@lannguyensi/harness 0.25.2 → 0.27.0

package/dist/schema/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/schema/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAExE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAE5C,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC;IAC9C,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;IACtC,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9B,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;IAChC,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9B,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;IACpC,YAAY,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3C,mBAAmB,EAAE,wBAAwB,CAAC,OAAO,CAAC,EAAE,CAAC;IACzD,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;IACtC,gBAAgB,EAAE,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;IACnD,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;CAC/B,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;IAC7B,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACjC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,EAAE,MAAM,CAAC;gBAC7B,OAAO,EAAE,WAAW,CAAC,CAAC,IAAI,sBAAsB,CAAC,CAAC,IAAI,oCAAoC;aAC3F,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACtE,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE;QACpC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE;YAC5B,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACnE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACtC,GAAG,CAAC,QAAQ,CAAC;wBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;wBAC3B,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,CAAC;wBAChD,OAAO,EAAE,6BAA6B,IAAI,CAAC,QAAQ,sCAAsC;qBAC1F,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAIL,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAGzB;IAFlB,YACE,OAAe,EACC,MAAoB;QAEpC,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,WAAM,GAAN,MAAM,CAAc;QAGpC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;aAChC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aAC7D,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,kBAAkB,CAC1B,wCAAwC,OAAO,EAAE,EACjD,MAAM,CAAC,KAAK,CAAC,MAAM,CACpB,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,0BAA0B,CAAC;AACzC,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/schema/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAExE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAE5C,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC;IAC9C,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;IACtC,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9B,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;IAChC,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9B,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;IACpC,YAAY,EAAE,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3C,gEAAgE;IAChE,iDAAiD;IACjD,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5B,YAAY,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,mBAAmB,EAAE,wBAAwB,CAAC,OAAO,CAAC,EAAE,CAAC;IACzD,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;IACtC,gBAAgB,EAAE,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;IACnD,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;CAC/B,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;IAC7B,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACjC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC,EAAE,MAAM,CAAC;gBAC7B,OAAO,EAAE,WAAW,CAAC,CAAC,IAAI,sBAAsB,CAAC,CAAC,IAAI,oCAAoC;aAC3F,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACtE,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE;QACpC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE;YAC5B,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACnE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACtC,GAAG,CAAC,QAAQ,CAAC;wBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;wBAC3B,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,CAAC;wBAChD,OAAO,EAAE,6BAA6B,IAAI,CAAC,QAAQ,sCAAsC;qBAC1F,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAIL,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAGzB;IAFlB,YACE,OAAe,EACC,MAAoB;QAEpC,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,WAAM,GAAN,MAAM,CAAc;QAGpC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;aAChC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aAC7D,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,IAAI,kBAAkB,CAC1B,wCAAwC,OAAO,EAAE,EACjD,MAAM,CAAC,KAAK,CAAC,MAAM,CACpB,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,0BAA0B,CAAC;AACzC,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,cAAc,WAAW,CAAC;AAC1B,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC"}

package/dist/schema/policies.d.ts

@@ -18,7 +18,7 @@ export declare const PolicyTriggerSchema: z.ZodObject<{
     bash_match?: string | undefined;
     extract?: Record<string, string> | undefined;
 }>;
-export declare const PolicyEnforcementSchema: z.ZodEnum<["block", "warn"]>;
+export declare const PolicyEnforcementSchema: z.ZodEnum<["block", "warn", "require_approval"]>;
 export declare const ProducerSchema: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
     kind: z.ZodLiteral<"bash">;
     command: z.ZodString;
@@ -72,6 +72,32 @@ export declare const PolicyUxSchema: z.ZodObject<{
     required: string[];
     run: string[];
 }>;
+export declare const PolicyWhenSchema: z.ZodEffects<z.ZodObject<{
+    "risk.severity_at_least": z.ZodOptional<z.ZodEnum<["low", "medium", "high", "critical"]>>;
+    "risk.category_in": z.ZodOptional<z.ZodArray<z.ZodEnum<["destructive", "data_loss", "production_mutation", "credential_access", "secret_exfiltration", "network_exfiltration", "deployment_change", "infrastructure_change", "privilege_escalation", "irreversible_action", "mass_update"]>, "many">>;
+    "environment.name": z.ZodOptional<z.ZodEnum<["production", "staging", "dev", "local", "unknown"]>>;
+    "action.reversible": z.ZodOptional<z.ZodBoolean>;
+}, "strict", z.ZodTypeAny, {
+    "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+    "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+    "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+    "action.reversible"?: boolean | undefined;
+}, {
+    "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+    "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+    "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+    "action.reversible"?: boolean | undefined;
+}>, {
+    "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+    "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+    "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+    "action.reversible"?: boolean | undefined;
+}, {
+    "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+    "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+    "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+    "action.reversible"?: boolean | undefined;
+}>;
 export declare const PolicySchema: z.ZodEffects<z.ZodObject<{
     name: z.ZodString;
     description: z.ZodString;
@@ -163,7 +189,7 @@ export declare const PolicySchema: z.ZodEffects<z.ZodObject<{
         at_head?: boolean | undefined;
     }>;
     hook: z.ZodString;
-    enforcement: z.ZodEnum<["block", "warn"]>;
+    enforcement: z.ZodEnum<["block", "warn", "require_approval"]>;
     producers: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
         kind: z.ZodLiteral<"bash">;
         command: z.ZodString;
@@ -217,6 +243,32 @@ export declare const PolicySchema: z.ZodEffects<z.ZodObject<{
         required: string[];
         run: string[];
     }>>;
+    when: z.ZodOptional<z.ZodEffects<z.ZodObject<{
+        "risk.severity_at_least": z.ZodOptional<z.ZodEnum<["low", "medium", "high", "critical"]>>;
+        "risk.category_in": z.ZodOptional<z.ZodArray<z.ZodEnum<["destructive", "data_loss", "production_mutation", "credential_access", "secret_exfiltration", "network_exfiltration", "deployment_change", "infrastructure_change", "privilege_escalation", "irreversible_action", "mass_update"]>, "many">>;
+        "environment.name": z.ZodOptional<z.ZodEnum<["production", "staging", "dev", "local", "unknown"]>>;
+        "action.reversible": z.ZodOptional<z.ZodBoolean>;
+    }, "strict", z.ZodTypeAny, {
+        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+        "action.reversible"?: boolean | undefined;
+    }, {
+        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+        "action.reversible"?: boolean | undefined;
+    }>, {
+        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+        "action.reversible"?: boolean | undefined;
+    }, {
+        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+        "action.reversible"?: boolean | undefined;
+    }>>;
 }, "strict", z.ZodTypeAny, {
     name: string;
     description: string;
@@ -238,7 +290,7 @@ export declare const PolicySchema: z.ZodEffects<z.ZodObject<{
         at_head?: boolean | undefined;
     };
     hook: string;
-    enforcement: "warn" | "block";
+    enforcement: "warn" | "block" | "require_approval";
     producers?: ({
         command: string;
         description: string;
@@ -258,6 +310,12 @@ export declare const PolicySchema: z.ZodEffects<z.ZodObject<{
         required: string[];
         run: string[];
     } | undefined;
+    when?: {
+        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+        "action.reversible"?: boolean | undefined;
+    } | undefined;
 }, {
     name: string;
     description: string;
@@ -279,7 +337,7 @@ export declare const PolicySchema: z.ZodEffects<z.ZodObject<{
         at_head?: boolean | undefined;
     };
     hook: string;
-    enforcement: "warn" | "block";
+    enforcement: "warn" | "block" | "require_approval";
     producers?: ({
         command: string;
         description: string;
@@ -299,6 +357,12 @@ export declare const PolicySchema: z.ZodEffects<z.ZodObject<{
