@zapier/policy-schema 0.12.0 → 0.15.0

package/dist/index.d.cts

@@ -1,137 +1,28 @@
 import { z } from 'zod';
 
-type ScalarOperator = "equals" | "in" | "matches" | "matches_host" | "matches_path" | "range";
-type JsonValue = string | number | boolean | null | JsonValue[] | {
-    [key: string]: JsonValue;
-};
-type ArrayOperator = "values_in";
-type UrlOperator = "matches_url";
-type OtherOperator = "exists" | "keys_in" | "size";
-type Operator = ScalarOperator | ArrayOperator | UrlOperator | OtherOperator;
-type RangeValue = {
-    min?: number;
-    max?: number;
-};
-type SizeValue = number | RangeValue;
-type ConditionValue = JsonValue | RangeValue | SizeValue;
-interface Condition {
-    path: (string | number)[];
-    operator: Operator;
-    value?: ConditionValue;
-}
-type Effect = "allow" | "ask" | "deny";
-interface Statement {
-    id?: string;
-    effect: Effect;
-    permissions: string[];
-    resources: string[];
-    conditions?: Condition[];
-}
-interface Policy {
-    version: 1 | 2;
-    statements: Statement[];
-}
-interface PolicyRequest {
-    permission: string;
-    resource: string;
-    context?: Record<string, unknown>;
-}
-/** SHA-256 hex digest of an RFC 8785 (JCS) canonicalized JSON value. */
-type CanonicalHash = string & {
-    readonly __brand: "CanonicalHash";
-};
-interface OverrideBase {
-    id?: string;
-    statementHash: CanonicalHash;
-    effect: "allow";
-}
-type Override = (OverrideBase & {
-    match: "any";
-}) | (OverrideBase & {
-    contextHash: CanonicalHash;
-}) | (OverrideBase & {
-    conditionals: Condition[];
-});
-interface ConditionTrace {
-    condition: Condition;
-    resolved: unknown;
-    passed: boolean;
-}
-interface OverrideTrace {
-    override: Override;
-    matched: boolean;
-    conditionResults?: ConditionTrace[];
-}
-interface StatementTrace {
-    statement: Statement;
-    permissionMatched: boolean;
-    resourceMatched: boolean;
-    conditionResults?: ConditionTrace[];
-    passed: boolean;
-    overrides?: OverrideTrace[];
-}
-interface EvaluatePolicyOptions {
-    policy: Policy;
-    request: PolicyRequest;
-    overrides?: Override[];
-    trace?: boolean;
-}
-type PolicyReason = "matched" | "unmatched" | "hpp" | "overridden";
-interface PolicyResult {
-    effect: Effect;
-    explicit: boolean;
-    reason: PolicyReason;
-    statements: StatementTrace[];
-}
-interface ParsedUrl {
-    scheme: string;
-    host: string;
-    port: number;
-    path: string;
-    query: Record<string, string[]>;
-}
-interface PolicyHttpRequest {
-    method: string;
-    url: ParsedUrl;
-    headers: Record<string, string | string[]>;
-    body: string | null;
-    body_json: unknown;
-    connection_id?: string;
-}
-interface PolicyActionRequest {
-    connection_id?: string;
-    selected_api?: string;
-    action_type?: string;
-    action_key?: string;
-    inputs?: Record<string, unknown>;
-}
-/** Simplified OpenAPI-compatible JSON Schema type for getOpenApiSchema(). */
-interface OpenApiSchema {
-    type?: string;
-    required?: string[];
-    properties?: Record<string, OpenApiSchema>;
-    items?: OpenApiSchema;
-    enum?: (string | number)[];
-    description?: string;
-    minItems?: number;
-    oneOf?: OpenApiSchema[];
-    anyOf?: OpenApiSchema[];
-}
-
-/** Current policy document version. */
-declare const VALID_VERSIONS: readonly [1, 2];
+/** Release-candidate policy document version for the current experimental shape. */
+declare const RUBBERDUCK_POLICY_VERSION: "rc-rubberduck";
+/** Supported policy document versions. */
+declare const VALID_VERSIONS: readonly [1, 2, "rc-rubberduck"];
 /** Valid policy effects. */
 declare const VALID_EFFECTS: readonly ["allow", "ask", "deny"];
+/** Derived from VALID_EFFECTS — the constant is the single source of truth. */
