depcurfew 1.2.0 → 1.4.0

package/dist/index.d.ts

@@ -1,7 +1,8 @@
-type ToolId = 'npm' | 'pnpm' | 'yarn' | 'bun' | 'deno' | 'uv' | 'pip' | 'poetry' | 'pdm' | 'pipenv' | 'renovate' | 'dependabot';
+import { Readable, Writable } from "node:stream";
+type ToolId = 'npm' | 'pnpm' | 'yarn' | 'bun' | 'deno' | 'uv' | 'pip' | 'poetry' | 'pdm' | 'pipenv' | 'composer' | 'renovate' | 'dependabot';
 type ToolKind = 'package-manager' | 'update-bot';
 /** The registry a package manager installs from; package names in the policy are compared per ecosystem. */
-type Ecosystem = 'npm' | 'pypi';
+type Ecosystem = 'npm' | 'pypi' | 'packagist';
 interface Evidence$1<T> {
   value: T;
   /** URL of official documentation or changelog. */
@@ -111,6 +112,7 @@ interface UserDirectory {
     env: string;
     absolute?: boolean;
     relativeToCwd?: boolean;
+    emptyCounts?: boolean;
   } | 'home';
   /** Path below it, with / separators; empty for the directory itself. */
   path: string;
@@ -179,10 +181,35 @@ interface UserVariable {
   /** The file the tool reads when the variable is unset, from the home directory (~/.npmrc): naming it changes nothing. */
   defaultPath?: string;
 }
+/**
+ * Directories of the user file that a library the tool calls decides, by the library's version (platformdirs for
+ * Poetry and PDM on macOS). depcurfew reads that version from the library's .dist-info next to the tool's own.
+ */
+interface LibraryDirectories {
+  /** The distribution name of the library, as its .dist-info folder spells it (platformdirs). */
+  library: string;
+  /** The platforms whose directories it decides; the other platforms keep those of `files`. */
+  platforms: readonly UserPlatform[];
+  /** The directories per library version, oldest first; they replace the directories of `files` on those platforms. */
+  directories: Versioned<readonly UserDirectory[]>;
+}
+/** The unit of the release-age setting in the user file, when it differs from the tool's own (`cooldown.unit`). */
+interface UserCooldownUnit {
+  key: string;
+  unit: 'seconds' | 'minutes' | 'hours' | 'days';
+  /** Only whole numbers count; depcurfew rounds up, to the longer delay. */
+  wholeNumbers: boolean;
+  /** What the tool does with any other value: ignores it without a word, or stops. */
+  otherValues: 'ignored' | 'fail';
+}
 /** The tool's user-level configuration, for `depcurfew apply --user` and `doctor --user`. */
 interface UserConfigKnowledge {
   /** The user file per version, oldest first; null for versions without a user file. */
   files: Fact<Versioned<UserFile | null>>;
+  /** Directories of the user file that depend on the version of a library the tool calls. */
+  libraryDirectories?: Fact<LibraryDirectories>;
+  /** The unit of the release-age setting there, when it is not the unit of the tool's project setting. */
+  cooldownUnit?: Fact<UserCooldownUnit>;
   /** Settings depcurfew can write there. */
   settings: Fact<readonly UserSetting[]>;
   /** What a version does with a key it does not know in the user file: ignore it, warn, or fail. */
@@ -211,6 +238,32 @@ interface ToolKnowledge {
   /** Further sourced facts that matter for generators and `doctor`, keyed by a short name. */
   extra?: Readonly<Record<string, Fact<unknown>>>;
 }
+/**
+ * The values with which a switch weakens a protection: `delay` is a release-age delay in the tool's unit
+ * (cooldown.unit) or a duration string (durationStrings), which depcurfew compares with the policy; `any` is every
+ * value; otherwise the values listed, or every value except those (fail closed). A flag without a value is "true".
+ */
+type OverrideValues = 'delay' | 'any' | readonly string[] | {
+  readonly except: readonly string[];
+};
+/** An option or environment variable of one command that weakens what depcurfew apply configured. */
+interface OverrideSwitch {
+  /** The option as the scanner resolves it (--name) or the variable, compared without regard to case. */
+  name: string;
+  /**
+   * The release-age delay, the rule on dependency install scripts, or a protection of the package manager that the
+   * policy does not manage (Composer's blocking of versions flagged as malware), which always counts (decision D-133).
+   */
+  weakens: 'delay' | 'scripts' | 'protection';
+  values: OverrideValues;
+  /** protection: what it turns off, for messages ("turns off the blocking of versions flagged as malware"). */
+  effect?: string;
+  /**
+   * protection: what that protection does, as a clause of its own, when it covers less than every package the command
+   * fetches ("secure-http lets Composer download only over HTTPS, …"; decision D-142).
+   */
+  protects?: string;
+}
 /** A tool that environment facts refer to: Node.js, Python or a package manager. */
 type RuntimeOrTool = 'node' | 'python' | ToolId;
 interface PackageManagerFieldKnowledge {
@@ -287,6 +340,18 @@ interface NpmRegistryKnowledge {
   installScripts: readonly string[];
 }
 /** How the Python interpreter runs a module (python -m pip) or a command string. */
+/**
+ * A Python virtual environment as venv creates it: `marker` is the file in the environment's directory, and the
+ * activation scripts sit in a binary directory right under it, per platform (bin on POSIX, Scripts on Windows).
+ */
+interface VirtualEnvironmentKnowledge {
+  marker: string;
+  scripts: readonly {
+    platform: 'posix' | 'windows';
+    directory: string;
+    names: readonly string[];
+  }[];
+}
 interface PythonInterpreterKnowledge {
   /** Executable names; versioned names such as python3.12 are the same. */
   executables: readonly string[];
@@ -331,6 +396,71 @@ interface ProjectStatusKnowledge {
   /** Installers may warn about the project. */
   warned: readonly string[];
 }
+/** The batch query of the OSV.dev API (decision D-129): where to send it, how its JSON is spelled, and its limit. */
+interface OsvApiKnowledge {
+  /** Base URL of the API. */
+  url: string;
+  queryBatchPath: string;
+  /** GET: one record by id ({id}). */
+  vulnerabilityPath: string;
+  /** The web page of a record ({id}). */
+  recordPage: string;
+  queriesField: string;
+  resultsField: string;
+  vulnsField: string;
+  idField: string;
+  /** A result with more pages carries this token; the next request sends it back as pageTokenField of that query. */
+  nextPageTokenField: string;
+  pageTokenField: string;
+  /** Most queries in one batch request. */
+  maxQueriesPerBatch: number;
+}
+/** When a batch result is paged: more vulnerabilities than these for one query, or for the whole batch. */
+interface OsvPagingKnowledge {
+  perQuery: number;
+  perBatch: number;
+}
+/** What OSV.dev promises about its service: no rate limit (null), how fresh the data is, the largest response over HTTP/1.1. */
+interface OsvServiceKnowledge {
+  rateLimit: number | null;
+  freshnessMinutes: number;
+  freshnessShare: number;
+  responseLimitBytes: number;
+}
+/** Withdrawn records: the field that marks them, and which responses still carry them. */
+interface OsvWithdrawnKnowledge {
+  field: string;
+  inQueryResponses: boolean;
+  inRecordResponses: boolean;
+}
+/** The records of known malicious packages in OSV.dev: their id prefix and where they come from. */
+interface OsvMaliciousKnowledge {
+  idPrefix: string;
+  database: string;
+  license: string;
+}
+/** The characters a record id may have (a regular expression for the whole id), from the OSV schema (decision D-135). */
+interface OsvIdKnowledge {
+  pattern: string;
+}
+/** OSV.dev, asked about known malicious package versions with --osv (decision D-129). */
+interface OsvKnowledge {
+  api: Fact<OsvApiKnowledge>;
+  paging: Fact<OsvPagingKnowledge>;
+  ids: Fact<OsvIdKnowledge>;
+  service: Fact<OsvServiceKnowledge>;
+  withdrawn: Fact<OsvWithdrawnKnowledge>;
+  malicious: Fact<OsvMaliciousKnowledge>;
+  /** The OSV ecosystem name of each ecosystem of depcurfew (npm, pypi, ...). */
+  ecosystems: Fact<Readonly<Record<string, string>>>;
+  /** How the API compares the version of a query with the versions of a record, by depcurfew's ecosystem (decision D-142). */
+  versionMatching: Fact<Readonly<Record<string, OsvVersionMatchingKnowledge>>>;
+}
+/** What OSV.dev leaves out of a version before it compares it. */
+interface OsvVersionMatchingKnowledge {
+  /** A leading character left out of both versions (Packagist: v and V). */
+  ignoredPrefixes: readonly string[];
+}
 /** Claude Code hooks that run before a tool call and can block it (used by depcurfew check --hook claude-code). */
 interface ClaudeCodeHooksKnowledge {
   /** Project settings file that can be committed. */
@@ -377,11 +507,172 @@ interface ClaudeCodeHooksKnowledge {
     args: string;
   };
 }
+/** additionalContext in hookSpecificOutput of a PreToolUse hook: text Claude reads next to the tool result. */
+interface ClaudeCodeHookContextKnowledge {
+  field: string;
+  /** Whether the field works without a permission decision (which leaves the call to the normal permission flow). */
+  withoutDecision: boolean;
+  /** Longer text is written to a file and Claude gets its path with a preview. */
+  inlineLimit: number;
+}
+/** The SessionStart hook that can install the project, and what happens to a guard whose script is missing. */
+interface ClaudeCodeSessionStartKnowledge {
+  event: string;
+  /** The matchers for a new and a resumed session. */
+  matchers: readonly string[];
+  /** The variable a shell-form hook command reads for the project root. */
+  projectDirVariable: string;
+  /** Whether Claude's first response waits for SessionStart hooks to finish. */
+  firstResponseWaits: boolean;
+  /** What a PreToolUse hook with onFailure "block" does when its script is missing. */
+  missingScriptWithBlock: 'blocks';
+  /** The part of the error Claude Code shows then, before the output of the command that failed. */
+  blockedNotice: string;
+  /** Whether a cloud environment's setup script runs before Claude Code starts. */
+  cloudSetupScriptRunsBeforeClaudeCode: boolean;
+}
 /** A Claude Code tool that runs shell commands, by the name a matcher and the event use, and the shell it runs them in. */
 interface ClaudeCodeShellTool {
   tool: string;
   shell: 'bash' | 'powershell';
 }
+/** A shell tool call that carries another input in place of the command (a Monitor WebSocket watch). */
+interface ClaudeCodeCommandlessInputKnowledge {
+  tool: string;
+  /** The field of the event, next to the command field, that takes the place of the command. */
+  input: string;
+}
+/** Model Context Protocol revisions: the legacy ones open a session with initialize, the modern ones carry the version on every request. */
+interface McpRevisionsKnowledge {
+  /** Newest first. */
+  legacy: readonly string[];
+  /** Newest first. */
+  modern: readonly string[];
+}
+/** The initialize handshake of the legacy revisions. */
+interface McpLifecycleKnowledge {
+  initialize: string;
+  initialized: string;
+  ping: string;
+  /** Fields of the initialize request and result. */
+  request: {
+    protocolVersion: string;
+    capabilities: string;
+    clientInfo: string;
+  };
+  result: {
+    protocolVersion: string;
+    capabilities: string;
+    serverInfo: string;
+    instructions: string;
+  };
+}
+/** What a modern (stateless) request and result carry in `_meta`, and the discovery method. */
+interface McpStatelessKnowledge {
+  metaField: string;
+  protocolVersion: string;
+  clientCapabilities: string;
+  clientInfo: string;
+  serverInfo: string;
+  discover: string;
+  /** The fields of a discovery result. */
+  discoverResult: {
+    supportedVersions: string;
+    capabilities: string;
+    instructions: string;
+  };
+  /** Every modern result has this field, with `complete` for a finished result. */
+  resultType: {
+    field: string;
+    complete: string;
+  };
+  /** Caching hints that discovery and tools/list results must carry. */
+  caching: {
+    ttl: string;
+    scope: string;
+    publicScope: string;
+  };
+  /** The data of an unsupported-version error. */
+  unsupportedVersionData: {
+    supported: string;
+    requested: string;
+  };
+}
+/** Tools: the methods and the fields of a tool and of a call result. */
+interface McpToolsKnowledge {
+  list: string;
+  call: string;
+  capability: string;
+  /** The revision that added each optional field of a tool or a result; older clients do not know them. */
+  fieldsSince: {
+    annotations: string;
+    title: string;
+    structuredContent: string;
+  };
+}
+interface McpCancellationKnowledge {
+  method: string;
+  requestId: string;
+}
+/** The JSON-RPC error codes the server uses. */
+interface McpErrorCodesKnowledge {
+  parseError: number;
+  invalidRequest: number;
+  methodNotFound: number;
+  invalidParams: number;
+  internalError: number;
+  unsupportedProtocolVersion: number;
+}
+/** The id of an error response: required (a string or a number) in the schemas before `optionalSince`, optional from it. */
+interface McpErrorIdKnowledge {
+  optionalSince: string;
+}
+/** stdio: messages are UTF-8 JSON-RPC, one per line, without embedded newlines; stderr is free for logs. */
+interface McpStdioKnowledge {
+  delimiter: string;
+  /** Revisions whose servers must accept JSON-RPC batches (arrays). */
+  batchRevisions: readonly string[];
+}
+/** How Claude Code is told about a stdio server: `claude mcp add` and the project file. */
+interface McpClaudeCodeKnowledge {
+  /** claude mcp add [options] <name> -- <command> [args...] */
+  addCommand: readonly string[];
+  separator: string;
+  scopeOption: string;
+  projectScope: string;
+  transportOption: string;
+  stdioTransport: string;
+  projectFile: string;
+  serversKey: string;
+  /** Set in the server's environment to the project root; in command and args it needs a default. */
+  projectDirVariable: string;
+  projectDirReference: string;
+}
+/** Where Claude Desktop keeps its configuration, per platform, and the key of its servers. */
+interface McpClaudeDesktopKnowledge {
+  configFiles: {
+    darwin: string;
+    win32: string;
+    linux: string;
+  };
+  serversKey: string;
+}
+/** VS Code's own format (.vscode/mcp.json) and its command line. */
+interface McpVsCodeKnowledge {
+  file: string;
+  serversKey: string;
+  typeField: string;
+  stdioType: string;
+  cwdField: string;
+  workspaceFolder: string;
+  /** code --add-mcp '{"name": …, …}' adds a server to the user profile. */
+  addOption: string;
+}
+interface McpClientsKnowledge {
+  claudeCode: Fact<McpClaudeCodeKnowledge>;
+  claudeDesktop: Fact<McpClaudeDesktopKnowledge>;
+  vscode: Fact<McpVsCodeKnowledge>;
+}
 /**
  * Annotation workflow commands: `::{command} {property}={value},…::{message}` on a line of its own. Values are
  * escaped by replacing each character listed in `escape` (in order), properties also with `escapeProperty`.
@@ -408,13 +699,32 @@ interface AnnotationLimitsKnowledge {
 /** The Markdown job summary of a step: the environment variable naming its file and its size limit. */
 /** Creating a check run with the workflow token, so that the result shows in the pull request's Checks tab. */
 interface CheckRunsKnowledge {
-  /** POST endpoint, with {repository} as owner/name. */
-  endpoint: string;
+  /**
+   * Paths with {repository} as owner/name: create (POST), update (PATCH, {id} the check run), and list the check runs
+   * of a commit (GET, {ref} a SHA), which takes the query parameters checkName and filter (with the value latest).
+   */
+  endpoints: {
+    create: string;
+    update: string;
+    list: string;
+  };
+  query: {
+    checkName: string;
+    filter: string;
+    latest: string;
+  };
   apiVersion: string;
-  /** The workflow permission the token needs. */
+  /** The workflow permission the token needs; it covers the list endpoint too (write includes read). */
   permission: Record<string, string>;
   /** Limit of output.summary, in characters. */
   summaryMaxLength: number;
+  /** output.annotations: at most this many per request; further ones are appended by update requests. */
+  annotationsPerRequest: number;
+  /** annotation_level for each doctor level. */
+  annotationLevels: Record<'error' | 'warning' | 'note', string>;
+  /** Limits of an annotation: title in characters, message in bytes (64 KB, taken as 64000). */
+  annotationTitleMaxLength: number;
+  annotationMessageMaxBytes: number;
   /** Variables the runner sets: API URL, owner/name, commit and the event payload file. */
   variables: {
     apiUrl: string;
@@ -456,12 +766,194 @@ interface GitIgnoreCaseKnowledge {
   /** Values read as true (case-insensitive); a key without a value is true too. */
   trueValues: readonly string[];
 }
+/** The file in which Corepack records the version of each package manager it runs outside a project. */
+interface CorepackDefaultsKnowledge {
+  /** The first Corepack version with this layout. */
+  since: string;
+  /** Where the file is: the first directory that applies is used. */
+  locations: readonly UserLocation[];
+}
+/** The version of a tool each release of a runtime bundles, for one release line (Node.js 22, CPython 3.12). */
+interface BundledVersionsLine {
+  /** The release line: 22 for Node.js, 3.12 for CPython. */
+  line: string;
+  /** The newest release of the line on the day the fact was verified. */
+  latest: string;
+  /** [first release, bundled version]: the first release of the line that bundles each version, oldest first. */
+  bundles: readonly (readonly [string, string])[];
+}
+/** One Node.js release line in the release schedule. */
+interface ReleaseLineSchedule {
+  line: number;
+  /** The first release (YYYY-MM-DD). */
+  start: string;
+  /** When the line became LTS; absent for lines that never do. */
+  lts?: string;
+  /** End of life: no more releases, security fixes included. */
+  end: string;
+  /** The LTS codename in lower case, as nvm, setup-node and the node image tags write it. */
+  codename?: string;
+}
+/** Names of moving Node.js versions in a version file or a setup-node input. */
+interface NodeVersionNamesKnowledge {
+  /** Names of the newest release. */
+  newest: readonly string[];
+  /** The name of the newest LTS line. */
+  newestLts: string;
+  /** Followed by a codename: that LTS line (lts/jod). */
+  ltsPrefix: string;
+  /** Followed by a number n: the n-th LTS line before the newest one (lts/-1); absent when not supported. */
+  previousLtsPrefix?: string;
+}
+interface NvmrcKnowledge extends NodeVersionNamesKnowledge {
+  file: string;
+  /** Starts a comment that runs to the end of the line. */
+  comment: string;
+}
+/** How setup-node reads the file named by node-version-file. */
+interface SetupNodeVersionFileKnowledge {
+  /** A JSON manifest whose keys are read in order: dotted paths, devEngines.runtime means its entry named node. */
+  packageJson: string;
+  packageJsonOrder: readonly string[];
+  /** Any other file: the first line that matches (multiline), group "version"; otherwise the whole text, trimmed. */
+  textPattern: string;
+}
+/** How an image reference names the registry, the namespace and the tag when they are left out. */
+interface ImageReferenceKnowledge {
+  defaultHost: string;
+  /** Hosts that mean the default registry. */
+  hosts: readonly string[];
+  /** The namespace of the official images, implied when a Docker Hub name has no namespace. */
+  officialNamespace: string;
+  defaultTag: string;
+}
+/** The Dockerfile syntax the reader relies on. */
+interface DockerfileSyntaxKnowledge {
+  /** Starts a comment line, and a parser directive at the top of the file. */
+  comment: string;
+  /** The parser directive that sets the escape character, and the characters it accepts (the default first). */
+  escapeDirective: string;
+  escapeCharacters: readonly string[];
+  /** The only instruction allowed before the first FROM. */
+  globalArgInstruction: string;
+}
+/** An official runtime image: which tool version it ships and how its tags are built. */
+interface RuntimeImageKnowledge {
+  /** The repository name on Docker Hub, in the official namespace. */
+  image: string;
+  /** The tool the image ships as the runtime release bundles it, unchanged. */
+  bundles: 'npm' | 'pip';
+  /** Variant names a tag may carry after the version (22-alpine, 3.12-slim-bookworm), or on its own. */
+  variants: readonly string[];
+}
+/** Tags of an official image that move to another release line: tag (without variant) to release line. */
+interface MovingTagsKnowledge {
+  tags: Readonly<Record<string, string>>;
+}
+/**
+ * An npm package with install scripts whose effect is known (decision D-127), read in its source at the releases in
+ * `versions`: `not-needed` when the package works without the script, `project-task` when the script does a task of
+ * the project (installing git hooks) that the project can run in its own lifecycle script (`projectScript`).
+ */
+interface InstallScriptPackageKnowledge {
+  name: string;
+  /** The releases the source was read at. */
+  versions: readonly string[];
+  /** The install script, as the package declares it or as npm adds it, for messages. */
+  script: string;
+  kind: 'not-needed' | 'project-task';
+  /** What the script does, as a clause for messages ("it runs lefthook install, which installs the git hooks"). */
+  does: string;
+  /** What changes when the script does not run, as a clause for messages ("nothing changes"). */
+  withoutScript: string;
+  /**
+   * Without its install script the package can take its binary only from an optional dependency for the platform (the
+   * script fetches it otherwise), so a denied one fails where optional dependencies are left out.
+   */
+  needsOptionalDependencies: boolean;
+  /**
+   * project-task: how the project does the same task without the install script, as the package documents it for
+   * projects that do not use that script: a command to run after each clone of the repository (decision D-135).
+   */
+  projectStep?: {
+    command: string;
+    after: 'clone';
+  };
+}
 interface EnvironmentKnowledge {
   corepack: {
     packageManagerField: Fact<PackageManagerFieldKnowledge>;
     devEnginesSince: Fact<string>;
     envFileSince: Fact<string>;
     bundledWithNode: Fact<Versioned<boolean>>;
+    /** The npm package of Corepack, whose package.json declares the shims of the package managers (yarn, pnpm). */
+    package: Fact<string>;
+    /** The npm packages that install a package manager itself, for the tools Corepack knows. */
+    toolPackages: Fact<Readonly<Partial<Record<ToolId, readonly string[]>>>>;
+    /** lastKnownGood.json: the version of each package manager Corepack runs outside a project. */
+    defaults: Fact<CorepackDefaultsKnowledge>;
+    /** corepack enable installs an npm shim only when npm is named. */
+    enableNpm: Fact<{
+      command: string;
+      npmOnlyWhenNamed: boolean;
+    }>;
+    /**
+     * Installing Corepack where Node.js does not come with it (decision D-128): the npm package and the command; then
+     * corepack enable puts the shims on the path.
+     */
+    manualInstall: Fact<{
+      package: string;
+      command: string;
+      enable: string;
+    }>;
+  };
+  /** npm packages whose install scripts are known to be unneeded or to do a task of the project (decision D-127). */
+  installScriptPackages: Readonly<Record<string, Fact<InstallScriptPackageKnowledge>>>;
+  node: {
+    /** The npm each Node.js release bundles, per release line. */
+    bundledNpm: Fact<readonly BundledVersionsLine[]>;
+    releaseSchedule: Fact<readonly ReleaseLineSchedule[]>;
+    nvmrc: Fact<NvmrcKnowledge>;
+    /** The version file of nodenv, also read by fnm and setup-node. */
+    nodeVersionFile: Fact<{
+      file: string;
+    }>;
+    /** engines.node in package.json: the Node.js versions a package works with, advisory. */
+    engines: Fact<{
+      key: string;
+      runtimeKey: string;
+    }>;
+    /** The Node.js version files that version managers also use in subdirectories of their directory. */
+    inheritedVersionFiles: Fact<readonly string[]>;
+  };
+  docker: {
+    imageReference: Fact<ImageReferenceKnowledge>;
+    syntax: Fact<DockerfileSyntaxKnowledge>;
+    /** How COPY and ADD read a source path in the build context: from its root, with ../ and trailing slashes removed. */
+    copySources: Fact<{
+      relativeTo: 'context';
+      parentNavigation: 'removed';
+      trailingSlash: 'ignored';
+    }>;
+    /** ENV: variables for the later instructions of the stage and the stages that start from it (decision D-115). */
+    environment: Fact<{
+      instruction: string;
+      inheritedByStages: boolean;
+      spaceForm: boolean;
+    }>;
+    /** The default file name, and the suffix of other Dockerfiles (build.Dockerfile). */
+    dockerfileNames: Fact<{
+      defaultName: string;
+      suffix: string;
+    }>;
+    /** Dockerfile.<name>: a common convention without an official source. */
+    dockerfilePrefix: Fact<string>;
+    /** The file name Buildah and Podman read by default. */
+    containerfile: Fact<string>;
+    nodeImage: Fact<RuntimeImageKnowledge>;
+    nodeImageTags: Fact<MovingTagsKnowledge>;
+    pythonImage: Fact<RuntimeImageKnowledge>;
+    pythonImageTags: Fact<MovingTagsKnowledge>;
   };
   devEngines: Fact<DevEnginesKnowledge>;
   devEnginesSince: Fact<string>;
@@ -477,7 +969,32 @@ interface EnvironmentKnowledge {
   };
   githubActions: {
     workflows: Fact<WorkflowsKnowledge>;
+    /** The ids GitHub accepts as keys of jobs, as a regular expression (decision D-135). */
+    jobId: Fact<{
+      pattern: string;
+    }>;
     setupNode: Fact<SetupActionKnowledge>;
+    /** The versions node-version accepts besides semver ranges. */
+    setupNodeVersions: Fact<NodeVersionNamesKnowledge>;
+    setupNodeVersionFile: Fact<SetupNodeVersionFileKnowledge>;
+    /**
+     * jobs.<job_id>.container: the image the job's run steps run in, as a string or under image, with its env
+     * (decision D-115).
+     */
+    jobContainer: Fact<{
+      key: string;
+      imageKey: string;
+      envKey: string;
+    }>;
+    /** The env maps of a workflow, a job and a step; the most specific one wins (decision D-115). */
+    environmentKeys: Fact<{
+      key: string;
+      levels: readonly ('workflow' | 'job' | 'step')[];
+    }>;
+    /** Whether workflows may use YAML anchors and aliases, which GitHub expands (decision D-141). */
+    yamlAliases: Fact<{
+      accepted: boolean;
+    }>;
     pnpmActionSetup: Fact<SetupActionKnowledge>;
     pnpmSetup: Fact<SetupActionKnowledge>;
     setupBun: Fact<SetupActionKnowledge>;
@@ -512,11 +1029,36 @@ interface EnvironmentKnowledge {
     hooks: Fact<ClaudeCodeHooksKnowledge>;
     /** The tools whose PreToolUse events carry a shell command in the hooks fact's input.command. */
     shellTools: Fact<readonly ClaudeCodeShellTool[]>;
+    sessionStart: Fact<ClaudeCodeSessionStartKnowledge>;
+    /** The field of a PreToolUse hook's output that adds text to Claude's context, with or without a decision. */
+    hookContext: Fact<ClaudeCodeHookContextKnowledge>;
+    /** Shell tool calls without a command: a Monitor WebSocket watch. */
+    commandlessInputs: Fact<readonly ClaudeCodeCommandlessInputKnowledge[]>;
+  };
+  /** The Model Context Protocol, for depcurfew mcp, and how its clients start a stdio server. */
+  mcp: {
+    revisions: Fact<McpRevisionsKnowledge>;
+    lifecycle: Fact<McpLifecycleKnowledge>;
+    stateless: Fact<McpStatelessKnowledge>;
+    tools: Fact<McpToolsKnowledge>;
+    cancellation: Fact<McpCancellationKnowledge>;
+    errorCodes: Fact<McpErrorCodesKnowledge>;
+    errorId: Fact<McpErrorIdKnowledge>;
+    stdio: Fact<McpStdioKnowledge>;
+    clients: McpClientsKnowledge;
   };
   git: {
     /** Where git reads the patterns of files it does not pick up, and the index that lists the tracked files. */
     ignore: Fact<GitIgnoreKnowledge>;
     ignoreCase: Fact<GitIgnoreCaseKnowledge>;
+    /**
+     * The entry at the root of a working tree that makes a directory a repository of its own: a .git directory, or in
+     * a submodule a .git file pointing to its git directory in the superproject (decision D-115).
+     */
+    repositoryEntry: Fact<{
+      entry: string;
+      submoduleEntry: 'file';
+    }>;
   };
   windows: {
     commandShims: Fact<CommandShimsKnowledge>;
@@ -525,6 +1067,8 @@ interface EnvironmentKnowledge {
       extensions: readonly string[];
     }>;
   };
+  /** OSV.dev, for --osv (decision D-129). */
+  osv: OsvKnowledge;
   python: {
     /** How Python package names are compared: lowercased, with every run of these characters replaced by `replacement`. */
     nameNormalization: Fact<{
@@ -540,6 +1084,10 @@ interface EnvironmentKnowledge {
     /** File extensions of source distributions on an index, which are built when installed. */
     sourceDistributionExtensions: Fact<readonly string[]>;
     interpreter: Fact<PythonInterpreterKnowledge>;
+    /** A virtual environment made by venv: the file in its directory that marks it, and its activation scripts. */
+    virtualEnvironment: Fact<VirtualEnvironmentKnowledge>;
+    /** The pip each CPython release bundles in ensurepip, per release line. */
+    bundledPip: Fact<readonly BundledVersionsLine[]>;
     /** Hatch, which has no supply-chain settings of its own: how a project shows it uses Hatch. */
     hatch: Fact<{
       pyprojectTable: string;
@@ -547,7 +1095,7 @@ interface EnvironmentKnowledge {
     }>;
   };
 }
-type PackageManagerId = Extract<ToolId, 'npm' | 'pnpm' | 'yarn' | 'bun' | 'deno' | 'uv' | 'pip' | 'poetry' | 'pdm' | 'pipenv'>;
+type PackageManagerId = Extract<ToolId, 'npm' | 'pnpm' | 'yarn' | 'bun' | 'deno' | 'uv' | 'pip' | 'poetry' | 'pdm' | 'pipenv' | 'composer'>;
 type BotId = Extract<ToolId, 'renovate' | 'dependabot'>;
 /** Why a package manager is considered in use. Ordered from the strongest signal. */
 type EvidenceKind = 'lockfile' | 'packageManager' | 'devEngines' | 'config' | 'ci' | 'default';
@@ -556,18 +1104,140 @@ interface Evidence {
   /** Repository-relative path with `/` separators. */
   file: string;
 }
-/** tool-config: a version the tool's own configuration requires, e.g. required-version in [tool.uv]. */
-type VersionSource = 'packageManager' | 'tool-config' | 'devEngines' | 'volta' | 'tool-versions' | 'github-actions';
-/** A version declared somewhere in the repository, as written (it may be a range or an expression). */
+/**
+ * tool-config: a version the tool's own configuration requires, e.g. required-version in [tool.uv]. nvmrc and
+ * node-version: the files .nvmrc and .node-version; engines: engines.node in package.json (a range of the Node.js
+ * versions the package works on, advisory); dockerfile: a Dockerfile (FROM node:22, RUN npm install -g npm@11).
+ */
+type VersionSource = 'packageManager' | 'tool-config' | 'devEngines' | 'volta' | 'tool-versions' | 'nvmrc' | 'node-version' | 'engines' | 'github-actions' | 'dockerfile';
+/**
+ * A version declared somewhere in the repository, as written (it may be a range or an expression). A CI step that
+ * names a version file has `versionFile`, and also `version` when depcurfew could read the version from that file.
+ */
 type VersionDeclaration = ({
   version: string;
+  versionFile?: string;
 } | {
   versionFile: string;
 }) & {
   source: VersionSource;
   file: string;
   line?: number;
+  /** github-actions: the key of the job under jobs. */
+  job?: string;
+  /** github-actions: the line of the step that sets the version up; installs after it and before the next such step use it. */
+  step?: number;
+  /** github-actions: the version is one value of this matrix key, from ${{ matrix.<key> }}; the line is the value's. */
+  matrix?: string;
+  /** Why depcurfew does not read the version written (a matrix with too many values); the version is then as written. */
+  unknown?: string;
+  /** dockerfile: the build stage, by its name or its number from 0. */
+  stage?: string;
+  /**
+   * github-actions: the image of jobs.<id>.container (node:20) the version comes from, read like a FROM of a Dockerfile
+   * (decision D-115); the line is the image's, and it stands for the job's steps until a setup step.
+   */
+  container?: string;
 };
+/**
+ * A command in a CI run step or a Dockerfile RUN instruction. install: installs packages with the tool (npm ci,
+ * npm install, pip install -r requirements.txt, pnpm install, yarn, bun add); upgrade: replaces the tool itself
+ * (npm install -g npm@11.17.0, pip install --upgrade pip, corepack enable npm). npm install -g with another package is
+ * neither: npm does not read the project .npmrc in global mode.
+ */
+interface ToolCommand {
+  kind: 'install' | 'upgrade';
+  /**
+   * pnpm, Yarn and Bun only install (their versions come from packageManager and the setup actions); poetry only
+   * upgrades: pipx install poetry==2.3.0 or pip install poetry==2.3.0 installs that Poetry (decision D-115).
+   */
+  tool: 'npm' | 'pip' | 'pnpm' | 'yarn' | 'bun' | 'poetry';
+  /** upgrade: the version asked for as written, latest when none is; absent when the command does not say (corepack enable npm). */
+  version?: string;
+  /** npm ci and its aliases, which install exactly the versions of package-lock.json (decision D-115). */
+  lockfile?: true;
+  /** npm runs it with dependency install scripts off (--ignore-scripts, npm_config_ignore_scripts=true; decision D-115). */
+  scriptsOff?: true;
+  /**
+   * npm install: its command line and variables leave out optional dependencies (--omit=optional, --no-optional,
+   * npm_config_omit=optional) or keep them whatever .npmrc says (--include=optional); absent when they do not say
+   * (decision D-127).
+   */
+  optionalDependencies?: 'omitted' | 'kept';
+  /** pip install: the release-age delay it gets, as written (--uploaded-prior-to, PIP_UPLOADED_PRIOR_TO; decision D-115). */
+  delay?: string;
+  /** pip install: PIP_CONFIG_FILE names a file that may set the delay, or the value is a variable depcurfew does not read. */
+  delayUnknown?: true;
+  line: number;
+  /**
+   * A command that installs or runs Corepack comes before it in the same job (an earlier run step, or earlier in its
+   * own) or Dockerfile stage (an earlier RUN, or earlier in its own), also on the same line (decision D-141).
+   */
+  afterCorepack?: true;
+  /**
+   * github-actions: the working directory of the run step as written (working-directory of the step, or
+   * defaults.run.working-directory of the job or the workflow), without ./ and a trailing /, joined with the literal
+   * cd before the command (cd frontend && npm ci); absent for the root. dockerfile: the directory of a literal cd before
+   * the command, relative to the working directory of the instruction. A cd depcurfew does not follow ($DIR, an
+   * absolute path) gives a directory that is no project (decision D-115).
+   */
+  directory?: string;
+}
+/** A GitHub Actions job, with what its run steps do with npm and pip. */
+interface WorkflowJob {
+  file: string;
+  /** The key of the job under jobs. */
+  id: string;
+  line: number;
+  /** Installs and package manager changes, in order. */
+  commands: ToolCommand[];
+  /** A run step calls node, npm, npx, pnpm, yarn, bun or corepack, so the job uses the Node.js it sets up. */
+  runsNode: boolean;
+  /**
+   * A run step may change pip's configuration (pip config set, a pip.conf it writes, PIP_CONFIG_FILE in env), so the
+   * release-age delay of its pip installs cannot be told (decision D-115).
+   */
+  pipConfig?: true;
+  /** The line of the first run step command that installs Corepack (npm install -g corepack) or runs it (decision D-128). */
+  corepack?: number;
+}
+/** The official runtime image a build stage starts from. */
+interface StageRuntime {
+  tool: 'node' | 'python';
+  /** The tag as written after ARG substitution; absent when the image has none (latest, or a digest alone). */
+  tag?: string;
+  /** The version the tag names: 22, 22.11.0, lts, jod, latest (moving tags stay names); absent when it cannot be told. */
+  version?: string;
+  /** Why the version cannot be told. */
+  unknown?: string;
+}
+interface DockerStage {
+  /** The line of its FROM instruction. */
+  line: number;
+  /** The name after AS, in lower case. */
+  name?: string;
+  /** The image after ARG substitution; absent when an ARG it uses has no value. */
+  image?: string;
+  /** The earlier stage this one starts from (FROM <name>), by its number from 0. */
+  from?: number;
+  /** The official node or python image of this stage or of the stage it starts from. */
+  runtime?: StageRuntime;
+  commands: ToolCommand[];
+  /** A RUN may change pip's configuration (pip config set, a pip.conf it writes), as for jobs (decision D-115). */
+  pipConfig?: true;
+  /** The line of the first RUN command that installs Corepack (npm install -g corepack) or runs it (decision D-128). */
+  corepack?: number;
+  /**
+   * The source paths of the stage's COPY and ADD instructions that copy from the build context (not --from), as
+   * written; absent when there are none. A root Dockerfile whose stage copies only files of one directory listed in
+   * projects builds that project (decision D-109). At most 256.
+   */
+  copies?: string[];
+}
+interface DockerfileInfo {
+  file: string;
+  stages: DockerStage[];
+}
 interface PackageManagerInfo {
   id: PackageManagerId;
   /** Yarn only: Berry (2+) or Classic (1.x). */
@@ -595,9 +1265,18 @@ interface DetectionWarning {
   code: string;
   message: string;
   files: string[];
+  /** The line in the first file the warning is about, when it names one (decision D-124). */
+  line?: number;
 }
 interface Detection {
   packageManagers: PackageManagerInfo[];
+  /**
+   * Detected with the directories listed in projects (decision D-137): package managers only CI setup steps of the root
+   * show, while the root holds no manifest of their registry, or every install with them in its workflows runs in a
+   * listed directory and no Dockerfile of the root installs with them. The steps set them up for the projects, so they
+   * are no package managers of the root; the versions the steps install are still checked. Absent when there are none.
+   */
+  ciForProjects?: PackageManagerInfo[];
   node: {
     versions: VersionDeclaration[];
   };
@@ -607,6 +1286,10 @@ interface Detection {
   npmrcFiles: string[];
   /** GitHub Actions workflow files that were read. */
   workflows: string[];
+  /** The jobs of those workflows. */
+  jobs: WorkflowJob[];
+  /** Dockerfiles and Containerfiles of the root, its direct subdirectories without a manifest, and workspace packages. */
+  dockerfiles: DockerfileInfo[];
   warnings: DetectionWarning[];
 }
 interface UserEnvironment {
@@ -619,14 +1302,36 @@ interface UserEnvironment {
   /** Whether a directory exists; replaceable in tests. */
   isDirectory?: (path: string) => boolean;
 }
+/** fetch as depcurfew calls it: a GET of a registry or index, or the POST of a batch query to OSV.dev (--osv, decision D-129). */
 type FetchLike = (url: string, init: {
   headers: Record<string, string>;
   signal: AbortSignal;
   redirect?: 'manual';
+  method?: 'POST';
+  body?: string;
 }) => Promise<Response>;
-declare const EXIT_OK = 0;
-declare const EXIT_FAILURE = 1;
-declare const EXIT_USAGE = 2;
+/**
+ * Lookups shared by the checks of one run, by registry or index and name: a command checked against two policies
+ * fetches and reads each document once (decision D-113).
