@lannguyensi/harness 0.64.0 → 1.0.0

package/dist/schema/policies.d.ts

@@ -1,974 +0,0 @@
-import { z } from "zod";
-export declare const PolicyTriggerSchema: z.ZodObject<{
-    event: z.ZodEnum<["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse", "Stop", "SubagentStart", "SubagentStop", "PreCompact"]>;
-    match: z.ZodOptional<z.ZodString>;
-    path_match: z.ZodOptional<z.ZodString>;
-    bash_match: z.ZodOptional<z.ZodString>;
-    input_match: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>>, Record<string, string | number | boolean>, Record<string, string | number | boolean>>>;
-    extract: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodEffects<z.ZodString, string, string>>, Record<string, string>, Record<string, string>>>;
-}, "strict", z.ZodTypeAny, {
-    event: "SessionStart" | "UserPromptSubmit" | "PreToolUse" | "PostToolUse" | "Stop" | "SubagentStart" | "SubagentStop" | "PreCompact";
-    match?: string | undefined;
-    path_match?: string | undefined;
-    bash_match?: string | undefined;
-    extract?: Record<string, string> | undefined;
-    input_match?: Record<string, string | number | boolean> | undefined;
-}, {
-    event: "SessionStart" | "UserPromptSubmit" | "PreToolUse" | "PostToolUse" | "Stop" | "SubagentStart" | "SubagentStop" | "PreCompact";
-    match?: string | undefined;
-    path_match?: string | undefined;
-    bash_match?: string | undefined;
-    extract?: Record<string, string> | undefined;
-    input_match?: Record<string, string | number | boolean> | undefined;
-}>;
-export declare const PolicyEnforcementSchema: z.ZodEnum<["block", "warn", "require_approval"]>;
-export declare const ProducerSchema: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
-    kind: z.ZodLiteral<"bash">;
-    command: z.ZodString;
-    description: z.ZodString;
-}, "strict", z.ZodTypeAny, {
-    command: string;
-    description: string;
-    kind: "bash";
-}, {
-    command: string;
-    description: string;
-    kind: "bash";
-}>, z.ZodObject<{
-    kind: z.ZodLiteral<"mcp">;
-    verb: z.ZodString;
-    example: z.ZodString;
-    description: z.ZodString;
-}, "strict", z.ZodTypeAny, {
-    description: string;
-    kind: "mcp";
-    verb: string;
-    example: string;
-}, {
-    description: string;
-    kind: "mcp";
-    verb: string;
-    example: string;
-}>, z.ZodObject<{
-    kind: z.ZodLiteral<"ask">;
-    command: z.ZodString;
-    description: z.ZodString;
-}, "strict", z.ZodTypeAny, {
-    command: string;
-    description: string;
-    kind: "ask";
-}, {
-    command: string;
-    description: string;
-    kind: "ask";
-}>]>;
-export declare const PolicyUxSchema: z.ZodObject<{
-    cannot: z.ZodString;
-    required: z.ZodArray<z.ZodString, "many">;
-    run: z.ZodArray<z.ZodString, "many">;
-}, "strict", z.ZodTypeAny, {
-    cannot: string;
-    required: string[];
-    run: string[];
-}, {
-    cannot: string;
-    required: string[];
-    run: string[];
-}>;
-export declare const PolicyWhenSchema: z.ZodEffects<z.ZodObject<{
-    "risk.severity_at_least": z.ZodOptional<z.ZodEnum<["low", "medium", "high", "critical"]>>;
-    "risk.category_in": z.ZodOptional<z.ZodArray<z.ZodEnum<["destructive", "data_loss", "production_mutation", "credential_access", "secret_exfiltration", "network_exfiltration", "deployment_change", "infrastructure_change", "privilege_escalation", "irreversible_action", "mass_update"]>, "many">>;
-    "environment.name": z.ZodOptional<z.ZodEnum<["production", "staging", "dev", "local", "unknown"]>>;
-    "action.reversible": z.ZodOptional<z.ZodBoolean>;
-    "action.deletion_target_unresolvable": z.ZodOptional<z.ZodLiteral<true>>;
-}, "strict", z.ZodTypeAny, {
-    "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
-    "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
-    "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
-    "action.reversible"?: boolean | undefined;
-    "action.deletion_target_unresolvable"?: true | undefined;
-}, {
-    "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
-    "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
-    "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
-    "action.reversible"?: boolean | undefined;
-    "action.deletion_target_unresolvable"?: true | undefined;
-}>, {
-    "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
-    "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
-    "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
-    "action.reversible"?: boolean | undefined;
-    "action.deletion_target_unresolvable"?: true | undefined;
-}, {
-    "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
-    "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