         required: string[];
         run: string[];
     } | undefined;
+    when?: {
+        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+        "action.reversible"?: boolean | undefined;
+    } | undefined;
 }>, {
     name: string;
     description: string;
@@ -320,7 +384,7 @@ export declare const PolicySchema: z.ZodEffects<z.ZodObject<{
         at_head?: boolean | undefined;
     };
     hook: string;
-    enforcement: "warn" | "block";
+    enforcement: "warn" | "block" | "require_approval";
     producers?: ({
         command: string;
         description: string;
@@ -340,6 +404,12 @@ export declare const PolicySchema: z.ZodEffects<z.ZodObject<{
         required: string[];
         run: string[];
     } | undefined;
+    when?: {
+        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+        "action.reversible"?: boolean | undefined;
+    } | undefined;
 }, {
     name: string;
     description: string;
@@ -361,7 +431,7 @@ export declare const PolicySchema: z.ZodEffects<z.ZodObject<{
         at_head?: boolean | undefined;
     };
     hook: string;
-    enforcement: "warn" | "block";
+    enforcement: "warn" | "block" | "require_approval";
     producers?: ({
         command: string;
         description: string;
@@ -381,6 +451,12 @@ export declare const PolicySchema: z.ZodEffects<z.ZodObject<{
         required: string[];
         run: string[];
     } | undefined;
+    when?: {
+        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+        "action.reversible"?: boolean | undefined;
+    } | undefined;
 }>;
 export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodObject<{
     name: z.ZodString;
@@ -473,7 +549,7 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         at_head?: boolean | undefined;
     }>;
     hook: z.ZodString;
-    enforcement: z.ZodEnum<["block", "warn"]>;
+    enforcement: z.ZodEnum<["block", "warn", "require_approval"]>;
     producers: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
         kind: z.ZodLiteral<"bash">;
         command: z.ZodString;
@@ -527,6 +603,32 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         required: string[];
         run: string[];
     }>>;
+    when: z.ZodOptional<z.ZodEffects<z.ZodObject<{
+        "risk.severity_at_least": z.ZodOptional<z.ZodEnum<["low", "medium", "high", "critical"]>>;
+        "risk.category_in": z.ZodOptional<z.ZodArray<z.ZodEnum<["destructive", "data_loss", "production_mutation", "credential_access", "secret_exfiltration", "network_exfiltration", "deployment_change", "infrastructure_change", "privilege_escalation", "irreversible_action", "mass_update"]>, "many">>;
+        "environment.name": z.ZodOptional<z.ZodEnum<["production", "staging", "dev", "local", "unknown"]>>;
+        "action.reversible": z.ZodOptional<z.ZodBoolean>;
+    }, "strict", z.ZodTypeAny, {
+        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+        "action.reversible"?: boolean | undefined;
+    }, {
+        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+        "action.reversible"?: boolean | undefined;
+    }>, {
+        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+        "action.reversible"?: boolean | undefined;
+    }, {
+        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+        "action.reversible"?: boolean | undefined;
+    }>>;
 }, "strict", z.ZodTypeAny, {
     name: string;
     description: string;
@@ -548,7 +650,7 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         at_head?: boolean | undefined;
     };
     hook: string;
-    enforcement: "warn" | "block";
+    enforcement: "warn" | "block" | "require_approval";
     producers?: ({
         command: string;
         description: string;
@@ -568,6 +670,12 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         required: string[];
         run: string[];
     } | undefined;
+    when?: {
+        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+        "action.reversible"?: boolean | undefined;
+    } | undefined;
 }, {
     name: string;
     description: string;
@@ -589,7 +697,7 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         at_head?: boolean | undefined;
     };
     hook: string;
-    enforcement: "warn" | "block";
+    enforcement: "warn" | "block" | "require_approval";
     producers?: ({
         command: string;
         description: string;
@@ -609,6 +717,12 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         required: string[];
         run: string[];
     } | undefined;
+    when?: {
+        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+        "action.reversible"?: boolean | undefined;
+    } | undefined;
 }>, {
     name: string;
     description: string;
@@ -630,7 +744,7 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         at_head?: boolean | undefined;
     };
     hook: string;
-    enforcement: "warn" | "block";
