autoremediator 0.21.2 → 0.22.0

package/dist/api/policy-nl/proposal.d.ts

@@ -0,0 +1,438 @@
+import { z } from "zod";
+declare function build(): {
+    patch: z.ZodObject<{
+        allowMajorBumps: z.ZodOptional<z.ZodBoolean>;
+        denyPackages: z.ZodOptional<z.ZodObject<{
+            add: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            remove: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+        allowPackages: z.ZodOptional<z.ZodObject<{
+            add: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            remove: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+        constraints: z.ZodOptional<z.ZodObject<{
+            directDependenciesOnly: z.ZodOptional<z.ZodBoolean>;
+            preferVersionBump: z.ZodOptional<z.ZodBoolean>;
+            installMode: z.ZodOptional<z.ZodEnum<{
+                deterministic: "deterministic";
+                "prefer-offline": "prefer-offline";
+                standard: "standard";
+            }>>;
+            installPreferOffline: z.ZodOptional<z.ZodBoolean>;
+            enforceFrozenLockfile: z.ZodOptional<z.ZodBoolean>;
+            workspace: z.ZodOptional<z.ZodString>;
+            typecheck: z.ZodOptional<z.ZodBoolean>;
+            requireProofOfFix: z.ZodOptional<z.ZodBoolean>;
+            enableBreakingChangeRefactor: z.ZodOptional<z.ZodBoolean>;
+            supplyChainPolicy: z.ZodOptional<z.ZodObject<{
+                minPublishAgeHours: z.ZodOptional<z.ZodNumber>;
+                blockInstallScripts: z.ZodOptional<z.ZodBoolean>;
+                requireProvenance: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+        exploitSignalOverride: z.ZodOptional<z.ZodObject<{
+            kev: z.ZodOptional<z.ZodObject<{
+                mandatory: z.ZodBoolean;
+            }, z.core.$strict>>;
+            epss: z.ZodOptional<z.ZodObject<{
+                mandatory: z.ZodBoolean;
+                threshold: z.ZodNumber;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+        suppressions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            justification: z.ZodEnum<{
+                fixed: "fixed";
+                mitigated: "mitigated";
+                not_affected: "not_affected";
+                under_investigation: "under_investigation";
+            }>;
+            cveId: z.ZodString;
+            notes: z.ZodOptional<z.ZodString>;
+            expiresAt: z.ZodString;
+        }, z.core.$strict>>>;
+        sla: z.ZodOptional<z.ZodObject<{
+            critical: z.ZodOptional<z.ZodNumber>;
+            high: z.ZodOptional<z.ZodNumber>;
+            medium: z.ZodOptional<z.ZodNumber>;
+            low: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>>;
+        dispositionPolicy: z.ZodOptional<z.ZodObject<{
+            minConfidenceForAutoApply: z.ZodOptional<z.ZodNumber>;
+            holdForTransitive: z.ZodOptional<z.ZodBoolean>;
+            escalateOnKev: z.ZodOptional<z.ZodBoolean>;
+            escalateOnSlaBreachSeverities: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                CRITICAL: "CRITICAL";
+                HIGH: "HIGH";
+                LOW: "LOW";
+                MEDIUM: "MEDIUM";
+                UNKNOWN: "UNKNOWN";
+            }>>>;
+        }, z.core.$strict>>;
+        containmentMode: z.ZodOptional<z.ZodBoolean>;
+        escalationGraph: z.ZodOptional<z.ZodObject<{
+            "breaking-change-unresolved": z.ZodOptional<z.ZodEnum<{
+                "create-draft-pr": "create-draft-pr";
+                "hold-branch": "hold-branch";
+                none: "none";
+                "notify-channel": "notify-channel";
+                "open-issue": "open-issue";
+            }>>;
+            "constraint-blocked": z.ZodOptional<z.ZodEnum<{
+                "create-draft-pr": "create-draft-pr";
+                "hold-branch": "hold-branch";
+                none: "none";
+                "notify-channel": "notify-channel";
+                "open-issue": "open-issue";
+            }>>;
+            "install-failed": z.ZodOptional<z.ZodEnum<{
+                "create-draft-pr": "create-draft-pr";
+                "hold-branch": "hold-branch";
+                none: "none";
+                "notify-channel": "notify-channel";
+                "open-issue": "open-issue";
+            }>>;
+            "major-bump-required": z.ZodOptional<z.ZodEnum<{
+                "create-draft-pr": "create-draft-pr";
+                "hold-branch": "hold-branch";
+                none: "none";
+                "notify-channel": "notify-channel";
