@zapier/policy-context 0.3.0

package/dist/index.cjs

@@ -0,0 +1,326 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  ActionRunContextSchema: () => ActionRunContextSchema,
+  BuildActionRunContextOptionsSchema: () => BuildActionRunContextOptionsSchema,
+  BuildHttpRequestContextOptionsSchema: () => BuildHttpRequestContextOptionsSchema,
+  HttpRequestContextSchema: () => HttpRequestContextSchema,
+  IGNORED_HEADERS: () => IGNORED_HEADERS,
+  JsonValueSchema: () => JsonValueSchema,
+  RequestContextSchema: () => RequestContextSchema,
+  buildActionResource: () => buildActionResource,
+  buildActionRunContext: () => buildActionRunContext,
+  buildBroadActionResource: () => buildBroadActionResource,
+  buildDomainHttpConditions: () => buildDomainHttpConditions,
+  buildExactActionConditions: () => buildExactActionConditions,
+  buildExactHttpConditions: () => buildExactHttpConditions,
+  buildHttpRequestContext: () => buildHttpRequestContext,
+  toExactPolicy: () => toExactPolicy
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/types.ts
+var import_zod = require("zod");
+var JsonValueSchema = import_zod.z.custom();
+var HttpRequestContextSchema = import_zod.z.object({
+  request_type: import_zod.z.literal("http_request"),
+  method: import_zod.z.string(),
+  /** Full URL including query string, e.g. "https://api.example.com/v1/foo?bar=baz" */
+  url: import_zod.z.string(),
+  /** Filtered headers (IGNORED_HEADERS excluded, keys lowercased) */
+  headers: import_zod.z.record(import_zod.z.string(), import_zod.z.string()).optional(),
+  /** Raw body string */
+  body: import_zod.z.string().optional(),
+  /** Parsed JSON body */
+  body_json: JsonValueSchema.optional(),
+  /** Zapier connection ID used for this request */
+  connection_id: import_zod.z.string().optional(),
+  /** Optional human-readable reason for the request */
+  reason: import_zod.z.string().optional()
+});
+var ActionRunContextSchema = import_zod.z.object({
+  request_type: import_zod.z.literal("action_run"),
+  selected_api: import_zod.z.string(),
+  action_type: import_zod.z.string(),
+  action_key: import_zod.z.string(),
+  connection_id: import_zod.z.string().optional(),
+  inputs: JsonValueSchema.optional(),
+  reason: import_zod.z.string().optional()
+});
+var RequestContextSchema = import_zod.z.discriminatedUnion("request_type", [
+  HttpRequestContextSchema,
+  ActionRunContextSchema
+]);
+
+// src/constants.ts
+var IGNORED_HEADERS = /* @__PURE__ */ new Set([
+  // Auth / credentials — never include in contexts or policy conditions
+  "authorization",
+  "x-relay-authorization",
+  "x-relay-authentication-id",
+  "x-api-key",
+  "cookie",
+  "set-cookie",
+  "proxy-authorization",
+  // HTTP infrastructure — varies per-request, not policy-relevant
+  "host",
+  "connection",
+  "content-length",
+  "transfer-encoding",
+  "accept-encoding",
+  "user-agent",
+  "accept",
+  "accept-language",
+  "sec-fetch-mode",
+  // Proxy / forwarding — infrastructure, not meaningful for policy
+  "x-forwarded-for",
+  "x-forwarded-host",
+  "x-forwarded-proto",
+  "x-real-ip",
+  // Proxy internal — sdkapi-specific headers
+  "x-is-interactive-session",
+  "x-relay-callback-url"
+]);
+
+// src/builders.ts
+var import_zod2 = require("zod");
+var BuildHttpRequestContextOptionsSchema = import_zod2.z.object({
+  method: import_zod2.z.string(),
+  /** Raw URL string. Will be normalized with https:// if no protocol present. */
+  url: import_zod2.z.string(),
+  /** Raw headers from the request. Will be filtered through IGNORED_HEADERS. */
+  headers: import_zod2.z.record(
+    import_zod2.z.string(),
+    import_zod2.z.union([import_zod2.z.string(), import_zod2.z.array(import_zod2.z.string()), import_zod2.z.undefined()])
+  ).optional(),
+  /** Raw body string */
+  body: import_zod2.z.string().nullable().optional(),
+  /** Pre-parsed JSON body (e.g. from Fastify's automatic JSON parsing) */
+  body_json: JsonValueSchema.optional(),
+  /** Connection ID associated with this request */
+  connection_id: import_zod2.z.string().optional()
+});
+function buildHttpRequestContext(options) {
+  const url = options.url.includes("://") ? options.url : `https://${options.url}`;
+  const headers = {};
+  if (options.headers) {
+    for (const [key, value] of Object.entries(options.headers)) {
+      const lowerKey = key.toLowerCase();
+      if (!IGNORED_HEADERS.has(lowerKey) && typeof value === "string") {
+        headers[lowerKey] = value;
+      }
+    }
+  }
+  return HttpRequestContextSchema.parse({
+    request_type: "http_request",
+    method: options.method,
+    url,
+    headers,
+    body: typeof options.body === "string" ? options.body : void 0,
+    body_json: typeof options.body_json === "object" && options.body_json !== null ? options.body_json : void 0,
+    connection_id: options.connection_id
+  });
+}
+var BuildActionRunContextOptionsSchema = import_zod2.z.object({
+  selected_api: import_zod2.z.string(),
+  action_type: import_zod2.z.string(),
+  action_key: import_zod2.z.string(),
+  connection_id: import_zod2.z.string().optional(),
+  inputs: JsonValueSchema.optional()
+});
+function buildActionRunContext(options) {
+  return ActionRunContextSchema.parse({
+    request_type: "action_run",
+    selected_api: options.selected_api,
+    action_type: options.action_type,
+    action_key: options.action_key,
+    connection_id: options.connection_id,
+    inputs: options.inputs
+  });
+}
+
+// src/conditions.ts
+function buildExactHttpConditions(context) {
+  const conditions = [
+    { path: ["method"], operator: "equals", value: context.method }
+  ];
+  let parsedUrl;
+  try {
+    parsedUrl = new URL(context.url);
+  } catch {
+    console.debug(
+      "buildExactHttpConditions: unparseable URL, using raw value",
+      { url: context.url }
+    );
+    conditions.push({
+      path: ["url"],
+      operator: "matches_url",
+      value: context.url
+    });
+    return conditions;
+  }
+  const urlWithoutQuery = `${parsedUrl.protocol}//${parsedUrl.host}${parsedUrl.pathname}`;
+  conditions.push({
+    path: ["url"],
+    operator: "matches_url",
+    value: urlWithoutQuery
+  });
+  const seenKeys = /* @__PURE__ */ new Set();
+  for (const key of parsedUrl.searchParams.keys()) {
+    if (seenKeys.has(key)) continue;
+    seenKeys.add(key);
+    const values = parsedUrl.searchParams.getAll(key);
+    conditions.push({
+      path: ["url", "query", key],
+      operator: "equals",
+      value: values
+    });
+  }
+  if (context.body_json !== void 0 && context.body_json !== null) {
+    conditions.push({
+      path: ["body_json"],
+      operator: "equals",
+      value: context.body_json
+    });
+  }
+  if (context.headers) {
+    for (const [key, value] of Object.entries(context.headers)) {
+      if (!IGNORED_HEADERS.has(key.toLowerCase()) && typeof value === "string") {
+        conditions.push({
+          path: ["headers", key.toLowerCase()],
+          operator: "equals",
+          value
+        });
+      }
+    }
+  }
+  return conditions;
+}
+function buildDomainHttpConditions(context) {
+  let host;
+  try {
+    host = new URL(context.url).host;
+  } catch {
+    return null;
+  }
+  return [
+    {
+      path: ["url", "host"],
+      operator: "matches_host",
+      value: host
+    }
+  ];
+}
+function buildExactActionConditions(context) {
+  const conditions = [];
+  if (context.inputs !== void 0 && context.inputs !== null && typeof context.inputs === "object") {
+    conditions.push({
+      path: ["params"],
+      operator: "equals",
+      value: context.inputs
+    });
+  }
+  return conditions;
+}
+function buildActionResource(context) {
+  return `action/${context.selected_api}/${context.action_type}/${context.action_key}`;
+}
+function buildBroadActionResource(context) {
+  return `action/${context.selected_api}/*/*`;
+}
+
+// src/policies.ts
+function buildAuthStatement(authenticationId) {
+  return {
+    effect: "allow",
+    permissions: ["can_use"],
+    resources: [`authentication/${authenticationId}`],
+    conditions: []
+  };
+}
+function httpContextToPolicy(context) {
+  const statements = [];
+  if (context.connection_id) {
+    statements.push(buildAuthStatement(context.connection_id));
+  }
+  const conditions = buildExactHttpConditions(context);
+  try {
+    const queryKeys = [...new URL(context.url).searchParams.keys()];
+    const uniqueKeys = [...new Set(queryKeys)];
+    conditions.push({
+      path: ["url", "query"],
+      operator: "keys_in",
+      value: uniqueKeys
+    });
+  } catch {
+    conditions.push({
+      path: ["url", "query"],
+      operator: "keys_in",
+      value: []
+    });
+  }
+  statements.push({
+    effect: "allow",
+    permissions: ["can_execute"],
+    resources: ["relay/http"],
+    conditions
+  });
+  return { version: 2, statements };
+}
+function actionContextToPolicy(context) {
+  const statements = [];
+  if (context.connection_id) {
+    statements.push(buildAuthStatement(context.connection_id));
+  }
+  statements.push({
+    effect: "allow",
+    permissions: ["can_execute"],
+    resources: [buildActionResource(context)],
+    conditions: buildExactActionConditions(context)
+  });
+  return { version: 2, statements };
+}
+function toExactPolicy(context) {
+  if (context.request_type === "http_request") {
+    return httpContextToPolicy(context);
+  }
+  return actionContextToPolicy(context);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ActionRunContextSchema,
