@zapier/policy-context 0.3.0 → 0.5.3

package/dist/index.cjs

@@ -23,9 +23,11 @@ __export(index_exports, {
   ActionRunContextSchema: () => ActionRunContextSchema,
   BuildActionRunContextOptionsSchema: () => BuildActionRunContextOptionsSchema,
   BuildHttpRequestContextOptionsSchema: () => BuildHttpRequestContextOptionsSchema,
+  DEFAULT_PORTS: () => DEFAULT_PORTS,
   HttpRequestContextSchema: () => HttpRequestContextSchema,
   IGNORED_HEADERS: () => IGNORED_HEADERS,
   JsonValueSchema: () => JsonValueSchema,
+  ParsedUrlSchema: () => ParsedUrlSchema,
   RequestContextSchema: () => RequestContextSchema,
   buildActionResource: () => buildActionResource,
   buildActionRunContext: () => buildActionRunContext,
@@ -34,6 +36,8 @@ __export(index_exports, {
   buildExactActionConditions: () => buildExactActionConditions,
   buildExactHttpConditions: () => buildExactHttpConditions,
   buildHttpRequestContext: () => buildHttpRequestContext,
+  buildUrlString: () => buildUrlString,
+  parseUrl: () => parseUrl,
   toExactPolicy: () => toExactPolicy
 });
 module.exports = __toCommonJS(index_exports);
@@ -41,17 +45,56 @@ module.exports = __toCommonJS(index_exports);
 // src/types.ts
 var import_zod = require("zod");
 var JsonValueSchema = import_zod.z.custom();
+var ParsedUrlSchema = import_zod.z.object({
+  scheme: import_zod.z.string(),
+  host: import_zod.z.string(),
+  port: import_zod.z.number(),
+  path: import_zod.z.string(),
+  query: import_zod.z.record(import_zod.z.string(), import_zod.z.array(import_zod.z.string()))
+});
+var DEFAULT_PORTS = {
+  http: 80,
+  https: 443
+};
+function parseUrl(raw) {
+  const url = new URL(raw);
+  const scheme = url.protocol.slice(0, -1).toLowerCase();
+  const host = url.hostname.toLowerCase();
+  const port = url.port ? parseInt(url.port, 10) : DEFAULT_PORTS[scheme] ?? 0;
+  const path = url.pathname || "/";
+  const query = {};
+  for (const [key, value] of url.searchParams) {
+    if (!query[key]) {
+      query[key] = [];
+    }
+    query[key].push(value);
+  }
+  return { scheme, host, port, path, query };
+}
+function buildUrlString(parsed) {
+  const { scheme, host, port, path, query } = parsed;
+  const defaultPort = DEFAULT_PORTS[scheme];
+  const portString = port !== defaultPort ? `:${String(port)}` : "";
+  const params = new URLSearchParams();
+  for (const [key, values] of Object.entries(query)) {
+    for (const value of values) {
+      params.append(key, value);
+    }
+  }
+  const queryString = params.toString();
+  return `${scheme}://${host}${portString}${path}${queryString ? "?" + queryString : ""}`;
+}
 var HttpRequestContextSchema = import_zod.z.object({
   request_type: import_zod.z.literal("http_request"),
   method: import_zod.z.string(),
-  /** Full URL including query string, e.g. "https://api.example.com/v1/foo?bar=baz" */
-  url: import_zod.z.string(),
+  /** Parsed URL components for policy condition matching */
+  url: ParsedUrlSchema,
   /** Filtered headers (IGNORED_HEADERS excluded, keys lowercased) */
-  headers: import_zod.z.record(import_zod.z.string(), import_zod.z.string()).optional(),
+  headers: import_zod.z.record(import_zod.z.string(), import_zod.z.string()),
   /** Raw body string */
-  body: import_zod.z.string().optional(),
+  body: import_zod.z.string().nullable(),
   /** Parsed JSON body */
-  body_json: JsonValueSchema.optional(),
+  body_json: JsonValueSchema.nullable(),
   /** Zapier connection ID used for this request */
   connection_id: import_zod.z.string().optional(),
   /** Optional human-readable reason for the request */
@@ -120,7 +163,8 @@ var BuildHttpRequestContextOptionsSchema = import_zod2.z.object({
   connection_id: import_zod2.z.string().optional()
 });
 function buildHttpRequestContext(options) {
-  const url = options.url.includes("://") ? options.url : `https://${options.url}`;
+  const rawUrl = options.url.includes("://") ? options.url : `https://${options.url}`;
+  const url = parseUrl(rawUrl);
   const headers = {};
   if (options.headers) {
     for (const [key, value] of Object.entries(options.headers)) {
@@ -130,13 +174,26 @@ function buildHttpRequestContext(options) {
       }
     }
   }
+  let body_json = null;
+  if (options.body_json !== void 0) {
+    body_json = options.body_json;
+  } else if (options.body) {
+    const contentType = headers["content-type"];
+    const isJson = typeof contentType === "string" && (contentType.includes("application/json") || contentType.includes("application/") && contentType.includes("+json"));
+    if (isJson) {
+      try {
+        body_json = JSON.parse(options.body);
+      } catch {
+      }
+    }
+  }
   return HttpRequestContextSchema.parse({
     request_type: "http_request",
     method: options.method,
     url,
     headers,
-    body: typeof options.body === "string" ? options.body : void 0,
-    body_json: typeof options.body_json === "object" && options.body_json !== null ? options.body_json : void 0,
+    body: options.body ?? null,
+    body_json,
     connection_id: options.connection_id
   });
 }
@@ -163,70 +220,46 @@ function buildExactHttpConditions(context) {
   const conditions = [
     { path: ["method"], operator: "equals", value: context.method }
   ];
-  let parsedUrl;
-  try {
-    parsedUrl = new URL(context.url);
-  } catch {
-    console.debug(
-      "buildExactHttpConditions: unparseable URL, using raw value",
-      { url: context.url }
-    );
-    conditions.push({
-      path: ["url"],
-      operator: "matches_url",
-      value: context.url
-    });
-    return conditions;
-  }
-  const urlWithoutQuery = `${parsedUrl.protocol}//${parsedUrl.host}${parsedUrl.pathname}`;
+  const { url } = context;
+  const defaultPort = url.scheme === "https" ? 443 : url.scheme === "http" ? 80 : 0;
+  const portString = url.port !== defaultPort ? `:${String(url.port)}` : "";
+  const urlWithoutQuery = `${url.scheme}://${url.host}${portString}${url.path}`;
   conditions.push({
     path: ["url"],
     operator: "matches_url",
     value: urlWithoutQuery
   });
-  const seenKeys = /* @__PURE__ */ new Set();
-  for (const key of parsedUrl.searchParams.keys()) {
-    if (seenKeys.has(key)) continue;
-    seenKeys.add(key);
-    const values = parsedUrl.searchParams.getAll(key);
+  for (const [key, values] of Object.entries(url.query)) {
     conditions.push({
       path: ["url", "query", key],
       operator: "equals",
       value: values
     });
   }
-  if (context.body_json !== void 0 && context.body_json !== null) {
+  if (context.body_json !== null) {
     conditions.push({
       path: ["body_json"],
       operator: "equals",
       value: context.body_json
     });
   }
-  if (context.headers) {
-    for (const [key, value] of Object.entries(context.headers)) {
-      if (!IGNORED_HEADERS.has(key.toLowerCase()) && typeof value === "string") {
-        conditions.push({
-          path: ["headers", key.toLowerCase()],
-          operator: "equals",
-          value
-        });
-      }
+  for (const [key, value] of Object.entries(context.headers)) {
+    if (!IGNORED_HEADERS.has(key.toLowerCase()) && typeof value === "string") {
+      conditions.push({
+        path: ["headers", key.toLowerCase()],
+        operator: "equals",
+        value
+      });
     }
   }
   return conditions;
 }
 function buildDomainHttpConditions(context) {
-  let host;
-  try {
-    host = new URL(context.url).host;
-  } catch {
-    return null;
-  }
   return [
     {
       path: ["url", "host"],
       operator: "matches_host",
-      value: host
+      value: context.url.host
     }
   ];
 }
@@ -263,21 +296,11 @@ function httpContextToPolicy(context) {
     statements.push(buildAuthStatement(context.connection_id));
   }
   const conditions = buildExactHttpConditions(context);
-  try {
-    const queryKeys = [...new URL(context.url).searchParams.keys()];
-    const uniqueKeys = [...new Set(queryKeys)];
-    conditions.push({
-      path: ["url", "query"],
-      operator: "keys_in",
-      value: uniqueKeys
-    });
-  } catch {
-    conditions.push({
-      path: ["url", "query"],
-      operator: "keys_in",
-      value: []
-    });
-  }
+  conditions.push({
+    path: ["url", "query"],
+    operator: "keys_in",
+    value: Object.keys(context.url.query)
+  });
   statements.push({
     effect: "allow",
     permissions: ["can_execute"],
@@ -310,9 +333,11 @@ function toExactPolicy(context) {
   ActionRunContextSchema,
   BuildActionRunContextOptionsSchema,
   BuildHttpRequestContextOptionsSchema,
+  DEFAULT_PORTS,
   HttpRequestContextSchema,
   IGNORED_HEADERS,
   JsonValueSchema,
+  ParsedUrlSchema,
   RequestContextSchema,
   buildActionResource,
   buildActionRunContext,
@@ -321,6 +346,8 @@ function toExactPolicy(context) {
   buildExactActionConditions,
   buildExactHttpConditions,
   buildHttpRequestContext,
+  buildUrlString,
+  parseUrl,
   toExactPolicy
 });
 //# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/types.ts","../src/constants.ts","../src/builders.ts","../src/conditions.ts","../src/policies.ts"],"sourcesContent":["// ABOUTME: Public API for @zapier/policy-context.\n// ABOUTME: Shared context types, builders, and condition generators for sdkapi + approvalsapi.\n\nexport {\n  HttpRequestContextSchema,\n  ActionRunContextSchema,\n  RequestContextSchema,\n  JsonValueSchema,\n  type HttpRequestContext,\n  type ActionRunContext,\n  type RequestContext,\n} from \"./types.ts\";\n\nexport { IGNORED_HEADERS } from \"./constants.ts\";\n\nexport {\n  buildHttpRequestContext,\n  buildActionRunContext,\n  BuildHttpRequestContextOptionsSchema,\n  BuildActionRunContextOptionsSchema,\n  type BuildHttpRequestContextOptions,\n  type BuildActionRunContextOptions,\n} from \"./builders.ts\";\n\nexport {\n  buildExactHttpConditions,\n  buildDomainHttpConditions,\n  buildExactActionConditions,\n  buildActionResource,\n  buildBroadActionResource,\n} from \"./conditions.ts\";\n\nexport { toExactPolicy } from \"./policies.ts\";\n","// ABOUTME: Canonical request context types shared between sdkapi and approvalsapi.\n// ABOUTME: These define the contract for how requests are described in approval flows and policy evaluation.\n\nimport { z } from \"zod\";\nimport type { JsonValue } from \"@zapier/policy-schema\";\n\n/**\n * Zod schema for arbitrary JSON values. Used across context schemas for\n * unstructured fields like `body_json` and `inputs`.\n */\nexport const JsonValueSchema = z.custom<JsonValue>();\n\n/**\n * HTTP request context for approval/policy flows.\n * Sent by sdkapi when a relay request is denied, stored by approvalsapi,\n * and used to build policy conditions.\n */\nexport const HttpRequestContextSchema = z.object({\n  request_type: z.literal(\"http_request\"),\n  method: z.string(),\n  /** Full URL including query string, e.g. \"https://api.example.com/v1/foo?bar=baz\" */\n  url: z.string(),\n  /** Filtered headers (IGNORED_HEADERS excluded, keys lowercased) */\n  headers: z.record(z.string(), z.string()).optional(),\n  /** Raw body string */\n  body: z.string().optional(),\n  /** Parsed JSON body */\n  body_json: JsonValueSchema.optional(),\n  /** Zapier connection ID used for this request */\n  connection_id: z.string().optional(),\n  /** Optional human-readable reason for the request */\n  reason: z.string().optional(),\n});\nexport type HttpRequestContext = z.infer<typeof HttpRequestContextSchema>;\n\n/**\n * Action run context for approval/policy flows.\n * Sent by sdkapi when an action run is denied, stored by approvalsapi,\n * and used to build policy conditions.\n */\nexport const ActionRunContextSchema = z.object({\n  request_type: z.literal(\"action_run\"),\n  selected_api: z.string(),\n  action_type: z.string(),\n  action_key: z.string(),\n  connection_id: z.string().optional(),\n  inputs: JsonValueSchema.optional(),\n  reason: z.string().optional(),\n});\nexport type ActionRunContext = z.infer<typeof ActionRunContextSchema>;\n\n/**\n * Discriminated union of all request context types.\n */\nexport const RequestContextSchema = z.discriminatedUnion(\"request_type\", [\n  HttpRequestContextSchema,\n  ActionRunContextSchema,\n]);\nexport type RequestContext = z.infer<typeof RequestContextSchema>;\n","// ABOUTME: Canonical set of headers to exclude when building request contexts.\n// ABOUTME: Shared between sdkapi (context creation) and approvalsapi (condition building).\n\n/**\n * Headers to exclude when building request contexts from raw HTTP requests.\n *\n * These are either sensitive (auth credentials), HTTP infrastructure headers\n * that vary per-request, or proxy-internal headers that are not meaningful\n * for policy decisions.\n */\nexport const IGNORED_HEADERS = new Set([\n  // Auth / credentials — never include in contexts or policy conditions\n  \"authorization\",\n  \"x-relay-authorization\",\n  \"x-relay-authentication-id\",\n  \"x-api-key\",\n  \"cookie\",\n  \"set-cookie\",\n  \"proxy-authorization\",\n\n  // HTTP infrastructure — varies per-request, not policy-relevant\n  \"host\",\n  \"connection\",\n  \"content-length\",\n  \"transfer-encoding\",\n  \"accept-encoding\",\n  \"user-agent\",\n  \"accept\",\n  \"accept-language\",\n  \"sec-fetch-mode\",\n\n  // Proxy / forwarding — infrastructure, not meaningful for policy\n  \"x-forwarded-for\",\n  \"x-forwarded-host\",\n  \"x-forwarded-proto\",\n  \"x-real-ip\",\n\n  // Proxy internal — sdkapi-specific headers\n  \"x-is-interactive-session\",\n  \"x-relay-callback-url\",\n]);\n","// ABOUTME: Canonical builders for creating request contexts from raw request parts.\n// ABOUTME: Used by sdkapi to build both approval contexts and policy eval contexts.\n\nimport { z } from \"zod\";\nimport {\n  HttpRequestContextSchema,\n  ActionRunContextSchema,\n  JsonValueSchema,\n  type HttpRequestContext,\n  type ActionRunContext,\n} from \"./types.ts\";\nimport { IGNORED_HEADERS } from \"./constants.ts\";\n\nexport const BuildHttpRequestContextOptionsSchema = z.object({\n  method: z.string(),\n  /** Raw URL string. Will be normalized with https:// if no protocol present. */\n  url: z.string(),\n  /** Raw headers from the request. Will be filtered through IGNORED_HEADERS. */\n  headers: z\n    .record(\n      z.string(),\n      z.union([z.string(), z.array(z.string()), z.undefined()]),\n    )\n    .optional(),\n  /** Raw body string */\n  body: z.string().nullable().optional(),\n  /** Pre-parsed JSON body (e.g. from Fastify's automatic JSON parsing) */\n  body_json: JsonValueSchema.optional(),\n  /** Connection ID associated with this request */\n  connection_id: z.string().optional(),\n});\nexport type BuildHttpRequestContextOptions = z.infer<\n  typeof BuildHttpRequestContextOptionsSchema\n>;\n\n/**\n * Build a canonical HttpRequestContext from raw request parts.\n *\n * This is the single source of truth for how HTTP request contexts are created.\n * Both sdkapi (for approval creation) and approvalsapi (for context storage)\n * should use this to ensure the context shape is consistent.\n *\n * - Normalizes URL (adds https:// if missing)\n * - Filters headers through IGNORED_HEADERS\n * - Only includes string-valued headers (drops string[] values like set-cookie)\n */\nexport function buildHttpRequestContext(\n  options: BuildHttpRequestContextOptions,\n): HttpRequestContext {\n  // Normalize URL — SDK CLI strips the protocol\n  const url = options.url.includes(\"://\")\n    ? options.url\n    : `https://${options.url}`;\n\n  // Filter headers: exclude ignored, lowercase keys, string values only\n  const headers: Record<string, string> = {};\n  if (options.headers) {\n    for (const [key, value] of Object.entries(options.headers)) {\n      const lowerKey = key.toLowerCase();\n      if (!IGNORED_HEADERS.has(lowerKey) && typeof value === \"string\") {\n        headers[lowerKey] = value;\n      }\n    }\n  }\n\n  return HttpRequestContextSchema.parse({\n    request_type: \"http_request\",\n    method: options.method,\n    url,\n    headers,\n    body: typeof options.body === \"string\" ? options.body : undefined,\n    body_json:\n      typeof options.body_json === \"object\" && options.body_json !== null\n        ? options.body_json\n        : undefined,\n    connection_id: options.connection_id,\n  });\n}\n\nexport const BuildActionRunContextOptionsSchema = z.object({\n  selected_api: z.string(),\n  action_type: z.string(),\n  action_key: z.string(),\n  connection_id: z.string().optional(),\n  inputs: JsonValueSchema.optional(),\n});\nexport type BuildActionRunContextOptions = z.infer<\n  typeof BuildActionRunContextOptionsSchema\n>;\n\n/**\n * Build a canonical ActionRunContext from raw action parts.\n */\nexport function buildActionRunContext(\n  options: BuildActionRunContextOptions,\n): ActionRunContext {\n  return ActionRunContextSchema.parse({\n    request_type: \"action_run\",\n    selected_api: options.selected_api,\n    action_type: options.action_type,\n    action_key: options.action_key,\n    connection_id: options.connection_id,\n    inputs: options.inputs,\n  });\n}\n","// ABOUTME: Builds policy conditions from stored request contexts.\n// ABOUTME: Used by approvalsapi's \"allow exact request\" and \"allow domain\" instant policy flows.\n\nimport type { Condition } from \"@zapier/policy-schema\";\nimport type { HttpRequestContext, ActionRunContext } from \"./types.ts\";\nimport { IGNORED_HEADERS } from \"./constants.ts\";\n\n/**\n * Build conditions that match an exact HTTP request.\n *\n * Handles the matches_url / query param split correctly:\n * - `matches_url` only supports scheme+host+port+path (no query string per spec)\n * - Query parameters are added as separate decomposed conditions on `url.query.<key>`\n *\n * @returns Condition[] for a relay/http permission statement\n */\nexport function buildExactHttpConditions(\n  context: HttpRequestContext,\n): Condition[] {\n  const conditions: Condition[] = [\n    { path: [\"method\"], operator: \"equals\", value: context.method },\n  ];\n\n  // Parse the URL to separate path from query params\n  let parsedUrl: URL;\n  try {\n    parsedUrl = new URL(context.url);\n  } catch {\n    // URL is unparseable — use it as-is (will fail matches_url, but that's correct)\n    console.debug(\n      \"buildExactHttpConditions: unparseable URL, using raw value\",\n      { url: context.url },\n    );\n    conditions.push({\n      path: [\"url\"],\n      operator: \"matches_url\",\n      value: context.url,\n    });\n    return conditions;\n  }\n\n  // matches_url condition uses URL without query string (per @zapier/policy spec)\n  const urlWithoutQuery = `${parsedUrl.protocol}//${parsedUrl.host}${parsedUrl.pathname}`;\n  conditions.push({\n    path: [\"url\"],\n    operator: \"matches_url\",\n    value: urlWithoutQuery,\n  });\n\n  // Add decomposed conditions for each query parameter.\n  // Use getAll to properly handle multi-value params (e.g. ?tag=a&tag=b → [\"a\", \"b\"]).\n  const seenKeys = new Set<string>();\n  for (const key of parsedUrl.searchParams.keys()) {\n    if (seenKeys.has(key)) continue;\n    seenKeys.add(key);\n    const values = parsedUrl.searchParams.getAll(key);\n    conditions.push({\n      path: [\"url\", \"query\", key],\n      operator: \"equals\",\n      value: values,\n    });\n  }\n\n  // body_json condition\n  if (context.body_json !== undefined && context.body_json !== null) {\n    conditions.push({\n      path: [\"body_json\"],\n      operator: \"equals\",\n      value: context.body_json,\n    });\n  }\n\n  // Header conditions (filtered through IGNORED_HEADERS again for safety)\n  if (context.headers) {\n    for (const [key, value] of Object.entries(context.headers)) {\n      if (\n        !IGNORED_HEADERS.has(key.toLowerCase()) &&\n        typeof value === \"string\"\n      ) {\n        conditions.push({\n          path: [\"headers\", key.toLowerCase()],\n          operator: \"equals\",\n          value,\n        });\n      }\n    }\n  }\n\n  return conditions;\n}\n\n/**\n * Build conditions that match any request to a given domain.\n * Extracts the host from the context URL.\n *\n * @returns Condition[] for a relay/http permission statement, or null if URL is unparseable\n */\nexport function buildDomainHttpConditions(\n  context: HttpRequestContext,\n): Condition[] | null {\n  let host: string;\n  try {\n    host = new URL(context.url).host;\n  } catch {\n    return null;\n  }\n\n  return [\n    {\n      path: [\"url\", \"host\"],\n      operator: \"matches_host\",\n      value: host,\n    },\n  ];\n}\n\n/**\n * Build conditions that match an exact action run (with inputs).\n *\n * @returns Condition[] for an action permission statement\n */\nexport function buildExactActionConditions(\n  context: ActionRunContext,\n): Condition[] {\n  const conditions: Condition[] = [];\n\n  if (\n    context.inputs !== undefined &&\n    context.inputs !== null &&\n    typeof context.inputs === \"object\"\n  ) {\n    conditions.push({\n      path: [\"params\"],\n      operator: \"equals\",\n      value: context.inputs,\n    });\n  }\n\n  return conditions;\n}\n\n/**\n * Build the resource string for an action.\n * Format: action/{selected_api}/{action_type}/{action_key}\n */\nexport function buildActionResource(context: ActionRunContext): string {\n  return `action/${context.selected_api}/${context.action_type}/${context.action_key}`;\n}\n\n/**\n * Build a broad action resource that matches all actions for an app.\n * Format: action/{selected_api}/{wildcard}/{wildcard}\n */\nexport function buildBroadActionResource(context: ActionRunContext): string {\n  return `action/${context.selected_api}/*/*`;\n}\n","// ABOUTME: Assembles complete Policy objects from request contexts.\n// ABOUTME: Single source of truth for \"exact request\" instant policies used by web UI and API.\n\nimport type { Policy, Statement } from \"@zapier/policy-schema\";\nimport type {\n  RequestContext,\n  HttpRequestContext,\n  ActionRunContext,\n} from \"./types.ts\";\nimport {\n  buildExactHttpConditions,\n  buildExactActionConditions,\n  buildActionResource,\n} from \"./conditions.ts\";\n\n/**\n * Build a `can_use` authentication statement, if the context has a connection_id.\n */\nfunction buildAuthStatement(authenticationId: string): Statement {\n  return {\n    effect: \"allow\",\n    permissions: [\"can_use\"],\n    resources: [`authentication/${authenticationId}`],\n    conditions: [],\n  };\n}\n\n/**\n * Build an exact-match policy from an HTTP request context.\n *\n * Produces a policy that allows only the specific request described by the context:\n * - `can_use` statement for the authentication (if present)\n * - `can_execute` statement for `relay/http` with conditions from `buildExactHttpConditions`\n *   plus a `keys_in` guard restricting allowed query parameter keys\n */\nfunction httpContextToPolicy(context: HttpRequestContext): Policy {\n  const statements: Statement[] = [];\n\n  if (context.connection_id) {\n    statements.push(buildAuthStatement(context.connection_id));\n  }\n\n  const conditions = buildExactHttpConditions(context);\n\n  // Add a keys_in guard so only the query param keys present in the original\n  // request are allowed — blocks injection of extra query params.\n  try {\n    const queryKeys = [...new URL(context.url).searchParams.keys()];\n    const uniqueKeys = [...new Set(queryKeys)];\n    conditions.push({\n      path: [\"url\", \"query\"],\n      operator: \"keys_in\",\n      value: uniqueKeys,\n    });\n  } catch {\n    // If URL parsing fails, block all query params\n    conditions.push({\n      path: [\"url\", \"query\"],\n      operator: \"keys_in\",\n      value: [],\n    });\n  }\n\n  statements.push({\n    effect: \"allow\",\n    permissions: [\"can_execute\"],\n    resources: [\"relay/http\"],\n    conditions,\n  });\n\n  return { version: 2, statements };\n}\n\n/**\n * Build an exact-match policy from an action run context.\n *\n * Produces a policy that allows only the specific action described by the context:\n * - `can_use` statement for the authentication (if present)\n * - `can_execute` statement for the action resource with input conditions\n */\nfunction actionContextToPolicy(context: ActionRunContext): Policy {\n  const statements: Statement[] = [];\n\n  if (context.connection_id) {\n    statements.push(buildAuthStatement(context.connection_id));\n  }\n\n  statements.push({\n    effect: \"allow\",\n    permissions: [\"can_execute\"],\n    resources: [buildActionResource(context)],\n    conditions: buildExactActionConditions(context),\n  });\n\n  return { version: 2, statements };\n}\n\n/**\n * Build an exact-match policy from any supported request context.\n *\n * This is the single source of truth for \"allow this exact request\" instant policies.\n * Used by the web UI and anywhere else that needs to produce an exact policy from a context.\n */\nexport function toExactPolicy(context: RequestContext): Policy {\n  if (context.request_type === \"http_request\") {\n    return httpContextToPolicy(context);\n  }\n  return actionContextToPolicy(context);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACGA,iBAAkB;AAOX,IAAM,kBAAkB,aAAE,OAAkB;AAO5C,IAAM,2BAA2B,aAAE,OAAO;AAAA,EAC/C,cAAc,aAAE,QAAQ,cAAc;AAAA,EACtC,QAAQ,aAAE,OAAO;AAAA;AAAA,EAEjB,KAAK,aAAE,OAAO;AAAA;AAAA,EAEd,SAAS,aAAE,OAAO,aAAE,OAAO,GAAG,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,EAEnD,MAAM,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE1B,WAAW,gBAAgB,SAAS;AAAA;AAAA,EAEpC,eAAe,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEnC,QAAQ,aAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAQM,IAAM,yBAAyB,aAAE,OAAO;AAAA,EAC7C,cAAc,aAAE,QAAQ,YAAY;AAAA,EACpC,cAAc,aAAE,OAAO;AAAA,EACvB,aAAa,aAAE,OAAO;AAAA,EACtB,YAAY,aAAE,OAAO;AAAA,EACrB,eAAe,aAAE,OAAO,EAAE,SAAS;AAAA,EACnC,QAAQ,gBAAgB,SAAS;AAAA,EACjC,QAAQ,aAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAMM,IAAM,uBAAuB,aAAE,mBAAmB,gBAAgB;AAAA,EACvE;AAAA,EACA;AACF,CAAC;;;AC/CM,IAAM,kBAAkB,oBAAI,IAAI;AAAA;AAAA,EAErC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AACF,CAAC;;;ACrCD,IAAAA,cAAkB;AAUX,IAAM,uCAAuC,cAAE,OAAO;AAAA,EAC3D,QAAQ,cAAE,OAAO;AAAA;AAAA,EAEjB,KAAK,cAAE,OAAO;AAAA;AAAA,EAEd,SAAS,cACN;AAAA,IACC,cAAE,OAAO;AAAA,IACT,cAAE,MAAM,CAAC,cAAE,OAAO,GAAG,cAAE,MAAM,cAAE,OAAO,CAAC,GAAG,cAAE,UAAU,CAAC,CAAC;AAAA,EAC1D,EACC,SAAS;AAAA;AAAA,EAEZ,MAAM,cAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAErC,WAAW,gBAAgB,SAAS;AAAA;AAAA,EAEpC,eAAe,cAAE,OAAO,EAAE,SAAS;AACrC,CAAC;AAgBM,SAAS,wBACd,SACoB;AAEpB,QAAM,MAAM,QAAQ,IAAI,SAAS,KAAK,IAClC,QAAQ,MACR,WAAW,QAAQ,GAAG;AAG1B,QAAM,UAAkC,CAAC;AACzC,MAAI,QAAQ,SAAS;AACnB,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,OAAO,GAAG;AAC1D,YAAM,WAAW,IAAI,YAAY;AACjC,UAAI,CAAC,gBAAgB,IAAI,QAAQ,KAAK,OAAO,UAAU,UAAU;AAC/D,gBAAQ,QAAQ,IAAI;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAEA,SAAO,yBAAyB,MAAM;AAAA,IACpC,cAAc;AAAA,IACd,QAAQ,QAAQ;AAAA,IAChB;AAAA,IACA;AAAA,IACA,MAAM,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;AAAA,IACxD,WACE,OAAO,QAAQ,cAAc,YAAY,QAAQ,cAAc,OAC3D,QAAQ,YACR;AAAA,IACN,eAAe,QAAQ;AAAA,EACzB,CAAC;AACH;AAEO,IAAM,qCAAqC,cAAE,OAAO;AAAA,EACzD,cAAc,cAAE,OAAO;AAAA,EACvB,aAAa,cAAE,OAAO;AAAA,EACtB,YAAY,cAAE,OAAO;AAAA,EACrB,eAAe,cAAE,OAAO,EAAE,SAAS;AAAA,EACnC,QAAQ,gBAAgB,SAAS;AACnC,CAAC;AAQM,SAAS,sBACd,SACkB;AAClB,SAAO,uBAAuB,MAAM;AAAA,IAClC,cAAc;AAAA,IACd,cAAc,QAAQ;AAAA,IACtB,aAAa,QAAQ;AAAA,IACrB,YAAY,QAAQ;AAAA,IACpB,eAAe,QAAQ;AAAA,IACvB,QAAQ,QAAQ;AAAA,EAClB,CAAC;AACH;;;ACxFO,SAAS,yBACd,SACa;AACb,QAAM,aAA0B;AAAA,IAC9B,EAAE,MAAM,CAAC,QAAQ,GAAG,UAAU,UAAU,OAAO,QAAQ,OAAO;AAAA,EAChE;AAGA,MAAI;AACJ,MAAI;AACF,gBAAY,IAAI,IAAI,QAAQ,GAAG;AAAA,EACjC,QAAQ;AAEN,YAAQ;AAAA,MACN;AAAA,MACA,EAAE,KAAK,QAAQ,IAAI;AAAA,IACrB;AACA,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,KAAK;AAAA,MACZ,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AACD,WAAO;AAAA,EACT;AAGA,QAAM,kBAAkB,GAAG,UAAU,QAAQ,KAAK,UAAU,IAAI,GAAG,UAAU,QAAQ;AACrF,aAAW,KAAK;AAAA,IACd,MAAM,CAAC,KAAK;AAAA,IACZ,UAAU;AAAA,IACV,OAAO;AAAA,EACT,CAAC;AAID,QAAM,WAAW,oBAAI,IAAY;AACjC,aAAW,OAAO,UAAU,aAAa,KAAK,GAAG;AAC/C,QAAI,SAAS,IAAI,GAAG,EAAG;AACvB,aAAS,IAAI,GAAG;AAChB,UAAM,SAAS,UAAU,aAAa,OAAO,GAAG;AAChD,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,OAAO,SAAS,GAAG;AAAA,MAC1B,UAAU;AAAA,MACV,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AAGA,MAAI,QAAQ,cAAc,UAAa,QAAQ,cAAc,MAAM;AACjE,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,WAAW;AAAA,MAClB,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH;AAGA,MAAI,QAAQ,SAAS;AACnB,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,OAAO,GAAG;AAC1D,UACE,CAAC,gBAAgB,IAAI,IAAI,YAAY,CAAC,KACtC,OAAO,UAAU,UACjB;AACA,mBAAW,KAAK;AAAA,UACd,MAAM,CAAC,WAAW,IAAI,YAAY,CAAC;AAAA,UACnC,UAAU;AAAA,UACV;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAQO,SAAS,0BACd,SACoB;AACpB,MAAI;AACJ,MAAI;AACF,WAAO,IAAI,IAAI,QAAQ,GAAG,EAAE;AAAA,EAC9B,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL;AAAA,MACE,MAAM,CAAC,OAAO,MAAM;AAAA,MACpB,UAAU;AAAA,MACV,OAAO;AAAA,IACT;AAAA,EACF;AACF;AAOO,SAAS,2BACd,SACa;AACb,QAAM,aAA0B,CAAC;AAEjC,MACE,QAAQ,WAAW,UACnB,QAAQ,WAAW,QACnB,OAAO,QAAQ,WAAW,UAC1B;AACA,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,QAAQ;AAAA,MACf,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAMO,SAAS,oBAAoB,SAAmC;AACrE,SAAO,UAAU,QAAQ,YAAY,IAAI,QAAQ,WAAW,IAAI,QAAQ,UAAU;AACpF;AAMO,SAAS,yBAAyB,SAAmC;AAC1E,SAAO,UAAU,QAAQ,YAAY;AACvC;;;ACzIA,SAAS,mBAAmB,kBAAqC;AAC/D,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,aAAa,CAAC,SAAS;AAAA,IACvB,WAAW,CAAC,kBAAkB,gBAAgB,EAAE;AAAA,IAChD,YAAY,CAAC;AAAA,EACf;AACF;AAUA,SAAS,oBAAoB,SAAqC;AAChE,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,eAAe;AACzB,eAAW,KAAK,mBAAmB,QAAQ,aAAa,CAAC;AAAA,EAC3D;AAEA,QAAM,aAAa,yBAAyB,OAAO;AAInD,MAAI;AACF,UAAM,YAAY,CAAC,GAAG,IAAI,IAAI,QAAQ,GAAG,EAAE,aAAa,KAAK,CAAC;AAC9D,UAAM,aAAa,CAAC,GAAG,IAAI,IAAI,SAAS,CAAC;AACzC,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,OAAO,OAAO;AAAA,MACrB,UAAU;AAAA,MACV,OAAO;AAAA,IACT,CAAC;AAAA,EACH,QAAQ;AAEN,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,OAAO,OAAO;AAAA,MACrB,UAAU;AAAA,MACV,OAAO,CAAC;AAAA,IACV,CAAC;AAAA,EACH;AAEA,aAAW,KAAK;AAAA,IACd,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,YAAY;AAAA,IACxB;AAAA,EACF,CAAC;AAED,SAAO,EAAE,SAAS,GAAG,WAAW;AAClC;AASA,SAAS,sBAAsB,SAAmC;AAChE,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,eAAe;AACzB,eAAW,KAAK,mBAAmB,QAAQ,aAAa,CAAC;AAAA,EAC3D;AAEA,aAAW,KAAK;AAAA,IACd,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,oBAAoB,OAAO,CAAC;AAAA,IACxC,YAAY,2BAA2B,OAAO;AAAA,EAChD,CAAC;AAED,SAAO,EAAE,SAAS,GAAG,WAAW;AAClC;AAQO,SAAS,cAAc,SAAiC;AAC7D,MAAI,QAAQ,iBAAiB,gBAAgB;AAC3C,WAAO,oBAAoB,OAAO;AAAA,EACpC;AACA,SAAO,sBAAsB,OAAO;AACtC;","names":["import_zod"]}