+type Effect = (typeof VALID_EFFECTS)[number];
 /** Valid condition operators. */
 declare const VALID_OPERATOR_LIST: readonly ["equals", "exists", "in", "keys_in", "matches", "matches_host", "matches_path", "matches_url", "range", "size", "values_in"];
+declare const ConditionValueSchema: z.ZodJSONSchema;
 declare const RangeValueSchema: z.ZodObject<{
     min: z.ZodOptional<z.ZodNumber>;
     max: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strict>;
+/** Derived from RangeValueSchema — the schema is the single source of truth. */
+type RangeValue = z.infer<typeof RangeValueSchema>;
 declare const SizeValueSchema: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
     min: z.ZodOptional<z.ZodNumber>;
     max: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strict>]>;
+/** Derived from SizeValueSchema — the schema is the single source of truth. */
+type SizeValue = z.infer<typeof SizeValueSchema>;
 declare const ConditionSchema: z.ZodUnion<readonly [z.ZodObject<{
     path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
     operator: z.ZodLiteral<"equals">;
@@ -182,6 +73,8 @@ declare const ConditionSchema: z.ZodUnion<readonly [z.ZodObject<{
         max: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strict>]>;
 }, z.core.$strict>]>;
+/** Derived from ConditionSchema — the schema is the single source of truth. */
+type Condition = z.infer<typeof ConditionSchema>;
 declare const ScalarOperatorSchema: z.ZodEnum<{
     equals: "equals";
     in: "in";
@@ -190,31 +83,40 @@ declare const ScalarOperatorSchema: z.ZodEnum<{
     matches_path: "matches_path";
     range: "range";
 }>;
+/** Derived from ScalarOperatorSchema — the schema is the single source of truth. */
+type ScalarOperator = z.infer<typeof ScalarOperatorSchema>;
 declare const ArrayOperatorSchema: z.ZodEnum<{
     values_in: "values_in";
 }>;
+/** Derived from ArrayOperatorSchema — the schema is the single source of truth. */
+type ArrayOperator = z.infer<typeof ArrayOperatorSchema>;
 declare const UrlOperatorSchema: z.ZodEnum<{
     matches_url: "matches_url";
 }>;
+/** Derived from UrlOperatorSchema — the schema is the single source of truth. */
+type UrlOperator = z.infer<typeof UrlOperatorSchema>;
 declare const OtherOperatorSchema: z.ZodEnum<{
     exists: "exists";
     keys_in: "keys_in";
     size: "size";
 }>;
+/** Derived from OtherOperatorSchema — the schema is the single source of truth. */
+type OtherOperator = z.infer<typeof OtherOperatorSchema>;
 declare const OperatorSchema: z.ZodEnum<{
     equals: "equals";
+    exists: "exists";
     in: "in";
+    keys_in: "keys_in";
     matches: "matches";
     matches_host: "matches_host";
     matches_path: "matches_path";
+    matches_url: "matches_url";
     range: "range";
-    exists: "exists";
-    keys_in: "keys_in";
     size: "size";
     values_in: "values_in";
-    matches_url: "matches_url";
 }>;
-declare const ConditionValueSchema: z.ZodJSONSchema;
+/** Derived from OperatorSchema — the schema is the single source of truth. */
+type Operator = z.infer<typeof OperatorSchema>;
 /** Statement schema accepting the union of all effects (use PolicySchema for version-aware validation). */
 declare const StatementSchema: z.ZodObject<{
     id: z.ZodOptional<z.ZodString>;
@@ -276,6 +178,23 @@ declare const StatementSchema: z.ZodObject<{
         }, z.core.$strict>]>;
     }, z.core.$strict>]>>>;
 }, z.core.$strict>;
+/** Derived from StatementSchema — the schema is the single source of truth. */
+type Statement = z.infer<typeof StatementSchema>;
+/** Statement identifier for rc-rubberduck policies. Must match ^s_\S+$ and be ≤512 chars. */
+declare const StatementIdSchema: z.ZodString;
+/** Derived from StatementIdSchema — the schema is the single source of truth. */
+type StatementId = z.infer<typeof StatementIdSchema>;
+/** Policy identifier for rc-rubberduck policies. Must match ^p_\S+$ and be ≤512 chars. */
+declare const PolicyIdSchema: z.ZodString;
+/** Derived from PolicyIdSchema — the schema is the single source of truth. */
+type PolicyId = z.infer<typeof PolicyIdSchema>;
+/** Effect applied when no statement matches (rc-rubberduck, required). deny == implicit deny. */
+declare const DefaultEffectSchema: z.ZodEnum<{
+    ask: "ask";
+    deny: "deny";
+}>;
+/** Derived from DefaultEffectSchema — the schema is the single source of truth. */
+type DefaultEffect = z.infer<typeof DefaultEffectSchema>;
 declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
     version: z.ZodLiteral<1>;
     statements: z.ZodArray<z.ZodObject<{
@@ -399,7 +318,289 @@ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
             }, z.core.$strict>]>;
         }, z.core.$strict>]>>>;
     }, z.core.$strict>>;
+}, z.core.$strict>, z.ZodObject<{
+    version: z.ZodLiteral<"rc-rubberduck">;
+    id: z.ZodString;
+    defaultEffect: z.ZodEnum<{
+        ask: "ask";
+        deny: "deny";
+    }>;
+    statements: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        effect: z.ZodEnum<{
+            allow: "allow";
+            ask: "ask";
+            deny: "deny";
+        }>;
+        permissions: z.ZodArray<z.ZodString>;
+        resources: z.ZodArray<z.ZodString>;
+        conditions: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"equals">;
+            value: z.ZodJSONSchema;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"in">;
+            value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"matches">;
+            value: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"matches_host">;
+            value: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"matches_path">;
+            value: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"range">;
+            value: z.ZodObject<{
+                min: z.ZodOptional<z.ZodNumber>;
+                max: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"matches_url">;
+            value: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"values_in">;
+            value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"exists">;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"keys_in">;
+            value: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"size">;
+            value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
+                min: z.ZodOptional<z.ZodNumber>;
+                max: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strict>]>;
+        }, z.core.$strict>]>>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>]>;
+/** Derived from PolicySchema — the schema is the single source of truth. */
+type Policy = z.infer<typeof PolicySchema>;
+/** SHA-256 hex digest of an RFC 8785 (JCS) canonicalized JSON value. */
+declare const CanonicalHashSchema: z.ZodCustom<CanonicalHash, CanonicalHash>;
+/**
+ * Runtime schema for the Override type. Each variant has exactly one target
+ * field (statementHash for v1/v2, statementId or policyId for rc-rubberduck) and exactly
+ * one binding mode (match, contextHash, or conditionals). `.strict()` keeps
+ * the variants mutually exclusive (an object carrying fields from two variants
+ * fails all branches).
+ *
+ * Targets are all non-null:
+ * - statementHash: targets a v1/v2 statement by canonical hash
+ * - statementId: targets an rc-rubberduck statement by id
+ * - policyId: targets that policy's default effect (rc-rubberduck only)
+ *
+ * Empty conditionals is intentional (the "blank check"): the override applies
+ * whenever the targeted ask statement fires, with no extra conditions. Do not
+ * add .min(1) to conditionals.
+ */
+declare const OverrideSchema: z.ZodUnion<readonly [z.ZodObject<{
+    match: z.ZodLiteral<"any">;
+    id: z.ZodOptional<z.ZodString>;
+    statementHash: z.ZodCustom<CanonicalHash, CanonicalHash>;
+    effect: z.ZodLiteral<"allow">;
+}, z.core.$strict>, z.ZodObject<{
+    contextHash: z.ZodCustom<CanonicalHash, CanonicalHash>;
+    id: z.ZodOptional<z.ZodString>;
+    statementHash: z.ZodCustom<CanonicalHash, CanonicalHash>;
+    effect: z.ZodLiteral<"allow">;
+}, z.core.$strict>, z.ZodObject<{
+    conditionals: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"equals">;
+        value: z.ZodJSONSchema;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"in">;
+        value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"matches">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"matches_host">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"matches_path">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"range">;
+        value: z.ZodObject<{
+            min: z.ZodOptional<z.ZodNumber>;
+            max: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"matches_url">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"values_in">;
+        value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"exists">;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"keys_in">;
+        value: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"size">;
+        value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
+            min: z.ZodOptional<z.ZodNumber>;
+            max: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>]>>;
+    id: z.ZodOptional<z.ZodString>;
+    statementHash: z.ZodCustom<CanonicalHash, CanonicalHash>;
+    effect: z.ZodLiteral<"allow">;
+}, z.core.$strict>, z.ZodObject<{
+    match: z.ZodLiteral<"any">;
+    id: z.ZodOptional<z.ZodString>;
+    statementId: z.ZodString;
+    effect: z.ZodLiteral<"allow">;
+}, z.core.$strict>, z.ZodObject<{
+    contextHash: z.ZodCustom<CanonicalHash, CanonicalHash>;
+    id: z.ZodOptional<z.ZodString>;
+    statementId: z.ZodString;
+    effect: z.ZodLiteral<"allow">;
+}, z.core.$strict>, z.ZodObject<{
+    conditionals: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"equals">;
+        value: z.ZodJSONSchema;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"in">;
+        value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"matches">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"matches_host">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"matches_path">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"range">;
+        value: z.ZodObject<{
+            min: z.ZodOptional<z.ZodNumber>;
+            max: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"matches_url">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"values_in">;
+        value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"exists">;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"keys_in">;
+        value: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"size">;
+        value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
+            min: z.ZodOptional<z.ZodNumber>;
+            max: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>]>>;
+    id: z.ZodOptional<z.ZodString>;
+    statementId: z.ZodString;
+    effect: z.ZodLiteral<"allow">;
+}, z.core.$strict>, z.ZodObject<{
+    match: z.ZodLiteral<"any">;
+    id: z.ZodOptional<z.ZodString>;
+    policyId: z.ZodString;
+    effect: z.ZodLiteral<"allow">;
+}, z.core.$strict>, z.ZodObject<{
+    contextHash: z.ZodCustom<CanonicalHash, CanonicalHash>;
+    id: z.ZodOptional<z.ZodString>;
+    policyId: z.ZodString;
+    effect: z.ZodLiteral<"allow">;
+}, z.core.$strict>, z.ZodObject<{
+    conditionals: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"equals">;
+        value: z.ZodJSONSchema;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"in">;
+        value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"matches">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"matches_host">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"matches_path">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"range">;
+        value: z.ZodObject<{
+            min: z.ZodOptional<z.ZodNumber>;
+            max: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"matches_url">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"values_in">;
+        value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"exists">;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"keys_in">;
+        value: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"size">;
+        value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
+            min: z.ZodOptional<z.ZodNumber>;
+            max: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>]>>;
+    id: z.ZodOptional<z.ZodString>;
+    policyId: z.ZodString;
+    effect: z.ZodLiteral<"allow">;
 }, z.core.$strict>]>;
+/** Derived from OverrideSchema — the schema is the single source of truth. */
+type Override = z.infer<typeof OverrideSchema>;
 /**
  * Returns an OpenAPI-compatible JSON Schema object for a policy document.
  *
@@ -408,4 +609,89 @@ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
  */
 declare function getOpenApiSchema(): OpenApiSchema;
 
-export { type ArrayOperator, ArrayOperatorSchema, type CanonicalHash, type Condition, ConditionSchema, type ConditionTrace, type ConditionValue, ConditionValueSchema, type Effect, type EvaluatePolicyOptions, type JsonValue, type OpenApiSchema, type Operator, OperatorSchema, type OtherOperator, OtherOperatorSchema, type Override, type OverrideTrace, type ParsedUrl, type Policy, type PolicyActionRequest, type PolicyHttpRequest, type PolicyReason, type PolicyRequest, type PolicyResult, PolicySchema, type RangeValue, RangeValueSchema, type ScalarOperator, ScalarOperatorSchema, type SizeValue, SizeValueSchema, type Statement, StatementSchema, type StatementTrace, type UrlOperator, UrlOperatorSchema, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };
+type JsonValue = string | number | boolean | null | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+type ConditionValue = JsonValue | RangeValue | SizeValue;
+interface PolicyRequest {
+    permission: string;
+    resource: string;
+    context?: Record<string, unknown>;
+}
+/** SHA-256 hex digest of an RFC 8785 (JCS) canonicalized JSON value. */
+type CanonicalHash = string & {
+    readonly __brand: "CanonicalHash";
+};
+interface ConditionTrace {
+    condition: Condition;
+    resolved: unknown;
+    passed: boolean;
+}
+interface OverrideTrace {
+    override: Override;
+    matched: boolean;
+    conditionResults?: ConditionTrace[];
+}
+interface DefaultTrace {
+    defaultEffect: DefaultEffect;
+    overrides: OverrideTrace[];
+}
+interface StatementTrace {
+    statement: Statement;
+    permissionMatched: boolean;
+    resourceMatched: boolean;
+    conditionResults?: ConditionTrace[];
+    passed: boolean;
+    overrides?: OverrideTrace[];
+}
+interface EvaluatePolicyOptions {
+    policy: Policy;
+    request: PolicyRequest;
+    overrides?: Override[];
+    trace?: boolean;
+}
+type PolicyReason = "matched" | "unmatched" | "hpp" | "overridden";
+interface PolicyResult {
+    effect: Effect;
+    explicit: boolean;
+    reason: PolicyReason;
+    statements: StatementTrace[];
+    /** Trace mode only. Present when no statement matched and an ask default was consulted (never attached for deny defaults). */
+    default?: DefaultTrace;
+}
+interface ParsedUrl {
+    scheme: string;
+    host: string;
+    port: number;
+    path: string;
+    query: Record<string, string[]>;
+}
+interface PolicyHttpRequest {
+    method: string;
+    url: ParsedUrl;
+    headers: Record<string, string | string[]>;
+    body: string | null;
+    body_json: unknown;
+    connection_id?: string;
+}
+interface PolicyActionRequest {
+    connection_id?: string;
+    selected_api?: string;
+    action_type?: string;
+    action_key?: string;
+    inputs?: Record<string, unknown>;
+}
+/** Simplified OpenAPI-compatible JSON Schema type for getOpenApiSchema(). */
+interface OpenApiSchema {
+    type?: string;
+    required?: string[];
+    properties?: Record<string, OpenApiSchema>;
+    items?: OpenApiSchema;
+    enum?: (string | number)[];
+    description?: string;
+    minItems?: number;
+    oneOf?: OpenApiSchema[];
+    anyOf?: OpenApiSchema[];
+}
+
+export { type ArrayOperator, ArrayOperatorSchema, type CanonicalHash, CanonicalHashSchema, type Condition, ConditionSchema, type ConditionTrace, type ConditionValue, ConditionValueSchema, type DefaultEffect, DefaultEffectSchema, type DefaultTrace, type Effect, type EvaluatePolicyOptions, type JsonValue, type OpenApiSchema, type Operator, OperatorSchema, type OtherOperator, OtherOperatorSchema, type Override, OverrideSchema, type OverrideTrace, type ParsedUrl, type Policy, type PolicyActionRequest, type PolicyHttpRequest, type PolicyId, PolicyIdSchema, type PolicyReason, type PolicyRequest, type PolicyResult, PolicySchema, RUBBERDUCK_POLICY_VERSION, type RangeValue, RangeValueSchema, type ScalarOperator, ScalarOperatorSchema, type SizeValue, SizeValueSchema, type Statement, type StatementId, StatementIdSchema, StatementSchema, type StatementTrace, type UrlOperator, UrlOperatorSchema, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };