@zapier/policy-schema 0.13.0 → 0.17.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/index.d.cts CHANGED
@@ -1,13 +1,23 @@
1
1
  import { z } from 'zod';
2
2
 
3
- /** Current policy document version. */
4
- declare const VALID_VERSIONS: readonly [1, 2];
3
+ /** Release-candidate policy document version for the current experimental shape. */
4
+ declare const RUBBERDUCK_POLICY_VERSION: "rc-rubberduck";
5
+ /** Supported policy document versions. */
6
+ declare const VALID_VERSIONS: readonly [1, 2, 3, "rc-rubberduck"];
7
+ /**
8
+ * Versions whose statements carry an id (s_/p_) and are therefore targeted by
9
+ * that id rather than canonical hash. Single source of truth shared with the
10
+ * engine's usesIds override-targeting predicate: "requires an id" and
11
+ * "targeted by id" coincide for every supported version.
12
+ */
13
+ declare const ID_BASED_VERSIONS: Set<"rc-rubberduck" | 1 | 2 | 3>;
5
14
  /** Valid policy effects. */
6
15
  declare const VALID_EFFECTS: readonly ["allow", "ask", "deny"];
7
16
  /** Derived from VALID_EFFECTS — the constant is the single source of truth. */
8
17
  type Effect = (typeof VALID_EFFECTS)[number];
9
18
  /** Valid condition operators. */
10
- declare const VALID_OPERATOR_LIST: readonly ["equals", "exists", "in", "keys_in", "matches", "matches_host", "matches_path", "matches_url", "range", "size", "values_in"];
19
+ declare const VALID_OPERATOR_LIST: readonly ["all", "equals", "exists", "in", "keys_in", "matches", "matches_host", "matches_path", "matches_url", "none", "range", "size", "some", "values_in"];
20
+ declare const ConditionValueSchema: z.ZodJSONSchema;
11
21
  declare const RangeValueSchema: z.ZodObject<{
12
22
  min: z.ZodOptional<z.ZodNumber>;
13
23
  max: z.ZodOptional<z.ZodNumber>;
@@ -69,6 +79,63 @@ declare const ConditionSchema: z.ZodUnion<readonly [z.ZodObject<{
69
79
  min: z.ZodOptional<z.ZodNumber>;
70
80
  max: z.ZodOptional<z.ZodNumber>;
71
81
  }, z.core.$strict>]>;
82
+ }, z.core.$strict>, z.ZodObject<{
83
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
84
+ operator: z.ZodEnum<{
85
+ some: "some";
86
+ all: "all";
87
+ none: "none";
88
+ }>;
89
+ where: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
90
+ operator: z.ZodLiteral<"equals">;
91
+ value: z.ZodJSONSchema;
92
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
93
+ }, z.core.$strict>, z.ZodObject<{
94
+ operator: z.ZodLiteral<"in">;
95
+ value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
96
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
97
+ }, z.core.$strict>, z.ZodObject<{
98
+ operator: z.ZodLiteral<"matches">;
99
+ value: z.ZodString;
100
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
101
+ }, z.core.$strict>, z.ZodObject<{
102
+ operator: z.ZodLiteral<"matches_host">;
103
+ value: z.ZodString;
104
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
105
+ }, z.core.$strict>, z.ZodObject<{
106
+ operator: z.ZodLiteral<"matches_path">;
107
+ value: z.ZodString;
108
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
109
+ }, z.core.$strict>, z.ZodObject<{
110
+ operator: z.ZodLiteral<"range">;
111
+ value: z.ZodObject<{
112
+ min: z.ZodOptional<z.ZodNumber>;
113
+ max: z.ZodOptional<z.ZodNumber>;
114
+ }, z.core.$strict>;
115
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
116
+ }, z.core.$strict>, z.ZodObject<{
117
+ operator: z.ZodLiteral<"matches_url">;
118
+ value: z.ZodString;
119
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
120
+ }, z.core.$strict>, z.ZodObject<{
121
+ operator: z.ZodLiteral<"values_in">;
122
+ value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
123
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
124
+ }, z.core.$strict>, z.ZodObject<{
125
+ operator: z.ZodLiteral<"exists">;
126
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
127
+ }, z.core.$strict>, z.ZodObject<{
128
+ operator: z.ZodLiteral<"keys_in">;
129
+ value: z.ZodArray<z.ZodString>;
130
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
131
+ }, z.core.$strict>, z.ZodObject<{
132
+ operator: z.ZodLiteral<"size">;
133
+ value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
134
+ min: z.ZodOptional<z.ZodNumber>;
135
+ max: z.ZodOptional<z.ZodNumber>;
136
+ }, z.core.$strict>]>;
137
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
138
+ }, z.core.$strict>]>>;
72
139
  }, z.core.$strict>]>;
73
140
  /** Derived from ConditionSchema — the schema is the single source of truth. */
74
141
  type Condition = z.infer<typeof ConditionSchema>;
@@ -84,6 +151,9 @@ declare const ScalarOperatorSchema: z.ZodEnum<{
84
151
  type ScalarOperator = z.infer<typeof ScalarOperatorSchema>;
85
152
  declare const ArrayOperatorSchema: z.ZodEnum<{
86
153
  values_in: "values_in";
154
+ some: "some";
155
+ all: "all";
156
+ none: "none";
87
157
  }>;
88
158
  /** Derived from ArrayOperatorSchema — the schema is the single source of truth. */
89
159
  type ArrayOperator = z.infer<typeof ArrayOperatorSchema>;
@@ -101,27 +171,29 @@ declare const OtherOperatorSchema: z.ZodEnum<{
101
171
  type OtherOperator = z.infer<typeof OtherOperatorSchema>;
102
172
  declare const OperatorSchema: z.ZodEnum<{
103
173
  equals: "equals";
104
- exists: "exists";
105
174
  in: "in";
106
- keys_in: "keys_in";
107
175
  matches: "matches";
108
176
  matches_host: "matches_host";
109
177
  matches_path: "matches_path";
110
- matches_url: "matches_url";
111
178
  range: "range";
112
- size: "size";