+{"version":3,"sources":["../src/index.ts","../src/types.ts","../src/constants.ts","../src/builders.ts","../src/conditions.ts","../src/policies.ts"],"sourcesContent":["// ABOUTME: Public API for @zapier/policy-context.\n// ABOUTME: Shared context types, builders, and condition generators for sdkapi + approvalsapi.\n\nexport {\n  HttpRequestContextSchema,\n  ActionRunContextSchema,\n  RequestContextSchema,\n  JsonValueSchema,\n  ParsedUrlSchema,\n  DEFAULT_PORTS,\n  parseUrl,\n  buildUrlString,\n  type HttpRequestContext,\n  type ActionRunContext,\n  type RequestContext,\n  type ParsedUrl,\n} from \"./types.ts\";\n\nexport { IGNORED_HEADERS } from \"./constants.ts\";\n\nexport {\n  buildHttpRequestContext,\n  buildActionRunContext,\n  BuildHttpRequestContextOptionsSchema,\n  BuildActionRunContextOptionsSchema,\n  type BuildHttpRequestContextOptions,\n  type BuildActionRunContextOptions,\n} from \"./builders.ts\";\n\nexport {\n  buildExactHttpConditions,\n  buildDomainHttpConditions,\n  buildExactActionConditions,\n  buildActionResource,\n  buildBroadActionResource,\n} from \"./conditions.ts\";\n\nexport { toExactPolicy } from \"./policies.ts\";\n","// ABOUTME: Canonical request context types shared between sdkapi and approvalsapi.\n// ABOUTME: These define the contract for how requests are described in approval flows and policy evaluation.\n\nimport { z } from \"zod\";\nimport type { JsonValue } from \"@zapier/policy-schema\";\n\n/**\n * Zod schema for arbitrary JSON values. Used across context schemas for\n * unstructured fields like `body_json` and `inputs`.\n */\nexport const JsonValueSchema = z.custom<JsonValue>();\n\n/**\n * Parsed URL components for policy evaluation.\n * Matches the ParsedUrl shape from @zapier/policy-schema so that\n * evaluatePolicy condition paths like [\"url\", \"host\"] resolve correctly.\n */\nexport const ParsedUrlSchema = z.object({\n  scheme: z.string(),\n  host: z.string(),\n  port: z.number(),\n  path: z.string(),\n  query: z.record(z.string(), z.array(z.string())),\n});\nexport type ParsedUrl = z.infer<typeof ParsedUrlSchema>;\n\n/** Default ports by scheme, used when URL has no explicit port. */\nexport const DEFAULT_PORTS: Record<string, number> = {\n  http: 80,\n  https: 443,\n};\n\n/**\n * Parse a raw URL string into a ParsedUrl.\n * Same logic as parseUrlForPolicyContext in @zapier/policy.\n */\nexport function parseUrl(raw: string): ParsedUrl {\n  const url = new URL(raw);\n  const scheme = url.protocol.slice(0, -1).toLowerCase();\n  const host = url.hostname.toLowerCase();\n  const port = url.port\n    ? parseInt(url.port, 10)\n    : (DEFAULT_PORTS[scheme] ?? 0);\n  const path = url.pathname || \"/\";\n  const query: Record<string, string[]> = {};\n  for (const [key, value] of url.searchParams) {\n    if (!query[key]) {\n      query[key] = [];\n    }\n    query[key].push(value);\n  }\n  return { scheme, host, port, path, query };\n}\n\n/**\n * Reconstruct a URL string from a ParsedUrl.\n * Same logic as buildUrl in @zapier/policy.\n */\nexport function buildUrlString(parsed: ParsedUrl): string {\n  const { scheme, host, port, path, query } = parsed;\n  const defaultPort = DEFAULT_PORTS[scheme];\n  const portString = port !== defaultPort ? `:${String(port)}` : \"\";\n  const params = new URLSearchParams();\n  for (const [key, values] of Object.entries(query)) {\n    for (const value of values) {\n      params.append(key, value);\n    }\n  }\n  const queryString = params.toString();\n  return `${scheme}://${host}${portString}${path}${queryString ? \"?\" + queryString : \"\"}`;\n}\n\n/**\n * HTTP request context for approval/policy flows.\n * Sent by sdkapi when a relay request is denied, stored by approvalsapi,\n * and used for both policy evaluation and building policy conditions.\n *\n * The url field is a ParsedUrl object (matching @zapier/policy-schema's ParsedUrl)\n * so that evaluatePolicy conditions like [\"url\", \"host\"] resolve correctly.\n */\nexport const HttpRequestContextSchema = z.object({\n  request_type: z.literal(\"http_request\"),\n  method: z.string(),\n  /** Parsed URL components for policy condition matching */\n  url: ParsedUrlSchema,\n  /** Filtered headers (IGNORED_HEADERS excluded, keys lowercased) */\n  headers: z.record(z.string(), z.string()),\n  /** Raw body string */\n  body: z.string().nullable(),\n  /** Parsed JSON body */\n  body_json: JsonValueSchema.nullable(),\n  /** Zapier connection ID used for this request */\n  connection_id: z.string().optional(),\n  /** Optional human-readable reason for the request */\n  reason: z.string().optional(),\n});\nexport type HttpRequestContext = z.infer<typeof HttpRequestContextSchema>;\n\n/**\n * Action run context for approval/policy flows.\n * Sent by sdkapi when an action run is denied, stored by approvalsapi,\n * and used to build policy conditions.\n */\nexport const ActionRunContextSchema = z.object({\n  request_type: z.literal(\"action_run\"),\n  selected_api: z.string(),\n  action_type: z.string(),\n  action_key: z.string(),\n  connection_id: z.string().optional(),\n  inputs: JsonValueSchema.optional(),\n  reason: z.string().optional(),\n});\nexport type ActionRunContext = z.infer<typeof ActionRunContextSchema>;\n\n/**\n * Discriminated union of all request context types.\n */\nexport const RequestContextSchema = z.discriminatedUnion(\"request_type\", [\n  HttpRequestContextSchema,\n  ActionRunContextSchema,\n]);\nexport type RequestContext = z.infer<typeof RequestContextSchema>;\n","// ABOUTME: Canonical set of headers to exclude when building request contexts.\n// ABOUTME: Shared between sdkapi (context creation) and approvalsapi (condition building).\n\n/**\n * Headers to exclude when building request contexts from raw HTTP requests.\n *\n * These are either sensitive (auth credentials), HTTP infrastructure headers\n * that vary per-request, or proxy-internal headers that are not meaningful\n * for policy decisions.\n */\nexport const IGNORED_HEADERS = new Set([\n  // Auth / credentials — never include in contexts or policy conditions\n  \"authorization\",\n  \"x-relay-authorization\",\n  \"x-relay-authentication-id\",\n  \"x-api-key\",\n  \"cookie\",\n  \"set-cookie\",\n  \"proxy-authorization\",\n\n  // HTTP infrastructure — varies per-request, not policy-relevant\n  \"host\",\n  \"connection\",\n  \"content-length\",\n  \"transfer-encoding\",\n  \"accept-encoding\",\n  \"user-agent\",\n  \"accept\",\n  \"accept-language\",\n  \"sec-fetch-mode\",\n\n  // Proxy / forwarding — infrastructure, not meaningful for policy\n  \"x-forwarded-for\",\n  \"x-forwarded-host\",\n  \"x-forwarded-proto\",\n  \"x-real-ip\",\n\n  // Proxy internal — sdkapi-specific headers\n  \"x-is-interactive-session\",\n  \"x-relay-callback-url\",\n]);\n","// ABOUTME: Canonical builders for creating request contexts from raw request parts.\n// ABOUTME: Used by sdkapi to build both approval contexts and policy eval contexts.\n\nimport { z } from \"zod\";\nimport {\n  HttpRequestContextSchema,\n  ActionRunContextSchema,\n  JsonValueSchema,\n  parseUrl,\n  type HttpRequestContext,\n  type ActionRunContext,\n} from \"./types.ts\";\nimport { IGNORED_HEADERS } from \"./constants.ts\";\n\nexport const BuildHttpRequestContextOptionsSchema = z.object({\n  method: z.string(),\n  /** Raw URL string. Will be normalized with https:// if no protocol present. */\n  url: z.string(),\n  /** Raw headers from the request. Will be filtered through IGNORED_HEADERS. */\n  headers: z\n    .record(\n      z.string(),\n      z.union([z.string(), z.array(z.string()), z.undefined()]),\n    )\n    .optional(),\n  /** Raw body string */\n  body: z.string().nullable().optional(),\n  /** Pre-parsed JSON body (e.g. from Fastify's automatic JSON parsing) */\n  body_json: JsonValueSchema.optional(),\n  /** Connection ID associated with this request */\n  connection_id: z.string().optional(),\n});\nexport type BuildHttpRequestContextOptions = z.infer<\n  typeof BuildHttpRequestContextOptionsSchema\n>;\n\n/**\n * Build a canonical HttpRequestContext from raw request parts.\n *\n * This is the single source of truth for how HTTP request contexts are created.\n * Both sdkapi (for policy evaluation) and approvalsapi (for context storage)\n * should use this to ensure the context shape is consistent.\n *\n * Matches the behavior of createPolicyHttpRequest from @zapier/policy, with\n * the addition of header filtering through IGNORED_HEADERS.\n *\n * - Normalizes URL (adds https:// if missing) and parses into { scheme, host, port, path, query }\n * - Filters headers through IGNORED_HEADERS, lowercases keys, string values only\n * - Auto-parses body_json from body when content-type is JSON and body_json not provided\n * - body defaults to null (not undefined)\n */\nexport function buildHttpRequestContext(\n  options: BuildHttpRequestContextOptions,\n): HttpRequestContext {\n  // Normalize URL — SDK CLI strips the protocol\n  const rawUrl = options.url.includes(\"://\")\n    ? options.url\n    : `https://${options.url}`;\n  const url = parseUrl(rawUrl);\n\n  // Filter headers: exclude ignored, lowercase keys, string values only\n  const headers: Record<string, string> = {};\n  if (options.headers) {\n    for (const [key, value] of Object.entries(options.headers)) {\n      const lowerKey = key.toLowerCase();\n      if (!IGNORED_HEADERS.has(lowerKey) && typeof value === \"string\") {\n        headers[lowerKey] = value;\n      }\n    }\n  }\n\n  // Auto-parse body_json from body when content-type is JSON\n  // (matches createPolicyHttpRequest behavior from @zapier/policy)\n  let body_json: unknown = null;\n  if (options.body_json !== undefined) {\n    body_json = options.body_json;\n  } else if (options.body) {\n    const contentType = headers[\"content-type\"];\n    const isJson =\n      typeof contentType === \"string\" &&\n      (contentType.includes(\"application/json\") ||\n        (contentType.includes(\"application/\") &&\n          contentType.includes(\"+json\")));\n    if (isJson) {\n      try {\n        body_json = JSON.parse(options.body);\n      } catch {\n        // Invalid JSON body — leave body_json as null\n      }\n    }\n  }\n\n  return HttpRequestContextSchema.parse({\n    request_type: \"http_request\",\n    method: options.method,\n    url,\n    headers,\n    body: options.body ?? null,\n    body_json,\n    connection_id: options.connection_id,\n  });\n}\n\nexport const BuildActionRunContextOptionsSchema = z.object({\n  selected_api: z.string(),\n  action_type: z.string(),\n  action_key: z.string(),\n  connection_id: z.string().optional(),\n  inputs: JsonValueSchema.optional(),\n});\nexport type BuildActionRunContextOptions = z.infer<\n  typeof BuildActionRunContextOptionsSchema\n>;\n\n/**\n * Build a canonical ActionRunContext from raw action parts.\n */\nexport function buildActionRunContext(\n  options: BuildActionRunContextOptions,\n): ActionRunContext {\n  return ActionRunContextSchema.parse({\n    request_type: \"action_run\",\n    selected_api: options.selected_api,\n    action_type: options.action_type,\n    action_key: options.action_key,\n    connection_id: options.connection_id,\n    inputs: options.inputs,\n  });\n}\n","// ABOUTME: Builds policy conditions from stored request contexts.\n// ABOUTME: Used by approvalsapi's \"allow exact request\" and \"allow domain\" instant policy flows.\n\nimport type { Condition } from \"@zapier/policy-schema\";\nimport type { HttpRequestContext, ActionRunContext } from \"./types.ts\";\nimport { IGNORED_HEADERS } from \"./constants.ts\";\n\n/**\n * Build conditions that match an exact HTTP request.\n *\n * Handles the matches_url / query param split correctly:\n * - `matches_url` only supports scheme+host+port+path (no query string per spec)\n * - Query parameters are added as separate decomposed conditions on `url.query.<key>`\n *\n * @returns Condition[] for a relay/http permission statement\n */\nexport function buildExactHttpConditions(\n  context: HttpRequestContext,\n): Condition[] {\n  const conditions: Condition[] = [\n    { path: [\"method\"], operator: \"equals\", value: context.method },\n  ];\n\n  const { url } = context;\n\n  // matches_url condition uses URL without query string (per @zapier/policy spec)\n  const defaultPort = url.scheme === \"https\" ? 443 : url.scheme === \"http\" ? 80 : 0;\n  const portString = url.port !== defaultPort ? `:${String(url.port)}` : \"\";\n  const urlWithoutQuery = `${url.scheme}://${url.host}${portString}${url.path}`;\n  conditions.push({\n    path: [\"url\"],\n    operator: \"matches_url\",\n    value: urlWithoutQuery,\n  });\n\n  // Add decomposed conditions for each query parameter.\n  for (const [key, values] of Object.entries(url.query)) {\n    conditions.push({\n      path: [\"url\", \"query\", key],\n      operator: \"equals\",\n      value: values,\n    });\n  }\n\n  // body_json condition\n  if (context.body_json !== null) {\n    conditions.push({\n      path: [\"body_json\"],\n      operator: \"equals\",\n      value: context.body_json,\n    });\n  }\n\n  // Header conditions (filtered through IGNORED_HEADERS again for safety)\n  for (const [key, value] of Object.entries(context.headers)) {\n    if (\n      !IGNORED_HEADERS.has(key.toLowerCase()) &&\n      typeof value === \"string\"\n    ) {\n      conditions.push({\n        path: [\"headers\", key.toLowerCase()],\n        operator: \"equals\",\n        value,\n      });\n    }\n  }\n\n  return conditions;\n}\n\n/**\n * Build conditions that match any request to a given domain.\n * Uses the host from the parsed URL.\n *\n * @returns Condition[] for a relay/http permission statement\n */\nexport function buildDomainHttpConditions(\n  context: HttpRequestContext,\n): Condition[] {\n  return [\n    {\n      path: [\"url\", \"host\"],\n      operator: \"matches_host\",\n      value: context.url.host,\n    },\n  ];\n}\n\n/**\n * Build conditions that match an exact action run (with inputs).\n *\n * @returns Condition[] for an action permission statement\n */\nexport function buildExactActionConditions(\n  context: ActionRunContext,\n): Condition[] {\n  const conditions: Condition[] = [];\n\n  if (\n    context.inputs !== undefined &&\n    context.inputs !== null &&\n    typeof context.inputs === \"object\"\n  ) {\n    conditions.push({\n      path: [\"params\"],\n      operator: \"equals\",\n      value: context.inputs,\n    });\n  }\n\n  return conditions;\n}\n\n/**\n * Build the resource string for an action.\n * Format: action/{selected_api}/{action_type}/{action_key}\n */\nexport function buildActionResource(context: ActionRunContext): string {\n  return `action/${context.selected_api}/${context.action_type}/${context.action_key}`;\n}\n\n/**\n * Build a broad action resource that matches all actions for an app.