dependency preflight derived

{
  "input": {
    "body": {
      "policy": "balanced",
      "packages": [
        {
          "name": "lodash",
          "version": "4.17.21"
        }
      ],
      "ecosystem": "npm"
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "policy": {
        "name": "balanced",
        "version": "2026-08-19.2"
      },
      "summary": {
        "allow": 0,
        "block": 0,
        "review": 1,
        "partial": 0,
        "package_count": 1
      },
      "decision": "review",
      "packages": [
        {
          "name": "lodash",
          "install": {
            "lifecycle_scripts": []
          },
          "license": {
            "status": "allow",
            "declared": "MIT",
            "normalized": "MIT"
          },
          "partial": false,
          "decision": "review",
          "evidence": [
            {
              "url": "https://registry.npmjs.org/lodash",
              "cached": false,
              "source": "npm",
              "retrieved_at": "2026-08-20T00:00:00.000Z"
            },
            {
              "url": "https://api.osv.dev/v1/query",
              "cached": false,
              "source": "osv",
              "retrieved_at": "2026-08-20T00:00:00.000Z"
            }
          ],
          "findings": [
            {
              "code": "KNOWN_VULNERABILITY",
              "level": "review",
              "message": "A known high-severity vulnerability affects the requested version; review a fixed version."
            }
          ],
          "ecosystem": "npm",
          "lifecycle": {
            "yanked": false,
            "deprecated": false,
            "latest_version": "4.18.1",
            "latest_release_date": "2026-04-01T21:01:20.458Z",
            "requested_release_date": "2021-02-20T15:42:16.891Z"
          },
          "version_exists": true,
          "vulnerabilities": [
            {
              "id": "GHSA-r5fr-rjxr-66jc",
              "url": "https://osv.dev/vulnerability/GHSA-r5fr-rjxr-66jc",
              "aliases": [
                "CVE-2021-23337"
              ],
              "summary": "Known code-injection vulnerability in the requested lodash version.",
              "severity": "high",
              "modified_at": "2026-07-08T08:11:11.759560102Z",
              "fixed_versions": [
                "4.18.0"
              ],
              "upstream_severity": "HIGH"
            }
          ],
          "requested_version": "4.17.21"
        }
      ],
      "workflow": {
        "rerun_when": [
          "package_added",
          "exact_version_changed",
          "policy_input_changed",
          "fresh_evidence_required"
        ],
        "instruction": "Run Dependency Preflight before installing every new dependency and whenever an exact version or policy input changes.",
        "decision_actions": {
          "allow": "Continue only if the result and its evidence meet the caller's requirements.",
          "block": "Do not install the requested exact version.",
          "review": "Pause installation and review the findings and evidence."
        },
        "recommended_trigger": "before_dependency_install",
        "avoid_duplicate_payment": "Reuse an acceptable current result when the ecosystem, package name, exact version, and policy inputs are unchanged."
      },
      "request_id": "req_example",
      "limitations": [
        "ALLOW means configured checks completed without a configured finding; it is not a claim that a package is safe.",
        "Known-vulnerability, registry metadata, release-age, declared-license, and npm install-lifecycle preflight only.",
        "PyPI source-build or install-time code execution is not currently analyzed.",
        "Not a security guarantee or legal opinion."
      ],
      "generated_at": "2026-01-01T00:00:00.000Z"
    }
  }
}