+    enforcement: "warn" | "block" | "require_approval";
     producers?: ({
         command: string;
         description: string;
@@ -650,6 +764,12 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         required: string[];
         run: string[];
     } | undefined;
+    when?: {
+        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+        "action.reversible"?: boolean | undefined;
+    } | undefined;
 }, {
     name: string;
     description: string;
@@ -671,7 +791,7 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         at_head?: boolean | undefined;
     };
     hook: string;
-    enforcement: "warn" | "block";
+    enforcement: "warn" | "block" | "require_approval";
     producers?: ({
         command: string;
         description: string;
@@ -691,6 +811,12 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         required: string[];
         run: string[];
     } | undefined;
+    when?: {
+        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+        "action.reversible"?: boolean | undefined;
+    } | undefined;
 }>, "many">, {
     name: string;
     description: string;
@@ -712,7 +838,7 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         at_head?: boolean | undefined;
     };
     hook: string;
-    enforcement: "warn" | "block";
+    enforcement: "warn" | "block" | "require_approval";
     producers?: ({
         command: string;
         description: string;
@@ -732,6 +858,12 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         required: string[];
         run: string[];
     } | undefined;
+    when?: {
+        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+        "action.reversible"?: boolean | undefined;
+    } | undefined;
 }[], {
     name: string;
     description: string;
@@ -753,7 +885,7 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         at_head?: boolean | undefined;
     };
     hook: string;
-    enforcement: "warn" | "block";
+    enforcement: "warn" | "block" | "require_approval";
     producers?: ({
         command: string;
         description: string;
@@ -773,7 +905,14 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         required: string[];
         run: string[];
     } | undefined;
+    when?: {
+        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
+        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
+        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
+        "action.reversible"?: boolean | undefined;
+    } | undefined;
 }[]>;
 export type Policy = z.infer<typeof PolicySchema>;
 export type Producer = z.infer<typeof ProducerSchema>;
 export type PolicyUx = z.infer<typeof PolicyUxSchema>;
+export type PolicyWhen = z.infer<typeof PolicyWhenSchema>;

package/dist/schema/policies.js

@@ -1,7 +1,9 @@
 import { z } from "zod";
+import { MatchableEnvironmentSchema } from "./environments.js";
 import { ExtractMapSchema } from "./extract.js";
 import { HookEventSchema } from "./hooks.js";
 import { RequiresSchema, isBuiltinVariable, referencedVariables } from "./requires.js";
+import { RiskCategorySchema, RiskSeveritySchema } from "./risk.js";
 export const PolicyTriggerSchema = z
     .object({
     event: HookEventSchema,
@@ -11,7 +13,19 @@ export const PolicyTriggerSchema = z
     extract: ExtractMapSchema.optional(),
 })
     .strict();
-export const PolicyEnforcementSchema = z.enum(["block", "warn"]);
+// How a policy acts when its `requires:` evidence is absent:
+//   block            — deny the tool call.
+//   warn             — let the call proceed, record + surface a warning.
+//   require_approval  — Phase 7 #5. The evaluator returns a first-class
+//                       `require_approval` outcome, distinct from `deny`
+//                       and `warn`; Phase 7 #6 makes it actually block
+//                       until matching approval evidence exists in the
+//                       ledger. A `block` / `warn` policy is unchanged.
+export const PolicyEnforcementSchema = z.enum([
+    "block",
+    "warn",
+    "require_approval",
+]);
 // `producers:` is the structured remediation hint the policy engine
 // appends to the deny envelope. Each entry tells the agent ONE concrete
 // way to produce the ledger evidence that would unblock the gate.
@@ -79,6 +93,42 @@ export const PolicyUxSchema = z
     run: z.array(z.string().min(1)).min(1),
 })
     .strict();
+// `when:` — the risk/environment-aware match layer.
+//
+// STATUS: live as of Phase 7 #5. `harness policy intercept` ANDs a
+// declared `when:` onto the policy's `trigger:` match, evaluating it
+// against the Action Envelope enriched by the Risk Classifier (#3) and
+// Context Resolver (#4). A policy with no `when:` matches on `trigger:`
+// alone, exactly as in Phase 4. See src/runtime/when-eval.ts for the
+// evaluator and docs/risk-gate.md for the clause semantics.
+//
+// Each clause is optional and keyed by the envelope path it tests:
+//   risk.severity_at_least — envelope risk severity at or above this
+//                            rung of the ordered scale.
+//   risk.category_in       — envelope risk carries any of these
+//                            categories.
+//   environment.name       — resolved environment equals this name
+//                            (`unknown` is matchable: unknown is not
+//                            safe).
+//   action.reversible      — envelope action reversibility flag.
+// An empty `when: {}` is rejected: it would be a silent no-op.
+export const PolicyWhenSchema = z
+    .object({
+    "risk.severity_at_least": RiskSeveritySchema.optional(),
+    "risk.category_in": z.array(RiskCategorySchema).min(1).optional(),
+    "environment.name": MatchableEnvironmentSchema.optional(),
+    "action.reversible": z.boolean().optional(),
+})
+    .strict()
+    .superRefine((when, ctx) => {
+    if (Object.keys(when).length === 0) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: [],
+            message: "policy.when must declare at least one clause; an empty when: {} is a silent no-op",
+        });
+    }
+});
 export const PolicySchema = z
     .object({
     name: z.string().min(1),
@@ -89,6 +139,7 @@ export const PolicySchema = z
     enforcement: PolicyEnforcementSchema,
     producers: z.array(ProducerSchema).min(1).optional(),
     ux: PolicyUxSchema.optional(),
+    when: PolicyWhenSchema.optional(),
 })
     .strict()
     .superRefine((policy, ctx) => {

package/dist/schema/policies.js.map

@@ -1 +1 @@
-{"version":3,"file":"policies.js","sourceRoot":"","sources":["../../src/schema/policies.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEvF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,KAAK,EAAE,eAAe;IACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,OAAO,EAAE,gBAAgB,CAAC,QAAQ,EAAE;CACrC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAEjE,oEAAoE;AACpE,wEAAwE;AACxE,kEAAkE;AAClE,qBAAqB;AACrB,qEAAqE;AACrE,kEAAkE;AAClE,wGAAwG;AACxG,mEAAmE;AACnE,0EAA0E;AAC1E,0DAA0D;AAC1D,EAAE;AACF,uEAAuE;AACvE,wEAAwE;AACxE,oEAAoE;AACpE,6BAA6B;AAC7B,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACzD,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/B,CAAC;SACD,MAAM,EAAE;IACX,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/B,CAAC;SACD,MAAM,EAAE;IACX,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/B,CAAC;SACD,MAAM,EAAE;CACZ,CAAC,CAAC;AAEH,qEAAqE;AACrE,EAAE;AACF,oEAAoE;AACpE,8DAA8D;AAC9D,sEAAsE;AACtE,uEAAuE;AACvE,wDAAwD;AACxD,kEAAkE;AAClE,EAAE;AACF,qEAAqE;AACrE,sEAAsE;AACtE,mEAAmE;AACnE,sEAAsE;AACtE,oEAAoE;AACpE,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,qEAAqE;AACrE,cAAc;AACd,8DAA8D;AAC9D,oEAAoE;AACpE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACvC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,OAAO,EAAE,mBAAmB;IAC5B,QAAQ,EAAE,cAAc;IACxB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,WAAW,EAAE,uBAAuB;IACpC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD,EAAE,EAAE,cAAc,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC3B,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;IACpE,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,iBAAiB,CAAC,CAAC,CAAC;YAAE,SAAS;QACnC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,UAAU,EAAE,YAAY,CAAC;gBAChC,OAAO,EAAE,qCAAqC,CAAC,sDAAsD;aACtG,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,WAAW,CAAC;gBACnB,OAAO,EACL,2HAA2H;aAC9H,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;IAChF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACxB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC;gBACjB,OAAO,EAAE,0BAA0B,CAAC,CAAC,IAAI,EAAE;aAC5C,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"policies.js","sourceRoot":"","sources":["../../src/schema/policies.