autoremediator 0.21.2 → 0.22.0

package/dist/platform/policy-loosening.js

@@ -0,0 +1,371 @@
+import { computeEscalationAction } from "./escalation.js";
+import { AUTONOMY_LEVEL_VALUES, UNRESOLVED_REASON_VALUES, } from "./option-schemas.js";
+/**
+ * What the pipeline assumes when the policy is silent. They mirror the defaults in
+ * `remediation/local/disposition.ts` and `autonomy/types.ts`, which a platform module cannot import;
+ * `policy-loosening.test.ts` pins the autonomy ones to their source.
+ */
+const DISPOSITION_DEFAULTS = {
+    minConfidenceForAutoApply: 0.7,
+    holdForTransitive: false,
+    escalateOnKev: true,
+    escalateOnSlaBreachSeverities: ["CRITICAL", "HIGH"],
+};
+const AUTONOMY_DEFAULTS = {
+    minVerifiedRuns: 5,
+    window: 20,
+    minSuccessRate: 0.9,
+    cooldownDays: 7,
+    requireTestCoverage: true,
+};
+/** The patch confidence a generated patch needs by risk level when the policy sets none (see `DEFAULT_CONFIDENCE_THRESHOLDS`). */
+const CONFIDENCE_DEFAULTS = { low: 0.65, medium: 0.7, high: 0.8 };
+/** With no `autonomy` key the feature is off; a repository then acts like one capped at L2 (pull requests, no auto-merge signal). */
+const IMPLICIT_CEILING = "L2";
+/**
+ * Every key of the policy file, and whether `findLoosenings` looks at it. A key ending in `.*` stands
+ * for everything under it. `policy-loosening.test.ts` walks `policyFileSchema` and fails when a key
+ * is missing here (or listed here but gone from the schema), so a new policy key has to be
+ * classified, and a "loosening" one given a check, before it can ship.
+ */
+export const POLICY_KEY_COVERAGE = {
+    allowMajorBumps: { kind: "loosening" },
+    denyPackages: { kind: "loosening" },
+    allowPackages: { kind: "loosening" },
+    "constraints.directDependenciesOnly": { kind: "loosening" },
+    "constraints.preferVersionBump": { kind: "loosening" },
+    "constraints.installMode": {
+        kind: "not-a-loosening",
+        reason: "How dependencies are installed (offline or fresh); every mode verifies the same way.",
+    },
+    "constraints.installPreferOffline": {
+        kind: "not-a-loosening",
+        reason: "A cache preference for installs; it does not change what may be changed.",
+    },
+    "constraints.enforceFrozenLockfile": { kind: "loosening" },
+    "constraints.workspace": {
+        kind: "not-a-loosening",
+        reason: "Scopes a run to one workspace package; it picks a target, not a safety rule.",
+    },
+    "constraints.typecheck": { kind: "loosening" },
+    "constraints.requireProofOfFix": { kind: "loosening" },
+    "constraints.enableBreakingChangeRefactor": { kind: "loosening" },
+    "constraints.supplyChainPolicy.minPublishAgeHours": { kind: "loosening" },
+    "constraints.supplyChainPolicy.blockInstallScripts": { kind: "loosening" },
+    "constraints.supplyChainPolicy.requireProvenance": { kind: "loosening" },
+    "patchConfidenceThresholds.low": { kind: "loosening" },
+    "patchConfidenceThresholds.medium": { kind: "loosening" },
+    "patchConfidenceThresholds.high": { kind: "loosening" },
+    "exploitSignalOverride.kev.mandatory": { kind: "loosening" },
+    "exploitSignalOverride.epss.mandatory": { kind: "loosening" },
+    "exploitSignalOverride.epss.threshold": { kind: "loosening" },
+    suppressions: { kind: "loosening" },
+    "sla.critical": { kind: "loosening" },
+    "sla.high": { kind: "loosening" },
+    "sla.medium": { kind: "loosening" },
+    "sla.low": { kind: "loosening" },
+    skipUnreachable: { kind: "loosening" },
+    trustMaintainerVex: { kind: "loosening" },
+    "dispositionPolicy.minConfidenceForAutoApply": { kind: "loosening" },
+    "dispositionPolicy.holdForTransitive": { kind: "loosening" },
+    "dispositionPolicy.escalateOnKev": { kind: "loosening" },
+    "dispositionPolicy.escalateOnSlaBreachSeverities": { kind: "loosening" },
+    containmentMode: { kind: "loosening" },
+    "escalationGraph.*": { kind: "loosening" },
+    "recipes.packages": { kind: "loosening" },
+    "autonomy.ceiling": { kind: "loosening" },
+    "autonomy.minVerifiedRuns": { kind: "loosening" },
+    "autonomy.window": { kind: "loosening" },
+    "autonomy.minSuccessRate": { kind: "loosening" },
+    "autonomy.cooldownDays": { kind: "loosening" },
+    "autonomy.requireTestCoverage": { kind: "loosening" },
+    "freshness.maxMajorsBehind": { kind: "loosening" },
+    "freshness.maxMinorsBehind": { kind: "loosening" },
+    "freshness.maxAgeDays": { kind: "loosening" },
+    "freshness.ignore": { kind: "loosening" },
+};
+const levelIndex = (level) => AUTONOMY_LEVEL_VALUES.indexOf(level);
+/** Whether the old policy's `true` protection is gone in the new one (only an explicit `true` counts as on). */
+const protectionDropped = (before, after) => before === true && after !== true;
+function listLoosenings(key, before, after, out) {
+    if (key === "denyPackages") {
+        for (const entry of before) {
+            if (!after.includes(entry)) {
+                out.push({ key, description: `"${entry}" is no longer denied, so it can be changed.` });
+            }
+        }
+        return;
+    }
+    // allowPackages: an active allowlist restricts; widening or removing it permits more.
+    if (before.length > 0 && after.length === 0) {
+        out.push({ key, description: "The allowlist is emptied, so any package can be changed." });
+        return;
+    }
+    if (before.length > 0) {
+        for (const entry of after) {
+            if (!before.includes(entry)) {
+                out.push({
+                    key,
+                    description: `"${entry}" is added to the allowlist, so it can be changed.`,
+                });
+            }
+        }
+    }
+}
+/**
+ * Every way `after` is less safe than `before`, found by comparing the two loaded policies. It is
+ * deliberately one-sided: tightening is never reported, and a change that is neither (an install
+ * mode, a workspace) is not a safety question. An empty result means nothing was loosened.
+ *
+ * Both arguments come from `loadPolicy`, so defaults are already filled in the same way.
+ */
+export function findLoosenings(before, after) {
+    const out = [];
+    if (!before.allowMajorBumps && after.allowMajorBumps) {
+        out.push({ key: "allowMajorBumps", description: "Major version upgrades become allowed." });
+    }
+    listLoosenings("denyPackages", before.denyPackages, after.denyPackages, out);
+    listLoosenings("allowPackages", before.allowPackages, after.allowPackages, out);
+    const bc = before.constraints ?? {};
+    const ac = after.constraints ?? {};
+    const switches = [
+        ["directDependenciesOnly", "Transitive dependencies may be changed again."],
+        ["preferVersionBump", "Overrides and patches are allowed where only version bumps were."],
+        ["enforceFrozenLockfile", "The frozen lockfile is no longer enforced."],
+        ["typecheck", "The type check after each change is no longer required."],
+        ["requireProofOfFix", "Changes no longer need a passing proof of fix."],
+    ];
+    for (const [name, description] of switches) {
+        if (protectionDropped(bc[name], ac[name])) {
+            out.push({ key: `constraints.${name}`, description });
+        }
+    }
+    if (bc.enableBreakingChangeRefactor !== true && ac.enableBreakingChangeRefactor === true) {
+        out.push({
+            key: "constraints.enableBreakingChangeRefactor",
+            description: "Experimental codemods may rewrite source code.",
+        });
+    }
+    const bs = bc.supplyChainPolicy ?? {};
+    const as = ac.supplyChainPolicy ?? {};
+    if (bs.minPublishAgeHours !== undefined && (as.minPublishAgeHours ?? 0) < bs.minPublishAgeHours) {
+        out.push({
+            key: "constraints.supplyChainPolicy.minPublishAgeHours",
+            description: `Newly published versions are accepted sooner (${bs.minPublishAgeHours}h becomes ${as.minPublishAgeHours ?? 0}h).`,
+        });
+    }
+    if (protectionDropped(bs.blockInstallScripts, as.blockInstallScripts)) {
+        out.push({
+            key: "constraints.supplyChainPolicy.blockInstallScripts",
+            description: "Versions with install scripts are no longer skipped.",
+        });
+    }
+    if (protectionDropped(bs.requireProvenance, as.requireProvenance)) {
+        out.push({
+            key: "constraints.supplyChainPolicy.requireProvenance",
+            description: "A provenance attestation is no longer required.",
+        });
+    }
+    const bk = before.exploitSignalOverride;
+    const ak = after.exploitSignalOverride;
+    if (protectionDropped(bk?.kev?.mandatory, ak?.kev?.mandatory)) {
+        out.push({
+            key: "exploitSignalOverride.kev",
+            description: "Known-exploited (KEV) vulnerabilities are no longer mandatory.",
+        });
+    }
+    if (protectionDropped(bk?.epss?.mandatory, ak?.epss?.mandatory)) {
+        out.push({
+            key: "exploitSignalOverride.epss",
+            description: "High-EPSS vulnerabilities are no longer mandatory.",
+        });
+    }
+    else if (bk?.epss?.threshold !== undefined && (ak?.epss?.threshold ?? 1) > bk.epss.threshold) {
+        out.push({
+            key: "exploitSignalOverride.epss.threshold",
+            description: `The EPSS threshold rises from ${bk.epss.threshold} to ${ak?.epss?.threshold ?? "unset"}, so fewer vulnerabilities count as exploited.`,
+        });
+    }
+    const beforeSuppressions = before.suppressions ?? [];
+    for (const entry of after.suppressions ?? []) {
+        const previous = beforeSuppressions.find((candidate) => candidate.cveId.toUpperCase() === entry.cveId.toUpperCase());
+        if (!previous) {
+            out.push({
+                key: "suppressions",
+                description: `${entry.cveId} is suppressed (${entry.justification}${entry.expiresAt ? `, until ${entry.expiresAt}` : ", with no expiry"}).`,
+            });
+            continue;
+        }
+        const earlier = previous.expiresAt ? new Date(previous.expiresAt).getTime() : Infinity;
