@vibesdotdev/security 0.0.0-stage → 1.0.0-rc.5

package/dist/schemas/contracts/card.js

@@ -0,0 +1,73 @@
+import * as z from 'zod/v4';
+import { PolicyOutcomeSchema } from "./policy.js";
+export const SECURITY_TOOL_IDS = [
+    'security.check-policy',
+    'security.redact-output',
+    'security.report-event',
+    'security.scan-input',
+];
+export const SecurityToolIdSchema = z.enum(SECURITY_TOOL_IDS);
+export const SecurityToolCardToneSchema = z.enum(['default', 'success', 'danger', 'warning', 'muted']);
+export const SecurityToolThreatSchema = z.object({ severity: z.string(), kind: z.string(), description: z.string() });
+export const SecurityToolCardRowSchema = z.object({ label: z.string(), value: z.string(), tone: SecurityToolCardToneSchema });
+export const SecurityToolCardModelSchema = z.object({
+    toolId: z.string(), title: z.string(), icon: z.string(), policyName: z.string().nullable(),
+    decision: PolicyOutcomeSchema.nullable(), decisionLabel: z.string().nullable(),
+    eventType: z.string().nullable(), recorded: z.boolean().nullable(), eventId: z.string().nullable(),
+    actor: z.string().nullable(), resource: z.string().nullable(), reason: z.string().nullable(),
+    error: z.string().nullable(), available: z.boolean().nullable(), availabilityLabel: z.string().nullable(),
+    threats: z.array(SecurityToolThreatSchema), matchCount: z.number().nullable(), redactedPreview: z.string().nullable(), defaultOpen: z.boolean()
+});
+const NonBlank = z.string().refine((s) => s.trim().length > 0);
+export const StringField = NonBlank.optional().catch(undefined);
+const DecisionField = z.enum(['allow', 'deny', 'review']).optional().catch(undefined);
+const BooleanField = z.boolean().optional().catch(undefined);
+const MatchesField = z.array(z.unknown()).optional().catch(undefined);
+const SingleThreatSchema = z.object({
+    kind: NonBlank,
+    severity: NonBlank.optional().catch(undefined),
+    description: NonBlank.optional().catch(undefined),
+}).passthrough();
+const ThreatsField = z.array(z.unknown()).optional().catch(undefined).transform((raw) => {
+    if (!Array.isArray(raw))
+        return [];
+    const threats = [];
+    for (const entry of raw) {
+        const parsed = SingleThreatSchema.safeParse(entry);
+        if (parsed.success) {
+            const item = parsed.data;
+            threats.push({
+                severity: item.severity ?? 'low',
+                kind: item.kind,
+                description: item.description ?? item.kind,
+            });
+        }
+    }
+    return threats;
+});
+const CardEventSchema = z.object({
+    id: StringField,
+    action: StringField,
+    actor: StringField,
+    resource: StringField,
+    outcome: DecisionField,
+}).passthrough().optional().catch(undefined);
+export const CardArgsSchema = z.object({
+    policyId: StringField,
+    event: CardEventSchema,
+}).passthrough().optional().catch(undefined);
+export const CardOutputSchema = z.object({
+    policyId: StringField,
+    outcome: DecisionField,
+    recorded: BooleanField,
+    eventId: StringField,
+    reason: StringField,
+    error: StringField,
+    engineAvailable: BooleanField,
+    scannerAvailable: BooleanField,
+    redactorAvailable: BooleanField,
+    threats: ThreatsField,
+    matches: MatchesField,
+    redacted: StringField,
+}).passthrough().optional().catch(undefined);
+//# sourceMappingURL=card.js.map