179
+ matches_url: "matches_url";
113
180
  values_in: "values_in";
181
+ exists: "exists";
182
+ keys_in: "keys_in";
183
+ size: "size";
184
+ some: "some";
185
+ all: "all";
186
+ none: "none";
114
187
  }>;
115
188
  /** Derived from OperatorSchema — the schema is the single source of truth. */
116
189
  type Operator = z.infer<typeof OperatorSchema>;
117
- declare const ConditionValueSchema: z.ZodJSONSchema;
118
190
  /** Statement schema accepting the union of all effects (use PolicySchema for version-aware validation). */
119
191
  declare const StatementSchema: z.ZodObject<{
120
192
  id: z.ZodOptional<z.ZodString>;
121
193
  effect: z.ZodEnum<{
122
194
  allow: "allow";
123
- ask: "ask";
124
195
  deny: "deny";
196
+ ask: "ask";
125
197
  }>;
126
198
  permissions: z.ZodArray<z.ZodString>;
127
199
  resources: z.ZodArray<z.ZodString>;
@@ -174,10 +246,84 @@ declare const StatementSchema: z.ZodObject<{
174
246
  min: z.ZodOptional<z.ZodNumber>;
175
247
  max: z.ZodOptional<z.ZodNumber>;
176
248
  }, z.core.$strict>]>;
249
+ }, z.core.$strict>, z.ZodObject<{
250
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
251
+ operator: z.ZodEnum<{
252
+ some: "some";
253
+ all: "all";
254
+ none: "none";
255
+ }>;
256
+ where: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
257
+ operator: z.ZodLiteral<"equals">;
258
+ value: z.ZodJSONSchema;
259
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
260
+ }, z.core.$strict>, z.ZodObject<{
261
+ operator: z.ZodLiteral<"in">;
262
+ value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
263
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
264
+ }, z.core.$strict>, z.ZodObject<{
265
+ operator: z.ZodLiteral<"matches">;
266
+ value: z.ZodString;
267
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
268
+ }, z.core.$strict>, z.ZodObject<{
269
+ operator: z.ZodLiteral<"matches_host">;
270
+ value: z.ZodString;
271
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
272
+ }, z.core.$strict>, z.ZodObject<{
273
+ operator: z.ZodLiteral<"matches_path">;
274
+ value: z.ZodString;
275
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
276
+ }, z.core.$strict>, z.ZodObject<{
277
+ operator: z.ZodLiteral<"range">;
278
+ value: z.ZodObject<{
279
+ min: z.ZodOptional<z.ZodNumber>;
280
+ max: z.ZodOptional<z.ZodNumber>;
281
+ }, z.core.$strict>;
282
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
283
+ }, z.core.$strict>, z.ZodObject<{
284
+ operator: z.ZodLiteral<"matches_url">;
285
+ value: z.ZodString;
286
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
287
+ }, z.core.$strict>, z.ZodObject<{
288
+ operator: z.ZodLiteral<"values_in">;
289
+ value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
290
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
291
+ }, z.core.$strict>, z.ZodObject<{
292
+ operator: z.ZodLiteral<"exists">;
293
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
294
+ }, z.core.$strict>, z.ZodObject<{
295
+ operator: z.ZodLiteral<"keys_in">;
296
+ value: z.ZodArray<z.ZodString>;
297
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
298
+ }, z.core.$strict>, z.ZodObject<{
299
+ operator: z.ZodLiteral<"size">;
300
+ value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
301
+ min: z.ZodOptional<z.ZodNumber>;
302
+ max: z.ZodOptional<z.ZodNumber>;
303
+ }, z.core.$strict>]>;
304
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
305
+ }, z.core.$strict>]>>;
177
306
  }, z.core.$strict>]>>>;
178
307
  }, z.core.$strict>;
179
308
  /** Derived from StatementSchema — the schema is the single source of truth. */
180
309
  type Statement = z.infer<typeof StatementSchema>;
310
+ /** Statement identifier for rc-rubberduck policies. Must match ^s_\S+$ and be ≤512 chars. */
311
+ declare const StatementIdSchema: z.ZodString;
312
+ /** Derived from StatementIdSchema — the schema is the single source of truth. */
313
+ type StatementId = z.infer<typeof StatementIdSchema>;
314
+ /** Policy identifier for rc-rubberduck policies. Must match ^p_\S+$ and be ≤512 chars. */
315
+ declare const PolicyIdSchema: z.ZodString;
316
+ /** Derived from PolicyIdSchema — the schema is the single source of truth. */
317
+ type PolicyId = z.infer<typeof PolicyIdSchema>;
318
+ /** Effect applied when no statement matches (rc-rubberduck, required). deny == implicit deny. */
319
+ declare const DefaultEffectSchema: z.ZodEnum<{
320
+ deny: "deny";
321
+ ask: "ask";
322
+ }>;
323
+ /** Derived from DefaultEffectSchema — the schema is the single source of truth. */
324
+ type DefaultEffect = z.infer<typeof DefaultEffectSchema>;
325
+ /** Upper bound on v3 statement tiers. Raising this later is backwards-compatible. */
326
+ declare const V3_MAX_TIERS = 3;
181
327
  declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
182
328
  version: z.ZodLiteral<1>;
183
329
  statements: z.ZodArray<z.ZodObject<{
@@ -237,6 +383,63 @@ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
237
383
  min: z.ZodOptional<z.ZodNumber>;
238
384
  max: z.ZodOptional<z.ZodNumber>;
239
385
  }, z.core.$strict>]>;
386
+ }, z.core.$strict>, z.ZodObject<{
387
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
388
+ operator: z.ZodEnum<{
389
+ some: "some";
390
+ all: "all";
391
+ none: "none";
392
+ }>;
393
+ where: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
394
+ operator: z.ZodLiteral<"equals">;
395
+ value: z.ZodJSONSchema;
396
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
397
