@lannguyensi/harness 0.27.0 → 0.28.0

package/dist/policy-packs/config-check.js

@@ -0,0 +1,58 @@
+// Per-pack `config:` shape check, used by both `harness validate` and
+// `harness doctor`. The top-level `PolicyPackSchema` accepts
+// `config: z.record(string, unknown)` — any key, any value — because
+// each builtin pack owns its own config interpretation. That means a
+// typo like `mode: "fastConfirm"` (camelCase instead of `fast_confirm`)
+// or `permision_profile` (misspelled key) currently falls through to
+// the runtime fallback and the operator only finds out when the hook
+// finally fires. This helper consults the per-pack `configSchema`
+// exported from each builtin module and surfaces every issue at
+// lint-time.
+//
+// Order is deliberate: the source check (`checkPolicyPackSources`) runs
+// first to catch unknown pack `source:` / `name:`; only packs that pass
+// that gate carry a registered schema. Both helpers stay separate so
+// validate can emit BOTH a "this pack does not resolve" diagnostic and
+// the per-key config diagnostics for sibling packs in the same run.
+import { isBuiltinPackName, resolveBuiltinConfigSchema } from "./registry.js";
+/**
+ * Walks `manifest.policy_packs` in declared order. For each enabled
+ * builtin pack with a registered `configSchema`, runs `safeParse` and
+ * lifts every zod issue into a flat `PolicyPackConfigIssue`. Unknown
+ * pack names are skipped (their resolution gap is the
+ * `checkPolicyPackSources` helper's job); non-builtin sources are
+ * skipped (no schema to consult in v1).
+ *
+ * Output order is stable: packs in manifest order, issues in zod's
+ * native traversal order.
+ */
+export function checkPolicyPackConfigs(manifest) {
+    const issues = [];
+    manifest.policy_packs.forEach((pack, packIndex) => {
+        if (!pack.enabled)
+            return;
+        if (!isBuiltinPackName(pack.name))
+            return;
+        const schema = resolveBuiltinConfigSchema(pack.name);
+        if (!schema)
+            return;
+        const parsed = schema.safeParse(pack.config);
+        if (parsed.success)
+            return;
+        for (const issue of parsed.error.issues) {
+            const configPath = issue.path
+                .map((seg) => (typeof seg === "number" ? `[${seg}]` : String(seg)))
+                .join(".")
+                .replace(/\.\[/g, "[");
+            issues.push({
+                packIndex,
+                packName: pack.name,
+                configPath,
+                message: issue.message,
+                code: issue.code,
+            });
+        }
+    });
+    return issues;
+}
+//# sourceMappingURL=config-check.js.map

package/dist/policy-packs/config-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-check.js","sourceRoot":"","sources":["../../src/policy-packs/config-check.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,6DAA6D;AAC7D,qEAAqE;AACrE,qEAAqE;AACrE,wEAAwE;AACxE,qEAAqE;AACrE,qEAAqE;AACrE,kEAAkE;AAClE,gEAAgE;AAChE,aAAa;AACb,EAAE;AACF,wEAAwE;AACxE,wEAAwE;AACxE,qEAAqE;AACrE,uEAAuE;AACvE,oEAAoE;AAGpE,OAAO,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAqB9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAkB;IAElB,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE;QAChD,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO;QAC1C,MAAM,MAAM,GAAG,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO;QAC3B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI;iBAC1B,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;iBAClE,IAAI,CAAC,GAAG,CAAC;iBACT,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC;gBACV,SAAS;gBACT,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,UAAU;gBACV,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,IAAI,EAAE,KAAK,CAAC,IAAI;aACjB,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/policy-packs/expand.js

@@ -2,10 +2,11 @@
 //
 // Walks the manifest's enabled packs, parses each `source:` string,
 // resolves builtin packs through the registry, and aggregates their
-// contributions (hooks + files). Unrecognised sources or unknown builtin
-// names produce non-fatal warnings here; `harness validate` is the
-// place that turns the same conditions into hard errors so the user
-// sees them at lint time, not silently at apply time.
+// contributions (hooks + files). Unrecognised sources / unknown builtin
+// names are caught up front by `checkPolicyPackSources` (called from
+// both `harness apply` and `harness validate`), so the warning + skip
+// branches below are belt-and-braces: they only trigger if a caller
+// invokes `expandPolicyPacks` directly without the pre-check.
 //
 // Hook-name collision handling: pack hooks are namespaced
 // (`policy-pack:<name>:<role>`) by the builtin definitions, so a user

