@servicenow/sdk-build-plugins 4.7.1 → 4.8.0

package/src/alias/alias-plugin.ts

@@ -0,0 +1,221 @@
+import { CallExpressionShape, Plugin, type Diagnostics, type Shape, type ObjectShape } from '@servicenow/sdk-build-core'
+import { NowIdShape } from '../now-id-plugin'
+
+const SYS_ALIAS = 'sys_alias'
+
+// Maps developer-facing camelCase connection type labels to ServiceNow platform values
+const CONNECTION_TYPE_MAP: Record<string, string> = {
+    httpConnection: 'http_connection',
+    jdbcConnection: 'jdbc_connection',
+    basicConnection: 'sys_connection',
+    jmsConnection: 'orch_jms_ds',
+}
+
+// Reverse map: platform values to camelCase labels (used in toShape)
+const CONNECTION_TYPE_REVERSE_MAP: Record<string, string> = Object.fromEntries(
+    Object.entries(CONNECTION_TYPE_MAP).map(([label, platform]) => [platform, label])
+)
+
+// Default retry policy sys_ids by platform connection type
+// Mirrors ServiceNow client scripts: "Default RetryPolicy onLoad new form" / "Default RetryPolicy onChange Conn-type"
+const DEFAULT_RETRY_POLICY: Record<string, string> = {
+    http_connection: 'ef751ff07301330025d71afe2ff6a7f9', // Default HTTP Retry Policy
+    jdbc_connection: 'e8ddcb7573331010cbfec9d234f6a7fd', // Default JDBC Retry Policy
+    sys_connection: 'e385484773100010e3a71afe2ff6a709', // Default Basic Connection Retry Policy
+}
+
+/**
+ * Hints when `connectionType` is set on a credential-only alias.
+ *
+ * Based on sys_alias UI policies:
+ * - "Show / hide connection type" — connectionType is only shown when type='connection'
+ */
+function hintConnectionTypeForCredential(
+    connectionTypeShape: Shape,
+    aliasType: string | undefined,
+    diagnostics: Diagnostics
+): void {
+    if (aliasType === 'credential' && connectionTypeShape.isDefined()) {
+        diagnostics.warn(
+            connectionTypeShape,
+            `'connectionType' is ignored when type is 'credential'. It only applies to 'connection' type aliases.`
+        )
+    }
+}
+
+/**
+ * Resolves a developer-facing camelCase connection type to the ServiceNow platform value.
+ * Returns the platform default ('http_connection') if the value is not provided.
+ */
+function resolveConnectionType(connectionTypeShape: Shape): string {
+    const value = connectionTypeShape.ifString()?.getValue()
+    if (!value) {
+        return 'http_connection'
+    }
+    return CONNECTION_TYPE_MAP[value] ?? 'http_connection'
+}
+
+/**
+ * Computes the `id` field value for a sys_alias record.
+ * ServiceNow's virtual field calculation: scope + '.' + name (global scope omits prefix).
+ * Without this, the stored 'id' column is empty and Flow Designer's
+ * idISNOTEMPTY filter hides the alias from dropdowns.
+ */
+function computeAliasId(name: string, scope: string): string {
+    const sanitizedName = name.replace(/[^A-Za-z0-9_]/g, '_')
+    return scope !== 'global' ? `${scope}.${sanitizedName}` : sanitizedName
+}
+
+/**
+ * Validates fields related to child aliases.
+ *
+ * Based on sys_alias UI policy "HideEmptyParentField" — the parent field is hidden
+ * in the UI when type='credential'.
+ */
+function validateChildAliasFields(arg: ObjectShape, diagnostics: Diagnostics): void {
+    const parent = arg.get('parent')
+    const type = arg.get('type')
+
+    // Warn if parent is set for credential-only alias — UI hides the field so it has no effect.
+    if (type?.isString() && type.getValue() === 'credential' && parent?.isDefined()) {
+        diagnostics.warn(
+            parent,
+            `'parent' field is not visible in the UI when type is 'credential'. ` +
+                `Parent aliases are only supported for 'connection' type aliases.`
+        )
+    }
+}
+
+/**
+ * Validates fields related to 'connection' type alias.
