@zapier/policy-context 0.9.0 → 1.0.0

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/types.ts","../src/constants.ts","../src/builders.ts","../src/conditions.ts","../src/policies.ts","../src/connection-policy.ts"],"sourcesContent":["// ABOUTME: Public API for @zapier/policy-context.\n// ABOUTME: Shared context types, builders, and condition generators for sdkapi + approvalsapi.\n\nexport {\n  HttpRequestContextSchema,\n  ActionRunContextSchema,\n  RequestContextSchema,\n  JsonValueSchema,\n  ParsedUrlSchema,\n  DEFAULT_PORTS,\n  parseUrl,\n  buildUrlString,\n  type HttpRequestContext,\n  type ActionRunContext,\n  type RequestContext,\n  type ParsedUrl,\n} from \"./types.ts\";\n\nexport { IGNORED_HEADERS } from \"./constants.ts\";\n\nexport {\n  buildHttpRequestContext,\n  buildActionRunContext,\n  BuildHttpRequestContextOptionsSchema,\n  BuildActionRunContextOptionsSchema,\n  type BuildHttpRequestContextOptions,\n  type BuildActionRunContextOptions,\n} from \"./builders.ts\";\n\nexport {\n  buildExactHttpConditions,\n  buildDomainHttpConditions,\n  buildExactActionConditions,\n  buildActionResource,\n  buildBroadActionResource,\n} from \"./conditions.ts\";\n\nexport { toExactPolicy } from \"./policies.ts\";\n\nexport {\n  buildConnectionPolicy,\n  AccessLevelSchema,\n  type AccessLevel,\n} from \"./connection-policy.ts\";\n","// ABOUTME: Canonical request context types shared between sdkapi and approvalsapi.\n// ABOUTME: These define the contract for how requests are described in approval flows and policy evaluation.\n\nimport { z } from \"zod\";\nimport type { JsonValue } from \"@zapier/policy-schema\";\n\n/**\n * Zod schema for arbitrary JSON values. Used across context schemas for\n * unstructured fields like `body_json` and `inputs`.\n */\nexport const JsonValueSchema = z.custom<JsonValue>();\n\n/**\n * Parsed URL components for policy evaluation.\n * Matches the ParsedUrl shape from @zapier/policy-schema so that\n * evaluatePolicy condition paths like [\"url\", \"host\"] resolve correctly.\n */\nexport const ParsedUrlSchema = z.object({\n  scheme: z.string(),\n  host: z.string(),\n  port: z.number(),\n  path: z.string(),\n  query: z.record(z.string(), z.array(z.string())),\n});\nexport type ParsedUrl = z.infer<typeof ParsedUrlSchema>;\n\n/** Default ports by scheme, used when URL has no explicit port. */\nexport const DEFAULT_PORTS: Record<string, number> = {\n  http: 80,\n  https: 443,\n};\n\n/**\n * Parse a raw URL string into a ParsedUrl.\n * Same logic as parseUrlForPolicyContext in @zapier/policy.\n */\nexport function parseUrl(raw: string): ParsedUrl {\n  const url = new URL(raw);\n  const scheme = url.protocol.slice(0, -1).toLowerCase();\n  const host = url.hostname.toLowerCase();\n  const port = url.port ? parseInt(url.port, 10) : (DEFAULT_PORTS[scheme] ?? 0);\n  const path = url.pathname || \"/\";\n  const query: Record<string, string[]> = {};\n  for (const [key, value] of url.searchParams) {\n    if (!query[key]) {\n      query[key] = [];\n    }\n    query[key].push(value);\n  }\n  return { scheme, host, port, path, query };\n}\n\n/**\n * Reconstruct a URL string from a ParsedUrl.\n * Same logic as buildUrl in @zapier/policy.\n */\nexport function buildUrlString(parsed: ParsedUrl): string {\n  const { scheme, host, port, path, query } = parsed;\n  const defaultPort = DEFAULT_PORTS[scheme];\n  const portString = port !== defaultPort ? `:${String(port)}` : \"\";\n  const params = new URLSearchParams();\n  for (const [key, values] of Object.entries(query)) {\n    for (const value of values) {\n      params.append(key, value);\n    }\n  }\n  const queryString = params.toString();\n  return `${scheme}://${host}${portString}${path}${queryString ? \"?\" + queryString : \"\"}`;\n}\n\n/**\n * HTTP request context for approval/policy flows.\n * Sent by sdkapi when a relay request is denied, stored by approvalsapi,\n * and used for both policy evaluation and building policy conditions.\n *\n * The url field is a ParsedUrl object (matching @zapier/policy-schema's ParsedUrl)\n * so that evaluatePolicy conditions like [\"url\", \"host\"] resolve correctly.\n */\nexport const HttpRequestContextSchema = z.object({\n  request_type: z.literal(\"http_request\"),\n  method: z.string(),\n  /** Parsed URL components for policy condition matching */\n  url: ParsedUrlSchema,\n  /** Filtered headers (IGNORED_HEADERS excluded, keys lowercased) */\n  headers: z.record(z.string(), z.string()),\n  /** Raw body string */\n  body: z.string().nullable(),\n  /** Parsed JSON body */\n  body_json: JsonValueSchema.nullable(),\n  /** Zapier connection ID used for this request */\n  connection_id: z.string().optional(),\n  /** Optional human-readable reason for the request */\n  reason: z.string().optional(),\n});\nexport type HttpRequestContext = z.infer<typeof HttpRequestContextSchema>;\n\n/**\n * Action run context for approval/policy flows.\n * Sent by sdkapi when an action run is denied, stored by approvalsapi,\n * and used to build policy conditions.\n */\nexport const ActionRunContextSchema = z.object({\n  request_type: z.literal(\"action_run\"),\n  selected_api: z.string(),\n  action_type: z.string(),\n  action_key: z.string(),\n  connection_id: z.string().optional(),\n  inputs: JsonValueSchema.optional(),\n  reason: z.string().optional(),\n});\nexport type ActionRunContext = z.infer<typeof ActionRunContextSchema>;\n\n/**\n * Discriminated union of all request context types.\n */\nexport const RequestContextSchema = z.discriminatedUnion(\"request_type\", [\n  HttpRequestContextSchema,\n  ActionRunContextSchema,\n]);\nexport type RequestContext = z.infer<typeof RequestContextSchema>;\n","// ABOUTME: Canonical set of headers to exclude when building request contexts.\n// ABOUTME: Shared between sdkapi (context creation) and approvalsapi (condition building).\n\n/**\n * Headers to exclude when building request contexts from raw HTTP requests.\n *\n * These are either sensitive (auth credentials), HTTP infrastructure headers\n * that vary per-request, or proxy-internal headers that are not meaningful\n * for policy decisions.\n */\nexport const IGNORED_HEADERS = new Set([\n  // Auth / credentials — never include in contexts or policy conditions\n  \"authorization\",\n  \"x-relay-authorization\",\n  \"x-relay-authentication-id\",\n  \"x-api-key\",\n  \"cookie\",\n  \"set-cookie\",\n  \"proxy-authorization\",\n\n  // HTTP infrastructure — varies per-request, not policy-relevant\n  \"host\",\n  \"connection\",\n  \"content-length\",\n  \"transfer-encoding\",\n  \"accept-encoding\",\n  \"user-agent\",\n  \"accept\",\n  \"accept-language\",\n  \"sec-fetch-mode\",\n\n  // Proxy / forwarding — infrastructure, not meaningful for policy\n  \"x-forwarded-for\",\n  \"x-forwarded-host\",\n  \"x-forwarded-proto\",\n  \"x-real-ip\",\n\n  // Proxy internal — sdkapi-specific headers\n  \"x-is-interactive-session\",\n  \"x-relay-callback-url\",\n]);\n","// ABOUTME: Canonical builders for creating request contexts from raw request parts.\n// ABOUTME: Used by sdkapi to build both approval contexts and policy eval contexts.\n\nimport { z } from \"zod\";\nimport {\n  HttpRequestContextSchema,\n  ActionRunContextSchema,\n  JsonValueSchema,\n  parseUrl,\n  type HttpRequestContext,\n  type ActionRunContext,\n} from \"./types.ts\";\nimport { IGNORED_HEADERS } from \"./constants.ts\";\n\nexport const BuildHttpRequestContextOptionsSchema = z.object({\n  method: z.string(),\n  /** Raw URL string. Will be normalized with https:// if no protocol present. */\n  url: z.string(),\n  /** Raw headers from the request. Will be filtered through IGNORED_HEADERS. */\n  headers: z\n    .record(\n      z.string(),\n      z.union([z.string(), z.array(z.string()), z.undefined()]),\n    )\n    .optional(),\n  /** Raw body string */\n  body: z.string().nullable().optional(),\n  /** Pre-parsed JSON body (e.g. from Fastify's automatic JSON parsing) */\n  body_json: JsonValueSchema.optional(),\n  /** Connection ID associated with this request */\n  connection_id: z.string().optional(),\n});\nexport type BuildHttpRequestContextOptions = z.infer<\n  typeof BuildHttpRequestContextOptionsSchema\n>;\n\n/**\n * Build a canonical HttpRequestContext from raw request parts.\n *\n * This is the single source of truth for how HTTP request contexts are created.\n * Both sdkapi (for policy evaluation) and approvalsapi (for context storage)\n * should use this to ensure the context shape is consistent.\n *\n * Matches the behavior of createPolicyHttpRequest from @zapier/policy, with\n * the addition of header filtering through IGNORED_HEADERS.\n *\n * - Normalizes URL (adds https:// if missing) and parses into { scheme, host, port, path, query }\n * - Filters headers through IGNORED_HEADERS, lowercases keys, string values only\n * - Auto-parses body_json from body when content-type is JSON and body_json not provided\n * - body defaults to null (not undefined)\n */\nexport function buildHttpRequestContext(\n  options: BuildHttpRequestContextOptions,\n): HttpRequestContext {\n  // Normalize URL — SDK CLI strips the protocol\n  const rawUrl = options.url.includes(\"://\")\n    ? options.url\n    : `https://${options.url}`;\n  const url = parseUrl(rawUrl);\n\n  // Filter headers: exclude ignored, lowercase keys, string values only\n  const headers: Record<string, string> = {};\n  if (options.headers) {\n    for (const [key, value] of Object.entries(options.headers)) {\n      const lowerKey = key.toLowerCase();\n      if (!IGNORED_HEADERS.has(lowerKey) && typeof value === \"string\") {\n        headers[lowerKey] = value;\n      }\n    }\n  }\n\n  // Auto-parse body_json from body when content-type is JSON\n  // (matches createPolicyHttpRequest behavior from @zapier/policy)\n  let body_json: unknown = null;\n  if (options.body_json !== undefined) {\n    body_json = options.body_json;\n  } else if (options.body) {\n    const contentType = headers[\"content-type\"];\n    const isJson =\n      typeof contentType === \"string\" &&\n      (contentType.includes(\"application/json\") ||\n        (contentType.includes(\"application/\") &&\n          contentType.includes(\"+json\")));\n    if (isJson) {\n      try {\n        body_json = JSON.parse(options.body);\n      } catch {\n        // Invalid JSON body — leave body_json as null\n      }\n    }\n  }\n\n  return HttpRequestContextSchema.parse({\n    request_type: \"http_request\",\n    method: options.method,\n    url,\n    headers,\n    body: options.body ?? null,\n    body_json,\n    connection_id: options.connection_id,\n  });\n}\n\nexport const BuildActionRunContextOptionsSchema = z.object({\n  selected_api: z.string(),\n  action_type: z.string(),\n  action_key: z.string(),\n  connection_id: z.string().optional(),\n  inputs: JsonValueSchema.optional(),\n});\nexport type BuildActionRunContextOptions = z.infer<\n  typeof BuildActionRunContextOptionsSchema\n>;\n\n/**\n * Build a canonical ActionRunContext from raw action parts.