-    "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
-    "action.reversible"?: boolean | undefined;
-    "action.deletion_target_unresolvable"?: true | undefined;
-}>;
-export declare const PolicySchema: z.ZodEffects<z.ZodObject<{
-    name: z.ZodString;
-    description: z.ZodString;
-    trigger: z.ZodObject<{
-        event: z.ZodEnum<["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse", "Stop", "SubagentStart", "SubagentStop", "PreCompact"]>;
-        match: z.ZodOptional<z.ZodString>;
-        path_match: z.ZodOptional<z.ZodString>;
-        bash_match: z.ZodOptional<z.ZodString>;
-        input_match: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>>, Record<string, string | number | boolean>, Record<string, string | number | boolean>>>;
-        extract: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodEffects<z.ZodString, string, string>>, Record<string, string>, Record<string, string>>>;
-    }, "strict", z.ZodTypeAny, {
-        event: "SessionStart" | "UserPromptSubmit" | "PreToolUse" | "PostToolUse" | "Stop" | "SubagentStart" | "SubagentStop" | "PreCompact";
-        match?: string | undefined;
-        path_match?: string | undefined;
-        bash_match?: string | undefined;
-        extract?: Record<string, string> | undefined;
-        input_match?: Record<string, string | number | boolean> | undefined;
-    }, {
-        event: "SessionStart" | "UserPromptSubmit" | "PreToolUse" | "PostToolUse" | "Stop" | "SubagentStart" | "SubagentStop" | "PreCompact";
-        match?: string | undefined;
-        path_match?: string | undefined;
-        bash_match?: string | undefined;
-        extract?: Record<string, string> | undefined;
-        input_match?: Record<string, string | number | boolean> | undefined;
-    }>;
-    requires: z.ZodOptional<z.ZodObject<{
-        ledger_tag: z.ZodString;
-        within: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-        count: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodObject<{
-            min: z.ZodOptional<z.ZodNumber>;
-            max: z.ZodOptional<z.ZodNumber>;
-            exact: z.ZodOptional<z.ZodNumber>;
-        }, "strict", z.ZodTypeAny, {
-            exact?: number | undefined;
-            min?: number | undefined;
-            max?: number | undefined;
-        }, {
-            exact?: number | undefined;
-            min?: number | undefined;
-            max?: number | undefined;
-        }>, {
-            exact?: number | undefined;
-            min?: number | undefined;
-            max?: number | undefined;
-        }, {
-            exact?: number | undefined;
-            min?: number | undefined;
-            max?: number | undefined;
-        }>, {
-            exact?: number | undefined;
-            min?: number | undefined;
-            max?: number | undefined;
-        }, {
-            exact?: number | undefined;
-            min?: number | undefined;
-            max?: number | undefined;
-        }>, {
-            exact?: number | undefined;
-            min?: number | undefined;
-            max?: number | undefined;
-        }, {
-            exact?: number | undefined;
-            min?: number | undefined;
-            max?: number | undefined;
-        }>, {
-            exact?: number | undefined;
-            min?: number | undefined;
-            max?: number | undefined;
-        }, {
-            exact?: number | undefined;
-            min?: number | undefined;
-            max?: number | undefined;
-        }>>;
-        at_head: z.ZodOptional<z.ZodBoolean>;
-    }, "strict", z.ZodTypeAny, {
-        ledger_tag: string;
-        within?: string | undefined;
-        count?: {
-            exact?: number | undefined;
-            min?: number | undefined;
-            max?: number | undefined;
-        } | undefined;
-        at_head?: boolean | undefined;
-    }, {
-        ledger_tag: string;
-        within?: string | undefined;
-        count?: {
-            exact?: number | undefined;
-            min?: number | undefined;
-            max?: number | undefined;
-        } | undefined;
-        at_head?: boolean | undefined;
-    }>>;
-    hook: z.ZodString;
-    enforcement: z.ZodEnum<["block", "warn", "require_approval"]>;
-    operator_only: z.ZodOptional<z.ZodBoolean>;
-    producers: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
-        kind: z.ZodLiteral<"bash">;
-        command: z.ZodString;
-        description: z.ZodString;
-    }, "strict", z.ZodTypeAny, {
-        command: string;
-        description: string;
-        kind: "bash";
-    }, {
-        command: string;
-        description: string;
-        kind: "bash";