+  BuildActionRunContextOptionsSchema,
+  BuildHttpRequestContextOptionsSchema,
+  HttpRequestContextSchema,
+  IGNORED_HEADERS,
+  JsonValueSchema,
+  RequestContextSchema,
+  buildActionResource,
+  buildActionRunContext,
+  buildBroadActionResource,
+  buildDomainHttpConditions,
+  buildExactActionConditions,
+  buildExactHttpConditions,
+  buildHttpRequestContext,
+  toExactPolicy
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/types.ts","../src/constants.ts","../src/builders.ts","../src/conditions.ts","../src/policies.ts"],"sourcesContent":["// ABOUTME: Public API for @zapier/policy-context.\n// ABOUTME: Shared context types, builders, and condition generators for sdkapi + approvalsapi.\n\nexport {\n  HttpRequestContextSchema,\n  ActionRunContextSchema,\n  RequestContextSchema,\n  JsonValueSchema,\n  type HttpRequestContext,\n  type ActionRunContext,\n  type RequestContext,\n} from \"./types.ts\";\n\nexport { IGNORED_HEADERS } from \"./constants.ts\";\n\nexport {\n  buildHttpRequestContext,\n  buildActionRunContext,\n  BuildHttpRequestContextOptionsSchema,\n  BuildActionRunContextOptionsSchema,\n  type BuildHttpRequestContextOptions,\n  type BuildActionRunContextOptions,\n} from \"./builders.ts\";\n\nexport {\n  buildExactHttpConditions,\n  buildDomainHttpConditions,\n  buildExactActionConditions,\n  buildActionResource,\n  buildBroadActionResource,\n} from \"./conditions.ts\";\n\nexport { toExactPolicy } from \"./policies.ts\";\n","// ABOUTME: Canonical request context types shared between sdkapi and approvalsapi.\n// ABOUTME: These define the contract for how requests are described in approval flows and policy evaluation.\n\nimport { z } from \"zod\";\nimport type { JsonValue } from \"@zapier/policy-schema\";\n\n/**\n * Zod schema for arbitrary JSON values. Used across context schemas for\n * unstructured fields like `body_json` and `inputs`.\n */\nexport const JsonValueSchema = z.custom<JsonValue>();\n\n/**\n * HTTP request context for approval/policy flows.\n * Sent by sdkapi when a relay request is denied, stored by approvalsapi,\n * and used to build policy conditions.\n */\nexport const HttpRequestContextSchema = z.object({\n  request_type: z.literal(\"http_request\"),\n  method: z.string(),\n  /** Full URL including query string, e.g. \"https://api.example.com/v1/foo?bar=baz\" */\n  url: z.string(),\n  /** Filtered headers (IGNORED_HEADERS excluded, keys lowercased) */\n  headers: z.record(z.string(), z.string()).optional(),\n  /** Raw body string */\n  body: z.string().optional(),\n  /** Parsed JSON body */\n  body_json: JsonValueSchema.optional(),\n  /** Zapier connection ID used for this request */\n  connection_id: z.string().optional(),\n  /** Optional human-readable reason for the request */\n  reason: z.string().optional(),\n});\nexport type HttpRequestContext = z.infer<typeof HttpRequestContextSchema>;\n\n/**\n * Action run context for approval/policy flows.\n * Sent by sdkapi when an action run is denied, stored by approvalsapi,\n * and used to build policy conditions.\n */\nexport const ActionRunContextSchema = z.object({\n  request_type: z.literal(\"action_run\"),\n  selected_api: z.string(),\n  action_type: z.string(),\n  action_key: z.string(),\n  connection_id: z.string().optional(),\n  inputs: JsonValueSchema.optional(),\n  reason: z.string().optional(),\n});\nexport type ActionRunContext = z.infer<typeof ActionRunContextSchema>;\n\n/**\n * Discriminated union of all request context types.\n */\nexport const RequestContextSchema = z.discriminatedUnion(\"request_type\", [\n  HttpRequestContextSchema,\n  ActionRunContextSchema,\n]);\nexport type RequestContext = z.infer<typeof RequestContextSchema>;\n","// ABOUTME: Canonical set of headers to exclude when building request contexts.\n// ABOUTME: Shared between sdkapi (context creation) and approvalsapi (condition building).\n\n/**\n * Headers to exclude when building request contexts from raw HTTP requests.\n *\n * These are either sensitive (auth credentials), HTTP infrastructure headers\n * that vary per-request, or proxy-internal headers that are not meaningful\n * for policy decisions.\n */\nexport const IGNORED_HEADERS = new Set([\n  // Auth / credentials — never include in contexts or policy conditions\n  \"authorization\",\n  \"x-relay-authorization\",\n  \"x-relay-authentication-id\",\n  \"x-api-key\",\n  \"cookie\",\n  \"set-cookie\",\n  \"proxy-authorization\",\n\n  // HTTP infrastructure — varies per-request, not policy-relevant\n  \"host\",\n  \"connection\",\n  \"content-length\",\n  \"transfer-encoding\",\n  \"accept-encoding\",\n  \"user-agent\",\n  \"accept\",\n  \"accept-language\",\n  \"sec-fetch-mode\",\n\n  // Proxy / forwarding — infrastructure, not meaningful for policy\n  \"x-forwarded-for\",\n  \"x-forwarded-host\",\n  \"x-forwarded-proto\",\n  \"x-real-ip\",\n\n  // Proxy internal — sdkapi-specific headers\n  \"x-is-interactive-session\",\n  \"x-relay-callback-url\",\n]);\n","// ABOUTME: Canonical builders for creating request contexts from raw request parts.\n// ABOUTME: Used by sdkapi to build both approval contexts and policy eval contexts.\n\nimport { z } from \"zod\";\nimport {\n  HttpRequestContextSchema,\n  ActionRunContextSchema,\n  JsonValueSchema,\n  type HttpRequestContext,\n  type ActionRunContext,\n} from \"./types.ts\";\nimport { IGNORED_HEADERS } from \"./constants.ts\";\n\nexport const BuildHttpRequestContextOptionsSchema = z.object({\n  method: z.string(),\n  /** Raw URL string. Will be normalized with https:// if no protocol present. */\n  url: z.string(),\n  /** Raw headers from the request. Will be filtered through IGNORED_HEADERS. */\n  headers: z\n    .record(\n      z.string(),\n      z.union([z.string(), z.array(z.string()), z.undefined()]),\n    )\n    .optional(),\n  /** Raw body string */\n  body: z.string().nullable().optional(),\n  /** Pre-parsed JSON body (e.g. from Fastify's automatic JSON parsing) */\n  body_json: JsonValueSchema.optional(),\n  /** Connection ID associated with this request */\n  connection_id: z.string().optional(),\n});\nexport type BuildHttpRequestContextOptions = z.infer<\n  typeof BuildHttpRequestContextOptionsSchema\n>;\n\n/**\n * Build a canonical HttpRequestContext from raw request parts.\n *\n * This is the single source of truth for how HTTP request contexts are created.\n * Both sdkapi (for approval creation) and approvalsapi (for context storage)\n * should use this to ensure the context shape is consistent.\n *\n * - Normalizes URL (adds https:// if missing)\n * - Filters headers through IGNORED_HEADERS\n * - Only includes string-valued headers (drops string[] values like set-cookie)\n */\nexport function buildHttpRequestContext(\n  options: BuildHttpRequestContextOptions,\n): HttpRequestContext {\n  // Normalize URL — SDK CLI strips the protocol\n  const url = options.url.includes(\"://\")\n    ? options.url\n    : `https://${options.url}`;\n\n  // Filter headers: exclude ignored, lowercase keys, string values only\n  const headers: Record<string, string> = {};\n  if (options.headers) {\n    for (const [key, value] of Object.entries(options.headers)) {\n      const lowerKey = key.toLowerCase();\n      if (!IGNORED_HEADERS.has(lowerKey) && typeof value === \"string\") {\n        headers[lowerKey] = value;\n      }\n    }\n  }\n\n  return HttpRequestContextSchema.parse({\n    request_type: \"http_request\",\n    method: options.method,\n    url,\n    headers,\n    body: typeof options.body === \"string\" ? options.body : undefined,\n    body_json:\n      typeof options.body_json === \"object\" && options.body_json !== null\n        ? options.body_json\n        : undefined,\n    connection_id: options.connection_id,\n  });\n}\n\nexport const BuildActionRunContextOptionsSchema = z.object({\n  selected_api: z.string(),\n  action_type: z.string(),\n  action_key: z.string(),\n  connection_id: z.string().optional(),\n  inputs: JsonValueSchema.optional(),\n});\nexport type BuildActionRunContextOptions = z.infer<\n  typeof BuildActionRunContextOptionsSchema\n>;\n\n/**\n * Build a canonical ActionRunContext from raw action parts.\n */\nexport function buildActionRunContext(\n  options: BuildActionRunContextOptions,\n): ActionRunContext {\n  return ActionRunContextSchema.parse({\n    request_type: \"action_run\",\n    selected_api: options.selected_api,\n    action_type: options.action_type,\n    action_key: options.action_key,\n    connection_id: options.connection_id,\n    inputs: options.inputs,\n  });\n}\n","// ABOUTME: Builds policy conditions from stored request contexts.\n// ABOUTME: Used by approvalsapi's \"allow exact request\" and \"allow domain\" instant policy flows.\n\nimport type { Condition } from \"@zapier/policy-schema\";\nimport type { HttpRequestContext, ActionRunContext } from \"./types.ts\";\nimport { IGNORED_HEADERS } from \"./constants.ts\";\n\n/**\n * Build conditions that match an exact HTTP request.\n *\n * Handles the matches_url / query param split correctly:\n * - `matches_url` only supports scheme+host+port+path (no query string per spec)\n * - Query parameters are added as separate decomposed conditions on `url.query.