@zapier/policy-schema 0.13.0 → 0.15.0

package/dist/index.cjs

@@ -3,7 +3,8 @@
 var zod = require('zod');
 
 // src/schema.ts
-var VALID_VERSIONS = [1, 2];
+var RUBBERDUCK_POLICY_VERSION = "rc-rubberduck";
+var VALID_VERSIONS = [1, 2, RUBBERDUCK_POLICY_VERSION];
 var VALID_EFFECTS = ["allow", "ask", "deny"];
 var VALID_OPERATOR_LIST = [
   "equals",
@@ -20,10 +21,11 @@ var VALID_OPERATOR_LIST = [
 ];
 var ScalarSchema = zod.z.union([zod.z.string(), zod.z.number(), zod.z.boolean()]);
 var PathSchema = zod.z.array(zod.z.union([zod.z.string(), zod.z.number()])).min(1);
+var ConditionValueSchema = zod.z.json();
 var EqualsConditionSchema = zod.z.object({
   path: PathSchema,
   operator: zod.z.literal("equals"),
-  value: zod.z.json()
+  value: ConditionValueSchema
 }).strict();
 var InConditionSchema = zod.z.object({
   path: PathSchema,
@@ -129,7 +131,6 @@ var OperatorSchema = zod.z.enum([
   "keys_in",
   "size"
 ]);
-var ConditionValueSchema = zod.z.json();
 var V1StatementSchema = zod.z.object({
   id: zod.z.string().optional(),
   effect: zod.z.enum(["allow", "deny"]),
@@ -145,32 +146,93 @@ var V2StatementSchema = zod.z.object({
   conditions: zod.z.array(ConditionSchema).optional()
 }).strict();
 var StatementSchema = V2StatementSchema;
+var StatementIdSchema = zod.z.string().regex(/^s_\S+$/, { error: "Statement id must match ^s_\\S+$" }).max(512);
+var PolicyIdSchema = zod.z.string().regex(/^p_\S+$/, { error: "Policy id must match ^p_\\S+$" }).max(512);
 var V1PolicySchema = zod.z.object({
   version: zod.z.literal(1),
   statements: zod.z.array(V1StatementSchema)
 }).strict();
+var DefaultEffectSchema = zod.z.enum(["deny", "ask"]);
 var V2PolicySchema = zod.z.object({
   version: zod.z.literal(2),
   statements: zod.z.array(V2StatementSchema)
 }).strict();
-var PolicySchema = zod.z.union([V1PolicySchema, V2PolicySchema]);
+var RcRubberduckStatementSchema = zod.z.object({
+  id: StatementIdSchema,
+  effect: zod.z.enum(["allow", "ask", "deny"]),
+  permissions: zod.z.array(zod.z.string()).min(1),
+  resources: zod.z.array(zod.z.string()).min(1),
+  conditions: zod.z.array(ConditionSchema).optional()
+}).strict();
+var RcRubberduckPolicySchema = zod.z.object({
+  version: zod.z.literal(RUBBERDUCK_POLICY_VERSION),
+  id: PolicyIdSchema,
+  defaultEffect: DefaultEffectSchema,
+  statements: zod.z.array(RcRubberduckStatementSchema)
+}).strict();
+var PolicySchema = zod.z.union([
+  V1PolicySchema,
+  V2PolicySchema,
+  RcRubberduckPolicySchema
+]);
 var CanonicalHashSchema = zod.z.custom(
   (value) => typeof value === "string" && /^[0-9a-f]{64}$/.test(value),
   { error: "Expected a 64-character lowercase hex SHA-256 digest" }
 );
-var OverrideBaseShape = {
+var OverrideHashBaseShape = {
   id: zod.z.string().optional(),
+  /**
+   * The canonical hash of the targeted statement.
+   * Used for v1/v2 policies. Must be a valid SHA-256 hex digest (non-null).
+   */
   statementHash: CanonicalHashSchema,
   effect: zod.z.literal("allow")
 };
+var OverrideIdBaseShape = {
+  id: zod.z.string().optional(),
+  /**
+   * The statement id of the targeted statement. Used for rc-rubberduck policies.
+   * Must be a valid statement id (non-null). To target the policy's default
+   * effect, use policyId instead.
+   */
+  statementId: StatementIdSchema,
+  effect: zod.z.literal("allow")
+};
+var OverridePolicyIdBaseShape = {
+  id: zod.z.string().optional(),
+  /**
+   * Targets the policy's default effect. Only applies when this policyId
+   * matches the evaluated policy's id. Used for rc-rubberduck policies.
+   */
+  policyId: PolicyIdSchema,
+  effect: zod.z.literal("allow")
+};
 var OverrideSchema = zod.z.union([
-  zod.z.object({ ...OverrideBaseShape, match: zod.z.literal("any") }).strict(),
-  zod.z.object({ ...OverrideBaseShape, contextHash: CanonicalHashSchema }).strict(),
-  // Empty conditionals is intentional (the "blank check"): the override
-  // applies whenever the targeted ask statement fires, with no extra
-  // conditions. Do not add .min(1) here.
+  // statementHash × match
+  zod.z.object({ ...OverrideHashBaseShape, match: zod.z.literal("any") }).strict(),
+  // statementHash × contextHash
+  zod.z.object({ ...OverrideHashBaseShape, contextHash: CanonicalHashSchema }).strict(),
+  // statementHash × conditionals
+  zod.z.object({
+    ...OverrideHashBaseShape,
+    conditionals: zod.z.array(ConditionSchema)
+  }).strict(),
+  // statementId × match
+  zod.z.object({ ...OverrideIdBaseShape, match: zod.z.literal("any") }).strict(),
+  // statementId × contextHash
+  zod.z.object({ ...OverrideIdBaseShape, contextHash: CanonicalHashSchema }).strict(),
+  // statementId × conditionals
+  zod.z.object({
+    ...OverrideIdBaseShape,
+    conditionals: zod.z.array(ConditionSchema)
+  }).strict(),
+  // policyId × match
+  zod.z.object({ ...OverridePolicyIdBaseShape, match: zod.z.literal("any") }).strict(),
+  // policyId × contextHash
+  zod.z.object({ ...OverridePolicyIdBaseShape, contextHash: CanonicalHashSchema }).strict(),
+  // policyId × conditionals
   zod.z.object({
-    ...OverrideBaseShape,
+    ...OverridePolicyIdBaseShape,
     conditionals: zod.z.array(ConditionSchema)
   }).strict()
 ]);
@@ -180,9 +242,20 @@ function getOpenApiSchema() {
     required: ["version", "statements"],
     properties: {
       version: {
-        type: "integer",
-        enum: [...VALID_VERSIONS],
-        description: `Policy schema version. Must be one of ${JSON.stringify([...VALID_VERSIONS])}.`
+        anyOf: [
+          { type: "integer", enum: [1, 2] },
+          { type: "string", enum: [RUBBERDUCK_POLICY_VERSION] }
+        ],
+        description: "Policy schema version. Stable versions are 1 and 2; supported release candidates are rc-rubberduck."
+      },
+      id: {
+        type: "string",
+        description: "Policy id (required for rc-rubberduck policies). Must use the p_ prefix and contain no whitespace."
+      },
+      defaultEffect: {
+        type: "string",
+        enum: [...DefaultEffectSchema.options],
+        description: "Effect applied when no statement matches. Required on rc-rubberduck policies; deny equals implicit deny."
       },
       statements: {
         type: "array",
@@ -193,12 +266,12 @@ function getOpenApiSchema() {
           properties: {
             id: {
               type: "string",
-              description: "Optional identifier for debugging and provenance. Included in canonical hash."
+              description: "Statement identifier. Required for rc-rubberduck policies; must use the s_ prefix with no whitespace. Optional on v1/v2 for debugging and provenance."
             },
             effect: {
               type: "string",
               enum: [...VALID_EFFECTS].sort(),
-              description: "Whether to allow, ask, or deny the specified permissions. The 'ask' effect is only valid in version 2 policies."
+              description: "Whether to allow, ask, or deny the specified permissions. The 'ask' effect is valid in version 2 and rc-rubberduck policies."
             },
             permissions: {
               type: "array",
@@ -249,13 +322,17 @@ exports.ArrayOperatorSchema = ArrayOperatorSchema;
 exports.CanonicalHashSchema = CanonicalHashSchema;
 exports.ConditionSchema = ConditionSchema;
 exports.ConditionValueSchema = ConditionValueSchema;
+exports.DefaultEffectSchema = DefaultEffectSchema;
 exports.OperatorSchema = OperatorSchema;
 exports.OtherOperatorSchema = OtherOperatorSchema;
 exports.OverrideSchema = OverrideSchema;
+exports.PolicyIdSchema = PolicyIdSchema;
 exports.PolicySchema = PolicySchema;
+exports.RUBBERDUCK_POLICY_VERSION = RUBBERDUCK_POLICY_VERSION;
 exports.RangeValueSchema = RangeValueSchema;
 exports.ScalarOperatorSchema = ScalarOperatorSchema;
 exports.SizeValueSchema = SizeValueSchema;
+exports.StatementIdSchema = StatementIdSchema;
 exports.StatementSchema = StatementSchema;
 exports.UrlOperatorSchema = UrlOperatorSchema;
 exports.VALID_EFFECTS = VALID_EFFECTS;

