@harness-engineering/core 0.15.0 → 0.16.0

package/dist/index.d.ts

@@ -1,8 +1,8 @@
-import { Result, SessionSectionName, SessionEntry, SessionSections, WorkflowStep, WorkflowStepResult, Workflow, WorkflowResult, SkillLifecycleHooks, SkillContext, SkillResult, TurnContext, CICheckName, CIFailOnSeverity, CICheckReport, Roadmap, FeatureStatus } from '@harness-engineering/types';
+import { Result, SessionSectionName, SessionEntry, SessionSections, WorkflowStep, WorkflowStepResult, Workflow, WorkflowResult, SkillLifecycleHooks, SkillContext, SkillResult, TurnContext, CICheckName, CIFailOnSeverity, CICheckReport, Roadmap, FeatureStatus, ModelPricing, UsageRecord, DailyUsage, SessionUsage } from '@harness-engineering/types';
 export * from '@harness-engineering/types';
 import { z } from 'zod';
-import { C as Collector, A as ArchConfig, a as ConstraintRule, M as MetricResult, b as ArchMetricCategory, c as ArchBaseline, d as ArchDiffResult, T as ThresholdConfig } from './matchers-Dj1t5vpg.js';
-export { e as ArchBaselineSchema, f as ArchConfigSchema, g as ArchDiffResultSchema, h as ArchHandle, i as ArchMetricCategorySchema, j as ArchitectureOptions, k as CategoryBaseline, l as CategoryBaselineSchema, m as CategoryRegression, n as CategoryRegressionSchema, o as ConstraintRuleSchema, p as MetricResultSchema, q as ThresholdConfigSchema, V as Violation, r as ViolationSchema, s as archMatchers, t as archModule, u as architecture } from './matchers-Dj1t5vpg.js';
+import { C as Collector, A as ArchConfig, a as ConstraintRule, M as MetricResult, b as ArchMetricCategory, c as ArchBaseline, d as ArchDiffResult, T as ThresholdConfig } from './matchers-D20x48U9.js';
+export { e as ArchBaselineSchema, f as ArchConfigSchema, g as ArchDiffResultSchema, h as ArchHandle, i as ArchMetricCategorySchema, j as ArchitectureOptions, k as CategoryBaseline, l as CategoryBaselineSchema, m as CategoryRegression, n as CategoryRegressionSchema, o as ConstraintRuleSchema, p as MetricResultSchema, q as ThresholdConfigSchema, V as Violation, r as ViolationSchema, s as archMatchers, t as archModule, u as architecture } from './matchers-D20x48U9.js';
 import Parser from 'web-tree-sitter';
 
 /**
@@ -594,12 +594,12 @@ declare const ManifestSchema: z.ZodObject<{
         schema: string;
     }>, "many">>;
 }, "strip", z.ZodTypeAny, {
-    version: string;
     name: string;
+    version: string;
     include: string[];
     keywords: string[];
-    description?: string | undefined;
     layers?: Record<string, string[]> | undefined;
+    description?: string | undefined;
     minHarnessVersion?: string | undefined;
     boundaries?: {
         name: string;
@@ -608,11 +608,11 @@ declare const ManifestSchema: z.ZodObject<{
         schema: string;
     }[] | undefined;
 }, {
-    version: string;
     name: string;
+    version: string;
     include: string[];
-    description?: string | undefined;
     layers?: Record<string, string[]> | undefined;
+    description?: string | undefined;
     minHarnessVersion?: string | undefined;
     keywords?: string[] | undefined;
     boundaries?: {
@@ -747,12 +747,12 @@ declare const BundleSchema: z.ZodObject<{
             schema: string;
         }>, "many">>;
     }, "strip", z.ZodTypeAny, {
-        version: string;
         name: string;
+        version: string;
         include: string[];
         keywords: string[];
-        description?: string | undefined;
         layers?: Record<string, string[]> | undefined;
+        description?: string | undefined;
         minHarnessVersion?: string | undefined;
         boundaries?: {
             name: string;
@@ -761,11 +761,11 @@ declare const BundleSchema: z.ZodObject<{
             schema: string;
         }[] | undefined;
     }, {
-        version: string;
         name: string;
+        version: string;
         include: string[];
-        description?: string | undefined;
         layers?: Record<string, string[]> | undefined;
+        description?: string | undefined;
         minHarnessVersion?: string | undefined;
         keywords?: string[] | undefined;
         boundaries?: {
@@ -871,15 +871,15 @@ declare const BundleSchema: z.ZodObject<{
     }>;
     contributions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, "strip", z.ZodTypeAny, {
-    version: string;
     name: string;
+    version: string;
     manifest: {
-        version: string;
         name: string;
+        version: string;
         include: string[];
         keywords: string[];
-        description?: string | undefined;
         layers?: Record<string, string[]> | undefined;
+        description?: string | undefined;
         minHarnessVersion?: string | undefined;
         boundaries?: {
             name: string;
@@ -914,14 +914,14 @@ declare const BundleSchema: z.ZodObject<{
     minHarnessVersion?: string | undefined;
     contributions?: Record<string, unknown> | undefined;
 }, {
-    version: string;
     name: string;
+    version: string;
     manifest: {
-        version: string;
         name: string;
+        version: string;
         include: string[];
-        description?: string | undefined;
         layers?: Record<string, string[]> | undefined;
+        description?: string | undefined;
         minHarnessVersion?: string | undefined;
         keywords?: string[] | undefined;
         boundaries?: {
@@ -970,16 +970,16 @@ declare const LockfilePackageSchema: z.ZodObject<{
     integrity: z.ZodOptional<z.ZodString>;
     provenance: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
 }, "strip", z.ZodTypeAny, {
-    version: string;
     source: string;
+    version: string;
     installedAt: string;
     contributions?: Record<string, unknown> | null | undefined;
     resolved?: string | undefined;
     integrity?: string | undefined;
     provenance?: string[] | undefined;
 }, {
-    version: string;
     source: string;
+    version: string;
     installedAt: string;
     contributions?: Record<string, unknown> | null | undefined;
     resolved?: string | undefined;
@@ -998,16 +998,16 @@ declare const LockfileSchema: z.ZodEffects<z.ZodObject<{
         integrity: z.ZodOptional<z.ZodString>;
         provenance: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     }, "strip", z.ZodTypeAny, {
-        version: string;
         source: string;
+        version: string;
         installedAt: string;
         contributions?: Record<string, unknown> | null | undefined;
         resolved?: string | undefined;
         integrity?: string | undefined;
         provenance?: string[] | undefined;
     }, {
-        version: string;
         source: string;
+        version: string;
         installedAt: string;
         contributions?: Record<string, unknown> | null | undefined;
         resolved?: string | undefined;
@@ -1016,8 +1016,8 @@ declare const LockfileSchema: z.ZodEffects<z.ZodObject<{
     }>>;
 }, "strip", z.ZodTypeAny, {
     packages: Record<string, {
-        version: string;
         source: string;
+        version: string;
         installedAt: string;
         contributions?: Record<string, unknown> | null | undefined;
         resolved?: string | undefined;
@@ -1028,8 +1028,8 @@ declare const LockfileSchema: z.ZodEffects<z.ZodObject<{
     lockfileVersion?: 1 | undefined;
 }, {
     packages: Record<string, {
-        version: string;
         source: string;
+        version: string;
         installedAt: string;
         contributions?: Record<string, unknown> | null | undefined;
         resolved?: string | undefined;
@@ -1040,8 +1040,8 @@ declare const LockfileSchema: z.ZodEffects<z.ZodObject<{
     lockfileVersion?: 1 | undefined;
 }>, {
     packages: Record<string, {
-        version: string;
         source: string;
+        version: string;
         installedAt: string;
         contributions?: Record<string, unknown> | null | undefined;
         resolved?: string | undefined;
@@ -1052,8 +1052,8 @@ declare const LockfileSchema: z.ZodEffects<z.ZodObject<{
     lockfileVersion?: 1 | undefined;
 }, {
     packages: Record<string, {
-        version: string;
         source: string;
+        version: string;
         installedAt: string;
         contributions?: Record<string, unknown> | null | undefined;
         resolved?: string | undefined;
@@ -1924,12 +1924,12 @@ declare const PatternConfigSchema: z.ZodObject<{
             match: z.ZodString;