<key>`\n *\n * @returns Condition[] for a relay/http permission statement\n */\nexport function buildExactHttpConditions(\n  context: HttpRequestContext,\n): Condition[] {\n  const conditions: Condition[] = [\n    { path: [\"method\"], operator: \"equals\", value: context.method },\n  ];\n\n  // Parse the URL to separate path from query params\n  let parsedUrl: URL;\n  try {\n    parsedUrl = new URL(context.url);\n  } catch {\n    // URL is unparseable — use it as-is (will fail matches_url, but that's correct)\n    console.debug(\n      \"buildExactHttpConditions: unparseable URL, using raw value\",\n      { url: context.url },\n    );\n    conditions.push({\n      path: [\"url\"],\n      operator: \"matches_url\",\n      value: context.url,\n    });\n    return conditions;\n  }\n\n  // matches_url condition uses URL without query string (per @zapier/policy spec)\n  const urlWithoutQuery = `${parsedUrl.protocol}//${parsedUrl.host}${parsedUrl.pathname}`;\n  conditions.push({\n    path: [\"url\"],\n    operator: \"matches_url\",\n    value: urlWithoutQuery,\n  });\n\n  // Add decomposed conditions for each query parameter.\n  // Use getAll to properly handle multi-value params (e.g. ?tag=a&tag=b → [\"a\", \"b\"]).\n  const seenKeys = new Set<string>();\n  for (const key of parsedUrl.searchParams.keys()) {\n    if (seenKeys.has(key)) continue;\n    seenKeys.add(key);\n    const values = parsedUrl.searchParams.getAll(key);\n    conditions.push({\n      path: [\"url\", \"query\", key],\n      operator: \"equals\",\n      value: values,\n    });\n  }\n\n  // body_json condition\n  if (context.body_json !== undefined && context.body_json !== null) {\n    conditions.push({\n      path: [\"body_json\"],\n      operator: \"equals\",\n      value: context.body_json,\n    });\n  }\n\n  // Header conditions (filtered through IGNORED_HEADERS again for safety)\n  if (context.headers) {\n    for (const [key, value] of Object.entries(context.headers)) {\n      if (\n        !IGNORED_HEADERS.has(key.toLowerCase()) &&\n        typeof value === \"string\"\n      ) {\n        conditions.push({\n          path: [\"headers\", key.toLowerCase()],\n          operator: \"equals\",\n          value,\n        });\n      }\n    }\n  }\n\n  return conditions;\n}\n\n/**\n * Build conditions that match any request to a given domain.\n * Extracts the host from the context URL.\n *\n * @returns Condition[] for a relay/http permission statement, or null if URL is unparseable\n */\nexport function buildDomainHttpConditions(\n  context: HttpRequestContext,\n): Condition[] | null {\n  let host: string;\n  try {\n    host = new URL(context.url).host;\n  } catch {\n    return null;\n  }\n\n  return [\n    {\n      path: [\"url\", \"host\"],\n      operator: \"matches_host\",\n      value: host,\n    },\n  ];\n}\n\n/**\n * Build conditions that match an exact action run (with inputs).\n *\n * @returns Condition[] for an action permission statement\n */\nexport function buildExactActionConditions(\n  context: ActionRunContext,\n): Condition[] {\n  const conditions: Condition[] = [];\n\n  if (\n    context.inputs !== undefined &&\n    context.inputs !== null &&\n    typeof context.inputs === \"object\"\n  ) {\n    conditions.push({\n      path: [\"params\"],\n      operator: \"equals\",\n      value: context.inputs,\n    });\n  }\n\n  return conditions;\n}\n\n/**\n * Build the resource string for an action.\n * Format: action/{selected_api}/{action_type}/{action_key}\n */\nexport function buildActionResource(context: ActionRunContext): string {\n  return `action/${context.selected_api}/${context.action_type}/${context.action_key}`;\n}\n\n/**\n * Build a broad action resource that matches all actions for an app.\n * Format: action/{selected_api}/{wildcard}/{wildcard}\n */\nexport function buildBroadActionResource(context: ActionRunContext): string {\n  return `action/${context.selected_api}/*/*`;\n}\n","// ABOUTME: Assembles complete Policy objects from request contexts.\n// ABOUTME: Single source of truth for \"exact request\" instant policies used by web UI and API.\n\nimport type { Policy, Statement } from \"@zapier/policy-schema\";\nimport type {\n  RequestContext,\n  HttpRequestContext,\n  ActionRunContext,\n} from \"./types.ts\";\nimport {\n  buildExactHttpConditions,\n  buildExactActionConditions,\n  buildActionResource,\n} from \"./conditions.ts\";\n\n/**\n * Build a `can_use` authentication statement, if the context has a connection_id.\n */\nfunction buildAuthStatement(authenticationId: string): Statement {\n  return {\n    effect: \"allow\",\n    permissions: [\"can_use\"],\n    resources: [`authentication/${authenticationId}`],\n    conditions: [],\n  };\n}\n\n/**\n * Build an exact-match policy from an HTTP request context.\n *\n * Produces a policy that allows only the specific request described by the context:\n * - `can_use` statement for the authentication (if present)\n * - `can_execute` statement for `relay/http` with conditions from `buildExactHttpConditions`\n *   plus a `keys_in` guard restricting allowed query parameter keys\n */\nfunction httpContextToPolicy(context: HttpRequestContext): Policy {\n  const statements: Statement[] = [];\n\n  if (context.connection_id) {\n    statements.push(buildAuthStatement(context.connection_id));\n  }\n\n  const conditions = buildExactHttpConditions(context);\n\n  // Add a keys_in guard so only the query param keys present in the original\n  // request are allowed — blocks injection of extra query params.\n  try {\n    const queryKeys = [...new URL(context.url).searchParams.keys()];\n    const uniqueKeys = [...new Set(queryKeys)];\n    conditions.push({\n      path: [\"url\", \"query\"],\n      operator: \"keys_in\",\n      value: uniqueKeys,\n    });\n  } catch {\n    // If URL parsing fails, block all query params\n    conditions.push({\n      path: [\"url\", \"query\"],\n      operator: \"keys_in\",\n      value: [],\n    });\n  }\n\n  statements.push({\n    effect: \"allow\",\n    permissions: [\"can_execute\"],\n    resources: [\"relay/http\"],\n    conditions,\n  });\n\n  return { version: 2, statements };\n}\n\n/**\n * Build an exact-match policy from an action run context.\n *\n * Produces a policy that allows only the specific action described by the context:\n * - `can_use` statement for the authentication (if present)\n * - `can_execute` statement for the action resource with input conditions\n */\nfunction actionContextToPolicy(context: ActionRunContext): Policy {\n  const statements: Statement[] = [];\n\n  if (context.connection_id) {\n    statements.push(buildAuthStatement(context.connection_id));\n  }\n\n  statements.push({\n    effect: \"allow\",\n    permissions: [\"can_execute\"],\n    resources: [buildActionResource(context)],\n    conditions: buildExactActionConditions(context),\n  });\n\n  return { version: 2, statements };\n}\n\n/**\n * Build an exact-match policy from any supported request context.\n *\n * This is the single source of truth for \"allow this exact request\" instant policies.\n * Used by the web UI and anywhere else that needs to produce an exact policy from a context.\n */\nexport function toExactPolicy(context: RequestContext): Policy {\n  if (context.request_type === \"http_request\") {\n    return httpContextToPolicy(context);\n  }\n  return actionContextToPolicy(context);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACGA,iBAAkB;AAOX,IAAM,kBAAkB,aAAE,OAAkB;AAO5C,IAAM,2BAA2B,aAAE,OAAO;AAAA,EAC/C,cAAc,aAAE,QAAQ,cAAc;AAAA,EACtC,QAAQ,aAAE,OAAO;AAAA;AAAA,EAEjB,KAAK,aAAE,OAAO;AAAA;AAAA,EAEd,SAAS,aAAE,OAAO,aAAE,OAAO,GAAG,aAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,EAEnD,MAAM,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE1B,WAAW,gBAAgB,SAAS;AAAA;AAAA,EAEpC,eAAe,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEnC,QAAQ,aAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAQM,IAAM,yBAAyB,aAAE,OAAO;AAAA,EAC7C,cAAc,aAAE,QAAQ,YAAY;AAAA,EACpC,cAAc,aAAE,OAAO;AAAA,EACvB,aAAa,aAAE,OAAO;AAAA,EACtB,YAAY,aAAE,OAAO;AAAA,EACrB,eAAe,aAAE,OAAO,EAAE,SAAS;AAAA,EACnC,QAAQ,gBAAgB,SAAS;AAAA,EACjC,QAAQ,aAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAMM,IAAM,uBAAuB,aAAE,mBAAmB,gBAAgB;AAAA,EACvE;AAAA,EACA;AACF,CAAC;;;AC/CM,IAAM,kBAAkB,oBAAI,IAAI;AAAA;AAAA,EAErC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AACF,CAAC;;;ACrCD,IAAAA,cAAkB;AAUX,IAAM,uCAAuC,cAAE,OAAO;AAAA,EAC3D,QAAQ,cAAE,OAAO;AAAA;AAAA,EAEjB,KAAK,cAAE,OAAO;AAAA;AAAA,EAEd,SAAS,cACN;AAAA,IACC,cAAE,OAAO;AAAA,IACT,cAAE,MAAM,CAAC,cAAE,OAAO,GAAG,cAAE,MAAM,cAAE,OAAO,CAAC,GAAG,cAAE,UAAU,CAAC,CAAC;AAAA,EAC1D,EACC,SAAS;AAAA;AAAA,EAEZ,MAAM,cAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAErC,WAAW,gBAAgB,SAAS;AAAA;AAAA,EAEpC,eAAe,cAAE,OAAO,EAAE,SAAS;AACrC,CAAC;AAgBM,SAAS,wBACd,SACoB;AAEpB,QAAM,MAAM,QAAQ,IAAI,SAAS,KAAK,IAClC,QAAQ,MACR,WAAW,QAAQ,GAAG;AAG1B,QAAM,UAAkC,CAAC;AACzC,MAAI,QAAQ,SAAS;AACnB,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,OAAO,GAAG;AAC1D,YAAM,WAAW,IAAI,YAAY;AACjC,UAAI,CAAC,gBAAgB,IAAI,QAAQ,KAAK,OAAO,UAAU,UAAU;AAC/D,gBAAQ,QAAQ,IAAI;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAEA,SAAO,yBAAyB,MAAM;AAAA,IACpC,cAAc;AAAA,IACd,QAAQ,QAAQ;AAAA,IAChB;AAAA,IACA;AAAA,IACA,MAAM,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;AAAA,IACxD,WACE,OAAO,QAAQ,cAAc,YAAY,QAAQ,cAAc,OAC3D,QAAQ,YACR;AAAA,IACN,eAAe,QAAQ;AAAA,EACzB,CAAC;AACH;AAEO,IAAM,qCAAqC,cAAE,OAAO;AAAA,EACzD,cAAc,cAAE,OAAO;AAAA,EACvB,aAAa,cAAE,OAAO;AAAA,EACtB,YAAY,cAAE,OAAO;AAAA,EACrB,eAAe,cAAE,OAAO,EAAE,SAAS;AAAA,EACnC,QAAQ,gBAAgB,SAAS;AACnC,CAAC;AAQM,SAAS,sBACd,SACkB;AAClB,SAAO,uBAAuB,MAAM;AAAA,IAClC,cAAc;AAAA,IACd,cAAc,QAAQ;AAAA,IACtB,aAAa,QAAQ;AAAA,IACrB,YAAY,QAAQ;AAAA,IACpB,eAAe,QAAQ;AAAA,IACvB,QAAQ,QAAQ;AAAA,EAClB,CAAC;AACH;;;ACxFO,SAAS,yBACd,SACa;AACb,QAAM,aAA0B;AAAA,IAC9B,EAAE,MAAM,CAAC,QAAQ,GAAG,UAAU,UAAU,OAAO,QAAQ,OAAO;AAAA,EAChE;AAGA,MAAI;AACJ,MAAI;AACF,gBAAY,IAAI,IAAI,QAAQ,GAAG;AAAA,EACjC,QAAQ;AAEN,YAAQ;AAAA,MACN;AAAA,MACA,EAAE,KAAK,QAAQ,IAAI;AAAA,IACrB;AACA,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,KAAK;AAAA,MACZ,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AACD,WAAO;AAAA,EACT;AAGA,QAAM,kBAAkB,GAAG,UAAU,QAAQ,KAAK,UAAU,IAAI,GAAG,UAAU,QAAQ;AACrF,aAAW,KAAK;AAAA,IACd,MAAM,CAAC,KAAK;AAAA,IACZ,UAAU;AAAA,IACV,OAAO;AAAA,EACT,CAAC;AAID,QAAM,WAAW,oBAAI,IAAY;AACjC,aAAW,OAAO,UAAU,aAAa,KAAK,GAAG;AAC/C,QAAI,SAAS,IAAI,GAAG,EAAG;AACvB,aAAS,IAAI,GAAG;AAChB,UAAM,SAAS,UAAU,aAAa,OAAO,GAAG;AAChD,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,OAAO,SAAS,GAAG;AAAA,MAC1B,UAAU;AAAA,MACV,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AAGA,MAAI,QAAQ,cAAc,UAAa,QAAQ,cAAc,MAAM;AACjE,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,WAAW;AAAA,MAClB,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH;AAGA,MAAI,QAAQ,SAAS;AACnB,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,OAAO,GAAG;AAC1D,UACE,CAAC,gBAAgB,IAAI,IAAI,YAAY,CAAC,KACtC,OAAO,UAAU,UACjB;AACA,mBAAW,KAAK;AAAA,UACd,MAAM,CAAC,WAAW,IAAI,YAAY,CAAC;AAAA,UACnC,UAAU;AAAA,UACV;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAQO,SAAS,0BACd,SACoB;AACpB,MAAI;AACJ,MAAI;AACF,WAAO,IAAI,IAAI,QAAQ,GAAG,EAAE;AAAA,EAC9B,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL;AAAA,MACE,MAAM,CAAC,OAAO,MAAM;AAAA,MACpB,UAAU;AAAA,MACV,OAAO;AAAA,IACT;AAAA,EACF;AACF;AAOO,SAAS,2BACd,SACa;AACb,QAAM,aAA0B,CAAC;AAEjC,MACE,QAAQ,WAAW,UACnB,QAAQ,WAAW,QACnB,OAAO,QAAQ,WAAW,UAC1B;AACA,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,QAAQ;AAAA,MACf,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAMO,SAAS,oBAAoB,SAAmC;AACrE,SAAO,UAAU,QAAQ,YAAY,IAAI,QAAQ,WAAW,IAAI,QAAQ,UAAU;AACpF;AAMO,SAAS,yBAAyB,SAAmC;AAC1E,SAAO,UAAU,QAAQ,YAAY;AACvC;;;ACzIA,SAAS,mBAAmB,kBAAqC;AAC/D,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,aAAa,CAAC,SAAS;AAAA,IACvB,WAAW,CAAC,kBAAkB,gBAAgB,EAAE;AAAA,IAChD,YAAY,CAAC;AAAA,EACf;AACF;AAUA,SAAS,oBAAoB,SAAqC;AAChE,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,eAAe;AACzB,eAAW,KAAK,mBAAmB,QAAQ,aAAa,CAAC;AAAA,EAC3D;AAEA,QAAM,aAAa,yBAAyB,OAAO;AAInD,MAAI;AACF,UAAM,YAAY,CAAC,GAAG,IAAI,IAAI,QAAQ,GAAG,EAAE,aAAa,KAAK,CAAC;AAC9D,UAAM,aAAa,CAAC,GAAG,IAAI,IAAI,SAAS,CAAC;AACzC,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,OAAO,OAAO;AAAA,MACrB,UAAU;AAAA,MACV,OAAO;AAAA,IACT,CAAC;AAAA,EACH,QAAQ;AAEN,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,OAAO,OAAO;AAAA,MACrB,UAAU;AAAA,MACV,OAAO,CAAC;AAAA,IACV,CAAC;AAAA,EACH;AAEA,aAAW,KAAK;AAAA,IACd,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,YAAY;AAAA,IACxB;AAAA,EACF,CAAC;AAED,SAAO,EAAE,SAAS,GAAG,WAAW;AAClC;AASA,SAAS,sBAAsB,SAAmC;AAChE,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,eAAe;AACzB,eAAW,KAAK,mBAAmB,QAAQ,aAAa,CAAC;AAAA,EAC3D;AAEA,aAAW,KAAK;AAAA,IACd,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,oBAAoB,OAAO,CAAC;AAAA,IACxC,YAAY,2BAA2B,OAAO;AAAA,EAChD,CAAC;AAED,SAAO,EAAE,SAAS,GAAG,WAAW;AAClC;AAQO,SAAS,cAAc,SAAiC;AAC7D,MAAI,QAAQ,iBAAiB,gBAAgB;AAC3C,WAAO,oBAAoB,OAAO;AAAA,EACpC;AACA,SAAO,sBAAsB,OAAO;AACtC;","names":["import_zod"]}

package/dist/index.d.cts

@@ -0,0 +1,149 @@
+import { z } from 'zod';
+import * as _zapier_policy_schema from '@zapier/policy-schema';
+import { JsonValue, Condition, Policy } from '@zapier/policy-schema';
+
+/**
+ * Zod schema for arbitrary JSON values. Used across context schemas for
+ * unstructured fields like `body_json` and `inputs`.
+ */
+declare const JsonValueSchema: z.ZodCustom<JsonValue, JsonValue>;
+/**
+ * HTTP request context for approval/policy flows.
+ * Sent by sdkapi when a relay request is denied, stored by approvalsapi,
+ * and used to build policy conditions.
+ */
+declare const HttpRequestContextSchema: z.ZodObject<{
+    request_type: z.ZodLiteral<"http_request">;
+    method: z.ZodString;
+    url: z.ZodString;
+    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    body: z.ZodOptional<z.ZodString>;
+    body_json: z.ZodOptional<z.ZodCustom<JsonValue, JsonValue>>;
+    connection_id: z.ZodOptional<z.ZodString>;
+    reason: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type HttpRequestContext = z.infer<typeof HttpRequestContextSchema>;
+/**
+ * Action run context for approval/policy flows.
+ * Sent by sdkapi when an action run is denied, stored by approvalsapi,
+ * and used to build policy conditions.
+ */
+declare const ActionRunContextSchema: z.ZodObject<{
+    request_type: z.ZodLiteral<"action_run">;
+    selected_api: z.ZodString;
+    action_type: z.ZodString;
+    action_key: z.ZodString;
+    connection_id: z.ZodOptional<z.ZodString>;
+    inputs: z.ZodOptional<z.ZodCustom<JsonValue, JsonValue>>;
+    reason: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type ActionRunContext = z.infer<typeof ActionRunContextSchema>;
+/**
+ * Discriminated union of all request context types.
+ */
+declare const RequestContextSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    request_type: z.ZodLiteral<"http_request">;
+    method: z.ZodString;
+    url: z.ZodString;
+    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    body: z.ZodOptional<z.ZodString>;
+    body_json: z.ZodOptional<z.ZodCustom<JsonValue, JsonValue>>;
+    connection_id: z.ZodOptional<z.ZodString>;
+    reason: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    request_type: z.ZodLiteral<"action_run">;
+    selected_api: z.ZodString;
+    action_type: z.ZodString;
+    action_key: z.ZodString;
+    connection_id: z.ZodOptional<z.ZodString>;
+    inputs: z.ZodOptional<z.ZodCustom<JsonValue, JsonValue>>;
+    reason: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>], "request_type">;
+type RequestContext = z.infer<typeof RequestContextSchema>;
+
+/**
+ * Headers to exclude when building request contexts from raw HTTP requests.
+ *
+ * These are either sensitive (auth credentials), HTTP infrastructure headers
+ * that vary per-request, or proxy-internal headers that are not meaningful
+ * for policy decisions.
+ */
+declare const IGNORED_HEADERS: Set<string>;
+
+declare const BuildHttpRequestContextOptionsSchema: z.ZodObject<{
+    method: z.ZodString;
+    url: z.ZodString;
+    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>, z.ZodUndefined]>>>;
+    body: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    body_json: z.ZodOptional<z.ZodCustom<_zapier_policy_schema.JsonValue, _zapier_policy_schema.JsonValue>>;
+    connection_id: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type BuildHttpRequestContextOptions = z.infer<typeof BuildHttpRequestContextOptionsSchema>;
+/**
+ * Build a canonical HttpRequestContext from raw request parts.
+ *
+ * This is the single source of truth for how HTTP request contexts are created.
+ * Both sdkapi (for approval creation) and approvalsapi (for context storage)
+ * should use this to ensure the context shape is consistent.
+ *
+ * - Normalizes URL (adds https:// if missing)
+ * - Filters headers through IGNORED_HEADERS
+ * - Only includes string-valued headers (drops string[] values like set-cookie)
+ */
+declare function buildHttpRequestContext(options: BuildHttpRequestContextOptions): HttpRequestContext;
+declare const BuildActionRunContextOptionsSchema: z.ZodObject<{
+    selected_api: z.ZodString;
+    action_type: z.ZodString;
+    action_key: z.ZodString;
+    connection_id: z.ZodOptional<z.ZodString>;
+    inputs: z.ZodOptional<z.ZodCustom<_zapier_policy_schema.JsonValue, _zapier_policy_schema.JsonValue>>;
+}, z.core.$strip>;
+type BuildActionRunContextOptions = z.infer<typeof BuildActionRunContextOptionsSchema>;
+/**
+ * Build a canonical ActionRunContext from raw action parts.
+ */
+declare function buildActionRunContext(options: BuildActionRunContextOptions): ActionRunContext;
+
+/**
+ * Build conditions that match an exact HTTP request.
+ *
+ * Handles the matches_url / query param split correctly:
+ * - `matches_url` only supports scheme+host+port+path (no query string per spec)
+ * - Query parameters are added as separate decomposed conditions on `url.query.<key>`
+ *
+ * @returns Condition[] for a relay/http permission statement
+ */
+declare function buildExactHttpConditions(context: HttpRequestContext): Condition[];
+/**
+ * Build conditions that match any request to a given domain.
+ * Extracts the host from the context URL.
+ *
+ * @returns Condition[] for a relay/http permission statement, or null if URL is unparseable
+ */
+declare function buildDomainHttpConditions(context: HttpRequestContext): Condition[] | null;
+/**
+ * Build conditions that match an exact action run (with inputs).
+ *
+ * @returns Condition[] for an action permission statement
+ */
+declare function buildExactActionConditions(context: ActionRunContext): Condition[];
+/**
+ * Build the resource string for an action.
+ * Format: action/{selected_api}/{action_type}/{action_key}
+ */
+declare function buildActionResource(context: ActionRunContext): string;
+/**
+ * Build a broad action resource that matches all actions for an app.
+ * Format: action/{selected_api}/{wildcard}/{wildcard}
+ */
+declare function buildBroadActionResource(context: ActionRunContext): string;
+
+/**
+ * Build an exact-match policy from any supported request context.
+ *
+ * This is the single source of truth for "allow this exact request" instant policies.
+ * Used by the web UI and anywhere else that needs to produce an exact policy from a context.