\n * Format: action/{selected_api}/{wildcard}/{wildcard}\n */\nexport function buildBroadActionResource(context: ActionRunContext): string {\n  return `action/${context.selected_api}/*/*`;\n}\n","// ABOUTME: Assembles complete Policy objects from request contexts.\n// ABOUTME: Single source of truth for \"exact request\" instant policies used by web UI and API.\n\nimport type { Policy, Statement } from \"@zapier/policy-schema\";\nimport type {\n  RequestContext,\n  HttpRequestContext,\n  ActionRunContext,\n} from \"./types.ts\";\nimport {\n  buildExactHttpConditions,\n  buildExactActionConditions,\n  buildActionResource,\n} from \"./conditions.ts\";\n\n/**\n * Build a `can_use` authentication statement, if the context has a connection_id.\n */\nfunction buildAuthStatement(authenticationId: string): Statement {\n  return {\n    effect: \"allow\",\n    permissions: [\"can_use\"],\n    resources: [`authentication/${authenticationId}`],\n    conditions: [],\n  };\n}\n\n/**\n * Build an exact-match policy from an HTTP request context.\n *\n * Produces a policy that allows only the specific request described by the context:\n * - `can_use` statement for the authentication (if present)\n * - `can_execute` statement for `relay/http` with conditions from `buildExactHttpConditions`\n *   plus a `keys_in` guard restricting allowed query parameter keys\n */\nfunction httpContextToPolicy(context: HttpRequestContext): Policy {\n  const statements: Statement[] = [];\n\n  if (context.connection_id) {\n    statements.push(buildAuthStatement(context.connection_id));\n  }\n\n  const conditions = buildExactHttpConditions(context);\n\n  // Add a keys_in guard so only the query param keys present in the original\n  // request are allowed — blocks injection of extra query params.\n  conditions.push({\n    path: [\"url\", \"query\"],\n    operator: \"keys_in\",\n    value: Object.keys(context.url.query),\n  });\n\n  statements.push({\n    effect: \"allow\",\n    permissions: [\"can_execute\"],\n    resources: [\"relay/http\"],\n    conditions,\n  });\n\n  return { version: 2, statements };\n}\n\n/**\n * Build an exact-match policy from an action run context.\n *\n * Produces a policy that allows only the specific action described by the context:\n * - `can_use` statement for the authentication (if present)\n * - `can_execute` statement for the action resource with input conditions\n */\nfunction actionContextToPolicy(context: ActionRunContext): Policy {\n  const statements: Statement[] = [];\n\n  if (context.connection_id) {\n    statements.push(buildAuthStatement(context.connection_id));\n  }\n\n  statements.push({\n    effect: \"allow\",\n    permissions: [\"can_execute\"],\n    resources: [buildActionResource(context)],\n    conditions: buildExactActionConditions(context),\n  });\n\n  return { version: 2, statements };\n}\n\n/**\n * Build an exact-match policy from any supported request context.\n *\n * This is the single source of truth for \"allow this exact request\" instant policies.\n * Used by the web UI and anywhere else that needs to produce an exact policy from a context.\n */\nexport function toExactPolicy(context: RequestContext): Policy {\n  if (context.request_type === \"http_request\") {\n    return httpContextToPolicy(context);\n  }\n  return actionContextToPolicy(context);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACGA,iBAAkB;AAOX,IAAM,kBAAkB,aAAE,OAAkB;AAO5C,IAAM,kBAAkB,aAAE,OAAO;AAAA,EACtC,QAAQ,aAAE,OAAO;AAAA,EACjB,MAAM,aAAE,OAAO;AAAA,EACf,MAAM,aAAE,OAAO;AAAA,EACf,MAAM,aAAE,OAAO;AAAA,EACf,OAAO,aAAE,OAAO,aAAE,OAAO,GAAG,aAAE,MAAM,aAAE,OAAO,CAAC,CAAC;AACjD,CAAC;AAIM,IAAM,gBAAwC;AAAA,EACnD,MAAM;AAAA,EACN,OAAO;AACT;AAMO,SAAS,SAAS,KAAwB;AAC/C,QAAM,MAAM,IAAI,IAAI,GAAG;AACvB,QAAM,SAAS,IAAI,SAAS,MAAM,GAAG,EAAE,EAAE,YAAY;AACrD,QAAM,OAAO,IAAI,SAAS,YAAY;AACtC,QAAM,OAAO,IAAI,OACb,SAAS,IAAI,MAAM,EAAE,IACpB,cAAc,MAAM,KAAK;AAC9B,QAAM,OAAO,IAAI,YAAY;AAC7B,QAAM,QAAkC,CAAC;AACzC,aAAW,CAAC,KAAK,KAAK,KAAK,IAAI,cAAc;AAC3C,QAAI,CAAC,MAAM,GAAG,GAAG;AACf,YAAM,GAAG,IAAI,CAAC;AAAA,IAChB;AACA,UAAM,GAAG,EAAE,KAAK,KAAK;AAAA,EACvB;AACA,SAAO,EAAE,QAAQ,MAAM,MAAM,MAAM,MAAM;AAC3C;AAMO,SAAS,eAAe,QAA2B;AACxD,QAAM,EAAE,QAAQ,MAAM,MAAM,MAAM,MAAM,IAAI;AAC5C,QAAM,cAAc,cAAc,MAAM;AACxC,QAAM,aAAa,SAAS,cAAc,IAAI,OAAO,IAAI,CAAC,KAAK;AAC/D,QAAM,SAAS,IAAI,gBAAgB;AACnC,aAAW,CAAC,KAAK,MAAM,KAAK,OAAO,QAAQ,KAAK,GAAG;AACjD,eAAW,SAAS,QAAQ;AAC1B,aAAO,OAAO,KAAK,KAAK;AAAA,IAC1B;AAAA,EACF;AACA,QAAM,cAAc,OAAO,SAAS;AACpC,SAAO,GAAG,MAAM,MAAM,IAAI,GAAG,UAAU,GAAG,IAAI,GAAG,cAAc,MAAM,cAAc,EAAE;AACvF;AAUO,IAAM,2BAA2B,aAAE,OAAO;AAAA,EAC/C,cAAc,aAAE,QAAQ,cAAc;AAAA,EACtC,QAAQ,aAAE,OAAO;AAAA;AAAA,EAEjB,KAAK;AAAA;AAAA,EAEL,SAAS,aAAE,OAAO,aAAE,OAAO,GAAG,aAAE,OAAO,CAAC;AAAA;AAAA,EAExC,MAAM,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE1B,WAAW,gBAAgB,SAAS;AAAA;AAAA,EAEpC,eAAe,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEnC,QAAQ,aAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAQM,IAAM,yBAAyB,aAAE,OAAO;AAAA,EAC7C,cAAc,aAAE,QAAQ,YAAY;AAAA,EACpC,cAAc,aAAE,OAAO;AAAA,EACvB,aAAa,aAAE,OAAO;AAAA,EACtB,YAAY,aAAE,OAAO;AAAA,EACrB,eAAe,aAAE,OAAO,EAAE,SAAS;AAAA,EACnC,QAAQ,gBAAgB,SAAS;AAAA,EACjC,QAAQ,aAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAMM,IAAM,uBAAuB,aAAE,mBAAmB,gBAAgB;AAAA,EACvE;AAAA,EACA;AACF,CAAC;;;AC9GM,IAAM,kBAAkB,oBAAI,IAAI;AAAA;AAAA,EAErC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AACF,CAAC;;;ACrCD,IAAAA,cAAkB;AAWX,IAAM,uCAAuC,cAAE,OAAO;AAAA,EAC3D,QAAQ,cAAE,OAAO;AAAA;AAAA,EAEjB,KAAK,cAAE,OAAO;AAAA;AAAA,EAEd,SAAS,cACN;AAAA,IACC,cAAE,OAAO;AAAA,IACT,cAAE,MAAM,CAAC,cAAE,OAAO,GAAG,cAAE,MAAM,cAAE,OAAO,CAAC,GAAG,cAAE,UAAU,CAAC,CAAC;AAAA,EAC1D,EACC,SAAS;AAAA;AAAA,EAEZ,MAAM,cAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAErC,WAAW,gBAAgB,SAAS;AAAA;AAAA,EAEpC,eAAe,cAAE,OAAO,EAAE,SAAS;AACrC,CAAC;AAoBM,SAAS,wBACd,SACoB;AAEpB,QAAM,SAAS,QAAQ,IAAI,SAAS,KAAK,IACrC,QAAQ,MACR,WAAW,QAAQ,GAAG;AAC1B,QAAM,MAAM,SAAS,MAAM;AAG3B,QAAM,UAAkC,CAAC;AACzC,MAAI,QAAQ,SAAS;AACnB,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,OAAO,GAAG;AAC1D,YAAM,WAAW,IAAI,YAAY;AACjC,UAAI,CAAC,gBAAgB,IAAI,QAAQ,KAAK,OAAO,UAAU,UAAU;AAC/D,gBAAQ,QAAQ,IAAI;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAIA,MAAI,YAAqB;AACzB,MAAI,QAAQ,cAAc,QAAW;AACnC,gBAAY,QAAQ;AAAA,EACtB,WAAW,QAAQ,MAAM;AACvB,UAAM,cAAc,QAAQ,cAAc;AAC1C,UAAM,SACJ,OAAO,gBAAgB,aACtB,YAAY,SAAS,kBAAkB,KACrC,YAAY,SAAS,cAAc,KAClC,YAAY,SAAS,OAAO;AAClC,QAAI,QAAQ;AACV,UAAI;AACF,oBAAY,KAAK,MAAM,QAAQ,IAAI;AAAA,MACrC,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAEA,SAAO,yBAAyB,MAAM;AAAA,IACpC,cAAc;AAAA,IACd,QAAQ,QAAQ;AAAA,IAChB;AAAA,IACA;AAAA,IACA,MAAM,QAAQ,QAAQ;AAAA,IACtB;AAAA,IACA,eAAe,QAAQ;AAAA,EACzB,CAAC;AACH;AAEO,IAAM,qCAAqC,cAAE,OAAO;AAAA,EACzD,cAAc,cAAE,OAAO;AAAA,EACvB,aAAa,cAAE,OAAO;AAAA,EACtB,YAAY,cAAE,OAAO;AAAA,EACrB,eAAe,cAAE,OAAO,EAAE,SAAS;AAAA,EACnC,QAAQ,gBAAgB,SAAS;AACnC,CAAC;AAQM,SAAS,sBACd,SACkB;AAClB,SAAO,uBAAuB,MAAM;AAAA,IAClC,cAAc;AAAA,IACd,cAAc,QAAQ;AAAA,IACtB,aAAa,QAAQ;AAAA,IACrB,YAAY,QAAQ;AAAA,IACpB,eAAe,QAAQ;AAAA,IACvB,QAAQ,QAAQ;AAAA,EAClB,CAAC;AACH;;;AChHO,SAAS,yBACd,SACa;AACb,QAAM,aAA0B;AAAA,IAC9B,EAAE,MAAM,CAAC,QAAQ,GAAG,UAAU,UAAU,OAAO,QAAQ,OAAO;AAAA,EAChE;AAEA,QAAM,EAAE,IAAI,IAAI;AAGhB,QAAM,cAAc,IAAI,WAAW,UAAU,MAAM,IAAI,WAAW,SAAS,KAAK;AAChF,QAAM,aAAa,IAAI,SAAS,cAAc,IAAI,OAAO,IAAI,IAAI,CAAC,KAAK;AACvE,QAAM,kBAAkB,GAAG,IAAI,MAAM,MAAM,IAAI,IAAI,GAAG,UAAU,GAAG,IAAI,IAAI;AAC3E,aAAW,KAAK;AAAA,IACd,MAAM,CAAC,KAAK;AAAA,IACZ,UAAU;AAAA,IACV,OAAO;AAAA,EACT,CAAC;AAGD,aAAW,CAAC,KAAK,MAAM,KAAK,OAAO,QAAQ,IAAI,KAAK,GAAG;AACrD,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,OAAO,SAAS,GAAG;AAAA,MAC1B,UAAU;AAAA,MACV,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AAGA,MAAI,QAAQ,cAAc,MAAM;AAC9B,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,WAAW;AAAA,MAClB,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH;AAGA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,OAAO,GAAG;AAC1D,QACE,CAAC,gBAAgB,IAAI,IAAI,YAAY,CAAC,KACtC,OAAO,UAAU,UACjB;AACA,iBAAW,KAAK;AAAA,QACd,MAAM,CAAC,WAAW,IAAI,YAAY,CAAC;AAAA,QACnC,UAAU;AAAA,QACV;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAQO,SAAS,0BACd,SACa;AACb,SAAO;AAAA,IACL;AAAA,MACE,MAAM,CAAC,OAAO,MAAM;AAAA,MACpB,UAAU;AAAA,MACV,OAAO,QAAQ,IAAI;AAAA,IACrB;AAAA,EACF;AACF;AAOO,SAAS,2BACd,SACa;AACb,QAAM,aAA0B,CAAC;AAEjC,MACE,QAAQ,WAAW,UACnB,QAAQ,WAAW,QACnB,OAAO,QAAQ,WAAW,UAC1B;AACA,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,QAAQ;AAAA,MACf,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAMO,SAAS,oBAAoB,SAAmC;AACrE,SAAO,UAAU,QAAQ,YAAY,IAAI,QAAQ,WAAW,IAAI,QAAQ,UAAU;AACpF;AAMO,SAAS,yBAAyB,SAAmC;AAC1E,SAAO,UAAU,QAAQ,YAAY;AACvC;;;AC7GA,SAAS,mBAAmB,kBAAqC;AAC/D,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,aAAa,CAAC,SAAS;AAAA,IACvB,WAAW,CAAC,kBAAkB,gBAAgB,EAAE;AAAA,IAChD,YAAY,CAAC;AAAA,EACf;AACF;AAUA,SAAS,oBAAoB,SAAqC;AAChE,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,eAAe;AACzB,eAAW,KAAK,mBAAmB,QAAQ,aAAa,CAAC;AAAA,EAC3D;AAEA,QAAM,aAAa,yBAAyB,OAAO;AAInD,aAAW,KAAK;AAAA,IACd,MAAM,CAAC,OAAO,OAAO;AAAA,IACrB,UAAU;AAAA,IACV,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK;AAAA,EACtC,CAAC;AAED,aAAW,KAAK;AAAA,IACd,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,YAAY;AAAA,IACxB;AAAA,EACF,CAAC;AAED,SAAO,EAAE,SAAS,GAAG,WAAW;AAClC;AASA,SAAS,sBAAsB,SAAmC;AAChE,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,eAAe;AACzB,eAAW,KAAK,mBAAmB,QAAQ,aAAa,CAAC;AAAA,EAC3D;AAEA,aAAW,KAAK;AAAA,IACd,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,oBAAoB,OAAO,CAAC;AAAA,IACxC,YAAY,2BAA2B,OAAO;AAAA,EAChD,CAAC;AAED,SAAO,EAAE,SAAS,GAAG,WAAW;AAClC;AAQO,SAAS,cAAc,SAAiC;AAC7D,MAAI,QAAQ,iBAAiB,gBAAgB;AAC3C,WAAO,oBAAoB,OAAO;AAAA,EACpC;AACA,SAAO,sBAAsB,OAAO;AACtC;","names":["import_zod"]}

package/dist/index.d.cts

@@ -7,18 +7,52 @@ import { JsonValue, Condition, Policy } from '@zapier/policy-schema';
  * unstructured fields like `body_json` and `inputs`.
  */
 declare const JsonValueSchema: z.ZodCustom<JsonValue, JsonValue>;
+/**
+ * Parsed URL components for policy evaluation.
+ * Matches the ParsedUrl shape from @zapier/policy-schema so that
+ * evaluatePolicy condition paths like ["url", "host"] resolve correctly.
+ */
+declare const ParsedUrlSchema: z.ZodObject<{
+    scheme: z.ZodString;
+    host: z.ZodString;
+    port: z.ZodNumber;
+    path: z.ZodString;
+    query: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+type ParsedUrl = z.infer<typeof ParsedUrlSchema>;
+/** Default ports by scheme, used when URL has no explicit port. */
+declare const DEFAULT_PORTS: Record<string, number>;
+/**
+ * Parse a raw URL string into a ParsedUrl.
+ * Same logic as parseUrlForPolicyContext in @zapier/policy.
+ */
+declare function parseUrl(raw: string): ParsedUrl;
+/**
+ * Reconstruct a URL string from a ParsedUrl.
+ * Same logic as buildUrl in @zapier/policy.
+ */
+declare function buildUrlString(parsed: ParsedUrl): string;
 /**
  * HTTP request context for approval/policy flows.
  * Sent by sdkapi when a relay request is denied, stored by approvalsapi,
- * and used to build policy conditions.
+ * and used for both policy evaluation and building policy conditions.
+ *
+ * The url field is a ParsedUrl object (matching @zapier/policy-schema's ParsedUrl)
+ * so that evaluatePolicy conditions like ["url", "host"] resolve correctly.
  */
 declare const HttpRequestContextSchema: z.ZodObject<{
     request_type: z.ZodLiteral<"http_request">;
     method: z.ZodString;
-    url: z.ZodString;
-    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-    body: z.ZodOptional<z.ZodString>;
-    body_json: z.ZodOptional<z.ZodCustom<JsonValue, JsonValue>>;
+    url: z.ZodObject<{
+        scheme: z.ZodString;
+        host: z.ZodString;
+        port: z.ZodNumber;
+        path: z.ZodString;
+        query: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>;
+    headers: z.ZodRecord<z.ZodString, z.ZodString>;
+    body: z.ZodNullable<z.ZodString>;
+    body_json: z.ZodNullable<z.ZodCustom<JsonValue, JsonValue>>;
     connection_id: z.ZodOptional<z.ZodString>;
     reason: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
@@ -44,10 +78,16 @@ type ActionRunContext = z.infer<typeof ActionRunContextSchema>;
 declare const RequestContextSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     request_type: z.ZodLiteral<"http_request">;
     method: z.ZodString;
-    url: z.ZodString;
-    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-    body: z.ZodOptional<z.ZodString>;
-    body_json: z.ZodOptional<z.ZodCustom<JsonValue, JsonValue>>;
+    url: z.ZodObject<{
+        scheme: z.ZodString;
+        host: z.ZodString;
+        port: z.ZodNumber;
+        path: z.ZodString;
+        query: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>;
+    headers: z.ZodRecord<z.ZodString, z.ZodString>;
+    body: z.ZodNullable<z.ZodString>;
+    body_json: z.ZodNullable<z.ZodCustom<JsonValue, JsonValue>>;
     connection_id: z.ZodOptional<z.ZodString>;
     reason: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
@@ -83,12 +123,16 @@ type BuildHttpRequestContextOptions = z.infer<typeof BuildHttpRequestContextOpti
  * Build a canonical HttpRequestContext from raw request parts.
  *
  * This is the single source of truth for how HTTP request contexts are created.
- * Both sdkapi (for approval creation) and approvalsapi (for context storage)
+ * Both sdkapi (for policy evaluation) and approvalsapi (for context storage)
  * should use this to ensure the context shape is consistent.
  *
- * - Normalizes URL (adds https:// if missing)
- * - Filters headers through IGNORED_HEADERS
- * - Only includes string-valued headers (drops string[] values like set-cookie)
+ * Matches the behavior of createPolicyHttpRequest from @zapier/policy, with
+ * the addition of header filtering through IGNORED_HEADERS.
+ *
+ * - Normalizes URL (adds https:// if missing) and parses into { scheme, host, port, path, query }
+ * - Filters headers through IGNORED_HEADERS, lowercases keys, string values only
+ * - Auto-parses body_json from body when content-type is JSON and body_json not provided
+ * - body defaults to null (not undefined)
  */
 declare function buildHttpRequestContext(options: BuildHttpRequestContextOptions): HttpRequestContext;
 declare const BuildActionRunContextOptionsSchema: z.ZodObject<{
@@ -116,11 +160,11 @@ declare function buildActionRunContext(options: BuildActionRunContextOptions): A
 declare function buildExactHttpConditions(context: HttpRequestContext): Condition[];
 /**
  * Build conditions that match any request to a given domain.
- * Extracts the host from the context URL.
+ * Uses the host from the parsed URL.
  *
- * @returns Condition[] for a relay/http permission statement, or null if URL is unparseable
+ * @returns Condition[] for a relay/http permission statement
  */
-declare function buildDomainHttpConditions(context: HttpRequestContext): Condition[] | null;
+declare function buildDomainHttpConditions(context: HttpRequestContext): Condition[];
 /**
  * Build conditions that match an exact action run (with inputs).