+ */
+type LookupCache = Map<string, Promise<unknown>>;
+interface McpLimits {
+  /** The longest line, in bytes; a longer one is answered with an error and skipped. */
+  lineBytes: number;
+  /** The deepest nesting of arrays and objects in a message. */
+  depth: number;
+  /** Tool calls that run at once. */
+  concurrentCalls: number;
+  /** Tool calls that wait for one of them; a call beyond that gets a result that says to try again. */
+  queuedCalls: number;
+  /** Messages in one batch (2025-03-26 only). */
+  batch: number;
+  /** How long calls may still run after stdin ends before they are stopped. */
+  graceMs: number;
+}
+export declare const EXIT_OK = 0;
+export declare const EXIT_FAILURE = 1;
+export declare const EXIT_USAGE = 2;
 interface CliIo {
   stdout(text: string): void;
   stderr(text: string): void;
@@ -641,18 +1346,41 @@ interface CliIo {
     stderr: boolean;
   };
 }
-interface CheckDependencies {
-  fetch: FetchLike;
-  now: () => Date;
-  /** The whole of stdin, for hook mode. */
-  stdin: () => Promise<string>;
-  /** The user's home directory, with the user's .npmrc. */
-  home?: () => string;
-  /** --user: platform, home directory and environment variables (tests replace them). */
-  userEnvironment?: () => UserEnvironment;
+/** What the server talks over and the process around it; tests replace it. */
+interface McpProcess {
+  input: Readable;
+  output: Writable;
+  env: Readonly<Record<string, string | undefined>>;
+  cwd: string;
+  /** Calls `stop` on SIGINT and SIGTERM; returns what removes the handlers. Left out in tests. */
+  onSignal?: (stop: () => void) => () => void;
+  limits?: Partial<McpLimits>;
+}
+declare class Repository {
+  #private;
+  readonly root: string;
+  readonly warnings: DetectionWarning[];
+  /** Repository-relative paths of the files that were read, for the log of what doctor checked. */
+  readonly read: Set<string>;
+  constructor(root: string);
+  warn(code: string, message: string, files: readonly string[], line?: number): void;
+  isFile(path: string): boolean;
+  /** Whether the path exists in the repository as something other than a regular file or a directory (a named pipe, a socket, a device). */
+  isSpecialFile(path: string): boolean;
+  /** The text of a file, without a byte order mark; undefined (with a warning when useful) if it cannot be read. */
+  readText(path: string, limit?: number): string | undefined;
+  /** The first bytes of a file, e.g. to recognize a lockfile format without reading a large file. */
+  readHead(path: string, bytes?: number): string | undefined;
+  /** Names of the files in a directory (following symlinks only inside the repository). */
+  listFiles(path: string): string[];
+  /** Names of the subdirectories of a directory, skipping node_modules, .git and symlinks that lead outside. */
+  listDirectories(path: string): string[];
+  /** Parses a file with the given parser, reporting failures as warnings. */
+  parse<T>(path: string, parser: (text: string) => T): T | undefined;
+  /** Like parse, but each file is read and parsed once per parser: several rules read the same file. */
+  parseOnce<T>(path: string, parser: (text: string) => T): T | undefined;
+  relative(absolute: string): string;
 }
-declare function run(argv: readonly string[], output: CliIo, dependencies?: CheckDependencies): Promise<number>;
-declare function getVersion(): string;
 interface Duration {
   /** The duration as written in the policy. */
   text: string;
@@ -666,8 +1394,8 @@ type DurationResult = {
   message: string;
 };
 /** Writes minutes with the largest unit that represents them exactly, e.g. 2160 → "36h". */
-declare function formatDuration(minutes: number): string;
-declare function parseDuration(input: string): DurationResult;
+export declare function formatDuration(minutes: number): string;
+export declare function parseDuration(input: string): DurationResult;
 interface Issue {
   /** Path to the field, e.g. `cooldown.exclude[2]`; `(root)` for the document itself. */
   path: string;
@@ -712,14 +1440,10 @@ interface Shape<In, Out = In> {
 }
 type Input<S> = S extends Shape<infer In, unknown> ? In : never;
 type Output<S> = S extends Shape<unknown, infer Out> ? Out : never;
+/** Which findings make depcurfew doctor exit with 1 (decision D-112). */
+declare const FAIL_ON_LEVELS: readonly ["error", "warning"];
 declare const policyShape: Shape<{
   version: 1;
-  $schema?: string;
-  cooldown?: {
-    minimum: string;
-    exclude?: readonly string[];
-    securityUpdates?: "bypass" | "delay";
-  };
   installScripts?: {
     default: "allow" | "deny";
     allow?: readonly string[];
@@ -731,16 +1455,21 @@ declare const policyShape: Shape<{
     file?: "allow" | "deny";
     directory?: "allow" | "deny";
   };
+  $schema?: string;
+  cooldown?: {
+    minimum: string;
+    exclude?: readonly string[];
+    securityUpdates?: "bypass" | "delay";
+  };
   targets?: "auto" | readonly ToolId[];
+  projects?: readonly string[];
+  doctor?: {
+    failOn?: "error" | "warning";
+  };
 }, {
   version: 1;
   targets: "auto" | readonly ToolId[];
-  $schema?: string;
-  cooldown?: {
-    minimum: Duration;
-    exclude: readonly string[];
-    securityUpdates: "bypass" | "delay";
-  };
+  projects: readonly string[];
   installScripts?: {
     default: "allow" | "deny";
     allow: readonly string[];
@@ -752,203 +1481,27 @@ declare const policyShape: Shape<{
     file?: "allow" | "deny";
     directory?: "allow" | "deny";
   };
+  $schema?: string;
+  cooldown?: {
+    minimum: Duration;
+    exclude: readonly string[];
+    securityUpdates: "bypass" | "delay";
+  };
+  doctor?: {
+    failOn?: "error" | "warning";
+  };
 }>;
 /** The policy as written in depcurfew.json. */
 type Policy = Input<typeof policyShape>;
 /** The policy after validation: defaults filled in, durations parsed. */
 type ResolvedPolicy = Output<typeof policyShape>;
-declare const APPLY_WARNINGS: {
-  readonly 'nothing-to-configure': "depcurfew found no supported package manager or bot, so nothing is configured.";
-  readonly 'environment-overrides': "apply --user: an environment variable makes a tool read another user file or none, or overrides a value apply writes there.";
-  readonly 'depcurfew-outdated': "The project installs a newer depcurfew than the one running, which may not know settings that version writes.";
-  readonly 'file-unreadable': "A file that shows which tools a project uses cannot be read or parsed (too large, a symlink out of the repository, no read permission, invalid), so depcurfew may configure fewer tools than the project uses.";
-  readonly 'tool-not-supported': "A detected or installed tool is not supported (Yarn Classic), so nothing is written for it.";
-  readonly 'tool-only-in-ci': "A tool appears only in a CI setup step, with no manifest, lockfile or configuration in the repository, so targets \"auto\" does not configure it.";
-  readonly 'version-not-pinned': "No exact version of a package manager is pinned, so depcurfew configures for the latest version it knows.";
-  readonly 'version-too-old': "The pinned version of a tool (with apply --user, the installed one) lacks a setting the policy needs, so that setting is not written.";
-  readonly 'version-unknown': "apply --user: the installed version of a tool cannot be read from its files, and a value it does not understand would stop every command, so nothing is written for it.";
-  readonly 'no-user-config': "apply --user: the tool has no user-level configuration file, so nothing is written for it.";
-  readonly 'user-setting-project-only': "apply --user: the tool reads a part of the policy only from project files, so it is not written into the user file.";
-  readonly 'user-directory-relative': "apply --user: the environment variable that names the directory of the user file (XDG_CONFIG_HOME, APPDATA) is a relative path, so the tool looks in another place from each directory, or where it looks then is not known; nothing is written for it.";
-  readonly 'user-setting-overridden': "apply --user: a file the tool reads ahead of its user file (~/.npmrc for pnpm 10) sets a key apply writes there to another value, so the value written has no effect.";
-  readonly 'version-not-used': "apply --user: --for gives the version of a tool that apply --user does not configure (not in PATH with targets \"auto\", or not listed under targets).";
-  readonly 'cooldown-not-written': "The release-age delay cannot be written for a tool.";
-  readonly 'cooldown-shortened': "A release-age delay set outside depcurfew's markers (in JSON files also one an earlier apply wrote) is longer than the policy, and apply replaces it with the shorter one.";
-  readonly 'cooldown-environment-only': "pip reads no project configuration, so the release-age delay has to be set in the environment where pip runs.";
-  readonly 'exclude-pattern-unsupported': "A cooldown exception uses a wildcard the tool does not support, so it is not written.";
-  readonly 'exclude-unsupported': "The tool has no setting for cooldown exceptions, so the release-age delay applies to every package.";
-  readonly 'allow-pattern-unsupported': "An installScripts.allow entry is a pattern, but the tool takes package names only, so it is not written.";
-  readonly 'deny-pattern-unsupported': "An installScripts.deny entry is a pattern, but the tool records denials by package name only, so it is not written.";
-  readonly 'allow-all-unsupported': "The tool has no setting that allows every install script, so installScripts \"allow\" is not written.";
-  readonly 'allow-all-replaced': "A setting that allowed every install script (with any value the tool reads as true, also one that a YAML merge key brings in, or pnpm 10's dangerously-allow-all-builds in .npmrc) was set to false, because the policy denies install scripts.";
-  readonly 'allow-list-entry-outside-policy': "An install-script allow-list in the repository (with apply --user, in a user file) lets a package run scripts the policy does not allow; apply does not remove it.";
-  readonly 'deny-conflicts-with-file': "An entry in a tool's own list lets a package of installScripts.deny run its install scripts, or blocks a package of installScripts.allow; apply does not change entries it did not write.";
-  readonly 'unexpected-value': "A setting apply adds to has a value of a type the tool does not accept there, so apply leaves it as it is and writes nothing into it.";
-  readonly 'built-in-list-replaced': "Bun's built-in list of trusted packages is replaced by the policy's allow-list.";
-  readonly 'scripts-not-enforceable': "The pinned (with apply --user, the installed) npm or pnpm runs every install script and has no allow-list, so \"deny\" cannot be enforced.";
-  readonly 'before-overrides-cooldown': "before= in .npmrc takes the place of the release-age delay apply writes, or makes npm stop with an error next to it (apply --user then does not write the delay).";
-  readonly 'exact-version-gap': "The pinned (with apply --user, the installed) pnpm skips the release-age delay for packages requested by exact version.";
-  readonly 'source-not-enforceable': "The tool has no setting for a dependency source the policy denies; doctor checks the lockfile instead.";
-  readonly 'source-switch-indirect-only': "The pnpm setting for git and tarball sources stops them only for indirect dependencies.";
-  readonly 'source-switch-combined': "One pnpm setting covers git and tarball sources, so denying one denies both.";
-  readonly 'forced-source-build': "Python packages on the allow-list are always built from source, because no tool can only allow a build.";
-  readonly 'build-switch-scope': "The tool's switch forbids building only packages from an index; git, local and archive dependencies are still built.";
-  readonly 'build-switch-install-only': "Poetry applies its build switch when installing; poetry lock may still build source distributions.";
-  readonly 'build-switch-environment-only': "The tool has no project setting that forbids building from source, so it has to be set in the environment where the tool runs.";
-  readonly 'requirements-file-missing': "There is no requirements file to write pip options into.";
-  readonly 'manifest-missing': "A setting belongs in a project manifest (package.json, deno.json, pyproject.toml, Pipfile) that does not exist, and apply does not create manifests.";
-  readonly 'lockfile-out-of-date': "The lockfile records, or is checked against, a setting apply changed, so it has to be locked again.";
-  readonly 'file-ignored-by-git': "A file apply writes matches a .gitignore rule, so the change may never reach the repository.";
-  readonly 'bot-config-missing': "A bot has no configuration file, and depcurfew does not create one.";
-  readonly 'bot-config-not-edited': "A bot configuration file is in a place or format depcurfew does not edit; a snippet shows what to add.";
-  readonly 'bot-entries-missing': "The Dependabot configuration has no entries for the package managers in use.";
-  readonly 'security-delay-unsupported': "Dependabot cannot delay security updates, so securityUpdates \"delay\" is not applied.";
-};
-declare const APPLY_ERRORS: {
-  readonly 'cannot-edit': "A file cannot be read or edited safely (invalid syntax, a symlink, a style depcurfew does not edit), so nothing is written.";
-  readonly 'cannot-write': "A file cannot be written (no permission, a read-only file system, a full disk, a directory or symlink in its place); the files already written are put back, so nothing changes.";
-  readonly 'policy-missing': "The directory has no depcurfew.json.";
-  readonly 'policy-invalid': "depcurfew.json does not follow the schema; issues lists the problems.";
-  readonly 'policy-unreadable': "depcurfew.json cannot be read.";
-  readonly 'policy-exists': "depcurfew init found a depcurfew.json and writes it only with --force.";
-  readonly 'directory-not-found': "The directory given on the command line does not exist or cannot be opened.";
-  readonly 'not-a-directory': "The path given on the command line is a file, not a directory.";
-  readonly 'home-missing': "apply --user and init --user: the home directory (HOME, USERPROFILE on Windows) does not exist or is not an absolute path, so nothing is written.";
-};
-type ApplyWarningCode = keyof typeof APPLY_WARNINGS;
-type ApplyErrorCode = keyof typeof APPLY_ERRORS;
-interface ApplyWarning {
-  code: ApplyWarningCode;
-  /** The tool it concerns, when there is one. */
-  tool?: ToolId;
-  /** The file it concerns, when there is one, and the line when it is known. */
-  location?: {
-    file: string;
-    line?: number;
-  };
-  /** What happened, for people; it starts with the tool's name when it concerns one. */
-  message: string;
-  /** What to do about it, when there is something to do. */
-  fix?: string;
-}
-/** A warning as one line of text, as ApplyReport.warnings has it. */
-declare function warningText(warning: ApplyWarning): string;
-interface FileChange {
-  /** Repository-relative path with `/` separators. */
-  file: string;
-  /** null for a new file. */
-  before: string | null;
-  after: string;
+interface SimilarName {
+  /** The popular package the name resembles. */
+  match: string;
+  /** edit: a letter or two differ; separators: only -, _ or . differ. */
+  reason: 'edit' | 'separators';
 }
-/**
- * A file could not be written. writeChanges has removed its temporary files and put back the files it had already
- * replaced, so nothing changed, except for the files in `unrestored` (whose earlier text is in `backups` when it could
- * be written) and the temporary files in `leftovers`. The message says why, without the file name.