+ */
+declare function toExactPolicy(context: RequestContext): Policy;
+
+export { type ActionRunContext, ActionRunContextSchema, type BuildActionRunContextOptions, BuildActionRunContextOptionsSchema, type BuildHttpRequestContextOptions, BuildHttpRequestContextOptionsSchema, type HttpRequestContext, HttpRequestContextSchema, IGNORED_HEADERS, JsonValueSchema, type RequestContext, RequestContextSchema, buildActionResource, buildActionRunContext, buildBroadActionResource, buildDomainHttpConditions, buildExactActionConditions, buildExactHttpConditions, buildHttpRequestContext, toExactPolicy };

package/dist/index.d.ts

@@ -0,0 +1,149 @@
+import { z } from 'zod';
+import * as _zapier_policy_schema from '@zapier/policy-schema';
+import { JsonValue, Condition, Policy } from '@zapier/policy-schema';
+
+/**
+ * Zod schema for arbitrary JSON values. Used across context schemas for
+ * unstructured fields like `body_json` and `inputs`.
+ */
+declare const JsonValueSchema: z.ZodCustom<JsonValue, JsonValue>;
+/**
+ * HTTP request context for approval/policy flows.
+ * Sent by sdkapi when a relay request is denied, stored by approvalsapi,
+ * and used to build policy conditions.
+ */
+declare const HttpRequestContextSchema: z.ZodObject<{
+    request_type: z.ZodLiteral<"http_request">;
+    method: z.ZodString;
+    url: z.ZodString;
+    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    body: z.ZodOptional<z.ZodString>;
+    body_json: z.ZodOptional<z.ZodCustom<JsonValue, JsonValue>>;
+    connection_id: z.ZodOptional<z.ZodString>;
+    reason: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type HttpRequestContext = z.infer<typeof HttpRequestContextSchema>;
+/**
+ * Action run context for approval/policy flows.
+ * Sent by sdkapi when an action run is denied, stored by approvalsapi,
+ * and used to build policy conditions.
+ */
+declare const ActionRunContextSchema: z.ZodObject<{
+    request_type: z.ZodLiteral<"action_run">;
+    selected_api: z.ZodString;
+    action_type: z.ZodString;
+    action_key: z.ZodString;
+    connection_id: z.ZodOptional<z.ZodString>;
+    inputs: z.ZodOptional<z.ZodCustom<JsonValue, JsonValue>>;
+    reason: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type ActionRunContext = z.infer<typeof ActionRunContextSchema>;
+/**
+ * Discriminated union of all request context types.
+ */
+declare const RequestContextSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    request_type: z.ZodLiteral<"http_request">;
+    method: z.ZodString;
+    url: z.ZodString;
+    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    body: z.ZodOptional<z.ZodString>;
+    body_json: z.ZodOptional<z.ZodCustom<JsonValue, JsonValue>>;
+    connection_id: z.ZodOptional<z.ZodString>;
+    reason: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    request_type: z.ZodLiteral<"action_run">;
+    selected_api: z.ZodString;
+    action_type: z.ZodString;
+    action_key: z.ZodString;
+    connection_id: z.ZodOptional<z.ZodString>;
+    inputs: z.ZodOptional<z.ZodCustom<JsonValue, JsonValue>>;
+    reason: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>], "request_type">;
+type RequestContext = z.infer<typeof RequestContextSchema>;
+
+/**
+ * Headers to exclude when building request contexts from raw HTTP requests.
+ *
+ * These are either sensitive (auth credentials), HTTP infrastructure headers
+ * that vary per-request, or proxy-internal headers that are not meaningful
+ * for policy decisions.
+ */
+declare const IGNORED_HEADERS: Set<string>;
+
+declare const BuildHttpRequestContextOptionsSchema: z.ZodObject<{
+    method: z.ZodString;
+    url: z.ZodString;
+    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>, z.ZodUndefined]>>>;
+    body: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    body_json: z.ZodOptional<z.ZodCustom<_zapier_policy_schema.JsonValue, _zapier_policy_schema.JsonValue>>;
+    connection_id: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type BuildHttpRequestContextOptions = z.infer<typeof BuildHttpRequestContextOptionsSchema>;
+/**
+ * Build a canonical HttpRequestContext from raw request parts.
+ *
+ * This is the single source of truth for how HTTP request contexts are created.
+ * Both sdkapi (for approval creation) and approvalsapi (for context storage)
+ * should use this to ensure the context shape is consistent.
+ *
+ * - Normalizes URL (adds https:// if missing)
+ * - Filters headers through IGNORED_HEADERS
+ * - Only includes string-valued headers (drops string[] values like set-cookie)
+ */
+declare function buildHttpRequestContext(options: BuildHttpRequestContextOptions): HttpRequestContext;
+declare const BuildActionRunContextOptionsSchema: z.ZodObject<{
+    selected_api: z.ZodString;
+    action_type: z.ZodString;
+    action_key: z.ZodString;
+    connection_id: z.ZodOptional<z.ZodString>;
+    inputs: z.ZodOptional<z.ZodCustom<_zapier_policy_schema.JsonValue, _zapier_policy_schema.JsonValue>>;
+}, z.core.$strip>;
+type BuildActionRunContextOptions = z.infer<typeof BuildActionRunContextOptionsSchema>;
+/**
+ * Build a canonical ActionRunContext from raw action parts.
+ */
+declare function buildActionRunContext(options: BuildActionRunContextOptions): ActionRunContext;
+
+/**
+ * Build conditions that match an exact HTTP request.
+ *
+ * Handles the matches_url / query param split correctly:
+ * - `matches_url` only supports scheme+host+port+path (no query string per spec)
+ * - Query parameters are added as separate decomposed conditions on `url.query.<key>`
+ *
+ * @returns Condition[] for a relay/http permission statement
+ */
+declare function buildExactHttpConditions(context: HttpRequestContext): Condition[];
+/**
+ * Build conditions that match any request to a given domain.
+ * Extracts the host from the context URL.
+ *
+ * @returns Condition[] for a relay/http permission statement, or null if URL is unparseable
+ */
+declare function buildDomainHttpConditions(context: HttpRequestContext): Condition[] | null;
+/**
+ * Build conditions that match an exact action run (with inputs).
+ *
+ * @returns Condition[] for an action permission statement
+ */
+declare function buildExactActionConditions(context: ActionRunContext): Condition[];
+/**
+ * Build the resource string for an action.
+ * Format: action/{selected_api}/{action_type}/{action_key}
+ */
+declare function buildActionResource(context: ActionRunContext): string;
+/**
+ * Build a broad action resource that matches all actions for an app.
+ * Format: action/{selected_api}/{wildcard}/{wildcard}
+ */
+declare function buildBroadActionResource(context: ActionRunContext): string;
+
+/**
+ * Build an exact-match policy from any supported request context.
+ *
+ * This is the single source of truth for "allow this exact request" instant policies.
+ * Used by the web UI and anywhere else that needs to produce an exact policy from a context.
+ */
+declare function toExactPolicy(context: RequestContext): Policy;
+
+export { type ActionRunContext, ActionRunContextSchema, type BuildActionRunContextOptions, BuildActionRunContextOptionsSchema, type BuildHttpRequestContextOptions, BuildHttpRequestContextOptionsSchema, type HttpRequestContext, HttpRequestContextSchema, IGNORED_HEADERS, JsonValueSchema, type RequestContext, RequestContextSchema, buildActionResource, buildActionRunContext, buildBroadActionResource, buildDomainHttpConditions, buildExactActionConditions, buildExactHttpConditions, buildHttpRequestContext, toExactPolicy };

package/dist/index.js

@@ -0,0 +1,285 @@
+// src/types.ts
+import { z } from "zod";
+var JsonValueSchema = z.custom();
+var HttpRequestContextSchema = z.object({
+  request_type: z.literal("http_request"),
+  method: z.string(),
+  /** Full URL including query string, e.g. "https://api.example.com/v1/foo?bar=baz" */
+  url: z.string(),
+  /** Filtered headers (IGNORED_HEADERS excluded, keys lowercased) */
+  headers: z.record(z.string(), z.string()).optional(),
+  /** Raw body string */
+  body: z.string().optional(),
+  /** Parsed JSON body */
+  body_json: JsonValueSchema.optional(),
+  /** Zapier connection ID used for this request */
+  connection_id: z.string().optional(),
+  /** Optional human-readable reason for the request */
+  reason: z.string().optional()
+});
+var ActionRunContextSchema = z.object({
+  request_type: z.literal("action_run"),
+  selected_api: z.string(),
+  action_type: z.string(),
+  action_key: z.string(),
+  connection_id: z.string().optional(),
+  inputs: JsonValueSchema.optional(),
+  reason: z.string().optional()
+});
+var RequestContextSchema = z.discriminatedUnion("request_type", [
+  HttpRequestContextSchema,
+  ActionRunContextSchema
+]);
+
+// src/constants.ts
+var IGNORED_HEADERS = /* @__PURE__ */ new Set([
+  // Auth / credentials — never include in contexts or policy conditions
+  "authorization",
+  "x-relay-authorization",
+  "x-relay-authentication-id",
+  "x-api-key",
+  "cookie",
+  "set-cookie",
+  "proxy-authorization",
+  // HTTP infrastructure — varies per-request, not policy-relevant
+  "host",
+  "connection",
+  "content-length",
+  "transfer-encoding",
+  "accept-encoding",
+  "user-agent",
+  "accept",
+  "accept-language",
+  "sec-fetch-mode",
+  // Proxy / forwarding — infrastructure, not meaningful for policy
+  "x-forwarded-for",
+  "x-forwarded-host",
+  "x-forwarded-proto",
+  "x-real-ip",
+  // Proxy internal — sdkapi-specific headers
+  "x-is-interactive-session",
+  "x-relay-callback-url"
+]);
+
+// src/builders.ts