+ *
+ * Based on sys_alias UI policies:
+ * - "Show/Hide Multiple connection flag" — multipleConnections is only shown when type='connection'
+ * - "Show / hide Default Retry Policy field" — retryPolicy is only shown when type='connection'
+ */
+function validateConnectionOnlyFields(arg: ObjectShape, aliasType: string | undefined, diagnostics: Diagnostics): void {
+    if (aliasType === 'credential') {
+        const multipleConnections = arg.get('multipleConnections')
+        if (multipleConnections?.isDefined()) {
+            diagnostics.warn(
+                multipleConnections,
+                `'multipleConnections' is ignored when type is 'credential'. It only applies to 'connection' type aliases.`
+            )
+        }
+
+        const retryPolicy = arg.get('retryPolicy')
+        if (retryPolicy?.isDefined()) {
+            diagnostics.warn(
+                retryPolicy,
+                `'retryPolicy' is ignored when type is 'credential'. It only applies to 'connection' type aliases.`
+            )
+        }
+    }
+}
+
+export const AliasPlugin = Plugin.create({
+    name: 'AliasPlugin',
+    records: {
+        [SYS_ALIAS]: {
+            toShape(record) {
+                // Resolve connection_type and alias type to determine default retry policy
+                const aliasType = record.get('type').toString().getValue() || 'connection'
+                const connType = record.get('connection_type').toString().getValue() || 'http_connection'
+                // For credential aliases, retry_policy is hidden in the UI and has no effect —
+                // treat whatever value is present as the default so it gets suppressed in Fluent output.
+                const retryPolicyValue = record.get('retry_policy').toString().getValue()
+                const defaultRetryPolicy =
+                    aliasType === 'connection' ? (DEFAULT_RETRY_POLICY[connType] ?? '') : retryPolicyValue
+                const camelCaseConnType = CONNECTION_TYPE_REVERSE_MAP[connType] ?? 'httpConnection'
+
+                return {
+                    success: true,
+                    value: new CallExpressionShape({
+                        source: record,
+                        callee: 'Alias',
+                        args: [
+                            record.transform(({ $ }) => ({
+                                $id: $.val(NowIdShape.from(record)),
+                                name: $,
+                                type: $.def('connection'),
+                                connectionType: $.from('connection_type').val(camelCaseConnType).def('httpConnection'),
+                                description: $.def(''),
+                                parent: $.def(''),
+                                configurationTemplate: $.from('configuration_template').def(''),
+                                retryPolicy: $.from('retry_policy').def(defaultRetryPolicy),
+                                multipleConnections: $.from('multiple_connections').toBoolean().def(false),
+                                protectionPolicy: $.from('sys_policy').def(''),
+                            })),
+                        ],
+                    }),
+                }
+            },
+        },
+    },
+    shapes: [
+        {
+            shape: CallExpressionShape,
+            fileTypes: ['fluent'],
+            async toRecord(callExpression, { factory, diagnostics, config }) {
+                if (callExpression.getCallee() !== 'Alias') {
+                    return { success: false }
+                }
+
+                const argRaw = callExpression.getArgument(0)
+                if (!argRaw?.isObject()) {
+                    return { success: false }
+                }
+                const arg = argRaw.asObject()
+
+                // Validate required 'name' property.
+                // TypeScript enforces `name: string`, but the empty-string check is semantic and
+                // cannot be expressed in the type system.