+                "open-issue": "open-issue";
+            }>>;
+            "no-safe-version": z.ZodOptional<z.ZodEnum<{
+                "create-draft-pr": "create-draft-pr";
+                "hold-branch": "hold-branch";
+                none: "none";
+                "notify-channel": "notify-channel";
+                "open-issue": "open-issue";
+            }>>;
+            "override-apply-failed": z.ZodOptional<z.ZodEnum<{
+                "create-draft-pr": "create-draft-pr";
+                "hold-branch": "hold-branch";
+                none: "none";
+                "notify-channel": "notify-channel";
+                "open-issue": "open-issue";
+            }>>;
+            "package-json-not-found": z.ZodOptional<z.ZodEnum<{
+                "create-draft-pr": "create-draft-pr";
+                "hold-branch": "hold-branch";
+                none: "none";
+                "notify-channel": "notify-channel";
+                "open-issue": "open-issue";
+            }>>;
+            "patch-apply-failed": z.ZodOptional<z.ZodEnum<{
+                "create-draft-pr": "create-draft-pr";
+                "hold-branch": "hold-branch";
+                none: "none";
+                "notify-channel": "notify-channel";
+                "open-issue": "open-issue";
+            }>>;
+            "patch-confidence-too-low": z.ZodOptional<z.ZodEnum<{
+                "create-draft-pr": "create-draft-pr";
+                "hold-branch": "hold-branch";
+                none: "none";
+                "notify-channel": "notify-channel";
+                "open-issue": "open-issue";
+            }>>;
+            "patch-generation-failed": z.ZodOptional<z.ZodEnum<{
+                "create-draft-pr": "create-draft-pr";
+                "hold-branch": "hold-branch";
+                none: "none";
+                "notify-channel": "notify-channel";
+                "open-issue": "open-issue";
+            }>>;
+            "patch-validation-failed": z.ZodOptional<z.ZodEnum<{
+                "create-draft-pr": "create-draft-pr";
+                "hold-branch": "hold-branch";
+                none: "none";
+                "notify-channel": "notify-channel";
+                "open-issue": "open-issue";
+            }>>;
+            "policy-blocked": z.ZodOptional<z.ZodEnum<{
+                "create-draft-pr": "create-draft-pr";
+                "hold-branch": "hold-branch";
+                none: "none";
+                "notify-channel": "notify-channel";
+                "open-issue": "open-issue";
+            }>>;
+            "proof-of-fix-failed": z.ZodOptional<z.ZodEnum<{
+                "create-draft-pr": "create-draft-pr";
+                "hold-branch": "hold-branch";
+                none: "none";
+                "notify-channel": "notify-channel";
+                "open-issue": "open-issue";
+            }>>;
+            "requires-llm-fallback": z.ZodOptional<z.ZodEnum<{
+                "create-draft-pr": "create-draft-pr";
+                "hold-branch": "hold-branch";
+                none: "none";
+                "notify-channel": "notify-channel";
+                "open-issue": "open-issue";
+            }>>;
+            "source-fetch-failed": z.ZodOptional<z.ZodEnum<{
+                "create-draft-pr": "create-draft-pr";
+                "hold-branch": "hold-branch";
+                none: "none";
+                "notify-channel": "notify-channel";
+                "open-issue": "open-issue";
+            }>>;
+            "transitive-dependency": z.ZodOptional<z.ZodEnum<{
+                "create-draft-pr": "create-draft-pr";
+                "hold-branch": "hold-branch";
+                none: "none";
+                "notify-channel": "notify-channel";
+                "open-issue": "open-issue";
+            }>>;
+            "transitive-override-unsupported-deno-native": z.ZodOptional<z.ZodEnum<{
+                "create-draft-pr": "create-draft-pr";
+                "hold-branch": "hold-branch";
+                none: "none";
+                "notify-channel": "notify-channel";
+                "open-issue": "open-issue";
+            }>>;
+            "validation-failed": z.ZodOptional<z.ZodEnum<{
+                "create-draft-pr": "create-draft-pr";
+                "hold-branch": "hold-branch";
+                none: "none";
+                "notify-channel": "notify-channel";
+                "open-issue": "open-issue";
+            }>>;
+        }, z.core.$strict>>;
+        autonomy: z.ZodOptional<z.ZodObject<{
+            ceiling: z.ZodEnum<{
+                L0: "L0";
+                L1: "L1";
+                L2: "L2";
+                L3: "L3";
+                L4: "L4";
+            }>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    proposal: z.ZodObject<{
+        patch: z.ZodObject<{
+            allowMajorBumps: z.ZodOptional<z.ZodBoolean>;
+            denyPackages: z.ZodOptional<z.ZodObject<{
+                add: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                remove: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            }, z.core.$strict>>;
+            allowPackages: z.ZodOptional<z.ZodObject<{
+                add: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                remove: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            }, z.core.$strict>>;
+            constraints: z.ZodOptional<z.ZodObject<{
+                directDependenciesOnly: z.ZodOptional<z.ZodBoolean>;
+                preferVersionBump: z.ZodOptional<z.ZodBoolean>;
+                installMode: z.ZodOptional<z.ZodEnum<{
+                    deterministic: "deterministic";
+                    "prefer-offline": "prefer-offline";
+                    standard: "standard";
+                }>>;
+                installPreferOffline: z.ZodOptional<z.ZodBoolean>;
+                enforceFrozenLockfile: z.ZodOptional<z.ZodBoolean>;
+                workspace: z.ZodOptional<z.ZodString>;
+                typecheck: z.ZodOptional<z.ZodBoolean>;
+                requireProofOfFix: z.ZodOptional<z.ZodBoolean>;
+                enableBreakingChangeRefactor: z.ZodOptional<z.ZodBoolean>;
+                supplyChainPolicy: z.ZodOptional<z.ZodObject<{
+                    minPublishAgeHours: z.ZodOptional<z.ZodNumber>;
+                    blockInstallScripts: z.ZodOptional<z.ZodBoolean>;
+                    requireProvenance: z.ZodOptional<z.ZodBoolean>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
+            exploitSignalOverride: z.ZodOptional<z.ZodObject<{
+                kev: z.ZodOptional<z.ZodObject<{
+                    mandatory: z.ZodBoolean;
+                }, z.core.$strict>>;
+                epss: z.ZodOptional<z.ZodObject<{
+                    mandatory: z.ZodBoolean;
+                    threshold: z.ZodNumber;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
+            suppressions: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                justification: z.ZodEnum<{
+                    fixed: "fixed";
+                    mitigated: "mitigated";
+                    not_affected: "not_affected";
+                    under_investigation: "under_investigation";
+                }>;
+                cveId: z.ZodString;
+                notes: z.ZodOptional<z.ZodString>;
+                expiresAt: z.ZodString;
+            }, z.core.$strict>>>;
+            sla: z.ZodOptional<z.ZodObject<{
+                critical: z.ZodOptional<z.ZodNumber>;
+                high: z.ZodOptional<z.ZodNumber>;
+                medium: z.ZodOptional<z.ZodNumber>;
+                low: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strict>>;
+            dispositionPolicy: z.ZodOptional<z.ZodObject<{
+                minConfidenceForAutoApply: z.ZodOptional<z.ZodNumber>;
+                holdForTransitive: z.ZodOptional<z.ZodBoolean>;
+                escalateOnKev: z.ZodOptional<z.ZodBoolean>;
+                escalateOnSlaBreachSeverities: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                    CRITICAL: "CRITICAL";
+                    HIGH: "HIGH";
+                    LOW: "LOW";
+                    MEDIUM: "MEDIUM";
+                    UNKNOWN: "UNKNOWN";
+                }>>>;
+            }, z.core.$strict>>;
+            containmentMode: z.ZodOptional<z.ZodBoolean>;
+            escalationGraph: z.ZodOptional<z.ZodObject<{
+                "breaking-change-unresolved": z.ZodOptional<z.ZodEnum<{
+                    "create-draft-pr": "create-draft-pr";
+                    "hold-branch": "hold-branch";
+                    none: "none";
+                    "notify-channel": "notify-channel";
+                    "open-issue": "open-issue";
+                }>>;
+                "constraint-blocked": z.ZodOptional<z.ZodEnum<{
+                    "create-draft-pr": "create-draft-pr";
+                    "hold-branch": "hold-branch";
+                    none: "none";
+                    "notify-channel": "notify-channel";
+                    "open-issue": "open-issue";
+                }>>;
+                "install-failed": z.ZodOptional<z.ZodEnum<{
+                    "create-draft-pr": "create-draft-pr";
+                    "hold-branch": "hold-branch";
+                    none: "none";
+                    "notify-channel": "notify-channel";
+                    "open-issue": "open-issue";
+                }>>;
+                "major-bump-required": z.ZodOptional<z.ZodEnum<{
+                    "create-draft-pr": "create-draft-pr";
+                    "hold-branch": "hold-branch";
+                    none: "none";
+                    "notify-channel": "notify-channel";
+                    "open-issue": "open-issue";
+                }>>;
+                "no-safe-version": z.ZodOptional<z.ZodEnum<{
+                    "create-draft-pr": "create-draft-pr";
+                    "hold-branch": "hold-branch";
+                    none: "none";
+                    "notify-channel": "notify-channel";
+                    "open-issue": "open-issue";
+                }>>;
+                "override-apply-failed": z.ZodOptional<z.ZodEnum<{
+                    "create-draft-pr": "create-draft-pr";
+                    "hold-branch": "hold-branch";
+                    none: "none";
+                    "notify-channel": "notify-channel";
+                    "open-issue": "open-issue";
+                }>>;
+                "package-json-not-found": z.ZodOptional<z.ZodEnum<{
+                    "create-draft-pr": "create-draft-pr";
+                    "hold-branch": "hold-branch";
+                    none: "none";
+                    "notify-channel": "notify-channel";
+                    "open-issue": "open-issue";
+                }>>;
+                "patch-apply-failed": z.ZodOptional<z.ZodEnum<{
+                    "create-draft-pr": "create-draft-pr";
+                    "hold-branch": "hold-branch";
+                    none: "none";
+                    "notify-channel": "notify-channel";
+                    "open-issue": "open-issue";
+                }>>;
+                "patch-confidence-too-low": z.ZodOptional<z.ZodEnum<{
+                    "create-draft-pr": "create-draft-pr";
+                    "hold-branch": "hold-branch";
+                    none: "none";
+                    "notify-channel": "notify-channel";
+                    "open-issue": "open-issue";
+                }>>;
+                "patch-generation-failed": z.ZodOptional<z.ZodEnum<{
+                    "create-draft-pr": "create-draft-pr";
+                    "hold-branch": "hold-branch";
+                    none: "none";
+                    "notify-channel": "notify-channel";
+                    "open-issue": "open-issue";
+                }>>;
+                "patch-validation-failed": z.ZodOptional<z.ZodEnum<{
+                    "create-draft-pr": "create-draft-pr";
+                    "hold-branch": "hold-branch";
+                    none: "none";
+                    "notify-channel": "notify-channel";
+                    "open-issue": "open-issue";
+                }>>;
+                "policy-blocked": z.ZodOptional<z.ZodEnum<{
+                    "create-draft-pr": "create-draft-pr";
+                    "hold-branch": "hold-branch";
+                    none: "none";
+                    "notify-channel": "notify-channel";
+                    "open-issue": "open-issue";
+                }>>;
+                "proof-of-fix-failed": z.ZodOptional<z.ZodEnum<{
+                    "create-draft-pr": "create-draft-pr";
+                    "hold-branch": "hold-branch";
+                    none: "none";
+                    "notify-channel": "notify-channel";
+                    "open-issue": "open-issue";
+                }>>;
+                "requires-llm-fallback": z.ZodOptional<z.ZodEnum<{
+                    "create-draft-pr": "create-draft-pr";
+                    "hold-branch": "hold-branch";
+                    none: "none";
+                    "notify-channel": "notify-channel";
+                    "open-issue": "open-issue";
+                }>>;
+                "source-fetch-failed": z.ZodOptional<z.ZodEnum<{
+                    "create-draft-pr": "create-draft-pr";
+                    "hold-branch": "hold-branch";
+                    none: "none";
+                    "notify-channel": "notify-channel";
+                    "open-issue": "open-issue";
+                }>>;
+                "transitive-dependency": z.ZodOptional<z.ZodEnum<{
+                    "create-draft-pr": "create-draft-pr";
+                    "hold-branch": "hold-branch";
+                    none: "none";
+                    "notify-channel": "notify-channel";
+                    "open-issue": "open-issue";
+                }>>;
+                "transitive-override-unsupported-deno-native": z.ZodOptional<z.ZodEnum<{
+                    "create-draft-pr": "create-draft-pr";
+                    "hold-branch": "hold-branch";
+                    none: "none";
+                    "notify-channel": "notify-channel";
+                    "open-issue": "open-issue";
+                }>>;
+                "validation-failed": z.ZodOptional<z.ZodEnum<{
+                    "create-draft-pr": "create-draft-pr";
+                    "hold-branch": "hold-branch";
+                    none: "none";
+                    "notify-channel": "notify-channel";
+                    "open-issue": "open-issue";
+                }>>;
+            }, z.core.$strict>>;
+            autonomy: z.ZodOptional<z.ZodObject<{
+                ceiling: z.ZodEnum<{
+                    L0: "L0";
+                    L1: "L1";
+                    L2: "L2";
+                    L3: "L3";
+                    L4: "L4";
+                }>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+        explanations: z.ZodArray<z.ZodObject<{
+            phrase: z.ZodString;
+            keys: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>>;
+        unsupported: z.ZodArray<z.ZodObject<{
+            phrase: z.ZodString;
+            reason: z.ZodString;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    /** The policy keys a model may touch. Everything else in the policy file is out of reach. */
+    keys: readonly string[];
+};
+/**
+ * The schemas, built on first use from the real policy schema. Built lazily so importing this module
+ * costs nothing and does not require the policy module to be loaded first.
+ */
+export declare function policySchemas(): ReturnType<typeof build>;
+export type PolicyPatch = z.infer<ReturnType<typeof build>["patch"]>;
+export type PolicyProposal = z.infer<ReturnType<typeof build>["proposal"]>;
+export {};
+//# sourceMappingURL=proposal.d.ts.map

package/dist/api/policy-nl/proposal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proposal.d.ts","sourceRoot":"","sources":["../../../src/api/policy-nl/proposal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAuBxB,iBAAS,KAAK;IA8EV,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IACL,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IACR,6FAA6F;IAC7F,IAAI,EAA0C,SAAS,MAAM,EAAE;EAElE;AAID;;;GAGG;AACH,wBAAgB,aAAa,IAAI,UAAU,CAAC,OAAO,KAAK,CAAC,CAGxD;AAED,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;AACrE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC"}

package/dist/api/policy-nl/proposal.js

@@ -0,0 +1,105 @@
+import { z } from "zod";
+import { AUTONOMY_LEVEL_VALUES } from "../../platform/option-schemas.js";
+import { policyFileSchema, suppressionSchema } from "../../platform/policy.js";
+import { MAX_NOTE_LENGTH } from "./sanitize.js";
+/** An npm package name or a `*` wildcard pattern over one. Nothing else can be written into a list. */
+const PACKAGE_PATTERN = /^(?:@[a-z0-9*][a-z0-9._*-]*\/)?[a-z0-9*][a-z0-9._*-]*$/;
+const packageName = z
+    .string()
+    .max(214)
+    .regex(PACKAGE_PATTERN, "must be an npm package name or a wildcard pattern such as @scope/*");
+const listEdit = z
+    .object({
+    add: z.array(packageName).max(50).optional(),
+    remove: z.array(packageName).max(50).optional(),
+})
+    .strict();
+/** `CVE-YYYY-NNNN…` or a GHSA id. */
+const ADVISORY_ID = /^(?:CVE-\d{4}-\d{4,}|GHSA(?:-[23456789cfghjmpqrvwx]{4}){3})$/i;
+function build() {
+    /** A suppression the model may propose: the policy's own entry, but with a required, bounded expiry. */
+    const suppressionProposal = suppressionSchema
+        .omit({ cveId: true, notes: true, expiresAt: true })
+        .extend({
+        cveId: z.string().regex(ADVISORY_ID, "must be a CVE or GHSA id"),
+        notes: z
+            .string()
+            .max(MAX_NOTE_LENGTH * 4)
+            .optional(),
+        expiresAt: z
+            .string()
+            .regex(/^\d{4}-\d{2}-\d{2}(?:T[\d:.]+Z)?$/, "must be a date such as 2027-01-31"),
+    })
+        .strict();
+    /**
+     * What a model may ask for: a patch over known policy keys, built from the real policy schema
+     * (`policyFileSchema`), so a key or value the policy file rejects cannot be expressed. Keys that can
+     * widen trust beyond the user's words (`recipes`, `patchConfidenceThresholds`, `skipUnreachable`)
+     * are left out on purpose. Defaults are not applied: an absent key means "leave it alone".
+     */
+    const policyPatchSchema = z
+        .object({
+        allowMajorBumps: z.boolean().optional(),
+        denyPackages: listEdit.optional(),
+        allowPackages: listEdit.optional(),
+        constraints: policyFileSchema.shape.constraints,
+        exploitSignalOverride: policyFileSchema.shape.exploitSignalOverride,
+        suppressions: z.array(suppressionProposal).max(20).optional(),
+        sla: policyFileSchema.shape.sla,
+        dispositionPolicy: policyFileSchema.shape.dispositionPolicy,
+        containmentMode: z.boolean().optional(),
+        escalationGraph: policyFileSchema.shape.escalationGraph,
+        autonomy: z
+            .object({ ceiling: z.enum(AUTONOMY_LEVEL_VALUES) })
+            .strict()
+            .optional(),
+    })
+        .strict();
+    const explanationSchema = z
+        .object({
+        phrase: z
+            .string()
+            .min(1)
+            .max(300)
+            .describe("The words of the request this explains, copied exactly from it."),
+        keys: z
+            .array(z.string().min(1).max(120))
+            .max(20)
+            .describe("Dotted policy keys this phrase set or confirmed, e.g. denyPackages or constraints.supplyChainPolicy.blockInstallScripts. Name the key even when the policy already had that value."),
+    })
+        .strict();
+    const unsupportedSchema = z
+        .object({
+        phrase: z
+            .string()
+            .min(1)
+            .max(300)
+            .describe("The words of the request that cannot be expressed, copied exactly."),
+        reason: z.string().min(1).max(300).describe("Why the policy file cannot express them."),
+    })
+        .strict();
+    /** The whole structured answer a model must give. */
+    const policyProposalSchema = z
+        .object({
+        patch: policyPatchSchema,
+        explanations: z.array(explanationSchema).max(50),
+        unsupported: z.array(unsupportedSchema).max(50),
+    })
+        .strict();
+    return {
+        patch: policyPatchSchema,
+        proposal: policyProposalSchema,
+        /** The policy keys a model may touch. Everything else in the policy file is out of reach. */
+        keys: Object.keys(policyPatchSchema.shape),
+    };
+}
+let cached;
+/**
+ * The schemas, built on first use from the real policy schema. Built lazily so importing this module
+ * costs nothing and does not require the policy module to be loaded first.
+ */
+export function policySchemas() {
+    cached ??= build();
+    return cached;
+}
+//# sourceMappingURL=proposal.js.map

package/dist/api/policy-nl/proposal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proposal.js","sourceRoot":"","sources":["../../../src/api/policy-nl/proposal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,uGAAuG;AACvG,MAAM,eAAe,GAAG,wDAAwD,CAAC;AACjF,MAAM,WAAW,GAAG,CAAC;KAClB,MAAM,EAAE;KACR,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CAAC,eAAe,EAAE,oEAAoE,CAAC,CAAC;AAEhG,MAAM,QAAQ,GAAG,CAAC;KACf,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;CAChD,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,qCAAqC;AACrC,MAAM,WAAW,GAAG,+DAA+D,CAAC;AAEpF,SAAS,KAAK;IACZ,wGAAwG;IACxG,MAAM,mBAAmB,GAAG,iBAAiB;SAC1C,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;SACnD,MAAM,CAAC;QACN,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,0BAA0B,CAAC;QAChE,KAAK,EAAE,CAAC;aACL,MAAM,EAAE;aACR,GAAG,CAAC,eAAe,GAAG,CAAC,CAAC;aACxB,QAAQ,EAAE;QACb,SAAS,EAAE,CAAC;aACT,MAAM,EAAE;aACR,KAAK,CAAC,mCAAmC,EAAE,mCAAmC,CAAC;KACnF,CAAC;SACD,MAAM,EAAE,CAAC;IAEZ;;;;;OAKG;IACH,MAAM,iBAAiB,GAAG,CAAC;SACxB,MAAM,CAAC;QACN,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