@zapier/policy-schema 0.17.0 → 0.19.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/dist/index.cjs +179 -43
  2. package/dist/index.d.cts +521 -5
  3. package/dist/index.d.ts +521 -5
  4. package/dist/index.mjs +178 -44
  5. package/package.json +1 -1
package/dist/index.d.ts CHANGED
@@ -3,14 +3,14 @@ import { z } from 'zod';
3
3
  /** Release-candidate policy document version for the current experimental shape. */
4
4
  declare const RUBBERDUCK_POLICY_VERSION: "rc-rubberduck";
5
5
  /** Supported policy document versions. */
6
- declare const VALID_VERSIONS: readonly [1, 2, 3, "rc-rubberduck"];
6
+ declare const VALID_VERSIONS: readonly [1, 2, 3, 4, "rc-rubberduck"];
7
7
  /**
8
8
  * Versions whose statements carry an id (s_/p_) and are therefore targeted by
9
9
  * that id rather than canonical hash. Single source of truth shared with the
10
10
  * engine's usesIds override-targeting predicate: "requires an id" and
11
11
  * "targeted by id" coincide for every supported version.
12
12
  */
13
- declare const ID_BASED_VERSIONS: Set<"rc-rubberduck" | 1 | 2 | 3>;
13
+ declare const ID_BASED_VERSIONS: Set<"rc-rubberduck" | 1 | 2 | 3 | 4>;
14
14
  /** Valid policy effects. */
15
15
  declare const VALID_EFFECTS: readonly ["allow", "ask", "deny"];
16
16
  /** Derived from VALID_EFFECTS — the constant is the single source of truth. */
@@ -31,26 +31,32 @@ declare const SizeValueSchema: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
31
31
  /** Derived from SizeValueSchema — the schema is the single source of truth. */
32
32
  type SizeValue = z.infer<typeof SizeValueSchema>;
33
33
  declare const ConditionSchema: z.ZodUnion<readonly [z.ZodObject<{
34
+ negate: z.ZodOptional<z.ZodBoolean>;
34
35
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
35
36
  operator: z.ZodLiteral<"equals">;
36
37
  value: z.ZodJSONSchema;
37
38
  }, z.core.$strict>, z.ZodObject<{
39
+ negate: z.ZodOptional<z.ZodBoolean>;
38
40
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
39
41
  operator: z.ZodLiteral<"in">;
40
42
  value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
41
43
  }, z.core.$strict>, z.ZodObject<{
44
+ negate: z.ZodOptional<z.ZodBoolean>;
42
45
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
43
46
  operator: z.ZodLiteral<"matches">;
44
47
  value: z.ZodString;
45
48
  }, z.core.$strict>, z.ZodObject<{
49
+ negate: z.ZodOptional<z.ZodBoolean>;
46
50
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
47
51
  operator: z.ZodLiteral<"matches_host">;
48
52
  value: z.ZodString;
49
53
  }, z.core.$strict>, z.ZodObject<{
54
+ negate: z.ZodOptional<z.ZodBoolean>;
50
55
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
51
56
  operator: z.ZodLiteral<"matches_path">;
52
57
  value: z.ZodString;
53
58
  }, z.core.$strict>, z.ZodObject<{
59
+ negate: z.ZodOptional<z.ZodBoolean>;
54
60
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
55
61
  operator: z.ZodLiteral<"range">;
56
62
  value: z.ZodObject<{
@@ -58,21 +64,26 @@ declare const ConditionSchema: z.ZodUnion<readonly [z.ZodObject<{
58
64
  max: z.ZodOptional<z.ZodNumber>;
59
65
  }, z.core.$strict>;
60
66
  }, z.core.$strict>, z.ZodObject<{
67
+ negate: z.ZodOptional<z.ZodBoolean>;
61
68
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
62
69
  operator: z.ZodLiteral<"matches_url">;
63
70
  value: z.ZodString;
64
71
  }, z.core.$strict>, z.ZodObject<{
72
+ negate: z.ZodOptional<z.ZodBoolean>;
65
73
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
66
74
  operator: z.ZodLiteral<"values_in">;
67
75
  value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
68
76
  }, z.core.$strict>, z.ZodObject<{
77
+ negate: z.ZodOptional<z.ZodBoolean>;
69
78
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
70
79
  operator: z.ZodLiteral<"exists">;
71
80
  }, z.core.$strict>, z.ZodObject<{
81
+ negate: z.ZodOptional<z.ZodBoolean>;
72
82
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
73
83
  operator: z.ZodLiteral<"keys_in">;
74
84
  value: z.ZodArray<z.ZodString>;
75
85
  }, z.core.$strict>, z.ZodObject<{
86
+ negate: z.ZodOptional<z.ZodBoolean>;
76
87
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
77
88
  operator: z.ZodLiteral<"size">;
78
89
  value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
@@ -87,26 +98,32 @@ declare const ConditionSchema: z.ZodUnion<readonly [z.ZodObject<{
87
98
  none: "none";
88
99
  }>;
89
100
  where: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
101
+ negate: z.ZodOptional<z.ZodBoolean>;
90
102
  operator: z.ZodLiteral<"equals">;
91
103
  value: z.ZodJSONSchema;
92
104
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
93
105
  }, z.core.$strict>, z.ZodObject<{
106
+ negate: z.ZodOptional<z.ZodBoolean>;
94
107
  operator: z.ZodLiteral<"in">;
95
108
  value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
96
109
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
97
110
  }, z.core.$strict>, z.ZodObject<{
111
+ negate: z.ZodOptional<z.ZodBoolean>;
98
112
  operator: z.ZodLiteral<"matches">;
99
113
  value: z.ZodString;
100
114
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
101
115
  }, z.core.$strict>, z.ZodObject<{
116
+ negate: z.ZodOptional<z.ZodBoolean>;
102
117
  operator: z.ZodLiteral<"matches_host">;
103
118
  value: z.ZodString;
104
119
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
105
120
  }, z.core.$strict>, z.ZodObject<{
121
+ negate: z.ZodOptional<z.ZodBoolean>;
106
122
  operator: z.ZodLiteral<"matches_path">;
107
123
  value: z.ZodString;
108
124
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
109
125
  }, z.core.$strict>, z.ZodObject<{
126
+ negate: z.ZodOptional<z.ZodBoolean>;
110
127
  operator: z.ZodLiteral<"range">;
111
128
  value: z.ZodObject<{
112
129
  min: z.ZodOptional<z.ZodNumber>;
@@ -114,21 +131,26 @@ declare const ConditionSchema: z.ZodUnion<readonly [z.ZodObject<{
114
131
  }, z.core.$strict>;
115
132
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
116
133
  }, z.core.$strict>, z.ZodObject<{
134
+ negate: z.ZodOptional<z.ZodBoolean>;
117
135
  operator: z.ZodLiteral<"matches_url">;
118
136
  value: z.ZodString;
119
137
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
120
138
  }, z.core.$strict>, z.ZodObject<{
139
+ negate: z.ZodOptional<z.ZodBoolean>;
121
140
  operator: z.ZodLiteral<"values_in">;
122
141
  value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
123
142
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
124
143
  }, z.core.$strict>, z.ZodObject<{
144
+ negate: z.ZodOptional<z.ZodBoolean>;
125
145
  operator: z.ZodLiteral<"exists">;
126
146
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
127
147
  }, z.core.$strict>, z.ZodObject<{
148
+ negate: z.ZodOptional<z.ZodBoolean>;
128
149
  operator: z.ZodLiteral<"keys_in">;
129
150
  value: z.ZodArray<z.ZodString>;
130
151
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
131
152
  }, z.core.$strict>, z.ZodObject<{
153
+ negate: z.ZodOptional<z.ZodBoolean>;
132
154
  operator: z.ZodLiteral<"size">;
133
155
  value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
134
156
  min: z.ZodOptional<z.ZodNumber>;
@@ -198,26 +220,32 @@ declare const StatementSchema: z.ZodObject<{
198
220
  permissions: z.ZodArray<z.ZodString>;
199
221
  resources: z.ZodArray<z.ZodString>;
200
222
  conditions: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
223
+ negate: z.ZodOptional<z.ZodBoolean>;
201
224
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
202
225
  operator: z.ZodLiteral<"equals">;
203
226
  value: z.ZodJSONSchema;
204
227
  }, z.core.$strict>, z.ZodObject<{
228
+ negate: z.ZodOptional<z.ZodBoolean>;
205
229
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
206
230
  operator: z.ZodLiteral<"in">;
207
231
  value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
208
232
  }, z.core.$strict>, z.ZodObject<{
233
+ negate: z.ZodOptional<z.ZodBoolean>;
209
234
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
210
235
  operator: z.ZodLiteral<"matches">;
211
236
  value: z.ZodString;
212
237
  }, z.core.$strict>, z.ZodObject<{
238
+ negate: z.ZodOptional<z.ZodBoolean>;
213
239
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
214
240
  operator: z.ZodLiteral<"matches_host">;
215
241
  value: z.ZodString;
216
242
  }, z.core.$strict>, z.ZodObject<{
243
+ negate: z.ZodOptional<z.ZodBoolean>;
217
244
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
218
245
  operator: z.ZodLiteral<"matches_path">;
219
246
  value: z.ZodString;
220
247
  }, z.core.$strict>, z.ZodObject<{
248
+ negate: z.ZodOptional<z.ZodBoolean>;
221
249
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
222
250
  operator: z.ZodLiteral<"range">;
223
251
  value: z.ZodObject<{
@@ -225,21 +253,26 @@ declare const StatementSchema: z.ZodObject<{
225
253
  max: z.ZodOptional<z.ZodNumber>;
226
254
  }, z.core.$strict>;
227
255
  }, z.core.$strict>, z.ZodObject<{
256
+ negate: z.ZodOptional<z.ZodBoolean>;
228
257
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
229
258
  operator: z.ZodLiteral<"matches_url">;
230
259
  value: z.ZodString;
231
260
  }, z.core.$strict>, z.ZodObject<{
261
+ negate: z.ZodOptional<z.ZodBoolean>;
232
262
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
233
263
  operator: z.ZodLiteral<"values_in">;
234
264
  value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
235
265
  }, z.core.$strict>, z.ZodObject<{
266
+ negate: z.ZodOptional<z.ZodBoolean>;
236
267
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
237
268
  operator: z.ZodLiteral<"exists">;
238
269
  }, z.core.$strict>, z.ZodObject<{
270
+ negate: z.ZodOptional<z.ZodBoolean>;
239
271
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
240
272
  operator: z.ZodLiteral<"keys_in">;
241
273
  value: z.ZodArray<z.ZodString>;
242
274
  }, z.core.$strict>, z.ZodObject<{
275
+ negate: z.ZodOptional<z.ZodBoolean>;
243
276
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
244
277
  operator: z.ZodLiteral<"size">;
245
278
  value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
@@ -254,26 +287,32 @@ declare const StatementSchema: z.ZodObject<{
254
287
  none: "none";
255
288
  }>;
256
289
  where: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
290
+ negate: z.ZodOptional<z.ZodBoolean>;
257
291
  operator: z.ZodLiteral<"equals">;
258
292
  value: z.ZodJSONSchema;
259
293
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
260
294
  }, z.core.$strict>, z.ZodObject<{
295
+ negate: z.ZodOptional<z.ZodBoolean>;
261
296
  operator: z.ZodLiteral<"in">;
262
297
  value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
263
298
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
264
299
  }, z.core.$strict>, z.ZodObject<{
300
+ negate: z.ZodOptional<z.ZodBoolean>;
265
301
  operator: z.ZodLiteral<"matches">;
266
302
  value: z.ZodString;
267
303
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
268
304
  }, z.core.$strict>, z.ZodObject<{
305
+ negate: z.ZodOptional<z.ZodBoolean>;
269
306
  operator: z.ZodLiteral<"matches_host">;
270
307
  value: z.ZodString;
271
308
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
272
309
  }, z.core.$strict>, z.ZodObject<{
310
+ negate: z.ZodOptional<z.ZodBoolean>;
273
311
  operator: z.ZodLiteral<"matches_path">;
274
312
  value: z.ZodString;
275
313
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
276
314
  }, z.core.$strict>, z.ZodObject<{
315
+ negate: z.ZodOptional<z.ZodBoolean>;
277
316
  operator: z.ZodLiteral<"range">;
278
317
  value: z.ZodObject<{
279
318
  min: z.ZodOptional<z.ZodNumber>;
@@ -281,21 +320,26 @@ declare const StatementSchema: z.ZodObject<{
281
320
  }, z.core.$strict>;
282
321
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
283
322
  }, z.core.$strict>, z.ZodObject<{
323
+ negate: z.ZodOptional<z.ZodBoolean>;
284
324
  operator: z.ZodLiteral<"matches_url">;
285
325
  value: z.ZodString;
286
326
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
287
327
  }, z.core.$strict>, z.ZodObject<{
328
+ negate: z.ZodOptional<z.ZodBoolean>;
288
329
  operator: z.ZodLiteral<"values_in">;
289
330
  value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
290
331
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
291
332
  }, z.core.$strict>, z.ZodObject<{
333
+ negate: z.ZodOptional<z.ZodBoolean>;
292
334
  operator: z.ZodLiteral<"exists">;
293
335
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
294
336
  }, z.core.$strict>, z.ZodObject<{
337
+ negate: z.ZodOptional<z.ZodBoolean>;
295
338
  operator: z.ZodLiteral<"keys_in">;
296
339
  value: z.ZodArray<z.ZodString>;
297
340
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
298
341
  }, z.core.$strict>, z.ZodObject<{
342
+ negate: z.ZodOptional<z.ZodBoolean>;
299
343
  operator: z.ZodLiteral<"size">;
300
344
  value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
301
345
  min: z.ZodOptional<z.ZodNumber>;
@@ -315,6 +359,10 @@ type StatementId = z.infer<typeof StatementIdSchema>;
315
359
  declare const PolicyIdSchema: z.ZodString;
316
360
  /** Derived from PolicyIdSchema — the schema is the single source of truth. */
317
361
  type PolicyId = z.infer<typeof PolicyIdSchema>;
362
+ /** Rule identifier for v4 policies. Must match ^r_\S+$ and be ≤512 chars. */
363
+ declare const RuleIdSchema: z.ZodString;
364
+ /** Derived from RuleIdSchema — the schema is the single source of truth. */
365
+ type RuleId = z.infer<typeof RuleIdSchema>;
318
366
  /** Effect applied when no statement matches (rc-rubberduck, required). deny == implicit deny. */
319
367
  declare const DefaultEffectSchema: z.ZodEnum<{
320
368
  deny: "deny";
@@ -324,6 +372,8 @@ declare const DefaultEffectSchema: z.ZodEnum<{
324
372
  type DefaultEffect = z.infer<typeof DefaultEffectSchema>;
325
373
  /** Upper bound on v3 statement tiers. Raising this later is backwards-compatible. */
326
374
  declare const V3_MAX_TIERS = 3;
375
+ /** Upper bound on v4 rule tiers. Separate from V3_MAX_TIERS so the two versions can diverge. */
376
+ declare const V4_MAX_TIERS = 3;
327
377
  declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
328
378
  version: z.ZodLiteral<1>;
329
379
  statements: z.ZodArray<z.ZodObject<{
@@ -335,26 +385,32 @@ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
335
385
  permissions: z.ZodArray<z.ZodString>;
336
386
  resources: z.ZodArray<z.ZodString>;
337
387
  conditions: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
388
+ negate: z.ZodOptional<z.ZodBoolean>;
338
389
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
339
390
  operator: z.ZodLiteral<"equals">;
340
391
  value: z.ZodJSONSchema;
341
392
  }, z.core.$strict>, z.ZodObject<{
393
+ negate: z.ZodOptional<z.ZodBoolean>;
342
394
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
343
395
  operator: z.ZodLiteral<"in">;
344
396
  value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
345
397
  }, z.core.$strict>, z.ZodObject<{
398
+ negate: z.ZodOptional<z.ZodBoolean>;
346
399
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
347
400
  operator: z.ZodLiteral<"matches">;
348
401
  value: z.ZodString;
349
402
  }, z.core.$strict>, z.ZodObject<{
403
+ negate: z.ZodOptional<z.ZodBoolean>;
350
404
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
351
405
  operator: z.ZodLiteral<"matches_host">;
352
406
  value: z.ZodString;
353
407
  }, z.core.$strict>, z.ZodObject<{
408
+ negate: z.ZodOptional<z.ZodBoolean>;
354
409
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
355
410
  operator: z.ZodLiteral<"matches_path">;
356
411
  value: z.ZodString;
357
412
  }, z.core.$strict>, z.ZodObject<{
413
+ negate: z.ZodOptional<z.ZodBoolean>;
358
414
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
359
415
  operator: z.ZodLiteral<"range">;
360
416
  value: z.ZodObject<{
@@ -362,21 +418,26 @@ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
362
418
  max: z.ZodOptional<z.ZodNumber>;
363
419
  }, z.core.$strict>;
364
420
  }, z.core.$strict>, z.ZodObject<{
421
+ negate: z.ZodOptional<z.ZodBoolean>;
365
422
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
366
423
  operator: z.ZodLiteral<"matches_url">;
367
424
  value: z.ZodString;
368
425
  }, z.core.$strict>, z.ZodObject<{
426
+ negate: z.ZodOptional<z.ZodBoolean>;
369
427
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
370
428
  operator: z.ZodLiteral<"values_in">;
371
429
  value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
372
430
  }, z.core.$strict>, z.ZodObject<{
431
+ negate: z.ZodOptional<z.ZodBoolean>;
373
432
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
374
433
  operator: z.ZodLiteral<"exists">;
375
434
  }, z.core.$strict>, z.ZodObject<{
435
+ negate: z.ZodOptional<z.ZodBoolean>;
376
436
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
377
437
  operator: z.ZodLiteral<"keys_in">;
378
438
  value: z.ZodArray<z.ZodString>;
379
439
  }, z.core.$strict>, z.ZodObject<{
440
+ negate: z.ZodOptional<z.ZodBoolean>;
380
441
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
381
442
  operator: z.ZodLiteral<"size">;
382
443
  value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
@@ -391,26 +452,32 @@ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
391
452
  none: "none";
392
453
  }>;
393
454
  where: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
455
+ negate: z.ZodOptional<z.ZodBoolean>;
394
456
  operator: z.ZodLiteral<"equals">;
395
457
  value: z.ZodJSONSchema;
396
458
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
397
459
  }, z.core.$strict>, z.ZodObject<{
460
+ negate: z.ZodOptional<z.ZodBoolean>;
398
461
  operator: z.ZodLiteral<"in">;
399
462
  value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
400
463
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
401
464
  }, z.core.$strict>, z.ZodObject<{
465
+ negate: z.ZodOptional<z.ZodBoolean>;
402
466
  operator: z.ZodLiteral<"matches">;
403
467
  value: z.ZodString;
404
468
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
405
469
  }, z.core.$strict>, z.ZodObject<{
470
+ negate: z.ZodOptional<z.ZodBoolean>;
406
471
  operator: z.ZodLiteral<"matches_host">;
407
472
  value: z.ZodString;
408
473
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
409
474
  }, z.core.$strict>, z.ZodObject<{
475
+ negate: z.ZodOptional<z.ZodBoolean>;