             convention: z.ZodEnum<["camelCase", "PascalCase", "UPPER_SNAKE", "kebab-case"]>;
         }, "strip", z.ZodTypeAny, {
-            type: "naming";
             match: string;
+            type: "naming";
             convention: "camelCase" | "PascalCase" | "UPPER_SNAKE" | "kebab-case";
         }, {
-            type: "naming";
             match: string;
+            type: "naming";
             convention: "camelCase" | "PascalCase" | "UPPER_SNAKE" | "kebab-case";
         }>, z.ZodObject<{
             type: z.ZodLiteral<"max-exports">;
@@ -1961,10 +1961,10 @@ declare const PatternConfigSchema: z.ZodObject<{
         }>]>;
         message: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
-        severity: "error" | "warning";
-        description: string;
         files: string[];
         name: string;
+        description: string;
+        severity: "error" | "warning";
         rule: {
             type: "must-export";
             names: string[];
@@ -1982,8 +1982,8 @@ declare const PatternConfigSchema: z.ZodObject<{
             type: "no-import";
             from: string;
         } | {
-            type: "naming";
             match: string;
+            type: "naming";
             convention: "camelCase" | "PascalCase" | "UPPER_SNAKE" | "kebab-case";
         } | {
             type: "max-exports";
@@ -1997,10 +1997,10 @@ declare const PatternConfigSchema: z.ZodObject<{
         };
         message?: string | undefined;
     }, {
-        severity: "error" | "warning";
-        description: string;
         files: string[];
         name: string;
+        description: string;
+        severity: "error" | "warning";
         rule: {
             type: "must-export";
             names: string[];
@@ -2018,8 +2018,8 @@ declare const PatternConfigSchema: z.ZodObject<{
             type: "no-import";
             from: string;
         } | {
-            type: "naming";
             match: string;
+            type: "naming";
             convention: "camelCase" | "PascalCase" | "UPPER_SNAKE" | "kebab-case";
         } | {
             type: "max-exports";
@@ -2037,10 +2037,10 @@ declare const PatternConfigSchema: z.ZodObject<{
     ignoreFiles: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
 }, "strip", z.ZodTypeAny, {
     patterns: {
-        severity: "error" | "warning";
-        description: string;
         files: string[];
         name: string;
+        description: string;
+        severity: "error" | "warning";
         rule: {
             type: "must-export";
             names: string[];
@@ -2058,8 +2058,8 @@ declare const PatternConfigSchema: z.ZodObject<{
             type: "no-import";
             from: string;
         } | {
-            type: "naming";
             match: string;
+            type: "naming";
             convention: "camelCase" | "PascalCase" | "UPPER_SNAKE" | "kebab-case";
         } | {
             type: "max-exports";
@@ -2077,10 +2077,10 @@ declare const PatternConfigSchema: z.ZodObject<{
     ignoreFiles?: string[] | undefined;
 }, {
     patterns: {
-        severity: "error" | "warning";
-        description: string;
         files: string[];
         name: string;
+        description: string;
+        severity: "error" | "warning";
         rule: {
             type: "must-export";
             names: string[];
@@ -2098,8 +2098,8 @@ declare const PatternConfigSchema: z.ZodObject<{
             type: "no-import";
             from: string;
         } | {
-            type: "naming";
             match: string;
+            type: "naming";
             convention: "camelCase" | "PascalCase" | "UPPER_SNAKE" | "kebab-case";
         } | {
             type: "max-exports";
@@ -2218,12 +2218,12 @@ declare const EntropyConfigSchema: z.ZodObject<{
                     match: z.ZodString;
                     convention: z.ZodEnum<["camelCase", "PascalCase", "UPPER_SNAKE", "kebab-case"]>;
                 }, "strip", z.ZodTypeAny, {
-                    type: "naming";
                     match: string;
+                    type: "naming";
                     convention: "camelCase" | "PascalCase" | "UPPER_SNAKE" | "kebab-case";
                 }, {
-                    type: "naming";
                     match: string;
+                    type: "naming";
                     convention: "camelCase" | "PascalCase" | "UPPER_SNAKE" | "kebab-case";
                 }>, z.ZodObject<{
                     type: z.ZodLiteral<"max-exports">;
@@ -2255,10 +2255,10 @@ declare const EntropyConfigSchema: z.ZodObject<{
                 }>]>;
                 message: z.ZodOptional<z.ZodString>;
             }, "strip", z.ZodTypeAny, {
-                severity: "error" | "warning";
-                description: string;
                 files: string[];
                 name: string;
+                description: string;
+                severity: "error" | "warning";
                 rule: {
                     type: "must-export";
                     names: string[];
@@ -2276,8 +2276,8 @@ declare const EntropyConfigSchema: z.ZodObject<{
                     type: "no-import";
                     from: string;
                 } | {
-                    type: "naming";
                     match: string;
+                    type: "naming";
                     convention: "camelCase" | "PascalCase" | "UPPER_SNAKE" | "kebab-case";
                 } | {
                     type: "max-exports";
@@ -2291,10 +2291,10 @@ declare const EntropyConfigSchema: z.ZodObject<{
                 };
                 message?: string | undefined;
             }, {
-                severity: "error" | "warning";
-                description: string;
                 files: string[];
                 name: string;
+                description: string;
+                severity: "error" | "warning";
                 rule: {
                     type: "must-export";
                     names: string[];
@@ -2312,8 +2312,8 @@ declare const EntropyConfigSchema: z.ZodObject<{
                     type: "no-import";
                     from: string;
                 } | {
-                    type: "naming";
                     match: string;
+                    type: "naming";
                     convention: "camelCase" | "PascalCase" | "UPPER_SNAKE" | "kebab-case";
                 } | {
                     type: "max-exports";
@@ -2331,10 +2331,10 @@ declare const EntropyConfigSchema: z.ZodObject<{
             ignoreFiles: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         }, "strip", z.ZodTypeAny, {
             patterns: {
-                severity: "error" | "warning";
-                description: string;
                 files: string[];
                 name: string;
+                description: string;
+                severity: "error" | "warning";
                 rule: {
                     type: "must-export";
                     names: string[];
@@ -2352,8 +2352,8 @@ declare const EntropyConfigSchema: z.ZodObject<{
                     type: "no-import";
                     from: string;
                 } | {
-                    type: "naming";
                     match: string;
+                    type: "naming";
                     convention: "camelCase" | "PascalCase" | "UPPER_SNAKE" | "kebab-case";
                 } | {
                     type: "max-exports";
@@ -2371,10 +2371,10 @@ declare const EntropyConfigSchema: z.ZodObject<{
             ignoreFiles?: string[] | undefined;
         }, {
             patterns: {
-                severity: "error" | "warning";
-                description: string;
                 files: string[];
                 name: string;
+                description: string;
+                severity: "error" | "warning";
                 rule: {
                     type: "must-export";
                     names: string[];
@@ -2392,8 +2392,8 @@ declare const EntropyConfigSchema: z.ZodObject<{
                     type: "no-import";
                     from: string;
                 } | {
-                    type: "naming";
                     match: string;
+                    type: "naming";
                     convention: "camelCase" | "PascalCase" | "UPPER_SNAKE" | "kebab-case";
                 } | {
                     type: "max-exports";
@@ -2427,10 +2427,10 @@ declare const EntropyConfigSchema: z.ZodObject<{
