@haibun/core 3.6.0 → 3.7.0

package/build/run-policy/run-policy-schema.d.ts

@@ -0,0 +1,76 @@
+import { z } from 'zod';
+import { type TRunPolicyConfig } from './run-policy-types.js';
+/**
+ * Validates the policy file structure itself.
+ * The structure mirrors TRunPolicyConfig (env + dirFilters array).
+ */
+declare const PolicyFileSchema: z.ZodObject<{
+    type: z.ZodDefault<z.ZodLiteral<"object">>;
+    properties: z.ZodObject<{
+        env: z.ZodObject<{
+            type: z.ZodDefault<z.ZodLiteral<"string">>;
+            enum: z.ZodArray<z.ZodString>;
+        }, z.core.$loose>;
+        dirFilters: z.ZodObject<{
+            type: z.ZodDefault<z.ZodLiteral<"array">>;
+            items: z.ZodObject<{
+                type: z.ZodDefault<z.ZodLiteral<"object">>;
+                properties: z.ZodObject<{
+                    dir: z.ZodObject<{
+                        type: z.ZodDefault<z.ZodLiteral<"string">>;
+                        enum: z.ZodArray<z.ZodString>;
+                    }, z.core.$loose>;
+                    access: z.ZodOptional<z.ZodObject<{
+                        type: z.ZodDefault<z.ZodLiteral<"string">>;
+                        enum: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            r: "r";
+                            a: "a";
+                            w: "w";
+                        }>>>;
+                    }, z.core.$loose>>;
+                }, z.core.$loose>;
+                required: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            }, z.core.$loose>;
+        }, z.core.$loose>;
+    }, z.core.$loose>;
+    deny: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        env: z.ZodOptional<z.ZodString>;
+        dir: z.ZodOptional<z.ZodString>;
+        access: z.ZodOptional<z.ZodEnum<{
+            r: "r";
+            a: "a";
+            w: "w";
+        }>>;
+    }, z.core.$strip>>>;
+}, z.core.$loose>;
+export type TRunPolicy = z.infer<typeof PolicyFileSchema>;
+/**
+ * Build a Zod validator for the entire TRunPolicyConfig based on the policy.
+ * This validator checks the whole config object at once ("wholesale validation").
+ */
+export declare function buildConfigValidator(policy: TRunPolicy): z.ZodObject<{
+    env: z.ZodEnum<{
+        [x: string]: string;
+    }>;
+    dirFilters: z.ZodArray<z.ZodObject<{
+        dir: z.ZodEnum<{
+            [x: string]: string;
+        }>;
+        access: z.ZodEnum<{
+            r: "r";
+            a: "a";
+            w: "w";
+        }>;
+    }, z.core.$strip>>;
+}, z.core.$loose>;
+/** Load and parse a policy file */
+export declare function loadRunPolicy(schemaPath: string): TRunPolicy;
+/**
+ * Validate a runtime config against a loaded policy.
+ * Uses the generated Zod validator to check the config wholesale.
+ */
+export declare function validateRunPolicyConfig(config: TRunPolicyConfig, policy: TRunPolicy, schemaPath: string): string[];
+/** Load policy, validate config, throw on failure. */
+export declare function loadAndValidateRunPolicy(config: TRunPolicyConfig, schemaPath: string): TRunPolicy;
+export {};
+//# sourceMappingURL=run-policy-schema.d.ts.map

package/build/run-policy/run-policy-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-policy-schema.d.ts","sourceRoot":"","sources":["../../src/run-policy/run-policy-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAiB,KAAK,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAY7E;;;GAGG;AACH,QAAA,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0BN,CAAC;AAEjB,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAM1D;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,UAAU;;;;;;;;;;;;;;kBAkCtD;AAED,mCAAmC;AACnC,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,CAQ5D;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAkBlH;AAED,sDAAsD;AACtD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,CAQjG"}