- */
-declare class WriteFailed extends Error {
-  readonly file: string;
-  /** Why, in plain words. */
-  readonly reason: string;
-  /** Files already replaced that could not be put back (normally none). */
-  readonly unrestored: string[];
-  /** For files in `unrestored`: the temporary file, next to it, that holds its earlier text. */
-  readonly backups: Readonly<Record<string, string>>;
-  /** Temporary files that could not be removed, named like `file` (relative to the root, or as WriteOptions.name says). */
-  readonly leftovers: string[];
-  /** Another program holds the file, or (on Windows) it is read-only. */
-  readonly busy: boolean;
-  readonly platform: NodeJS.Platform;
-  constructor(file: string, error: unknown, unrestored: string[], details?: {
-    platform?: NodeJS.Platform;
-    backups?: Record<string, string>;
-    leftovers?: string[];
-  });
-}
-interface Snippet {
-  tool: ToolId;
-  file: string;
-  text: string;
-}
-/** A file a generator could not read or edit; nothing is written when there is one. */
-interface EditFailure {
-  tool: ToolId;
-  file: string;
-  message: string;
-}
-interface ApplyReport {
-  changes: FileChange[];
-  /** The warnings as one line of text each. */
-  warnings: string[];
-  /** The same warnings with a code, the tool, the file and what to do (apply --json). */
-  warningDetails: ApplyWarning[];
-  snippets: Snippet[];
-  /** Files that could not be edited, as messages. When there are any, nothing is written. */
-  errors: string[];
-  /** The same failures with the tool and the file. */
-  failures: EditFailure[];
-}
-/** The bots' delay: the policy's, or longer if a package manager rounded its delay up further. */
-declare function botDuration(policy: Duration, managerMinutes: readonly number[]): Duration;
-/** Computes every change without writing anything. */
-declare function planApply(root: string, policy: ResolvedPolicy, detection: Detection, tools?: readonly ToolKnowledge[]): ApplyReport;
-declare class PolicyError extends Error {
-  readonly issues: string[];
-  readonly code: ApplyErrorCode;
-  /** What to do, when the message does not say it. */
-  readonly fix: string | undefined;
-  constructor(message: string, issues?: string[], code?: ApplyErrorCode, fix?: string);
-  /** The message and what to do, as one line of text. */
-  get text(): string;
-}
-declare function loadPolicy(root: string): ResolvedPolicy;
-/**
- * A file could not be written (code cannot-write). The files apply had already replaced were put back, so the
- * repository is as it was, unless `unrestored` lists files. `report` is the plan that was being written.
- */
-declare class ApplyWriteError extends Error {
-  readonly code: "cannot-write";
-  /** The file that could not be written, relative to the repository. */
-  readonly file: string;
-  /** What to do. */
-  readonly fix: string;
-  /** Files already replaced that could not be put back (normally none). */
-  readonly unrestored: string[];
-  readonly report: ApplyReport;
-  /**
-   * `command` is what the fix tells the user to run again (depcurfew apply --user for user files), and
-   * `versionControl` whether the files may be in version control, to restore them from.
-   */
-  constructor(failure: WriteFailed, report: ApplyReport, options?: {
-    command?: string;
-    versionControl?: boolean;
-  });
-}
-/**
- * Reads the policy, detects the project, plans the changes and (unless told otherwise) writes them. If any file
- * could not be edited, nothing is written, so a run either applies the whole policy or leaves the repository as it was.
- * A file that cannot be written throws ApplyWriteError after the files already written are put back.
- */
-declare function applyProject(root: string, options?: {
-  write?: boolean;
-}): ApplyReport;
-interface DiffOptions {
-  /** Shows the values of secrets as <redacted> in every line (redactSecrets), for a diff that people or logs see. */
-  redact?: boolean;
-}
-/**
- * A unified diff with three lines of context; empty when the texts are equal. `before` is null for a new file.
- * Control characters in the file name are shown as text (printable), so that a name cannot start a line of its own
- * and forge a header or a hunk. A file with an absolute path (a user file outside the home directory) is named as it
- * is, without the a/ and b/ of repository paths.
- */
-declare function unifiedDiff(file: string, before: string | null, after: string, context?: number, options?: DiffOptions): string;
-interface SimilarName {
-  /** The popular package the name resembles. */
-  match: string;
-  /** edit: a letter or two differ; separators: only -, _ or . differ. */
-  reason: 'edit' | 'separators';
-}
-declare class PopularNames {
+export declare class PopularNames {
   #private;
   constructor(names: readonly string[]);
   has(name: string): boolean;
@@ -956,7 +1509,9 @@ declare class PopularNames {
   similar(name: string): SimilarName | undefined;
 }
 type SpecKind = 'registry' | 'git' | 'remoteTarball' | 'file' | 'directory' | 'workspace' | 'other';
-type FindingCode = 'invalid-spec' | 'forbidden-source' | 'unchecked-source' | 'unverified' | 'not-found' | 'no-version' | 'too-young' | 'install-scripts' | 'similar-name' | 'deprecated' | 'yanked' | 'archived' | 'quarantined' | 'insecure-registry';
+type FindingCode = 'invalid-spec' | 'forbidden-source' | 'unchecked-source' | 'unverified' | 'not-found' | 'no-version' | 'too-young' | 'install-scripts' | 'similar-name' | 'deprecated' | 'yanked' | 'archived' | 'quarantined' | 'insecure-registry' |
+/** --osv: OSV.dev has a record of the OpenSSF malicious-packages database for the version (decision D-129). */
+'known-malicious';
 interface CheckFinding {
   level: 'error' | 'warning';
   code: FindingCode;
@@ -985,6 +1540,8 @@ interface PackageReport {
 /** A spec with what the install command changes about the version or the build. */
 interface CheckRequest {
   spec: string;
+  /** The package manager of the command, when a command names one (the hook): its own registry settings apply. */
+  tool?: ToolId;
   /** npm: the dist-tag npm prefers for a name without a version or with a range; the registry's default when left out. */
   tag?: string;
   /** The package manager is not npm, so tag= in .npmrc (CheckOptions.defaultTag) does not choose its version. */
@@ -993,6 +1550,35 @@ interface CheckRequest {
   prereleases?: 'allow' | 'deny';
   /** Python: the package is built from source even when it has wheels (true), or only wheels are used (false). */
   buildFromSource?: boolean;
+  /**
+   * npm: the command line has an option that may set workspaces (--no-workspaces, --workspaces=false), with which npm
+   * reads the .npmrc of a workspace package as its project configuration (decision D-124).
+   */
+  workspacesOption?: boolean;
+  /**
+   * Composer (decision D-133): the command does not read the composer.json of the directory it runs in (create-project,
+   * global), so the repositories declared there do not apply to it.
+   */
+  readsManifest?: false;
+  /**
+   * Composer: composer update names the package without a constraint, so the constraint the root composer.json
+   * requires applies; a package that composer.json does not require is not checked.
+   */
+  fromManifest?: true;
+  /**
+   * Composer (decision D-136): the command word as written and the command of Composer it stands for, when it is not
+   * that command's exact name (an alias, an abbreviation, another case), so that the scripts of the composer.json the
+   * command runs with, which Composer then registers as commands, may make it stand for a script or for nothing.
+   */
+  composerCommand?: {
+    word: string;
+    command: string;
+  };
+  /**
+   * Composer: picks the version at the minimum stability stable, without the minimum-stability and prefer-stable of
+   * the root composer.json, for a file of a parent directory that Composer may not use (decision D-142).
+   */
+  rootStability?: false;
 }
 interface CheckOptions {
   policy: ResolvedPolicy;
@@ -1013,63 +1599,55 @@ interface CheckOptions {
    * written by the package's publisher and should not reach the model as part of depcurfew's reason.
    */
   scriptBodies?: boolean;
+  /** Stops the lookups: checkSpecs then rejects with the signal's reason (a cancelled call of depcurfew mcp). */
+  signal?: AbortSignal;
+  /** Lookups shared with other checks of the same run (the two policies of the hook), by registry and name. */
+  lookups?: LookupCache;
+  /**
+   * npm packages not to look up: their scope's registry is set in a file depcurfew does not take (decision D-113), so
+   * the name may be private and the public registry may hold a look-alike. The package is reported as unverified.
+   */
+  skipLookup?: (name: string, tool: ToolId | undefined, request?: Omit<CheckRequest, 'spec'>) => boolean;
+  /**
+   * Composer: minimum-stability and prefer-stable of the root composer.json (decision D-136), for the requests that read
+   * it; without them, the defaults (stable, prefer-stable off).
+   */
+  composerStability?: {
+    minimum?: string;
+    preferStable: boolean;
+    file: string;
+  };
 }
-declare function checkSpec(request: string | CheckRequest, options: CheckOptions): Promise<PackageReport>;
-/** Checks the specs a few at a time; the reports keep the order of the specs. */
-declare function checkSpecs(specs: readonly (string | CheckRequest)[], options: CheckOptions): Promise<PackageReport[]>;
-interface InstallRequest {
-  tool: ToolId;
-  /** The command as written, for messages. */
-  command: string;
-  spec: string;
-  /** npm: the dist-tag the command makes npm prefer (--tag, npm_config_tag). */
-  tag?: string;
-  /** Python: the command allows pre-releases of the package, or forbids them; left out, the tool's default applies. */
-  prereleases?: 'allow' | 'deny';
-  /** Python: the command makes the tool build the package from source (true) or install wheels only (false). */
-  buildFromSource?: boolean;
-}
-interface CommandScan {
-  requests: InstallRequest[];
-  /** Why an install command could not be read; undefined when every one could. */
-  unreadable: string | undefined;
+/** A package version to look up; `ecosystem` is depcurfew's (npm, pypi, packagist), whose names the policy writes without a prefix, with pypi: and with composer:. */
+interface OsvPackage {
+  ecosystem: string;
+  name: string;
+  version: string;
 }
-interface ScanOptions {
-  /** The shell that runs the line: a POSIX shell (the default; also Git Bash) or PowerShell. */
-  shell?: 'posix' | 'powershell';
+/** What OSV.dev says about one version: the ids of its MAL- records (none: no known malware), or why it was not checked. */
+type OsvVerdict = {
+  status: 'checked';
+  malicious: string[];
+} | {
+  status: 'unchecked';
+  reason: string;
+};
+interface OsvOptions {
+  fetch: FetchLike;
+  signal?: AbortSignal | undefined;
+  /** Per request; OSV_TIMEOUT_MS when left out. */
+  timeoutMs?: number;
+  /** Largest answer read; the response limit of OSV.dev over HTTP/1.1 when left out. */
+  maxBytes?: number;
+  /** Most distinct versions looked up in one run; the others stay unchecked. MAX_OSV_PACKAGES when left out. */
+  limit?: number;
 }
-/** The packages a command line installs or downloads to run with npm, pnpm, Yarn, Bun, Deno, pip, uv, Poetry, PDM, Pipenv or pipx. */
-declare function scanCommandLine(line: string, options?: ScanOptions): CommandScan;
 /**
- * Describes the repository at `root`. Never executes anything from the repository and never leaves it;
- * problems with individual files become warnings.
+ * What OSV.dev says about each package version, in the order given. Each distinct version is asked about once; the
+ * batches go one after the other, and once one fails the rest is not asked (OSV.dev is out of reach, or answers
+ * wrong), so every version left is unchecked with that reason. When `options.signal` aborts, the promise rejects.
  */
-declare function detectProject(root: string, tools?: readonly ToolKnowledge[], environment?: EnvironmentKnowledge): Detection;
-declare class Repository {
-  #private;
-  readonly root: string;
-  readonly warnings: DetectionWarning[];
-  /** Repository-relative paths of the files that were read, for the log of what doctor checked. */
-  readonly read: Set<string>;
-  constructor(root: string);
-  warn(code: string, message: string, files: readonly string[]): void;
-  isFile(path: string): boolean;
-  /** Whether the path exists in the repository as something other than a regular file or a directory (a named pipe, a socket, a device). */
-  isSpecialFile(path: string): boolean;
-  /** The text of a file, without a byte order mark; undefined (with a warning when useful) if it cannot be read. */
-  readText(path: string, limit?: number): string | undefined;
-  /** The first bytes of a file, e.g. to recognize a lockfile format without reading a large file. */
-  readHead(path: string, bytes?: number): string | undefined;
-  /** Names of the files in a directory (following symlinks only inside the repository). */
-  listFiles(path: string): string[];
-  /** Names of the subdirectories of a directory, skipping node_modules, .git and symlinks that lead outside. */
-  listDirectories(path: string): string[];
-  /** Parses a file with the given parser, reporting failures as warnings. */
-  parse<T>(path: string, parser: (text: string) => T): T | undefined;
-  /** Like parse, but each file is read and parsed once per parser: several rules read the same file. */
-  parseOnce<T>(path: string, parser: (text: string) => T): T | undefined;
-  relative(absolute: string): string;
-}
+export declare function queryOsv(packages: readonly OsvPackage[], options: OsvOptions): Promise<OsvVerdict[]>;
 /** The SARIF levels: an error fails `doctor`, warnings and notes do not. */
 type Level = 'error' | 'warning' | 'note';
 interface Location {
@@ -1077,6 +1655,8 @@ interface Location {
   file: string;
   /** 1-based; absent when the finding concerns the whole file. */
   line?: number;
+  /** 1-based column on `line`, when the problem has one (a syntax error); absent otherwise (decision D-116). */
+  column?: number;
   /** doctor --user: the environment variable, as it is set, of a finding whose file is "environment". */
   variable?: string;
 }
@@ -1088,10 +1668,23 @@ interface Finding {
   /** A fix for this finding; the rule's general help applies when absent. */
   fix?: string;
 }
-/** Something doctor could not check, such as an unreadable file. Not a problem in the repository itself. */
+/**
+ * Something doctor could not check, such as an unreadable file. Not a problem in the repository itself, so it never
+ * fails doctor. It has the fields of a finding (decision D-116): the level, always note; a code, the rule that could not
+ * check something or the code of the warning or state that gave it; where it is; the message; and what to do.