  *
@@ -146,4 +190,4 @@ declare function buildBroadActionResource(context: ActionRunContext): string;
  */
 declare function toExactPolicy(context: RequestContext): Policy;
 
-export { type ActionRunContext, ActionRunContextSchema, type BuildActionRunContextOptions, BuildActionRunContextOptionsSchema, type BuildHttpRequestContextOptions, BuildHttpRequestContextOptionsSchema, type HttpRequestContext, HttpRequestContextSchema, IGNORED_HEADERS, JsonValueSchema, type RequestContext, RequestContextSchema, buildActionResource, buildActionRunContext, buildBroadActionResource, buildDomainHttpConditions, buildExactActionConditions, buildExactHttpConditions, buildHttpRequestContext, toExactPolicy };
+export { type ActionRunContext, ActionRunContextSchema, type BuildActionRunContextOptions, BuildActionRunContextOptionsSchema, type BuildHttpRequestContextOptions, BuildHttpRequestContextOptionsSchema, DEFAULT_PORTS, type HttpRequestContext, HttpRequestContextSchema, IGNORED_HEADERS, JsonValueSchema, type ParsedUrl, ParsedUrlSchema, type RequestContext, RequestContextSchema, buildActionResource, buildActionRunContext, buildBroadActionResource, buildDomainHttpConditions, buildExactActionConditions, buildExactHttpConditions, buildHttpRequestContext, buildUrlString, parseUrl, toExactPolicy };

package/dist/index.d.ts

@@ -7,18 +7,52 @@ import { JsonValue, Condition, Policy } from '@zapier/policy-schema';
  * unstructured fields like `body_json` and `inputs`.
  */
 declare const JsonValueSchema: z.ZodCustom<JsonValue, JsonValue>;
+/**
+ * Parsed URL components for policy evaluation.
+ * Matches the ParsedUrl shape from @zapier/policy-schema so that
+ * evaluatePolicy condition paths like ["url", "host"] resolve correctly.
+ */
+declare const ParsedUrlSchema: z.ZodObject<{
+    scheme: z.ZodString;
+    host: z.ZodString;
+    port: z.ZodNumber;
+    path: z.ZodString;
+    query: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+type ParsedUrl = z.infer<typeof ParsedUrlSchema>;
+/** Default ports by scheme, used when URL has no explicit port. */
+declare const DEFAULT_PORTS: Record<string, number>;
+/**
+ * Parse a raw URL string into a ParsedUrl.
+ * Same logic as parseUrlForPolicyContext in @zapier/policy.
+ */
+declare function parseUrl(raw: string): ParsedUrl;
+/**
+ * Reconstruct a URL string from a ParsedUrl.
+ * Same logic as buildUrl in @zapier/policy.
+ */
+declare function buildUrlString(parsed: ParsedUrl): string;
 /**
  * HTTP request context for approval/policy flows.
  * Sent by sdkapi when a relay request is denied, stored by approvalsapi,
- * and used to build policy conditions.
+ * and used for both policy evaluation and building policy conditions.
+ *
+ * The url field is a ParsedUrl object (matching @zapier/policy-schema's ParsedUrl)
+ * so that evaluatePolicy conditions like ["url", "host"] resolve correctly.
  */
 declare const HttpRequestContextSchema: z.ZodObject<{
     request_type: z.ZodLiteral<"http_request">;
     method: z.ZodString;
-    url: z.ZodString;
-    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-    body: z.ZodOptional<z.ZodString>;
-    body_json: z.ZodOptional<z.ZodCustom<JsonValue, JsonValue>>;
+    url: z.ZodObject<{
+        scheme: z.ZodString;
+        host: z.ZodString;
+        port: z.ZodNumber;
+        path: z.ZodString;
+        query: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>;
+    headers: z.ZodRecord<z.ZodString, z.ZodString>;
+    body: z.ZodNullable<z.ZodString>;
+    body_json: z.ZodNullable<z.ZodCustom<JsonValue, JsonValue>>;
     connection_id: z.ZodOptional<z.ZodString>;
     reason: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
@@ -44,10 +78,16 @@ type ActionRunContext = z.infer<typeof ActionRunContextSchema>;
 declare const RequestContextSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     request_type: z.ZodLiteral<"http_request">;
     method: z.ZodString;
-    url: z.ZodString;
-    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-    body: z.ZodOptional<z.ZodString>;
-    body_json: z.ZodOptional<z.ZodCustom<JsonValue, JsonValue>>;
+    url: z.ZodObject<{
+        scheme: z.ZodString;
+        host: z.ZodString;
+        port: z.ZodNumber;
+        path: z.ZodString;
+        query: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>;
+    headers: z.ZodRecord<z.ZodString, z.ZodString>;
+    body: z.ZodNullable<z.ZodString>;
+    body_json: z.ZodNullable<z.ZodCustom<JsonValue, JsonValue>>;
     connection_id: z.ZodOptional<z.ZodString>;
     reason: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>, z.ZodObject<{
@@ -83,12 +123,16 @@ type BuildHttpRequestContextOptions = z.infer<typeof BuildHttpRequestContextOpti
  * Build a canonical HttpRequestContext from raw request parts.
  *
  * This is the single source of truth for how HTTP request contexts are created.
- * Both sdkapi (for approval creation) and approvalsapi (for context storage)
+ * Both sdkapi (for policy evaluation) and approvalsapi (for context storage)
  * should use this to ensure the context shape is consistent.
  *
- * - Normalizes URL (adds https:// if missing)
- * - Filters headers through IGNORED_HEADERS
- * - Only includes string-valued headers (drops string[] values like set-cookie)
+ * Matches the behavior of createPolicyHttpRequest from @zapier/policy, with
+ * the addition of header filtering through IGNORED_HEADERS.
+ *
+ * - Normalizes URL (adds https:// if missing) and parses into { scheme, host, port, path, query }
+ * - Filters headers through IGNORED_HEADERS, lowercases keys, string values only
+ * - Auto-parses body_json from body when content-type is JSON and body_json not provided
+ * - body defaults to null (not undefined)
  */
 declare function buildHttpRequestContext(options: BuildHttpRequestContextOptions): HttpRequestContext;
 declare const BuildActionRunContextOptionsSchema: z.ZodObject<{
@@ -116,11 +160,11 @@ declare function buildActionRunContext(options: BuildActionRunContextOptions): A
 declare function buildExactHttpConditions(context: HttpRequestContext): Condition[];
 /**
  * Build conditions that match any request to a given domain.
- * Extracts the host from the context URL.
+ * Uses the host from the parsed URL.
  *
- * @returns Condition[] for a relay/http permission statement, or null if URL is unparseable
+ * @returns Condition[] for a relay/http permission statement
  */
-declare function buildDomainHttpConditions(context: HttpRequestContext): Condition[] | null;
+declare function buildDomainHttpConditions(context: HttpRequestContext): Condition[];
 /**
  * Build conditions that match an exact action run (with inputs).
  *
@@ -146,4 +190,4 @@ declare function buildBroadActionResource(context: ActionRunContext): string;
  */
 declare function toExactPolicy(context: RequestContext): Policy;
 
-export { type ActionRunContext, ActionRunContextSchema, type BuildActionRunContextOptions, BuildActionRunContextOptionsSchema, type BuildHttpRequestContextOptions, BuildHttpRequestContextOptionsSchema, type HttpRequestContext, HttpRequestContextSchema, IGNORED_HEADERS, JsonValueSchema, type RequestContext, RequestContextSchema, buildActionResource, buildActionRunContext, buildBroadActionResource, buildDomainHttpConditions, buildExactActionConditions, buildExactHttpConditions, buildHttpRequestContext, toExactPolicy };
+export { type ActionRunContext, ActionRunContextSchema, type BuildActionRunContextOptions, BuildActionRunContextOptionsSchema, type BuildHttpRequestContextOptions, BuildHttpRequestContextOptionsSchema, DEFAULT_PORTS, type HttpRequestContext, HttpRequestContextSchema, IGNORED_HEADERS, JsonValueSchema, type ParsedUrl, ParsedUrlSchema, type RequestContext, RequestContextSchema, buildActionResource, buildActionRunContext, buildBroadActionResource, buildDomainHttpConditions, buildExactActionConditions, buildExactHttpConditions, buildHttpRequestContext, buildUrlString, parseUrl, toExactPolicy };

package/dist/index.js

@@ -1,17 +1,56 @@
 // src/types.ts
 import { z } from "zod";
 var JsonValueSchema = z.custom();
+var ParsedUrlSchema = z.object({
+  scheme: z.string(),
+  host: z.string(),
+  port: z.number(),
+  path: z.string(),
+  query: z.record(z.string(), z.array(z.string()))
+});
+var DEFAULT_PORTS = {
+  http: 80,
+  https: 443
+};
+function parseUrl(raw) {
+  const url = new URL(raw);
+  const scheme = url.protocol.slice(0, -1).toLowerCase();
+  const host = url.hostname.toLowerCase();
+  const port = url.port ? parseInt(url.port, 10) : DEFAULT_PORTS[scheme] ?? 0;
+  const path = url.pathname || "/";
+  const query = {};
+  for (const [key, value] of url.searchParams) {
+    if (!query[key]) {
+      query[key] = [];
+    }
+    query[key].push(value);
+  }
+  return { scheme, host, port, path, query };
+}
+function buildUrlString(parsed) {
+  const { scheme, host, port, path, query } = parsed;
+  const defaultPort = DEFAULT_PORTS[scheme];
+  const portString = port !== defaultPort ? `:${String(port)}` : "";
+  const params = new URLSearchParams();
+  for (const [key, values] of Object.entries(query)) {
+    for (const value of values) {
+      params.append(key, value);
+    }
+  }
+  const queryString = params.toString();
+  return `${scheme}://${host}${portString}${path}${queryString ? "?" + queryString : ""}`;
+}
 var HttpRequestContextSchema = z.object({
   request_type: z.literal("http_request"),
   method: z.string(),
-  /** Full URL including query string, e.g. "https://api.example.com/v1/foo?bar=baz" */
-  url: z.string(),
+  /** Parsed URL components for policy condition matching */
+  url: ParsedUrlSchema,
   /** Filtered headers (IGNORED_HEADERS excluded, keys lowercased) */
-  headers: z.record(z.string(), z.string()).optional(),
+  headers: z.record(z.string(), z.string()),
   /** Raw body string */
-  body: z.string().optional(),
+  body: z.string().nullable(),
   /** Parsed JSON body */
-  body_json: JsonValueSchema.optional(),
+  body_json: JsonValueSchema.nullable(),
   /** Zapier connection ID used for this request */
   connection_id: z.string().optional(),
   /** Optional human-readable reason for the request */
@@ -80,7 +119,8 @@ var BuildHttpRequestContextOptionsSchema = z2.object({
   connection_id: z2.string().optional()
 });
 function buildHttpRequestContext(options) {
-  const url = options.url.includes("://") ? options.url : `https://${options.url}`;
+  const rawUrl = options.url.includes("://") ? options.url : `https://${options.url}`;
+  const url = parseUrl(rawUrl);
   const headers = {};
   if (options.headers) {
     for (const [key, value] of Object.entries(options.headers)) {
@@ -90,13 +130,26 @@ function buildHttpRequestContext(options) {
       }
     }
   }
+  let body_json = null;
+  if (options.body_json !== void 0) {
+    body_json = options.body_json;
+  } else if (options.body) {
+    const contentType = headers["content-type"];
+    const isJson = typeof contentType === "string" && (contentType.includes("application/json") || contentType.includes("application/") && contentType.includes("+json"));
+    if (isJson) {
+      try {
+        body_json = JSON.parse(options.body);
+      } catch {
+      }
+    }
+  }
   return HttpRequestContextSchema.parse({
     request_type: "http_request",
     method: options.method,
     url,
     headers,
-    body: typeof options.body === "string" ? options.body : void 0,
-    body_json: typeof options.body_json === "object" && options.body_json !== null ? options.body_json : void 0,
+    body: options.body ?? null,
+    body_json,
     connection_id: options.connection_id
   });
 }
@@ -123,70 +176,46 @@ function buildExactHttpConditions(context) {
   const conditions = [
     { path: ["method"], operator: "equals", value: context.method }
   ];
-  let parsedUrl;
-  try {
-    parsedUrl = new URL(context.url);
-  } catch {
-    console.debug(
-      "buildExactHttpConditions: unparseable URL, using raw value",
-      { url: context.url }
-    );
-    conditions.push({
-      path: ["url"],
-      operator: "matches_url",
-      value: context.url
-    });
-    return conditions;
-  }
-  const urlWithoutQuery = `${parsedUrl.protocol}//${parsedUrl.host}${parsedUrl.pathname}`;
+  const { url } = context;
+  const defaultPort = url.scheme === "https" ? 443 : url.scheme === "http" ? 80 : 0;
+  const portString = url.port !== defaultPort ? `:${String(url.port)}` : "";
+  const urlWithoutQuery = `${url.scheme}://${url.host}${portString}${url.path}`;
   conditions.push({
     path: ["url"],
     operator: "matches_url",
     value: urlWithoutQuery
   });
-  const seenKeys = /* @__PURE__ */ new Set();
-  for (const key of parsedUrl.searchParams.keys()) {
-    if (seenKeys.has(key)) continue;
-    seenKeys.add(key);
-    const values = parsedUrl.searchParams.getAll(key);
+  for (const [key, values] of Object.entries(url.query)) {
     conditions.push({
       path: ["url", "query", key],
       operator: "equals",
       value: values
     });
   }
-  if (context.body_json !== void 0 && context.body_json !== null) {
+  if (context.body_json !== null) {
     conditions.push({
       path: ["body_json"],
       operator: "equals",
       value: context.body_json
     });
   }
-  if (context.headers) {
-    for (const [key, value] of Object.entries(context.headers)) {
-      if (!IGNORED_HEADERS.has(key.toLowerCase()) && typeof value === "string") {
-        conditions.push({
-          path: ["headers", key.toLowerCase()],
-          operator: "equals",
-          value
-        });
-      }
+  for (const [key, value] of Object.entries(context.headers)) {
+    if (!IGNORED_HEADERS.has(key.toLowerCase()) && typeof value === "string") {
+      conditions.push({
+        path: ["headers", key.toLowerCase()],
+        operator: "equals",
+        value
+      });
     }
   }
   return conditions;
 }
 function buildDomainHttpConditions(context) {
-  let host;
-  try {
-    host = new URL(context.url).host;
-  } catch {
-    return null;
-  }
   return [
     {
       path: ["url", "host"],
       operator: "matches_host",
-      value: host
+      value: context.url.host
     }
   ];
 }
@@ -223,21 +252,11 @@ function httpContextToPolicy(context) {
     statements.push(buildAuthStatement(context.connection_id));
   }
   const conditions = buildExactHttpConditions(context);
-  try {
-    const queryKeys = [...new URL(context.url).searchParams.keys()];
-    const uniqueKeys = [...new Set(queryKeys)];
-    conditions.push({
-      path: ["url", "query"],
-      operator: "keys_in",
-      value: uniqueKeys
-    });
-  } catch {
-    conditions.push({
-      path: ["url", "query"],
-      operator: "keys_in",
-      value: []
-    });
-  }
+  conditions.push({
+    path: ["url", "query"],
+    operator: "keys_in",
+    value: Object.keys(context.url.query)
+  });
   statements.push({
     effect: "allow",
     permissions: ["can_execute"],
@@ -269,9 +288,11 @@ export {
   ActionRunContextSchema,
   BuildActionRunContextOptionsSchema,
   BuildHttpRequestContextOptionsSchema,
+  DEFAULT_PORTS,
   HttpRequestContextSchema,
   IGNORED_HEADERS,
   JsonValueSchema,
+  ParsedUrlSchema,
   RequestContextSchema,
   buildActionResource,
   buildActionRunContext,
@@ -280,6 +301,8 @@ export {
   buildExactActionConditions,
   buildExactHttpConditions,
   buildHttpRequestContext,