package/dist/policy-packs/expand.js.map

@@ -1 +1 @@
-{"version":3,"file":"expand.js","sourceRoot":"","sources":["../../src/policy-packs/expand.ts"],"names":[],"mappings":"AAAA,oDAAoD;AACpD,EAAE;AACF,oEAAoE;AACpE,oEAAoE;AACpE,yEAAyE;AACzE,mEAAmE;AACnE,oEAAoE;AACpE,sDAAsD;AACtD,EAAE;AACF,0DAA0D;AAC1D,sEAAsE;AACtE,uEAAuE;AACvE,qEAAqE;AACrE,oEAAoE;AACpE,qCAAqC;AAIrC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAgB,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAK9C,MAAM,UAAU,iBAAiB,CAC/B,QAAkB,EAClB,UAAmB,eAAe,EAClC,OAAiC,EAAE;IAEnC,MAAM,GAAG,GAAwB,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACrF,IAAI,QAAQ,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IAEnD,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,YAAY,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACpC,GAAG,CAAC,QAAQ,CAAC,IAAI,CACf,gBAAgB,IAAI,CAAC,IAAI,aAAa,IAAI,CAAC,SAAS,CAClD,IAAI,CAAC,MAAM,CACZ,+DAA+D,CACjE,CAAC;YACF,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,QAAQ,CAAC,IAAI,CACf,gBAAgB,IAAI,CAAC,IAAI,oFAAoF,CAC9G,CAAC;YACF,SAAS;QACX,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACxC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;YAC/C,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrC,GAAG,CAAC,QAAQ,CAAC,IAAI,CACf,gBAAgB,IAAI,CAAC,IAAI,iBAAiB,IAAI,CAAC,IAAI,wGAAwG,CAC5J,CAAC;gBACF,SAAS;YACX,CAAC;YACD,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrC,GAAG,CAAC,QAAQ,CAAC,IAAI,CACf,gBAAgB,IAAI,CAAC,IAAI,iBAAiB,IAAI,CAAC,IAAI,oEAAoE,CACxH,CAAC;gBACF,SAAS;YACX,CAAC;YACD,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,QAAQ,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;YACtC,cAAc,GAAG,IAAI,CAAC;YACtB,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK;gBAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACzE,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,YAAY,CAAC,WAAW,CAAC,GAAG;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACrE,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,YAAY,CAAC,WAAW,CAAC,IAAI;gBAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,IAAI,cAAc,EAAE,CAAC;QACnB,+DAA+D;QAC/D,gEAAgE;QAChE,+DAA+D;QAC/D,kEAAkE;QAClE,cAAc;QACd,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACjB,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QACD,MAAM,WAAW,GAAgC;YAC/C,KAAK,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE;YAC3B,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE;YACvB,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE;SAC1B,CAAC;QACF,GAAG,CAAC,WAAW,GAAG,WAAW,CAAC;IAChC,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"expand.js","sourceRoot":"","sources":["../../src/policy-packs/expand.ts"],"names":[],"mappings":"AAAA,oDAAoD;AACpD,EAAE;AACF,oEAAoE;AACpE,oEAAoE;AACpE,wEAAwE;AACxE,qEAAqE;AACrE,sEAAsE;AACtE,oEAAoE;AACpE,8DAA8D;AAC9D,EAAE;AACF,0DAA0D;AAC1D,sEAAsE;AACtE,uEAAuE;AACvE,qEAAqE;AACrE,oEAAoE;AACpE,qCAAqC;AAIrC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAgB,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAK9C,MAAM,UAAU,iBAAiB,CAC/B,QAAkB,EAClB,UAAmB,eAAe,EAClC,OAAiC,EAAE;IAEnC,MAAM,GAAG,GAAwB,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACrF,IAAI,QAAQ,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IAEnD,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,YAAY,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACpC,GAAG,CAAC,QAAQ,CAAC,IAAI,CACf,gBAAgB,IAAI,CAAC,IAAI,aAAa,IAAI,CAAC,SAAS,CAClD,IAAI,CAAC,MAAM,CACZ,+DAA+D,CACjE,CAAC;YACF,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,QAAQ,CAAC,IAAI,CACf,gBAAgB,IAAI,CAAC,IAAI,oFAAoF,CAC9G,CAAC;YACF,SAAS;QACX,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACxC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;YAC/C,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrC,GAAG,CAAC,QAAQ,CAAC,IAAI,CACf,gBAAgB,IAAI,CAAC,IAAI,iBAAiB,IAAI,CAAC,IAAI,wGAAwG,CAC5J,CAAC;gBACF,SAAS;YACX,CAAC;YACD,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrC,GAAG,CAAC,QAAQ,CAAC,IAAI,CACf,gBAAgB,IAAI,CAAC,IAAI,iBAAiB,IAAI,CAAC,IAAI,oEAAoE,CACxH,CAAC;gBACF,SAAS;YACX,CAAC;YACD,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;QACD,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,QAAQ,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC;YACtC,cAAc,GAAG,IAAI,CAAC;YACtB,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK;gBAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACzE,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,YAAY,CAAC,WAAW,CAAC,GAAG;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACrE,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,YAAY,CAAC,WAAW,CAAC,IAAI;gBAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IAED,IAAI,cAAc,EAAE,CAAC;QACnB,+DAA+D;QAC/D,gEAAgE;QAChE,+DAA+D;QAC/D,kEAAkE;QAClE,cAAc;QACd,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACjB,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QACD,MAAM,WAAW,GAAgC;YAC/C,KAAK,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE;YAC3B,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE;YACvB,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE;SAC1B,CAAC;QACF,GAAG,CAAC,WAAW,GAAG,WAAW,CAAC;IAChC,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/policy-packs/index.d.ts

@@ -1,5 +1,8 @@
 export { expandPolicyPacks, type ExpandPolicyPacksOptions } from "./expand.js";
-export { KNOWN_BUILTIN_PACKS, isBuiltinPackName, resolveBuiltin, type BuiltinPackName, type ResolveBuiltinResult, } from "./registry.js";
+export { KNOWN_BUILTIN_PACKS, isBuiltinPackName, resolveBuiltin, resolveBuiltinConfigSchema, resolveBuiltinVersionCommand, type BuiltinPackName, type ResolveBuiltinResult, } from "./registry.js";
+export { checkPolicyPackConfigs, type PolicyPackConfigIssue, } from "./config-check.js";
+export { checkPolicyPackVersions, type PolicyPackVersionGap, type PolicyPackVersionGapKind, } from "./version-check.js";
 export { KNOWN_RUNTIMES, DEFAULT_RUNTIME, isRuntime, parseRuntime, type Runtime, } from "./runtime.js";
 export { parsePackSource, type PackSourceKind, type PackSourceParseResult } from "./source.js";
+export { checkPolicyPackSources, type PolicyPackSourceIssue, type PolicyPackSourceIssueKind, } from "./source-check.js";
 export type { PackContribution, PackContributionFile, PackExpansionResult, } from "./types.js";

package/dist/policy-packs/index.js

@@ -1,5 +1,8 @@
 export { expandPolicyPacks } from "./expand.js";
-export { KNOWN_BUILTIN_PACKS, isBuiltinPackName, resolveBuiltin, } from "./registry.js";
+export { KNOWN_BUILTIN_PACKS, isBuiltinPackName, resolveBuiltin, resolveBuiltinConfigSchema, resolveBuiltinVersionCommand, } from "./registry.js";
+export { checkPolicyPackConfigs, } from "./config-check.js";
+export { checkPolicyPackVersions, } from "./version-check.js";
 export { KNOWN_RUNTIMES, DEFAULT_RUNTIME, isRuntime, parseRuntime, } from "./runtime.js";
 export { parsePackSource } from "./source.js";
+export { checkPolicyPackSources, } from "./source-check.js";
 //# sourceMappingURL=index.js.map

package/dist/policy-packs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/policy-packs/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAiC,MAAM,aAAa,CAAC;AAC/E,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,GAGf,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,cAAc,EACd,eAAe,EACf,SAAS,EACT,YAAY,GAEb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,eAAe,EAAmD,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/policy-packs/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAiC,MAAM,aAAa,CAAC;AAC/E,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,cAAc,EACd,0BAA0B,EAC1B,4BAA4B,GAG7B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,GAEvB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,uBAAuB,GAGxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,cAAc,EACd,eAAe,EACf,SAAS,EACT,YAAY,GAEb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,eAAe,EAAmD,MAAM,aAAa,CAAC;AAC/F,OAAO,EACL,sBAAsB,GAGvB,MAAM,mBAAmB,CAAC"}

package/dist/policy-packs/registry.d.ts

@@ -1,3 +1,4 @@
+import type { z } from "zod";
 import type { PolicyPack } from "../schema/index.js";
 import { type ResolvePackOptions } from "./builtin/understanding-before-execution.js";
 import { type Runtime } from "./runtime.js";
@@ -10,3 +11,22 @@ export interface ResolveBuiltinResult {
     warnings: string[];
 }
 export declare function resolveBuiltin(pack: PolicyPack, runtime?: Runtime, opts?: ResolvePackOptions): ResolveBuiltinResult | null;
+/**
+ * Per-builtin `config:` schema lookup. Returns null when the pack name
+ * is not a builtin (caller should already have flagged that via
+ * `checkPolicyPackSources`), and a schema when one is registered.
+ * Consumed by `checkPolicyPackConfigs` so `harness validate` /
+ * `harness doctor` catch typo'd keys at lint time.
+ */
+export declare function resolveBuiltinConfigSchema(packName: string): z.ZodTypeAny | null;
+/**
+ * Canonical version-probe command for a builtin pack's package-side bin.
+ * Returns `null` when the pack name is not a builtin (caller should
+ * already have flagged that via `checkPolicyPackSources`), or when the
+ * pack has no separate package-side bin (e.g. `branch-protection`'s
+ * blocker is harness itself, no external binary to probe). Consumed by
+ * `checkPolicyPackVersions` so `harness doctor` can compare the
+ * installed version against an operator-declared pack-level
+ * `min_version` floor.
+ */
+export declare function resolveBuiltinVersionCommand(packName: string): readonly [string, string] | null;