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAEnE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,KAAK,EAAE,eAAe;IACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,OAAO,EAAE,gBAAgB,CAAC,QAAQ,EAAE;CACrC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,6DAA6D;AAC7D,2CAA2C;AAC3C,yEAAyE;AACzE,wEAAwE;AACxE,yEAAyE;AACzE,uEAAuE;AACvE,uEAAuE;AACvE,wEAAwE;AACxE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC5C,OAAO;IACP,MAAM;IACN,kBAAkB;CACnB,CAAC,CAAC;AAEH,oEAAoE;AACpE,wEAAwE;AACxE,kEAAkE;AAClE,qBAAqB;AACrB,qEAAqE;AACrE,kEAAkE;AAClE,wGAAwG;AACxG,mEAAmE;AACnE,0EAA0E;AAC1E,0DAA0D;AAC1D,EAAE;AACF,uEAAuE;AACvE,wEAAwE;AACxE,oEAAoE;AACpE,6BAA6B;AAC7B,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACzD,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/B,CAAC;SACD,MAAM,EAAE;IACX,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/B,CAAC;SACD,MAAM,EAAE;IACX,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/B,CAAC;SACD,MAAM,EAAE;CACZ,CAAC,CAAC;AAEH,qEAAqE;AACrE,EAAE;AACF,oEAAoE;AACpE,8DAA8D;AAC9D,sEAAsE;AACtE,uEAAuE;AACvE,wDAAwD;AACxD,kEAAkE;AAClE,EAAE;AACF,qEAAqE;AACrE,sEAAsE;AACtE,mEAAmE;AACnE,sEAAsE;AACtE,oEAAoE;AACpE,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,qEAAqE;AACrE,cAAc;AACd,8DAA8D;AAC9D,oEAAoE;AACpE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACvC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,oDAAoD;AACpD,EAAE;AACF,mEAAmE;AACnE,qEAAqE;AACrE,uEAAuE;AACvE,wEAAwE;AACxE,qEAAqE;AACrE,4DAA4D;AAC5D,EAAE;AACF,mEAAmE;AACnE,qEAAqE;AACrE,wDAAwD;AACxD,gEAAgE;AAChE,yCAAyC;AACzC,mEAAmE;AACnE,qEAAqE;AACrE,oCAAoC;AACpC,iEAAiE;AACjE,+DAA+D;AAC/D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,wBAAwB,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACvD,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjE,kBAAkB,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IACzD,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC5C,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,EAAE;YACR,OAAO,EACL,mFAAmF;SACtF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,OAAO,EAAE,mBAAmB;IAC5B,QAAQ,EAAE,cAAc;IACxB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,WAAW,EAAE,uBAAuB;IACpC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD,EAAE,EAAE,cAAc,CAAC,QAAQ,EAAE;IAC7B,IAAI,EAAE,gBAAgB,CAAC,QAAQ,EAAE;CAClC,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC3B,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;IACpE,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,iBAAiB,CAAC,CAAC,CAAC;YAAE,SAAS;QACnC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,UAAU,EAAE,YAAY,CAAC;gBAChC,OAAO,EAAE,qCAAqC,CAAC,sDAAsD;aACtG,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,WAAW,CAAC;gBACnB,OAAO,EACL,2HAA2H;aAC9H,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;IAChF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACxB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC;gBACjB,OAAO,EAAE,0BAA0B,CAAC,CAAC,IAAI,EAAE;aAC5C,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/schema/risk.d.ts

@@ -0,0 +1,131 @@
+import { z } from "zod";
+export declare const RiskSeveritySchema: z.ZodEnum<["low", "medium", "high", "critical"]>;
+export declare const RiskCategorySchema: z.ZodEnum<["destructive", "data_loss", "production_mutation", "credential_access", "secret_exfiltration", "network_exfiltration", "deployment_change", "infrastructure_change", "privilege_escalation", "irreversible_action", "mass_update"]>;
+export declare const RiskClassifierSchema: z.ZodObject<{
+    name: z.ZodString;
+    tool: z.ZodString;
+    patterns: z.ZodArray<z.ZodEffects<z.ZodObject<{
+        pattern: z.ZodString;
+        categories: z.ZodArray<z.ZodEnum<["destructive", "data_loss", "production_mutation", "credential_access", "secret_exfiltration", "network_exfiltration", "deployment_change", "infrastructure_change", "privilege_escalation", "irreversible_action", "mass_update"]>, "many">;
+        severity: z.ZodEnum<["low", "medium", "high", "critical"]>;
+    }, "strict", z.ZodTypeAny, {
+        pattern: string;
+        categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+        severity: "low" | "medium" | "high" | "critical";
+    }, {
+        pattern: string;
+        categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+        severity: "low" | "medium" | "high" | "critical";
+    }>, {
+        pattern: string;
