🎩 You're Invited:Meet the Socket team at Black Hat in Las Vegas, August 3-6.RSVP →

recourse-cli

Advanced tools

Install Socket

Detect and block malicious and high-risk dependencies

Install

recourse-cli - npm Package Compare versions

Comparing version

0.1.35

0.1.36

+18

dist/analyzer/cross-action-patterns.d.ts

		/**
		* Cross-Action Pattern Catalog
		*
		* Each pattern is a self-describing detector for dangerous
		* combinations of actions in a Terraform plan.
		*
		* Design doc: docs/design/cross-action-analysis.md
		*/
		import type { CrossActionPattern } from './cross-action.js';
		export declare const backupAndProtectedDeleted: CrossActionPattern;
		export declare const replicaAndPrimaryDeleted: CrossActionPattern;
		export declare const protectionDisabledThenDeleted: CrossActionPattern;
		/**
		* All registered cross-action patterns.
		* Adding a new pattern = adding one entry to this array.
		*/
		export declare const crossActionPatterns: CrossActionPattern[];
		//# sourceMappingURL=cross-action-patterns.d.ts.map

+1

dist/analyzer/cross-action-patterns.d.ts.map

{"version":3,"file":"cross-action-patterns.d.ts","sourceRoot":"","sources":["../../src/analyzer/cross-action-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EACV,kBAAkB,EAInB,MAAM,mBAAmB,CAAC;AAO3B,eAAO,MAAM,yBAAyB,EAAE,kBA6DvC,CAAC;AA0CF,eAAO,MAAM,wBAAwB,EAAE,kBAsDtC,CAAC;AAMF,eAAO,MAAM,6BAA6B,EAAE,kBAsD3C,CAAC;AAMF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,kBAAkB,EAInD,CAAC"}

+193

dist/analyzer/cross-action-patterns.js

		/**
		* Cross-Action Pattern Catalog
		*
		* Each pattern is a self-describing detector for dangerous
		* combinations of actions in a Terraform plan.
		*
		* Design doc: docs/design/cross-action-analysis.md
		*/
		import { RecoverabilityTier } from '../resources/types.js';
		import { meetsConfidenceThreshold } from './cross-action.js';
		// -----------------------------------------------------------------------------
		// Pattern 1: Backup and Protected Resource Both Deleted
		// -----------------------------------------------------------------------------
		export const backupAndProtectedDeleted = {
		id: 'backup_and_protected_both_deleted',
		name: 'Backup and protected resource both deleted',
		minimumConfidence: 'probable',
		upgradeTier: RecoverabilityTier.UNRECOVERABLE,
		explanationTemplate: "The backup '{source}' is being deleted in the same plan as the resource it backs up ('{target}'). " +
		'Recovery from this backup would not be possible after this plan applies.',
		detect(context) {
		const matches = [];
		const deletions = context.changes.filter(c => c.actions.includes('delete'));
		// Find all snapshot deletions
		const snapshotDeletions = deletions.filter(c => c.type === 'aws_db_snapshot' \|\|
		c.type === 'aws_ebs_snapshot' \|\|
		c.type === 'aws_rds_cluster_snapshot');
		// Find all instance/database deletions
		const instanceDeletions = deletions.filter(c => c.type === 'aws_db_instance' \|\|
		c.type === 'aws_instance' \|\|
		c.type === 'aws_rds_cluster');
		// Build a set of deleted instance identifiers for fast lookup
		const deletedInstanceIds = new Set();
		for (const instance of instanceDeletions) {
		const id = instance.before?.identifier
		?? instance.before?.id
		?? instance.name;
		if (id)
		deletedInstanceIds.add(id);
		}
		// Check each snapshot for relationship to deleted instance
		for (const snapshot of snapshotDeletions) {
		const relationship = detectBackupRelationship(snapshot, instanceDeletions, context.stateIndex, deletedInstanceIds);
		if (relationship && meetsConfidenceThreshold(relationship.confidence, this.minimumConfidence)) {
		matches.push({
		affectedResources: [relationship.target, snapshot.address],
		relationship,
		context: {
		snapshotType: snapshot.type,
		instanceType: instanceDeletions.find(i => (i.before?.identifier ?? i.name) === relationship.target.split('.').pop())?.type,
		},
		});
		}
		}
		return matches;
		},
		};
		/**
		* Detects backup relationship between a snapshot and deleted instances.
		*/
		function detectBackupRelationship(snapshot, instanceDeletions, _stateIndex, deletedInstanceIds) {
		// Check explicit reference in snapshot
		const snapshotInstanceId = snapshot.before?.db_instance_identifier
		?? snapshot.before?.volume_id
		?? snapshot.before?.db_cluster_identifier;
		if (snapshotInstanceId && deletedInstanceIds.has(snapshotInstanceId)) {
		// Find the instance address
		const instance = instanceDeletions.find(i => (i.before?.identifier ?? i.name) === snapshotInstanceId);
		if (instance) {
		return {
		type: 'backup',
		source: snapshot.address,
		target: instance.address,
		detectionMethod: 'explicit_reference',
		confidence: 'definite',
		};
		}
		}
		// TODO: State lookup for additional relationships
		// TODO: Naming convention detection (low confidence)
		return null;
		}
		// -----------------------------------------------------------------------------
		// Pattern 2: Replica and Primary Both Deleted
		// -----------------------------------------------------------------------------
		export const replicaAndPrimaryDeleted = {
		id: 'replica_and_primary_both_deleted',
		name: 'Replica and primary both deleted',
		minimumConfidence: 'probable',
		upgradeTier: RecoverabilityTier.UNRECOVERABLE,
		explanationTemplate: "The replica '{source}' is being deleted in the same plan as its primary ('{target}'). " +
		'All copies of the data would be lost after this plan applies.',
		detect(context) {
		const matches = [];
		const deletions = context.changes.filter(c => c.actions.includes('delete'));
		// Find all DB instance deletions
		const dbDeletions = deletions.filter(c => c.type === 'aws_db_instance' \|\|
		c.type === 'aws_rds_cluster');
		// Build a set of deleted primary identifiers
		const deletedPrimaryIds = new Set();
		for (const db of dbDeletions) {
		const id = db.before?.identifier ?? db.name;
		if (id)
		deletedPrimaryIds.add(id);
		}
		// Check each deletion for replica relationship
		for (const db of dbDeletions) {
		const replicaSourceId = db.before?.replicate_source_db
		?? db.before?.replication_source_identifier;
		if (replicaSourceId && deletedPrimaryIds.has(replicaSourceId)) {
		// Find the primary's address
		const primary = dbDeletions.find(d => (d.before?.identifier ?? d.name) === replicaSourceId);
		if (primary) {
		matches.push({
		affectedResources: [primary.address, db.address],
		relationship: {
		type: 'replica',
		source: db.address,
		target: primary.address,
		detectionMethod: 'explicit_reference',
		confidence: 'definite',
		},
		});
		}
		}
		}
		return matches;
		},
		};
		// -----------------------------------------------------------------------------
		// Pattern 3: Protection Disabled Then Resource Deleted
		// -----------------------------------------------------------------------------
		export const protectionDisabledThenDeleted = {
		id: 'protection_disabled_then_deleted',
		name: 'Protection disabled then resource deleted',
		minimumConfidence: 'definite',
		upgradeTier: RecoverabilityTier.UNRECOVERABLE,
		explanationTemplate: "Deletion protection was disabled and the resource '{target}' was deleted in the same plan. " +
		'This bypasses the protection mechanism designed to prevent accidental deletion.',
		detect(context) {
		const matches = [];
		// Group changes by address
		const changesByAddress = new Map();
		for (const change of context.changes) {
		const existing = changesByAddress.get(change.address) ?? [];
		existing.push(change);
		changesByAddress.set(change.address, existing);
		}
		// Find resources with both update and delete actions
		for (const [address, changes] of changesByAddress) {
		const updates = changes.filter(c => c.actions.includes('update'));
		const deletes = changes.filter(c => c.actions.includes('delete'));
		if (updates.length === 0 \|\| deletes.length === 0)
		continue;
		// Check if any update disabled deletion protection
		for (const update of updates) {
		const beforeProtection = update.before?.deletion_protection;
		const afterProtection = update.after?.deletion_protection;
		if (beforeProtection === true && afterProtection === false) {
		matches.push({
		affectedResources: [address],
		relationship: {
		type: 'protection',
		source: address,
		target: address,
		detectionMethod: 'explicit_reference',
		confidence: 'definite',
		},
		context: {
		protectionField: 'deletion_protection',
		beforeValue: beforeProtection,
		afterValue: afterProtection,
		},
		});
		}
		}
		}
		return matches;
		},
		};
		// -----------------------------------------------------------------------------
		// Pattern Registry
		// -----------------------------------------------------------------------------
		/**
		* All registered cross-action patterns.
		* Adding a new pattern = adding one entry to this array.
		*/
		export const crossActionPatterns = [
		backupAndProtectedDeleted,
		replicaAndPrimaryDeleted,
		protectionDisabledThenDeleted,
		];
		//# sourceMappingURL=cross-action-patterns.js.map