package/dist/schemas/contracts/card.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"card.js","sourceRoot":"","sources":["../../../src/schemas/contracts/card.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC7B,uBAAuB;IACvB,wBAAwB;IACxB,uBAAuB;IACvB,qBAAqB;CACf,CAAC;AACX,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;AAG9D,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;AAEvG,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAEtH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC,CAAC;AAE9H,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1F,QAAQ,EAAE,mBAAmB,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClG,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5F,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzG,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;CAClJ,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC/D,MAAM,CAAC,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AAChE,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AACtF,MAAM,YAAY,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AAC7D,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AACtE,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,QAAQ;IACd,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IAC9C,WAAW,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;CACpD,CAAC,CAAC,WAAW,EAAE,CAAC;AACjB,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,EAAwB,EAAE;IAC1G,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QACnB,OAAO,EAAE,CAAC;IACd,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,KAAK;gBAChC,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI;aAC7C,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC,CAAC,CAAC;AACH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,EAAE,EAAE,WAAW;IACf,MAAM,EAAE,WAAW;IACnB,KAAK,EAAE,WAAW;IAClB,QAAQ,EAAE,WAAW;IACrB,OAAO,EAAE,aAAa;CACzB,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AAC7C,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,QAAQ,EAAE,WAAW;IACrB,KAAK,EAAE,eAAe;CACzB,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AAC7C,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,QAAQ,EAAE,WAAW;IACrB,OAAO,EAAE,aAAa;IACtB,QAAQ,EAAE,YAAY;IACtB,OAAO,EAAE,WAAW;IACpB,MAAM,EAAE,WAAW;IACnB,KAAK,EAAE,WAAW;IAClB,eAAe,EAAE,YAAY;IAC7B,gBAAgB,EAAE,YAAY;IAC9B,iBAAiB,EAAE,YAAY;IAC/B,OAAO,EAAE,YAAY;IACrB,OAAO,EAAE,YAAY;IACrB,QAAQ,EAAE,WAAW;CACxB,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC"}

package/dist/schemas/contracts/dep-scanner.d.ts

@@ -0,0 +1,91 @@
+import * as z from 'zod/v4';
+export declare const IOCEntrySchema: z.ZodObject<{
+    packageName: z.ZodString;
+    versionRange: z.ZodString;
+    cve: z.ZodOptional<z.ZodString>;
+    severity: z.ZodEnum<{
+        low: "low";
+        medium: "medium";
+        high: "high";
+        critical: "critical";
+    }>;
+    source: z.ZodString;
+    reportedAt: z.ZodString;
+}, z.core.$strip>;
+export type IOCEntry = z.infer<typeof IOCEntrySchema>;
+export declare const DepScanReportSchema: z.ZodObject<{
+    verdict: z.ZodEnum<{
+        unknown: "unknown";
+        clean: "clean";
+        compromised: "compromised";
+    }>;
+    findings: z.ZodArray<z.ZodObject<{
+        packageName: z.ZodString;
+        versionRange: z.ZodString;
+        cve: z.ZodOptional<z.ZodString>;
+        severity: z.ZodEnum<{
+            low: "low";
+            medium: "medium";
+            high: "high";
+            critical: "critical";
+        }>;
+        source: z.ZodString;
+        reportedAt: z.ZodString;
+    }, z.core.$strip>>;
+    scannedAt: z.ZodString;
+    packagesChecked: z.ZodNumber;
+    scannerAvailable: z.ZodBoolean;
+}, z.core.$strip>;
+export type DepScanReport = z.infer<typeof DepScanReportSchema>;
+export declare const DepScannerDescriptorSchema: z.ZodObject<{
+    id: z.ZodString;
+    kind: z.ZodLiteral<"security/dep-scanner">;
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    hardware: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        consumer: "consumer";
+        cloud: "cloud";
+    }>>>;
+}, z.core.$strip>;
+export type DepScannerDescriptor = z.output<typeof DepScannerDescriptorSchema>;
+export declare const DepScannerServiceSchema: z.ZodObject<{
+    descriptor: z.ZodObject<{
+        id: z.ZodString;
+        kind: z.ZodLiteral<"security/dep-scanner">;
+        name: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        hardware: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+            consumer: "consumer";
+            cloud: "cloud";
+        }>>>;
+    }, z.core.$strip>;
+    scan: z.ZodFunction<z.ZodTuple<readonly [z.ZodString], null>, z.ZodPromise<z.ZodObject<{
+        verdict: z.ZodEnum<{
+            unknown: "unknown";
+            clean: "clean";
+            compromised: "compromised";
+        }>;
+        findings: z.ZodArray<z.ZodObject<{
+            packageName: z.ZodString;
+            versionRange: z.ZodString;
+            cve: z.ZodOptional<z.ZodString>;
+            severity: z.ZodEnum<{
+                low: "low";
+                medium: "medium";
+                high: "high";
+                critical: "critical";
+            }>;
+            source: z.ZodString;
+            reportedAt: z.ZodString;
+        }, z.core.$strip>>;
+        scannedAt: z.ZodString;
+        packagesChecked: z.ZodNumber;
+        scannerAvailable: z.ZodBoolean;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type DepScannerService = z.infer<typeof DepScannerServiceSchema>;
+//# sourceMappingURL=dep-scanner.d.ts.map

package/dist/schemas/contracts/dep-scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dep-scanner.d.ts","sourceRoot":"","sources":["../../../src/schemas/contracts/dep-scanner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,eAAO,MAAM,cAAc;;;;;;;;;;;;iBAOzB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AACtD,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;iBAM9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,eAAO,MAAM,0BAA0B;;;;;;;;;;;iBAQrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC/E,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAA0I,CAAC;AAC/K,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC"}

package/dist/schemas/contracts/dep-scanner.js

@@ -0,0 +1,27 @@
+import * as z from 'zod/v4';
+export const IOCEntrySchema = z.object({
+    packageName: z.string(),
+    versionRange: z.string(),
+    cve: z.string().optional(),
+    severity: z.enum(['low', 'medium', 'high', 'critical']),
+    source: z.string(),
+    reportedAt: z.string().datetime(),
+});
+export const DepScanReportSchema = z.object({
+    verdict: z.enum(['clean', 'compromised', 'unknown']),
+    findings: z.array(IOCEntrySchema),
+    scannedAt: z.string().datetime(),
+    packagesChecked: z.number(),
+    scannerAvailable: z.boolean().describe('Whether a real scanner is registered (if false, verdict is from the default stub)'),
+});
+export const DepScannerDescriptorSchema = z.object({
+    id: z.string(),
+    kind: z.literal('security/dep-scanner'),
+    name: z.string(),
+    description: z.string().optional(),
+    enabled: z.boolean().optional(),
+    tags: z.array(z.string()).optional(),
+    hardware: z.array(z.enum(['consumer', 'cloud'])).optional(),
+});
+export const DepScannerServiceSchema = z.object({ descriptor: DepScannerDescriptorSchema, scan: z.function({ input: [z.string()], output: z.promise(DepScanReportSchema) }) });
+//# sourceMappingURL=dep-scanner.js.map

package/dist/schemas/contracts/dep-scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dep-scanner.js","sourceRoot":"","sources":["../../../src/schemas/contracts/dep-scanner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IACvD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;IACpD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,mFAAmF,CAAC;CAC9H,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/B,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC9D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC"}

package/dist/schemas/contracts/freshness-policy.d.ts

@@ -0,0 +1,99 @@
+import * as z from 'zod/v4';
+export declare const FreshnessVerdictSchema: z.ZodObject<{
+    packageName: z.ZodString;
+    version: z.ZodString;
+    publishedAt: z.ZodString;
+    ageHours: z.ZodNumber;
+    verdict: z.ZodEnum<{
+        unknown: "unknown";
+        fresh: "fresh";
+        stale: "stale";
+    }>;
+    policy: z.ZodObject<{
+        minAgeHours: z.ZodNumber;
+        maxAgeDays: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type FreshnessVerdict = z.infer<typeof FreshnessVerdictSchema>;
+export declare const FreshnessPolicyDescriptorSchema: z.ZodObject<{
+    id: z.ZodString;
+    kind: z.ZodLiteral<"security/freshness-policy">;
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    hardware: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        consumer: "consumer";
+        cloud: "cloud";
+    }>>>;
+    minAgeHours: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    maxAgeDays: z.ZodOptional<z.ZodNumber>;
+    allowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    breakglass: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+}, z.core.$strip>;
+export type FreshnessPolicyDescriptor = z.output<typeof FreshnessPolicyDescriptorSchema>;
+export declare const FreshnessInputSchema: z.ZodObject<{
+    name: z.ZodString;
+    version: z.ZodString;
+    publishedAt: z.ZodString;
+}, z.core.$strip>;
+export declare const FreshnessInputsSchema: z.ZodArray<z.ZodObject<{
+    name: z.ZodString;
+    version: z.ZodString;
+    publishedAt: z.ZodString;
+}, z.core.$strip>>;
+export type FreshnessInput = z.infer<typeof FreshnessInputSchema>;
+export declare const FreshnessPolicyServiceSchema: z.ZodObject<{
+    descriptor: z.ZodObject<{
+        id: z.ZodString;
+        kind: z.ZodLiteral<"security/freshness-policy">;
+        name: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        hardware: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+            consumer: "consumer";
+            cloud: "cloud";
+        }>>>;
+        minAgeHours: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        maxAgeDays: z.ZodOptional<z.ZodNumber>;
+        allowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        breakglass: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    }, z.core.$strip>;
+    evaluate: z.ZodFunction<z.ZodTuple<readonly [z.ZodString, z.ZodString, z.ZodString], null>, z.ZodPromise<z.ZodObject<{
+        packageName: z.ZodString;
+        version: z.ZodString;
+        publishedAt: z.ZodString;
+        ageHours: z.ZodNumber;
+        verdict: z.ZodEnum<{
+            unknown: "unknown";
+            fresh: "fresh";
+            stale: "stale";
+        }>;
+        policy: z.ZodObject<{
+            minAgeHours: z.ZodNumber;
+            maxAgeDays: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>;
+    }, z.core.$strip>>>;
+    evaluateMany: z.ZodFunction<z.ZodTuple<readonly [z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        version: z.ZodString;
+        publishedAt: z.ZodString;
+    }, z.core.$strip>>], null>, z.ZodPromise<z.ZodArray<z.ZodObject<{
+        packageName: z.ZodString;
+        version: z.ZodString;
+        publishedAt: z.ZodString;
+        ageHours: z.ZodNumber;
+        verdict: z.ZodEnum<{
+            unknown: "unknown";
+            fresh: "fresh";
+            stale: "stale";
+        }>;
+        policy: z.ZodObject<{
+            minAgeHours: z.ZodNumber;
+            maxAgeDays: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>;
+    }, z.core.$strip>>>>;
+}, z.core.$strip>;
+export type FreshnessPolicyService = z.infer<typeof FreshnessPolicyServiceSchema>;
+//# sourceMappingURL=freshness-policy.d.ts.map