-    }>, z.ZodObject<{
-        kind: z.ZodLiteral<"mcp">;
-        verb: z.ZodString;
-        example: z.ZodString;
-        description: z.ZodString;
-    }, "strict", z.ZodTypeAny, {
-        description: string;
-        kind: "mcp";
-        verb: string;
-        example: string;
-    }, {
-        description: string;
-        kind: "mcp";
-        verb: string;
-        example: string;
-    }>, z.ZodObject<{
-        kind: z.ZodLiteral<"ask">;
-        command: z.ZodString;
-        description: z.ZodString;
-    }, "strict", z.ZodTypeAny, {
-        command: string;
-        description: string;
-        kind: "ask";
-    }, {
-        command: string;
-        description: string;
-        kind: "ask";
-    }>]>, "many">>;
-    ux: z.ZodOptional<z.ZodObject<{
-        cannot: z.ZodString;
-        required: z.ZodArray<z.ZodString, "many">;
-        run: z.ZodArray<z.ZodString, "many">;
-    }, "strict", z.ZodTypeAny, {
-        cannot: string;
-        required: string[];
-        run: string[];
-    }, {
-        cannot: string;
-        required: string[];
-        run: string[];
-    }>>;
-    when: z.ZodOptional<z.ZodEffects<z.ZodObject<{
-        "risk.severity_at_least": z.ZodOptional<z.ZodEnum<["low", "medium", "high", "critical"]>>;
-        "risk.category_in": z.ZodOptional<z.ZodArray<z.ZodEnum<["destructive", "data_loss", "production_mutation", "credential_access", "secret_exfiltration", "network_exfiltration", "deployment_change", "infrastructure_change", "privilege_escalation", "irreversible_action", "mass_update"]>, "many">>;
-        "environment.name": z.ZodOptional<z.ZodEnum<["production", "staging", "dev", "local", "unknown"]>>;
-        "action.reversible": z.ZodOptional<z.ZodBoolean>;
-        "action.deletion_target_unresolvable": z.ZodOptional<z.ZodLiteral<true>>;
-    }, "strict", z.ZodTypeAny, {
-        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
-        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
-        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
-        "action.reversible"?: boolean | undefined;
-        "action.deletion_target_unresolvable"?: true | undefined;
-    }, {
-        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
-        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
-        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
-        "action.reversible"?: boolean | undefined;
-        "action.deletion_target_unresolvable"?: true | undefined;
-    }>, {
-        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
-        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
-        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
-        "action.reversible"?: boolean | undefined;
-        "action.deletion_target_unresolvable"?: true | undefined;
-    }, {
-        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
-        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
-        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
-        "action.reversible"?: boolean | undefined;
-        "action.deletion_target_unresolvable"?: true | undefined;
-    }>>;
-}, "strict", z.ZodTypeAny, {
-    name: string;
-    description: string;
-    trigger: {
-        event: "SessionStart" | "UserPromptSubmit" | "PreToolUse" | "PostToolUse" | "Stop" | "SubagentStart" | "SubagentStop" | "PreCompact";
-        match?: string | undefined;
-        path_match?: string | undefined;
-        bash_match?: string | undefined;
-        extract?: Record<string, string> | undefined;
-        input_match?: Record<string, string | number | boolean> | undefined;
-    };
-    hook: string;
-    enforcement: "warn" | "block" | "require_approval";
-    requires?: {
-        ledger_tag: string;
-        within?: string | undefined;
-        count?: {
-            exact?: number | undefined;
-            min?: number | undefined;
-            max?: number | undefined;
-        } | undefined;
-        at_head?: boolean | undefined;
-    } | undefined;
-    operator_only?: boolean | undefined;
-    producers?: ({
-        command: string;
-        description: string;
-        kind: "bash";
-    } | {
-        description: string;
-        kind: "mcp";
-        verb: string;
-        example: string;
-    } | {
-        command: string;
-        description: string;
-        kind: "ask";
-    })[] | undefined;
-    ux?: {
-        cannot: string;
-        required: string[];
-        run: string[];
-    } | undefined;
-    when?: {
-        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
-        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
-        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
