autoremediator 0.21.2 → 0.22.0

package/dist/platform/option-schemas.d.ts

@@ -0,0 +1,1225 @@
+/**
+ * Wire schemas for every option a caller can pass to remediation, as zod.
+ *
+ * This is the single definition behind the JSON Schemas that MCP tools, OpenAPI paths and CLI help
+ * advertise, and behind input validation on those surfaces. Option names follow the canonical
+ * naming in AGENTS.md. Fields that cannot travel over a wire (a `PatchGenerator` instance) are
+ * SDK-only and deliberately absent.
+ */
+import { z } from "zod";
+import type { RemediateOptions, UnresolvedReason } from "./types.js";
+export declare const PACKAGE_MANAGER_VALUES: readonly ["npm", "pnpm", "yarn", "bun", "deno"];
+export declare const PROVENANCE_SOURCE_VALUES: readonly ["cli", "sdk", "mcp", "openapi", "unknown"];
+export declare const SCAN_FORMAT_VALUES: readonly ["npm-audit", "yarn-audit", "sarif", "auto"];
+export declare const INSTALL_MODE_VALUES: readonly ["deterministic", "prefer-offline", "standard"];
+export declare const CHANGE_REQUEST_PROVIDER_VALUES: readonly ["github", "gitlab"];
+export declare const CHANGE_REQUEST_GROUPING_VALUES: readonly ["all", "per-cve", "per-package", "by-severity"];
+export declare const ESCALATION_ACTION_VALUES: readonly ["open-issue", "notify-channel", "create-draft-pr", "hold-branch", "none"];
+export declare const SEVERITY_VALUES: readonly ["UNKNOWN", "LOW", "MEDIUM", "HIGH", "CRITICAL"];
+/** Every reason a result can be unresolved, as a runtime list kept in step with the type. */
+export declare const UNRESOLVED_REASON_VALUES: readonly ["constraint-blocked", "transitive-dependency", "transitive-override-unsupported-deno-native", "install-failed", "major-bump-required", "no-safe-version", "override-apply-failed", "package-json-not-found", "patch-apply-failed", "patch-confidence-too-low", "patch-generation-failed", "patch-validation-failed", "proof-of-fix-failed", "breaking-change-unresolved", "policy-blocked", "requires-llm-fallback", "source-fetch-failed", "validation-failed"];
+type MissingReason = Exclude<UnresolvedReason, (typeof UNRESOLVED_REASON_VALUES)[number]>;
+export declare const unresolvedReasonsAreComplete: MissingReason extends never ? true : never;
+export declare const OPTION_DESCRIPTIONS: {
+    readonly cveId: "CVE ID, e.g. CVE-2021-23337";
+    readonly inputPath: "Absolute path to the scanner output file";
+    readonly cwd: "Absolute path to the project root (default: process.cwd())";
+    readonly packageManager: "Package manager override (auto-detected by default)";
+    readonly dryRun: "If true, plan changes but write nothing";
+    readonly preview: "If true, enforce non-mutating preview mode";
+    readonly simulationMode: "If true, attach deterministic simulation and rebuttal metadata for dry-run or preview execution";
+    readonly runTests: "Run package-manager test command after applying fix";
+    readonly model: 'Language model for the patch fallback as "<provider>:<model-id>", e.g. "anthropic:claude-sonnet-5-5" (default: AUTOREMEDIATOR_MODEL)';
+    readonly patchConfidenceThresholdLow: "Patch acceptance confidence threshold for low-risk patches (0..1)";
+    readonly patchConfidenceThresholdMedium: "Patch acceptance confidence threshold for medium-risk patches (0..1)";
+    readonly patchConfidenceThresholdHigh: "Patch acceptance confidence threshold for high-risk patches (0..1)";
+    readonly patchesDir: "Directory to write .patch files (default: ./patches)";
+    readonly policy: "Optional path to .github/autoremediator.yml policy file";
+    readonly requestId: "Request correlation ID";
+    readonly sessionId: "Session correlation ID";
+    readonly parentRunId: "Parent run correlation ID";
+    readonly idempotencyKey: "Idempotency key for replay-safe execution";
+    readonly resume: "Return cached result for matching idempotency key when available";
+    readonly actor: "Actor identity for evidence provenance";
+    readonly source: "Source system for provenance";
+    readonly format: "Scanner format (default: auto)";
+    readonly audit: "Run package-manager-native audit command instead of reading a scan file";
+    readonly evidence: "Write evidence JSON to .autoremediator/evidence/ (default: true)";
+    readonly directDependenciesOnly: "Restrict remediation to direct dependencies only";
+    readonly preferVersionBump: "Reject override and patch remediation when version-bump-only policy is required";
+    readonly installMode: "Install behavior profile: deterministic|prefer-offline|standard";
+    readonly installPreferOffline: "Override prefer-offline flag behavior for install commands";
+    readonly enforceFrozenLockfile: "Override frozen lockfile behavior for install commands";
+    readonly workspace: "Workspace/package selector for scoped remediation in monorepos";
+    readonly createChangeRequest: "Enable creation of native pull request / merge request after remediation";
+    readonly changeRequestProvider: "Change request provider (github|gitlab|bitbucket|azure-devops)";
+    readonly changeRequestGrouping: "Grouping strategy for change requests (all|per-cve|per-package)";
+    readonly changeRequestRepository: "Repository slug override for change request creation";
+    readonly changeRequestBaseBranch: "Base branch used for change request targeting";
+    readonly changeRequestBranchPrefix: "Branch prefix for generated change request branches";
+    readonly changeRequestTitlePrefix: "Title prefix for generated change requests";
+    readonly includeTransitive: "Include transitive dependencies in the outdated check. Default: false.";
+    readonly updateOutdated: "Run in update-outdated mode: bump all outdated npm packages without requiring a CVE.";
+    readonly kevMandatory: "If true, CVEs with active CISA KEV status bypass severity filtering and are treated as mandatory";
+    readonly epssThreshold: "EPSS probability threshold (0..1) above which a CVE is treated as mandatory regardless of severity";
+    readonly suppressionsFile: "Path to a YAML file containing additional VEX suppression entries to merge with policy-inline suppressions";
+    readonly slaCheck: "Compare CVE publication dates against configured SLA windows and include breach records in the report output";
+    readonly skipUnreachable: "Skip remediation for CVEs where the vulnerable package cannot be reached from any project entry point (requires static import analysis)";
+    readonly dispositionPolicy: "Autonomous disposition policy controlling when fixes are auto-applied, held, or escalated";
+    readonly dispositionPolicyMinConfidenceForAutoApply: "Minimum patch confidence (0–1) required for auto-apply disposition";
+    readonly dispositionPolicyHoldForTransitive: "Hold transitive dependency fixes for human review instead of auto-applying";
+    readonly dispositionPolicyEscalateOnSlaBreachSeverities: "CVE severities that trigger escalate disposition on SLA breach";
+    readonly dispositionPolicyEscalateOnKev: "Escalate disposition for CVEs with active CISA KEV status";
+    readonly containmentMode: "Roll back applied results whose disposition is hold-for-approval (low confidence, held transitive) so they await approval; urgent escalate fixes (KEV, SLA) are kept";
+    readonly campaignMode: "Enable portfolio campaign mode to risk-rank targets before execution";
+    readonly escalationGraph: "Optional mapping from unresolved reasons to intended escalation actions";
+    readonly offlineIntelligence: "Skip all network calls to intelligence sources. Only local inventory and npm-registry version resolution proceed.";
+    readonly intelligenceSnapshotPath: "Path to a local JSON snapshot of pre-fetched CVE intelligence (keyed by CVE ID) used when offline mode is active.";
+    readonly proofOfFix: "If true, enforce dual-stage exploit reproduction proof-of-fix verification (assert failure pre-patch, assert pass post-patch)";
+    readonly requireProofOfFix: "If true, reject patches and roll back if proof-of-fix verification fails";
+    readonly breakingChangeRefactor: "Experimental: when a major upgrade breaks type checking, rewrite consumer call sites using built-in codemods (currently rimraf and uuid only); reverted if checks still fail";
+    readonly typecheck: "Run the project's type checker after each change and roll back if it fails";
+    readonly supplyChainPolicy: "Supply-chain trust gate for candidate versions: minimum release age, install scripts, provenance";
+    readonly supplyChainMinPublishAgeHours: "Skip versions published more recently than this many hours";
+    readonly supplyChainBlockInstallScripts: "Skip versions that define preinstall, install or postinstall scripts";
+    readonly supplyChainRequireProvenance: "Require a provenance attestation on the chosen version";
+    readonly exploitSignalOverride: "Treat CVEs with an exploit signal as mandatory regardless of severity: CISA KEV status and/or an EPSS probability above a threshold";
+    readonly exploitSignalKevMandatory: "Treat CVEs with active CISA KEV status as mandatory";
+    readonly exploitSignalEpssMandatory: "Treat CVEs above the EPSS threshold as mandatory";
+    readonly exploitSignalEpssThreshold: "EPSS probability (0..1) above which a CVE is mandatory";
+    readonly reproductionTest: "Reproduction test script content or file path used by proof-of-fix";
+    readonly traceFile: "Path to a trace written by 'autoremediator trace run' (or the autoremediator/trace hook). Adds runtime evidence: whether the traced command loaded the package and, if calls were counted, called the symbol. A package that did not load is not proof that it is unreachable.";
+    readonly patchConfidenceThresholds: "Per-risk minimum confidence required to accept a generated patch";
+    readonly constraints: "Orchestration constraints that limit how remediation may change the project";
+    readonly changeRequest: "Native pull request / merge request creation controls";
+    readonly changeRequestEnabled: "Enable creation of native pull request / merge request after remediation";
+    readonly autonomy: "Earned autonomy: the policy sets a ceiling level (L0 observe, L1 suggest, L2 open pull request, L3 auto-merge-eligible, L4 autonomous with escalation) and the repository's own verified track record sets the level actually in force";
+    readonly autonomyCeiling: "Highest autonomy level this repository may ever act at (L0 to L4)";
+    readonly autonomyMinVerifiedRuns: "Verified runs in the recent window needed for L3 (twice as many for L4). Default 5";
+    readonly autonomyWindow: "How many of the most recent runs count as recent (a run with several changes is one run). Default 20";
+    readonly autonomyMinSuccessRate: "Share of recent runs that must be verified successes (0..1) for L3 and L4. Default 0.9";
+    readonly autonomyCooldownDays: "Days a rollback or verifier failure keeps the level capped (L1 after one, L0 after two). Default 7";
+    readonly autonomyRequireTestCoverage: "Require that recent verified runs also passed the project's tests (L3) and type check (L4). Default true";
+    readonly autonomyOptions: "Path to the project's policy file, whose autonomy key is read";
+};
+/**
+ * A string that names a filesystem path. The `x-path` keyword lands in the generated JSON Schema, so
+ * clients can see which arguments are paths and the path guard knows which fields to confine.
+ */
+export declare const pathField: (description: string) => z.ZodString;
+export declare const supplyChainPolicySchema: z.ZodObject<{
+    minPublishAgeHours: z.ZodOptional<z.ZodNumber>;
+    blockInstallScripts: z.ZodOptional<z.ZodBoolean>;
+    requireProvenance: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export declare const constraintsSchema: z.ZodObject<{
+    directDependenciesOnly: z.ZodOptional<z.ZodBoolean>;
+    preferVersionBump: z.ZodOptional<z.ZodBoolean>;
+    installMode: z.ZodOptional<z.ZodEnum<{
+        deterministic: "deterministic";
+        "prefer-offline": "prefer-offline";
+        standard: "standard";
+    }>>;
+    installPreferOffline: z.ZodOptional<z.ZodBoolean>;
+    enforceFrozenLockfile: z.ZodOptional<z.ZodBoolean>;
+    workspace: z.ZodOptional<z.ZodString>;
+    typecheck: z.ZodOptional<z.ZodBoolean>;
+    requireProofOfFix: z.ZodOptional<z.ZodBoolean>;
+    enableBreakingChangeRefactor: z.ZodOptional<z.ZodBoolean>;
+    supplyChainPolicy: z.ZodOptional<z.ZodObject<{
+        minPublishAgeHours: z.ZodOptional<z.ZodNumber>;
+        blockInstallScripts: z.ZodOptional<z.ZodBoolean>;
+        requireProvenance: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const AUTONOMY_LEVEL_VALUES: readonly ["L0", "L1", "L2", "L3", "L4"];
+export type AutonomyLevel = (typeof AUTONOMY_LEVEL_VALUES)[number];
+/**
+ * The `autonomy` key of the policy file. Only the policy file can set it: the ceiling is a trust
+ * decision, so no wire option (MCP, HTTP, CLI flag) can raise it.
+ */
+export declare const autonomyPolicySchema: z.ZodObject<{
+    ceiling: z.ZodEnum<{
+        L0: "L0";
+        L1: "L1";
+        L2: "L2";
+        L3: "L3";
+        L4: "L4";
+    }>;
+    minVerifiedRuns: z.ZodOptional<z.ZodNumber>;
+    window: z.ZodOptional<z.ZodNumber>;
+    minSuccessRate: z.ZodOptional<z.ZodNumber>;
+    cooldownDays: z.ZodOptional<z.ZodNumber>;
+    requireTestCoverage: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export type AutonomyPolicy = z.infer<typeof autonomyPolicySchema>;
+export declare const patchConfidenceThresholdsSchema: z.ZodObject<{
+    low: z.ZodOptional<z.ZodNumber>;
+    medium: z.ZodOptional<z.ZodNumber>;
+    high: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+export declare const exploitSignalOverrideSchema: z.ZodObject<{
+    kev: z.ZodOptional<z.ZodObject<{
+        mandatory: z.ZodBoolean;
+    }, z.core.$strict>>;
+    epss: z.ZodOptional<z.ZodObject<{
+        mandatory: z.ZodBoolean;
+        threshold: z.ZodNumber;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const dispositionPolicySchema: z.ZodObject<{
+    minConfidenceForAutoApply: z.ZodOptional<z.ZodNumber>;
+    holdForTransitive: z.ZodOptional<z.ZodBoolean>;
+    escalateOnKev: z.ZodOptional<z.ZodBoolean>;
+    escalateOnSlaBreachSeverities: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        CRITICAL: "CRITICAL";
+        HIGH: "HIGH";
+        LOW: "LOW";
+        MEDIUM: "MEDIUM";
+        UNKNOWN: "UNKNOWN";
+    }>>>;
+}, z.core.$strict>;
+/** Maps each unresolved reason to an intended follow-up action; unknown reasons are rejected. */
+export declare const escalationGraphSchema: z.ZodObject<{
+    "breaking-change-unresolved": z.ZodOptional<z.ZodEnum<{
+        "create-draft-pr": "create-draft-pr";
+        "hold-branch": "hold-branch";
+        none: "none";
+        "notify-channel": "notify-channel";
+        "open-issue": "open-issue";
+    }>>;
+    "constraint-blocked": z.ZodOptional<z.ZodEnum<{
+        "create-draft-pr": "create-draft-pr";
+        "hold-branch": "hold-branch";
+        none: "none";
+        "notify-channel": "notify-channel";
+        "open-issue": "open-issue";
+    }>>;
+    "install-failed": z.ZodOptional<z.ZodEnum<{
+        "create-draft-pr": "create-draft-pr";
+        "hold-branch": "hold-branch";
+        none: "none";
+        "notify-channel": "notify-channel";
+        "open-issue": "open-issue";
+    }>>;
+    "major-bump-required": z.ZodOptional<z.ZodEnum<{
+        "create-draft-pr": "create-draft-pr";
+        "hold-branch": "hold-branch";
+        none: "none";
+        "notify-channel": "notify-channel";
+        "open-issue": "open-issue";
+    }>>;
+    "no-safe-version": z.ZodOptional<z.ZodEnum<{
+        "create-draft-pr": "create-draft-pr";
+        "hold-branch": "hold-branch";
+        none: "none";
+        "notify-channel": "notify-channel";
+        "open-issue": "open-issue";
+    }>>;
+    "override-apply-failed": z.ZodOptional<z.ZodEnum<{
+        "create-draft-pr": "create-draft-pr";
+        "hold-branch": "hold-branch";
+        none: "none";
+        "notify-channel": "notify-channel";
+        "open-issue": "open-issue";
+    }>>;
+    "package-json-not-found": z.ZodOptional<z.ZodEnum<{
+        "create-draft-pr": "create-draft-pr";
+        "hold-branch": "hold-branch";
+        none: "none";
+        "notify-channel": "notify-channel";
+        "open-issue": "open-issue";
+    }>>;
+    "patch-apply-failed": z.ZodOptional<z.ZodEnum<{
+        "create-draft-pr": "create-draft-pr";
+        "hold-branch": "hold-branch";
+        none: "none";
+        "notify-channel": "notify-channel";
+        "open-issue": "open-issue";
+    }>>;
+    "patch-confidence-too-low": z.ZodOptional<z.ZodEnum<{
+        "create-draft-pr": "create-draft-pr";
+        "hold-branch": "hold-branch";
+        none: "none";
+        "notify-channel": "notify-channel";
+        "open-issue": "open-issue";
+    }>>;
+    "patch-generation-failed": z.ZodOptional<z.ZodEnum<{
+        "create-draft-pr": "create-draft-pr";
+        "hold-branch": "hold-branch";
+        none: "none";
+        "notify-channel": "notify-channel";
+        "open-issue": "open-issue";
+    }>>;
+    "patch-validation-failed": z.ZodOptional<z.ZodEnum<{
+        "create-draft-pr": "create-draft-pr";
+        "hold-branch": "hold-branch";
+        none: "none";
+        "notify-channel": "notify-channel";
+        "open-issue": "open-issue";
+    }>>;
+    "policy-blocked": z.ZodOptional<z.ZodEnum<{
+        "create-draft-pr": "create-draft-pr";
+        "hold-branch": "hold-branch";
+        none: "none";
+        "notify-channel": "notify-channel";
+        "open-issue": "open-issue";
+    }>>;
+    "proof-of-fix-failed": z.ZodOptional<z.ZodEnum<{
+        "create-draft-pr": "create-draft-pr";
+        "hold-branch": "hold-branch";
+        none: "none";
+        "notify-channel": "notify-channel";
+        "open-issue": "open-issue";
+    }>>;
+    "requires-llm-fallback": z.ZodOptional<z.ZodEnum<{
+        "create-draft-pr": "create-draft-pr";
+        "hold-branch": "hold-branch";
+        none: "none";
+        "notify-channel": "notify-channel";
+        "open-issue": "open-issue";
+    }>>;
+    "source-fetch-failed": z.ZodOptional<z.ZodEnum<{
+        "create-draft-pr": "create-draft-pr";
+        "hold-branch": "hold-branch";
+        none: "none";
+        "notify-channel": "notify-channel";
+        "open-issue": "open-issue";
+    }>>;
+    "transitive-dependency": z.ZodOptional<z.ZodEnum<{
+        "create-draft-pr": "create-draft-pr";
+        "hold-branch": "hold-branch";
+        none: "none";
+        "notify-channel": "notify-channel";
+        "open-issue": "open-issue";
+    }>>;
+    "transitive-override-unsupported-deno-native": z.ZodOptional<z.ZodEnum<{
+        "create-draft-pr": "create-draft-pr";
+        "hold-branch": "hold-branch";
+        none: "none";
+        "notify-channel": "notify-channel";
+        "open-issue": "open-issue";
+    }>>;
+    "validation-failed": z.ZodOptional<z.ZodEnum<{
+        "create-draft-pr": "create-draft-pr";
+        "hold-branch": "hold-branch";
+        none: "none";
+        "notify-channel": "notify-channel";
+        "open-issue": "open-issue";
+    }>>;
+}, z.core.$strict>;
+export declare const changeRequestOptionsSchema: z.ZodObject<{
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    provider: z.ZodOptional<z.ZodEnum<{
+        github: "github";
+        gitlab: "gitlab";
+    }>>;
+    grouping: z.ZodOptional<z.ZodEnum<{
+        all: "all";
+        "by-severity": "by-severity";
+        "per-cve": "per-cve";
+        "per-package": "per-package";
+    }>>;
+    repository: z.ZodOptional<z.ZodString>;
+    baseBranch: z.ZodOptional<z.ZodString>;
+    branchPrefix: z.ZodOptional<z.ZodString>;
+    titlePrefix: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+/** Options shared by every operation that remediates; the wire form of `RemediateOptions`. */
+export declare const remediateOptionsSchema: z.ZodObject<{
+    cwd: z.ZodOptional<z.ZodString>;
+    packageManager: z.ZodOptional<z.ZodEnum<{
+        bun: "bun";
+        deno: "deno";
+        npm: "npm";
+        pnpm: "pnpm";
+        yarn: "yarn";
+    }>>;
+    dryRun: z.ZodOptional<z.ZodBoolean>;
+    preview: z.ZodOptional<z.ZodBoolean>;
+    simulationMode: z.ZodOptional<z.ZodBoolean>;
+    runTests: z.ZodOptional<z.ZodBoolean>;
+    typecheck: z.ZodOptional<z.ZodBoolean>;
+    supplyChainPolicy: z.ZodOptional<z.ZodObject<{
+        minPublishAgeHours: z.ZodOptional<z.ZodNumber>;
+        blockInstallScripts: z.ZodOptional<z.ZodBoolean>;
+        requireProvenance: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>;
+    model: z.ZodOptional<z.ZodString>;
+    patchConfidenceThresholds: z.ZodOptional<z.ZodObject<{
+        low: z.ZodOptional<z.ZodNumber>;
+        medium: z.ZodOptional<z.ZodNumber>;
+        high: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
+    patchesDir: z.ZodOptional<z.ZodString>;
+    policy: z.ZodOptional<z.ZodString>;
+    evidence: z.ZodOptional<z.ZodBoolean>;
+    requestId: z.ZodOptional<z.ZodString>;
+    sessionId: z.ZodOptional<z.ZodString>;
+    parentRunId: z.ZodOptional<z.ZodString>;
+    idempotencyKey: z.ZodOptional<z.ZodString>;
+    resume: z.ZodOptional<z.ZodBoolean>;
+    actor: z.ZodOptional<z.ZodString>;
+    source: z.ZodOptional<z.ZodEnum<{
+        cli: "cli";
+        mcp: "mcp";
+        openapi: "openapi";
+        sdk: "sdk";
+        unknown: "unknown";
+    }>>;
+    constraints: z.ZodOptional<z.ZodObject<{
+        directDependenciesOnly: z.ZodOptional<z.ZodBoolean>;
+        preferVersionBump: z.ZodOptional<z.ZodBoolean>;
+        installMode: z.ZodOptional<z.ZodEnum<{
+            deterministic: "deterministic";
+            "prefer-offline": "prefer-offline";
+            standard: "standard";
+        }>>;
+        installPreferOffline: z.ZodOptional<z.ZodBoolean>;
+        enforceFrozenLockfile: z.ZodOptional<z.ZodBoolean>;
+        workspace: z.ZodOptional<z.ZodString>;
+        typecheck: z.ZodOptional<z.ZodBoolean>;
+        requireProofOfFix: z.ZodOptional<z.ZodBoolean>;
+        enableBreakingChangeRefactor: z.ZodOptional<z.ZodBoolean>;
+        supplyChainPolicy: z.ZodOptional<z.ZodObject<{
+            minPublishAgeHours: z.ZodOptional<z.ZodNumber>;
+            blockInstallScripts: z.ZodOptional<z.ZodBoolean>;
+            requireProvenance: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    changeRequest: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        provider: z.ZodOptional<z.ZodEnum<{
+            github: "github";
+            gitlab: "gitlab";
+        }>>;
+        grouping: z.ZodOptional<z.ZodEnum<{
+            all: "all";
+            "by-severity": "by-severity";
+            "per-cve": "per-cve";
+            "per-package": "per-package";
+        }>>;
+        repository: z.ZodOptional<z.ZodString>;
+        baseBranch: z.ZodOptional<z.ZodString>;
+        branchPrefix: z.ZodOptional<z.ZodString>;
+        titlePrefix: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    exploitSignalOverride: z.ZodOptional<z.ZodObject<{
+        kev: z.ZodOptional<z.ZodObject<{
+            mandatory: z.ZodBoolean;
+        }, z.core.$strict>>;
+        epss: z.ZodOptional<z.ZodObject<{
+            mandatory: z.ZodBoolean;
+            threshold: z.ZodNumber;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    suppressionsFile: z.ZodOptional<z.ZodString>;
+    slaCheck: z.ZodOptional<z.ZodBoolean>;
+    skipUnreachable: z.ZodOptional<z.ZodBoolean>;
+    dispositionPolicy: z.ZodOptional<z.ZodObject<{
+        minConfidenceForAutoApply: z.ZodOptional<z.ZodNumber>;
+        holdForTransitive: z.ZodOptional<z.ZodBoolean>;
+        escalateOnKev: z.ZodOptional<z.ZodBoolean>;
+        escalateOnSlaBreachSeverities: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+            CRITICAL: "CRITICAL";
+            HIGH: "HIGH";
+            LOW: "LOW";
+            MEDIUM: "MEDIUM";
+            UNKNOWN: "UNKNOWN";
+        }>>>;
+    }, z.core.$strict>>;
+    containmentMode: z.ZodOptional<z.ZodBoolean>;
+    campaignMode: z.ZodOptional<z.ZodBoolean>;
+    escalationGraph: z.ZodOptional<z.ZodObject<{
+        "breaking-change-unresolved": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "constraint-blocked": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "install-failed": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "major-bump-required": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "no-safe-version": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "override-apply-failed": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "package-json-not-found": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "patch-apply-failed": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "patch-confidence-too-low": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "patch-generation-failed": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "patch-validation-failed": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "policy-blocked": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "proof-of-fix-failed": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "requires-llm-fallback": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "source-fetch-failed": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "transitive-dependency": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "transitive-override-unsupported-deno-native": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "validation-failed": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+    }, z.core.$strict>>;
+    offlineIntelligence: z.ZodOptional<z.ZodBoolean>;
+    intelligenceSnapshotPath: z.ZodOptional<z.ZodString>;
+    proofOfFix: z.ZodOptional<z.ZodBoolean>;
+    requireProofOfFix: z.ZodOptional<z.ZodBoolean>;
+    reproductionTest: z.ZodOptional<z.ZodString>;
+    breakingChangeRefactor: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export declare const scanOptionsSchema: z.ZodObject<{
+    cwd: z.ZodOptional<z.ZodString>;
+    packageManager: z.ZodOptional<z.ZodEnum<{
+        bun: "bun";
+        deno: "deno";
+        npm: "npm";
+        pnpm: "pnpm";
+        yarn: "yarn";
+    }>>;
+    dryRun: z.ZodOptional<z.ZodBoolean>;
+    preview: z.ZodOptional<z.ZodBoolean>;
+    simulationMode: z.ZodOptional<z.ZodBoolean>;
+    runTests: z.ZodOptional<z.ZodBoolean>;
+    typecheck: z.ZodOptional<z.ZodBoolean>;
+    supplyChainPolicy: z.ZodOptional<z.ZodObject<{
+        minPublishAgeHours: z.ZodOptional<z.ZodNumber>;
+        blockInstallScripts: z.ZodOptional<z.ZodBoolean>;
+        requireProvenance: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>;
+    model: z.ZodOptional<z.ZodString>;
+    patchConfidenceThresholds: z.ZodOptional<z.ZodObject<{
+        low: z.ZodOptional<z.ZodNumber>;
+        medium: z.ZodOptional<z.ZodNumber>;
+        high: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
+    patchesDir: z.ZodOptional<z.ZodString>;
+    policy: z.ZodOptional<z.ZodString>;
+    evidence: z.ZodOptional<z.ZodBoolean>;
+    requestId: z.ZodOptional<z.ZodString>;
+    sessionId: z.ZodOptional<z.ZodString>;
+    parentRunId: z.ZodOptional<z.ZodString>;
+    idempotencyKey: z.ZodOptional<z.ZodString>;
+    resume: z.ZodOptional<z.ZodBoolean>;
+    actor: z.ZodOptional<z.ZodString>;
+    source: z.ZodOptional<z.ZodEnum<{
+        cli: "cli";
+        mcp: "mcp";
+        openapi: "openapi";
+        sdk: "sdk";
+        unknown: "unknown";
+    }>>;
+    constraints: z.ZodOptional<z.ZodObject<{
+        directDependenciesOnly: z.ZodOptional<z.ZodBoolean>;
+        preferVersionBump: z.ZodOptional<z.ZodBoolean>;
+        installMode: z.ZodOptional<z.ZodEnum<{
+            deterministic: "deterministic";
+            "prefer-offline": "prefer-offline";
+            standard: "standard";
+        }>>;
+        installPreferOffline: z.ZodOptional<z.ZodBoolean>;
+        enforceFrozenLockfile: z.ZodOptional<z.ZodBoolean>;
+        workspace: z.ZodOptional<z.ZodString>;
+        typecheck: z.ZodOptional<z.ZodBoolean>;
+        requireProofOfFix: z.ZodOptional<z.ZodBoolean>;
+        enableBreakingChangeRefactor: z.ZodOptional<z.ZodBoolean>;
+        supplyChainPolicy: z.ZodOptional<z.ZodObject<{
+            minPublishAgeHours: z.ZodOptional<z.ZodNumber>;
+            blockInstallScripts: z.ZodOptional<z.ZodBoolean>;
+            requireProvenance: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    changeRequest: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        provider: z.ZodOptional<z.ZodEnum<{
+            github: "github";
+            gitlab: "gitlab";
+        }>>;
+        grouping: z.ZodOptional<z.ZodEnum<{
+            all: "all";
+            "by-severity": "by-severity";
+            "per-cve": "per-cve";
+            "per-package": "per-package";
+        }>>;
+        repository: z.ZodOptional<z.ZodString>;
+        baseBranch: z.ZodOptional<z.ZodString>;
+        branchPrefix: z.ZodOptional<z.ZodString>;
+        titlePrefix: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    exploitSignalOverride: z.ZodOptional<z.ZodObject<{
+        kev: z.ZodOptional<z.ZodObject<{
+            mandatory: z.ZodBoolean;
+        }, z.core.$strict>>;
+        epss: z.ZodOptional<z.ZodObject<{
+            mandatory: z.ZodBoolean;
+            threshold: z.ZodNumber;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    suppressionsFile: z.ZodOptional<z.ZodString>;
+    slaCheck: z.ZodOptional<z.ZodBoolean>;
+    skipUnreachable: z.ZodOptional<z.ZodBoolean>;
+    dispositionPolicy: z.ZodOptional<z.ZodObject<{
+        minConfidenceForAutoApply: z.ZodOptional<z.ZodNumber>;
+        holdForTransitive: z.ZodOptional<z.ZodBoolean>;
+        escalateOnKev: z.ZodOptional<z.ZodBoolean>;
+        escalateOnSlaBreachSeverities: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+            CRITICAL: "CRITICAL";
+            HIGH: "HIGH";
+            LOW: "LOW";
+            MEDIUM: "MEDIUM";
+            UNKNOWN: "UNKNOWN";
+        }>>>;
+    }, z.core.$strict>>;
+    containmentMode: z.ZodOptional<z.ZodBoolean>;
+    campaignMode: z.ZodOptional<z.ZodBoolean>;
+    escalationGraph: z.ZodOptional<z.ZodObject<{
+        "breaking-change-unresolved": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "constraint-blocked": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "install-failed": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "major-bump-required": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "no-safe-version": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "override-apply-failed": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "package-json-not-found": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "patch-apply-failed": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "patch-confidence-too-low": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "patch-generation-failed": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "patch-validation-failed": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "policy-blocked": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "proof-of-fix-failed": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "requires-llm-fallback": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "source-fetch-failed": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "transitive-dependency": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "transitive-override-unsupported-deno-native": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "validation-failed": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+    }, z.core.$strict>>;
+    offlineIntelligence: z.ZodOptional<z.ZodBoolean>;
+    intelligenceSnapshotPath: z.ZodOptional<z.ZodString>;
+    proofOfFix: z.ZodOptional<z.ZodBoolean>;
+    requireProofOfFix: z.ZodOptional<z.ZodBoolean>;
+    reproductionTest: z.ZodOptional<z.ZodString>;
+    breakingChangeRefactor: z.ZodOptional<z.ZodBoolean>;
+    format: z.ZodOptional<z.ZodEnum<{
+        auto: "auto";
+        "npm-audit": "npm-audit";
+        sarif: "sarif";
+        "yarn-audit": "yarn-audit";
+    }>>;
+    audit: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export declare const updateOutdatedOptionsSchema: z.ZodObject<{
+    cwd: z.ZodOptional<z.ZodString>;
+    packageManager: z.ZodOptional<z.ZodEnum<{
+        bun: "bun";
+        deno: "deno";
+        npm: "npm";
+        pnpm: "pnpm";
+        yarn: "yarn";
+    }>>;
+    dryRun: z.ZodOptional<z.ZodBoolean>;
+    preview: z.ZodOptional<z.ZodBoolean>;
+    runTests: z.ZodOptional<z.ZodBoolean>;
+    typecheck: z.ZodOptional<z.ZodBoolean>;
+    supplyChainPolicy: z.ZodOptional<z.ZodObject<{
+        minPublishAgeHours: z.ZodOptional<z.ZodNumber>;
+        blockInstallScripts: z.ZodOptional<z.ZodBoolean>;
+        requireProvenance: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>;
+    model: z.ZodOptional<z.ZodString>;
+    patchConfidenceThresholds: z.ZodOptional<z.ZodObject<{
+        low: z.ZodOptional<z.ZodNumber>;
+        medium: z.ZodOptional<z.ZodNumber>;
+        high: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
+    patchesDir: z.ZodOptional<z.ZodString>;
+    policy: z.ZodOptional<z.ZodString>;
+    evidence: z.ZodOptional<z.ZodBoolean>;
+    requestId: z.ZodOptional<z.ZodString>;
+    sessionId: z.ZodOptional<z.ZodString>;
+    parentRunId: z.ZodOptional<z.ZodString>;
+    idempotencyKey: z.ZodOptional<z.ZodString>;
+    resume: z.ZodOptional<z.ZodBoolean>;
+    actor: z.ZodOptional<z.ZodString>;
+    source: z.ZodOptional<z.ZodEnum<{
+        cli: "cli";
+        mcp: "mcp";
+        openapi: "openapi";
+        sdk: "sdk";
+        unknown: "unknown";
+    }>>;
+    constraints: z.ZodOptional<z.ZodObject<{
+        directDependenciesOnly: z.ZodOptional<z.ZodBoolean>;
+        preferVersionBump: z.ZodOptional<z.ZodBoolean>;
+        installMode: z.ZodOptional<z.ZodEnum<{
+            deterministic: "deterministic";
+            "prefer-offline": "prefer-offline";
+            standard: "standard";
+        }>>;
+        installPreferOffline: z.ZodOptional<z.ZodBoolean>;
+        enforceFrozenLockfile: z.ZodOptional<z.ZodBoolean>;
+        workspace: z.ZodOptional<z.ZodString>;
+        typecheck: z.ZodOptional<z.ZodBoolean>;
+        requireProofOfFix: z.ZodOptional<z.ZodBoolean>;
+        enableBreakingChangeRefactor: z.ZodOptional<z.ZodBoolean>;
+        supplyChainPolicy: z.ZodOptional<z.ZodObject<{
+            minPublishAgeHours: z.ZodOptional<z.ZodNumber>;
+            blockInstallScripts: z.ZodOptional<z.ZodBoolean>;
+            requireProvenance: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    changeRequest: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        provider: z.ZodOptional<z.ZodEnum<{
+            github: "github";
+            gitlab: "gitlab";
+        }>>;
+        grouping: z.ZodOptional<z.ZodEnum<{
+            all: "all";
+            "by-severity": "by-severity";
+            "per-cve": "per-cve";
+            "per-package": "per-package";
+        }>>;
+        repository: z.ZodOptional<z.ZodString>;
+        baseBranch: z.ZodOptional<z.ZodString>;
+        branchPrefix: z.ZodOptional<z.ZodString>;
+        titlePrefix: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    exploitSignalOverride: z.ZodOptional<z.ZodObject<{
+        kev: z.ZodOptional<z.ZodObject<{
+            mandatory: z.ZodBoolean;
+        }, z.core.$strict>>;
+        epss: z.ZodOptional<z.ZodObject<{
+            mandatory: z.ZodBoolean;
+            threshold: z.ZodNumber;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    suppressionsFile: z.ZodOptional<z.ZodString>;
+    slaCheck: z.ZodOptional<z.ZodBoolean>;
+    skipUnreachable: z.ZodOptional<z.ZodBoolean>;
+    dispositionPolicy: z.ZodOptional<z.ZodObject<{
+        minConfidenceForAutoApply: z.ZodOptional<z.ZodNumber>;
+        holdForTransitive: z.ZodOptional<z.ZodBoolean>;
+        escalateOnKev: z.ZodOptional<z.ZodBoolean>;
+        escalateOnSlaBreachSeverities: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+            CRITICAL: "CRITICAL";
+            HIGH: "HIGH";
+            LOW: "LOW";
+            MEDIUM: "MEDIUM";
+            UNKNOWN: "UNKNOWN";
+        }>>>;
+    }, z.core.$strict>>;
+    containmentMode: z.ZodOptional<z.ZodBoolean>;
+    campaignMode: z.ZodOptional<z.ZodBoolean>;
+    escalationGraph: z.ZodOptional<z.ZodObject<{
+        "breaking-change-unresolved": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "constraint-blocked": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "install-failed": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "major-bump-required": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "no-safe-version": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "override-apply-failed": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "package-json-not-found": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "patch-apply-failed": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "patch-confidence-too-low": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "patch-generation-failed": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "patch-validation-failed": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "policy-blocked": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "proof-of-fix-failed": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "requires-llm-fallback": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "source-fetch-failed": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "transitive-dependency": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "transitive-override-unsupported-deno-native": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "validation-failed": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+    }, z.core.$strict>>;
+    offlineIntelligence: z.ZodOptional<z.ZodBoolean>;
+    intelligenceSnapshotPath: z.ZodOptional<z.ZodString>;
+    proofOfFix: z.ZodOptional<z.ZodBoolean>;
+    requireProofOfFix: z.ZodOptional<z.ZodBoolean>;
+    reproductionTest: z.ZodOptional<z.ZodString>;
+    breakingChangeRefactor: z.ZodOptional<z.ZodBoolean>;
+    includeTransitive: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export declare const portfolioTargetSchema: z.ZodObject<{
+    cwd: z.ZodString;
+    label: z.ZodOptional<z.ZodString>;
+    cveId: z.ZodOptional<z.ZodString>;
+    inputPath: z.ZodOptional<z.ZodString>;
+    format: z.ZodOptional<z.ZodEnum<{
+        auto: "auto";
+        "npm-audit": "npm-audit";
+        sarif: "sarif";
+        "yarn-audit": "yarn-audit";
+    }>>;
+    audit: z.ZodOptional<z.ZodBoolean>;
+    riskHint: z.ZodOptional<z.ZodObject<{
+        severity: z.ZodOptional<z.ZodEnum<{
+            CRITICAL: "CRITICAL";
+            HIGH: "HIGH";
+            LOW: "LOW";
+            MEDIUM: "MEDIUM";
+            UNKNOWN: "UNKNOWN";
+        }>>;
+        exploitSignal: z.ZodOptional<z.ZodBoolean>;
+        slaBreached: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const patchArtifactQuerySchema: z.ZodObject<{
+    cwd: z.ZodOptional<z.ZodString>;
+    patchesDir: z.ZodOptional<z.ZodString>;
+    packageManager: z.ZodOptional<z.ZodEnum<{
+        bun: "bun";
+        deno: "deno";
+        npm: "npm";
+        pnpm: "pnpm";
+        yarn: "yarn";
+    }>>;
+}, z.core.$strict>;
+export declare const reconcileOptionsSchema: z.ZodObject<{
+    cwd: z.ZodOptional<z.ZodString>;
+    patchesDir: z.ZodOptional<z.ZodString>;
+    packageManager: z.ZodOptional<z.ZodEnum<{
+        bun: "bun";
+        deno: "deno";
+        npm: "npm";
+        pnpm: "pnpm";
+        yarn: "yarn";
+    }>>;
+    autoApply: z.ZodOptional<z.ZodBoolean>;
+    runTests: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export declare const patchFilePathSchema: z.ZodString;
+export declare const deltaScanOptionsSchema: z.ZodObject<{
+    cwd: z.ZodOptional<z.ZodString>;
+    baseRef: z.ZodOptional<z.ZodString>;
+    includeUnstaged: z.ZodOptional<z.ZodBoolean>;
+    packageManager: z.ZodOptional<z.ZodEnum<{
+        bun: "bun";
+        deno: "deno";
+        npm: "npm";
+        pnpm: "pnpm";
+        yarn: "yarn";
+    }>>;
+}, z.core.$strict>;
+export declare const evaluatePackageOptionsSchema: z.ZodObject<{
+    version: z.ZodOptional<z.ZodString>;
+    packageManager: z.ZodOptional<z.ZodEnum<{
+        bun: "bun";
+        deno: "deno";
+        npm: "npm";
+        pnpm: "pnpm";
+        yarn: "yarn";
+    }>>;
+    cwd: z.ZodOptional<z.ZodString>;
+    enrichIntelligence: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export declare const getAutonomyOptionsSchema: z.ZodObject<{
+    cwd: z.ZodOptional<z.ZodString>;
+    policy: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+/** A name that is safe in a registry path and under `node_modules/`; see `isValidPackageName`. */
+export declare const registryPackageName: () => z.ZodString;
+export declare const packageNameSchema: z.ZodString;
+export declare const RUN_STATUS_VALUES: readonly ["planned", "applying", "applied", "partial", "failed", "rolled-back"];
+/** Verification checks in the order they run (cheap and static first). */
+export declare const VERIFY_CHECK_VALUES: readonly ["scope", "policy", "supply-chain", "install", "vuln-gone", "typecheck", "tests", "proof-of-fix"];
+export declare const runIdSchema: z.ZodString;
+export declare const optionalRunIdSchema: z.ZodOptional<z.ZodString>;
+export declare const planIdSchema: z.ZodOptional<z.ZodString>;
+export declare const applyPlanOptionsSchema: z.ZodObject<{
+    cwd: z.ZodOptional<z.ZodString>;
+    runId: z.ZodOptional<z.ZodString>;
+    planId: z.ZodOptional<z.ZodString>;
+    itemIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    verify: z.ZodOptional<z.ZodBoolean>;
+    repair: z.ZodOptional<z.ZodBoolean>;
+    model: z.ZodOptional<z.ZodString>;
+    maxRepairRounds: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+export declare const runQuerySchema: z.ZodObject<{
+    runId: z.ZodString;
+    cwd: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export declare const rollbackRunOptionsSchema: z.ZodObject<{
+    runId: z.ZodString;
+    cwd: z.ZodOptional<z.ZodString>;
+    force: z.ZodOptional<z.ZodBoolean>;
+    reinstall: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export declare const itemIdSchema: z.ZodString;
+export declare const attemptIdSchema: z.ZodString;
+export declare const startAttemptOptionsSchema: z.ZodObject<{
+    runId: z.ZodString;
+    itemId: z.ZodString;
+    cwd: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export declare const attemptQuerySchema: z.ZodObject<{
+    runId: z.ZodString;
+    attemptId: z.ZodString;
+    cwd: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export declare const proposePatchOptionsSchema: z.ZodObject<{
+    runId: z.ZodString;
+    attemptId: z.ZodString;
+    cwd: z.ZodOptional<z.ZodString>;
+    diff: z.ZodString;
+}, z.core.$strict>;
+export declare const verifyAttemptOptionsSchema: z.ZodObject<{
+    runId: z.ZodString;
+    attemptId: z.ZodString;
+    cwd: z.ZodOptional<z.ZodString>;
+    checks: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        install: "install";
+        policy: "policy";
+        "proof-of-fix": "proof-of-fix";
+        scope: "scope";
+        "supply-chain": "supply-chain";
+        tests: "tests";
+        typecheck: "typecheck";
+        "vuln-gone": "vuln-gone";
+    }>>>;
+}, z.core.$strict>;
+export declare const verifyRunOptionsSchema: z.ZodObject<{
+    runId: z.ZodString;
+    cwd: z.ZodOptional<z.ZodString>;
+    checks: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        install: "install";
+        policy: "policy";
+        "proof-of-fix": "proof-of-fix";
+        scope: "scope";
+        "supply-chain": "supply-chain";
+        tests: "tests";
+        typecheck: "typecheck";
+        "vuln-gone": "vuln-gone";
+    }>>>;
+    offline: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export declare const listRunsOptionsSchema: z.ZodObject<{
+    cwd: z.ZodOptional<z.ZodString>;
+    status: z.ZodOptional<z.ZodEnum<{
+        applied: "applied";
+        applying: "applying";
+        failed: "failed";
+        partial: "partial";
+        planned: "planned";
+        "rolled-back": "rolled-back";
+    }>>;
+    limit: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+type WireKeys = keyof z.input<typeof remediateOptionsSchema>;
+type SdkOnly = "patchGenerator" | "ignoreMemory";
+type NotOnTheWire = Exclude<keyof RemediateOptions, WireKeys | SdkOnly>;
+type NotInTheSdk = Exclude<WireKeys, keyof RemediateOptions>;
+export declare const wireOptionsMatchSdk: [NotOnTheWire, NotInTheSdk] extends [never, never] ? true : never;
+export {};
+//# sourceMappingURL=option-schemas.d.ts.map