package/dist/index.d.cts

@@ -1,13 +1,16 @@
 import { z } from 'zod';
 
-/** Current policy document version. */
-declare const VALID_VERSIONS: readonly [1, 2];
+/** Release-candidate policy document version for the current experimental shape. */
+declare const RUBBERDUCK_POLICY_VERSION: "rc-rubberduck";
+/** Supported policy document versions. */
+declare const VALID_VERSIONS: readonly [1, 2, "rc-rubberduck"];
 /** Valid policy effects. */
 declare const VALID_EFFECTS: readonly ["allow", "ask", "deny"];
 /** Derived from VALID_EFFECTS — the constant is the single source of truth. */
 type Effect = (typeof VALID_EFFECTS)[number];
 /** Valid condition operators. */
 declare const VALID_OPERATOR_LIST: readonly ["equals", "exists", "in", "keys_in", "matches", "matches_host", "matches_path", "matches_url", "range", "size", "values_in"];
+declare const ConditionValueSchema: z.ZodJSONSchema;
 declare const RangeValueSchema: z.ZodObject<{
     min: z.ZodOptional<z.ZodNumber>;
     max: z.ZodOptional<z.ZodNumber>;
@@ -114,7 +117,6 @@ declare const OperatorSchema: z.ZodEnum<{
 }>;
 /** Derived from OperatorSchema — the schema is the single source of truth. */
 type Operator = z.infer<typeof OperatorSchema>;
-declare const ConditionValueSchema: z.ZodJSONSchema;
 /** Statement schema accepting the union of all effects (use PolicySchema for version-aware validation). */
 declare const StatementSchema: z.ZodObject<{
     id: z.ZodOptional<z.ZodString>;
@@ -178,6 +180,21 @@ declare const StatementSchema: z.ZodObject<{
 }, z.core.$strict>;
 /** Derived from StatementSchema — the schema is the single source of truth. */
 type Statement = z.infer<typeof StatementSchema>;
+/** Statement identifier for rc-rubberduck policies. Must match ^s_\S+$ and be ≤512 chars. */
+declare const StatementIdSchema: z.ZodString;
+/** Derived from StatementIdSchema — the schema is the single source of truth. */
+type StatementId = z.infer<typeof StatementIdSchema>;
+/** Policy identifier for rc-rubberduck policies. Must match ^p_\S+$ and be ≤512 chars. */
+declare const PolicyIdSchema: z.ZodString;
+/** Derived from PolicyIdSchema — the schema is the single source of truth. */
+type PolicyId = z.infer<typeof PolicyIdSchema>;
+/** Effect applied when no statement matches (rc-rubberduck, required). deny == implicit deny. */
+declare const DefaultEffectSchema: z.ZodEnum<{
+    ask: "ask";
+    deny: "deny";
+}>;
+/** Derived from DefaultEffectSchema — the schema is the single source of truth. */
+type DefaultEffect = z.infer<typeof DefaultEffectSchema>;
 declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
     version: z.ZodLiteral<1>;
     statements: z.ZodArray<z.ZodObject<{
@@ -301,15 +318,93 @@ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
             }, z.core.$strict>]>;
         }, z.core.$strict>]>>>;
     }, z.core.$strict>>;
+}, z.core.$strict>, z.ZodObject<{
+    version: z.ZodLiteral<"rc-rubberduck">;
+    id: z.ZodString;
+    defaultEffect: z.ZodEnum<{
+        ask: "ask";
+        deny: "deny";
+    }>;
+    statements: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        effect: z.ZodEnum<{
+            allow: "allow";
+            ask: "ask";
+            deny: "deny";
+        }>;
+        permissions: z.ZodArray<z.ZodString>;
+        resources: z.ZodArray<z.ZodString>;
+        conditions: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"equals">;
+            value: z.ZodJSONSchema;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"in">;
+            value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"matches">;
+            value: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"matches_host">;
+            value: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"matches_path">;
+            value: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"range">;
+            value: z.ZodObject<{
+                min: z.ZodOptional<z.ZodNumber>;
+                max: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"matches_url">;
+            value: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"values_in">;
+            value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"exists">;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"keys_in">;
+            value: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"size">;
+            value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
+                min: z.ZodOptional<z.ZodNumber>;
+                max: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strict>]>;
+        }, z.core.$strict>]>>>;
+    }, z.core.$strict>>;
 }, z.core.$strict>]>;
 /** Derived from PolicySchema — the schema is the single source of truth. */
 type Policy = z.infer<typeof PolicySchema>;
 /** SHA-256 hex digest of an RFC 8785 (JCS) canonicalized JSON value. */
 declare const CanonicalHashSchema: z.ZodCustom<CanonicalHash, CanonicalHash>;
 /**
- * Runtime schema for the Override type. `.strict()` keeps the variants
- * mutually exclusive (an object carrying two variant fields fails all
- * branches).
+ * Runtime schema for the Override type. Each variant has exactly one target