+import { z as z2 } from "zod";
+var BuildHttpRequestContextOptionsSchema = z2.object({
+  method: z2.string(),
+  /** Raw URL string. Will be normalized with https:// if no protocol present. */
+  url: z2.string(),
+  /** Raw headers from the request. Will be filtered through IGNORED_HEADERS. */
+  headers: z2.record(
+    z2.string(),
+    z2.union([z2.string(), z2.array(z2.string()), z2.undefined()])
+  ).optional(),
+  /** Raw body string */
+  body: z2.string().nullable().optional(),
+  /** Pre-parsed JSON body (e.g. from Fastify's automatic JSON parsing) */
+  body_json: JsonValueSchema.optional(),
+  /** Connection ID associated with this request */
+  connection_id: z2.string().optional()
+});
+function buildHttpRequestContext(options) {
+  const url = options.url.includes("://") ? options.url : `https://${options.url}`;
+  const headers = {};
+  if (options.headers) {
+    for (const [key, value] of Object.entries(options.headers)) {
+      const lowerKey = key.toLowerCase();
+      if (!IGNORED_HEADERS.has(lowerKey) && typeof value === "string") {
+        headers[lowerKey] = value;
+      }
+    }
+  }
+  return HttpRequestContextSchema.parse({
+    request_type: "http_request",
+    method: options.method,
+    url,
+    headers,
+    body: typeof options.body === "string" ? options.body : void 0,
+    body_json: typeof options.body_json === "object" && options.body_json !== null ? options.body_json : void 0,
+    connection_id: options.connection_id
+  });
+}
+var BuildActionRunContextOptionsSchema = z2.object({
+  selected_api: z2.string(),
+  action_type: z2.string(),
+  action_key: z2.string(),
+  connection_id: z2.string().optional(),
+  inputs: JsonValueSchema.optional()
+});
+function buildActionRunContext(options) {
+  return ActionRunContextSchema.parse({
+    request_type: "action_run",
+    selected_api: options.selected_api,
+    action_type: options.action_type,
+    action_key: options.action_key,
+    connection_id: options.connection_id,
+    inputs: options.inputs
+  });
+}
+
+// src/conditions.ts
+function buildExactHttpConditions(context) {
+  const conditions = [
+    { path: ["method"], operator: "equals", value: context.method }
+  ];
+  let parsedUrl;
+  try {
+    parsedUrl = new URL(context.url);
+  } catch {
+    console.debug(
+      "buildExactHttpConditions: unparseable URL, using raw value",
+      { url: context.url }
+    );
+    conditions.push({
+      path: ["url"],
+      operator: "matches_url",
+      value: context.url
+    });
+    return conditions;
+  }
+  const urlWithoutQuery = `${parsedUrl.protocol}//${parsedUrl.host}${parsedUrl.pathname}`;
+  conditions.push({
+    path: ["url"],
+    operator: "matches_url",
+    value: urlWithoutQuery
+  });
+  const seenKeys = /* @__PURE__ */ new Set();
+  for (const key of parsedUrl.searchParams.keys()) {
+    if (seenKeys.has(key)) continue;
+    seenKeys.add(key);
+    const values = parsedUrl.searchParams.getAll(key);
+    conditions.push({
+      path: ["url", "query", key],
+      operator: "equals",
+      value: values
+    });
+  }
+  if (context.body_json !== void 0 && context.body_json !== null) {
+    conditions.push({
+      path: ["body_json"],
+      operator: "equals",
+      value: context.body_json
+    });
+  }
+  if (context.headers) {
+    for (const [key, value] of Object.entries(context.headers)) {
+      if (!IGNORED_HEADERS.has(key.toLowerCase()) && typeof value === "string") {
+        conditions.push({
+          path: ["headers", key.toLowerCase()],
+          operator: "equals",
+          value
+        });
+      }
+    }
+  }
+  return conditions;
+}
+function buildDomainHttpConditions(context) {
+  let host;
+  try {
+    host = new URL(context.url).host;
+  } catch {
+    return null;
+  }
+  return [
+    {
+      path: ["url", "host"],
+      operator: "matches_host",
+      value: host
+    }
+  ];
+}
+function buildExactActionConditions(context) {
+  const conditions = [];
+  if (context.inputs !== void 0 && context.inputs !== null && typeof context.inputs === "object") {
+    conditions.push({
+      path: ["params"],
+      operator: "equals",
+      value: context.inputs
+    });
+  }
+  return conditions;
+}
+function buildActionResource(context) {
+  return `action/${context.selected_api}/${context.action_type}/${context.action_key}`;
+}
+function buildBroadActionResource(context) {
+  return `action/${context.selected_api}/*/*`;
+}
+
+// src/policies.ts
+function buildAuthStatement(authenticationId) {
+  return {
+    effect: "allow",
+    permissions: ["can_use"],
+    resources: [`authentication/${authenticationId}`],
+    conditions: []
+  };
+}
+function httpContextToPolicy(context) {
+  const statements = [];
+  if (context.connection_id) {
+    statements.push(buildAuthStatement(context.connection_id));
+  }
+  const conditions = buildExactHttpConditions(context);
+  try {
+    const queryKeys = [...new URL(context.url).searchParams.keys()];
+    const uniqueKeys = [...new Set(queryKeys)];
+    conditions.push({
+      path: ["url", "query"],
+      operator: "keys_in",
+      value: uniqueKeys
+    });
+  } catch {
+    conditions.push({
+      path: ["url", "query"],
+      operator: "keys_in",
+      value: []
+    });
+  }
+  statements.push({
+    effect: "allow",
+    permissions: ["can_execute"],
+    resources: ["relay/http"],
+    conditions
+  });
+  return { version: 2, statements };
+}
+function actionContextToPolicy(context) {
+  const statements = [];
+  if (context.connection_id) {
+    statements.push(buildAuthStatement(context.connection_id));
+  }
+  statements.push({
+    effect: "allow",
+    permissions: ["can_execute"],
+    resources: [buildActionResource(context)],
+    conditions: buildExactActionConditions(context)
+  });
+  return { version: 2, statements };
+}
+function toExactPolicy(context) {
+  if (context.request_type === "http_request") {
+    return httpContextToPolicy(context);
+  }
+  return actionContextToPolicy(context);
+}
+export {
+  ActionRunContextSchema,
+  BuildActionRunContextOptionsSchema,
+  BuildHttpRequestContextOptionsSchema,
+  HttpRequestContextSchema,
+  IGNORED_HEADERS,
+  JsonValueSchema,
+  RequestContextSchema,
+  buildActionResource,
+  buildActionRunContext,
+  buildBroadActionResource,
+  buildDomainHttpConditions,
+  buildExactActionConditions,
+  buildExactHttpConditions,
+  buildHttpRequestContext,
+  toExactPolicy
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/types.ts","../src/constants.ts","../src/builders.ts","../src/conditions.ts","../src/policies.ts"],"sourcesContent":["// ABOUTME: Canonical request context types shared between sdkapi and approvalsapi.\n// ABOUTME: These define the contract for how requests are described in approval flows and policy evaluation.\n\nimport { z } from \"zod\";\nimport type { JsonValue } from \"@zapier/policy-schema\";\n\n/**\n * Zod schema for arbitrary JSON values. Used across context schemas for\n * unstructured fields like `body_json` and `inputs`.\n */\nexport const JsonValueSchema = z.custom<JsonValue>();\n\n/**\n * HTTP request context for approval/policy flows.\n * Sent by sdkapi when a relay request is denied, stored by approvalsapi,\n * and used to build policy conditions.\n */\nexport const HttpRequestContextSchema = z.object({\n  request_type: z.literal(\"http_request\"),\n  method: z.string(),\n  /** Full URL including query string, e.g. \"https://api.example.com/v1/foo?bar=baz\" */\n  url: z.string(),\n  /** Filtered headers (IGNORED_HEADERS excluded, keys lowercased) */\n  headers: z.record(z.string(), z.string()).optional(),\n  /** Raw body string */\n  body: z.string().optional(),\n  /** Parsed JSON body */\n  body_json: JsonValueSchema.optional(),\n  /** Zapier connection ID used for this request */\n  connection_id: z.string().optional(),\n  /** Optional human-readable reason for the request */\n  reason: z.string().optional(),\n});\nexport type HttpRequestContext = z.infer<typeof HttpRequestContextSchema>;\n\n/**\n * Action run context for approval/policy flows.\n * Sent by sdkapi when an action run is denied, stored by approvalsapi,\n * and used to build policy conditions.\n */\nexport const ActionRunContextSchema = z.object({\n  request_type: z.literal(\"action_run\"),\n  selected_api: z.string(),\n  action_type: z.string(),\n  action_key: z.string(),\n  connection_id: z.string().optional(),\n  inputs: JsonValueSchema.optional(),\n  reason: z.string().optional(),\n});\nexport type ActionRunContext = z.infer<typeof ActionRunContextSchema>;\n\n/**\n * Discriminated union of all request context types.\n */\nexport const RequestContextSchema = z.discriminatedUnion(\"request_type\", [\n  HttpRequestContextSchema,\n  ActionRunContextSchema,\n]);\nexport type RequestContext = z.infer<typeof RequestContextSchema>;\n","// ABOUTME: Canonical set of headers to exclude when building request contexts.\n// ABOUTME: Shared between sdkapi (context creation) and approvalsapi (condition building).\n\n/**\n * Headers to exclude when building request contexts from raw HTTP requests.\n *\n * These are either sensitive (auth credentials), HTTP infrastructure headers\n * that vary per-request, or proxy-internal headers that are not meaningful\n * for policy decisions.