+                const name = arg.get('name')
+                const nameValue = name.ifString()?.getValue().trim() ?? ''
+                if (nameValue === '') {
+                    diagnostics.error(name.isDefined() ? name : arg, `'name' is required and cannot be empty.`)
+                    return { success: false }
+                }
+
+                // Resolve type and connectionType
+                const typeShape = arg.get('type')
+                const aliasType = typeShape.ifString()?.getValue() ?? 'connection'
+
+                const connectionTypeShape = arg.get('connectionType')
+                const resolvedConnectionType = resolveConnectionType(connectionTypeShape)
+
+                // Cross-field hints
+                hintConnectionTypeForCredential(connectionTypeShape, aliasType, diagnostics)
+                validateChildAliasFields(arg, diagnostics)
+                validateConnectionOnlyFields(arg, aliasType, diagnostics)
+
+                // Resolve default retry policy (only for connection type)
+                const defaultRetryPolicy =
+                    aliasType === 'connection' ? (DEFAULT_RETRY_POLICY[resolvedConnectionType] ?? '') : ''
+
+                const aliasId = computeAliasId(nameValue, config.scope)
+
+                // Create the sys_alias record
+                const record = await factory.createRecord({
+                    source: callExpression,
+                    table: SYS_ALIAS,
+                    explicitId: arg.get('$id'),
+                    properties: arg.transform(({ $ }) => ({
+                        name: $,
+                        id: $.val(aliasId),
+                        type: $.def('connection'),
+                        connection_type: $.from('connectionType').val(resolvedConnectionType).def('http_connection'),
+                        description: $.def(''),
+                        parent: $,
+                        configuration_template: $.from('configurationTemplate'),
+                        retry_policy: $.from('retryPolicy').def(defaultRetryPolicy),
+                        multiple_connections: $.from('multipleConnections').def(false),
+                        sys_policy: $.from('protectionPolicy'),
+                    })),
+                })
+
+                return { success: true, value: record }
+            },
+        },
+    ],
+})

package/src/alias/alias-template-plugin.ts

@@ -0,0 +1,271 @@
+import { CallExpressionShape, Plugin, type Shape, type StringShape } from '@servicenow/sdk-build-core'
+import { NowIdShape } from '../now-id-plugin'
+import { NowIncludeShape } from '../now-include-plugin'
+import { ModuleFunctionShape } from '../server-module-plugin'
+import { toReference } from '../utils'
+
+const DEFAULT_POST_PROCESS_SCRIPT = `(function execute(aliasId, connectionSysId, jsonDefaultData, jsonDynamicData) {
+   // aliasId: sys_id of the alias record
+   // connectionSysId: sys_id of the connection record created by using the default and dynamic data
+   // jsonDefaultData (String): The default JSON template data from template table
+   // e.g. var jsonDefaultParsed = JSON.parse(jsonDefaultData);
+   //      gs.info("default connection url = " + jsonDefaultParsed["connection"]["connection_url"]);
+   // jsonDynamicData (String): User input based on the key/values defined in "Dynamic Data"
+   // e.g. var jsonDynamicParsed = JSON.parse(jsonDynamicData);
+   //      gs.info("dynamic connection url = " + jsonDynamicParsed["connection.connection_url"]);
+})(aliasId, connectionSysId, jsonDefaultData, jsonDynamicData);
+`
+const DEFAULT_PRE_EDIT_SCRIPT = `(function execute(aliasId, connectionSysId, jsonDefaultData, jsonDynamicData) {
+   // aliasId: sys_id of the alias record.
+   // connectionSysId: sys_id of the connection record created by using the default and dynamic data.
+   // jsonDefaultData (String): The default JSON template data from template table.
+   // e.g. var jsonDefaultParsed = JSON.parse(jsonDefaultData);
+   //      gs.info("default connection url = " + jsonDefaultParsed["connection"]["connection_url"]);
+   // jsonDynamicData (String): Current values of Connection and Credential fields (except Password fields) based on the key-value pairs defined in "Dynamic Data".
+   // e.g. var jsonDynamicParsed = JSON.parse(jsonDynamicData);
+   //      gs.info("dynamic connection url = " + jsonDynamicParsed["connection.connection_url"]);
+
+   //returns array of objects. Each object has name-value pairs for populating additional fields values in connections dashboard in the edit view.
+   //In this example script, additionalField1, additionalField2 are additional fields.
+   //Here we define calcAdditionalField1(), calcAdditionalField2() functions in the script
+   //to calculate current values for additionalField1, additionalField2.
+
+   //return [{
+   //         name: "additionalField1"
+   //         value: calcAdditionalField1(),
+   //    },
+   //    {
+   //         name: "additionalField2"
+   //         value: calcAdditionalField2(),
+   //    }
+   //];
+
+   return [];
+})(aliasId, connectionSysId, jsonDefaultData, jsonDynamicData);
+`
+const DEFAULT_ON_EDIT_SCRIPT = `(function execute(aliasId, connectionSysId, jsonDefaultData, jsonDynamicData) {
+   // aliasId: sys_id of the alias record
+   // connectionSysId: sys_id of the connection record created by using the default and dynamic data
+   // jsonDefaultData (String): The default JSON template data from template table
+   // e.g. var jsonDefaultParsed = JSON.parse(jsonDefaultData);
+   //      gs.info("default connection url = " + jsonDefaultParsed["connection"]["connection_url"]);
+   // jsonDynamicData (String): User input based on the key/values defined in "Dynamic Data"
+   // e.g. var jsonDynamicParsed = JSON.parse(jsonDynamicData);
+   //      gs.info("dynamic connection url = " + jsonDynamicParsed["connection.connection_url"]);
+})(aliasId, connectionSysId, jsonDefaultData, jsonDynamicData);
+`
+
+function camelToSnake(key: string): string {
+    return key.replace(/[A-Z]/g, (letter) => `_${letter.toLowerCase()}`)
+}
+
+function snakeToCamel(key: string): string {
+    return key.replace(/_([a-z])/g, (_, letter) => letter.toUpperCase())
+}
+
+// Only these keys differ between DB (snake_case) and Fluent API (camelCase).
+// All other keys — including arbitrary user-defined values in open [key: string]: unknown
+// sections — are left unchanged to avoid corrupting non-SDK field names.
+const DB_SNAKE_KEYS = new Set([
+    'connection_fields',
+    'credential_fields',
+    'additional_fields',
+    'use_mid',
+    'connection_url',
+    'default_group',
+])
+const FLUENT_CAMEL_KEYS = new Set([
+    'connectionFields',
+    'credentialFields',
+    'additionalFields',
+    'useMid',
+    'connectionUrl',
+    'defaultGroup',
+])
+
+function convertKeys(obj: unknown, converter: (key: string) => string, definedKeys: Set<string>): unknown {
+    if (obj === null || typeof obj !== 'object') {
+        return obj
+    }
+    if (Array.isArray(obj)) {
+        return obj.map((item) => convertKeys(item, converter, definedKeys))
+    }
+    const result: Record<string, unknown> = {}
+    for (const [key, value] of Object.entries(obj as Record<string, unknown>)) {
+        const newKey = definedKeys.has(key) ? converter(key) : key
+        result[newKey] = convertKeys(value, converter, definedKeys)
+    }
+    return result
+}
+
+/**
+ * Parse JSON string from DB and convert snake_case keys to camelCase (DB → Fluent)
+ * Used in toShape for dynamicDataSchema and defaultDataTemplate
+ */
+function parseDbJson(v: StringShape | undefined): unknown {
+    const parsed = v?.ifNotEmpty()?.parseJson()
+    if (!parsed) {
+        return undefined
+    }
+    const db = parsed.getValue()
+    if (db === undefined || db === null) {
+        return undefined
+    }
+    return convertKeys(db, snakeToCamel, DB_SNAKE_KEYS)
+}
+
+/**
+ * Convert camelCase keys to snake_case and stringify to JSON (Fluent → DB)
+ * Used in toRecord for dynamicDataSchema and defaultDataTemplate
+ */
+function serializeFluentJson(v: unknown): string | undefined {
+    if (v === undefined || v === null) {
+        return undefined
+    }
+    return JSON.stringify(convertKeys(v, camelToSnake, FLUENT_CAMEL_KEYS), null, 2)
+}
+
+/**
+ * Helper function to handle ModuleFunctionShape transformation for alias template scripts
+ * Converts module function references to function call strings with proper parameters
+ */
+function mapScriptWithModuleSupport(v: Shape) {
+    return (
+        v
+            .if(ModuleFunctionShape)
+            ?.toString(
+                (n: string) => `${n}({{PARAMS}})`,
+                ['aliasId', 'connectionSysId', 'jsonDefaultData', 'jsonDynamicData']
+            ) ?? v
+    )
+}
+
+export const AliasTemplatePlugin = Plugin.create({
+    name: 'AliasTemplatePlugin',
+    records: {
+        sys_alias_templates: {
+            async toShape(record, { transform }) {
+                // Only call NowIncludeShape.fromRecord for non-empty, non-default script fields.
+                // Scripts that match the default are omitted so round-trips stay clean.
+                const preEditScriptField = record.get('pre_edit_script').ifString()?.ifNotEmpty()
+                const onEditScriptField = record.get('on_edit_script').ifString()?.ifNotEmpty()
+                const postProcessScriptField = record.get('post_process_script').ifString()?.ifNotEmpty()
+
+                const preEditScript =
+                    preEditScriptField && preEditScriptField.getValue().trim() !== DEFAULT_PRE_EDIT_SCRIPT.trim()
+                        ? await NowIncludeShape.fromRecord(record, preEditScriptField, transform)
+                        : undefined
+                const onEditScript =
+                    onEditScriptField && onEditScriptField.getValue().trim() !== DEFAULT_ON_EDIT_SCRIPT.trim()
+                        ? await NowIncludeShape.fromRecord(record, onEditScriptField, transform)
+                        : undefined
+                const postProcessScript =
+                    postProcessScriptField &&
+                    postProcessScriptField.getValue().trim() !== DEFAULT_POST_PROCESS_SCRIPT.trim()
+                        ? await NowIncludeShape.fromRecord(record, postProcessScriptField, transform)
+                        : undefined
+
+                return {
+                    success: true,
+                    value: new CallExpressionShape({
+                        source: record,
+                        callee: 'AliasTemplate',
+                        args: [
+                            record.transform(({ $ }) => ({
+                                $id: $.val(NowIdShape.from(record)),
+                                name: $,
+
+                                // JSON strings stored in DB → typed objects in Fluent code
+                                // Only defined SDK keys are converted from snake_case to camelCase
+                                dynamicDataSchema: $.from('dynamic_data_schema').map((v) => parseDbJson(v.ifString())),
+                                defaultDataTemplate: $.from('default_data_template').map((v) =>
+                                    parseDbJson(v.ifString())
+                                ),
+
+                                // Script fields via NowIncludeShape for IDE file support
+                                preEditScript: $.val(preEditScript),
+                                onEditScript: $.val(onEditScript),
+                                postProcessScript: $.val(postProcessScript),
+
+                                // Reference field — omit when empty
+                                testAction: $.from('test_action').def(''),
+                            })),
+                        ],
+                    }),
+                }
+            },
+        },
+    },
+    shapes: [
+        {
+            shape: CallExpressionShape,
+            fileTypes: ['fluent'],
+            async toRecord(callExpression, { factory, config, diagnostics }) {
+                if (callExpression.getCallee() !== 'AliasTemplate') {
+                    return { success: false }
+                }
+
+                const arg = callExpression.getArgument(0).asObject()
+
+                // Check for unresolved script references
+                if (arg.get('preEditScript').isUnresolved()) {
+                    diagnostics.error(
+                        arg.get('preEditScript').getOriginalNode(),
+                        `Unable to resolve the preEditScript reference, ensure the imported module is within the ${config.serverModulesDir} directory.`
+                    )
+                }
+                if (arg.get('onEditScript').isUnresolved()) {
+                    diagnostics.error(
+                        arg.get('onEditScript').getOriginalNode(),
+                        `Unable to resolve the onEditScript reference, ensure the imported module is within the ${config.serverModulesDir} directory.`
+                    )
+                }
+                if (arg.get('postProcessScript').isUnresolved()) {
+                    diagnostics.error(
+                        arg.get('postProcessScript').getOriginalNode(),
+                        `Unable to resolve the postProcessScript reference, ensure the imported module is within the ${config.serverModulesDir} directory.`
+                    )
+                }
+
+                return {
+                    success: true,
+                    value: await factory.createRecord({
+                        source: callExpression,
+                        table: 'sys_alias_templates',
+                        explicitId: arg.get('$id'),
+                        properties: arg.transform(({ $ }) => ({
+                            name: $,
+
+                            // Typed objects in Fluent code → JSON strings for DB
+                            // Only defined SDK keys are converted from camelCase to snake_case
+                            dynamic_data_schema: $.from('dynamicDataSchema').map((v) =>
+                                serializeFluentJson(v.ifDefined() ? v.getValue() : undefined)
+                            ),
+                            default_data_template: $.from('defaultDataTemplate').map((v) =>
+                                serializeFluentJson(v.ifDefined() ? v.getValue() : undefined)
+                            ),
+
+                            // Script fields — CDATA wraps both inline strings and Now.include() content
+                            // Support for app_modules via ModuleFunctionShape
+                            pre_edit_script: $.from('preEditScript')
+                                .map(mapScriptWithModuleSupport)
+                                .toCdata()
+                                .def(DEFAULT_PRE_EDIT_SCRIPT),
+                            on_edit_script: $.from('onEditScript')
+                                .map(mapScriptWithModuleSupport)
+                                .toCdata()
+                                .def(DEFAULT_ON_EDIT_SCRIPT),
+                            post_process_script: $.from('postProcessScript')
+                                .map(mapScriptWithModuleSupport)
+                                .toCdata()
+                                .def(DEFAULT_POST_PROCESS_SCRIPT),
+
+                            // Reference field — extract sys_id from Record ref or plain string
+                            test_action: $.from('testAction').map((v) => toReference(v)),
+                        })),
+                    }),
+                }
+            },
+        },
+    ],
+})

package/src/alias/index.ts

@@ -0,0 +1,3 @@
+export * from './alias-plugin'
+export * from './retry-policy-plugin'
+export * from './alias-template-plugin'

package/src/alias/retry-policy-plugin.ts

@@ -0,0 +1,138 @@
+import { CallExpressionShape, Plugin } from '@servicenow/sdk-build-core'
+import { NowIdShape } from '../now-id-plugin'
+
+const SYS_RETRY_POLICY = 'sys_retry_policy'
+
+const DEFAULT_CONNECTION_TYPE = 'http_retry_conditions'
+const DEFAULT_RETRY_STRATEGY = 'fixed_time_interval'
+const MAX_ELAPSED_TIME_SECONDS = 86400
+const DEFAULT_RESTRICT_TO = 'http_method,status_code,error,response_body,response_headers'
+
+export const RetryPolicyPlugin = Plugin.create({
+    name: 'RetryPolicyPlugin',
+
+    records: {
+        [SYS_RETRY_POLICY]: {
+            async toShape(record) {
+                const restrictToRaw = record.get('restrict_to')?.ifString()?.getValue()
+                const restrictToArray =
+                    restrictToRaw === undefined || restrictToRaw === DEFAULT_RESTRICT_TO
+                        ? undefined
+                        : restrictToRaw === ''
+                          ? []
+                          : restrictToRaw
+                                .split(',')
+                                .map((s) => s.trim())
+                                .filter(Boolean)
+
+                return {
+                    success: true,
+                    value: new CallExpressionShape({
+                        source: record,
+                        callee: 'RetryPolicy',
+                        args: [
+                            record.transform(({ $ }) => ({
+                                $id: $.val(NowIdShape.from(record)),
+                                name: $.def(''),
+                                connectionType: $.from('connection_type').def(DEFAULT_CONNECTION_TYPE),
+                                retryStrategy: $.from('retry_strategy').def(DEFAULT_RETRY_STRATEGY),
+                                count: $.map((v) => v.ifString()?.ifNotEmpty()?.toNumber()),
+                                interval: $.map((v) => v.ifString()?.ifNotEmpty()?.toNumber()),
+                                maxElapsedTime: $.from('max_elapsed_time').map((v) =>
+                                    v.ifString()?.ifNotEmpty()?.toNumber()
+                                ),
+                                condition: $.def(''),
+                                restrictTo: $.val(restrictToArray),