+ }, z.core.$strict>, z.ZodObject<{
398
+ operator: z.ZodLiteral<"in">;
399
+ value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
400
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
401
+ }, z.core.$strict>, z.ZodObject<{
402
+ operator: z.ZodLiteral<"matches">;
403
+ value: z.ZodString;
404
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
405
+ }, z.core.$strict>, z.ZodObject<{
406
+ operator: z.ZodLiteral<"matches_host">;
407
+ value: z.ZodString;
408
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
409
+ }, z.core.$strict>, z.ZodObject<{
410
+ operator: z.ZodLiteral<"matches_path">;
411
+ value: z.ZodString;
412
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
413
+ }, z.core.$strict>, z.ZodObject<{
414
+ operator: z.ZodLiteral<"range">;
415
+ value: z.ZodObject<{
416
+ min: z.ZodOptional<z.ZodNumber>;
417
+ max: z.ZodOptional<z.ZodNumber>;
418
+ }, z.core.$strict>;
419
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
420
+ }, z.core.$strict>, z.ZodObject<{
421
+ operator: z.ZodLiteral<"matches_url">;
422
+ value: z.ZodString;
423
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
424
+ }, z.core.$strict>, z.ZodObject<{
425
+ operator: z.ZodLiteral<"values_in">;
426
+ value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
427
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
428
+ }, z.core.$strict>, z.ZodObject<{
429
+ operator: z.ZodLiteral<"exists">;
430
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
431
+ }, z.core.$strict>, z.ZodObject<{
432
+ operator: z.ZodLiteral<"keys_in">;
433
+ value: z.ZodArray<z.ZodString>;
434
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
435
+ }, z.core.$strict>, z.ZodObject<{
436
+ operator: z.ZodLiteral<"size">;
437
+ value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
438
+ min: z.ZodOptional<z.ZodNumber>;
439
+ max: z.ZodOptional<z.ZodNumber>;
440
+ }, z.core.$strict>]>;
441
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
442
+ }, z.core.$strict>]>>;
240
443
  }, z.core.$strict>]>>>;
241
444
  }, z.core.$strict>>;
242
445
  }, z.core.$strict>, z.ZodObject<{
@@ -245,8 +448,251 @@ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
245
448
  id: z.ZodOptional<z.ZodString>;
246
449
  effect: z.ZodEnum<{
247
450
  allow: "allow";
451
+ deny: "deny";
452
+ ask: "ask";
453
+ }>;
454
+ permissions: z.ZodArray<z.ZodString>;
455
+ resources: z.ZodArray<z.ZodString>;
456
+ conditions: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
457
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
458
+ operator: z.ZodLiteral<"equals">;
459
+ value: z.ZodJSONSchema;
460
+ }, z.core.$strict>, z.ZodObject<{
461
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
462
+ operator: z.ZodLiteral<"in">;
463
+ value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
464
+ }, z.core.$strict>, z.ZodObject<{
465
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
466
+ operator: z.ZodLiteral<"matches">;
467
+ value: z.ZodString;
468
+ }, z.core.$strict>, z.ZodObject<{
469
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
470
+ operator: z.ZodLiteral<"matches_host">;
471
+ value: z.ZodString;
472
+ }, z.core.$strict>, z.ZodObject<{
473
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
474
+ operator: z.ZodLiteral<"matches_path">;
475
+ value: z.ZodString;
476
+ }, z.core.$strict>, z.ZodObject<{
477
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
478
+ operator: z.ZodLiteral<"range">;
479
+ value: z.ZodObject<{
480
+ min: z.ZodOptional<z.ZodNumber>;
481
+ max: z.ZodOptional<z.ZodNumber>;
482
+ }, z.core.$strict>;
483
+ }, z.core.$strict>, z.ZodObject<{
484
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
485
+ operator: z.ZodLiteral<"matches_url">;
486
+ value: z.ZodString;
487
+ }, z.core.$strict>, z.ZodObject<{
488
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
489
+ operator: z.ZodLiteral<"values_in">;
490
+ value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
491
+ }, z.core.$strict>, z.ZodObject<{
492
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
493
+ operator: z.ZodLiteral<"exists">;
494
+ }, z.core.$strict>, z.ZodObject<{
495
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
496
+ operator: z.ZodLiteral<"keys_in">;
497
+ value: z.ZodArray<z.ZodString>;
498
+ }, z.core.$strict>, z.ZodObject<{
499
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
500
+ operator: z.ZodLiteral<"size">;
501
+ value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
502
+ min: z.ZodOptional<z.ZodNumber>;
503
+ max: z.ZodOptional<z.ZodNumber>;
504
+ }, z.core.$strict>]>;
505
+ }, z.core.$strict>, z.ZodObject<{
506
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
507
+ operator: z.ZodEnum<{
508
+ some: "some";
509
+ all: "all";
510
+ none: "none";
511
+ }>;
512
+ where: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
513
+ operator: z.ZodLiteral<"equals">;
514
+ value: z.ZodJSONSchema;
515
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
516
+ }, z.core.$strict>, z.ZodObject<{
517
+ operator: z.ZodLiteral<"in">;
518
+ value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
519
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
520
+ }, z.core.$strict>, z.ZodObject<{
521
+ operator: z.ZodLiteral<"matches">;
522
+ value: z.ZodString;
523
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
524
+ }, z.core.$strict>, z.ZodObject<{
525
+ operator: z.ZodLiteral<"matches_host">;
526
+ value: z.ZodString;
527