+        const later = entry.expiresAt ? new Date(entry.expiresAt).getTime() : Infinity;
+        if (later > earlier || (Number.isNaN(later) && !Number.isNaN(earlier))) {
+            out.push({
+                key: "suppressions",
+                description: `The suppression of ${entry.cveId} lasts longer than before.`,
+            });
+        }
+        else if (previous.justification !== entry.justification) {
+            out.push({
+                key: "suppressions",
+                description: `The suppression of ${entry.cveId} changes from ${previous.justification} to ${entry.justification}.`,
+            });
+        }
+    }
+    const bsla = before.sla ?? {};
+    const asla = after.sla ?? {};
+    for (const severity of ["critical", "high", "medium", "low"]) {
+        const was = bsla[severity];
+        if (was !== undefined && (asla[severity] === undefined || asla[severity] > was)) {
+            out.push({
+                key: `sla.${severity}`,
+                description: `The ${severity} deadline is ${asla[severity] === undefined ? "removed" : `${was}h becoming ${asla[severity]}h`}.`,
+            });
+        }
+    }
+    if (before.skipUnreachable !== true && after.skipUnreachable === true) {
+        out.push({
+            key: "skipUnreachable",
+            description: "Vulnerabilities in unreachable code are skipped.",
+        });
+    }
+    if (before.trustMaintainerVex !== true && after.trustMaintainerVex === true) {
+        out.push({
+            key: "trustMaintainerVex",
+            description: "A maintainer's shipped not_affected VEX statement now suppresses a vulnerability.",
+        });
+    }
+    for (const risk of ["low", "medium", "high"]) {
+        const was = before.patchConfidenceThresholds?.[risk] ?? CONFIDENCE_DEFAULTS[risk];
+        const now = after.patchConfidenceThresholds?.[risk] ?? CONFIDENCE_DEFAULTS[risk];
+        if (now < was) {
+            out.push({
+                key: `patchConfidenceThresholds.${risk}`,
+                description: `A ${risk}-risk patch is accepted at lower confidence (${was} becomes ${now}).`,
+            });
+        }
+    }
+    const bd = { ...DISPOSITION_DEFAULTS, ...before.dispositionPolicy };
+    const ad = { ...DISPOSITION_DEFAULTS, ...after.dispositionPolicy };
+    if (ad.minConfidenceForAutoApply < bd.minConfidenceForAutoApply) {
+        out.push({
+            key: "dispositionPolicy.minConfidenceForAutoApply",
+            description: `Patches are auto-applied at lower confidence (${bd.minConfidenceForAutoApply} becomes ${ad.minConfidenceForAutoApply}).`,
+        });
+    }
+    if (bd.holdForTransitive && !ad.holdForTransitive) {
+        out.push({
+            key: "dispositionPolicy.holdForTransitive",
+            description: "Transitive changes are no longer held for approval.",
+        });
+    }
+    if (bd.escalateOnKev && !ad.escalateOnKev) {
+        out.push({
+            key: "dispositionPolicy.escalateOnKev",
+            description: "Known-exploited vulnerabilities are no longer escalated.",
+        });
+    }
+    const dropped = bd.escalateOnSlaBreachSeverities.filter((severity) => !ad.escalateOnSlaBreachSeverities.includes(severity));
+    if (dropped.length > 0) {
+        out.push({
+            key: "dispositionPolicy.escalateOnSlaBreachSeverities",
+            description: `SLA breaches at ${dropped.join(", ")} are no longer escalated.`,
+        });
+    }
+    if (before.containmentMode && !after.containmentMode) {
+        out.push({
+            key: "containmentMode",
+            description: "Changes held for approval are no longer rolled back.",
+        });
+    }
+    for (const reason of UNRESOLVED_REASON_VALUES) {
+        const was = computeEscalationAction(reason, before.escalationGraph);
+        const now = computeEscalationAction(reason, after.escalationGraph);
+        if (was !== "none" && now === "none") {
+            out.push({
+                key: `escalationGraph.${reason}`,
+                description: `"${reason}" is no longer escalated (it was ${was}).`,
+            });
+        }
+    }
+    const ba = before.autonomy;
+    const aa = after.autonomy;
+    const beforeCeiling = ba?.ceiling ?? IMPLICIT_CEILING;
+    if (!aa) {
+        if (ba) {
+            out.push({
+                key: "autonomy",
+                description: "The autonomy ceiling is removed, so the repository is no longer capped.",
+            });
+        }
+    }
+    else {
+        if (levelIndex(aa.ceiling) > levelIndex(beforeCeiling)) {
+            out.push({
+                key: "autonomy.ceiling",
+                description: `The autonomy ceiling rises from ${ba ? ba.ceiling : `${IMPLICIT_CEILING} (implicit)`} to ${aa.ceiling}.`,
+            });
+        }
+        const was = { ...AUTONOMY_DEFAULTS, ...ba };
+        const now = { ...AUTONOMY_DEFAULTS, ...aa };
+        if (ba) {
+            for (const field of [
+                "minVerifiedRuns",
+                "window",
+                "minSuccessRate",
+                "cooldownDays",
+            ]) {
+                if (now[field] < was[field]) {
+                    out.push({
+                        key: `autonomy.${field}`,
+                        description: `Autonomy is earned on less evidence (${field} ${was[field]} becomes ${now[field]}).`,
+                    });
+                }
+            }
+            if (was.requireTestCoverage && !now.requireTestCoverage) {
+                out.push({
+                    key: "autonomy.requireTestCoverage",
+                    description: "Autonomy no longer needs runs whose tests passed.",
+                });
+            }
+        }
+    }
+    const bf = before.freshness;
+    const af = after.freshness;
+    if (bf) {
+        for (const limit of ["maxMajorsBehind", "maxMinorsBehind", "maxAgeDays"]) {
+            const was = bf[limit];
+            const now = af?.[limit];
+            if (was !== undefined && (now === undefined || now > was)) {
+                out.push({
+                    key: `freshness.${limit}`,
+                    description: now === undefined
+                        ? `The ${limit} limit is removed.`
+                        : `The ${limit} limit rises from ${was} to ${now}.`,
+                });
+            }
+        }
+        const ignored = new Set(bf.ignore);
+        const added = (af?.ignore ?? []).filter((entry) => !ignored.has(entry));
+        if (added.length > 0) {
+            out.push({
+                key: "freshness.ignore",
+                description: `${added.map((entry) => `"${entry}"`).join(", ")} no longer counts towards freshness.`,
+            });
+        }
+    }
+    const trusted = new Set(before.recipes?.packages ?? []);
+    for (const name of after.recipes?.packages ?? []) {
+        if (!trusted.has(name)) {
+            out.push({
+                key: "recipes.packages",
+                description: `"${name}" becomes a trusted recipe source.`,
+            });
+        }
+    }
+    return out;
+}
+/** Whether `after` is less safe than `before` in any way {@link findLoosenings} knows. */
+export function isLoosening(before, after) {
+    return findLoosenings(before, after).length > 0;
+}
+//# sourceMappingURL=policy-loosening.js.map

package/dist/platform/policy-loosening.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-loosening.js","sourceRoot":"","sources":["../../src/platform/policy-loosening.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EACL,qBAAqB,EACrB,wBAAwB,GAEzB,MAAM,qBAAqB,CAAC;AAY7B;;;;GAIG;AACH,MAAM,oBAAoB,GAAG;IAC3B,yBAAyB,EAAE,GAAG;IAC9B,iBAAiB,EAAE,KAAK;IACxB,aAAa,EAAE,IAAI;IACnB,6BAA6B,EAAE,CAAC,UAAU,EAAE,MAAM,CAA2B;CAC9E,CAAC;AACF,MAAM,iBAAiB,GAAG;IACxB,eAAe,EAAE,CAAC;IAClB,MAAM,EAAE,EAAE;IACV,cAAc,EAAE,GAAG;IACnB,YAAY,EAAE,CAAC;IACf,mBAAmB,EAAE,IAAI;CAC1B,CAAC;AACF,kIAAkI;AAClI,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAW,CAAC;AAC3E,qIAAqI;AACrI,MAAM,gBAAgB,GAAkB,IAAI,CAAC;AAS7C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAE5B;IACF,eAAe,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IACtC,YAAY,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IACnC,aAAa,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IACpC,oCAAoC,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IAC3D,+BAA+B,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IACtD,yBAAyB,EAAE;QACzB,IAAI,EAAE,iBAAiB;QACvB,MAAM,EAAE,sFAAsF;KAC/F;IACD,kCAAkC,EAAE;QAClC,IAAI,EAAE,iBAAiB;QACvB,MAAM,EAAE,0EAA0E;KACnF;IACD,mCAAmC,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IAC1D,uBAAuB,EAAE;QACvB,IAAI,EAAE,iBAAiB;QACvB,MAAM,EAAE,8EAA8E;KACvF;IACD,uBAAuB,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IAC9C,+BAA+B,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IACtD,0CAA0C,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IACjE,kDAAkD,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IACzE,mDAAmD,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IAC1E,iDAAiD,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IACxE,+BAA+B,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IACtD,kCAAkC,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IACzD,gCAAgC,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IACvD,qCAAqC,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IAC5D,sCAAsC,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IAC7D,sCAAsC,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IAC7D,YAAY,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IACnC,cAAc,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IACrC,UAAU,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IACjC,YAAY,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IACnC,SAAS,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IAChC,eAAe,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IACtC,kBAAkB,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IACzC,6CAA6C,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IACpE,qCAAqC,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IAC5D,iCAAiC,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IACxD,iDAAiD,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IACxE,eAAe,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IACtC,mBAAmB,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IAC1C,kBAAkB,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IACzC,kBAAkB,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IACzC,0BAA0B,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IACjD,iBAAiB,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IACxC,yBAAyB,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IAChD,uBAAuB,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IAC9C,8BAA8B,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IACrD,2BAA2B,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IAClD,2BAA2B,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IAClD,sBAAsB,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;IAC7C,kBAAkB,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;CAC1C,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,KAAoB,EAAU,EAAE,CAAC,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAE1F,gHAAgH;AAChH,MAAM,iBAAiB,GAAG,CAAC,MAA2B,EAAE,KAA0B,EAAW,EAAE,CAC7F,MAAM,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC;AAEpC,SAAS,cAAc,CACrB,GAAqC,EACrC,MAAyB,EACzB,KAAwB,EACxB,GAAgB;IAEhB,IAAI,GAAG,KAAK,cAAc,EAAE,CAAC;QAC3B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3B,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,KAAK,8CAA8C,EAAE,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;QACD,OAAO;IACT,CAAC;IACD,sFAAsF;IACtF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,0DAA0D,EAAE,CAAC,CAAC;QAC3F,OAAO;IACT,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5B,GAAG,CAAC,IAAI,CAAC;oBACP,GAAG;oBACH,WAAW,EAAE,IAAI,KAAK,oDAAoD;iBAC3E,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,MAA4B,EAC5B,KAA2B;IAE3B,MAAM,GAAG,GAAgB,EAAE,CAAC;IAE5B,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QACrD,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,iBAAiB,EAAE,WAAW,EAAE,wCAAwC,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,cAAc,CAAC,cAAc,EAAE,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAC7E,cAAc,CAAC,eAAe,EAAE,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;IAEhF,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;IACpC,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAkC;QAC9C,CAAC,wBAAwB,EAAE,+CAA+C,CAAC;QAC3E,CAAC,mBAAmB,EAAE,kEAAkE,CAAC;QACzF,CAAC,uBAAuB,EAAE,4CAA4C,CAAC;QACvE,CAAC,WAAW,EAAE,yDAAyD,CAAC;QACxE,CAAC,mBAAmB,EAAE,gDAAgD,CAAC;KACxE,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,QAAQ,EAAE,CAAC;QAC3C,IAAI,iBAAiB,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC1C,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,eAAe,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IACD,IAAI,EAAE,CAAC,4BAA4B,KAAK,IAAI,IAAI,EAAE,CAAC,4BAA4B,KAAK,IAAI,EAAE,CAAC;QACzF,GAAG,CAAC,IAAI,CAAC;YACP,GAAG,EAAE,0CAA0C;YAC/C,WAAW,EAAE,gDAAgD;SAC9D,CAAC,CAAC;IACL,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,CAAC,iBAAiB,IAAI,EAAE,CAAC;IACtC,MAAM,EAAE,GAAG,EAAE,CAAC,iBAAiB,IAAI,EAAE,CAAC;IACtC,IAAI,EAAE,CAAC,kBAAkB,KAAK,SAAS,IAAI,CAAC,EAAE,CAAC,kBAAkB,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,kBAAkB,EAAE,CAAC;QAChG,GAAG,CAAC,IAAI,CAAC;YACP,GAAG,EAAE,kDAAkD;YACvD,WAAW,EAAE,iDAAiD,EAAE,CAAC,kBAAkB,aAAa,EAAE,CAAC,kBAAkB,IAAI,CAAC,KAAK;SAChI,CAAC,CAAC;IACL,CAAC;IACD,IAAI,iBAAiB,CAAC,EAAE,CAAC,mBAAmB,EAAE,EAAE,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,IAAI,CAAC;YACP,GAAG,EAAE,mDAAmD;YACxD,WAAW,EAAE,sDAAsD;SACpE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,iBAAiB,CAAC,EAAE,CAAC,iBAAiB,EAAE,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,IAAI,CAAC;YACP,GAAG,EAAE,iDAAiD;YACtD,WAAW,EAAE,iDAAiD;SAC/D,CAAC,CAAC;IACL,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,CAAC,qBAAqB,CAAC;IACxC,MAAM,EAAE,GAAG,KAAK,CAAC,qBAAqB,CAAC;IACvC,IAAI,iBAAiB,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,IAAI,CAAC;YACP,GAAG,EAAE,2BAA2B;YAChC,WAAW,EAAE,gEAAgE;SAC9E,CAAC,CAAC;IACL,CAAC;IACD,IAAI,iBAAiB,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,IAAI,CAAC;YACP,GAAG,EAAE,4BAA4B;YACjC,WAAW,EAAE,oDAAoD;SAClE,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,KAAK,SAAS,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/F,GAAG,CAAC,IAAI,CAAC;YACP,GAAG,EAAE,sCAAsC;YAC3C,WAAW,EAAE,iCAAiC,EAAE,CAAC,IAAI,CAAC,SAAS,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,IAAI,OAAO,gDAAgD;SACrJ,CAAC,CAAC;IACL,CAAC;IAED,MAAM,kBAAkB,GAAG,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;IACrD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CACtC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,CAC3E,CAAC;QACF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,IAAI,CAAC;gBACP,GAAG,EAAE,cAAc;gBACnB,WAAW,EAAE,GAAG,KAAK,CAAC,KAAK,mBAAmB,KAAK,CAAC,aAAa,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,kBAAkB,IAAI;aAC5I,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;QACvF,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC/E,IAAI,KAAK,GAAG,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACvE,GAAG,CAAC,IAAI,CAAC;gBACP,GAAG,EAAE,cAAc;gBACnB,WAAW,EAAE,sBAAsB,KAAK,CAAC,KAAK,4BAA4B;aAC3E,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,QAAQ,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;YAC1D,GAAG,CAAC,IAAI,CAAC;gBACP,GAAG,EAAE,cAAc;gBACnB,WAAW,EAAE,sBAAsB,KAAK,CAAC,KAAK,iBAAiB,QAAQ,CAAC,aAAa,OAAO,KAAK,CAAC,aAAa,GAAG;aACnH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC;IAC7B,KAAK,MAAM,QAAQ,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAU,EAAE,CAAC;QACtE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;YAChF,GAAG,CAAC,IAAI,CAAC;gBACP,GAAG,EAAE,OAAO,QAAQ,EAAE;gBACtB,WAAW,EAAE,OAAO,QAAQ,gBAAgB,IAAI,CAAC,QAAQ,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,cAAc,IAAI,CAAC,QAAQ,CAAC,GAAG,GAAG;aAChI,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,eAAe,KAAK,IAAI,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;QACtE,GAAG,CAAC,IAAI,CAAC;YACP,GAAG,EAAE,iBAAiB;YACtB,WAAW,EAAE,kDAAkD;SAChE,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,CAAC,kBAAkB,KAAK,IAAI,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;QAC5E,GAAG,CAAC,IAAI,CAAC;YACP,GAAG,EAAE,oBAAoB;YACzB,WAAW,EACT,mFAAmF;SACtF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAU,EAAE,CAAC;QACtD,MAAM,GAAG,GAAG,MAAM,CAAC,yBAAyB,EAAE,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAClF,MAAM,GAAG,GAAG,KAAK,CAAC,yBAAyB,EAAE,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACjF,IAAI,GAAG,GAAG,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,IAAI,CAAC;gBACP,GAAG,EAAE,6BAA6B,IAAI,EAAE;gBACxC,WAAW,EAAE,KAAK,IAAI,gDAAgD,GAAG,YAAY,GAAG,IAAI;aAC7F,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,EAAE,GAAG,EAAE,GAAG,oBAAoB,EAAE,GAAG,MAAM,CAAC,iBAAiB,EAAE,CAAC;IACpE,MAAM,EAAE,GAAG,EAAE,GAAG,oBAAoB,EAAE,GAAG,KAAK,CAAC,iBAAiB,EAAE,CAAC;IACnE,IAAI,EAAE,CAAC,yBAAyB,GAAG,EAAE,CAAC,yBAAyB,EAAE,CAAC;QAChE,GAAG,CAAC,IAAI,CAAC;YACP,GAAG,EAAE,6CAA6C;YAClD,WAAW,EAAE,iDAAiD,EAAE,CAAC,yBAAyB,YAAY,EAAE,CAAC,yBAAyB,IAAI;SACvI,CAAC,CAAC;IACL,CAAC;IACD,IAAI,EAAE,CAAC,iBAAiB,IAAI,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC;QAClD,GAAG,CAAC,IAAI,CAAC;YACP,GAAG,EAAE,qCAAqC;YAC1C,WAAW,EAAE,qDAAqD;SACnE,CAAC,CAAC;IACL,CAAC;IACD,IAAI,EAAE,CAAC,aAAa,IAAI,CAAC,EAAE,CAAC,aAAa,EAAE,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC;YACP,GAAG,EAAE,iCAAiC;YACtC,WAAW,EAAE,0DAA0D;SACxE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,OAAO,GAAG,EAAE,CAAC,6BAA6B,CAAC,MAAM,CACrD,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,6BAA6B,CAAC,QAAQ,CAAC,QAAQ,CAAC,CACnE,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,IAAI,CAAC;YACP,GAAG,EAAE,iDAAiD;YACtD,WAAW,EAAE,mBAAmB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B;SAC9E,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,CAAC,eAAe,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;QACrD,GAAG,CAAC,IAAI,CAAC;YACP,GAAG,EAAE,iBAAiB;YACtB,WAAW,EAAE,sDAAsD;SACpE,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,wBAAwB,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,uBAAuB,CAAC,MAAM,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,uBAAuB,CAAC,MAAM,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;QACnE,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACrC,GAAG,CAAC,IAAI,CAAC;gBACP,GAAG,EAAE,mBAAmB,MAAM,EAAE;gBAChC,WAAW,EAAE,IAAI,MAAM,oCAAoC,GAAG,IAAI;aACnE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC3B,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC;IAC1B,MAAM,aAAa,GAAG,EAAE,EAAE,OAAO,IAAI,gBAAgB,CAAC;IACtD,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,IAAI,EAAE,EAAE,CAAC;YACP,GAAG,CAAC,IAAI,CAAC;gBACP,GAAG,EAAE,UAAU;gBACf,WAAW,EAAE,yEAAyE;aACvF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,UAAU,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,IAAI,CAAC;gBACP,GAAG,EAAE,kBAAkB;gBACvB,WAAW,EAAE,mCAAmC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,gBAAgB,aAAa,OAAO,EAAE,CAAC,OAAO,GAAG;aACvH,CAAC,CAAC;QACL,CAAC;QACD,MAAM,GAAG,GAAG,EAAE,GAAG,iBAAiB,EAAE,GAAG,EAAE,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,EAAE,GAAG,iBAAiB,EAAE,GAAG,EAAE,EAAE,CAAC;QAC5C,IAAI,EAAE,EAAE,CAAC;YACP,KAAK,MAAM,KAAK,IAAI;gBAClB,iBAAiB;gBACjB,QAAQ;gBACR,gBAAgB;gBAChB,cAAc;aACN,EAAE,CAAC;gBACX,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC5B,GAAG,CAAC,IAAI,CAAC;wBACP,GAAG,EAAE,YAAY,KAAK,EAAE;wBACxB,WAAW,EAAE,wCAAwC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,KAAK,CAAC,IAAI;qBACnG,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACD,IAAI,GAAG,CAAC,mBAAmB,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC;gBACxD,GAAG,CAAC,IAAI,CAAC;oBACP,GAAG,EAAE,8BAA8B;oBACnC,WAAW,EAAE,mDAAmD;iBACjE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC;IAC5B,MAAM,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC;IAC3B,IAAI,EAAE,EAAE,CAAC;QACP,KAAK,MAAM,KAAK,IAAI,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,YAAY,CAAU,EAAE,CAAC;YAClF,MAAM,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;YACtB,MAAM,GAAG,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;YACxB,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC;gBAC1D,GAAG,CAAC,IAAI,CAAC;oBACP,GAAG,EAAE,aAAa,KAAK,EAAE;oBACzB,WAAW,EACT,GAAG,KAAK,SAAS;wBACf,CAAC,CAAC,OAAO,KAAK,oBAAoB;wBAClC,CAAC,CAAC,OAAO,KAAK,qBAAqB,GAAG,OAAO,GAAG,GAAG;iBACxD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QACxE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,IAAI,CAAC;gBACP,GAAG,EAAE,kBAAkB;gBACvB,WAAW,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,sCAAsC;aACpG,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;IACxD,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC;QACjD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,GAAG,CAAC,IAAI,CAAC;gBACP,GAAG,EAAE,kBAAkB;gBACvB,WAAW,EAAE,IAAI,IAAI,oCAAoC;aAC1D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,WAAW,CAAC,MAA4B,EAAE,KAA2B;IACnF,OAAO,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAClD,CAAC"}

package/dist/platform/policy.d.ts

@@ -1,3 +1,6 @@
+import { z } from "zod";
+import { type FreshnessPolicy } from "./freshness-policy.js";
+import { type AutonomyPolicy } from "./option-schemas.js";
 import type { CveSeverity, DispositionPolicy, EscalationGraph, ExploitSignalOverridePolicy, PatchConfidenceThresholds, RemediationConstraints, SlaBreach, SlaPolicy, VexSuppression } from "./types.js";
 export interface AutoremediatorPolicy {
     allowMajorBumps: boolean;
@@ -9,11 +12,255 @@ export interface AutoremediatorPolicy {
     suppressions?: VexSuppression[];
     sla?: SlaPolicy;
     skipUnreachable?: boolean;
+    /** Treat a maintainer's shipped `not_affected` VEX statement as a suppression. Default false: it is shown as evidence only. */
+    trustMaintainerVex?: boolean;
     dispositionPolicy?: DispositionPolicy;
     containmentMode?: boolean;
     escalationGraph?: EscalationGraph;
+    /** Packages whose `recipes/` are trusted as recipe sources (see docs/guides/recipes.md). */
+    recipes?: {
+        packages: string[];
+    };
+    /** Earned autonomy. Absent means the feature is off and behaviour is unchanged. */
+    autonomy?: AutonomyPolicy;
+    /** How far behind the latest release direct dependencies may fall (see docs/guides/freshness.md). */
+    freshness?: FreshnessPolicy;
 }
 export declare const DEFAULT_POLICY: AutoremediatorPolicy;
+export declare const suppressionSchema: z.ZodObject<{
+    cveId: z.ZodString;
+    justification: z.ZodEnum<{
+        fixed: "fixed";
+        mitigated: "mitigated";
+        not_affected: "not_affected";
+        under_investigation: "under_investigation";
+    }>;
+    notes: z.ZodOptional<z.ZodString>;
+    expiresAt: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodPipe<z.ZodDate, z.ZodTransform<string, Date>>]>>;
+}, z.core.$strict>;
+/** Shape of the policy YAML. Unknown keys are rejected so typos and removed options are caught. */
+export declare const policyFileSchema: z.ZodObject<{
+    allowMajorBumps: z.ZodDefault<z.ZodBoolean>;
+    denyPackages: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    allowPackages: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    constraints: z.ZodOptional<z.ZodObject<{
+        directDependenciesOnly: z.ZodOptional<z.ZodBoolean>;
+        preferVersionBump: z.ZodOptional<z.ZodBoolean>;
+        installMode: z.ZodOptional<z.ZodEnum<{
+            deterministic: "deterministic";
+            "prefer-offline": "prefer-offline";
+            standard: "standard";
+        }>>;
+        installPreferOffline: z.ZodOptional<z.ZodBoolean>;
+        enforceFrozenLockfile: z.ZodOptional<z.ZodBoolean>;
+        workspace: z.ZodOptional<z.ZodString>;
+        typecheck: z.ZodOptional<z.ZodBoolean>;
+        requireProofOfFix: z.ZodOptional<z.ZodBoolean>;
+        enableBreakingChangeRefactor: z.ZodOptional<z.ZodBoolean>;
+        supplyChainPolicy: z.ZodOptional<z.ZodObject<{
+            minPublishAgeHours: z.ZodOptional<z.ZodNumber>;
+            blockInstallScripts: z.ZodOptional<z.ZodBoolean>;
+            requireProvenance: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    patchConfidenceThresholds: z.ZodOptional<z.ZodObject<{
+        low: z.ZodOptional<z.ZodNumber>;
+        medium: z.ZodOptional<z.ZodNumber>;
+        high: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
+    exploitSignalOverride: z.ZodOptional<z.ZodObject<{
+        kev: z.ZodOptional<z.ZodObject<{
+            mandatory: z.ZodBoolean;
+        }, z.core.$strict>>;
+        epss: z.ZodOptional<z.ZodObject<{