410
476
  operator: z.ZodLiteral<"matches_path">;
411
477
  value: z.ZodString;
412
478
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
413
479
  }, z.core.$strict>, z.ZodObject<{
480
+ negate: z.ZodOptional<z.ZodBoolean>;
414
481
  operator: z.ZodLiteral<"range">;
415
482
  value: z.ZodObject<{
416
483
  min: z.ZodOptional<z.ZodNumber>;
@@ -418,21 +485,26 @@ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
418
485
  }, z.core.$strict>;
419
486
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
420
487
  }, z.core.$strict>, z.ZodObject<{
488
+ negate: z.ZodOptional<z.ZodBoolean>;
421
489
  operator: z.ZodLiteral<"matches_url">;
422
490
  value: z.ZodString;
423
491
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
424
492
  }, z.core.$strict>, z.ZodObject<{
493
+ negate: z.ZodOptional<z.ZodBoolean>;
425
494
  operator: z.ZodLiteral<"values_in">;
426
495
  value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
427
496
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
428
497
  }, z.core.$strict>, z.ZodObject<{
498
+ negate: z.ZodOptional<z.ZodBoolean>;
429
499
  operator: z.ZodLiteral<"exists">;
430
500
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
431
501
  }, z.core.$strict>, z.ZodObject<{
502
+ negate: z.ZodOptional<z.ZodBoolean>;
432
503
  operator: z.ZodLiteral<"keys_in">;
433
504
  value: z.ZodArray<z.ZodString>;
434
505
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
435
506
  }, z.core.$strict>, z.ZodObject<{
507
+ negate: z.ZodOptional<z.ZodBoolean>;
436
508
  operator: z.ZodLiteral<"size">;
437
509
  value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
438
510
  min: z.ZodOptional<z.ZodNumber>;
@@ -454,26 +526,32 @@ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
454
526
  permissions: z.ZodArray<z.ZodString>;
455
527
  resources: z.ZodArray<z.ZodString>;
456
528
  conditions: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
529
+ negate: z.ZodOptional<z.ZodBoolean>;
457
530
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
458
531
  operator: z.ZodLiteral<"equals">;
459
532
  value: z.ZodJSONSchema;
460
533
  }, z.core.$strict>, z.ZodObject<{
534
+ negate: z.ZodOptional<z.ZodBoolean>;
461
535
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
462
536
  operator: z.ZodLiteral<"in">;
463
537
  value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
464
538
  }, z.core.$strict>, z.ZodObject<{
539
+ negate: z.ZodOptional<z.ZodBoolean>;
465
540
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
466
541
  operator: z.ZodLiteral<"matches">;
467
542
  value: z.ZodString;
468
543
  }, z.core.$strict>, z.ZodObject<{
544
+ negate: z.ZodOptional<z.ZodBoolean>;
469
545
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
470
546
  operator: z.ZodLiteral<"matches_host">;
471
547
  value: z.ZodString;
472
548
  }, z.core.$strict>, z.ZodObject<{
549
+ negate: z.ZodOptional<z.ZodBoolean>;
473
550
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
474
551
  operator: z.ZodLiteral<"matches_path">;
475
552
  value: z.ZodString;
476
553
  }, z.core.$strict>, z.ZodObject<{
554
+ negate: z.ZodOptional<z.ZodBoolean>;
477
555
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
478
556
  operator: z.ZodLiteral<"range">;
479
557
  value: z.ZodObject<{
@@ -481,21 +559,26 @@ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
481
559
  max: z.ZodOptional<z.ZodNumber>;
482
560
  }, z.core.$strict>;
483
561
  }, z.core.$strict>, z.ZodObject<{
562
+ negate: z.ZodOptional<z.ZodBoolean>;
484
563
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
485
564
  operator: z.ZodLiteral<"matches_url">;
486
565
  value: z.ZodString;
487
566
  }, z.core.$strict>, z.ZodObject<{
567
+ negate: z.ZodOptional<z.ZodBoolean>;
488
568
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
489
569
  operator: z.ZodLiteral<"values_in">;
490
570
  value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
491
571
  }, z.core.$strict>, z.ZodObject<{
572
+ negate: z.ZodOptional<z.ZodBoolean>;
492
573
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
493
574
  operator: z.ZodLiteral<"exists">;
494
575
  }, z.core.$strict>, z.ZodObject<{
576
+ negate: z.ZodOptional<z.ZodBoolean>;
495
577
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
496
578
  operator: z.ZodLiteral<"keys_in">;
497
579
  value: z.ZodArray<z.ZodString>;
498
580
  }, z.core.$strict>, z.ZodObject<{
581
+ negate: z.ZodOptional<z.ZodBoolean>;
499
582
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
500
583
  operator: z.ZodLiteral<"size">;
501
584
  value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
@@ -510,26 +593,32 @@ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
510
593
  none: "none";
511
594
  }>;
512
595
  where: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
596
+ negate: z.ZodOptional<z.ZodBoolean>;
513
597
  operator: z.ZodLiteral<"equals">;
514
598
  value: z.ZodJSONSchema;
515
599
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
516
600
  }, z.core.$strict>, z.ZodObject<{
601
+ negate: z.ZodOptional<z.ZodBoolean>;
517
602
  operator: z.ZodLiteral<"in">;
518
603
  value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
519
604
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
520
605
  }, z.core.$strict>, z.ZodObject<{
606
+ negate: z.ZodOptional<z.ZodBoolean>;
521
607
  operator: z.ZodLiteral<"matches">;
522
608
  value: z.ZodString;
523
609
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
524
610
  }, z.core.$strict>, z.ZodObject<{
611
+ negate: z.ZodOptional<z.ZodBoolean>;
525
612
  operator: z.ZodLiteral<"matches_host">;
526
613
  value: z.ZodString;
527
614
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
528
615
  }, z.core.$strict>, z.ZodObject<{
616
+ negate: z.ZodOptional<z.ZodBoolean>;
529
617
  operator: z.ZodLiteral<"matches_path">;
530
618
  value: z.ZodString;
531
619
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
532
620
  }, z.core.$strict>, z.ZodObject<{
621
+ negate: z.ZodOptional<z.ZodBoolean>;
533
622
  operator: z.ZodLiteral<"range">;
534
623
  value: z.ZodObject<{
535
624
  min: z.ZodOptional<z.ZodNumber>;
@@ -537,21 +626,26 @@ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
537
626
  }, z.core.$strict>;
538
627
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
539
628
  }, z.core.$strict>, z.ZodObject<{
629
+ negate: z.ZodOptional<z.ZodBoolean>;
540
630
  operator: z.ZodLiteral<"matches_url">;
541
631
  value: z.ZodString;
542
632
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
543
633
  }, z.core.$strict>, z.ZodObject<{
634
+ negate: z.ZodOptional<z.ZodBoolean>;
544
635
  operator: z.ZodLiteral<"values_in">;
545
636
  value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
546
637
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
547
638
  }, z.core.$strict>, z.ZodObject<{
639
+ negate: z.ZodOptional<z.ZodBoolean>;
548
640
  operator: z.ZodLiteral<"exists">;
549
641
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
550
642
  }, z.core.$strict>, z.ZodObject<{
643
+ negate: z.ZodOptional<z.ZodBoolean>;
551
644
  operator: z.ZodLiteral<"keys_in">;
552
645
  value: z.ZodArray<z.ZodString>;
553
646
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
554
647
  }, z.core.$strict>, z.ZodObject<{
648
+ negate: z.ZodOptional<z.ZodBoolean>;
555
649
  operator: z.ZodLiteral<"size">;
556
650
  value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
557
651
  min: z.ZodOptional<z.ZodNumber>;
@@ -573,26 +667,32 @@ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
573
667
  permissions: z.ZodArray<z.ZodString>;
574
668
  resources: z.ZodArray<z.ZodString>;
575
669
  conditions: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
670
+ negate: z.ZodOptional<z.ZodBoolean>;
576
671
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
577
672
  operator: z.ZodLiteral<"equals">;
578
673
  value: z.ZodJSONSchema;
579
674
  }, z.core.$strict>, z.ZodObject<{
675
+ negate: z.ZodOptional<z.ZodBoolean>;
580
676
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
581
677
  operator: z.ZodLiteral<"in">;
582
678
  value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
583
679
  }, z.core.$strict>, z.ZodObject<{
680
+ negate: z.ZodOptional<z.ZodBoolean>;
584
681
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
585
682
  operator: z.ZodLiteral<"matches">;
586
683
  value: z.ZodString;
587
684
  }, z.core.$strict>, z.ZodObject<{
685
+ negate: z.ZodOptional<z.ZodBoolean>;
588
686
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
589
687
  operator: z.ZodLiteral<"matches_host">;
590
688
  value: z.ZodString;
591
689
  }, z.core.$strict>, z.ZodObject<{
690
+ negate: z.ZodOptional<z.ZodBoolean>;
592
691
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
593
692
  operator: z.ZodLiteral<"matches_path">;
594
693
  value: z.ZodString;
595
694
  }, z.core.$strict>, z.ZodObject<{
695
+ negate: z.ZodOptional<z.ZodBoolean>;
596
696
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
597
697
  operator: z.ZodLiteral<"range">;
598
698
  value: z.ZodObject<{
@@ -600,21 +700,26 @@ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
600
700
  max: z.ZodOptional<z.ZodNumber>;
601
701
  }, z.core.$strict>;
602
702
  }, z.core.$strict>, z.ZodObject<{
703
+ negate: z.ZodOptional<z.ZodBoolean>;
603
704
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
604
705
  operator: z.ZodLiteral<"matches_url">;
605
706
  value: z.ZodString;
606
707
  }, z.core.$strict>, z.ZodObject<{
708
+ negate: z.ZodOptional<z.ZodBoolean>;
607
709
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
608
710
  operator: z.ZodLiteral<"values_in">;
609
711
  value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
610
712
  }, z.core.$strict>, z.ZodObject<{
713
+ negate: z.ZodOptional<z.ZodBoolean>;
611
714
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
612
715
  operator: z.ZodLiteral<"exists">;
613
716
  }, z.core.$strict>, z.ZodObject<{
717
+ negate: z.ZodOptional<z.ZodBoolean>;
614
718
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
615
719
  operator: z.ZodLiteral<"keys_in">;
616
720
  value: z.ZodArray<z.ZodString>;
617
721
  }, z.core.$strict>, z.ZodObject<{
722
+ negate: z.ZodOptional<z.ZodBoolean>;
618
723
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
619
724
  operator: z.ZodLiteral<"size">;
620
725
  value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
@@ -629,26 +734,32 @@ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
629
734
  none: "none";
630
735
  }>;
631
736
  where: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
737
+ negate: z.ZodOptional<z.ZodBoolean>;
632
738
  operator: z.ZodLiteral<"equals">;
633
739
  value: z.ZodJSONSchema;
634
740
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
635
741
  }, z.core.$strict>, z.ZodObject<{
742
+ negate: z.ZodOptional<z.ZodBoolean>;
636
743
  operator: z.ZodLiteral<"in">;
637
744
  value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
638
745
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
639
746
  }, z.core.$strict>, z.ZodObject<{
747
+ negate: z.ZodOptional<z.ZodBoolean>;
640
748
  operator: z.ZodLiteral<"matches">;
641
749
  value: z.ZodString;
642
750
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
643
751
  }, z.core.$strict>, z.ZodObject<{
752
+ negate: z.ZodOptional<z.ZodBoolean>;
644
753
  operator: z.ZodLiteral<"matches_host">;
645
754
  value: z.ZodString;
646
755
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
647
756
  }, z.core.$strict>, z.ZodObject<{
757
+ negate: z.ZodOptional<z.ZodBoolean>;
648
758
  operator: z.ZodLiteral<"matches_path">;
649
759
  value: z.ZodString;
650
760
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
651
761
  }, z.core.$strict>, z.ZodObject<{
762
+ negate: z.ZodOptional<z.ZodBoolean>;
652
763
  operator: z.ZodLiteral<"range">;
653
764
  value: z.ZodObject<{
654
765
  min: z.ZodOptional<z.ZodNumber>;
@@ -656,21 +767,167 @@ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
656
767
  }, z.core.$strict>;
657
768
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
658
769
  }, z.core.$strict>, z.ZodObject<{
770
+ negate: z.ZodOptional<z.ZodBoolean>;
659
771
  operator: z.ZodLiteral<"matches_url">;
660
772
  value: z.ZodString;
661
773
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
662
774
  }, z.core.$strict>, z.ZodObject<{
775
+ negate: z.ZodOptional<z.ZodBoolean>;
663
776
  operator: z.ZodLiteral<"values_in">;
664
777
  value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
665
778
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
666
779
  }, z.core.$strict>, z.ZodObject<{
780
+ negate: z.ZodOptional<z.ZodBoolean>;
667
781
  operator: z.ZodLiteral<"exists">;
668
782
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
669
783
  }, z.core.$strict>, z.ZodObject<{
784
+ negate: z.ZodOptional<z.ZodBoolean>;
670
785
  operator: z.ZodLiteral<"keys_in">;
671
786
  value: z.ZodArray<z.ZodString>;
672
787
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
673
788
  }, z.core.$strict>, z.ZodObject<{
789
+ negate: z.ZodOptional<z.ZodBoolean>;
790
+ operator: z.ZodLiteral<"size">;
791
+ value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
792
+ min: z.ZodOptional<z.ZodNumber>;
793
+ max: z.ZodOptional<z.ZodNumber>;
794
+ }, z.core.$strict>]>;
795
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
796
+ }, z.core.$strict>]>>;
797
+ }, z.core.$strict>]>>>;
798
+ }, z.core.$strict>>>;
799
+ }, z.core.$strict>, z.ZodObject<{
800
+ version: z.ZodLiteral<4>;
801
+ rules: z.ZodArray<z.ZodArray<z.ZodObject<{
802
+ id: z.ZodString;
803
+ effect: z.ZodEnum<{
804
+ allow: "allow";
805
+ deny: "deny";
806
+ ask: "ask";
807
+ }>;
808
+ permissions: z.ZodArray<z.ZodString>;
809
+ resources: z.ZodArray<z.ZodString>;
810
+ conditions: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
811
+ negate: z.ZodOptional<z.ZodBoolean>;
812
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
813
+ operator: z.ZodLiteral<"equals">;
814
+ value: z.ZodJSONSchema;
815
+ }, z.core.$strict>, z.ZodObject<{
816
+ negate: z.ZodOptional<z.ZodBoolean>;
817
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
818
+ operator: z.ZodLiteral<"in">;
819
+ value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
820
+ }, z.core.$strict>, z.ZodObject<{
821
+ negate: z.ZodOptional<z.ZodBoolean>;
822
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
823
+ operator: z.ZodLiteral<"matches">;
824
+ value: z.ZodString;
825
+ }, z.core.$strict>, z.ZodObject<{
826
+ negate: z.ZodOptional<z.ZodBoolean>;
827
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
828
+ operator: z.ZodLiteral<"matches_host">;
829
+ value: z.ZodString;
830
+ }, z.core.$strict>, z.ZodObject<{
831
+ negate: z.ZodOptional<z.ZodBoolean>;
832
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
833
+ operator: z.ZodLiteral<"matches_path">;
834
+ value: z.ZodString;
835
+ }, z.core.$strict>, z.ZodObject<{
836
+ negate: z.ZodOptional<z.ZodBoolean>;
837
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
838
+ operator: z.ZodLiteral<"range">;
839
+ value: z.ZodObject<{
840
+ min: z.ZodOptional<z.ZodNumber>;
841
+ max: z.ZodOptional<z.ZodNumber>;
842
+ }, z.core.$strict>;
843
+ }, z.core.$strict>, z.ZodObject<{
844
+ negate: z.ZodOptional<z.ZodBoolean>;
845
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
846
+ operator: z.ZodLiteral<"matches_url">;
847
+ value: z.ZodString;
848
+ }, z.core.$strict>, z.ZodObject<{
849
+ negate: z.ZodOptional<z.ZodBoolean>;
850
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
851
+ operator: z.ZodLiteral<"values_in">;
852
+ value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
853
+ }, z.core.$strict>, z.ZodObject<{
854
+ negate: z.ZodOptional<z.ZodBoolean>;
855
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
856
+ operator: z.ZodLiteral<"exists">;
857
+ }, z.core.$strict>, z.ZodObject<{
858
+ negate: z.ZodOptional<z.ZodBoolean>;
859
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
860
+ operator: z.ZodLiteral<"keys_in">;
861
+ value: z.ZodArray<z.ZodString>;
862
+ }, z.core.$strict>, z.ZodObject<{
863
+ negate: z.ZodOptional<z.ZodBoolean>;
864
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
865
+ operator: z.ZodLiteral<"size">;
866
+ value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
867
+ min: z.ZodOptional<z.ZodNumber>;
868
+ max: z.ZodOptional<z.ZodNumber>;
869
+ }, z.core.$strict>]>;
870
+ }, z.core.$strict>, z.ZodObject<{
871
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
872
+ operator: z.ZodEnum<{
873
+ some: "some";
874
+ all: "all";
875
+ none: "none";
876
+ }>;
877
+ where: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
878
+ negate: z.ZodOptional<z.ZodBoolean>;
879
+ operator: z.ZodLiteral<"equals">;
880
+ value: z.ZodJSONSchema;
881
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
882
+ }, z.core.$strict>, z.ZodObject<{
883
+ negate: z.ZodOptional<z.ZodBoolean>;
884
+ operator: z.ZodLiteral<"in">;
885
+ value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
886
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
887
+ }, z.core.$strict>, z.ZodObject<{
888
+ negate: z.ZodOptional<z.ZodBoolean>;
889
+ operator: z.ZodLiteral<"matches">;
890
+ value: z.ZodString;
891
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
892
+ }, z.core.$strict>, z.ZodObject<{
893
+ negate: z.ZodOptional<z.ZodBoolean>;
894
+ operator: z.ZodLiteral<"matches_host">;
895
+ value: z.ZodString;
896
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
897
+ }, z.core.$strict>, z.ZodObject<{
898
+ negate: z.ZodOptional<z.ZodBoolean>;
899
+ operator: z.ZodLiteral<"matches_path">;
900
+ value: z.ZodString;
901
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
902
+ }, z.core.$strict>, z.ZodObject<{
903
+ negate: z.ZodOptional<z.ZodBoolean>;
904
+ operator: z.ZodLiteral<"range">;
905
+ value: z.ZodObject<{
906
+ min: z.ZodOptional<z.ZodNumber>;
907
+ max: z.ZodOptional<z.ZodNumber>;
908
+ }, z.core.$strict>;
909
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
910
+ }, z.core.$strict>, z.ZodObject<{
911
+ negate: z.ZodOptional<z.ZodBoolean>;
912
+ operator: z.ZodLiteral<"matches_url">;
913
+ value: z.ZodString;
914
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
915
+ }, z.core.$strict>, z.ZodObject<{
916
+ negate: z.ZodOptional<z.ZodBoolean>;
917
+ operator: z.ZodLiteral<"values_in">;
918
+ value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
919
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
920
+ }, z.core.$strict>, z.ZodObject<{
921
+ negate: z.ZodOptional<z.ZodBoolean>;
922
+ operator: z.ZodLiteral<"exists">;
923
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
924
+ }, z.core.$strict>, z.ZodObject<{
925
+ negate: z.ZodOptional<z.ZodBoolean>;
926
+ operator: z.ZodLiteral<"keys_in">;
927
+ value: z.ZodArray<z.ZodString>;
928
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
929
+ }, z.core.$strict>, z.ZodObject<{
930
+ negate: z.ZodOptional<z.ZodBoolean>;
674
931
  operator: z.ZodLiteral<"size">;
675
932
  value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
676
933
  min: z.ZodOptional<z.ZodNumber>;
@@ -697,26 +954,32 @@ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
697
954
  permissions: z.ZodArray<z.ZodString>;
698
955
  resources: z.ZodArray<z.ZodString>;
699
956
  conditions: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
957
+ negate: z.ZodOptional<z.ZodBoolean>;
700
958
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
701
959
  operator: z.ZodLiteral<"equals">;
702
960
  value: z.ZodJSONSchema;
703
961
  }, z.core.$strict>, z.ZodObject<{
962
+ negate: z.ZodOptional<z.ZodBoolean>;
704
963
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
705
964
  operator: z.ZodLiteral<"in">;
706
965
  value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
707
966
  }, z.core.$strict>, z.ZodObject<{
967
+ negate: z.ZodOptional<z.ZodBoolean>;
708
968
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
709
969
  operator: z.ZodLiteral<"matches">;
710
970
  value: z.ZodString;
711
971
  }, z.core.$strict>, z.ZodObject<{
972
+ negate: z.ZodOptional<z.ZodBoolean>;
712
973
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
713
974
  operator: z.ZodLiteral<"matches_host">;
714
975
  value: z.ZodString;
715
976
  }, z.core.$strict>, z.ZodObject<{
977
+ negate: z.ZodOptional<z.ZodBoolean>;
716
978
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
717
979
  operator: z.ZodLiteral<"matches_path">;
718
980
  value: z.ZodString;
719
981
  }, z.core.$strict>, z.ZodObject<{
982
+ negate: z.ZodOptional<z.ZodBoolean>;
720
983
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
721
984
  operator: z.ZodLiteral<"range">;
722
985
  value: z.ZodObject<{
@@ -724,21 +987,26 @@ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
724
987
  max: z.ZodOptional<z.ZodNumber>;
725
988
  }, z.core.$strict>;
726
989
  }, z.core.$strict>, z.ZodObject<{
990
+ negate: z.ZodOptional<z.ZodBoolean>;
727
991
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
728
992
  operator: z.ZodLiteral<"matches_url">;
729
993
  value: z.ZodString;
730
994
  }, z.core.$strict>, z.ZodObject<{
995
+ negate: z.ZodOptional<z.ZodBoolean>;
731
996
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
732
997
  operator: z.ZodLiteral<"values_in">;
733
998
  value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
734
999
  }, z.core.$strict>, z.ZodObject<{
1000
+ negate: z.ZodOptional<z.ZodBoolean>;
735
1001
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
736
1002
  operator: z.ZodLiteral<"exists">;
737
1003
  }, z.core.$strict>, z.ZodObject<{
1004
+ negate: z.ZodOptional<z.ZodBoolean>;
738
1005
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
739
1006
  operator: z.ZodLiteral<"keys_in">;
740
1007
  value: z.ZodArray<z.ZodString>;
741
1008
  }, z.core.$strict>, z.ZodObject<{
1009
+ negate: z.ZodOptional<z.ZodBoolean>;
742
1010
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
743
1011
  operator: z.ZodLiteral<"size">;
744
1012
  value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
@@ -753,26 +1021,32 @@ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
753
1021
  none: "none";
754
1022
  }>;
755
1023
  where: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
1024
+ negate: z.ZodOptional<z.ZodBoolean>;
756
1025
  operator: z.ZodLiteral<"equals">;
757
1026
  value: z.ZodJSONSchema;
758
1027
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
759
1028
  }, z.core.$strict>, z.ZodObject<{
1029
+ negate: z.ZodOptional<z.ZodBoolean>;
760
1030
  operator: z.ZodLiteral<"in">;
761
1031
  value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
762
1032
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
763
1033
  }, z.core.$strict>, z.ZodObject<{
1034
+ negate: z.ZodOptional<z.ZodBoolean>;
764
1035
  operator: z.ZodLiteral<"matches">;
765
1036
  value: z.ZodString;
766
1037
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
767
1038
  }, z.core.$strict>, z.ZodObject<{
1039
+ negate: z.ZodOptional<z.ZodBoolean>;
768
1040
  operator: z.ZodLiteral<"matches_host">;
769
1041
  value: z.ZodString;
770
1042
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
771
1043
  }, z.core.$strict>, z.ZodObject<{
1044
+ negate: z.ZodOptional<z.ZodBoolean>;
772
1045
  operator: z.ZodLiteral<"matches_path">;
773
1046
  value: z.ZodString;
774
1047
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
775
1048
  }, z.core.$strict>, z.ZodObject<{
1049
+ negate: z.ZodOptional<z.ZodBoolean>;
776
1050
  operator: z.ZodLiteral<"range">;
777
1051
  value: z.ZodObject<{
778
1052
  min: z.ZodOptional<z.ZodNumber>;
@@ -780,21 +1054,26 @@ declare const PolicySchema: z.ZodUnion<readonly [z.ZodObject<{
780
1054
  }, z.core.$strict>;
781
1055
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
782
1056
  }, z.core.$strict>, z.ZodObject<{
1057
+ negate: z.ZodOptional<z.ZodBoolean>;
783
1058
  operator: z.ZodLiteral<"matches_url">;
784
1059
  value: z.ZodString;
785
1060
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
786
1061
  }, z.core.$strict>, z.ZodObject<{
1062
+ negate: z.ZodOptional<z.ZodBoolean>;
787
1063
  operator: z.ZodLiteral<"values_in">;
788
1064
  value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
789
1065
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
790
1066
  }, z.core.$strict>, z.ZodObject<{
1067
+ negate: z.ZodOptional<z.ZodBoolean>;
791
1068
  operator: z.ZodLiteral<"exists">;
792
1069
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
793
1070
  }, z.core.$strict>, z.ZodObject<{
1071
+ negate: z.ZodOptional<z.ZodBoolean>;
794
1072
  operator: z.ZodLiteral<"keys_in">;
795
1073
  value: z.ZodArray<z.ZodString>;
796
1074
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
797
1075
  }, z.core.$strict>, z.ZodObject<{
1076
+ negate: z.ZodOptional<z.ZodBoolean>;
798
1077
  operator: z.ZodLiteral<"size">;
799
1078
  value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
800
1079
  min: z.ZodOptional<z.ZodNumber>;
@@ -811,15 +1090,17 @@ type Policy = z.infer<typeof PolicySchema>;
811
1090
  declare const CanonicalHashSchema: z.ZodCustom<CanonicalHash, CanonicalHash>;
812
1091
  /**
813
1092
  * Runtime schema for the Override type. Each variant has exactly one target
814
- * field (statementHash for v1/v2, statementId or policyId for rc-rubberduck) and exactly
1093
+ * field (statementHash for v1/v2, statementId for v3/rc-rubberduck, policyId for
1094
+ * rc-rubberduck, ruleId for v4) and exactly
815
1095
  * one binding mode (match, contextHash, or conditionals). `.strict()` keeps
816
1096
  * the variants mutually exclusive (an object carrying fields from two variants
817
1097
  * fails all branches).
818
1098
  *
819
1099
  * Targets are all non-null:
820
1100
  * - statementHash: targets a v1/v2 statement by canonical hash
821
- * - statementId: targets an rc-rubberduck statement by id
1101
+ * - statementId: targets a v3/rc-rubberduck statement by id
822
1102
  * - policyId: targets that policy's default effect (rc-rubberduck only)
1103
+ * - ruleId: targets a v4 rule by id
823
1104
  *
824
1105
  * Empty conditionals is intentional (the "blank check"): the override applies
825
1106
  * whenever the targeted ask statement fires, with no extra conditions. Do not
@@ -837,26 +1118,32 @@ declare const OverrideSchema: z.ZodUnion<readonly [z.ZodObject<{
837
1118
  effect: z.ZodLiteral<"allow">;
838
1119
  }, z.core.$strict>, z.ZodObject<{
839
1120
  conditionals: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
1121
+ negate: z.ZodOptional<z.ZodBoolean>;
840
1122
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
841
1123
  operator: z.ZodLiteral<"equals">;
842
1124
  value: z.ZodJSONSchema;
843
1125
  }, z.core.$strict>, z.ZodObject<{
1126
+ negate: z.ZodOptional<z.ZodBoolean>;
844
1127
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
845
1128
  operator: z.ZodLiteral<"in">;
846
1129
  value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
847
1130
  }, z.core.$strict>, z.ZodObject<{
1131
+ negate: z.ZodOptional<z.ZodBoolean>;
848
1132
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
849
1133
  operator: z.ZodLiteral<"matches">;
850
1134
  value: z.ZodString;
851
1135
  }, z.core.$strict>, z.ZodObject<{
1136
+ negate: z.ZodOptional<z.ZodBoolean>;
852
1137
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
853
1138
  operator: z.ZodLiteral<"matches_host">;
854
1139
  value: z.ZodString;
855
1140
  }, z.core.$strict>, z.ZodObject<{
1141
+ negate: z.ZodOptional<z.ZodBoolean>;
856
1142
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
857
1143
  operator: z.ZodLiteral<"matches_path">;
858
1144
  value: z.ZodString;
859
1145
  }, z.core.$strict>, z.ZodObject<{
1146
+ negate: z.ZodOptional<z.ZodBoolean>;
860
1147
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
861
1148
  operator: z.ZodLiteral<"range">;
862
1149
  value: z.ZodObject<{
@@ -864,21 +1151,26 @@ declare const OverrideSchema: z.ZodUnion<readonly [z.ZodObject<{
864
1151
  max: z.ZodOptional<z.ZodNumber>;
865
1152
  }, z.core.$strict>;
866
1153
  }, z.core.$strict>, z.ZodObject<{
1154
+ negate: z.ZodOptional<z.ZodBoolean>;
867
1155
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
868
1156
  operator: z.ZodLiteral<"matches_url">;
869
1157
  value: z.ZodString;
870
1158
  }, z.core.$strict>, z.ZodObject<{
1159
+ negate: z.ZodOptional<z.ZodBoolean>;
871
1160
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
872
1161
  operator: z.ZodLiteral<"values_in">;
873
1162
  value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
874
1163
  }, z.core.$strict>, z.ZodObject<{
1164
+ negate: z.ZodOptional<z.ZodBoolean>;
875
1165
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
876
1166
  operator: z.ZodLiteral<"exists">;
877
1167
  }, z.core.$strict>, z.ZodObject<{
1168
+ negate: z.ZodOptional<z.ZodBoolean>;
878
1169
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
879
1170
  operator: z.ZodLiteral<"keys_in">;
880
1171
  value: z.ZodArray<z.ZodString>;
881
1172
  }, z.core.$strict>, z.ZodObject<{
1173
+ negate: z.ZodOptional<z.ZodBoolean>;
882
1174
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
883
1175
  operator: z.ZodLiteral<"size">;
884
1176
  value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
@@ -893,26 +1185,32 @@ declare const OverrideSchema: z.ZodUnion<readonly [z.ZodObject<{
893
1185
  none: "none";
894
1186
  }>;
895
1187
  where: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
1188
+ negate: z.ZodOptional<z.ZodBoolean>;
896
1189
  operator: z.ZodLiteral<"equals">;
897
1190
  value: z.ZodJSONSchema;
898
1191
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
899
1192
  }, z.core.$strict>, z.ZodObject<{
1193
+ negate: z.ZodOptional<z.ZodBoolean>;
900
1194
  operator: z.ZodLiteral<"in">;
901
1195
  value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
902
1196
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
903
1197
  }, z.core.$strict>, z.ZodObject<{
1198
+ negate: z.ZodOptional<z.ZodBoolean>;
904
1199
  operator: z.ZodLiteral<"matches">;
905
1200
  value: z.ZodString;
906
1201
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
907
1202
  }, z.core.$strict>, z.ZodObject<{
1203
+ negate: z.ZodOptional<z.ZodBoolean>;
908
1204
  operator: z.ZodLiteral<"matches_host">;
909
1205
  value: z.ZodString;
910
1206
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
911
1207
  }, z.core.$strict>, z.ZodObject<{
1208
+ negate: z.ZodOptional<z.ZodBoolean>;
912
1209
  operator: z.ZodLiteral<"matches_path">;
913
1210
  value: z.ZodString;
914
1211
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
915
1212
  }, z.core.$strict>, z.ZodObject<{
1213
+ negate: z.ZodOptional<z.ZodBoolean>;
916
1214
  operator: z.ZodLiteral<"range">;
917
1215
  value: z.ZodObject<{
918
1216
  min: z.ZodOptional<z.ZodNumber>;
@@ -920,21 +1218,26 @@ declare const OverrideSchema: z.ZodUnion<readonly [z.ZodObject<{
920
1218
  }, z.core.$strict>;
921
1219
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
922
1220
  }, z.core.$strict>, z.ZodObject<{
1221
+ negate: z.ZodOptional<z.ZodBoolean>;
923
1222
  operator: z.ZodLiteral<"matches_url">;
924
1223
  value: z.ZodString;
925
1224
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
926
1225
  }, z.core.$strict>, z.ZodObject<{
1226
+ negate: z.ZodOptional<z.ZodBoolean>;
927
1227
  operator: z.ZodLiteral<"values_in">;
928
1228
  value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
929
1229
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
930
1230
  }, z.core.$strict>, z.ZodObject<{
1231
+ negate: z.ZodOptional<z.ZodBoolean>;
931
1232
  operator: z.ZodLiteral<"exists">;
932
1233
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
933
1234
  }, z.core.$strict>, z.ZodObject<{
1235
+ negate: z.ZodOptional<z.ZodBoolean>;
934
1236
  operator: z.ZodLiteral<"keys_in">;
935
1237
  value: z.ZodArray<z.ZodString>;
936
1238
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
937
1239
  }, z.core.$strict>, z.ZodObject<{
1240
+ negate: z.ZodOptional<z.ZodBoolean>;
938
1241
  operator: z.ZodLiteral<"size">;
939
1242
  value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
940
1243
  min: z.ZodOptional<z.ZodNumber>;
@@ -958,26 +1261,32 @@ declare const OverrideSchema: z.ZodUnion<readonly [z.ZodObject<{
958
1261
  effect: z.ZodLiteral<"allow">;
959
1262
  }, z.core.$strict>, z.ZodObject<{
960
1263
  conditionals: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
1264
+ negate: z.ZodOptional<z.ZodBoolean>;
961
1265
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
962
1266
  operator: z.ZodLiteral<"equals">;
963
1267
  value: z.ZodJSONSchema;
964
1268
  }, z.core.$strict>, z.ZodObject<{
1269
+ negate: z.ZodOptional<z.ZodBoolean>;
965
1270
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
966
1271
  operator: z.ZodLiteral<"in">;
967
1272
  value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
968
1273
  }, z.core.$strict>, z.ZodObject<{
1274
+ negate: z.ZodOptional<z.ZodBoolean>;
969
1275
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
970
1276
  operator: z.ZodLiteral<"matches">;
971
1277
  value: z.ZodString;
972
1278
  }, z.core.$strict>, z.ZodObject<{
1279
+ negate: z.ZodOptional<z.ZodBoolean>;
973
1280
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
974
1281
  operator: z.ZodLiteral<"matches_host">;
975
1282
  value: z.ZodString;
976
1283
  }, z.core.$strict>, z.ZodObject<{
1284
+ negate: z.ZodOptional<z.ZodBoolean>;
977
1285
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
978
1286
  operator: z.ZodLiteral<"matches_path">;
979
1287
  value: z.ZodString;
980
1288
  }, z.core.$strict>, z.ZodObject<{
1289
+ negate: z.ZodOptional<z.ZodBoolean>;
981
1290
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
982
1291
  operator: z.ZodLiteral<"range">;
983
1292
  value: z.ZodObject<{
@@ -985,21 +1294,26 @@ declare const OverrideSchema: z.ZodUnion<readonly [z.ZodObject<{
985
1294
  max: z.ZodOptional<z.ZodNumber>;
986
1295
  }, z.core.$strict>;
987
1296
  }, z.core.$strict>, z.ZodObject<{
1297
+ negate: z.ZodOptional<z.ZodBoolean>;
988
1298
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
989
1299
  operator: z.ZodLiteral<"matches_url">;
990
1300
  value: z.ZodString;
991
1301
  }, z.core.$strict>, z.ZodObject<{
1302
+ negate: z.ZodOptional<z.ZodBoolean>;
992
1303
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
993
1304
  operator: z.ZodLiteral<"values_in">;
994
1305
  value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
995
1306
  }, z.core.$strict>, z.ZodObject<{
1307
+ negate: z.ZodOptional<z.ZodBoolean>;
996
1308
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
997
1309
  operator: z.ZodLiteral<"exists">;
998
1310
  }, z.core.$strict>, z.ZodObject<{
1311
+ negate: z.ZodOptional<z.ZodBoolean>;
999
1312
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1000
1313
  operator: z.ZodLiteral<"keys_in">;
1001
1314
  value: z.ZodArray<z.ZodString>;
1002
1315
  }, z.core.$strict>, z.ZodObject<{
1316
+ negate: z.ZodOptional<z.ZodBoolean>;
1003
1317
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1004
1318
  operator: z.ZodLiteral<"size">;
1005
1319
  value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
@@ -1014,26 +1328,32 @@ declare const OverrideSchema: z.ZodUnion<readonly [z.ZodObject<{
1014
1328
  none: "none";
1015
1329
  }>;
1016
1330
  where: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
1331
+ negate: z.ZodOptional<z.ZodBoolean>;
1017
1332
  operator: z.ZodLiteral<"equals">;
1018
1333
  value: z.ZodJSONSchema;
1019
1334
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1020
1335
  }, z.core.$strict>, z.ZodObject<{
1336
+ negate: z.ZodOptional<z.ZodBoolean>;
1021
1337
  operator: z.ZodLiteral<"in">;
1022
1338
  value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
1023
1339
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1024
1340
  }, z.core.$strict>, z.ZodObject<{
1341
+ negate: z.ZodOptional<z.ZodBoolean>;
1025
1342
  operator: z.ZodLiteral<"matches">;
1026
1343
  value: z.ZodString;
1027
1344
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1028
1345
  }, z.core.$strict>, z.ZodObject<{
1346
+ negate: z.ZodOptional<z.ZodBoolean>;
1029
1347
  operator: z.ZodLiteral<"matches_host">;
1030
1348
  value: z.ZodString;
1031
1349
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1032
1350
  }, z.core.$strict>, z.ZodObject<{
1351
+ negate: z.ZodOptional<z.ZodBoolean>;
1033
1352
  operator: z.ZodLiteral<"matches_path">;
1034
1353
  value: z.ZodString;
1035
1354
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1036
1355
  }, z.core.$strict>, z.ZodObject<{
1356
+ negate: z.ZodOptional<z.ZodBoolean>;
1037
1357
  operator: z.ZodLiteral<"range">;
1038
1358
  value: z.ZodObject<{
1039
1359
  min: z.ZodOptional<z.ZodNumber>;
@@ -1041,21 +1361,26 @@ declare const OverrideSchema: z.ZodUnion<readonly [z.ZodObject<{
1041
1361
  }, z.core.$strict>;
1042
1362
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1043
1363
  }, z.core.$strict>, z.ZodObject<{
1364
+ negate: z.ZodOptional<z.ZodBoolean>;
1044
1365
  operator: z.ZodLiteral<"matches_url">;
1045
1366
  value: z.ZodString;
1046
1367
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1047
1368
  }, z.core.$strict>, z.ZodObject<{
1369
+ negate: z.ZodOptional<z.ZodBoolean>;
1048
1370
  operator: z.ZodLiteral<"values_in">;
1049
1371
  value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
1050
1372
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1051
1373
  }, z.core.$strict>, z.ZodObject<{
1374
+ negate: z.ZodOptional<z.ZodBoolean>;
1052
1375
  operator: z.ZodLiteral<"exists">;
1053
1376
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1054
1377
  }, z.core.$strict>, z.ZodObject<{
1378
+ negate: z.ZodOptional<z.ZodBoolean>;
1055
1379
  operator: z.ZodLiteral<"keys_in">;
1056
1380
  value: z.ZodArray<z.ZodString>;
1057
1381
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1058
1382
  }, z.core.$strict>, z.ZodObject<{
1383
+ negate: z.ZodOptional<z.ZodBoolean>;
1059
1384
  operator: z.ZodLiteral<"size">;
1060
1385
  value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
1061
1386
  min: z.ZodOptional<z.ZodNumber>;
@@ -1079,26 +1404,32 @@ declare const OverrideSchema: z.ZodUnion<readonly [z.ZodObject<{
1079
1404
  effect: z.ZodLiteral<"allow">;
1080
1405
  }, z.core.$strict>, z.ZodObject<{
1081
1406
  conditionals: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
1407
+ negate: z.ZodOptional<z.ZodBoolean>;
1082
1408
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1083
1409
  operator: z.ZodLiteral<"equals">;
1084
1410
  value: z.ZodJSONSchema;
1085
1411
  }, z.core.$strict>, z.ZodObject<{
1412
+ negate: z.ZodOptional<z.ZodBoolean>;
1086
1413
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1087
1414
  operator: z.ZodLiteral<"in">;
1088
1415
  value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
1089
1416
  }, z.core.$strict>, z.ZodObject<{
1417
+ negate: z.ZodOptional<z.ZodBoolean>;
1090
1418
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1091
1419
  operator: z.ZodLiteral<"matches">;
1092
1420
  value: z.ZodString;
1093
1421
  }, z.core.$strict>, z.ZodObject<{
1422
+ negate: z.ZodOptional<z.ZodBoolean>;
1094
1423
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1095
1424
  operator: z.ZodLiteral<"matches_host">;
1096
1425
  value: z.ZodString;
1097
1426
  }, z.core.$strict>, z.ZodObject<{
1427
+ negate: z.ZodOptional<z.ZodBoolean>;
1098
1428
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1099
1429
  operator: z.ZodLiteral<"matches_path">;
1100
1430
  value: z.ZodString;
1101
1431
  }, z.core.$strict>, z.ZodObject<{
1432
+ negate: z.ZodOptional<z.ZodBoolean>;
1102
1433
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1103
1434
  operator: z.ZodLiteral<"range">;
1104
1435
  value: z.ZodObject<{
@@ -1106,21 +1437,26 @@ declare const OverrideSchema: z.ZodUnion<readonly [z.ZodObject<{
1106
1437
  max: z.ZodOptional<z.ZodNumber>;
1107
1438
  }, z.core.$strict>;
1108
1439
  }, z.core.$strict>, z.ZodObject<{
1440
+ negate: z.ZodOptional<z.ZodBoolean>;
1109
1441
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1110
1442
  operator: z.ZodLiteral<"matches_url">;
1111
1443
  value: z.ZodString;
1112
1444
  }, z.core.$strict>, z.ZodObject<{
1445
+ negate: z.ZodOptional<z.ZodBoolean>;
1113
1446
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1114
1447
  operator: z.ZodLiteral<"values_in">;
1115
1448
  value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
1116
1449
  }, z.core.$strict>, z.ZodObject<{
1450
+ negate: z.ZodOptional<z.ZodBoolean>;
1117
1451
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1118
1452
  operator: z.ZodLiteral<"exists">;
1119
1453
  }, z.core.$strict>, z.ZodObject<{
1454
+ negate: z.ZodOptional<z.ZodBoolean>;
1120
1455
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1121
1456
  operator: z.ZodLiteral<"keys_in">;
1122
1457
  value: z.ZodArray<z.ZodString>;
1123
1458
  }, z.core.$strict>, z.ZodObject<{
1459
+ negate: z.ZodOptional<z.ZodBoolean>;
1124
1460
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1125
1461
  operator: z.ZodLiteral<"size">;
1126
1462
  value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
@@ -1135,26 +1471,32 @@ declare const OverrideSchema: z.ZodUnion<readonly [z.ZodObject<{
1135
1471
  none: "none";
1136
1472
  }>;
1137
1473
  where: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
1474
+ negate: z.ZodOptional<z.ZodBoolean>;
1138
1475
  operator: z.ZodLiteral<"equals">;
1139
1476
  value: z.ZodJSONSchema;
1140
1477
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1141
1478
  }, z.core.$strict>, z.ZodObject<{
1479
+ negate: z.ZodOptional<z.ZodBoolean>;
1142
1480
  operator: z.ZodLiteral<"in">;
1143
1481
  value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
1144
1482
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1145
1483
  }, z.core.$strict>, z.ZodObject<{
1484
+ negate: z.ZodOptional<z.ZodBoolean>;
1146
1485
  operator: z.ZodLiteral<"matches">;
1147
1486
  value: z.ZodString;
1148
1487
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1149
1488
  }, z.core.$strict>, z.ZodObject<{
1489
+ negate: z.ZodOptional<z.ZodBoolean>;
1150
1490
  operator: z.ZodLiteral<"matches_host">;
1151
1491
  value: z.ZodString;
1152
1492
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1153
1493
  }, z.core.$strict>, z.ZodObject<{
1494
+ negate: z.ZodOptional<z.ZodBoolean>;
1154
1495
  operator: z.ZodLiteral<"matches_path">;
1155
1496
  value: z.ZodString;
1156
1497
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1157
1498
  }, z.core.$strict>, z.ZodObject<{
1499
+ negate: z.ZodOptional<z.ZodBoolean>;
1158
1500
  operator: z.ZodLiteral<"range">;
1159
1501
  value: z.ZodObject<{
1160
1502
  min: z.ZodOptional<z.ZodNumber>;
@@ -1162,21 +1504,26 @@ declare const OverrideSchema: z.ZodUnion<readonly [z.ZodObject<{
1162
1504
  }, z.core.$strict>;
1163
1505
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1164
1506
  }, z.core.$strict>, z.ZodObject<{
1507
+ negate: z.ZodOptional<z.ZodBoolean>;
1165
1508
  operator: z.ZodLiteral<"matches_url">;
1166
1509
  value: z.ZodString;
1167
1510
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1168
1511
  }, z.core.$strict>, z.ZodObject<{
1512
+ negate: z.ZodOptional<z.ZodBoolean>;
1169
1513
  operator: z.ZodLiteral<"values_in">;
1170
1514
  value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
1171
1515
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1172
1516
  }, z.core.$strict>, z.ZodObject<{
1517
+ negate: z.ZodOptional<z.ZodBoolean>;
1173
1518
  operator: z.ZodLiteral<"exists">;
1174
1519
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1175
1520
  }, z.core.$strict>, z.ZodObject<{
1521
+ negate: z.ZodOptional<z.ZodBoolean>;
1176
1522
  operator: z.ZodLiteral<"keys_in">;
1177
1523
  value: z.ZodArray<z.ZodString>;
1178
1524
  path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1179
1525
  }, z.core.$strict>, z.ZodObject<{
1526
+ negate: z.ZodOptional<z.ZodBoolean>;
1180
1527
  operator: z.ZodLiteral<"size">;
1181
1528
  value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
1182
1529
  min: z.ZodOptional<z.ZodNumber>;
@@ -1188,6 +1535,149 @@ declare const OverrideSchema: z.ZodUnion<readonly [z.ZodObject<{
1188
1535
  id: z.ZodOptional<z.ZodString>;
1189
1536
  policyId: z.ZodString;
1190
1537
  effect: z.ZodLiteral<"allow">;
1538
+ }, z.core.$strict>, z.ZodObject<{
1539
+ match: z.ZodLiteral<"any">;
1540
+ id: z.ZodOptional<z.ZodString>;
1541
+ ruleId: z.ZodString;
1542
+ effect: z.ZodLiteral<"allow">;
1543
+ }, z.core.$strict>, z.ZodObject<{
1544
+ contextHash: z.ZodCustom<CanonicalHash, CanonicalHash>;
1545
+ id: z.ZodOptional<z.ZodString>;
1546
+ ruleId: z.ZodString;
1547
+ effect: z.ZodLiteral<"allow">;
1548
+ }, z.core.$strict>, z.ZodObject<{
1549
+ conditionals: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
1550
+ negate: z.ZodOptional<z.ZodBoolean>;
1551
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1552
+ operator: z.ZodLiteral<"equals">;
1553
+ value: z.ZodJSONSchema;
1554
+ }, z.core.$strict>, z.ZodObject<{
1555
+ negate: z.ZodOptional<z.ZodBoolean>;
1556
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1557
+ operator: z.ZodLiteral<"in">;
1558
+ value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
1559
+ }, z.core.$strict>, z.ZodObject<{
1560
+ negate: z.ZodOptional<z.ZodBoolean>;
1561
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1562
+ operator: z.ZodLiteral<"matches">;
1563
+ value: z.ZodString;
1564
+ }, z.core.$strict>, z.ZodObject<{
1565
+ negate: z.ZodOptional<z.ZodBoolean>;
1566
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1567
+ operator: z.ZodLiteral<"matches_host">;
1568
+ value: z.ZodString;
1569
+ }, z.core.$strict>, z.ZodObject<{
1570
+ negate: z.ZodOptional<z.ZodBoolean>;
1571
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1572
+ operator: z.ZodLiteral<"matches_path">;
1573
+ value: z.ZodString;
1574
+ }, z.core.$strict>, z.ZodObject<{
1575
+ negate: z.ZodOptional<z.ZodBoolean>;
1576
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1577
+ operator: z.ZodLiteral<"range">;
1578
+ value: z.ZodObject<{
1579
+ min: z.ZodOptional<z.ZodNumber>;
1580
+ max: z.ZodOptional<z.ZodNumber>;
1581
+ }, z.core.$strict>;
1582
+ }, z.core.$strict>, z.ZodObject<{
1583
+ negate: z.ZodOptional<z.ZodBoolean>;
1584
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1585
+ operator: z.ZodLiteral<"matches_url">;
1586
+ value: z.ZodString;
1587
+ }, z.core.$strict>, z.ZodObject<{
1588
+ negate: z.ZodOptional<z.ZodBoolean>;
1589
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1590
+ operator: z.ZodLiteral<"values_in">;
1591
+ value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
1592
+ }, z.core.$strict>, z.ZodObject<{
1593
+ negate: z.ZodOptional<z.ZodBoolean>;
1594
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1595
+ operator: z.ZodLiteral<"exists">;
1596
+ }, z.core.$strict>, z.ZodObject<{
1597
+ negate: z.ZodOptional<z.ZodBoolean>;
1598
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1599
+ operator: z.ZodLiteral<"keys_in">;
1600
+ value: z.ZodArray<z.ZodString>;
1601
+ }, z.core.$strict>, z.ZodObject<{
1602
+ negate: z.ZodOptional<z.ZodBoolean>;
1603
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1604
+ operator: z.ZodLiteral<"size">;
1605
+ value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
1606
+ min: z.ZodOptional<z.ZodNumber>;
1607
+ max: z.ZodOptional<z.ZodNumber>;
1608
+ }, z.core.$strict>]>;
1609
+ }, z.core.$strict>, z.ZodObject<{
1610
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1611
+ operator: z.ZodEnum<{
1612
+ some: "some";
1613
+ all: "all";
1614
+ none: "none";
1615
+ }>;
1616
+ where: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
1617
+ negate: z.ZodOptional<z.ZodBoolean>;
1618
+ operator: z.ZodLiteral<"equals">;
1619
+ value: z.ZodJSONSchema;
1620
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1621
+ }, z.core.$strict>, z.ZodObject<{
1622
+ negate: z.ZodOptional<z.ZodBoolean>;
1623
+ operator: z.ZodLiteral<"in">;
1624
+ value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
1625
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1626
+ }, z.core.$strict>, z.ZodObject<{
1627
+ negate: z.ZodOptional<z.ZodBoolean>;
1628
+ operator: z.ZodLiteral<"matches">;
1629
+ value: z.ZodString;
1630
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1631
+ }, z.core.$strict>, z.ZodObject<{
1632
+ negate: z.ZodOptional<z.ZodBoolean>;
1633
+ operator: z.ZodLiteral<"matches_host">;
1634
+ value: z.ZodString;
1635
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1636
+ }, z.core.$strict>, z.ZodObject<{
1637
+ negate: z.ZodOptional<z.ZodBoolean>;
1638
+ operator: z.ZodLiteral<"matches_path">;
1639
+ value: z.ZodString;
1640
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1641
+ }, z.core.$strict>, z.ZodObject<{
1642
+ negate: z.ZodOptional<z.ZodBoolean>;
1643
+ operator: z.ZodLiteral<"range">;
1644
+ value: z.ZodObject<{
1645
+ min: z.ZodOptional<z.ZodNumber>;
1646
+ max: z.ZodOptional<z.ZodNumber>;
1647
+ }, z.core.$strict>;
1648
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1649
+ }, z.core.$strict>, z.ZodObject<{
1650
+ negate: z.ZodOptional<z.ZodBoolean>;
1651
+ operator: z.ZodLiteral<"matches_url">;
1652
+ value: z.ZodString;
1653
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1654
+ }, z.core.$strict>, z.ZodObject<{
1655
+ negate: z.ZodOptional<z.ZodBoolean>;
1656
+ operator: z.ZodLiteral<"values_in">;
1657
+ value: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
1658
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1659
+ }, z.core.$strict>, z.ZodObject<{
1660
+ negate: z.ZodOptional<z.ZodBoolean>;
1661
+ operator: z.ZodLiteral<"exists">;
1662
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1663
+ }, z.core.$strict>, z.ZodObject<{
1664
+ negate: z.ZodOptional<z.ZodBoolean>;
1665
+ operator: z.ZodLiteral<"keys_in">;
1666
+ value: z.ZodArray<z.ZodString>;
1667
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1668
+ }, z.core.$strict>, z.ZodObject<{
1669
+ negate: z.ZodOptional<z.ZodBoolean>;
1670
+ operator: z.ZodLiteral<"size">;
1671
+ value: z.ZodUnion<readonly [z.ZodNumber, z.ZodObject<{
1672
+ min: z.ZodOptional<z.ZodNumber>;
1673
+ max: z.ZodOptional<z.ZodNumber>;
1674
+ }, z.core.$strict>]>;
1675
+ path: z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>>;
1676
+ }, z.core.$strict>]>>;
1677
+ }, z.core.$strict>]>>;
1678
+ id: z.ZodOptional<z.ZodString>;
1679
+ ruleId: z.ZodString;
1680
+ effect: z.ZodLiteral<"allow">;
1191
1681
  }, z.core.$strict>]>;
1192
1682
  /** Derived from OverrideSchema — the schema is the single source of truth. */
1193
1683
  type Override = z.infer<typeof OverrideSchema>;
@@ -1234,6 +1724,18 @@ interface StatementTrace {
1234
1724
  passed: boolean;
1235
1725
  overrides?: OverrideTrace[];
1236
1726
  }
1727
+ /**
1728
+ * v4 rule trace. Identical to StatementTrace but the matched object is keyed
1729
+ * `rule` instead of `statement`, matching the v4 `statements`->`rules` rename.
1730
+ */
1731
+ interface RuleTrace {
1732
+ rule: Statement;
1733
+ permissionMatched: boolean;
1734
+ resourceMatched: boolean;
1735
+ conditionResults?: ConditionTrace[];
1736
+ passed: boolean;
1737
+ overrides?: OverrideTrace[];
1738
+ }
1237
1739
  interface EvaluatePolicyOptions {
1238
1740
  policy: Policy;
1239
1741
  request: PolicyRequest;
@@ -1249,6 +1751,19 @@ interface PolicyResult {
1249
1751
  /** Trace mode only. Present when no statement matched and an ask default was consulted (never attached for deny defaults). */
1250
1752
  default?: DefaultTrace;
1251
1753
  }
1754
+ /**
1755
+ * Result of evaluating a v4 policy. Version-gated shape: the trace array is
1756
+ * keyed `rules` (of RuleTrace) instead of `statements`, matching the v4
1757
+ * `statements`->`rules` rename. Only ever returned for a v4 policy; all other
1758
+ * versions return {@link PolicyResult}. v4 has no ask default (no
1759
+ * defaultEffect), so there is no `default` field.
1760
+ */
1761
+ interface PolicyResultV4 {
1762
+ effect: Effect;
1763
+ explicit: boolean;
1764
+ reason: PolicyReason;
1765
+ rules: RuleTrace[];
1766
+ }
1252
1767
  interface ParsedUrl {
1253
1768
  scheme: string;
1254
1769
  host: string;
@@ -1278,10 +1793,11 @@ interface OpenApiSchema {
1278
1793
  properties?: Record<string, OpenApiSchema>;
1279
1794
  items?: OpenApiSchema;
1280
1795
  enum?: (string | number)[];
1796
+ const?: string | number;
1281
1797
  description?: string;
1282
1798
  minItems?: number;
1283
1799
  oneOf?: OpenApiSchema[];
1284
1800
  anyOf?: OpenApiSchema[];
1285
1801
  }
1286
1802
 
1287
- export { type ArrayOperator, ArrayOperatorSchema, type CanonicalHash, CanonicalHashSchema, type Condition, ConditionSchema, type ConditionTrace, type ConditionValue, ConditionValueSchema, type DefaultEffect, DefaultEffectSchema, type DefaultTrace, type Effect, type EvaluatePolicyOptions, ID_BASED_VERSIONS, type JsonValue, type OpenApiSchema, type Operator, OperatorSchema, type OtherOperator, OtherOperatorSchema, type Override, OverrideSchema, type OverrideTrace, type ParsedUrl, type Policy, type PolicyActionRequest, type PolicyHttpRequest, type PolicyId, PolicyIdSchema, type PolicyReason, type PolicyRequest, type PolicyResult, PolicySchema, RUBBERDUCK_POLICY_VERSION, type RangeValue, RangeValueSchema, type ScalarOperator, ScalarOperatorSchema, type SizeValue, SizeValueSchema, type Statement, type StatementId, StatementIdSchema, StatementSchema, type StatementTrace, type UrlOperator, UrlOperatorSchema, V3_MAX_TIERS, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };
1803
+ export { type ArrayOperator, ArrayOperatorSchema, type CanonicalHash, CanonicalHashSchema, type Condition, ConditionSchema, type ConditionTrace, type ConditionValue, ConditionValueSchema, type DefaultEffect, DefaultEffectSchema, type DefaultTrace, type Effect, type EvaluatePolicyOptions, ID_BASED_VERSIONS, type JsonValue, type OpenApiSchema, type Operator, OperatorSchema, type OtherOperator, OtherOperatorSchema, type Override, OverrideSchema, type OverrideTrace, type ParsedUrl, type Policy, type PolicyActionRequest, type PolicyHttpRequest, type PolicyId, PolicyIdSchema, type PolicyReason, type PolicyRequest, type PolicyResult, type PolicyResultV4, PolicySchema, RUBBERDUCK_POLICY_VERSION, type RangeValue, RangeValueSchema, type RuleId, RuleIdSchema, type RuleTrace, type ScalarOperator, ScalarOperatorSchema, type SizeValue, SizeValueSchema, type Statement, type StatementId, StatementIdSchema, StatementSchema, type StatementTrace, type UrlOperator, UrlOperatorSchema, V3_MAX_TIERS, V4_MAX_TIERS, VALID_EFFECTS, VALID_OPERATOR_LIST, VALID_VERSIONS, getOpenApiSchema };