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
528
+ }, z.core.$strict>, z.ZodObject<{
529
+ operator: z.ZodLiteral<"matches_path">;
530
+ value: z.ZodString;
531
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
532
+ }, z.core.$strict>, z.ZodObject<{
533
+ operator: z.ZodLiteral<"range">;
534
+ value: z.ZodObject<{
535
+ min: z.ZodOptional<z.ZodNumber>;
536
+ max: z.ZodOptional<z.ZodNumber>;
537
+ }, z.core.$strict>;
538
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
539
+ }, z.core.$strict>, z.ZodObject<{
540
+ operator: z.ZodLiteral<"matches_url">;
541
+ value: z.ZodString;
542
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
543
+ }, z.core.$strict>, z.ZodObject<{
544
+ operator: z.ZodLiteral<"values_in">;
545
+ value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
546
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
547
+ }, z.core.$strict>, z.ZodObject<{
548
+ operator: z.ZodLiteral<"exists">;
549
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
550
+ }, z.core.$strict>, z.ZodObject<{
551
+ operator: z.ZodLiteral<"keys_in">;
552
+ value: z.ZodArray<z.ZodString>;
553
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
554
+ }, z.core.$strict>, z.ZodObject<{
555
+ operator: z.ZodLiteral<"size">;
556
+ value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
557
+ min: z.ZodOptional<z.ZodNumber>;
558
+ max: z.ZodOptional<z.ZodNumber>;
559
+ }, z.core.$strict>]>;
560
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
561
+ }, z.core.$strict>]>>;
562
+ }, z.core.$strict>]>>>;
563
+ }, z.core.$strict>>;
564
+ }, z.core.$strict>, z.ZodObject<{
565
+ version: z.ZodLiteral<3>;
566
+ statements: z.ZodArray<z.ZodArray<z.ZodObject<{
567
+ id: z.ZodString;
568
+ effect: z.ZodEnum<{
569
+ allow: "allow";
570
+ deny: "deny";
248
571
  ask: "ask";
572
+ }>;
573
+ permissions: z.ZodArray<z.ZodString>;
574
+ resources: z.ZodArray<z.ZodString>;
575
+ conditions: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
576
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
577
+ operator: z.ZodLiteral<"equals">;
578
+ value: z.ZodJSONSchema;
579
+ }, z.core.$strict>, z.ZodObject<{
580
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
581
+ operator: z.ZodLiteral<"in">;
582
+ value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
583
+ }, z.core.$strict>, z.ZodObject<{
584
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
585
+ operator: z.ZodLiteral<"matches">;
586
+ value: z.ZodString;
587
+ }, z.core.$strict>, z.ZodObject<{
588
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
589
+ operator: z.ZodLiteral<"matches_host">;
590
+ value: z.ZodString;
591
+ }, z.core.$strict>, z.ZodObject<{
592
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
593
+ operator: z.ZodLiteral<"matches_path">;
594
+ value: z.ZodString;
595
+ }, z.core.$strict>, z.ZodObject<{
596
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
597
+ operator: z.ZodLiteral<"range">;
598
+ value: z.ZodObject<{
599
+ min: z.ZodOptional<z.ZodNumber>;
600
+ max: z.ZodOptional<z.ZodNumber>;
601
+ }, z.core.$strict>;
602
+ }, z.core.$strict>, z.ZodObject<{
603
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
604
+ operator: z.ZodLiteral<"matches_url">;
605
+ value: z.ZodString;
606
+ }, z.core.$strict>, z.ZodObject<{
607
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
608
+ operator: z.ZodLiteral<"values_in">;
609
+ value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
610
+ }, z.core.$strict>, z.ZodObject<{
611
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
612
+ operator: z.ZodLiteral<"exists">;
613
+ }, z.core.$strict>, z.ZodObject<{
614
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
615
+ operator: z.ZodLiteral<"keys_in">;
616
+ value: z.ZodArray<z.ZodString>;
617
+ }, z.core.$strict>, z.ZodObject<{
618
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
619
+ operator: z.ZodLiteral<"size">;
620
+ value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
621
+ min: z.ZodOptional<z.ZodNumber>;
622
+ max: z.ZodOptional<z.ZodNumber>;
623
+ }, z.core.$strict>]>;
624
+ }, z.core.$strict>, z.ZodObject<{
625
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
626
+ operator: z.ZodEnum<{
627
+ some: "some";
628
+ all: "all";
629
+ none: "none";
630
+ }>;
631
+ where: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
632
+ operator: z.ZodLiteral<"equals">;
633
+ value: z.ZodJSONSchema;
634
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
635
+ }, z.core.$strict>, z.ZodObject<{
636
+ operator: z.ZodLiteral<"in">;
637
+ value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
638
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
639
+ }, z.core.$strict>, z.ZodObject<{
640
+ operator: z.ZodLiteral<"matches">;
641
+ value: z.ZodString;
642
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
643
+ }, z.core.$strict>, z.ZodObject<{
644
+ operator: z.ZodLiteral<"matches_host">;
645
+ value: z.ZodString;
646
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
647
+ }, z.core.$strict>, z.ZodObject<{
648
+ operator: z.ZodLiteral<"matches_path">;
649
+ value: z.ZodString;
650
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
651
+ }, z.core.$strict>, z.ZodObject<{
652
+ operator: z.ZodLiteral<"range">;
653
+ value: z.ZodObject<{
654
+ min: z.ZodOptional<z.ZodNumber>;
655
+ max: z.ZodOptional<z.ZodNumber>;
656
+ }, z.core.$strict>;
657
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
658
+ }, z.core.$strict>, z.ZodObject<{