+1

dist/analyzer/cross-action-patterns.js.map

+194

dist/analyzer/cross-action.d.ts

		/**
		* Cross-Action Analysis
		*
		* Detects dangerous patterns where individual actions are safe but
		* their combination is unrecoverable.
		*
		* Design doc: docs/design/cross-action-analysis.md
		*/
		import type { ResourceChange, TerraformState, RecoverabilityResult } from '../resources/types.js';
		import { RecoverabilityTier } from '../resources/types.js';
		import type { DependencyGraph } from './dependencies.js';
		/**
		* Confidence levels for relationship detection.
		*
		* - definite: Structural proof (explicit attribute reference)
		* - probable: Strong inference from state lookup
		* - possible: Heuristic match (naming convention)
		*/
		export type RelationshipConfidence = 'definite' \| 'probable' \| 'possible';
		/**
		* How a relationship was discovered.
		*/
		export type RelationshipDetectionMethod = 'explicit_reference' \| 'state_lookup' \| 'naming_convention';
		/**
		* Types of semantic relationships between resources.
		*/
		export type RelationshipType = 'backup' \| 'replica' \| 'protection' \| 'dependency';
		/**
		* Result of detecting a relationship between resources.
		* Returned by handler relationship detection functions.
		*/
		export interface RelationshipMatch {
		/** The resource ID this resource relates to */
		targetId: string;
		/** How the relationship was discovered */
		detectionMethod: RelationshipDetectionMethod;
		/** Confidence level of the match */
		confidence: RelationshipConfidence;
		}
		/**
		* Full relationship information including type, for pattern matching.
		*/
		export interface CrossActionRelationship {
		type: RelationshipType;
		source: string;
		target: string;
		detectionMethod: RelationshipDetectionMethod;
		confidence: RelationshipConfidence;
		}
		/**
		* Context passed to pattern detection functions.
		*/
		export interface CrossActionContext {
		/** All resource changes in the plan */
		changes: ResourceChange[];
		/** Dependency graph between resources */
		dependencies: DependencyGraph \| null;
		/** Individual recoverability verdicts (before cross-action analysis) */
		verdicts: Map<string, RecoverabilityResult>;
		/**
		* Terraform state (if available).
		*
		* Implementation note: State should be pre-indexed by resource address
		* for O(1) lookups. The stateIndex field provides this.
		*/
		state: TerraformState \| null;
		/**
		* Pre-indexed state for O(1) resource lookups.
		* Built once at analysis start, used by relationship detection.
		*/
		stateIndex: Map<string, Record<string, unknown>> \| null;
		}
		/**
		* A single match from a pattern detection function.
		*/
		export interface PatternMatch {
		/** Resources involved in this match */
		affectedResources: string[];
		/** The specific relationship that triggered the match */
		relationship: CrossActionRelationship;
		/** Additional context for the explanation */
		context?: Record<string, unknown>;
		}
		/**
		* A cross-action pattern definition.
		*
		* Patterns are self-describing and registered in a catalog.
		* Each pattern declares what it detects, when it fires, and
		* how confident it needs to be to fire.
		*/
		export interface CrossActionPattern {
		/** Unique identifier for telemetry and reporting */
		id: string;
		/** Human-readable name */
		name: string;
		/**
		* Predicate that examines the plan and returns matched resource groups.
		* Returns empty array if pattern doesn't match.
		*
		* Multiple-match behavior: If a single plan has multiple matches at
		* different confidence levels, the function should return ALL matches
		* that meet the minimumConfidence threshold. The caller will include
		* all matches in the output array.
		*/
		detect(context: CrossActionContext): PatternMatch[];
		/** Tier to upgrade the plan-level summary to when pattern matches */
		upgradeTier: RecoverabilityTier;
		/**
		* Minimum confidence level required to fire this pattern.
		*
		* Matches below this confidence are not returned by detect().
		* For example, backup_and_protected_both_deleted requires 'probable'
		* because naming-convention matches are too speculative for UNRECOVERABLE.
		*/
		minimumConfidence: RelationshipConfidence;
		/** Template for explanation (interpolated with match details) */
		explanationTemplate: string;
		}
		/**
		* A cross-action risk detected in a plan.
		* Included in ConsequenceReport.crossActionRisks array.
		*/
		export interface CrossActionRisk {
		/** Pattern identifier */
		pattern: string;
		/** Human-readable pattern name */
		patternName: string;
		/** Resources involved */
		affectedResources: string[];
		/** The relationship that triggered the match */
		relationship: CrossActionRelationship;
		/** Human-readable explanation */
		explanation: string;
		/** What the tier was upgraded to */
		upgradedTier: RecoverabilityTier;
		/** Scope limitations, if any */
		scopeWarning?: string;
		}
		/**
		* Relationship detection function signature.
		*
		* Handlers implement this to declare how their resource types
		* relate to other resources (backup, replica, etc.).
		*
		* @param resource - The resource to check (e.g., a snapshot)
		* @param candidates - All deletions of target types in the plan
		* @param stateIndex - Pre-indexed state for O(1) lookups
		* @returns Match info if relationship found, null otherwise
		*/
		export type DetectRelationshipFn = (resource: ResourceChange, candidates: ResourceChange[], stateIndex: Map<string, Record<string, unknown>> \| null) => RelationshipMatch \| null;
		/**
		* Relationship declaration for a handler.
		* Added to ResourceHandler interface.
		*/
		export interface HandlerRelationships {
		/** This resource can be a backup of another resource */
		canBeBackupOf?: {
		targetTypes: string[];
		detectRelationship: DetectRelationshipFn;
		};
		/** This resource can be a replica of another resource */
		canBeReplicaOf?: {
		targetTypes: string[];
		detectRelationship: DetectRelationshipFn;
		};
		}
		/**
		* Builds a pre-indexed state map for O(1) resource lookups.
		*
		* Called once at the start of analysis. Handlers use this
		* for state-based relationship detection without O(N) scans.
		*/
		export declare function buildStateIndex(state: TerraformState \| null): Map<string, Record<string, unknown>> \| null;
		/**
		* Checks if a confidence level meets a minimum threshold.
		*/
		export declare function meetsConfidenceThreshold(actual: RelationshipConfidence, minimum: RelationshipConfidence): boolean;
		/**
		* Builds CrossActionContext from analysis inputs.
		*/
		export declare function buildCrossActionContext(changes: ResourceChange[], dependencies: DependencyGraph \| null, verdicts: Map<string, RecoverabilityResult>, state: TerraformState \| null): CrossActionContext;
		/**
		* Runs all patterns against the context and returns matches.
		*
		* This is the main entry point for cross-action analysis.
		* Called by blast-radius.ts after individual evaluations.
		*/
		export declare function detectCrossActionRisks(context: CrossActionContext, patterns: CrossActionPattern[]): CrossActionRisk[];
		/**
		* Computes the worst tier from cross-action risks.
		* Returns null if no risks detected.
		*/
		export declare function getWorstCrossActionTier(risks: CrossActionRisk[]): RecoverabilityTier \| null;
		//# sourceMappingURL=cross-action.d.ts.map

+1

dist/analyzer/cross-action.d.ts.map

{"version":3,"file":"cross-action.d.ts","sourceRoot":"","sources":["../../src/analyzer/cross-action.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,cAAc,EACd,oBAAoB,EACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAMzD;;;;;;GAMG;AACH,MAAM,MAAM,sBAAsB,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,CAAC;AAE1E;;GAEG;AACH,MAAM,MAAM,2BAA2B,GACnC,oBAAoB,GACpB,cAAc,GACd,mBAAmB,CAAC;AAExB;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,SAAS,GAAG,YAAY,GAAG,YAAY,CAAC;AAMlF;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,+CAA+C;IAC/C,QAAQ,EAAE,MAAM,CAAC;IAEjB,0CAA0C;IAC1C,eAAe,EAAE,2BAA2B,CAAC;IAE7C,oCAAoC;IACpC,UAAU,EAAE,sBAAsB,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,gBAAgB,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,2BAA2B,CAAC;IAC7C,UAAU,EAAE,sBAAsB,CAAC;CACpC;AAMD;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,uCAAuC;IACvC,OAAO,EAAE,cAAc,EAAE,CAAC;IAE1B,yCAAyC;IACzC,YAAY,EAAE,eAAe,GAAG,IAAI,CAAC;IAErC,wEAAwE;IACxE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAE5C;;;;;OAKG;IACH,KAAK,EAAE,cAAc,GAAG,IAAI,CAAC;IAE7B;;;OAGG;IACH,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;CACzD;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,uCAAuC;IACvC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAE5B,yDAAyD;IACzD,YAAY,EAAE,uBAAuB,CAAC;IAEtC,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,oDAAoD;IACpD,EAAE,EAAE,MAAM,CAAC;IAEX,0BAA0B;IAC1B,IAAI,EAAE,MAAM,CAAC;IAEb;;;;;;;;OAQG;IACH,MAAM,CAAC,OAAO,EAAE,kBAAkB,GAAG,YAAY,EAAE,CAAC;IAEpD,qEAAqE;IACrE,WAAW,EAAE,kBAAkB,CAAC;IAEhC;;;;;;OAMG;IACH,iBAAiB,EAAE,sBAAsB,CAAC;IAE1C,iEAAiE;IACjE,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAMD;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,yBAAyB;IACzB,OAAO,EAAE,MAAM,CAAC;IAEhB,kCAAkC;IAClC,WAAW,EAAE,MAAM,CAAC;IAEpB,yBAAyB;IACzB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAE5B,gDAAgD;IAChD,YAAY,EAAE,uBAAuB,CAAC;IAEtC,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAC;IAEpB,oCAAoC;IACpC,YAAY,EAAE,kBAAkB,CAAC;IAEjC,gCAAgC;IAChC,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAMD;;;;;;;;;;GAUG;AACH,MAAM,MAAM,oBAAoB,GAAG,CACjC,QAAQ,EAAE,cAAc,EACxB,UAAU,EAAE,cAAc,EAAE,EAC5B,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI,KACpD,iBAAiB,GAAG,IAAI,CAAC;AAE9B;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,wDAAwD;IACxD,aAAa,CAAC,EAAE;QACd,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,kBAAkB,EAAE,oBAAoB,CAAC;KAC1C,CAAC;IAEF,yDAAyD;IACzD,cAAc,CAAC,EAAE;QACf,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,kBAAkB,EAAE,oBAAoB,CAAC;KAC1C,CAAC;CACH;AAMD;;;;;GAKG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,cAAc,GAAG,IAAI,GAC3B,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,IAAI,CAQ7C;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,sBAAsB,EAC9B,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAMT;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,cAAc,EAAE,EACzB,YAAY,EAAE,eAAe,GAAG,IAAI,EACpC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,EAC3C,KAAK,EAAE,cAAc,GAAG,IAAI,GAC3B,kBAAkB,CAQpB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,kBAAkB,EAC3B,QAAQ,EAAE,kBAAkB,EAAE,GAC7B,eAAe,EAAE,CAyBnB;AA2CD;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,eAAe,EAAE,GACvB,kBAAkB,GAAG,IAAI,CAU3B"}

+124

dist/analyzer/cross-action.js

		/**
		* Cross-Action Analysis
		*
		* Detects dangerous patterns where individual actions are safe but
		* their combination is unrecoverable.
		*
		* Design doc: docs/design/cross-action-analysis.md
		*/
		import { RecoverabilityTier } from '../resources/types.js';
		// -----------------------------------------------------------------------------
		// Analysis Functions
		// -----------------------------------------------------------------------------
		/**
		* Builds a pre-indexed state map for O(1) resource lookups.
		*
		* Called once at the start of analysis. Handlers use this
		* for state-based relationship detection without O(N) scans.
		*/
		export function buildStateIndex(state) {
		if (!state)
		return null;
		const index = new Map();
		for (const resource of state.resources) {
		index.set(resource.address, resource.values);
		}
		return index;
		}
		/**
		* Checks if a confidence level meets a minimum threshold.
		*/
		export function meetsConfidenceThreshold(actual, minimum) {
		const levels = ['definite', 'probable', 'possible'];
		const actualIndex = levels.indexOf(actual);
		const minimumIndex = levels.indexOf(minimum);
		// Lower index = higher confidence
		return actualIndex <= minimumIndex;
		}
		/**
		* Builds CrossActionContext from analysis inputs.
		*/
		export function buildCrossActionContext(changes, dependencies, verdicts, state) {
		return {
		changes,
		dependencies,
		verdicts,
		state,
		stateIndex: buildStateIndex(state),
		};
		}
		/**
		* Runs all patterns against the context and returns matches.
		*
		* This is the main entry point for cross-action analysis.
		* Called by blast-radius.ts after individual evaluations.
		*/
		export function detectCrossActionRisks(context, patterns) {
		const risks = [];
		for (const pattern of patterns) {
		const matches = pattern.detect(context);
		for (const match of matches) {
		// Verify match meets minimum confidence (defense in depth)
		if (!meetsConfidenceThreshold(match.relationship.confidence, pattern.minimumConfidence)) {
		continue;
		}
		risks.push({
		pattern: pattern.id,
		patternName: pattern.name,
		affectedResources: match.affectedResources,
		relationship: match.relationship,
		explanation: interpolateExplanation(pattern.explanationTemplate, match),
		upgradedTier: pattern.upgradeTier,
		scopeWarning: buildScopeWarning(match, context),
		});
		}
		}
		return risks;
		}
		/**
		* Interpolates a pattern explanation template with match details.
		*/
		function interpolateExplanation(template, match) {
		return template
		.replace('{source}', match.relationship.source)
		.replace('{target}', match.relationship.target)
		.replace('{type}', match.relationship.type)
		.replace('{confidence}', match.relationship.confidence);
		}
		/**
		* Builds scope warning based on match and context.
		*/
		function buildScopeWarning(match, context) {
		const warnings = [];
		// Always warn about plan scope
		warnings.push('Analysis limited to resources in this plan.');
		// Warn if no state was provided
		if (!context.state) {
		warnings.push('No Terraform state provided; relationship detection limited to plan references.');
		}
		// Warn about cross-account/region limitations
		if (match.relationship.type === 'backup') {
		warnings.push('Cross-account or externally-managed backups not evaluated.');
		}
		// Warn about naming convention detection
		if (match.relationship.detectionMethod === 'naming_convention') {
		warnings.push('Relationship inferred from naming convention; may be coincidental.');
		}
		return warnings.join(' ');
		}
		/**
		* Computes the worst tier from cross-action risks.
		* Returns null if no risks detected.
		*/
		export function getWorstCrossActionTier(risks) {
		if (risks.length === 0)
		return null;
		let worst = RecoverabilityTier.REVERSIBLE;
		for (const risk of risks) {
		if (risk.upgradedTier > worst) {
		worst = risk.upgradedTier;
		}
		}
		return worst;
		}
		//# sourceMappingURL=cross-action.js.map