package/dist/schemas/contracts/freshness-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"freshness-policy.d.ts","sourceRoot":"","sources":["../../../src/schemas/contracts/freshness-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;iBAUjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;iBAY1C,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACzF,eAAO,MAAM,oBAAoB;;;;iBAE/B,CAAC;AACH,eAAO,MAAM,qBAAqB;;;;kBAAgC,CAAC;AACnE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAAyW,CAAC;AACnZ,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC"}

package/dist/schemas/contracts/freshness-policy.js

@@ -0,0 +1,31 @@
+import * as z from 'zod/v4';
+export const FreshnessVerdictSchema = z.object({
+    packageName: z.string(),
+    version: z.string(),
+    publishedAt: z.string().datetime(),
+    ageHours: z.number(),
+    verdict: z.enum(['fresh', 'stale', 'unknown']),
+    policy: z.object({
+        minAgeHours: z.number(),
+        maxAgeDays: z.number().optional(),
+    }),
+});
+export const FreshnessPolicyDescriptorSchema = z.object({
+    id: z.string(),
+    kind: z.literal('security/freshness-policy'),
+    name: z.string(),
+    description: z.string().optional(),
+    enabled: z.boolean().optional(),
+    tags: z.array(z.string()).optional(),
+    hardware: z.array(z.enum(['consumer', 'cloud'])).optional(),
+    minAgeHours: z.number().optional().default(48),
+    maxAgeDays: z.number().optional(),
+    allowlist: z.array(z.string()).optional(),
+    breakglass: z.boolean().optional().default(false),
+});
+export const FreshnessInputSchema = z.object({
+    name: z.string(), version: z.string(), publishedAt: z.string().datetime(),
+});
+export const FreshnessInputsSchema = z.array(FreshnessInputSchema);
+export const FreshnessPolicyServiceSchema = z.object({ descriptor: FreshnessPolicyDescriptorSchema, evaluate: z.function({ input: [FreshnessInputSchema.shape.name, FreshnessInputSchema.shape.version, FreshnessInputSchema.shape.publishedAt], output: z.promise(FreshnessVerdictSchema) }), evaluateMany: z.function({ input: [FreshnessInputsSchema], output: z.promise(z.array(FreshnessVerdictSchema)) }) });
+//# sourceMappingURL=freshness-policy.js.map

package/dist/schemas/contracts/freshness-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"freshness-policy.js","sourceRoot":"","sources":["../../../src/schemas/contracts/freshness-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC9C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;QACvB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACpC,CAAC;CACL,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/B,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACzC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACpD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5E,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;AAEnE,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,+BAA+B,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,IAAI,EAAE,oBAAoB,CAAC,KAAK,CAAC,OAAO,EAAE,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC"}