package/dist/policy-packs/registry.js

@@ -4,8 +4,8 @@
 // builtins are added by appending to `KNOWN_BUILTIN_PACKS` and a case
 // arm in `resolveBuiltin()`. Non-builtin sources (path/npm/git) are
 // out of scope for v1; their resolution lands in a later sub-task.
-import { PACK_NAME as BRANCH_PROTECTION, resolve as resolveBranchProtection, } from "./builtin/branch-protection.js";
-import { PACK_NAME as UNDERSTANDING_BEFORE_EXECUTION, resolve as resolveUnderstandingBeforeExecution, } from "./builtin/understanding-before-execution.js";
+import { configSchema as branchProtectionConfigSchema, PACK_NAME as BRANCH_PROTECTION, resolve as resolveBranchProtection, } from "./builtin/branch-protection.js";
+import { configSchema as understandingBeforeExecutionConfigSchema, PACK_NAME as UNDERSTANDING_BEFORE_EXECUTION, resolve as resolveUnderstandingBeforeExecution, VERSION_COMMAND as UNDERSTANDING_BEFORE_EXECUTION_VERSION_COMMAND, } from "./builtin/understanding-before-execution.js";
 import { DEFAULT_RUNTIME } from "./runtime.js";
 export const KNOWN_BUILTIN_PACKS = [
     UNDERSTANDING_BEFORE_EXECUTION,
@@ -24,4 +24,41 @@ export function resolveBuiltin(pack, runtime = DEFAULT_RUNTIME, opts = {}) {
             return resolveBranchProtection(pack, runtime);
     }
 }
+/**
+ * Per-builtin `config:` schema lookup. Returns null when the pack name
+ * is not a builtin (caller should already have flagged that via
+ * `checkPolicyPackSources`), and a schema when one is registered.
+ * Consumed by `checkPolicyPackConfigs` so `harness validate` /
+ * `harness doctor` catch typo'd keys at lint time.
+ */
+export function resolveBuiltinConfigSchema(packName) {
+    if (!isBuiltinPackName(packName))
+        return null;
+    switch (packName) {
+        case UNDERSTANDING_BEFORE_EXECUTION:
+            return understandingBeforeExecutionConfigSchema;
+        case BRANCH_PROTECTION:
+            return branchProtectionConfigSchema;
+    }
+}
+/**
+ * Canonical version-probe command for a builtin pack's package-side bin.
+ * Returns `null` when the pack name is not a builtin (caller should
+ * already have flagged that via `checkPolicyPackSources`), or when the
+ * pack has no separate package-side bin (e.g. `branch-protection`'s
+ * blocker is harness itself, no external binary to probe). Consumed by
+ * `checkPolicyPackVersions` so `harness doctor` can compare the
+ * installed version against an operator-declared pack-level
+ * `min_version` floor.
+ */
+export function resolveBuiltinVersionCommand(packName) {
+    if (!isBuiltinPackName(packName))
+        return null;
+    switch (packName) {
+        case UNDERSTANDING_BEFORE_EXECUTION:
+            return UNDERSTANDING_BEFORE_EXECUTION_VERSION_COMMAND;
+        case BRANCH_PROTECTION:
+            return null;
+    }
+}
 //# sourceMappingURL=registry.js.map

package/dist/policy-packs/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/policy-packs/registry.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,EAAE;AACF,kEAAkE;AAClE,sEAAsE;AACtE,oEAAoE;AACpE,mEAAmE;AAGnE,OAAO,EACL,SAAS,IAAI,iBAAiB,EAC9B,OAAO,IAAI,uBAAuB,GACnC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,SAAS,IAAI,8BAA8B,EAC3C,OAAO,IAAI,mCAAmC,GAE/C,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,eAAe,EAAgB,MAAM,cAAc,CAAC;AAG7D,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,8BAA8B;IAC9B,iBAAiB;CACT,CAAC;AAGX,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAQ,mBAAyC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACnE,CAAC;AAOD,MAAM,UAAU,cAAc,CAC5B,IAAgB,EAChB,UAAmB,eAAe,EAClC,OAA2B,EAAE;IAE7B,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,QAAQ,IAAI,CAAC,IAAuB,EAAE,CAAC;QACrC,KAAK,8BAA8B;YACjC,OAAO,mCAAmC,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAClE,KAAK,iBAAiB;YACpB,OAAO,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;AACH,CAAC"}
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/policy-packs/registry.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,EAAE;AACF,kEAAkE;AAClE,sEAAsE;AACtE,oEAAoE;AACpE,mEAAmE;AAInE,OAAO,EACL,YAAY,IAAI,4BAA4B,EAC5C,SAAS,IAAI,iBAAiB,EAC9B,OAAO,IAAI,uBAAuB,GACnC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,YAAY,IAAI,wCAAwC,EACxD,SAAS,IAAI,8BAA8B,EAC3C,OAAO,IAAI,mCAAmC,EAC9C,eAAe,IAAI,8CAA8C,GAElE,MAAM,6CAA6C,CAAC;AACrD,OAAO,EAAE,eAAe,EAAgB,MAAM,cAAc,CAAC;AAG7D,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,8BAA8B;IAC9B,iBAAiB;CACT,CAAC;AAGX,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAQ,mBAAyC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACnE,CAAC;AAOD,MAAM,UAAU,cAAc,CAC5B,IAAgB,EAChB,UAAmB,eAAe,EAClC,OAA2B,EAAE;IAE7B,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,QAAQ,IAAI,CAAC,IAAuB,EAAE,CAAC;QACrC,KAAK,8BAA8B;YACjC,OAAO,mCAAmC,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QAClE,KAAK,iBAAiB;YACpB,OAAO,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAAgB;IAEhB,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,QAAQ,QAA2B,EAAE,CAAC;QACpC,KAAK,8BAA8B;YACjC,OAAO,wCAAwC,CAAC;QAClD,KAAK,iBAAiB;YACpB,OAAO,4BAA4B,CAAC;IACxC,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAgB;IAEhB,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,QAAQ,QAA2B,EAAE,CAAC;QACpC,KAAK,8BAA8B;YACjC,OAAO,8CAA8C,CAAC;QACxD,KAAK,iBAAiB;YACpB,OAAO,IAAI,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/policy-packs/source-check.d.ts