659
+ operator: z.ZodLiteral<"matches_url">;
660
+ value: z.ZodString;
661
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
662
+ }, z.core.$strict>, z.ZodObject<{
663
+ operator: z.ZodLiteral<"values_in">;
664
+ value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
665
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
666
+ }, z.core.$strict>, z.ZodObject<{
667
+ operator: z.ZodLiteral<"exists">;
668
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
669
+ }, z.core.$strict>, z.ZodObject<{
670
+ operator: z.ZodLiteral<"keys_in">;
671
+ value: z.ZodArray<z.ZodString>;
672
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
673
+ }, z.core.$strict>, z.ZodObject<{
674
+ operator: z.ZodLiteral<"size">;
675
+ value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
676
+ min: z.ZodOptional<z.ZodNumber>;
677
+ max: z.ZodOptional<z.ZodNumber>;
678
+ }, z.core.$strict>]>;
679
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
680
+ }, z.core.$strict>]>>;
681
+ }, z.core.$strict>]>>>;
682
+ }, z.core.$strict>>>;
683
+ }, z.core.$strict>, z.ZodObject<{
684
+ version: z.ZodLiteral<"rc-rubberduck">;
685
+ id: z.ZodString;
686
+ defaultEffect: z.ZodEnum<{
687
+ deny: "deny";
688
+ ask: "ask";
689
+ }>;
690
+ statements: z.ZodArray<z.ZodObject<{
691
+ id: z.ZodString;
692
+ effect: z.ZodEnum<{
693
+ allow: "allow";
249
694
  deny: "deny";
695
+ ask: "ask";
250
696
  }>;
251
697
  permissions: z.ZodArray<z.ZodString>;
252
698
  resources: z.ZodArray<z.ZodString>;
@@ -299,6 +745,63 @@ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
299
745
  min: z.ZodOptional<z.ZodNumber>;
300
746
  max: z.ZodOptional<z.ZodNumber>;
301
747
  }, z.core.$strict>]>;
748
+ }, z.core.$strict>, z.ZodObject<{
749
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
750
+ operator: z.ZodEnum<{
751
+ some: "some";
752
+ all: "all";
753
+ none: "none";
754
+ }>;
755
+ where: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
756
+ operator: z.ZodLiteral<"equals">;
757
+ value: z.ZodJSONSchema;
758
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
759
+ }, z.core.$strict>, z.ZodObject<{
760
+ operator: z.ZodLiteral<"in">;
761
+ value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
762
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
763
+ }, z.core.$strict>, z.ZodObject<{
764
+ operator: z.ZodLiteral<"matches">;
765
+ value: z.ZodString;
766
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
767
+ }, z.core.$strict>, z.ZodObject<{
768
+ operator: z.ZodLiteral<"matches_host">;
769
+ value: z.ZodString;
770
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
771
+ }, z.core.$strict>, z.ZodObject<{
772
+ operator: z.ZodLiteral<"matches_path">;
773
+ value: z.ZodString;
774
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
775
+ }, z.core.$strict>, z.ZodObject<{
776
+ operator: z.ZodLiteral<"range">;
777
+ value: z.ZodObject<{
778
+ min: z.ZodOptional<z.ZodNumber>;
779
+ max: z.ZodOptional<z.ZodNumber>;
780
+ }, z.core.$strict>;
781
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
782
+ }, z.core.$strict>, z.ZodObject<{
783
+ operator: z.ZodLiteral<"matches_url">;
784
+ value: z.ZodString;
785
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
786
+ }, z.core.$strict>, z.ZodObject<{
787
+ operator: z.ZodLiteral<"values_in">;
788
+ value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
789
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
790
+ }, z.core.$strict>, z.ZodObject<{
791
+ operator: z.ZodLiteral<"exists">;
792
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
793
+ }, z.core.$strict>, z.ZodObject<{
794
+ operator: z.ZodLiteral<"keys_in">;
795
+ value: z.ZodArray<z.ZodString>;
796
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
797
+ }, z.core.$strict>, z.ZodObject<{
798
+ operator: z.ZodLiteral<"size">;
799
+ value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
800
+ min: z.ZodOptional<z.ZodNumber>;
801
+ max: z.ZodOptional<z.ZodNumber>;
802
+ }, z.core.$strict>]>;
803
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
804
+ }, z.core.$strict>]>>;
302
805
  }, z.core.$strict>]>>>;
303
806
  }, z.core.$strict>>;
304
807
  }, z.core.$strict>]>;
@@ -307,9 +810,20 @@ type Policy = z.infer<typeof PolicySchema>;
307
810
  /** SHA-256 hex digest of an RFC 8785 (JCS) canonicalized JSON value. */
308
811
  declare const CanonicalHashSchema: z.ZodCustom<CanonicalHash, CanonicalHash>;
309
812
  /**
310
- * Runtime schema for the Override type. `.strict()` keeps the variants
311
- * mutually exclusive (an object carrying two variant fields fails all
312
- * branches).
813
+ * Runtime schema for the Override type. Each variant has exactly one target
814
+ * field (statementHash for v1/v2, statementId or policyId for rc-rubberduck) and exactly
815
+ * one binding mode (match, contextHash, or conditionals). `.strict()` keeps
816
+ * the variants mutually exclusive (an object carrying fields from two variants
817
+ * fails all branches).
818
+ *
819
+ * Targets are all non-null:
820
+ * - statementHash: targets a v1/v2 statement by canonical hash
821
+ * - statementId: targets an rc-rubberduck statement by id
822
+ * - policyId: targets that policy's default effect (rc-rubberduck only)
823
+ *
824
+ * Empty conditionals is intentional (the "blank check"): the override applies
825
+ * whenever the targeted ask statement fires, with no extra conditions. Do not
826
+ * add .min(1) to conditionals.