package/build/run-policy/run-policy-schema.js

@@ -0,0 +1,124 @@
+import { z } from 'zod';
+import { readFileSync } from 'fs';
+import { ACCESS_LEVELS } from './run-policy-types.js';
+// ============================================================================
+// Policy File Schema — Hierarchical JSON Schema
+// ============================================================================
+const DenyRuleSchema = z.object({
+    env: z.string().optional(),
+    dir: z.string().optional(),
+    access: z.enum(ACCESS_LEVELS).optional(),
+});
+/**
+ * Validates the policy file structure itself.
+ * The structure mirrors TRunPolicyConfig (env + dirFilters array).
+ */
+const PolicyFileSchema = z.object({
+    type: z.literal('object').default('object'),
+    properties: z.object({
+        env: z.object({
+            type: z.literal('string').default('string'),
+            enum: z.array(z.string()).min(1, 'At least one environment required'),
+        }).passthrough(),
+        dirFilters: z.object({
+            type: z.literal('array').default('array'),
+            items: z.object({
+                type: z.literal('object').default('object'),
+                properties: z.object({
+                    dir: z.object({
+                        type: z.literal('string').default('string'),
+                        enum: z.array(z.string()).min(1, 'At least one directory required'),
+                    }).passthrough(),
+                    access: z.object({
+                        type: z.literal('string').default('string'),
+                        enum: z.array(z.enum(ACCESS_LEVELS)).optional(),
+                    }).passthrough().optional()
+                }).passthrough(),
+                required: z.array(z.string()).optional()
+            }).passthrough()
+        }).passthrough()
+    }).passthrough(),
+    deny: z.array(DenyRuleSchema).default([]),
+}).passthrough();
+// ============================================================================
+// Validation — Hierarchical Object Validation
+// ============================================================================
+/**
+ * Build a Zod validator for the entire TRunPolicyConfig based on the policy.
+ * This validator checks the whole config object at once ("wholesale validation").
+ */
+export function buildConfigValidator(policy) {
+    const validEnvs = policy.properties.env.enum;
+    const validDirs = policy.properties.dirFilters.items.properties.dir.enum;
+    const ConfigValidator = z.object({
+        env: z.enum(validEnvs),
+        dirFilters: z.array(z.object({
+            dir: z.enum(validDirs),
+            access: z.enum(ACCESS_LEVELS),
+        })),
+    }).passthrough();
+    // Apply deny rules via superRefine on the whole object
+    return ConfigValidator.superRefine((data, ctx) => {
+        if (!data.dirFilters)
+            return;
+        data.dirFilters.forEach((filter, index) => {
+            const flat = { env: data.env, dir: filter.dir, access: filter.access };
+            for (const rule of policy.deny) {
+                const match = (!rule.env || rule.env === flat.env)
+                    && (!rule.dir || rule.dir === flat.dir)
+                    && (!rule.access || rule.access === flat.access);
+                if (match) {
+                    ctx.addIssue({
+                        code: 'custom',
+                        path: ['dirFilters', index],
+                        message: `Denied by policy: ${JSON.stringify(rule)}`,
+                    });
+                }
+            }
+        });
+    });
+}
+/** Load and parse a policy file */
+export function loadRunPolicy(schemaPath) {
+    let raw;
+    try {
+        raw = readFileSync(schemaPath, 'utf-8');
+    }
+    catch (err) {
+        throw new Error(`Cannot read run policy "${schemaPath}": ${err.message}`);
+    }
+    return PolicyFileSchema.parse(JSON.parse(raw));
+}
+/**
+ * Validate a runtime config against a loaded policy.
+ * Uses the generated Zod validator to check the config wholesale.
+ */
+export function validateRunPolicyConfig(config, policy, schemaPath) {
+    const validator = buildConfigValidator(policy);
+    const objectToValidate = { $schema: schemaPath, ...config };
+    const result = validator.safeParse(objectToValidate);
+    if (!result.success) {
+        return result.error.issues.map((issue) => {
+            if (issue.path[0] === 'dirFilters' && typeof issue.path[1] === 'number') {
+                const idx = issue.path[1];
+                const f = config.dirFilters[idx];
+                const filterStr = f ? `${f.dir}:${f.access}` : 'unknown';
+                const reason = issue.message.replace(/Expected .*, received/, 'Invalid').replace(/'/g, '"');
+                return `Filter "${filterStr}" in "${config.env}": ${reason}`;
+            }
+            return issue.message;
+        });
+    }
+    return [];
+}
+/** Load policy, validate config, throw on failure. */
+export function loadAndValidateRunPolicy(config, schemaPath) {
+    const policy = loadRunPolicy(schemaPath);
+    const errors = validateRunPolicyConfig(config, policy, schemaPath);
+    if (errors.length > 0) {
+        const jsonContext = JSON.stringify({ $schema: schemaPath, ...config }, null, 2);
+        throw new Error(`Run policy validation failed:\n${jsonContext}\n\nErrors:\n${errors.map((e) => `  • ${e}`).join('\n')}`);
+    }
+    return policy;
+}
+//# sourceMappingURL=run-policy-schema.js.map

package/build/run-policy/run-policy-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-policy-schema.js","sourceRoot":"","sources":["../../src/run-policy/run-policy-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,aAAa,EAAyB,MAAM,uBAAuB,CAAC;AAE7E,+EAA+E;AAC/E,gDAAgD;AAChD,+EAA+E;AAE/E,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC;YACZ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;YAC3C,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,mCAAmC,CAAC;SACtE,CAAC,CAAC,WAAW,EAAE;QAChB,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;YACnB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;YACzC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;gBACd,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;oBACnB,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC;wBACZ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;wBAC3C,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,iCAAiC,CAAC;qBACpE,CAAC,CAAC,WAAW,EAAE;oBAChB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;wBACf,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;wBAC3C,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;iBAC5B,CAAC,CAAC,WAAW,EAAE;gBAChB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;aACzC,CAAC,CAAC,WAAW,EAAE;SACjB,CAAC,CAAC,WAAW,EAAE;KACjB,CAAC,CAAC,WAAW,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC1C,CAAC,CAAC,WAAW,EAAE,CAAC;AAIjB,+EAA+E;AAC/E,8CAA8C;AAC9C,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAkB;IACrD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAA6B,CAAC;IACtE,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAA6B,CAAC;IAElG,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;QAC/B,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;QACtB,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;YAC3B,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;YACtB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;SAC9B,CAAC,CAAC;KACJ,CAAC,CAAC,WAAW,EAAE,CAAC;IAEjB,uDAAuD;IACvD,OAAO,eAAe,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC/C,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,OAAO;QAE7B,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;YACxC,MAAM,IAAI,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;YAEvE,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC/B,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC;uBAC7C,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC;uBACpC,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC;gBAEnD,IAAI,KAAK,EAAE,CAAC;oBACV,GAAG,CAAC,QAAQ,CAAC;wBACX,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;wBAC3B,OAAO,EAAE,qBAAqB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;qBACrD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,mCAAmC;AACnC,MAAM,UAAU,aAAa,CAAC,UAAkB;IAC9C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,UAAU,MAAO,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAwB,EAAE,MAAkB,EAAE,UAAkB;IACtG,MAAM,SAAS,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,gBAAgB,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,EAAE,CAAC;IAC5D,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAErD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACvC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,YAAY,IAAI,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACxE,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC1B,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;gBACjC,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;gBACzD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,uBAAuB,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBAC5F,OAAO,WAAW,SAAS,SAAS,MAAM,CAAC,GAAG,MAAM,MAAM,EAAE,CAAC;YAC/D,CAAC;YACD,OAAO,KAAK,CAAC,OAAO,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,wBAAwB,CAAC,MAAwB,EAAE,UAAkB;IACnF,MAAM,MAAM,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,uBAAuB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IACnE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,kCAAkC,WAAW,gBAAgB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3H,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/build/run-policy/run-policy-types.d.ts

@@ -0,0 +1,58 @@
+import { z } from 'zod';
+/** CLI option name for run-policy */
+export declare const OPTION_RUN_POLICY = "--run-policy";
+/** CLI option for dry-run mode (preview which features pass/fail the run policy) */
+export declare const OPTION_DRY_RUN = "--dry-run";
+/** Environment variable for run-policy (format: "env dir:access[,dir:access]") */
+export declare const HAIBUN_RUN_POLICY = "HAIBUN_RUN_POLICY";
+/** Valid access levels, forming a strict hierarchy: r ⊂ a ⊂ w */
+export declare const ACCESS_LEVELS: readonly ["r", "a", "w"];
+/** Feature filename prefixes corresponding to access levels */
+export declare const ACCESS_PREFIXES: readonly ["r_", "a_", "w_"];
+export declare const AccessLevelSchema: z.ZodEnum<{
+    r: "r";
+    a: "a";
+    w: "w";
+}>;
+export type AccessLevel = z.infer<typeof AccessLevelSchema>;
+export type TDirFilter = {
+    dir: string;
+    access: string;
+};
+export type TRunPolicyConfig = {
+    env: string;
+    dirFilters: TDirFilter[];
+};
+/** Parses "smoke:r" → { dir: "smoke", access: "r" } */
+export declare const DirFilterSchema: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<{
+    dir: string;
+    access: string;
+}, string>>, z.ZodObject<{
+    dir: z.ZodString;
+    access: z.ZodString;
+}, z.core.$strip>>;
+/** Parse dir:access[,dir:access] string */
+export declare function parseDirFilters(input: string): TDirFilter[];
+export declare const RunPolicyConfigSchema: z.ZodPipe<z.ZodObject<{
+    env: z.ZodString;
+    dirAccessStr: z.ZodString;
+}, z.core.$strip>, z.ZodTransform<TRunPolicyConfig, {
+    env: string;
+    dirAccessStr: string;
+}>>;
+/** Parse --run-policy arguments: env dir:access[,dir:access] */
+export declare function parseRunPolicyArgs(env: string, dirAccessStr: string): TRunPolicyConfig;
+/** Parse HAIBUN_RUN_POLICY env var: "env dir:access[,dir:access]" */
+export declare function parseRunPolicyEnv(envVar: string): TRunPolicyConfig;
+/** Numeric rank for hierarchy comparison: r=0, a=1, w=2 */
+export declare function accessRank(level: string): number;
+/** Check if granted level includes required level (w ⊃ a ⊃ r) */
+export declare function accessLevelIncludes(granted: string, required: string): boolean;
+/** Extract access prefix from feature filename, or undefined if unrecognized */
+export declare function getFeatureAccessPrefix(filename: string): AccessLevel | undefined;
+/**
+ * Determine if a feature file should run given the active dir filters.
+ * Exclusive: only features with a recognized prefix in a listed directory pass.
+ */
+export declare function featureMatchesFilter(featurePath: string, dirFilters: TDirFilter[]): boolean;
+//# sourceMappingURL=run-policy-types.d.ts.map

package/build/run-policy/run-policy-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-policy-types.d.ts","sourceRoot":"","sources":["../../src/run-policy/run-policy-types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,qCAAqC;AACrC,eAAO,MAAM,iBAAiB,iBAAiB,CAAC;AAEhD,oFAAoF;AACpF,eAAO,MAAM,cAAc,cAAc,CAAC;AAE1C,kFAAkF;AAClF,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AAErD,iEAAiE;AACjE,eAAO,MAAM,aAAa,0BAA2B,CAAC;AAEtD,+DAA+D;AAC/D,eAAO,MAAM,eAAe,6BAA8B,CAAC;AAQ3D,eAAO,MAAM,iBAAiB;;;;EAAwB,CAAC;AACvD,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,MAAM,MAAM,UAAU,GAAG;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,UAAU,EAAE,CAAC;CAC1B,CAAC;AAEF,uDAAuD;AACvD,eAAO,MAAM,eAAe;;;;;;kBASiD,CAAC;AAE9E,2CAA2C;AAC3C,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,EAAE,CAE3D;AAED,eAAO,MAAM,qBAAqB;;;;;;GAMhC,CAAC;AAMH,gEAAgE;AAChE,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,gBAAgB,CAUtF;AAED,qEAAqE;AACrE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,gBAAgB,CAMlE;AAMD,2DAA2D;AAC3D,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,iEAAiE;AACjE,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE9E;AAED,gFAAgF;AAChF,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAGhF;AAMD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,OAAO,CAY3F"}

package/build/run-policy/run-policy-types.js

@@ -0,0 +1,102 @@
+import { z } from 'zod';
+// ============================================================================
+// Constants
+// ============================================================================
+/** CLI option name for run-policy */
+export const OPTION_RUN_POLICY = '--run-policy';
+/** CLI option for dry-run mode (preview which features pass/fail the run policy) */
+export const OPTION_DRY_RUN = '--dry-run';
+/** Environment variable for run-policy (format: "env dir:access[,dir:access]") */
+export const HAIBUN_RUN_POLICY = 'HAIBUN_RUN_POLICY';
+/** Valid access levels, forming a strict hierarchy: r ⊂ a ⊂ w */
+export const ACCESS_LEVELS = ['r', 'a', 'w'];
+/** Feature filename prefixes corresponding to access levels */
+export const ACCESS_PREFIXES = ['r_', 'a_', 'w_'];
+// ============================================================================
+// Zod Schemas — types are inferred, parsing via transforms
+// ============================================================================
+// Basic types
+const InputAccessLevelSchema = z.string();
+export const AccessLevelSchema = z.enum(ACCESS_LEVELS);
+/** Parses "smoke:r" → { dir: "smoke", access: "r" } */
+export const DirFilterSchema = z.string()
+    .transform((val, ctx) => {
+    const parts = val.split(':');
+    if (parts.length !== 2) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message: `Invalid filter format "${val}". Expected "dir:access"` });
+        return z.NEVER;
+    }
+    return { dir: parts[0], access: parts[1] };
+})
+    .pipe(z.object({ dir: z.string().min(1), access: InputAccessLevelSchema }));
+/** Parse dir:access[,dir:access] string */
+export function parseDirFilters(input) {
+    return input.split(',').map(s => DirFilterSchema.parse(s));
+}
+export const RunPolicyConfigSchema = z.object({
+    env: z.string().min(1),
+    dirAccessStr: z.string(),
+}).transform((data) => {
+    const dirFilters = parseDirFilters(data.dirAccessStr);
+    return { env: data.env, dirFilters };
+});
+// ============================================================================
+// Parsing — thin wrappers delegating to Zod
+// ============================================================================
+/** Parse --run-policy arguments: env dir:access[,dir:access] */
+export function parseRunPolicyArgs(env, dirAccessStr) {
+    try {
+        return RunPolicyConfigSchema.parse({ env, dirAccessStr });
+    }
+    catch (e) {
+        if (e instanceof z.ZodError) {
+            const detail = e.issues.map((i) => `  • ${i.path.join('.')}: ${i.message}`).join('\n');
+            throw new Error(`Run policy configuration failed:\n${detail}`);
+        }
+        throw e;
+    }
+}
+/** Parse HAIBUN_RUN_POLICY env var: "env dir:access[,dir:access]" */
+export function parseRunPolicyEnv(envVar) {
+    const parts = envVar.trim().split(/\s+/);
+    if (parts.length !== 2) {
+        throw new Error(`Invalid format. Expected "env dir:access"`);
+    }
+    return parseRunPolicyArgs(parts[0], parts[1]);
+}
+// ============================================================================
+// Access Level Logic — minimal procedural (pure domain logic)
+// ============================================================================
+/** Numeric rank for hierarchy comparison: r=0, a=1, w=2 */
+export function accessRank(level) {
+    return ACCESS_LEVELS.indexOf(level);
+}
+/** Check if granted level includes required level (w ⊃ a ⊃ r) */
+export function accessLevelIncludes(granted, required) {
+    return accessRank(granted) >= accessRank(required);
+}
+/** Extract access prefix from feature filename, or undefined if unrecognized */
+export function getFeatureAccessPrefix(filename) {
+    const result = AccessLevelSchema.safeParse(filename.charAt(0));
+    return result.success && filename.charAt(1) === '_' ? result.data : undefined;
+}
+// ============================================================================
+// Feature Matching — runtime matching (must be procedural)
+// ============================================================================
+/**
+ * Determine if a feature file should run given the active dir filters.
+ * Exclusive: only features with a recognized prefix in a listed directory pass.
+ */
+export function featureMatchesFilter(featurePath, dirFilters) {
+    const parts = featurePath.replace(/^\//, '').split('/');
+    const filename = parts[parts.length - 1];
+    const featureDir = parts.length > 1 ? parts[0] : undefined;
+    const requiredAccess = getFeatureAccessPrefix(filename);
+    if (!requiredAccess)
+        return false;
+    const matchingFilter = dirFilters.find((f) => f.dir === featureDir);
+    if (!matchingFilter)
+        return false;
+    return accessLevelIncludes(matchingFilter.access, requiredAccess);
+}
+//# sourceMappingURL=run-policy-types.js.map

package/build/run-policy/run-policy-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-policy-types.js","sourceRoot":"","sources":["../../src/run-policy/run-policy-types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E,qCAAqC;AACrC,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAEhD,oFAAoF;AACpF,MAAM,CAAC,MAAM,cAAc,GAAG,WAAW,CAAC;AAE1C,kFAAkF;AAClF,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAErD,iEAAiE;AACjE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAU,CAAC;AAEtD,+DAA+D;AAC/D,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAU,CAAC;AAE3D,+EAA+E;AAC/E,2DAA2D;AAC3D,+EAA+E;AAE/E,cAAc;AACd,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;AAC1C,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AAavD,uDAAuD;AACvD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,EAAE;KACtC,SAAS,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACtB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,0BAA0B,GAAG,0BAA0B,EAAE,CAAC,CAAC;QAChH,OAAO,CAAC,CAAC,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7C,CAAC,CAAC;KACD,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAC;AAE9E,2CAA2C;AAC3C,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;CACzB,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,EAAoB,EAAE;IACtC,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACtD,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC;AACvC,CAAC,CAAC,CAAC;AAEH,+EAA+E;AAC/E,4CAA4C;AAC5C,+EAA+E;AAE/E,gEAAgE;AAChE,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,YAAoB;IAClE,IAAI,CAAC;QACH,OAAO,qBAAqB,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvF,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,+EAA+E;AAC/E,8DAA8D;AAC9D,+EAA+E;AAE/E,2DAA2D;AAC3D,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,aAAa,CAAC,OAAO,CAAC,KAAoB,CAAC,CAAC;AACrD,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,mBAAmB,CAAC,OAAe,EAAE,QAAgB;IACnE,OAAO,UAAU,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC;AACrD,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,sBAAsB,CAAC,QAAgB;IACrD,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/D,OAAO,MAAM,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAChF,CAAC;AAED,+EAA+E;AAC/E,2DAA2D;AAC3D,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAmB,EAAE,UAAwB;IAChF,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE3D,MAAM,cAAc,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,CAAC,cAAc;QAAE,OAAO,KAAK,CAAC;IAElC,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC;IACpE,IAAI,CAAC,cAAc;QAAE,OAAO,KAAK,CAAC;IAElC,OAAO,mBAAmB,CAAC,cAAc,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AACpE,CAAC"}

package/build/runfilter/filter-schema.d.ts

@@ -0,0 +1,76 @@
+import { z } from 'zod';
+import { type TFilterConfig } from './filter-types.js';
+/**
+ * Validates the policy file structure itself.
+ * The structure now mimics TFilterConfig (env + dirFilters array).
+ */
+declare const PolicyFileSchema: z.ZodObject<{
+    type: z.ZodDefault<z.ZodLiteral<"object">>;
+    properties: z.ZodObject<{
+        env: z.ZodObject<{
+            type: z.ZodDefault<z.ZodLiteral<"string">>;
+            enum: z.ZodArray<z.ZodString>;
+        }, z.core.$loose>;
+        dirFilters: z.ZodObject<{
+            type: z.ZodDefault<z.ZodLiteral<"array">>;
+            items: z.ZodObject<{
+                type: z.ZodDefault<z.ZodLiteral<"object">>;
+                properties: z.ZodObject<{
+                    dir: z.ZodObject<{
+                        type: z.ZodDefault<z.ZodLiteral<"string">>;
+                        enum: z.ZodArray<z.ZodString>;
+                    }, z.core.$loose>;
+                    access: z.ZodOptional<z.ZodObject<{
+                        type: z.ZodDefault<z.ZodLiteral<"string">>;
+                        enum: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+                            r: "r";
+                            a: "a";
+                            w: "w";
+                        }>>>;
+                    }, z.core.$loose>>;
+                }, z.core.$loose>;
+                required: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            }, z.core.$loose>;
+        }, z.core.$loose>;
+    }, z.core.$loose>;
+    deny: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        env: z.ZodOptional<z.ZodString>;
+        dir: z.ZodOptional<z.ZodString>;
+        access: z.ZodOptional<z.ZodEnum<{
+            r: "r";
+            a: "a";
+            w: "w";
+        }>>;
+    }, z.core.$strip>>>;
+}, z.core.$loose>;
+export type TFilterPolicy = z.infer<typeof PolicyFileSchema>;
+/**
+ * Build a Zod validator for the entire TFilterConfig based on the policy.
+ * This validator checks the whole config object at once ("wholesale validation").
+ */
+export declare function buildConfigValidator(policy: TFilterPolicy): z.ZodObject<{
+    env: z.ZodEnum<{
+        [x: string]: string;
+    }>;
+    dirFilters: z.ZodArray<z.ZodObject<{
+        dir: z.ZodEnum<{
+            [x: string]: string;
+        }>;
+        access: z.ZodEnum<{
+            r: "r";
+            a: "a";
+            w: "w";
+        }>;
+    }, z.core.$strip>>;
+}, z.core.$loose>;
+/** Load and parse a policy file */
+export declare function loadFilterPolicy(schemaPath: string): TFilterPolicy;
+/**
+ * Validate a runtime config against a loaded policy.
+ * Uses the generated Zod validator to check the config wholesale.
+ */
+export declare function validateFilterConfig(config: TFilterConfig, policy: TFilterPolicy, schemaPath: string): string[];
+/** Load schema, validate config, throw on failure. */
+export declare function loadAndValidateFilters(config: TFilterConfig, schemaPath: string): TFilterPolicy;
+export {};
+//# sourceMappingURL=filter-schema.d.ts.map

package/build/runfilter/filter-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"filter-schema.d.ts","sourceRoot":"","sources":["../../src/runfilter/filter-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAiB,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAYtE;;;GAGG;AACH,QAAA,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0BN,CAAC;AAEjB,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAM7D;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,aAAa;;;;;;;;;;;;;;kBAsCzD;AAED,mCAAmC;AACnC,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,aAAa,CAQlE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAmB/G;AAED,sDAAsD;AACtD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,GAAG,aAAa,CAQ/F"}

package/build/runfilter/filter-schema.js

@@ -0,0 +1,129 @@
+import { z } from 'zod';
+import { readFileSync } from 'fs';
+import { ACCESS_LEVELS } from './filter-types.js';
+// ============================================================================
+// Policy File Schema — Hierarchical JSON Schema
+// ============================================================================
+const DenyRuleSchema = z.object({
+    env: z.string().optional(),
+    dir: z.string().optional(),
+    access: z.enum(ACCESS_LEVELS).optional(),
+});
+/**
+ * Validates the policy file structure itself.
+ * The structure now mimics TFilterConfig (env + dirFilters array).
+ */
+const PolicyFileSchema = z.object({
+    type: z.literal('object').default('object'),
+    properties: z.object({
+        env: z.object({
+            type: z.literal('string').default('string'),
+            enum: z.array(z.string()).min(1, 'At least one environment required'),
+        }).passthrough(),
+        dirFilters: z.object({
+            type: z.literal('array').default('array'),
+            items: z.object({
+                type: z.literal('object').default('object'),
+                properties: z.object({
+                    dir: z.object({
+                        type: z.literal('string').default('string'),
+                        enum: z.array(z.string()).min(1, 'At least one directory required'),
+                    }).passthrough(),
+                    access: z.object({
+                        type: z.literal('string').default('string'),
+                        enum: z.array(z.enum(ACCESS_LEVELS)).optional(),
+                    }).passthrough().optional()
+                }).passthrough(),
+                required: z.array(z.string()).optional()
+            }).passthrough()
+        }).passthrough()
+    }).passthrough(),
+    deny: z.array(DenyRuleSchema).default([]),
+}).passthrough();
+// ============================================================================
+// Validation — Hierarchical Object Validation
+// ============================================================================
+/**
+ * Build a Zod validator for the entire TFilterConfig based on the policy.
+ * This validator checks the whole config object at once ("wholesale validation").
+ */
+export function buildConfigValidator(policy) {
+    const validEnvs = policy.properties.env.enum;
+    // Extract enums from nested structure: properties.dirFilters.items.properties.dir.enum
+    const validDirs = policy.properties.dirFilters.items.properties.dir.enum;
+    const ConfigValidator = z.object({
+        env: z.enum(validEnvs),
+        dirFilters: z.array(z.object({
+            dir: z.enum(validDirs),
+            access: z.enum(ACCESS_LEVELS),
+        })),
+        // Allow extra properties like schemaPath or $schema
+    }).passthrough();
+    // Apply deny rules via superRefine on the whole object
+    return ConfigValidator.superRefine((data, ctx) => {
+        // Check each directory filter against all deny rules
+        // data.dirFilters is available because ConfigValidator ensures it exists (or Zod parse fails before here)
+        if (!data.dirFilters)
+            return;
+        data.dirFilters.forEach((filter, index) => {
+            const flat = { env: data.env, dir: filter.dir, access: filter.access };
+            for (const rule of policy.deny) {
+                const match = (!rule.env || rule.env === flat.env)
+                    && (!rule.dir || rule.dir === flat.dir)
+                    && (!rule.access || rule.access === flat.access);
+                if (match) {
+                    ctx.addIssue({
+                        code: 'custom',
+                        path: ['dirFilters', index],
+                        message: `Denied by policy: ${JSON.stringify(rule)}`,
+                    });
+                }
+            }
+        });
+    });
+}
+/** Load and parse a policy file */
+export function loadFilterPolicy(schemaPath) {
+    let raw;
+    try {
+        raw = readFileSync(schemaPath, 'utf-8');
+    }
+    catch (err) {
+        throw new Error(`Cannot read filter schema "${schemaPath}": ${err.message}`);
+    }
+    return PolicyFileSchema.parse(JSON.parse(raw));
+}
+/**
+ * Validate a runtime config against a loaded policy.
+ * Uses the generated Zod validator to check the config wholesale.
+ */
+export function validateFilterConfig(config, policy, schemaPath) {
+    const validator = buildConfigValidator(policy);
+    const objectToValidate = { $schema: schemaPath, ...config };
+    const result = validator.safeParse(objectToValidate);
+    if (!result.success) {
+        return result.error.issues.map((issue) => {
+            // Improve error message context
+            if (issue.path[0] === 'dirFilters' && typeof issue.path[1] === 'number') {
+                const idx = issue.path[1];
+                const f = config.dirFilters[idx];
+                const filterStr = f ? `${f.dir}:${f.access}` : 'unknown';
+                const reason = issue.message.replace(/Expected .*, received/, 'Invalid').replace(/'/g, '"');
+                return `Filter "${filterStr}" in "${config.env}": ${reason}`;
+            }
+            return issue.message;
+        });
+    }
+    return [];
+}
+/** Load schema, validate config, throw on failure. */
+export function loadAndValidateFilters(config, schemaPath) {
+    const policy = loadFilterPolicy(schemaPath);
+    const errors = validateFilterConfig(config, policy, schemaPath);
+    if (errors.length > 0) {
+        const jsonContext = JSON.stringify({ $schema: schemaPath, ...config }, null, 2);
+        throw new Error(`Filter validation failed:\n${jsonContext}\n\nErrors:\n${errors.map((e) => `  • ${e}`).join('\n')}`);
+    }
+    return policy;
+}
+//# sourceMappingURL=filter-schema.js.map

package/build/runfilter/filter-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filter-schema.js","sourceRoot":"","sources":["../../src/runfilter/filter-schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,aAAa,EAAsB,MAAM,mBAAmB,CAAC;AAEtE,+EAA+E;AAC/E,gDAAgD;AAChD,+EAA+E;AAE/E,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC;YACZ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;YAC3C,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,mCAAmC,CAAC;SACtE,CAAC,CAAC,WAAW,EAAE;QAChB,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;YACnB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;YACzC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;gBACd,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;oBACnB,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC;wBACZ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;wBAC3C,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,iCAAiC,CAAC;qBACpE,CAAC,CAAC,WAAW,EAAE;oBAChB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;wBACf,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;wBAC3C,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE;qBAChD,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;iBAC5B,CAAC,CAAC,WAAW,EAAE;gBAChB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;aACzC,CAAC,CAAC,WAAW,EAAE;SACjB,CAAC,CAAC,WAAW,EAAE;KACjB,CAAC,CAAC,WAAW,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC1C,CAAC,CAAC,WAAW,EAAE,CAAC;AAIjB,+EAA+E;AAC/E,8CAA8C;AAC9C,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAqB;IACxD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAA6B,CAAC;IACtE,uFAAuF;IACvF,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAA6B,CAAC;IAElG,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;QAC/B,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;QACtB,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;YAC3B,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;YACtB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC;SAC9B,CAAC,CAAC;QACH,oDAAoD;KACrD,CAAC,CAAC,WAAW,EAAE,CAAC;IAEjB,uDAAuD;IACvD,OAAO,eAAe,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC/C,qDAAqD;QACrD,0GAA0G;QAC1G,IAAI,CAAC,IAAI,CAAC,UAAU;YAAE,OAAO;QAE7B,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;YACxC,MAAM,IAAI,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;YAEvE,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC/B,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC;uBAC7C,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,CAAC;uBACpC,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC;gBAEnD,IAAI,KAAK,EAAE,CAAC;oBACV,GAAG,CAAC,QAAQ,CAAC;wBACX,IAAI,EAAE,QAAQ;wBACd,IAAI,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC;wBAC3B,OAAO,EAAE,qBAAqB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;qBACrD,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,mCAAmC;AACnC,MAAM,UAAU,gBAAgB,CAAC,UAAkB;IACjD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,8BAA8B,UAAU,MAAO,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAqB,EAAE,MAAqB,EAAE,UAAkB;IACnG,MAAM,SAAS,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,gBAAgB,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,EAAE,CAAC;IAC5D,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAErD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YACvC,gCAAgC;YAChC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,YAAY,IAAI,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACxE,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC1B,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;gBACjC,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;gBACzD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,uBAAuB,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;gBAC5F,OAAO,WAAW,SAAS,SAAS,MAAM,CAAC,GAAG,MAAM,MAAM,EAAE,CAAC;YAC/D,CAAC;YACD,OAAO,KAAK,CAAC,OAAO,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,sBAAsB,CAAC,MAAqB,EAAE,UAAkB;IAC9E,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IAChE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,8BAA8B,WAAW,gBAAgB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}