QACvC,YAAY,EAAE,QAAQ,CAAC,QAAQ,EAAE;QACjC,aAAa,EAAE,QAAQ,CAAC,QAAQ,EAAE;QAClC,WAAW,EAAE,gBAAgB,CAAC,KAAK,CAAC,WAAW;QAC/C,qBAAqB,EAAE,gBAAgB,CAAC,KAAK,CAAC,qBAAqB;QACnE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC7D,GAAG,EAAE,gBAAgB,CAAC,KAAK,CAAC,GAAG;QAC/B,iBAAiB,EAAE,gBAAgB,CAAC,KAAK,CAAC,iBAAiB;QAC3D,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QACvC,eAAe,EAAE,gBAAgB,CAAC,KAAK,CAAC,eAAe;QACvD,QAAQ,EAAE,CAAC;aACR,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,EAAE,CAAC;aAClD,MAAM,EAAE;aACR,QAAQ,EAAE;KACd,CAAC;SACD,MAAM,EAAE,CAAC;IAEZ,MAAM,iBAAiB,GAAG,CAAC;SACxB,MAAM,CAAC;QACN,MAAM,EAAE,CAAC;aACN,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,GAAG,CAAC;aACR,QAAQ,CAAC,iEAAiE,CAAC;QAC9E,IAAI,EAAE,CAAC;aACJ,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;aACjC,GAAG,CAAC,EAAE,CAAC;aACP,QAAQ,CACP,oLAAoL,CACrL;KACJ,CAAC;SACD,MAAM,EAAE,CAAC;IAEZ,MAAM,iBAAiB,GAAG,CAAC;SACxB,MAAM,CAAC;QACN,MAAM,EAAE,CAAC;aACN,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,GAAG,CAAC;aACR,QAAQ,CAAC,oEAAoE,CAAC;QACjF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,0CAA0C,CAAC;KACxF,CAAC;SACD,MAAM,EAAE,CAAC;IAEZ,qDAAqD;IACrD,MAAM,oBAAoB,GAAG,CAAC;SAC3B,MAAM,CAAC;QACN,KAAK,EAAE,iBAAiB;QACxB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QAChD,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;KAChD,CAAC;SACD,MAAM,EAAE,CAAC;IAEZ,OAAO;QACL,KAAK,EAAE,iBAAiB;QACxB,QAAQ,EAAE,oBAAoB;QAC9B,6FAA6F;QAC7F,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAsB;KAChE,CAAC;AACJ,CAAC;AAED,IAAI,MAA4C,CAAC;AAEjD;;;GAGG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,KAAK,KAAK,EAAE,CAAC;IACnB,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/api/policy-nl/request-match.d.ts

@@ -0,0 +1,20 @@
+/** The request as tokens, each knowing which rule (clause) it belongs to. */
+export interface RequestIndex {
+    tokens: string[];
+    /** `clause[i]` is the rule that `tokens[i]` is part of. */
+    clause: number[];
+}
+/** Normalised words of a text: lower-case, punctuation and spacing folded away, package names kept whole. */
+export declare const tokensOf: (text: string) => string[];
+/** Split a request into rules: by line, semicolon or sentence end. */
+export declare function clausesOf(request: string): string[];
+export declare function indexRequest(request: string): RequestIndex;
+/** Start positions where `phrase` occurs in the request as a run of consecutive words, in order. */
+export declare function findPhrase(index: RequestIndex, phrase: string): number[];
+/**
+ * Whether a negation (never, not, don't, without, no...) governs the run of words that starts at
+ * `start`: inside it, or in the few words before it within the same rule. A model that quotes
+ * "allow major bumps" out of "Never allow major bumps" is quoting words that say the opposite.
+ */
+export declare function isNegated(index: RequestIndex, start: number, length: number): boolean;
+//# sourceMappingURL=request-match.d.ts.map

package/dist/api/policy-nl/request-match.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-match.d.ts","sourceRoot":"","sources":["../../../src/api/policy-nl/request-match.ts"],"names":[],"mappings":"AAEA,6EAA6E;AAC7E,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,2DAA2D;IAC3D,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,6GAA6G;AAC7G,eAAO,MAAM,QAAQ,SAAU,MAAM,KAAG,MAAM,EAI1B,CAAC;AAErB,sEAAsE;AACtE,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAKnD;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAU1D;AAED,oGAAoG;AACpG,wBAAgB,UAAU,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAQxE;AA4CD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAWrF"}