313
827
  */
314
828
  declare const OverrideSchema: z.ZodUnion<readonly [z.ZodObject<{
315
829
  match: z.ZodLiteral<"any">;
@@ -371,13 +885,312 @@ declare const OverrideSchema: z.ZodUnion<readonly [z.ZodObject<{
371
885
  min: z.ZodOptional<z.ZodNumber>;
372
886
  max: z.ZodOptional<z.ZodNumber>;
373
887
  }, z.core.$strict>]>;
374
- }, z.core.$strict>]>>;
375
- id: z.ZodOptional<z.ZodString>;
376
- statementHash: z.ZodCustom<CanonicalHash, CanonicalHash>;
377
- effect: z.ZodLiteral<"allow">;
378
- }, z.core.$strict>]>;
379
- /** Derived from OverrideSchema — the schema is the single source of truth. */
380
- type Override = z.infer<typeof OverrideSchema>;
888
+ }, z.core.$strict>, z.ZodObject<{
889
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
890
+ operator: z.ZodEnum<{
891
+ some: "some";
892
+ all: "all";
893
+ none: "none";
894
+ }>;
895
+ where: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
896
+ operator: z.ZodLiteral<"equals">;
897
+ value: z.ZodJSONSchema;
898
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
899
+ }, z.core.$strict>, z.ZodObject<{
900
+ operator: z.ZodLiteral<"in">;
901
+ value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
902
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
903
+ }, z.core.$strict>, z.ZodObject<{
904
+ operator: z.ZodLiteral<"matches">;
905
+ value: z.ZodString;
906
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
907
+ }, z.core.$strict>, z.ZodObject<{
908
+ operator: z.ZodLiteral<"matches_host">;
909
+ value: z.ZodString;
910
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
911
+ }, z.core.$strict>, z.ZodObject<{
912
+ operator: z.ZodLiteral<"matches_path">;
913
+ value: z.ZodString;
914
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
915
+ }, z.core.$strict>, z.ZodObject<{
916
+ operator: z.ZodLiteral<"range">;
917
+ value: z.ZodObject<{
918
+ min: z.ZodOptional<z.ZodNumber>;
919
+ max: z.ZodOptional<z.ZodNumber>;
920
+ }, z.core.$strict>;
921
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
922
+ }, z.core.$strict>, z.ZodObject<{
923
+ operator: z.ZodLiteral<"matches_url">;
924
+ value: z.ZodString;
925
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
926
+ }, z.core.$strict>, z.ZodObject<{
927
+ operator: z.ZodLiteral<"values_in">;
928
+ value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
929
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
930
+ }, z.core.$strict>, z.ZodObject<{
931
+ operator: z.ZodLiteral<"exists">;
932
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
933
+ }, z.core.$strict>, z.ZodObject<{
934
+ operator: z.ZodLiteral<"keys_in">;
935
+ value: z.ZodArray<z.ZodString>;
936
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
937
+ }, z.core.$strict>, z.ZodObject<{
938
+ operator: z.ZodLiteral<"size">;
939
+ value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
940
+ min: z.ZodOptional<z.ZodNumber>;
941
+ max: z.ZodOptional<z.ZodNumber>;
942
+ }, z.core.$strict>]>;
943
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
944
+ }, z.core.$strict>]>>;
945
+ }, z.core.$strict>]>>;
946
+ id: z.ZodOptional<z.ZodString>;
947
+ statementHash: z.ZodCustom<CanonicalHash, CanonicalHash>;
948
+ effect: z.ZodLiteral<"allow">;
949
+ }, z.core.$strict>, z.ZodObject<{
950
+ match: z.ZodLiteral<"any">;
951
+ id: z.ZodOptional<z.ZodString>;
952
+ statementId: z.ZodString;
953
+ effect: z.ZodLiteral<"allow">;
954
+ }, z.core.$strict>, z.ZodObject<{
955
+ contextHash: z.ZodCustom<CanonicalHash, CanonicalHash>;
956
+ id: z.ZodOptional<z.ZodString>;
957
+ statementId: z.ZodString;
958
+ effect: z.ZodLiteral<"allow">;
959
+ }, z.core.$strict>, z.ZodObject<{
960
+ conditionals: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
961
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
962
+ operator: z.ZodLiteral<"equals">;
963
+ value: z.ZodJSONSchema;
964
+ }, z.core.$strict>, z.ZodObject<{
965
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
966
+ operator: z.ZodLiteral<"in">;
967
+ value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
968
+ }, z.core.$strict>, z.ZodObject<{
969
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
970
+ operator: z.ZodLiteral<"matches">;
971
+ value: z.ZodString;
972
+ }, z.core.$strict>, z.ZodObject<{
973
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
974
+ operator: z.ZodLiteral<"matches_host">;
975
+ value: z.ZodString;
976
+ }, z.core.$strict>, z.ZodObject<{
977
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
978
+ operator: z.ZodLiteral<"matches_path">;
979
+ value: z.ZodString;
980
+ }, z.core.$strict>, z.ZodObject<{
981
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
982
+ operator: z.ZodLiteral<"range">;
983
+ value: z.ZodObject<{
984
+ min: z.ZodOptional<z.ZodNumber>;
985
+ max: z.ZodOptional<z.ZodNumber>;
986
+ }, z.core.$strict>;
987
+ }, z.core.$strict>, z.ZodObject<{
988
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
989
+ operator: z.ZodLiteral<"matches_url">;
990
+ value: z.ZodString;
991
+ }, z.core.$strict>, z.ZodObject<{
992
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
993
+ operator: z.ZodLiteral<"values_in">;
994
+ value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
995
+ }, z.core.$strict>, z.ZodObject<{
996
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
997
+ operator: z.ZodLiteral<"exists">;
998
+ }, z.core.$strict>, z.ZodObject<{
999
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1000
+ operator: z.ZodLiteral<"keys_in">;
1001
+ value: z.ZodArray<z.ZodString>;