         } | undefined;
         patterns?: boolean | {
             patterns: {
-                severity: "error" | "warning";
-                description: string;
                 files: string[];
                 name: string;
+                description: string;
+                severity: "error" | "warning";
                 rule: {
                     type: "must-export";
                     names: string[];
@@ -2448,8 +2448,8 @@ declare const EntropyConfigSchema: z.ZodObject<{
                     type: "no-import";
                     from: string;
                 } | {
-                    type: "naming";
                     match: string;
+                    type: "naming";
                     convention: "camelCase" | "PascalCase" | "UPPER_SNAKE" | "kebab-case";
                 } | {
                     type: "max-exports";
@@ -2483,10 +2483,10 @@ declare const EntropyConfigSchema: z.ZodObject<{
         } | undefined;
         patterns?: boolean | {
             patterns: {
-                severity: "error" | "warning";
-                description: string;
                 files: string[];
                 name: string;
+                description: string;
+                severity: "error" | "warning";
                 rule: {
                     type: "must-export";
                     names: string[];
@@ -2504,8 +2504,8 @@ declare const EntropyConfigSchema: z.ZodObject<{
                     type: "no-import";
                     from: string;
                 } | {
-                    type: "naming";
                     match: string;
+                    type: "naming";
                     convention: "camelCase" | "PascalCase" | "UPPER_SNAKE" | "kebab-case";
                 } | {
                     type: "max-exports";
@@ -2545,10 +2545,10 @@ declare const EntropyConfigSchema: z.ZodObject<{
         } | undefined;
         patterns?: boolean | {
             patterns: {
-                severity: "error" | "warning";
-                description: string;
                 files: string[];
                 name: string;
+                description: string;
+                severity: "error" | "warning";
                 rule: {
                     type: "must-export";
                     names: string[];
@@ -2566,8 +2566,8 @@ declare const EntropyConfigSchema: z.ZodObject<{
                     type: "no-import";
                     from: string;
                 } | {
-                    type: "naming";
                     match: string;
+                    type: "naming";
                     convention: "camelCase" | "PascalCase" | "UPPER_SNAKE" | "kebab-case";
                 } | {
                     type: "max-exports";
@@ -2609,10 +2609,10 @@ declare const EntropyConfigSchema: z.ZodObject<{
         } | undefined;
         patterns?: boolean | {
             patterns: {
-                severity: "error" | "warning";
-                description: string;
                 files: string[];
                 name: string;
+                description: string;
+                severity: "error" | "warning";
                 rule: {
                     type: "must-export";
                     names: string[];
@@ -2630,8 +2630,8 @@ declare const EntropyConfigSchema: z.ZodObject<{
                     type: "no-import";
                     from: string;
                 } | {
-                    type: "naming";
                     match: string;
+                    type: "naming";
                     convention: "camelCase" | "PascalCase" | "UPPER_SNAKE" | "kebab-case";
                 } | {
                     type: "max-exports";
@@ -3357,13 +3357,13 @@ declare const FailureEntrySchema: z.ZodObject<{
     description: z.ZodString;
 }, "strip", z.ZodTypeAny, {
     type: string;
-    date: string;
     description: string;
+    date: string;
     skill: string;
 }, {
     type: string;
-    date: string;
     description: string;
+    date: string;
     skill: string;
 }>;
 type FailureEntry = z.infer<typeof FailureEntrySchema>;
@@ -3426,14 +3426,14 @@ declare const GateResultSchema: z.ZodObject<{
         output: z.ZodOptional<z.ZodString>;
         duration: z.ZodOptional<z.ZodNumber>;
     }, "strip", z.ZodTypeAny, {
-        passed: boolean;
         name: string;
+        passed: boolean;
         command: string;
         output?: string | undefined;
         duration?: number | undefined;
     }, {
-        passed: boolean;
         name: string;
+        passed: boolean;
         command: string;
         output?: string | undefined;
         duration?: number | undefined;
@@ -3441,8 +3441,8 @@ declare const GateResultSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     passed: boolean;
     checks: {
-        passed: boolean;
         name: string;
+        passed: boolean;
         command: string;
         output?: string | undefined;
         duration?: number | undefined;
@@ -3450,8 +3450,8 @@ declare const GateResultSchema: z.ZodObject<{
 }, {
     passed: boolean;
     checks: {
-        passed: boolean;
         name: string;
+        passed: boolean;
         command: string;
         output?: string | undefined;
         duration?: number | undefined;
@@ -3514,13 +3514,13 @@ declare const HarnessStateSchema: z.ZodObject<{
         description: z.ZodString;
         status: z.ZodEnum<["open", "resolved"]>;
     }, "strip", z.ZodTypeAny, {
-        status: "resolved" | "open";
         id: string;
         description: string;
-    }, {
         status: "resolved" | "open";
+    }, {
         id: string;
         description: string;
+        status: "resolved" | "open";
     }>, "many">>;
     progress: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodEnum<["pending", "in_progress", "complete"]>>>;
     lastSession: z.ZodOptional<z.ZodObject<{
@@ -3546,9 +3546,9 @@ declare const HarnessStateSchema: z.ZodObject<{
         decision: string;
     }[];
     blockers: {
-        status: "resolved" | "open";
         id: string;
         description: string;
+        status: "resolved" | "open";
     }[];
     schemaVersion: 1;
     position: {
@@ -3570,9 +3570,9 @@ declare const HarnessStateSchema: z.ZodObject<{
         decision: string;
     }[] | undefined;
     blockers?: {
-        status: "resolved" | "open";
         id: string;
         description: string;
+        status: "resolved" | "open";
     }[] | undefined;
     position?: {
         task?: string | undefined;
@@ -3977,7 +3977,7 @@ type TurnExecutor = (context: TurnContext) => Promise<{
 declare function runPipeline(initialContext: SkillContext, executor: SkillExecutor, options?: PipelineOptions): Promise<PipelineResult>;
 declare function runMultiTurnPipeline(initialContext: SkillContext, turnExecutor: TurnExecutor, options?: PipelineOptions): Promise<PipelineResult>;
 
-type SecurityCategory = 'secrets' | 'injection' | 'xss' | 'crypto' | 'network' | 'deserialization' | 'path-traversal' | 'agent-config' | 'mcp';
+type SecurityCategory = 'secrets' | 'injection' | 'xss' | 'crypto' | 'network' | 'deserialization' | 'path-traversal' | 'agent-config' | 'mcp' | 'insecure-defaults' | 'sharp-edges';
 type SecuritySeverity = 'error' | 'warning' | 'info';
 type SecurityConfidence = 'high' | 'medium' | 'low';
 interface SecurityRule {
@@ -4015,6 +4015,12 @@ interface ScanResult {
     externalToolsUsed: string[];
     coverage: 'baseline' | 'enhanced';
 }
+interface SuppressionRecord {
+    ruleId: string;
+    file: string;
+    line: number;
+    justification: string | null;
+}
 type RuleOverride = 'off' | SecuritySeverity;
 interface SecurityConfig {
     enabled: boolean;
@@ -4033,6 +4039,11 @@ interface SecurityConfig {
 }
 declare const DEFAULT_SECURITY_CONFIG: SecurityConfig;
 
+interface SuppressionMatch {
+    ruleId: string;
+    justification: string | null;
+}
+declare function parseHarnessIgnore(line: string, ruleId: string): SuppressionMatch | null;
 declare class SecurityScanner {
     private registry;
     private config;
@@ -4048,6 +4059,12 @@ declare class SecurityScanner {
     scanContent(content: string, filePath: string, startLine?: number): SecurityFinding[];
     scanFile(filePath: string): Promise<SecurityFinding[]>;
     private scanContentForFile;
+    /**
+     * Core scanning loop shared by scanContent and scanContentForFile.
