autoremediator 0.5.0 → 0.7.0

package/dist/cli.js

@@ -1,22 +1,55 @@
 #!/usr/bin/env node
 import {
+  PACKAGE_VERSION
+} from "./chunk-7XSZTGU7.js";
+import {
+  OPTION_DESCRIPTIONS,
   ciExitCode,
   remediate,
   remediateFromScan,
   toCiSummary,
   toSarifOutput
-} from "./chunk-VLXGEH7U.js";
+} from "./chunk-MUFP2DQX.js";
 
-// src/cli.ts
-import { Command } from "commander";
-import { existsSync, writeFileSync } from "fs";
+// src/cli/index.ts
 import { fileURLToPath } from "url";
+
+// src/cli/program.ts
+import { Command } from "commander";
+import { existsSync } from "fs";
+
+// src/cli/runners.ts
+import { writeFileSync } from "fs";
+
+// src/cli/output.ts
 function logJson(value) {
   process.stdout.write(`${JSON.stringify(value, null, 2)}
 `);
 }
-function isCveId(value) {
-  return /^CVE-\d{4}-\d+$/i.test(value);
+function formatCountMap(counts) {
+  if (!counts) return void 0;
+  const entries = Object.entries(counts).filter(([, value]) => value > 0);
+  if (entries.length === 0) return void 0;
+  return entries.map(([key, value]) => `${key}=${value}`).join(", ");
+}
+
+// src/cli/runners.ts
+function asSingleCveScanReport(report) {
+  return {
+    schemaVersion: "1.0",
+    status: report.results.some((result) => !result.applied && !result.dryRun) ? report.results.some((result) => result.applied || result.dryRun) ? "partial" : "failed" : "ok",
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    cveIds: [report.cveId],
+    reports: [report],
+    successCount: report.results.filter((result) => result.applied || result.dryRun).length,
+    failedCount: report.results.filter((result) => !result.applied && !result.dryRun).length,
+    errors: [],
+    evidenceFile: report.evidenceFile,
+    patchCount: report.results.filter((result) => result.strategy === "patch-file").length,
+    correlation: report.correlation,
+    provenance: report.provenance,
+    constraints: report.constraints
+  };
 }
 async function runSingleCve(cveId, opts) {
   const report = await remediate(cveId, {
@@ -25,7 +58,9 @@ async function runSingleCve(cveId, opts) {
     dryRun: opts.dryRun,
     preview: opts.preview,
     runTests: opts.runTests,
+    patchesDir: opts.patchesDir,
     policy: opts.policy,
+    evidence: opts.evidence,
     llmProvider: opts.llmProvider,
     requestId: opts.requestId,
     sessionId: opts.sessionId,
@@ -39,14 +74,32 @@ async function runSingleCve(cveId, opts) {
       preferVersionBump: opts.preferVersionBump
     }
   });
+  const reportAsScan = asSingleCveScanReport(report);
+  if (opts.outputFormat === "sarif") {
+    logJson(toSarifOutput(reportAsScan));
+    if (opts.ci) {
+      process.exitCode = ciExitCode(toCiSummary(reportAsScan));
+    }
+    return;
+  }
   if (opts.json) {
     logJson(report);
+    if (opts.ci) {
+      process.exitCode = ciExitCode(toCiSummary(reportAsScan));
+    }
     return;
   }
   process.stdout.write(`${report.summary}
 `);
   process.stdout.write(`Results: ${report.results.length}
 `);
+  if (report.evidenceFile) {
+    process.stdout.write(`Evidence: ${report.evidenceFile}
+`);
+  }
+  if (opts.ci) {
+    process.exitCode = ciExitCode(toCiSummary(reportAsScan));
+  }
 }
 async function runScanInput(inputPath, opts) {
   const report = await remediateFromScan(inputPath, {
@@ -54,6 +107,7 @@ async function runScanInput(inputPath, opts) {
     packageManager: opts.packageManager,
     format: opts.format,
     policy: opts.policy,
+    patchesDir: opts.patchesDir,
     dryRun: opts.dryRun,
     preview: opts.preview,
     runTests: opts.runTests,
@@ -97,6 +151,21 @@ async function runScanInput(inputPath, opts) {
 `);
   process.stdout.write(`Failed remediations: ${report.failedCount}
 `);
+  const strategyCounts = formatCountMap(report.strategyCounts);
+  if (strategyCounts) {
+    process.stdout.write(`Strategy counts: ${strategyCounts}
+`);
+  }
+  const dependencyScopeCounts = formatCountMap(report.dependencyScopeCounts);
+  if (dependencyScopeCounts) {
+    process.stdout.write(`Dependency scope counts: ${dependencyScopeCounts}
+`);
+  }
+  const unresolvedByReason = formatCountMap(report.unresolvedByReason);
+  if (unresolvedByReason) {
+    process.stdout.write(`Unresolved reasons: ${unresolvedByReason}
+`);
+  }
   if (report.evidenceFile) {
     process.stdout.write(`Evidence: ${report.evidenceFile}
 `);
@@ -111,16 +180,43 @@ async function runScanInput(inputPath, opts) {
     process.exitCode = ciExitCode(toCiSummary(report));
   }
 }
+
+// src/cli/types.ts
+function isCveId(value) {
+  return /^CVE-\d{4}-\d+$/i.test(value);
+}
+
+// src/cli/program.ts
+function addSharedOptions(program, includeInput = false) {
+  program.option("--cwd <path>", OPTION_DESCRIPTIONS.cwd, process.cwd()).option("--package-manager <name>", OPTION_DESCRIPTIONS.packageManager).option("--patches-dir <path>", OPTION_DESCRIPTIONS.patchesDir).option("--dry-run", OPTION_DESCRIPTIONS.dryRun, false).option("--preview", OPTION_DESCRIPTIONS.preview, false).option("--run-tests", OPTION_DESCRIPTIONS.runTests, false).option("--llm-provider <provider>", OPTION_DESCRIPTIONS.llmProvider).option("--request-id <id>", OPTION_DESCRIPTIONS.requestId).option("--session-id <id>", OPTION_DESCRIPTIONS.sessionId).option("--parent-run-id <id>", OPTION_DESCRIPTIONS.parentRunId).option("--idempotency-key <key>", OPTION_DESCRIPTIONS.idempotencyKey).option("--resume", OPTION_DESCRIPTIONS.resume, false).option("--actor <name>", OPTION_DESCRIPTIONS.actor).option("--source <src>", `${OPTION_DESCRIPTIONS.source}: cli|sdk|mcp|openapi|unknown`).option("--direct-dependencies-only", OPTION_DESCRIPTIONS.directDependenciesOnly, false).option("--prefer-version-bump", OPTION_DESCRIPTIONS.preferVersionBump, false).option("--policy <path>", OPTION_DESCRIPTIONS.policy).option("--evidence", OPTION_DESCRIPTIONS.evidence, true).option("--no-evidence", "Disable evidence file output").option("--ci", "Enable CI behavior (non-zero exit on failed remediations)", false).option("--output-format <format>", "Output format: json|sarif", "json").option("--json", "Print JSON output", false);
+  if (includeInput) {
+    program.option("--input <path>", `${OPTION_DESCRIPTIONS.inputPath} (scanner-first mode)`);
+  }
+  return program;
+}
 function createProgram() {
   const program = new Command();
-  program.name("autoremediator").description("Scanner-first Node.js vulnerability auto-remediation tool").version("0.1.2").showHelpAfterError();
-  program.command("cve").description("Remediate a single CVE ID").argument("<cveId>", "CVE ID, e.g. CVE-2021-23337").option("--cwd <path>", "Target project directory", process.cwd()).option("--package-manager <name>", "Package manager: npm|pnpm|yarn").option("--dry-run", "Plan changes only without mutating files", false).option("--preview", "Run non-mutating remediation preview mode", false).option("--run-tests", "Run package-manager test validation after apply", false).option("--llm-provider <provider>", "LLM provider: openai|anthropic|local").option("--request-id <id>", "Request correlation ID").option("--session-id <id>", "Session correlation ID").option("--parent-run-id <id>", "Parent run correlation ID").option("--idempotency-key <key>", "Idempotency key for replay-safe execution").option("--resume", "Resume by returning cached result for matching idempotency key", false).option("--actor <name>", "Actor identity for evidence provenance").option("--source <src>", "Source system: cli|sdk|mcp|openapi|unknown").option("--direct-dependencies-only", "Enforce direct-dependency-only remediation constraint", false).option("--prefer-version-bump", "Reject patch-file outcomes when version-bump is preferred", false).option("--json", "Print JSON output", false).action(async (cveId, opts) => {