+ * field (statementHash for v1/v2, statementId or policyId for rc-rubberduck) and exactly
+ * one binding mode (match, contextHash, or conditionals). `.strict()` keeps
+ * the variants mutually exclusive (an object carrying fields from two variants
+ * fails all branches).
+ *
+ * Targets are all non-null:
+ * - statementHash: targets a v1/v2 statement by canonical hash
+ * - statementId: targets an rc-rubberduck statement by id
+ * - policyId: targets that policy's default effect (rc-rubberduck only)
+ *
+ * Empty conditionals is intentional (the "blank check"): the override applies
+ * whenever the targeted ask statement fires, with no extra conditions. Do not
+ * add .min(1) to conditionals.
  */
 declare const OverrideSchema: z.ZodUnion<readonly [z.ZodObject<{
     match: z.ZodLiteral<"any">;
@@ -375,6 +470,134 @@ declare const OverrideSchema: z.ZodUnion<readonly [z.ZodObject<{
     id: z.ZodOptional<z.ZodString>;
     statementHash: z.ZodCustom<CanonicalHash, CanonicalHash>;
     effect: z.ZodLiteral<"allow">;
+}, z.core.$strict>, z.ZodObject<{
+    match: z.ZodLiteral<"any">;
+    id: z.ZodOptional<z.ZodString>;
+    statementId: z.ZodString;
+    effect: z.ZodLiteral<"allow">;
+}, z.core.$strict>, z.ZodObject<{
+    contextHash: z.ZodCustom<CanonicalHash, CanonicalHash>;
+    id: z.ZodOptional<z.ZodString>;
+    statementId: z.ZodString;
+    effect: z.ZodLiteral<"allow">;
+}, z.core.$strict>, z.ZodObject<{
+    conditionals: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"equals">;
+        value: z.ZodJSONSchema;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"in">;
+        value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"matches">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"matches_host">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"matches_path">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"range">;
+        value: z.ZodObject<{
+            min: z.ZodOptional<z.ZodNumber>;
+            max: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"matches_url">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"values_in">;
+        value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"exists">;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"keys_in">;
+        value: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"size">;
+        value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
+            min: z.ZodOptional<z.ZodNumber>;
+            max: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>]>>;
+    id: z.ZodOptional<z.ZodString>;
+    statementId: z.ZodString;
+    effect: z.ZodLiteral<"allow">;
+}, z.core.$strict>, z.ZodObject<{
+    match: z.ZodLiteral<"any">;
+    id: z.ZodOptional<z.ZodString>;
+    policyId: z.ZodString;
+    effect: z.ZodLiteral<"allow">;
+}, z.core.$strict>, z.ZodObject<{
+    contextHash: z.ZodCustom<CanonicalHash, CanonicalHash>;
+    id: z.ZodOptional<z.ZodString>;
+    policyId: z.ZodString;
+    effect: z.ZodLiteral<"allow">;
+}, z.core.$strict>, z.ZodObject<{
+    conditionals: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"equals">;
+        value: z.ZodJSONSchema;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"in">;
+        value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"matches">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"matches_host">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"matches_path">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"range">;
+        value: z.ZodObject<{
+            min: z.ZodOptional<z.ZodNumber>;
+            max: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"matches_url">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"values_in">;
+        value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"exists">;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"keys_in">;
+        value: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"size">;
+        value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
+            min: z.ZodOptional<z.ZodNumber>;
+            max: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>]>>;
+    id: z.ZodOptional<z.ZodString>;
+    policyId: z.ZodString;
+    effect: z.ZodLiteral<"allow">;
 }, z.core.$strict>]>;
 /** Derived from OverrideSchema — the schema is the single source of truth. */
 type Override = z.infer<typeof OverrideSchema>;
@@ -409,6 +632,10 @@ interface OverrideTrace {
     matched: boolean;
     conditionResults?: ConditionTrace[];
 }
+interface DefaultTrace {
+    defaultEffect: DefaultEffect;
+    overrides: OverrideTrace[];
+}
 interface StatementTrace {
     statement: Statement;
     permissionMatched: boolean;
@@ -429,6 +656,8 @@ interface PolicyResult {
     explicit: boolean;
     reason: PolicyReason;
     statements: StatementTrace[];
+    /** Trace mode only. Present when no statement matched and an ask default was consulted (never attached for deny defaults). */
+    default?: DefaultTrace;
 }
 interface ParsedUrl {
     scheme: string;
@@ -465,4 +694,4 @@ interface OpenApiSchema {
     anyOf?: OpenApiSchema[];
 }
 
-export { type ArrayOperator, ArrayOperatorSchema, type CanonicalHash, CanonicalHashSchema, type Condition, ConditionSchema, type ConditionTrace, type ConditionValue, ConditionValueSchema, type Effect, type EvaluatePolicyOptions, type JsonValue, type OpenApiSchema, type Operator, OperatorSchema, type OtherOperator, OtherOperatorSchema, type Override, OverrideSchema, type OverrideTrace, type ParsedUrl, type Policy, type PolicyActionRequest, type PolicyHttpRequest, type PolicyReason, type PolicyRequest, type PolicyResult, PolicySchema, type RangeValue, RangeValueSchema, type ScalarOperator, ScalarOperatorSchema, type SizeValue, SizeValueSchema, type Statement, StatementSchema, type StatementTrace, type UrlOperator, UrlOperatorSchema, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };
+export { type ArrayOperator, ArrayOperatorSchema, type CanonicalHash, CanonicalHashSchema, type Condition, ConditionSchema, type ConditionTrace, type ConditionValue, ConditionValueSchema, type DefaultEffect, DefaultEffectSchema, type DefaultTrace, type Effect, type EvaluatePolicyOptions, type JsonValue, type OpenApiSchema, type Operator, OperatorSchema, type OtherOperator, OtherOperatorSchema, type Override, OverrideSchema, type OverrideTrace, type ParsedUrl, type Policy, type PolicyActionRequest, type PolicyHttpRequest, type PolicyId, PolicyIdSchema, type PolicyReason, type PolicyRequest, type PolicyResult, PolicySchema, RUBBERDUCK_POLICY_VERSION, type RangeValue, RangeValueSchema, type ScalarOperator, ScalarOperatorSchema, type SizeValue, SizeValueSchema, type Statement, type StatementId, StatementIdSchema, StatementSchema, type StatementTrace, type UrlOperator, UrlOperatorSchema, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };

package/dist/index.d.ts

@@ -1,13 +1,16 @@
 import { z } from 'zod';
 
-/** Current policy document version. */
-declare const VALID_VERSIONS: readonly [1, 2];
+/** Release-candidate policy document version for the current experimental shape. */
+declare const RUBBERDUCK_POLICY_VERSION: "rc-rubberduck";
+/** Supported policy document versions. */
+declare const VALID_VERSIONS: readonly [1, 2, "rc-rubberduck"];
 /** Valid policy effects. */
 declare const VALID_EFFECTS: readonly ["allow", "ask", "deny"];
 /** Derived from VALID_EFFECTS — the constant is the single source of truth. */
 type Effect = (typeof VALID_EFFECTS)[number];
 /** Valid condition operators. */
 declare const VALID_OPERATOR_LIST: readonly ["equals", "exists", "in", "keys_in", "matches", "matches_host", "matches_path", "matches_url", "range", "size", "values_in"];
+declare const ConditionValueSchema: z.ZodJSONSchema;
 declare const RangeValueSchema: z.ZodObject<{
     min: z.ZodOptional<z.ZodNumber>;
     max: z.ZodOptional<z.ZodNumber>;
@@ -114,7 +117,6 @@ declare const OperatorSchema: z.ZodEnum<{
 }>;
 /** Derived from OperatorSchema — the schema is the single source of truth. */
 type Operator = z.infer<typeof OperatorSchema>;
-declare const ConditionValueSchema: z.ZodJSONSchema;
 /** Statement schema accepting the union of all effects (use PolicySchema for version-aware validation). */
 declare const StatementSchema: z.ZodObject<{
     id: z.ZodOptional<z.ZodString>;
@@ -178,6 +180,21 @@ declare const StatementSchema: z.ZodObject<{
 }, z.core.$strict>;
 /** Derived from StatementSchema — the schema is the single source of truth. */
 type Statement = z.infer<typeof StatementSchema>;
+/** Statement identifier for rc-rubberduck policies. Must match ^s_\S+$ and be ≤512 chars. */
+declare const StatementIdSchema: z.ZodString;
+/** Derived from StatementIdSchema — the schema is the single source of truth. */
+type StatementId = z.infer<typeof StatementIdSchema>;
+/** Policy identifier for rc-rubberduck policies. Must match ^p_\S+$ and be ≤512 chars. */
+declare const PolicyIdSchema: z.ZodString;
+/** Derived from PolicyIdSchema — the schema is the single source of truth. */
+type PolicyId = z.infer<typeof PolicyIdSchema>;
+/** Effect applied when no statement matches (rc-rubberduck, required). deny == implicit deny. */
+declare const DefaultEffectSchema: z.ZodEnum<{
+    ask: "ask";
+    deny: "deny";
+}>;
+/** Derived from DefaultEffectSchema — the schema is the single source of truth. */
+type DefaultEffect = z.infer<typeof DefaultEffectSchema>;
 declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
     version: z.ZodLiteral<1>;
     statements: z.ZodArray<z.ZodObject<{
@@ -301,15 +318,93 @@ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
             }, z.core.$strict>]>;
         }, z.core.$strict>]>>>;
     }, z.core.$strict>>;
+}, z.core.$strict>, z.ZodObject<{
+    version: z.ZodLiteral<"rc-rubberduck">;
+    id: z.ZodString;
+    defaultEffect: z.ZodEnum<{
+        ask: "ask";
+        deny: "deny";
+    }>;
+    statements: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        effect: z.ZodEnum<{
+            allow: "allow";
+            ask: "ask";
+            deny: "deny";
+        }>;
+        permissions: z.ZodArray<z.ZodString>;
+        resources: z.ZodArray<z.ZodString>;
+        conditions: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"equals">;
+            value: z.ZodJSONSchema;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"in">;
+            value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"matches">;
+            value: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"matches_host">;
+            value: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"matches_path">;
+            value: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"range">;
+            value: z.ZodObject<{
+                min: z.ZodOptional<z.ZodNumber>;
+                max: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"matches_url">;
+            value: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"values_in">;
+            value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"exists">;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"keys_in">;
+            value: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>, z.ZodObject<{
+            path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+            operator: z.ZodLiteral<"size">;
+            value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
+                min: z.ZodOptional<z.ZodNumber>;
+                max: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strict>]>;
+        }, z.core.$strict>]>>>;
+    }, z.core.$strict>>;
 }, z.core.$strict>]>;
 /** Derived from PolicySchema — the schema is the single source of truth. */
 type Policy = z.infer<typeof PolicySchema>;
 /** SHA-256 hex digest of an RFC 8785 (JCS) canonicalized JSON value. */
 declare const CanonicalHashSchema: z.ZodCustom<CanonicalHash, CanonicalHash>;
 /**
- * Runtime schema for the Override type. `.strict()` keeps the variants
- * mutually exclusive (an object carrying two variant fields fails all
- * branches).
+ * Runtime schema for the Override type. Each variant has exactly one target
+ * field (statementHash for v1/v2, statementId or policyId for rc-rubberduck) and exactly
+ * one binding mode (match, contextHash, or conditionals). `.strict()` keeps
+ * the variants mutually exclusive (an object carrying fields from two variants
+ * fails all branches).
+ *
+ * Targets are all non-null:
+ * - statementHash: targets a v1/v2 statement by canonical hash
+ * - statementId: targets an rc-rubberduck statement by id
+ * - policyId: targets that policy's default effect (rc-rubberduck only)
+ *
+ * Empty conditionals is intentional (the "blank check"): the override applies
+ * whenever the targeted ask statement fires, with no extra conditions. Do not
+ * add .min(1) to conditionals.
  */
 declare const OverrideSchema: z.ZodUnion<readonly [z.ZodObject<{
     match: z.ZodLiteral<"any">;
@@ -375,6 +470,134 @@ declare const OverrideSchema: z.ZodUnion<readonly [z.ZodObject<{
     id: z.ZodOptional<z.ZodString>;
     statementHash: z.ZodCustom<CanonicalHash, CanonicalHash>;
     effect: z.ZodLiteral<"allow">;
+}, z.core.$strict>, z.ZodObject<{
+    match: z.ZodLiteral<"any">;
+    id: z.ZodOptional<z.ZodString>;
+    statementId: z.ZodString;
+    effect: z.ZodLiteral<"allow">;
+}, z.core.$strict>, z.ZodObject<{
+    contextHash: z.ZodCustom<CanonicalHash, CanonicalHash>;
+    id: z.ZodOptional<z.ZodString>;
+    statementId: z.ZodString;
+    effect: z.ZodLiteral<"allow">;
+}, z.core.$strict>, z.ZodObject<{
+    conditionals: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"equals">;
+        value: z.ZodJSONSchema;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"in">;
+        value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"matches">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"matches_host">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"matches_path">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"range">;
+        value: z.ZodObject<{
+            min: z.ZodOptional<z.ZodNumber>;
+            max: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"matches_url">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"values_in">;
+        value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"exists">;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"keys_in">;
+        value: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"size">;
+        value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
+            min: z.ZodOptional<z.ZodNumber>;
+            max: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>]>>;
+    id: z.ZodOptional<z.ZodString>;
+    statementId: z.ZodString;
+    effect: z.ZodLiteral<"allow">;
+}, z.core.$strict>, z.ZodObject<{
+    match: z.ZodLiteral<"any">;
+    id: z.ZodOptional<z.ZodString>;
+    policyId: z.ZodString;
+    effect: z.ZodLiteral<"allow">;
+}, z.core.$strict>, z.ZodObject<{
+    contextHash: z.ZodCustom<CanonicalHash, CanonicalHash>;
+    id: z.ZodOptional<z.ZodString>;
+    policyId: z.ZodString;
+    effect: z.ZodLiteral<"allow">;
+}, z.core.$strict>, z.ZodObject<{
+    conditionals: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"equals">;
+        value: z.ZodJSONSchema;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"in">;
+        value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"matches">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"matches_host">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"matches_path">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"range">;
+        value: z.ZodObject<{
+            min: z.ZodOptional<z.ZodNumber>;
+            max: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"matches_url">;
+        value: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"values_in">;
+        value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"exists">;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"keys_in">;
+        value: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
+        operator: z.ZodLiteral<"size">;
+        value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
+            min: z.ZodOptional<z.ZodNumber>;
+            max: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>]>;
+    }, z.core.$strict>]>>;
+    id: z.ZodOptional<z.ZodString>;
+    policyId: z.ZodString;
+    effect: z.ZodLiteral<"allow">;
 }, z.core.$strict>]>;
 /** Derived from OverrideSchema — the schema is the single source of truth. */
 type Override = z.infer<typeof OverrideSchema>;
@@ -409,6 +632,10 @@ interface OverrideTrace {
     matched: boolean;
     conditionResults?: ConditionTrace[];
 }
+interface DefaultTrace {
+    defaultEffect: DefaultEffect;
+    overrides: OverrideTrace[];
+}
 interface StatementTrace {
     statement: Statement;
     permissionMatched: boolean;
@@ -429,6 +656,8 @@ interface PolicyResult {
     explicit: boolean;
     reason: PolicyReason;
     statements: StatementTrace[];
+    /** Trace mode only. Present when no statement matched and an ask default was consulted (never attached for deny defaults). */
+    default?: DefaultTrace;
 }
 interface ParsedUrl {
     scheme: string;
@@ -465,4 +694,4 @@ interface OpenApiSchema {
     anyOf?: OpenApiSchema[];
 }
 
-export { type ArrayOperator, ArrayOperatorSchema, type CanonicalHash, CanonicalHashSchema, type Condition, ConditionSchema, type ConditionTrace, type ConditionValue, ConditionValueSchema, type Effect, type EvaluatePolicyOptions, type JsonValue, type OpenApiSchema, type Operator, OperatorSchema, type OtherOperator, OtherOperatorSchema, type Override, OverrideSchema, type OverrideTrace, type ParsedUrl, type Policy, type PolicyActionRequest, type PolicyHttpRequest, type PolicyReason, type PolicyRequest, type PolicyResult, PolicySchema, type RangeValue, RangeValueSchema, type ScalarOperator, ScalarOperatorSchema, type SizeValue, SizeValueSchema, type Statement, StatementSchema, type StatementTrace, type UrlOperator, UrlOperatorSchema, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };
+export { type ArrayOperator, ArrayOperatorSchema, type CanonicalHash, CanonicalHashSchema, type Condition, ConditionSchema, type ConditionTrace, type ConditionValue, ConditionValueSchema, type DefaultEffect, DefaultEffectSchema, type DefaultTrace, type Effect, type EvaluatePolicyOptions, type JsonValue, type OpenApiSchema, type Operator, OperatorSchema, type OtherOperator, OtherOperatorSchema, type Override, OverrideSchema, type OverrideTrace, type ParsedUrl, type Policy, type PolicyActionRequest, type PolicyHttpRequest, type PolicyId, PolicyIdSchema, type PolicyReason, type PolicyRequest, type PolicyResult, PolicySchema, RUBBERDUCK_POLICY_VERSION, type RangeValue, RangeValueSchema, type ScalarOperator, ScalarOperatorSchema, type SizeValue, SizeValueSchema, type Statement, type StatementId, StatementIdSchema, StatementSchema, type StatementTrace, type UrlOperator, UrlOperatorSchema, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };

package/dist/index.mjs

@@ -1,7 +1,8 @@
 import { z } from 'zod';
 
 // src/schema.ts
-var VALID_VERSIONS = [1, 2];
+var RUBBERDUCK_POLICY_VERSION = "rc-rubberduck";
+var VALID_VERSIONS = [1, 2, RUBBERDUCK_POLICY_VERSION];
 var VALID_EFFECTS = ["allow", "ask", "deny"];
 var VALID_OPERATOR_LIST = [
   "equals",
@@ -18,10 +19,11 @@ var VALID_OPERATOR_LIST = [
 ];
 var ScalarSchema = z.union([z.string(), z.number(), z.boolean()]);
 var PathSchema = z.array(z.union([z.string(), z.number()])).min(1);
+var ConditionValueSchema = z.json();
 var EqualsConditionSchema = z.object({
   path: PathSchema,
   operator: z.literal("equals"),
-  value: z.json()
+  value: ConditionValueSchema
 }).strict();
 var InConditionSchema = z.object({
   path: PathSchema,
@@ -127,7 +129,6 @@ var OperatorSchema = z.enum([
   "keys_in",
   "size"
 ]);
-var ConditionValueSchema = z.json();
 var V1StatementSchema = z.object({
   id: z.string().optional(),
   effect: z.enum(["allow", "deny"]),
@@ -143,32 +144,93 @@ var V2StatementSchema = z.object({
   conditions: z.array(ConditionSchema).optional()
 }).strict();
 var StatementSchema = V2StatementSchema;
+var StatementIdSchema = z.string().regex(/^s_\S+$/, { error: "Statement id must match ^s_\\S+$" }).max(512);
+var PolicyIdSchema = z.string().regex(/^p_\S+$/, { error: "Policy id must match ^p_\\S+$" }).max(512);
 var V1PolicySchema = z.object({
   version: z.literal(1),
   statements: z.array(V1StatementSchema)
 }).strict();
+var DefaultEffectSchema = z.enum(["deny", "ask"]);
 var V2PolicySchema = z.object({
   version: z.literal(2),
   statements: z.array(V2StatementSchema)
 }).strict();
-var PolicySchema = z.union([V1PolicySchema, V2PolicySchema]);
+var RcRubberduckStatementSchema = z.object({
+  id: StatementIdSchema,
+  effect: z.enum(["allow", "ask", "deny"]),
+  permissions: z.array(z.string()).min(1),
+  resources: z.array(z.string()).min(1),
+  conditions: z.array(ConditionSchema).optional()
+}).strict();
+var RcRubberduckPolicySchema = z.object({
+  version: z.literal(RUBBERDUCK_POLICY_VERSION),
+  id: PolicyIdSchema,
+  defaultEffect: DefaultEffectSchema,
+  statements: z.array(RcRubberduckStatementSchema)
+}).strict();
+var PolicySchema = z.union([
+  V1PolicySchema,
+  V2PolicySchema,
+  RcRubberduckPolicySchema
+]);
 var CanonicalHashSchema = z.custom(
   (value) => typeof value === "string" && /^[0-9a-f]{64}$/.test(value),
   { error: "Expected a 64-character lowercase hex SHA-256 digest" }
 );
-var OverrideBaseShape = {
+var OverrideHashBaseShape = {
   id: z.string().optional(),
+  /**
+   * The canonical hash of the targeted statement.
+   * Used for v1/v2 policies. Must be a valid SHA-256 hex digest (non-null).
+   */
   statementHash: CanonicalHashSchema,
   effect: z.literal("allow")
 };
+var OverrideIdBaseShape = {
+  id: z.string().optional(),
+  /**
+   * The statement id of the targeted statement. Used for rc-rubberduck policies.
+   * Must be a valid statement id (non-null). To target the policy's default
+   * effect, use policyId instead.
+   */
+  statementId: StatementIdSchema,
+  effect: z.literal("allow")
+};
+var OverridePolicyIdBaseShape = {
+  id: z.string().optional(),
+  /**
+   * Targets the policy's default effect. Only applies when this policyId
+   * matches the evaluated policy's id. Used for rc-rubberduck policies.
+   */
+  policyId: PolicyIdSchema,
+  effect: z.literal("allow")
+};
 var OverrideSchema = z.union([
-  z.object({ ...OverrideBaseShape, match: z.literal("any") }).strict(),
-  z.object({ ...OverrideBaseShape, contextHash: CanonicalHashSchema }).strict(),
-  // Empty conditionals is intentional (the "blank check"): the override
-  // applies whenever the targeted ask statement fires, with no extra
-  // conditions. Do not add .min(1) here.
+  // statementHash × match
+  z.object({ ...OverrideHashBaseShape, match: z.literal("any") }).strict(),
+  // statementHash × contextHash
+  z.object({ ...OverrideHashBaseShape, contextHash: CanonicalHashSchema }).strict(),
+  // statementHash × conditionals
+  z.object({
+    ...OverrideHashBaseShape,
+    conditionals: z.array(ConditionSchema)
+  }).strict(),
+  // statementId × match
+  z.object({ ...OverrideIdBaseShape, match: z.literal("any") }).strict(),
+  // statementId × contextHash
+  z.object({ ...OverrideIdBaseShape, contextHash: CanonicalHashSchema }).strict(),
+  // statementId × conditionals
+  z.object({
+    ...OverrideIdBaseShape,
+    conditionals: z.array(ConditionSchema)
+  }).strict(),
+  // policyId × match
+  z.object({ ...OverridePolicyIdBaseShape, match: z.literal("any") }).strict(),
+  // policyId × contextHash
+  z.object({ ...OverridePolicyIdBaseShape, contextHash: CanonicalHashSchema }).strict(),
+  // policyId × conditionals
   z.object({
-    ...OverrideBaseShape,
+    ...OverridePolicyIdBaseShape,
     conditionals: z.array(ConditionSchema)
   }).strict()
 ]);
@@ -178,9 +240,20 @@ function getOpenApiSchema() {
     required: ["version", "statements"],
     properties: {
       version: {
-        type: "integer",
-        enum: [...VALID_VERSIONS],
-        description: `Policy schema version. Must be one of ${JSON.stringify([...VALID_VERSIONS])}.`
+        anyOf: [
+          { type: "integer", enum: [1, 2] },
+          { type: "string", enum: [RUBBERDUCK_POLICY_VERSION] }
+        ],
+        description: "Policy schema version. Stable versions are 1 and 2; supported release candidates are rc-rubberduck."
+      },
+      id: {
+        type: "string",
+        description: "Policy id (required for rc-rubberduck policies). Must use the p_ prefix and contain no whitespace."
+      },
+      defaultEffect: {
+        type: "string",
+        enum: [...DefaultEffectSchema.options],
+        description: "Effect applied when no statement matches. Required on rc-rubberduck policies; deny equals implicit deny."
       },
       statements: {
         type: "array",
@@ -191,12 +264,12 @@ function getOpenApiSchema() {
           properties: {
             id: {
               type: "string",
-              description: "Optional identifier for debugging and provenance. Included in canonical hash."
+              description: "Statement identifier. Required for rc-rubberduck policies; must use the s_ prefix with no whitespace. Optional on v1/v2 for debugging and provenance."
             },
             effect: {
               type: "string",
               enum: [...VALID_EFFECTS].sort(),
-              description: "Whether to allow, ask, or deny the specified permissions. The 'ask' effect is only valid in version 2 policies."
+              description: "Whether to allow, ask, or deny the specified permissions. The 'ask' effect is valid in version 2 and rc-rubberduck policies."
             },
             permissions: {
               type: "array",
@@ -243,4 +316,4 @@ function getOpenApiSchema() {
   };
 }
 
-export { ArrayOperatorSchema, CanonicalHashSchema, ConditionSchema, ConditionValueSchema, OperatorSchema, OtherOperatorSchema, OverrideSchema, PolicySchema, RangeValueSchema, ScalarOperatorSchema, SizeValueSchema, StatementSchema, UrlOperatorSchema, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };
+export { ArrayOperatorSchema, CanonicalHashSchema, ConditionSchema, ConditionValueSchema, DefaultEffectSchema, OperatorSchema, OtherOperatorSchema, OverrideSchema, PolicyIdSchema, PolicySchema, RUBBERDUCK_POLICY_VERSION, RangeValueSchema, ScalarOperatorSchema, SizeValueSchema, StatementIdSchema, StatementSchema, UrlOperatorSchema, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zapier/policy-schema",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "description": "Zod schemas and TypeScript types for the Zapier policy engine",
   "type": "module",
   "main": "dist/index.cjs",