+     * Evaluates each rule against each line, handling suppression (FP gate)
+     * and pattern matching uniformly.
+     */
+    private scanLinesWithRules;
     scanFiles(filePaths: string[]): Promise<ScanResult>;
 }
 
@@ -4092,9 +4109,9 @@ declare const SecurityConfigSchema: z.ZodObject<{
         } | undefined;
     }>>;
 }, "strip", z.ZodTypeAny, {
+    rules: Record<string, "error" | "warning" | "info" | "off">;
     enabled: boolean;
     strict: boolean;
-    rules: Record<string, "error" | "warning" | "info" | "off">;
     exclude: string[];
     external?: {
         semgrep?: {
@@ -4106,9 +4123,9 @@ declare const SecurityConfigSchema: z.ZodObject<{
         } | undefined;
     } | undefined;
 }, {
+    rules?: Record<string, "error" | "warning" | "info" | "off"> | undefined;
     enabled?: boolean | undefined;
     strict?: boolean | undefined;
-    rules?: Record<string, "error" | "warning" | "info" | "off"> | undefined;
     exclude?: string[] | undefined;
     external?: {
         semgrep?: {
@@ -4153,6 +4170,116 @@ declare const agentConfigRules: SecurityRule[];
 
 declare const mcpRules: SecurityRule[];
 
+declare const insecureDefaultsRules: SecurityRule[];
+
+declare const sharpEdgesRules: SecurityRule[];
+
+/**
+ * Sentinel Injection Pattern Engine
+ *
+ * Shared pattern library for detecting prompt injection attacks in text input.
+ * Used by sentinel hooks, MCP middleware, and the scan-config CLI.
+ *
+ * This engine DETECTS and REPORTS patterns. It does NOT strip them --
+ * the existing sanitizeExternalText() in ConnectorUtils.ts handles stripping.
+ */
+type InjectionSeverity = 'high' | 'medium' | 'low';
+interface InjectionFinding {
+    severity: InjectionSeverity;
+    ruleId: string;
+    match: string;
+    line?: number;
+}
+interface InjectionPattern {
+    ruleId: string;
+    severity: InjectionSeverity;
+    category: string;
+    description: string;
+    pattern: RegExp;
+}
+/**
+ * Scan text for prompt injection patterns.
+ *
+ * Returns an array of findings sorted by severity (high first).
+ * The caller decides how to act on findings based on severity:
+ * - HIGH/MEDIUM: Trigger taint (hooks and MCP middleware)
+ * - LOW: Informational only (logged to stderr, no taint)
+ */
+declare function scanForInjection(text: string): InjectionFinding[];
+/**
+ * Get all registered injection patterns.
+ * Useful for inspection, documentation, and testing.
+ */
+declare function getInjectionPatterns(): ReadonlyArray<InjectionPattern>;
+/**
+ * Bash command patterns that are blocked during tainted sessions.
+ * Used by sentinel hooks and MCP middleware — kept in one place to prevent drift.
+ * Hooks that cannot import from core at startup define their own inline copy with a sync comment.
+ */
+declare const DESTRUCTIVE_BASH: ReadonlyArray<RegExp>;
+
+/**
+ * Sentinel Taint State Management
+ *
+ * Session-scoped taint file read/write/check/clear/expire logic.
+ * Taint files live at `.harness/session-taint-{sessionId}.json`.
+ *
+ * The taint file is the single source of truth for enforcement.
+ * Hooks and MCP middleware read this file on every invocation.
+ */
+
+interface TaintFinding {
+    ruleId: string;
+    severity: string;
+    match: string;
+    source: string;
+    detectedAt: string;
+}
+interface TaintState {
+    sessionId: string;
+    taintedAt: string;
+    expiresAt: string;
+    reason: string;
+    severity: 'high' | 'medium';
+    findings: TaintFinding[];
+}
+interface TaintCheckResult {
+    tainted: boolean;
+    expired: boolean;
+    state: TaintState | null;
+}
+/**
+ * Get the taint file path for a given session.
+ */
+declare function getTaintFilePath(projectRoot: string, sessionId?: string): string;
+/**
+ * Read the taint state for a session.
+ * Returns null if no taint file exists or if the file is malformed (fail-open).
+ * If malformed, the file is deleted.
+ */
+declare function readTaint(projectRoot: string, sessionId?: string): TaintState | null;
+/**
+ * Check taint status for a session.
+ * Handles expiry: if taint has expired, deletes the file and returns expired=true.
+ */
+declare function checkTaint(projectRoot: string, sessionId?: string): TaintCheckResult;
+/**
+ * Write taint state for a session.
+ * Creates .harness/ directory if it doesn't exist.
+ * If taint already exists for this session, appends new findings and keeps the earlier taintedAt.
+ */
+declare function writeTaint(projectRoot: string, sessionId: string | undefined, reason: string, findings: InjectionFinding[], source: string): TaintState;
+/**
+ * Clear taint for a specific session or all sessions.
+ * Returns the number of taint files removed.
+ */
+declare function clearTaint(projectRoot: string, sessionId?: string): number;
+/**
+ * List all active taint sessions.
+ * Returns session IDs with active (non-expired) taint.
+ */
+declare function listTaintedSessions(projectRoot: string): string[];
+
 declare const nodeRules: SecurityRule[];
 
 declare const expressRules: SecurityRule[];
@@ -4161,6 +4288,34 @@ declare const reactRules: SecurityRule[];
 
 declare const goRules: SecurityRule[];
 
+/**
+ * Shared scan-config types and utilities.
+ * Used by both the CLI `harness scan-config` command and the orchestrator workspace scanner.
+ */
+
+interface ScanConfigFinding {
+    ruleId: string;
+    severity: 'high' | 'medium' | 'low';
+    message: string;
+    match: string;
+    line?: number;
+}
+interface ScanConfigFileResult {
+    file: string;
+    findings: ScanConfigFinding[];
+    overallSeverity: 'high' | 'medium' | 'low' | 'clean';
+}
+interface ScanConfigResult {
+    exitCode: number;
+    results: ScanConfigFileResult[];
+}
+declare function mapSecuritySeverity(severity: string): 'high' | 'medium' | 'low';
+declare function computeOverallSeverity(findings: ScanConfigFinding[]): 'high' | 'medium' | 'low' | 'clean';
+declare function computeScanExitCode(results: ScanConfigFileResult[]): number;
+declare function mapInjectionFindings(injectionFindings: InjectionFinding[]): ScanConfigFinding[];
+declare function isDuplicateFinding(existing: ScanConfigFinding[], secFinding: SecurityFinding): boolean;
+declare function mapSecurityFindings(secFindings: SecurityFinding[], existing: ScanConfigFinding[]): ScanConfigFinding[];
+
 interface RunCIChecksInput {
     projectRoot: string;
     config: Record<string, unknown>;
@@ -4970,12 +5125,12 @@ declare const QuestionSchema: z.ZodObject<{
     default: z.ZodOptional<z.ZodString>;
 }, "strip", z.ZodTypeAny, {
     text: string;
-    options?: string[] | undefined;
     default?: string | undefined;
+    options?: string[] | undefined;
 }, {
     text: string;
-    options?: string[] | undefined;
     default?: string | undefined;
+    options?: string[] | undefined;
 }>;
 declare const ConfirmationSchema: z.ZodObject<{
     text: z.ZodString;
@@ -5019,12 +5174,12 @@ declare const EmitInteractionInputSchema: z.ZodObject<{
         default: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         text: string;
-        options?: string[] | undefined;
         default?: string | undefined;
+        options?: string[] | undefined;
     }, {
         text: string;
-        options?: string[] | undefined;
         default?: string | undefined;
+        options?: string[] | undefined;
     }>>;
     confirmation: z.ZodOptional<z.ZodObject<{
         text: z.ZodString;
@@ -5064,8 +5219,8 @@ declare const EmitInteractionInputSchema: z.ZodObject<{
     stream?: string | undefined;
     question?: {
         text: string;
-        options?: string[] | undefined;
         default?: string | undefined;
+        options?: string[] | undefined;
     } | undefined;
     confirmation?: {
         text: string;
@@ -5085,8 +5240,8 @@ declare const EmitInteractionInputSchema: z.ZodObject<{
     stream?: string | undefined;
     question?: {
         text: string;
-        options?: string[] | undefined;
         default?: string | undefined;
+        options?: string[] | undefined;
     } | undefined;
     confirmation?: {
         text: string;
@@ -5236,6 +5391,100 @@ declare function unfoldSymbol(filePath: string, symbolName: string): Promise<Unf
  */
 declare function unfoldRange(filePath: string, startLine: number, endLine: number): Promise<UnfoldResult>;
 
+/** Shape of the LiteLLM pricing JSON (per-model entry). */
+interface LiteLLMModelEntry {
+    input_cost_per_token?: number;
+    output_cost_per_token?: number;
+    cache_read_input_token_cost?: number;
+    cache_creation_input_token_cost?: number;
+    mode?: string;
+    [key: string]: unknown;
+}
+/** Shape of the full LiteLLM pricing JSON file. */
+interface LiteLLMPricingData {
+    [modelName: string]: LiteLLMModelEntry;
+}
+/** Parsed pricing dataset keyed by model name. */
+type PricingDataset = Map<string, ModelPricing>;
+/** Shape of the disk cache file. */
+interface PricingCacheFile {
+    fetchedAt: string;
+    data: LiteLLMPricingData;
+}
+/** Shape of the fallback.json file. */
+interface FallbackPricingFile {
+    _generatedAt: string;
+    _source: string;
+    models: Record<string, ModelPricing>;
+}
+
+/**
+ * Parses LiteLLM's raw pricing JSON into a PricingDataset map.
+ * Only includes chat-mode models with valid input/output costs.
+ */
+declare function parseLiteLLMData(raw: LiteLLMPricingData): PricingDataset;
+/**
+ * Looks up pricing for a given model name.
+ * Returns null and logs a warning if the model is not found.
+ */
+declare function getModelPrice(model: string, dataset: PricingDataset): ModelPricing | null;
+
+/** Pinned LiteLLM pricing URL. */
+declare const LITELLM_PRICING_URL = "https://raw.githubusercontent.com/BerriAI/litellm/main/model_prices_and_context_window.json";
+/** Cache time-to-live: 24 hours in milliseconds. */
+declare const CACHE_TTL_MS: number;
+/** Number of days after which fallback usage triggers a staleness warning. */
+declare const STALENESS_WARNING_DAYS = 7;
+/**
+ * Loads pricing data with the following priority:
+ * 1. Fresh disk cache (<24h old) — no network request
+ * 2. Network fetch from LiteLLM — writes to disk cache
+ * 3. Expired disk cache (any age) — when network fails
+ * 4. Bundled fallback.json — when no cache and no network
+ */
+declare function loadPricingData(projectRoot: string): Promise<PricingDataset>;
+
+/**
+ * Calculates the cost of a usage record in integer microdollars.
+ * Returns null if the model is unknown or not specified.
+ */
+declare function calculateCost(record: UsageRecord, dataset: PricingDataset): number | null;
+
+/**
+ * Aggregates an array of UsageRecords into per-session summaries.
+ *
+ * When records from both harness and Claude Code sources share a session ID:
+ * - Harness token counts are authoritative
+ * - CC data supplements the model field
+ * - The result is marked as 'merged'
+ */
+declare function aggregateBySession(records: UsageRecord[]): SessionUsage[];
+/**
+ * Aggregates an array of UsageRecords into per-day summaries.
+ * Groups by calendar date (UTC) derived from the record timestamp.
+ */
+declare function aggregateByDay(records: UsageRecord[]): DailyUsage[];
+
+/**
+ * Reads .harness/metrics/costs.jsonl and normalizes snake_case hook output
+ * to camelCase UsageRecord format.
+ *
+ * - Skips malformed lines with a warning to stderr
+ * - Handles legacy entries missing cache/model fields
+ * - Returns empty array if file does not exist
+ */
+declare function readCostRecords(projectRoot: string): UsageRecord[];
+
+/**
+ * Discovers and parses Claude Code JSONL files from ~/.claude/projects/ directories.
+ *
+ * Best-effort: the path is not a public API and may change across CC versions.
+ * - If ~/.claude/projects/ does not exist, returns empty array (no error)
+ * - Malformed entries are skipped with a console.warn
+ * - Each valid assistant entry with usage data maps to a UsageRecord tagged with _source: 'claude-code'
+ */
+declare function parseCCRecords(): UsageRecord[];
+
 /**
  * @harness-engineering/core
  *
@@ -5257,4 +5506,4 @@ declare function unfoldRange(filePath: string, startLine: number, endLine: numbe
  */
 declare const VERSION = "0.15.0";
 
-export { AGENT_DESCRIPTORS, ARCHITECTURE_DESCRIPTOR, type AST, type ActionContext, type ActionEvent, type ActionEventHandler, type ActionEventType, type ActionResult, type ActionSink, type ActionTracker, type ActionType, type AgentAction, AgentActionEmitter, type AgentExecutor, type AgentMapLink, type AgentMapSection, type AgentMapValidation, type AgentProcess, type AgentReviewResult, type AgentType, type AgentsMapConfig, ArchBaseline, ArchBaselineManager, ArchConfig, ArchDiffResult, ArchMetricCategory, BUG_DETECTION_DESCRIPTOR, type BaseError, type Baseline, BaselineManager, type BaselinesFile, type BenchmarkResult, type BenchmarkRunOptions, BenchmarkRunner, type BlueprintData, BlueprintGenerator, type BlueprintModule, type BlueprintOptions, type BoundaryDefinition, type BoundaryValidation, type BoundaryValidator, type BoundaryViolation, type BrokenLink, type BudgetedLearningsOptions, type Bundle, type BundleConstraints, BundleConstraintsSchema, BundleSchema, COMPLIANCE_DESCRIPTOR, type ChangeType, type ChangedFile, ChecklistBuilder, type CircularDependency, CircularDepsCollector, type CircularDepsResult, type CleanupFinding, type CodeBlock, type CodeChanges, type CodePattern, type CodeReference, type CodeSymbol, type CodebaseSnapshot, Collector, type CommentedCodeBlock, type CommitFormat, type CommitHistoryEntry, type CommitValidation, ComplexityCollector, type ComplexityConfig, type ComplexityReport, type ComplexityThresholds, type ComplexityViolation, type ConfigError, type ConfigPattern, type Confirmation, ConfirmationSchema, type ConflictReport, ConsoleSink, type ConstraintError, type ConstraintNodeStore, ConstraintRule, type Content, ContentPipeline, type ContextBundle, type ContextError, type ContextFile, type ContextFilterResult, type ContextScopeOptions, type Contributions, ContributionsSchema, type Convention, CouplingCollector, type CouplingConfig, type CouplingReport, type CouplingThresholds, type CouplingViolation, type CoverageOptions, type CoverageReport, type CriticalPathEntry, CriticalPathResolver, type CriticalPathSet, type CustomRule, type CustomRuleResult, DEFAULT_PROVIDER_TIERS, DEFAULT_SECURITY_CONFIG, DEFAULT_STATE, DEFAULT_STREAM_INDEX, type DeadCodeConfig, type DeadCodeReport, type DeadExport, type DeadFile, type DeadInternal, type DeduplicateFindingsOptions, DepDepthCollector, type DependencyEdge, type DependencyGraph, type DependencyValidation, type DependencyViolation, type DetectStaleResult, type DiffInfo, type DocumentationDrift, type DocumentationFile, type DocumentationGap, type DriftConfig, type DriftReport, EXTENSION_MAP, type EligibilityResult, type EmitEventInput, type EmitEventOptions, type EmitEventResult, type EmitInteractionInput, EmitInteractionInputSchema, EntropyAnalyzer, type EntropyConfig, EntropyConfigSchema, type EntropyError, type EntropyReport, type EventType, type EvidenceCoverageReport, ExclusionSet, type ExecutorHealth, type Export, type ExportMap, type FailureEntry, FailureEntrySchema, type FanOutOptions, type FeedbackAgentConfig, type FeedbackConfig, type FeedbackError$1 as FeedbackError, type FileCategory, FileSink, type FindingSeverity, type Fix, type FixConfig, type FixResult, type FixType, ForbiddenImportCollector, type ForbiddenImportViolation, type ForbiddenPattern, type GateConfig, GateConfigSchema, type GateResult, GateResultSchema, type GenerationSection, type GitHubInlineComment, type GraphAdapter, type GraphComplexityData, type GraphCouplingData, type GraphCoverageData, type GraphCriticalPathData, type GraphDependencyData, type GraphHarnessCheckData, type GraphImpactData, type Handoff, HandoffSchema, type HarnessState, HarnessStateSchema, type HealthCheckResult, type Hotspot, type HotspotContext, type Import, type InlineReference, type IntegrityReport, type InteractionType, InteractionTypeSchema, type InternalSymbol, type JSDocComment, type LanguageParser, type Layer, type LayerConfig, LayerViolationCollector, type LearningPattern, type LearningsFrontmatter, type LearningsIndexEntry, type LoadEventsOptions, type Lockfile, type LockfilePackage, LockfilePackageSchema, LockfileSchema, type LogEntry, type LogFilter, type Manifest, ManifestSchema, type MechanicalCheckOptions, type MechanicalCheckResult, type MechanicalCheckStatus, type MechanicalFinding, type MergeResult, type Metric, MetricResult, type ModelProvider, type ModelTier, type ModelTierConfig, type ModuleDependency, ModuleSizeCollector, NoOpExecutor, NoOpSink, NoOpTelemetryAdapter, type OrphanedDep, type OutlineResult, type ParseError, type ParsedFile, type PatternConfig, PatternConfigSchema, type PatternMatch, type PatternReport, type PatternViolation, type PeerReview, type PeerReviewOptions, type PipelineContext, type PipelineFlags, type PipelineOptions, type PipelineResult, type PrMetadata, type PriorReview, ProjectScanner, type PromoteResult, type ProviderDefaults, type PruneResult, type Question, QuestionSchema, REQUIRED_SECTIONS, type ReachabilityNode, RegressionDetector, type RegressionReport, type RegressionResult, type ReviewAgentDescriptor, type ReviewAssessment, type ReviewChecklist, type ReviewComment, type ReviewContext, type ReviewDomain, type ReviewFinding, type ReviewItem, type ReviewOutputOptions, type ReviewPipelineResult, type ReviewStrength, type RuleOverride, RuleRegistry, type RunCIChecksInput, type RunPipelineOptions, SECURITY_DESCRIPTOR, type SafetyLevel, type ScanResult, type SearchMatch, type SearchResult, type SecurityCategory, type SecurityConfidence, type SecurityConfig, SecurityConfigSchema, type SecurityFinding, type SecurityRule, SecurityScanner, type SecuritySeverity, type SelfReviewConfig, type SessionSummaryData, SharableBoundaryConfigSchema, SharableForbiddenImportSchema, SharableLayerSchema, SharableSecurityRulesSchema, type SizeBudgetConfig, type SizeBudgetReport, type SizeBudgetViolation, type SkillEvent, SkillEventSchema, type SkillExecutor, type SourceFile, type Span, type SpanEvent, type StaleConstraint, type StepExecutor, type StreamIndex, StreamIndexSchema, type StreamInfo, StreamInfoSchema, type StructureValidation, type Suggestion, type SuggestionReport, type SupportedLanguage, type SymbolKind, type SyncChange, type SyncOptions, type TelemetryAdapter, type TelemetryHealth, ThresholdConfig, type TimeRange, type TokenBudget, type TokenBudgetOverrides, type Trace, type Transition, TransitionSchema, type TurnExecutor, TypeScriptParser, type UnfoldResult, type