+ */
 interface Notice {
+  level: 'note';
+  code: string;
   message: string;
+  /** The file it concerns, the same as location.file; kept for programs that read it before location was added. */
   file?: string;
+  /** The line, when the notice is about one (a CI run step or RUN instruction depcurfew did not follow, decision D-124). */
+  location?: {
+    file: string;
+    line?: number;
+  };
+  fix?: string;
 }
 interface RuleContext {
   root: string;
@@ -1103,8 +1696,43 @@ interface RuleContext {
   report(finding: Omit<Finding, 'rule' | 'level'> & {
     level?: Level;
   }): void;
-  notice(message: string, file?: string): void;
+  /** Something the rule could not check; its code is the rule's id (decision D-116). */
+  notice(message: string, file?: string, fix?: string): void;
+  /**
+   * Set when the rules run on a directory listed in projects in depcurfew.json (decision D-100): its path relative to
+   * the repository root. `root`, `repository` and `detection` are then the project's, and file names relative to it.
+   */
+  project?: string;
+  /**
+   * At the repository root: the directories listed in projects that could be read, for the rules that compare the
+   * bots, which are configured from the root, with the package managers of every project.
+   */
+  projects?: readonly ProjectView[];
+  /** How apply plans this directory, for the rules that compare with that plan (config-drift). */
+  plan?: PlanOptions;
+  /** doctor --osv (decision D-129): absent without it; see OsvDoctor. */
+  osv?: OsvDoctor;
 }
+/**
+ * What known-malicious gets with --osv: a list to fill with the locked versions (the first run, before OSV.dev is
+ * asked), or the answers of OSV.dev by osvKey (the second run, which reports).
+ */
+type OsvDoctor = {
+  collect: OsvPackage[];
+} | {
+  answers: ReadonlyMap<string, OsvVerdict>;
+};
+/** A directory listed in projects, as the rules at the repository root see it. */
+interface ProjectView {
+  /** Relative to the repository root, as listed. */
+  directory: string;
+  /** The absolute path. */
+  root: string;
+  repository: Repository;
+  detection: Detection;
+}
+/** What a rule may look at to decide whether it concerns the project: the context without the reporting functions. */
+type RuleScope = Omit<RuleContext, 'report' | 'notice'>;
 interface Rule {
   /** Stable kebab-case identifier, used in SARIF and in the documentation. */
   id: string;
@@ -1120,23 +1748,38 @@ interface Rule {
   level: Level;
   /** Rules that compare the repository with depcurfew.json do not run without one. */
   requiresPolicy: boolean;
+  /**
+   * Whether the rule concerns the project at all, from detection: the Python rules without a Python tool, the bot rules
+   * without a bot. false shows the rule as "not applicable" in the list of what doctor checked (decision D-098). It
+   * never changes findings: check still runs, and a rule that reports one has problems. Absent: it always applies.
+   */
+  applies?(scope: RuleScope): boolean;
   check(context: RuleContext): void;
 }
 /** A package manager or bot doctor checked, with the version it checked against when one is known. */
 interface CheckedTool {
   id: string;
   name: string;
+  /** The directory listed in projects the tool was found in; absent for the repository root. */
+  project?: string;
   version?: string;
   /** Where the version comes from: a repository file, or PATH for doctor --user. */
   versionFrom?: string;
+  /** A bot configuration in a directory listed in projects, which the bot does not read (it reads the root's, decision D-109). */
+  unread?: true;
+  /** A package manager that a CI setup step of the root sets up for the directories listed in projects (decisions D-137 and D-141). */
+  setUpInCi?: true;
 }
 /** One check of the list of what doctor checked: a rule and what came of it. */
 interface RuleResult {
   rule: string;
   /** What the rule checks, in plain words (Rule.check). */
   check: string;
-  /** passed: it ran and found nothing; problems: it reported findings; skipped: it needs a policy that is missing or invalid. */
-  result: 'passed' | 'problems' | 'skipped';
+  /**
+   * passed: it ran and found nothing; problems: it reported findings; skipped: it needs a policy that is missing or
+   * invalid; not-applicable: it does not concern the project, e.g. a Python rule without a Python tool (decision D-098).
+   */
+  result: 'passed' | 'problems' | 'skipped' | 'not-applicable';
   errors: number;
   warnings: number;
   notes: number;
@@ -1160,8 +1803,285 @@ interface DoctorReport {
   /** What was checked. */
   checked?: Checked;
 }
-/** Every doctor rule, in the order they are documented. unreadable-config runs last, after every other rule has read its files. */
-declare const RULES: readonly Rule[];
+/** What a directory listed in projects takes from the repository root besides its CI installs (decision D-109). */
+interface RootPlaces {
+  /** The project; the stages of root Dockerfiles are then read for it (decision D-115). */
+  project?: string;
+  /** The root's Node.js version files (.nvmrc, .node-version, .tool-versions) of the kinds the project has none of. */
+  versions: readonly VersionDeclaration[];
+  /**
+   * Root Dockerfiles with the stages that build the project (they copy only its files, decision D-109) or install in its
+   * directory after copying the whole build context (cd frontend && npm ci, decision D-115).
+   */
+  dockerfiles: readonly {
+    file: DockerfileInfo;
+    stages: readonly number[];
+  }[];
+}
+export declare const APPLY_WARNINGS: {
+  readonly 'nothing-to-configure': "depcurfew found no supported package manager or bot, so nothing is configured.";
+  readonly 'environment-overrides': "apply --user: an environment variable makes a tool read another user file or none, or overrides a value apply writes there.";
+  readonly 'depcurfew-outdated': "The project installs a newer depcurfew than the one running, which may not know settings that version writes.";
+  readonly 'file-unreadable': "A file that shows which tools a project uses cannot be read or parsed (too large, a symlink out of the repository, no read permission, invalid), so depcurfew may configure fewer tools than the project uses.";
+  readonly 'tool-not-supported': "A detected or installed tool is not supported (Yarn Classic), so nothing is written for it.";
+  readonly 'target-not-found': "With projects, a package manager listed under targets is configured in each directory (the root or a project) that uses it, and none uses it, so nothing is written for it.";
+  readonly 'tool-only-in-ci': "A tool appears only in a CI setup step, with no manifest, lockfile or configuration in the repository, so targets \"auto\" does not configure it.";
+  readonly 'version-not-pinned': "No exact version of a package manager is pinned, so depcurfew configures for the latest version it knows.";
+  readonly 'version-too-old': "The pinned version of a tool (with apply --user, the installed one) lacks a setting the policy needs, so that setting is not written.";
+  readonly 'version-unknown': "apply --user: the installed version of a tool cannot be read from its files, and a value it does not understand would stop every command, so nothing is written for it.";
+  readonly 'no-user-config': "apply --user: the tool has no user-level configuration file, so nothing is written for it.";
+  readonly 'user-setting-project-only': "apply --user: the tool reads a part of the policy only from project files, so it is not written into the user file.";
+  readonly 'user-directory-relative': "apply --user: the environment variable that names the directory of the user file (XDG_CONFIG_HOME, APPDATA) is a relative path, so the tool looks in another place from each directory, or where it looks then is not known; nothing is written for it.";
+  readonly 'user-file-uncertain': "apply --user: a library the tool calls decides where its user file is (platformdirs for Poetry and PDM on macOS), and its version cannot be read from files, so apply --user writes where the tool's docs say and names the other files the tool may read.";
+  readonly 'user-setting-overridden': "apply --user: a file the tool reads ahead of its user file (~/.npmrc for pnpm 10) sets a key apply writes there to another value, so the value written has no effect.";
+  readonly 'version-not-used': "apply --user: --for gives the version of a tool that apply --user does not configure (not in PATH with targets \"auto\", or not listed under targets).";
+  readonly 'cooldown-not-written': "The release-age delay cannot be written for a tool.";
+  readonly 'cooldown-shortened': "A release-age delay set outside depcurfew's markers (in JSON files also one an earlier apply wrote) is longer than the policy, and apply replaces it with the shorter one.";
+  readonly 'cooldown-environment-only': "pip reads no project configuration, so the release-age delay has to be set in the environment where pip runs.";
+  readonly 'exclude-pattern-unsupported': "A cooldown exception uses a wildcard the tool does not support, so it is not written.";
+  readonly 'exclude-unsupported': "The tool has no setting for cooldown exceptions, so the release-age delay applies to every package.";
+  readonly 'exclude-not-written': "The setting that holds the cooldown exceptions (Composer's config.policy.cooldown.ignore) has a value of a type the tool does not accept there, so apply leaves it as it is and does not add the exceptions; the release-age delay is written.";
+  readonly 'exclude-entry-outside-policy': "A cooldown exception in a file without depcurfew's markers (Composer's config.policy.cooldown.ignore) exempts a package that cooldown.exclude does not; apply removes only the entries it wrote, recognised by their reason, and leaves this one.";
+  readonly 'allow-pattern-unsupported': "An installScripts.allow entry is a pattern, but the tool takes package names only, so it is not written.";
+  readonly 'deny-pattern-unsupported': "An installScripts.deny entry is a pattern, but the tool records denials by package name only, so it is not written.";
+  readonly 'allow-all-unsupported': "The tool has no setting that allows every install script, so installScripts \"allow\" is not written.";
+  readonly 'allow-all-replaced': "A setting that allowed every install script (with any value the tool reads as true, also one that a YAML merge key brings in, or pnpm 10's dangerously-allow-all-builds in .npmrc) was set to false, or replaced with the policy's allow-list where the setting is the list itself (Deno's allowScripts, Composer's allow-plugins, which then may be {}), because the policy denies install scripts.";
+  readonly 'allow-list-entry-outside-policy': "An install-script allow-list in the repository (with apply --user, in a user file) lets a package run scripts the policy does not allow; apply does not remove it.";
+  readonly 'deny-conflicts-with-file': "An entry in a tool's own list lets a package of installScripts.deny run its install scripts, or blocks a package of installScripts.allow; apply does not change entries it did not write.";
+  readonly 'deny-needs-optional-dependencies': "A package of installScripts.deny takes its binary from an optional dependency (esbuild), but npm leaves optional dependencies out (omit=optional or optional=false in .npmrc, --omit=optional or --no-optional on an install of a CI job or Dockerfile, NPM_CONFIG_OMIT=optional), so the package cannot find its binary after that install.";
+  readonly 'unexpected-value': "A setting apply adds to has a value of a type the tool does not accept there, so apply leaves it as it is and writes nothing into it.";
+  readonly 'built-in-list-replaced': "Bun's built-in list of trusted packages is replaced by the policy's allow-list.";
+  readonly 'scripts-not-enforceable': "The pinned (with apply --user, the installed) npm or pnpm, or another npm the repository runs (one a declared Node.js comes with, or a CI job or Dockerfile installs), runs every install script and has no allow-list, so \"deny\" cannot be enforced; also given for an npm the repository runs whose version depcurfew cannot tell, which counts as one that runs them.";
+  readonly 'strict-allow-scripts-for-npm-in-use': "An npm the repository runs (the pinned one, one a CI job or Dockerfile installs, or one a declared Node.js comes with, for a project also through the root version files and root Dockerfiles that build it) is 11.16 to 11.x and runs install scripts the allow-list does not cover unless strict-allow-scripts is set, so apply writes strict-allow-scripts=true, which makes npm 12 stop the install at such a script; not given when that npm is the pinned one and no place runs npm 12.";
+  readonly 'before-overrides-cooldown': "before= in .npmrc takes the place of the release-age delay apply writes, or makes npm stop with an error next to it (apply --user then does not write the delay).";
+  readonly 'exact-version-gap': "The pinned (with apply --user, the installed) pnpm skips the release-age delay for packages requested by exact version.";
+  readonly 'source-not-enforceable': "The tool has no setting for a dependency source the policy denies; doctor checks the lockfile instead.";
+  readonly 'source-switch-indirect-only': "The pnpm setting for git and tarball sources stops them only for indirect dependencies.";
+  readonly 'source-switch-combined': "One pnpm setting covers git and tarball sources, so denying one denies both.";
+  readonly 'forced-source-build': "Python packages on the allow-list are always built from source, because no tool can only allow a build.";
+  readonly 'build-switch-scope': "The tool's switch forbids building only packages from an index; git, local and archive dependencies are still built.";
+  readonly 'build-switch-install-only': "Poetry applies its build switch when installing; poetry lock may still build source distributions.";
+  readonly 'build-switch-environment-only': "The tool has no project setting that forbids building from source, so it has to be set in the environment where the tool runs.";
+  readonly 'requirements-file-missing': "There is no requirements file to write pip options into.";
+  readonly 'manifest-missing': "A setting belongs in a project manifest (package.json, deno.json, pyproject.toml, Pipfile, composer.json) that does not exist, and apply does not create manifests.";
+  readonly 'lockfile-out-of-date': "The lockfile records, or is checked against, a setting apply changed, so it has to be locked again.";
+  readonly 'file-ignored-by-git': "A file apply writes matches a .gitignore rule, so the change may never reach the repository.";
+  readonly 'bot-config-missing': "A bot has no configuration file, and depcurfew does not create one.";
+  readonly 'bot-config-not-edited': "A bot configuration file is in a place or format depcurfew does not edit; a snippet shows what to add.";
+  readonly 'bot-entries-missing': "The Dependabot configuration has no entries for the package managers in use.";
+  readonly 'bot-config-unreadable': "The Dependabot configuration uses a YAML alias, which Dependabot does not accept, so it reads no configuration from the file (the cooldown apply writes included), and depcurfew does not read the delays the file sets.";
+  readonly 'bot-rule-shortens-delay': "A Renovate packageRules entry apply does not manage gives every package of a registry, Renovate manager or category in use, or the actions of the workflows, or some update types of them, a shorter release-age delay than the one apply writes; Renovate uses it, and apply does not change it.";
+  readonly 'security-delay-unsupported': "Dependabot cannot delay security updates, so securityUpdates \"delay\" is not applied.";
+};
+export declare const APPLY_ERRORS: {
+  readonly 'cannot-edit': "A file cannot be read or edited safely (invalid syntax, a symlink, a style depcurfew does not edit), so nothing is written.";
+  readonly 'cannot-write': "A file cannot be written (no permission, a read-only file system, a full disk, a directory or symlink in its place); the files already written are put back, so nothing changes.";
+  readonly 'policy-missing': "The directory has no depcurfew.json.";
+  readonly 'policy-invalid': "depcurfew.json does not follow the schema; issues lists the problems.";
+  readonly 'policy-unreadable': "depcurfew.json cannot be read.";
+  readonly 'policy-exists': "depcurfew init found a depcurfew.json and writes it only with --force.";
+  readonly 'directory-not-found': "The directory given on the command line does not exist or cannot be opened.";
+  readonly 'not-a-directory': "The path given on the command line is a file, not a directory.";
+  readonly usage: "The command line is not valid: an unknown command, option or hook, a missing or extra argument, an option without its value or with one it does not take (such as a --registry that is not an http:// or https:// URL), or options that cannot go together (exit code 2); with --json the document holds only schemaVersion and this error.";
+  readonly 'project-not-found': "A directory listed in projects in depcurfew.json does not exist, so nothing is written.";
+  readonly 'project-not-a-directory': "A path listed in projects in depcurfew.json is a file, not a directory, so nothing is written.";
+  readonly 'project-symlink': "A directory listed in projects in depcurfew.json is a symlink or lies under one, which may lead out of the repository, so nothing is written.";
+  readonly 'project-has-policy': "A directory listed in projects has a depcurfew.json of its own, a second policy for the same files, so nothing is written.";
+  readonly 'project-is-repository': "A directory listed in projects is a separate git repository or lies in one (it has a .git of its own, as a git submodule does), whose files belong to that repository, so nothing is written.";
+  readonly 'project-in-workspace': "A directory listed in projects is, holds or lies in a workspace package of the repository root, which the root configuration already covers, so nothing is written.";
+  readonly 'home-missing': "apply --user and init --user: the home directory (HOME, USERPROFILE on Windows) does not exist or is not an absolute path, so nothing is written.";
+};
+type ApplyWarningCode = keyof typeof APPLY_WARNINGS;
+type ApplyErrorCode = keyof typeof APPLY_ERRORS;
+interface ApplyWarning {
+  code: ApplyWarningCode;
+  /** The directory listed in projects that the warning concerns; absent for the repository root. */
+  project?: string;
+  /** The tool it concerns, when there is one. */
+  tool?: ToolId;
+  /** The file it concerns, when there is one, and the line when it is known. */
+  location?: {
+    file: string;
+    line?: number;
+  };
+  /** What happened, for people; it starts with the tool's name when it concerns one. */
+  message: string;
+  /** What to do about it, when there is something to do. */
+  fix?: string;
+}
+/** A warning as one line of text, as ApplyReport.warnings has it. */
+export declare function warningText(warning: ApplyWarning): string;
+interface FileChange {
+  /** Repository-relative path with `/` separators. */
+  file: string;
+  /** null for a new file. */
+  before: string | null;
+  after: string;
+}
+/**
+ * A file could not be written. writeChanges has removed its temporary files and put back the files it had already
+ * replaced, so nothing changed, except for the files in `unrestored` (whose earlier text is in `backups` when it could
+ * be written) and the temporary files in `leftovers`. The message says why, without the file name.