package/dist/schemas/contracts/ioc-feed.d.ts

@@ -0,0 +1,85 @@
+import * as z from 'zod/v4';
+export declare const IOCFeedEntrySchema: z.ZodObject<{
+    packageName: z.ZodString;
+    versionRange: z.ZodString;
+    cve: z.ZodOptional<z.ZodString>;
+    severity: z.ZodEnum<{
+        low: "low";
+        medium: "medium";
+        high: "high";
+        critical: "critical";
+    }>;
+    reportedAt: z.ZodString;
+}, z.core.$strip>;
+export type IOCFeedEntry = z.infer<typeof IOCFeedEntrySchema>;
+/** Successful provider synchronization only; descriptor-only defaults refuse with UNAVAILABLE/ioc-feed-unavailable. */
+export declare const IOCFeedSyncStatusSchema: z.ZodObject<{
+    lastSuccessfulSyncAt: z.ZodString;
+    maxStaleness: z.ZodDefault<z.ZodNumber>;
+    entryCount: z.ZodNumber;
+}, z.core.$strip>;
+export type IOCFeedSyncStatus = z.infer<typeof IOCFeedSyncStatusSchema>;
+export declare const IOCFeedDescriptorSchema: z.ZodObject<{
+    id: z.ZodString;
+    kind: z.ZodLiteral<"security/ioc-feed">;
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    hardware: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        consumer: "consumer";
+        cloud: "cloud";
+    }>>>;
+    maxStaleness: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    trustTier: z.ZodDefault<z.ZodOptional<z.ZodEnum<{
+        low: "low";
+        medium: "medium";
+        high: "high";
+    }>>>;
+}, z.core.$strip>;
+export type IOCFeedDescriptor = z.output<typeof IOCFeedDescriptorSchema>;
+/** All three methods require an implementation; an empty query is authoritative only from a provider. */
+export declare const IOCFeedServiceSchema: z.ZodObject<{
+    descriptor: z.ZodObject<{
+        id: z.ZodString;
+        kind: z.ZodLiteral<"security/ioc-feed">;
+        name: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        hardware: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+            consumer: "consumer";
+            cloud: "cloud";
+        }>>>;
+        maxStaleness: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        trustTier: z.ZodDefault<z.ZodOptional<z.ZodEnum<{
+            low: "low";
+            medium: "medium";
+            high: "high";
+        }>>>;
+    }, z.core.$strip>;
+    sync: z.ZodFunction<z.ZodTuple<readonly [], null>, z.ZodPromise<z.ZodObject<{
+        lastSuccessfulSyncAt: z.ZodString;
+        maxStaleness: z.ZodDefault<z.ZodNumber>;
+        entryCount: z.ZodNumber;
+    }, z.core.$strip>>>;
+    query: z.ZodFunction<z.ZodTuple<readonly [z.ZodString, z.ZodString], null>, z.ZodPromise<z.ZodArray<z.ZodObject<{
+        packageName: z.ZodString;
+        versionRange: z.ZodString;
+        cve: z.ZodOptional<z.ZodString>;
+        severity: z.ZodEnum<{
+            low: "low";
+            medium: "medium";
+            high: "high";
+            critical: "critical";
+        }>;
+        reportedAt: z.ZodString;
+    }, z.core.$strip>>>>;
+    getStatus: z.ZodFunction<z.ZodTuple<readonly [], null>, z.ZodPromise<z.ZodObject<{
+        lastSuccessfulSyncAt: z.ZodString;
+        maxStaleness: z.ZodDefault<z.ZodNumber>;
+        entryCount: z.ZodNumber;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type IOCFeedService = z.infer<typeof IOCFeedServiceSchema>;
+//# sourceMappingURL=ioc-feed.d.ts.map

package/dist/schemas/contracts/ioc-feed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ioc-feed.d.ts","sourceRoot":"","sources":["../../../src/schemas/contracts/ioc-feed.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,eAAO,MAAM,kBAAkB;;;;;;;;;;;iBAM7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC9D,uHAAuH;AACvH,eAAO,MAAM,uBAAuB;;;;iBAIlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;iBAUlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACzE,yGAAyG;AACzG,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAA2T,CAAC;AAC7V,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/schemas/contracts/ioc-feed.js

@@ -0,0 +1,28 @@
+import * as z from 'zod/v4';
+export const IOCFeedEntrySchema = z.object({
+    packageName: z.string(),
+    versionRange: z.string(),
+    cve: z.string().optional(),
+    severity: z.enum(['low', 'medium', 'high', 'critical']),
+    reportedAt: z.string().datetime(),
+});
+/** Successful provider synchronization only; descriptor-only defaults refuse with UNAVAILABLE/ioc-feed-unavailable. */
+export const IOCFeedSyncStatusSchema = z.object({
+    lastSuccessfulSyncAt: z.string().datetime(),
+    maxStaleness: z.number().default(72),
+    entryCount: z.number(),
+});
+export const IOCFeedDescriptorSchema = z.object({
+    id: z.string(),
+    kind: z.literal('security/ioc-feed'),
+    name: z.string(),
+    description: z.string().optional(),
+    enabled: z.boolean().optional(),
+    tags: z.array(z.string()).optional(),
+    hardware: z.array(z.enum(['consumer', 'cloud'])).optional(),
+    maxStaleness: z.number().optional().default(72),
+    trustTier: z.enum(['high', 'medium', 'low']).optional().default('medium'),
+});
+/** All three methods require an implementation; an empty query is authoritative only from a provider. */
+export const IOCFeedServiceSchema = z.object({ descriptor: IOCFeedDescriptorSchema, sync: z.function({ input: [], output: z.promise(IOCFeedSyncStatusSchema) }), query: z.function({ input: [z.string(), z.string()], output: z.promise(z.array(IOCFeedEntrySchema)) }), getStatus: z.function({ input: [], output: z.promise(IOCFeedSyncStatusSchema) }) });
+//# sourceMappingURL=ioc-feed.js.map

package/dist/schemas/contracts/ioc-feed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ioc-feed.js","sourceRoot":"","sources":["../../../src/schemas/contracts/ioc-feed.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IACvD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAEH,uHAAuH;AACvH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACzB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/B,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/C,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;CAC5E,CAAC,CAAC;AAEH,yGAAyG;AACzG,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC"}

package/dist/schemas/contracts/misc.d.ts

@@ -0,0 +1,11 @@
+import * as z from 'zod/v4';
+import type { ZodIssue } from 'zod/v4';
+export declare const ForwardableAuthHeadersSchema: z.ZodObject<{
+    cookie: z.ZodOptional<z.ZodString>;
+    jwt: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type ForwardableAuthHeaders = z.infer<typeof ForwardableAuthHeadersSchema>;
+export declare const ValidationErrorDetailValueSchema: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull, z.ZodUndefined]>;
+export type ValidationErrorDetailValue = z.infer<typeof ValidationErrorDetailValueSchema>;
+export type ValidationErrorDetails = ZodIssue[] | Record<string, ValidationErrorDetailValue>;
+//# sourceMappingURL=misc.d.ts.map

package/dist/schemas/contracts/misc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"misc.d.ts","sourceRoot":"","sources":["../../../src/schemas/contracts/misc.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACvC,eAAO,MAAM,4BAA4B;;;iBAA0E,CAAC;AACpH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,eAAO,MAAM,gCAAgC,0FAA0E,CAAC;AACxH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAC1F,MAAM,MAAM,sBAAsB,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC"}

package/dist/schemas/contracts/misc.js

@@ -0,0 +1,4 @@
+import * as z from 'zod/v4';
+export const ForwardableAuthHeadersSchema = z.object({ cookie: z.string().optional(), jwt: z.string().optional() });
+export const ValidationErrorDetailValueSchema = z.union([z.string(), z.number(), z.boolean(), z.null(), z.undefined()]);
+//# sourceMappingURL=misc.js.map

package/dist/schemas/contracts/misc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"misc.js","sourceRoot":"","sources":["../../../src/schemas/contracts/misc.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAEpH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC"}