\n */\nexport function buildActionRunContext(\n  options: BuildActionRunContextOptions,\n): ActionRunContext {\n  return ActionRunContextSchema.parse({\n    request_type: \"action_run\",\n    selected_api: options.selected_api,\n    action_type: options.action_type,\n    action_key: options.action_key,\n    connection_id: options.connection_id,\n    inputs: options.inputs,\n  });\n}\n","// ABOUTME: Builds policy conditions from stored request contexts.\n// ABOUTME: Used by approvalsapi's \"allow exact request\" and \"allow domain\" instant policy flows.\n\nimport type { Condition } from \"@zapier/policy-schema\";\nimport type { HttpRequestContext, ActionRunContext } from \"./types.ts\";\nimport { IGNORED_HEADERS } from \"./constants.ts\";\n\n/**\n * Build conditions that match an exact HTTP request.\n *\n * Handles the matches_url / query param split correctly:\n * - `matches_url` only supports scheme+host+port+path (no query string per spec)\n * - Query parameters are added as separate decomposed conditions on `url.query.<key>`\n *\n * @returns Condition[] for an http permission statement\n */\nexport function buildExactHttpConditions(\n  context: HttpRequestContext,\n): Condition[] {\n  const conditions: Condition[] = [\n    { path: [\"method\"], operator: \"equals\", value: context.method },\n  ];\n\n  const { url } = context;\n\n  // matches_url condition uses URL without query string (per @zapier/policy spec)\n  const defaultPort =\n    url.scheme === \"https\" ? 443 : url.scheme === \"http\" ? 80 : 0;\n  const portString = url.port !== defaultPort ? `:${String(url.port)}` : \"\";\n  const urlWithoutQuery = `${url.scheme}://${url.host}${portString}${url.path}`;\n  conditions.push({\n    path: [\"url\"],\n    operator: \"matches_url\",\n    value: urlWithoutQuery,\n  });\n\n  // Add decomposed conditions for each query parameter.\n  for (const [key, values] of Object.entries(url.query)) {\n    conditions.push({\n      path: [\"url\", \"query\", key],\n      operator: \"equals\",\n      value: values,\n    });\n  }\n\n  // body_json condition\n  if (context.body_json !== null) {\n    conditions.push({\n      path: [\"body_json\"],\n      operator: \"equals\",\n      value: context.body_json,\n    });\n  }\n\n  // Header conditions (filtered through IGNORED_HEADERS again for safety)\n  for (const [key, value] of Object.entries(context.headers)) {\n    if (!IGNORED_HEADERS.has(key.toLowerCase()) && typeof value === \"string\") {\n      conditions.push({\n        path: [\"headers\", key.toLowerCase()],\n        operator: \"equals\",\n        value,\n      });\n    }\n  }\n\n  return conditions;\n}\n\n/**\n * Build conditions that match any request to a given domain.\n * Uses the host from the parsed URL.\n *\n * @returns Condition[] for an http permission statement\n */\nexport function buildDomainHttpConditions(\n  context: HttpRequestContext,\n): Condition[] {\n  return [\n    {\n      path: [\"url\", \"host\"],\n      operator: \"matches_host\",\n      value: context.url.host,\n    },\n  ];\n}\n\n/**\n * Build conditions that match an exact action run (with inputs).\n *\n * @returns Condition[] for an action permission statement\n */\nexport function buildExactActionConditions(\n  context: ActionRunContext,\n): Condition[] {\n  const conditions: Condition[] = [];\n\n  if (\n    context.inputs !== undefined &&\n    context.inputs !== null &&\n    typeof context.inputs === \"object\"\n  ) {\n    conditions.push({\n      path: [\"inputs\"],\n      operator: \"equals\",\n      value: context.inputs,\n    });\n  }\n\n  return conditions;\n}\n\n/**\n * Build the resource string for an action.\n * Format: action/{selected_api}/{action_type}/{action_key}\n */\nexport function buildActionResource(context: ActionRunContext): string {\n  return `action/${context.selected_api}/${context.action_type}/${context.action_key}`;\n}\n\n/**\n * Build a broad action resource that matches all actions for an app.\n * Format: action/{selected_api}/{wildcard}/{wildcard}\n */\nexport function buildBroadActionResource(context: ActionRunContext): string {\n  return `action/${context.selected_api}/*/*`;\n}\n","// ABOUTME: Assembles complete Policy objects from request contexts.\n// ABOUTME: Single source of truth for \"exact request\" instant policies used by web UI and API.\n\nimport type { Policy, Statement } from \"@zapier/policy-schema\";\nimport type {\n  RequestContext,\n  HttpRequestContext,\n  ActionRunContext,\n} from \"./types.ts\";\nimport {\n  buildExactHttpConditions,\n  buildExactActionConditions,\n  buildActionResource,\n} from \"./conditions.ts\";\n\n/**\n * Build a `can_use` authentication statement, if the context has a connection_id.\n */\nfunction buildAuthStatement(authenticationId: string): Statement {\n  return {\n    effect: \"allow\",\n    permissions: [\"can_use\"],\n    resources: [`connection/${authenticationId}`],\n    conditions: [],\n  };\n}\n\n/**\n * Build an exact-match policy from an HTTP request context.\n *\n * Produces a policy that allows only the specific request described by the context:\n * - `can_use` statement for the authentication (if present)\n * - `can_execute` statement for `http` with conditions from `buildExactHttpConditions`\n *   plus a `keys_in` guard restricting allowed query parameter keys\n */\nfunction httpContextToPolicy(context: HttpRequestContext): Policy {\n  const statements: Statement[] = [];\n\n  if (context.connection_id) {\n    statements.push(buildAuthStatement(context.connection_id));\n  }\n\n  const conditions = buildExactHttpConditions(context);\n\n  // Add a keys_in guard so only the query param keys present in the original\n  // request are allowed — blocks injection of extra query params.\n  conditions.push({\n    path: [\"url\", \"query\"],\n    operator: \"keys_in\",\n    value: Object.keys(context.url.query),\n  });\n\n  statements.push({\n    effect: \"allow\",\n    permissions: [\"can_execute\"],\n    resources: [\"http\"],\n    conditions,\n  });\n\n  return { version: 2, statements };\n}\n\n/**\n * Build an exact-match policy from an action run context.\n *\n * Produces a policy that allows only the specific action described by the context:\n * - `can_use` statement for the authentication (if present)\n * - `can_execute` statement for the action resource with input conditions\n */\nfunction actionContextToPolicy(context: ActionRunContext): Policy {\n  const statements: Statement[] = [];\n\n  if (context.connection_id) {\n    statements.push(buildAuthStatement(context.connection_id));\n  }\n\n  statements.push({\n    effect: \"allow\",\n    permissions: [\"can_execute\"],\n    resources: [buildActionResource(context)],\n    conditions: buildExactActionConditions(context),\n  });\n\n  return { version: 2, statements };\n}\n\n/**\n * Build an exact-match policy from any supported request context.\n *\n * This is the single source of truth for \"allow this exact request\" instant policies.\n * Used by the web UI and anywhere else that needs to produce an exact policy from a context.\n */\nexport function toExactPolicy(context: RequestContext): Policy {\n  if (context.request_type === \"http_request\") {\n    return httpContextToPolicy(context);\n  }\n  return actionContextToPolicy(context);\n}\n","// ABOUTME: Builds connection-level policies for the basic approvals MVP.\n// ABOUTME: Generates deterministic policies that allow read or read+write access scoped to a specific connection.\n\nimport { z } from \"zod\";\nimport type { Policy, Statement, Condition } from \"@zapier/policy-schema\";\n\nexport const AccessLevelSchema = z.enum([\"read\", \"read_write\"]);\nexport type AccessLevel = z.infer<typeof AccessLevelSchema>;\n\nconst READ_HTTP_METHODS = [\"GET\", \"HEAD\", \"OPTIONS\"];\nconst READ_ACTION_TYPES = [\"read\", \"search\"];\n\n/**\n * Build a connection-level policy that covers both HTTP and action access.\n *\n * Always produces three statements:\n * 1. `can_use` for the authentication\n * 2. `can_execute` on `http` scoped by connection_id (+ method filter for read)\n * 3. `can_execute` on `action/{selectedApi}/**` scoped by connection_id (+ action_type filter for read)\n */\nexport function buildConnectionPolicy(options: {\n  connectionId: string;\n  selectedApi: string;\n  accessLevel: AccessLevel;\n}): Policy {\n  const { connectionId, selectedApi, accessLevel } = options;\n\n  const authStatement: Statement = {\n    effect: \"allow\",\n    permissions: [\"can_use\"],\n    resources: [`connection/${connectionId}`],\n    conditions: [],\n  };\n\n  const connectionCondition: Condition = {\n    path: [\"connection_id\"],\n    operator: \"equals\",\n    value: connectionId,\n  };\n\n  const httpConditions: Condition[] = [connectionCondition];\n  if (accessLevel === \"read\") {\n    httpConditions.push({\n      path: [\"method\"],\n      operator: \"in\",\n      value: READ_HTTP_METHODS,\n    });\n  }\n\n  const httpStatement: Statement = {\n    effect: \"allow\",\n    permissions: [\"can_execute\"],\n    resources: [\"http\"],\n    conditions: httpConditions,\n  };\n\n  const actionConditions: Condition[] = [connectionCondition];\n  if (accessLevel === \"read\") {\n    actionConditions.push({\n      path: [\"action_type\"],\n      operator: \"in\",\n      value: READ_ACTION_TYPES,\n    });\n  }\n\n  const actionStatement: Statement = {\n    effect: \"allow\",\n    permissions: [\"can_execute\"],\n    resources: [`action/${selectedApi}/*/*`],\n    conditions: actionConditions,\n  };\n\n  return {\n    version: 2,\n    statements: [authStatement, httpStatement, actionStatement],\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACGA,iBAAkB;AAOX,IAAM,kBAAkB,aAAE,OAAkB;AAO5C,IAAM,kBAAkB,aAAE,OAAO;AAAA,EACtC,QAAQ,aAAE,OAAO;AAAA,EACjB,MAAM,aAAE,OAAO;AAAA,EACf,MAAM,aAAE,OAAO;AAAA,EACf,MAAM,aAAE,OAAO;AAAA,EACf,OAAO,aAAE,OAAO,aAAE,OAAO,GAAG,aAAE,MAAM,aAAE,OAAO,CAAC,CAAC;AACjD,CAAC;AAIM,IAAM,gBAAwC;AAAA,EACnD,MAAM;AAAA,EACN,OAAO;AACT;AAMO,SAAS,SAAS,KAAwB;AAC/C,QAAM,MAAM,IAAI,IAAI,GAAG;AACvB,QAAM,SAAS,IAAI,SAAS,MAAM,GAAG,EAAE,EAAE,YAAY;AACrD,QAAM,OAAO,IAAI,SAAS,YAAY;AACtC,QAAM,OAAO,IAAI,OAAO,SAAS,IAAI,MAAM,EAAE,IAAK,cAAc,MAAM,KAAK;AAC3E,QAAM,OAAO,IAAI,YAAY;AAC7B,QAAM,QAAkC,CAAC;AACzC,aAAW,CAAC,KAAK,KAAK,KAAK,IAAI,cAAc;AAC3C,QAAI,CAAC,MAAM,GAAG,GAAG;AACf,YAAM,GAAG,IAAI,CAAC;AAAA,IAChB;AACA,UAAM,GAAG,EAAE,KAAK,KAAK;AAAA,EACvB;AACA,SAAO,EAAE,QAAQ,MAAM,MAAM,MAAM,MAAM;AAC3C;AAMO,SAAS,eAAe,QAA2B;AACxD,QAAM,EAAE,QAAQ,MAAM,MAAM,MAAM,MAAM,IAAI;AAC5C,QAAM,cAAc,cAAc,MAAM;AACxC,QAAM,aAAa,SAAS,cAAc,IAAI,OAAO,IAAI,CAAC,KAAK;AAC/D,QAAM,SAAS,IAAI,gBAAgB;AACnC,aAAW,CAAC,KAAK,MAAM,KAAK,OAAO,QAAQ,KAAK,GAAG;AACjD,eAAW,SAAS,QAAQ;AAC1B,aAAO,OAAO,KAAK,KAAK;AAAA,IAC1B;AAAA,EACF;AACA,QAAM,cAAc,OAAO,SAAS;AACpC,SAAO,GAAG,MAAM,MAAM,IAAI,GAAG,UAAU,GAAG,IAAI,GAAG,cAAc,MAAM,cAAc,EAAE;AACvF;AAUO,IAAM,2BAA2B,aAAE,OAAO;AAAA,EAC/C,cAAc,aAAE,QAAQ,cAAc;AAAA,EACtC,QAAQ,aAAE,OAAO;AAAA;AAAA,EAEjB,KAAK;AAAA;AAAA,EAEL,SAAS,aAAE,OAAO,aAAE,OAAO,GAAG,aAAE,OAAO,CAAC;AAAA;AAAA,EAExC,MAAM,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAE1B,WAAW,gBAAgB,SAAS;AAAA;AAAA,EAEpC,eAAe,aAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEnC,QAAQ,aAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAQM,IAAM,yBAAyB,aAAE,OAAO;AAAA,EAC7C,cAAc,aAAE,QAAQ,YAAY;AAAA,EACpC,cAAc,aAAE,OAAO;AAAA,EACvB,aAAa,aAAE,OAAO;AAAA,EACtB,YAAY,aAAE,OAAO;AAAA,EACrB,eAAe,aAAE,OAAO,EAAE,SAAS;AAAA,EACnC,QAAQ,gBAAgB,SAAS;AAAA,EACjC,QAAQ,aAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAMM,IAAM,uBAAuB,aAAE,mBAAmB,gBAAgB;AAAA,EACvE;AAAA,EACA;AACF,CAAC;;;AC5GM,IAAM,kBAAkB,oBAAI,IAAI;AAAA;AAAA,EAErC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AACF,CAAC;;;ACrCD,IAAAA,cAAkB;AAWX,IAAM,uCAAuC,cAAE,OAAO;AAAA,EAC3D,QAAQ,cAAE,OAAO;AAAA;AAAA,EAEjB,KAAK,cAAE,OAAO;AAAA;AAAA,EAEd,SAAS,cACN;AAAA,IACC,cAAE,OAAO;AAAA,IACT,cAAE,MAAM,CAAC,cAAE,OAAO,GAAG,cAAE,MAAM,cAAE,OAAO,CAAC,GAAG,cAAE,UAAU,CAAC,CAAC;AAAA,EAC1D,EACC,SAAS;AAAA;AAAA,EAEZ,MAAM,cAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAErC,WAAW,gBAAgB,SAAS;AAAA;AAAA,EAEpC,eAAe,cAAE,OAAO,EAAE,SAAS;AACrC,CAAC;AAoBM,SAAS,wBACd,SACoB;AAEpB,QAAM,SAAS,QAAQ,IAAI,SAAS,KAAK,IACrC,QAAQ,MACR,WAAW,QAAQ,GAAG;AAC1B,QAAM,MAAM,SAAS,MAAM;AAG3B,QAAM,UAAkC,CAAC;AACzC,MAAI,QAAQ,SAAS;AACnB,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,OAAO,GAAG;AAC1D,YAAM,WAAW,IAAI,YAAY;AACjC,UAAI,CAAC,gBAAgB,IAAI,QAAQ,KAAK,OAAO,UAAU,UAAU;AAC/D,gBAAQ,QAAQ,IAAI;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAIA,MAAI,YAAqB;AACzB,MAAI,QAAQ,cAAc,QAAW;AACnC,gBAAY,QAAQ;AAAA,EACtB,WAAW,QAAQ,MAAM;AACvB,UAAM,cAAc,QAAQ,cAAc;AAC1C,UAAM,SACJ,OAAO,gBAAgB,aACtB,YAAY,SAAS,kBAAkB,KACrC,YAAY,SAAS,cAAc,KAClC,YAAY,SAAS,OAAO;AAClC,QAAI,QAAQ;AACV,UAAI;AACF,oBAAY,KAAK,MAAM,QAAQ,IAAI;AAAA,MACrC,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAEA,SAAO,yBAAyB,MAAM;AAAA,IACpC,cAAc;AAAA,IACd,QAAQ,QAAQ;AAAA,IAChB;AAAA,IACA;AAAA,IACA,MAAM,QAAQ,QAAQ;AAAA,IACtB;AAAA,IACA,eAAe,QAAQ;AAAA,EACzB,CAAC;AACH;AAEO,IAAM,qCAAqC,cAAE,OAAO;AAAA,EACzD,cAAc,cAAE,OAAO;AAAA,EACvB,aAAa,cAAE,OAAO;AAAA,EACtB,YAAY,cAAE,OAAO;AAAA,EACrB,eAAe,cAAE,OAAO,EAAE,SAAS;AAAA,EACnC,QAAQ,gBAAgB,SAAS;AACnC,CAAC;AAQM,SAAS,sBACd,SACkB;AAClB,SAAO,uBAAuB,MAAM;AAAA,IAClC,cAAc;AAAA,IACd,cAAc,QAAQ;AAAA,IACtB,aAAa,QAAQ;AAAA,IACrB,YAAY,QAAQ;AAAA,IACpB,eAAe,QAAQ;AAAA,IACvB,QAAQ,QAAQ;AAAA,EAClB,CAAC;AACH;;;AChHO,SAAS,yBACd,SACa;AACb,QAAM,aAA0B;AAAA,IAC9B,EAAE,MAAM,CAAC,QAAQ,GAAG,UAAU,UAAU,OAAO,QAAQ,OAAO;AAAA,EAChE;AAEA,QAAM,EAAE,IAAI,IAAI;AAGhB,QAAM,cACJ,IAAI,WAAW,UAAU,MAAM,IAAI,WAAW,SAAS,KAAK;AAC9D,QAAM,aAAa,IAAI,SAAS,cAAc,IAAI,OAAO,IAAI,IAAI,CAAC,KAAK;AACvE,QAAM,kBAAkB,GAAG,IAAI,MAAM,MAAM,IAAI,IAAI,GAAG,UAAU,GAAG,IAAI,IAAI;AAC3E,aAAW,KAAK;AAAA,IACd,MAAM,CAAC,KAAK;AAAA,IACZ,UAAU;AAAA,IACV,OAAO;AAAA,EACT,CAAC;AAGD,aAAW,CAAC,KAAK,MAAM,KAAK,OAAO,QAAQ,IAAI,KAAK,GAAG;AACrD,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,OAAO,SAAS,GAAG;AAAA,MAC1B,UAAU;AAAA,MACV,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AAGA,MAAI,QAAQ,cAAc,MAAM;AAC9B,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,WAAW;AAAA,MAClB,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH;AAGA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,OAAO,GAAG;AAC1D,QAAI,CAAC,gBAAgB,IAAI,IAAI,YAAY,CAAC,KAAK,OAAO,UAAU,UAAU;AACxE,iBAAW,KAAK;AAAA,QACd,MAAM,CAAC,WAAW,IAAI,YAAY,CAAC;AAAA,QACnC,UAAU;AAAA,QACV;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAQO,SAAS,0BACd,SACa;AACb,SAAO;AAAA,IACL;AAAA,MACE,MAAM,CAAC,OAAO,MAAM;AAAA,MACpB,UAAU;AAAA,MACV,OAAO,QAAQ,IAAI;AAAA,IACrB;AAAA,EACF;AACF;AAOO,SAAS,2BACd,SACa;AACb,QAAM,aAA0B,CAAC;AAEjC,MACE,QAAQ,WAAW,UACnB,QAAQ,WAAW,QACnB,OAAO,QAAQ,WAAW,UAC1B;AACA,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,QAAQ;AAAA,MACf,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAMO,SAAS,oBAAoB,SAAmC;AACrE,SAAO,UAAU,QAAQ,YAAY,IAAI,QAAQ,WAAW,IAAI,QAAQ,UAAU;AACpF;AAMO,SAAS,yBAAyB,SAAmC;AAC1E,SAAO,UAAU,QAAQ,YAAY;AACvC;;;AC3GA,SAAS,mBAAmB,kBAAqC;AAC/D,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,aAAa,CAAC,SAAS;AAAA,IACvB,WAAW,CAAC,cAAc,gBAAgB,EAAE;AAAA,IAC5C,YAAY,CAAC;AAAA,EACf;AACF;AAUA,SAAS,oBAAoB,SAAqC;AAChE,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,eAAe;AACzB,eAAW,KAAK,mBAAmB,QAAQ,aAAa,CAAC;AAAA,EAC3D;AAEA,QAAM,aAAa,yBAAyB,OAAO;AAInD,aAAW,KAAK;AAAA,IACd,MAAM,CAAC,OAAO,OAAO;AAAA,IACrB,UAAU;AAAA,IACV,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK;AAAA,EACtC,CAAC;AAED,aAAW,KAAK;AAAA,IACd,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,MAAM;AAAA,IAClB;AAAA,EACF,CAAC;AAED,SAAO,EAAE,SAAS,GAAG,WAAW;AAClC;AASA,SAAS,sBAAsB,SAAmC;AAChE,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,eAAe;AACzB,eAAW,KAAK,mBAAmB,QAAQ,aAAa,CAAC;AAAA,EAC3D;AAEA,aAAW,KAAK;AAAA,IACd,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,oBAAoB,OAAO,CAAC;AAAA,IACxC,YAAY,2BAA2B,OAAO;AAAA,EAChD,CAAC;AAED,SAAO,EAAE,SAAS,GAAG,WAAW;AAClC;AAQO,SAAS,cAAc,SAAiC;AAC7D,MAAI,QAAQ,iBAAiB,gBAAgB;AAC3C,WAAO,oBAAoB,OAAO;AAAA,EACpC;AACA,SAAO,sBAAsB,OAAO;AACtC;;;AC9FA,IAAAC,cAAkB;AAGX,IAAM,oBAAoB,cAAE,KAAK,CAAC,QAAQ,YAAY,CAAC;AAG9D,IAAM,oBAAoB,CAAC,OAAO,QAAQ,SAAS;AACnD,IAAM,oBAAoB,CAAC,QAAQ,QAAQ;AAUpC,SAAS,sBAAsB,SAI3B;AACT,QAAM,EAAE,cAAc,aAAa,YAAY,IAAI;AAEnD,QAAM,gBAA2B;AAAA,IAC/B,QAAQ;AAAA,IACR,aAAa,CAAC,SAAS;AAAA,IACvB,WAAW,CAAC,cAAc,YAAY,EAAE;AAAA,IACxC,YAAY,CAAC;AAAA,EACf;AAEA,QAAM,sBAAiC;AAAA,IACrC,MAAM,CAAC,eAAe;AAAA,IACtB,UAAU;AAAA,IACV,OAAO;AAAA,EACT;AAEA,QAAM,iBAA8B,CAAC,mBAAmB;AACxD,MAAI,gBAAgB,QAAQ;AAC1B,mBAAe,KAAK;AAAA,MAClB,MAAM,CAAC,QAAQ;AAAA,MACf,UAAU;AAAA,MACV,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AAEA,QAAM,gBAA2B;AAAA,IAC/B,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,MAAM;AAAA,IAClB,YAAY;AAAA,EACd;AAEA,QAAM,mBAAgC,CAAC,mBAAmB;AAC1D,MAAI,gBAAgB,QAAQ;AAC1B,qBAAiB,KAAK;AAAA,MACpB,MAAM,CAAC,aAAa;AAAA,MACpB,UAAU;AAAA,MACV,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AAEA,QAAM,kBAA6B;AAAA,IACjC,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,UAAU,WAAW,MAAM;AAAA,IACvC,YAAY;AAAA,EACd;AAEA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,YAAY,CAAC,eAAe,eAAe,eAAe;AAAA,EAC5D;AACF;","names":["import_zod","import_zod"]}
+{"version":3,"sources":["../src/index.ts","../src/types.ts","../src/constants.ts","../src/builders.ts","../src/conditions.ts","../src/policies.ts","../src/connection-policy.ts"],"sourcesContent":["// ABOUTME: Public API for @zapier/policy-context.\n// ABOUTME: Shared context types, builders, and condition generators for sdkapi + approvalsapi.\n\nexport {\n  HttpRequestContextSchema,\n  ActionRunContextSchema,\n  ActionTypeSchema,\n  RequestContextSchema,\n  JsonValueSchema,\n  ParsedUrlSchema,\n  DEFAULT_PORTS,\n  parseUrl,\n  buildUrlString,\n  parseActionResource,\n  type HttpRequestContext,\n  type ActionRunContext,\n  type ActionType,\n  type RequestContext,\n  type ParsedUrl,\n} from \"./types.ts\";\n\nexport { IGNORED_HEADERS } from \"./constants.ts\";\n\nexport {\n  buildHttpRequestContext,\n  buildActionRunContext,\n  BuildHttpRequestContextOptionsSchema,\n  BuildActionRunContextOptionsSchema,\n  type BuildHttpRequestContextOptions,\n  type BuildActionRunContextOptions,\n} from \"./builders.ts\";\n\nexport {\n  buildExactHttpConditions,\n  buildDomainHttpConditions,\n  buildExactActionConditions,\n  buildActionResource,\n  buildBroadActionResource,\n} from \"./conditions.ts\";\n\nexport { toExactPolicy } from \"./policies.ts\";\n\nexport {\n  buildConnectionPolicy,\n  isWriteRequest,\n  AccessLevelSchema,\n  READ_ACTION_TYPES,\n  READ_HTTP_METHODS,\n  type AccessLevel,\n} from \"./connection-policy.ts\";\n","// ABOUTME: Canonical request context types shared between sdkapi and approvalsapi.\n// ABOUTME: These define the contract for how requests are described in approval flows and policy evaluation.\n\nimport { z } from \"zod\";\nimport { extendZodWithOpenApi } from \"@asteasolutions/zod-to-openapi\";\nimport { JsonValueSchema } from \"@zapier/policy-schema\";\n\nextendZodWithOpenApi(z);\n\nexport { JsonValueSchema };\n\n/**\n * Parsed URL components for policy evaluation.\n * Matches the ParsedUrl shape from @zapier/policy-schema so that\n * evaluatePolicy condition paths like [\"url\", \"host\"] resolve correctly.\n */\nexport const ParsedUrlSchema = z\n  .object({\n    scheme: z.string().openapi({ description: 'URL scheme, e.g. \"https\"' }),\n    host: z.string().openapi({ description: 'Hostname, e.g. \"api.example.com\"' }),\n    port: z\n      .number()\n      .int()\n      .openapi({\n        description: \"Port number (defaults to 443 for https, 80 for http)\",\n      }),\n    path: z.string().openapi({ description: 'URL path, e.g. \"/v1/foo\"' }),\n    query: z\n      .record(z.string(), z.array(z.string()))\n      .openapi({\n        description: \"Query parameters as key to string array mapping\",\n      }),\n  })\n  .openapi(\"ParsedUrl\");\nexport type ParsedUrl = z.infer<typeof ParsedUrlSchema>;\n\n/** Default ports by scheme, used when URL has no explicit port. */\nexport const DEFAULT_PORTS: Record<string, number> = {\n  http: 80,\n  https: 443,\n};\n\n/**\n * Parse a raw URL string into a ParsedUrl.\n * Same logic as parseUrlForPolicyContext in @zapier/policy.\n */\nexport function parseUrl(raw: string): ParsedUrl {\n  const url = new URL(raw);\n  const scheme = url.protocol.slice(0, -1).toLowerCase();\n  const host = url.hostname.toLowerCase();\n  const port = url.port ? parseInt(url.port, 10) : (DEFAULT_PORTS[scheme] ?? 0);\n  const path = url.pathname || \"/\";\n  const query: Record<string, string[]> = {};\n  for (const [key, value] of url.searchParams) {\n    if (!query[key]) {\n      query[key] = [];\n    }\n    query[key].push(value);\n  }\n  return { scheme, host, port, path, query };\n}\n\n/**\n * Reconstruct a URL string from a ParsedUrl.\n * Same logic as buildUrl in @zapier/policy.