@lannguyensi/harness 0.25.1 → 0.26.0

package/dist/schema/index.d.ts

@@ -568,6 +568,32 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             required: string[];
             run: string[];
         }>>;
+        when: z.ZodOptional<z.ZodEffects<z.ZodObject<{
+            "risk.severity_at_least": z.ZodOptional<z.ZodEnum<["low", "medium", "high", "critical"]>>;
+            "risk.category_in": z.ZodOptional<z.ZodArray<z.ZodEnum<["destructive", "data_loss", "production_mutation", "credential_access", "secret_exfiltration", "network_exfiltration", "deployment_change", "infrastructure_change", "privilege_escalation", "irreversible_action", "mass_update"]>, "many">>;
+            "environment.name": z.ZodOptional<z.ZodEnum<["production", "staging", "dev", "local", "unknown"]>>;
+            "action.reversible": z.ZodOptional<z.ZodBoolean>;
+        }, "strict", z.ZodTypeAny, {
+            "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+            "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+            "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+            "action.reversible"?: boolean | undefined;
+        }, {
+            "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+            "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+            "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+            "action.reversible"?: boolean | undefined;
+        }>, {
+            "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+            "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+            "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+            "action.reversible"?: boolean | undefined;
+        }, {
+            "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+            "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+            "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+            "action.reversible"?: boolean | undefined;
+        }>>;
     }, "strict", z.ZodTypeAny, {
         name: string;
         description: string;
@@ -609,6 +635,12 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             required: string[];
             run: string[];
         } | undefined;
+        when?: {
+            "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+            "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+            "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+            "action.reversible"?: boolean | undefined;
+        } | undefined;
     }, {
         name: string;
         description: string;
@@ -650,6 +682,12 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             required: string[];
             run: string[];
         } | undefined;
+        when?: {
+            "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+            "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+            "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+            "action.reversible"?: boolean | undefined;
+        } | undefined;
     }>, {
         name: string;
         description: string;
@@ -691,6 +729,12 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             required: string[];
             run: string[];
         } | undefined;
+        when?: {
+            "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+            "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+            "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+            "action.reversible"?: boolean | undefined;
+        } | undefined;
     }, {
         name: string;
         description: string;
@@ -732,6 +776,12 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             required: string[];
             run: string[];
         } | undefined;
+        when?: {
+            "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+            "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+            "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+            "action.reversible"?: boolean | undefined;
+        } | undefined;
     }>, "many">, {
         name: string;
         description: string;
@@ -773,6 +823,12 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             required: string[];
             run: string[];
         } | undefined;
+        when?: {
+            "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+            "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+            "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+            "action.reversible"?: boolean | undefined;
+        } | undefined;
     }[], {
         name: string;
         description: string;
@@ -814,6 +870,12 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             required: string[];
             run: string[];
         } | undefined;
+        when?: {
+            "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+            "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+            "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+            "action.reversible"?: boolean | undefined;
+        } | undefined;
     }[]>>;
     policy_packs: z.ZodDefault<z.ZodEffects<z.ZodArray<z.ZodObject<{
         name: z.ZodString;
@@ -846,6 +908,222 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
         source?: string | undefined;
         config?: Record<string, unknown> | undefined;
     }[]>>;
+    risk: z.ZodDefault<z.ZodEffects<z.ZodObject<{
+        classifiers: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            tool: z.ZodString;
+            patterns: z.ZodArray<z.ZodEffects<z.ZodObject<{
