@lannguyensi/harness 0.26.0 → 0.28.0

package/dist/runtime/when-eval.d.ts

@@ -0,0 +1,40 @@
+import type { PolicyWhen } from "../schema/index.js";
+import type { EnvironmentResolution } from "./environment-resolver.js";
+import type { RiskProfile } from "./risk-classifier.js";
+/** The enriched-envelope inputs a `when:` block is evaluated against. */
+export interface WhenContext {
+    risk: RiskProfile;
+    environment: EnvironmentResolution;
+}
+/** The four `when:` clause keys, exactly as they appear in the manifest. */
+export type WhenClauseKey = "risk.severity_at_least" | "risk.category_in" | "environment.name" | "action.reversible";
+/** One declared clause's verdict, carried for explainability. */
+export interface WhenClauseResult {
+    clause: WhenClauseKey;
+    /** Human-readable expected value, as written in the manifest. */
+    expected: string;
+    /** Human-readable observed value, from the enriched envelope. */
+    actual: string;
+    matched: boolean;
+}
+export interface WhenEvaluation {
+    /** AND of every declared clause. A `when:` with no clauses cannot be
+     *  constructed (the schema rejects `when: {}`), so an evaluated
+     *  `when:` always has at least one clause. */
+    matched: boolean;
+    /** One entry per DECLARED clause, in manifest-key order. */
+    clauses: WhenClauseResult[];
+    /** True when at least one clause matched only because the action was
+     *  unclassified ("unknown is not safe"). Surfaced so `explain-policy`
+     *  can tell an operator a match was fail-closed, not a real hit. */
+    unclassifiedFallback: boolean;
+}
+/**
+ * Evaluate a policy's `when:` block against the enriched envelope.
+ *
+ * Every clause is optional; only declared clauses are evaluated, and
+ * `matched` is their AND. An unclassified risk profile (`classified:
+ * false`) satisfies the three risk-derived clauses by the "unknown is
+ * not safe" rule; `environment.name` is always a plain equality test.
+ */
+export declare function evaluateWhen(when: PolicyWhen, ctx: WhenContext): WhenEvaluation;

package/dist/runtime/when-eval.js

@@ -0,0 +1,134 @@
+// Phase 7 #5 — `policy.when:` evaluator.
+//
+// A policy's `trigger:` decides WHICH tool calls it inspects; its
+// optional `when:` block decides whether — given the enriched Action
+// Envelope — the policy actually applies to this particular call. The
+// runtime ANDs the two: a policy fires only when `trigger:` AND every
+// declared `when:` clause hold.
+//
+// Pure: the risk profile (#3) + environment resolution (#4) come in, a
+// match verdict with a per-clause breakdown comes out, no I/O. The
+// breakdown is what `harness explain-policy` renders.
+//
+// "Unknown is not safe" — the load-bearing decision in this module.
+// The Risk Classifier emits `severity: null` / `reversible: null` /
+// `categories: []` for an action no pattern matched (`classified:
+// false`). A null does not silently fail to satisfy a clause: an
+// UNCLASSIFIED action satisfies every `risk.*` / `action.reversible`
+// clause, so a risk-gating policy treats "we could not classify this"
+// as risk-bearing rather than letting it slip the gate. A *classified*
+// action is compared on its real values. `environment.name` needs no
+// such rule: the resolver always returns a concrete environment, with
+// `unknown` as the matchable no-resolver-fired case.
+//
+// Design source: lava-ice-logs/2026-04-30/harness-risk-gate-extension.md
+// (design phase D); the null-handling steer is the Phase 7 #3 review
+// note on agent-tasks task harness-phase-7-5.
+import { RiskSeveritySchema } from "../schema/index.js";
+// Ordered severity scale; an index is the comparison key for
+// `severity_at_least`. Sourced from the schema enum so a reordering
+// there flows through unchanged — same pattern as the Risk Classifier.
+const SEVERITY_ORDER = RiskSeveritySchema.options;
+function severityIndex(severity) {
+    return SEVERITY_ORDER.indexOf(severity);
+}
+/**
+ * Evaluate a policy's `when:` block against the enriched envelope.
+ *
+ * Every clause is optional; only declared clauses are evaluated, and
+ * `matched` is their AND. An unclassified risk profile (`classified:
+ * false`) satisfies the three risk-derived clauses by the "unknown is
+ * not safe" rule; `environment.name` is always a plain equality test.
+ */
+export function evaluateWhen(when, ctx) {
+    const clauses = [];
+    let unclassifiedFallback = false;
+    const unclassified = !ctx.risk.classified;
+    const sevAtLeast = when["risk.severity_at_least"];
+    if (sevAtLeast !== undefined) {
+        let matched;
+        let actual;
+        if (unclassified) {
+            // severity is null — treat as risk-bearing: satisfies any threshold.
+            matched = true;
+            actual = "null (unclassified)";
+            unclassifiedFallback = true;
+        }
+        else {
+            matched =
+                severityIndex(ctx.risk.severity) >= severityIndex(sevAtLeast);
+            actual = ctx.risk.severity;
+        }
+        clauses.push({
+            clause: "risk.severity_at_least",
+            expected: `>= ${sevAtLeast}`,
+            actual,
+            matched,
+        });
+    }
+    const categoryIn = when["risk.category_in"];
+    if (categoryIn !== undefined) {
+        let matched;
+        let actual;
+        if (unclassified) {
+            // categories is [] — treat as risk-bearing, consistent with the
+            // severity clause: an unclassified action satisfies every risk
+            // clause so a multi-clause `when:` cannot be slipped by one
+            // clause matching null while another fails an empty set.
+            matched = true;
+            actual = "[] (unclassified)";
+            unclassifiedFallback = true;
+        }
+        else {
+            matched = categoryIn.some((c) => ctx.risk.categories.includes(c));
+            actual =
+                ctx.risk.categories.length > 0
+                    ? `[${ctx.risk.categories.join(", ")}]`
+                    : "[]";
+        }
+        clauses.push({
+            clause: "risk.category_in",
+            expected: `any of [${categoryIn.join(", ")}]`,
+            actual,
+            matched,
+        });
+    }
+    const envName = when["environment.name"];
+    if (envName !== undefined) {
+        clauses.push({
+            clause: "environment.name",
+            expected: envName,
+            actual: ctx.environment.name,
+            matched: ctx.environment.name === envName,
+        });
+    }
+    const reversible = when["action.reversible"];
+    if (reversible !== undefined) {
+        let matched;
+        let actual;
+        if (unclassified) {
+            // reversible is null — reversibility unknown. "Unknown is not
+            // safe": the clause matches whichever value the policy gates on,
+            // so an unclassified action never escapes a reversibility gate.
+            matched = true;
+            actual = "null (unclassified)";
+            unclassifiedFallback = true;
+        }
+        else {
+            matched = ctx.risk.reversible === reversible;
+            actual = String(ctx.risk.reversible);
+        }
+        clauses.push({
+            clause: "action.reversible",
+            expected: String(reversible),
+            actual,
+            matched,
+        });
+    }
+    return {
+        matched: clauses.every((c) => c.matched),
+        clauses,
+        unclassifiedFallback,
+    };
+}
+//# sourceMappingURL=when-eval.js.map

package/dist/runtime/when-eval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"when-eval.js","sourceRoot":"","sources":["../../src/runtime/when-eval.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,EAAE;AACF,kEAAkE;AAClE,qEAAqE;AACrE,sEAAsE;AACtE,sEAAsE;AACtE,gCAAgC;AAChC,EAAE;AACF,uEAAuE;AACvE,mEAAmE;AACnE,sDAAsD;AACtD,EAAE;AACF,oEAAoE;AACpE,oEAAoE;AACpE,kEAAkE;AAClE,iEAAiE;AACjE,qEAAqE;AACrE,sEAAsE;AACtE,uEAAuE;AACvE,qEAAqE;AACrE,sEAAsE;AACtE,qDAAqD;AACrD,EAAE;AACF,yEAAyE;AACzE,qEAAqE;AACrE,8CAA8C;AAG9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAIxD,6DAA6D;AAC7D,oEAAoE;AACpE,uEAAuE;AACvE,MAAM,cAAc,GAAsB,kBAAkB,CAAC,OAAO,CAAC;AAsCrE,SAAS,aAAa,CAAC,QAAgB;IACrC,OAAO,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAgB,EAChB,GAAgB;IAEhB,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,IAAI,oBAAoB,GAAG,KAAK,CAAC;IACjC,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC;IAE1C,MAAM,UAAU,GAAG,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAClD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,OAAgB,CAAC;QACrB,IAAI,MAAc,CAAC;QACnB,IAAI,YAAY,EAAE,CAAC;YACjB,qEAAqE;YACrE,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,GAAG,qBAAqB,CAAC;YAC/B,oBAAoB,GAAG,IAAI,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,OAAO;gBACL,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,QAAS,CAAC,IAAI,aAAa,CAAC,UAAU,CAAC,CAAC;YACjE,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,QAAS,CAAC;QAC9B,CAAC;QACD,OAAO,CAAC,IAAI,CAAC;YACX,MAAM,EAAE,wBAAwB;YAChC,QAAQ,EAAE,MAAM,UAAU,EAAE;YAC5B,MAAM;YACN,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC5C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,OAAgB,CAAC;QACrB,IAAI,MAAc,CAAC;QACnB,IAAI,YAAY,EAAE,CAAC;YACjB,gEAAgE;YAChE,+DAA+D;YAC/D,4DAA4D;YAC5D,yDAAyD;YACzD,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,GAAG,mBAAmB,CAAC;YAC7B,oBAAoB,GAAG,IAAI,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAClE,MAAM;gBACJ,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;oBAC5B,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;oBACvC,CAAC,CAAC,IAAI,CAAC;QACb,CAAC;QACD,OAAO,CAAC,IAAI,CAAC;YACX,MAAM,EAAE,kBAAkB;YAC1B,QAAQ,EAAE,WAAW,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;YAC7C,MAAM;YACN,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACzC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,CAAC,IAAI,CAAC;YACX,MAAM,EAAE,kBAAkB;YAC1B,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC,IAAI;YAC5B,OAAO,EAAE,GAAG,CAAC,WAAW,CAAC,IAAI,KAAK,OAAO;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC7C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,OAAgB,CAAC;QACrB,IAAI,MAAc,CAAC;QACnB,IAAI,YAAY,EAAE,CAAC;YACjB,8DAA8D;YAC9D,iEAAiE;YACjE,gEAAgE;YAChE,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,GAAG,qBAAqB,CAAC;YAC/B,oBAAoB,GAAG,IAAI,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,UAAU,CAAC;YAC7C,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC;YACX,MAAM,EAAE,mBAAmB;YAC3B,QAAQ,EAAE,MAAM,CAAC,UAAU,CAAC;YAC5B,MAAM;YACN,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QACxC,OAAO;QACP,oBAAoB;KACrB,CAAC;AACJ,CAAC"}

package/dist/schema/hooks.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { NUMERIC_VERSION_MESSAGE, NUMERIC_VERSION_PATTERN } from "../io/version-compare.js";
 export const HookEventSchema = z.enum([
     "SessionStart",
     "UserPromptSubmit",
@@ -31,7 +32,11 @@ export const HookSchema = z
     // `~/.claude/hooks/foo.sh`), so there is no useful default for
     // `version_command` and a min_version-without-command is treated as a
     // config error.
-    min_version: z.string().min(1).optional(),
+    min_version: z
+        .string()
+        .min(1)
+        .regex(NUMERIC_VERSION_PATTERN, NUMERIC_VERSION_MESSAGE)
+        .optional(),
     version_command: z.array(z.string().min(1)).min(1).optional(),
 })
     .strict()

package/dist/schema/hooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../../src/schema/hooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC;IACpC,cAAc;IACd,kBAAkB;IAClB,YAAY;IACZ,aAAa;IACb,MAAM;IACN,cAAc;IACd,YAAY;CACb,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC;IACxC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAChB,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACjB,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,eAAe;IACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,QAAQ,EAAE,kBAAkB;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACrD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,yEAAyE;IACzE,wEAAwE;IACxE,qEAAqE;IACrE,mDAAmD;IACnD,+DAA+D;IAC/D,sEAAsE;IACtE,gBAAgB;IAChB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC9D,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,eAAe,KAAK,SAAS,EACrE;IACE,OAAO,EAAE,sDAAsD;IAC/D,IAAI,EAAE,CAAC,iBAAiB,CAAC;CAC1B,CACF,CAAC;AAEJ,mEAAmE;AACnE,wEAAwE;AACxE,0EAA0E;AAC1E,wEAAwE;AACxE,uEAAuE;AACvE,EAAE;AACF,0EAA0E;AAC1E,yEAAyE;AACzE,sEAAsE;AACtE,MAAM,2BAA2B,GAA0B,CAAC,SAAS,CAAC,CAAC;AAEvE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IACxE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACrB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC;gBACjB,OAAO,EAAE,wBAAwB,CAAC,CAAC,IAAI,EAAE;aAC1C,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACjB,KAAK,MAAM,MAAM,IAAI,2BAA2B,EAAE,CAAC;YACjD,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9B,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;oBAC3B,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC;oBACjB,OAAO,EACL,cAAc,CAAC,CAAC,IAAI,2BAA2B,MAAM,IAAI;wBACzD,2DAA2D;wBAC3D,uDAAuD;wBACvD,8DAA8D;iBACjE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../../src/schema/hooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAE5F,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC;IACpC,cAAc;IACd,kBAAkB;IAClB,YAAY;IACZ,aAAa;IACb,MAAM;IACN,cAAc;IACd,YAAY;CACb,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC;IACxC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAChB,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACjB,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,eAAe;IACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,QAAQ,EAAE,kBAAkB;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACrD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,yEAAyE;IACzE,wEAAwE;IACxE,qEAAqE;IACrE,mDAAmD;IACnD,+DAA+D;IAC/D,sEAAsE;IACtE,gBAAgB;IAChB,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,KAAK,CAAC,uBAAuB,EAAE,uBAAuB,CAAC;SACvD,QAAQ,EAAE;IACb,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC9D,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,eAAe,KAAK,SAAS,EACrE;IACE,OAAO,EAAE,sDAAsD;IAC/D,IAAI,EAAE,CAAC,iBAAiB,CAAC;CAC1B,CACF,CAAC;AAEJ,mEAAmE;AACnE,wEAAwE;AACxE,0EAA0E;AAC1E,wEAAwE;AACxE,uEAAuE;AACvE,EAAE;AACF,0EAA0E;AAC1E,yEAAyE;AACzE,sEAAsE;AACtE,MAAM,2BAA2B,GAA0B,CAAC,SAAS,CAAC,CAAC;AAEvE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IACxE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACrB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC;gBACjB,OAAO,EAAE,wBAAwB,CAAC,CAAC,IAAI,EAAE;aAC1C,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACjB,KAAK,MAAM,MAAM,IAAI,2BAA2B,EAAE,CAAC;YACjD,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9B,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;oBAC3B,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC;oBACjB,OAAO,EACL,cAAc,CAAC,CAAC,IAAI,2BAA2B,MAAM,IAAI;wBACzD,2DAA2D;wBAC3D,uDAAuD;wBACvD,8DAA8D;iBACjE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/schema/index.d.ts

@@ -514,7 +514,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             at_head?: boolean | undefined;
         }>;
         hook: z.ZodString;
-        enforcement: z.ZodEnum<["block", "warn"]>;
+        enforcement: z.ZodEnum<["block", "warn", "require_approval"]>;
         producers: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
             kind: z.ZodLiteral<"bash">;
             command: z.ZodString;
@@ -615,7 +615,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             at_head?: boolean | undefined;
         };
         hook: string;
-        enforcement: "warn" | "block";
+        enforcement: "warn" | "block" | "require_approval";
         producers?: ({
             command: string;
             description: string;
@@ -662,7 +662,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             at_head?: boolean | undefined;
         };
         hook: string;
-        enforcement: "warn" | "block";
+        enforcement: "warn" | "block" | "require_approval";
         producers?: ({
             command: string;
             description: string;
@@ -709,7 +709,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             at_head?: boolean | undefined;
         };
         hook: string;
-        enforcement: "warn" | "block";
+        enforcement: "warn" | "block" | "require_approval";
         producers?: ({
             command: string;
             description: string;
@@ -756,7 +756,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             at_head?: boolean | undefined;
         };
         hook: string;
-        enforcement: "warn" | "block";
+        enforcement: "warn" | "block" | "require_approval";
         producers?: ({
             command: string;
             description: string;
@@ -803,7 +803,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             at_head?: boolean | undefined;
         };
         hook: string;
-        enforcement: "warn" | "block";
+        enforcement: "warn" | "block" | "require_approval";
         producers?: ({
             command: string;
             description: string;
@@ -850,7 +850,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             at_head?: boolean | undefined;
         };
         hook: string;
-        enforcement: "warn" | "block";
+        enforcement: "warn" | "block" | "require_approval";
         producers?: ({
             command: string;
             description: string;
@@ -883,15 +883,18 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
         description: z.ZodOptional<z.ZodString>;
         config: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        min_version: z.ZodOptional<z.ZodString>;
     }, "strict", z.ZodTypeAny, {
         name: string;
         enabled: boolean;
         source: string;
         config: Record<string, unknown>;
         description?: string | undefined;
+        min_version?: string | undefined;
     }, {
         name: string;
         description?: string | undefined;
+        min_version?: string | undefined;
         enabled?: boolean | undefined;
         source?: string | undefined;
         config?: Record<string, unknown> | undefined;
@@ -901,9 +904,11 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
         source: string;
         config: Record<string, unknown>;
         description?: string | undefined;
+        min_version?: string | undefined;
     }[], {
         name: string;
         description?: string | undefined;
+        min_version?: string | undefined;
         enabled?: boolean | undefined;
         source?: string | undefined;
         config?: Record<string, unknown> | undefined;
@@ -2575,7 +2580,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             at_head?: boolean | undefined;
         };
         hook: string;
-        enforcement: "warn" | "block";
+        enforcement: "warn" | "block" | "require_approval";
         producers?: ({
             command: string;
             description: string;
@@ -2608,6 +2613,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
         source: string;
         config: Record<string, unknown>;
         description?: string | undefined;
+        min_version?: string | undefined;
     }[];
     risk: {
         classifiers: {
@@ -2870,7 +2876,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             at_head?: boolean | undefined;
         };
         hook: string;
-        enforcement: "warn" | "block";
+        enforcement: "warn" | "block" | "require_approval";
         producers?: ({
             command: string;
             description: string;
@@ -2900,6 +2906,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
     policy_packs?: {
         name: string;
         description?: string | undefined;
+        min_version?: string | undefined;
         enabled?: boolean | undefined;
         source?: string | undefined;
         config?: Record<string, unknown> | undefined;
@@ -3165,7 +3172,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             at_head?: boolean | undefined;
         };
         hook: string;
-        enforcement: "warn" | "block";
+        enforcement: "warn" | "block" | "require_approval";
         producers?: ({
             command: string;
             description: string;
@@ -3198,6 +3205,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
         source: string;
         config: Record<string, unknown>;
         description?: string | undefined;
+        min_version?: string | undefined;
     }[];
     risk: {
         classifiers: {
@@ -3460,7 +3468,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
             at_head?: boolean | undefined;
         };
         hook: string;
-        enforcement: "warn" | "block";
+        enforcement: "warn" | "block" | "require_approval";
         producers?: ({
             command: string;
             description: string;
@@ -3490,6 +3498,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
     policy_packs?: {
         name: string;
         description?: string | undefined;
+        min_version?: string | undefined;
         enabled?: boolean | undefined;
         source?: string | undefined;
         config?: Record<string, unknown> | undefined;

package/dist/schema/memory.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { NUMERIC_VERSION_MESSAGE, NUMERIC_VERSION_PATTERN } from "../io/version-compare.js";
 export const MemoryScopeSchema = z.enum(["project", "user"]);
 export const MemoryDirectorySchema = z
     .object({
@@ -10,7 +11,11 @@ export const MemoryRouterSchema = z
     .object({
     command: z.array(z.string().min(1)).min(1),
     enabled: z.boolean().default(true),
-    min_version: z.string().min(1).optional(),
+    min_version: z
+        .string()
+        .min(1)
+        .regex(NUMERIC_VERSION_PATTERN, NUMERIC_VERSION_MESSAGE)
+        .optional(),
     version_command: z.array(z.string().min(1)).min(1).optional(),
 })
     .strict();

package/dist/schema/memory.js.map

@@ -1 +1 @@
-{"version":3,"file":"memory.js","sourceRoot":"","sources":["../../src/schema/memory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;AAE7D,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,iBAAiB;CACzB,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC9D,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IACxD,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACjE,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC,SAAS,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC;CAChE,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;IAC5C,OAAO,EAAE,4DAA4D;CACtE,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvD,MAAM,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,MAAM,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;CACvC,CAAC;KACD,MAAM,EAAE,CAAC"}
+{"version":3,"file":"memory.js","sourceRoot":"","sources":["../../src/schema/memory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAE5F,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;AAE7D,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,iBAAiB;CACzB,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,KAAK,CAAC,uBAAuB,EAAE,uBAAuB,CAAC;SACvD,QAAQ,EAAE;IACb,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC9D,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IACxD,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACjE,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC,SAAS,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC;CAChE,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;IAC5C,OAAO,EAAE,4DAA4D;CACtE,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvD,MAAM,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,MAAM,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;CACvC,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/schema/policies.d.ts

@@ -18,7 +18,7 @@ export declare const PolicyTriggerSchema: z.ZodObject<{
     bash_match?: string | undefined;
     extract?: Record<string, string> | undefined;
 }>;
-export declare const PolicyEnforcementSchema: z.ZodEnum<["block", "warn"]>;
+export declare const PolicyEnforcementSchema: z.ZodEnum<["block", "warn", "require_approval"]>;
 export declare const ProducerSchema: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
     kind: z.ZodLiteral<"bash">;
     command: z.ZodString;
@@ -189,7 +189,7 @@ export declare const PolicySchema: z.ZodEffects<z.ZodObject<{
         at_head?: boolean | undefined;
     }>;
     hook: z.ZodString;
-    enforcement: z.ZodEnum<["block", "warn"]>;
+    enforcement: z.ZodEnum<["block", "warn", "require_approval"]>;
     producers: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
         kind: z.ZodLiteral<"bash">;
         command: z.ZodString;
@@ -290,7 +290,7 @@ export declare const PolicySchema: z.ZodEffects<z.ZodObject<{
         at_head?: boolean | undefined;
     };
     hook: string;
-    enforcement: "warn" | "block";
+    enforcement: "warn" | "block" | "require_approval";
     producers?: ({
         command: string;
         description: string;
@@ -337,7 +337,7 @@ export declare const PolicySchema: z.ZodEffects<z.ZodObject<{
         at_head?: boolean | undefined;
     };
     hook: string;
-    enforcement: "warn" | "block";
+    enforcement: "warn" | "block" | "require_approval";
     producers?: ({
         command: string;
         description: string;
@@ -384,7 +384,7 @@ export declare const PolicySchema: z.ZodEffects<z.ZodObject<{
         at_head?: boolean | undefined;
     };
     hook: string;
-    enforcement: "warn" | "block";
+    enforcement: "warn" | "block" | "require_approval";
     producers?: ({
         command: string;
         description: string;
@@ -431,7 +431,7 @@ export declare const PolicySchema: z.ZodEffects<z.ZodObject<{
         at_head?: boolean | undefined;
     };
     hook: string;
-    enforcement: "warn" | "block";
+    enforcement: "warn" | "block" | "require_approval";
     producers?: ({
         command: string;
         description: string;
@@ -549,7 +549,7 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         at_head?: boolean | undefined;
     }>;
     hook: z.ZodString;
-    enforcement: z.ZodEnum<["block", "warn"]>;
+    enforcement: z.ZodEnum<["block", "warn", "require_approval"]>;
     producers: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
         kind: z.ZodLiteral<"bash">;
         command: z.ZodString;
@@ -650,7 +650,7 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         at_head?: boolean | undefined;
     };
     hook: string;
-    enforcement: "warn" | "block";
+    enforcement: "warn" | "block" | "require_approval";
     producers?: ({
         command: string;
         description: string;
@@ -697,7 +697,7 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         at_head?: boolean | undefined;
     };
     hook: string;
-    enforcement: "warn" | "block";
+    enforcement: "warn" | "block" | "require_approval";
     producers?: ({
         command: string;
         description: string;
@@ -744,7 +744,7 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         at_head?: boolean | undefined;
     };
     hook: string;
-    enforcement: "warn" | "block";
+    enforcement: "warn" | "block" | "require_approval";
     producers?: ({
         command: string;
         description: string;
@@ -791,7 +791,7 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         at_head?: boolean | undefined;
     };
     hook: string;
-    enforcement: "warn" | "block";
+    enforcement: "warn" | "block" | "require_approval";
     producers?: ({
         command: string;
         description: string;
@@ -838,7 +838,7 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         at_head?: boolean | undefined;
     };
     hook: string;
-    enforcement: "warn" | "block";
+    enforcement: "warn" | "block" | "require_approval";
     producers?: ({
         command: string;
         description: string;
@@ -885,7 +885,7 @@ export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodO
         at_head?: boolean | undefined;
     };
     hook: string;
-    enforcement: "warn" | "block";
+    enforcement: "warn" | "block" | "require_approval";
     producers?: ({
         command: string;
         description: string;

package/dist/schema/policies.js

@@ -13,7 +13,19 @@ export const PolicyTriggerSchema = z
     extract: ExtractMapSchema.optional(),
 })
     .strict();
-export const PolicyEnforcementSchema = z.enum(["block", "warn"]);
+// How a policy acts when its `requires:` evidence is absent:
+//   block            — deny the tool call.
+//   warn             — let the call proceed, record + surface a warning.
+//   require_approval  — Phase 7 #5. The evaluator returns a first-class
+//                       `require_approval` outcome, distinct from `deny`
+//                       and `warn`; Phase 7 #6 makes it actually block
+//                       until matching approval evidence exists in the
+//                       ledger. A `block` / `warn` policy is unchanged.
+export const PolicyEnforcementSchema = z.enum([
+    "block",
+    "warn",
+    "require_approval",
+]);
 // `producers:` is the structured remediation hint the policy engine
 // appends to the deny envelope. Each entry tells the agent ONE concrete
 // way to produce the ledger evidence that would unblock the gate.
@@ -81,14 +93,14 @@ export const PolicyUxSchema = z
     run: z.array(z.string().min(1)).min(1),
 })
     .strict();
-// `when:` — Phase 7 #1 anchor. The risk/environment-aware match layer.
+// `when:` — the risk/environment-aware match layer.
 //
-// STATUS: schema vocabulary only. `harness policy intercept` does NOT
-// evaluate `when:` yet — a policy's `trigger:` remains the sole match
-// surface at runtime. The Phase 7 #5 evaluator will AND a declared
-// `when:` onto the trigger match, reading the enriched Action Envelope
-// (see docs/ROADMAP.md and docs/risk-gate.md). A `when:` block today is
-// parsed, validated, and otherwise inert.
+// STATUS: live as of Phase 7 #5. `harness policy intercept` ANDs a
+// declared `when:` onto the policy's `trigger:` match, evaluating it
+// against the Action Envelope enriched by the Risk Classifier (#3) and
+// Context Resolver (#4). A policy with no `when:` matches on `trigger:`
+// alone, exactly as in Phase 4. See src/runtime/when-eval.ts for the
+// evaluator and docs/risk-gate.md for the clause semantics.
 //
 // Each clause is optional and keyed by the envelope path it tests:
 //   risk.severity_at_least — envelope risk severity at or above this

package/dist/schema/policies.js.map

@@ -1 +1 @@
-{"version":3,"file":"policies.js","sourceRoot":"","sources":["../../src/schema/policies.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAEnE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,KAAK,EAAE,eAAe;IACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,OAAO,EAAE,gBAAgB,CAAC,QAAQ,EAAE;CACrC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAEjE,oEAAoE;AACpE,wEAAwE;AACxE,kEAAkE;AAClE,qBAAqB;AACrB,qEAAqE;AACrE,kEAAkE;AAClE,wGAAwG;AACxG,mEAAmE;AACnE,0EAA0E;AAC1E,0DAA0D;AAC1D,EAAE;AACF,uEAAuE;AACvE,wEAAwE;AACxE,oEAAoE;AACpE,6BAA6B;AAC7B,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACzD,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/B,CAAC;SACD,MAAM,EAAE;IACX,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/B,CAAC;SACD,MAAM,EAAE;IACX,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/B,CAAC;SACD,MAAM,EAAE;CACZ,CAAC,CAAC;AAEH,qEAAqE;AACrE,EAAE;AACF,oEAAoE;AACpE,8DAA8D;AAC9D,sEAAsE;AACtE,uEAAuE;AACvE,wDAAwD;AACxD,kEAAkE;AAClE,EAAE;AACF,qEAAqE;AACrE,sEAAsE;AACtE,mEAAmE;AACnE,sEAAsE;AACtE,oEAAoE;AACpE,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,qEAAqE;AACrE,cAAc;AACd,8DAA8D;AAC9D,oEAAoE;AACpE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACvC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,uEAAuE;AACvE,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,mEAAmE;AACnE,uEAAuE;AACvE,wEAAwE;AACxE,0CAA0C;AAC1C,EAAE;AACF,mEAAmE;AACnE,qEAAqE;AACrE,wDAAwD;AACxD,gEAAgE;AAChE,yCAAyC;AACzC,mEAAmE;AACnE,qEAAqE;AACrE,oCAAoC;AACpC,iEAAiE;AACjE,+DAA+D;AAC/D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,wBAAwB,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACvD,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjE,kBAAkB,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IACzD,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC5C,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,EAAE;YACR,OAAO,EACL,mFAAmF;SACtF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,OAAO,EAAE,mBAAmB;IAC5B,QAAQ,EAAE,cAAc;IACxB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,WAAW,EAAE,uBAAuB;IACpC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD,EAAE,EAAE,cAAc,CAAC,QAAQ,EAAE;IAC7B,IAAI,EAAE,gBAAgB,CAAC,QAAQ,EAAE;CAClC,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC3B,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;IACpE,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,iBAAiB,CAAC,CAAC,CAAC;YAAE,SAAS;QACnC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,UAAU,EAAE,YAAY,CAAC;gBAChC,OAAO,EAAE,qCAAqC,CAAC,sDAAsD;aACtG,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,WAAW,CAAC;gBACnB,OAAO,EACL,2HAA2H;aAC9H,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;IAChF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACxB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC;gBACjB,OAAO,EAAE,0BAA0B,CAAC,CAAC,IAAI,EAAE;aAC5C,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"policies.js","sourceRoot":"","sources":["../../src/schema/policies.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAEnE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,KAAK,EAAE,eAAe;IACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,OAAO,EAAE,gBAAgB,CAAC,QAAQ,EAAE;CACrC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,6DAA6D;AAC7D,2CAA2C;AAC3C,yEAAyE;AACzE,wEAAwE;AACxE,yEAAyE;AACzE,uEAAuE;AACvE,uEAAuE;AACvE,wEAAwE;AACxE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC5C,OAAO;IACP,MAAM;IACN,kBAAkB;CACnB,CAAC,CAAC;AAEH,oEAAoE;AACpE,wEAAwE;AACxE,kEAAkE;AAClE,qBAAqB;AACrB,qEAAqE;AACrE,kEAAkE;AAClE,wGAAwG;AACxG,mEAAmE;AACnE,0EAA0E;AAC1E,0DAA0D;AAC1D,EAAE;AACF,uEAAuE;AACvE,wEAAwE;AACxE,oEAAoE;AACpE,6BAA6B;AAC7B,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACzD,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/B,CAAC;SACD,MAAM,EAAE;IACX,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/B,CAAC;SACD,MAAM,EAAE;IACX,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/B,CAAC;SACD,MAAM,EAAE;CACZ,CAAC,CAAC;AAEH,qEAAqE;AACrE,EAAE;AACF,oEAAoE;AACpE,8DAA8D;AAC9D,sEAAsE;AACtE,uEAAuE;AACvE,wDAAwD;AACxD,kEAAkE;AAClE,EAAE;AACF,qEAAqE;AACrE,sEAAsE;AACtE,mEAAmE;AACnE,sEAAsE;AACtE,oEAAoE;AACpE,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,qEAAqE;AACrE,cAAc;AACd,8DAA8D;AAC9D,oEAAoE;AACpE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACvC,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,oDAAoD;AACpD,EAAE;AACF,mEAAmE;AACnE,qEAAqE;AACrE,uEAAuE;AACvE,wEAAwE;AACxE,qEAAqE;AACrE,4DAA4D;AAC5D,EAAE;AACF,mEAAmE;AACnE,qEAAqE;AACrE,wDAAwD;AACxD,gEAAgE;AAChE,yCAAyC;AACzC,mEAAmE;AACnE,qEAAqE;AACrE,oCAAoC;AACpC,iEAAiE;AACjE,+DAA+D;AAC/D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,wBAAwB,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACvD,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjE,kBAAkB,EAAE,0BAA0B,CAAC,QAAQ,EAAE;IACzD,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC5C,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzB,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,EAAE;YACR,OAAO,EACL,mFAAmF;SACtF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,OAAO,EAAE,mBAAmB;IAC5B,QAAQ,EAAE,cAAc;IACxB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,WAAW,EAAE,uBAAuB;IACpC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpD,EAAE,EAAE,cAAc,CAAC,QAAQ,EAAE;IAC7B,IAAI,EAAE,gBAAgB,CAAC,QAAQ,EAAE;CAClC,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC3B,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;IACpE,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,iBAAiB,CAAC,CAAC,CAAC;YAAE,SAAS;QACnC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,UAAU,EAAE,YAAY,CAAC;gBAChC,OAAO,EAAE,qCAAqC,CAAC,sDAAsD;aACtG,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,WAAW,CAAC;gBACnB,OAAO,EACL,2HAA2H;aAC9H,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE;IAChF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACxB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC;gBACjB,OAAO,EAAE,0BAA0B,CAAC,CAAC,IAAI,EAAE;aAC5C,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/schema/policy-packs.d.ts

@@ -5,15 +5,18 @@ export declare const PolicyPackSchema: z.ZodObject<{
     enabled: z.ZodDefault<z.ZodBoolean>;
     description: z.ZodOptional<z.ZodString>;
     config: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    min_version: z.ZodOptional<z.ZodString>;
 }, "strict", z.ZodTypeAny, {
     name: string;
     enabled: boolean;
     source: string;
     config: Record<string, unknown>;
     description?: string | undefined;
+    min_version?: string | undefined;
 }, {
     name: string;
     description?: string | undefined;
+    min_version?: string | undefined;
     enabled?: boolean | undefined;
     source?: string | undefined;
     config?: Record<string, unknown> | undefined;
@@ -24,15 +27,18 @@ export declare const PolicyPacksSchema: z.ZodEffects<z.ZodArray<z.ZodObject<{
     enabled: z.ZodDefault<z.ZodBoolean>;
     description: z.ZodOptional<z.ZodString>;
     config: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    min_version: z.ZodOptional<z.ZodString>;
 }, "strict", z.ZodTypeAny, {
     name: string;
     enabled: boolean;
     source: string;
     config: Record<string, unknown>;
     description?: string | undefined;
+    min_version?: string | undefined;
 }, {
     name: string;
     description?: string | undefined;
+    min_version?: string | undefined;
     enabled?: boolean | undefined;
     source?: string | undefined;
     config?: Record<string, unknown> | undefined;
@@ -42,9 +48,11 @@ export declare const PolicyPacksSchema: z.ZodEffects<z.ZodArray<z.ZodObject<{
     source: string;
     config: Record<string, unknown>;
     description?: string | undefined;
+    min_version?: string | undefined;
 }[], {
     name: string;
     description?: string | undefined;
+    min_version?: string | undefined;
     enabled?: boolean | undefined;
     source?: string | undefined;
     config?: Record<string, unknown> | undefined;