@@ -0,0 +1,28 @@
+import type { Manifest } from "../schema/index.js";
+export type PolicyPackSourceIssueKind = "unknown-source" | "unknown-builtin";
+export interface PolicyPackSourceIssue {
+    packIndex: number;
+    packName: string;
+    kind: PolicyPackSourceIssueKind;
+    /** Raw `source:` string for `unknown-source`; absent for `unknown-builtin`. */
+    source?: string;
+    /**
+     * Path suffix matching the validate Diagnostic shape: `source` or `name`.
+     * Not independent of `kind` — `unknown-source` always pairs with `source`,
+     * `unknown-builtin` with `name`. Carried explicitly so call sites
+     * (apply error text, validate Diagnostic.path) don't each re-derive it.
+     */
+    field: "source" | "name";
+    message: string;
+}
+/**
+ * Walks `manifest.policy_packs` in declared order and returns one issue
+ * per offending enabled pack. Output order is stable and matches the
+ * manifest array order — call sites rely on this when aggregating
+ * messages, and `tests/policy-packs/source-check.test.ts` asserts it.
+ *
+ * `enabled: false` packs are skipped on both sides: an operator who has
+ * intentionally stashed an unfinished pack reference shouldn't have
+ * apply or validate red until they re-enable it.
+ */
+export declare function checkPolicyPackSources(manifest: Manifest): PolicyPackSourceIssue[];

package/dist/policy-packs/source-check.js

@@ -0,0 +1,49 @@
+// Shared pack-source / builtin-name check, used by both
+// `harness validate` (lint-time hard error) and `harness apply`
+// (fail-loud before expansion). Without a single source of truth here,
+// the two paths drifted: apply silently skipped unknown packs while
+// validate erred — so an operator who never ran `validate` would push a
+// broken manifest, see "apply succeeded", and only discover the pack
+// never wired up at runtime.
+import { isBuiltinPackName } from "./registry.js";
+import { parsePackSource } from "./source.js";
+/**
+ * Walks `manifest.policy_packs` in declared order and returns one issue
+ * per offending enabled pack. Output order is stable and matches the
+ * manifest array order — call sites rely on this when aggregating
+ * messages, and `tests/policy-packs/source-check.test.ts` asserts it.
+ *
+ * `enabled: false` packs are skipped on both sides: an operator who has
+ * intentionally stashed an unfinished pack reference shouldn't have
+ * apply or validate red until they re-enable it.
+ */
+export function checkPolicyPackSources(manifest) {
+    const issues = [];
+    manifest.policy_packs.forEach((pack, i) => {
+        if (!pack.enabled)
+            return;
+        const sourceParsed = parsePackSource(pack.source);
+        if (sourceParsed.kind === "unknown") {
+            issues.push({
+                packIndex: i,
+                packName: pack.name,
+                kind: "unknown-source",
+                source: pack.source,
+                field: "source",
+                message: `unknown source ${JSON.stringify(pack.source)}: only "builtin" resolves in v1; see docs/policy-packs/`,
+            });
+            return;
+        }
+        if (!isBuiltinPackName(pack.name)) {
+            issues.push({
+                packIndex: i,
+                packName: pack.name,
+                kind: "unknown-builtin",
+                field: "name",
+                message: `not a known builtin pack: ${JSON.stringify(pack.name)}. See docs/policy-packs/ for supported names.`,
+            });
+        }
+    });
+    return issues;
+}
+//# sourceMappingURL=source-check.js.map

package/dist/policy-packs/source-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-check.js","sourceRoot":"","sources":["../../src/policy-packs/source-check.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,gEAAgE;AAChE,uEAAuE;AACvE,oEAAoE;AACpE,wEAAwE;AACxE,qEAAqE;AACrE,6BAA6B;AAE7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAqB9C;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAAkB;IACvD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE;QACxC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,YAAY,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC;gBACV,SAAS,EAAE,CAAC;gBACZ,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,IAAI,EAAE,gBAAgB;gBACtB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,KAAK,EAAE,QAAQ;gBACf,OAAO,EAAE,kBAAkB,IAAI,CAAC,SAAS,CACvC,IAAI,CAAC,MAAM,CACZ,yDAAyD;aAC3D,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC;gBACV,SAAS,EAAE,CAAC;gBACZ,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,IAAI,EAAE,iBAAiB;gBACvB,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,6BAA6B,IAAI,CAAC,SAAS,CAClD,IAAI,CAAC,IAAI,CACV,+CAA+C;aACjD,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/policy-packs/version-check.d.ts

@@ -0,0 +1,37 @@
+import type { Manifest } from "../schema/index.js";
+export type PolicyPackVersionGapKind = 
+/** Pack declares min_version but no version probe is registered (warn). */
+"no_probe_registered"
+/** Version probe returned null (binary missing / failed to launch). */
+ | "probe_failed"
+/** Probe stdout did not match a `digit(.digit)*` token. */
+ | "parse_failed"
+/** Probed version is below the declared floor. */
+ | "below_floor";
+export interface PolicyPackVersionGap {
+    packIndex: number;
+    packName: string;
+    /** The declared floor from `policy_packs[i].min_version`. */
+    declaredMinVersion: string;
+    /**
+     * The version probe command that was (or would have been) invoked.
+     * Empty array when no probe is registered for the pack.
+     */
+    versionCommand: readonly string[];
+    /** Parsed version string when the probe succeeded; otherwise null. */
+    actualVersion: string | null;
+    kind: PolicyPackVersionGapKind;
+    message: string;
+}
+/**
+ * Walks `manifest.policy_packs` in declared order. For each enabled
+ * builtin pack that carries an explicit `min_version`, runs the
+ * registered probe (or flags missing-probe), parses the version, and
+ * compares against the floor. Returns one gap per offending pack;
+ * green ones produce nothing.
+ *
+ * `enabled: false` packs are skipped (consistent with the source +
+ * config helpers). Non-builtin pack names are skipped: the source
+ * check is the source of truth for "this pack does not resolve".
+ */
+export declare function checkPolicyPackVersions(manifest: Manifest, versionProbe: (cmd: readonly string[]) => string | null): PolicyPackVersionGap[];