-    await runSingleCve(cveId, opts);
+  program.name("autoremediator").description("Scanner-first Node.js vulnerability auto-remediation tool").version(PACKAGE_VERSION).showHelpAfterError();
+  addSharedOptions(
+    program.command("cve").description("Remediate a single CVE ID").argument("<cveId>", OPTION_DESCRIPTIONS.cveId),
+    false
+  ).action(async (cveId, opts, command) => {
+    const merged = {
+      ...opts,
+      ...command.optsWithGlobals()
+    };
+    await runSingleCve(cveId, merged);
   });
-  program.command("scan").description("Remediate vulnerabilities from scanner output (npm/pnpm/yarn audit JSON or SARIF)").requiredOption("--input <path>", "Path to scanner output file").option("--format <type>", "Input format: auto|npm-audit|yarn-audit|sarif", "auto").option("--cwd <path>", "Target project directory", process.cwd()).option("--package-manager <name>", "Package manager: npm|pnpm|yarn").option("--policy <path>", "Path to policy file (.autoremediator.json)").option("--dry-run", "Plan changes only without mutating files", false).option("--preview", "Run non-mutating remediation preview mode", false).option("--run-tests", "Run package-manager test validation after apply", false).option("--llm-provider <provider>", "LLM provider: openai|anthropic|local").option("--request-id <id>", "Request correlation ID").option("--session-id <id>", "Session correlation ID").option("--parent-run-id <id>", "Parent run correlation ID").option("--idempotency-key <key>", "Idempotency key for replay-safe execution").option("--resume", "Resume by returning cached result for matching idempotency key", false).option("--actor <name>", "Actor identity for evidence provenance").option("--source <src>", "Source system: cli|sdk|mcp|openapi|unknown").option("--direct-dependencies-only", "Enforce direct-dependency-only remediation constraint", false).option("--prefer-version-bump", "Reject patch-file outcomes when version-bump is preferred", false).option("--evidence", "Enable evidence file output", true).option("--no-evidence", "Disable evidence file output").option("--ci", "Enable CI behavior (non-zero exit on failed remediations)", false).option("--summary-file <path>", "Write machine-readable scan summary JSON to path").option("--output-format <format>", "Output format: json|sarif", "json").option("--json", "Print JSON output", false).action(async (opts) => {
+  addSharedOptions(
+    program.command("scan").description("Remediate vulnerabilities from scanner output (npm/pnpm/yarn audit JSON or SARIF)").requiredOption("--input <path>", OPTION_DESCRIPTIONS.inputPath).option("--format <type>", OPTION_DESCRIPTIONS.format, "auto").option("--summary-file <path>", "Write machine-readable scan summary JSON to path"),
+    false
+  ).action(async (opts) => {
     await runScanInput(opts.input, opts);
   });
-  program.argument("[target]", "Scanner output file path (or CVE ID fallback)").option("--cwd <path>", "Target project directory", process.cwd()).option("--package-manager <name>", "Package manager: npm|pnpm|yarn").option("--dry-run", "Plan changes only without mutating files", false).option("--preview", "Run non-mutating remediation preview mode", false).option("--run-tests", "Run package-manager test validation after apply", false).option("--llm-provider <provider>", "LLM provider: openai|anthropic|local").option("--request-id <id>", "Request correlation ID").option("--session-id <id>", "Session correlation ID").option("--parent-run-id <id>", "Parent run correlation ID").option("--idempotency-key <key>", "Idempotency key for replay-safe execution").option("--resume", "Resume by returning cached result for matching idempotency key", false).option("--actor <name>", "Actor identity for evidence provenance").option("--source <src>", "Source system: cli|sdk|mcp|openapi|unknown").option("--direct-dependencies-only", "Enforce direct-dependency-only remediation constraint", false).option("--prefer-version-bump", "Reject patch-file outcomes when version-bump is preferred", false).option("--input <path>", "Path to scanner output file (scanner-first mode)").option("--format <type>", "Input format: auto|npm-audit|yarn-audit|sarif", "auto").option("--policy <path>", "Path to policy file (.autoremediator.json)").option("--evidence", "Enable evidence file output", true).option("--no-evidence", "Disable evidence file output").option("--ci", "Enable CI behavior (non-zero exit on failed remediations)", false).option("--summary-file <path>", "Write machine-readable scan summary JSON to path").option("--output-format <format>", "Output format: json|sarif", "json").option("--json", "Print JSON output", false).action(async (target, opts) => {
+  addSharedOptions(
+    program.argument("[target]", "Scanner output file path (or CVE ID fallback)").option("--format <type>", OPTION_DESCRIPTIONS.format, "auto").option("--summary-file <path>", "Write machine-readable scan summary JSON to path"),
+    true
+  ).action(async (target, opts) => {
     if (opts.input) {
       await runScanInput(opts.input, opts);
       return;
@@ -143,8 +239,13 @@ function createProgram() {
   });
   return program;
 }
+
+// src/cli/index.ts
+function createProgram2() {
+  return createProgram();
+}
 async function main(argv = process.argv) {
-  const program = createProgram();
+  const program = createProgram2();
   await program.parseAsync(argv);
 }
 function isMainModule() {
@@ -160,6 +261,6 @@ if (isMainModule()) {
   });
 }
 export {
-  createProgram
+  createProgram2 as createProgram
 };
 //# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/cli.ts"],"sourcesContent":["#!/usr/bin/env node\n\nimport { Command } from \"commander\";\nimport { ciExitCode, remediate, remediateFromScan, toCiSummary, toSarifOutput } from \"./api.js\";\nimport { existsSync, writeFileSync } from \"node:fs\";\nimport { fileURLToPath } from \"node:url\";\n\ntype ScanFormat = \"auto\" | \"npm-audit\" | \"yarn-audit\" | \"sarif\";\n\ninterface CommandOptions {\n  cwd: string;\n  packageManager?: \"npm\" | \"pnpm\" | \"yarn\";\n  dryRun: boolean;\n  preview: boolean;\n  runTests: boolean;\n  json: boolean;\n  outputFormat: \"json\" | \"sarif\";\n  llmProvider?: \"openai\" | \"anthropic\" | \"local\";\n  requestId?: string;\n  sessionId?: string;\n  parentRunId?: string;\n  idempotencyKey?: string;\n  resume: boolean;\n  actor?: string;\n  source?: \"cli\" | \"sdk\" | \"mcp\" | \"openapi\" | \"unknown\";\n  directDependenciesOnly: boolean;\n  preferVersionBump: boolean;\n  input?: string;\n  format: ScanFormat;\n  policy?: string;\n  evidence: boolean;\n  ci: boolean;\n  summaryFile?: string;\n}\n\nfunction logJson(value: unknown): void {\n  process.stdout.write(`${JSON.stringify(value, null, 2)}\\n`);\n}\n\nfunction isCveId(value: string): boolean {\n  return /^CVE-\\d{4}-\\d+$/i.test(value);\n}\n\nasync function runSingleCve(cveId: string, opts: CommandOptions): Promise<void> {\n  const report = await remediate(cveId, {\n    cwd: opts.cwd,\n    packageManager: opts.packageManager,\n    dryRun: opts.dryRun,\n    preview: opts.preview,\n    runTests: opts.runTests,\n    policy: opts.policy,\n    llmProvider: opts.llmProvider,\n    requestId: opts.requestId,\n    sessionId: opts.sessionId,\n    parentRunId: opts.parentRunId,\n    idempotencyKey: opts.idempotencyKey,\n    resume: opts.resume,\n    actor: opts.actor,\n    source: opts.source ?? \"cli\",\n    constraints: {\n      directDependenciesOnly: opts.directDependenciesOnly,\n      preferVersionBump: opts.preferVersionBump,\n    },\n  });\n\n  if (opts.json) {\n    logJson(report);\n    return;\n  }\n\n  process.stdout.write(`${report.summary}\\n`);\n  process.stdout.write(`Results: ${report.results.length}\\n`);\n}\n\nasync function runScanInput(inputPath: string, opts: CommandOptions): Promise<void> {\n  const report = await remediateFromScan(inputPath, {\n    cwd: opts.cwd,\n    packageManager: opts.packageManager,\n    format: opts.format,\n    policy: opts.policy,\n    dryRun: opts.dryRun,\n    preview: opts.preview,\n    runTests: opts.runTests,\n    llmProvider: opts.llmProvider,\n    evidence: opts.evidence,\n    requestId: opts.requestId,\n    sessionId: opts.sessionId,\n    parentRunId: opts.parentRunId,\n    idempotencyKey: opts.idempotencyKey,\n    resume: opts.resume,\n    actor: opts.actor,\n    source: opts.source ?? \"cli\",\n    constraints: {\n      directDependenciesOnly: opts.directDependenciesOnly,\n      preferVersionBump: opts.preferVersionBump,\n    },\n  });\n\n  if (opts.summaryFile) {\n    const summary = toCiSummary(report);\n    writeFileSync(opts.summaryFile, JSON.stringify(summary, null, 2) + \"\\n\", \"utf8\");\n  }\n\n  if (opts.outputFormat === \"sarif\") {\n    logJson(toSarifOutput(report));\n    if (opts.ci) {\n      process.exitCode = ciExitCode(toCiSummary(report));\n    }\n    return;\n  }\n\n  if (opts.json) {\n    logJson(report);\n    if (opts.ci) {\n      process.exitCode = ciExitCode(toCiSummary(report));\n    }\n    return;\n  }\n\n  process.stdout.write(`CVEs found: ${report.cveIds.length}\\n`);\n  process.stdout.write(`Remediation reports: ${report.reports.length}\\n`);\n  process.stdout.write(`Successful remediations: ${report.successCount}\\n`);\n  process.stdout.write(`Failed remediations: ${report.failedCount}\\n`);\n  if (report.evidenceFile) {\n    process.stdout.write(`Evidence: ${report.evidenceFile}\\n`);\n  }\n\n  if (report.errors.length > 0) {\n    for (const error of report.errors) {\n      process.stdout.write(`Error ${error.cveId}: ${error.message}\\n`);\n    }\n  }\n\n  if (opts.ci) {\n    process.exitCode = ciExitCode(toCiSummary(report));\n  }\n}\n\nexport function createProgram(): Command {\n  const program = new Command();\n\n  program\n    .name(\"autoremediator\")\n    .description(\"Scanner-first Node.js vulnerability auto-remediation tool\")\n    .version(\"0.1.2\")\n    .showHelpAfterError();\n\n  program\n    .command(\"cve\")\n    .description(\"Remediate a single CVE ID\")\n    .argument(\"<cveId>\", \"CVE ID, e.g. CVE-2021-23337\")\n    .option(\"--cwd <path>\", \"Target project directory\", process.cwd())\n    .option(\"--package-manager <name>\", \"Package manager: npm|pnpm|yarn\")\n    .option(\"--dry-run\", \"Plan changes only without mutating files\", false)\n    .option(\"--preview\", \"Run non-mutating remediation preview mode\", false)\n    .option(\"--run-tests\", \"Run package-manager test validation after apply\", false)\n    .option(\"--llm-provider <provider>\", \"LLM provider: openai|anthropic|local\")\n    .option(\"--request-id <id>\", \"Request correlation ID\")\n    .option(\"--session-id <id>\", \"Session correlation ID\")\n    .option(\"--parent-run-id <id>\", \"Parent run correlation ID\")\n    .option(\"--idempotency-key <key>\", \"Idempotency key for replay-safe execution\")\n    .option(\"--resume\", \"Resume by returning cached result for matching idempotency key\", false)\n    .option(\"--actor <name>\", \"Actor identity for evidence provenance\")\n    .option(\"--source <src>\", \"Source system: cli|sdk|mcp|openapi|unknown\")\n    .option(\"--direct-dependencies-only\", \"Enforce direct-dependency-only remediation constraint\", false)\n    .option(\"--prefer-version-bump\", \"Reject patch-file outcomes when version-bump is preferred\", false)\n    .option(\"--json\", \"Print JSON output\", false)\n    .action(async (cveId: string, opts: CommandOptions) => {\n      await runSingleCve(cveId, opts);\n    });\n\n  program\n    .command(\"scan\")\n    .description(\"Remediate vulnerabilities from scanner output (npm/pnpm/yarn audit JSON or SARIF)\")\n    .requiredOption(\"--input <path>\", \"Path to scanner output file\")\n    .option(\"--format <type>\", \"Input format: auto|npm-audit|yarn-audit|sarif\", \"auto\")\n    .option(\"--cwd <path>\", \"Target project directory\", process.cwd())\n    .option(\"--package-manager <name>\", \"Package manager: npm|pnpm|yarn\")\n    .option(\"--policy <path>\", \"Path to policy file (.autoremediator.json)\")\n    .option(\"--dry-run\", \"Plan changes only without mutating files\", false)\n    .option(\"--preview\", \"Run non-mutating remediation preview mode\", false)\n    .option(\"--run-tests\", \"Run package-manager test validation after apply\", false)\n    .option(\"--llm-provider <provider>\", \"LLM provider: openai|anthropic|local\")\n    .option(\"--request-id <id>\", \"Request correlation ID\")\n    .option(\"--session-id <id>\", \"Session correlation ID\")\n    .option(\"--parent-run-id <id>\", \"Parent run correlation ID\")\n    .option(\"--idempotency-key <key>\", \"Idempotency key for replay-safe execution\")\n    .option(\"--resume\", \"Resume by returning cached result for matching idempotency key\", false)\n    .option(\"--actor <name>\", \"Actor identity for evidence provenance\")\n    .option(\"--source <src>\", \"Source system: cli|sdk|mcp|openapi|unknown\")\n    .option(\"--direct-dependencies-only\", \"Enforce direct-dependency-only remediation constraint\", false)\n    .option(\"--prefer-version-bump\", \"Reject patch-file outcomes when version-bump is preferred\", false)\n    .option(\"--evidence\", \"Enable evidence file output\", true)\n    .option(\"--no-evidence\", \"Disable evidence file output\")\n    .option(\"--ci\", \"Enable CI behavior (non-zero exit on failed remediations)\", false)\n    .option(\"--summary-file <path>\", \"Write machine-readable scan summary JSON to path\")\n    .option(\"--output-format <format>\", \"Output format: json|sarif\", \"json\")\n    .option(\"--json\", \"Print JSON output\", false)\n    .action(async (opts: CommandOptions) => {\n      await runScanInput(opts.input!, opts);\n    });\n\n  // Scanner-first top-level mode (default):\n  //   autoremediator --input audit.json\n  //   autoremediator audit.json\n  program\n    .argument(\"[target]\", \"Scanner output file path (or CVE ID fallback)\")\n    .option(\"--cwd <path>\", \"Target project directory\", process.cwd())\n    .option(\"--package-manager <name>\", \"Package manager: npm|pnpm|yarn\")\n    .option(\"--dry-run\", \"Plan changes only without mutating files\", false)\n    .option(\"--preview\", \"Run non-mutating remediation preview mode\", false)\n    .option(\"--run-tests\", \"Run package-manager test validation after apply\", false)\n    .option(\"--llm-provider <provider>\", \"LLM provider: openai|anthropic|local\")\n    .option(\"--request-id <id>\", \"Request correlation ID\")\n    .option(\"--session-id <id>\", \"Session correlation ID\")\n    .option(\"--parent-run-id <id>\", \"Parent run correlation ID\")\n    .option(\"--idempotency-key <key>\", \"Idempotency key for replay-safe execution\")\n    .option(\"--resume\", \"Resume by returning cached result for matching idempotency key\", false)\n    .option(\"--actor <name>\", \"Actor identity for evidence provenance\")\n    .option(\"--source <src>\", \"Source system: cli|sdk|mcp|openapi|unknown\")\n    .option(\"--direct-dependencies-only\", \"Enforce direct-dependency-only remediation constraint\", false)\n    .option(\"--prefer-version-bump\", \"Reject patch-file outcomes when version-bump is preferred\", false)\n    .option(\"--input <path>\", \"Path to scanner output file (scanner-first mode)\")\n    .option(\"--format <type>\", \"Input format: auto|npm-audit|yarn-audit|sarif\", \"auto\")\n    .option(\"--policy <path>\", \"Path to policy file (.autoremediator.json)\")\n    .option(\"--evidence\", \"Enable evidence file output\", true)\n    .option(\"--no-evidence\", \"Disable evidence file output\")\n    .option(\"--ci\", \"Enable CI behavior (non-zero exit on failed remediations)\", false)\n    .option(\"--summary-file <path>\", \"Write machine-readable scan summary JSON to path\")\n    .option(\"--output-format <format>\", \"Output format: json|sarif\", \"json\")\n    .option(\"--json\", \"Print JSON output\", false)\n    .action(async (target: string | undefined, opts: CommandOptions) => {\n      if (opts.input) {\n        await runScanInput(opts.input, opts);\n        return;\n      }\n\n      if (!target) {\n        program.outputHelp();\n        return;\n      }\n\n      if (isCveId(target)) {\n        await runSingleCve(target, opts);\n        return;\n      }\n\n      if (existsSync(target)) {\n        await runScanInput(target, opts);\n        return;\n      }\n\n      throw new Error(\n        `Target \"${target}\" is neither a valid CVE ID nor an existing scan file path.`\n      );\n    });\n\n  return program;\n}\n\nasync function main(argv = process.argv): Promise<void> {\n  const program = createProgram();\n  await program.parseAsync(argv);\n}\n\nfunction isMainModule(): boolean {\n  if (!process.argv[1]) return false;\n  return fileURLToPath(import.meta.url) === process.argv[1];\n}\n\nif (isMainModule()) {\n  main().catch((error) => {\n    const message = error instanceof Error ? error.message : String(error);\n    process.stderr.write(`[autoremediator] ${message}\\n`);\n    process.exit(1);\n  });\n}\n"],"mappings":";;;;;;;;;;AAEA,SAAS,eAAe;AAExB,SAAS,YAAY,qBAAqB;AAC1C,SAAS,qBAAqB;AA8B9B,SAAS,QAAQ,OAAsB;AACrC,UAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA,CAAI;AAC5D;AAEA,SAAS,QAAQ,OAAwB;AACvC,SAAO,mBAAmB,KAAK,KAAK;AACtC;AAEA,eAAe,aAAa,OAAe,MAAqC;AAC9E,QAAM,SAAS,MAAM,UAAU,OAAO;AAAA,IACpC,KAAK,KAAK;AAAA,IACV,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK;AAAA,IACb,SAAS,KAAK;AAAA,IACd,UAAU,KAAK;AAAA,IACf,QAAQ,KAAK;AAAA,IACb,aAAa,KAAK;AAAA,IAClB,WAAW,KAAK;AAAA,IAChB,WAAW,KAAK;AAAA,IAChB,aAAa,KAAK;AAAA,IAClB,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK;AAAA,IACb,OAAO,KAAK;AAAA,IACZ,QAAQ,KAAK,UAAU;AAAA,IACvB,aAAa;AAAA,MACX,wBAAwB,KAAK;AAAA,MAC7B,mBAAmB,KAAK;AAAA,IAC1B;AAAA,EACF,CAAC;AAED,MAAI,KAAK,MAAM;AACb,YAAQ,MAAM;AACd;AAAA,EACF;AAEA,UAAQ,OAAO,MAAM,GAAG,OAAO,OAAO;AAAA,CAAI;AAC1C,UAAQ,OAAO,MAAM,YAAY,OAAO,QAAQ,MAAM;AAAA,CAAI;AAC5D;AAEA,eAAe,aAAa,WAAmB,MAAqC;AAClF,QAAM,SAAS,MAAM,kBAAkB,WAAW;AAAA,IAChD,KAAK,KAAK;AAAA,IACV,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK;AAAA,IACb,QAAQ,KAAK;AAAA,IACb,QAAQ,KAAK;AAAA,IACb,SAAS,KAAK;AAAA,IACd,UAAU,KAAK;AAAA,IACf,aAAa,KAAK;AAAA,IAClB,UAAU,KAAK;AAAA,IACf,WAAW,KAAK;AAAA,IAChB,WAAW,KAAK;AAAA,IAChB,aAAa,KAAK;AAAA,IAClB,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK;AAAA,IACb,OAAO,KAAK;AAAA,IACZ,QAAQ,KAAK,UAAU;AAAA,IACvB,aAAa;AAAA,MACX,wBAAwB,KAAK;AAAA,MAC7B,mBAAmB,KAAK;AAAA,IAC1B;AAAA,EACF,CAAC;AAED,MAAI,KAAK,aAAa;AACpB,UAAM,UAAU,YAAY,MAAM;AAClC,kBAAc,KAAK,aAAa,KAAK,UAAU,SAAS,MAAM,CAAC,IAAI,MAAM,MAAM;AAAA,EACjF;AAEA,MAAI,KAAK,iBAAiB,SAAS;AACjC,YAAQ,cAAc,MAAM,CAAC;AAC7B,QAAI,KAAK,IAAI;AACX,cAAQ,WAAW,WAAW,YAAY,MAAM,CAAC;AAAA,IACnD;AACA;AAAA,EACF;AAEA,MAAI,KAAK,MAAM;AACb,YAAQ,MAAM;AACd,QAAI,KAAK,IAAI;AACX,cAAQ,WAAW,WAAW,YAAY,MAAM,CAAC;AAAA,IACnD;AACA;AAAA,EACF;AAEA,UAAQ,OAAO,MAAM,eAAe,OAAO,OAAO,MAAM;AAAA,CAAI;AAC5D,UAAQ,OAAO,MAAM,wBAAwB,OAAO,QAAQ,MAAM;AAAA,CAAI;AACtE,UAAQ,OAAO,MAAM,4BAA4B,OAAO,YAAY;AAAA,CAAI;AACxE,UAAQ,OAAO,MAAM,wBAAwB,OAAO,WAAW;AAAA,CAAI;AACnE,MAAI,OAAO,cAAc;AACvB,YAAQ,OAAO,MAAM,aAAa,OAAO,YAAY;AAAA,CAAI;AAAA,EAC3D;AAEA,MAAI,OAAO,OAAO,SAAS,GAAG;AAC5B,eAAW,SAAS,OAAO,QAAQ;AACjC,cAAQ,OAAO,MAAM,SAAS,MAAM,KAAK,KAAK,MAAM,OAAO;AAAA,CAAI;AAAA,IACjE;AAAA,EACF;AAEA,MAAI,KAAK,IAAI;AACX,YAAQ,WAAW,WAAW,YAAY,MAAM,CAAC;AAAA,EACnD;AACF;AAEO,SAAS,gBAAyB;AACvC,QAAM,UAAU,IAAI,QAAQ;AAE5B,UACG,KAAK,gBAAgB,EACrB,YAAY,2DAA2D,EACvE,QAAQ,OAAO,EACf,mBAAmB;AAEtB,UACG,QAAQ,KAAK,EACb,YAAY,2BAA2B,EACvC,SAAS,WAAW,6BAA6B,EACjD,OAAO,gBAAgB,4BAA4B,QAAQ,IAAI,CAAC,EAChE,OAAO,4BAA4B,gCAAgC,EACnE,OAAO,aAAa,4CAA4C,KAAK,EACrE,OAAO,aAAa,6CAA6C,KAAK,EACtE,OAAO,eAAe,mDAAmD,KAAK,EAC9E,OAAO,6BAA6B,sCAAsC,EAC1E,OAAO,qBAAqB,wBAAwB,EACpD,OAAO,qBAAqB,wBAAwB,EACpD,OAAO,wBAAwB,2BAA2B,EAC1D,OAAO,2BAA2B,2CAA2C,EAC7E,OAAO,YAAY,kEAAkE,KAAK,EAC1F,OAAO,kBAAkB,wCAAwC,EACjE,OAAO,kBAAkB,4CAA4C,EACrE,OAAO,8BAA8B,yDAAyD,KAAK,EACnG,OAAO,yBAAyB,6DAA6D,KAAK,EAClG,OAAO,UAAU,qBAAqB,KAAK,EAC3C,OAAO,OAAO,OAAe,SAAyB;AACrD,UAAM,aAAa,OAAO,IAAI;AAAA,EAChC,CAAC;AAEH,UACG,QAAQ,MAAM,EACd,YAAY,mFAAmF,EAC/F,eAAe,kBAAkB,6BAA6B,EAC9D,OAAO,mBAAmB,iDAAiD,MAAM,EACjF,OAAO,gBAAgB,4BAA4B,QAAQ,IAAI,CAAC,EAChE,OAAO,4BAA4B,gCAAgC,EACnE,OAAO,mBAAmB,4CAA4C,EACtE,OAAO,aAAa,4CAA4C,KAAK,EACrE,OAAO,aAAa,6CAA6C,KAAK,EACtE,OAAO,eAAe,mDAAmD,KAAK,EAC9E,OAAO,6BAA6B,sCAAsC,EAC1E,OAAO,qBAAqB,wBAAwB,EACpD,OAAO,qBAAqB,wBAAwB,EACpD,OAAO,wBAAwB,2BAA2B,EAC1D,OAAO,2BAA2B,2CAA2C,EAC7E,OAAO,YAAY,kEAAkE,KAAK,EAC1F,OAAO,kBAAkB,wCAAwC,EACjE,OAAO,kBAAkB,4CAA4C,EACrE,OAAO,8BAA8B,yDAAyD,KAAK,EACnG,OAAO,yBAAyB,6DAA6D,KAAK,EAClG,OAAO,cAAc,+BAA+B,IAAI,EACxD,OAAO,iBAAiB,8BAA8B,EACtD,OAAO,QAAQ,6DAA6D,KAAK,EACjF,OAAO,yBAAyB,kDAAkD,EAClF,OAAO,4BAA4B,6BAA6B,MAAM,EACtE,OAAO,UAAU,qBAAqB,KAAK,EAC3C,OAAO,OAAO,SAAyB;AACtC,UAAM,aAAa,KAAK,OAAQ,IAAI;AAAA,EACtC,CAAC;AAKH,UACG,SAAS,YAAY,+CAA+C,EACpE,OAAO,gBAAgB,4BAA4B,QAAQ,IAAI,CAAC,EAChE,OAAO,4BAA4B,gCAAgC,EACnE,OAAO,aAAa,4CAA4C,KAAK,EACrE,OAAO,aAAa,6CAA6C,KAAK,EACtE,OAAO,eAAe,mDAAmD,KAAK,EAC9E,OAAO,6BAA6B,sCAAsC,EAC1E,OAAO,qBAAqB,wBAAwB,EACpD,OAAO,qBAAqB,wBAAwB,EACpD,OAAO,wBAAwB,2BAA2B,EAC1D,OAAO,2BAA2B,2CAA2C,EAC7E,OAAO,YAAY,kEAAkE,KAAK,EAC1F,OAAO,kBAAkB,wCAAwC,EACjE,OAAO,kBAAkB,4CAA4C,EACrE,OAAO,8BAA8B,yDAAyD,KAAK,EACnG,OAAO,yBAAyB,6DAA6D,KAAK,EAClG,OAAO,kBAAkB,kDAAkD,EAC3E,OAAO,mBAAmB,iDAAiD,MAAM,EACjF,OAAO,mBAAmB,4CAA4C,EACtE,OAAO,cAAc,+BAA+B,IAAI,EACxD,OAAO,iBAAiB,8BAA8B,EACtD,OAAO,QAAQ,6DAA6D,KAAK,EACjF,OAAO,yBAAyB,kDAAkD,EAClF,OAAO,4BAA4B,6BAA6B,MAAM,EACtE,OAAO,UAAU,qBAAqB,KAAK,EAC3C,OAAO,OAAO,QAA4B,SAAyB;AAClE,QAAI,KAAK,OAAO;AACd,YAAM,aAAa,KAAK,OAAO,IAAI;AACnC;AAAA,IACF;AAEA,QAAI,CAAC,QAAQ;AACX,cAAQ,WAAW;AACnB;AAAA,IACF;AAEA,QAAI,QAAQ,MAAM,GAAG;AACnB,YAAM,aAAa,QAAQ,IAAI;AAC/B;AAAA,IACF;AAEA,QAAI,WAAW,MAAM,GAAG;AACtB,YAAM,aAAa,QAAQ,IAAI;AAC/B;AAAA,IACF;AAEA,UAAM,IAAI;AAAA,MACR,WAAW,MAAM;AAAA,IACnB;AAAA,EACF,CAAC;AAEH,SAAO;AACT;AAEA,eAAe,KAAK,OAAO,QAAQ,MAAqB;AACtD,QAAM,UAAU,cAAc;AAC9B,QAAM,QAAQ,WAAW,IAAI;AAC/B;AAEA,SAAS,eAAwB;AAC/B,MAAI,CAAC,QAAQ,KAAK,CAAC,EAAG,QAAO;AAC7B,SAAO,cAAc,YAAY,GAAG,MAAM,QAAQ,KAAK,CAAC;AAC1D;AAEA,IAAI,aAAa,GAAG;AAClB,OAAK,EAAE,MAAM,CAAC,UAAU;AACtB,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,YAAQ,OAAO,MAAM,oBAAoB,OAAO;AAAA,CAAI;AACpD,YAAQ,KAAK,CAAC;AAAA,EAChB,CAAC;AACH;","names":[]}
+{"version":3,"sources":["../src/cli/index.ts","../src/cli/program.ts","../src/cli/runners.ts","../src/cli/output.ts","../src/cli/types.ts"],"sourcesContent":["#!/usr/bin/env node\n\nimport { Command } from \"commander\";\nimport { fileURLToPath } from \"node:url\";\nimport { createProgram as createCliProgram } from \"./program.js\";\n\nexport function createProgram(): Command {\n  return createCliProgram();\n}\n\nasync function main(argv = process.argv): Promise<void> {\n  const program = createProgram();\n  await program.parseAsync(argv);\n}\n\nfunction isMainModule(): boolean {\n  if (!process.argv[1]) return false;\n  return fileURLToPath(import.meta.url) === process.argv[1];\n}\n\nif (isMainModule()) {\n  main().catch((error) => {\n    const message = error instanceof Error ? error.message : String(error);\n    process.stderr.write(`[autoremediator] ${message}\\n`);\n    process.exit(1);\n  });\n}\n","import { Command } from \"commander\";\nimport { OPTION_DESCRIPTIONS } from \"../api/index.js\";\nimport { existsSync } from \"node:fs\";\nimport { PACKAGE_VERSION } from \"../version\";\nimport { runScanInput, runSingleCve } from \"./runners.js\";\nimport type { CommandOptions } from \"./types.js\";\nimport { isCveId } from \"./types.js\";\n\nfunction addSharedOptions(program: Command, includeInput = false): Command {\n  program\n    .option(\"--cwd <path>\", OPTION_DESCRIPTIONS.cwd, process.cwd())\n    .option(\"--package-manager <name>\", OPTION_DESCRIPTIONS.packageManager)\n    .option(\"--patches-dir <path>\", OPTION_DESCRIPTIONS.patchesDir)\n    .option(\"--dry-run\", OPTION_DESCRIPTIONS.dryRun, false)\n    .option(\"--preview\", OPTION_DESCRIPTIONS.preview, false)\n    .option(\"--run-tests\", OPTION_DESCRIPTIONS.runTests, false)\n    .option(\"--llm-provider <provider>\", OPTION_DESCRIPTIONS.llmProvider)\n    .option(\"--request-id <id>\", OPTION_DESCRIPTIONS.requestId)\n    .option(\"--session-id <id>\", OPTION_DESCRIPTIONS.sessionId)\n    .option(\"--parent-run-id <id>\", OPTION_DESCRIPTIONS.parentRunId)\n    .option(\"--idempotency-key <key>\", OPTION_DESCRIPTIONS.idempotencyKey)\n    .option(\"--resume\", OPTION_DESCRIPTIONS.resume, false)\n    .option(\"--actor <name>\", OPTION_DESCRIPTIONS.actor)\n    .option(\"--source <src>\", `${OPTION_DESCRIPTIONS.source}: cli|sdk|mcp|openapi|unknown`)\n    .option(\"--direct-dependencies-only\", OPTION_DESCRIPTIONS.directDependenciesOnly, false)\n    .option(\"--prefer-version-bump\", OPTION_DESCRIPTIONS.preferVersionBump, false)\n    .option(\"--policy <path>\", OPTION_DESCRIPTIONS.policy)\n    .option(\"--evidence\", OPTION_DESCRIPTIONS.evidence, true)\n    .option(\"--no-evidence\", \"Disable evidence file output\")\n    .option(\"--ci\", \"Enable CI behavior (non-zero exit on failed remediations)\", false)\n    .option(\"--output-format <format>\", \"Output format: json|sarif\", \"json\")\n    .option(\"--json\", \"Print JSON output\", false);\n\n  if (includeInput) {\n    program.option(\"--input <path>\", `${OPTION_DESCRIPTIONS.inputPath} (scanner-first mode)`);\n  }\n\n  return program;\n}\n\nexport function createProgram(): Command {\n  const program = new Command();\n\n  program\n    .name(\"autoremediator\")\n    .description(\"Scanner-first Node.js vulnerability auto-remediation tool\")\n    .version(PACKAGE_VERSION)\n    .showHelpAfterError();\n\n  addSharedOptions(\n    program\n      .command(\"cve\")\n      .description(\"Remediate a single CVE ID\")\n      .argument(\"<cveId>\", OPTION_DESCRIPTIONS.cveId),\n    false\n  ).action(async (cveId: string, opts: CommandOptions, command: Command) => {\n    const merged = {\n      ...opts,\n      ...(command.optsWithGlobals() as Partial<CommandOptions>),\n    } as CommandOptions;\n    await runSingleCve(cveId, merged);\n  });\n\n  addSharedOptions(\n    program\n      .command(\"scan\")\n      .description(\"Remediate vulnerabilities from scanner output (npm/pnpm/yarn audit JSON or SARIF)\")\n      .requiredOption(\"--input <path>\", OPTION_DESCRIPTIONS.inputPath)\n      .option(\"--format <type>\", OPTION_DESCRIPTIONS.format, \"auto\")\n      .option(\"--summary-file <path>\", \"Write machine-readable scan summary JSON to path\"),\n    false\n  ).action(async (opts: CommandOptions) => {\n    await runScanInput(opts.input!, opts);\n  });\n\n  addSharedOptions(\n    program\n      .argument(\"[target]\", \"Scanner output file path (or CVE ID fallback)\")\n      .option(\"--format <type>\", OPTION_DESCRIPTIONS.format, \"auto\")\n      .option(\"--summary-file <path>\", \"Write machine-readable scan summary JSON to path\"),\n    true\n  ).action(async (target: string | undefined, opts: CommandOptions) => {\n    if (opts.input) {\n      await runScanInput(opts.input, opts);\n      return;\n    }\n\n    if (!target) {\n      program.outputHelp();\n      return;\n    }\n\n    if (isCveId(target)) {\n      await runSingleCve(target, opts);\n      return;\n    }\n\n    if (existsSync(target)) {\n      await runScanInput(target, opts);\n      return;\n    }\n\n    throw new Error(\n      `Target \"${target}\" is neither a valid CVE ID nor an existing scan file path.`\n    );\n  });\n\n  return program;\n}\n","import {\n  ciExitCode,\n  remediate,\n  remediateFromScan,\n  type ScanReport,\n  toCiSummary,\n  toSarifOutput,\n} from \"../api/index.js\";\nimport { writeFileSync } from \"node:fs\";\nimport { formatCountMap, logJson } from \"./output.js\";\nimport type { CommandOptions } from \"./types.js\";\n\nfunction asSingleCveScanReport(report: Awaited<ReturnType<typeof remediate>>): ScanReport {\n  return {\n    schemaVersion: \"1.0\",\n    status: report.results.some((result) => !result.applied && !result.dryRun)\n      ? report.results.some((result) => result.applied || result.dryRun)\n        ? \"partial\"\n        : \"failed\"\n      : \"ok\",\n    generatedAt: new Date().toISOString(),\n    cveIds: [report.cveId],\n    reports: [report],\n    successCount: report.results.filter((result) => result.applied || result.dryRun).length,\n    failedCount: report.results.filter((result) => !result.applied && !result.dryRun).length,\n    errors: [],\n    evidenceFile: report.evidenceFile,\n    patchCount: report.results.filter((result) => result.strategy === \"patch-file\").length,\n    correlation: report.correlation,\n    provenance: report.provenance,\n    constraints: report.constraints,\n  };\n}\n\nexport async function runSingleCve(cveId: string, opts: CommandOptions): Promise<void> {\n  const report = await remediate(cveId, {\n    cwd: opts.cwd,\n    packageManager: opts.packageManager,\n    dryRun: opts.dryRun,\n    preview: opts.preview,\n    runTests: opts.runTests,\n    patchesDir: opts.patchesDir,\n    policy: opts.policy,\n    evidence: opts.evidence,\n    llmProvider: opts.llmProvider,\n    requestId: opts.requestId,\n    sessionId: opts.sessionId,\n    parentRunId: opts.parentRunId,\n    idempotencyKey: opts.idempotencyKey,\n    resume: opts.resume,\n    actor: opts.actor,\n    source: opts.source ?? \"cli\",\n    constraints: {\n      directDependenciesOnly: opts.directDependenciesOnly,\n      preferVersionBump: opts.preferVersionBump,\n    },\n  });\n\n  const reportAsScan = asSingleCveScanReport(report);\n\n  if (opts.outputFormat === \"sarif\") {\n    logJson(toSarifOutput(reportAsScan));\n    if (opts.ci) {\n      process.exitCode = ciExitCode(toCiSummary(reportAsScan));\n    }\n    return;\n  }\n\n  if (opts.json) {\n    logJson(report);\n    if (opts.ci) {\n      process.exitCode = ciExitCode(toCiSummary(reportAsScan));\n    }\n    return;\n  }\n\n  process.stdout.write(`${report.summary}\\n`);\n  process.stdout.write(`Results: ${report.results.length}\\n`);\n  if (report.evidenceFile) {\n    process.stdout.write(`Evidence: ${report.evidenceFile}\\n`);\n  }\n  if (opts.ci) {\n    process.exitCode = ciExitCode(toCiSummary(reportAsScan));\n  }\n}\n\nexport async function runScanInput(inputPath: string, opts: CommandOptions): Promise<void> {\n  const report = await remediateFromScan(inputPath, {\n    cwd: opts.cwd,\n    packageManager: opts.packageManager,\n    format: opts.format,\n    policy: opts.policy,\n    patchesDir: opts.patchesDir,\n    dryRun: opts.dryRun,\n    preview: opts.preview,\n    runTests: opts.runTests,\n    llmProvider: opts.llmProvider,\n    evidence: opts.evidence,\n    requestId: opts.requestId,\n    sessionId: opts.sessionId,\n    parentRunId: opts.parentRunId,\n    idempotencyKey: opts.idempotencyKey,\n    resume: opts.resume,\n    actor: opts.actor,\n    source: opts.source ?? \"cli\",\n    constraints: {\n      directDependenciesOnly: opts.directDependenciesOnly,\n      preferVersionBump: opts.preferVersionBump,\n    },\n  });\n\n  if (opts.summaryFile) {\n    const summary = toCiSummary(report);\n    writeFileSync(opts.summaryFile, JSON.stringify(summary, null, 2) + \"\\n\", \"utf8\");\n  }\n\n  if (opts.outputFormat === \"sarif\") {\n    logJson(toSarifOutput(report));\n    if (opts.ci) {\n      process.exitCode = ciExitCode(toCiSummary(report));\n    }\n    return;\n  }\n\n  if (opts.json) {\n    logJson(report);\n    if (opts.ci) {\n      process.exitCode = ciExitCode(toCiSummary(report));\n    }\n    return;\n  }\n\n  process.stdout.write(`CVEs found: ${report.cveIds.length}\\n`);\n  process.stdout.write(`Remediation reports: ${report.reports.length}\\n`);\n  process.stdout.write(`Successful remediations: ${report.successCount}\\n`);\n  process.stdout.write(`Failed remediations: ${report.failedCount}\\n`);\n  const strategyCounts = formatCountMap(report.strategyCounts);\n  if (strategyCounts) {\n    process.stdout.write(`Strategy counts: ${strategyCounts}\\n`);\n  }\n  const dependencyScopeCounts = formatCountMap(report.dependencyScopeCounts);\n  if (dependencyScopeCounts) {\n    process.stdout.write(`Dependency scope counts: ${dependencyScopeCounts}\\n`);\n  }\n  const unresolvedByReason = formatCountMap(report.unresolvedByReason);\n  if (unresolvedByReason) {\n    process.stdout.write(`Unresolved reasons: ${unresolvedByReason}\\n`);\n  }\n  if (report.evidenceFile) {\n    process.stdout.write(`Evidence: ${report.evidenceFile}\\n`);\n  }\n\n  if (report.errors.length > 0) {\n    for (const error of report.errors) {\n      process.stdout.write(`Error ${error.cveId}: ${error.message}\\n`);\n    }\n  }\n\n  if (opts.ci) {\n    process.exitCode = ciExitCode(toCiSummary(report));\n  }\n}\n","export function logJson(value: unknown): void {\n  process.stdout.write(`${JSON.stringify(value, null, 2)}\\n`);\n}\n\nexport function formatCountMap(counts: Record<string, number> | undefined): string | undefined {\n  if (!counts) return undefined;\n\n  const entries = Object.entries(counts).filter(([, value]) => value > 0);\n  if (entries.length === 0) return undefined;\n\n  return entries.map(([key, value]) => `${key}=${value}`).join(\", \");\n}\n","export type ScanFormat = \"auto\" | \"npm-audit\" | \"yarn-audit\" | \"sarif\";\n\nexport interface CommandOptions {\n  cwd: string;\n  packageManager?: \"npm\" | \"pnpm\" | \"yarn\";\n  patchesDir?: string;\n  dryRun: boolean;\n  preview: boolean;\n  runTests: boolean;\n  json: boolean;\n  outputFormat: \"json\" | \"sarif\";\n  llmProvider?: \"openai\" | \"anthropic\" | \"local\";\n  requestId?: string;\n  sessionId?: string;\n  parentRunId?: string;\n  idempotencyKey?: string;\n  resume: boolean;\n  actor?: string;\n  source?: \"cli\" | \"sdk\" | \"mcp\" | \"openapi\" | \"unknown\";\n  directDependenciesOnly: boolean;\n  preferVersionBump: boolean;\n  input?: string;\n  format: ScanFormat;\n  policy?: string;\n  evidence: boolean;\n  ci: boolean;\n  summaryFile?: string;\n}\n\nexport function isCveId(value: string): boolean {\n  return /^CVE-\\d{4}-\\d+$/i.test(value);\n}\n"],"mappings":";;;;;;;;;;;;;;AAGA,SAAS,qBAAqB;;;ACH9B,SAAS,eAAe;AAExB,SAAS,kBAAkB;;;ACM3B,SAAS,qBAAqB;;;ACRvB,SAAS,QAAQ,OAAsB;AAC5C,UAAQ,OAAO,MAAM,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA,CAAI;AAC5D;AAEO,SAAS,eAAe,QAAgE;AAC7F,MAAI,CAAC,OAAQ,QAAO;AAEpB,QAAM,UAAU,OAAO,QAAQ,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,MAAM,QAAQ,CAAC;AACtE,MAAI,QAAQ,WAAW,EAAG,QAAO;AAEjC,SAAO,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,GAAG,GAAG,IAAI,KAAK,EAAE,EAAE,KAAK,IAAI;AACnE;;;ADCA,SAAS,sBAAsB,QAA2D;AACxF,SAAO;AAAA,IACL,eAAe;AAAA,IACf,QAAQ,OAAO,QAAQ,KAAK,CAAC,WAAW,CAAC,OAAO,WAAW,CAAC,OAAO,MAAM,IACrE,OAAO,QAAQ,KAAK,CAAC,WAAW,OAAO,WAAW,OAAO,MAAM,IAC7D,YACA,WACF;AAAA,IACJ,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,IACpC,QAAQ,CAAC,OAAO,KAAK;AAAA,IACrB,SAAS,CAAC,MAAM;AAAA,IAChB,cAAc,OAAO,QAAQ,OAAO,CAAC,WAAW,OAAO,WAAW,OAAO,MAAM,EAAE;AAAA,IACjF,aAAa,OAAO,QAAQ,OAAO,CAAC,WAAW,CAAC,OAAO,WAAW,CAAC,OAAO,MAAM,EAAE;AAAA,IAClF,QAAQ,CAAC;AAAA,IACT,cAAc,OAAO;AAAA,IACrB,YAAY,OAAO,QAAQ,OAAO,CAAC,WAAW,OAAO,aAAa,YAAY,EAAE;AAAA,IAChF,aAAa,OAAO;AAAA,IACpB,YAAY,OAAO;AAAA,IACnB,aAAa,OAAO;AAAA,EACtB;AACF;AAEA,eAAsB,aAAa,OAAe,MAAqC;AACrF,QAAM,SAAS,MAAM,UAAU,OAAO;AAAA,IACpC,KAAK,KAAK;AAAA,IACV,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK;AAAA,IACb,SAAS,KAAK;AAAA,IACd,UAAU,KAAK;AAAA,IACf,YAAY,KAAK;AAAA,IACjB,QAAQ,KAAK;AAAA,IACb,UAAU,KAAK;AAAA,IACf,aAAa,KAAK;AAAA,IAClB,WAAW,KAAK;AAAA,IAChB,WAAW,KAAK;AAAA,IAChB,aAAa,KAAK;AAAA,IAClB,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK;AAAA,IACb,OAAO,KAAK;AAAA,IACZ,QAAQ,KAAK,UAAU;AAAA,IACvB,aAAa;AAAA,MACX,wBAAwB,KAAK;AAAA,MAC7B,mBAAmB,KAAK;AAAA,IAC1B;AAAA,EACF,CAAC;AAED,QAAM,eAAe,sBAAsB,MAAM;AAEjD,MAAI,KAAK,iBAAiB,SAAS;AACjC,YAAQ,cAAc,YAAY,CAAC;AACnC,QAAI,KAAK,IAAI;AACX,cAAQ,WAAW,WAAW,YAAY,YAAY,CAAC;AAAA,IACzD;AACA;AAAA,EACF;AAEA,MAAI,KAAK,MAAM;AACb,YAAQ,MAAM;AACd,QAAI,KAAK,IAAI;AACX,cAAQ,WAAW,WAAW,YAAY,YAAY,CAAC;AAAA,IACzD;AACA;AAAA,EACF;AAEA,UAAQ,OAAO,MAAM,GAAG,OAAO,OAAO;AAAA,CAAI;AAC1C,UAAQ,OAAO,MAAM,YAAY,OAAO,QAAQ,MAAM;AAAA,CAAI;AAC1D,MAAI,OAAO,cAAc;AACvB,YAAQ,OAAO,MAAM,aAAa,OAAO,YAAY;AAAA,CAAI;AAAA,EAC3D;AACA,MAAI,KAAK,IAAI;AACX,YAAQ,WAAW,WAAW,YAAY,YAAY,CAAC;AAAA,EACzD;AACF;AAEA,eAAsB,aAAa,WAAmB,MAAqC;AACzF,QAAM,SAAS,MAAM,kBAAkB,WAAW;AAAA,IAChD,KAAK,KAAK;AAAA,IACV,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK;AAAA,IACb,QAAQ,KAAK;AAAA,IACb,YAAY,KAAK;AAAA,IACjB,QAAQ,KAAK;AAAA,IACb,SAAS,KAAK;AAAA,IACd,UAAU,KAAK;AAAA,IACf,aAAa,KAAK;AAAA,IAClB,UAAU,KAAK;AAAA,IACf,WAAW,KAAK;AAAA,IAChB,WAAW,KAAK;AAAA,IAChB,aAAa,KAAK;AAAA,IAClB,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK;AAAA,IACb,OAAO,KAAK;AAAA,IACZ,QAAQ,KAAK,UAAU;AAAA,IACvB,aAAa;AAAA,MACX,wBAAwB,KAAK;AAAA,MAC7B,mBAAmB,KAAK;AAAA,IAC1B;AAAA,EACF,CAAC;AAED,MAAI,KAAK,aAAa;AACpB,UAAM,UAAU,YAAY,MAAM;AAClC,kBAAc,KAAK,aAAa,KAAK,UAAU,SAAS,MAAM,CAAC,IAAI,MAAM,MAAM;AAAA,EACjF;AAEA,MAAI,KAAK,iBAAiB,SAAS;AACjC,YAAQ,cAAc,MAAM,CAAC;AAC7B,QAAI,KAAK,IAAI;AACX,cAAQ,WAAW,WAAW,YAAY,MAAM,CAAC;AAAA,IACnD;AACA;AAAA,EACF;AAEA,MAAI,KAAK,MAAM;AACb,YAAQ,MAAM;AACd,QAAI,KAAK,IAAI;AACX,cAAQ,WAAW,WAAW,YAAY,MAAM,CAAC;AAAA,IACnD;AACA;AAAA,EACF;AAEA,UAAQ,OAAO,MAAM,eAAe,OAAO,OAAO,MAAM;AAAA,CAAI;AAC5D,UAAQ,OAAO,MAAM,wBAAwB,OAAO,QAAQ,MAAM;AAAA,CAAI;AACtE,UAAQ,OAAO,MAAM,4BAA4B,OAAO,YAAY;AAAA,CAAI;AACxE,UAAQ,OAAO,MAAM,wBAAwB,OAAO,WAAW;AAAA,CAAI;AACnE,QAAM,iBAAiB,eAAe,OAAO,cAAc;AAC3D,MAAI,gBAAgB;AAClB,YAAQ,OAAO,MAAM,oBAAoB,cAAc;AAAA,CAAI;AAAA,EAC7D;AACA,QAAM,wBAAwB,eAAe,OAAO,qBAAqB;AACzE,MAAI,uBAAuB;AACzB,YAAQ,OAAO,MAAM,4BAA4B,qBAAqB;AAAA,CAAI;AAAA,EAC5E;AACA,QAAM,qBAAqB,eAAe,OAAO,kBAAkB;AACnE,MAAI,oBAAoB;AACtB,YAAQ,OAAO,MAAM,uBAAuB,kBAAkB;AAAA,CAAI;AAAA,EACpE;AACA,MAAI,OAAO,cAAc;AACvB,YAAQ,OAAO,MAAM,aAAa,OAAO,YAAY;AAAA,CAAI;AAAA,EAC3D;AAEA,MAAI,OAAO,OAAO,SAAS,GAAG;AAC5B,eAAW,SAAS,OAAO,QAAQ;AACjC,cAAQ,OAAO,MAAM,SAAS,MAAM,KAAK,KAAK,MAAM,OAAO;AAAA,CAAI;AAAA,IACjE;AAAA,EACF;AAEA,MAAI,KAAK,IAAI;AACX,YAAQ,WAAW,WAAW,YAAY,MAAM,CAAC;AAAA,EACnD;AACF;;;AEpIO,SAAS,QAAQ,OAAwB;AAC9C,SAAO,mBAAmB,KAAK,KAAK;AACtC;;;AHvBA,SAAS,iBAAiB,SAAkB,eAAe,OAAgB;AACzE,UACG,OAAO,gBAAgB,oBAAoB,KAAK,QAAQ,IAAI,CAAC,EAC7D,OAAO,4BAA4B,oBAAoB,cAAc,EACrE,OAAO,wBAAwB,oBAAoB,UAAU,EAC7D,OAAO,aAAa,oBAAoB,QAAQ,KAAK,EACrD,OAAO,aAAa,oBAAoB,SAAS,KAAK,EACtD,OAAO,eAAe,oBAAoB,UAAU,KAAK,EACzD,OAAO,6BAA6B,oBAAoB,WAAW,EACnE,OAAO,qBAAqB,oBAAoB,SAAS,EACzD,OAAO,qBAAqB,oBAAoB,SAAS,EACzD,OAAO,wBAAwB,oBAAoB,WAAW,EAC9D,OAAO,2BAA2B,oBAAoB,cAAc,EACpE,OAAO,YAAY,oBAAoB,QAAQ,KAAK,EACpD,OAAO,kBAAkB,oBAAoB,KAAK,EAClD,OAAO,kBAAkB,GAAG,oBAAoB,MAAM,+BAA+B,EACrF,OAAO,8BAA8B,oBAAoB,wBAAwB,KAAK,EACtF,OAAO,yBAAyB,oBAAoB,mBAAmB,KAAK,EAC5E,OAAO,mBAAmB,oBAAoB,MAAM,EACpD,OAAO,cAAc,oBAAoB,UAAU,IAAI,EACvD,OAAO,iBAAiB,8BAA8B,EACtD,OAAO,QAAQ,6DAA6D,KAAK,EACjF,OAAO,4BAA4B,6BAA6B,MAAM,EACtE,OAAO,UAAU,qBAAqB,KAAK;AAE9C,MAAI,cAAc;AAChB,YAAQ,OAAO,kBAAkB,GAAG,oBAAoB,SAAS,uBAAuB;AAAA,EAC1F;AAEA,SAAO;AACT;AAEO,SAAS,gBAAyB;AACvC,QAAM,UAAU,IAAI,QAAQ;AAE5B,UACG,KAAK,gBAAgB,EACrB,YAAY,2DAA2D,EACvE,QAAQ,eAAe,EACvB,mBAAmB;AAEtB;AAAA,IACE,QACG,QAAQ,KAAK,EACb,YAAY,2BAA2B,EACvC,SAAS,WAAW,oBAAoB,KAAK;AAAA,IAChD;AAAA,EACF,EAAE,OAAO,OAAO,OAAe,MAAsB,YAAqB;AACxE,UAAM,SAAS;AAAA,MACb,GAAG;AAAA,MACH,GAAI,QAAQ,gBAAgB;AAAA,IAC9B;AACA,UAAM,aAAa,OAAO,MAAM;AAAA,EAClC,CAAC;AAED;AAAA,IACE,QACG,QAAQ,MAAM,EACd,YAAY,mFAAmF,EAC/F,eAAe,kBAAkB,oBAAoB,SAAS,EAC9D,OAAO,mBAAmB,oBAAoB,QAAQ,MAAM,EAC5D,OAAO,yBAAyB,kDAAkD;AAAA,IACrF;AAAA,EACF,EAAE,OAAO,OAAO,SAAyB;AACvC,UAAM,aAAa,KAAK,OAAQ,IAAI;AAAA,EACtC,CAAC;AAED;AAAA,IACE,QACG,SAAS,YAAY,+CAA+C,EACpE,OAAO,mBAAmB,oBAAoB,QAAQ,MAAM,EAC5D,OAAO,yBAAyB,kDAAkD;AAAA,IACrF;AAAA,EACF,EAAE,OAAO,OAAO,QAA4B,SAAyB;AACnE,QAAI,KAAK,OAAO;AACd,YAAM,aAAa,KAAK,OAAO,IAAI;AACnC;AAAA,IACF;AAEA,QAAI,CAAC,QAAQ;AACX,cAAQ,WAAW;AACnB;AAAA,IACF;AAEA,QAAI,QAAQ,MAAM,GAAG;AACnB,YAAM,aAAa,QAAQ,IAAI;AAC/B;AAAA,IACF;AAEA,QAAI,WAAW,MAAM,GAAG;AACtB,YAAM,aAAa,QAAQ,IAAI;AAC/B;AAAA,IACF;AAEA,UAAM,IAAI;AAAA,MACR,WAAW,MAAM;AAAA,IACnB;AAAA,EACF,CAAC;AAED,SAAO;AACT;;;ADtGO,SAASA,iBAAyB;AACvC,SAAO,cAAiB;AAC1B;AAEA,eAAe,KAAK,OAAO,QAAQ,MAAqB;AACtD,QAAM,UAAUA,eAAc;AAC9B,QAAM,QAAQ,WAAW,IAAI;AAC/B;AAEA,SAAS,eAAwB;AAC/B,MAAI,CAAC,QAAQ,KAAK,CAAC,EAAG,QAAO;AAC7B,SAAO,cAAc,YAAY,GAAG,MAAM,QAAQ,KAAK,CAAC;AAC1D;AAEA,IAAI,aAAa,GAAG;AAClB,OAAK,EAAE,MAAM,CAAC,UAAU;AACtB,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,YAAQ,OAAO,MAAM,oBAAoB,OAAO;AAAA,CAAI;AACpD,YAAQ,KAAK,CAAC;AAAA,EAChB,CAAC;AACH;","names":["createProgram"]}

package/dist/index.d.ts

@@ -1,214 +1,12 @@
-/** A resolved CVE entry with affected npm package info */
-interface CveDetails {
-    id: string;
-    summary: string;
-    severity: "LOW" | "MEDIUM" | "HIGH" | "CRITICAL" | "UNKNOWN";
-    cvssScore?: number;
-    epss?: {
-        score: number;
-        percentile: number;
-        date?: string;
-    };
-    kev?: {
-        knownExploited: boolean;
-        dateAdded?: string;
-        dueDate?: string;
-        requiredAction?: string;
-        knownRansomwareCampaignUse?: string;
-    };
-    intelligence?: {
-        cveServicesEnriched?: boolean;
-        gitlabAdvisoryMatched?: boolean;
-        certCcMatched?: boolean;
-        depsDevEnrichedPackages?: number;
-        scorecardProjects?: number;
-        vendorAdvisories?: string[];
-        commercialFeeds?: string[];
-        sourceHealth?: Record<string, {
-            attempted: boolean;
-            changed: boolean;
-            error?: string;
-        }>;
-    };
-    references: string[];
-    affectedPackages: AffectedPackage[];
-}
-/** A single npm package affected by a CVE */
-interface AffectedPackage {
-    name: string;
-    ecosystem: "npm";
-    /** Semver range string for the vulnerable version window, e.g. ">=0.0.0 <4.17.21" */
-    vulnerableRange: string;
-    /** The first version that is NOT vulnerable (the safe upgrade target) */
-    firstPatchedVersion?: string;
-    /** Source that provided this entry */
-    source: "osv" | "github-advisory";
-}
-/** A package found in the consumer's project */
-interface InventoryPackage {
-    name: string;
-    version: string;
-    /** "direct" = listed in package.json; "indirect" = transitive dep */
-    type: "direct" | "indirect";
-}
-/** A package that is both installed and matches a vulnerable range */
-interface VulnerablePackage {
-    installed: InventoryPackage;
-    affected: AffectedPackage;
-    /** The resolved safe upgrade version, if one exists on npm */
-    safeUpgradeVersion?: string;
-}
-/** The outcome of a single patch operation */
-type PatchStrategy = "version-bump" | "patch-file" | "none";
-interface PatchResult {
-    packageName: string;
-    strategy: PatchStrategy;
-    fromVersion: string;
-    toVersion?: string;
-    patchFilePath?: string;
-    applied: boolean;
-    dryRun: boolean;
-    message: string;
-    validation?: {
-        passed: boolean;
-        error?: string;
-    };
-}
-interface CorrelationContext {
-    requestId?: string;
-    sessionId?: string;
-    parentRunId?: string;
-}
-interface RemediationConstraints {
-    directDependenciesOnly?: boolean;
-    preferVersionBump?: boolean;
-}
-interface ProvenanceContext {
-    actor?: string;
-    source?: "cli" | "sdk" | "mcp" | "openapi" | "unknown";
-}
-/** Top-level options for the remediate() API and CLI */
-interface RemediateOptions extends CorrelationContext {
-    /** Working directory of the consumer's project (defaults to process.cwd()) */
-    cwd?: string;
-    /** Package manager to use (defaults to auto-detect from lockfile) */
-    packageManager?: "npm" | "pnpm" | "yarn";
-    /** If true, plan and report changes but do not write anything */
-    dryRun?: boolean;
-    /** If true, run package-manager tests after patching */
-    runTests?: boolean;
-    /** Override the LLM provider (falls back to env AUTOREMEDIATOR_LLM_PROVIDER) */
-    llmProvider?: "openai" | "anthropic" | "local";
-    /** Override the model name */
-    model?: string;
-    /** Optional path to a policy file (.autoremediator.json) */
-    policy?: string;
-    /** Directory to write .patch files (default: ./patches) */
-    patchesDir?: string;
-    /** If true, run a non-mutating remediation preview (forces dryRun behavior for mutation tools). */
-    preview?: boolean;
-    /** Optional deterministic idempotency key for request replay handling. */
-    idempotencyKey?: string;
-    /** If true, return cached report for matching idempotency key + CVE when available. */
-    resume?: boolean;
-    /** Optional caller provenance fields for evidence and reporting. */
-    actor?: string;
-    source?: "cli" | "sdk" | "mcp" | "openapi" | "unknown";
-    /** Optional orchestration constraints for result enforcement. */
-    constraints?: RemediationConstraints;
-}
-/** Final report returned by the remediation pipeline */
-interface RemediationReport {
-    cveId: string;
-    cveDetails: CveDetails | null;
-    vulnerablePackages: VulnerablePackage[];
-    results: PatchResult[];
-    agentSteps: number;
-    summary: string;
-    correlation?: CorrelationContext;
-    provenance?: ProvenanceContext;
-    constraints?: RemediationConstraints;
-    resumedFromCache?: boolean;
-}
-
-type ScanInputFormat = "npm-audit" | "yarn-audit" | "sarif" | "auto";
+import { R as RemediateOptions, a as RemediationReport, C as CiSummary, S as ScanReport } from './remediate-from-scan-C-E7gqxF.js';
+export { A as AffectedPackage, b as CorrelationContext, c as CveDetails, D as DependencyScope, d as DependencyScopeCounts, I as InventoryPackage, P as PatchResult, e as PatchStrategy, f as PatchStrategyCounts, g as ProvenanceContext, h as RemediationConstraints, i as ScanInputFormat, j as ScanOptions, U as UnresolvedReason, k as UnresolvedReasonCounts, V as VulnerablePackage, p as planRemediation, r as remediate, l as remediateFromScan } from './remediate-from-scan-C-E7gqxF.js';
+export { L as LLM_PROVIDER_VALUES, O as OPTION_DESCRIPTIONS, P as PACKAGE_MANAGER_VALUES, a as PROVENANCE_SOURCE_VALUES, c as createConstraintSchemaProperties, b as createRemediateOptionSchemaProperties, d as createScanOptionSchemaProperties, e as createScanReportSchemaProperties } from './options-schema-DfLBOsPI.js';
 
 declare function runRemediationPipeline(cveId: string, options?: RemediateOptions): Promise<RemediationReport>;
 
-interface ScanOptions extends RemediateOptions {
-    format?: ScanInputFormat;
-    policy?: string;
-    evidence?: boolean;
-}
-interface ScanReport {
-    schemaVersion: "1.0";
-    status: "ok" | "partial" | "failed";
-    generatedAt: string;
-    cveIds: string[];
-    reports: RemediationReport[];
-    successCount: number;
-    failedCount: number;
-    errors: Array<{
-        cveId: string;
-        message: string;
-    }>;
-    evidenceFile?: string;
-    patchCount: number;
-    patchValidationFailures?: Array<{
-        packageName: string;
-        cveId: string;
-        error: string;
-    }>;
-    patchesDir?: string;
-    correlation?: CorrelationContext;
-    provenance?: ProvenanceContext;
-    constraints?: RemediationConstraints;
-    idempotencyKey?: string;
-}
-interface CiSummary {
-    schemaVersion: "1.0";
-    status: "ok" | "partial" | "failed";
-    generatedAt: string;
-    cveCount: number;
-    remediationCount: number;
-    successCount: number;
-    failedCount: number;
-    errors: Array<{
-        cveId: string;
-        message: string;
-    }>;
-    evidenceFile?: string;
-    patchCount?: number;
-    patchValidationFailures?: Array<{
-        packageName: string;
-        cveId: string;
-        error: string;
-    }>;
-    patchesDir?: string;
-    correlation?: CorrelationContext;
-    provenance?: ProvenanceContext;
-    constraints?: RemediationConstraints;
-    idempotencyKey?: string;
-}
-/**
- * Main entry point for programmatic use.
- *
- * @param cveId  - CVE identifier, e.g. "CVE-2021-23337"
- * @param options - Optional configuration (cwd, dryRun, llmProvider, etc.)
- * @returns       A RemediationReport describing what was found and done
- */
-declare function remediate(cveId: string, options?: RemediateOptions): Promise<RemediationReport>;
-/**
- * Non-mutating preview entrypoint for planning and orchestration.
- */
-declare function planRemediation(cveId: string, options?: RemediateOptions): Promise<RemediationReport>;
-/**
- * Scanner-first entrypoint: parse a scanner output file (npm audit JSON or SARIF),
- * extract CVEs, and run remediations one-by-one.
- */
-declare function remediateFromScan(inputPath: string, options?: ScanOptions): Promise<ScanReport>;
 declare function toCiSummary(report: ScanReport): CiSummary;
 declare function ciExitCode(summary: CiSummary): number;
+
 type SarifLevel = "error" | "warning" | "note" | "none";
 interface SarifRule {
     id: string;
@@ -256,9 +54,6 @@ interface SarifOutput {
         results: SarifResult[];
     }>;
 }
-/**
- * Convert a ScanReport to SARIF 2.1.0 format for GitHub Code Scanning upload.
- */
 declare function toSarifOutput(report: ScanReport): SarifOutput;
 
-export { type AffectedPackage, type CiSummary, type CorrelationContext, type CveDetails, type InventoryPackage, type PatchResult, type PatchStrategy, type ProvenanceContext, type RemediateOptions, type RemediationConstraints, type RemediationReport, type SarifOutput, type ScanInputFormat, type ScanOptions, type ScanReport, type VulnerablePackage, ciExitCode, planRemediation, remediate, remediateFromScan, runRemediationPipeline, toCiSummary, toSarifOutput };
+export { CiSummary, RemediateOptions, RemediationReport, type SarifOutput, ScanReport, ciExitCode, runRemediationPipeline, toCiSummary, toSarifOutput };

package/dist/index.js

@@ -1,14 +1,30 @@
 import {
+  LLM_PROVIDER_VALUES,
+  OPTION_DESCRIPTIONS,
+  PACKAGE_MANAGER_VALUES,
+  PROVENANCE_SOURCE_VALUES,
   ciExitCode,
+  createConstraintSchemaProperties,
+  createRemediateOptionSchemaProperties,
+  createScanOptionSchemaProperties,
+  createScanReportSchemaProperties,
   planRemediation,
   remediate,
   remediateFromScan,
   runRemediationPipeline,
   toCiSummary,
   toSarifOutput
-} from "./chunk-VLXGEH7U.js";
+} from "./chunk-MUFP2DQX.js";
 export {
+  LLM_PROVIDER_VALUES,
+  OPTION_DESCRIPTIONS,
+  PACKAGE_MANAGER_VALUES,
+  PROVENANCE_SOURCE_VALUES,
   ciExitCode,
+  createConstraintSchemaProperties,
+  createRemediateOptionSchemaProperties,
+  createScanOptionSchemaProperties,
+  createScanReportSchemaProperties,
   planRemediation,
   remediate,
   remediateFromScan,