-        "action.reversible"?: boolean | undefined;
-        "action.deletion_target_unresolvable"?: true | undefined;
-    } | undefined;
-}, {
-    name: string;
-    description: string;
-    trigger: {
-        event: "SessionStart" | "UserPromptSubmit" | "PreToolUse" | "PostToolUse" | "Stop" | "SubagentStart" | "SubagentStop" | "PreCompact";
-        match?: string | undefined;
-        path_match?: string | undefined;
-        bash_match?: string | undefined;
-        extract?: Record<string, string> | undefined;
-        input_match?: Record<string, string | number | boolean> | undefined;
-    };
-    hook: string;
-    enforcement: "warn" | "block" | "require_approval";
-    requires?: {
-        ledger_tag: string;
-        within?: string | undefined;
-        count?: {
-            exact?: number | undefined;
-            min?: number | undefined;
-            max?: number | undefined;
-        } | undefined;
-        at_head?: boolean | undefined;
-    } | undefined;
-    operator_only?: boolean | undefined;
-    producers?: ({
-        command: string;
-        description: string;
-        kind: "bash";
-    } | {
-        description: string;
-        kind: "mcp";
-        verb: string;
-        example: string;
-    } | {
-        command: string;
-        description: string;
-        kind: "ask";
-    })[] | undefined;
-    ux?: {
-        cannot: string;
-        required: string[];
-        run: string[];
-    } | undefined;
-    when?: {
-        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
-        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
-        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
-        "action.reversible"?: boolean | undefined;
-        "action.deletion_target_unresolvable"?: true | undefined;
-    } | undefined;
-}>, {
-    name: string;
-    description: string;
-    trigger: {
-        event: "SessionStart" | "UserPromptSubmit" | "PreToolUse" | "PostToolUse" | "Stop" | "SubagentStart" | "SubagentStop" | "PreCompact";
-        match?: string | undefined;
-        path_match?: string | undefined;
-        bash_match?: string | undefined;
-        extract?: Record<string, string> | undefined;
-        input_match?: Record<string, string | number | boolean> | undefined;
-    };
-    hook: string;
-    enforcement: "warn" | "block" | "require_approval";
-    requires?: {
-        ledger_tag: string;
-        within?: string | undefined;
-        count?: {
-            exact?: number | undefined;
-            min?: number | undefined;
-            max?: number | undefined;
-        } | undefined;
-        at_head?: boolean | undefined;
-    } | undefined;
-    operator_only?: boolean | undefined;
-    producers?: ({
-        command: string;
-        description: string;
-        kind: "bash";
-    } | {
-        description: string;
-        kind: "mcp";
-        verb: string;
-        example: string;
-    } | {
-        command: string;
-        description: string;
-        kind: "ask";
-    })[] | undefined;
-    ux?: {
-        cannot: string;
-        required: string[];
-        run: string[];
-    } | undefined;
-    when?: {
-        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
-        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
-        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
-        "action.reversible"?: boolean | undefined;
-        "action.deletion_target_unresolvable"?: true | undefined;
-    } | undefined;
-}, {
-    name: string;
-    description: string;
-    trigger: {
-        event: "SessionStart" | "UserPromptSubmit" | "PreToolUse" | "PostToolUse" | "Stop" | "SubagentStart" | "SubagentStop" | "PreCompact";
-        match?: string | undefined;
-        path_match?: string | undefined;
-        bash_match?: string | undefined;
-        extract?: Record<string, string> | undefined;
-        input_match?: Record<string, string | number | boolean> | undefined;
-    };
-    hook: string;
-    enforcement: "warn" | "block" | "require_approval";
-    requires?: {
-        ledger_tag: string;
-        within?: string | undefined;
-        count?: {
-            exact?: number | undefined;
-            min?: number | undefined;
-            max?: number | undefined;
-        } | undefined;
-        at_head?: boolean | undefined;
-    } | undefined;
-    operator_only?: boolean | undefined;
-    producers?: ({
-        command: string;
-        description: string;
-        kind: "bash";
-    } | {
-        description: string;
-        kind: "mcp";
-        verb: string;
-        example: string;
-    } | {
-        command: string;
-        description: string;
-        kind: "ask";
-    })[] | undefined;