\n */\nexport function buildUrlString(parsed: ParsedUrl): string {\n  const { scheme, host, port, path, query } = parsed;\n  const defaultPort = DEFAULT_PORTS[scheme];\n  const portString = port !== defaultPort ? `:${String(port)}` : \"\";\n  const params = new URLSearchParams();\n  for (const [key, values] of Object.entries(query)) {\n    for (const value of values) {\n      params.append(key, value);\n    }\n  }\n  const queryString = params.toString();\n  return `${scheme}://${host}${portString}${path}${queryString ? \"?\" + queryString : \"\"}`;\n}\n\n/**\n * HTTP request context for approval/policy flows.\n * Sent by sdkapi when a relay request is denied, stored by approvalsapi,\n * and used for both policy evaluation and building policy conditions.\n *\n * The url field is a ParsedUrl object (matching @zapier/policy-schema's ParsedUrl)\n * so that evaluatePolicy conditions like [\"url\", \"host\"] resolve correctly.\n */\nexport const HttpRequestContextSchema = z\n  .object({\n    request_type: z.literal(\"http_request\"),\n    method: z\n      .string()\n      .max(10)\n      .transform((m) => m.toUpperCase()),\n    /** Parsed URL components for policy condition matching */\n    url: ParsedUrlSchema,\n    /** Filtered headers (IGNORED_HEADERS excluded, keys lowercased) */\n    headers: z\n      .record(z.string(), z.string())\n      .openapi({\n        description: \"Filtered headers (IGNORED_HEADERS excluded, keys lowercased)\",\n      }),\n    /** Raw body string */\n    body: z.string().max(65536).nullable(),\n    /** Parsed JSON body */\n    body_json: JsonValueSchema.nullable().openapi({\n      // `type: 'object'` is a placeholder so zod-to-openapi short-circuits\n      // introspection of the recursive JsonValueSchema (z.lazy). The\n      // generator script strips this `type` after emit so the produced\n      // schema matches the original \"any JSON value\" shape.\n      type: \"object\",\n      description: \"Parsed JSON body (if applicable)\",\n    }),\n    /** Zapier connection ID used for this request */\n    connection_id: z\n      .string()\n      .max(255)\n      .optional()\n      .openapi({ description: \"Zapier connection ID used for this request\" }),\n    /** Optional human-readable reason for the request */\n    reason: z\n      .string()\n      .max(1024)\n      .optional()\n      .openapi({ description: \"Optional human-readable reason for the request\" }),\n  })\n  .openapi(\"HttpRequestContext\");\nexport type HttpRequestContext = z.infer<typeof HttpRequestContextSchema>;\n\n/**\n * Canonical Zapier action types.\n *\n * Mirrors the `action_type` enum in sdkapi's OpenAPI spec\n * (`packages/openapi-spec/openapi.d.ts` `action_type`). Single source of\n * truth for any code that branches on or filters by action_type — keeps\n * `ActionRunContextSchema`, `BuildActionRunContextOptionsSchema`, and the\n * `READ_ACTION_TYPES` allowlist in `connection-policy.ts` aligned.\n */\nexport const ActionTypeSchema = z\n  .enum([\n    \"filter\",\n    \"read\",\n    \"read_bulk\",\n    \"run\",\n    \"search\",\n    \"search_and_write\",\n    \"search_or_write\",\n    \"write\",\n  ])\n  .openapi(\"action_type\", { description: \"Canonical Zapier action type.\" });\nexport type ActionType = z.infer<typeof ActionTypeSchema>;\n\n/**\n * Allowed character set for `selected_api` and `action_key` segments of\n * an action resource. Blocks `*`, `/`, whitespace, and other glob/path\n * metacharacters that would otherwise widen policy scope. Permits at\n * most one `@`, which `globSelectedApiVersion` treats as the\n * version separator.\n */\nexport const ACTION_RESOURCE_SEGMENT_PATTERN =\n  /^[A-Za-z0-9._+-]+(?:@[A-Za-z0-9._+-]+)?$/;\n\n/**\n * Parse an action resource string of the form\n * `action/{selected_api}/{action_type}/{action_key}` into its parts.\n * Throws if the string doesn't match the canonical 4-segment shape or\n * if its `action_type` segment isn't one of the canonical 8 — every\n * action_run context that has been through `ActionRunContextSchema` is\n * guaranteed to parse cleanly, so a thrown error here means upstream\n * validation was bypassed.\n */\nexport function parseActionResource(resource: string): {\n  selected_api: string;\n  action_type: ActionType;\n  action_key: string;\n} {\n  const segments = resource.split(\"/\");\n  if (segments.length !== 4 || segments[0] !== \"action\") {\n    throw new Error(\n      `action resource must be action/{selected_api}/{action_type}/{action_key}: got ${resource}`,\n    );\n  }\n  const [, selectedApi, actionTypeRaw, actionKey] = segments;\n  if (!selectedApi || !actionTypeRaw || !actionKey) {\n    throw new Error(`action resource has empty segment: ${resource}`);\n  }\n  const actionType = ActionTypeSchema.safeParse(actionTypeRaw);\n  if (!actionType.success) {\n    throw new Error(\n      `action resource has unknown action_type \"${actionTypeRaw}\": ${resource}`,\n    );\n  }\n  if (!ACTION_RESOURCE_SEGMENT_PATTERN.test(selectedApi)) {\n    throw new Error(\n      `action resource has invalid selected_api segment \"${selectedApi}\": ${resource}`,\n    );\n  }\n  if (!ACTION_RESOURCE_SEGMENT_PATTERN.test(actionKey)) {\n    throw new Error(\n      `action resource has invalid action_key segment \"${actionKey}\": ${resource}`,\n    );\n  }\n  return {\n    selected_api: selectedApi,\n    action_type: actionType.data,\n    action_key: actionKey,\n  };\n}\n\n/**\n * Action run context for approval/policy flows.\n * Sent by sdkapi when an action run is denied, stored by approvalsapi,\n * and used to build policy conditions.\n *\n * Carries the action identity in a single canonical `resource` field of\n * the form `action/{selected_api}/{action_type}/{action_key}`, which is\n * also what the policy engine matches against. Use `parseActionResource`\n * to extract the individual parts when needed for display.\n *\n * Accepts either the canonical `resource` field or the legacy\n * `{selected_api, action_type, action_key}` triple on input — the\n * transform composes a canonical resource from the legacy fields when\n * needed, so downstream code only ever sees a single `resource`. Lets\n * sdkapi keep sending the old shape during the migration window.\n */\n/**\n * Raw input shape for `ActionRunContextSchema`, before the transform that\n * canonicalizes legacy fields into `resource`. Exposed for the OpenAPI\n * schema generator (which can't represent transforms) — runtime callers\n * should keep using `ActionRunContextSchema`.\n */\nexport const ActionRunContextInputSchema = z\n  .object({\n    request_type: z.literal(\"action_run\"),\n    resource: z\n      .string()\n      .max(1024)\n      .optional()\n      .openapi({\n        description:\n          \"Canonical action resource, e.g. action/Slack@1.0.0/write/send_message\",\n      }),\n    selected_api: z\n      .string()\n      .max(255)\n      .optional()\n      .openapi({\n        deprecated: true,\n        description:\n          \"Legacy: app identifier, e.g. Slack@1.0.0. Prefer `resource`.\",\n      }),\n    action_type: ActionTypeSchema.optional().openapi({\n      deprecated: true,\n      description: \"Legacy: canonical Zapier action type. Prefer `resource`.\",\n    }),\n    action_key: z\n      .string()\n      .max(255)\n      .optional()\n      .openapi({\n        deprecated: true,\n        description:\n          \"Legacy: action key, e.g. send_message. Prefer `resource`.\",\n      }),\n    connection_id: z\n      .string()\n      .max(255)\n      .optional()\n      .openapi({ description: \"Zapier connection ID used for this request\" }),\n    inputs: JsonValueSchema.optional().openapi({\n      // `type: 'object'` is a placeholder so zod-to-openapi short-circuits\n      // introspection of the recursive JsonValueSchema (z.lazy). The\n      // generator script strips this `type` after emit so the produced\n      // schema matches the original \"any inputs\" shape.\n      type: \"object\",\n      description: \"Action input parameters\",\n    }),\n    reason: z\n      .string()\n      .max(1024)\n      .optional()\n      .openapi({ description: \"Optional human-readable reason for the request\" }),\n  })\n  .openapi(\"ActionRunContext\", {\n    description:\n      \"Action run context. The canonical shape carries the action identity in a single `resource` field of the form `action/{selected_api}/{action_type}/{action_key}`. The legacy `{selected_api, action_type, action_key}` shape is also accepted on input during the migration window — approvalsapi normalizes it to the canonical form before storage.\",\n  });\n\nexport const ActionRunContextSchema = ActionRunContextInputSchema.transform(\n  (input, ctx) => {\n    const resource =\n      input.resource ??\n      (input.selected_api && input.action_type && input.action_key\n        ? `action/${input.selected_api}/${input.action_type}/${input.action_key}`\n        : undefined);\n    if (resource === undefined) {\n      ctx.addIssue({\n        code: \"custom\",\n        message:\n          \"action_run context requires either `resource` or all of `selected_api`/`action_type`/`action_key`\",\n      });\n      return z.NEVER;\n    }\n    try {\n      parseActionResource(resource);\n    } catch (err) {\n      ctx.addIssue({\n        code: \"custom\",\n        message: err instanceof Error ? err.message : String(err),\n      });\n      return z.NEVER;\n    }\n    return {\n      request_type: \"action_run\" as const,\n      resource,\n      ...(input.connection_id !== undefined && {\n        connection_id: input.connection_id,\n      }),\n      ...(input.inputs !== undefined && { inputs: input.inputs }),\n      ...(input.reason !== undefined && { reason: input.reason }),\n    };\n  },\n);\nexport type ActionRunContext = z.infer<typeof ActionRunContextSchema>;\n\n/**\n * Union of all request context types, keyed on `request_type`.\n *\n * Plain `z.union` (not `z.discriminatedUnion`) because\n * `ActionRunContextSchema` carries a `.transform` and discriminated\n * unions can't accept a `ZodEffects` member.\n */\nexport const RequestContextSchema = z\n  .union([HttpRequestContextSchema, ActionRunContextSchema])\n  .openapi(\"RequestContext\", {\n    description: \"Discriminated union over request_type.\",\n  });\nexport type RequestContext = z.infer<typeof RequestContextSchema>;\n","// ABOUTME: Canonical set of headers to exclude when building request contexts.\n// ABOUTME: Shared between sdkapi (context creation) and approvalsapi (condition building).\n\n/**\n * Headers to exclude when building request contexts from raw HTTP requests.