@lannguyensi/harness 0.48.0 → 0.50.0

package/dist/schema/index.d.ts

@@ -574,26 +574,31 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             "risk.category_in": z.ZodOptional<z.ZodArray<z.ZodEnum<["destructive", "data_loss", "production_mutation", "credential_access", "secret_exfiltration", "network_exfiltration", "deployment_change", "infrastructure_change", "privilege_escalation", "irreversible_action", "mass_update"]>, "many">>;
             "environment.name": z.ZodOptional<z.ZodEnum<["production", "staging", "dev", "local", "unknown"]>>;
             "action.reversible": z.ZodOptional<z.ZodBoolean>;
+            "action.deletion_target_unresolvable": z.ZodOptional<z.ZodLiteral<true>>;
         }, "strict", z.ZodTypeAny, {
             "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
             "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
             "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
             "action.reversible"?: boolean | undefined;
+            "action.deletion_target_unresolvable"?: true | undefined;
         }, {
             "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
             "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
             "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
             "action.reversible"?: boolean | undefined;
+            "action.deletion_target_unresolvable"?: true | undefined;
         }>, {
             "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
             "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
             "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
             "action.reversible"?: boolean | undefined;
+            "action.deletion_target_unresolvable"?: true | undefined;
         }, {
             "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
             "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
             "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
             "action.reversible"?: boolean | undefined;
+            "action.deletion_target_unresolvable"?: true | undefined;
         }>>;
     }, "strict", z.ZodTypeAny, {
         name: string;
@@ -642,6 +647,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
             "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
             "action.reversible"?: boolean | undefined;
+            "action.deletion_target_unresolvable"?: true | undefined;
         } | undefined;
     }, {
         name: string;
@@ -690,6 +696,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
             "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
             "action.reversible"?: boolean | undefined;
+            "action.deletion_target_unresolvable"?: true | undefined;
         } | undefined;
     }>, {
         name: string;
@@ -738,6 +745,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
             "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
             "action.reversible"?: boolean | undefined;
+            "action.deletion_target_unresolvable"?: true | undefined;
         } | undefined;
     }, {
         name: string;
@@ -786,6 +794,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
             "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
             "action.reversible"?: boolean | undefined;
+            "action.deletion_target_unresolvable"?: true | undefined;
         } | undefined;
     }>, "many">, {
         name: string;
@@ -834,6 +843,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
             "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
             "action.reversible"?: boolean | undefined;
+            "action.deletion_target_unresolvable"?: true | undefined;
         } | undefined;
     }[], {
         name: string;
@@ -882,6 +892,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
             "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
             "action.reversible"?: boolean | undefined;
+            "action.deletion_target_unresolvable"?: true | undefined;
         } | undefined;
     }[]>>;
     policy_packs: z.ZodDefault<z.ZodEffects<z.ZodArray<z.ZodObject<{
@@ -963,6 +974,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             tool: string;
         }>, "many">>;
         degraded_fail_posture: z.ZodDefault<z.ZodEnum<["preserve_enforcement", "fail_open"]>>;
+        safe_deletion_roots: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
     }, "strict", z.ZodTypeAny, {
         classifiers: {
             patterns: {
@@ -974,6 +986,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             tool: string;
         }[];
         degraded_fail_posture: "preserve_enforcement" | "fail_open";
+        safe_deletion_roots: string[];
     }, {
         classifiers?: {
             patterns: {
@@ -985,6 +998,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             tool: string;
         }[] | undefined;
         degraded_fail_posture?: "preserve_enforcement" | "fail_open" | undefined;
+        safe_deletion_roots?: string[] | undefined;
     }>, {
         classifiers: {
             patterns: {
@@ -996,6 +1010,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             tool: string;
         }[];
         degraded_fail_posture: "preserve_enforcement" | "fail_open";
+        safe_deletion_roots: string[];
     }, {
         classifiers?: {
             patterns: {
@@ -1007,6 +1022,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             tool: string;
         }[] | undefined;
         degraded_fail_posture?: "preserve_enforcement" | "fail_open" | undefined;
+        safe_deletion_roots?: string[] | undefined;
     }>>;
     environments: z.ZodDefault<z.ZodEffects<z.ZodObject<{
         resolvers: z.ZodDefault<z.ZodArray<z.ZodObject<{
@@ -2660,6 +2676,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
             "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
             "action.reversible"?: boolean | undefined;
+            "action.deletion_target_unresolvable"?: true | undefined;
         } | undefined;
     }[];
     policy_packs: {
@@ -2681,6 +2698,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             tool: string;
         }[];
         degraded_fail_posture: "preserve_enforcement" | "fail_open";
+        safe_deletion_roots: string[];
     };
     environments: {
         resolvers: {
@@ -2974,6 +2992,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
             "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
             "action.reversible"?: boolean | undefined;
+            "action.deletion_target_unresolvable"?: true | undefined;
         } | undefined;
     }[] | undefined;
     policy_packs?: {
@@ -2995,6 +3014,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             tool: string;
         }[] | undefined;
         degraded_fail_posture?: "preserve_enforcement" | "fail_open" | undefined;
+        safe_deletion_roots?: string[] | undefined;
     } | undefined;
     environments?: {
         resolvers?: {
@@ -3288,6 +3308,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
             "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
             "action.reversible"?: boolean | undefined;
+            "action.deletion_target_unresolvable"?: true | undefined;
         } | undefined;
     }[];
     policy_packs: {
@@ -3309,6 +3330,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             tool: string;
         }[];
         degraded_fail_posture: "preserve_enforcement" | "fail_open";
+        safe_deletion_roots: string[];
     };
     environments: {
         resolvers: {
@@ -3602,6 +3624,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
             "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
             "action.reversible"?: boolean | undefined;
+            "action.deletion_target_unresolvable"?: true | undefined;
         } | undefined;
     }[] | undefined;
     policy_packs?: {
@@ -3623,6 +3646,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             tool: string;
         }[] | undefined;
         degraded_fail_posture?: "preserve_enforcement" | "fail_open" | undefined;
+        safe_deletion_roots?: string[] | undefined;
     } | undefined;
     environments?: {
         resolvers?: {

package/dist/schema/policies.d.ts

@@ -77,26 +77,31 @@ export declare const PolicyWhenSchema: z.ZodEffects<z.ZodObject<{
     "risk.category_in": z.ZodOptional<z.ZodArray<z.ZodEnum<["destructive", "data_loss", "production_mutation", "credential_access", "secret_exfiltration", "network_exfiltration", "deployment_change", "infrastructure_change", "privilege_escalation", "irreversible_action", "mass_update"]>, "many">>;
     "environment.name": z.ZodOptional<z.ZodEnum<["production", "staging", "dev", "local", "unknown"]>>;
     "action.reversible": z.ZodOptional<z.ZodBoolean>;
+    "action.deletion_target_unresolvable": z.ZodOptional<z.ZodLiteral<true>>;
 }, "strict", z.ZodTypeAny, {
     "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
     "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
     "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
     "action.reversible"?: boolean | undefined;
+    "action.deletion_target_unresolvable"?: true | undefined;
 }, {
     "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
     "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
     "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
     "action.reversible"?: boolean | undefined;
+    "action.deletion_target_unresolvable"?: true | undefined;
 }>, {
     "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
     "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
     "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
     "action.reversible"?: boolean | undefined;
+    "action.deletion_target_unresolvable"?: true | undefined;
 }, {
     "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
     "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
     "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
     "action.reversible"?: boolean | undefined;
+    "action.deletion_target_unresolvable"?: true | undefined;
 }>;
 export declare const PolicySchema: z.ZodEffects<z.ZodObject<{
     name: z.ZodString;
@@ -249,26 +254,31 @@ export declare const PolicySchema: z.ZodEffects<z.ZodObject<{
         "risk.category_in": z.ZodOptional<z.ZodArray<z.ZodEnum<["destructive", "data_loss", "production_mutation", "credential_access", "secret_exfiltration", "network_exfiltration", "deployment_change", "infrastructure_change", "privilege_escalation", "irreversible_action", "mass_update"]>, "many">>;
         "environment.name": z.ZodOptional<z.ZodEnum<["production", "staging", "dev", "local", "unknown"]>>;
         "action.reversible": z.ZodOptional<z.ZodBoolean>;
+        "action.deletion_target_unresolvable": z.ZodOptional<z.ZodLiteral<true>>;
     }, "strict", z.ZodTypeAny, {
         "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
         "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
         "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
         "action.reversible"?: boolean | undefined;
+        "action.deletion_target_unresolvable"?: true | undefined;
     }, {
         "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
         "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
         "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
         "action.reversible"?: boolean | undefined;
+        "action.deletion_target_unresolvable"?: true | undefined;
     }>, {
         "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
         "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
         "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
         "action.reversible"?: boolean | undefined;
+        "action.deletion_target_unresolvable"?: true | undefined;
     }, {
         "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
         "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
         "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
         "action.reversible"?: boolean | undefined;
+        "action.deletion_target_unresolvable"?: true | undefined;
     }>>;
 }, "strict", z.ZodTypeAny, {
     name: string;
@@ -317,6 +327,7 @@ export declare const PolicySchema: z.ZodEffects<z.ZodObject<{
         "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
         "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
         "action.reversible"?: boolean | undefined;
+        "action.deletion_target_unresolvable"?: true | undefined;
     } | undefined;
 }, {
     name: string;
@@ -365,6 +376,7 @@ export declare const PolicySchema: z.ZodEffects<z.ZodObject<{
         "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
         "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
         "action.reversible"?: boolean | undefined;
+        "action.deletion_target_unresolvable"?: true | undefined;
     } | undefined;
 }>, {
     name: string;
@@ -413,6 +425,7 @@ export declare const PolicySchema: z.ZodEffects<z.ZodObject<{
         "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
         "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
         "action.reversible"?: boolean | undefined;
+        "action.deletion_target_unresolvable"?: true | undefined;
     } | undefined;
 }, {
     name: string;
@@ -461,6 +474,7 @@ export declare const PolicySchema: z.ZodEffects<z.ZodObject<{
         "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
         "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
         "action.reversible"?: boolean | undefined;
+        "action.deletion_target_unresolvable"?: true | undefined;
     } | undefined;
 }>;
 export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodObject<{
@@ -614,26 +628,31 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         "risk.category_in": z.ZodOptional<z.ZodArray<z.ZodEnum<["destructive", "data_loss", "production_mutation", "credential_access", "secret_exfiltration", "network_exfiltration", "deployment_change", "infrastructure_change", "privilege_escalation", "irreversible_action", "mass_update"]>, "many">>;
         "environment.name": z.ZodOptional<z.ZodEnum<["production", "staging", "dev", "local", "unknown"]>>;
         "action.reversible": z.ZodOptional<z.ZodBoolean>;
+        "action.deletion_target_unresolvable": z.ZodOptional<z.ZodLiteral<true>>;
     }, "strict", z.ZodTypeAny, {
         "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
         "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
         "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
         "action.reversible"?: boolean | undefined;
+        "action.deletion_target_unresolvable"?: true | undefined;
     }, {
         "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
         "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
         "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
         "action.reversible"?: boolean | undefined;
+        "action.deletion_target_unresolvable"?: true | undefined;
     }>, {
         "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
         "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
         "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
         "action.reversible"?: boolean | undefined;
+        "action.deletion_target_unresolvable"?: true | undefined;
     }, {
         "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
         "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
         "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
         "action.reversible"?: boolean | undefined;
+        "action.deletion_target_unresolvable"?: true | undefined;
     }>>;
 }, "strict", z.ZodTypeAny, {
     name: string;
@@ -682,6 +701,7 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
         "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
         "action.reversible"?: boolean | undefined;
+        "action.deletion_target_unresolvable"?: true | undefined;
     } | undefined;
 }, {
     name: string;
@@ -730,6 +750,7 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
         "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
         "action.reversible"?: boolean | undefined;
+        "action.deletion_target_unresolvable"?: true | undefined;
     } | undefined;
 }>, {
     name: string;
@@ -778,6 +799,7 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
         "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
         "action.reversible"?: boolean | undefined;
+        "action.deletion_target_unresolvable"?: true | undefined;
     } | undefined;
 }, {
     name: string;
@@ -826,6 +848,7 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
         "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
         "action.reversible"?: boolean | undefined;
+        "action.deletion_target_unresolvable"?: true | undefined;
     } | undefined;
 }>, "many">, {
     name: string;
@@ -874,6 +897,7 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
         "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
         "action.reversible"?: boolean | undefined;
+        "action.deletion_target_unresolvable"?: true | undefined;
     } | undefined;
 }[], {
     name: string;
@@ -922,6 +946,7 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
         "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
         "action.reversible"?: boolean | undefined;
+        "action.deletion_target_unresolvable"?: true | undefined;
     } | undefined;
 }[]>;
 export type Policy = z.infer<typeof PolicySchema>;

package/dist/schema/policies.js

@@ -111,6 +111,34 @@ export const PolicyUxSchema = z
 //                            (`unknown` is matchable: unknown is not
 //                            safe).
 //   action.reversible      — envelope action reversibility flag.
+//   action.deletion_target_unresolvable — a deletion-verb command (`rm
+//                            -r*`/`-f*`, `find ... -delete`, `git clean
+//                            -f*`) whose target(s) could not be
+//                            statically proven inside a declared
+//                            `risk.safe_deletion_roots` entry. UNLIKE the
+//                            four clauses above, this one is NEVER
+//                            subject to the "unknown is not safe"
+//                            fail-close: an action the deletion resolver
+//                            does not recognize as a deletion verb at
+//                            all does not satisfy this clause, so a
+//                            policy gated purely on it does not need an
+//                            `environment.name` scope to avoid firing on
+//                            every unrelated unclassified command — see
+//                            src/runtime/when-eval.ts and
+//                            src/runtime/deletion-target-resolve.ts.
+//                            ONLY `true` is a meaningful value (task
+//                            d03af8f6, review round 2): a resolver
+//                            verdict is either `unresolvable: true` (gate
+//                            it) or the action never reaches this clause
+//                            at all (a resolved-safe target or a
+//                            non-deletion command both simply fail to
+//                            match `true`) — `false` would match every
+//                            non-deletion-verb command in the manifest
+//                            (verdict `null` -> "actual" false -> equals
+//                            declared `false`), which is never the
+//                            intent of a `when:` clause naming this key.
+//                            The schema accepts only the literal `true`;
+//                            `false` is a validate-time error.
 // An empty `when: {}` is rejected: it would be a silent no-op.
 export const PolicyWhenSchema = z
     .object({
@@ -118,6 +146,7 @@ export const PolicyWhenSchema = z
     "risk.category_in": z.array(RiskCategorySchema).min(1).optional(),
     "environment.name": MatchableEnvironmentSchema.optional(),
     "action.reversible": z.boolean().optional(),
+    "action.deletion_target_unresolvable": z.literal(true).optional(),
 })
     .strict()
     .superRefine((when, ctx) => {

package/dist/schema/policies.js.map

@@ -1 +1 @@
-{"version":3,"file":"policies.js","sourceRoot":"","sources":["../../src/schema/policies.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAEnE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,KAAK,EAAE,eAAe;IACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,OAAO,EAAE,gBAAgB,CAAC,QAAQ,EAAE;CACrC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,6DAA6D;AAC7D,2CAA2C;AAC3C,yEAAyE;AACzE,wEAAwE;AACxE,yEAAyE;AACzE,uEAAuE;AACvE,uEAAuE;AACvE,wEAAwE;AACxE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC5C,OAAO;IACP,MAAM;IACN,kBAAkB;CACnB,CAAC,CAAC;AAEH,oEAAoE;AACpE,wEAAwE;AACxE,kEAAkE;AAClE,qBAAqB;AACrB,qEAAqE;AACrE,kEAAkE;AAClE,wGAAwG;AACxG,mEAAmE;AACnE,0EAA0E;AAC1E,0DAA0D;AAC1D,EAAE;AACF,uEAAuE;AACvE,wEAAwE;AACxE,oEAAoE;AACpE,6BAA6B;AAC7B,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACzD,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/B,CAAC;SACD,MAAM,EAAE;IACX,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/B,CAAC;SACD,MAAM,EAAE;IACX,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/B,CAAC;SACD,MAAM,EAAE;CACZ,CAAC,CAAC;AAEH,qEAAqE;AACrE,EAAE;AACF,oEAAoE;AACpE,8DAA8D;AAC9D,sEAAsE;AACtE,uEAAuE;AACvE,wDAAwD;AACxD,kEAAkE;AAClE,EAAE;AACF,qEAAqE;AACrE,sEAAsE;AACtE,mEAAmE;AACnE,sEAAsE;AACtE,oEAAoE;AACpE,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,qEAAqE;AACrE,cAAc;AACd,8DAA8D;AAC9D,oEAAoE;AACpE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACvC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,oDAAoD;AACpD,EAAE;AACF,mEAAmE;AACnE,qEAAqE;AACrE,uEAAuE;AACvE,wEAAwE;AACxE,qEAAqE;AACrE,4DAA4D;AAC5D,EAAE;AACF,mEAAmE;AACnE,qEAAqE;AACrE,wDAAwD;AACxD,gEAAgE;AAChE,yCAAyC;AACzC,mEAAmE;AACnE,qEAAqE;AACrE,oCAAoC;AACpC,iEAAiE;AACjE,+DAA+D;AAC/D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,wBAAwB,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACvD,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjE,kBAAkB,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IACzD,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC5C,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,EAAE;YACR,OAAO,EACL,mFAAmF;SACtF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,qEAAqE;AACrE,oEAAoE;AACpE,kEAAkE;AAClE,wCAAwC;AACxC,sEAAsE;AACtE,sEAAsE;AACtE,yEAAyE;AACzE,wEAAwE;AACxE,4DAA4D;AAC5D,gEAAgE;AAChE,qDAAqD;AACrD,EAAE;AACF,mEAAmE;AACnE,uEAAuE;AACvE,qEAAqE;AACrE,gEAAgE;AAChE,kEAAkE;AAClE,wEAAwE;AACxE,8DAA8D;AAC9D,mEAAmE;AACnE,oEAAoE;AACpE,uEAAuE;AACvE,yDAAyD;AACzD,EAAE;AACF,uEAAuE;AACvE,qEAAqE;AACrE,gEAAgE;AAChE,iEAAiE;AACjE,mEAAmE;AACnE,uEAAuE;AACvE,yEAAyE;AACzE,oEAAoE;AACpE,qEAAqE;AACrE,mEAAmE;AACnE,oEAAoE;AACpE,uEAAuE;AACvE,8DAA8D;AAC9D,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,OAAO,EAAE,mBAAmB;IAC5B,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE;IACnC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,WAAW,EAAE,uBAAuB;IACpC,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD,EAAE,EAAE,cAAc,CAAC,QAAQ,EAAE;IAC7B,IAAI,EAAE,gBAAgB,CAAC,QAAQ,EAAE;CAClC,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC3B,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,WAAW,KAAK,OAAO,EAAE,CAAC;YACnC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,eAAe,CAAC;gBACvB,OAAO,EACL,qLAAqL;aACxL,CAAC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,UAAU,CAAC;gBAClB,OAAO,EACL,4MAA4M;aAC/M,CAAC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACnC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,WAAW,CAAC;gBACnB,OAAO,EACL,+UAA+U;aAClV,CAAC,CAAC;QACL,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACzC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,OAAO,EACL,4GAA4G;SAC/G,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;QACpE,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,iBAAiB,CAAC,CAAC,CAAC;gBAAE,SAAS;YACnC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrB,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;oBAC3B,IAAI,EAAE,CAAC,UAAU,EAAE,YAAY,CAAC;oBAChC,OAAO,EAAE,qCAAqC,CAAC,sDAAsD;iBACtG,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,WAAW,CAAC;gBACnB,OAAO,EACL,2HAA2H;aAC9H,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;IAChF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACxB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC;gBACjB,OAAO,EAAE,0BAA0B,CAAC,CAAC,IAAI,EAAE;aAC5C,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"policies.js","sourceRoot":"","sources":["../../src/schema/policies.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAEnE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,KAAK,EAAE,eAAe;IACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,OAAO,EAAE,gBAAgB,CAAC,QAAQ,EAAE;CACrC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,6DAA6D;AAC7D,2CAA2C;AAC3C,yEAAyE;AACzE,wEAAwE;AACxE,yEAAyE;AACzE,uEAAuE;AACvE,uEAAuE;AACvE,wEAAwE;AACxE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC5C,OAAO;IACP,MAAM;IACN,kBAAkB;CACnB,CAAC,CAAC;AAEH,oEAAoE;AACpE,wEAAwE;AACxE,kEAAkE;AAClE,qBAAqB;AACrB,qEAAqE;AACrE,kEAAkE;AAClE,wGAAwG;AACxG,mEAAmE;AACnE,0EAA0E;AAC1E,0DAA0D;AAC1D,EAAE;AACF,uEAAuE;AACvE,wEAAwE;AACxE,oEAAoE;AACpE,6BAA6B;AAC7B,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACzD,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/B,CAAC;SACD,MAAM,EAAE;IACX,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/B,CAAC;SACD,MAAM,EAAE;IACX,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/B,CAAC;SACD,MAAM,EAAE;CACZ,CAAC,CAAC;AAEH,qEAAqE;AACrE,EAAE;AACF,oEAAoE;AACpE,8DAA8D;AAC9D,sEAAsE;AACtE,uEAAuE;AACvE,wDAAwD;AACxD,kEAAkE;AAClE,EAAE;AACF,qEAAqE;AACrE,sEAAsE;AACtE,mEAAmE;AACnE,sEAAsE;AACtE,oEAAoE;AACpE,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,qEAAqE;AACrE,cAAc;AACd,8DAA8D;AAC9D,oEAAoE;AACpE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACvC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,oDAAoD;AACpD,EAAE;AACF,mEAAmE;AACnE,qEAAqE;AACrE,uEAAuE;AACvE,wEAAwE;AACxE,qEAAqE;AACrE,4DAA4D;AAC5D,EAAE;AACF,mEAAmE;AACnE,qEAAqE;AACrE,wDAAwD;AACxD,gEAAgE;AAChE,yCAAyC;AACzC,mEAAmE;AACnE,qEAAqE;AACrE,oCAAoC;AACpC,iEAAiE;AACjE,uEAAuE;AACvE,wEAAwE;AACxE,gEAAgE;AAChE,iEAAiE;AACjE,0EAA0E;AAC1E,mEAAmE;AACnE,kEAAkE;AAClE,yEAAyE;AACzE,sEAAsE;AACtE,oEAAoE;AACpE,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AACxE,0DAA0D;AAC1D,qEAAqE;AACrE,qEAAqE;AACrE,mEAAmE;AACnE,0EAA0E;AAC1E,yEAAyE;AACzE,iEAAiE;AACjE,sEAAsE;AACtE,uEAAuE;AACvE,uEAAuE;AACvE,yEAAyE;AACzE,mEAAmE;AACnE,yEAAyE;AACzE,yEAAyE;AACzE,+DAA+D;AAC/D,+DAA+D;AAC/D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,wBAAwB,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACvD,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjE,kBAAkB,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IACzD,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC3C,qCAAqC,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CAClE,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,EAAE;YACR,OAAO,EACL,mFAAmF;SACtF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,qEAAqE;AACrE,oEAAoE;AACpE,kEAAkE;AAClE,wCAAwC;AACxC,sEAAsE;AACtE,sEAAsE;AACtE,yEAAyE;AACzE,wEAAwE;AACxE,4DAA4D;AAC5D,gEAAgE;AAChE,qDAAqD;AACrD,EAAE;AACF,mEAAmE;AACnE,uEAAuE;AACvE,qEAAqE;AACrE,gEAAgE;AAChE,kEAAkE;AAClE,wEAAwE;AACxE,8DAA8D;AAC9D,mEAAmE;AACnE,oEAAoE;AACpE,uEAAuE;AACvE,yDAAyD;AACzD,EAAE;AACF,uEAAuE;AACvE,qEAAqE;AACrE,gEAAgE;AAChE,iEAAiE;AACjE,mEAAmE;AACnE,uEAAuE;AACvE,yEAAyE;AACzE,oEAAoE;AACpE,qEAAqE;AACrE,mEAAmE;AACnE,oEAAoE;AACpE,uEAAuE;AACvE,8DAA8D;AAC9D,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,OAAO,EAAE,mBAAmB;IAC5B,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE;IACnC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,WAAW,EAAE,uBAAuB;IACpC,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD,EAAE,EAAE,cAAc,CAAC,QAAQ,EAAE;IAC7B,IAAI,EAAE,gBAAgB,CAAC,QAAQ,EAAE;CAClC,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC3B,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,WAAW,KAAK,OAAO,EAAE,CAAC;YACnC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,eAAe,CAAC;gBACvB,OAAO,EACL,qLAAqL;aACxL,CAAC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,UAAU,CAAC;gBAClB,OAAO,EACL,4MAA4M;aAC/M,CAAC,CAAC;QACL,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACnC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,WAAW,CAAC;gBACnB,OAAO,EACL,+UAA+U;aAClV,CAAC,CAAC;QACL,CAAC;IACH,CAAC;SAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACzC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,OAAO,EACL,4GAA4G;SAC/G,CAAC,CAAC;IACL,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;QACpE,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,iBAAiB,CAAC,CAAC,CAAC;gBAAE,SAAS;YACnC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrB,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;oBAC3B,IAAI,EAAE,CAAC,UAAU,EAAE,YAAY,CAAC;oBAChC,OAAO,EAAE,qCAAqC,CAAC,sDAAsD;iBACtG,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,WAAW,CAAC;gBACnB,OAAO,EACL,2HAA2H;aAC9H,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;IAChF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACxB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC;gBACjB,OAAO,EAAE,0BAA0B,CAAC,CAAC,IAAI,EAAE;aAC5C,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/schema/risk.d.ts

@@ -43,6 +43,7 @@ export declare const RiskClassifierSchema: z.ZodObject<{
     tool: string;
 }>;
 export declare const DegradedFailPostureSchema: z.ZodEnum<["preserve_enforcement", "fail_open"]>;
+export declare const DEFAULT_SAFE_DELETION_ROOTS: string[];
 export declare const RiskSchema: z.ZodEffects<z.ZodObject<{
     classifiers: z.ZodDefault<z.ZodArray<z.ZodObject<{
         name: z.ZodString;
@@ -86,6 +87,7 @@ export declare const RiskSchema: z.ZodEffects<z.ZodObject<{
         tool: string;
     }>, "many">>;
     degraded_fail_posture: z.ZodDefault<z.ZodEnum<["preserve_enforcement", "fail_open"]>>;
+    safe_deletion_roots: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
 }, "strict", z.ZodTypeAny, {
     classifiers: {
         patterns: {
@@ -97,6 +99,7 @@ export declare const RiskSchema: z.ZodEffects<z.ZodObject<{
         tool: string;
     }[];
     degraded_fail_posture: "preserve_enforcement" | "fail_open";
+    safe_deletion_roots: string[];
 }, {
     classifiers?: {
         patterns: {
@@ -108,6 +111,7 @@ export declare const RiskSchema: z.ZodEffects<z.ZodObject<{
         tool: string;
     }[] | undefined;
     degraded_fail_posture?: "preserve_enforcement" | "fail_open" | undefined;
+    safe_deletion_roots?: string[] | undefined;
 }>, {
     classifiers: {
         patterns: {
@@ -119,6 +123,7 @@ export declare const RiskSchema: z.ZodEffects<z.ZodObject<{
         tool: string;
     }[];
     degraded_fail_posture: "preserve_enforcement" | "fail_open";
+    safe_deletion_roots: string[];
 }, {
     classifiers?: {
         patterns: {
@@ -130,6 +135,7 @@ export declare const RiskSchema: z.ZodEffects<z.ZodObject<{
         tool: string;
     }[] | undefined;
     degraded_fail_posture?: "preserve_enforcement" | "fail_open" | undefined;
+    safe_deletion_roots?: string[] | undefined;
 }>;
 export type DegradedFailPosture = z.infer<typeof DegradedFailPostureSchema>;
 export type RiskSeverity = z.infer<typeof RiskSeveritySchema>;

package/dist/schema/risk.js

@@ -92,10 +92,40 @@ export const DegradedFailPostureSchema = z.enum([
     "preserve_enforcement",
     "fail_open",
 ]);
+// Safe-deletion-root allowlist (task d03af8f6). `src/runtime/
+// deletion-target-resolve.ts` statically resolves the target(s) of a
+// deletion-verb command (`rm -r*`/`-f*`, `find ... -delete`/`-exec*`/
+// `-execdir` with an `rm` payload, `git clean -f*`) and treats a target
+// as safe only when it is an ABSOLUTE path that lies STRICTLY INSIDE one
+// of these roots (a plain directory-prefix match against `root + "/"`;
+// the root itself does not count, for EVERY verb alike — `find`'s own
+// start point is removed by `-delete`/`-exec` the same way `rm`'s
+// operand is, so it gets no root-equality exception either). An
+// optional trailing `/**` or `/*` on an entry is stripped
+// as documentation sugar before matching — it is not a real glob
+// engine. A target the
+// resolver cannot statically prove absolute and prefix-matched — an
+// unexpanded `$VAR`/`${VAR}` reference, a `~`-relative path, a relative
+// path, or a `..`-traversal that normalizes outside every root — is
+// treated as UNRESOLVABLE, never guessed safe. The defaults cover the
+// two spellings this harness's own scratchpad convention can use: a
+// symlinked `/tmp` and its `/private/tmp` realpath (macOS); an operator
+// who overrides this list REPLACES it, it does not merge with the
+// default. See docs/risk-gate.md.
+// Exported (not just used as the schema `.default()`) so runtime call
+// sites can fall back to the same list for a hand-built `Manifest` that
+// bypassed schema parsing entirely (every test fixture that constructs
+// `{ risk: { classifiers: [...] } }` directly, without going through
+// `RiskSchema.parse`) — see `src/runtime/intercept.ts` and
+// `src/cli/explain-policy.ts`.