\n */\nexport const IGNORED_HEADERS = new Set([\n  // Auth / credentials — never include in contexts or policy conditions\n  \"authorization\",\n  \"x-relay-authorization\",\n  \"x-relay-authentication-id\",\n  \"x-api-key\",\n  \"cookie\",\n  \"set-cookie\",\n  \"proxy-authorization\",\n\n  // HTTP infrastructure — varies per-request, not policy-relevant\n  \"host\",\n  \"connection\",\n  \"content-length\",\n  \"transfer-encoding\",\n  \"accept-encoding\",\n  \"user-agent\",\n  \"accept\",\n  \"accept-language\",\n  \"sec-fetch-mode\",\n\n  // Proxy / forwarding — infrastructure, not meaningful for policy\n  \"x-forwarded-for\",\n  \"x-forwarded-host\",\n  \"x-forwarded-proto\",\n  \"x-real-ip\",\n\n  // Proxy internal — sdkapi-specific headers\n  \"x-is-interactive-session\",\n  \"x-relay-callback-url\",\n]);\n","// ABOUTME: Canonical builders for creating request contexts from raw request parts.\n// ABOUTME: Used by sdkapi to build both approval contexts and policy eval contexts.\n\nimport { z } from \"zod\";\nimport {\n  HttpRequestContextSchema,\n  ActionRunContextSchema,\n  JsonValueSchema,\n  type HttpRequestContext,\n  type ActionRunContext,\n} from \"./types.ts\";\nimport { IGNORED_HEADERS } from \"./constants.ts\";\n\nexport const BuildHttpRequestContextOptionsSchema = z.object({\n  method: z.string(),\n  /** Raw URL string. Will be normalized with https:// if no protocol present. */\n  url: z.string(),\n  /** Raw headers from the request. Will be filtered through IGNORED_HEADERS. */\n  headers: z\n    .record(\n      z.string(),\n      z.union([z.string(), z.array(z.string()), z.undefined()]),\n    )\n    .optional(),\n  /** Raw body string */\n  body: z.string().nullable().optional(),\n  /** Pre-parsed JSON body (e.g. from Fastify's automatic JSON parsing) */\n  body_json: JsonValueSchema.optional(),\n  /** Connection ID associated with this request */\n  connection_id: z.string().optional(),\n});\nexport type BuildHttpRequestContextOptions = z.infer<\n  typeof BuildHttpRequestContextOptionsSchema\n>;\n\n/**\n * Build a canonical HttpRequestContext from raw request parts.\n *\n * This is the single source of truth for how HTTP request contexts are created.\n * Both sdkapi (for approval creation) and approvalsapi (for context storage)\n * should use this to ensure the context shape is consistent.\n *\n * - Normalizes URL (adds https:// if missing)\n * - Filters headers through IGNORED_HEADERS\n * - Only includes string-valued headers (drops string[] values like set-cookie)\n */\nexport function buildHttpRequestContext(\n  options: BuildHttpRequestContextOptions,\n): HttpRequestContext {\n  // Normalize URL — SDK CLI strips the protocol\n  const url = options.url.includes(\"://\")\n    ? options.url\n    : `https://${options.url}`;\n\n  // Filter headers: exclude ignored, lowercase keys, string values only\n  const headers: Record<string, string> = {};\n  if (options.headers) {\n    for (const [key, value] of Object.entries(options.headers)) {\n      const lowerKey = key.toLowerCase();\n      if (!IGNORED_HEADERS.has(lowerKey) && typeof value === \"string\") {\n        headers[lowerKey] = value;\n      }\n    }\n  }\n\n  return HttpRequestContextSchema.parse({\n    request_type: \"http_request\",\n    method: options.method,\n    url,\n    headers,\n    body: typeof options.body === \"string\" ? options.body : undefined,\n    body_json:\n      typeof options.body_json === \"object\" && options.body_json !== null\n        ? options.body_json\n        : undefined,\n    connection_id: options.connection_id,\n  });\n}\n\nexport const BuildActionRunContextOptionsSchema = z.object({\n  selected_api: z.string(),\n  action_type: z.string(),\n  action_key: z.string(),\n  connection_id: z.string().optional(),\n  inputs: JsonValueSchema.optional(),\n});\nexport type BuildActionRunContextOptions = z.infer<\n  typeof BuildActionRunContextOptionsSchema\n>;\n\n/**\n * Build a canonical ActionRunContext from raw action parts.\n */\nexport function buildActionRunContext(\n  options: BuildActionRunContextOptions,\n): ActionRunContext {\n  return ActionRunContextSchema.parse({\n    request_type: \"action_run\",\n    selected_api: options.selected_api,\n    action_type: options.action_type,\n    action_key: options.action_key,\n    connection_id: options.connection_id,\n    inputs: options.inputs,\n  });\n}\n","// ABOUTME: Builds policy conditions from stored request contexts.\n// ABOUTME: Used by approvalsapi's \"allow exact request\" and \"allow domain\" instant policy flows.\n\nimport type { Condition } from \"@zapier/policy-schema\";\nimport type { HttpRequestContext, ActionRunContext } from \"./types.ts\";\nimport { IGNORED_HEADERS } from \"./constants.ts\";\n\n/**\n * Build conditions that match an exact HTTP request.\n *\n * Handles the matches_url / query param split correctly:\n * - `matches_url` only supports scheme+host+port+path (no query string per spec)\n * - Query parameters are added as separate decomposed conditions on `url.query.<key>`\n *\n * @returns Condition[] for a relay/http permission statement\n */\nexport function buildExactHttpConditions(\n  context: HttpRequestContext,\n): Condition[] {\n  const conditions: Condition[] = [\n    { path: [\"method\"], operator: \"equals\", value: context.method },\n  ];\n\n  // Parse the URL to separate path from query params\n  let parsedUrl: URL;\n  try {\n    parsedUrl = new URL(context.url);\n  } catch {\n    // URL is unparseable — use it as-is (will fail matches_url, but that's correct)\n    console.debug(\n      \"buildExactHttpConditions: unparseable URL, using raw value\",\n      { url: context.url },\n    );\n    conditions.push({\n      path: [\"url\"],\n      operator: \"matches_url\",\n      value: context.url,\n    });\n    return conditions;\n  }\n\n  // matches_url condition uses URL without query string (per @zapier/policy spec)\n  const urlWithoutQuery = `${parsedUrl.protocol}//${parsedUrl.host}${parsedUrl.pathname}`;\n  conditions.push({\n    path: [\"url\"],\n    operator: \"matches_url\",\n    value: urlWithoutQuery,\n  });\n\n  // Add decomposed conditions for each query parameter.\n  // Use getAll to properly handle multi-value params (e.g. ?tag=a&tag=b → [\"a\", \"b\"]).\n  const seenKeys = new Set<string>();\n  for (const key of parsedUrl.searchParams.keys()) {\n    if (seenKeys.has(key)) continue;\n    seenKeys.add(key);\n    const values = parsedUrl.searchParams.getAll(key);\n    conditions.push({\n      path: [\"url\", \"query\", key],\n      operator: \"equals\",\n      value: values,\n    });\n  }\n\n  // body_json condition\n  if (context.body_json !== undefined && context.body_json !== null) {\n    conditions.push({\n      path: [\"body_json\"],\n      operator: \"equals\",\n      value: context.body_json,\n    });\n  }\n\n  // Header conditions (filtered through IGNORED_HEADERS again for safety)\n  if (context.headers) {\n    for (const [key, value] of Object.entries(context.headers)) {\n      if (\n        !IGNORED_HEADERS.has(key.toLowerCase()) &&\n        typeof value === \"string\"\n      ) {\n        conditions.push({\n          path: [\"headers\", key.toLowerCase()],\n          operator: \"equals\",\n          value,\n        });\n      }\n    }\n  }\n\n  return conditions;\n}\n\n/**\n * Build conditions that match any request to a given domain.\n * Extracts the host from the context URL.\n *\n * @returns Condition[] for a relay/http permission statement, or null if URL is unparseable\n */\nexport function buildDomainHttpConditions(\n  context: HttpRequestContext,\n): Condition[] | null {\n  let host: string;\n  try {\n    host = new URL(context.url).host;\n  } catch {\n    return null;\n  }\n\n  return [\n    {\n      path: [\"url\", \"host\"],\n      operator: \"matches_host\",\n      value: host,\n    },\n  ];\n}\n\n/**\n * Build conditions that match an exact action run (with inputs).\n *\n * @returns Condition[] for an action permission statement\n */\nexport function buildExactActionConditions(\n  context: ActionRunContext,\n): Condition[] {\n  const conditions: Condition[] = [];\n\n  if (\n    context.inputs !== undefined &&\n    context.inputs !== null &&\n    typeof context.inputs === \"object\"\n  ) {\n    conditions.push({\n      path: [\"params\"],\n      operator: \"equals\",\n      value: context.inputs,\n    });\n  }\n\n  return conditions;\n}\n\n/**\n * Build the resource string for an action.\n * Format: action/{selected_api}/{action_type}/{action_key}\n */\nexport function buildActionResource(context: ActionRunContext): string {\n  return `action/${context.selected_api}/${context.action_type}/${context.action_key}`;\n}\n\n/**\n * Build a broad action resource that matches all actions for an app.\n * Format: action/{selected_api}/{wildcard}/{wildcard}\n */\nexport function buildBroadActionResource(context: ActionRunContext): string {\n  return `action/${context.selected_api}/*/*`;\n}\n","// ABOUTME: Assembles complete Policy objects from request contexts.\n// ABOUTME: Single source of truth for \"exact request\" instant policies used by web UI and API.\n\nimport type { Policy, Statement } from \"@zapier/policy-schema\";\nimport type {\n  RequestContext,\n  HttpRequestContext,\n  ActionRunContext,\n} from \"./types.ts\";\nimport {\n  buildExactHttpConditions,\n  buildExactActionConditions,\n  buildActionResource,\n} from \"./conditions.ts\";\n\n/**\n * Build a `can_use` authentication statement, if the context has a connection_id.\n */\nfunction buildAuthStatement(authenticationId: string): Statement {\n  return {\n    effect: \"allow\",\n    permissions: [\"can_use\"],\n    resources: [`authentication/${authenticationId}`],\n    conditions: [],\n  };\n}\n\n/**\n * Build an exact-match policy from an HTTP request context.