\n *\n * These are either sensitive (auth credentials), HTTP infrastructure headers\n * that vary per-request, or proxy-internal headers that are not meaningful\n * for policy decisions.\n */\nexport const IGNORED_HEADERS = new Set([\n  // Auth / credentials — never include in contexts or policy conditions\n  \"authorization\",\n  \"x-relay-authorization\",\n  \"x-relay-authentication-id\",\n  \"x-api-key\",\n  \"cookie\",\n  \"set-cookie\",\n  \"proxy-authorization\",\n\n  // HTTP infrastructure — varies per-request, not policy-relevant\n  \"host\",\n  \"connection\",\n  \"content-length\",\n  \"transfer-encoding\",\n  \"accept-encoding\",\n  \"user-agent\",\n  \"accept\",\n  \"accept-language\",\n  \"sec-fetch-mode\",\n\n  // Proxy / forwarding — infrastructure, not meaningful for policy\n  \"x-forwarded-for\",\n  \"x-forwarded-host\",\n  \"x-forwarded-proto\",\n  \"x-real-ip\",\n\n  // Proxy internal — sdkapi-specific headers\n  \"x-is-interactive-session\",\n  \"x-relay-callback-url\",\n]);\n","// ABOUTME: Canonical builders for creating request contexts from raw request parts.\n// ABOUTME: Used by sdkapi to build both approval contexts and policy eval contexts.\n\nimport { z } from \"zod\";\nimport {\n  HttpRequestContextSchema,\n  ActionRunContextSchema,\n  ActionTypeSchema,\n  JsonValueSchema,\n  parseUrl,\n  ACTION_RESOURCE_SEGMENT_PATTERN,\n  type HttpRequestContext,\n  type ActionRunContext,\n} from \"./types.ts\";\nimport { buildActionResource } from \"./conditions.ts\";\nimport { IGNORED_HEADERS } from \"./constants.ts\";\n\nexport const BuildHttpRequestContextOptionsSchema = z.object({\n  method: z.string(),\n  /** Raw URL string. Will be normalized with https:// if no protocol present. */\n  url: z.string(),\n  /** Raw headers from the request. Will be filtered through IGNORED_HEADERS. */\n  headers: z\n    .record(\n      z.string(),\n      z.union([z.string(), z.array(z.string()), z.undefined()]),\n    )\n    .optional(),\n  /** Raw body string */\n  body: z.string().nullable().optional(),\n  /** Pre-parsed JSON body (e.g. from Fastify's automatic JSON parsing) */\n  body_json: JsonValueSchema.optional(),\n  /** Connection ID associated with this request */\n  connection_id: z.string().optional(),\n});\nexport type BuildHttpRequestContextOptions = z.infer<\n  typeof BuildHttpRequestContextOptionsSchema\n>;\n\n/**\n * Build a canonical HttpRequestContext from raw request parts.\n *\n * This is the single source of truth for how HTTP request contexts are created.\n * Both sdkapi (for policy evaluation) and approvalsapi (for context storage)\n * should use this to ensure the context shape is consistent.\n *\n * Matches the behavior of createPolicyHttpRequest from @zapier/policy, with\n * the addition of header filtering through IGNORED_HEADERS.\n *\n * - Normalizes URL (adds https:// if missing) and parses into { scheme, host, port, path, query }\n * - Filters headers through IGNORED_HEADERS, lowercases keys, string values only\n * - Auto-parses body_json from body when content-type is JSON and body_json not provided\n * - body defaults to null (not undefined)\n */\nexport function buildHttpRequestContext(\n  options: BuildHttpRequestContextOptions,\n): HttpRequestContext {\n  // Validate options up-front so downstream string ops (e.g. method.toUpperCase)\n  // see well-typed values. Mirrors the pattern in buildActionRunContext.\n  const parsed = BuildHttpRequestContextOptionsSchema.parse(options);\n\n  // Normalize URL — SDK CLI strips the protocol\n  const rawUrl = parsed.url.includes(\"://\")\n    ? parsed.url\n    : `https://${parsed.url}`;\n  const url = parseUrl(rawUrl);\n\n  // Filter headers: exclude ignored, lowercase keys, string values only\n  const headers: Record<string, string> = {};\n  if (parsed.headers) {\n    for (const [key, value] of Object.entries(parsed.headers)) {\n      const lowerKey = key.toLowerCase();\n      if (!IGNORED_HEADERS.has(lowerKey) && typeof value === \"string\") {\n        headers[lowerKey] = value;\n      }\n    }\n  }\n\n  // Auto-parse body_json from body when content-type is JSON\n  // (matches createPolicyHttpRequest behavior from @zapier/policy)\n  let body_json: unknown = null;\n  if (parsed.body_json !== undefined) {\n    body_json = parsed.body_json;\n  } else if (parsed.body) {\n    const contentType = headers[\"content-type\"];\n    const isJson =\n      typeof contentType === \"string\" &&\n      (contentType.includes(\"application/json\") ||\n        (contentType.includes(\"application/\") &&\n          contentType.includes(\"+json\")));\n    if (isJson) {\n      try {\n        body_json = JSON.parse(parsed.body);\n      } catch {\n        // Invalid JSON body — leave body_json as null\n      }\n    }\n  }\n\n  return HttpRequestContextSchema.parse({\n    request_type: \"http_request\",\n    method: parsed.method.toUpperCase(),\n    url,\n    headers,\n    body: parsed.body ?? null,\n    body_json,\n    connection_id: parsed.connection_id,\n  });\n}\n\nexport const BuildActionRunContextOptionsSchema = z.object({\n  selected_api: z.string().regex(ACTION_RESOURCE_SEGMENT_PATTERN, {\n    message:\n      \"selected_api must contain only [A-Za-z0-9._@+-] (no globs, slashes, or whitespace)\",\n  }),\n  action_type: ActionTypeSchema,\n  action_key: z.string().regex(ACTION_RESOURCE_SEGMENT_PATTERN, {\n    message:\n      \"action_key must contain only [A-Za-z0-9._@+-] (no globs, slashes, or whitespace)\",\n  }),\n  connection_id: z.string().optional(),\n  inputs: JsonValueSchema.optional(),\n  reason: z.string().optional(),\n});\nexport type BuildActionRunContextOptions = z.infer<\n  typeof BuildActionRunContextOptionsSchema\n>;\n\n/**\n * Build a canonical ActionRunContext from raw action parts.\n *\n * Callers pass the three identity fields separately for readability;\n * this validates them and collapses them into the canonical `resource`\n * string the schema stores.\n */\nexport function buildActionRunContext(\n  options: BuildActionRunContextOptions,\n): ActionRunContext {\n  const parsed = BuildActionRunContextOptionsSchema.parse(options);\n  return ActionRunContextSchema.parse({\n    request_type: \"action_run\",\n    resource: buildActionResource({\n      selected_api: parsed.selected_api,\n      action_type: parsed.action_type,\n      action_key: parsed.action_key,\n    }),\n    connection_id: parsed.connection_id,\n    inputs: parsed.inputs,\n    reason: parsed.reason,\n  });\n}\n","// ABOUTME: Builds policy conditions from stored request contexts.\n// ABOUTME: Used by approvalsapi's \"allow exact request\" and \"allow domain\" instant policy flows.\n\nimport type { Condition } from \"@zapier/policy-schema\";\nimport type {\n  HttpRequestContext,\n  ActionRunContext,\n  ActionType,\n} from \"./types.ts\";\nimport { IGNORED_HEADERS } from \"./constants.ts\";\n\n/**\n * Build conditions that match an exact HTTP request.\n *\n * Handles the matches_url / query param split correctly:\n * - `matches_url` only supports scheme+host+port+path (no query string per spec)\n * - Query parameters are added as separate decomposed conditions on `url.query.<key>`\n *\n * @returns Condition[] for an http permission statement\n */\nexport function buildExactHttpConditions(\n  context: HttpRequestContext,\n): Condition[] {\n  const conditions: Condition[] = [\n    { path: [\"method\"], operator: \"equals\", value: context.method },\n  ];\n\n  const { url } = context;\n\n  // matches_url condition uses URL without query string (per @zapier/policy spec)\n  const defaultPort =\n    url.scheme === \"https\" ? 443 : url.scheme === \"http\" ? 80 : 0;\n  const portString = url.port !== defaultPort ? `:${String(url.port)}` : \"\";\n  const urlWithoutQuery = `${url.scheme}://${url.host}${portString}${url.path}`;\n  conditions.push({\n    path: [\"url\"],\n    operator: \"matches_url\",\n    value: urlWithoutQuery,\n  });\n\n  // Add decomposed conditions for each query parameter.\n  for (const [key, values] of Object.entries(url.query)) {\n    conditions.push({\n      path: [\"url\", \"query\", key],\n      operator: \"equals\",\n      value: values,\n    });\n  }\n\n  // body_json condition\n  if (context.body_json !== null) {\n    conditions.push({\n      path: [\"body_json\"],\n      operator: \"equals\",\n      value: context.body_json,\n    });\n  } else if (context.body !== null) {\n    // Non-JSON body (text/plain, XML, form-encoded): pin the raw body so\n    // exact-match policies actually match the originating request.\n    conditions.push({\n      path: [\"body\"],\n      operator: \"equals\",\n      value: context.body,\n    });\n  }\n\n  // Header conditions (filtered through IGNORED_HEADERS again for safety)\n  for (const [key, value] of Object.entries(context.headers)) {\n    if (!IGNORED_HEADERS.has(key.toLowerCase()) && typeof value === \"string\") {\n      conditions.push({\n        path: [\"headers\", key.toLowerCase()],\n        operator: \"equals\",\n        value,\n      });\n    }\n  }\n\n  return conditions;\n}\n\n/**\n * Build conditions that match any request to a given domain.\n * Uses the host from the parsed URL.\n *\n * @returns Condition[] for an http permission statement\n */\nexport function buildDomainHttpConditions(\n  context: HttpRequestContext,\n): Condition[] {\n  return [\n    {\n      path: [\"url\", \"host\"],\n      operator: \"matches_host\",\n      value: context.url.host,\n    },\n  ];\n}\n\n/**\n * Build conditions that match an exact action run (with inputs).\n *\n * @returns Condition[] for an action permission statement\n */\nexport function buildExactActionConditions(\n  context: ActionRunContext,\n): Condition[] {\n  const conditions: Condition[] = [];\n\n  if (context.inputs !== undefined && context.inputs !== null) {\n    conditions.push({\n      path: [\"inputs\"],\n      operator: \"equals\",\n      value: context.inputs,\n    });\n  }\n\n  return conditions;\n}\n\n/**\n * The three identity fields that compose an action resource string.\n */\nexport interface ActionResourceParts {\n  selected_api: string;\n  action_type: ActionType;\n  action_key: string;\n}\n\n/**\n * Build the resource string for an action.\n * Format: action/{selected_api}/{action_type}/{action_key}\n */\nexport function buildActionResource(parts: ActionResourceParts): string {\n  return `action/${parts.selected_api}/${parts.action_type}/${parts.action_key}`;\n}\n\n/**\n * Build a broad action resource that matches all actions of the same type\n * for an app (e.g. all reads, all writes). Scopes on `action_type` to\n * avoid silently granting cross-type access.