1002
+ }, z.core.$strict>, z.ZodObject<{
1003
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1004
+ operator: z.ZodLiteral<"size">;
1005
+ value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
1006
+ min: z.ZodOptional<z.ZodNumber>;
1007
+ max: z.ZodOptional<z.ZodNumber>;
1008
+ }, z.core.$strict>]>;
1009
+ }, z.core.$strict>, z.ZodObject<{
1010
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1011
+ operator: z.ZodEnum<{
1012
+ some: "some";
1013
+ all: "all";
1014
+ none: "none";
1015
+ }>;
1016
+ where: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
1017
+ operator: z.ZodLiteral<"equals">;
1018
+ value: z.ZodJSONSchema;
1019
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1020
+ }, z.core.$strict>, z.ZodObject<{
1021
+ operator: z.ZodLiteral<"in">;
1022
+ value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
1023
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1024
+ }, z.core.$strict>, z.ZodObject<{
1025
+ operator: z.ZodLiteral<"matches">;
1026
+ value: z.ZodString;
1027
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1028
+ }, z.core.$strict>, z.ZodObject<{
1029
+ operator: z.ZodLiteral<"matches_host">;
1030
+ value: z.ZodString;
1031
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1032
+ }, z.core.$strict>, z.ZodObject<{
1033
+ operator: z.ZodLiteral<"matches_path">;
1034
+ value: z.ZodString;
1035
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1036
+ }, z.core.$strict>, z.ZodObject<{
1037
+ operator: z.ZodLiteral<"range">;
1038
+ value: z.ZodObject<{
1039
+ min: z.ZodOptional<z.ZodNumber>;
1040
+ max: z.ZodOptional<z.ZodNumber>;
1041
+ }, z.core.$strict>;
1042
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1043
+ }, z.core.$strict>, z.ZodObject<{
1044
+ operator: z.ZodLiteral<"matches_url">;
1045
+ value: z.ZodString;
1046
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1047
+ }, z.core.$strict>, z.ZodObject<{
1048
+ operator: z.ZodLiteral<"values_in">;
1049
+ value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
1050
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1051
+ }, z.core.$strict>, z.ZodObject<{
1052
+ operator: z.ZodLiteral<"exists">;
1053
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1054
+ }, z.core.$strict>, z.ZodObject<{
1055
+ operator: z.ZodLiteral<"keys_in">;
1056
+ value: z.ZodArray<z.ZodString>;
1057
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1058
+ }, z.core.$strict>, z.ZodObject<{
1059
+ operator: z.ZodLiteral<"size">;
1060
+ value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
1061
+ min: z.ZodOptional<z.ZodNumber>;
1062
+ max: z.ZodOptional<z.ZodNumber>;
1063
+ }, z.core.$strict>]>;
1064
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1065
+ }, z.core.$strict>]>>;
1066
+ }, z.core.$strict>]>>;
1067
+ id: z.ZodOptional<z.ZodString>;
1068
+ statementId: z.ZodString;
1069
+ effect: z.ZodLiteral<"allow">;
1070
+ }, z.core.$strict>, z.ZodObject<{
1071
+ match: z.ZodLiteral<"any">;
1072
+ id: z.ZodOptional<z.ZodString>;
1073
+ policyId: z.ZodString;
1074
+ effect: z.ZodLiteral<"allow">;
1075
+ }, z.core.$strict>, z.ZodObject<{
1076
+ contextHash: z.ZodCustom<CanonicalHash, CanonicalHash>;
1077
+ id: z.ZodOptional<z.ZodString>;
1078
+ policyId: z.ZodString;
1079
+ effect: z.ZodLiteral<"allow">;
1080
+ }, z.core.$strict>, z.ZodObject<{
1081
+ conditionals: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
1082
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1083
+ operator: z.ZodLiteral<"equals">;
1084
+ value: z.ZodJSONSchema;
1085
+ }, z.core.$strict>, z.ZodObject<{
1086
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1087
+ operator: z.ZodLiteral<"in">;
1088
+ value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
1089
+ }, z.core.$strict>, z.ZodObject<{
1090
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1091
+ operator: z.ZodLiteral<"matches">;
1092
+ value: z.ZodString;
1093
+ }, z.core.$strict>, z.ZodObject<{
1094
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1095
+ operator: z.ZodLiteral<"matches_host">;
1096
+ value: z.ZodString;
1097
+ }, z.core.$strict>, z.ZodObject<{
1098
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1099
+ operator: z.ZodLiteral<"matches_path">;
1100
+ value: z.ZodString;
1101
+ }, z.core.$strict>, z.ZodObject<{
1102
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1103
+ operator: z.ZodLiteral<"range">;
1104
+ value: z.ZodObject<{
1105
+ min: z.ZodOptional<z.ZodNumber>;
1106
+ max: z.ZodOptional<z.ZodNumber>;
1107
+ }, z.core.$strict>;
1108
+ }, z.core.$strict>, z.ZodObject<{
1109
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1110
+ operator: z.ZodLiteral<"matches_url">;
1111
+ value: z.ZodString;
1112
+ }, z.core.$strict>, z.ZodObject<{
1113
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1114
+ operator: z.ZodLiteral<"values_in">;
1115
+ value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
1116
+ }, z.core.$strict>, z.ZodObject<{
1117
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1118
+ operator: z.ZodLiteral<"exists">;
1119
+ }, z.core.$strict>, z.ZodObject<{
1120
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1121
+ operator: z.ZodLiteral<"keys_in">;
1122
+ value: z.ZodArray<z.ZodString>;
1123
+ }, z.core.$strict>, z.ZodObject<{
1124
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1125
+ operator: z.ZodLiteral<"size">;
1126
+ value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
1127
+ min: z.ZodOptional<z.ZodNumber>;
1128
+ max: z.ZodOptional<z.ZodNumber>;
1129