package/dist/schemas/contracts/policy.d.ts

@@ -0,0 +1,93 @@
+import * as z from 'zod/v4';
+export declare const PolicyRuleSchema: z.ZodObject<{
+    pattern: z.ZodOptional<z.ZodString>;
+    action: z.ZodEnum<{
+        allow: "allow";
+        deny: "deny";
+        review: "review";
+    }>;
+    target: z.ZodEnum<{
+        metadata: "metadata";
+        content: "content";
+        header: "header";
+    }>;
+}, z.core.$strip>;
+export type PolicyRule = z.infer<typeof PolicyRuleSchema>;
+export declare const SecurityPolicyDescriptorSchema: z.ZodObject<{
+    id: z.ZodString;
+    kind: z.ZodLiteral<"security/policy">;
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    hardware: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        consumer: "consumer";
+        cloud: "cloud";
+    }>>>;
+    rules: z.ZodArray<z.ZodObject<{
+        pattern: z.ZodOptional<z.ZodString>;
+        action: z.ZodEnum<{
+            allow: "allow";
+            deny: "deny";
+            review: "review";
+        }>;
+        target: z.ZodEnum<{
+            metadata: "metadata";
+            content: "content";
+            header: "header";
+        }>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type SecurityPolicyDescriptor = z.output<typeof SecurityPolicyDescriptorSchema>;
+export declare const PolicyOutcomeSchema: z.ZodEnum<{
+    allow: "allow";
+    deny: "deny";
+    review: "review";
+}>;
+export type PolicyOutcome = z.infer<typeof PolicyOutcomeSchema>;
+export declare const PolicyEvaluationContextSchema: z.ZodObject<{
+    actor: z.ZodOptional<z.ZodString>;
+    action: z.ZodOptional<z.ZodString>;
+    resource: z.ZodOptional<z.ZodString>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strip>;
+export type PolicyEvaluationContext = z.infer<typeof PolicyEvaluationContextSchema>;
+export declare const SecurityPolicyServiceSchema: z.ZodObject<{
+    descriptor: z.ZodObject<{
+        id: z.ZodString;
+        kind: z.ZodLiteral<"security/policy">;
+        name: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        hardware: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+            consumer: "consumer";
+            cloud: "cloud";
+        }>>>;
+        rules: z.ZodArray<z.ZodObject<{
+            pattern: z.ZodOptional<z.ZodString>;
+            action: z.ZodEnum<{
+                allow: "allow";
+                deny: "deny";
+                review: "review";
+            }>;
+            target: z.ZodEnum<{
+                metadata: "metadata";
+                content: "content";
+                header: "header";
+            }>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+    evaluate: z.ZodFunction<z.ZodTuple<readonly [z.ZodObject<{
+        actor: z.ZodOptional<z.ZodString>;
+        action: z.ZodOptional<z.ZodString>;
+        resource: z.ZodOptional<z.ZodString>;
+        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strip>], null>, z.ZodPromise<z.ZodEnum<{
+        allow: "allow";
+        deny: "deny";
+        review: "review";
+    }>>>;
+}, z.core.$strip>;
+export type SecurityPolicyService = z.infer<typeof SecurityPolicyServiceSchema>;
+//# sourceMappingURL=policy.d.ts.map

package/dist/schemas/contracts/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/schemas/contracts/policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,eAAO,MAAM,gBAAgB;;;;;;;;;;;;iBAI3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;iBASzC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACvF,eAAO,MAAM,mBAAmB;;;;EAAsC,CAAC;AACvE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,eAAO,MAAM,6BAA6B;;;;;iBAKxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAAqK,CAAC;AAC9M,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC"}

package/dist/schemas/contracts/policy.js

@@ -0,0 +1,25 @@
+import * as z from 'zod/v4';
+export const PolicyRuleSchema = z.object({
+    pattern: z.string().optional(),
+    action: z.enum(['allow', 'deny', 'review']),
+    target: z.enum(['content', 'metadata', 'header']),
+});
+export const SecurityPolicyDescriptorSchema = z.object({
+    id: z.string(),
+    kind: z.literal('security/policy'),
+    name: z.string(),
+    description: z.string().optional(),
+    enabled: z.boolean().optional(),
+    tags: z.array(z.string()).optional(),
+    hardware: z.array(z.enum(['consumer', 'cloud'])).optional(),
+    rules: z.array(PolicyRuleSchema),
+});
+export const PolicyOutcomeSchema = z.enum(['allow', 'deny', 'review']);
+export const PolicyEvaluationContextSchema = z.object({
+    actor: z.string().optional(),
+    action: z.string().optional(),
+    resource: z.string().optional(),
+    metadata: z.record(z.string(), z.unknown()).optional(),
+});
+export const SecurityPolicyServiceSchema = z.object({ descriptor: SecurityPolicyDescriptorSchema, evaluate: z.function({ input: [PolicyEvaluationContextSchema], output: z.promise(PolicyOutcomeSchema) }) });
+//# sourceMappingURL=policy.js.map

package/dist/schemas/contracts/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/schemas/contracts/policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;CACpD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/B,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3D,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEvE,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACzD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,8BAA8B,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,6BAA6B,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC"}