\n *\n * Format: action/{selected_api}/{action_type}/{wildcard}\n */\nexport function buildBroadActionResource(\n  parts: Pick<ActionResourceParts, \"selected_api\" | \"action_type\">,\n): string {\n  return `action/${parts.selected_api}/${parts.action_type}/*`;\n}\n","// ABOUTME: Assembles complete Policy objects from request contexts.\n// ABOUTME: Single source of truth for \"exact request\" instant policies used by web UI and API.\n\nimport type { Policy, Statement } from \"@zapier/policy-schema\";\nimport type {\n  RequestContext,\n  HttpRequestContext,\n  ActionRunContext,\n} from \"./types.ts\";\nimport {\n  buildExactHttpConditions,\n  buildExactActionConditions,\n} from \"./conditions.ts\";\n\n/**\n * Build a `can_use` authentication statement, if the context has a connection_id.\n */\nfunction buildAuthStatement(authenticationId: string): Statement {\n  return {\n    effect: \"allow\",\n    permissions: [\"can_use\"],\n    resources: [`connection/${authenticationId}`],\n    conditions: [],\n  };\n}\n\n/**\n * Build an exact-match policy from an HTTP request context.\n *\n * Produces a policy that allows only the specific request described by the context:\n * - `can_use` statement for the authentication (if present)\n * - `can_execute` statement for `http` with conditions from `buildExactHttpConditions`\n *   plus a `keys_in` guard restricting allowed query parameter keys\n */\nfunction httpContextToPolicy(context: HttpRequestContext): Policy {\n  const statements: Statement[] = [];\n\n  if (context.connection_id) {\n    statements.push(buildAuthStatement(context.connection_id));\n  }\n\n  const conditions = buildExactHttpConditions(context);\n\n  // Add a keys_in guard so only the query param keys present in the original\n  // request are allowed — blocks injection of extra query params.\n  conditions.push({\n    path: [\"url\", \"query\"],\n    operator: \"keys_in\",\n    value: Object.keys(context.url.query),\n  });\n\n  statements.push({\n    effect: \"allow\",\n    permissions: [\"can_execute\"],\n    resources: [\"http\"],\n    conditions,\n  });\n\n  return { version: 2, statements };\n}\n\n/**\n * Build an exact-match policy from an action run context.\n *\n * Produces a policy that allows only the specific action described by the context:\n * - `can_use` statement for the authentication (if present)\n * - `can_execute` statement for the action resource with input conditions\n */\nfunction actionContextToPolicy(context: ActionRunContext): Policy {\n  const statements: Statement[] = [];\n\n  if (context.connection_id) {\n    statements.push(buildAuthStatement(context.connection_id));\n  }\n\n  statements.push({\n    effect: \"allow\",\n    permissions: [\"can_execute\"],\n    resources: [context.resource],\n    conditions: buildExactActionConditions(context),\n  });\n\n  return { version: 2, statements };\n}\n\n/**\n * Build an exact-match policy from any supported request context.\n *\n * This is the single source of truth for \"allow this exact request\" instant policies.\n * Used by the web UI and anywhere else that needs to produce an exact policy from a context.\n */\nexport function toExactPolicy(context: RequestContext): Policy {\n  if (context.request_type === \"http_request\") {\n    return httpContextToPolicy(context);\n  }\n  return actionContextToPolicy(context);\n}\n","// ABOUTME: Builds connection-level policies for the basic approvals MVP.\n// ABOUTME: Generates deterministic policies that allow read or read+write access scoped to a specific connection.\n\nimport { z } from \"zod\";\nimport type { Policy, Statement, Condition } from \"@zapier/policy-schema\";\nimport {\n  parseActionResource,\n  type ActionType,\n  type RequestContext,\n} from \"./types.ts\";\n\n/**\n * Replace the implementation-version suffix of a `selected_api` with a `@*`\n * wildcard so connection-level policies stay valid across version bumps. A\n * runtime request with `selected_api: \"App@2.7.3\"` matches a policy resource\n * scoped to `App@*` while still being distinguishable from a different app\n * (e.g. `App2@1.0.0`).\n *\n * No-op when the input has no `@` — assumed to be already version-less.\n */\nfunction globSelectedApiVersion(selectedApi: string): string {\n  const at = selectedApi.indexOf(\"@\");\n  return at === -1 ? selectedApi : selectedApi.slice(0, at) + \"@*\";\n}\n\nexport const AccessLevelSchema = z.enum([\"read\", \"read_write\"]);\nexport type AccessLevel = z.infer<typeof AccessLevelSchema>;\n\n/** HTTP methods that count as side-effect-free reads for connection-level policies. */\nexport const READ_HTTP_METHODS = [\"GET\", \"HEAD\", \"OPTIONS\"] as const;\n\n/**\n * Action types that count as side-effect-free reads for connection-level\n * policies. `read_bulk` is the paginated/bulk variant of `read` — same\n * external API semantics, no mutations. Widely used by major apps (Slack,\n * Gmail, Jira, Salesforce, etc.) via the public `bulkReads` schema key.\n * `filter` and `run` are excluded: neither has a runtime executor for\n * external apps, and `filter` actions don't carry a connection_id anyway,\n * so this allowlist has no effect on them.\n */\nexport const READ_ACTION_TYPES = [\n  \"read\",\n  \"read_bulk\",\n  \"search\",\n] as const satisfies readonly ActionType[];\n\nconst READ_HTTP_METHOD_SET: ReadonlySet<string> = new Set(READ_HTTP_METHODS);\nconst READ_ACTION_TYPE_SET: ReadonlySet<ActionType> = new Set(\n  READ_ACTION_TYPES,\n);\n\n/**\n * Returns true when the request needs write access (i.e. it is NOT a\n * side-effect-free read). Mirrors the logic encoded in `buildConnectionPolicy`\n * so UI surfaces that gate the read-vs-read_write choice stay consistent\n * with the policies they generate.\n */\nexport function isWriteRequest(context: RequestContext): boolean {\n  if (context.request_type === \"http_request\") {\n    // Method is uppercase by construction (buildHttpRequestContext canonicalizes\n    // it on the way in), so no normalization is needed here.\n    return !READ_HTTP_METHOD_SET.has(context.method);\n  }\n  const { action_type } = parseActionResource(context.resource);\n  return !READ_ACTION_TYPE_SET.has(action_type);\n}\n\n/**\n * Build a connection-level policy that covers both HTTP and action access.\n *\n * Always produces three statements:\n * 1. `can_use` for the authentication\n * 2. `can_execute` on `http` scoped by connection_id (+ method filter for read)\n * 3. `can_execute` on `action/{selectedApi}/{action_type}/*` per allowed type,\n *    scoped by connection_id. For read access, the resource list expands to\n *    one entry per read action_type so the engine matches via the resource\n *    string rather than a separate `path: [\"action_type\"]` condition.\n */\nexport function buildConnectionPolicy(options: {\n  connectionId: string;\n  selectedApi: string;\n  accessLevel: AccessLevel;\n}): Policy {\n  const { connectionId, selectedApi, accessLevel } = options;\n\n  const authStatement: Statement = {\n    effect: \"allow\",\n    permissions: [\"can_use\"],\n    resources: [`connection/${connectionId}`],\n    conditions: [],\n  };\n\n  const connectionCondition: Condition = {\n    path: [\"connection_id\"],\n    operator: \"equals\",\n    value: connectionId,\n  };\n\n  const httpConditions: Condition[] = [connectionCondition];\n  if (accessLevel === \"read\") {\n    httpConditions.push({\n      path: [\"method\"],\n      operator: \"in\",\n      value: [...READ_HTTP_METHODS],\n    });\n  }\n\n  const httpStatement: Statement = {\n    effect: \"allow\",\n    permissions: [\"can_execute\"],\n    resources: [\"http\"],\n    conditions: httpConditions,\n  };\n\n  const apiPattern = globSelectedApiVersion(selectedApi);\n  const actionResources =\n    accessLevel === \"read\"\n      ? READ_ACTION_TYPES.map((t) => `action/${apiPattern}/${t}/*`)\n      : [`action/${apiPattern}/*/*`];\n\n  const actionStatement: Statement = {\n    effect: \"allow\",\n    permissions: [\"can_execute\"],\n    resources: actionResources,\n    conditions: [connectionCondition],\n  };\n\n  return {\n    version: 2,\n    statements: [authStatement, httpStatement, actionStatement],\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACGA,iBAAkB;AAClB,4BAAqC;AACrC,2BAAgC;AAAA,IAEhC,4CAAqB,YAAC;AASf,IAAM,kBAAkB,aAC5B,OAAO;AAAA,EACN,QAAQ,aAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,2BAA2B,CAAC;AAAA,EACtE,MAAM,aAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,mCAAmC,CAAC;AAAA,EAC5E,MAAM,aACH,OAAO,EACP,IAAI,EACJ,QAAQ;AAAA,IACP,aAAa;AAAA,EACf,CAAC;AAAA,EACH,MAAM,aAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,2BAA2B,CAAC;AAAA,EACpE,OAAO,aACJ,OAAO,aAAE,OAAO,GAAG,aAAE,MAAM,aAAE,OAAO,CAAC,CAAC,EACtC,QAAQ;AAAA,IACP,aAAa;AAAA,EACf,CAAC;AACL,CAAC,EACA,QAAQ,WAAW;AAIf,IAAM,gBAAwC;AAAA,EACnD,MAAM;AAAA,EACN,OAAO;AACT;AAMO,SAAS,SAAS,KAAwB;AAC/C,QAAM,MAAM,IAAI,IAAI,GAAG;AACvB,QAAM,SAAS,IAAI,SAAS,MAAM,GAAG,EAAE,EAAE,YAAY;AACrD,QAAM,OAAO,IAAI,SAAS,YAAY;AACtC,QAAM,OAAO,IAAI,OAAO,SAAS,IAAI,MAAM,EAAE,IAAK,cAAc,MAAM,KAAK;AAC3E,QAAM,OAAO,IAAI,YAAY;AAC7B,QAAM,QAAkC,CAAC;AACzC,aAAW,CAAC,KAAK,KAAK,KAAK,IAAI,cAAc;AAC3C,QAAI,CAAC,MAAM,GAAG,GAAG;AACf,YAAM,GAAG,IAAI,CAAC;AAAA,IAChB;AACA,UAAM,GAAG,EAAE,KAAK,KAAK;AAAA,EACvB;AACA,SAAO,EAAE,QAAQ,MAAM,MAAM,MAAM,MAAM;AAC3C;AAMO,SAAS,eAAe,QAA2B;AACxD,QAAM,EAAE,QAAQ,MAAM,MAAM,MAAM,MAAM,IAAI;AAC5C,QAAM,cAAc,cAAc,MAAM;AACxC,QAAM,aAAa,SAAS,cAAc,IAAI,OAAO,IAAI,CAAC,KAAK;AAC/D,QAAM,SAAS,IAAI,gBAAgB;AACnC,aAAW,CAAC,KAAK,MAAM,KAAK,OAAO,QAAQ,KAAK,GAAG;AACjD,eAAW,SAAS,QAAQ;AAC1B,aAAO,OAAO,KAAK,KAAK;AAAA,IAC1B;AAAA,EACF;AACA,QAAM,cAAc,OAAO,SAAS;AACpC,SAAO,GAAG,MAAM,MAAM,IAAI,GAAG,UAAU,GAAG,IAAI,GAAG,cAAc,MAAM,cAAc,EAAE;AACvF;AAUO,IAAM,2BAA2B,aACrC,OAAO;AAAA,EACN,cAAc,aAAE,QAAQ,cAAc;AAAA,EACtC,QAAQ,aACL,OAAO,EACP,IAAI,EAAE,EACN,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC;AAAA;AAAA,EAEnC,KAAK;AAAA;AAAA,EAEL,SAAS,aACN,OAAO,aAAE,OAAO,GAAG,aAAE,OAAO,CAAC,EAC7B,QAAQ;AAAA,IACP,aAAa;AAAA,EACf,CAAC;AAAA;AAAA,EAEH,MAAM,aAAE,OAAO,EAAE,IAAI,KAAK,EAAE,SAAS;AAAA;AAAA,EAErC,WAAW,qCAAgB,SAAS,EAAE,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,IAK5C,MAAM;AAAA,IACN,aAAa;AAAA,EACf,CAAC;AAAA;AAAA,EAED,eAAe,aACZ,OAAO,EACP,IAAI,GAAG,EACP,SAAS,EACT,QAAQ,EAAE,aAAa,6CAA6C,CAAC;AAAA;AAAA,EAExE,QAAQ,aACL,OAAO,EACP,IAAI,IAAI,EACR,SAAS,EACT,QAAQ,EAAE,aAAa,iDAAiD,CAAC;AAC9E,CAAC,EACA,QAAQ,oBAAoB;AAYxB,IAAM,mBAAmB,aAC7B,KAAK;AAAA,EACJ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC,EACA,QAAQ,eAAe,EAAE,aAAa,gCAAgC,CAAC;AAUnE,IAAM,kCACX;AAWK,SAAS,oBAAoB,UAIlC;AACA,QAAM,WAAW,SAAS,MAAM,GAAG;AACnC,MAAI,SAAS,WAAW,KAAK,SAAS,CAAC,MAAM,UAAU;AACrD,UAAM,IAAI;AAAA,MACR,iFAAiF,QAAQ;AAAA,IAC3F;AAAA,EACF;AACA,QAAM,CAAC,EAAE,aAAa,eAAe,SAAS,IAAI;AAClD,MAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,WAAW;AAChD,UAAM,IAAI,MAAM,sCAAsC,QAAQ,EAAE;AAAA,EAClE;AACA,QAAM,aAAa,iBAAiB,UAAU,aAAa;AAC3D,MAAI,CAAC,WAAW,SAAS;AACvB,UAAM,IAAI;AAAA,MACR,4CAA4C,aAAa,MAAM,QAAQ;AAAA,IACzE;AAAA,EACF;AACA,MAAI,CAAC,gCAAgC,KAAK,WAAW,GAAG;AACtD,UAAM,IAAI;AAAA,MACR,qDAAqD,WAAW,MAAM,QAAQ;AAAA,IAChF;AAAA,EACF;AACA,MAAI,CAAC,gCAAgC,KAAK,SAAS,GAAG;AACpD,UAAM,IAAI;AAAA,MACR,mDAAmD,SAAS,MAAM,QAAQ;AAAA,IAC5E;AAAA,EACF;AACA,SAAO;AAAA,IACL,cAAc;AAAA,IACd,aAAa,WAAW;AAAA,IACxB,YAAY;AAAA,EACd;AACF;AAwBO,IAAM,8BAA8B,aACxC,OAAO;AAAA,EACN,cAAc,aAAE,QAAQ,YAAY;AAAA,EACpC,UAAU,aACP,OAAO,EACP,IAAI,IAAI,EACR,SAAS,EACT,QAAQ;AAAA,IACP,aACE;AAAA,EACJ,CAAC;AAAA,EACH,cAAc,aACX,OAAO,EACP,IAAI,GAAG,EACP,SAAS,EACT,QAAQ;AAAA,IACP,YAAY;AAAA,IACZ,aACE;AAAA,EACJ,CAAC;AAAA,EACH,aAAa,iBAAiB,SAAS,EAAE,QAAQ;AAAA,IAC/C,YAAY;AAAA,IACZ,aAAa;AAAA,EACf,CAAC;AAAA,EACD,YAAY,aACT,OAAO,EACP,IAAI,GAAG,EACP,SAAS,EACT,QAAQ;AAAA,IACP,YAAY;AAAA,IACZ,aACE;AAAA,EACJ,CAAC;AAAA,EACH,eAAe,aACZ,OAAO,EACP,IAAI,GAAG,EACP,SAAS,EACT,QAAQ,EAAE,aAAa,6CAA6C,CAAC;AAAA,EACxE,QAAQ,qCAAgB,SAAS,EAAE,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,IAKzC,MAAM;AAAA,IACN,aAAa;AAAA,EACf,CAAC;AAAA,EACD,QAAQ,aACL,OAAO,EACP,IAAI,IAAI,EACR,SAAS,EACT,QAAQ,EAAE,aAAa,iDAAiD,CAAC;AAC9E,CAAC,EACA,QAAQ,oBAAoB;AAAA,EAC3B,aACE;AACJ,CAAC;AAEI,IAAM,yBAAyB,4BAA4B;AAAA,EAChE,CAAC,OAAO,QAAQ;AACd,UAAM,WACJ,MAAM,aACL,MAAM,gBAAgB,MAAM,eAAe,MAAM,aAC9C,UAAU,MAAM,YAAY,IAAI,MAAM,WAAW,IAAI,MAAM,UAAU,KACrE;AACN,QAAI,aAAa,QAAW;AAC1B,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,SACE;AAAA,MACJ,CAAC;AACD,aAAO,aAAE;AAAA,IACX;AACA,QAAI;AACF,0BAAoB,QAAQ;AAAA,IAC9B,SAAS,KAAK;AACZ,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,MAC1D,CAAC;AACD,aAAO,aAAE;AAAA,IACX;AACA,WAAO;AAAA,MACL,cAAc;AAAA,MACd;AAAA,MACA,GAAI,MAAM,kBAAkB,UAAa;AAAA,QACvC,eAAe,MAAM;AAAA,MACvB;AAAA,MACA,GAAI,MAAM,WAAW,UAAa,EAAE,QAAQ,MAAM,OAAO;AAAA,MACzD,GAAI,MAAM,WAAW,UAAa,EAAE,QAAQ,MAAM,OAAO;AAAA,IAC3D;AAAA,EACF;AACF;AAUO,IAAM,uBAAuB,aACjC,MAAM,CAAC,0BAA0B,sBAAsB,CAAC,EACxD,QAAQ,kBAAkB;AAAA,EACzB,aAAa;AACf,CAAC;;;ACvUI,IAAM,kBAAkB,oBAAI,IAAI;AAAA;AAAA,EAErC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AACF,CAAC;;;ACrCD,IAAAA,cAAkB;;;ACiBX,SAAS,yBACd,SACa;AACb,QAAM,aAA0B;AAAA,IAC9B,EAAE,MAAM,CAAC,QAAQ,GAAG,UAAU,UAAU,OAAO,QAAQ,OAAO;AAAA,EAChE;AAEA,QAAM,EAAE,IAAI,IAAI;AAGhB,QAAM,cACJ,IAAI,WAAW,UAAU,MAAM,IAAI,WAAW,SAAS,KAAK;AAC9D,QAAM,aAAa,IAAI,SAAS,cAAc,IAAI,OAAO,IAAI,IAAI,CAAC,KAAK;AACvE,QAAM,kBAAkB,GAAG,IAAI,MAAM,MAAM,IAAI,IAAI,GAAG,UAAU,GAAG,IAAI,IAAI;AAC3E,aAAW,KAAK;AAAA,IACd,MAAM,CAAC,KAAK;AAAA,IACZ,UAAU;AAAA,IACV,OAAO;AAAA,EACT,CAAC;AAGD,aAAW,CAAC,KAAK,MAAM,KAAK,OAAO,QAAQ,IAAI,KAAK,GAAG;AACrD,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,OAAO,SAAS,GAAG;AAAA,MAC1B,UAAU;AAAA,MACV,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AAGA,MAAI,QAAQ,cAAc,MAAM;AAC9B,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,WAAW;AAAA,MAClB,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH,WAAW,QAAQ,SAAS,MAAM;AAGhC,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,MAAM;AAAA,MACb,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH;AAGA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,OAAO,GAAG;AAC1D,QAAI,CAAC,gBAAgB,IAAI,IAAI,YAAY,CAAC,KAAK,OAAO,UAAU,UAAU;AACxE,iBAAW,KAAK;AAAA,QACd,MAAM,CAAC,WAAW,IAAI,YAAY,CAAC;AAAA,QACnC,UAAU;AAAA,QACV;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AAQO,SAAS,0BACd,SACa;AACb,SAAO;AAAA,IACL;AAAA,MACE,MAAM,CAAC,OAAO,MAAM;AAAA,MACpB,UAAU;AAAA,MACV,OAAO,QAAQ,IAAI;AAAA,IACrB;AAAA,EACF;AACF;AAOO,SAAS,2BACd,SACa;AACb,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,WAAW,UAAa,QAAQ,WAAW,MAAM;AAC3D,eAAW,KAAK;AAAA,MACd,MAAM,CAAC,QAAQ;AAAA,MACf,UAAU;AAAA,MACV,OAAO,QAAQ;AAAA,IACjB,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAeO,SAAS,oBAAoB,OAAoC;AACtE,SAAO,UAAU,MAAM,YAAY,IAAI,MAAM,WAAW,IAAI,MAAM,UAAU;AAC9E;AASO,SAAS,yBACd,OACQ;AACR,SAAO,UAAU,MAAM,YAAY,IAAI,MAAM,WAAW;AAC1D;;;ADlIO,IAAM,uCAAuC,cAAE,OAAO;AAAA,EAC3D,QAAQ,cAAE,OAAO;AAAA;AAAA,EAEjB,KAAK,cAAE,OAAO;AAAA;AAAA,EAEd,SAAS,cACN;AAAA,IACC,cAAE,OAAO;AAAA,IACT,cAAE,MAAM,CAAC,cAAE,OAAO,GAAG,cAAE,MAAM,cAAE,OAAO,CAAC,GAAG,cAAE,UAAU,CAAC,CAAC;AAAA,EAC1D,EACC,SAAS;AAAA;AAAA,EAEZ,MAAM,cAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA;AAAA,EAErC,WAAW,qCAAgB,SAAS;AAAA;AAAA,EAEpC,eAAe,cAAE,OAAO,EAAE,SAAS;AACrC,CAAC;AAoBM,SAAS,wBACd,SACoB;AAGpB,QAAM,SAAS,qCAAqC,MAAM,OAAO;AAGjE,QAAM,SAAS,OAAO,IAAI,SAAS,KAAK,IACpC,OAAO,MACP,WAAW,OAAO,GAAG;AACzB,QAAM,MAAM,SAAS,MAAM;AAG3B,QAAM,UAAkC,CAAC;AACzC,MAAI,OAAO,SAAS;AAClB,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,OAAO,GAAG;AACzD,YAAM,WAAW,IAAI,YAAY;AACjC,UAAI,CAAC,gBAAgB,IAAI,QAAQ,KAAK,OAAO,UAAU,UAAU;AAC/D,gBAAQ,QAAQ,IAAI;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAIA,MAAI,YAAqB;AACzB,MAAI,OAAO,cAAc,QAAW;AAClC,gBAAY,OAAO;AAAA,EACrB,WAAW,OAAO,MAAM;AACtB,UAAM,cAAc,QAAQ,cAAc;AAC1C,UAAM,SACJ,OAAO,gBAAgB,aACtB,YAAY,SAAS,kBAAkB,KACrC,YAAY,SAAS,cAAc,KAClC,YAAY,SAAS,OAAO;AAClC,QAAI,QAAQ;AACV,UAAI;AACF,oBAAY,KAAK,MAAM,OAAO,IAAI;AAAA,MACpC,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAEA,SAAO,yBAAyB,MAAM;AAAA,IACpC,cAAc;AAAA,IACd,QAAQ,OAAO,OAAO,YAAY;AAAA,IAClC;AAAA,IACA;AAAA,IACA,MAAM,OAAO,QAAQ;AAAA,IACrB;AAAA,IACA,eAAe,OAAO;AAAA,EACxB,CAAC;AACH;AAEO,IAAM,qCAAqC,cAAE,OAAO;AAAA,EACzD,cAAc,cAAE,OAAO,EAAE,MAAM,iCAAiC;AAAA,IAC9D,SACE;AAAA,EACJ,CAAC;AAAA,EACD,aAAa;AAAA,EACb,YAAY,cAAE,OAAO,EAAE,MAAM,iCAAiC;AAAA,IAC5D,SACE;AAAA,EACJ,CAAC;AAAA,EACD,eAAe,cAAE,OAAO,EAAE,SAAS;AAAA,EACnC,QAAQ,qCAAgB,SAAS;AAAA,EACjC,QAAQ,cAAE,OAAO,EAAE,SAAS;AAC9B,CAAC;AAYM,SAAS,sBACd,SACkB;AAClB,QAAM,SAAS,mCAAmC,MAAM,OAAO;AAC/D,SAAO,uBAAuB,MAAM;AAAA,IAClC,cAAc;AAAA,IACd,UAAU,oBAAoB;AAAA,MAC5B,cAAc,OAAO;AAAA,MACrB,aAAa,OAAO;AAAA,MACpB,YAAY,OAAO;AAAA,IACrB,CAAC;AAAA,IACD,eAAe,OAAO;AAAA,IACtB,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,EACjB,CAAC;AACH;;;AErIA,SAAS,mBAAmB,kBAAqC;AAC/D,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,aAAa,CAAC,SAAS;AAAA,IACvB,WAAW,CAAC,cAAc,gBAAgB,EAAE;AAAA,IAC5C,YAAY,CAAC;AAAA,EACf;AACF;AAUA,SAAS,oBAAoB,SAAqC;AAChE,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,eAAe;AACzB,eAAW,KAAK,mBAAmB,QAAQ,aAAa,CAAC;AAAA,EAC3D;AAEA,QAAM,aAAa,yBAAyB,OAAO;AAInD,aAAW,KAAK;AAAA,IACd,MAAM,CAAC,OAAO,OAAO;AAAA,IACrB,UAAU;AAAA,IACV,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK;AAAA,EACtC,CAAC;AAED,aAAW,KAAK;AAAA,IACd,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,MAAM;AAAA,IAClB;AAAA,EACF,CAAC;AAED,SAAO,EAAE,SAAS,GAAG,WAAW;AAClC;AASA,SAAS,sBAAsB,SAAmC;AAChE,QAAM,aAA0B,CAAC;AAEjC,MAAI,QAAQ,eAAe;AACzB,eAAW,KAAK,mBAAmB,QAAQ,aAAa,CAAC;AAAA,EAC3D;AAEA,aAAW,KAAK;AAAA,IACd,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,QAAQ,QAAQ;AAAA,IAC5B,YAAY,2BAA2B,OAAO;AAAA,EAChD,CAAC;AAED,SAAO,EAAE,SAAS,GAAG,WAAW;AAClC;AAQO,SAAS,cAAc,SAAiC;AAC7D,MAAI,QAAQ,iBAAiB,gBAAgB;AAC3C,WAAO,oBAAoB,OAAO;AAAA,EACpC;AACA,SAAO,sBAAsB,OAAO;AACtC;;;AC7FA,IAAAC,cAAkB;AAiBlB,SAAS,uBAAuB,aAA6B;AAC3D,QAAM,KAAK,YAAY,QAAQ,GAAG;AAClC,SAAO,OAAO,KAAK,cAAc,YAAY,MAAM,GAAG,EAAE,IAAI;AAC9D;AAEO,IAAM,oBAAoB,cAAE,KAAK,CAAC,QAAQ,YAAY,CAAC;AAIvD,IAAM,oBAAoB,CAAC,OAAO,QAAQ,SAAS;AAWnD,IAAM,oBAAoB;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,uBAA4C,IAAI,IAAI,iBAAiB;AAC3E,IAAM,uBAAgD,IAAI;AAAA,EACxD;AACF;AAQO,SAAS,eAAe,SAAkC;AAC/D,MAAI,QAAQ,iBAAiB,gBAAgB;AAG3C,WAAO,CAAC,qBAAqB,IAAI,QAAQ,MAAM;AAAA,EACjD;AACA,QAAM,EAAE,YAAY,IAAI,oBAAoB,QAAQ,QAAQ;AAC5D,SAAO,CAAC,qBAAqB,IAAI,WAAW;AAC9C;AAaO,SAAS,sBAAsB,SAI3B;AACT,QAAM,EAAE,cAAc,aAAa,YAAY,IAAI;AAEnD,QAAM,gBAA2B;AAAA,IAC/B,QAAQ;AAAA,IACR,aAAa,CAAC,SAAS;AAAA,IACvB,WAAW,CAAC,cAAc,YAAY,EAAE;AAAA,IACxC,YAAY,CAAC;AAAA,EACf;AAEA,QAAM,sBAAiC;AAAA,IACrC,MAAM,CAAC,eAAe;AAAA,IACtB,UAAU;AAAA,IACV,OAAO;AAAA,EACT;AAEA,QAAM,iBAA8B,CAAC,mBAAmB;AACxD,MAAI,gBAAgB,QAAQ;AAC1B,mBAAe,KAAK;AAAA,MAClB,MAAM,CAAC,QAAQ;AAAA,MACf,UAAU;AAAA,MACV,OAAO,CAAC,GAAG,iBAAiB;AAAA,IAC9B,CAAC;AAAA,EACH;AAEA,QAAM,gBAA2B;AAAA,IAC/B,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW,CAAC,MAAM;AAAA,IAClB,YAAY;AAAA,EACd;AAEA,QAAM,aAAa,uBAAuB,WAAW;AACrD,QAAM,kBACJ,gBAAgB,SACZ,kBAAkB,IAAI,CAAC,MAAM,UAAU,UAAU,IAAI,CAAC,IAAI,IAC1D,CAAC,UAAU,UAAU,MAAM;AAEjC,QAAM,kBAA6B;AAAA,IACjC,QAAQ;AAAA,IACR,aAAa,CAAC,aAAa;AAAA,IAC3B,WAAW;AAAA,IACX,YAAY,CAAC,mBAAmB;AAAA,EAClC;AAEA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,YAAY,CAAC,eAAe,eAAe,eAAe;AAAA,EAC5D;AACF;","names":["import_zod","import_zod"]}

package/dist/index.d.cts

@@ -1,12 +1,8 @@
-import { z } from 'zod';
 import * as _zapier_policy_schema from '@zapier/policy-schema';
-import { JsonValue, Condition, Policy } from '@zapier/policy-schema';
+import { Condition, Policy } from '@zapier/policy-schema';
+export { JsonValueSchema } from '@zapier/policy-schema';
+import { z } from 'zod';
 
-/**
- * Zod schema for arbitrary JSON values. Used across context schemas for
- * unstructured fields like `body_json` and `inputs`.
- */
-declare const JsonValueSchema: z.ZodCustom<JsonValue, JsonValue>;
 /**
  * Parsed URL components for policy evaluation.
  * Matches the ParsedUrl shape from @zapier/policy-schema so that
@@ -42,7 +38,7 @@ declare function buildUrlString(parsed: ParsedUrl): string;
  */
 declare const HttpRequestContextSchema: z.ZodObject<{
     request_type: z.ZodLiteral<"http_request">;
-    method: z.ZodString;
+    method: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
     url: z.ZodObject<{
         scheme: z.ZodString;
         host: z.ZodString;
@@ -52,32 +48,90 @@ declare const HttpRequestContextSchema: z.ZodObject<{
     }, z.core.$strip>;
     headers: z.ZodRecord<z.ZodString, z.ZodString>;
     body: z.ZodNullable<z.ZodString>;
-    body_json: z.ZodNullable<z.ZodCustom<JsonValue, JsonValue>>;
+    body_json: z.ZodNullable<z.ZodType<_zapier_policy_schema.JsonValue, unknown, z.core.$ZodTypeInternals<_zapier_policy_schema.JsonValue, unknown>>>;
     connection_id: z.ZodOptional<z.ZodString>;
     reason: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 type HttpRequestContext = z.infer<typeof HttpRequestContextSchema>;
 /**
- * Action run context for approval/policy flows.
- * Sent by sdkapi when an action run is denied, stored by approvalsapi,
- * and used to build policy conditions.
+ * Canonical Zapier action types.
+ *
+ * Mirrors the `action_type` enum in sdkapi's OpenAPI spec
+ * (`packages/openapi-spec/openapi.d.ts` `action_type`). Single source of
+ * truth for any code that branches on or filters by action_type — keeps
+ * `ActionRunContextSchema`, `BuildActionRunContextOptionsSchema`, and the
+ * `READ_ACTION_TYPES` allowlist in `connection-policy.ts` aligned.