+1

dist/analyzer/cross-action.js.map

{"version":3,"file":"cross-action.js","sourceRoot":"","sources":["../../src/analyzer/cross-action.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAwN3D,gFAAgF;AAChF,qBAAqB;AACrB,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,KAA4B;IAE5B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAmC,CAAC;IACzD,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACvC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CACtC,MAA8B,EAC9B,OAA+B;IAE/B,MAAM,MAAM,GAA6B,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IAC9E,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,kCAAkC;IAClC,OAAO,WAAW,IAAI,YAAY,CAAC;AACrC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAyB,EACzB,YAAoC,EACpC,QAA2C,EAC3C,KAA4B;IAE5B,OAAO;QACL,OAAO;QACP,YAAY;QACZ,QAAQ;QACR,KAAK;QACL,UAAU,EAAE,eAAe,CAAC,KAAK,CAAC;KACnC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAA2B,EAC3B,QAA8B;IAE9B,MAAM,KAAK,GAAsB,EAAE,CAAC;IAEpC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAExC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,2DAA2D;YAC3D,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;gBACxF,SAAS;YACX,CAAC;YAED,KAAK,CAAC,IAAI,CAAC;gBACT,OAAO,EAAE,OAAO,CAAC,EAAE;gBACnB,WAAW,EAAE,OAAO,CAAC,IAAI;gBACzB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;gBAC1C,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,WAAW,EAAE,sBAAsB,CAAC,OAAO,CAAC,mBAAmB,EAAE,KAAK,CAAC;gBACvE,YAAY,EAAE,OAAO,CAAC,WAAW;gBACjC,YAAY,EAAE,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC;aAChD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,sBAAsB,CAAC,QAAgB,EAAE,KAAmB;IACnE,OAAO,QAAQ;SACZ,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC;SAC9C,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC;SAC9C,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC;SAC1C,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;AAC5D,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CACxB,KAAmB,EACnB,OAA2B;IAE3B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,+BAA+B;IAC/B,QAAQ,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAE7D,gCAAgC;IAChC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,QAAQ,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAC;IACnG,CAAC;IAED,8CAA8C;IAC9C,IAAI,KAAK,CAAC,YAAY,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACzC,QAAQ,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;IAC9E,CAAC;IAED,yCAAyC;IACzC,IAAI,KAAK,CAAC,YAAY,CAAC,eAAe,KAAK,mBAAmB,EAAE,CAAC;QAC/D,QAAQ,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;IACtF,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,KAAwB;IAExB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpC,IAAI,KAAK,GAAG,kBAAkB,CAAC,UAAU,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,YAAY,GAAG,KAAK,EAAE,CAAC;YAC9B,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

+1

-1

dist/cli.js

		@@ -24,3 +24,3 @@ import { Command } from 'commander';
		.description('Know what you can\'t undo before you terraform apply')
		.version('0.1.34');
		.version('0.1.36');
		program
		@@ -27,0 +27,0 @@ .command('plan')

+7

-0

dist/core/consequence.d.ts

		import type { RecoverabilityResult } from '../resources/types.js';
		import type { DependencyImpact, EvidenceItem, MissingEvidence, MutationIntent, VerificationSuggestion } from './mutation.js';
		import type { EvidenceRequirementLevel, EvidenceSufficiency } from './state-schema.js';
		import type { CrossActionRisk } from '../analyzer/cross-action.js';
		export type ConsequenceDecision = 'allow' \| 'warn' \| 'block' \| 'escalate';
		@@ -93,3 +94,9 @@ /**
		requiredEvidence?: RequiredEvidence;
		/**
		* Cross-action risks detected in the plan.
		* Empty array if no patterns matched.
		* Always present when cross-action analysis runs (explicit "we checked").
		*/
		crossActionRisks?: CrossActionRisk[];
		}
		//# sourceMappingURL=consequence.d.ts.map

+1

-1

dist/core/consequence.d.ts.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"consequence.d.ts","sourceRoot":"","sources":["../../src/core/consequence.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAC7H,OAAO,KAAK,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAEvF,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,GAAG,UAAU,CAAC;AAM1E;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,sEAAsE;IACtE,GAAG,EAAE,MAAM,CAAC;IACZ,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,wBAAwB;IACxB,KAAK,EAAE,wBAAwB,CAAC;IAChC,uCAAuC;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,+BAA+B;IAC/B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,wEAAwE;IACxE,sBAAsB,EAAE,OAAO,CAAC;CACjC;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,YAAY,EAAE,MAAM,CAAC;IACrB,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,mBAAmB,EAAE,OAAO,CAAC;IAC7B,sCAAsC;IACtC,YAAY,EAAE,yBAAyB,EAAE,CAAC;IAC1C,qBAAqB;IACrB,OAAO,EAAE;QACP,iCAAiC;QACjC,KAAK,EAAE,MAAM,CAAC;QACd,6BAA6B;QAC7B,SAAS,EAAE,MAAM,CAAC;QAClB,wCAAwC;QACxC,eAAe,EAAE,MAAM,CAAC;QACxB,oEAAoE;QACpE,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;IACF,0EAA0E;IAC1E,UAAU,EAAE,OAAO,CAAC;IACpB,qFAAqF;IACrF,WAAW,EAAE,mBAAmB,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,cAAc,CAAC;IACvB,cAAc,EAAE,oBAAoB,CAAC;IACrC,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,eAAe,EAAE,eAAe,EAAE,CAAC;IACnC,gBAAgB,EAAE,gBAAgB,EAAE,CAAC;IACrC,yDAAyD;IACzD,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CACrC;AAED,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,oBAAoB,CAAC;IAC1C,WAAW,EAAE,OAAO,CAAC;IACrB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAE/C,MAAM,MAAM,kBAAkB,GAC1B,uBAAuB,GACvB,cAAc,GACd,gBAAgB,GAChB,0BAA0B,GAC1B,eAAe,CAAC;AAEpB,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB,CAAC,EAAE;QACpB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,OAAO,EAAE,kBAAkB,CAAC;IAC5B,mEAAmE;IACnE,cAAc,EAAE,mBAAmB,CAAC;IACpC,2CAA2C;IAC3C,gBAAgB,EAAE,MAAM,CAAC;IAGzB,2BAA2B,CAAC,EAAE,2BAA2B,CAAC;IAC1D,uBAAuB,CAAC,EAAE,sBAAsB,EAAE,CAAC;IACnD,kBAAkB,CAAC,EAAE,sBAAsB,CAAC;IAG5C,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CACrC"}
		{"version":3,"file":"consequence.d.ts","sourceRoot":"","sources":["../../src/core/consequence.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAC7H,OAAO,KAAK,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACvF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAEnE,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,GAAG,UAAU,CAAC;AAM1E;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,sEAAsE;IACtE,GAAG,EAAE,MAAM,CAAC;IACZ,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,wBAAwB;IACxB,KAAK,EAAE,wBAAwB,CAAC;IAChC,uCAAuC;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB,+BAA+B;IAC/B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,wEAAwE;IACxE,sBAAsB,EAAE,OAAO,CAAC;CACjC;AAED;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,wEAAwE;IACxE,YAAY,EAAE,MAAM,CAAC;IACrB,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,mBAAmB,EAAE,OAAO,CAAC;IAC7B,sCAAsC;IACtC,YAAY,EAAE,yBAAyB,EAAE,CAAC;IAC1C,qBAAqB;IACrB,OAAO,EAAE;QACP,iCAAiC;QACjC,KAAK,EAAE,MAAM,CAAC;QACd,6BAA6B;QAC7B,SAAS,EAAE,MAAM,CAAC;QAClB,wCAAwC;QACxC,eAAe,EAAE,MAAM,CAAC;QACxB,oEAAoE;QACpE,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;IACF,0EAA0E;IAC1E,UAAU,EAAE,OAAO,CAAC;IACpB,qFAAqF;IACrF,WAAW,EAAE,mBAAmB,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,cAAc,CAAC;IACvB,cAAc,EAAE,oBAAoB,CAAC;IACrC,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,eAAe,EAAE,eAAe,EAAE,CAAC;IACnC,gBAAgB,EAAE,gBAAgB,EAAE,CAAC;IACrC,yDAAyD;IACzD,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CACrC;AAED,MAAM,WAAW,kBAAkB;IACjC,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,oBAAoB,CAAC;IAC1C,WAAW,EAAE,OAAO,CAAC;IACrB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAE/C,MAAM,MAAM,kBAAkB,GAC1B,uBAAuB,GACvB,cAAc,GACd,gBAAgB,GAChB,0BAA0B,GAC1B,eAAe,CAAC;AAEpB,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB,CAAC,EAAE;QACpB,QAAQ,EAAE,MAAM,CAAC;QACjB,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,gBAAgB,EAAE,CAAC;IAC9B,OAAO,EAAE,kBAAkB,CAAC;IAC5B,mEAAmE;IACnE,cAAc,EAAE,mBAAmB,CAAC;IACpC,2CAA2C;IAC3C,gBAAgB,EAAE,MAAM,CAAC;IAGzB,2BAA2B,CAAC,EAAE,2BAA2B,CAAC;IAC1D,uBAAuB,CAAC,EAAE,sBAAsB,EAAE,CAAC;IACnD,kBAAkB,CAAC,EAAE,sBAAsB,CAAC;IAG5C,2EAA2E;IAC3E,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAGpC;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,eAAe,EAAE,CAAC;CACtC"}

+1

-0

dist/core/index.d.ts

		export type { ActorKind, AgentInterpretation, DependencyImpact, EvidenceItem, EvidenceSubmission, MissingEvidence, MutationAction, MutationActor, MutationIntent, MutationSource, MutationTarget, VerificationApiCall, VerificationCommand, VerificationPriority, VerificationSuggestion, VerificationType, VerificationUncertainty, VerificationVerdictImpact, } from './mutation.js';
		export type { AnalyzedMutation, ConsequenceDecision, ConsequenceReport, ConsequenceSummary, EvidenceRequirementStatus, RequiredEvidence, VerificationProtocolVersion, VerificationStatus, VerificationStatusInfo, } from './consequence.js';
		export type { CrossActionRelationship, CrossActionRisk, RelationshipConfidence, RelationshipDetectionMethod, RelationshipType, } from '../analyzer/cross-action.js';
		export type { EvidenceConflict, EvidenceFreshness, EvidenceFreshnessLevel, EvidenceRequirement, EvidenceRequirementLevel, EvidenceSource, EvidenceSufficiency, ResourceEvidenceRequirements, StateAssessment, StateCompleteness, StateCompletenessLevel, StateRecommendation, // Deprecated - use EvidenceSufficiency
		@@ -4,0 +5,0 @@ TrackedEvidence, } from './state-schema.js';

+1

-1

dist/core/index.d.ts.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,SAAS,EACT,mBAAmB,EACnB,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,aAAa,EACb,cAAc,EACd,cAAc,EACd,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,gBAAgB,EAChB,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,eAAe,CAAC;AAEvB,YAAY,EACV,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,EACzB,gBAAgB,EAChB,2BAA2B,EAC3B,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAG1B,YAAY,EACV,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,EACnB,wBAAwB,EACxB,cAAc,EACd,mBAAmB,EACnB,4BAA4B,EAC5B,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,EAAG,uCAAuC;AAC7D,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,WAAW,EACX,2BAA2B,EAC3B,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,4BAA4B,CAAC"}
		{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,SAAS,EACT,mBAAmB,EACnB,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,aAAa,EACb,cAAc,EACd,cAAc,EACd,cAAc,EACd,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,gBAAgB,EAChB,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,eAAe,CAAC;AAEvB,YAAY,EACV,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,EACzB,gBAAgB,EAChB,2BAA2B,EAC3B,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAG1B,YAAY,EACV,uBAAuB,EACvB,eAAe,EACf,sBAAsB,EACtB,2BAA2B,EAC3B,gBAAgB,GACjB,MAAM,6BAA6B,CAAC;AAGrC,YAAY,EACV,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,EACnB,wBAAwB,EACxB,cAAc,EACd,mBAAmB,EACnB,4BAA4B,EAC5B,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,EAAG,uCAAuC;AAC7D,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,WAAW,EACX,2BAA2B,EAC3B,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,4BAA4B,CAAC"}

+1

-1

dist/core/index.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAkDA,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,WAAW,EACX,2BAA2B,EAC3B,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,4BAA4B,CAAC"}
		{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AA2DA,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,WAAW,EACX,2BAA2B,EAC3B,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,4BAA4B,CAAC"}

+1

-1

dist/evaluator/terraform.d.ts.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"terraform.d.ts","sourceRoot":"","sources":["../../src/evaluator/terraform.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAEV,iBAAiB,EAKlB,MAAM,kBAAkB,CAAC;AAM1B,OAAO,EAIL,KAAK,aAAa,EAClB,KAAK,cAAc,EAEpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,KAAK,WAAW,EACjB,MAAM,oBAAoB,CAAC;AAG5B,MAAM,WAAW,2BAA2B;IAC1C,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,aAAa,EACnB,KAAK,EAAE,cAAc,GAAG,IAAI,EAC5B,OAAO,GAAE,2BAAgC,GACxC,iBAAiB,CAqKnB"}
		{"version":3,"file":"terraform.d.ts","sourceRoot":"","sources":["../../src/evaluator/terraform.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAEV,iBAAiB,EAKlB,MAAM,kBAAkB,CAAC;AAM1B,OAAO,EAIL,KAAK,aAAa,EAClB,KAAK,cAAc,EAEpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,KAAK,WAAW,EACjB,MAAM,oBAAoB,CAAC;AAG5B,MAAM,WAAW,2BAA2B;IAC1C,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,aAAa,EACnB,KAAK,EAAE,cAAc,GAAG,IAAI,EAC5B,OAAO,GAAE,2BAAgC,GACxC,iBAAiB,CAwNnB"}

+43

-4

dist/evaluator/terraform.js

		import { analyzeBlastRadius } from '../analyzer/blast-radius.js';
		import { buildDependencyGraph } from '../analyzer/dependencies.js';
		import { buildCrossActionContext, detectCrossActionRisks, getWorstCrossActionTier, } from '../analyzer/cross-action.js';
		import { crossActionPatterns } from '../analyzer/cross-action-patterns.js';
		import { terraformChangeToMutation } from '../adapters/terraform.js';
		@@ -56,3 +59,28 @@ import { buildRequiredEvidence, getEvidenceRequirements, } from '../core/index.js';
		});
		const worstRecoverability = getWorstRecoverability(blastRadiusReport.changes.map(change => change.recoverability));
		// Get effective state for cross-action analysis
		const effectiveState = state \|\| plan.priorState \|\| null;
		// Build verdicts map for cross-action context
		const verdicts = new Map();
		for (const change of blastRadiusReport.changes) {
		verdicts.set(change.resource.address, change.recoverability);
		}
		// Run cross-action analysis
		const dependencyGraph = effectiveState ? buildDependencyGraph(effectiveState) : null;
		const crossActionContext = buildCrossActionContext(blastRadiusReport.changes.map(c => c.resource), dependencyGraph, verdicts, effectiveState);
		const crossActionRisks = detectCrossActionRisks(crossActionContext, crossActionPatterns);
		// Get worst tier from cross-action risks (may upgrade plan-level summary)
		const crossActionWorstTier = getWorstCrossActionTier(crossActionRisks);
		// Get worst recoverability from individual mutations
		let worstRecoverability = getWorstRecoverability(blastRadiusReport.changes.map(change => change.recoverability));
		// Upgrade if cross-action analysis found worse tier
		if (crossActionWorstTier !== null && crossActionWorstTier > worstRecoverability.tier) {
		const crossActionReason = crossActionRisks
		.map(r => r.patternName)
		.join('; ');
		worstRecoverability = {
		tier: crossActionWorstTier,
		label: RecoverabilityLabels[crossActionWorstTier],
		reasoning: `Cross-action analysis: ${crossActionReason}`,
		};
		}
		// Aggregate verification suggestions from all mutations
		@@ -120,2 +148,9 @@ const verificationSuggestions = [];
		}
		// Determine if plan has unrecoverable actions (including from cross-action analysis)
		const hasUnrecoverableFromCrossAction = crossActionWorstTier === RecoverabilityTier.UNRECOVERABLE;
		const hasUnrecoverable = blastRadiusReport.summary.hasUnrecoverable \|\| hasUnrecoverableFromCrossAction;
		// Re-evaluate policy with potentially upgraded worst tier
		const finalPolicyEvaluation = hasUnrecoverableFromCrossAction
		? evaluateBlastRadiusReport({ ...blastRadiusReport, summary: { ...blastRadiusReport.summary, hasUnrecoverable: true } }, options.policy)
		: policyEvaluation;
		const report = {
		@@ -127,7 +162,11 @@ mutations,
		needsReview: worstRecoverability.tier === RecoverabilityTier.NEEDS_REVIEW,
		hasUnrecoverable: blastRadiusReport.summary.hasUnrecoverable,
		hasUnrecoverable,
		dependencyImpactCount: blastRadiusReport.summary.cascadeImpactCount,
		},
		riskAssessment: policyEvaluation.decision,
		assessmentReason: policyEvaluation.reason,
		riskAssessment: finalPolicyEvaluation.decision,
		assessmentReason: hasUnrecoverableFromCrossAction
		? `${finalPolicyEvaluation.reason} (cross-action risk detected)`
		: finalPolicyEvaluation.reason,
		// Always include cross-action risks (empty array if none detected)
		crossActionRisks,
		};
		@@ -134,0 +173,0 @@ // Add verification protocol fields

+1

-1

dist/evaluator/terraform.js.map

		@@ -1,1 +0,1 @@
		{"version":3,"file":"terraform.js","sourceRoot":"","sources":["../../src/evaluator/terraform.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAUrE,OAAO,EACL,qBAAqB,EACrB,uBAAuB,GAExB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,oBAAoB,EACpB,kBAAkB,GAKnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,yBAAyB,GAE1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,0BAA0B,EAAqD,MAAM,0BAA0B,CAAC;AAQzH,MAAM,UAAU,iCAAiC,CAC/C,IAAmB,EACnB,KAA4B,EAC5B,UAAuC,EAAE;IAEzC,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE;QACxD,aAAa,EAAE,OAAO,CAAC,aAAa;KACrC,CAAC,CAAC;IAEH,MAAM,gBAAgB,GAAG,yBAAyB,CAChD,iBAAiB,EACjB,OAAO,CAAC,MAAM,CACf,CAAC;IAEF,MAAM,SAAS,GAAuB,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;QAC3E,MAAM,QAAQ,GAAmB;YAC/B;gBACE,GAAG,EAAE,0BAA0B;gBAC/B,KAAK,EAAE,MAAM,CAAC,cAAc,CAAC,SAAS;gBACtC,OAAO,EAAE,IAAI;gBACb,WAAW,EAAE,kDAAkD;aAChE;SACF,CAAC;QAEF,mDAAmD;QACnD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClE,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBAC1C,QAAQ,CAAC,IAAI,CAAC;wBACZ,GAAG,EAAE,SAAS,GAAG,EAAE;wBACnB,KAAK;wBACL,OAAO,EAAE,IAAI;wBACb,WAAW,EAAE,mBAAmB,GAAG,EAAE;qBACtC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,gBAAgB,GAAG,8BAA8B,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAEnF,OAAO;YACL,MAAM,EAAE,yBAAyB,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,cAAc,CAAC;YAC1E,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,QAAQ;YACR,eAAe,EAAE,MAAM,CAAC,cAAc,CAAC,IAAI,KAAK,kBAAkB,CAAC,YAAY;gBAC7E,CAAC,CAAC;oBACE;wBACE,GAAG,EAAE,oBAAoB;wBACzB,WAAW,EAAE,yEAAyE;wBACtF,MAAM,EAAE,iBAAiB;qBAC1B;iBACF;gBACH,CAAC,CAAC,EAAE;YACN,gBAAgB,EAAE,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACpD,QAAQ,EAAE,MAAM,CAAC,gBAAgB;gBACjC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;YACH,gBAAgB;SACjB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,MAAM,mBAAmB,GAAG,sBAAsB,CAChD,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAC/D,CAAC;IAEF,wDAAwD;IACxD,MAAM,uBAAuB,GAA6B,EAAE,CAAC;IAC7D,MAAM,oBAAoB,GAA0B,EAAE,CAAC;IACvD,IAAI,2BAA+D,CAAC;IAEpE,KAAK,MAAM,MAAM,IAAI,iBAAiB,CAAC,OAAO,EAAE,CAAC;QAC/C,oDAAoD;QACpD,IAAI,MAAM,CAAC,cAAc,CAAC,uBAAuB,EAAE,CAAC;YAClD,uBAAuB,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC,uBAAuB,CAAC,CAAC;QACjF,CAAC;QACD,kFAAkF;aAC7E,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,MAAM,MAAM,GAAG,0BAA0B,CACvC,MAAM,CAAC,QAAQ,CAAC,IAAI,EACpB,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,EAC5B;gBACE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO;aACjC,CACF,CAAC;YAEF,6DAA6D;YAC7D,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAExC,gDAAgD;YAChD,IAAI,MAAM,CAAC,MAAM,KAAK,uBAAuB,EAAE,CAAC;gBAC9C,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;oBAC5C,uBAAuB,CAAC,IAAI,CAAC;wBAC3B,GAAG,UAAU;wBACb,gDAAgD;wBAChD,WAAW,EAAE,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,IAAI,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,WAAW,EAAE;qBAC1H,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,4EAA4E;YAC5E,IAAI,CAAC,2BAA2B,EAAE,CAAC;gBACjC,2BAA2B,GAAG;oBAC5B,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,MAAM,EAAE,MAAM,CAAC,YAAY;oBAC3B,mBAAmB,EAAE;wBACnB,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC,QAAQ;wBACxC,UAAU,EAAE,MAAM,CAAC,cAAc,CAAC,UAAU;wBAC5C,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC,MAAM;wBACpC,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,SAAS;qBAC3C;iBACF,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,6FAA6F;gBAC7F,MAAM,cAAc,GAA2B;oBAC7C,gBAAgB,EAAE,CAAC;oBACnB,0BAA0B,EAAE,CAAC;oBAC7B,uBAAuB,EAAE,CAAC;oBAC1B,cAAc,EAAE,CAAC;iBAClB,CAAC;gBACF,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,2BAA2B,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;oBACrG,2BAA2B,GAAG;wBAC5B,MAAM,EAAE,MAAM,CAAC,MAAM;wBACrB,MAAM,EAAE,MAAM,CAAC,YAAY;wBAC3B,mBAAmB,EAAE;4BACnB,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC,QAAQ;4BACxC,UAAU,EAAE,MAAM,CAAC,cAAc,CAAC,UAAU;4BAC5C,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC,MAAM;4BACpC,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,SAAS;yBAC3C;qBACF,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAsB;QAChC,SAAS;QACT,OAAO,EAAE;YACP,cAAc,EAAE,SAAS,CAAC,MAAM;YAChC,mBAAmB;YACnB,WAAW,EAAE,mBAAmB,CAAC,IAAI,KAAK,kBAAkB,CAAC,YAAY;YACzE,gBAAgB,EAAE,iBAAiB,CAAC,OAAO,CAAC,gBAAgB;YAC5D,qBAAqB,EAAE,iBAAiB,CAAC,OAAO,CAAC,kBAAkB;SACpE;QACD,cAAc,EAAE,gBAAgB,CAAC,QAAQ;QACzC,gBAAgB,EAAE,gBAAgB,CAAC,MAAM;KAC1C,CAAC;IAEF,mCAAmC;IACnC,IAAI,uBAAuB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,2BAA2B,GAAG,IAAI,CAAC;QAC1C,MAAM,CAAC,uBAAuB,GAAG,uBAAuB,CAAC;IAC3D,CAAC;IAED,iEAAiE;IACjE,IAAI,2BAA2B,EAAE,CAAC;QAChC,MAAM,CAAC,2BAA2B,GAAG,IAAI,CAAC;QAC1C,MAAM,CAAC,kBAAkB,GAAG,2BAA2B,CAAC;IAC1D,CAAC;SAAM,IAAI,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACtF,sEAAsE;QACtE,MAAM,CAAC,2BAA2B,GAAG,IAAI,CAAC;QAC1C,MAAM,CAAC,kBAAkB,GAAG;YAC1B,MAAM,EAAE,uBAAuB;YAC/B,MAAM,EAAE,qDAAqD;SAC9D,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,sBAAsB,CAAC,OAA+B;IAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,IAAI,EAAE,kBAAkB,CAAC,UAAU;YACnC,KAAK,EAAE,oBAAoB,CAAC,kBAAkB,CAAC,UAAU,CAAC;YAC1D,SAAS,EAAE,uBAAuB;SACnC,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CACvC,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAC5C,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,8BAA8B,CACrC,MAAsB,EACtB,QAAwB;IAExB,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC9C,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACnC,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,QAAQ,CAAC;IAEb,MAAM,YAAY,GAAG,uBAAuB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAEnE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,mDAAmD;QACnD,OAAO;YACL,YAAY;YACZ,MAAM;YACN,mBAAmB,EAAE,KAAK;YAC1B,YAAY,EAAE,EAAE;YAChB,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE;YAC3E,UAAU,EAAE,IAAI;YAChB,WAAW,EAAE,YAAY;SAC1B,CAAC;IACJ,CAAC;IAED,OAAO,qBAAqB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;AAC7E,CAAC"}
		{"version":3,"file":"terraform.js","sourceRoot":"","sources":["../../src/evaluator/terraform.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,uBAAuB,GAExB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAC3E,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAUrE,OAAO,EACL,qBAAqB,EACrB,uBAAuB,GAExB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,oBAAoB,EACpB,kBAAkB,GAKnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,yBAAyB,GAE1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,0BAA0B,EAAqD,MAAM,0BAA0B,CAAC;AAQzH,MAAM,UAAU,iCAAiC,CAC/C,IAAmB,EACnB,KAA4B,EAC5B,UAAuC,EAAE;IAEzC,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE;QACxD,aAAa,EAAE,OAAO,CAAC,aAAa;KACrC,CAAC,CAAC;IAEH,MAAM,gBAAgB,GAAG,yBAAyB,CAChD,iBAAiB,EACjB,OAAO,CAAC,MAAM,CACf,CAAC;IAEF,MAAM,SAAS,GAAuB,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;QAC3E,MAAM,QAAQ,GAAmB;YAC/B;gBACE,GAAG,EAAE,0BAA0B;gBAC/B,KAAK,EAAE,MAAM,CAAC,cAAc,CAAC,SAAS;gBACtC,OAAO,EAAE,IAAI;gBACb,WAAW,EAAE,kDAAkD;aAChE;SACF,CAAC;QAEF,mDAAmD;QACnD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClE,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBAC1C,QAAQ,CAAC,IAAI,CAAC;wBACZ,GAAG,EAAE,SAAS,GAAG,EAAE;wBACnB,KAAK;wBACL,OAAO,EAAE,IAAI;wBACb,WAAW,EAAE,mBAAmB,GAAG,EAAE;qBACtC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,gBAAgB,GAAG,8BAA8B,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAEnF,OAAO;YACL,MAAM,EAAE,yBAAyB,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,cAAc,CAAC;YAC1E,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,QAAQ;YACR,eAAe,EAAE,MAAM,CAAC,cAAc,CAAC,IAAI,KAAK,kBAAkB,CAAC,YAAY;gBAC7E,CAAC,CAAC;oBACE;wBACE,GAAG,EAAE,oBAAoB;wBACzB,WAAW,EAAE,yEAAyE;wBACtF,MAAM,EAAE,iBAAiB;qBAC1B;iBACF;gBACH,CAAC,CAAC,EAAE;YACN,gBAAgB,EAAE,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACpD,QAAQ,EAAE,MAAM,CAAC,gBAAgB;gBACjC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;YACH,gBAAgB;SACjB,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,gDAAgD;IAChD,MAAM,cAAc,GAAG,KAAK,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC;IAExD,8CAA8C;IAC9C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAgC,CAAC;IACzD,KAAK,MAAM,MAAM,IAAI,iBAAiB,CAAC,OAAO,EAAE,CAAC;QAC/C,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;IAC/D,CAAC;IAED,4BAA4B;IAC5B,MAAM,eAAe,GAAG,cAAc,CAAC,CAAC,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrF,MAAM,kBAAkB,GAAG,uBAAuB,CAChD,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAC9C,eAAe,EACf,QAAQ,EACR,cAAc,CACf,CAAC;IACF,MAAM,gBAAgB,GAAG,sBAAsB,CAAC,kBAAkB,EAAE,mBAAmB,CAAC,CAAC;IAEzF,0EAA0E;IAC1E,MAAM,oBAAoB,GAAG,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;IAEvE,qDAAqD;IACrD,IAAI,mBAAmB,GAAG,sBAAsB,CAC9C,iBAAiB,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAC/D,CAAC;IAEF,oDAAoD;IACpD,IAAI,oBAAoB,KAAK,IAAI,IAAI,oBAAoB,GAAG,mBAAmB,CAAC,IAAI,EAAE,CAAC;QACrF,MAAM,iBAAiB,GAAG,gBAAgB;aACvC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;aACvB,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,mBAAmB,GAAG;YACpB,IAAI,EAAE,oBAAoB;YAC1B,KAAK,EAAE,oBAAoB,CAAC,oBAAoB,CAAC;YACjD,SAAS,EAAE,0BAA0B,iBAAiB,EAAE;SACzD,CAAC;IACJ,CAAC;IAED,wDAAwD;IACxD,MAAM,uBAAuB,GAA6B,EAAE,CAAC;IAC7D,MAAM,oBAAoB,GAA0B,EAAE,CAAC;IACvD,IAAI,2BAA+D,CAAC;IAEpE,KAAK,MAAM,MAAM,IAAI,iBAAiB,CAAC,OAAO,EAAE,CAAC;QAC/C,oDAAoD;QACpD,IAAI,MAAM,CAAC,cAAc,CAAC,uBAAuB,EAAE,CAAC;YAClD,uBAAuB,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,cAAc,CAAC,uBAAuB,CAAC,CAAC;QACjF,CAAC;QACD,kFAAkF;aAC7E,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,MAAM,MAAM,GAAG,0BAA0B,CACvC,MAAM,CAAC,QAAQ,CAAC,IAAI,EACpB,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,EAC5B;gBACE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO;aACjC,CACF,CAAC;YAEF,6DAA6D;YAC7D,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAExC,gDAAgD;YAChD,IAAI,MAAM,CAAC,MAAM,KAAK,uBAAuB,EAAE,CAAC;gBAC9C,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;oBAC5C,uBAAuB,CAAC,IAAI,CAAC;wBAC3B,GAAG,UAAU;wBACb,gDAAgD;wBAChD,WAAW,EAAE,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,IAAI,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,WAAW,EAAE;qBAC1H,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,4EAA4E;YAC5E,IAAI,CAAC,2BAA2B,EAAE,CAAC;gBACjC,2BAA2B,GAAG;oBAC5B,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,MAAM,EAAE,MAAM,CAAC,YAAY;oBAC3B,mBAAmB,EAAE;wBACnB,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC,QAAQ;wBACxC,UAAU,EAAE,MAAM,CAAC,cAAc,CAAC,UAAU;wBAC5C,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC,MAAM;wBACpC,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,SAAS;qBAC3C;iBACF,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,6FAA6F;gBAC7F,MAAM,cAAc,GAA2B;oBAC7C,gBAAgB,EAAE,CAAC;oBACnB,0BAA0B,EAAE,CAAC;oBAC7B,uBAAuB,EAAE,CAAC;oBAC1B,cAAc,EAAE,CAAC;iBAClB,CAAC;gBACF,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,2BAA2B,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;oBACrG,2BAA2B,GAAG;wBAC5B,MAAM,EAAE,MAAM,CAAC,MAAM;wBACrB,MAAM,EAAE,MAAM,CAAC,YAAY;wBAC3B,mBAAmB,EAAE;4BACnB,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC,QAAQ;4BACxC,UAAU,EAAE,MAAM,CAAC,cAAc,CAAC,UAAU;4BAC5C,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC,MAAM;4BACpC,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,SAAS;yBAC3C;qBACF,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,qFAAqF;IACrF,MAAM,+BAA+B,GAAG,oBAAoB,KAAK,kBAAkB,CAAC,aAAa,CAAC;IAClG,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,OAAO,CAAC,gBAAgB,IAAI,+BAA+B,CAAC;IAEvG,0DAA0D;IAC1D,MAAM,qBAAqB,GAAG,+BAA+B;QAC3D,CAAC,CAAC,yBAAyB,CACvB,EAAE,GAAG,iBAAiB,EAAE,OAAO,EAAE,EAAE,GAAG,iBAAiB,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,EAC3F,OAAO,CAAC,MAAM,CACf;QACH,CAAC,CAAC,gBAAgB,CAAC;IAErB,MAAM,MAAM,GAAsB;QAChC,SAAS;QACT,OAAO,EAAE;YACP,cAAc,EAAE,SAAS,CAAC,MAAM;YAChC,mBAAmB;YACnB,WAAW,EAAE,mBAAmB,CAAC,IAAI,KAAK,kBAAkB,CAAC,YAAY;YACzE,gBAAgB;YAChB,qBAAqB,EAAE,iBAAiB,CAAC,OAAO,CAAC,kBAAkB;SACpE;QACD,cAAc,EAAE,qBAAqB,CAAC,QAAQ;QAC9C,gBAAgB,EAAE,+BAA+B;YAC/C,CAAC,CAAC,GAAG,qBAAqB,CAAC,MAAM,+BAA+B;YAChE,CAAC,CAAC,qBAAqB,CAAC,MAAM;QAChC,mEAAmE;QACnE,gBAAgB;KACjB,CAAC;IAEF,mCAAmC;IACnC,IAAI,uBAAuB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,2BAA2B,GAAG,IAAI,CAAC;QAC1C,MAAM,CAAC,uBAAuB,GAAG,uBAAuB,CAAC;IAC3D,CAAC;IAED,iEAAiE;IACjE,IAAI,2BAA2B,EAAE,CAAC;QAChC,MAAM,CAAC,2BAA2B,GAAG,IAAI,CAAC;QAC1C,MAAM,CAAC,kBAAkB,GAAG,2BAA2B,CAAC;IAC1D,CAAC;SAAM,IAAI,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACtF,sEAAsE;QACtE,MAAM,CAAC,2BAA2B,GAAG,IAAI,CAAC;QAC1C,MAAM,CAAC,kBAAkB,GAAG;YAC1B,MAAM,EAAE,uBAAuB;YAC/B,MAAM,EAAE,qDAAqD;SAC9D,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,sBAAsB,CAAC,OAA+B;IAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,IAAI,EAAE,kBAAkB,CAAC,UAAU;YACnC,KAAK,EAAE,oBAAoB,CAAC,kBAAkB,CAAC,UAAU,CAAC;YAC1D,SAAS,EAAE,uBAAuB;SACnC,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,CACvC,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAC5C,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,8BAA8B,CACrC,MAAsB,EACtB,QAAwB;IAExB,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC9C,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACnC,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,QAAQ,CAAC;IAEb,MAAM,YAAY,GAAG,uBAAuB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAEnE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,mDAAmD;QACnD,OAAO;YACL,YAAY;YACZ,MAAM;YACN,mBAAmB,EAAE,KAAK;YAC1B,YAAY,EAAE,EAAE;YAChB,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE;YAC3E,UAAU,EAAE,IAAI;YAChB,WAAW,EAAE,YAAY;SAC1B,CAAC;IACJ,CAAC;IAED,OAAO,qBAAqB,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;AAC7E,CAAC"}

+1

-1

package.json

		{
		"name": "recourse-cli",
		"version": "0.1.35",
		"version": "0.1.36",
		"mcpName": "io.github.recourseOS/recourse",
		@@ -5,0 +5,0 @@ "description": "MCP server for AI agents to evaluate consequences before destructive actions. Analyzes Terraform plans, shell commands, and MCP tool calls.",

+1

-0

README.md

		@@ -68,2 +68,3 @@ <p align="center">
		- evidence: what was found, what's missing, what's needed for confident classification
		- crossActionRisks: dangerous patterns where individual actions are safe but their combination is unrecoverable (e.g., deleting a backup + the database it backs up)

		@@ -70,0 +71,0 @@ The engine emits facts. Callers interpret them in context — a `block` assessment in staging might be acceptable; in production it might require approval.

recourse-cli - npm Package Compare versions

New alerts

Fixed alerts

Improved metrics