+                pattern: z.ZodString;
+                categories: z.ZodArray<z.ZodEnum<["destructive", "data_loss", "production_mutation", "credential_access", "secret_exfiltration", "network_exfiltration", "deployment_change", "infrastructure_change", "privilege_escalation", "irreversible_action", "mass_update"]>, "many">;
+                severity: z.ZodEnum<["low", "medium", "high", "critical"]>;
+            }, "strict", z.ZodTypeAny, {
+                pattern: string;
+                categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+                severity: "low" | "medium" | "high" | "critical";
+            }, {
+                pattern: string;
+                categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+                severity: "low" | "medium" | "high" | "critical";
+            }>, {
+                pattern: string;
+                categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+                severity: "low" | "medium" | "high" | "critical";
+            }, {
+                pattern: string;
+                categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+                severity: "low" | "medium" | "high" | "critical";
+            }>, "many">;
+        }, "strict", z.ZodTypeAny, {
+            patterns: {
+                pattern: string;
+                categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+                severity: "low" | "medium" | "high" | "critical";
+            }[];
+            name: string;
+            tool: string;
+        }, {
+            patterns: {
+                pattern: string;
+                categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+                severity: "low" | "medium" | "high" | "critical";
+            }[];
+            name: string;
+            tool: string;
+        }>, "many">>;
+    }, "strict", z.ZodTypeAny, {
+        classifiers: {
+            patterns: {
+                pattern: string;
+                categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+                severity: "low" | "medium" | "high" | "critical";
+            }[];
+            name: string;
+            tool: string;
+        }[];
+    }, {
+        classifiers?: {
+            patterns: {
+                pattern: string;
+                categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+                severity: "low" | "medium" | "high" | "critical";
+            }[];
+            name: string;
+            tool: string;
+        }[] | undefined;
+    }>, {
+        classifiers: {
+            patterns: {
+                pattern: string;
+                categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+                severity: "low" | "medium" | "high" | "critical";
+            }[];
+            name: string;
+            tool: string;
+        }[];
+    }, {
+        classifiers?: {
+            patterns: {
+                pattern: string;
+                categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+                severity: "low" | "medium" | "high" | "critical";
+            }[];
+            name: string;
+            tool: string;
+        }[] | undefined;
+    }>>;
+    environments: z.ZodDefault<z.ZodEffects<z.ZodObject<{
+        resolvers: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            environment: z.ZodEnum<["production", "staging", "dev", "local"]>;
+            signals: z.ZodEffects<z.ZodObject<{
+                branch_patterns: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                env_var_patterns: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    var: z.ZodString;
+                    patterns: z.ZodArray<z.ZodString, "many">;
+                }, "strict", z.ZodTypeAny, {
+                    var: string;
+                    patterns: string[];
+                }, {
+                    var: string;
+                    patterns: string[];
+                }>, "many">>;
+                kube_context_patterns: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+                kube_namespace_patterns: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            }, "strict", z.ZodTypeAny, {
+                branch_patterns?: string[] | undefined;
+                env_var_patterns?: {
+                    var: string;
+                    patterns: string[];
+                }[] | undefined;
+                kube_context_patterns?: string[] | undefined;
+                kube_namespace_patterns?: string[] | undefined;
+            }, {
+                branch_patterns?: string[] | undefined;
+                env_var_patterns?: {
+                    var: string;
+                    patterns: string[];
+                }[] | undefined;
+                kube_context_patterns?: string[] | undefined;
+                kube_namespace_patterns?: string[] | undefined;
+            }>, {
+                branch_patterns?: string[] | undefined;
+                env_var_patterns?: {
+                    var: string;
+                    patterns: string[];
+                }[] | undefined;
+                kube_context_patterns?: string[] | undefined;
+                kube_namespace_patterns?: string[] | undefined;
+            }, {
+                branch_patterns?: string[] | undefined;
+                env_var_patterns?: {
+                    var: string;
+                    patterns: string[];
+                }[] | undefined;
+                kube_context_patterns?: string[] | undefined;
+                kube_namespace_patterns?: string[] | undefined;
+            }>;
+        }, "strict", z.ZodTypeAny, {
+            name: string;
+            environment: "production" | "staging" | "dev" | "local";
+            signals: {
+                branch_patterns?: string[] | undefined;
+                env_var_patterns?: {
+                    var: string;
+                    patterns: string[];
+                }[] | undefined;
+                kube_context_patterns?: string[] | undefined;
+                kube_namespace_patterns?: string[] | undefined;
+            };
+        }, {
+            name: string;
+            environment: "production" | "staging" | "dev" | "local";
+            signals: {
+                branch_patterns?: string[] | undefined;
+                env_var_patterns?: {
+                    var: string;
+                    patterns: string[];
+                }[] | undefined;
+                kube_context_patterns?: string[] | undefined;
+                kube_namespace_patterns?: string[] | undefined;
+            };
+        }>, "many">>;
+    }, "strict", z.ZodTypeAny, {
+        resolvers: {
+            name: string;
+            environment: "production" | "staging" | "dev" | "local";
+            signals: {
+                branch_patterns?: string[] | undefined;
+                env_var_patterns?: {
+                    var: string;
+                    patterns: string[];
+                }[] | undefined;
+                kube_context_patterns?: string[] | undefined;
+                kube_namespace_patterns?: string[] | undefined;
+            };
+        }[];
+    }, {
+        resolvers?: {
+            name: string;
+            environment: "production" | "staging" | "dev" | "local";
+            signals: {
+                branch_patterns?: string[] | undefined;
+                env_var_patterns?: {
+                    var: string;
+                    patterns: string[];
+                }[] | undefined;
+                kube_context_patterns?: string[] | undefined;
+                kube_namespace_patterns?: string[] | undefined;
+            };
+        }[] | undefined;
+    }>, {
+        resolvers: {
+            name: string;
+            environment: "production" | "staging" | "dev" | "local";
+            signals: {
+                branch_patterns?: string[] | undefined;
+                env_var_patterns?: {
+                    var: string;
+                    patterns: string[];
+                }[] | undefined;
+                kube_context_patterns?: string[] | undefined;
+                kube_namespace_patterns?: string[] | undefined;
+            };
+        }[];
+    }, {
+        resolvers?: {
+            name: string;
+            environment: "production" | "staging" | "dev" | "local";
+            signals: {
+                branch_patterns?: string[] | undefined;
+                env_var_patterns?: {
+                    var: string;
+                    patterns: string[];
+                }[] | undefined;
+                kube_context_patterns?: string[] | undefined;
+                kube_namespace_patterns?: string[] | undefined;
+            };
+        }[] | undefined;
+    }>>;
     permission_profiles: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
         description: z.ZodOptional<z.ZodString>;
         actions: z.ZodDefault<z.ZodObject<{
@@ -2317,6 +2595,12 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             required: string[];
             run: string[];
         } | undefined;
+        when?: {
+            "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+            "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+            "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+            "action.reversible"?: boolean | undefined;
+        } | undefined;
     }[];
     policy_packs: {
         name: string;
@@ -2325,6 +2609,32 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
         config: Record<string, unknown>;
         description?: string | undefined;
     }[];
+    risk: {
+        classifiers: {
+            patterns: {
+                pattern: string;
+                categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+                severity: "low" | "medium" | "high" | "critical";
+            }[];
+            name: string;
+            tool: string;
+        }[];
+    };
+    environments: {
+        resolvers: {
+            name: string;
+            environment: "production" | "staging" | "dev" | "local";
+            signals: {
+                branch_patterns?: string[] | undefined;
+                env_var_patterns?: {
+                    var: string;
+                    patterns: string[];
+                }[] | undefined;
+                kube_context_patterns?: string[] | undefined;
+                kube_namespace_patterns?: string[] | undefined;
+            };
+        }[];
+    };
     permission_profiles: Record<string, {
         actions: {
             push?: {
@@ -2580,6 +2890,12 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             required: string[];
             run: string[];
         } | undefined;
+        when?: {
+            "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+            "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+            "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+            "action.reversible"?: boolean | undefined;
+        } | undefined;
     }[] | undefined;
     policy_packs?: {
         name: string;
@@ -2588,6 +2904,32 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
         source?: string | undefined;
         config?: Record<string, unknown> | undefined;
     }[] | undefined;
+    risk?: {
+        classifiers?: {
+            patterns: {
+                pattern: string;
+                categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+                severity: "low" | "medium" | "high" | "critical";
+            }[];
+            name: string;
+            tool: string;
+        }[] | undefined;
+    } | undefined;
+    environments?: {
+        resolvers?: {
+            name: string;
+            environment: "production" | "staging" | "dev" | "local";
+            signals: {
+                branch_patterns?: string[] | undefined;
+                env_var_patterns?: {
+                    var: string;
+                    patterns: string[];
+                }[] | undefined;
+                kube_context_patterns?: string[] | undefined;
+                kube_namespace_patterns?: string[] | undefined;
+            };
+        }[] | undefined;
+    } | undefined;
     permission_profiles?: Record<string, {
         description?: string | undefined;
         actions?: {
@@ -2843,6 +3185,12 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             required: string[];
             run: string[];
         } | undefined;
+        when?: {
+            "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+            "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+            "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+            "action.reversible"?: boolean | undefined;
+        } | undefined;
     }[];
     policy_packs: {
         name: string;
@@ -2851,6 +3199,32 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
         config: Record<string, unknown>;
         description?: string | undefined;
     }[];
+    risk: {
+        classifiers: {
+            patterns: {
+                pattern: string;
+                categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+                severity: "low" | "medium" | "high" | "critical";
+            }[];
+            name: string;
+            tool: string;
+        }[];
+    };
+    environments: {
+        resolvers: {
+            name: string;
+            environment: "production" | "staging" | "dev" | "local";
+            signals: {
+                branch_patterns?: string[] | undefined;
+                env_var_patterns?: {
+                    var: string;
+                    patterns: string[];
+                }[] | undefined;
+                kube_context_patterns?: string[] | undefined;
+                kube_namespace_patterns?: string[] | undefined;
+            };
+        }[];
+    };
     permission_profiles: Record<string, {
         actions: {
             push?: {
@@ -3106,6 +3480,12 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             required: string[];
             run: string[];
         } | undefined;
+        when?: {
+            "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+            "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+            "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+            "action.reversible"?: boolean | undefined;
+        } | undefined;
     }[] | undefined;
     policy_packs?: {
         name: string;
@@ -3114,6 +3494,32 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
         source?: string | undefined;
         config?: Record<string, unknown> | undefined;
     }[] | undefined;
+    risk?: {
+        classifiers?: {
+            patterns: {
+                pattern: string;
+                categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+                severity: "low" | "medium" | "high" | "critical";
+            }[];
+            name: string;
+            tool: string;
+        }[] | undefined;
+    } | undefined;
+    environments?: {
+        resolvers?: {
+            name: string;
+            environment: "production" | "staging" | "dev" | "local";
+            signals: {
+                branch_patterns?: string[] | undefined;
+                env_var_patterns?: {
+                    var: string;
+                    patterns: string[];
+                }[] | undefined;
+                kube_context_patterns?: string[] | undefined;
+                kube_namespace_patterns?: string[] | undefined;
+            };
+        }[] | undefined;
+    } | undefined;
     permission_profiles?: Record<string, {
         description?: string | undefined;
         actions?: {
@@ -3267,6 +3673,8 @@ export * from "./hooks.js";
 export * from "./permission-profiles.js";
 export * from "./policies.js";
 export * from "./policy-packs.js";
+export * from "./risk.js";
+export * from "./environments.js";
 export * from "./workflows.js";
 export * from "./audit.js";
 export * from "./extract.js";

package/dist/schema/index.js

@@ -1,10 +1,12 @@
 import { z } from "zod";
+import { EnvironmentsSchema } from "./environments.js";
 import { GroundingSchema } from "./grounding.js";
 import { HooksSchema } from "./hooks.js";
 import { MemorySchema } from "./memory.js";
 import { PoliciesSchema } from "./policies.js";
 import { PermissionProfilesSchema } from "./permission-profiles.js";
 import { PolicyPacksSchema } from "./policy-packs.js";
+import { RiskSchema } from "./risk.js";
 import { ToolsSchema } from "./tools.js";
 import { AuditSchema } from "./audit.js";
 import { ReviewTemplatesSchema, WorkflowsSchema } from "./workflows.js";
@@ -18,6 +20,10 @@ export const ManifestSchema = z
     hooks: HooksSchema.default([]),
     policies: PoliciesSchema.default([]),
     policy_packs: PolicyPacksSchema.default([]),
+    // Phase 7 Risk Gate inputs — schema vocabulary only, no runtime
+    // surface reads them yet. See docs/risk-gate.md.