\n *\n * Produces a policy that allows only the specific request described by the context:\n * - `can_use` statement for the authentication (if present)\n * - `can_execute` statement for `relay/http` with conditions from `buildExactHttpConditions`\n *   plus a `keys_in` guard restricting allowed query parameter keys\n */\nfunction httpContextToPolicy(context: HttpRequestContext): Policy {\n  const statements: Statement[] = [];\n\n  if (context.connection_id) {\n    statements.push(buildAuthStatement(context.connection_id));\n  }\n\n  const conditions = buildExactHttpConditions(context);\n\n  // Add a keys_in guard so only the query param keys present in the original\n  // request are allowed — blocks injection of extra query params.\n  try {\n    const queryKeys = [...new URL(context.url).searchParams.keys()];\n    const uniqueKeys = [...new Set(queryKeys)];\n    conditions.push({\n      path: [\"url\", \"query\"],\n      operator: \"keys_in\",\n      value: uniqueKeys,\n    });\n  } catch {\n    // If URL parsing fails, block all query params\n    conditions.push({\n      path: [\"url\", \"query\"],\n      operator: \"keys_in\",\n      value: [],\n    });\n  }\n\n  statements.push({\n    effect: \"allow\",\n    permissions: [\"can_execute\"],\n    resources: [\"relay/http\"],\n    conditions,\n  });\n\n  return { version: 2, statements };\n}\n\n/**\n * Build an exact-match policy from an action run context.\n *\n * Produces a policy that allows only the specific action described by the context:\n * - `can_use` statement for the authentication (if present)\n * - `can_execute` statement for the action resource with input conditions\n */\nfunction actionContextToPolicy(context: ActionRunContext): Policy {\n  const statements: Statement[] = [];\n\n  if (context.connection_id) {\n    statements.push(buildAuthStatement(context.connection_id));\n  }\n\n  statements.push({\n    effect: \"allow\",\n    permissions: [\"can_execute\"],\n    resources: [buildActionResource(context)],\n    conditions: buildExactActionConditions(context),\n  });\n\n  return { version: 2, statements };\n}\n\n/**\n * Build an exact-match policy from any supported request context.\n *\n * This is the single source of truth for \"allow this exact request\" instant policies.\n * Used by the web UI and anywhere else that needs to produce an exact policy from a context.\n */\nexport function toExactPolicy(context: RequestContext): Policy {\n  if (context.request_type === \"http_request\") {\n    return httpContextToPolicy(context);\n  }\n  return actionContextToPolicy(context);\n}\n"],"mappings":";AAGA,SAAS,SAAS;AAOX,IAAM,kBAAkB,EAAE,OAAkB;AAO5C,IAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,cAAc,EAAE,QAAQ,cAAc;AAAA,EACtC,QAAQ,EAAE,OAAO;AAAA;AAAA,EAEjB,KAAK,EAAE,OAAO;AAAA;AAAA,EAEd,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,EAEnD,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE1B,WAAW,gBAAgB,SAAS;AAAA;AAAA,EAEpC,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEnC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAQM,IAAM,yBAAyB,EAAE,OAAO;AAAA,EAC7C,cAAc,EAAE,QAAQ,YAAY;AAAA,EACpC,cAAc,EAAE,OAAO;AAAA,EACvB,aAAa,EAAE,OAAO;AAAA,EACtB,YAAY,EAAE,OAAO;AAAA,EACrB,eAAe,EAAE,OAAO,EAAE,SAAS;AAAA,EACnC,QAAQ,gBAAgB,SAAS;AAAA,EACjC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAMM,IAAM,uBAAuB,EAAE,mBAAmB,gBAAgB;AAAA,EACvE;AAAA,EACA;AACF,CAAC;;;AC/CM,IAAM,kBAAkB,oBAAI,IAAI;AAAA;AAAA,EAErC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AACF,CAAC;;;ACrCD,SAAS,KAAAA,UAAS;AAUX,IAAM,uCAAuCC,GAAE,OAAO;AAAA,EAC3D,QAAQA,GAAE,OAAO;AAAA;AAAA,EAEjB,KAAKA,GAAE,OAAO;AAAA;AAAA,EAEd,SAASA,GACN;AAAA,IACCA,GAAE,OAAO;AAAA,IACTA,GAAE,MAAM,CAACA,GAAE,OAAO,GAAGA,GAAE,MAAMA,GAAE,OAAO,CAAC,GAAGA,GAAE,UAAU,CAAC,CAAC;AAAA,EAC1D,EACC,SAAS;AAAA;AAAA,EAEZ,MAAMA,GAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAErC,WAAW,gBAAgB,SAAS;AAAA;AAAA,EAEpC,eAAeA,GAAE,OAAO,EAAE,SAAS;AACrC,CAAC;AAgBM,SAAS,wBACd,SACoB;AAEpB,QAAM,MAAM,QAAQ,IAAI,SAAS,KAAK,IAClC,QAAQ,MACR,WAAW,QAAQ,GAAG;AAG1B,QAAM,UAAkC,CAAC;AACzC,MAAI,QAAQ,SAAS;AACnB,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,OAAO,GAAG;AAC1D,YAAM,WAAW,IAAI,YAAY;AACjC,UAAI,CAAC,gBAAgB,IAAI,QAAQ,KAAK,OAAO,UAAU,UAAU;AAC/D,gBAAQ,QAAQ,IAAI;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAEA,SAAO,yBAAyB,MAAM;AAAA,IACpC,cAAc;AAAA,IACd,QAAQ,QAAQ;AAAA,IAChB;AAAA,IACA;AAAA,IACA,MAAM,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;AAAA,IACxD,WACE,OAAO,QAAQ,cAAc,YAAY,QAAQ,cAAc,OAC3D,QAAQ,YACR;AAAA,IACN,eAAe,QAAQ;AAAA,EACzB,CAAC;AACH;AAEO,IAAM,qCAAqCA,GAAE,OAAO;AAAA,EACzD,cAAcA,GAAE,OAAO;AAAA,EACvB,aAAaA,GAAE,OAAO;AAAA,EACtB,YAAYA,GAAE,OAAO;AAAA,EACrB,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA,EACnC,QAAQ,gBAAgB,SAAS;AACnC,CAAC;AAQM,SAAS,sBACd,SACkB;AAClB,SAAO,uBAAuB,MAAM;AAAA,IAClC,cAAc;AAAA,IACd,cAAc,QAAQ;AAAA,IACtB,aAAa,QAAQ;AAAA,IACrB,YAAY,QAAQ;AAAA,IACpB,eAAe,QAAQ;AAAA,IACvB,QAAQ,QAAQ;AAAA,EAClB,CAAC;AACH;;;ACxFO,SAAS,yBACd,SACa;AACb,QAAM,aAA0B;AAAA,IAC9B,EAAE,MAAM,CAAC,QAAQ,GAAG,UAAU,UAAU,OAAO,QAAQ,OAAO;AAAA,EAChE;AAGA,MAAI;AACJ,MAAI;AACF,gBAAY,IAAI,IAAI,QAAQ,GAAG;AAAA,EACjC,QAAQ;AAEN,YAAQ;AAAA,MACN;AAAA,MACA,EAAE,KAAK,QAAQ,IAAI;AAAA,IACrB;AACA,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,KAAK;AAAA,MACZ,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AACD,WAAO;AAAA,EACT;AAGA,QAAM,kBAAkB,GAAG,UAAU,QAAQ,KAAK,UAAU,IAAI,GAAG,UAAU,QAAQ;AACrF,aAAW,KAAK;AAAA,IACd,MAAM,CAAC,KAAK;AAAA,IACZ,UAAU;AAAA,IACV,OAAO;AAAA,EACT,CAAC;AAID,QAAM,WAAW,oBAAI,IAAY;AACjC,aAAW,OAAO,UAAU,aAAa,KAAK,GAAG;AAC/C,QAAI,SAAS,IAAI,GAAG,EAAG;AACvB,aAAS,IAAI,GAAG;AAChB,UAAM,SAAS,UAAU,aAAa,OAAO,GAAG;AAChD,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,OAAO,SAAS,GAAG;AAAA,MAC1B,UAAU;AAAA,MACV,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AAGA,MAAI,QAAQ,cAAc,UAAa,QAAQ,cAAc,MAAM;AACjE,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,WAAW;AAAA,MAClB,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH;AAGA,MAAI,QAAQ,SAAS;AACnB,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,OAAO,GAAG;AAC1D,UACE,CAAC,gBAAgB,IAAI,IAAI,YAAY,CAAC,KACtC,OAAO,UAAU,UACjB;AACA,mBAAW,KAAK;AAAA,UACd,MAAM,CAAC,WAAW,IAAI,YAAY,CAAC;AAAA,UACnC,UAAU;AAAA,UACV;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAQO,SAAS,0BACd,SACoB;AACpB,MAAI;AACJ,MAAI;AACF,WAAO,IAAI,IAAI,QAAQ,GAAG,EAAE;AAAA,EAC9B,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL;AAAA,MACE,MAAM,CAAC,OAAO,MAAM;AAAA,MACpB,UAAU;AAAA,MACV,OAAO;AAAA,IACT;AAAA,EACF;AACF;AAOO,SAAS,2BACd,SACa;AACb,QAAM,aAA0B,CAAC;AAEjC,MACE,QAAQ,WAAW,UACnB,QAAQ,WAAW,QACnB,OAAO,QAAQ,WAAW,UAC1B;AACA,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,QAAQ;AAAA,MACf,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAMO,SAAS,oBAAoB,SAAmC;AACrE,SAAO,UAAU,QAAQ,YAAY,IAAI,QAAQ,WAAW,IAAI,QAAQ,UAAU;AACpF;AAMO,SAAS,yBAAyB,SAAmC;AAC1E,SAAO,UAAU,QAAQ,YAAY;AACvC;;;ACzIA,SAAS,mBAAmB,kBAAqC;AAC/D,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,aAAa,CAAC,SAAS;AAAA,IACvB,WAAW,CAAC,kBAAkB,gBAAgB,EAAE;AAAA,IAChD,YAAY,CAAC;AAAA,EACf;AACF;AAUA,SAAS,oBAAoB,SAAqC;AAChE,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,eAAe;AACzB,eAAW,KAAK,mBAAmB,QAAQ,aAAa,CAAC;AAAA,EAC3D;AAEA,QAAM,aAAa,yBAAyB,OAAO;AAInD,MAAI;AACF,UAAM,YAAY,CAAC,GAAG,IAAI,IAAI,QAAQ,GAAG,EAAE,aAAa,KAAK,CAAC;AAC9D,UAAM,aAAa,CAAC,GAAG,IAAI,IAAI,SAAS,CAAC;AACzC,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,OAAO,OAAO;AAAA,MACrB,UAAU;AAAA,MACV,OAAO;AAAA,IACT,CAAC;AAAA,EACH,QAAQ;AAEN,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,OAAO,OAAO;AAAA,MACrB,UAAU;AAAA,MACV,OAAO,CAAC;AAAA,IACV,CAAC;AAAA,EACH;AAEA,aAAW,KAAK;AAAA,IACd,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,YAAY;AAAA,IACxB;AAAA,EACF,CAAC;AAED,SAAO,EAAE,SAAS,GAAG,WAAW;AAClC;AASA,SAAS,sBAAsB,SAAmC;AAChE,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,eAAe;AACzB,eAAW,KAAK,mBAAmB,QAAQ,aAAa,CAAC;AAAA,EAC3D;AAEA,aAAW,KAAK;AAAA,IACd,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,oBAAoB,OAAO,CAAC;AAAA,IACxC,YAAY,2BAA2B,OAAO;AAAA,EAChD,CAAC;AAED,SAAO,EAAE,SAAS,GAAG,WAAW;AAClC;AAQO,SAAS,cAAc,SAAiC;AAC7D,MAAI,QAAQ,iBAAiB,gBAAgB;AAC3C,WAAO,oBAAoB,OAAO;AAAA,EACpC;AACA,SAAO,sBAAsB,OAAO;AACtC;","names":["z","z"]}

package/package.json

@@ -0,0 +1,53 @@
+{
+  "name": "@zapier/policy-context",
+  "version": "0.3.0",
+  "description": "Shared request context types, builders, and policy condition generators for sdkapi and approvalsapi",
+  "repository": {
+    "type": "git",
+    "url": "https://gitlab.com/zapier/zapier-sdk/approvalsapi.git",
+    "directory": "packages/policy-context"
+  },
+  "type": "module",
+  "exports": {
+    ".": "./src/index.ts",
+    "./*": "./src/*.ts"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsup",
+    "lint": "eslint src/**/*.ts",
+    "fmt": "prettier --write \"**/*.ts\"",
+    "test": "vitest run",
+    "test:watch": "vitest watch --clearScreen=false",
+    "types": "tsc",
+    "types:watch": "tsc --watch"
+  },
+  "publishConfig": {
+    "access": "restricted",
+    "provenance": true,
+    "main": "dist/index.cjs",
+    "module": "dist/index.js",
+    "types": "dist/index.d.ts",
+    "exports": {
+      ".": {
+        "require": {
+          "types": "./dist/index.d.cts",
+          "default": "./dist/index.cjs"
+        },
+        "import": {
+          "types": "./dist/index.d.ts",
+          "default": "./dist/index.js"
+        }
+      }
+    }
+  },
+  "dependencies": {
+    "@zapier/policy-schema": "0.8.0",
+    "zod": "^4.0.0"
+  },
+  "devDependencies": {
+    "tsup": "^8.0.0"
+  }
+}