+ */
+declare class WriteFailed extends Error {
+  readonly file: string;
+  /** Why, in plain words. */
+  readonly reason: string;
+  /** Files already replaced that could not be put back (normally none). */
+  readonly unrestored: string[];
+  /** For files in `unrestored`: the temporary file, next to it, that holds its earlier text. */
+  readonly backups: Readonly<Record<string, string>>;
+  /** Temporary files that could not be removed, named like `file` (relative to the root, or as WriteOptions.name says). */
+  readonly leftovers: string[];
+  /** Another program holds the file, or (on Windows) it is read-only. */
+  readonly busy: boolean;
+  readonly platform: NodeJS.Platform;
+  constructor(file: string, error: unknown, unrestored: string[], details?: {
+    platform?: NodeJS.Platform;
+    backups?: Record<string, string>;
+    leftovers?: string[];
+  });
+}
+interface Snippet {
+  tool: ToolId;
+  file: string;
+  text: string;
+}
+/** A file a generator could not read or edit; nothing is written when there is one. */
+interface EditFailure {
+  tool: ToolId;
+  file: string;
+  message: string;
+  /** What to do, when the generic fix of cannot-edit does not say it. */
+  fix?: string;
+}
+/** Why a directory listed in projects cannot be used; nothing is written and doctor reports it (invalid-project). */
+interface ProjectProblem {
+  code: Extract<ApplyErrorCode, `project-${string}`>;
+  /** The entry of projects it concerns. */
+  project: string;
+  location: {
+    file: string;
+    line?: number;
+  };
+  message: string;
+  fix: string;
+}
+interface ApplyReport {
+  /** Repository-relative paths, also for the files of the directories listed in projects. */
+  changes: FileChange[];
+  /** The warnings as one line of text each. */
+  warnings: string[];
+  /** The same warnings with a code, the tool, the file and what to do (apply --json). */
+  warningDetails: ApplyWarning[];
+  snippets: Snippet[];
+  /** Files that could not be edited, as messages. When there are any, nothing is written. */
+  errors: string[];
+  /** The same failures with the tool and the file. */
+  failures: EditFailure[];
+  /**
+   * Directories listed in projects that cannot be used (decision D-100); their messages come first in `errors`, and
+   * nothing is written when there is one.
+   */
+  problems?: ApplyProblem[];
+}
+/** An error that concerns no file being edited (a directory listed in projects, the home directory of apply --user). */
+interface ApplyProblem {
+  code: ApplyErrorCode;
+  location: {
+    file: string;
+    line?: number;
+  };
+  message: string;
+  fix: string;
+}
+/** How a directory is planned in a repository with projects (decision D-100). */
+interface PlanOptions {
+  /** The directory is the project listed so in projects (relative to the repository root): bots are not configured there. */
+  project?: string;
+  /** The directory is the root of a repository with projects: what the projects configure, which bots serve too. */
+  projects?: {
+    managerMinutes: readonly number[];
+    targets: ReadonlySet<ToolId>;
+  };
+  /**
+   * The project's installs in CI jobs of the repository root (working-directory: frontend), with their Node.js setup
+   * steps, for the npm the project runs (decision D-105); jobsInProject gives them.
+   */
+  ci?: {
+    jobs: readonly WorkflowJob[];
+    versions: readonly VersionDeclaration[];
+  };
+  /**
+   * What the project takes from the repository root (decision D-109): the root's Node.js version files when it has none
+   * of its own, and the stages of root Dockerfiles that build it; rootPlaces gives them.
+   */
+  root?: RootPlaces;
+}
+/** The bots' delay: the policy's, or longer if a package manager rounded its delay up further. */
+export declare function botDuration(policy: Duration, managerMinutes: readonly number[]): Duration;
+/**
+ * Computes every change of one directory without writing anything. With projects in the policy, `options` says which
+ * part of the repository this directory is (planRepository plans them all).
+ */
+export declare function planApply(root: string, policy: ResolvedPolicy, detection: Detection, tools?: readonly ToolKnowledge[], options?: PlanOptions): ApplyReport;
+/**
+ * Plans the whole repository: the root as planApply does, and each directory listed in projects as a project of its
+ * own with the same policy (decision D-100). Bots are configured only from the root, with a delay at least as long
+ * as any package manager of any project gets. Every path is relative to the root. A listed directory that cannot be
+ * used is an error (`problems`), so that nothing is written; the other directories are still planned, so one run
+ * reports everything.
+ */
+export declare function planRepository(root: string, policy: ResolvedPolicy, tools?: readonly ToolKnowledge[], rootDetection?: Detection): ApplyReport;
+export declare class PolicyError extends Error {
+  readonly issues: string[];
+  readonly code: ApplyErrorCode;
+  /** What to do, when the message does not say it. */
+  readonly fix: string | undefined;
+  /** The line of the policy file the first problem concerns, when it can be found (decision D-116). */
+  readonly line: number | undefined;
+  constructor(message: string, issues?: string[], code?: ApplyErrorCode, fix?: string, line?: number);
+  /** The message and what to do, as one line of text. */
+  get text(): string;
+}
+export declare function loadPolicy(root: string): ResolvedPolicy;
+/**
+ * A file could not be written (code cannot-write). The files apply had already replaced were put back, so the
+ * repository is as it was, unless `unrestored` lists files. `report` is the plan that was being written.
+ */
+export declare class ApplyWriteError extends Error {
+  readonly code: "cannot-write";
+  /** The file that could not be written, relative to the repository. */
+  readonly file: string;
+  /** What to do. */
+  readonly fix: string;
+  /** Files already replaced that could not be put back (normally none). */
+  readonly unrestored: string[];
+  readonly report: ApplyReport;
+  /**
+   * `command` is what the fix tells the user to run again (depcurfew apply --user for user files), and
+   * `versionControl` whether the files may be in version control, to restore them from.
+   */
+  constructor(failure: WriteFailed, report: ApplyReport, options?: {
+    command?: string;
+    versionControl?: boolean;
+  });
+}
+/**
+ * Reads the policy, detects the project, plans the changes and (unless told otherwise) writes them. If any file
+ * could not be edited, nothing is written, so a run either applies the whole policy or leaves the repository as it was.
+ * A file that cannot be written throws ApplyWriteError after the files already written are put back.
+ */
+export declare function applyProject(root: string, options?: {
+  write?: boolean;
+  beforeWrite?: () => void;
+}): ApplyReport;
+export declare function checkSpec(request: string | CheckRequest, options: CheckOptions): Promise<PackageReport>;
+/**
+ * Checks the specs a few at a time; the reports keep the order of the specs. When `options.signal` aborts, no further
+ * spec is looked up and the promise rejects with the signal's reason.
+ */
+export declare function checkSpecs(specs: readonly (string | CheckRequest)[], options: CheckOptions): Promise<PackageReport[]>;
 interface Paint {
   red(text: string): string;
   yellow(text: string): string;
@@ -1170,8 +2090,231 @@ interface Paint {
   bold(text: string): string;
   dim(text: string): string;
 }
-declare function countLevels(findings: readonly Finding[]): Record<'error' | 'warning' | 'note', number>;
-declare function renderText(report: DoctorReport, rules: readonly Rule[], colors?: Paint): string;
+interface CheckDependencies {
+  fetch: FetchLike;
+  now: () => Date;
+  /** The whole of stdin, for hook mode. */
+  stdin: () => Promise<string>;
+  /** The user's home directory, with the user's .npmrc. */
+  home?: () => string;
+  /** The project root Claude Code gives hooks (CLAUDE_PROJECT_DIR); tests replace it. */
+  projectDir?: () => string | undefined;
+  /** --user: platform, home directory and environment variables (tests replace them). */
+  userEnvironment?: () => UserEnvironment;
+  /**
+   * The platform the hook runs on: on Windows a POSIX shell (Git Bash) hands its variables to programs that do not tell
+   * their names apart by case (decision D-143); tests replace it.
+   */
+  platform?: () => NodeJS.Platform;
+  /** depcurfew mcp: the streams the server talks over, its environment and signals (tests replace them). */
+  mcpProcess?: () => McpProcess;
+}
+export declare function run(argv: readonly string[], output: CliIo, dependencies?: CheckDependencies): Promise<number>;
+export declare function getVersion(): string;
+interface DiffOptions {
+  /** Shows the values of secrets as <redacted> in every line (redactSecrets), for a diff that people or logs see. */
+  redact?: boolean;
+}
+/**
+ * A unified diff with three lines of context; empty when the texts are equal. `before` is null for a new file.
+ * Control characters in the file name are shown as text (printable), so that a name cannot start a line of its own
+ * and forge a header or a hunk. A file with an absolute path (a user file outside the home directory) is named as it
+ * is, without the a/ and b/ of repository paths.
+ */
+export declare function unifiedDiff(file: string, before: string | null, after: string, context?: number, options?: DiffOptions): string;
+/**
+ * Where a command runs, relative to the directory the command line starts in: the directories it changes to, in order
+ * (an absolute one starts over). `localPrefix`: npm --prefix names npm's local prefix, whose .npmrc npm reads without
+ * looking for a package.json above it. `entered`: the indexes of the steps that the shell changes to (cd, pushd,
+ * Set-Location), which fail and leave the shell where it was when the directory does not exist, so the hook checks that
+ * it does (decision D-119); a directory that a mkdir earlier on the line creates is left out. `physical`: the indexes of
+ * the steps resolved through symlinks (cd -P, set -P), as the system resolves them. `assumes`: directories the shell
+ * changed to earlier on the line and left again (cd -, popd, cd /path), each of which must exist for this directory to
+ * be right, as a change that fails leaves OLDPWD and the stack of pushd as they were (decision D-123); the hook checks
+ * their entered steps too.
+ */
+interface KnownDirectory {
+  steps: readonly string[];
+  localPrefix?: true;
+  entered?: readonly number[];
+  physical?: readonly number[];
+  assumes?: readonly KnownDirectory[];
+  /**
+   * In `assumes`: a Python virtual environment whose activation script the command runs with . or source, which the
+   * hook trusts not to change directory only when this directory holds pyvenv.cfg (decision D-123).
+   */
+  venv?: true;
+}
+/** A directory as KnownDirectory gives it, or why it cannot be told. */
+type CommandDirectory = KnownDirectory | {
+  unknown: string;
+};
+/** Why a relative directory that the shell finds when it gets to it (pushd -n) cannot be followed, by the variables of the line. */
+interface RelativeDoubt {
+  variables: ShellVariables;
+}
+/**
+ * A change of directory by one command (decision D-123 for the stack): cd; cd - (`back`, with `push` for pushd -);
+ * pushd dir (`keep`: pushd -n, which only puts dir on the stack; no path: Push-Location alone, which pushes the location
+ * without changing it); pushd without a directory (`swap`); pushd +N or -N (`rotate`, `fromRight` for -N); popd with
+ * +N or -N (`count`); dirs -c (`clear`); set -P or set +P (`mode`), which make later changes resolve the path physically
+ * or not. `physical`: cd -P or cd -L chose. `stack`: the stack of pushd is unknown too. `lasting`: the directory of every
+ * later command is unknown, whatever changes it later. `doubt`: the variables of the line, for a directory pushd -n put
+ * on the stack, which the shell finds relative to where it is when it gets to it. `activate`: . or source of the
+ * activation script of the virtual environment in `root`, which changes no directory when `root` holds pyvenv.cfg;
+ * `reason` is why the directory is unknown when it cannot be trusted (decision D-123).
+ */
+type Move = {
+  kind: 'cd';
+  path: string;
+  physical?: boolean;
+} | {
+  kind: 'back';
+  command: string;
+  push?: true;
+} | {
+  kind: 'push';
+  path: string | undefined;
+  keep?: true;
+} | {
+  kind: 'swap';
+  command: string;
+  doubt?: RelativeDoubt;
+} | {
+  kind: 'rotate';
+  command: string;
+  count: number;
+  fromRight: boolean;
+  keep: boolean;
+  doubt?: RelativeDoubt;
+} | {
+  kind: 'pop';
+  command: string;
+  count?: number;
+  fromRight?: boolean;
+  keep?: boolean;
+  doubt?: RelativeDoubt;
+} | {
+  kind: 'clear';
+} | {
+  kind: 'mode';
+  physical: boolean;
+} | {
+  kind: 'unknown';
+  reason: string;
+  stack?: true;
+  lasting?: true;
+} | {
+  kind: 'activate';
+  root: string;
+  reason: string;
+};
+/**
+ * Variables the command line sets that change where cd goes: CDPATH, OLDPWD (cd -), PWD and DIRSTACK (popd).
+ * `dynamic`: why a variable whose name the shell builds may be set, which may be any of them (decision D-123).
+ */
+interface ShellVariables {
+  cdPath: boolean;
+  oldPwd: boolean;
+  pwd: boolean;
+  dirStack: boolean;
+  dynamic?: string;
+}
+interface InstallRequest {
+  tool: ToolId;
+  /** The command as written, for messages. */
+  command: string;
+  spec: string;
+  /** npm: the dist-tag the command makes npm prefer (--tag, npm_config_tag). */
+  tag?: string;
+  /** Python: the command allows pre-releases of the package, or forbids them; left out, the tool's default applies. */
+  prereleases?: 'allow' | 'deny';
+  /** Python: the command makes the tool build the package from source (true) or install wheels only (false). */
+  buildFromSource?: boolean;
+  /** Where the install runs, when the command changes directory before it or moves it with an option (decision D-118). */
+  directory?: CommandDirectory;
+  /** Composer: the command does not read the composer.json of the directory it runs in (create-project, global; decision D-133). */
+  readsManifest?: false;
+  /** Composer: composer update names the package without a constraint, so the one of the root composer.json applies. */
+  fromManifest?: true;
+  /** Composer: the command word, when the scripts of composer.json may change the command it stands for (decision D-136). */
+  composerCommand?: {
+    word: string;
+    command: string;
+  };
+}
+/** An option or variable of a command that weakens the release-age delay or the rule on install scripts (installOverrides). */
+interface Override {
+  tool: ToolId;
+  /** The command it is on, for messages. */
+  command: string;
+  /** As written: --min-release-age=0, npm_config_ignore_scripts=false. */
+  written: string;
+  weakens: OverrideSwitch['weakens'];
+  /** protection: what it turns off (OverrideSwitch.effect). */
+  effect?: string;
+  /** protection: what that protection does, when it covers less than every package the command fetches (OverrideSwitch.protects). */
+  protects?: string;
+  /** The delay it sets, to compare with the policy; left out when any value weakens it. */
+  delay?: string;
+  /** The shell expands its value. */
+  expanded?: boolean;
+  /** A shell builtin or another form sets it, whose value depcurfew does not read (decision D-143); written is the name. */
+  unread?: true;
+  /** Where its command runs, when that is not where the command line starts (decision D-118). */
+  directory?: CommandDirectory;
+}
+interface CommandScan {
+  requests: InstallRequest[];
+  /** Why an install command could not be read; undefined when every one could. */
+  unreadable: string | undefined;
+  /** Options and variables that weaken what depcurfew apply configured, to be compared with the policy. */
+  overrides?: Override[];
+  /** A command on the line changes the package manager's configuration; it counts when the line installs packages. */
+  changes?: string;
+  /** A package manager runs on the line, so variables that weaken it count. */
+  manager?: boolean;
+  /** How the command changes the directory of the shell that runs it (cd, pushd, eval 'cd …'), in order. */
+  moves?: Move[];
+}
+interface ScanOptions {
+  /** The shell that runs the line: a POSIX shell (the default; also Git Bash) or PowerShell. */
+  shell?: 'posix' | 'powershell';
+  /**
+   * The line runs on Windows (by default where depcurfew runs), whose programs do not tell the names of environment
+   * variables apart by case, so a POSIX shell's Composer=… sets COMPOSER there too (decision D-143).
+   */
+  windows?: boolean;
+}
+/** The packages a command line installs or downloads to run with npm, pnpm, Yarn, Bun, Deno, pip, uv, Poetry, PDM, Pipenv or pipx. */
+export declare function scanCommandLine(line: string, options?: ScanOptions): CommandScan;
+interface DetectOptions {
+  /** The directories listed in projects in depcurfew.json, relative to the root (decision D-137). */
+  projects?: readonly string[];
+}
+export declare function detectProject(root: string, tools?: readonly ToolKnowledge[], environment?: EnvironmentKnowledge, options?: DetectOptions): Detection;
+/** Every doctor rule, in the order they are documented. unreadable-config runs last, after every other rule has read its files. */
+export declare const RULES: readonly Rule[];
+type FailOn = (typeof FAIL_ON_LEVELS)[number];
+/** Where the setting came from: the command line (or the Action input), doctor.failOn of the policy, or neither. */
+type FailOnFrom = 'option' | 'policy' | 'default';
+interface FailOnSetting {
+  failOn: FailOn;
+  from: FailOnFrom;
+  /** from option: the option as given, "--strict" or "--fail-on warning". */
+  option?: string;
+  /** from policy: the policy file as messages show it, e.g. depcurfew.json. */
+  file?: string;
+}
+export declare function countLevels(findings: readonly Finding[]): Record<'error' | 'warning' | 'note', number>;
+/**
+ * `failOn`: which findings fail doctor and where that was set (decision D-112); when warnings make it fail, a line under
+ * the counts says why, with how to fail on errors only. `strict` alone (before D-112) adds STRICT_NOTE.
+ */
+export declare function renderText(report: DoctorReport, rules: readonly Rule[], colors?: Paint, options?: {
+  strict?: boolean;
+  failOn?: FailOnSetting;
+}): string;
 /** The text of a line in a repository file, to give regions the end column GitHub asks for. */
 type LineReader = (file: string, line: number) => string | undefined;
 /** Why doctor could not run, with a stable code. */
@@ -1180,16 +2323,26 @@ interface SarifError {
   message: string;
   fix?: string;
 }
-declare function toSarif(report: DoctorReport, rules: readonly Rule[], version: string, readLine?: LineReader, errors?: readonly SarifError[]): object;
+export declare function toSarif(report: DoctorReport, rules: readonly Rule[], version: string, readLine?: LineReader, errors?: readonly SarifError[]): object;
 /**
  * Runs the rules on a repository. When depcurfew.json exists but is invalid, it throws PolicyError, or with
  * invalidPolicy: 'report' runs the rules that need no policy and reports the problems as an invalid-policy finding.
+ * `policy` passes the policy in instead of reading depcurfew.json (null: run as without one). With projects in the
+ * policy, the rules also run on every listed directory with the same policy, and the report covers them all, with
+ * paths relative to the root (decision D-100).
  */
-declare function runDoctor(root: string, options?: {
+export declare function runDoctor(root: string, options?: {
   rules?: readonly Rule[];
   tools?: readonly ToolKnowledge[];
   invalidPolicy?: 'throw' | 'report';
+  policy?: ResolvedPolicy | null;
+  osv?: OsvDoctor;
 }): DoctorReport;
+/**
+ * runDoctor with known-malicious: the locked versions are looked up in OSV.dev first. Throws PolicyError as runDoctor
+ * does for an invalid depcurfew.json, unless asked to report it.
+ */
+export declare function runDoctorWithOsv(root: string, options: Omit<Parameters<typeof runDoctor>[1] & object, 'osv'>, osv: OsvOptions): Promise<DoctorReport>;
 type NumericDelayUnit = Exclude<DelayUnit, 'duration-string'>;
 declare const DURATION_STRING_UNITS: readonly ["minutes", "hours", "days", "weeks"];
 type DurationStringUnit = (typeof DURATION_STRING_UNITS)[number];
@@ -1210,19 +2363,19 @@ type CooldownConversion = {
   reason: string;
   fix: string;
 };
-declare function convertMinutes(minutes: number, unit: NumericDelayUnit): Converted<number>;
+export declare function convertMinutes(minutes: number, unit: NumericDelayUnit): Converted<number>;
 /** Writes minutes as a duration string such as `36 hours` or `3 days`. */
-declare function toDurationString(minutes: number, units: readonly DurationStringUnit[]): Converted<string>;
+export declare function toDurationString(minutes: number, units: readonly DurationStringUnit[]): Converted<string>;
 /**
  * Converts the policy's minimum release age into the value for one tool. When official sources disagree on the
  * unit, the smallest unit wins: its larger number is long enough under every reading.
  */
-declare function convertCooldown(tool: ToolKnowledge, duration: Duration): CooldownConversion;
-declare const POLICY_FILE = "depcurfew.json";
+export declare function convertCooldown(tool: ToolKnowledge, duration: Duration): CooldownConversion;
+export declare const POLICY_FILE = "depcurfew.json";
 /** Where the published package serves schema.json; init writes it into `$schema`. */
-declare const SCHEMA_URL = "https://unpkg.com/depcurfew/schema.json";
+export declare const SCHEMA_URL = "https://unpkg.com/depcurfew/schema.json";
 /** What `depcurfew init` writes. Every section is explicit, so the file shows what can be configured. */
-declare const DEFAULT_POLICY: {
+export declare const DEFAULT_POLICY: {
   readonly $schema: "https://unpkg.com/depcurfew/schema.json";
   readonly version: 1;
   readonly cooldown: {
@@ -1242,8 +2395,11 @@ declare const DEFAULT_POLICY: {
     readonly directory: "allow";
   };
   readonly targets: "auto";
+  readonly doctor: {
+    readonly failOn: "warning";
+  };
 };
-declare function renderPolicy(policy: Policy): string;
+export declare function renderPolicy(policy: Policy): string;
 type PolicyIssue = Issue;
 type PolicyResult = {
   ok: true;
@@ -1253,8 +2409,8 @@ type PolicyResult = {
   issues: PolicyIssue[];
 };
 /** Validates a parsed policy document and fills in defaults. Reports every problem, each with the path to its field. */
-declare function validatePolicy(document: unknown, tools?: readonly ToolKnowledge[]): PolicyResult;
+export declare function validatePolicy(document: unknown, tools?: readonly ToolKnowledge[]): PolicyResult;
 /** Parses and validates the text of a policy file. */
-declare function parsePolicy(source: string, tools?: readonly ToolKnowledge[]): PolicyResult;
-declare function formatIssue(issue: PolicyIssue): string;
-export { APPLY_ERRORS, APPLY_WARNINGS, type ApplyErrorCode, type ApplyReport, type ApplyWarning, type ApplyWarningCode, ApplyWriteError, type CheckFinding, type CheckOptions, type CliIo, type CommandScan, type Converted, type CooldownConversion, DEFAULT_POLICY, type Detection, type DetectionWarning, type DoctorReport, type Duration, type DurationResult, type DurationStringUnit, EXIT_FAILURE, EXIT_OK, EXIT_USAGE, type FileChange, type Finding, type FindingCode, type InstallRequest, type Level, type Location, type Notice, type NumericDelayUnit, POLICY_FILE, type PackageManagerInfo, type PackageReport, type Policy, PolicyError, type PolicyIssue, type PolicyResult, PopularNames, RULES, type ResolvedPolicy, type Rule, SCHEMA_URL, type ScanOptions, type Snippet, type VersionDeclaration, applyProject, botDuration, checkSpec, checkSpecs, convertCooldown, convertMinutes, countLevels, detectProject, formatDuration, formatIssue, getVersion, loadPolicy, parseDuration, parsePolicy, planApply, renderPolicy, renderText, run, runDoctor, scanCommandLine, toDurationString, toSarif, unifiedDiff, validatePolicy, warningText };
+export declare function parsePolicy(source: string, tools?: readonly ToolKnowledge[]): PolicyResult;
+export declare function formatIssue(issue: PolicyIssue): string;
+export type { ApplyErrorCode, ApplyProblem, ApplyReport, ApplyWarning, ApplyWarningCode, CheckFinding, CheckOptions, CliIo, CommandDirectory, CommandScan, Converted, CooldownConversion, DetectOptions, Detection, DetectionWarning, DoctorReport, Duration, DurationResult, DurationStringUnit, FileChange, Finding, FindingCode, InstallRequest, KnownDirectory, Level, Location, Notice, NumericDelayUnit, OsvOptions, OsvPackage, OsvVerdict, PackageManagerInfo, PackageReport, PlanOptions, Policy, PolicyIssue, PolicyResult, ProjectProblem, ResolvedPolicy, Rule, ScanOptions, Snippet, VersionDeclaration };