@lannguyensi/harness 0.25.2 → 0.26.0

package/dist/schema/policies.d.ts

@@ -72,6 +72,32 @@ export declare const PolicyUxSchema: z.ZodObject<{
     required: string[];
     run: string[];
 }>;
+export declare const PolicyWhenSchema: z.ZodEffects<z.ZodObject<{
+    "risk.severity_at_least": z.ZodOptional<z.ZodEnum<["low", "medium", "high", "critical"]>>;
+    "risk.category_in": z.ZodOptional<z.ZodArray<z.ZodEnum<["destructive", "data_loss", "production_mutation", "credential_access", "secret_exfiltration", "network_exfiltration", "deployment_change", "infrastructure_change", "privilege_escalation", "irreversible_action", "mass_update"]>, "many">>;
+    "environment.name": z.ZodOptional<z.ZodEnum<["production", "staging", "dev", "local", "unknown"]>>;
+    "action.reversible": z.ZodOptional<z.ZodBoolean>;
+}, "strict", z.ZodTypeAny, {
+    "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+    "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+    "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+    "action.reversible"?: boolean | undefined;
+}, {
+    "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+    "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+    "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+    "action.reversible"?: boolean | undefined;
+}>, {
+    "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+    "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+    "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+    "action.reversible"?: boolean | undefined;
+}, {
+    "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+    "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+    "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+    "action.reversible"?: boolean | undefined;
+}>;
 export declare const PolicySchema: z.ZodEffects<z.ZodObject<{
     name: z.ZodString;
     description: z.ZodString;
@@ -217,6 +243,32 @@ export declare const PolicySchema: z.ZodEffects<z.ZodObject<{
         required: string[];
         run: string[];
     }>>;
+    when: z.ZodOptional<z.ZodEffects<z.ZodObject<{
+        "risk.severity_at_least": z.ZodOptional<z.ZodEnum<["low", "medium", "high", "critical"]>>;
+        "risk.category_in": z.ZodOptional<z.ZodArray<z.ZodEnum<["destructive", "data_loss", "production_mutation", "credential_access", "secret_exfiltration", "network_exfiltration", "deployment_change", "infrastructure_change", "privilege_escalation", "irreversible_action", "mass_update"]>, "many">>;
+        "environment.name": z.ZodOptional<z.ZodEnum<["production", "staging", "dev", "local", "unknown"]>>;
+        "action.reversible": z.ZodOptional<z.ZodBoolean>;
+    }, "strict", z.ZodTypeAny, {
+        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+        "action.reversible"?: boolean | undefined;
+    }, {
+        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+        "action.reversible"?: boolean | undefined;
+    }>, {
+        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+        "action.reversible"?: boolean | undefined;
+    }, {
+        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+        "action.reversible"?: boolean | undefined;
+    }>>;
 }, "strict", z.ZodTypeAny, {
     name: string;
     description: string;
@@ -258,6 +310,12 @@ export declare const PolicySchema: z.ZodEffects<z.ZodObject<{
         required: string[];
         run: string[];
     } | undefined;
+    when?: {
+        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+        "action.reversible"?: boolean | undefined;
+    } | undefined;
 }, {
     name: string;
     description: string;
@@ -299,6 +357,12 @@ export declare const PolicySchema: z.ZodEffects<z.ZodObject<{
         required: string[];
         run: string[];
     } | undefined;
+    when?: {
+        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+        "action.reversible"?: boolean | undefined;
+    } | undefined;
 }>, {
     name: string;
     description: string;
@@ -340,6 +404,12 @@ export declare const PolicySchema: z.ZodEffects<z.ZodObject<{
         required: string[];
         run: string[];
     } | undefined;
+    when?: {
+        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+        "action.reversible"?: boolean | undefined;
+    } | undefined;
 }, {
     name: string;
     description: string;
@@ -381,6 +451,12 @@ export declare const PolicySchema: z.ZodEffects<z.ZodObject<{
         required: string[];
         run: string[];
     } | undefined;
+    when?: {
+        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+        "action.reversible"?: boolean | undefined;
+    } | undefined;
 }>;
 export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodObject<{
     name: z.ZodString;
@@ -527,6 +603,32 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         required: string[];
         run: string[];
     }>>;
+    when: z.ZodOptional<z.ZodEffects<z.ZodObject<{
+        "risk.severity_at_least": z.ZodOptional<z.ZodEnum<["low", "medium", "high", "critical"]>>;
+        "risk.category_in": z.ZodOptional<z.ZodArray<z.ZodEnum<["destructive", "data_loss", "production_mutation", "credential_access", "secret_exfiltration", "network_exfiltration", "deployment_change", "infrastructure_change", "privilege_escalation", "irreversible_action", "mass_update"]>, "many">>;
+        "environment.name": z.ZodOptional<z.ZodEnum<["production", "staging", "dev", "local", "unknown"]>>;
+        "action.reversible": z.ZodOptional<z.ZodBoolean>;
+    }, "strict", z.ZodTypeAny, {
+        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+        "action.reversible"?: boolean | undefined;
+    }, {
+        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+        "action.reversible"?: boolean | undefined;
+    }>, {
+        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+        "action.reversible"?: boolean | undefined;
+    }, {
+        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+        "action.reversible"?: boolean | undefined;
+    }>>;
 }, "strict", z.ZodTypeAny, {
     name: string;
     description: string;
@@ -568,6 +670,12 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         required: string[];
         run: string[];
     } | undefined;
+    when?: {
+        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+        "action.reversible"?: boolean | undefined;
+    } | undefined;
 }, {
     name: string;
     description: string;
@@ -609,6 +717,12 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         required: string[];
         run: string[];
     } | undefined;
+    when?: {
+        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+        "action.reversible"?: boolean | undefined;
+    } | undefined;
 }>, {
     name: string;
     description: string;
@@ -650,6 +764,12 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         required: string[];
         run: string[];
     } | undefined;
+    when?: {
+        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+        "action.reversible"?: boolean | undefined;
+    } | undefined;
 }, {
     name: string;
     description: string;
@@ -691,6 +811,12 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         required: string[];
         run: string[];
     } | undefined;
+    when?: {
+        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+        "action.reversible"?: boolean | undefined;
+    } | undefined;
 }>, "many">, {
     name: string;
     description: string;
@@ -732,6 +858,12 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         required: string[];
         run: string[];
     } | undefined;
+    when?: {
+        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+        "action.reversible"?: boolean | undefined;
+    } | undefined;
 }[], {
     name: string;
     description: string;
@@ -773,7 +905,14 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         required: string[];
         run: string[];
     } | undefined;
+    when?: {
+        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+        "action.reversible"?: boolean | undefined;
+    } | undefined;
 }[]>;
 export type Policy = z.infer<typeof PolicySchema>;
 export type Producer = z.infer<typeof ProducerSchema>;
 export type PolicyUx = z.infer<typeof PolicyUxSchema>;
+export type PolicyWhen = z.infer<typeof PolicyWhenSchema>;

package/dist/schema/policies.js

@@ -1,7 +1,9 @@
 import { z } from "zod";
+import { MatchableEnvironmentSchema } from "./environments.js";
 import { ExtractMapSchema } from "./extract.js";
 import { HookEventSchema } from "./hooks.js";
 import { RequiresSchema, isBuiltinVariable, referencedVariables } from "./requires.js";
+import { RiskCategorySchema, RiskSeveritySchema } from "./risk.js";
 export const PolicyTriggerSchema = z
     .object({
     event: HookEventSchema,
@@ -79,6 +81,42 @@ export const PolicyUxSchema = z
     run: z.array(z.string().min(1)).min(1),
 })
     .strict();
+// `when:` — Phase 7 #1 anchor. The risk/environment-aware match layer.
+//
+// STATUS: schema vocabulary only. `harness policy intercept` does NOT
+// evaluate `when:` yet — a policy's `trigger:` remains the sole match
+// surface at runtime. The Phase 7 #5 evaluator will AND a declared
+// `when:` onto the trigger match, reading the enriched Action Envelope
+// (see docs/ROADMAP.md and docs/risk-gate.md). A `when:` block today is
+// parsed, validated, and otherwise inert.
+//
+// Each clause is optional and keyed by the envelope path it tests:
+//   risk.severity_at_least — envelope risk severity at or above this
+//                            rung of the ordered scale.
+//   risk.category_in       — envelope risk carries any of these
+//                            categories.
+//   environment.name       — resolved environment equals this name
+//                            (`unknown` is matchable: unknown is not
+//                            safe).
+//   action.reversible      — envelope action reversibility flag.
+// An empty `when: {}` is rejected: it would be a silent no-op.
+export const PolicyWhenSchema = z
+    .object({
+    "risk.severity_at_least": RiskSeveritySchema.optional(),
+    "risk.category_in": z.array(RiskCategorySchema).min(1).optional(),
+    "environment.name": MatchableEnvironmentSchema.optional(),
+    "action.reversible": z.boolean().optional(),
+})
+    .strict()
+    .superRefine((when, ctx) => {
+    if (Object.keys(when).length === 0) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: [],
+            message: "policy.when must declare at least one clause; an empty when: {} is a silent no-op",
+        });
+    }
+});
 export const PolicySchema = z
     .object({
     name: z.string().min(1),
@@ -89,6 +127,7 @@ export const PolicySchema = z
     enforcement: PolicyEnforcementSchema,
     producers: z.array(ProducerSchema).min(1).optional(),
     ux: PolicyUxSchema.optional(),
+    when: PolicyWhenSchema.optional(),
 })
     .strict()
     .superRefine((policy, ctx) => {

package/dist/schema/policies.js.map

@@ -1 +1 @@
-{"version":3,"file":"policies.js","sourceRoot":"","sources":["../../src/schema/policies.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEvF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,KAAK,EAAE,eAAe;IACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,OAAO,EAAE,gBAAgB,CAAC,QAAQ,EAAE;CACrC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAEjE,oEAAoE;AACpE,wEAAwE;AACxE,kEAAkE;AAClE,qBAAqB;AACrB,qEAAqE;AACrE,kEAAkE;AAClE,wGAAwG;AACxG,mEAAmE;AACnE,0EAA0E;AAC1E,0DAA0D;AAC1D,EAAE;AACF,uEAAuE;AACvE,wEAAwE;AACxE,oEAAoE;AACpE,6BAA6B;AAC7B,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACzD,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/B,CAAC;SACD,MAAM,EAAE;IACX,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/B,CAAC;SACD,MAAM,EAAE;IACX,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/B,CAAC;SACD,MAAM,EAAE;CACZ,CAAC,CAAC;AAEH,qEAAqE;AACrE,EAAE;AACF,oEAAoE;AACpE,8DAA8D;AAC9D,sEAAsE;AACtE,uEAAuE;AACvE,wDAAwD;AACxD,kEAAkE;AAClE,EAAE;AACF,qEAAqE;AACrE,sEAAsE;AACtE,mEAAmE;AACnE,sEAAsE;AACtE,oEAAoE;AACpE,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,qEAAqE;AACrE,cAAc;AACd,8DAA8D;AAC9D,oEAAoE;AACpE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACvC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,OAAO,EAAE,mBAAmB;IAC5B,QAAQ,EAAE,cAAc;IACxB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,WAAW,EAAE,uBAAuB;IACpC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD,EAAE,EAAE,cAAc,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC3B,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;IACpE,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,iBAAiB,CAAC,CAAC,CAAC;YAAE,SAAS;QACnC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,UAAU,EAAE,YAAY,CAAC;gBAChC,OAAO,EAAE,qCAAqC,CAAC,sDAAsD;aACtG,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,WAAW,CAAC;gBACnB,OAAO,EACL,2HAA2H;aAC9H,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;IAChF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACxB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC;gBACjB,OAAO,EAAE,0BAA0B,CAAC,CAAC,IAAI,EAAE;aAC5C,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"policies.js","sourceRoot":"","sources":["../../src/schema/policies.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAEnE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,KAAK,EAAE,eAAe;IACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,OAAO,EAAE,gBAAgB,CAAC,QAAQ,EAAE;CACrC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAEjE,oEAAoE;AACpE,wEAAwE;AACxE,kEAAkE;AAClE,qBAAqB;AACrB,qEAAqE;AACrE,kEAAkE;AAClE,wGAAwG;AACxG,mEAAmE;AACnE,0EAA0E;AAC1E,0DAA0D;AAC1D,EAAE;AACF,uEAAuE;AACvE,wEAAwE;AACxE,oEAAoE;AACpE,6BAA6B;AAC7B,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACzD,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/B,CAAC;SACD,MAAM,EAAE;IACX,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/B,CAAC;SACD,MAAM,EAAE;IACX,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/B,CAAC;SACD,MAAM,EAAE;CACZ,CAAC,CAAC;AAEH,qEAAqE;AACrE,EAAE;AACF,oEAAoE;AACpE,8DAA8D;AAC9D,sEAAsE;AACtE,uEAAuE;AACvE,wDAAwD;AACxD,kEAAkE;AAClE,EAAE;AACF,qEAAqE;AACrE,sEAAsE;AACtE,mEAAmE;AACnE,sEAAsE;AACtE,oEAAoE;AACpE,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,qEAAqE;AACrE,cAAc;AACd,8DAA8D;AAC9D,oEAAoE;AACpE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACvC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,uEAAuE;AACvE,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,mEAAmE;AACnE,uEAAuE;AACvE,wEAAwE;AACxE,0CAA0C;AAC1C,EAAE;AACF,mEAAmE;AACnE,qEAAqE;AACrE,wDAAwD;AACxD,gEAAgE;AAChE,yCAAyC;AACzC,mEAAmE;AACnE,qEAAqE;AACrE,oCAAoC;AACpC,iEAAiE;AACjE,+DAA+D;AAC/D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,wBAAwB,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACvD,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjE,kBAAkB,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IACzD,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC5C,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,EAAE;YACR,OAAO,EACL,mFAAmF;SACtF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,OAAO,EAAE,mBAAmB;IAC5B,QAAQ,EAAE,cAAc;IACxB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,WAAW,EAAE,uBAAuB;IACpC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD,EAAE,EAAE,cAAc,CAAC,QAAQ,EAAE;IAC7B,IAAI,EAAE,gBAAgB,CAAC,QAAQ,EAAE;CAClC,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC3B,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;IACpE,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,iBAAiB,CAAC,CAAC,CAAC;YAAE,SAAS;QACnC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,UAAU,EAAE,YAAY,CAAC;gBAChC,OAAO,EAAE,qCAAqC,CAAC,sDAAsD;aACtG,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,WAAW,CAAC;gBACnB,OAAO,EACL,2HAA2H;aAC9H,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;IAChF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACxB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC;gBACjB,OAAO,EAAE,0BAA0B,CAAC,CAAC,IAAI,EAAE;aAC5C,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/schema/risk.d.ts

@@ -0,0 +1,131 @@
+import { z } from "zod";
+export declare const RiskSeveritySchema: z.ZodEnum<["low", "medium", "high", "critical"]>;
+export declare const RiskCategorySchema: z.ZodEnum<["destructive", "data_loss", "production_mutation", "credential_access", "secret_exfiltration", "network_exfiltration", "deployment_change", "infrastructure_change", "privilege_escalation", "irreversible_action", "mass_update"]>;
+export declare const RiskClassifierSchema: z.ZodObject<{
+    name: z.ZodString;
+    tool: z.ZodString;
+    patterns: z.ZodArray<z.ZodEffects<z.ZodObject<{
+        pattern: z.ZodString;
+        categories: z.ZodArray<z.ZodEnum<["destructive", "data_loss", "production_mutation", "credential_access", "secret_exfiltration", "network_exfiltration", "deployment_change", "infrastructure_change", "privilege_escalation", "irreversible_action", "mass_update"]>, "many">;
+        severity: z.ZodEnum<["low", "medium", "high", "critical"]>;
+    }, "strict", z.ZodTypeAny, {
+        pattern: string;
+        categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+        severity: "low" | "medium" | "high" | "critical";
+    }, {
+        pattern: string;
+        categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+        severity: "low" | "medium" | "high" | "critical";
+    }>, {
+        pattern: string;
+        categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+        severity: "low" | "medium" | "high" | "critical";
+    }, {
+        pattern: string;
+        categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+        severity: "low" | "medium" | "high" | "critical";
+    }>, "many">;
+}, "strict", z.ZodTypeAny, {
+    patterns: {
+        pattern: string;
+        categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+        severity: "low" | "medium" | "high" | "critical";
+    }[];
+    name: string;
+    tool: string;
+}, {
+    patterns: {
+        pattern: string;
+        categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+        severity: "low" | "medium" | "high" | "critical";
+    }[];
+    name: string;
+    tool: string;
+}>;
+export declare const RiskSchema: z.ZodEffects<z.ZodObject<{
+    classifiers: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        tool: z.ZodString;
+        patterns: z.ZodArray<z.ZodEffects<z.ZodObject<{
+            pattern: z.ZodString;
+            categories: z.ZodArray<z.ZodEnum<["destructive", "data_loss", "production_mutation", "credential_access", "secret_exfiltration", "network_exfiltration", "deployment_change", "infrastructure_change", "privilege_escalation", "irreversible_action", "mass_update"]>, "many">;
+            severity: z.ZodEnum<["low", "medium", "high", "critical"]>;
+        }, "strict", z.ZodTypeAny, {
+            pattern: string;
+            categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+            severity: "low" | "medium" | "high" | "critical";
+        }, {
+            pattern: string;
+            categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+            severity: "low" | "medium" | "high" | "critical";
+        }>, {
+            pattern: string;
+            categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+            severity: "low" | "medium" | "high" | "critical";
+        }, {
+            pattern: string;
+            categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+            severity: "low" | "medium" | "high" | "critical";
+        }>, "many">;
+    }, "strict", z.ZodTypeAny, {
+        patterns: {
+            pattern: string;
+            categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+            severity: "low" | "medium" | "high" | "critical";
+        }[];
+        name: string;
+        tool: string;
+    }, {
+        patterns: {
+            pattern: string;
+            categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+            severity: "low" | "medium" | "high" | "critical";
+        }[];
+        name: string;
+        tool: string;
+    }>, "many">>;
+}, "strict", z.ZodTypeAny, {
+    classifiers: {
+        patterns: {
+            pattern: string;
+            categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+            severity: "low" | "medium" | "high" | "critical";
+        }[];
+        name: string;
+        tool: string;
+    }[];
+}, {
+    classifiers?: {
+        patterns: {
+            pattern: string;
+            categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+            severity: "low" | "medium" | "high" | "critical";
+        }[];
+        name: string;
+        tool: string;
+    }[] | undefined;
+}>, {
+    classifiers: {
+        patterns: {
+            pattern: string;
+            categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+            severity: "low" | "medium" | "high" | "critical";
+        }[];
+        name: string;
+        tool: string;
+    }[];
+}, {
+    classifiers?: {
+        patterns: {
+            pattern: string;
+            categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+            severity: "low" | "medium" | "high" | "critical";
+        }[];
+        name: string;
+        tool: string;
+    }[] | undefined;
+}>;
+export type RiskSeverity = z.infer<typeof RiskSeveritySchema>;
+export type RiskCategory = z.infer<typeof RiskCategorySchema>;
+export type RiskClassifier = z.infer<typeof RiskClassifierSchema>;
+export type RiskConfig = z.infer<typeof RiskSchema>;