+export const DEFAULT_SAFE_DELETION_ROOTS = ["/tmp", "/private/tmp"];
 export const RiskSchema = z
     .object({
     classifiers: z.array(RiskClassifierSchema).default([]),
     degraded_fail_posture: DegradedFailPostureSchema.default("preserve_enforcement"),
+    safe_deletion_roots: z
+        .array(z.string().min(1))
+        .default(DEFAULT_SAFE_DELETION_ROOTS),
 })
     .strict()
     .superRefine((risk, ctx) => {
@@ -110,5 +140,55 @@ export const RiskSchema = z
         }
         seen.add(c.name);
     });
+    // A filesystem-root entry — bare `/`, or anything that lexically
+    // NORMALIZES to `/` (`/.`, `/./`, `/tmp/..` — task d03af8f6, review
+    // round 3, LOW (d), widening review round 2 LOW (a)'s bare-`/`-only
+    // check) — would match every absolute path as "inside" it via the
+    // resolver's own `target.startsWith(root + "/")` prefix check —
+    // silently defeating the entire point of an allowlist. Rejected at
+    // parse time with a message rather than special-cased to "matches
+    // everything" at runtime, since an operator who wrote one of these
+    // spellings almost certainly meant a specific subdirectory.
+    // Non-absolute entries and ones containing `$`/`~` are a `harness
+    // validate` LINT instead (a warning, not a parse-time error) — see
+    // `checkSafeDeletionRootsSyntax` in `src/cli/validate/checks.ts`.
+    risk.safe_deletion_roots.forEach((root, i) => {
+        if (normalizesToFilesystemRoot(root)) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: ["safe_deletion_roots", i],
+                message: `risk.safe_deletion_roots entry "${root}" normalizes to the filesystem root and can ` +
+                    `never be a meaningful allowlist entry: every absolute deletion target would match ` +
+                    `it as "inside," defeating the allowlist. Declare specific subdirectories instead ` +
+                    `(e.g. "/tmp").`,
+            });
+        }
+    });
 });
+/**
+ * `true` when `root` (trimmed) lexically collapses to the filesystem
+ * root `/` — bare `/`, any run of bare `/` characters, `/.`, `/./`, or a
+ * `..`-traversal that pops back to `/` (`/tmp/..`). Lexical only (no
+ * filesystem I/O, mirrors `deletion-target-resolve.ts`'s own
+ * `normalizePosixPath` in spirit — not imported from there: this is a
+ * schema-time validation, `deletion-target-resolve.ts` is a runtime
+ * module, and neither layer should depend on the other for a check this
+ * small).
+ */
+function normalizesToFilesystemRoot(root) {
+    const trimmed = root.trim();
+    if (!trimmed.startsWith("/"))
+        return false;
+    const out = [];
+    for (const part of trimmed.split("/")) {
+        if (part === "" || part === ".")
+            continue;
+        if (part === "..") {
+            out.pop();
+            continue;
+        }
+        out.push(part);
+    }
+    return out.length === 0;
+}
 //# sourceMappingURL=risk.js.map

package/dist/schema/risk.js.map

@@ -1 +1 @@
-{"version":3,"file":"risk.js","sourceRoot":"","sources":["../../src/schema/risk.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,4CAA4C;AAC5C,EAAE;AACF,iEAAiE;AACjE,qEAAqE;AACrE,oEAAoE;AACpE,uEAAuE;AACvE,kEAAkE;AAClE,mEAAmE;AACnE,wEAAwE;AACxE,qEAAqE;AACrE,+DAA+D;AAC/D,qBAAqB;AACrB,EAAE;AACF,0EAA0E;AAE1E,uEAAuE;AACvE,uEAAuE;AACvE,sEAAsE;AACtE,qEAAqE;AACrE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAEhF,wEAAwE;AACxE,uEAAuE;AACvE,wEAAwE;AACxE,uEAAuE;AACvE,8DAA8D;AAC9D,+DAA+D;AAC/D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC;IACvC,aAAa;IACb,WAAW;IACX,qBAAqB;IACrB,mBAAmB;IACnB,qBAAqB;IACrB,sBAAsB;IACtB,mBAAmB;IACnB,uBAAuB;IACvB,sBAAsB;IACtB,qBAAqB;IACrB,aAAa;CACd,CAAC,CAAC;AAEH,kEAAkE;AAClE,qEAAqE;AACrE,uEAAuE;AACvE,mEAAmE;AACnE,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,QAAQ,EAAE,kBAAkB;CAC7B,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,SAAS,CAAC;YACjB,OAAO,EAAE,kBAAmB,GAAa,CAAC,OAAO,EAAE;SACpD,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,kEAAkE;IAClE,oEAAoE;IACpE,4DAA4D;IAC5D,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,sEAAsE;AACtE,0EAA0E;AAC1E,0EAA0E;AAC1E,yCAAyC;AACzC,EAAE;AACF,mEAAmE;AACnE,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AACxE,yDAAyD;AACzD,uEAAuE;AACvE,sEAAsE;AACtE,+DAA+D;AAC/D,EAAE;AACF,oEAAoE;AACpE,sEAAsE;AACtE,uEAAuE;AACvE,oDAAoD;AACpD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC9C,sBAAsB;IACtB,WAAW;CACZ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,qBAAqB,EAAE,yBAAyB,CAAC,OAAO,CACtD,sBAAsB,CACvB;CACF,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAChC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,aAAa,EAAE,CAAC,EAAE,MAAM,CAAC;gBAChC,OAAO,EAAE,mCAAmC,CAAC,CAAC,IAAI,EAAE;aACrD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"risk.js","sourceRoot":"","sources":["../../src/schema/risk.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,4CAA4C;AAC5C,EAAE;AACF,iEAAiE;AACjE,qEAAqE;AACrE,oEAAoE;AACpE,uEAAuE;AACvE,kEAAkE;AAClE,mEAAmE;AACnE,wEAAwE;AACxE,qEAAqE;AACrE,+DAA+D;AAC/D,qBAAqB;AACrB,EAAE;AACF,0EAA0E;AAE1E,uEAAuE;AACvE,uEAAuE;AACvE,sEAAsE;AACtE,qEAAqE;AACrE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAEhF,wEAAwE;AACxE,uEAAuE;AACvE,wEAAwE;AACxE,uEAAuE;AACvE,8DAA8D;AAC9D,+DAA+D;AAC/D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC;IACvC,aAAa;IACb,WAAW;IACX,qBAAqB;IACrB,mBAAmB;IACnB,qBAAqB;IACrB,sBAAsB;IACtB,mBAAmB;IACnB,uBAAuB;IACvB,sBAAsB;IACtB,qBAAqB;IACrB,aAAa;CACd,CAAC,CAAC;AAEH,kEAAkE;AAClE,qEAAqE;AACrE,uEAAuE;AACvE,mEAAmE;AACnE,MAAM,iBAAiB,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,QAAQ,EAAE,kBAAkB;CAC7B,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,SAAS,CAAC;YACjB,OAAO,EAAE,kBAAmB,GAAa,CAAC,OAAO,EAAE;SACpD,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,kEAAkE;IAClE,oEAAoE;IACpE,4DAA4D;IAC5D,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5C,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,sEAAsE;AACtE,0EAA0E;AAC1E,0EAA0E;AAC1E,yCAAyC;AACzC,EAAE;AACF,mEAAmE;AACnE,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AACxE,yDAAyD;AACzD,uEAAuE;AACvE,sEAAsE;AACtE,+DAA+D;AAC/D,EAAE;AACF,oEAAoE;AACpE,sEAAsE;AACtE,uEAAuE;AACvE,oDAAoD;AACpD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC9C,sBAAsB;IACtB,WAAW;CACZ,CAAC,CAAC;AAEH,8DAA8D;AAC9D,qEAAqE;AACrE,sEAAsE;AACtE,wEAAwE;AACxE,yEAAyE;AACzE,uEAAuE;AACvE,sEAAsE;AACtE,kEAAkE;AAClE,gEAAgE;AAChE,0DAA0D;AAC1D,iEAAiE;AACjE,uBAAuB;AACvB,oEAAoE;AACpE,wEAAwE;AACxE,oEAAoE;AACpE,sEAAsE;AACtE,oEAAoE;AACpE,wEAAwE;AACxE,kEAAkE;AAClE,kCAAkC;AAClC,sEAAsE;AACtE,wEAAwE;AACxE,uEAAuE;AACvE,qEAAqE;AACrE,2DAA2D;AAC3D,+BAA+B;AAC/B,MAAM,CAAC,MAAM,2BAA2B,GAAa,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AAE9E,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,qBAAqB,EAAE,yBAAyB,CAAC,OAAO,CACtD,sBAAsB,CACvB;IACD,mBAAmB,EAAE,CAAC;SACnB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACxB,OAAO,CAAC,2BAA2B,CAAC;CACxC,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAChC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,aAAa,EAAE,CAAC,EAAE,MAAM,CAAC;gBAChC,OAAO,EAAE,mCAAmC,CAAC,CAAC,IAAI,EAAE;aACrD,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;IACH,iEAAiE;IACjE,oEAAoE;IACpE,oEAAoE;IACpE,kEAAkE;IAClE,gEAAgE;IAChE,mEAAmE;IACnE,kEAAkE;IAClE,mEAAmE;IACnE,4DAA4D;IAC5D,kEAAkE;IAClE,mEAAmE;IACnE,kEAAkE;IAClE,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QAC3C,IAAI,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,qBAAqB,EAAE,CAAC,CAAC;gBAChC,OAAO,EACL,mCAAmC,IAAI,8CAA8C;oBACrF,oFAAoF;oBACpF,mFAAmF;oBACnF,gBAAgB;aACnB,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEL;;;;;;;;;GASG;AACH,SAAS,0BAA0B,CAAC,IAAY;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG;YAAE,SAAS;QAC1C,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC;AAC1B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lannguyensi/harness",
-  "version": "0.48.0",
+  "version": "0.50.0",
   "description": "Declarative control plane for agent harnesses — one YAML for grounding, tools, memory, and hooks.",
   "license": "MIT",
   "homepage": "https://github.com/LanNguyenSi/harness",