  */
-declare const ActionRunContextSchema: z.ZodObject<{
+declare const ActionTypeSchema: z.ZodEnum<{
+    filter: "filter";
+    read: "read";
+    read_bulk: "read_bulk";
+    run: "run";
+    search: "search";
+    search_and_write: "search_and_write";
+    search_or_write: "search_or_write";
+    write: "write";
+}>;
+type ActionType = z.infer<typeof ActionTypeSchema>;
+/**
+ * Parse an action resource string of the form
+ * `action/{selected_api}/{action_type}/{action_key}` into its parts.
+ * Throws if the string doesn't match the canonical 4-segment shape or
+ * if its `action_type` segment isn't one of the canonical 8 — every
+ * action_run context that has been through `ActionRunContextSchema` is
+ * guaranteed to parse cleanly, so a thrown error here means upstream
+ * validation was bypassed.
+ */
+declare function parseActionResource(resource: string): {
+    selected_api: string;
+    action_type: ActionType;
+    action_key: string;
+};
+declare const ActionRunContextSchema: z.ZodPipe<z.ZodObject<{
     request_type: z.ZodLiteral<"action_run">;
-    selected_api: z.ZodString;
-    action_type: z.ZodString;
-    action_key: z.ZodString;
+    resource: z.ZodOptional<z.ZodString>;
+    selected_api: z.ZodOptional<z.ZodString>;
+    action_type: z.ZodOptional<z.ZodEnum<{
+        filter: "filter";
+        read: "read";
+        read_bulk: "read_bulk";
+        run: "run";
+        search: "search";
+        search_and_write: "search_and_write";
+        search_or_write: "search_or_write";
+        write: "write";
+    }>>;
+    action_key: z.ZodOptional<z.ZodString>;
     connection_id: z.ZodOptional<z.ZodString>;
-    inputs: z.ZodOptional<z.ZodCustom<JsonValue, JsonValue>>;
+    inputs: z.ZodOptional<z.ZodType<_zapier_policy_schema.JsonValue, unknown, z.core.$ZodTypeInternals<_zapier_policy_schema.JsonValue, unknown>>>;
     reason: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>;
+}, z.core.$strip>, z.ZodTransform<{
+    reason?: string | undefined;
+    inputs?: _zapier_policy_schema.JsonValue | undefined;
+    connection_id?: string | undefined;
+    request_type: "action_run";
+    resource: string;
+}, {
+    request_type: "action_run";
+    resource?: string | undefined;
+    selected_api?: string | undefined;
+    action_type?: "filter" | "read" | "read_bulk" | "run" | "search" | "search_and_write" | "search_or_write" | "write" | undefined;
+    action_key?: string | undefined;
+    connection_id?: string | undefined;
+    inputs?: _zapier_policy_schema.JsonValue | undefined;
+    reason?: string | undefined;
+}>>;
 type ActionRunContext = z.infer<typeof ActionRunContextSchema>;
 /**
- * Discriminated union of all request context types.
+ * Union of all request context types, keyed on `request_type`.
+ *
+ * Plain `z.union` (not `z.discriminatedUnion`) because
+ * `ActionRunContextSchema` carries a `.transform` and discriminated
+ * unions can't accept a `ZodEffects` member.
  */
-declare const RequestContextSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+declare const RequestContextSchema: z.ZodUnion<readonly [z.ZodObject<{
     request_type: z.ZodLiteral<"http_request">;
-    method: z.ZodString;
+    method: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
     url: z.ZodObject<{
         scheme: z.ZodString;
         host: z.ZodString;
@@ -87,18 +141,43 @@ declare const RequestContextSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     }, z.core.$strip>;
     headers: z.ZodRecord<z.ZodString, z.ZodString>;
     body: z.ZodNullable<z.ZodString>;
-    body_json: z.ZodNullable<z.ZodCustom<JsonValue, JsonValue>>;
+    body_json: z.ZodNullable<z.ZodType<_zapier_policy_schema.JsonValue, unknown, z.core.$ZodTypeInternals<_zapier_policy_schema.JsonValue, unknown>>>;
     connection_id: z.ZodOptional<z.ZodString>;
     reason: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>, z.ZodObject<{
+}, z.core.$strip>, z.ZodPipe<z.ZodObject<{
     request_type: z.ZodLiteral<"action_run">;
-    selected_api: z.ZodString;
-    action_type: z.ZodString;
-    action_key: z.ZodString;
+    resource: z.ZodOptional<z.ZodString>;
+    selected_api: z.ZodOptional<z.ZodString>;
+    action_type: z.ZodOptional<z.ZodEnum<{
+        filter: "filter";
+        read: "read";
+        read_bulk: "read_bulk";
+        run: "run";
+        search: "search";
+        search_and_write: "search_and_write";
+        search_or_write: "search_or_write";
+        write: "write";
+    }>>;
+    action_key: z.ZodOptional<z.ZodString>;
     connection_id: z.ZodOptional<z.ZodString>;
-    inputs: z.ZodOptional<z.ZodCustom<JsonValue, JsonValue>>;
+    inputs: z.ZodOptional<z.ZodType<_zapier_policy_schema.JsonValue, unknown, z.core.$ZodTypeInternals<_zapier_policy_schema.JsonValue, unknown>>>;
     reason: z.ZodOptional<z.ZodString>;
-}, z.core.$strip>], "request_type">;
+}, z.core.$strip>, z.ZodTransform<{
+    reason?: string | undefined;
+    inputs?: _zapier_policy_schema.JsonValue | undefined;
+    connection_id?: string | undefined;
+    request_type: "action_run";
+    resource: string;
+}, {
+    request_type: "action_run";
+    resource?: string | undefined;
+    selected_api?: string | undefined;
+    action_type?: "filter" | "read" | "read_bulk" | "run" | "search" | "search_and_write" | "search_or_write" | "write" | undefined;
+    action_key?: string | undefined;
+    connection_id?: string | undefined;
+    inputs?: _zapier_policy_schema.JsonValue | undefined;
+    reason?: string | undefined;
+}>>]>;
 type RequestContext = z.infer<typeof RequestContextSchema>;
 
 /**
@@ -115,7 +194,7 @@ declare const BuildHttpRequestContextOptionsSchema: z.ZodObject<{
     url: z.ZodString;
     headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>, z.ZodUndefined]>>>;
     body: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    body_json: z.ZodOptional<z.ZodCustom<_zapier_policy_schema.JsonValue, _zapier_policy_schema.JsonValue>>;
+    body_json: z.ZodOptional<z.ZodType<_zapier_policy_schema.JsonValue, unknown, z.core.$ZodTypeInternals<_zapier_policy_schema.JsonValue, unknown>>>;
     connection_id: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 type BuildHttpRequestContextOptions = z.infer<typeof BuildHttpRequestContextOptionsSchema>;
@@ -137,14 +216,28 @@ type BuildHttpRequestContextOptions = z.infer<typeof BuildHttpRequestContextOpti
 declare function buildHttpRequestContext(options: BuildHttpRequestContextOptions): HttpRequestContext;
 declare const BuildActionRunContextOptionsSchema: z.ZodObject<{
     selected_api: z.ZodString;
-    action_type: z.ZodString;
+    action_type: z.ZodEnum<{
+        filter: "filter";
+        read: "read";
+        read_bulk: "read_bulk";
+        run: "run";
+        search: "search";
+        search_and_write: "search_and_write";
+        search_or_write: "search_or_write";
+        write: "write";
+    }>;
     action_key: z.ZodString;
     connection_id: z.ZodOptional<z.ZodString>;
-    inputs: z.ZodOptional<z.ZodCustom<_zapier_policy_schema.JsonValue, _zapier_policy_schema.JsonValue>>;
+    inputs: z.ZodOptional<z.ZodType<_zapier_policy_schema.JsonValue, unknown, z.core.$ZodTypeInternals<_zapier_policy_schema.JsonValue, unknown>>>;
+    reason: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 type BuildActionRunContextOptions = z.infer<typeof BuildActionRunContextOptionsSchema>;
 /**
  * Build a canonical ActionRunContext from raw action parts.
+ *
+ * Callers pass the three identity fields separately for readability;
+ * this validates them and collapses them into the canonical `resource`
+ * string the schema stores.
  */
 declare function buildActionRunContext(options: BuildActionRunContextOptions): ActionRunContext;
 
@@ -171,16 +264,27 @@ declare function buildDomainHttpConditions(context: HttpRequestContext): Conditi
  * @returns Condition[] for an action permission statement
  */
 declare function buildExactActionConditions(context: ActionRunContext): Condition[];
+/**
+ * The three identity fields that compose an action resource string.
+ */
+interface ActionResourceParts {
+    selected_api: string;
+    action_type: ActionType;
+    action_key: string;
+}
 /**
  * Build the resource string for an action.
  * Format: action/{selected_api}/{action_type}/{action_key}
  */
-declare function buildActionResource(context: ActionRunContext): string;
+declare function buildActionResource(parts: ActionResourceParts): string;
 /**
- * Build a broad action resource that matches all actions for an app.
- * Format: action/{selected_api}/{wildcard}/{wildcard}
+ * Build a broad action resource that matches all actions of the same type
+ * for an app (e.g. all reads, all writes). Scopes on `action_type` to
+ * avoid silently granting cross-type access.
+ *
+ * Format: action/{selected_api}/{action_type}/{wildcard}
  */
-declare function buildBroadActionResource(context: ActionRunContext): string;
+declare function buildBroadActionResource(parts: Pick<ActionResourceParts, "selected_api" | "action_type">): string;
 
 /**
  * Build an exact-match policy from any supported request context.
@@ -195,13 +299,35 @@ declare const AccessLevelSchema: z.ZodEnum<{
     read_write: "read_write";
 }>;
 type AccessLevel = z.infer<typeof AccessLevelSchema>;
+/** HTTP methods that count as side-effect-free reads for connection-level policies. */
+declare const READ_HTTP_METHODS: readonly ["GET", "HEAD", "OPTIONS"];
+/**
+ * Action types that count as side-effect-free reads for connection-level
+ * policies. `read_bulk` is the paginated/bulk variant of `read` — same
+ * external API semantics, no mutations. Widely used by major apps (Slack,
+ * Gmail, Jira, Salesforce, etc.) via the public `bulkReads` schema key.
+ * `filter` and `run` are excluded: neither has a runtime executor for
+ * external apps, and `filter` actions don't carry a connection_id anyway,
+ * so this allowlist has no effect on them.
+ */
+declare const READ_ACTION_TYPES: readonly ["read", "read_bulk", "search"];
+/**
+ * Returns true when the request needs write access (i.e. it is NOT a
+ * side-effect-free read). Mirrors the logic encoded in `buildConnectionPolicy`
+ * so UI surfaces that gate the read-vs-read_write choice stay consistent
+ * with the policies they generate.
+ */
+declare function isWriteRequest(context: RequestContext): boolean;
 /**
  * Build a connection-level policy that covers both HTTP and action access.
  *
  * Always produces three statements:
  * 1. `can_use` for the authentication
  * 2. `can_execute` on `http` scoped by connection_id (+ method filter for read)
- * 3. `can_execute` on `action/{selectedApi}/**` scoped by connection_id (+ action_type filter for read)
+ * 3. `can_execute` on `action/{selectedApi}/{action_type}/*` per allowed type,
+ *    scoped by connection_id. For read access, the resource list expands to
+ *    one entry per read action_type so the engine matches via the resource
+ *    string rather than a separate `path: ["action_type"]` condition.
  */
 declare function buildConnectionPolicy(options: {
     connectionId: string;
@@ -209,4 +335,4 @@ declare function buildConnectionPolicy(options: {
     accessLevel: AccessLevel;
 }): Policy;
 
-export { type AccessLevel, AccessLevelSchema, type ActionRunContext, ActionRunContextSchema, type BuildActionRunContextOptions, BuildActionRunContextOptionsSchema, type BuildHttpRequestContextOptions, BuildHttpRequestContextOptionsSchema, DEFAULT_PORTS, type HttpRequestContext, HttpRequestContextSchema, IGNORED_HEADERS, JsonValueSchema, type ParsedUrl, ParsedUrlSchema, type RequestContext, RequestContextSchema, buildActionResource, buildActionRunContext, buildBroadActionResource, buildConnectionPolicy, buildDomainHttpConditions, buildExactActionConditions, buildExactHttpConditions, buildHttpRequestContext, buildUrlString, parseUrl, toExactPolicy };
+export { type AccessLevel, AccessLevelSchema, type ActionRunContext, ActionRunContextSchema, type ActionType, ActionTypeSchema, type BuildActionRunContextOptions, BuildActionRunContextOptionsSchema, type BuildHttpRequestContextOptions, BuildHttpRequestContextOptionsSchema, DEFAULT_PORTS, type HttpRequestContext, HttpRequestContextSchema, IGNORED_HEADERS, type ParsedUrl, ParsedUrlSchema, READ_ACTION_TYPES, READ_HTTP_METHODS, type RequestContext, RequestContextSchema, buildActionResource, buildActionRunContext, buildBroadActionResource, buildConnectionPolicy, buildDomainHttpConditions, buildExactActionConditions, buildExactHttpConditions, buildHttpRequestContext, buildUrlString, isWriteRequest, parseActionResource, parseUrl, toExactPolicy };