package/dist/schema/risk.js

@@ -0,0 +1,87 @@
+import { z } from "zod";
+// Risk Gate vocabulary — Phase 7 #1 anchor.
+//
+// STATUS: schema vocabulary only. `harness validate` parses and
+// validates a `risk:` block, but no runtime surface reads it yet. The
+// Risk Classifier that consumes `risk.classifiers[]` to assign an
+// Action Envelope a severity + categories lands in Phase 7 #3 (see
+// docs/ROADMAP.md and docs/risk-gate.md). Until then a `risk:` block is
+// inert, validated config.
+//
+// Design source: lava-ice-logs/2026-04-30/harness-risk-gate-extension.md.
+// Severity is an ordered scale: a future `when.risk.severity_at_least:
+// high` clause matches `high` and `critical`. The ordering is the enum
+// declaration order — the Phase 7 #5 evaluator derives the comparison
+// from `RiskSeveritySchema.options`. This anchor only fixes the set.
+export const RiskSeveritySchema = z.enum(["low", "medium", "high", "critical"]);
+// Closed category vocabulary. Phase 7 #1 deliberately ships a fixed set
+// rather than a free-form string: a typo (`data-loss` for `data_loss`)
+// is then a validate-time error instead of a clause that silently never
+// matches, and `when.risk.category_in` stays statically checkable. New
+// categories are a schema addition, not operator config — see
+// docs/risk-gate.md for the rationale and the v2 escape hatch.
+export const RiskCategorySchema = z.enum([
+    "destructive",
+    "data_loss",
+    "production_mutation",
+    "credential_access",
+    "secret_exfiltration",
+    "network_exfiltration",
+    "deployment_change",
+    "infrastructure_change",
+    "privilege_escalation",
+    "irreversible_action",
+    "mass_update",
+]);
+// One pattern → (categories, severity) assignment. `pattern` is a
+// regular expression matched against the classified tool's raw input
+// (the exact field and match semantics are the Phase 7 #3 classifier's
+// concern; the anchor only stores and regex-validates the string).
+const RiskPatternSchema = z
+    .object({
+    pattern: z.string().min(1),
+    categories: z.array(RiskCategorySchema).min(1),
+    severity: RiskSeveritySchema,
+})
+    .strict()
+    .superRefine((rule, ctx) => {
+    try {
+        new RegExp(rule.pattern);
+    }
+    catch (err) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ["pattern"],
+            message: `invalid regex: ${err.message}`,
+        });
+    }
+});
+export const RiskClassifierSchema = z
+    .object({
+    name: z.string().min(1),
+    // The tool name whose input the classifier's patterns run against
+    // (e.g. `Bash`). The matcher that binds a classifier to a live tool
+    // event is Phase 7 #3; the anchor only records the binding.
+    tool: z.string().min(1),
+    patterns: z.array(RiskPatternSchema).min(1),
+})
+    .strict();
+export const RiskSchema = z
+    .object({
+    classifiers: z.array(RiskClassifierSchema).default([]),
+})
+    .strict()
+    .superRefine((risk, ctx) => {
+    const seen = new Set();
+    risk.classifiers.forEach((c, i) => {
+        if (seen.has(c.name)) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: ["classifiers", i, "name"],
+                message: `duplicate risk classifier name: ${c.name}`,
+            });
+        }
+        seen.add(c.name);
+    });
+});
+//# sourceMappingURL=risk.js.map

package/dist/schema/risk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"risk.js","sourceRoot":"","sources":["../../src/schema/risk.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,4CAA4C;AAC5C,EAAE;AACF,gEAAgE;AAChE,sEAAsE;AACtE,kEAAkE;AAClE,mEAAmE;AACnE,wEAAwE;AACxE,2BAA2B;AAC3B,EAAE;AACF,0EAA0E;AAE1E,uEAAuE;AACvE,uEAAuE;AACvE,sEAAsE;AACtE,qEAAqE;AACrE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAEhF,wEAAwE;AACxE,uEAAuE;AACvE,wEAAwE;AACxE,uEAAuE;AACvE,8DAA8D;AAC9D,+DAA+D;AAC/D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC;IACvC,aAAa;IACb,WAAW;IACX,qBAAqB;IACrB,mBAAmB;IACnB,qBAAqB;IACrB,sBAAsB;IACtB,mBAAmB;IACnB,uBAAuB;IACvB,sBAAsB;IACtB,qBAAqB;IACrB,aAAa;CACd,CAAC,CAAC;AAEH,kEAAkE;AAClE,qEAAqE;AACrE,uEAAuE;AACvE,mEAAmE;AACnE,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,QAAQ,EAAE,kBAAkB;CAC7B,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,SAAS,CAAC;YACjB,OAAO,EAAE,kBAAmB,GAAa,CAAC,OAAO,EAAE;SACpD,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,kEAAkE;IAClE,oEAAoE;IACpE,4DAA4D;IAC5D,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACvD,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAChC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,aAAa,EAAE,CAAC,EAAE,MAAM,CAAC;gBAChC,OAAO,EAAE,mCAAmC,CAAC,CAAC,IAAI,EAAE;aACrD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lannguyensi/harness",
-  "version": "0.25.2",
+  "version": "0.26.0",
   "description": "Declarative control plane for agent harnesses — one YAML for grounding, tools, memory, and hooks.",
   "license": "MIT",
   "homepage": "https://github.com/LanNguyenSi/harness",

package/dist/cli/pack/pause-check.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pause-check.js","sourceRoot":"","sources":["../../../src/cli/pack/pause-check.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,uEAAuE;AACvE,sEAAsE;AACtE,uEAAuE;AACvE,qEAAqE;AACrE,sCAAsC;AACtC,EAAE;AACF,uEAAuE;AACvE,uEAAuE;AACvE,qEAAqE;AACrE,2BAA2B;AAE3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,YAAY,EAAsB,MAAM,cAAc,CAAC;AAehE;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAuB;IAC1D,IAAI,YAAoB,CAAC;IACzB,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACpC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IACnC,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;YACrC,YAAY,GAAG,mBAAmB,CAAC;gBACjC,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,YAAY,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI;aACxC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,mEAAmE;YACnE,oCAAoC;YACpC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,MAAM,YAAY,GAA6C;QAC7D,YAAY;QACZ,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC;IACF,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,YAAY,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IACjE,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS;QAAE,YAAY,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACxD,OAAO,kBAAkB,CAAC,YAAY,CAAC,CAAC;AAC1C,CAAC"}