+ }, z.core.$strict>]>;
1130
+ }, z.core.$strict>, z.ZodObject<{
1131
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1132
+ operator: z.ZodEnum<{
1133
+ some: "some";
1134
+ all: "all";
1135
+ none: "none";
1136
+ }>;
1137
+ where: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
1138
+ operator: z.ZodLiteral<"equals">;
1139
+ value: z.ZodJSONSchema;
1140
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1141
+ }, z.core.$strict>, z.ZodObject<{
1142
+ operator: z.ZodLiteral<"in">;
1143
+ value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
1144
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1145
+ }, z.core.$strict>, z.ZodObject<{
1146
+ operator: z.ZodLiteral<"matches">;
1147
+ value: z.ZodString;
1148
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1149
+ }, z.core.$strict>, z.ZodObject<{
1150
+ operator: z.ZodLiteral<"matches_host">;
1151
+ value: z.ZodString;
1152
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1153
+ }, z.core.$strict>, z.ZodObject<{
1154
+ operator: z.ZodLiteral<"matches_path">;
1155
+ value: z.ZodString;
1156
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1157
+ }, z.core.$strict>, z.ZodObject<{
1158
+ operator: z.ZodLiteral<"range">;
1159
+ value: z.ZodObject<{
1160
+ min: z.ZodOptional<z.ZodNumber>;
1161
+ max: z.ZodOptional<z.ZodNumber>;
1162
+ }, z.core.$strict>;
1163
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1164
+ }, z.core.$strict>, z.ZodObject<{
1165
+ operator: z.ZodLiteral<"matches_url">;
1166
+ value: z.ZodString;
1167
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1168
+ }, z.core.$strict>, z.ZodObject<{
1169
+ operator: z.ZodLiteral<"values_in">;
1170
+ value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
1171
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1172
+ }, z.core.$strict>, z.ZodObject<{
1173
+ operator: z.ZodLiteral<"exists">;
1174
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1175
+ }, z.core.$strict>, z.ZodObject<{
1176
+ operator: z.ZodLiteral<"keys_in">;
1177
+ value: z.ZodArray<z.ZodString>;
1178
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1179
+ }, z.core.$strict>, z.ZodObject<{
1180
+ operator: z.ZodLiteral<"size">;
1181
+ value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
1182
+ min: z.ZodOptional<z.ZodNumber>;
1183
+ max: z.ZodOptional<z.ZodNumber>;
1184
+ }, z.core.$strict>]>;
1185
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1186
+ }, z.core.$strict>]>>;
1187
+ }, z.core.$strict>]>>;
1188
+ id: z.ZodOptional<z.ZodString>;
1189
+ policyId: z.ZodString;
1190
+ effect: z.ZodLiteral<"allow">;
1191
+ }, z.core.$strict>]>;
1192
+ /** Derived from OverrideSchema — the schema is the single source of truth. */
1193
+ type Override = z.infer<typeof OverrideSchema>;
381
1194
  /**
382
1195
  * Returns an OpenAPI-compatible JSON Schema object for a policy document.
383
1196
  *
@@ -409,6 +1222,10 @@ interface OverrideTrace {
409
1222
  matched: boolean;
410
1223
  conditionResults?: ConditionTrace[];
411
1224
  }
1225
+ interface DefaultTrace {
1226
+ defaultEffect: DefaultEffect;
1227
+ overrides: OverrideTrace[];
1228
+ }
412
1229
  interface StatementTrace {
413
1230
  statement: Statement;
414
1231
  permissionMatched: boolean;
@@ -429,6 +1246,8 @@ interface PolicyResult {
429
1246
  explicit: boolean;
430
1247
  reason: PolicyReason;
431
1248
  statements: StatementTrace[];
1249
+ /** Trace mode only. Present when no statement matched and an ask default was consulted (never attached for deny defaults). */
1250
+ default?: DefaultTrace;
432
1251
  }
433
1252
  interface ParsedUrl {
434
1253
  scheme: string;
@@ -465,4 +1284,4 @@ interface OpenApiSchema {
465
1284
  anyOf?: OpenApiSchema[];
466
1285
  }
467
1286
 
468
- export { type ArrayOperator, ArrayOperatorSchema, type CanonicalHash, CanonicalHashSchema, type Condition, ConditionSchema, type ConditionTrace, type ConditionValue, ConditionValueSchema, type Effect, type EvaluatePolicyOptions, type JsonValue, type OpenApiSchema, type Operator, OperatorSchema, type OtherOperator, OtherOperatorSchema, type Override, OverrideSchema, type OverrideTrace, type ParsedUrl, type Policy, type PolicyActionRequest, type PolicyHttpRequest, type PolicyReason, type PolicyRequest, type PolicyResult, PolicySchema, type RangeValue, RangeValueSchema, type ScalarOperator, ScalarOperatorSchema, type SizeValue, SizeValueSchema, type Statement, StatementSchema, type StatementTrace, type UrlOperator, UrlOperatorSchema, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };
1287
+ export { type ArrayOperator, ArrayOperatorSchema, type CanonicalHash, CanonicalHashSchema, type Condition, ConditionSchema, type ConditionTrace, type ConditionValue, ConditionValueSchema, type DefaultEffect, DefaultEffectSchema, type DefaultTrace, type Effect, type EvaluatePolicyOptions, ID_BASED_VERSIONS, type JsonValue, type OpenApiSchema, type Operator, OperatorSchema, type OtherOperator, OtherOperatorSchema, type Override, OverrideSchema, type OverrideTrace, type ParsedUrl, type Policy, type PolicyActionRequest, type PolicyHttpRequest, type PolicyId, PolicyIdSchema, type PolicyReason, type PolicyRequest, type PolicyResult, PolicySchema, RUBBERDUCK_POLICY_VERSION, type RangeValue, RangeValueSchema, type ScalarOperator, ScalarOperatorSchema, type SizeValue, SizeValueSchema, type Statement, type StatementId, StatementIdSchema, StatementSchema, type StatementTrace, type UrlOperator, UrlOperatorSchema, V3_MAX_TIERS, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };