autoremediator 0.6.0 → 0.7.0

package/dist/openapi/server.d.ts

@@ -1,14 +1,6 @@
+import { J as JsonSchemaProperty } from '../options-schema-DfLBOsPI.js';
 import http from 'node:http';
-import { remediate, remediateFromScan, planRemediation } from '../index.js';
-
-/**
- * autoremediator OpenAPI HTTP server
- *
- * Exposes POST /remediate and POST /remediate-from-scan as a lightweight
- * HTTP server using Node.js built-in http module (no framework dependency).
- *
- * Start: node dist/openapi/server.js [--port 3000]
- */
+import { r as remediate, l as remediateFromScan, p as planRemediation } from '../remediate-from-scan-C-E7gqxF.js';
 
 interface OpenApiServerDeps {
     remediateFn: typeof remediate;
@@ -44,9 +36,7 @@ declare const OPENAPI_SPEC: {
                                     options: {
                                         type: string;
                                         description: string;
-                                        properties: Record<string, {
-                                            [x: string]: unknown;
-                                        }>;
+                                        properties: Record<string, JsonSchemaProperty>;
                                     };
                                 };
                             };
@@ -102,9 +92,7 @@ declare const OPENAPI_SPEC: {
                                     options: {
                                         type: string;
                                         description: string;
-                                        properties: Record<string, {
-                                            [x: string]: unknown;
-                                        }>;
+                                        properties: Record<string, JsonSchemaProperty>;
                                     };
                                 };
                             };
@@ -159,9 +147,7 @@ declare const OPENAPI_SPEC: {
                                     options: {
                                         type: string;
                                         description: string;
-                                        properties: Record<string, {
-                                            [x: string]: unknown;
-                                        }>;
+                                        properties: Record<string, JsonSchemaProperty>;
                                     };
                                 };
                             };
@@ -175,9 +161,7 @@ declare const OPENAPI_SPEC: {
                             "application/json": {
                                 schema: {
                                     type: string;
-                                    properties: Record<string, {
-                                        [x: string]: unknown;
-                                    }>;
+                                    properties: Record<string, JsonSchemaProperty>;
                                 };
                             };
                         };

package/dist/openapi/server.js

@@ -9,7 +9,7 @@ import {
   planRemediation,
   remediate,
   remediateFromScan
-} from "../chunk-ZXPLOIB7.js";
+} from "../chunk-MUFP2DQX.js";
 
 // src/openapi/server.ts
 import http from "http";
@@ -205,7 +205,7 @@ var OPENAPI_SPEC = {
                   options: {
                     type: "object",
                     description: "RemediateOptions",
-                    properties: createRemediateOptionSchemaProperties({ includeDryRun: false, includePreview: false })
+                    properties: createRemediateOptionSchemaProperties({ includeDryRun: false, includePreview: false, includeEvidence: true })
                   }
                 }
               }

package/dist/openapi/server.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/openapi/server.ts"],"sourcesContent":["/**\n * autoremediator OpenAPI HTTP server\n *\n * Exposes POST /remediate and POST /remediate-from-scan as a lightweight\n * HTTP server using Node.js built-in http module (no framework dependency).\n *\n * Start: node dist/openapi/server.js [--port 3000]\n */\nimport http from \"node:http\";\nimport { fileURLToPath } from \"node:url\";\nimport {\n  createRemediateOptionSchemaProperties,\n  createScanOptionSchemaProperties,\n  createScanReportSchemaProperties,\n  OPTION_DESCRIPTIONS,\n  planRemediation,\n  remediate,\n  remediateFromScan,\n} from \"../api.js\";\nimport type { RemediateOptions, ScanOptions } from \"../api.js\";\nimport { PACKAGE_VERSION } from \"../version\";\n\nconst DEFAULT_PORT = 3000;\n\nfunction parsePort(): number {\n  const idx = process.argv.indexOf(\"--port\");\n  if (idx !== -1 && process.argv[idx + 1]) {\n    const p = parseInt(process.argv[idx + 1], 10);\n    if (!isNaN(p)) return p;\n  }\n  if (process.env.PORT) {\n    const p = parseInt(process.env.PORT, 10);\n    if (!isNaN(p)) return p;\n  }\n  return DEFAULT_PORT;\n}\n\nfunction readBody(req: http.IncomingMessage): Promise<unknown> {\n  return new Promise((resolve, reject) => {\n    let raw = \"\";\n    req.setEncoding(\"utf8\");\n    req.on(\"data\", (chunk: string) => { raw += chunk; });\n    req.on(\"end\", () => {\n      try {\n        resolve(raw ? JSON.parse(raw) : {});\n      } catch {\n        reject(new Error(\"Invalid JSON body\"));\n      }\n    });\n    req.on(\"error\", reject);\n  });\n}\n\nfunction send(res: http.ServerResponse, status: number, body: unknown): void {\n  const payload = JSON.stringify(body);\n  res.writeHead(status, {\n    \"Content-Type\": \"application/json\",\n    \"Content-Length\": Buffer.byteLength(payload),\n  });\n  res.end(payload);\n}\n\nfunction withOpenApiSource(options: unknown): Record<string, unknown> {\n  const normalized = typeof options === \"object\" && options !== null\n    ? (options as Record<string, unknown>)\n    : {};\n  return {\n    ...normalized,\n    source: typeof normalized.source === \"string\" ? normalized.source : \"openapi\",\n  };\n}\n\ninterface OpenApiServerDeps {\n  remediateFn: typeof remediate;\n  remediateFromScanFn: typeof remediateFromScan;\n  planRemediationFn: typeof planRemediation;\n}\n\nconst defaultDeps: OpenApiServerDeps = {\n  remediateFn: remediate,\n  remediateFromScanFn: remediateFromScan,\n  planRemediationFn: planRemediation,\n};\n\nexport function createOpenApiServer(deps: OpenApiServerDeps = defaultDeps): http.Server {\n  return http.createServer(async (req, res) => {\n    const url = new URL(req.url ?? \"/\", `http://localhost`);\n    const method = req.method?.toUpperCase();\n\n  // Health check\n  if (method === \"GET\" && url.pathname === \"/health\") {\n    return send(res, 200, { status: \"ok\" });\n  }\n\n  // OpenAPI spec\n  if (method === \"GET\" && url.pathname === \"/openapi.json\") {\n    return send(res, 200, OPENAPI_SPEC);\n  }\n\n    if (method === \"POST\" && url.pathname === \"/remediate\") {\n    let body: { cveId?: unknown; options?: unknown };\n    try {\n      body = (await readBody(req)) as typeof body;\n    } catch {\n      return send(res, 400, { error: \"Invalid JSON body\" });\n    }\n    if (typeof body.cveId !== \"string\" || !body.cveId) {\n      return send(res, 400, { error: \"cveId is required (string)\" });\n    }\n    try {\n      const report = await deps.remediateFn(body.cveId, withOpenApiSource(body.options) as RemediateOptions);\n      return send(res, 200, report);\n    } catch (err) {\n      const message = err instanceof Error ? err.message : String(err);\n      return send(res, 400, { error: message });\n    }\n  }\n\n    if (method === \"POST\" && url.pathname === \"/plan-remediation\") {\n    let body: { cveId?: unknown; options?: unknown };\n    try {\n      body = (await readBody(req)) as typeof body;\n    } catch {\n      return send(res, 400, { error: \"Invalid JSON body\" });\n    }\n    if (typeof body.cveId !== \"string\" || !body.cveId) {\n      return send(res, 400, { error: \"cveId is required (string)\" });\n    }\n    try {\n      const report = await deps.planRemediationFn(body.cveId, withOpenApiSource(body.options) as RemediateOptions);\n      return send(res, 200, report);\n    } catch (err) {\n      const message = err instanceof Error ? err.message : String(err);\n      return send(res, 400, { error: message });\n    }\n  }\n\n    if (method === \"POST\" && url.pathname === \"/remediate-from-scan\") {\n    let body: { inputPath?: unknown; options?: unknown };\n    try {\n      body = (await readBody(req)) as typeof body;\n    } catch {\n      return send(res, 400, { error: \"Invalid JSON body\" });\n    }\n    if (typeof body.inputPath !== \"string\" || !body.inputPath) {\n      return send(res, 400, { error: \"inputPath is required (string)\" });\n    }\n    try {\n      const report = await deps.remediateFromScanFn(body.inputPath, withOpenApiSource(body.options) as ScanOptions);\n      return send(res, 200, report);\n    } catch (err) {\n      const message = err instanceof Error ? err.message : String(err);\n      return send(res, 400, { error: message });\n    }\n  }\n\n    return send(res, 404, { error: \"Not found\" });\n  });\n}\n\nexport const OPENAPI_SPEC = {\n  openapi: \"3.1.0\",\n  info: {\n    title: \"autoremediator\",\n    version: PACKAGE_VERSION,\n    description: \"Agentic CVE remediation for Node.js dependency projects\",\n  },\n  paths: {\n    \"/remediate\": {\n      post: {\n        operationId: \"remediate\",\n        summary: \"Remediate a single CVE\",\n        requestBody: {\n          required: true,\n          content: {\n            \"application/json\": {\n              schema: {\n                type: \"object\",\n                required: [\"cveId\"],\n                properties: {\n                  cveId: {\n                    type: \"string\",\n                    description: OPTION_DESCRIPTIONS.cveId,\n                    pattern: \"^CVE-\\\\d{4}-\\\\d+$\",\n                  },\n                  options: {\n                    type: \"object\",\n                    description: \"RemediateOptions\",\n                    properties: createRemediateOptionSchemaProperties(),\n                  },\n                },\n              },\n            },\n          },\n        },\n        responses: {\n          \"200\": {\n            description: \"RemediationReport\",\n            content: { \"application/json\": { schema: { type: \"object\" } } },\n          },\n          \"400\": {\n            description: \"Invalid input or remediation error\",\n            content: {\n              \"application/json\": {\n                schema: {\n                  type: \"object\",\n                  properties: { error: { type: \"string\" } },\n                },\n              },\n            },\n          },\n        },\n      },\n    },\n    \"/plan-remediation\": {\n      post: {\n        operationId: \"planRemediation\",\n        summary: \"Generate a non-mutating remediation preview\",\n        requestBody: {\n          required: true,\n          content: {\n            \"application/json\": {\n              schema: {\n                type: \"object\",\n                required: [\"cveId\"],\n                properties: {\n                  cveId: {\n                    type: \"string\",\n                    description: OPTION_DESCRIPTIONS.cveId,\n                    pattern: \"^CVE-\\\\d{4}-\\\\d+$\",\n                  },\n                  options: {\n                    type: \"object\",\n                    description: \"RemediateOptions\",\n                    properties: createRemediateOptionSchemaProperties({ includeDryRun: false, includePreview: false }),\n                  },\n                },\n              },\n            },\n          },\n        },\n        responses: {\n          \"200\": {\n            description: \"RemediationReport\",\n            content: { \"application/json\": { schema: { type: \"object\" } } },\n          },\n          \"400\": {\n            description: \"Invalid input or remediation error\",\n            content: {\n              \"application/json\": {\n                schema: {\n                  type: \"object\",\n                  properties: { error: { type: \"string\" } },\n                },\n              },\n            },\n          },\n        },\n      },\n    },\n    \"/remediate-from-scan\": {\n      post: {\n        operationId: \"remediateFromScan\",\n        summary: \"Parse a scanner file and remediate all found CVEs\",\n        requestBody: {\n          required: true,\n          content: {\n            \"application/json\": {\n              schema: {\n                type: \"object\",\n                required: [\"inputPath\"],\n                properties: {\n                  inputPath: {\n                    type: \"string\",\n                    description: OPTION_DESCRIPTIONS.inputPath,\n                  },\n                  options: {\n                    type: \"object\",\n                    description: \"ScanOptions\",\n                    properties: createScanOptionSchemaProperties(),\n                  },\n                },\n              },\n            },\n          },\n        },\n        responses: {\n          \"200\": {\n            description: \"ScanReport\",\n            content: {\n              \"application/json\": {\n                schema: {\n                  type: \"object\",\n                  properties: createScanReportSchemaProperties(),\n                },\n              },\n            },\n          },\n          \"400\": {\n            description: \"Invalid input or remediation error\",\n            content: {\n              \"application/json\": {\n                schema: {\n                  type: \"object\",\n                  properties: { error: { type: \"string\" } },\n                },\n              },\n            },\n          },\n        },\n      },\n    },\n    \"/health\": {\n      get: {\n        operationId: \"health\",\n        summary: \"Health check\",\n        responses: {\n          \"200\": {\n            description: \"Server is healthy\",\n            content: {\n              \"application/json\": {\n                schema: {\n                  type: \"object\",\n                  properties: { status: { type: \"string\" } },\n                },\n              },\n            },\n          },\n        },\n      },\n    },\n  },\n};\n\nfunction isMainModule(): boolean {\n  if (!process.argv[1]) return false;\n  return fileURLToPath(import.meta.url) === process.argv[1];\n}\n\nif (isMainModule()) {\n  const port = parsePort();\n  const server = createOpenApiServer();\n  server.listen(port, () => {\n    console.log(`autoremediator OpenAPI server listening on http://localhost:${port}`);\n    console.log(`  OpenAPI spec: http://localhost:${port}/openapi.json`);\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;AAQA,OAAO,UAAU;AACjB,SAAS,qBAAqB;AAa9B,IAAM,eAAe;AAErB,SAAS,YAAoB;AAC3B,QAAM,MAAM,QAAQ,KAAK,QAAQ,QAAQ;AACzC,MAAI,QAAQ,MAAM,QAAQ,KAAK,MAAM,CAAC,GAAG;AACvC,UAAM,IAAI,SAAS,QAAQ,KAAK,MAAM,CAAC,GAAG,EAAE;AAC5C,QAAI,CAAC,MAAM,CAAC,EAAG,QAAO;AAAA,EACxB;AACA,MAAI,QAAQ,IAAI,MAAM;AACpB,UAAM,IAAI,SAAS,QAAQ,IAAI,MAAM,EAAE;AACvC,QAAI,CAAC,MAAM,CAAC,EAAG,QAAO;AAAA,EACxB;AACA,SAAO;AACT;AAEA,SAAS,SAAS,KAA6C;AAC7D,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,QAAI,MAAM;AACV,QAAI,YAAY,MAAM;AACtB,QAAI,GAAG,QAAQ,CAAC,UAAkB;AAAE,aAAO;AAAA,IAAO,CAAC;AACnD,QAAI,GAAG,OAAO,MAAM;AAClB,UAAI;AACF,gBAAQ,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC;AAAA,MACpC,QAAQ;AACN,eAAO,IAAI,MAAM,mBAAmB,CAAC;AAAA,MACvC;AAAA,IACF,CAAC;AACD,QAAI,GAAG,SAAS,MAAM;AAAA,EACxB,CAAC;AACH;AAEA,SAAS,KAAK,KAA0B,QAAgB,MAAqB;AAC3E,QAAM,UAAU,KAAK,UAAU,IAAI;AACnC,MAAI,UAAU,QAAQ;AAAA,IACpB,gBAAgB;AAAA,IAChB,kBAAkB,OAAO,WAAW,OAAO;AAAA,EAC7C,CAAC;AACD,MAAI,IAAI,OAAO;AACjB;AAEA,SAAS,kBAAkB,SAA2C;AACpE,QAAM,aAAa,OAAO,YAAY,YAAY,YAAY,OACzD,UACD,CAAC;AACL,SAAO;AAAA,IACL,GAAG;AAAA,IACH,QAAQ,OAAO,WAAW,WAAW,WAAW,WAAW,SAAS;AAAA,EACtE;AACF;AAQA,IAAM,cAAiC;AAAA,EACrC,aAAa;AAAA,EACb,qBAAqB;AAAA,EACrB,mBAAmB;AACrB;AAEO,SAAS,oBAAoB,OAA0B,aAA0B;AACtF,SAAO,KAAK,aAAa,OAAO,KAAK,QAAQ;AAC3C,UAAM,MAAM,IAAI,IAAI,IAAI,OAAO,KAAK,kBAAkB;AACtD,UAAM,SAAS,IAAI,QAAQ,YAAY;AAGzC,QAAI,WAAW,SAAS,IAAI,aAAa,WAAW;AAClD,aAAO,KAAK,KAAK,KAAK,EAAE,QAAQ,KAAK,CAAC;AAAA,IACxC;AAGA,QAAI,WAAW,SAAS,IAAI,aAAa,iBAAiB;AACxD,aAAO,KAAK,KAAK,KAAK,YAAY;AAAA,IACpC;AAEE,QAAI,WAAW,UAAU,IAAI,aAAa,cAAc;AACxD,UAAI;AACJ,UAAI;AACF,eAAQ,MAAM,SAAS,GAAG;AAAA,MAC5B,QAAQ;AACN,eAAO,KAAK,KAAK,KAAK,EAAE,OAAO,oBAAoB,CAAC;AAAA,MACtD;AACA,UAAI,OAAO,KAAK,UAAU,YAAY,CAAC,KAAK,OAAO;AACjD,eAAO,KAAK,KAAK,KAAK,EAAE,OAAO,6BAA6B,CAAC;AAAA,MAC/D;AACA,UAAI;AACF,cAAM,SAAS,MAAM,KAAK,YAAY,KAAK,OAAO,kBAAkB,KAAK,OAAO,CAAqB;AACrG,eAAO,KAAK,KAAK,KAAK,MAAM;AAAA,MAC9B,SAAS,KAAK;AACZ,cAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,eAAO,KAAK,KAAK,KAAK,EAAE,OAAO,QAAQ,CAAC;AAAA,MAC1C;AAAA,IACF;AAEE,QAAI,WAAW,UAAU,IAAI,aAAa,qBAAqB;AAC/D,UAAI;AACJ,UAAI;AACF,eAAQ,MAAM,SAAS,GAAG;AAAA,MAC5B,QAAQ;AACN,eAAO,KAAK,KAAK,KAAK,EAAE,OAAO,oBAAoB,CAAC;AAAA,MACtD;AACA,UAAI,OAAO,KAAK,UAAU,YAAY,CAAC,KAAK,OAAO;AACjD,eAAO,KAAK,KAAK,KAAK,EAAE,OAAO,6BAA6B,CAAC;AAAA,MAC/D;AACA,UAAI;AACF,cAAM,SAAS,MAAM,KAAK,kBAAkB,KAAK,OAAO,kBAAkB,KAAK,OAAO,CAAqB;AAC3G,eAAO,KAAK,KAAK,KAAK,MAAM;AAAA,MAC9B,SAAS,KAAK;AACZ,cAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,eAAO,KAAK,KAAK,KAAK,EAAE,OAAO,QAAQ,CAAC;AAAA,MAC1C;AAAA,IACF;AAEE,QAAI,WAAW,UAAU,IAAI,aAAa,wBAAwB;AAClE,UAAI;AACJ,UAAI;AACF,eAAQ,MAAM,SAAS,GAAG;AAAA,MAC5B,QAAQ;AACN,eAAO,KAAK,KAAK,KAAK,EAAE,OAAO,oBAAoB,CAAC;AAAA,MACtD;AACA,UAAI,OAAO,KAAK,cAAc,YAAY,CAAC,KAAK,WAAW;AACzD,eAAO,KAAK,KAAK,KAAK,EAAE,OAAO,iCAAiC,CAAC;AAAA,MACnE;AACA,UAAI;AACF,cAAM,SAAS,MAAM,KAAK,oBAAoB,KAAK,WAAW,kBAAkB,KAAK,OAAO,CAAgB;AAC5G,eAAO,KAAK,KAAK,KAAK,MAAM;AAAA,MAC9B,SAAS,KAAK;AACZ,cAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,eAAO,KAAK,KAAK,KAAK,EAAE,OAAO,QAAQ,CAAC;AAAA,MAC1C;AAAA,IACF;AAEE,WAAO,KAAK,KAAK,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,EAC9C,CAAC;AACH;AAEO,IAAM,eAAe;AAAA,EAC1B,SAAS;AAAA,EACT,MAAM;AAAA,IACJ,OAAO;AAAA,IACP,SAAS;AAAA,IACT,aAAa;AAAA,EACf;AAAA,EACA,OAAO;AAAA,IACL,cAAc;AAAA,MACZ,MAAM;AAAA,QACJ,aAAa;AAAA,QACb,SAAS;AAAA,QACT,aAAa;AAAA,UACX,UAAU;AAAA,UACV,SAAS;AAAA,YACP,oBAAoB;AAAA,cAClB,QAAQ;AAAA,gBACN,MAAM;AAAA,gBACN,UAAU,CAAC,OAAO;AAAA,gBAClB,YAAY;AAAA,kBACV,OAAO;AAAA,oBACL,MAAM;AAAA,oBACN,aAAa,oBAAoB;AAAA,oBACjC,SAAS;AAAA,kBACX;AAAA,kBACA,SAAS;AAAA,oBACP,MAAM;AAAA,oBACN,aAAa;AAAA,oBACb,YAAY,sCAAsC;AAAA,kBACpD;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,QACA,WAAW;AAAA,UACT,OAAO;AAAA,YACL,aAAa;AAAA,YACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,SAAS,EAAE,EAAE;AAAA,UAChE;AAAA,UACA,OAAO;AAAA,YACL,aAAa;AAAA,YACb,SAAS;AAAA,cACP,oBAAoB;AAAA,gBAClB,QAAQ;AAAA,kBACN,MAAM;AAAA,kBACN,YAAY,EAAE,OAAO,EAAE,MAAM,SAAS,EAAE;AAAA,gBAC1C;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,qBAAqB;AAAA,MACnB,MAAM;AAAA,QACJ,aAAa;AAAA,QACb,SAAS;AAAA,QACT,aAAa;AAAA,UACX,UAAU;AAAA,UACV,SAAS;AAAA,YACP,oBAAoB;AAAA,cAClB,QAAQ;AAAA,gBACN,MAAM;AAAA,gBACN,UAAU,CAAC,OAAO;AAAA,gBAClB,YAAY;AAAA,kBACV,OAAO;AAAA,oBACL,MAAM;AAAA,oBACN,aAAa,oBAAoB;AAAA,oBACjC,SAAS;AAAA,kBACX;AAAA,kBACA,SAAS;AAAA,oBACP,MAAM;AAAA,oBACN,aAAa;AAAA,oBACb,YAAY,sCAAsC,EAAE,eAAe,OAAO,gBAAgB,MAAM,CAAC;AAAA,kBACnG;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,QACA,WAAW;AAAA,UACT,OAAO;AAAA,YACL,aAAa;AAAA,YACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,SAAS,EAAE,EAAE;AAAA,UAChE;AAAA,UACA,OAAO;AAAA,YACL,aAAa;AAAA,YACb,SAAS;AAAA,cACP,oBAAoB;AAAA,gBAClB,QAAQ;AAAA,kBACN,MAAM;AAAA,kBACN,YAAY,EAAE,OAAO,EAAE,MAAM,SAAS,EAAE;AAAA,gBAC1C;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,wBAAwB;AAAA,MACtB,MAAM;AAAA,QACJ,aAAa;AAAA,QACb,SAAS;AAAA,QACT,aAAa;AAAA,UACX,UAAU;AAAA,UACV,SAAS;AAAA,YACP,oBAAoB;AAAA,cAClB,QAAQ;AAAA,gBACN,MAAM;AAAA,gBACN,UAAU,CAAC,WAAW;AAAA,gBACtB,YAAY;AAAA,kBACV,WAAW;AAAA,oBACT,MAAM;AAAA,oBACN,aAAa,oBAAoB;AAAA,kBACnC;AAAA,kBACA,SAAS;AAAA,oBACP,MAAM;AAAA,oBACN,aAAa;AAAA,oBACb,YAAY,iCAAiC;AAAA,kBAC/C;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,QACA,WAAW;AAAA,UACT,OAAO;AAAA,YACL,aAAa;AAAA,YACb,SAAS;AAAA,cACP,oBAAoB;AAAA,gBAClB,QAAQ;AAAA,kBACN,MAAM;AAAA,kBACN,YAAY,iCAAiC;AAAA,gBAC/C;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,UACA,OAAO;AAAA,YACL,aAAa;AAAA,YACb,SAAS;AAAA,cACP,oBAAoB;AAAA,gBAClB,QAAQ;AAAA,kBACN,MAAM;AAAA,kBACN,YAAY,EAAE,OAAO,EAAE,MAAM,SAAS,EAAE;AAAA,gBAC1C;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,WAAW;AAAA,MACT,KAAK;AAAA,QACH,aAAa;AAAA,QACb,SAAS;AAAA,QACT,WAAW;AAAA,UACT,OAAO;AAAA,YACL,aAAa;AAAA,YACb,SAAS;AAAA,cACP,oBAAoB;AAAA,gBAClB,QAAQ;AAAA,kBACN,MAAM;AAAA,kBACN,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,EAAE;AAAA,gBAC3C;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,eAAwB;AAC/B,MAAI,CAAC,QAAQ,KAAK,CAAC,EAAG,QAAO;AAC7B,SAAO,cAAc,YAAY,GAAG,MAAM,QAAQ,KAAK,CAAC;AAC1D;AAEA,IAAI,aAAa,GAAG;AAClB,QAAM,OAAO,UAAU;AACvB,QAAM,SAAS,oBAAoB;AACnC,SAAO,OAAO,MAAM,MAAM;AACxB,YAAQ,IAAI,+DAA+D,IAAI,EAAE;AACjF,YAAQ,IAAI,oCAAoC,IAAI,eAAe;AAAA,EACrE,CAAC;AACH;","names":[]}
+{"version":3,"sources":["../../src/openapi/server.ts"],"sourcesContent":["/**\n * autoremediator OpenAPI HTTP server\n *\n * Exposes POST /remediate and POST /remediate-from-scan as a lightweight\n * HTTP server using Node.js built-in http module (no framework dependency).\n *\n * Start: node dist/openapi/server.js [--port 3000]\n */\nimport http from \"node:http\";\nimport { fileURLToPath } from \"node:url\";\nimport {\n  createRemediateOptionSchemaProperties,\n  createScanOptionSchemaProperties,\n  createScanReportSchemaProperties,\n  OPTION_DESCRIPTIONS,\n  planRemediation,\n  remediate,\n  remediateFromScan,\n} from \"../api/index.js\";\nimport type { RemediateOptions, ScanOptions } from \"../api/index.js\";\nimport { PACKAGE_VERSION } from \"../version\";\n\nconst DEFAULT_PORT = 3000;\n\nfunction parsePort(): number {\n  const idx = process.argv.indexOf(\"--port\");\n  if (idx !== -1 && process.argv[idx + 1]) {\n    const p = parseInt(process.argv[idx + 1], 10);\n    if (!isNaN(p)) return p;\n  }\n  if (process.env.PORT) {\n    const p = parseInt(process.env.PORT, 10);\n    if (!isNaN(p)) return p;\n  }\n  return DEFAULT_PORT;\n}\n\nfunction readBody(req: http.IncomingMessage): Promise<unknown> {\n  return new Promise((resolve, reject) => {\n    let raw = \"\";\n    req.setEncoding(\"utf8\");\n    req.on(\"data\", (chunk: string) => { raw += chunk; });\n    req.on(\"end\", () => {\n      try {\n        resolve(raw ? JSON.parse(raw) : {});\n      } catch {\n        reject(new Error(\"Invalid JSON body\"));\n      }\n    });\n    req.on(\"error\", reject);\n  });\n}\n\nfunction send(res: http.ServerResponse, status: number, body: unknown): void {\n  const payload = JSON.stringify(body);\n  res.writeHead(status, {\n    \"Content-Type\": \"application/json\",\n    \"Content-Length\": Buffer.byteLength(payload),\n  });\n  res.end(payload);\n}\n\nfunction withOpenApiSource(options: unknown): Record<string, unknown> {\n  const normalized = typeof options === \"object\" && options !== null\n    ? (options as Record<string, unknown>)\n    : {};\n  return {\n    ...normalized,\n    source: typeof normalized.source === \"string\" ? normalized.source : \"openapi\",\n  };\n}\n\ninterface OpenApiServerDeps {\n  remediateFn: typeof remediate;\n  remediateFromScanFn: typeof remediateFromScan;\n  planRemediationFn: typeof planRemediation;\n}\n\nconst defaultDeps: OpenApiServerDeps = {\n  remediateFn: remediate,\n  remediateFromScanFn: remediateFromScan,\n  planRemediationFn: planRemediation,\n};\n\nexport function createOpenApiServer(deps: OpenApiServerDeps = defaultDeps): http.Server {\n  return http.createServer(async (req, res) => {\n    const url = new URL(req.url ?? \"/\", `http://localhost`);\n    const method = req.method?.toUpperCase();\n\n  // Health check\n  if (method === \"GET\" && url.pathname === \"/health\") {\n    return send(res, 200, { status: \"ok\" });\n  }\n\n  // OpenAPI spec\n  if (method === \"GET\" && url.pathname === \"/openapi.json\") {\n    return send(res, 200, OPENAPI_SPEC);\n  }\n\n    if (method === \"POST\" && url.pathname === \"/remediate\") {\n    let body: { cveId?: unknown; options?: unknown };\n    try {\n      body = (await readBody(req)) as typeof body;\n    } catch {\n      return send(res, 400, { error: \"Invalid JSON body\" });\n    }\n    if (typeof body.cveId !== \"string\" || !body.cveId) {\n      return send(res, 400, { error: \"cveId is required (string)\" });\n    }\n    try {\n      const report = await deps.remediateFn(body.cveId, withOpenApiSource(body.options) as RemediateOptions);\n      return send(res, 200, report);\n    } catch (err) {\n      const message = err instanceof Error ? err.message : String(err);\n      return send(res, 400, { error: message });\n    }\n  }\n\n    if (method === \"POST\" && url.pathname === \"/plan-remediation\") {\n    let body: { cveId?: unknown; options?: unknown };\n    try {\n      body = (await readBody(req)) as typeof body;\n    } catch {\n      return send(res, 400, { error: \"Invalid JSON body\" });\n    }\n    if (typeof body.cveId !== \"string\" || !body.cveId) {\n      return send(res, 400, { error: \"cveId is required (string)\" });\n    }\n    try {\n      const report = await deps.planRemediationFn(body.cveId, withOpenApiSource(body.options) as RemediateOptions);\n      return send(res, 200, report);\n    } catch (err) {\n      const message = err instanceof Error ? err.message : String(err);\n      return send(res, 400, { error: message });\n    }\n  }\n\n    if (method === \"POST\" && url.pathname === \"/remediate-from-scan\") {\n    let body: { inputPath?: unknown; options?: unknown };\n    try {\n      body = (await readBody(req)) as typeof body;\n    } catch {\n      return send(res, 400, { error: \"Invalid JSON body\" });\n    }\n    if (typeof body.inputPath !== \"string\" || !body.inputPath) {\n      return send(res, 400, { error: \"inputPath is required (string)\" });\n    }\n    try {\n      const report = await deps.remediateFromScanFn(body.inputPath, withOpenApiSource(body.options) as ScanOptions);\n      return send(res, 200, report);\n    } catch (err) {\n      const message = err instanceof Error ? err.message : String(err);\n      return send(res, 400, { error: message });\n    }\n  }\n\n    return send(res, 404, { error: \"Not found\" });\n  });\n}\n\nexport const OPENAPI_SPEC = {\n  openapi: \"3.1.0\",\n  info: {\n    title: \"autoremediator\",\n    version: PACKAGE_VERSION,\n    description: \"Agentic CVE remediation for Node.js dependency projects\",\n  },\n  paths: {\n    \"/remediate\": {\n      post: {\n        operationId: \"remediate\",\n        summary: \"Remediate a single CVE\",\n        requestBody: {\n          required: true,\n          content: {\n            \"application/json\": {\n              schema: {\n                type: \"object\",\n                required: [\"cveId\"],\n                properties: {\n                  cveId: {\n                    type: \"string\",\n                    description: OPTION_DESCRIPTIONS.cveId,\n                    pattern: \"^CVE-\\\\d{4}-\\\\d+$\",\n                  },\n                  options: {\n                    type: \"object\",\n                    description: \"RemediateOptions\",\n                    properties: createRemediateOptionSchemaProperties(),\n                  },\n                },\n              },\n            },\n          },\n        },\n        responses: {\n          \"200\": {\n            description: \"RemediationReport\",\n            content: { \"application/json\": { schema: { type: \"object\" } } },\n          },\n          \"400\": {\n            description: \"Invalid input or remediation error\",\n            content: {\n              \"application/json\": {\n                schema: {\n                  type: \"object\",\n                  properties: { error: { type: \"string\" } },\n                },\n              },\n            },\n          },\n        },\n      },\n    },\n    \"/plan-remediation\": {\n      post: {\n        operationId: \"planRemediation\",\n        summary: \"Generate a non-mutating remediation preview\",\n        requestBody: {\n          required: true,\n          content: {\n            \"application/json\": {\n              schema: {\n                type: \"object\",\n                required: [\"cveId\"],\n                properties: {\n                  cveId: {\n                    type: \"string\",\n                    description: OPTION_DESCRIPTIONS.cveId,\n                    pattern: \"^CVE-\\\\d{4}-\\\\d+$\",\n                  },\n                  options: {\n                    type: \"object\",\n                    description: \"RemediateOptions\",\n                    properties: createRemediateOptionSchemaProperties({ includeDryRun: false, includePreview: false, includeEvidence: true }),\n                  },\n                },\n              },\n            },\n          },\n        },\n        responses: {\n          \"200\": {\n            description: \"RemediationReport\",\n            content: { \"application/json\": { schema: { type: \"object\" } } },\n          },\n          \"400\": {\n            description: \"Invalid input or remediation error\",\n            content: {\n              \"application/json\": {\n                schema: {\n                  type: \"object\",\n                  properties: { error: { type: \"string\" } },\n                },\n              },\n            },\n          },\n        },\n      },\n    },\n    \"/remediate-from-scan\": {\n      post: {\n        operationId: \"remediateFromScan\",\n        summary: \"Parse a scanner file and remediate all found CVEs\",\n        requestBody: {\n          required: true,\n          content: {\n            \"application/json\": {\n              schema: {\n                type: \"object\",\n                required: [\"inputPath\"],\n                properties: {\n                  inputPath: {\n                    type: \"string\",\n                    description: OPTION_DESCRIPTIONS.inputPath,\n                  },\n                  options: {\n                    type: \"object\",\n                    description: \"ScanOptions\",\n                    properties: createScanOptionSchemaProperties(),\n                  },\n                },\n              },\n            },\n          },\n        },\n        responses: {\n          \"200\": {\n            description: \"ScanReport\",\n            content: {\n              \"application/json\": {\n                schema: {\n                  type: \"object\",\n                  properties: createScanReportSchemaProperties(),\n                },\n              },\n            },\n          },\n          \"400\": {\n            description: \"Invalid input or remediation error\",\n            content: {\n              \"application/json\": {\n                schema: {\n                  type: \"object\",\n                  properties: { error: { type: \"string\" } },\n                },\n              },\n            },\n          },\n        },\n      },\n    },\n    \"/health\": {\n      get: {\n        operationId: \"health\",\n        summary: \"Health check\",\n        responses: {\n          \"200\": {\n            description: \"Server is healthy\",\n            content: {\n              \"application/json\": {\n                schema: {\n                  type: \"object\",\n                  properties: { status: { type: \"string\" } },\n                },\n              },\n            },\n          },\n        },\n      },\n    },\n  },\n};\n\nfunction isMainModule(): boolean {\n  if (!process.argv[1]) return false;\n  return fileURLToPath(import.meta.url) === process.argv[1];\n}\n\nif (isMainModule()) {\n  const port = parsePort();\n  const server = createOpenApiServer();\n  server.listen(port, () => {\n    console.log(`autoremediator OpenAPI server listening on http://localhost:${port}`);\n    console.log(`  OpenAPI spec: http://localhost:${port}/openapi.json`);\n  });\n}\n"],"mappings":";;;;;;;;;;;;;;AAQA,OAAO,UAAU;AACjB,SAAS,qBAAqB;AAa9B,IAAM,eAAe;AAErB,SAAS,YAAoB;AAC3B,QAAM,MAAM,QAAQ,KAAK,QAAQ,QAAQ;AACzC,MAAI,QAAQ,MAAM,QAAQ,KAAK,MAAM,CAAC,GAAG;AACvC,UAAM,IAAI,SAAS,QAAQ,KAAK,MAAM,CAAC,GAAG,EAAE;AAC5C,QAAI,CAAC,MAAM,CAAC,EAAG,QAAO;AAAA,EACxB;AACA,MAAI,QAAQ,IAAI,MAAM;AACpB,UAAM,IAAI,SAAS,QAAQ,IAAI,MAAM,EAAE;AACvC,QAAI,CAAC,MAAM,CAAC,EAAG,QAAO;AAAA,EACxB;AACA,SAAO;AACT;AAEA,SAAS,SAAS,KAA6C;AAC7D,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,QAAI,MAAM;AACV,QAAI,YAAY,MAAM;AACtB,QAAI,GAAG,QAAQ,CAAC,UAAkB;AAAE,aAAO;AAAA,IAAO,CAAC;AACnD,QAAI,GAAG,OAAO,MAAM;AAClB,UAAI;AACF,gBAAQ,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC;AAAA,MACpC,QAAQ;AACN,eAAO,IAAI,MAAM,mBAAmB,CAAC;AAAA,MACvC;AAAA,IACF,CAAC;AACD,QAAI,GAAG,SAAS,MAAM;AAAA,EACxB,CAAC;AACH;AAEA,SAAS,KAAK,KAA0B,QAAgB,MAAqB;AAC3E,QAAM,UAAU,KAAK,UAAU,IAAI;AACnC,MAAI,UAAU,QAAQ;AAAA,IACpB,gBAAgB;AAAA,IAChB,kBAAkB,OAAO,WAAW,OAAO;AAAA,EAC7C,CAAC;AACD,MAAI,IAAI,OAAO;AACjB;AAEA,SAAS,kBAAkB,SAA2C;AACpE,QAAM,aAAa,OAAO,YAAY,YAAY,YAAY,OACzD,UACD,CAAC;AACL,SAAO;AAAA,IACL,GAAG;AAAA,IACH,QAAQ,OAAO,WAAW,WAAW,WAAW,WAAW,SAAS;AAAA,EACtE;AACF;AAQA,IAAM,cAAiC;AAAA,EACrC,aAAa;AAAA,EACb,qBAAqB;AAAA,EACrB,mBAAmB;AACrB;AAEO,SAAS,oBAAoB,OAA0B,aAA0B;AACtF,SAAO,KAAK,aAAa,OAAO,KAAK,QAAQ;AAC3C,UAAM,MAAM,IAAI,IAAI,IAAI,OAAO,KAAK,kBAAkB;AACtD,UAAM,SAAS,IAAI,QAAQ,YAAY;AAGzC,QAAI,WAAW,SAAS,IAAI,aAAa,WAAW;AAClD,aAAO,KAAK,KAAK,KAAK,EAAE,QAAQ,KAAK,CAAC;AAAA,IACxC;AAGA,QAAI,WAAW,SAAS,IAAI,aAAa,iBAAiB;AACxD,aAAO,KAAK,KAAK,KAAK,YAAY;AAAA,IACpC;AAEE,QAAI,WAAW,UAAU,IAAI,aAAa,cAAc;AACxD,UAAI;AACJ,UAAI;AACF,eAAQ,MAAM,SAAS,GAAG;AAAA,MAC5B,QAAQ;AACN,eAAO,KAAK,KAAK,KAAK,EAAE,OAAO,oBAAoB,CAAC;AAAA,MACtD;AACA,UAAI,OAAO,KAAK,UAAU,YAAY,CAAC,KAAK,OAAO;AACjD,eAAO,KAAK,KAAK,KAAK,EAAE,OAAO,6BAA6B,CAAC;AAAA,MAC/D;AACA,UAAI;AACF,cAAM,SAAS,MAAM,KAAK,YAAY,KAAK,OAAO,kBAAkB,KAAK,OAAO,CAAqB;AACrG,eAAO,KAAK,KAAK,KAAK,MAAM;AAAA,MAC9B,SAAS,KAAK;AACZ,cAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,eAAO,KAAK,KAAK,KAAK,EAAE,OAAO,QAAQ,CAAC;AAAA,MAC1C;AAAA,IACF;AAEE,QAAI,WAAW,UAAU,IAAI,aAAa,qBAAqB;AAC/D,UAAI;AACJ,UAAI;AACF,eAAQ,MAAM,SAAS,GAAG;AAAA,MAC5B,QAAQ;AACN,eAAO,KAAK,KAAK,KAAK,EAAE,OAAO,oBAAoB,CAAC;AAAA,MACtD;AACA,UAAI,OAAO,KAAK,UAAU,YAAY,CAAC,KAAK,OAAO;AACjD,eAAO,KAAK,KAAK,KAAK,EAAE,OAAO,6BAA6B,CAAC;AAAA,MAC/D;AACA,UAAI;AACF,cAAM,SAAS,MAAM,KAAK,kBAAkB,KAAK,OAAO,kBAAkB,KAAK,OAAO,CAAqB;AAC3G,eAAO,KAAK,KAAK,KAAK,MAAM;AAAA,MAC9B,SAAS,KAAK;AACZ,cAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,eAAO,KAAK,KAAK,KAAK,EAAE,OAAO,QAAQ,CAAC;AAAA,MAC1C;AAAA,IACF;AAEE,QAAI,WAAW,UAAU,IAAI,aAAa,wBAAwB;AAClE,UAAI;AACJ,UAAI;AACF,eAAQ,MAAM,SAAS,GAAG;AAAA,MAC5B,QAAQ;AACN,eAAO,KAAK,KAAK,KAAK,EAAE,OAAO,oBAAoB,CAAC;AAAA,MACtD;AACA,UAAI,OAAO,KAAK,cAAc,YAAY,CAAC,KAAK,WAAW;AACzD,eAAO,KAAK,KAAK,KAAK,EAAE,OAAO,iCAAiC,CAAC;AAAA,MACnE;AACA,UAAI;AACF,cAAM,SAAS,MAAM,KAAK,oBAAoB,KAAK,WAAW,kBAAkB,KAAK,OAAO,CAAgB;AAC5G,eAAO,KAAK,KAAK,KAAK,MAAM;AAAA,MAC9B,SAAS,KAAK;AACZ,cAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,eAAO,KAAK,KAAK,KAAK,EAAE,OAAO,QAAQ,CAAC;AAAA,MAC1C;AAAA,IACF;AAEE,WAAO,KAAK,KAAK,KAAK,EAAE,OAAO,YAAY,CAAC;AAAA,EAC9C,CAAC;AACH;AAEO,IAAM,eAAe;AAAA,EAC1B,SAAS;AAAA,EACT,MAAM;AAAA,IACJ,OAAO;AAAA,IACP,SAAS;AAAA,IACT,aAAa;AAAA,EACf;AAAA,EACA,OAAO;AAAA,IACL,cAAc;AAAA,MACZ,MAAM;AAAA,QACJ,aAAa;AAAA,QACb,SAAS;AAAA,QACT,aAAa;AAAA,UACX,UAAU;AAAA,UACV,SAAS;AAAA,YACP,oBAAoB;AAAA,cAClB,QAAQ;AAAA,gBACN,MAAM;AAAA,gBACN,UAAU,CAAC,OAAO;AAAA,gBAClB,YAAY;AAAA,kBACV,OAAO;AAAA,oBACL,MAAM;AAAA,oBACN,aAAa,oBAAoB;AAAA,oBACjC,SAAS;AAAA,kBACX;AAAA,kBACA,SAAS;AAAA,oBACP,MAAM;AAAA,oBACN,aAAa;AAAA,oBACb,YAAY,sCAAsC;AAAA,kBACpD;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,QACA,WAAW;AAAA,UACT,OAAO;AAAA,YACL,aAAa;AAAA,YACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,SAAS,EAAE,EAAE;AAAA,UAChE;AAAA,UACA,OAAO;AAAA,YACL,aAAa;AAAA,YACb,SAAS;AAAA,cACP,oBAAoB;AAAA,gBAClB,QAAQ;AAAA,kBACN,MAAM;AAAA,kBACN,YAAY,EAAE,OAAO,EAAE,MAAM,SAAS,EAAE;AAAA,gBAC1C;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,qBAAqB;AAAA,MACnB,MAAM;AAAA,QACJ,aAAa;AAAA,QACb,SAAS;AAAA,QACT,aAAa;AAAA,UACX,UAAU;AAAA,UACV,SAAS;AAAA,YACP,oBAAoB;AAAA,cAClB,QAAQ;AAAA,gBACN,MAAM;AAAA,gBACN,UAAU,CAAC,OAAO;AAAA,gBAClB,YAAY;AAAA,kBACV,OAAO;AAAA,oBACL,MAAM;AAAA,oBACN,aAAa,oBAAoB;AAAA,oBACjC,SAAS;AAAA,kBACX;AAAA,kBACA,SAAS;AAAA,oBACP,MAAM;AAAA,oBACN,aAAa;AAAA,oBACb,YAAY,sCAAsC,EAAE,eAAe,OAAO,gBAAgB,OAAO,iBAAiB,KAAK,CAAC;AAAA,kBAC1H;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,QACA,WAAW;AAAA,UACT,OAAO;AAAA,YACL,aAAa;AAAA,YACb,SAAS,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,SAAS,EAAE,EAAE;AAAA,UAChE;AAAA,UACA,OAAO;AAAA,YACL,aAAa;AAAA,YACb,SAAS;AAAA,cACP,oBAAoB;AAAA,gBAClB,QAAQ;AAAA,kBACN,MAAM;AAAA,kBACN,YAAY,EAAE,OAAO,EAAE,MAAM,SAAS,EAAE;AAAA,gBAC1C;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,wBAAwB;AAAA,MACtB,MAAM;AAAA,QACJ,aAAa;AAAA,QACb,SAAS;AAAA,QACT,aAAa;AAAA,UACX,UAAU;AAAA,UACV,SAAS;AAAA,YACP,oBAAoB;AAAA,cAClB,QAAQ;AAAA,gBACN,MAAM;AAAA,gBACN,UAAU,CAAC,WAAW;AAAA,gBACtB,YAAY;AAAA,kBACV,WAAW;AAAA,oBACT,MAAM;AAAA,oBACN,aAAa,oBAAoB;AAAA,kBACnC;AAAA,kBACA,SAAS;AAAA,oBACP,MAAM;AAAA,oBACN,aAAa;AAAA,oBACb,YAAY,iCAAiC;AAAA,kBAC/C;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,QACA,WAAW;AAAA,UACT,OAAO;AAAA,YACL,aAAa;AAAA,YACb,SAAS;AAAA,cACP,oBAAoB;AAAA,gBAClB,QAAQ;AAAA,kBACN,MAAM;AAAA,kBACN,YAAY,iCAAiC;AAAA,gBAC/C;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,UACA,OAAO;AAAA,YACL,aAAa;AAAA,YACb,SAAS;AAAA,cACP,oBAAoB;AAAA,gBAClB,QAAQ;AAAA,kBACN,MAAM;AAAA,kBACN,YAAY,EAAE,OAAO,EAAE,MAAM,SAAS,EAAE;AAAA,gBAC1C;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,WAAW;AAAA,MACT,KAAK;AAAA,QACH,aAAa;AAAA,QACb,SAAS;AAAA,QACT,WAAW;AAAA,UACT,OAAO;AAAA,YACL,aAAa;AAAA,YACb,SAAS;AAAA,cACP,oBAAoB;AAAA,gBAClB,QAAQ;AAAA,kBACN,MAAM;AAAA,kBACN,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,EAAE;AAAA,gBAC3C;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,eAAwB;AAC/B,MAAI,CAAC,QAAQ,KAAK,CAAC,EAAG,QAAO;AAC7B,SAAO,cAAc,YAAY,GAAG,MAAM,QAAQ,KAAK,CAAC;AAC1D;AAEA,IAAI,aAAa,GAAG;AAClB,QAAM,OAAO,UAAU;AACvB,QAAM,SAAS,oBAAoB;AACnC,SAAO,OAAO,MAAM,MAAM;AACxB,YAAQ,IAAI,+DAA+D,IAAI,EAAE;AACjF,YAAQ,IAAI,oCAAoC,IAAI,eAAe;AAAA,EACrE,CAAC;AACH;","names":[]}

package/dist/options-schema-DfLBOsPI.d.ts

@@ -0,0 +1,37 @@
+type JsonSchemaProperty = Record<string, unknown>;
+declare const PACKAGE_MANAGER_VALUES: readonly ["npm", "pnpm", "yarn"];
+declare const LLM_PROVIDER_VALUES: readonly ["openai", "anthropic", "local"];
+declare const PROVENANCE_SOURCE_VALUES: readonly ["cli", "sdk", "mcp", "openapi", "unknown"];
+declare const OPTION_DESCRIPTIONS: {
+    readonly cveId: "CVE ID, e.g. CVE-2021-23337";
+    readonly inputPath: "Absolute path to the scanner output file";
+    readonly cwd: "Absolute path to the project root (default: process.cwd())";
+    readonly packageManager: "Package manager override (auto-detected by default)";
+    readonly dryRun: "If true, plan changes but write nothing";
+    readonly preview: "If true, enforce non-mutating preview mode";
+    readonly runTests: "Run package-manager test command after applying fix";
+    readonly llmProvider: "LLM provider override";
+    readonly patchesDir: "Directory to write .patch files (default: ./patches)";
+    readonly policy: "Optional path to .autoremediator policy file";
+    readonly requestId: "Request correlation ID";
+    readonly sessionId: "Session correlation ID";
+    readonly parentRunId: "Parent run correlation ID";
+    readonly idempotencyKey: "Idempotency key for replay-safe execution";
+    readonly resume: "Return cached result for matching idempotency key when available";
+    readonly actor: "Actor identity for evidence provenance";
+    readonly source: "Source system for provenance";
+    readonly format: "Scanner format (default: auto)";
+    readonly evidence: "Write evidence JSON to .autoremediator/evidence/ (default: true)";
+    readonly directDependenciesOnly: "Restrict remediation to direct dependencies only";
+    readonly preferVersionBump: "Reject override and patch remediation when version-bump-only policy is required";
+};
+declare function createConstraintSchemaProperties(): Record<string, JsonSchemaProperty>;
+declare function createRemediateOptionSchemaProperties(options?: {
+    includeDryRun?: boolean;
+    includePreview?: boolean;
+    includeEvidence?: boolean;
+}): Record<string, JsonSchemaProperty>;
+declare function createScanOptionSchemaProperties(): Record<string, JsonSchemaProperty>;
+declare function createScanReportSchemaProperties(): Record<string, JsonSchemaProperty>;
+
+export { type JsonSchemaProperty as J, LLM_PROVIDER_VALUES as L, OPTION_DESCRIPTIONS as O, PACKAGE_MANAGER_VALUES as P, PROVENANCE_SOURCE_VALUES as a, createRemediateOptionSchemaProperties as b, createConstraintSchemaProperties as c, createScanOptionSchemaProperties as d, createScanReportSchemaProperties as e };

package/dist/remediate-from-scan-C-E7gqxF.d.ts

@@ -0,0 +1,211 @@
+/** A resolved CVE entry with affected npm package info */
+interface CveDetails {
+    id: string;
+    summary: string;
+    severity: "LOW" | "MEDIUM" | "HIGH" | "CRITICAL" | "UNKNOWN";
+    cvssScore?: number;
+    epss?: {
+        score: number;
+        percentile: number;
+        date?: string;
+    };
+    kev?: {
+        knownExploited: boolean;
+        dateAdded?: string;
+        dueDate?: string;
+        requiredAction?: string;
+        knownRansomwareCampaignUse?: string;
+    };
+    intelligence?: {
+        cveServicesEnriched?: boolean;
+        gitlabAdvisoryMatched?: boolean;
+        certCcMatched?: boolean;
+        depsDevEnrichedPackages?: number;
+        scorecardProjects?: number;
+        vendorAdvisories?: string[];
+        commercialFeeds?: string[];
+        sourceHealth?: Record<string, {
+            attempted: boolean;
+            changed: boolean;
+            error?: string;
+        }>;
+    };
+    references: string[];
+    affectedPackages: AffectedPackage[];
+}
+/** A single npm package affected by a CVE */
+interface AffectedPackage {
+    name: string;
+    ecosystem: "npm";
+    /** Semver range string for the vulnerable version window, e.g. ">=0.0.0 <4.17.21" */
+    vulnerableRange: string;
+    /** The first version that is NOT vulnerable (the safe upgrade target) */
+    firstPatchedVersion?: string;
+    /** Source that provided this entry */
+    source: "osv" | "github-advisory";
+}
+/** A package found in the consumer's project */
+interface InventoryPackage {
+    name: string;
+    version: string;
+    /** "direct" = listed in package.json; "indirect" = transitive dep */
+    type: "direct" | "indirect";
+}
+/** A package that is both installed and matches a vulnerable range */
+interface VulnerablePackage {
+    installed: InventoryPackage;
+    affected: AffectedPackage;
+    /** The resolved safe upgrade version, if one exists on npm */
+    safeUpgradeVersion?: string;
+}
+/** The outcome of a single patch operation */
+type PatchStrategy = "version-bump" | "override" | "patch-file" | "none";
+type DependencyScope = "direct" | "transitive";
+type UnresolvedReason = "constraint-blocked" | "indirect-dependency" | "install-failed" | "major-bump-required" | "no-safe-version" | "override-apply-failed" | "package-json-not-found" | "patch-apply-failed" | "patch-confidence-too-low" | "patch-generation-failed" | "patch-validation-failed" | "policy-blocked" | "requires-llm-fallback" | "source-fetch-failed" | "validation-failed";
+type PatchStrategyCounts = Partial<Record<PatchStrategy, number>>;
+type DependencyScopeCounts = Partial<Record<DependencyScope, number>>;
+type UnresolvedReasonCounts = Partial<Record<UnresolvedReason, number>>;
+interface PatchResult {
+    packageName: string;
+    strategy: PatchStrategy;
+    fromVersion: string;
+    toVersion?: string;
+    patchFilePath?: string;
+    applied: boolean;
+    dryRun: boolean;
+    message: string;
+    unresolvedReason?: UnresolvedReason;
+    validation?: {
+        passed: boolean;
+        error?: string;
+    };
+}
+interface CorrelationContext {
+    requestId?: string;
+    sessionId?: string;
+    parentRunId?: string;
+}
+interface RemediationConstraints {
+    directDependenciesOnly?: boolean;
+    preferVersionBump?: boolean;
+}
+interface ProvenanceContext {
+    actor?: string;
+    source?: "cli" | "sdk" | "mcp" | "openapi" | "unknown";
+}
+/** Top-level options for the remediate() API and CLI */
+interface RemediateOptions extends CorrelationContext {
+    /** Working directory of the consumer's project (defaults to process.cwd()) */
+    cwd?: string;
+    /** Package manager to use (defaults to auto-detect from lockfile) */
+    packageManager?: "npm" | "pnpm" | "yarn";
+    /** If true, plan and report changes but do not write anything */
+    dryRun?: boolean;
+    /** If true, run package-manager tests after patching */
+    runTests?: boolean;
+    /** Override the LLM provider (falls back to env AUTOREMEDIATOR_LLM_PROVIDER) */
+    llmProvider?: "openai" | "anthropic" | "local";
+    /** Override the model name */
+    model?: string;
+    /** Optional path to a policy file (.autoremediator.json) */
+    policy?: string;
+    /** If false, do not write evidence JSON for this run (default: true). */
+    evidence?: boolean;
+    /** Directory to write .patch files (default: ./patches) */
+    patchesDir?: string;
+    /** If true, run a non-mutating remediation preview (forces dryRun behavior for mutation tools). */
+    preview?: boolean;
+    /** Optional deterministic idempotency key for request replay handling. */
+    idempotencyKey?: string;
+    /** If true, return cached report for matching idempotency key + CVE when available. */
+    resume?: boolean;
+    /** Optional caller provenance fields for evidence and reporting. */
+    actor?: string;
+    source?: "cli" | "sdk" | "mcp" | "openapi" | "unknown";
+    /** Optional orchestration constraints for result enforcement. */
+    constraints?: RemediationConstraints;
+}
+/** Final report returned by the remediation pipeline */
+interface RemediationReport {
+    cveId: string;
+    cveDetails: CveDetails | null;
+    vulnerablePackages: VulnerablePackage[];
+    results: PatchResult[];
+    agentSteps: number;
+    summary: string;
+    evidenceFile?: string;
+    correlation?: CorrelationContext;
+    provenance?: ProvenanceContext;
+    constraints?: RemediationConstraints;
+    resumedFromCache?: boolean;
+}
+
+type ScanInputFormat = "npm-audit" | "yarn-audit" | "sarif" | "auto";
+
+interface ScanOptions extends RemediateOptions {
+    format?: ScanInputFormat;
+    policy?: string;
+}
+interface ScanReport {
+    schemaVersion: "1.0";
+    status: "ok" | "partial" | "failed";
+    generatedAt: string;
+    cveIds: string[];
+    reports: RemediationReport[];
+    successCount: number;
+    failedCount: number;
+    errors: Array<{
+        cveId: string;
+        message: string;
+    }>;
+    evidenceFile?: string;
+    patchCount: number;
+    patchValidationFailures?: Array<{
+        packageName: string;
+        cveId: string;
+        error: string;
+    }>;
+    strategyCounts?: PatchStrategyCounts;
+    dependencyScopeCounts?: DependencyScopeCounts;
+    unresolvedByReason?: UnresolvedReasonCounts;
+    patchesDir?: string;
+    correlation?: CorrelationContext;
+    provenance?: ProvenanceContext;
+    constraints?: RemediationConstraints;
+    idempotencyKey?: string;
+}
+interface CiSummary {
+    schemaVersion: "1.0";
+    status: "ok" | "partial" | "failed";
+    generatedAt: string;
+    cveCount: number;
+    remediationCount: number;
+    successCount: number;
+    failedCount: number;
+    errors: Array<{
+        cveId: string;
+        message: string;
+    }>;
+    evidenceFile?: string;
+    patchCount?: number;
+    patchValidationFailures?: Array<{
+        packageName: string;
+        cveId: string;
+        error: string;
+    }>;
+    strategyCounts?: PatchStrategyCounts;
+    dependencyScopeCounts?: DependencyScopeCounts;
+    unresolvedByReason?: UnresolvedReasonCounts;
+    patchesDir?: string;
+    correlation?: CorrelationContext;
+    provenance?: ProvenanceContext;
+    constraints?: RemediationConstraints;
+    idempotencyKey?: string;
+}
+
+declare function remediate(cveId: string, options?: RemediateOptions): Promise<RemediationReport>;
+declare function planRemediation(cveId: string, options?: RemediateOptions): Promise<RemediationReport>;
+
+declare function remediateFromScan(inputPath: string, options?: ScanOptions): Promise<ScanReport>;
+
+export { type AffectedPackage as A, type CiSummary as C, type DependencyScope as D, type InventoryPackage as I, type PatchResult as P, type RemediateOptions as R, type ScanReport as S, type UnresolvedReason as U, type VulnerablePackage as V, type RemediationReport as a, type CorrelationContext as b, type CveDetails as c, type DependencyScopeCounts as d, type PatchStrategy as e, type PatchStrategyCounts as f, type ProvenanceContext as g, type RemediationConstraints as h, type ScanInputFormat as i, type ScanOptions as j, type UnresolvedReasonCounts as k, remediateFromScan as l, planRemediation as p, remediate as r };