+  buildUrlString,
+  parseUrl,
   toExactPolicy
 };
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/types.ts","../src/constants.ts","../src/builders.ts","../src/conditions.ts","../src/policies.ts"],"sourcesContent":["// ABOUTME: Canonical request context types shared between sdkapi and approvalsapi.\n// ABOUTME: These define the contract for how requests are described in approval flows and policy evaluation.\n\nimport { z } from \"zod\";\nimport type { JsonValue } from \"@zapier/policy-schema\";\n\n/**\n * Zod schema for arbitrary JSON values. Used across context schemas for\n * unstructured fields like `body_json` and `inputs`.\n */\nexport const JsonValueSchema = z.custom<JsonValue>();\n\n/**\n * HTTP request context for approval/policy flows.\n * Sent by sdkapi when a relay request is denied, stored by approvalsapi,\n * and used to build policy conditions.\n */\nexport const HttpRequestContextSchema = z.object({\n  request_type: z.literal(\"http_request\"),\n  method: z.string(),\n  /** Full URL including query string, e.g. \"https://api.example.com/v1/foo?bar=baz\" */\n  url: z.string(),\n  /** Filtered headers (IGNORED_HEADERS excluded, keys lowercased) */\n  headers: z.record(z.string(), z.string()).optional(),\n  /** Raw body string */\n  body: z.string().optional(),\n  /** Parsed JSON body */\n  body_json: JsonValueSchema.optional(),\n  /** Zapier connection ID used for this request */\n  connection_id: z.string().optional(),\n  /** Optional human-readable reason for the request */\n  reason: z.string().optional(),\n});\nexport type HttpRequestContext = z.infer<typeof HttpRequestContextSchema>;\n\n/**\n * Action run context for approval/policy flows.\n * Sent by sdkapi when an action run is denied, stored by approvalsapi,\n * and used to build policy conditions.\n */\nexport const ActionRunContextSchema = z.object({\n  request_type: z.literal(\"action_run\"),\n  selected_api: z.string(),\n  action_type: z.string(),\n  action_key: z.string(),\n  connection_id: z.string().optional(),\n  inputs: JsonValueSchema.optional(),\n  reason: z.string().optional(),\n});\nexport type ActionRunContext = z.infer<typeof ActionRunContextSchema>;\n\n/**\n * Discriminated union of all request context types.\n */\nexport const RequestContextSchema = z.discriminatedUnion(\"request_type\", [\n  HttpRequestContextSchema,\n  ActionRunContextSchema,\n]);\nexport type RequestContext = z.infer<typeof RequestContextSchema>;\n","// ABOUTME: Canonical set of headers to exclude when building request contexts.\n// ABOUTME: Shared between sdkapi (context creation) and approvalsapi (condition building).\n\n/**\n * Headers to exclude when building request contexts from raw HTTP requests.\n *\n * These are either sensitive (auth credentials), HTTP infrastructure headers\n * that vary per-request, or proxy-internal headers that are not meaningful\n * for policy decisions.\n */\nexport const IGNORED_HEADERS = new Set([\n  // Auth / credentials — never include in contexts or policy conditions\n  \"authorization\",\n  \"x-relay-authorization\",\n  \"x-relay-authentication-id\",\n  \"x-api-key\",\n  \"cookie\",\n  \"set-cookie\",\n  \"proxy-authorization\",\n\n  // HTTP infrastructure — varies per-request, not policy-relevant\n  \"host\",\n  \"connection\",\n  \"content-length\",\n  \"transfer-encoding\",\n  \"accept-encoding\",\n  \"user-agent\",\n  \"accept\",\n  \"accept-language\",\n  \"sec-fetch-mode\",\n\n  // Proxy / forwarding — infrastructure, not meaningful for policy\n  \"x-forwarded-for\",\n  \"x-forwarded-host\",\n  \"x-forwarded-proto\",\n  \"x-real-ip\",\n\n  // Proxy internal — sdkapi-specific headers\n  \"x-is-interactive-session\",\n  \"x-relay-callback-url\",\n]);\n","// ABOUTME: Canonical builders for creating request contexts from raw request parts.\n// ABOUTME: Used by sdkapi to build both approval contexts and policy eval contexts.\n\nimport { z } from \"zod\";\nimport {\n  HttpRequestContextSchema,\n  ActionRunContextSchema,\n  JsonValueSchema,\n  type HttpRequestContext,\n  type ActionRunContext,\n} from \"./types.ts\";\nimport { IGNORED_HEADERS } from \"./constants.ts\";\n\nexport const BuildHttpRequestContextOptionsSchema = z.object({\n  method: z.string(),\n  /** Raw URL string. Will be normalized with https:// if no protocol present. */\n  url: z.string(),\n  /** Raw headers from the request. Will be filtered through IGNORED_HEADERS. */\n  headers: z\n    .record(\n      z.string(),\n      z.union([z.string(), z.array(z.string()), z.undefined()]),\n    )\n    .optional(),\n  /** Raw body string */\n  body: z.string().nullable().optional(),\n  /** Pre-parsed JSON body (e.g. from Fastify's automatic JSON parsing) */\n  body_json: JsonValueSchema.optional(),\n  /** Connection ID associated with this request */\n  connection_id: z.string().optional(),\n});\nexport type BuildHttpRequestContextOptions = z.infer<\n  typeof BuildHttpRequestContextOptionsSchema\n>;\n\n/**\n * Build a canonical HttpRequestContext from raw request parts.\n *\n * This is the single source of truth for how HTTP request contexts are created.\n * Both sdkapi (for approval creation) and approvalsapi (for context storage)\n * should use this to ensure the context shape is consistent.\n *\n * - Normalizes URL (adds https:// if missing)\n * - Filters headers through IGNORED_HEADERS\n * - Only includes string-valued headers (drops string[] values like set-cookie)\n */\nexport function buildHttpRequestContext(\n  options: BuildHttpRequestContextOptions,\n): HttpRequestContext {\n  // Normalize URL — SDK CLI strips the protocol\n  const url = options.url.includes(\"://\")\n    ? options.url\n    : `https://${options.url}`;\n\n  // Filter headers: exclude ignored, lowercase keys, string values only\n  const headers: Record<string, string> = {};\n  if (options.headers) {\n    for (const [key, value] of Object.entries(options.headers)) {\n      const lowerKey = key.toLowerCase();\n      if (!IGNORED_HEADERS.has(lowerKey) && typeof value === \"string\") {\n        headers[lowerKey] = value;\n      }\n    }\n  }\n\n  return HttpRequestContextSchema.parse({\n    request_type: \"http_request\",\n    method: options.method,\n    url,\n    headers,\n    body: typeof options.body === \"string\" ? options.body : undefined,\n    body_json:\n      typeof options.body_json === \"object\" && options.body_json !== null\n        ? options.body_json\n        : undefined,\n    connection_id: options.connection_id,\n  });\n}\n\nexport const BuildActionRunContextOptionsSchema = z.object({\n  selected_api: z.string(),\n  action_type: z.string(),\n  action_key: z.string(),\n  connection_id: z.string().optional(),\n  inputs: JsonValueSchema.optional(),\n});\nexport type BuildActionRunContextOptions = z.infer<\n  typeof BuildActionRunContextOptionsSchema\n>;\n\n/**\n * Build a canonical ActionRunContext from raw action parts.\n */\nexport function buildActionRunContext(\n  options: BuildActionRunContextOptions,\n): ActionRunContext {\n  return ActionRunContextSchema.parse({\n    request_type: \"action_run\",\n    selected_api: options.selected_api,\n    action_type: options.action_type,\n    action_key: options.action_key,\n    connection_id: options.connection_id,\n    inputs: options.inputs,\n  });\n}\n","// ABOUTME: Builds policy conditions from stored request contexts.\n// ABOUTME: Used by approvalsapi's \"allow exact request\" and \"allow domain\" instant policy flows.\n\nimport type { Condition } from \"@zapier/policy-schema\";\nimport type { HttpRequestContext, ActionRunContext } from \"./types.ts\";\nimport { IGNORED_HEADERS } from \"./constants.ts\";\n\n/**\n * Build conditions that match an exact HTTP request.\n *\n * Handles the matches_url / query param split correctly:\n * - `matches_url` only supports scheme+host+port+path (no query string per spec)\n * - Query parameters are added as separate decomposed conditions on `url.query.<key>`\n *\n * @returns Condition[] for a relay/http permission statement\n */\nexport function buildExactHttpConditions(\n  context: HttpRequestContext,\n): Condition[] {\n  const conditions: Condition[] = [\n    { path: [\"method\"], operator: \"equals\", value: context.method },\n  ];\n\n  // Parse the URL to separate path from query params\n  let parsedUrl: URL;\n  try {\n    parsedUrl = new URL(context.url);\n  } catch {\n    // URL is unparseable — use it as-is (will fail matches_url, but that's correct)\n    console.debug(\n      \"buildExactHttpConditions: unparseable URL, using raw value\",\n      { url: context.url },\n    );\n    conditions.push({\n      path: [\"url\"],\n      operator: \"matches_url\",\n      value: context.url,\n    });\n    return conditions;\n  }\n\n  // matches_url condition uses URL without query string (per @zapier/policy spec)\n  const urlWithoutQuery = `${parsedUrl.protocol}//${parsedUrl.host}${parsedUrl.pathname}`;\n  conditions.push({\n    path: [\"url\"],\n    operator: \"matches_url\",\n    value: urlWithoutQuery,\n  });\n\n  // Add decomposed conditions for each query parameter.\n  // Use getAll to properly handle multi-value params (e.g. ?tag=a&tag=b → [\"a\", \"b\"]).\n  const seenKeys = new Set<string>();\n  for (const key of parsedUrl.searchParams.keys()) {\n    if (seenKeys.has(key)) continue;\n    seenKeys.add(key);\n    const values = parsedUrl.searchParams.getAll(key);\n    conditions.push({\n      path: [\"url\", \"query\", key],\n      operator: \"equals\",\n      value: values,\n    });\n  }\n\n  // body_json condition\n  if (context.body_json !== undefined && context.body_json !== null) {\n    conditions.push({\n      path: [\"body_json\"],\n      operator: \"equals\",\n      value: context.body_json,\n    });\n  }\n\n  // Header conditions (filtered through IGNORED_HEADERS again for safety)\n  if (context.headers) {\n    for (const [key, value] of Object.entries(context.headers)) {\n      if (\n        !IGNORED_HEADERS.has(key.toLowerCase()) &&\n        typeof value === \"string\"\n      ) {\n        conditions.push({\n          path: [\"headers\", key.toLowerCase()],\n          operator: \"equals\",\n          value,\n        });\n      }\n    }\n  }\n\n  return conditions;\n}\n\n/**\n * Build conditions that match any request to a given domain.\n * Extracts the host from the context URL.\n *\n * @returns Condition[] for a relay/http permission statement, or null if URL is unparseable\n */\nexport function buildDomainHttpConditions(\n  context: HttpRequestContext,\n): Condition[] | null {\n  let host: string;\n  try {\n    host = new URL(context.url).host;\n  } catch {\n    return null;\n  }\n\n  return [\n    {\n      path: [\"url\", \"host\"],\n      operator: \"matches_host\",\n      value: host,\n    },\n  ];\n}\n\n/**\n * Build conditions that match an exact action run (with inputs).\n *\n * @returns Condition[] for an action permission statement\n */\nexport function buildExactActionConditions(\n  context: ActionRunContext,\n): Condition[] {\n  const conditions: Condition[] = [];\n\n  if (\n    context.inputs !== undefined &&\n    context.inputs !== null &&\n    typeof context.inputs === \"object\"\n  ) {\n    conditions.push({\n      path: [\"params\"],\n      operator: \"equals\",\n      value: context.inputs,\n    });\n  }\n\n  return conditions;\n}\n\n/**\n * Build the resource string for an action.\n * Format: action/{selected_api}/{action_type}/{action_key}\n */\nexport function buildActionResource(context: ActionRunContext): string {\n  return `action/${context.selected_api}/${context.action_type}/${context.action_key}`;\n}\n\n/**\n * Build a broad action resource that matches all actions for an app.\n * Format: action/{selected_api}/{wildcard}/{wildcard}\n */\nexport function buildBroadActionResource(context: ActionRunContext): string {\n  return `action/${context.selected_api}/*/*`;\n}\n","// ABOUTME: Assembles complete Policy objects from request contexts.\n// ABOUTME: Single source of truth for \"exact request\" instant policies used by web UI and API.\n\nimport type { Policy, Statement } from \"@zapier/policy-schema\";\nimport type {\n  RequestContext,\n  HttpRequestContext,\n  ActionRunContext,\n} from \"./types.ts\";\nimport {\n  buildExactHttpConditions,\n  buildExactActionConditions,\n  buildActionResource,\n} from \"./conditions.ts\";\n\n/**\n * Build a `can_use` authentication statement, if the context has a connection_id.\n */\nfunction buildAuthStatement(authenticationId: string): Statement {\n  return {\n    effect: \"allow\",\n    permissions: [\"can_use\"],\n    resources: [`authentication/${authenticationId}`],\n    conditions: [],\n  };\n}\n\n/**\n * Build an exact-match policy from an HTTP request context.\n *\n * Produces a policy that allows only the specific request described by the context:\n * - `can_use` statement for the authentication (if present)\n * - `can_execute` statement for `relay/http` with conditions from `buildExactHttpConditions`\n *   plus a `keys_in` guard restricting allowed query parameter keys\n */\nfunction httpContextToPolicy(context: HttpRequestContext): Policy {\n  const statements: Statement[] = [];\n\n  if (context.connection_id) {\n    statements.push(buildAuthStatement(context.connection_id));\n  }\n\n  const conditions = buildExactHttpConditions(context);\n\n  // Add a keys_in guard so only the query param keys present in the original\n  // request are allowed — blocks injection of extra query params.\n  try {\n    const queryKeys = [...new URL(context.url).searchParams.keys()];\n    const uniqueKeys = [...new Set(queryKeys)];\n    conditions.push({\n      path: [\"url\", \"query\"],\n      operator: \"keys_in\",\n      value: uniqueKeys,\n    });\n  } catch {\n    // If URL parsing fails, block all query params\n    conditions.push({\n      path: [\"url\", \"query\"],\n      operator: \"keys_in\",\n      value: [],\n    });\n  }\n\n  statements.push({\n    effect: \"allow\",\n    permissions: [\"can_execute\"],\n    resources: [\"relay/http\"],\n    conditions,\n  });\n\n  return { version: 2, statements };\n}\n\n/**\n * Build an exact-match policy from an action run context.\n *\n * Produces a policy that allows only the specific action described by the context:\n * - `can_use` statement for the authentication (if present)\n * - `can_execute` statement for the action resource with input conditions\n */\nfunction actionContextToPolicy(context: ActionRunContext): Policy {\n  const statements: Statement[] = [];\n\n  if (context.connection_id) {\n    statements.push(buildAuthStatement(context.connection_id));\n  }\n\n  statements.push({\n    effect: \"allow\",\n    permissions: [\"can_execute\"],\n    resources: [buildActionResource(context)],\n    conditions: buildExactActionConditions(context),\n  });\n\n  return { version: 2, statements };\n}\n\n/**\n * Build an exact-match policy from any supported request context.\n *\n * This is the single source of truth for \"allow this exact request\" instant policies.\n * Used by the web UI and anywhere else that needs to produce an exact policy from a context.