-    ux?: {
-        cannot: string;
-        required: string[];
-        run: string[];
-    } | undefined;
-    when?: {
-        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
-        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
-        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
-        "action.reversible"?: boolean | undefined;
-        "action.deletion_target_unresolvable"?: true | undefined;
-    } | undefined;
-}>;
-export declare const PoliciesSchema: z.ZodEffects<z.ZodArray<z.ZodEffects<z.ZodObject<{
-    name: z.ZodString;
-    description: z.ZodString;
-    trigger: z.ZodObject<{
-        event: z.ZodEnum<["SessionStart", "UserPromptSubmit", "PreToolUse", "PostToolUse", "Stop", "SubagentStart", "SubagentStop", "PreCompact"]>;
-        match: z.ZodOptional<z.ZodString>;
-        path_match: z.ZodOptional<z.ZodString>;
-        bash_match: z.ZodOptional<z.ZodString>;
-        input_match: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>>, Record<string, string | number | boolean>, Record<string, string | number | boolean>>>;
-        extract: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodEffects<z.ZodString, string, string>>, Record<string, string>, Record<string, string>>>;
-    }, "strict", z.ZodTypeAny, {
-        event: "SessionStart" | "UserPromptSubmit" | "PreToolUse" | "PostToolUse" | "Stop" | "SubagentStart" | "SubagentStop" | "PreCompact";
-        match?: string | undefined;
-        path_match?: string | undefined;
-        bash_match?: string | undefined;
-        extract?: Record<string, string> | undefined;
-        input_match?: Record<string, string | number | boolean> | undefined;
-    }, {
-        event: "SessionStart" | "UserPromptSubmit" | "PreToolUse" | "PostToolUse" | "Stop" | "SubagentStart" | "SubagentStop" | "PreCompact";
-        match?: string | undefined;
-        path_match?: string | undefined;
-        bash_match?: string | undefined;
-        extract?: Record<string, string> | undefined;
-        input_match?: Record<string, string | number | boolean> | undefined;
-    }>;
-    requires: z.ZodOptional<z.ZodObject<{
-        ledger_tag: z.ZodString;
-        within: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
-        count: z.ZodOptional<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodEffects<z.ZodObject<{
-            min: z.ZodOptional<z.ZodNumber>;
-            max: z.ZodOptional<z.ZodNumber>;
-            exact: z.ZodOptional<z.ZodNumber>;
-        }, "strict", z.ZodTypeAny, {
-            exact?: number | undefined;
-            min?: number | undefined;
-            max?: number | undefined;
-        }, {
-            exact?: number | undefined;
-            min?: number | undefined;
-            max?: number | undefined;
-        }>, {
-            exact?: number | undefined;
-            min?: number | undefined;
-            max?: number | undefined;
-        }, {
-            exact?: number | undefined;
-            min?: number | undefined;
-            max?: number | undefined;
-        }>, {
-            exact?: number | undefined;
-            min?: number | undefined;
-            max?: number | undefined;
-        }, {
-            exact?: number | undefined;
-            min?: number | undefined;
-            max?: number | undefined;
-        }>, {
-            exact?: number | undefined;
-            min?: number | undefined;
-            max?: number | undefined;
-        }, {
-            exact?: number | undefined;
-            min?: number | undefined;
-            max?: number | undefined;
-        }>, {
-            exact?: number | undefined;
-            min?: number | undefined;
-            max?: number | undefined;
-        }, {
-            exact?: number | undefined;
-            min?: number | undefined;
-            max?: number | undefined;
-        }>>;
-        at_head: z.ZodOptional<z.ZodBoolean>;
-    }, "strict", z.ZodTypeAny, {
-        ledger_tag: string;
-        within?: string | undefined;
-        count?: {
-            exact?: number | undefined;
-            min?: number | undefined;
-            max?: number | undefined;
-        } | undefined;
-        at_head?: boolean | undefined;
-    }, {
-        ledger_tag: string;
-        within?: string | undefined;
-        count?: {
-            exact?: number | undefined;
-            min?: number | undefined;
-            max?: number | undefined;
-        } | undefined;
-        at_head?: boolean | undefined;
-    }>>;
-    hook: z.ZodString;
-    enforcement: z.ZodEnum<["block", "warn", "require_approval"]>;
-    operator_only: z.ZodOptional<z.ZodBoolean>;
-    producers: z.ZodOptional<z.ZodArray<z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
-        kind: z.ZodLiteral<"bash">;
-        command: z.ZodString;
-        description: z.ZodString;
-    }, "strict", z.ZodTypeAny, {
-        command: string;
-        description: string;
-        kind: "bash";
-    }, {
-        command: string;
-        description: string;
-        kind: "bash";
-    }>, z.ZodObject<{
-        kind: z.ZodLiteral<"mcp">;
-        verb: z.ZodString;
-        example: z.ZodString;
-        description: z.ZodString;
-    }, "strict", z.ZodTypeAny, {
-        description: string;
-        kind: "mcp";
-        verb: string;
-        example: string;
-    }, {
-        description: string;
-        kind: "mcp";
-        verb: string;
-        example: string;
-    }>, z.ZodObject<{
-        kind: z.ZodLiteral<"ask">;
-        command: z.ZodString;
-        description: z.ZodString;
-    }, "strict", z.ZodTypeAny, {
-        command: string;
-        description: string;
-        kind: "ask";
-    }, {
-        command: string;
-        description: string;
-        kind: "ask";
-    }>]>, "many">>;
-    ux: z.ZodOptional<z.ZodObject<{
-        cannot: z.ZodString;
-        required: z.ZodArray<z.ZodString, "many">;
-        run: z.ZodArray<z.ZodString, "many">;
-    }, "strict", z.ZodTypeAny, {
-        cannot: string;
-        required: string[];
-        run: string[];
-    }, {
-        cannot: string;
-        required: string[];
-        run: string[];
-    }>>;
-    when: z.ZodOptional<z.ZodEffects<z.ZodObject<{
-        "risk.severity_at_least": z.ZodOptional<z.ZodEnum<["low", "medium", "high", "critical"]>>;
-        "risk.category_in": z.ZodOptional<z.ZodArray<z.ZodEnum<["destructive", "data_loss", "production_mutation", "credential_access", "secret_exfiltration", "network_exfiltration", "deployment_change", "infrastructure_change", "privilege_escalation", "irreversible_action", "mass_update"]>, "many">>;
-        "environment.name": z.ZodOptional<z.ZodEnum<["production", "staging", "dev", "local", "unknown"]>>;
-        "action.reversible": z.ZodOptional<z.ZodBoolean>;
-        "action.deletion_target_unresolvable": z.ZodOptional<z.ZodLiteral<true>>;
-    }, "strict", z.ZodTypeAny, {
-        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
-        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
-        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
-        "action.reversible"?: boolean | undefined;
-        "action.deletion_target_unresolvable"?: true | undefined;
-    }, {
-        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
-        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
-        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
-        "action.reversible"?: boolean | undefined;
-        "action.deletion_target_unresolvable"?: true | undefined;
-    }>, {
-        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
-        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
-        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
-        "action.reversible"?: boolean | undefined;
-        "action.deletion_target_unresolvable"?: true | undefined;
-    }, {
-        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
-        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
-        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
-        "action.reversible"?: boolean | undefined;
-        "action.deletion_target_unresolvable"?: true | undefined;
-    }>>;
-}, "strict", z.ZodTypeAny, {
-    name: string;
-    description: string;
-    trigger: {
-        event: "SessionStart" | "UserPromptSubmit" | "PreToolUse" | "PostToolUse" | "Stop" | "SubagentStart" | "SubagentStop" | "PreCompact";
-        match?: string | undefined;
-        path_match?: string | undefined;
-        bash_match?: string | undefined;
-        extract?: Record<string, string> | undefined;
-        input_match?: Record<string, string | number | boolean> | undefined;
-    };
-    hook: string;
-    enforcement: "warn" | "block" | "require_approval";
-    requires?: {
-        ledger_tag: string;
-        within?: string | undefined;
-        count?: {
-            exact?: number | undefined;
-            min?: number | undefined;
-            max?: number | undefined;
-        } | undefined;
-        at_head?: boolean | undefined;
-    } | undefined;
-    operator_only?: boolean | undefined;
-    producers?: ({
-        command: string;
-        description: string;
-        kind: "bash";
-    } | {
-        description: string;
-        kind: "mcp";
-        verb: string;
-        example: string;
-    } | {
-        command: string;
-        description: string;
-        kind: "ask";
-    })[] | undefined;
-    ux?: {
-        cannot: string;
-        required: string[];
-        run: string[];
-    } | undefined;
-    when?: {
-        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
-        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
-        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
-        "action.reversible"?: boolean | undefined;
-        "action.deletion_target_unresolvable"?: true | undefined;
-    } | undefined;
-}, {
-    name: string;
-    description: string;
-    trigger: {
-        event: "SessionStart" | "UserPromptSubmit" | "PreToolUse" | "PostToolUse" | "Stop" | "SubagentStart" | "SubagentStop" | "PreCompact";
-        match?: string | undefined;
-        path_match?: string | undefined;
-        bash_match?: string | undefined;
-        extract?: Record<string, string> | undefined;
-        input_match?: Record<string, string | number | boolean> | undefined;
-    };
-    hook: string;
-    enforcement: "warn" | "block" | "require_approval";
-    requires?: {
-        ledger_tag: string;
-        within?: string | undefined;
-        count?: {
-            exact?: number | undefined;
-            min?: number | undefined;
-            max?: number | undefined;
-        } | undefined;
-        at_head?: boolean | undefined;
-    } | undefined;
-    operator_only?: boolean | undefined;
-    producers?: ({
-        command: string;
-        description: string;
-        kind: "bash";
-    } | {
-        description: string;
-        kind: "mcp";
-        verb: string;
-        example: string;
-    } | {
-        command: string;
-        description: string;
-        kind: "ask";
-    })[] | undefined;
-    ux?: {
-        cannot: string;
-        required: string[];
-        run: string[];
-    } | undefined;
-    when?: {
-        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
-        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
-        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
-        "action.reversible"?: boolean | undefined;
-        "action.deletion_target_unresolvable"?: true | undefined;
-    } | undefined;
-}>, {
-    name: string;
-    description: string;
-    trigger: {
-        event: "SessionStart" | "UserPromptSubmit" | "PreToolUse" | "PostToolUse" | "Stop" | "SubagentStart" | "SubagentStop" | "PreCompact";
-        match?: string | undefined;
-        path_match?: string | undefined;
-        bash_match?: string | undefined;
-        extract?: Record<string, string> | undefined;
-        input_match?: Record<string, string | number | boolean> | undefined;
-    };
-    hook: string;
-    enforcement: "warn" | "block" | "require_approval";
-    requires?: {
-        ledger_tag: string;
-        within?: string | undefined;
-        count?: {
-            exact?: number | undefined;
-            min?: number | undefined;
-            max?: number | undefined;
-        } | undefined;
-        at_head?: boolean | undefined;
-    } | undefined;
-    operator_only?: boolean | undefined;
-    producers?: ({
-        command: string;
-        description: string;
-        kind: "bash";
-    } | {
-        description: string;
-        kind: "mcp";
-        verb: string;
-        example: string;
-    } | {
-        command: string;
-        description: string;
-        kind: "ask";
-    })[] | undefined;
-    ux?: {
-        cannot: string;
-        required: string[];
-        run: string[];
-    } | undefined;
-    when?: {
-        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
-        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
-        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
-        "action.reversible"?: boolean | undefined;
-        "action.deletion_target_unresolvable"?: true | undefined;
-    } | undefined;
-}, {
-    name: string;
-    description: string;
-    trigger: {
-        event: "SessionStart" | "UserPromptSubmit" | "PreToolUse" | "PostToolUse" | "Stop" | "SubagentStart" | "SubagentStop" | "PreCompact";
-        match?: string | undefined;
-        path_match?: string | undefined;
-        bash_match?: string | undefined;
-        extract?: Record<string, string> | undefined;
-        input_match?: Record<string, string | number | boolean> | undefined;
-    };
-    hook: string;
-    enforcement: "warn" | "block" | "require_approval";
-    requires?: {
-        ledger_tag: string;
-        within?: string | undefined;
-        count?: {
-            exact?: number | undefined;
-            min?: number | undefined;
-            max?: number | undefined;
-        } | undefined;
-        at_head?: boolean | undefined;
-    } | undefined;
-    operator_only?: boolean | undefined;
-    producers?: ({
-        command: string;
-        description: string;
-        kind: "bash";
-    } | {
-        description: string;
-        kind: "mcp";
-        verb: string;
-        example: string;
-    } | {
-        command: string;
-        description: string;
-        kind: "ask";
-    })[] | undefined;
-    ux?: {
-        cannot: string;
-        required: string[];
-        run: string[];
-    } | undefined;
-    when?: {
-        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
-        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
-        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
-        "action.reversible"?: boolean | undefined;
-        "action.deletion_target_unresolvable"?: true | undefined;
-    } | undefined;
-}>, "many">, {
-    name: string;
-    description: string;
-    trigger: {
-        event: "SessionStart" | "UserPromptSubmit" | "PreToolUse" | "PostToolUse" | "Stop" | "SubagentStart" | "SubagentStop" | "PreCompact";
-        match?: string | undefined;
-        path_match?: string | undefined;
-        bash_match?: string | undefined;
-        extract?: Record<string, string> | undefined;
-        input_match?: Record<string, string | number | boolean> | undefined;
-    };
-    hook: string;
-    enforcement: "warn" | "block" | "require_approval";
-    requires?: {
-        ledger_tag: string;
-        within?: string | undefined;
-        count?: {
-            exact?: number | undefined;
-            min?: number | undefined;
-            max?: number | undefined;
-        } | undefined;
-        at_head?: boolean | undefined;
-    } | undefined;
-    operator_only?: boolean | undefined;
-    producers?: ({
-        command: string;
-        description: string;
-        kind: "bash";
-    } | {
-        description: string;
-        kind: "mcp";
-        verb: string;
-        example: string;
-    } | {
-        command: string;
-        description: string;
-        kind: "ask";
-    })[] | undefined;
-    ux?: {
-        cannot: string;
-        required: string[];
-        run: string[];
-    } | undefined;
-    when?: {
-        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
-        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
-        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
-        "action.reversible"?: boolean | undefined;
-        "action.deletion_target_unresolvable"?: true | undefined;
-    } | undefined;
-}[], {
-    name: string;
-    description: string;
-    trigger: {
-        event: "SessionStart" | "UserPromptSubmit" | "PreToolUse" | "PostToolUse" | "Stop" | "SubagentStart" | "SubagentStop" | "PreCompact";
-        match?: string | undefined;
-        path_match?: string | undefined;
-        bash_match?: string | undefined;
-        extract?: Record<string, string> | undefined;
-        input_match?: Record<string, string | number | boolean> | undefined;
-    };
-    hook: string;
-    enforcement: "warn" | "block" | "require_approval";
-    requires?: {
-        ledger_tag: string;
-        within?: string | undefined;
-        count?: {
-            exact?: number | undefined;
-            min?: number | undefined;
-            max?: number | undefined;
-        } | undefined;
-        at_head?: boolean | undefined;
-    } | undefined;
-    operator_only?: boolean | undefined;
-    producers?: ({
-        command: string;
-        description: string;
-        kind: "bash";
-    } | {
-        description: string;
-        kind: "mcp";
-        verb: string;
-        example: string;
-    } | {
-        command: string;
-        description: string;
-        kind: "ask";
-    })[] | undefined;
-    ux?: {
-        cannot: string;
-        required: string[];
-        run: string[];
-    } | undefined;
-    when?: {
-        "risk.severity_at_least"?: "low" | "medium" | "high" | "critical" | undefined;
-        "risk.category_in"?: ("destructive" | "data_loss" | "production_mutation" | "credential_access" | "secret_exfiltration" | "network_exfiltration" | "deployment_change" | "infrastructure_change" | "privilege_escalation" | "irreversible_action" | "mass_update")[] | undefined;
-        "environment.name"?: "production" | "staging" | "dev" | "local" | "unknown" | undefined;
-        "action.reversible"?: boolean | undefined;
-        "action.deletion_target_unresolvable"?: true | undefined;
-    } | undefined;
-}[]>;
-export type Policy = z.infer<typeof PolicySchema>;
-export type Producer = z.infer<typeof ProducerSchema>;
-export type PolicyUx = z.infer<typeof PolicyUxSchema>;
-export type PolicyWhen = z.infer<typeof PolicyWhenSchema>;