UnusedImport, type UpdateCheckState, VERSION, type ValidateFindingsOptions, type ValidationError, type WorkflowPhase, addProvenance, agentConfigRules, analyzeDiff, analyzeLearningPatterns, appendFailure, appendLearning, appendSessionEntry, applyFixes, applyHotspotDowngrade, applySyncChanges, archiveFailures, archiveLearnings, archiveSession, archiveStream, buildDependencyGraph, buildExclusionSet, buildSnapshot, checkDocCoverage, checkEligibility, checkEvidenceCoverage, classifyFinding, clearEventHashCache, clearFailuresCache, clearLearningsCache, configureFeedback, constraintRuleId, contextBudget, contextFilter, countLearningEntries, createBoundaryValidator, createCommentedCodeFixes, createError, createFixes, createForbiddenImportFixes, createOrphanedDepFixes, createParseError, createSelfReview, createStream, cryptoRules, deduplicateCleanupFindings, deduplicateFindings, deepMergeConstraints, defaultCollectors, defineLayer, deserializationRules, detectChangeType, detectCircularDeps, detectCircularDepsInFiles, detectComplexityViolations, detectCouplingViolations, detectDeadCode, detectDocDrift, detectLanguage, detectPatternViolations, detectSizeBudgetViolations, detectStack, detectStaleConstraints, determineAssessment, diff, emitEvent, executeWorkflow, expressRules, extractBundle, extractIndexEntry, extractMarkdownLinks, extractSections, fanOutReview, formatEventTimeline, formatFindingBlock, formatGitHubComment, formatGitHubSummary, formatOutline, formatTerminalOutput, generateAgentsMap, generateSuggestions, getActionEmitter, getExitCode, getFeedbackConfig, getOutline, getParser, getPhaseCategories, getStreamForBranch, getUpdateNotification, goRules, injectionRules, isSmallSuggestion, isUpdateCheckEnabled, listActiveSessions, listStreams, loadBudgetedLearnings, loadEvents, loadFailures, loadHandoff, loadIndexEntries, loadRelevantLearnings, loadSessionSummary, loadState, loadStreamIndex, logAgentAction, mcpRules, migrateToStreams, networkRules, nodeRules, parseDateFromEntry, parseDiff, parseFile, parseFrontmatter, parseManifest, parseRoadmap, parseSecurityConfig, parseSize, pathTraversalRules, previewFix, promoteSessionLearnings, pruneLearnings, reactRules, readCheckState, readLockfile, readSessionSection, readSessionSections, removeContributions, removeProvenance, requestMultiplePeerReviews, requestPeerReview, resetFeedbackConfig, resetParserCache, resolveFileToLayer, resolveModelTier, resolveRuleSeverity, resolveSessionDir, resolveStreamPath, resolveThresholds, runAll, runArchitectureAgent, runBugDetectionAgent, runCIChecks, runComplianceAgent, runMechanicalChecks, runMechanicalGate, runMultiTurnPipeline, runPipeline, runReviewPipeline, runSecurityAgent, saveHandoff, saveState, saveStreamIndex, scopeContext, searchSymbols, secretRules, serializeRoadmap, setActiveStream, shouldRunCheck, spawnBackgroundCheck, syncConstraintNodes, syncRoadmap, tagUncitedFindings, touchStream, trackAction, unfoldRange, unfoldSymbol, updateSessionEntryStatus, updateSessionIndex, validateAgentsMap, validateBoundaries, validateCommitMessage, validateConfig, validateDependencies, validateFileStructure, validateFindings, validateKnowledgeMap, validatePatternConfig, violationId, writeConfig, writeLockfile, writeSessionSummary, xssRules };
+export { AGENT_DESCRIPTORS, ARCHITECTURE_DESCRIPTOR, type AST, type ActionContext, type ActionEvent, type ActionEventHandler, type ActionEventType, type ActionResult, type ActionSink, type ActionTracker, type ActionType, type AgentAction, AgentActionEmitter, type AgentExecutor, type AgentMapLink, type AgentMapSection, type AgentMapValidation, type AgentProcess, type AgentReviewResult, type AgentType, type AgentsMapConfig, ArchBaseline, ArchBaselineManager, ArchConfig, ArchDiffResult, ArchMetricCategory, BUG_DETECTION_DESCRIPTOR, type BaseError, type Baseline, BaselineManager, type BaselinesFile, type BenchmarkResult, type BenchmarkRunOptions, BenchmarkRunner, type BlueprintData, BlueprintGenerator, type BlueprintModule, type BlueprintOptions, type BoundaryDefinition, type BoundaryValidation, type BoundaryValidator, type BoundaryViolation, type BrokenLink, type BudgetedLearningsOptions, type Bundle, type BundleConstraints, BundleConstraintsSchema, BundleSchema, CACHE_TTL_MS, COMPLIANCE_DESCRIPTOR, type ChangeType, type ChangedFile, ChecklistBuilder, type CircularDependency, CircularDepsCollector, type CircularDepsResult, type CleanupFinding, type CodeBlock, type CodeChanges, type CodePattern, type CodeReference, type CodeSymbol, type CodebaseSnapshot, Collector, type CommentedCodeBlock, type CommitFormat, type CommitHistoryEntry, type CommitValidation, ComplexityCollector, type ComplexityConfig, type ComplexityReport, type ComplexityThresholds, type ComplexityViolation, type ConfigError, type ConfigPattern, type Confirmation, ConfirmationSchema, type ConflictReport, ConsoleSink, type ConstraintError, type ConstraintNodeStore, ConstraintRule, type Content, ContentPipeline, type ContextBundle, type ContextError, type ContextFile, type ContextFilterResult, type ContextScopeOptions, type Contributions, ContributionsSchema, type Convention, CouplingCollector, type CouplingConfig, type CouplingReport, type CouplingThresholds, type CouplingViolation, type CoverageOptions, type CoverageReport, type CriticalPathEntry, CriticalPathResolver, type CriticalPathSet, type CustomRule, type CustomRuleResult, DEFAULT_PROVIDER_TIERS, DEFAULT_SECURITY_CONFIG, DEFAULT_STATE, DEFAULT_STREAM_INDEX, DESTRUCTIVE_BASH, type DeadCodeConfig, type DeadCodeReport, type DeadExport, type DeadFile, type DeadInternal, type DeduplicateFindingsOptions, DepDepthCollector, type DependencyEdge, type DependencyGraph, type DependencyValidation, type DependencyViolation, type DetectStaleResult, type DiffInfo, type DocumentationDrift, type DocumentationFile, type DocumentationGap, type DriftConfig, type DriftReport, EXTENSION_MAP, type EligibilityResult, type EmitEventInput, type EmitEventOptions, type EmitEventResult, type EmitInteractionInput, EmitInteractionInputSchema, EntropyAnalyzer, type EntropyConfig, EntropyConfigSchema, type EntropyError, type EntropyReport, type EventType, type EvidenceCoverageReport, ExclusionSet, type ExecutorHealth, type Export, type ExportMap, type FailureEntry, FailureEntrySchema, type FallbackPricingFile, type FanOutOptions, type FeedbackAgentConfig, type FeedbackConfig, type FeedbackError$1 as FeedbackError, type FileCategory, FileSink, type FindingSeverity, type Fix, type FixConfig, type FixResult, type FixType, ForbiddenImportCollector, type ForbiddenImportViolation, type ForbiddenPattern, type GateConfig, GateConfigSchema, type GateResult, GateResultSchema, type GenerationSection, type GitHubInlineComment, type GraphAdapter, type GraphComplexityData, type GraphCouplingData, type GraphCoverageData, type GraphCriticalPathData, type GraphDependencyData, type GraphHarnessCheckData, type GraphImpactData, type