\n */\nexport function toExactPolicy(context: RequestContext): Policy {\n  if (context.request_type === \"http_request\") {\n    return httpContextToPolicy(context);\n  }\n  return actionContextToPolicy(context);\n}\n"],"mappings":";AAGA,SAAS,SAAS;AAOX,IAAM,kBAAkB,EAAE,OAAkB;AAO5C,IAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,cAAc,EAAE,QAAQ,cAAc;AAAA,EACtC,QAAQ,EAAE,OAAO;AAAA;AAAA,EAEjB,KAAK,EAAE,OAAO;AAAA;AAAA,EAEd,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,EAEnD,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE1B,WAAW,gBAAgB,SAAS;AAAA;AAAA,EAEpC,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEnC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAQM,IAAM,yBAAyB,EAAE,OAAO;AAAA,EAC7C,cAAc,EAAE,QAAQ,YAAY;AAAA,EACpC,cAAc,EAAE,OAAO;AAAA,EACvB,aAAa,EAAE,OAAO;AAAA,EACtB,YAAY,EAAE,OAAO;AAAA,EACrB,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,QAAQ,gBAAgB,SAAS;AAAA,EACjC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAMM,IAAM,uBAAuB,EAAE,mBAAmB,gBAAgB;AAAA,EACvE;AAAA,EACA;AACF,CAAC;;;AC/CM,IAAM,kBAAkB,oBAAI,IAAI;AAAA;AAAA,EAErC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AACF,CAAC;;;ACrCD,SAAS,KAAAA,UAAS;AAUX,IAAM,uCAAuCC,GAAE,OAAO;AAAA,EAC3D,QAAQA,GAAE,OAAO;AAAA;AAAA,EAEjB,KAAKA,GAAE,OAAO;AAAA;AAAA,EAEd,SAASA,GACN;AAAA,IACCA,GAAE,OAAO;AAAA,IACTA,GAAE,MAAM,CAACA,GAAE,OAAO,GAAGA,GAAE,MAAMA,GAAE,OAAO,CAAC,GAAGA,GAAE,UAAU,CAAC,CAAC;AAAA,EAC1D,EACC,SAAS;AAAA;AAAA,EAEZ,MAAMA,GAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAErC,WAAW,gBAAgB,SAAS;AAAA;AAAA,EAEpC,eAAeA,GAAE,OAAO,EAAE,SAAS;AACrC,CAAC;AAgBM,SAAS,wBACd,SACoB;AAEpB,QAAM,MAAM,QAAQ,IAAI,SAAS,KAAK,IAClC,QAAQ,MACR,WAAW,QAAQ,GAAG;AAG1B,QAAM,UAAkC,CAAC;AACzC,MAAI,QAAQ,SAAS;AACnB,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,OAAO,GAAG;AAC1D,YAAM,WAAW,IAAI,YAAY;AACjC,UAAI,CAAC,gBAAgB,IAAI,QAAQ,KAAK,OAAO,UAAU,UAAU;AAC/D,gBAAQ,QAAQ,IAAI;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAEA,SAAO,yBAAyB,MAAM;AAAA,IACpC,cAAc;AAAA,IACd,QAAQ,QAAQ;AAAA,IAChB;AAAA,IACA;AAAA,IACA,MAAM,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;AAAA,IACxD,WACE,OAAO,QAAQ,cAAc,YAAY,QAAQ,cAAc,OAC3D,QAAQ,YACR;AAAA,IACN,eAAe,QAAQ;AAAA,EACzB,CAAC;AACH;AAEO,IAAM,qCAAqCA,GAAE,OAAO;AAAA,EACzD,cAAcA,GAAE,OAAO;AAAA,EACvB,aAAaA,GAAE,OAAO;AAAA,EACtB,YAAYA,GAAE,OAAO;AAAA,EACrB,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA,EACnC,QAAQ,gBAAgB,SAAS;AACnC,CAAC;AAQM,SAAS,sBACd,SACkB;AAClB,SAAO,uBAAuB,MAAM;AAAA,IAClC,cAAc;AAAA,IACd,cAAc,QAAQ;AAAA,IACtB,aAAa,QAAQ;AAAA,IACrB,YAAY,QAAQ;AAAA,IACpB,eAAe,QAAQ;AAAA,IACvB,QAAQ,QAAQ;AAAA,EAClB,CAAC;AACH;;;ACxFO,SAAS,yBACd,SACa;AACb,QAAM,aAA0B;AAAA,IAC9B,EAAE,MAAM,CAAC,QAAQ,GAAG,UAAU,UAAU,OAAO,QAAQ,OAAO;AAAA,EAChE;AAGA,MAAI;AACJ,MAAI;AACF,gBAAY,IAAI,IAAI,QAAQ,GAAG;AAAA,EACjC,QAAQ;AAEN,YAAQ;AAAA,MACN;AAAA,MACA,EAAE,KAAK,QAAQ,IAAI;AAAA,IACrB;AACA,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,KAAK;AAAA,MACZ,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AACD,WAAO;AAAA,EACT;AAGA,QAAM,kBAAkB,GAAG,UAAU,QAAQ,KAAK,UAAU,IAAI,GAAG,UAAU,QAAQ;AACrF,aAAW,KAAK;AAAA,IACd,MAAM,CAAC,KAAK;AAAA,IACZ,UAAU;AAAA,IACV,OAAO;AAAA,EACT,CAAC;AAID,QAAM,WAAW,oBAAI,IAAY;AACjC,aAAW,OAAO,UAAU,aAAa,KAAK,GAAG;AAC/C,QAAI,SAAS,IAAI,GAAG,EAAG;AACvB,aAAS,IAAI,GAAG;AAChB,UAAM,SAAS,UAAU,aAAa,OAAO,GAAG;AAChD,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,OAAO,SAAS,GAAG;AAAA,MAC1B,UAAU;AAAA,MACV,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AAGA,MAAI,QAAQ,cAAc,UAAa,QAAQ,cAAc,MAAM;AACjE,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,WAAW;AAAA,MAClB,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH;AAGA,MAAI,QAAQ,SAAS;AACnB,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,OAAO,GAAG;AAC1D,UACE,CAAC,gBAAgB,IAAI,IAAI,YAAY,CAAC,KACtC,OAAO,UAAU,UACjB;AACA,mBAAW,KAAK;AAAA,UACd,MAAM,CAAC,WAAW,IAAI,YAAY,CAAC;AAAA,UACnC,UAAU;AAAA,UACV;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAQO,SAAS,0BACd,SACoB;AACpB,MAAI;AACJ,MAAI;AACF,WAAO,IAAI,IAAI,QAAQ,GAAG,EAAE;AAAA,EAC9B,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL;AAAA,MACE,MAAM,CAAC,OAAO,MAAM;AAAA,MACpB,UAAU;AAAA,MACV,OAAO;AAAA,IACT;AAAA,EACF;AACF;AAOO,SAAS,2BACd,SACa;AACb,QAAM,aAA0B,CAAC;AAEjC,MACE,QAAQ,WAAW,UACnB,QAAQ,WAAW,QACnB,OAAO,QAAQ,WAAW,UAC1B;AACA,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,QAAQ;AAAA,MACf,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAMO,SAAS,oBAAoB,SAAmC;AACrE,SAAO,UAAU,QAAQ,YAAY,IAAI,QAAQ,WAAW,IAAI,QAAQ,UAAU;AACpF;AAMO,SAAS,yBAAyB,SAAmC;AAC1E,SAAO,UAAU,QAAQ,YAAY;AACvC;;;ACzIA,SAAS,mBAAmB,kBAAqC;AAC/D,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,aAAa,CAAC,SAAS;AAAA,IACvB,WAAW,CAAC,kBAAkB,gBAAgB,EAAE;AAAA,IAChD,YAAY,CAAC;AAAA,EACf;AACF;AAUA,SAAS,oBAAoB,SAAqC;AAChE,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,eAAe;AACzB,eAAW,KAAK,mBAAmB,QAAQ,aAAa,CAAC;AAAA,EAC3D;AAEA,QAAM,aAAa,yBAAyB,OAAO;AAInD,MAAI;AACF,UAAM,YAAY,CAAC,GAAG,IAAI,IAAI,QAAQ,GAAG,EAAE,aAAa,KAAK,CAAC;AAC9D,UAAM,aAAa,CAAC,GAAG,IAAI,IAAI,SAAS,CAAC;AACzC,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,OAAO,OAAO;AAAA,MACrB,UAAU;AAAA,MACV,OAAO;AAAA,IACT,CAAC;AAAA,EACH,QAAQ;AAEN,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,OAAO,OAAO;AAAA,MACrB,UAAU;AAAA,MACV,OAAO,CAAC;AAAA,IACV,CAAC;AAAA,EACH;AAEA,aAAW,KAAK;AAAA,IACd,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,YAAY;AAAA,IACxB;AAAA,EACF,CAAC;AAED,SAAO,EAAE,SAAS,GAAG,WAAW;AAClC;AASA,SAAS,sBAAsB,SAAmC;AAChE,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,eAAe;AACzB,eAAW,KAAK,mBAAmB,QAAQ,aAAa,CAAC;AAAA,EAC3D;AAEA,aAAW,KAAK;AAAA,IACd,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,oBAAoB,OAAO,CAAC;AAAA,IACxC,YAAY,2BAA2B,OAAO;AAAA,EAChD,CAAC;AAED,SAAO,EAAE,SAAS,GAAG,WAAW;AAClC;AAQO,SAAS,cAAc,SAAiC;AAC7D,MAAI,QAAQ,iBAAiB,gBAAgB;AAC3C,WAAO,oBAAoB,OAAO;AAAA,EACpC;AACA,SAAO,sBAAsB,OAAO;AACtC;","names":["z","z"]}
+{"version":3,"sources":["../src/types.ts","../src/constants.ts","../src/builders.ts","../src/conditions.ts","../src/policies.ts"],"sourcesContent":["// ABOUTME: Canonical request context types shared between sdkapi and approvalsapi.\n// ABOUTME: These define the contract for how requests are described in approval flows and policy evaluation.\n\nimport { z } from \"zod\";\nimport type { JsonValue } from \"@zapier/policy-schema\";\n\n/**\n * Zod schema for arbitrary JSON values. Used across context schemas for\n * unstructured fields like `body_json` and `inputs`.\n */\nexport const JsonValueSchema = z.custom<JsonValue>();\n\n/**\n * Parsed URL components for policy evaluation.\n * Matches the ParsedUrl shape from @zapier/policy-schema so that\n * evaluatePolicy condition paths like [\"url\", \"host\"] resolve correctly.\n */\nexport const ParsedUrlSchema = z.object({\n  scheme: z.string(),\n  host: z.string(),\n  port: z.number(),\n  path: z.string(),\n  query: z.record(z.string(), z.array(z.string())),\n});\nexport type ParsedUrl = z.infer<typeof ParsedUrlSchema>;\n\n/** Default ports by scheme, used when URL has no explicit port. */\nexport const DEFAULT_PORTS: Record<string, number> = {\n  http: 80,\n  https: 443,\n};\n\n/**\n * Parse a raw URL string into a ParsedUrl.\n * Same logic as parseUrlForPolicyContext in @zapier/policy.\n */\nexport function parseUrl(raw: string): ParsedUrl {\n  const url = new URL(raw);\n  const scheme = url.protocol.slice(0, -1).toLowerCase();\n  const host = url.hostname.toLowerCase();\n  const port = url.port\n    ? parseInt(url.port, 10)\n    : (DEFAULT_PORTS[scheme] ?? 0);\n  const path = url.pathname || \"/\";\n  const query: Record<string, string[]> = {};\n  for (const [key, value] of url.searchParams) {\n    if (!query[key]) {\n      query[key] = [];\n    }\n    query[key].push(value);\n  }\n  return { scheme, host, port, path, query };\n}\n\n/**\n * Reconstruct a URL string from a ParsedUrl.\n * Same logic as buildUrl in @zapier/policy.\n */\nexport function buildUrlString(parsed: ParsedUrl): string {\n  const { scheme, host, port, path, query } = parsed;\n  const defaultPort = DEFAULT_PORTS[scheme];\n  const portString = port !== defaultPort ? `:${String(port)}` : \"\";\n  const params = new URLSearchParams();\n  for (const [key, values] of Object.entries(query)) {\n    for (const value of values) {\n      params.append(key, value);\n    }\n  }\n  const queryString = params.toString();\n  return `${scheme}://${host}${portString}${path}${queryString ? \"?\" + queryString : \"\"}`;\n}\n\n/**\n * HTTP request context for approval/policy flows.\n * Sent by sdkapi when a relay request is denied, stored by approvalsapi,\n * and used for both policy evaluation and building policy conditions.\n *\n * The url field is a ParsedUrl object (matching @zapier/policy-schema's ParsedUrl)\n * so that evaluatePolicy conditions like [\"url\", \"host\"] resolve correctly.\n */\nexport const HttpRequestContextSchema = z.object({\n  request_type: z.literal(\"http_request\"),\n  method: z.string(),\n  /** Parsed URL components for policy condition matching */\n  url: ParsedUrlSchema,\n  /** Filtered headers (IGNORED_HEADERS excluded, keys lowercased) */\n  headers: z.record(z.string(), z.string()),\n  /** Raw body string */\n  body: z.string().nullable(),\n  /** Parsed JSON body */\n  body_json: JsonValueSchema.nullable(),\n  /** Zapier connection ID used for this request */\n  connection_id: z.string().optional(),\n  /** Optional human-readable reason for the request */\n  reason: z.string().optional(),\n});\nexport type HttpRequestContext = z.infer<typeof HttpRequestContextSchema>;\n\n/**\n * Action run context for approval/policy flows.\n * Sent by sdkapi when an action run is denied, stored by approvalsapi,\n * and used to build policy conditions.\n */\nexport const ActionRunContextSchema = z.object({\n  request_type: z.literal(\"action_run\"),\n  selected_api: z.string(),\n  action_type: z.string(),\n  action_key: z.string(),\n  connection_id: z.string().optional(),\n  inputs: JsonValueSchema.optional(),\n  reason: z.string().optional(),\n});\nexport type ActionRunContext = z.infer<typeof ActionRunContextSchema>;\n\n/**\n * Discriminated union of all request context types.\n */\nexport const RequestContextSchema = z.discriminatedUnion(\"request_type\", [\n  HttpRequestContextSchema,\n  ActionRunContextSchema,\n]);\nexport type RequestContext = z.infer<typeof RequestContextSchema>;\n","// ABOUTME: Canonical set of headers to exclude when building request contexts.\n// ABOUTME: Shared between sdkapi (context creation) and approvalsapi (condition building).\n\n/**\n * Headers to exclude when building request contexts from raw HTTP requests.\n *\n * These are either sensitive (auth credentials), HTTP infrastructure headers\n * that vary per-request, or proxy-internal headers that are not meaningful\n * for policy decisions.\n */\nexport const IGNORED_HEADERS = new Set([\n  // Auth / credentials — never include in contexts or policy conditions\n  \"authorization\",\n  \"x-relay-authorization\",\n  \"x-relay-authentication-id\",\n  \"x-api-key\",\n  \"cookie\",\n  \"set-cookie\",\n  \"proxy-authorization\",\n\n  // HTTP infrastructure — varies per-request, not policy-relevant\n  \"host\",\n  \"connection\",\n  \"content-length\",\n  \"transfer-encoding\",\n  \"accept-encoding\",\n  \"user-agent\",\n  \"accept\",\n  \"accept-language\",\n  \"sec-fetch-mode\",\n\n  // Proxy / forwarding — infrastructure, not meaningful for policy\n  \"x-forwarded-for\",\n  \"x-forwarded-host\",\n  \"x-forwarded-proto\",\n  \"x-real-ip\",\n\n  // Proxy internal — sdkapi-specific headers\n  \"x-is-interactive-session\",\n  \"x-relay-callback-url\",\n]);\n","// ABOUTME: Canonical builders for creating request contexts from raw request parts.\n// ABOUTME: Used by sdkapi to build both approval contexts and policy eval contexts.\n\nimport { z } from \"zod\";\nimport {\n  HttpRequestContextSchema,\n  ActionRunContextSchema,\n  JsonValueSchema,\n  parseUrl,\n  type HttpRequestContext,\n  type ActionRunContext,\n} from \"./types.ts\";\nimport { IGNORED_HEADERS } from \"./constants.ts\";\n\nexport const BuildHttpRequestContextOptionsSchema = z.object({\n  method: z.string(),\n  /** Raw URL string. Will be normalized with https:// if no protocol present. */\n  url: z.string(),\n  /** Raw headers from the request. Will be filtered through IGNORED_HEADERS. */\n  headers: z\n    .record(\n      z.string(),\n      z.union([z.string(), z.array(z.string()), z.undefined()]),\n    )\n    .optional(),\n  /** Raw body string */\n  body: z.string().nullable().optional(),\n  /** Pre-parsed JSON body (e.g. from Fastify's automatic JSON parsing) */\n  body_json: JsonValueSchema.optional(),\n  /** Connection ID associated with this request */\n  connection_id: z.string().optional(),\n});\nexport type BuildHttpRequestContextOptions = z.infer<\n  typeof BuildHttpRequestContextOptionsSchema\n>;\n\n/**\n * Build a canonical HttpRequestContext from raw request parts.\n *\n * This is the single source of truth for how HTTP request contexts are created.\n * Both sdkapi (for policy evaluation) and approvalsapi (for context storage)\n * should use this to ensure the context shape is consistent.\n *\n * Matches the behavior of createPolicyHttpRequest from @zapier/policy, with\n * the addition of header filtering through IGNORED_HEADERS.\n *\n * - Normalizes URL (adds https:// if missing) and parses into { scheme, host, port, path, query }\n * - Filters headers through IGNORED_HEADERS, lowercases keys, string values only\n * - Auto-parses body_json from body when content-type is JSON and body_json not provided\n * - body defaults to null (not undefined)\n */\nexport function buildHttpRequestContext(\n  options: BuildHttpRequestContextOptions,\n): HttpRequestContext {\n  // Normalize URL — SDK CLI strips the protocol\n  const rawUrl = options.url.includes(\"://\")\n    ? options.url\n    : `https://${options.url}`;\n  const url = parseUrl(rawUrl);\n\n  // Filter headers: exclude ignored, lowercase keys, string values only\n  const headers: Record<string, string> = {};\n  if (options.headers) {\n    for (const [key, value] of Object.entries(options.headers)) {\n      const lowerKey = key.toLowerCase();\n      if (!IGNORED_HEADERS.has(lowerKey) && typeof value === \"string\") {\n        headers[lowerKey] = value;\n      }\n    }\n  }\n\n  // Auto-parse body_json from body when content-type is JSON\n  // (matches createPolicyHttpRequest behavior from @zapier/policy)\n  let body_json: unknown = null;\n  if (options.body_json !== undefined) {\n    body_json = options.body_json;\n  } else if (options.body) {\n    const contentType = headers[\"content-type\"];\n    const isJson =\n      typeof contentType === \"string\" &&\n      (contentType.includes(\"application/json\") ||\n        (contentType.includes(\"application/\") &&\n          contentType.includes(\"+json\")));\n    if (isJson) {\n      try {\n        body_json = JSON.parse(options.body);\n      } catch {\n        // Invalid JSON body — leave body_json as null\n      }\n    }\n  }\n\n  return HttpRequestContextSchema.parse({\n    request_type: \"http_request\",\n    method: options.method,\n    url,\n    headers,\n    body: options.body ?? null,\n    body_json,\n    connection_id: options.connection_id,\n  });\n}\n\nexport const BuildActionRunContextOptionsSchema = z.object({\n  selected_api: z.string(),\n  action_type: z.string(),\n  action_key: z.string(),\n  connection_id: z.string().optional(),\n  inputs: JsonValueSchema.optional(),\n});\nexport type BuildActionRunContextOptions = z.infer<\n  typeof BuildActionRunContextOptionsSchema\n>;\n\n/**\n * Build a canonical ActionRunContext from raw action parts.\n */\nexport function buildActionRunContext(\n  options: BuildActionRunContextOptions,\n): ActionRunContext {\n  return ActionRunContextSchema.parse({\n    request_type: \"action_run\",\n    selected_api: options.selected_api,\n    action_type: options.action_type,\n    action_key: options.action_key,\n    connection_id: options.connection_id,\n    inputs: options.inputs,\n  });\n}\n","// ABOUTME: Builds policy conditions from stored request contexts.\n// ABOUTME: Used by approvalsapi's \"allow exact request\" and \"allow domain\" instant policy flows.\n\nimport type { Condition } from \"@zapier/policy-schema\";\nimport type { HttpRequestContext, ActionRunContext } from \"./types.ts\";\nimport { IGNORED_HEADERS } from \"./constants.ts\";\n\n/**\n * Build conditions that match an exact HTTP request.\n *\n * Handles the matches_url / query param split correctly:\n * - `matches_url` only supports scheme+host+port+path (no query string per spec)\n * - Query parameters are added as separate decomposed conditions on `url.query.<key>`\n *\n * @returns Condition[] for a relay/http permission statement\n */\nexport function buildExactHttpConditions(\n  context: HttpRequestContext,\n): Condition[] {\n  const conditions: Condition[] = [\n    { path: [\"method\"], operator: \"equals\", value: context.method },\n  ];\n\n  const { url } = context;\n\n  // matches_url condition uses URL without query string (per @zapier/policy spec)\n  const defaultPort = url.scheme === \"https\" ? 443 : url.scheme === \"http\" ? 80 : 0;\n  const portString = url.port !== defaultPort ? `:${String(url.port)}` : \"\";\n  const urlWithoutQuery = `${url.scheme}://${url.host}${portString}${url.path}`;\n  conditions.push({\n    path: [\"url\"],\n    operator: \"matches_url\",\n    value: urlWithoutQuery,\n  });\n\n  // Add decomposed conditions for each query parameter.\n  for (const [key, values] of Object.entries(url.query)) {\n    conditions.push({\n      path: [\"url\", \"query\", key],\n      operator: \"equals\",\n      value: values,\n    });\n  }\n\n  // body_json condition\n  if (context.body_json !== null) {\n    conditions.push({\n      path: [\"body_json\"],\n      operator: \"equals\",\n      value: context.body_json,\n    });\n  }\n\n  // Header conditions (filtered through IGNORED_HEADERS again for safety)\n  for (const [key, value] of Object.entries(context.headers)) {\n    if (\n      !IGNORED_HEADERS.has(key.toLowerCase()) &&\n      typeof value === \"string\"\n    ) {\n      conditions.push({\n        path: [\"headers\", key.toLowerCase()],\n        operator: \"equals\",\n        value,\n      });\n    }\n  }\n\n  return conditions;\n}\n\n/**\n * Build conditions that match any request to a given domain.\n * Uses the host from the parsed URL.\n *\n * @returns Condition[] for a relay/http permission statement\n */\nexport function buildDomainHttpConditions(\n  context: HttpRequestContext,\n): Condition[] {\n  return [\n    {\n      path: [\"url\", \"host\"],\n      operator: \"matches_host\",\n      value: context.url.host,\n    },\n  ];\n}\n\n/**\n * Build conditions that match an exact action run (with inputs).\n *\n * @returns Condition[] for an action permission statement\n */\nexport function buildExactActionConditions(\n  context: ActionRunContext,\n): Condition[] {\n  const conditions: Condition[] = [];\n\n  if (\n    context.inputs !== undefined &&\n    context.inputs !== null &&\n    typeof context.inputs === \"object\"\n  ) {\n    conditions.push({\n      path: [\"params\"],\n      operator: \"equals\",\n      value: context.inputs,\n    });\n  }\n\n  return conditions;\n}\n\n/**\n * Build the resource string for an action.\n * Format: action/{selected_api}/{action_type}/{action_key}\n */\nexport function buildActionResource(context: ActionRunContext): string {\n  return `action/${context.selected_api}/${context.action_type}/${context.action_key}`;\n}\n\n/**\n * Build a broad action resource that matches all actions for an app.\n * Format: action/{selected_api}/{wildcard}/{wildcard}\n */\nexport function buildBroadActionResource(context: ActionRunContext): string {\n  return `action/${context.selected_api}/*/*`;\n}\n","// ABOUTME: Assembles complete Policy objects from request contexts.\n// ABOUTME: Single source of truth for \"exact request\" instant policies used by web UI and API.\n\nimport type { Policy, Statement } from \"@zapier/policy-schema\";\nimport type {\n  RequestContext,\n  HttpRequestContext,\n  ActionRunContext,\n} from \"./types.ts\";\nimport {\n  buildExactHttpConditions,\n  buildExactActionConditions,\n  buildActionResource,\n} from \"./conditions.ts\";\n\n/**\n * Build a `can_use` authentication statement, if the context has a connection_id.\n */\nfunction buildAuthStatement(authenticationId: string): Statement {\n  return {\n    effect: \"allow\",\n    permissions: [\"can_use\"],\n    resources: [`authentication/${authenticationId}`],\n    conditions: [],\n  };\n}\n\n/**\n * Build an exact-match policy from an HTTP request context.\n *\n * Produces a policy that allows only the specific request described by the context:\n * - `can_use` statement for the authentication (if present)\n * - `can_execute` statement for `relay/http` with conditions from `buildExactHttpConditions`\n *   plus a `keys_in` guard restricting allowed query parameter keys\n */\nfunction httpContextToPolicy(context: HttpRequestContext): Policy {\n  const statements: Statement[] = [];\n\n  if (context.connection_id) {\n    statements.push(buildAuthStatement(context.connection_id));\n  }\n\n  const conditions = buildExactHttpConditions(context);\n\n  // Add a keys_in guard so only the query param keys present in the original\n  // request are allowed — blocks injection of extra query params.\n  conditions.push({\n    path: [\"url\", \"query\"],\n    operator: \"keys_in\",\n    value: Object.keys(context.url.query),\n  });\n\n  statements.push({\n    effect: \"allow\",\n    permissions: [\"can_execute\"],\n    resources: [\"relay/http\"],\n    conditions,\n  });\n\n  return { version: 2, statements };\n}\n\n/**\n * Build an exact-match policy from an action run context.\n *\n * Produces a policy that allows only the specific action described by the context:\n * - `can_use` statement for the authentication (if present)\n * - `can_execute` statement for the action resource with input conditions\n */\nfunction actionContextToPolicy(context: ActionRunContext): Policy {\n  const statements: Statement[] = [];\n\n  if (context.connection_id) {\n    statements.push(buildAuthStatement(context.connection_id));\n  }\n\n  statements.push({\n    effect: \"allow\",\n    permissions: [\"can_execute\"],\n    resources: [buildActionResource(context)],\n    conditions: buildExactActionConditions(context),\n  });\n\n  return { version: 2, statements };\n}\n\n/**\n * Build an exact-match policy from any supported request context.\n *\n * This is the single source of truth for \"allow this exact request\" instant policies.\n * Used by the web UI and anywhere else that needs to produce an exact policy from a context.\n */\nexport function toExactPolicy(context: RequestContext): Policy {\n  if (context.request_type === \"http_request\") {\n    return httpContextToPolicy(context);\n  }\n  return actionContextToPolicy(context);\n}\n"],"mappings":";AAGA,SAAS,SAAS;AAOX,IAAM,kBAAkB,EAAE,OAAkB;AAO5C,IAAM,kBAAkB,EAAE,OAAO;AAAA,EACtC,QAAQ,EAAE,OAAO;AAAA,EACjB,MAAM,EAAE,OAAO;AAAA,EACf,MAAM,EAAE,OAAO;AAAA,EACf,MAAM,EAAE,OAAO;AAAA,EACf,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AACjD,CAAC;AAIM,IAAM,gBAAwC;AAAA,EACnD,MAAM;AAAA,EACN,OAAO;AACT;AAMO,SAAS,SAAS,KAAwB;AAC/C,QAAM,MAAM,IAAI,IAAI,GAAG;AACvB,QAAM,SAAS,IAAI,SAAS,MAAM,GAAG,EAAE,EAAE,YAAY;AACrD,QAAM,OAAO,IAAI,SAAS,YAAY;AACtC,QAAM,OAAO,IAAI,OACb,SAAS,IAAI,MAAM,EAAE,IACpB,cAAc,MAAM,KAAK;AAC9B,QAAM,OAAO,IAAI,YAAY;AAC7B,QAAM,QAAkC,CAAC;AACzC,aAAW,CAAC,KAAK,KAAK,KAAK,IAAI,cAAc;AAC3C,QAAI,CAAC,MAAM,GAAG,GAAG;AACf,YAAM,GAAG,IAAI,CAAC;AAAA,IAChB;AACA,UAAM,GAAG,EAAE,KAAK,KAAK;AAAA,EACvB;AACA,SAAO,EAAE,QAAQ,MAAM,MAAM,MAAM,MAAM;AAC3C;AAMO,SAAS,eAAe,QAA2B;AACxD,QAAM,EAAE,QAAQ,MAAM,MAAM,MAAM,MAAM,IAAI;AAC5C,QAAM,cAAc,cAAc,MAAM;AACxC,QAAM,aAAa,SAAS,cAAc,IAAI,OAAO,IAAI,CAAC,KAAK;AAC/D,QAAM,SAAS,IAAI,gBAAgB;AACnC,aAAW,CAAC,KAAK,MAAM,KAAK,OAAO,QAAQ,KAAK,GAAG;AACjD,eAAW,SAAS,QAAQ;AAC1B,aAAO,OAAO,KAAK,KAAK;AAAA,IAC1B;AAAA,EACF;AACA,QAAM,cAAc,OAAO,SAAS;AACpC,SAAO,GAAG,MAAM,MAAM,IAAI,GAAG,UAAU,GAAG,IAAI,GAAG,cAAc,MAAM,cAAc,EAAE;AACvF;AAUO,IAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,cAAc,EAAE,QAAQ,cAAc;AAAA,EACtC,QAAQ,EAAE,OAAO;AAAA;AAAA,EAEjB,KAAK;AAAA;AAAA,EAEL,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC;AAAA;AAAA,EAExC,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE1B,WAAW,gBAAgB,SAAS;AAAA;AAAA,EAEpC,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEnC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAQM,IAAM,yBAAyB,EAAE,OAAO;AAAA,EAC7C,cAAc,EAAE,QAAQ,YAAY;AAAA,EACpC,cAAc,EAAE,OAAO;AAAA,EACvB,aAAa,EAAE,OAAO;AAAA,EACtB,YAAY,EAAE,OAAO;AAAA,EACrB,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,QAAQ,gBAAgB,SAAS;AAAA,EACjC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAMM,IAAM,uBAAuB,EAAE,mBAAmB,gBAAgB;AAAA,EACvE;AAAA,EACA;AACF,CAAC;;;AC9GM,IAAM,kBAAkB,oBAAI,IAAI;AAAA;AAAA,EAErC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AACF,CAAC;;;ACrCD,SAAS,KAAAA,UAAS;AAWX,IAAM,uCAAuCC,GAAE,OAAO;AAAA,EAC3D,QAAQA,GAAE,OAAO;AAAA;AAAA,EAEjB,KAAKA,GAAE,OAAO;AAAA;AAAA,EAEd,SAASA,GACN;AAAA,IACCA,GAAE,OAAO;AAAA,IACTA,GAAE,MAAM,CAACA,GAAE,OAAO,GAAGA,GAAE,MAAMA,GAAE,OAAO,CAAC,GAAGA,GAAE,UAAU,CAAC,CAAC;AAAA,EAC1D,EACC,SAAS;AAAA;AAAA,EAEZ,MAAMA,GAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAErC,WAAW,gBAAgB,SAAS;AAAA;AAAA,EAEpC,eAAeA,GAAE,OAAO,EAAE,SAAS;AACrC,CAAC;AAoBM,SAAS,wBACd,SACoB;AAEpB,QAAM,SAAS,QAAQ,IAAI,SAAS,KAAK,IACrC,QAAQ,MACR,WAAW,QAAQ,GAAG;AAC1B,QAAM,MAAM,SAAS,MAAM;AAG3B,QAAM,UAAkC,CAAC;AACzC,MAAI,QAAQ,SAAS;AACnB,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,OAAO,GAAG;AAC1D,YAAM,WAAW,IAAI,YAAY;AACjC,UAAI,CAAC,gBAAgB,IAAI,QAAQ,KAAK,OAAO,UAAU,UAAU;AAC/D,gBAAQ,QAAQ,IAAI;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAIA,MAAI,YAAqB;AACzB,MAAI,QAAQ,cAAc,QAAW;AACnC,gBAAY,QAAQ;AAAA,EACtB,WAAW,QAAQ,MAAM;AACvB,UAAM,cAAc,QAAQ,cAAc;AAC1C,UAAM,SACJ,OAAO,gBAAgB,aACtB,YAAY,SAAS,kBAAkB,KACrC,YAAY,SAAS,cAAc,KAClC,YAAY,SAAS,OAAO;AAClC,QAAI,QAAQ;AACV,UAAI;AACF,oBAAY,KAAK,MAAM,QAAQ,IAAI;AAAA,MACrC,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAEA,SAAO,yBAAyB,MAAM;AAAA,IACpC,cAAc;AAAA,IACd,QAAQ,QAAQ;AAAA,IAChB;AAAA,IACA;AAAA,IACA,MAAM,QAAQ,QAAQ;AAAA,IACtB;AAAA,IACA,eAAe,QAAQ;AAAA,EACzB,CAAC;AACH;AAEO,IAAM,qCAAqCA,GAAE,OAAO;AAAA,EACzD,cAAcA,GAAE,OAAO;AAAA,EACvB,aAAaA,GAAE,OAAO;AAAA,EACtB,YAAYA,GAAE,OAAO;AAAA,EACrB,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA,EACnC,QAAQ,gBAAgB,SAAS;AACnC,CAAC;AAQM,SAAS,sBACd,SACkB;AAClB,SAAO,uBAAuB,MAAM;AAAA,IAClC,cAAc;AAAA,IACd,cAAc,QAAQ;AAAA,IACtB,aAAa,QAAQ;AAAA,IACrB,YAAY,QAAQ;AAAA,IACpB,eAAe,QAAQ;AAAA,IACvB,QAAQ,QAAQ;AAAA,EAClB,CAAC;AACH;;;AChHO,SAAS,yBACd,SACa;AACb,QAAM,aAA0B;AAAA,IAC9B,EAAE,MAAM,CAAC,QAAQ,GAAG,UAAU,UAAU,OAAO,QAAQ,OAAO;AAAA,EAChE;AAEA,QAAM,EAAE,IAAI,IAAI;AAGhB,QAAM,cAAc,IAAI,WAAW,UAAU,MAAM,IAAI,WAAW,SAAS,KAAK;AAChF,QAAM,aAAa,IAAI,SAAS,cAAc,IAAI,OAAO,IAAI,IAAI,CAAC,KAAK;AACvE,QAAM,kBAAkB,GAAG,IAAI,MAAM,MAAM,IAAI,IAAI,GAAG,UAAU,GAAG,IAAI,IAAI;AAC3E,aAAW,KAAK;AAAA,IACd,MAAM,CAAC,KAAK;AAAA,IACZ,UAAU;AAAA,IACV,OAAO;AAAA,EACT,CAAC;AAGD,aAAW,CAAC,KAAK,MAAM,KAAK,OAAO,QAAQ,IAAI,KAAK,GAAG;AACrD,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,OAAO,SAAS,GAAG;AAAA,MAC1B,UAAU;AAAA,MACV,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AAGA,MAAI,QAAQ,cAAc,MAAM;AAC9B,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,WAAW;AAAA,MAClB,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH;AAGA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,OAAO,GAAG;AAC1D,QACE,CAAC,gBAAgB,IAAI,IAAI,YAAY,CAAC,KACtC,OAAO,UAAU,UACjB;AACA,iBAAW,KAAK;AAAA,QACd,MAAM,CAAC,WAAW,IAAI,YAAY,CAAC;AAAA,QACnC,UAAU;AAAA,QACV;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAQO,SAAS,0BACd,SACa;AACb,SAAO;AAAA,IACL;AAAA,MACE,MAAM,CAAC,OAAO,MAAM;AAAA,MACpB,UAAU;AAAA,MACV,OAAO,QAAQ,IAAI;AAAA,IACrB;AAAA,EACF;AACF;AAOO,SAAS,2BACd,SACa;AACb,QAAM,aAA0B,CAAC;AAEjC,MACE,QAAQ,WAAW,UACnB,QAAQ,WAAW,QACnB,OAAO,QAAQ,WAAW,UAC1B;AACA,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,QAAQ;AAAA,MACf,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAMO,SAAS,oBAAoB,SAAmC;AACrE,SAAO,UAAU,QAAQ,YAAY,IAAI,QAAQ,WAAW,IAAI,QAAQ,UAAU;AACpF;AAMO,SAAS,yBAAyB,SAAmC;AAC1E,SAAO,UAAU,QAAQ,YAAY;AACvC;;;AC7GA,SAAS,mBAAmB,kBAAqC;AAC/D,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,aAAa,CAAC,SAAS;AAAA,IACvB,WAAW,CAAC,kBAAkB,gBAAgB,EAAE;AAAA,IAChD,YAAY,CAAC;AAAA,EACf;AACF;AAUA,SAAS,oBAAoB,SAAqC;AAChE,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,eAAe;AACzB,eAAW,KAAK,mBAAmB,QAAQ,aAAa,CAAC;AAAA,EAC3D;AAEA,QAAM,aAAa,yBAAyB,OAAO;AAInD,aAAW,KAAK;AAAA,IACd,MAAM,CAAC,OAAO,OAAO;AAAA,IACrB,UAAU;AAAA,IACV,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK;AAAA,EACtC,CAAC;AAED,aAAW,KAAK;AAAA,IACd,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,YAAY;AAAA,IACxB;AAAA,EACF,CAAC;AAED,SAAO,EAAE,SAAS,GAAG,WAAW;AAClC;AASA,SAAS,sBAAsB,SAAmC;AAChE,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,eAAe;AACzB,eAAW,KAAK,mBAAmB,QAAQ,aAAa,CAAC;AAAA,EAC3D;AAEA,aAAW,KAAK;AAAA,IACd,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,oBAAoB,OAAO,CAAC;AAAA,IACxC,YAAY,2BAA2B,OAAO;AAAA,EAChD,CAAC;AAED,SAAO,EAAE,SAAS,GAAG,WAAW;AAClC;AAQO,SAAS,cAAc,SAAiC;AAC7D,MAAI,QAAQ,iBAAiB,gBAAgB;AAC3C,WAAO,oBAAoB,OAAO;AAAA,EACpC;AACA,SAAO,sBAAsB,OAAO;AACtC;","names":["z","z"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zapier/policy-context",
-  "version": "0.3.0",
+  "version": "0.5.3",
   "description": "Shared request context types, builders, and policy condition generators for sdkapi and approvalsapi",
   "repository": {
     "type": "git",
@@ -9,12 +9,30 @@
   },
   "type": "module",
   "exports": {
-    ".": "./src/index.ts",
-    "./*": "./src/*.ts"
+    ".": {
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      },
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      }
+    }
   },
   "files": [
     "dist"
   ],
+  "publishConfig": {
+    "access": "restricted"
+  },
+  "dependencies": {
+    "@zapier/policy-schema": "0.8.0",
+    "zod": "^4.0.0"
+  },
+  "devDependencies": {
+    "tsup": "^8.0.0"
+  },
   "scripts": {
     "build": "tsup",
     "lint": "eslint src/**/*.ts",
@@ -24,30 +42,7 @@
     "types": "tsc",
     "types:watch": "tsc --watch"
   },
-  "publishConfig": {
-    "access": "restricted",
-    "provenance": true,
-    "main": "dist/index.cjs",
-    "module": "dist/index.js",
-    "types": "dist/index.d.ts",
-    "exports": {
-      ".": {
-        "require": {
-          "types": "./dist/index.d.cts",
-          "default": "./dist/index.cjs"
-        },
-        "import": {
-          "types": "./dist/index.d.ts",
-          "default": "./dist/index.js"
-        }
-      }
-    }
-  },
-  "dependencies": {
-    "@zapier/policy-schema": "0.8.0",
-    "zod": "^4.0.0"
-  },
-  "devDependencies": {
-    "tsup": "^8.0.0"
-  }
-}
+  "main": "dist/index.cjs",
+  "module": "dist/index.js",
+  "types": "dist/index.d.ts"
+}