+                                protectionPolicy: $.from('sys_policy').def(''),
+                            })),
+                        ],
+                    }),
+                }
+            },
+        },
+    },
+
+    shapes: [
+        {
+            shape: CallExpressionShape,
+            fileTypes: ['fluent'],
+            async toRecord(callExpression, { factory, diagnostics }) {
+                if (callExpression.getCallee() !== 'RetryPolicy') {
+                    return { success: false }
+                }
+
+                const arg = callExpression.getArgument(0).asObject()
+
+                // Runtime validation for maxElapsedTime upper bound (TypeScript cannot enforce numeric ranges)
+                const maxElapsedTimeShape = arg.get('maxElapsedTime')
+                const maxElapsedTime = maxElapsedTimeShape.ifNumber()?.getValue()
+                if (maxElapsedTime !== undefined && maxElapsedTime > MAX_ELAPSED_TIME_SECONDS) {
+                    diagnostics.error(
+                        maxElapsedTimeShape,
+                        `maxElapsedTime must not exceed ${MAX_ELAPSED_TIME_SECONDS} seconds (24 hours). Received: ${maxElapsedTime}.`
+                    )
+                }
+
+                const countShape = arg.get('count')
+                const count = countShape.ifNumber()?.getValue()
+                if (count !== undefined && !Number.isInteger(count)) {
+                    diagnostics.error(countShape, `count must be an integer. Received: ${count}.`)
+                }
+
+                const intervalShape = arg.get('interval')
+                const interval = intervalShape.ifNumber()?.getValue()
+                if (interval !== undefined && !Number.isInteger(interval)) {
+                    diagnostics.error(intervalShape, `interval must be an integer. Received: ${interval}.`)
+                }
+
+                // Convert restrictTo string[] → comma-separated string for the DB
+                const restrictToShape = arg.get('restrictTo')
+                const restrictToArrayShape = restrictToShape.ifArray()
+                const restrictToCsv = restrictToArrayShape
+                    ? restrictToArrayShape
+                          .getElements()
+                          .map((el) => el.ifString()?.getValue() ?? '')
+                          .filter(Boolean)
+                          .join(',')
+                    : DEFAULT_RESTRICT_TO
+
+                // Validate condition only references fields in restrictTo
+                const allowedFields = (restrictToCsv || DEFAULT_RESTRICT_TO).split(',')
+                const conditionShape = arg.get('condition')
+                const conditionValue = conditionShape.ifString()?.ifNotEmpty()?.getValue()
+                if (conditionValue) {
+                    for (const part of conditionValue.split('^')) {
+                        const fieldPart = part.startsWith('OR') ? part.slice(2) : part
+                        if (!allowedFields.some((field) => fieldPart.startsWith(field))) {
+                            const fieldName = fieldPart.match(/^[a-z_]+/)?.[0] ?? fieldPart
+                            diagnostics.error(
+                                conditionShape,
+                                `Condition references field '${fieldName}' which is not in restrictTo. Allowed fields: ${allowedFields.join(', ')}.`
+                            )
+                            break
+                        }
+                    }
+                }
+
+                const record = await factory.createRecord({
+                    source: callExpression,
+                    table: SYS_RETRY_POLICY,
+                    explicitId: arg.get('$id'),
+                    properties: arg.transform(({ $ }) => ({
+                        name: $.def(''),
+                        connection_type: $.from('connectionType').def(DEFAULT_CONNECTION_TYPE),
+                        retry_strategy: $.from('retryStrategy').def(DEFAULT_RETRY_STRATEGY),
+                        count: $,
+                        interval: $,
+                        max_elapsed_time: $.from('maxElapsedTime'),
+                        condition: $.def(''),
+                        restrict_to: $.val(restrictToCsv),
+                        sys_policy: $.from('protectionPolicy').def(''),
+                    })),
+                })
+
+                return { success: true, value: record }
+            },
+        },
+    ],
+})