package/dist/policy-packs/version-check.js

@@ -0,0 +1,89 @@
+// Per-pack version-floor check. Doctor uses this to surface a warning
+// when the operator declared `policy_packs[].min_version: x.y.z` and
+// the installed package-side bin reports below that. Mirrors the
+// hook-level `checkHookVersion` design (see `src/cli/doctor/index.ts`):
+// the same warning rungs, the same parse-failure fallback, so an
+// operator reading doctor output sees a consistent shape regardless of
+// which layer raised the gap.
+//
+// The split between this and the hook-level check is deliberate: a
+// hook-level floor covers each individual hook command, this catches a
+// pack-level config-schema mismatch (a `config:` key only the newer
+// package honours). Both can fire in the same doctor run.
+import { compareNumericVersions } from "../io/version-compare.js";
+import { isBuiltinPackName, resolveBuiltinVersionCommand } from "./registry.js";
+/**
+ * Walks `manifest.policy_packs` in declared order. For each enabled
+ * builtin pack that carries an explicit `min_version`, runs the
+ * registered probe (or flags missing-probe), parses the version, and
+ * compares against the floor. Returns one gap per offending pack;
+ * green ones produce nothing.
+ *
+ * `enabled: false` packs are skipped (consistent with the source +
+ * config helpers). Non-builtin pack names are skipped: the source
+ * check is the source of truth for "this pack does not resolve".
+ */
+export function checkPolicyPackVersions(manifest, versionProbe) {
+    const gaps = [];
+    manifest.policy_packs.forEach((pack, packIndex) => {
+        if (!pack.enabled)
+            return;
+        if (!isBuiltinPackName(pack.name))
+            return;
+        if (!pack.min_version)
+            return;
+        const versionCommand = resolveBuiltinVersionCommand(pack.name);
+        if (versionCommand === null) {
+            gaps.push({
+                packIndex,
+                packName: pack.name,
+                declaredMinVersion: pack.min_version,
+                versionCommand: [],
+                actualVersion: null,
+                kind: "no_probe_registered",
+                message: `no version probe registered for pack "${pack.name}"; the declared min_version cannot be enforced`,
+            });
+            return;
+        }
+        const stdout = versionProbe(versionCommand);
+        if (stdout === null) {
+            gaps.push({
+                packIndex,
+                packName: pack.name,
+                declaredMinVersion: pack.min_version,
+                versionCommand,
+                actualVersion: null,
+                kind: "probe_failed",
+                message: `version probe failed for ${versionCommand.join(" ")}`,
+            });
+            return;
+        }
+        const match = stdout.match(/(\d+(?:\.\d+){0,3})/);
+        if (!match || !match[1]) {
+            gaps.push({
+                packIndex,
+                packName: pack.name,
+                declaredMinVersion: pack.min_version,
+                versionCommand,
+                actualVersion: null,
+                kind: "parse_failed",
+                message: `could not parse a version from "${stdout.trim()}"`,
+            });
+            return;
+        }
+        const actual = match[1];
+        if (compareNumericVersions(actual, pack.min_version) < 0) {
+            gaps.push({
+                packIndex,
+                packName: pack.name,
+                declaredMinVersion: pack.min_version,
+                versionCommand,
+                actualVersion: actual,
+                kind: "below_floor",
+                message: `outdated: installed v${actual} < required ${pack.min_version}`,
+            });
+        }
+    });
+    return gaps;
+}
+//# sourceMappingURL=version-check.js.map

package/dist/policy-packs/version-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version-check.js","sourceRoot":"","sources":["../../src/policy-packs/version-check.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,qEAAqE;AACrE,iEAAiE;AACjE,wEAAwE;AACxE,iEAAiE;AACjE,uEAAuE;AACvE,8BAA8B;AAC9B,EAAE;AACF,mEAAmE;AACnE,uEAAuE;AACvE,oEAAoE;AACpE,0DAA0D;AAE1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC;AA6BhF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAAkB,EAClB,YAAuD;IAEvD,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,QAAQ,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE;QAChD,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO;QAC1C,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO;QAC9B,MAAM,cAAc,GAAG,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC;gBACR,SAAS;gBACT,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,kBAAkB,EAAE,IAAI,CAAC,WAAW;gBACpC,cAAc,EAAE,EAAE;gBAClB,aAAa,EAAE,IAAI;gBACnB,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,yCAAyC,IAAI,CAAC,IAAI,gDAAgD;aAC5G,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;QAC5C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC;gBACR,SAAS;gBACT,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,kBAAkB,EAAE,IAAI,CAAC,WAAW;gBACpC,cAAc;gBACd,aAAa,EAAE,IAAI;gBACnB,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,4BAA4B,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;aAChE,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC;gBACR,SAAS;gBACT,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,kBAAkB,EAAE,IAAI,CAAC,WAAW;gBACpC,cAAc;gBACd,aAAa,EAAE,IAAI;gBACnB,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,mCAAmC,MAAM,CAAC,IAAI,EAAE,GAAG;aAC7D,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,sBAAsB,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACzD,IAAI,CAAC,IAAI,CAAC;gBACR,SAAS;gBACT,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,kBAAkB,EAAE,IAAI,CAAC,WAAW;gBACpC,cAAc;gBACd,aAAa,EAAE,MAAM;gBACrB,IAAI,EAAE,aAAa;gBACnB,OAAO,EAAE,wBAAwB,MAAM,eAAe,IAAI,CAAC,WAAW,EAAE;aACzE,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/probes/memory.d.ts