+            mandatory: z.ZodBoolean;
+            threshold: z.ZodNumber;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    suppressions: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        cveId: z.ZodString;
+        justification: z.ZodEnum<{
+            fixed: "fixed";
+            mitigated: "mitigated";
+            not_affected: "not_affected";
+            under_investigation: "under_investigation";
+        }>;
+        notes: z.ZodOptional<z.ZodString>;
+        expiresAt: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodPipe<z.ZodDate, z.ZodTransform<string, Date>>]>>;
+    }, z.core.$strict>>>;
+    sla: z.ZodOptional<z.ZodObject<{
+        critical: z.ZodOptional<z.ZodNumber>;
+        high: z.ZodOptional<z.ZodNumber>;
+        medium: z.ZodOptional<z.ZodNumber>;
+        low: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
+    skipUnreachable: z.ZodDefault<z.ZodBoolean>;
+    trustMaintainerVex: z.ZodDefault<z.ZodBoolean>;
+    dispositionPolicy: z.ZodOptional<z.ZodObject<{
+        minConfidenceForAutoApply: z.ZodOptional<z.ZodNumber>;
+        holdForTransitive: z.ZodOptional<z.ZodBoolean>;
+        escalateOnKev: z.ZodOptional<z.ZodBoolean>;
+        escalateOnSlaBreachSeverities: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+            CRITICAL: "CRITICAL";
+            HIGH: "HIGH";
+            LOW: "LOW";
+            MEDIUM: "MEDIUM";
+            UNKNOWN: "UNKNOWN";
+        }>>>;
+    }, z.core.$strict>>;
+    containmentMode: z.ZodDefault<z.ZodBoolean>;
+    escalationGraph: z.ZodOptional<z.ZodObject<{
+        "breaking-change-unresolved": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "constraint-blocked": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "install-failed": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "major-bump-required": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "no-safe-version": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "override-apply-failed": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "package-json-not-found": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "patch-apply-failed": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "patch-confidence-too-low": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "patch-generation-failed": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "patch-validation-failed": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "policy-blocked": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "proof-of-fix-failed": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "requires-llm-fallback": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "source-fetch-failed": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "transitive-dependency": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "transitive-override-unsupported-deno-native": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+        "validation-failed": z.ZodOptional<z.ZodEnum<{
+            "create-draft-pr": "create-draft-pr";
+            "hold-branch": "hold-branch";
+            none: "none";
+            "notify-channel": "notify-channel";
+            "open-issue": "open-issue";
+        }>>;
+    }, z.core.$strict>>;
+    recipes: z.ZodOptional<z.ZodObject<{
+        packages: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
+    autonomy: z.ZodOptional<z.ZodObject<{
+        ceiling: z.ZodEnum<{
+            L0: "L0";
+            L1: "L1";
+            L2: "L2";
+            L3: "L3";
+            L4: "L4";
+        }>;
+        minVerifiedRuns: z.ZodOptional<z.ZodNumber>;
+        window: z.ZodOptional<z.ZodNumber>;
+        minSuccessRate: z.ZodOptional<z.ZodNumber>;
+        cooldownDays: z.ZodOptional<z.ZodNumber>;
+        requireTestCoverage: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>;
+    freshness: z.ZodOptional<z.ZodObject<{
+        maxMajorsBehind: z.ZodOptional<z.ZodNumber>;
+        maxMinorsBehind: z.ZodOptional<z.ZodNumber>;
+        maxAgeDays: z.ZodOptional<z.ZodNumber>;
+        ignore: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
 /**
  * Load and validate the policy.
  *
@@ -22,7 +269,7 @@ export declare const DEFAULT_POLICY: AutoremediatorPolicy;
  * means "no policy". An explicit path that does not exist, unreadable files, invalid YAML and
  * schema violations all throw, so a broken policy can never silently degrade to defaults.
  */
-export declare function loadPolicy(cwd: string, explicitPath?: string): AutoremediatorPolicy;
+export declare function loadPolicy(cwd: string, explicitPathOrEmpty?: string): AutoremediatorPolicy;
 export declare function isPackageAllowed(policy: AutoremediatorPolicy, packageName: string): boolean;
 export declare function isActiveSuppression(suppression: VexSuppression): boolean;
 export declare function findSuppression(policy: AutoremediatorPolicy, cveId: string): VexSuppression | undefined;