package/llms.txt

@@ -44,7 +44,7 @@ autoremediator ./npm-audit.json --cwd ./my-project --ci
 autoremediator-mcp   # stdio transport — register with any MCP host
 ```
 
-Available MCP tools: `remediate`, `remediateFromScan`
+Available MCP tools: `remediate`, `planRemediation`, `remediateFromScan`
 
 ## Tools (agent / MCP)
 
@@ -55,6 +55,7 @@ Available MCP tools: `remediate`, `remediateFromScan`
 | `check-version-match` | Cross-reference inventory against vulnerable ranges |
 | `find-fixed-version`  | Query npm registry for lowest safe upgrade |
 | `apply-version-bump`  | Update package.json and run package-manager install |
+| `apply-package-override` | Apply package-manager-native override for vulnerable transitive dependencies |
 | `fetch-package-source`| Download package tarball for patch generation |
 | `generate-patch`      | Generate unified diff patch via LLM |
 | `apply-patch-file`    | Write/apply patch file via native or compatibility patch flow |
@@ -63,6 +64,7 @@ Available MCP tools: `remediate`, `remediateFromScan`
 
 ```
 lookup-cve → check-inventory → check-version-match → find-fixed-version → apply-version-bump
+	└─ transitive path: apply-package-override
 	└─ fallback: fetch-package-source → generate-patch → apply-patch-file
 ```
 
@@ -72,11 +74,20 @@ lookup-cve → check-inventory → check-version-match → find-fixed-version
 |--------|------|---------|-------------|
 | `cwd` | string | `process.cwd()` | Project root |
 | `dryRun` | boolean | `false` | Plan only, write nothing |
-| `skipTests` | boolean | `true` | Skip package-manager test command after fix |
+| `runTests` | boolean | `false` | Run package-manager test command after fix |
 | `packageManager` | `npm\|pnpm\|yarn` | auto-detect | Override package manager selection |
-| `llmProvider` | `openai\|anthropic\|local` | `openai` | LLM backend (`local` = deterministic, no API key needed) |
+| `llmProvider` | `openai\|anthropic\|local` | `openai` | LLM backend (`local` = deterministic primary path; fallback patch generation may require model credentials) |
 | `patchesDir` | string | `./patches` | Directory for .patch files |
-| `policyPath` | string | `.autoremediator.json` | Policy file path |
+| `policy` | string | `.autoremediator.json` | Policy file path |
+| `preview` | boolean | `false` | Non-mutating remediation preview (forces dry-run behavior) |
+| `evidence` | boolean | `true` | Write evidence JSON output |
+| `requestId` | string | auto-generated | Request correlation ID |
+| `sessionId` | string | unset | Session correlation ID |
+| `parentRunId` | string | unset | Parent run correlation ID |
+| `idempotencyKey` | string | unset | Replay-safe idempotency key |
+| `resume` | boolean | `false` | Return cached result for matching idempotency key when available |
+| `constraints.directDependenciesOnly` | boolean | `false` | Restrict remediation to direct dependencies |
+| `constraints.preferVersionBump` | boolean | `false` | Reject override and patch remediation |
 
 ## Policy File (`.autoremediator.json`)
 
@@ -114,6 +125,7 @@ lookup-cve → check-inventory → check-version-match → find-fixed-version
 	results: PatchResult[];       // strategy: "version-bump" | "patch-file" | "none"
 	agentSteps: number;
 	summary: string;
+	evidenceFile?: string;
 }
 ```
 
@@ -129,8 +141,11 @@ lookup-cve → check-inventory → check-version-match → find-fixed-version
 	failedCount: number;
 	errors: Array<{ cveId: string; message: string }>;
 	evidenceFile?: string;        // path to .autoremediator/evidence/<runId>.json
-	patchFileCount: number;
+	patchCount: number;
 	patchValidationFailures?: Array<{ packageName: string; cveId: string; error: string }>;
-	patchStorageDir?: string;
+	strategyCounts?: Record<string, number>;
+	dependencyScopeCounts?: Record<string, number>;
+	unresolvedByReason?: Record<string, number>;
+	patchesDir?: string;
 }
 ```

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "autoremediator",
   "private": false,
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Risk-aware, agentic CVE remediation for Node.js using OSV, CISA KEV, and FIRST EPSS intelligence with policy and evidence controls.",
   "keywords": [
     "security-remediation",