Handoff, HandoffSchema, type HarnessState, HarnessStateSchema, type HealthCheckResult, type Hotspot, type HotspotContext, type Import, type InjectionFinding, type InjectionPattern, type InjectionSeverity, type InlineReference, type IntegrityReport, type InteractionType, InteractionTypeSchema, type InternalSymbol, type JSDocComment, LITELLM_PRICING_URL, type LanguageParser, type Layer, type LayerConfig, LayerViolationCollector, type LearningPattern, type LearningsFrontmatter, type LearningsIndexEntry, type LiteLLMModelEntry, type LiteLLMPricingData, type LoadEventsOptions, type Lockfile, type LockfilePackage, LockfilePackageSchema, LockfileSchema, type LogEntry, type LogFilter, type Manifest, ManifestSchema, type MechanicalCheckOptions, type MechanicalCheckResult, type MechanicalCheckStatus, type MechanicalFinding, type MergeResult, type Metric, MetricResult, type ModelProvider, type ModelTier, type ModelTierConfig, type ModuleDependency, ModuleSizeCollector, NoOpExecutor, NoOpSink, NoOpTelemetryAdapter, type OrphanedDep, type OutlineResult, type ParseError, type ParsedFile, type PatternConfig, PatternConfigSchema, type PatternMatch, type PatternReport, type PatternViolation, type PeerReview, type PeerReviewOptions, type PipelineContext, type PipelineFlags, type PipelineOptions, type PipelineResult, type PrMetadata, type PricingCacheFile, type PricingDataset, type PriorReview, ProjectScanner, type PromoteResult, type ProviderDefaults, type PruneResult, type Question, QuestionSchema, REQUIRED_SECTIONS, type ReachabilityNode, RegressionDetector, type RegressionReport, type RegressionResult, type ReviewAgentDescriptor, type ReviewAssessment, type ReviewChecklist, type ReviewComment, type ReviewContext, type ReviewDomain, type ReviewFinding, type ReviewItem, type ReviewOutputOptions, type ReviewPipelineResult, type ReviewStrength, type RuleOverride, RuleRegistry, type RunCIChecksInput, type RunPipelineOptions, SECURITY_DESCRIPTOR, STALENESS_WARNING_DAYS, type SafetyLevel, type ScanConfigFileResult, type ScanConfigFinding, type ScanConfigResult, type ScanResult, type SearchMatch, type SearchResult, type SecurityCategory, type SecurityConfidence, type SecurityConfig, SecurityConfigSchema, type SecurityFinding, type SecurityRule, SecurityScanner, type SecuritySeverity, type SelfReviewConfig, type SessionSummaryData, SharableBoundaryConfigSchema, SharableForbiddenImportSchema, SharableLayerSchema, SharableSecurityRulesSchema, type SizeBudgetConfig, type SizeBudgetReport, type SizeBudgetViolation, type SkillEvent, SkillEventSchema, type SkillExecutor, type SourceFile, type Span, type SpanEvent, type StaleConstraint, type StepExecutor, type StreamIndex, StreamIndexSchema, type StreamInfo, StreamInfoSchema, type StructureValidation, type Suggestion, type SuggestionReport, type SupportedLanguage, type SuppressionRecord, type SymbolKind, type SyncChange, type SyncOptions, type TaintCheckResult, type TaintFinding, type TaintState, type TelemetryAdapter, type TelemetryHealth, ThresholdConfig, type TimeRange, type TokenBudget, type TokenBudgetOverrides, type Trace, type Transition, TransitionSchema, type TurnExecutor, TypeScriptParser, type UnfoldResult, type UnusedImport, type UpdateCheckState, VERSION, type ValidateFindingsOptions, type ValidationError, type WorkflowPhase, addProvenance, agentConfigRules, aggregateByDay, aggregateBySession, analyzeDiff, analyzeLearningPatterns, appendFailure, appendLearning, appendSessionEntry, applyFixes, applyHotspotDowngrade, applySyncChanges, archiveFailures, archiveLearnings, archiveSession, archiveStream, buildDependencyGraph, buildExclusionSet, buildSnapshot, calculateCost, checkDocCoverage, checkEligibility, checkEvidenceCoverage, checkTaint, classifyFinding, clearEventHashCache, clearFailuresCache, clearLearningsCache, clearTaint, computeOverallSeverity, computeScanExitCode, configureFeedback, constraintRuleId, contextBudget, contextFilter, countLearningEntries, createBoundaryValidator, createCommentedCodeFixes, createError, createFixes, createForbiddenImportFixes, createOrphanedDepFixes, createParseError, createSelfReview, createStream, cryptoRules, deduplicateCleanupFindings, deduplicateFindings, deepMergeConstraints, defaultCollectors, defineLayer, deserializationRules, detectChangeType, detectCircularDeps, detectCircularDepsInFiles, detectComplexityViolations, detectCouplingViolations, detectDeadCode, detectDocDrift, detectLanguage, detectPatternViolations, detectSizeBudgetViolations, detectStack, detectStaleConstraints, determineAssessment, diff, emitEvent, executeWorkflow, expressRules, extractBundle, extractIndexEntry, extractMarkdownLinks, extractSections, fanOutReview, formatEventTimeline, formatFindingBlock, formatGitHubComment, formatGitHubSummary, formatOutline, formatTerminalOutput, generateAgentsMap, generateSuggestions, getActionEmitter, getExitCode, getFeedbackConfig, getInjectionPatterns, getModelPrice, getOutline, getParser, getPhaseCategories, getStreamForBranch, getTaintFilePath, getUpdateNotification, goRules, injectionRules, insecureDefaultsRules, isDuplicateFinding, isSmallSuggestion, isUpdateCheckEnabled, listActiveSessions, listStreams, listTaintedSessions, loadBudgetedLearnings, loadEvents, loadFailures, loadHandoff, loadIndexEntries, loadPricingData, loadRelevantLearnings, loadSessionSummary, loadState, loadStreamIndex, logAgentAction, mapInjectionFindings, mapSecurityFindings, mapSecuritySeverity, mcpRules, migrateToStreams, networkRules, nodeRules, parseCCRecords, parseDateFromEntry, parseDiff, parseFile, parseFrontmatter, parseHarnessIgnore, parseLiteLLMData, parseManifest, parseRoadmap, parseSecurityConfig, parseSize, pathTraversalRules, previewFix, promoteSessionLearnings, pruneLearnings, reactRules, readCheckState, readCostRecords, readLockfile, readSessionSection, readSessionSections, readTaint, removeContributions, removeProvenance, requestMultiplePeerReviews, requestPeerReview, resetFeedbackConfig, resetParserCache, resolveFileToLayer, resolveModelTier, resolveRuleSeverity, resolveSessionDir, resolveStreamPath, resolveThresholds, runAll, runArchitectureAgent, runBugDetectionAgent, runCIChecks, runComplianceAgent, runMechanicalChecks, runMechanicalGate, runMultiTurnPipeline, runPipeline, runReviewPipeline, runSecurityAgent, saveHandoff, saveState, saveStreamIndex, scanForInjection, scopeContext, searchSymbols, secretRules, serializeRoadmap, setActiveStream, sharpEdgesRules, shouldRunCheck, spawnBackgroundCheck, syncConstraintNodes, syncRoadmap, tagUncitedFindings, touchStream, trackAction, unfoldRange, unfoldSymbol, updateSessionEntryStatus, updateSessionIndex, validateAgentsMap, validateBoundaries, validateCommitMessage, validateConfig, validateDependencies, validateFileStructure, validateFindings, validateKnowledgeMap, validatePatternConfig, violationId, writeConfig, writeLockfile, writeSessionSummary, writeTaint, xssRules };