AACtG,MAAM,YAAY,GAAG,yEAAyE,CAAC;AAE/F,MAAM,QAAQ,GACZ,iJAAiJ,CAAC;AACpJ,MAAM,aAAa,GACjB,4GAA4G,CAAC;AAC/G,MAAM,SAAS,GAAG,iCAAiC,CAAC;AACpD,MAAM,cAAc,GAAG,yCAAyC,CAAC;AACjE,uEAAuE;AACvE,MAAM,QAAQ,GAAG,wCAAwC,CAAC;AAC1D,0GAA0G;AAC1G,MAAM,UAAU,GACd,8OAA8O,CAAC;AAEjP,6FAA6F;AAC7F,MAAM,cAAc,GAAG,IAAI,CAAC;AAC5B,mDAAmD;AACnD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,wEAAwE;AACxE,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B,MAAM,OAAO,GAAG,YAAY,CAAC,SAAS,CAAC;AACvC,MAAM,eAAe,GAA6B;IAChD,MAAM,EAAE,OAAO,CAAC,UAAU;IAC1B,MAAM,EAAE,OAAO,CAAC,UAAU;IAC1B,IAAI,EAAE,OAAO,CAAC,QAAQ;CACvB,CAAC;AAUF,SAAS,QAAQ,CAAC,IAAY,EAAE,OAAe;IAC7C,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;AACvE,CAAC;AAUD,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,KAAK,GAAa,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,QAAQ,GAAG,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC;QAC1D,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,GAAG;YAAE,KAAK,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IACD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5F,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,UAAU,CAAC,OAAoB,EAAE,KAAa;IACrD,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,KAAa,EAAE,GAAW;IAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG;QACtF,OAAO,IAAI,CAAC;IACd,MAAM,QAAQ,GAAG,WAAW,CAAC;IAC7B,IAAI,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACxE,IAAI,KAAK,KAAK,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,YAAY,GAAG,4CAA4C,CAAC;AAElE,SAAS,YAAY,CAAC,IAAY,EAAE,OAAoB,EAAE,KAAa;IACrE,iDAAiD;IACjD,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;IACjC,OAAO,GAAG,GAAG,IAAI,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK;YAAE,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC;;YAClD,IAAI,GAAG,GAAG,CAAC;IAClB,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,GAAG,aAAa,CAAC,CAAC;IACvD,+FAA+F;IAC/F,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,SAAS,CAChB,IAAY,EACZ,OAAoB,EACpB,IAAU,EACV,KAAa,EACb,GAAW;IAEX,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAClD,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7F,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACjF,iEAAiE;IACjE,IAAI,IAAI,CAAC,UAAU,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QAChG,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,EAAE,YAAY,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACpD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;YAC1B,MAAM,GAAG,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YACpC,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,YAAY,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;gBAAE,SAAS;YAC9F,IAAI,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC;gBAAE,SAAS;YAC7D,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YACnD,MAAM;QACR,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC;IACxE,OAAO,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;AACpF,CAAC;AAaD,MAAM,gBAAgB,GAAG,yEAAyE,CAAC;AACnG,MAAM,SAAS,GACb,4KAA4K,CAAC;AAE/K,SAAS,aAAa,CAAC,IAAY,EAAE,IAAwB;IAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,SAAS,CAAC;IAC7D,MAAM,iBAAiB,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,OAAO;SACjB,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;SACzB,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;SACzB,UAAU,CAAC,sBAAsB,EAAE,EAAE,CAAC;SACtC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;SAC3B,IAAI,EAAE,CAAC;IACV,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACzD,IAAI,iBAAiB;QAAE,OAAO,OAAO,CAAC;IACtC,sGAAsG;IACtG,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,IAAI,KAAK,SAAS,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,OAAO,UAAU,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,KAAK,GAAG,IAAI;SACf,KAAK,CAAC,OAAO,EAAE,kBAAkB,CAAC;SAClC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACxF,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,IAAI,OAAqC,CAAC;IAC1C,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;QACrD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;YACvD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,8FAA8F;QAC9F,IAAI,OAAO,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,uGAAuG;AACvG,MAAM,gBAAgB,GACpB,wGAAwG,CAAC;AAC3G,MAAM,WAAW,GAAG,uDAAuD,CAAC;AAC5E,MAAM,OAAO,GAAG,0DAA0D,CAAC;AAE3E,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,0BAA0B,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;IAC3C,uDAAuD;IACvD,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,eAAe,CAAC,OAAyB;IACvD,MAAM,IAAI,GAAqB,EAAE,CAAC;IAClC,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAC9C,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,aAAa,GAAG,IAAI,CAAC;YACrB,SAAS;QACX,CAAC;QACD,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,aAAa,GAAG,KAAK,CAAC;QAClD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,IAAI,KAAK,EAAE;YAAE,SAAS;QAC1B,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;QAC/B,MAAM,KAAK,GAAG,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,aAAa,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,IAAI,MAAM,GAAG,OAAO,CAAC,eAAe;gBAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;YACvE,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,MAAM,GAAG,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;AACzE,CAAC;AAUD,qGAAqG;AACrG,MAAM,UAAU,cAAc,CAAC,KAA2B;IACxD,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;YAAE,SAAS;QAChG,qEAAqE;QACrE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,SAAS;QACxC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;QACxE,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;YACxB,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,WAAW;gBACrB,MAAM,EAAE,aAAa,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;gBAC3C,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,gBAAgB,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC;gBAC/D,QAAQ,EAAE,YAAY,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC;gBACxE,WAAW,EAAE,CAAC;aACf,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iHAAiH;AACjH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC;AACzD,CAAC"}

package/dist/remediation/radar/code-diff.d.ts

@@ -0,0 +1,30 @@
+import { type RadarFlag } from "./types.js";
+/**
+ * Whether a regular expression has a shape known to backtrack catastrophically or quadratically:
+ * a quantified group that itself contains a quantifier, two adjacent identical quantified atoms
+ * (`\s*\s*`), or an unanchored `\s+$` / `\s*$`. Conservative: it names shapes, it does not prove
+ * a bound.
+ */
+export declare function isRedosProne(source: string): boolean;
+export interface FileVersions {
+    before: ReadonlyMap<string, string>;
+    after: ReadonlyMap<string, string>;
+}
+export interface CodeDiffResult {
+    flags: RadarFlag[];
+    filesCompared: number;
+    filesChanged: number;
+    /** Files skipped for size, count cap or parse failure. */
+    filesSkipped: number;
+}
+/**
+ * Compare two versions' files and return what changed in security-relevant ways. `release` labels
+ * the flags (a version, or a span when several releases were diffed at once).
+ */
+export declare function codeDiffFlags(versions: FileVersions, release: string): CodeDiffResult;
+/** Added and removed non-blank lines between two files (multiset difference), for a model to read. */
+export declare function lineDiff(before: string, after: string): {
+    added: string[];
+    removed: string[];
+};
+//# sourceMappingURL=code-diff.d.ts.map

package/dist/remediation/radar/code-diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"code-diff.d.ts","sourceRoot":"","sources":["../../../src/remediation/radar/code-diff.ts"],"names":[],"mappings":"AAaA,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,YAAY,CAAC;AAkF1D;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAqCpD;AA4OD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,0DAA0D;IAC1D,YAAY,EAAE,MAAM,CAAC;CACtB;AA2CD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,GAAG,cAAc,CAiIrF;AAWD,sGAAsG;AACtG,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAa9F"}