@@ -50,6 +50,6 @@ export interface MemoryOptions {
      * spawnSync probe at CLI invocation. Returning `null` is treated as
      * "version probe failed" and emits a warn line.
      */
-    versionProbe?: (cmd: string[]) => string | null;
+    versionProbe?: (cmd: readonly string[]) => string | null;
 }
 export declare function inspectMemory(manifest: Manifest, opts?: MemoryOptions): MemoryReport;

package/dist/schema/hooks.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { NUMERIC_VERSION_MESSAGE, NUMERIC_VERSION_PATTERN } from "../io/version-compare.js";
 export const HookEventSchema = z.enum([
     "SessionStart",
     "UserPromptSubmit",
@@ -31,7 +32,11 @@ export const HookSchema = z
     // `~/.claude/hooks/foo.sh`), so there is no useful default for
     // `version_command` and a min_version-without-command is treated as a
     // config error.
-    min_version: z.string().min(1).optional(),
+    min_version: z
+        .string()
+        .min(1)
+        .regex(NUMERIC_VERSION_PATTERN, NUMERIC_VERSION_MESSAGE)
+        .optional(),
     version_command: z.array(z.string().min(1)).min(1).optional(),
 })
     .strict()

package/dist/schema/hooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../../src/schema/hooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC;IACpC,cAAc;IACd,kBAAkB;IAClB,YAAY;IACZ,aAAa;IACb,MAAM;IACN,cAAc;IACd,YAAY;CACb,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC;IACxC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAChB,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACjB,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,eAAe;IACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,QAAQ,EAAE,kBAAkB;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACrD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,yEAAyE;IACzE,wEAAwE;IACxE,qEAAqE;IACrE,mDAAmD;IACnD,+DAA+D;IAC/D,sEAAsE;IACtE,gBAAgB;IAChB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC9D,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,eAAe,KAAK,SAAS,EACrE;IACE,OAAO,EAAE,sDAAsD;IAC/D,IAAI,EAAE,CAAC,iBAAiB,CAAC;CAC1B,CACF,CAAC;AAEJ,mEAAmE;AACnE,wEAAwE;AACxE,0EAA0E;AAC1E,wEAAwE;AACxE,uEAAuE;AACvE,EAAE;AACF,0EAA0E;AAC1E,yEAAyE;AACzE,sEAAsE;AACtE,MAAM,2BAA2B,GAA0B,CAAC,SAAS,CAAC,CAAC;AAEvE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IACxE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACrB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC;gBACjB,OAAO,EAAE,wBAAwB,CAAC,CAAC,IAAI,EAAE;aAC1C,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACjB,KAAK,MAAM,MAAM,IAAI,2BAA2B,EAAE,CAAC;YACjD,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9B,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;oBAC3B,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC;oBACjB,OAAO,EACL,cAAc,CAAC,CAAC,IAAI,2BAA2B,MAAM,IAAI;wBACzD,2DAA2D;wBAC3D,uDAAuD;wBACvD,8DAA8D;iBACjE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../../src/schema/hooks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAE5F,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC;IACpC,cAAc;IACd,kBAAkB;IAClB,YAAY;IACZ,aAAa;IACb,MAAM;IACN,cAAc;IACd,YAAY;CACb,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC;IACxC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAChB,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACjB,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC;KACxB,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,eAAe;IACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,QAAQ,EAAE,kBAAkB;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACrD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,yEAAyE;IACzE,wEAAwE;IACxE,qEAAqE;IACrE,mDAAmD;IACnD,+DAA+D;IAC/D,sEAAsE;IACtE,gBAAgB;IAChB,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,KAAK,CAAC,uBAAuB,EAAE,uBAAuB,CAAC;SACvD,QAAQ,EAAE;IACb,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC9D,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,eAAe,KAAK,SAAS,EACrE;IACE,OAAO,EAAE,sDAAsD;IAC/D,IAAI,EAAE,CAAC,iBAAiB,CAAC;CAC1B,CACF,CAAC;AAEJ,mEAAmE;AACnE,wEAAwE;AACxE,0EAA0E;AAC1E,wEAAwE;AACxE,uEAAuE;AACvE,EAAE;AACF,0EAA0E;AAC1E,yEAAyE;AACzE,sEAAsE;AACtE,MAAM,2BAA2B,GAA0B,CAAC,SAAS,CAAC,CAAC;AAEvE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IACxE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACrB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC;gBACjB,OAAO,EAAE,wBAAwB,CAAC,CAAC,IAAI,EAAE;aAC1C,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACjB,KAAK,MAAM,MAAM,IAAI,2BAA2B,EAAE,CAAC;YACjD,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9B,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;oBAC3B,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC;oBACjB,OAAO,EACL,cAAc,CAAC,CAAC,IAAI,2BAA2B,MAAM,IAAI;wBACzD,2DAA2D;wBAC3D,uDAAuD;wBACvD,8DAA8D;iBACjE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/schema/index.d.ts

@@ -883,15 +883,18 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
         description: z.ZodOptional<z.ZodString>;
         config: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        min_version: z.ZodOptional<z.ZodString>;
     }, "strict", z.ZodTypeAny, {
         name: string;
         enabled: boolean;
         source: string;
         config: Record<string, unknown>;
         description?: string | undefined;
+        min_version?: string | undefined;
     }, {
         name: string;
         description?: string | undefined;
+        min_version?: string | undefined;
         enabled?: boolean | undefined;
         source?: string | undefined;
         config?: Record<string, unknown> | undefined;
@@ -901,9 +904,11 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
         source: string;
         config: Record<string, unknown>;
         description?: string | undefined;
+        min_version?: string | undefined;
     }[], {
         name: string;
         description?: string | undefined;
+        min_version?: string | undefined;
         enabled?: boolean | undefined;
         source?: string | undefined;
         config?: Record<string, unknown> | undefined;
@@ -2608,6 +2613,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
         source: string;
         config: Record<string, unknown>;
         description?: string | undefined;
+        min_version?: string | undefined;
     }[];
     risk: {
         classifiers: {
@@ -2900,6 +2906,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
     policy_packs?: {
         name: string;
         description?: string | undefined;
+        min_version?: string | undefined;
         enabled?: boolean | undefined;
         source?: string | undefined;
         config?: Record<string, unknown> | undefined;
@@ -3198,6 +3205,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
         source: string;
         config: Record<string, unknown>;
         description?: string | undefined;
+        min_version?: string | undefined;
     }[];
     risk: {
         classifiers: {
@@ -3490,6 +3498,7 @@ export declare const ManifestSchema: z.ZodEffects<z.ZodObject<{
     policy_packs?: {
         name: string;
         description?: string | undefined;
+        min_version?: string | undefined;
         enabled?: boolean | undefined;
         source?: string | undefined;
         config?: Record<string, unknown> | undefined;

package/dist/schema/memory.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { NUMERIC_VERSION_MESSAGE, NUMERIC_VERSION_PATTERN } from "../io/version-compare.js";
 export const MemoryScopeSchema = z.enum(["project", "user"]);
 export const MemoryDirectorySchema = z
     .object({
@@ -10,7 +11,11 @@ export const MemoryRouterSchema = z
     .object({
     command: z.array(z.string().min(1)).min(1),
     enabled: z.boolean().default(true),
-    min_version: z.string().min(1).optional(),
+    min_version: z
+        .string()
+        .min(1)
+        .regex(NUMERIC_VERSION_PATTERN, NUMERIC_VERSION_MESSAGE)
+        .optional(),
     version_command: z.array(z.string().min(1)).min(1).optional(),
 })
     .strict();

package/dist/schema/memory.js.map

@@ -1 +1 @@
-{"version":3,"file":"memory.js","sourceRoot":"","sources":["../../src/schema/memory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;AAE7D,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,iBAAiB;CACzB,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC9D,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IACxD,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACjE,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC,SAAS,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC;CAChE,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;IAC5C,OAAO,EAAE,4DAA4D;CACtE,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvD,MAAM,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,MAAM,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;CACvC,CAAC;KACD,MAAM,EAAE,CAAC"}
+{"version":3,"file":"memory.js","sourceRoot":"","sources":["../../src/schema/memory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAE5F,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;AAE7D,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,iBAAiB;CACzB,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,KAAK,CAAC,uBAAuB,EAAE,uBAAuB,CAAC;SACvD,QAAQ,EAAE;IACb,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC9D,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IACxD,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACjE,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,OAAO,EAAE,iBAAiB,CAAC,OAAO,CAAC,SAAS,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC;CAChE,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;IAC5C,OAAO,EAAE,4DAA4D;CACtE,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvD,MAAM,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IACrC,SAAS,EAAE,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,MAAM,EAAE,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;CACvC,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/schema/policy-packs.d.ts

@@ -5,15 +5,18 @@ export declare const PolicyPackSchema: z.ZodObject<{
     enabled: z.ZodDefault<z.ZodBoolean>;
     description: z.ZodOptional<z.ZodString>;
     config: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    min_version: z.ZodOptional<z.ZodString>;
 }, "strict", z.ZodTypeAny, {
     name: string;
     enabled: boolean;
     source: string;
     config: Record<string, unknown>;
     description?: string | undefined;
+    min_version?: string | undefined;
 }, {
     name: string;
     description?: string | undefined;
+    min_version?: string | undefined;
     enabled?: boolean | undefined;
     source?: string | undefined;
     config?: Record<string, unknown> | undefined;
@@ -24,15 +27,18 @@ export declare const PolicyPacksSchema: z.ZodEffects<z.ZodArray<z.ZodObject<{
     enabled: z.ZodDefault<z.ZodBoolean>;
     description: z.ZodOptional<z.ZodString>;
     config: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    min_version: z.ZodOptional<z.ZodString>;
 }, "strict", z.ZodTypeAny, {
     name: string;
     enabled: boolean;
     source: string;
     config: Record<string, unknown>;
     description?: string | undefined;
+    min_version?: string | undefined;
 }, {
     name: string;
     description?: string | undefined;
+    min_version?: string | undefined;
     enabled?: boolean | undefined;
     source?: string | undefined;
     config?: Record<string, unknown> | undefined;
@@ -42,9 +48,11 @@ export declare const PolicyPacksSchema: z.ZodEffects<z.ZodArray<z.ZodObject<{
     source: string;
     config: Record<string, unknown>;
     description?: string | undefined;
+    min_version?: string | undefined;
 }[], {
     name: string;
     description?: string | undefined;
+    min_version?: string | undefined;
     enabled?: boolean | undefined;
     source?: string | undefined;
     config?: Record<string, unknown> | undefined;