+        categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+        severity: "low" | "medium" | "high" | "critical";
+    }, {
+        pattern: string;
+        categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+        severity: "low" | "medium" | "high" | "critical";
+    }>, "many">;
+}, "strict", z.ZodTypeAny, {
+    patterns: {
+        pattern: string;
+        categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+        severity: "low" | "medium" | "high" | "critical";
+    }[];
+    name: string;
+    tool: string;
+}, {
+    patterns: {
+        pattern: string;
+        categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+        severity: "low" | "medium" | "high" | "critical";
+    }[];
+    name: string;
+    tool: string;
+}>;
+export declare const RiskSchema: z.ZodEffects<z.ZodObject<{
+    classifiers: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        tool: z.ZodString;
+        patterns: z.ZodArray<z.ZodEffects<z.ZodObject<{
+            pattern: z.ZodString;
+            categories: z.ZodArray<z.ZodEnum<["destructive", "data_loss", "production_mutation", "credential_access", "secret_exfiltration", "network_exfiltration", "deployment_change", "infrastructure_change", "privilege_escalation", "irreversible_action", "mass_update"]>, "many">;
+            severity: z.ZodEnum<["low", "medium", "high", "critical"]>;
+        }, "strict", z.ZodTypeAny, {
+            pattern: string;
+            categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+            severity: "low" | "medium" | "high" | "critical";
+        }, {
+            pattern: string;
+            categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+            severity: "low" | "medium" | "high" | "critical";
+        }>, {
+            pattern: string;
+            categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+            severity: "low" | "medium" | "high" | "critical";
+        }, {
+            pattern: string;
+            categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+            severity: "low" | "medium" | "high" | "critical";
+        }>, "many">;
+    }, "strict", z.ZodTypeAny, {
+        patterns: {
+            pattern: string;
+            categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+            severity: "low" | "medium" | "high" | "critical";
+        }[];
+        name: string;
+        tool: string;
+    }, {
+        patterns: {
+            pattern: string;
+            categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+            severity: "low" | "medium" | "high" | "critical";
+        }[];
+        name: string;
+        tool: string;
+    }>, "many">>;
+}, "strict", z.ZodTypeAny, {
+    classifiers: {
+        patterns: {
+            pattern: string;
+            categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+            severity: "low" | "medium" | "high" | "critical";
+        }[];
+        name: string;
+        tool: string;
+    }[];
+}, {
+    classifiers?: {
+        patterns: {
+            pattern: string;
+            categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+            severity: "low" | "medium" | "high" | "critical";
+        }[];
+        name: string;
+        tool: string;
+    }[] | undefined;
+}>, {
+    classifiers: {
+        patterns: {
+            pattern: string;
+            categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+            severity: "low" | "medium" | "high" | "critical";
+        }[];
+        name: string;
+        tool: string;
+    }[];
+}, {
+    classifiers?: {
+        patterns: {
+            pattern: string;
+            categories: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[];
+            severity: "low" | "medium" | "high" | "critical";
+        }[];
+        name: string;
+        tool: string;
+    }[] | undefined;
+}>;
+export type RiskSeverity = z.infer<typeof RiskSeveritySchema>;
+export type RiskCategory = z.infer<typeof RiskCategorySchema>;
+export type RiskClassifier = z.infer<typeof RiskClassifierSchema>;
+export type RiskConfig = z.infer<typeof RiskSchema>;