+    risk: RiskSchema.default({}),
+    environments: EnvironmentsSchema.default({}),
     permission_profiles: PermissionProfilesSchema.default({}),
     workflows: WorkflowsSchema.default([]),
     review_templates: ReviewTemplatesSchema.default({}),
@@ -75,6 +81,8 @@ export * from "./hooks.js";
 export * from "./permission-profiles.js";
 export * from "./policies.js";
 export * from "./policy-packs.js";
+export * from "./risk.js";
+export * from "./environments.js";
 export * from "./workflows.js";
 export * from "./audit.js";
 export * from "./extract.js";

package/dist/schema/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/schema/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAExE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAE5C,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC;IAC9C,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;IACtC,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9B,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;IAChC,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9B,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;IACpC,YAAY,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3C,mBAAmB,EAAE,wBAAwB,CAAC,OAAO,CAAC,EAAE,CAAC;IACzD,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;IACtC,gBAAgB,EAAE,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;IACnD,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;CAC/B,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;IAC7B,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACjC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,EAAE,MAAM,CAAC;gBAC7B,OAAO,EAAE,WAAW,CAAC,CAAC,IAAI,sBAAsB,CAAC,CAAC,IAAI,oCAAoC;aAC3F,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACtE,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE;QACpC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE;YAC5B,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACnE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACtC,GAAG,CAAC,QAAQ,CAAC;wBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;wBAC3B,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,CAAC;wBAChD,OAAO,EAAE,6BAA6B,IAAI,CAAC,QAAQ,sCAAsC;qBAC1F,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAIL,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAGzB;IAFlB,YACE,OAAe,EACC,MAAoB;QAEpC,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,WAAM,GAAN,MAAM,CAAc;QAGpC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;aAChC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aAC7D,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,kBAAkB,CAC1B,wCAAwC,OAAO,EAAE,EACjD,MAAM,CAAC,KAAK,CAAC,MAAM,CACpB,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,0BAA0B,CAAC;AACzC,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/schema/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAExE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAE5C,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC;IAC9C,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;IACtC,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9B,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;IAChC,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9B,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;IACpC,YAAY,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3C,gEAAgE;IAChE,iDAAiD;IACjD,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5B,YAAY,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,mBAAmB,EAAE,wBAAwB,CAAC,OAAO,CAAC,EAAE,CAAC;IACzD,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;IACtC,gBAAgB,EAAE,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;IACnD,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;CAC/B,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;IAC7B,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACjC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,EAAE,MAAM,CAAC;gBAC7B,OAAO,EAAE,WAAW,CAAC,CAAC,IAAI,sBAAsB,CAAC,CAAC,IAAI,oCAAoC;aAC3F,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACtE,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE;QACpC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE;YAC5B,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACnE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACtC,GAAG,CAAC,QAAQ,CAAC;wBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;wBAC3B,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,CAAC;wBAChD,OAAO,EAAE,6BAA6B,IAAI,CAAC,QAAQ,sCAAsC;qBAC1F,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAIL,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAGzB;IAFlB,YACE,OAAe,EACC,MAAoB;QAEpC,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,WAAM,GAAN,MAAM,CAAc;QAGpC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;aAChC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aAC7D,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,kBAAkB,CAC1B,wCAAwC,OAAO,EAAE,EACjD,MAAM,CAAC,KAAK,CAAC,MAAM,CACpB,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,0BAA0B,CAAC;AACzC,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,cAAc,WAAW,CAAC;AAC1B,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC"}